@north-light/crouter 0.3.192 → 0.3.194

package/dist/core/__tests__/serial/human-deliver-e2e.test.js

@@ -4,16 +4,15 @@
 // delivery is daemon-owned; no subprocess handler or delivery receipt exists.
 import { test, before, beforeEach, afterEach, after } from 'node:test';
 import assert from 'node:assert/strict';
-import { mkdtempSync, existsSync, writeFileSync } from 'node:fs';
+import { mkdtempSync, rmSync, existsSync, writeFileSync } from 'node:fs';
 import { tmpdir } from 'node:os';
 import { join } from 'node:path';
 import { ApiError, CrtrClient } from '../../../api/index.js';
 import { createApiServer } from '../../../daemon/api/server.js';
 import { apiSocketPath } from '../../canvas/paths.js';
-import { validateDeck } from '../../human/deck-schema.js';
 import { claimTicket, readTicketClaim } from '../../human/claim.js';
 import { ticketDir } from '../../human/root.js';
-import { submitDeck, submitReview } from '../../human/tickets.js';
+import { submitPage, submitReview } from '../../human/tickets.js';
 import { spawnNode } from '../../runtime/nodes.js';
 import { getNode, closeDb } from '../../canvas/index.js';
 import { readInboxSince } from '../../feed/inbox.js';
@@ -63,6 +62,30 @@ async function expectBadResolve(nodeId, body) {
 async function expectReviewSubmitGuidance(nodeId, body) {
     await assert.rejects(() => client.request('POST', `/v1/human/tickets/${nodeId}/resolve`, body), (error) => error instanceof ApiError && error.status === 400 && error.code === 'invalid_request' && error.message.includes('POST /v1/human/reviews/:review_id/submit'));
 }
+/** Publish a one-text-slot page ticket into the bridge's ticket directory. */
+function submitBridgePage(bridge) {
+    const dir = ticketDir(bridge);
+    const sourceDir = mkdtempSync(join(tmpdir(), 'crtr-e2e-page-'));
+    const sourceFile = join(sourceDir, 'page.md');
+    writeFileSync(sourceFile, [
+        '---',
+        'title: Ship it?',
+        'subtitle: Decide whether to ship now so the release can proceed.',
+        '---',
+        '',
+        '```slot:text',
+        '{ "id": "question", "initialText": "", "editable": true }',
+        '```',
+        '',
+    ].join('\n'));
+    try {
+        submitPage({ dir, sourceFile, dialect: 'md' });
+    }
+    finally {
+        rmSync(sourceDir, { recursive: true, force: true });
+    }
+    return dir;
+}
 function reportBody(ref) {
     const resolved = resolveRef(ref);
     if (resolved === null || resolved.source !== 'report')
@@ -71,24 +94,17 @@ function reportBody(ref) {
 }
 test('malformed resolves leave the mounted ticket claim in place', async () => {
     const parent = spawnNode({ kind: 'general', parent: null, cwd: home, name: 'asker' }).node_id;
-    const deckBridge = spawnNode({ kind: 'human', parent, cwd: home, name: 'human-deck', lifecycle: 'terminal' }).node_id;
-    const deckDir = ticketDir(deckBridge);
-    submitDeck({
-        dir: deckDir,
-        deck: validateDeck({
-            title: 'Ship it?',
-            interactions: [{ id: 'question', title: 'Ship it?', subtitle: 'Decide whether to ship now so the release can proceed.', options: [], allowFreetext: true }],
-        }),
-    });
-    const deckClaim = claimTicket(deckDir);
-    assert.ok(deckClaim !== null);
-    for (const body of [{ responses: [null] }, { response: [] }, { responses: [], debug: true }]) {
-        await expectBadResolve(deckBridge, body);
-        assert.equal(readTicketClaim(deckDir)?.token, deckClaim.token, 'malformed deck input must not take over the live claim');
+    const pageBridge = spawnNode({ kind: 'human', parent, cwd: home, name: 'human-page', lifecycle: 'terminal' }).node_id;
+    const pageDir = submitBridgePage(pageBridge);
+    const pageClaim = claimTicket(pageDir);
+    assert.ok(pageClaim !== null);
+    for (const body of [{ responses: [] }, { response: {} }, { responses: {}, debug: true }]) {
+        await expectBadResolve(pageBridge, body);
+        assert.equal(readTicketClaim(pageDir)?.token, pageClaim.token, 'malformed page input must not take over the live claim');
     }
-    for (const body of [{ responses: [], feedback: {} }, { feedback: [] }]) {
-        await expectReviewSubmitGuidance(deckBridge, body);
-        assert.equal(readTicketClaim(deckDir)?.token, deckClaim.token, 'feedback-shaped input must not take over the live claim');
+    for (const body of [{ responses: {}, feedback: {} }, { feedback: [] }]) {
+        await expectReviewSubmitGuidance(pageBridge, body);
+        assert.equal(readTicketClaim(pageDir)?.token, pageClaim.token, 'feedback-shaped input must not take over the live claim');
     }
     const reviewBridge = spawnNode({ kind: 'human', parent, cwd: home, name: 'human-review', lifecycle: 'terminal' }).node_id;
     const reviewDir = ticketDir(reviewBridge);
@@ -97,22 +113,15 @@ test('malformed resolves leave the mounted ticket claim in place', async () => {
     submitReview({ dir: reviewDir, review: { title: 'Review', subtitle: 'Review this file so implementation can proceed safely.', source: {}, file } });
     const reviewClaim = claimTicket(reviewDir);
     assert.ok(reviewClaim !== null);
-    await expectReviewSubmitGuidance(reviewBridge, { responses: [] });
+    await expectReviewSubmitGuidance(reviewBridge, { responses: {} });
     assert.equal(readTicketClaim(reviewDir)?.token, reviewClaim.token, 'review ticket resolve must not take over the live claim');
 });
 test('the ticket resolve route pushFinals the readable answer to the parent', async () => {
     const parent = spawnNode({ kind: 'general', parent: null, cwd: home, name: 'asker' }).node_id;
     const bridge = spawnNode({ kind: 'human', parent, cwd: home, name: 'human-ask', lifecycle: 'terminal' }).node_id;
-    const dir = ticketDir(bridge);
-    submitDeck({
-        dir,
-        deck: validateDeck({
-            title: 'Ship it?',
-            interactions: [{ id: 'question', title: 'Ship it?', subtitle: 'Decide whether to ship now so the release can proceed.', options: [], allowFreetext: true }],
-        }),
-    });
-    const result = await client.resolveHumanTicket(bridge, { responses: [{ id: 'question', freetext: 'yes, ship' }] });
-    assert.deepEqual(result, { delivered: true, kind: 'deck' });
+    const dir = submitBridgePage(bridge);
+    const result = await client.resolveHumanTicket(bridge, { responses: { question: { text: 'yes, ship', edited: true, comments: [] } } });
+    assert.deepEqual(result, { delivered: true, kind: 'page' });
     assert.equal(getNode(bridge)?.status, 'done', 'bridge finalized by crtrd');
     const finals = readInboxSince(parent).filter((entry) => entry.from === bridge && entry.kind === 'final');
     assert.equal(finals.length, 1, 'exactly one pushFinal reached the parent');

package/dist/core/__tests__/serial/spawn-root.test.js

@@ -8,6 +8,7 @@ import { tmpdir } from 'node:os';
 import { join } from 'node:path';
 import { createServer } from 'node:net';
 import { spawn as spawnProcess } from 'node:child_process';
+import { findDaemonPids, stopDaemonProcess } from '../../../daemon/manage.js';
 import { createNode, getNode, getRow, subscribersOf } from '../../canvas/canvas.js';
 import { closeDb } from '../../canvas/db.js';
 import { nodeDir } from '../../canvas/paths.js';
@@ -40,8 +41,9 @@ beforeEach(() => {
     closeDb();
     rmSync(home, { recursive: true, force: true });
 });
-after(() => {
+after(async () => {
     closeDb();
+    await Promise.all(findDaemonPids().map((pid) => stopDaemonProcess(pid)));
     rmSync(home, { recursive: true, force: true });
 });
 test('managed child: parent on the spine + active subscription + provenance', () => {

package/dist/core/__tests__/spawn-worktree-id-conflict.test.js

@@ -18,6 +18,7 @@ import { closeDb } from '../canvas/db.js';
 import { spawnNode } from '../runtime/nodes.js';
 import { spawnChild } from '../runtime/spawn.js';
 import { managedWorktreePath } from '../worktree.js';
+import { findDaemonPids, stopDaemonProcess } from '../../daemon/manage.js';
 let home;
 let repoDir;
 function run(args, cwd) {
@@ -41,8 +42,9 @@ beforeEach(() => {
     rmSync(home, { recursive: true, force: true });
     process.env['CRTR_HOME'] = home;
 });
-after(() => {
+after(async () => {
     closeDb();
+    await Promise.all(findDaemonPids().map((pid) => stopDaemonProcess(pid)));
     rmSync(home, { recursive: true, force: true });
     rmSync(repoDir, { recursive: true, force: true });
 });

package/dist/core/auth-interaction.d.ts

@@ -1,4 +1,4 @@
-import type { AuthInteraction } from '@earendil-works/pi-ai';
+import type { ProviderAuthInteraction } from '@earendil-works/pi-ai';
 import type { LoginDialogComponent } from '@earendil-works/pi-coding-agent';
 export type DialogInteractionOptions = {
     /** Open the verification URL for `auth_url` / `device_code` events. */
@@ -16,4 +16,4 @@ export type DialogInteractionOptions = {
  * the dialog occupies crouter's single inline slot in both surfaces, so swapping in pi's
  * separate selector component (what pi's own interactive mode does) has nowhere to go.
  */
-export declare function dialogAuthInteraction(dialog: LoginDialogComponent, options?: DialogInteractionOptions): AuthInteraction;
+export declare function dialogAuthInteraction(dialog: LoginDialogComponent, options?: DialogInteractionOptions): ProviderAuthInteraction;

package/dist/core/bash-jobs.d.ts

@@ -12,12 +12,53 @@ export interface BashJobPaths {
      * Inspector's cancel) — without it on disk, only the agent's own handoff
      * notice knows the group to signal. */
     jobPgid: string;
+    /** Human-readable label supplied with the bash call, when any. */
+    jobPurpose: string;
 }
+/** A purpose is display text, never shell input. Keep the file-backed control
+ * plane to one bounded, visible line so old or hand-written job directories
+ * cannot inject control content into terminal or JSON presenters. */
+export declare function normalizeBashJobPurpose(value: unknown): string | null;
 export declare function bashJobsDir(contextDir: string): string;
+/** Whether a job id can safely be used as one path segment. Generated ids are
+ * numeric epoch prefixes plus a hex suffix; this broader safe alphabet keeps
+ * older file-backed ids readable without allowing path or request delimiters. */
+export declare function isSafeBashJobId(jobId: string): boolean;
 export declare function bashJobPaths(contextDir: string, jobId: string): BashJobPaths;
 /** The job's supervisor process group, or undefined for a job started before
  * pgid was persisted (or a partially-written dir). */
 export declare function readJobPgid(contextDir: string, jobId: string): number | undefined;
+/** The optional human-readable job label. Jobs created before labels existed
+ * have no file and deliberately project null. */
+export declare function readJobPurpose(contextDir: string, jobId: string): string | null;
+/** Whether a persisted job supervisor process group is still present. EPERM
+ *  means the group exists but cannot be signaled by this process; it is still
+ *  live for the status surface. */
+export declare function isBashJobProcessGroupAlive(pgid: number): boolean;
+export type StopBackgroundBashJobResult = {
+    kind: 'stopped';
+    signaled: boolean;
+    pgid: number;
+    logPath: string;
+} | {
+    kind: 'missing';
+} | {
+    kind: 'retired';
+    logPath: string;
+} | {
+    kind: 'not-stoppable';
+    logPath: string;
+};
+/** Stop one live background job using the same process-group and sentinel
+ *  semantics as `crtr node bash kill`. The caller owns the user-facing
+ *  notification; this primitive owns only the job control-plane mutation.
+ *
+ *  Only a job in the live-background state the roster projects (job.bg
+ *  present, job.exit absent) may be signaled. Job directories persist after
+ *  the supervisor exits, so a retired, still-foreground, or already-stopped
+ *  job would otherwise have its recorded pgid signaled long after the OS
+ *  could have reused that id for an unrelated process group. */
+export declare function stopBackgroundBashJob(contextDir: string, jobId: string): Promise<StopBackgroundBashJobResult>;
 /** Last `count` lines of a job log, cheaply: read at most the trailing 64 KiB
  * rather than the whole file, which for a long-running job can be enormous. */
 export declare function tailJobLog(logPath: string, count: number): string[];
@@ -40,6 +81,8 @@ export interface BashJobStatus {
     jobId: string;
     /** Full text of cmd.sh. */
     command: string;
+    /** Human-readable label, or null for an unlabeled or legacy job. */
+    purpose: string | null;
     startedAtMs: number;
     logPath: string;
 }

package/dist/core/bash-jobs.js

@@ -3,11 +3,32 @@
 // job.bg, while foreground completion renames it to job.done. The detached
 // supervisor can therefore outlive pi and still decide whether to report exit.
 import { randomBytes } from 'node:crypto';
-import { closeSync, existsSync, openSync, readdirSync, readFileSync, readSync, renameSync, statSync } from 'node:fs';
+import { closeSync, existsSync, openSync, readdirSync, readFileSync, readSync, renameSync, statSync, writeFileSync } from 'node:fs';
 import { join } from 'node:path';
+const MAX_BASH_JOB_PURPOSE_BYTES = 280;
+/** A purpose is display text, never shell input. Keep the file-backed control
+ * plane to one bounded, visible line so old or hand-written job directories
+ * cannot inject control content into terminal or JSON presenters. */
+export function normalizeBashJobPurpose(value) {
+    if (typeof value !== 'string' || /[\p{Cc}\p{Cf}]/u.test(value))
+        return null;
+    const purpose = value.trim();
+    if (purpose === '')
+        return null;
+    return Buffer.byteLength(purpose, 'utf8') <= MAX_BASH_JOB_PURPOSE_BYTES ? purpose : null;
+}
 export function bashJobsDir(contextDir) {
     return join(contextDir, 'jobs');
 }
+/** Whether a job id can safely be used as one path segment. Generated ids are
+ * numeric epoch prefixes plus a hex suffix; this broader safe alphabet keeps
+ * older file-backed ids readable without allowing path or request delimiters. */
+export function isSafeBashJobId(jobId) {
+    return typeof jobId === 'string'
+        && jobId !== '' && jobId !== '.' && jobId !== '..'
+        && /^[A-Za-z0-9._~-]+$/u.test(jobId)
+        && Buffer.byteLength(jobId, 'utf8') <= 128;
+}
 export function bashJobPaths(contextDir, jobId) {
     const dir = join(bashJobsDir(contextDir), jobId);
     return {
@@ -20,6 +41,7 @@ export function bashJobPaths(contextDir, jobId) {
         jobBg: join(dir, 'job.bg'),
         jobDone: join(dir, 'job.done'),
         jobPgid: join(dir, 'job.pgid'),
+        jobPurpose: join(dir, 'purpose'),
     };
 }
 /** The job's supervisor process group, or undefined for a job started before
@@ -33,6 +55,78 @@ export function readJobPgid(contextDir, jobId) {
         return undefined;
     }
 }
+/** The optional human-readable job label. Jobs created before labels existed
+ * have no file and deliberately project null. */
+export function readJobPurpose(contextDir, jobId) {
+    try {
+        return normalizeBashJobPurpose(readFileSync(bashJobPaths(contextDir, jobId).jobPurpose, 'utf8'));
+    }
+    catch {
+        return null;
+    }
+}
+/** Whether a persisted job supervisor process group is still present. EPERM
+ *  means the group exists but cannot be signaled by this process; it is still
+ *  live for the status surface. */
+export function isBashJobProcessGroupAlive(pgid) {
+    try {
+        process.kill(-pgid, 0);
+        return true;
+    }
+    catch (err) {
+        return err.code === 'EPERM';
+    }
+}
+/** Stop one live background job using the same process-group and sentinel
+ *  semantics as `crtr node bash kill`. The caller owns the user-facing
+ *  notification; this primitive owns only the job control-plane mutation.
+ *
+ *  Only a job in the live-background state the roster projects (job.bg
+ *  present, job.exit absent) may be signaled. Job directories persist after
+ *  the supervisor exits, so a retired, still-foreground, or already-stopped
+ *  job would otherwise have its recorded pgid signaled long after the OS
+ *  could have reused that id for an unrelated process group. */
+export async function stopBackgroundBashJob(contextDir, jobId) {
+    const paths = bashJobPaths(contextDir, jobId);
+    if (!existsSync(paths.dir))
+        return { kind: 'missing' };
+    if (!existsSync(paths.jobBg) || existsSync(paths.jobExit))
+        return { kind: 'retired', logPath: paths.jobLog };
+    const pgid = readJobPgid(contextDir, jobId);
+    if (pgid === undefined)
+        return { kind: 'not-stoppable', logPath: paths.jobLog };
+    // Claim the stop by creating job.exit exclusively, before signaling. The
+    // loser of two concurrent stops — and a stop that races the supervisor's own
+    // completion — reports retired instead of signaling a departed group and
+    // sending the owning node a second "was stopped" notice.
+    try {
+        const fd = openSync(paths.jobExit, 'wx');
+        try {
+            writeFileSync(fd, '143\n');
+        }
+        finally {
+            closeSync(fd);
+        }
+    }
+    catch (err) {
+        if (err.code === 'EEXIST')
+            return { kind: 'retired', logPath: paths.jobLog };
+        throw err;
+    }
+    let signaled = true;
+    try {
+        process.kill(-pgid, 'SIGTERM');
+    }
+    catch {
+        signaled = false;
+    }
+    await new Promise((resolve) => setTimeout(resolve, 400));
+    try {
+        process.kill(-pgid, 'SIGKILL');
+    }
+    catch { /* already gone */ }
+    return { kind: 'stopped', signaled, pgid, logPath: paths.jobLog };
+}
 /** Last `count` lines of a job log, cheaply: read at most the trailing 64 KiB
  * rather than the whole file, which for a long-running job can be enormous. */
 export function tailJobLog(logPath, count) {
@@ -122,7 +216,7 @@ export function activeBackgroundBashJobs(contextDir) {
         catch {
             continue;
         }
-        jobs.push({ jobId, command, startedAtMs, logPath: paths.jobLog });
+        jobs.push({ jobId, command, purpose: readJobPurpose(contextDir, jobId), startedAtMs, logPath: paths.jobLog });
     }
     return jobs.sort((a, b) => a.startedAtMs - b.startedAtMs);
 }

package/dist/core/canvas/__tests__/attention.test.js

@@ -4,7 +4,7 @@ import assert from 'node:assert/strict';
 import { mkdtempSync, rmSync, mkdirSync } from 'node:fs';
 import { tmpdir } from 'node:os';
 import { join } from 'node:path';
-import { atomicWriteJson, deckPath } from '../../human/convention.js';
+import { atomicWriteJson, pageManifestPath } from '../../human/convention.js';
 import { createNode } from '../canvas.js';
 import { closeDb } from '../db.js';
 import { nodeDir } from '../paths.js';
@@ -22,12 +22,18 @@ function meta(id, cwd, extra) {
         ...extra,
     };
 }
-function seedDeck(bridgeId) {
+function seedPage(bridgeId) {
     const dir = nodeDir(bridgeId);
     mkdirSync(dir, { recursive: true });
-    atomicWriteJson(deckPath(dir), {
+    atomicWriteJson(pageManifestPath(dir), {
+        schema: 'crtr.page/v1',
+        dialect: 'md',
         title: bridgeId,
-        interactions: [{ id: 'q', title: bridgeId, subtitle: 'Acknowledge this ticket so the request can proceed.', options: [] }],
+        subtitle: 'Acknowledge this ticket so the request can proceed.',
+        placement: 'inline',
+        document: 'page.md',
+        steps: 1,
+        slots: [],
     });
 }
 function bridge(id, parent, cwd) {
@@ -61,10 +67,10 @@ test('ticketCountsForNodes follows bridge parents even when asking nodes share a
     bridge('ha2', 'a', sharedCwd);
     bridge('hb', 'b', sharedCwd);
     bridge('hc', 'c', soloCwd);
-    seedDeck('ha1');
-    seedDeck('ha2');
-    seedDeck('hb');
-    seedDeck('hc');
+    seedPage('ha1');
+    seedPage('ha2');
+    seedPage('hb');
+    seedPage('hc');
     assert.deepEqual(ticketCountsForNodes(['a', 'b', 'c']), { a: 2, b: 1, c: 1 });
 });
 test('pendingTicketsForView returns the asking node rather than a cwd bucket', () => {
@@ -72,8 +78,8 @@ test('pendingTicketsForView returns the asking node rather than a cwd bucket', (
     createNode(meta('b', sharedCwd));
     bridge('ha', 'a', sharedCwd);
     bridge('hb', 'b', sharedCwd);
-    seedDeck('ha');
-    seedDeck('hb');
+    seedPage('ha');
+    seedPage('hb');
     assert.deepEqual(pendingTicketsForView('a').map(({ node_id, count }) => ({ node_id, count })), [
         { node_id: 'a', count: 1 },
     ]);

package/dist/core/canvas/__tests__/render-remote.test.js

@@ -19,7 +19,7 @@ import { createServer } from 'node:http';
 import { mkdtempSync, rmSync, mkdirSync, writeFileSync } from 'node:fs';
 import { tmpdir } from 'node:os';
 import { join } from 'node:path';
-import { atomicWriteJson, deckPath } from '#core/human/convention';
+import { atomicWriteJson, pageManifestPath } from '#core/human/convention';
 import { RemoteCanvasSource } from '../remote-canvas-source.js';
 import { dashboardRowsAllFromSource, enrichRowsFromSource, loadPreviewFromSource, renderForestFromSource } from '../render.js';
 import { createNode } from '../canvas.js';
@@ -113,9 +113,15 @@ function seedPoisonedLocalState() {
     createNode(meta('a', { cwd: localCwd }));
     const askDir = nodeDir('poison-ask');
     mkdirSync(askDir, { recursive: true });
-    atomicWriteJson(deckPath(askDir), {
+    atomicWriteJson(pageManifestPath(askDir), {
+        schema: 'crtr.page/v1',
+        dialect: 'md',
         title: 'poison',
-        interactions: [{ id: 'q', kind: 'ask', title: 'poison', subtitle: 'This local ticket must not affect the remote rendering.' }],
+        subtitle: 'This local ticket must not affect the remote rendering.',
+        placement: 'inline',
+        document: 'page.md',
+        steps: 1,
+        slots: [],
     });
     // A local focus + broker viewer — poison both `viewed` signals.
     openFocusRow('poison-focus', null, null, 'a');

package/dist/core/canvas/attention.js

@@ -3,7 +3,7 @@
 // Every ticket is a direct child of the single registered `<canvas>/nodes` root,
 // named for its terminal human bridge node. The bridge's parent is the asking
 // node, so storage identity and attribution come from the canvas graph rather
-// than duplicated attribution fields in deck/review data.
+// than duplicated attribution fields in page/review data.
 import { basename } from 'node:path';
 import { scanInbox } from '../human/scan.js';
 import { filterTerminalReviewTickets } from '../review/ticket-filter.js';

package/dist/core/canvas/browse/app.js

@@ -55,7 +55,7 @@ export async function runBrowse(opts) {
         process.stdout.write(await renderForestFromSource(source) + '\n');
         return;
     }
-    // Snapshot the canvas. Drop kind:'human' control-plane decks — they have no pi
+    // Snapshot the canvas. Drop kind:'human' control-plane pages — they have no pi
     // session, so `surface node focus` refuses them; they are never a navigation/resume
     // target (mirrors the surface-node focus guard).
     let rows;

package/dist/core/canvas/nav-model.d.ts

@@ -3,7 +3,7 @@ import type { NodeMeta } from './index.js';
 export { PI_MAX_WIDGET_LINES, VIEWPORT_FALLBACK_ROWS, ESC, RESET, BOLD, DIM, REVERSE, BG_ATTACHED, GREEN, RED, YELLOW, CYAN, GRAY, nodeGlyph, visibleWidth, truncate, fillWidth, fillBar, readTelemetry, fmtTokens, tokensCell, activityCell, cycleBadge, navLabel, shortId, askBadge, liveBelowBadge, isAttached, hasBrokerViewers, fetchAsksMap, graphWidgetBudget, GRAPH_HINT, type Telemetry, type FlatRow, type FoldState, type SubtreeActivity, } from './nav-render.js';
 /** First manager (by created) — the UP step for the ancestry spine. */
 export declare function managerOf(id: string): string | undefined;
-/** A kind:'human' node is a control-plane ASK (a deck on the human's
+/** A kind:'human' node is a control-plane ASK (a page on the human's
  *  screen), NOT a pi conversation — it has no session, so focusing/reviving it
  *  boots a confused blank "you have been revived" pi. Its pending-ask signal
  *  already rides the ⚑ badge on the ASKING node (attention.ts follows the

package/dist/core/canvas/nav-model.js

@@ -73,7 +73,7 @@ function mgrsOf(id) {
 export function managerOf(id) {
     return mgrsOf(id)[0]?.node_id;
 }
-/** A kind:'human' node is a control-plane ASK (a deck on the human's
+/** A kind:'human' node is a control-plane ASK (a page on the human's
  *  screen), NOT a pi conversation — it has no session, so focusing/reviving it
  *  boots a confused blank "you have been revived" pi. Its pending-ask signal
  *  already rides the ⚑ badge on the ASKING node (attention.ts follows the

package/dist/core/canvas/remote-canvas-source.js

@@ -208,7 +208,7 @@ export class RemoteCanvasSource {
     }
     async ticketCountsForView(root) {
         // The `canvas attention map` transport is unchanged; its `counts` values now
-        // mean all pending human tickets (deck/review/notify), not just asks.
+        // mean all pending human tickets (page/review), not just asks.
         const res = await this.execJson(['canvas', 'attention', 'map', '--view', root]);
         return isPlainObject(res) && isPlainObject(res['counts']) ? res['counts'] : {};
     }

package/dist/core/canvas/types.d.ts

@@ -11,7 +11,8 @@
  *  only `dead` is a fault. */
 export type NodeStatus = 'active' | 'idle' | 'done' | 'dead' | 'canceled';
 /** Does stopping finalize the node? terminal = worker (finalizes on push --final);
- *  resident = manager/orchestrator (stays dormant, woken by inbox). */
+ *  resident = interactable while attached or holding a live obligation. An
+ *  unattended obligation-free resident completes after the daemon grace. */
 export type Lifecycle = 'terminal' | 'resident';
 /** base = hands-on worker; orchestrator = delegating manager. Bespoke per kind. */
 export type Mode = 'base' | 'orchestrator';

package/dist/core/config.js

@@ -10,6 +10,7 @@ import { profileRoot } from './profiles/manifest.js';
 import { withExclusiveDirectoryLock } from './exclusive-lock.js';
 import { SCOPE_CONFIG_KEYS } from './user-settings.js';
 import { normalizeWorkingGerunds } from '../shared/working-activity.js';
+import { normalizePageComponents } from './human/page-catalog.js';
 function configPathFor(root) {
     return join(root, CONFIG_FILE);
 }
@@ -478,6 +479,8 @@ function mergeConfig(partial) {
         ? [...defaults.working_gerunds]
         : normalizeWorkingGerunds(partial.working_gerunds);
     const whip_mode = typeof partial.whip_mode === 'boolean' ? partial.whip_mode : defaults.whip_mode;
+    const html_pages = typeof partial.html_pages === 'boolean' ? partial.html_pages : defaults.html_pages;
+    const page_components = normalizePageComponents(partial.page_components);
     const whip_messages = normalizeWhipMessages(partial.whip_messages);
     const mouse_mode_default = MOUSE_MODE_DEFAULTS.includes(partial.mouse_mode_default)
         ? partial.mouse_mode_default
@@ -497,7 +500,7 @@ function mergeConfig(partial) {
     const kinds = mergeKinds(partial.kinds);
     const remoteCanvas = mergeRemoteCanvas(partial.remoteCanvas);
     const spawnEnv = mergeSpawnEnv(partial.spawnEnv, defaults.spawnEnv?.allow);
-    return { schema_version, marketplaces, plugins, auto_update, max_panes_per_window, auto_open_child_viewers, brokerThresholds, completion_bell, working_gerunds, whip_mode, whip_messages, mouse_mode_default, live_cycles, condensed_history, fold_finished_tools, summarize_tool_calls, detailed_tool_recaps, keybindings, tmux_passthrough, modelLadders, ...(Object.keys(modelRoutes).length > 0 ? { modelRoutes } : {}), ...(modelRouting !== undefined ? { modelRouting } : {}), kinds, remoteCanvas, spawnEnv };
+    return { schema_version, marketplaces, plugins, auto_update, max_panes_per_window, auto_open_child_viewers, brokerThresholds, completion_bell, working_gerunds, whip_mode, html_pages, page_components, whip_messages, mouse_mode_default, live_cycles, condensed_history, fold_finished_tools, summarize_tool_calls, detailed_tool_recaps, keybindings, tmux_passthrough, modelLadders, ...(Object.keys(modelRoutes).length > 0 ? { modelRoutes } : {}), ...(modelRouting !== undefined ? { modelRouting } : {}), kinds, remoteCanvas, spawnEnv };
 }
 /** Raw (un-defaulted) partial config for one scope, or null if the scope has
  *  no root or no config.json. Used by `readMergedLaunchConfig` to layer

package/dist/core/human/__tests__/page-render.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/core/human/__tests__/page-render.test.js

@@ -0,0 +1,49 @@
+// Two properties of the default page template whose absence would be SILENT —
+// every ordinary page still renders and still looks right when either breaks.
+// Nothing else about rendering is pinned here; prose shape is the renderer's
+// own business and a change there is visible the moment anyone looks at a page.
+import assert from 'node:assert/strict';
+import { mkdtempSync, readFileSync, rmSync, writeFileSync } from 'node:fs';
+import { tmpdir } from 'node:os';
+import { join } from 'node:path';
+import test from 'node:test';
+import { derivePageManifest } from '../page.js';
+import { renderPageHtml } from '../page-render.js';
+function render(name, source) {
+    const dir = mkdtempSync(join(tmpdir(), 'crtr-page-render-test-'));
+    try {
+        const path = join(dir, name);
+        writeFileSync(path, source);
+        return renderPageHtml(derivePageManifest(path, name.endsWith('.md') ? 'md' : 'html'), readFileSync(path, 'utf8'));
+    }
+    finally {
+        rmSync(dir, { recursive: true, force: true });
+    }
+}
+test('a config value carrying script markup cannot end its own <script> element', () => {
+    const html = render('page.md', [
+        '---', 'title: Escaping', '---', '',
+        'Pick one.', '',
+        '```slot:options',
+        '{"id":"esc","mode":"single","options":[{"id":"a","label":"</script><script>x</script>"},{"id":"b","label":"<!-- c -->"}]}',
+        '```', '',
+    ].join('\n'));
+    const config = /<crtr-options slot-id="esc"><script type="application\/json">([\s\S]*?)<\/script>/.exec(html)?.[1];
+    assert.ok(config !== undefined, `no options config in payload:\n${html}`);
+    // The mutation this catches: dropping the `<` escape for a plain JSON.stringify.
+    assert.ok(!config.includes('<'), `config text still carries a raw "<": ${config}`);
+    assert.equal(JSON.parse(config).options[0].label, '</script><script>x</script>');
+});
+test('an authored html slot id is mirrored to the slot-id the runtime reads', () => {
+    const html = render('page.html', [
+        '<!doctype html><html><head><meta name="crtr-page-title" content="Sign-off"></head><body>',
+        '<crtr-pages><crtr-page label="Window">',
+        '<crtr-options id="window"><script type="application/json">{"mode":"single","options":[{"id":"sat","label":"Saturday"}]}</script></crtr-options>',
+        '</crtr-page></crtr-pages>',
+        '</body></html>',
+    ].join('\n'));
+    // Without this, every element mounts and renders and no response ever
+    // reaches the host, because `src/pages` keys responses by `slot-id`.
+    assert.match(html, /<crtr-options id="window" slot-id="window">/);
+    assert.match(html, /<crtr-page label="Window">/);
+});

package/dist/core/human/__tests__/page-tickets.test.d.ts

@@ -0,0 +1 @@
+export {};