@north-light/crouter 0.3.176 → 0.3.177

package/dist/core/runtime/revive-all.d.ts

@@ -13,18 +13,18 @@ export declare const TERMINAL_BY_CHOICE: readonly NodeStatus[];
  *  inbox watcher's own hold-and-flush) ever brings such a node back on its
  *  own — only an explicit revive/reopen does. Shared by `isDisconnected`
  *  (mass-revive scope, below) and `node message send --tier deferred`'s terminal-edge
- *  rejection (gh #341) — a deferred entry appended to such a target would
+ *  rejection — a deferred entry appended to such a target would
  *  never be delivered, so that doorway rejects instead of silently holding
  *  it forever. */
 export declare function hasNoNaturalCycle(meta: Pick<NodeMeta, 'status' | 'final_report'>): boolean;
 /** True when `meta`'s engine is NOT running but it has a resumable saved session
- *  — the precise "disconnected" predicate (gh #9).
+ *  — the precise "disconnected" predicate.
  *
  *  - engine not running: no live `pi_pid` (a dead/absent broker pid).
  *  - reconnectable: a captured pi session marker (`pi_session_file` or
  *    `pi_session_id`) — without one there is nothing to reopen. reviveNode
  *    resumes by the `.jsonl` path when it still exists, else relaunches fresh (a
- *    bare `pi_session_id` alone no longer resumes — the broker preflight rejects
+ *    bare `pi_session_id` alone does not resume — the broker preflight rejects
  *    it — so such a node comes back fresh).
  *  - `human`-kind rows are the `crtr human` bridge, never a pi engine, so they
  *    are never "disconnected" (mirrors the daemon's superviseTick carve-out).

package/dist/core/runtime/revive-all.js

@@ -1,4 +1,4 @@
-// revive-all — resume EVERY disconnected node in one shot (gh issue #9).
+// revive-all — resume EVERY disconnected node in one shot.
 //
 // After a mass-disconnect event (a reboot, a killed login/tmux session, a mass
 // crash, or the daemon being down a while) many nodes end up with their
@@ -30,20 +30,20 @@ export const TERMINAL_BY_CHOICE = ['done', 'canceled'];
  *  inbox watcher's own hold-and-flush) ever brings such a node back on its
  *  own — only an explicit revive/reopen does. Shared by `isDisconnected`
  *  (mass-revive scope, below) and `node message send --tier deferred`'s terminal-edge
- *  rejection (gh #341) — a deferred entry appended to such a target would
+ *  rejection — a deferred entry appended to such a target would
  *  never be delivered, so that doorway rejects instead of silently holding
  *  it forever. */
 export function hasNoNaturalCycle(meta) {
     return meta.final_report != null || TERMINAL_BY_CHOICE.includes(meta.status);
 }
 /** True when `meta`'s engine is NOT running but it has a resumable saved session
- *  — the precise "disconnected" predicate (gh #9).
+ *  — the precise "disconnected" predicate.
  *
  *  - engine not running: no live `pi_pid` (a dead/absent broker pid).
  *  - reconnectable: a captured pi session marker (`pi_session_file` or
  *    `pi_session_id`) — without one there is nothing to reopen. reviveNode
  *    resumes by the `.jsonl` path when it still exists, else relaunches fresh (a
- *    bare `pi_session_id` alone no longer resumes — the broker preflight rejects
+ *    bare `pi_session_id` alone does not resume — the broker preflight rejects
  *    it — so such a node comes back fresh).
  *  - `human`-kind rows are the `crtr human` bridge, never a pi engine, so they
  *    are never "disconnected" (mirrors the daemon's superviseTick carve-out).
@@ -78,8 +78,8 @@ export function listDisconnected() {
         // IDENTITY-aware AND requires CONFIRMED alive: a bare isPidAlive would
         // misread a recycled pi_pid as "engine running" and SKIP the node, so it
         // never reaches reviveNode's own identity-aware double-launch guard
-        // (Round 2 of the pid-reuse-liveness fix, fold-in Major). `dead` OR
-        // `indeterminate` both count as disconnected/eligible here — only a
+        // guard. `dead` OR `indeterminate` both count as disconnected/eligible
+        // here — only a
         // positively confirmed-alive read is treated as "still connected".
         if (meta !== null && isDisconnected(meta, (pid) => recordedPidLiveness(pid, meta.pi_pid_identity) === 'alive'))
             out.push(meta);

package/dist/core/runtime/revive.js

@@ -100,7 +100,7 @@ export function reviveNode(nodeId, opts) {
     }
     // Fresh durable snapshot immediately before the lifecycle guard.
     meta = getNode(nodeId) ?? meta;
-    // #339/#340: refuse to revive a LATCHED node — the reopen gate at every
+    // Refuse to revive a LATCHED node — the reopen gate at every
     // legitimate caller (node message send, node lifecycle revive) already checked this
     // before calling in, but a target can finalize in the gap between that
     // check and this call. This authoritative snapshot closes that race;

package/dist/core/runtime/spawn.d.ts

@@ -109,8 +109,7 @@ export interface SpawnChildResult {
  *  (explicit `--parent` or the calling node's CRTR_NODE_ID). A --root spawn
  *  does not: it is top-level by definition and the spawner identity is
  *  provenance only — a human shell with no CRTR_NODE_ID is a legitimate root
- *  spawner (regression: `crtr node new --root` from outside a node used to
- *  throw here). */
+ *  spawner, so `crtr node new --root` from outside a node must not throw. */
 export declare function resolveSpawner(parent: string | undefined, ctxNodeId: string | null, root: boolean): string | null;
 /** Spawn a node from a live node. By default a managed terminal worker in a
  *  background window, with the spawner auto-subscribed (active) via spawnNode.

package/dist/core/runtime/spawn.js

@@ -187,8 +187,7 @@ export async function assertLaunchModelRegistered(request, options, registry) {
  *  (explicit `--parent` or the calling node's CRTR_NODE_ID). A --root spawn
  *  does not: it is top-level by definition and the spawner identity is
  *  provenance only — a human shell with no CRTR_NODE_ID is a legitimate root
- *  spawner (regression: `crtr node new --root` from outside a node used to
- *  throw here). */
+ *  spawner, so `crtr node new --root` from outside a node must not throw. */
 export function resolveSpawner(parent, ctxNodeId, root) {
     const spawner = parent ?? ctxNodeId ?? null;
     if (!root && spawner === null) {
@@ -218,7 +217,7 @@ export async function spawnChildPrepared(opts, beforeBrokerLaunch) {
     const attendedRoot = root && lifecycle === 'resident';
     // Born WITHOUT a name — the canvas-goal-capture extension names it async from
     // its first message (the kickoff task) inside its own pi process, so spawn
-    // never blocks on the LLM naming round-trip (the 2-3s freeze it used to cost).
+    // never blocks on the LLM naming round-trip (a 2-3s freeze).
     const wantsWorktree = opts.worktree === true;
     const nodeId = wantsWorktree ? (opts.nodeId ?? newNodeId()) : opts.nodeId;
     // Preflight: resolve every fallible input BEFORE creating the worktree or the

package/dist/core/runtime/structured-output.js

@@ -3,15 +3,13 @@ import { dirname, resolve } from 'node:path';
 import { randomUUID } from 'node:crypto';
 import { nodeDir, contextDir } from '../canvas/paths.js';
 import { InputError } from '../io.js';
+import { isRecord } from '../../shared/predicates.js';
 export function outputSchemaPath(nodeId) {
     return `${nodeDir(nodeId)}/output-schema.json`;
 }
 export function outputResultPath(nodeId) {
     return `${contextDir(nodeId)}/result.json`;
 }
-function isObject(value) {
-    return value !== null && typeof value === 'object' && !Array.isArray(value);
-}
 export function parseOutputSchemaValue(value) {
     const raw = value?.trim();
     if (raw === undefined || raw === '')
@@ -49,7 +47,7 @@ export function parseOutputSchemaValue(value) {
             next: 'Pass valid JSON whose top-level value is an object.',
         });
     }
-    if (!isObject(parsed)) {
+    if (!isRecord(parsed)) {
         throw new InputError({
             error: 'bad_output_schema',
             message: `output schema from ${source} must be a JSON object`,
@@ -91,7 +89,7 @@ export function readOutputRequest(nodeId) {
     catch (err) {
         return { state: 'invalid', error: `request file is not valid JSON: ${err.message}` };
     }
-    if (!isObject(parsed)) {
+    if (!isRecord(parsed)) {
         return { state: 'invalid', error: 'request file top-level value must be an object' };
     }
     const mode = parsed['mode'];
@@ -99,7 +97,7 @@ export function readOutputRequest(nodeId) {
     if (mode !== 'terminal' && mode !== 'oneoff') {
         return { state: 'invalid', error: `mode must be 'terminal' or 'oneoff', got ${JSON.stringify(mode)}` };
     }
-    if (!isObject(schema)) {
+    if (!isRecord(schema)) {
         return { state: 'invalid', error: `schema must be an object, got ${typeof schema}` };
     }
     return { state: 'valid', request: { mode, schema } };

package/dist/core/runtime/tmux-driver.d.ts

@@ -1,6 +1,6 @@
 import { type AttachBindingId } from '../keybindings/index.js';
-/** POSIX single-quote escaping for one shell word. */
-export declare function shellQuote(s: string): string;
+import { shellQuote } from '../../shared/shell-quote.js';
+export { shellQuote };
 declare function tmux(args: string[]): {
     ok: boolean;
     stdout: string;

package/dist/core/runtime/tmux-driver.js

@@ -6,13 +6,11 @@
 import { execFile, spawnSync } from 'node:child_process';
 import { encodeAttachControlInput, } from '../keybindings/index.js';
 import { bundledPiCommandForShell } from './pi-cli.js';
+import { shellQuote } from '../../shared/shell-quote.js';
 // ---------------------------------------------------------------------------
-// Shell quoting + tmux invocation
+// tmux invocation
 // ---------------------------------------------------------------------------
-/** POSIX single-quote escaping for one shell word. */
-export function shellQuote(s) {
-    return `'${s.replace(/'/g, `'\\''`)}'`;
-}
+export { shellQuote };
 function tmux(args) {
     const r = spawnSync('tmux', args, { encoding: 'utf8' });
     return {

package/dist/core/runtime/tool-group-summary.js

@@ -49,9 +49,10 @@ const SUMMARY_SYSTEM_PROMPT = 'Create a structured recap of this coding-agent to
     'Omit inbox receipt, delivery, and queueing; node-response and report bookkeeping; help lookups; status checks; and summary-generation activity. ' +
     'A node response may support a substantive outcome, but its arrival or resummarization is never itself an outcome. ' +
     'If no meaningful outcome remains after those omissions, submit the single bullet "No meaningful changes." ' +
-    'Count nodes created and distinct files created, modified, or deleted only when evidenced by the supplied tool arguments or results; otherwise use zero, even when the corresponding mechanics are omitted from bullets. ' +
+    'Count nodes created, and separately count distinct files removed from disk, only when the supplied tool arguments or results evidence them; otherwise use zero, even when the corresponding mechanics are omitted from bullets. ' +
+    'A deleted file is one that no longer exists after the segment, never a file that was merely edited or overwritten, and a recursive or wildcard removal of an unknown number of files counts as one. ' +
     'Do not invent success when a result shows failure. ' +
-    'Call submit_summary exactly once with bullets, nodesSpawned, and filesEdited, then stop.';
+    'Call submit_summary exactly once with bullets, nodesSpawned, and filesDeleted, then stop.';
 const SUBMIT_SUMMARY_SCHEMA = Type.Object({
     bullets: Type.Array(Type.String({
         minLength: 1,
@@ -62,9 +63,9 @@ const SUBMIT_SUMMARY_SCHEMA = Type.Object({
         minimum: 0,
         description: 'Count of nodes created during the supplied segment, or zero when none are evidenced.',
     }),
-    filesEdited: Type.Integer({
+    filesDeleted: Type.Integer({
         minimum: 0,
-        description: 'Count of distinct files created, modified, or deleted during the supplied segment, or zero when none are evidenced.',
+        description: 'Count of distinct files removed from disk during the supplied segment, or zero when none are evidenced.',
     }),
 }, { additionalProperties: false });
 /** Generate a structured summary object, or null on every failure. */

package/dist/core/runtime/warm-pool.js

@@ -47,7 +47,7 @@
 // and at daemon start for the most recently used profiles, so the FIRST node
 // after sitting down is warm too.
 //
-// The pool no longer fans out per directory: a node runs in its profile's home
+// The pool does not fan out per directory: a node runs in its profile's home
 // (`resolveNodeCwd` in the create handler), so the cwd a spare freezes is a
 // function of its profile, and "which spare serves this create" is in practice
 // a question about the profile alone.

package/dist/core/scope.js

@@ -1,10 +1,11 @@
 import { homedir } from 'node:os';
-import { existsSync, statSync, realpathSync } from 'node:fs';
+import { existsSync, statSync } from 'node:fs';
 import { join, resolve, dirname } from 'node:path';
 import { CRTR_DIR_NAME } from '../types.js';
 import { assetRoot } from './asset-root.js';
 import { usage } from './errors.js';
 import { loadProfileManifest } from './profiles/manifest.js';
+import { realpathOrSelf } from './fs-utils.js';
 // Cache of resolved project-scope-root STACKS, keyed by (resolved cwd, profile
 // id). A profile widens the pointer set beyond the bare cwd (see
 // findProjectScopeRoots below), so the cache key must carry both — the same
@@ -31,14 +32,6 @@ export function builtinPiPackageDir(name) {
 export function userScopeRoot() {
     return join(homedir(), CRTR_DIR_NAME);
 }
-function realpathOrSelf(p) {
-    try {
-        return realpathSync(p);
-    }
-    catch {
-        return p;
-    }
-}
 function isProjectScopeDir(candidate, userRoot) {
     if (!existsSync(candidate))
         return false;

package/dist/core/self-update.js

@@ -1,6 +1,6 @@
-// Self-update and content-check primitives extracted from commands/update.ts.
-// Moved here to break the core→commands import inversion: auto-update.ts
-// (core) previously imported from commands/update.ts (commands layer).
+// Self-update and content-check primitives. They live in core/ so auto-update.ts
+// (core) reaches them without importing commands/update.ts, which would invert
+// the core→commands layering.
 import { spawnSync } from 'node:child_process';
 import { fileURLToPath } from 'node:url';
 import { join, dirname } from 'node:path';

package/dist/core/spawn.d.ts

@@ -13,4 +13,3 @@ export declare function isInTmux(): boolean;
  *  no server is running — the true "no tmux to surface into" case that should
  *  degrade to the inbox-drain follow-up. */
 export declare function tmuxServerReachable(): boolean;
-export declare function shellQuote(s: string): string;

package/dist/core/spawn.js

@@ -1,4 +1,4 @@
-// Tmux reachability + quoting helpers for the `human` command tree.
+// Tmux reachability for the `human` command tree.
 //
 // The human surface gates on whether the canvas tmux server is reachable
 // (tmuxServerReachable) so it can decide whether to surface a prompt or degrade
@@ -25,6 +25,3 @@ export function tmuxServerReachable() {
     const r = spawnSync('tmux', ['list-clients', '-F', '#{client_name}'], { encoding: 'utf8' });
     return r.status === 0;
 }
-export function shellQuote(s) {
-    return `'${s.replace(/'/g, "'\\''")}'`;
-}

package/dist/core/substrate/on-read.js

@@ -24,7 +24,6 @@
 // Every candidate renders at its own fileReadVisibility rung. Explicit routing
 // is the whole on-read model, so directory INDEX ceilings remain a boot-catalog
 // concern and do not cap a deliberately matched document.
-import { realpathSync } from 'node:fs';
 import { homedir } from 'node:os';
 import { basename, dirname, matchesGlob, parse, relative, sep } from 'node:path';
 import { CRTR_DIR_NAME } from '../../types.js';
@@ -37,15 +36,8 @@ import { displayName } from './ceiling.js';
 import { gatePasses } from './gate.js';
 import { normalizeDocName, parseSubstrateDoc, parseSubstrateFrontmatter, previewLine, resolveDocName } from './schema.js';
 import { cachedSubstrateDocs } from './session-cache.js';
+import { realpathOrSelf } from '../fs-utils.js';
 const JUNK_DIRS = new Set(['node_modules', '.git', 'dist', 'build', '.next', '.cache', '.yalc']);
-function realpathOrSelf(p) {
-    try {
-        return realpathSync(p);
-    }
-    catch {
-        return p;
-    }
-}
 function attr(s) {
     return s
         .replace(/&/g, '&')

package/dist/core/wake.js

@@ -3,8 +3,8 @@
 // This is the ONE place that owns cron time logic. Both the CLI surface and the
 // daemon's firing pass import from here, so there is no duplicated cron usage
 // and no surface<->daemon inverted dependency:
-//   - parseWhen / parseCadence  — arm-time grammar (surface, T7)
-//   - nextSlotAfter             — per-tick advance / coalescing (daemon, T4)
+//   - parseWhen / parseCadence  — arm-time grammar (surface)
+//   - nextSlotAfter             — per-tick advance / coalescing (daemon)
 //
 // Design refs: surface-design §4 (grammar), §5 (timezone/DST ruling),
 // design §5.3 + D7 (engine evaluates UTC; the surface bakes the IANA zone

package/dist/core/worktree.d.ts

@@ -95,11 +95,11 @@ export interface AutoDroppedWorktree {
  *  branch and the live checkout stay fully recoverable and the caller's
  *  `open_managed_worktree` guard fires. */
 export declare function autoDropCleanManagedWorktreeLocked(nodeId: string, wt: ManagedWorktree, proof: CleanEmptyProof): AutoDroppedWorktree | null;
-/** `push final`'s escape hatch (#327, #333): a managed worktree that has
+/** `push final`'s escape hatch: a managed worktree that has
  *  nothing to land is auto-dropped instead of blocking on an explicit
  *  `node worktree close` — one the caller may have been told NOT to run
- *  because a manager already landed the same change another way (#327), or
- *  that never had anything to close in the first place (#333, a read-only
+ *  because a manager already landed the same change another way, or
+ *  that never had anything to close in the first place (a read-only
  *  review node). Returns null and changes nothing when the worktree is not
  *  PROVABLY empty-and-clean by `proveCleanEmptyManagedWorktree`, OR when a
  *  concurrent mutation invalidates that proof before the destructive delete

package/dist/core/worktree.js

@@ -6,6 +6,7 @@ import { crtrHome } from './canvas/paths.js';
 import { getNode, updateNode } from './canvas/index.js';
 import { CONFIG_FILE, CRTR_DIR_NAME, STATE_FILE } from '../types.js';
 import { withExclusiveDirectoryLock } from './exclusive-lock.js';
+import { shellQuote } from '../shared/shell-quote.js';
 export class WorktreeError extends Error {
     code;
     next;
@@ -137,7 +138,7 @@ function rollbackManagedWorktreeLocked(wt, pathWasAbsent) {
 export function rollbackManagedWorktree(wt) {
     withRepositoryWorktreeLock(wt.repo_root, () => rollbackManagedWorktreeLocked(wt, false));
 }
-// Fix #330/#331: every crtr process auto-initializes a project scope's
+// Every crtr process auto-initializes a project scope's
 // `.crouter/config.json` (`ensureProjectScope` → `ensureScopeInitialized`)
 // the first time it runs against a project root that has no ancestor
 // `.crouter/` yet — which every fresh managed worktree checkout is, unless
@@ -357,9 +358,6 @@ let worktreeCleanupRunner = defaultWorktreeCleanupRunner;
 export function setWorktreeCleanupRunnerForTest(runner) {
     worktreeCleanupRunner = runner ?? defaultWorktreeCleanupRunner;
 }
-function shellQuote(value) {
-    return `'${value.replaceAll("'", "'\\''")}'`;
-}
 function isValidRegisteredCheckout(output, wt) {
     let path = null;
     let prunable = false;
@@ -607,11 +605,11 @@ export function autoDropCleanManagedWorktreeLocked(nodeId, wt, proof) {
         branch_deleted: true,
     };
 }
-/** `push final`'s escape hatch (#327, #333): a managed worktree that has
+/** `push final`'s escape hatch: a managed worktree that has
  *  nothing to land is auto-dropped instead of blocking on an explicit
  *  `node worktree close` — one the caller may have been told NOT to run
- *  because a manager already landed the same change another way (#327), or
- *  that never had anything to close in the first place (#333, a read-only
+ *  because a manager already landed the same change another way, or
+ *  that never had anything to close in the first place (a read-only
  *  review node). Returns null and changes nothing when the worktree is not
  *  PROVABLY empty-and-clean by `proveCleanEmptyManagedWorktree`, OR when a
  *  concurrent mutation invalidates that proof before the destructive delete

package/dist/daemon/api/bridge.js

@@ -49,7 +49,7 @@ function refuseUpgrade(socket, status, statusText, code, message) {
         `connection: close\r\n\r\n` +
         body;
     // `end(payload)` flushes the full body THEN sends FIN — a bare
-    // `write`+`destroy` can truncate the body for a slow remote peer (review M1).
+    // `write`+`destroy` can truncate the body for a slow remote peer.
     try {
         socket.end(payload);
     }

package/dist/daemon/api/handlers/broker-ops.js

@@ -254,8 +254,7 @@ function settleBroker(nodeId, request) {
         return node.intent === 'refresh' ? { action: 'shutdown' } : { action: 'stay_dormant' };
     }
     const signals = { pushedFinal: request.pushedFinal, askedHuman: request.askedHuman };
-    // These two current-state outcomes were previously duplicated around the
-    // stop guard. They are terminal broker consequences, not Pi decisions.
+    // Two current-state outcomes: terminal broker consequences, not Pi decisions.
     if (signals.pushedFinal || node.status === 'done') {
         clearFault(nodeId);
         if (focusOf(nodeId) !== null)

package/dist/daemon/api/handlers/messages.js

@@ -86,7 +86,7 @@ function parseSchema(raw) {
 function label(text) {
     return text.split('\n')[0].slice(0, 120);
 }
-/** The #341/#343 fail-loud rejection for a deferred immediate message aimed at a
+/** The fail-loud rejection for a deferred immediate message aimed at a
  *  target with no natural cycle ahead of it (done/canceled/finalized). Thrown as
  *  an InputError so `toErrorBody` round-trips the FULL structured payload
  *  (code+message+next) into `ApiError.details`, and the CLI's shared
@@ -207,7 +207,7 @@ async function handleMessage(ctx) {
             data: { situational: true, situationalOnly: true },
         });
     };
-    // #341/#343 deferred guard: a done/canceled/finalized target has no natural
+    // Deferred guard: a done/canceled/finalized target has no natural
     // cycle ahead of it, so a deferred entry would sit unseen forever — reject
     // fail-loud BEFORE any side effect, atomically with the append (the read and
     // the write share one canvas write-lock). Non-deferred tiers deliver directly.

package/dist/daemon/api/handlers/nodes.js

@@ -357,7 +357,7 @@ function handleRevive(ctx) {
     const body = ctx.body;
     const resume = body?.resume ?? true;
     const reopen = body?.reopen ?? false;
-    // #339 gate, enforced server-side (the latch clear is a canvas write the CLI
+    // Reopen gate, enforced server-side (the latch clear is a canvas write the CLI
     // caller cannot reach): --reopen CAS-clears a spent `final_report`; the
     // no-reopen path refuses a still-latched node (`node_finalized`). reviveNode
     // keeps its own belt-and-suspenders latch guard under the launch lock.

package/dist/daemon/api/handlers/reports.js

@@ -42,7 +42,7 @@ async function handlePush(ctx) {
     const before = req.tier === 'final' ? getNode(id)?.status : undefined;
     // `final` with an OPEN managed worktree, BEFORE the push/transition (spec
     // §6.2 — worktree fs ops are server-side). A provably-clean, zero-commit
-    // worktree is auto-dropped (#327/#333) so a read-only or already-landed node
+    // worktree is auto-dropped so a read-only or already-landed node
     // can finish without an explicit `node worktree close`; any real unlanded
     // work instead blocks with the parity `open_managed_worktree` error,
     // round-tripped via CrtrError.details so the CLI renders the same InputError

package/dist/daemon/api/handlers/validate.d.ts

@@ -1,4 +1,6 @@
+import { isRecord } from '../../../shared/predicates.js';
 import type { RequestContext } from '../router.js';
+export { isRecord };
 export type Violation = {
     field: string;
     problem: string;
@@ -7,7 +9,6 @@ export type Violation = {
 /** Reject the request with every violation collected so far. `subject` names
  *  what was being parsed, e.g. "review comment request". */
 export declare function invalidRequest(subject: string, violations: Violation[]): never;
-export declare function isRecord(value: unknown): value is Record<string, unknown>;
 /** Narrow a request body to an object and reject any field outside `allowed`.
  *  A non-object body yields `{}` so the caller's field reads all miss and
  *  report their own violations rather than throwing. */

package/dist/daemon/api/handlers/validate.js

@@ -4,14 +4,13 @@
 // `invalidRequest` once so a caller sees every problem with its body in a
 // single 400 rather than one per round trip.
 import { ApiError } from '../../../api/index.js';
+import { isRecord } from '../../../shared/predicates.js';
+export { isRecord };
 /** Reject the request with every violation collected so far. `subject` names
  *  what was being parsed, e.g. "review comment request". */
 export function invalidRequest(subject, violations) {
     throw new ApiError(400, 'invalid_request', `${subject} is invalid`, { violations });
 }
-export function isRecord(value) {
-    return typeof value === 'object' && value !== null && !Array.isArray(value);
-}
 /** Narrow a request body to an object and reject any field outside `allowed`.
  *  A non-object body yields `{}` so the caller's field reads all miss and
  *  report their own violations rather than throwing. */

package/dist/daemon/cron-run.js

@@ -377,8 +377,7 @@ async function disposeSettledRun(c, ctx, outOfBand, selfCanceled = false) {
 }
 /** The shared delivering tail of `always` and a CHANGED `on-change`: push
  *  stdout to the armed sink, or take the failure path when the sink is
- *  undeliverable. (The two cases used to share a commented, lint-suppressed
- *  switch fallthrough.) */
+ *  undeliverable. */
 async function deliverOrEscalate(c, ctx, outOfBand, prefix) {
     if (ctx.stdoutHead.trim() === '') {
         return { delivered: `${prefix}empty stdout — nothing delivered`, paused: false };
@@ -464,8 +463,9 @@ export function recoverStaleCronLeases(now, options = {}) {
 }
 /** Wait for a SIGTERMed stale-lease run to actually die, escalating to SIGKILL
  *  if it does not — the same bound `killWithEscalation` gives a live timeout.
- *  Recovery used to record the run as finished the instant it signaled, while a
- *  signal-trapping command was still running and still producing side effects. */
+ *  Recovery must not record the run as finished the instant it signals: a
+ *  signal-trapping command can still be running and still producing side
+ *  effects. */
 async function awaitLeasedRunDeath(c) {
     const deadline = Date.now() + CRON_KILL_GRACE_MS;
     while (Date.now() < deadline) {
@@ -477,7 +477,7 @@ async function awaitLeasedRunDeath(c) {
 }
 /** Settle a stale lease whose process can no longer be observed: the daemon
  *  life that owned this run ended (SIGKILL, host reboot) and nothing recorded
- *  the outcome. Releasing the lease — all this used to do — is wrong twice.
+ *  the outcome. Releasing the lease and nothing else is wrong twice.
  *
  *  1. The run must leave a RECORD. The run log's whole justification is "it
  *     silently stopped working Tuesday"; a hole exactly where the crash
@@ -799,8 +799,8 @@ export function executeCron(c, opts) {
             }
             catch (err) {
                 // Unparseable recurrence. This row can never be scheduled again as
-                // written — but DELETING it (what this used to do) destroys the user's
-                // config AND its whole run history with no record and no escalation, the
+                // written — but DELETING it would destroy the user's config AND its
+                // whole run history with no record and no escalation, the
                 // one outcome the spec has no vocabulary for. Take the failure path
                 // instead: kill the just-started run and hand `close` a process error, so
                 // the row PAUSES and an escalation node arrives holding the parse error.

package/dist/daemon/human/finish.js

@@ -3,7 +3,8 @@ import { ApiError } from '../../api/index.js';
 import { getNode, subscribersOf } from '../../core/canvas/canvas.js';
 import { ticketDir } from '../../core/human/root.js';
 import { cancelTicket, projectReviewOutput, readTicketResult, takeoverAndCompleteDeck, } from '../../core/human/tickets.js';
-import { readJson, responsePath } from '../../core/human/convention.js';
+import { responsePath } from '../../core/human/convention.js';
+import { readJsonOrNull } from '../../core/fs-utils.js';
 import { appendInbox } from '../../core/feed/inbox.js';
 import { FinalDeliveryError, pushFinal } from '../../core/feed/feed.js';
 import { transition } from '../../core/runtime/lifecycle.js';
@@ -67,7 +68,7 @@ export async function cancelHumanTicket(nodeId, opts) {
  */
 export async function deliverTerminalResult(nodeId) {
     const dir = ticketDir(nodeId);
-    const run = readJson(join(dir, 'run.json'));
+    const run = readJsonOrNull(join(dir, 'run.json'));
     if (run?.mode === 'notify')
         return false;
     const result = readTicketResult(dir);

package/dist/daemon/manage.d.ts

@@ -78,12 +78,12 @@ export declare function waitForDaemonExit(pid: number, timeoutMs?: number, deps?
 /** Stop the RECORDED daemon: SIGTERM, and if it does not exit within the wait
  *  window, escalate to SIGKILL exactly as `sweepStrayDaemons` does for a stray.
  *
- *  The escalation is the point. `stop` used to send SIGTERM, wait, and throw on
- *  timeout — before ever reaching the stray sweep — so the one daemon `stop` is
- *  actually aimed at was the only crtrd process exempt from the SIGKILL backstop.
- *  A daemon whose shutdown hung (or outran the window) then became permanently
- *  unstoppable from the CLI: every retry re-sent a SIGTERM it was already
- *  ignoring, and `start` kept refusing as "already running".
+ *  The escalation is the point. Without it — SIGTERM, wait, throw on timeout,
+ *  never reaching the stray sweep — the one daemon `stop` is actually aimed at
+ *  would be the only crtrd process exempt from the SIGKILL backstop, and a
+ *  daemon whose shutdown hangs (or outruns the window) becomes permanently
+ *  unstoppable from the CLI: every retry re-sends a SIGTERM it is already
+ *  ignoring, and `start` keeps refusing as "already running".
  *
  *  A SIGKILL'd daemon runs no exit handler, so it leaves its pidfile behind
  *  pointing at a dead pid. That is a stale record, not an owner: `readPidfile`

package/dist/daemon/manage.js

@@ -193,15 +193,14 @@ export function sweepStrayDaemons(keepPid) {
 // Daemon lifecycle transitions are bounded so callers never claim a state
 // change before the pidfile and process liveness agree.
 //
-// #508: a cold boot right after `install-runtime` (empty module cache, fresh
-// generation, possible pending db migration) can take several seconds to
-// reach writePidfile() — a fixed 5s window produced false "did not become
-// ready" failures on a daemon that was in fact starting up fine. Widened to
-// tolerate that slow-but-valid cold start; a process exit (signal/non-zero
-// code) still fails immediately regardless of this window.
+// A cold boot right after `install-runtime` (empty module cache, fresh
+// generation, possible pending db migration) can take several seconds to reach
+// writePidfile(), so the window is wide enough to tolerate that slow-but-valid
+// cold start rather than report a false "did not become ready"; a process exit
+// (signal/non-zero code) still fails immediately regardless of this window.
 // Exported so `commands/api-client.ts` can align the CLI-side `CrtrClient`'s
 // cold-start `/healthz` poll window with this authoritative valid-startup bound
-// (issue #508 follow-up) instead of the two windows drifting independently.
+// instead of the two windows drifting independently.
 export const DAEMON_VERIFY_WINDOW_MS = 20_000;
 const DAEMON_VERIFY_POLL_MS = 10;
 function sleepMs(ms) {
@@ -272,12 +271,12 @@ const DAEMON_KILL_WINDOW_MS = 2_000;
 /** Stop the RECORDED daemon: SIGTERM, and if it does not exit within the wait
  *  window, escalate to SIGKILL exactly as `sweepStrayDaemons` does for a stray.
  *
- *  The escalation is the point. `stop` used to send SIGTERM, wait, and throw on
- *  timeout — before ever reaching the stray sweep — so the one daemon `stop` is
- *  actually aimed at was the only crtrd process exempt from the SIGKILL backstop.
- *  A daemon whose shutdown hung (or outran the window) then became permanently
- *  unstoppable from the CLI: every retry re-sent a SIGTERM it was already
- *  ignoring, and `start` kept refusing as "already running".
+ *  The escalation is the point. Without it — SIGTERM, wait, throw on timeout,
+ *  never reaching the stray sweep — the one daemon `stop` is actually aimed at
+ *  would be the only crtrd process exempt from the SIGKILL backstop, and a
+ *  daemon whose shutdown hangs (or outruns the window) becomes permanently
+ *  unstoppable from the CLI: every retry re-sends a SIGTERM it is already
+ *  ignoring, and `start` keeps refusing as "already running".
  *
  *  A SIGKILL'd daemon runs no exit handler, so it leaves its pidfile behind
  *  pointing at a dead pid. That is a stale record, not an owner: `readPidfile`
@@ -332,8 +331,8 @@ export async function spawnDaemon() {
     // output the daemon doesn't control, plus the narrow set of authorized raw
     // `[crtrd] …` bootstrap/fatal lines that by construction predate or escape
     // canonical event emission (the pre-bind losing-claim line and a cleanup-
-    // fatal write in crtrd.ts): all used to go to /dev/null for any manually-
-    // started daemon, the common case (only a launchd-owned daemon had a
+    // fatal write in crtrd.ts). Without this fd all of it is discarded for any
+    // manually-started daemon, the common case (only a launchd-owned daemon has a
     // logging plist). Every other daemon diagnostic — including per-node
     // supervise/relaunch failures — is a canonical `emitEvent` write, not raw
     // stderr; this file is not where those live. Mirrors host.ts's broker.log
@@ -344,7 +343,7 @@ export async function spawnDaemon() {
         bindDaemonEventSource();
     // `--canvas-home` declares this daemon's canvas ownership in argv so
     // findDaemonPids()/sweepStrayDaemons (above) can match its own daemon
-    // exactly instead of scanning the whole machine (#518). crtrd-cli.ts's argv
+    // exactly instead of scanning the whole machine. crtrd-cli.ts's argv
     // parsing only looks for `--tcp`, so this extra pair of tokens is inert
     // there — it exists purely for `ps` visibility.
     const child = spawn(hostExecPath(), [...launchArgs, '--canvas-home', crtrHome()], {