@north-light/crouter 0.3.173 → 0.3.175

package/dist/daemon/api/map.js

@@ -10,13 +10,15 @@
 // reasonable projections; this module is what makes them concrete, so any DTO
 // field that projection proves wrong is corrected here at the source.
 import { ReviewOperationError as ReviewOperationErrorClass } from '../../core/review/types.js';
-import { contextDir, inboxPath, nodeDir, nodeMetaPath, reportsDir, transcriptPath, viewSocketPath, } from '../../core/canvas/paths.js';
+import { contextDir, inboxPath, nodeDir, nodeMetaPath, reportsDir, reviewResultPath, transcriptPath, viewSocketPath, } from '../../core/canvas/paths.js';
 import { FinalizationError } from '../../core/feed/feed.js';
 import { NodeIdConflictError } from '../../core/runtime/nodes.js';
 import { readContextTokens } from '../../core/canvas/telemetry.js';
 import { CrtrError } from '../../core/errors.js';
 import { ExitCode } from '../../types.js';
 import { sinkDisplay } from '../cron-sink.js';
+import { responsePath } from '../../core/human/convention.js';
+import { ticketDir } from '../../core/human/root.js';
 // ---------------------------------------------------------------------------
 // Node projections
 // ---------------------------------------------------------------------------
@@ -37,6 +39,10 @@ export function toNodeSummaryDTO(row) {
         intent: row.intent,
         waiting_for: row.waiting_for,
         pi_pid: row.pi_pid,
+        pi_pid_identity: row.pi_pid_identity,
+        window: row.window,
+        tmux_session: row.tmux_session,
+        pane: row.pane,
         final_report: row.final_report ?? null,
         finalized_at: row.finalized_at ?? null,
     };
@@ -99,6 +105,10 @@ export function toNodeDetailDTO(meta, edges) {
         intent: (meta.intent ?? null),
         waiting_for: meta.waiting_for ?? null,
         pi_pid: meta.pi_pid ?? null,
+        pi_pid_identity: meta.pi_pid_identity ?? null,
+        window: meta.window ?? null,
+        tmux_session: meta.tmux_session ?? null,
+        pane: meta.pane ?? null,
         final_report: meta.final_report ?? null,
         finalized_at: meta.finalized_at ?? null,
         edges: toNodeEdgesDTO(meta, edges),
@@ -111,7 +121,6 @@ export function toNodeDetailDTO(meta, edges) {
     if (meta.cycles !== undefined)
         dto.cycles = meta.cycles;
     dto.context_tokens = readContextTokens(meta.node_id);
-    dto.pi_pid_identity = meta.pi_pid_identity ?? null;
     if (meta.pi_session_id !== undefined)
         dto.pi_session_id = meta.pi_session_id ?? null;
     dto.model_override = meta.model_override ?? null;
@@ -375,7 +384,6 @@ export const REVIEW_ERROR_MAP = Object.freeze({
     source_unreadable: { status: 409, code: 'review_source_unreadable' },
     delivery_unroutable: { status: 409, code: 'review_delivery_unroutable' },
     unknown_review: { status: 404, code: 'unknown_review' },
-    review_not_open: { status: 409, code: 'review_not_open' },
     review_terminal: { status: 409, code: 'review_terminal_conflict' },
     review_required: { status: 400, code: 'review_required' },
     stale_document: { status: 409, code: 'stale_document' },
@@ -454,9 +462,22 @@ function reviewErrorDetails(err) {
     const { review, ...detail } = err.detail;
     return {
         ...detail,
-        review: toReviewDTO(review),
+        review: terminalConflictReviewDTO(review),
     };
 }
+function terminalConflictReviewDTO(review) {
+    if (review.state !== 'approved')
+        return toReviewDTO(review);
+    const result_path = review.origin_kind === 'inline'
+        ? reviewResultPath(review.review_id)
+        : responsePath(ticketDir(requireBridgeNodeId(review)));
+    return toReviewDTO(review, { result_path });
+}
+function requireBridgeNodeId(review) {
+    if (review.bridge_node_id === null)
+        throw new Error(`approved ticket review lacks its bridge node: ${review.review_id}`);
+    return review.bridge_node_id;
+}
 function statusForExitCode(exitCode) {
     switch (exitCode) {
         case ExitCode.NOT_FOUND:

package/dist/daemon/api/router.js

@@ -7,10 +7,9 @@
 // on '/'; a `:name` segment captures into `params`. `handle(req, res)` resolves
 // the JSON body, dispatches to the matched handler, and wraps EVERY handler so a
 // thrown error becomes a JSON `ErrorBody` with the mapped status (map.ts §8) —
-// a handler throw NEVER crashes the daemon (the belt-and-suspenders 500 mirrors
-// `clients/web/server.ts`'s request-listener boundary).
+// a handler throw NEVER crashes the daemon.
 //
-// The WS attach upgrade (`GET /nodes/:id/attach` with `Upgrade: websocket`) is
+// The WS attach upgrade (`GET /v1/nodes/:id/attach` with `Upgrade: websocket`) is
 // NOT routed here — the server (A-9) owns the upgrade handshake and hands it to
 // `bridge.ts` (A-8). This router serves only non-upgrade HTTP requests.
 import { toErrorBody } from './map.js';

package/dist/daemon/api/server.js

@@ -10,12 +10,8 @@
 // Non-upgrade requests flow through the hand-rolled `Router` (A-6) loaded with
 // every handler route table (A-7). `GET /v1/nodes/:id/attach` upgrades are
 // handed to `handleAttachUpgrade` (A-8, the WS attach bridge with
-// attach-implies-revive); every OTHER upgrade path destroys the socket, and an
-// unhandled upgrade error destroys the socket — it NEVER throws (mirrors the web
-// server's belt-and-suspenders upgrade guard, `clients/web/server.ts`).
-//
-// The structural template is `clients/web/server.ts:566,708-747`: one
-// `createServer` + a manual `upgrade` handler routing only attach paths.
+// attach-implies-revive); every other upgrade path destroys the socket, and an
+// unhandled upgrade error destroys the socket without throwing.
 import { createServer } from 'node:http';
 import { chmodSync, existsSync, unlinkSync } from 'node:fs';
 import { apiSocketPath } from '../../core/canvas/paths.js';
@@ -23,6 +19,7 @@ import { emitEvent } from '../../core/events/emit.js';
 import { Router } from './router.js';
 import { handleAttachUpgrade } from './bridge.js';
 import { attachRoutes } from './handlers/attach.js';
+import { brokerOperationRoutes } from './handlers/broker-ops.js';
 import { canvasRoutes } from './handlers/canvas.js';
 import { daemonRoutes } from './handlers/daemon.js';
 import { fileRoutes } from './handlers/files.js';
@@ -48,6 +45,7 @@ function buildRouter() {
         .registerAll(healthRoutes)
         .registerAll(daemonRoutes)
         .registerAll(nodeRoutes)
+        .registerAll(brokerOperationRoutes)
         .registerAll(worktreeRoutes)
         .registerAll(messageRoutes)
         .registerAll(reportRoutes)
@@ -189,7 +187,7 @@ export function createApiServer(opts = {}) {
     };
     const bindErrorHandler = (server) => {
         // A bind failure or post-listen accept error must not be an unhandled
-        // 'error' that crashes the process — emit and carry on (web server's n9).
+        // 'error' that crashes the process — emit and carry on.
         server.on('error', (err) => {
             emitEvent({ event: 'api.server.failed', level: 'error', error: err });
         });

package/dist/daemon/cron-run.d.ts

@@ -21,6 +21,10 @@ export interface RunDueCronOptions {
  *  that merely runs a shell command or sends a message reads false and is
  *  never gated. */
 export declare function cronLaunchesNode(c: Cron): boolean;
+/** Mark a cancellation as originating from the live cron run it names. Only
+ * that exact process may finish after its row is removed, so an external cancel
+ * retains its normal process-group kill behavior. */
+export declare function markSelfCanceledCronRun(cronId: string, runId: string): boolean;
 /** Recover stale 'running' rows left by a PRIOR daemon instance: a pid that is
  *  not VERIFIABLY still the process this lease launched resets straight to
  *  idle; a confirmed-live process group past its own run_timeout_s is killed

package/dist/daemon/cron-run.js

@@ -124,6 +124,16 @@ export function cronLaunchesNode(c) {
     return NODE_LAUNCHING_COMMAND.test(c.command);
 }
 const liveRuns = new Map();
+/** Mark a cancellation as originating from the live cron run it names. Only
+ * that exact process may finish after its row is removed, so an external cancel
+ * retains its normal process-group kill behavior. */
+export function markSelfCanceledCronRun(cronId, runId) {
+    const live = liveRuns.get(cronId);
+    if (live === undefined || live.runId !== runId)
+        return false;
+    live.selfCanceled = true;
+    return true;
+}
 /** The cron's profile, re-validated at delivery time and returned in canonical
  *  id form when its manifest still resolves, else null (root fallback per spec). */
 function resolveLiveProfile(c) {
@@ -321,13 +331,16 @@ async function escalateFailure(c, ctx, deliveryFailure) {
 /** Apply the cron's output disposition to one settled run: hash bookkeeping,
  *  sink delivery, and the failure path. `outOfBand` runs deliver but never
  *  pause/escalate — the invoker sees the result directly. */
-async function disposeSettledRun(c, ctx, outOfBand) {
+async function disposeSettledRun(c, ctx, outOfBand, selfCanceled = false) {
     const prefix = outOfBand ? 'out-of-band: ' : '';
-    // Re-read the row: last_output_hash/state must be current, and a cron
-    // canceled mid-run must not deliver (its record no-ops anyway).
+    // Re-read the row: last_output_hash/state must be current. An external
+    // cancellation suppresses delivery as before. A cancellation made by this
+    // exact run is different: the process has already produced its output and
+    // the documented self-cancel pattern must deliver that final observation.
     const fresh = getCron(c.cron_id);
-    if (fresh === null)
+    if (fresh === null && !selfCanceled)
         return { delivered: `${prefix}cron canceled mid-run — nothing delivered`, paused: false };
+    const effective = fresh ?? c;
     const failed = ctx.timedOut || ctx.processErrorMessage !== null || ctx.exitCode !== 0;
     // on-change bookkeeping happens for every SCHEDULED settled run (delivered or
     // not, failed or not) so the next comparison is against the latest
@@ -335,19 +348,21 @@ async function disposeSettledRun(c, ctx, outOfBand) {
     // verification, and a baseline it rewrote would make the next scheduled run
     // report "unchanged" and skip a delivery the user should have received.
     let changed = true;
-    if (fresh.on_output === 'on-change') {
-        changed = fresh.last_output_hash !== ctx.stdoutSha256;
-        if (!outOfBand)
+    if (effective.on_output === 'on-change') {
+        changed = effective.last_output_hash !== ctx.stdoutSha256;
+        // The row is intentionally gone after an in-run self-cancel, so there is
+        // no baseline to persist. It cannot fire again to need one.
+        if (!outOfBand && fresh !== null)
             setCronLastOutputHash(c.cron_id, ctx.stdoutSha256);
     }
     if (failed) {
-        if (fresh.on_output === 'silent')
+        if (effective.on_output === 'silent')
             return { delivered: `${prefix}silent`, paused: false };
         if (outOfBand)
             return { delivered: `out-of-band: ${failureSummary(ctx, null)} — not escalated`, paused: false };
-        return { delivered: await escalateFailure(fresh, ctx, null), paused: true };
+        return { delivered: await escalateFailure(effective, ctx, null), paused: true };
     }
-    switch (fresh.on_output) {
+    switch (effective.on_output) {
         case 'silent':
             return { delivered: `${prefix}silent`, paused: false };
         case 'on-failure':
@@ -355,9 +370,9 @@ async function disposeSettledRun(c, ctx, outOfBand) {
         case 'on-change':
             if (!changed)
                 return { delivered: `${prefix}unchanged — not delivered (on-change)`, paused: false };
-            return deliverOrEscalate(fresh, ctx, outOfBand, prefix);
+            return deliverOrEscalate(effective, ctx, outOfBand, prefix);
         case 'always':
-            return deliverOrEscalate(fresh, ctx, outOfBand, prefix);
+            return deliverOrEscalate(effective, ctx, outOfBand, prefix);
     }
 }
 /** The shared delivering tail of `always` and a CHANGED `on-change`: push
@@ -694,6 +709,7 @@ export function executeCron(c, opts) {
             const stderrHead = stderr.decode();
             const live = liveRuns.get(c.cron_id);
             const wasReplaced = live !== undefined && live.runId === runId && live.replaced;
+            const wasSelfCanceled = live !== undefined && live.runId === runId && live.selfCanceled;
             if (live !== undefined && live.runId === runId)
                 liveRuns.delete(c.cron_id);
             void (async () => {
@@ -722,7 +738,7 @@ export function executeCron(c, opts) {
                         stdoutHead,
                         stdoutSha256: stdoutHash.digest('hex'),
                         stderrHead,
-                    }, outOfBand);
+                    }, outOfBand, wasSelfCanceled);
                     delivered = disposition.delivered;
                     paused = disposition.paused;
                 }
@@ -766,6 +782,7 @@ export function executeCron(c, opts) {
         liveRuns.set(c.cron_id, {
             runId,
             replaced: false,
+            selfCanceled: false,
             kill: () => {
                 if (child.pid != null)
                     killWithEscalation(child.pid);

package/dist/daemon/crtrd.d.ts

@@ -1,14 +1,5 @@
-import { type NodeRow } from '../core/canvas/index.js';
-import { FAULT_QUIET_MS } from '../core/runtime/fault.js';
-export { readPidfile, isDaemonRunning } from './pidfile.js';
-export { FAULT_QUIET_MS };
-import { isPidAlive } from '../core/canvas/pid.js';
-import { DaemonFleet, retryResumeMode } from './fleet.js';
-export { retryResumeMode };
-export declare function brokerThresholdsForDaemon(): {
-    warning: number;
-    automaticReviveCap: number;
-};
+import { type DetachedWorkLifecycle } from './reconcilers/broker-supervision.js';
+import { DaemonFleet } from './fleet.js';
 export declare function brokerCommandDeclaresCanvasHome(command: string, home: string): boolean;
 /** The `--epoch <id>` tag host.ts stamps into every broker's argv, or null
  *  for a legacy/untagged broker (which the census treats as prior-epoch). */
@@ -22,53 +13,7 @@ export declare function brokerCommandEpoch(command: string): string | null;
  *  no-op. Capacity-gated: past the automatic-revive cap the sweep stops — the
  *  tick's pass-2 inbox wakes own the remainder as capacity frees up. */
 export declare function runStartupRecoverySweep(fleet: DaemonFleet): Promise<void>;
-export declare const YIELD_STALL_GRACE_MS: number;
-/** Refresh-stall decision (§H refresh-authority; audit 2026-06-09, Bug 1 — node
- *  mq5v9hfa-74493d45 and siblings; stuck-refresh — parent mq7s5o93): a `node
- *  yield` / refresh records intent='refresh' and relies on the in-process
- *  stophook to call shutdown at stop, but the engine can be left ALIVE — either
- *  it HANGS instead of exiting (very large contexts) or a STALE stophook (pi
- *  extensions never reload) ignores intent='refresh' entirely and never calls
- *  shutdown. Either way: engine alive, turn over, intent pending forever. The
- *  daemon only revives DEAD engines, so without this verdict the node is
- *  permanently stuck (no revive, no wake). Pure core, mirroring wedgeVerdict;
- *  the kill side effects live in handleYieldStall.
- *
- *  'kill' ONLY when ALL of: engine alive, intent='refresh', the turn is over
- *  (busy marker absent — a node may legitimately keep working for many minutes
- *  after running `node yield` mid-turn, and a working engine must never be
- *  killed), and the state has persisted past YIELD_STALL_GRACE_MS. */
-export declare function yieldStallVerdict(piPidAlive: boolean | null, intent: NodeRow['intent'], busy: boolean, stalledFor: number | null): 'leave' | 'pending' | 'kill';
-export declare const WEDGE_QUIET_MS: number;
-export declare const WEDGE_CPU_MAX_PERCENT = 2;
-export type WedgeVerdict = 'leave' | 'pending' | 'wedged';
-/** Pure wedge decision — mirrors yieldStallVerdict: a total
- *  function of the observed signals, no clock or process access of its own.
- *  `busy` false — the turn already ended (however it routed) — is never a
- *  wedge, regardless of how stale the marker looks. `quietForMs` null means
- *  the heartbeat marker couldn't be read (treated as “not enough evidence”, not
- *  “wedged”). `cpuPercent` null (sample failed/unavailable) or above the
- *  ceiling — EITHER keeps the verdict at 'pending' (keep watching next tick)
- *  rather than firing on an unconfirmed or contradicted signal. */
-export declare function wedgeVerdict(input: {
-    busy: boolean;
-    quietForMs: number | null;
-    cpuPercent: number | null;
-}): WedgeVerdict;
-export declare function sumTreeCpu(psOutput: string, rootPid: number): number | null;
-/** Pure (issue #119): does `rootPid` have ANY descendant in this ps snapshot
- *  — a runaway subprocess to kill — or does the broker stand ALONE in its own
- *  tree (nothing to kill; the engine itself stalled)? Shares `parsePsTree`
- *  with `sumTreeCpu` so the two facts the wedge remediation needs come from
- *  one `ps` sample. Null when `rootPid` isn't in the sample at all (can't
- *  tell — same "unknown, never treated as a fact" stance `sumTreeCpu` takes on
- *  a missing root). Exported for direct unit testing. */
-export declare function treeHasDescendants(psOutput: string, rootPid: number): boolean | null;
-export declare const DEAD_REAP_GRACE_MS: number;
-export { isPidAlive };
-interface DaemonTickLifecycle {
-    acceptsDetachedWork(): boolean;
-    registerDetached(work: Promise<void>): void;
+interface DaemonTickLifecycle extends DetachedWorkLifecycle {
 }
 /** Supervision tick over the daemon's current live set. */
 export declare function superviseTick(now?: number, lifecycle?: DaemonTickLifecycle): Promise<void>;