@north-light/crouter 0.3.183 → 0.3.185

package/dist/core/canvas/nav-model.js

@@ -15,74 +15,45 @@ import { activeFaultForDisplay } from './render.js';
 import { readFault } from '../runtime/fault.js';
 import { faultSummary } from './status-glyph.js';
 import { statusRank } from './node-order.js';
-import { beginFrameTelem, nodeGlyph, navLabel, shortId, tokensCell, activityCell, cycleBadge, askBadge, liveBelowBadge, truncate, fillBar, fillWidth, isAttached, BOLD, DIM, RESET, REVERSE, BG_ATTACHED, } from './nav-render.js';
+import { nodeGlyph, navLabel, shortId, tokensCell, activityCell, cycleBadge, askBadge, liveBelowBadge, truncate, fillBar, fillWidth, isAttached, BOLD, DIM, RESET, REVERSE, BG_ATTACHED, } from './nav-render.js';
 // Re-export the pure render/telemetry half so existing nav-model importers
 // (chrome/canvas-panels, overlays/graph, resume) keep resolving these here.
 export { PI_MAX_WIDGET_LINES, VIEWPORT_FALLBACK_ROWS, ESC, RESET, BOLD, DIM, REVERSE, BG_ATTACHED, GREEN, RED, YELLOW, CYAN, GRAY, nodeGlyph, visibleWidth, truncate, fillWidth, fillBar, readTelemetry, fmtTokens, tokensCell, activityCell, cycleBadge, navLabel, shortId, askBadge, liveBelowBadge, isAttached, hasBrokerViewers, fetchAsksMap, graphWidgetBudget, GRAPH_HINT, } from './nav-render.js';
 // ---------------------------------------------------------------------------
-// Per-frame read cache
+// Read primitives — UNCACHED, deliberately
 //
-// One render fans the SAME handful of nodes out 5-10× each: computeSubtreeActivity
-// walks the whole tree (getNode + subscriptions per node), buildGraphModel walks it
-// again (climbRoot, sortedChildIds), then every visible row re-reads getNode +
-// telemetry + subscriptions for its badges. getNode alone is an fs.readFileSync of
-// meta.json plus a sqlite row read, and readTelemetry another readFileSync — so on a
-// modest graph a single 'j' keystroke fanned out to DOZENS of redundant disk reads.
-// That redundancy is the GRAPH view's open/scroll lag.
+// These once memoized into module-global Maps that a `beginFrame()` cleared at
+// the top of each TUI render. That cache is gone. Nothing in this module is
+// frame-scoped any more: the GRAPH overlay reads the canvas through crtrd's
+// remote CanvasSource (clients/attach/overlays/graph.ts) and never imports this
+// file, while the one live consumer left — crtrd's `GET /v1/nodes?under=` via
+// `subtreeIds` — is a daemon that runs for HOURS between restarts.
 //
-// Each render is a synchronous snapshot, so we memoize the read primitives for the
-// duration of one frame and clear at the top of render(): the next keystroke (or the
-// ask-poll / inbox render) re-reads fresh, so a killed node, a new spawn, or a status
-// flip all surface on the very next frame. Nothing here writes, so a stale entry can
-// at worst be one frame old — and render() always reruns immediately after any action.
-// The telemetry cache lives in nav-render (readTelemetry); beginFrame clears it too.
+// A process-lifetime memo there is not "at worst one frame stale", it is
+// permanent: the first `?under=X` request that lands before X has spawned any
+// children pinned `[]` under X and every later request returned it. Correctness
+// on the daemon outranks a render amortization no caller asks for, so each read
+// goes straight to the canvas db. The only frame cache still in play is
+// nav-render's telemetry memo, whose TUI callers clear it themselves via
+// `beginFrameTelem()`.
 // ---------------------------------------------------------------------------
-const frameNodes = new Map();
-const frameSubs = new Map();
-const frameMgrs = new Map();
-export function beginFrame() {
-    frameNodes.clear();
-    frameSubs.clear();
-    frameMgrs.clear();
-    beginFrameTelem();
-}
-/** getNode memoized for the current frame (meta.json read + sqlite row). */
-export function cNode(id) {
-    if (frameNodes.has(id))
-        return frameNodes.get(id) ?? null;
-    const v = getNode(id);
-    frameNodes.set(id, v);
-    return v;
-}
-/** subscriptionsOf (a node's reports) memoized for the current frame. */
-export function cSubscriptions(id) {
-    const hit = frameSubs.get(id);
-    if (hit !== undefined)
-        return hit;
-    let v;
+/** subscriptionsOf (a node's reports); an unreadable row reads as no edges. */
+function subsOf(id) {
     try {
-        v = subscriptionsOf(id);
+        return subscriptionsOf(id);
     }
     catch {
-        v = [];
+        return [];
     }
-    frameSubs.set(id, v);
-    return v;
 }
-/** subscribersOf (a node's managers) memoized for the current frame. */
-export function cSubscribers(id) {
-    const hit = frameMgrs.get(id);
-    if (hit !== undefined)
-        return hit;
-    let v;
+/** subscribersOf (a node's managers); an unreadable row reads as no edges. */
+function mgrsOf(id) {
     try {
-        v = subscribersOf(id);
+        return subscribersOf(id);
     }
     catch {
-        v = [];
+        return [];
     }
-    frameMgrs.set(id, v);
-    return v;
 }
 // ---------------------------------------------------------------------------
 // Attachment — is a human currently WATCHING a node? A separate axis from
@@ -100,7 +71,7 @@ export function cSubscribers(id) {
 // ---------------------------------------------------------------------------
 /** First manager (by created) — the UP step for the ancestry spine. */
 export function managerOf(id) {
-    return cSubscribers(id)[0]?.node_id;
+    return mgrsOf(id)[0]?.node_id;
 }
 /** A kind:'human' node is a control-plane ASK (a deck on the human's
  *  screen), NOT a pi conversation — it has no session, so focusing/reviving it
@@ -110,17 +81,17 @@ export function managerOf(id) {
  *  own. Drop it from every navigable list (the tree, BASE reports, child counts,
  *  subtree expansion) so it can never be selected. */
 export function isHumanAsk(id) {
-    return cNode(id)?.kind === 'human';
+    return getNode(id)?.kind === 'human';
 }
 /** A node's direct children that are navigable conversations — human-ask nodes
  *  dropped. The one place the nav chrome enumerates children. */
 export function convoChildIds(id) {
-    return cSubscriptions(id).map((s) => s.node_id).filter((cid) => !isHumanAsk(cid));
+    return subsOf(id).map((s) => s.node_id).filter((cid) => !isHumanAsk(cid));
 }
 /** Live reports (active|idle) of a node — the DOWN set in BASE. */
 export function liveReports(id) {
     return convoChildIds(id).filter((cid) => {
-        const st = cNode(cid)?.status;
+        const st = getNode(cid)?.status;
         return st === 'active' || st === 'idle';
     });
 }
@@ -175,7 +146,7 @@ export function childBadge(node) {
  *  the tree and when stepping into a subtree (`l`). Array.sort is stable, so
  *  equal-status siblings keep their creation order. */
 export function sortedChildIds(id) {
-    return convoChildIds(id).sort((a, b) => statusRank(cNode(a)?.status) - statusRank(cNode(b)?.status));
+    return convoChildIds(id).sort((a, b) => statusRank(getNode(a)?.status) - statusRank(getNode(b)?.status));
 }
 // ---------------------------------------------------------------------------
 // GRAPH model — flatten the local graph fold-aware. Rebuilt every render (cheap
@@ -189,7 +160,7 @@ export function computeSubtreeActivity(root, self) {
     // Returns the count of active nodes in subtree(id) INCLUDING id, and whether
     // that subtree is worth revealing (holds an active node or self).
     const visit = (id) => {
-        const selfActive = cNode(id)?.status === 'active';
+        const selfActive = getNode(id)?.status === 'active';
         if (seen.has(id))
             return { active: selfActive ? 1 : 0, reveal: selfActive || id === self };
         seen.add(id);
@@ -254,7 +225,7 @@ export function renderGraphRow(r, isCursor, focused, activeBelow, asks) {
         const line = `${r.branch}  ${DIM}↺ ${shortId(r.id)}${RESET}`;
         return wrap(line, false);
     }
-    const node = cNode(r.id);
+    const node = getNode(r.id);
     const dot = nodeGlyph(node);
     const rawName = navLabel(node, r.id);
     const name = r.isSelf ? `${BOLD}${rawName}${RESET}` : rawName;

package/dist/core/canvas/nav-render.d.ts

@@ -50,8 +50,8 @@ export declare function fillWidth(): number;
  *  bar; the visible width is padded out to `width`; the line closes with a real
  *  RESET so the style never bleeds into the editor below. */
 export declare function fillBar(content: string, width: number, open: string): string;
-/** Clear the per-frame telemetry cache. Called from nav-model's beginFrame so
- *  the graph half and the render half share one frame boundary. */
+/** Clear the per-frame telemetry cache. Every render pass calls this first, so
+ *  one keystroke re-reads each node's telemetry exactly once. */
 export declare function beginFrameTelem(): void;
 export interface Telemetry {
     /** Live context-window size (pi's getContextUsage) — the figure pi's own footer

package/dist/core/canvas/nav-render.js

@@ -130,14 +130,16 @@ export function fillBar(content, width, open) {
     return `${open}${reasserted}${' '.repeat(pad)}${RESET}`;
 }
 // ---------------------------------------------------------------------------
-// Per-frame telemetry cache. Cleared at the top of each render pass (nav-model's
-// beginFrame calls beginFrameTelem) so token/activity cells read fresh once per
-// frame instead of once per row. Nothing here writes, so a stale entry can at
-// worst be one frame old.
+// Per-frame telemetry cache. Its callers are TUI render passes ONLY (the GRAPH
+// overlay and the canvas panels), each of which calls beginFrameTelem() at the
+// top of the pass, so token/activity cells read fresh once per frame instead of
+// once per row and a stale entry can at worst be one frame old. Never memoize a
+// canvas read for a caller that is not a render pass: crtrd lives for hours, and
+// a memo it never clears is permanent, not per-frame.
 // ---------------------------------------------------------------------------
 const frameTelem = new Map();
-/** Clear the per-frame telemetry cache. Called from nav-model's beginFrame so
- *  the graph half and the render half share one frame boundary. */
+/** Clear the per-frame telemetry cache. Every render pass calls this first, so
+ *  one keystroke re-reads each node's telemetry exactly once. */
 export function beginFrameTelem() {
     frameTelem.clear();
 }

package/dist/core/command-manifests/registry.d.ts

@@ -4,7 +4,13 @@ import type { DeclLeafBase, DeclBranch, CommandManifestIssue } from './schema.js
 export type CommandContributorRef = {
     name: string;
     scope: 'user' | 'project';
+    sourceMarketplace?: string;
 };
+/** The stable source name used to qualify a colliding plugin command. */
+export declare function commandContributorOrigin(contributor: Pick<CommandContributorRef, 'name' | 'sourceMarketplace'>): string;
+/** The top-level name assigned to a plugin command that collides with another
+ * plugin command. */
+export declare function qualifiedTopLevelCommandName(contributor: Pick<CommandContributorRef, 'name' | 'sourceMarketplace'>, commandName: string): string;
 /** Adapter callback to turn a declared leaf into a crtr LeafDef. Takes the
  *  leaf definition and its resolved command path, returns the outputKind and
  *  run function to be used by the tree composer. */
@@ -34,7 +40,8 @@ export interface CommandRegistrySnapshot {
     issues: ContributorIssue[];
 }
 /** Resolve a flat list of candidate contributions into a collision-resolved
- *  snapshot. Every contribution at a collided path is dropped (all claimants),
- *  an issue is recorded on each claimant, core names take precedence, and
- *  results are deterministically ordered by contributor name. */
+ *  snapshot. Plugin claimants at a collided path are qualified by origin and
+ *  kept; core names take precedence and are dropped. An issue is recorded on
+ *  every claimant, and results are deterministically ordered by contributor
+ *  name. */
 export declare function resolveCommandRegistry(candidates: readonly CommandContribution[], reservedCoreNames: ReadonlySet<string>): CommandRegistrySnapshot;

package/dist/core/command-manifests/registry.js

@@ -2,26 +2,35 @@
 // contributor attribution. This module takes raw candidates (from plugins,
 // HTTP-transport plugins, or any external source) and runs one unified pass that:
 //
-// 1. Detects collisions by resolved path (shortest collision wins).
-// 2. Drops all claimants at each collided path.
-// 3. Records issues on every claimant at each collision.
-// 4. Gives core absolute precedence.
+// 1. Detects top-level collisions between plugins.
+// 2. Keeps every plugin claimant by mounting it at <origin>:<command>.
+// 3. Records an informational issue on every qualified claimant.
+// 4. Gives core absolute precedence and drops core-name claimants.
 // 5. Returns a deterministically ordered, collision-resolved snapshot.
 //
 // The registry itself is transport-neutral: it knows nothing about plugin
 // executables or HTTP invokers. Each contribution carries its own adapter
 // callback, which the tree composer invokes to turn a leaf into a real crtr
 // LeafDef.
+/** The stable source name used to qualify a colliding plugin command. */
+export function commandContributorOrigin(contributor) {
+    return contributor.sourceMarketplace ?? contributor.name;
+}
+/** The top-level name assigned to a plugin command that collides with another
+ * plugin command. */
+export function qualifiedTopLevelCommandName(contributor, commandName) {
+    return `${commandContributorOrigin(contributor)}:${commandName}`;
+}
 /** Resolve a flat list of candidate contributions into a collision-resolved
- *  snapshot. Every contribution at a collided path is dropped (all claimants),
- *  an issue is recorded on each claimant, core names take precedence, and
- *  results are deterministically ordered by contributor name. */
+ *  snapshot. Plugin claimants at a collided path are qualified by origin and
+ *  kept; core names take precedence and are dropped. An issue is recorded on
+ *  every claimant, and results are deterministically ordered by contributor
+ *  name. */
 export function resolveCommandRegistry(candidates, reservedCoreNames) {
     const collisions = new Map();
     const contributionsByPath = new Map();
-    // Phase 1: Detect collisions. Collect every top-level path (and implicitly,
-    // every ancestor path that the top-level node reaches), detect duplicates.
-    // A collision drops ALL claimants at that path.
+    // Phase 1: Detect collisions. A core collision drops the plugin claimant;
+    // a cross-plugin collision qualifies every claimant in phase 2.
     for (const contrib of candidates) {
         const { node, contributor } = contrib;
         const path = [node.name];
@@ -54,8 +63,8 @@ export function resolveCommandRegistry(candidates, reservedCoreNames) {
             contributionsByPath.set(pathKey, contrib);
         }
     }
-    // Phase 2: Build the final snapshot. Include only non-collided contributions
-    // and record issues on all collided claimants.
+    // Phase 2: Build the final snapshot. Core collisions are dropped; plugin
+    // collisions keep every claimant under its origin-qualified command name.
     const accepted = [];
     const issues = [];
     for (const contrib of candidates) {
@@ -63,11 +72,11 @@ export function resolveCommandRegistry(candidates, reservedCoreNames) {
         if (collisions.has(pathKey)) {
             const collision = collisions.get(pathKey);
             const claimantNames = collision.claimants.map((c) => c.contributor.name).join(', ');
-            const claimantKinds = collision.claimants.map((c) => c.contributor.name).join(', ');
-            // Record an issue on this claimant. A core collision has exactly one
-            // claimant contesting a reserved built-in name, not "multiple contributors".
-            issues.push(collision.isCoreCollision
-                ? {
+            // A core collision has exactly one claimant contesting a reserved
+            // built-in name. Plugin collisions are informative: every claimant is
+            // retained under the source-qualified name reported here.
+            if (collision.isCoreCollision) {
+                issues.push({
                     code: 'command_collision',
                     contributor: contrib.contributor,
                     path: contrib.node.name,
@@ -75,16 +84,21 @@ export function resolveCommandRegistry(candidates, reservedCoreNames) {
                     received: claimantNames,
                     expected: 'no top-level command name matching a reserved core command',
                     next: `Rename "${contrib.node.name}" to a name that does not collide with core.`,
-                }
-                : {
+                });
+            }
+            else {
+                const qualifiedName = qualifiedTopLevelCommandName(contrib.contributor, contrib.node.name);
+                accepted.push({ ...contrib, node: { ...contrib.node, name: qualifiedName } });
+                issues.push({
                     code: 'command_collision',
                     contributor: contrib.contributor,
                     path: contrib.node.name,
-                    message: `top-level command "${contrib.node.name}" is claimed by multiple contributors: ${claimantKinds}`,
+                    message: `top-level command "${contrib.node.name}" is claimed by ${claimantNames} — mounted as "${qualifiedName}"`,
                     received: claimantNames,
-                    expected: 'exactly one contributor per top-level command',
-                    next: `Remove or disable all but one of: ${claimantNames}.`,
+                    expected: 'an origin-qualified top-level command for each claimant',
+                    next: `Invoke "${qualifiedName}" to use this plugin command.`,
                 });
+            }
         }
         else {
             // Not collided — accept it.

package/dist/core/command-plugins/compose.js

@@ -4,7 +4,7 @@ import { invokeHttpLeaf } from './transport/http-invoke.js';
 export function adaptPluginContributions(contributions) {
     return {
         contributions: contributions.map((contribution) => ({
-            contributor: { name: contribution.plugin.name, scope: contribution.plugin.scope },
+            contributor: { name: contribution.plugin.name, scope: contribution.plugin.scope, sourceMarketplace: contribution.plugin.sourceMarketplace },
             node: contribution.node,
             adaptLeaf: (leaf, commandPath) => {
                 const transport = contribution.transport;

package/dist/core/command-plugins/discovery.js

@@ -3,7 +3,7 @@ import { resolve, sep } from 'node:path';
 import { listInstalledPlugins, listInstalledPluginsInRoot } from '../resolver.js';
 import { projectScopeRoots } from '../scope.js';
 import { validateCommandManifest } from '../command-manifests/manifest.js';
-import { resolveCommandRegistry } from '../command-manifests/registry.js';
+import { qualifiedTopLevelCommandName, resolveCommandRegistry } from '../command-manifests/registry.js';
 import { adaptPluginContributions } from './compose.js';
 import { validateHttpPluginTransport } from './endpoint.js';
 export function effectiveCommandPlugins(startDir = process.cwd(), profileId) {
@@ -139,18 +139,26 @@ export function validateEffectiveCommandPlugins(reservedNames, startDir = proces
     const validations = effectiveCommandPlugins(startDir, profileId).map((plugin) => validatePluginCommands(plugin, reservedNames, coreCommandPaths));
     const claims = new Map();
     for (const validation of validations)
-        for (const contribution of validation.contributions)
-            (claims.get(contribution.node.name) ?? (claims.set(contribution.node.name, []), claims.get(contribution.node.name))).push(validation);
+        for (const contribution of validation.contributions) {
+            const claimants = claims.get(contribution.node.name);
+            if (claimants === undefined)
+                claims.set(contribution.node.name, [contribution]);
+            else
+                claimants.push(contribution);
+        }
     for (const [name, claimants] of claims)
         if (claimants.length > 1)
-            for (const validation of claimants) {
-                validation.contributions = validation.contributions.filter((contribution) => contribution.node.name !== name);
-                validation.issues.push({ code: 'command_collision', plugin: validation.plugin.name, path: name, message: `top-level command "${name}" is claimed by multiple plugins`, received: claimants.map((claimant) => claimant.plugin.name).join(', '), expected: 'exactly one plugin per top-level command name', next: 'Disable or remove all but one claimant.' });
+            for (const claimant of claimants) {
+                const { plugin } = claimant;
+                const qualifiedName = qualifiedTopLevelCommandName({ name: plugin.name, sourceMarketplace: plugin.sourceMarketplace }, name);
+                const validation = validations.find((candidate) => candidate.plugin.root === plugin.root);
+                validation.contributions = validation.contributions.map((contribution) => contribution === claimant ? { ...contribution, node: { ...contribution.node, name: qualifiedName } } : contribution);
+                validation.issues.push({ code: 'command_collision', plugin: plugin.name, path: name, message: `top-level command "${name}" is claimed by ${claimants.map((entry) => entry.plugin.name).join(', ')} — mounted as "${qualifiedName}"`, received: claimants.map((entry) => entry.plugin.name).join(', '), expected: 'an origin-qualified top-level command for each claimant', next: `Invoke "${qualifiedName}" to use this plugin command.` });
             }
     return validations;
 }
 function contributorIssue(plugin, issue) {
-    return { ...issue, contributor: { name: plugin.name, scope: plugin.scope } };
+    return { ...issue, contributor: { name: plugin.name, scope: plugin.scope, sourceMarketplace: plugin.sourceMarketplace } };
 }
 export function discoverCommandContributions(reservedNames, startDir = process.cwd(), profileId) {
     const validations = validateEffectiveCommandPlugins(reservedNames, startDir, profileId);

package/dist/core/keybindings/catalog.d.ts

@@ -1,6 +1,6 @@
 import type { BindingDefinition, SafetyRequirement } from './types.js';
 import type { AttachBindingId, AttachMenuBindingId } from './attach-control.js';
-type TmuxMenuAction = 'open' | 'attach' | 'show' | 'view-settings' | 'fold-tools' | 'metadata' | 'promote' | 'resume' | 'fork' | 'demote' | 'detach' | 'close-subtree' | 'background-bash' | 'file-review' | 'pin' | 'reload-viewer' | 'recap' | 'context' | 'providers' | 'graph' | 'focus-manager' | 'copy-id' | 'issues';
+type TmuxMenuAction = 'open' | 'attach' | 'show' | 'view-settings' | 'fold-tools' | 'metadata' | 'promote' | 'resume' | 'fork' | 'demote' | 'detach' | 'close-subtree' | 'background-bash' | 'file-review' | 'pin' | 'reload-viewer' | 'recap' | 'context' | 'providers' | 'plugins' | 'graph' | 'focus-manager' | 'copy-id' | 'issues';
 type TmuxMenuEntryAction = Exclude<TmuxMenuAction, 'open' | 'attach'> | `issue.${'idea' | 'bug'}`;
 type GraphAction = 'down' | 'up' | 'first' | 'last' | 'collapse-or-manager' | 'expand-or-child' | 'focus' | 'revive' | 'focus-manager' | 'close-subtree' | 'dismiss';
 type BrowseAction = 'quit' | 'down' | 'up' | 'first' | 'last' | 'expand-or-child' | 'collapse-or-parent' | 'toggle-fold' | 'tab-next' | 'tab-previous' | `tab.${1 | 2 | 3 | 4 | 5}` | 'close-subtree' | 'confirm-close' | 'sort' | 'scope' | 'profile' | 'residents' | 'preview' | 'search' | 'revive-now' | 'focus' | 'focus-background';

package/dist/core/keybindings/catalog.js

@@ -53,6 +53,7 @@ export const BINDING_CATALOG = Object.freeze([
     ...menuEntry('metadata', 'Show metadata', 'Show the focused node’s metadata dossier.', ['m'], ['tmux.menu.show']),
     ...menuEntry('context', 'Browse context', 'Browse the focused node context.', ['c'], ['tmux.menu.show']),
     ...menuEntry('providers', 'Open settings', 'Open the crouter settings panel.', [','], ['tmux.menu']),
+    ...menuEntry('plugins', 'Browse plugins', 'Open the crouter plugin browser.', ['k'], ['tmux.menu']),
     ...menuEntry('graph', 'Canvas graph', 'Open the canvas graph.', ['g'], ['tmux.menu']),
     ...menuEntry('focus-manager', 'Go to manager', 'Focus this node’s manager.', ['h'], ['tmux.menu']),
     ...menuEntry('copy-id', 'Copy node id', 'Copy the focused node id to the system clipboard.', ['y'], ['tmux.menu']),

package/dist/core/resolver.d.ts

@@ -8,7 +8,7 @@ export interface ParsedSkillQualifier {
     segments: string[];
 }
 export declare function parseSkillQualifier(raw: string): ParsedSkillQualifier;
-export declare function listInstalledMarketplaces(scope: Scope): InstalledMarketplace[];
+export declare function listInstalledMarketplaces(scope: Exclude<Scope, 'builtin'>): InstalledMarketplace[];
 export declare function listAllMarketplaces(): InstalledMarketplace[];
-export declare function findMarketplaceByName(name: string, scope?: Scope): InstalledMarketplace | null;
+export declare function findMarketplaceByName(name: string, scope?: Exclude<Scope, 'builtin'>): InstalledMarketplace | null;
 export declare function scopeRootsLabel(): string;

package/dist/core/runtime/tmux-bindings.js

@@ -33,6 +33,7 @@ const LEAF_MENU_ACTIONS = {
     // The settings page lays out a grouped rail beside a content panel; the
     // default dialog-sized popup clipped both the rail and the models matrix.
     'crtr.tmux.menu.providers': { description: 'settings', action: { kind: 'popup', run: 'sys settings', size: { w: '90%', h: '85%' } } },
+    'crtr.tmux.menu.plugins': { description: 'plugins', action: { kind: 'popup', run: 'pkg browse', size: { w: '90%', h: '85%' } } },
     'crtr.tmux.menu.graph': { description: 'canvas graph', action: { kind: 'keys', keys: '/graph' } },
     'crtr.tmux.menu.focus-manager': { description: 'go to manager', action: { kind: 'command', run: 'surface node focus {manager}' } },
     'crtr.tmux.menu.copy-id': { description: 'copy node id', action: { kind: 'command', run: 'surface node id --pane {pane}' } },
@@ -301,6 +302,7 @@ function menuItems(bindings, entries) {
     ]));
     addGroup('System', boundItems([
         'crtr.tmux.menu.providers',
+        'crtr.tmux.menu.plugins',
         'crtr.tmux.menu.issues',
     ]));
     const prefixGestures = bindings.gestures('crtr.tmux.menu.open');

package/dist/core/tui/page-host.d.ts

@@ -0,0 +1,25 @@
+import { ProcessTerminal, TUI, type Component, type Focusable } from "@earendil-works/pi-tui";
+import { readRawScopeConfig } from "../config.js";
+import { type BindingId, type BindingResolution } from "../keybindings/index.js";
+/** A full-screen page: a focusable TUI component that cleans up after itself. */
+export type TuiPageSurface = Component & Focusable & {
+    dispose(): void;
+};
+export interface TuiPageContext {
+    tui: TUI;
+    terminal: ProcessTerminal;
+    bindings: BindingResolution<BindingId>;
+    rawUserConfig: ReturnType<typeof readRawScopeConfig>;
+}
+export interface TuiPageControl<Result> {
+    /** Close the page with a result. */
+    submit(result: Result): void;
+    /** Close the page with no result. */
+    cancel(): void;
+}
+/** Mount one page as the TUI's only child and resolve when it closes.
+ *
+ *  `interceptCancel` is a process-level escape hatch for surfaces that must be
+ *  abandonable while a nested component holds the keyboard; it runs before the
+ *  page sees the input and closes the page when it returns true. */
+export declare function runTuiPage<Result>(createSurface: (context: TuiPageContext, control: TuiPageControl<Result>) => TuiPageSurface, interceptCancel?: (data: string, bindings: BindingResolution<BindingId>) => boolean): Promise<Result | undefined>;

package/dist/core/tui/page-host.js

@@ -0,0 +1,65 @@
+// The process-level terminal host for crouter's full-screen TUI pages —
+// `crtr sys settings`, the setup wizard, and `crtr pkg browse`.
+//
+// It owns exactly the concerns every page shares: theme, resolved keybindings,
+// the raw user config those pages edit, the ProcessTerminal/TUI pair, and a
+// restore path that survives an exception, a signal, and process exit. Anything
+// a single page needs beyond that — pi's model runtime, a canvas client — the
+// page's own runner builds and closes over before calling in here.
+import { ProcessTerminal, TUI, } from "@earendil-works/pi-tui";
+import { applyTheme } from "../../clients/attach/config.js";
+import { readRawScopeConfig } from "../config.js";
+import { resolveKeybindings, } from "../keybindings/index.js";
+/** Mount one page as the TUI's only child and resolve when it closes.
+ *
+ *  `interceptCancel` is a process-level escape hatch for surfaces that must be
+ *  abandonable while a nested component holds the keyboard; it runs before the
+ *  page sees the input and closes the page when it returns true. */
+export async function runTuiPage(createSurface, interceptCancel) {
+    applyTheme({ cwd: process.cwd() });
+    const rawUserConfig = readRawScopeConfig("user");
+    const bindings = resolveKeybindings(rawUserConfig?.keybindings);
+    const terminal = new ProcessTerminal();
+    const tui = new TUI(terminal, true);
+    return new Promise((resolve, reject) => {
+        let surface;
+        let restored = false;
+        const restore = () => {
+            if (restored)
+                return;
+            restored = true;
+            surface?.dispose();
+            try {
+                tui.stop();
+            }
+            catch {
+                /* terminal restore */
+            }
+        };
+        const finish = (result) => {
+            restore();
+            resolve(result);
+        };
+        try {
+            surface = createSurface({ tui, terminal, bindings, rawUserConfig }, { submit: finish, cancel: () => finish(undefined) });
+            tui.addChild(surface);
+            tui.setFocus(surface);
+            process.once("exit", restore);
+            for (const signal of ["SIGTERM", "SIGHUP", "SIGINT"])
+                process.once(signal, () => finish(undefined));
+            if (interceptCancel !== undefined) {
+                tui.addInputListener((data) => {
+                    if (!interceptCancel(data, bindings))
+                        return undefined;
+                    finish(undefined);
+                    return { consume: true };
+                });
+            }
+            tui.start();
+        }
+        catch (error) {
+            restore();
+            reject(error);
+        }
+    });
+}

package/dist/daemon/__tests__/subtree-filter-freshness.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/daemon/__tests__/subtree-filter-freshness.test.js

@@ -0,0 +1,63 @@
+// Regression: crtrd served a PERMANENTLY stale `GET /v1/nodes?under=<id>`.
+//
+// `handleList`'s subtree scope came from nav-model's `subtreeIds`, whose reads
+// memoized into module-global Maps that only a `beginFrame()` cleared — and
+// `beginFrame()` had no call sites anywhere. In a TUI that re-renders, a memo is
+// one frame stale; in crtrd, which lives for hours, it is forever. The first
+// `?under=X` request that arrived BEFORE X had spawned children pinned `[]`
+// under X, and every later request returned that `[]` — Northlight's onboarding
+// progress bar sat at 0/100 for the life of the daemon while the unfiltered list
+// showed all 23 children with correct parents.
+//
+// This drives the real route handler against a real canvas db in exactly that
+// order: list the subtree while it is genuinely empty, THEN spawn children, then
+// list again. Nothing here would have failed with a hand-checked subtree walk —
+// only the request-order sequence catches it.
+import { test, before, after, beforeEach } from 'node:test';
+import assert from 'node:assert/strict';
+import { mkdtempSync, rmSync } from 'node:fs';
+import { tmpdir } from 'node:os';
+import { join } from 'node:path';
+import { createNode, subscribe } from '../../core/canvas/canvas.js';
+import { closeDb } from '../../core/canvas/db.js';
+import { nodeRoutes } from '../api/handlers/nodes.js';
+let home;
+function node(id, parent) {
+    return {
+        node_id: id, name: id, created: new Date().toISOString(), cwd: '/tmp/work',
+        kind: 'general', mode: 'base', lifecycle: 'terminal', status: 'active',
+        ...(parent !== undefined ? { parent } : {}),
+    };
+}
+/** GET /v1/nodes?under=<id> through the registered route, as crtrd serves it. */
+async function listUnder(id) {
+    const route = nodeRoutes.find((r) => r.method === 'GET' && r.pattern === '/v1/nodes');
+    const ctx = {
+        method: 'GET', path: '/v1/nodes', params: {},
+        query: new URLSearchParams({ under: id }), body: undefined,
+    };
+    const res = (await route.handler(ctx));
+    assert.equal(res.status, 200);
+    return res.body.map((r) => r.node_id);
+}
+before(() => { home = mkdtempSync(join(tmpdir(), 'crtr-subtree-')); process.env['CRTR_HOME'] = home; });
+beforeEach(() => { closeDb(); rmSync(home, { recursive: true, force: true }); });
+after(() => { closeDb(); rmSync(home, { recursive: true, force: true }); delete process.env['CRTR_HOME']; });
+test('a subtree query answered before any child exists does not poison later queries on the same daemon process', async () => {
+    const coordinator = 'coordinator';
+    createNode(node(coordinator));
+    // The poisoning request: the gateway polls within a second of the coordinator
+    // being created, before it has spawned anything.
+    assert.deepEqual(await listUnder(coordinator), [], 'an empty subtree is genuinely empty');
+    // The coordinator now spawns its children (parent subscribes_to child).
+    createNode(node('research-gmail', coordinator));
+    createNode(node('research-misc', coordinator));
+    subscribe(coordinator, 'research-gmail');
+    subscribe(coordinator, 'research-misc');
+    assert.deepEqual((await listUnder(coordinator)).sort(), ['research-gmail', 'research-misc'], 'the same long-lived process must see children spawned after its first subtree query');
+    // A grandchild spawned later still surfaces — the walk is re-read at every
+    // level, not just the root's direct edges.
+    createNode(node('writer-connectivity', 'research-gmail'));
+    subscribe('research-gmail', 'writer-connectivity');
+    assert.deepEqual((await listUnder(coordinator)).sort(), ['research-gmail', 'research-misc', 'writer-connectivity'], 'a grandchild spawned after an earlier query surfaces too');
+});