@north-light/crouter 0.3.192 → 0.3.194

package/dist/builtin-memory/internal/nodes-and-canvas.md

@@ -38,7 +38,7 @@ A push fans a ~30-token **pointer** (a ref path), not the content; subscribers d
 Two orthogonal axes:
 
 - **mode**: base (a hands-on worker — finishes its own job, yielding mode-preservingly when a task needs another window) ↔ orchestrator (`node promote` — a long-lived, roadmap-holding coordinator that delegates independent work and survives context refresh via `node yield`). Promote only when worthwhile parallel work makes coordinating and integrating children the node's primary job; task duration, sequential phases, or one helper are not enough.
-- **lifecycle**: terminal (owes a final up the spine, reaps when done) ↔ resident (`node config --lifecycle <value>` / interactable — stays dormant, wakes on inbox/human, never forced to finish). `node lifecycle demote` is the friendly flip-to-terminal-in-place.
+- **lifecycle**: terminal (owes a final up the spine, reaps when done) ↔ resident (`node config --lifecycle <value>` / interactable — never forced to submit; stays wakeable while attached or awaiting something live, then completes after 15 unattended minutes with no live obligation). `node lifecycle demote` is the friendly flip-to-terminal-in-place.
 
 A dormant node wakes from an **inbox** message (a push, or `node message send`) or from a scheduled **cron** whose bash command performs the action (`node message send`, `node lifecycle revive`, or `node new`). A cron can gate its action on an external condition such as CI or a deploy; inspect or reap schedules with `cron list`/`cron cancel`. To monitor your own children you arm nothing — you auto-subscribe on spawn, so their finish/crash/close wakes you; a deadline to chase a delegate is a belt-and-suspenders the runtime makes redundant. A terminal node blocked on a one-off message from a parent or controller it holds no live subscription to declares that wait with `node wait controller` before going dormant, so the next inbox delivery from that sender clears the wait rather than the runtime treating the idle as finished. Use `node wait deadline` only for the atomic inbox-versus-deadline race.
 
@@ -48,4 +48,4 @@ Tear-down: `node lifecycle close` cascade-cancels a node + its exclusive subtree
 
 Use `node lifecycle revive <id>` to reopen one dormant or terminal node. It resumes an existing saved conversation by default; `--fresh` starts a new cycle on its existing session file, or a truly fresh session if no file exists. A finalized node requires `--reopen` before it can take a new mandate. Mass-reconnecting every eligible disconnected node after a reboot or outage is `canvas revive --all` instead. `reviveNode()` is the **only** sanctioned launcher of a node's broker engine — it builds the pi invocation, sets `CRTR_NODE_ID` + canvas extensions, runs `transition('revive')`, and starts the headless broker host, keeping the db row and broker process in lockstep. Never spawn `pi --session` raw, and never open a node by spawning pi directly — UIs go through `surface node focus` / `node lifecycle revive`.
 
-The daemon (`crtrd`, managed via `sys daemon start/stop/status`) supervises live broker exits. It applies a bounded respawn policy to interrupted nonterminal nodes: a cleanly aborted saved turn resumes with a continuation, while a dirty interrupted turn, pending refresh, or pending cycle starts a fresh cycle from the saved session. Repeated short-lived exits and boot failures terminalize the node as `dead`; no automatic recovery occurs after terminalization, so use an explicit lifecycle revive or an inbox wake. It does not host agents or open viewers. When activating source changes, build, run `npm run install-runtime`, then restart the daemon because new daemon/brokers select the atomically switched, immutable generation while live brokers retain their own. Restarting is safe: it never signals running nodes.
+The daemon (`crtrd`, managed via `sys daemon start/stop/status`) supervises live broker exits. It releases an unattended broker after 15 minutes: residents with no live obligation become `done` and pruning-eligible, while terminal nodes and residents awaiting a live child, controller, human, deadline, or structured output become `idle` and remain wakeable. It applies a bounded respawn policy to interrupted nonterminal nodes: a cleanly aborted saved turn resumes with a continuation, while a dirty interrupted turn, pending refresh, or pending cycle starts a fresh cycle from the saved session. Repeated short-lived exits and boot failures terminalize the node as `dead`; no automatic recovery occurs after terminalization, so use an explicit lifecycle revive or an inbox wake. It does not host agents or open viewers. When activating source changes, build, run `npm run install-runtime`, then restart the daemon because new daemon/brokers select the atomically switched, immutable generation while live brokers retain their own. Restarting is safe: it never signals running nodes.

package/dist/builtin-memory/internal/storage-tiers.md

@@ -22,7 +22,7 @@ User-wide content with no cwd dimension also belongs here: `~/.crouter/profile-d
 
 ## 2. Canvas home — node-graph runtime state, node artifacts, and bounded diagnostics
 
-`~/.crouter/canvas/` (overridable with `CRTR_HOME`) is the cwd-agnostic node-graph home. `canvas.db` is the SQLite WAL topology store for nodes and edges, including durable tmux-pane focus. `nodes/<node_id>/` owns `meta.json`, `context/`, `reports/`, `messages/`, `inbox.jsonl`, `transcript.jsonl`, `session.ptr`, and `job/` state. Human ticket files (`deck.json`, `run.json`, `response.json`, `review.json`, and `branch-point.jsonl`) live directly in a terminal human bridge node directory; `nodes/` is the single ticket root, derived rather than registered.
+`~/.crouter/canvas/` (overridable with `CRTR_HOME`) is the cwd-agnostic node-graph home. `canvas.db` is the SQLite WAL topology store for nodes and edges, including durable tmux-pane focus. `nodes/<node_id>/` owns `meta.json`, `context/`, `reports/`, `messages/`, `inbox.jsonl`, `transcript.jsonl`, `session.ptr`, and `job/` state. Human ticket files (`page.json`, `page.md`, `run.json`, `response.json`, `review.json`, and `branch-point.jsonl`) live directly in a terminal human bridge node directory; `nodes/` is the single ticket root, derived rather than registered.
 
 Specifications and plans are ordinary node-context artifacts. They share the node's lifetime and are removed when that node is reaped.
 

package/dist/builtin-pi-packages/pi-crtr-extensions/extensions/__tests__/serial/provider-rotation.test.ts

@@ -138,8 +138,11 @@ test("brick-repro: concurrent refreshes of the same expired pool token serialize
   assert.equal(poolEntry.label, "anthropic");
 
   let refreshCalls = 0;
-  rotationModule.__setRefreshForProviderForTest(async (_providerId, refreshToken) => {
+  const requestController = new AbortController();
+  const refreshSignals: (AbortSignal | undefined)[] = [];
+  rotationModule.__setRefreshForProviderForTest(async (_providerId, refreshToken, signal) => {
     refreshCalls += 1;
+    refreshSignals.push(signal);
     if (refreshCalls === 1) {
       return { refresh: "shared-refresh-rotated", access: "access-fresh", expires: Date.now() + 60_000 };
     }
@@ -150,11 +153,12 @@ test("brick-repro: concurrent refreshes of the same expired pool token serialize
 
   try {
     const [a, b] = await Promise.all([
-      rotationModule.__refreshCredentialIfNeededForTest("anthropic", poolEntry),
-      rotationModule.__refreshCredentialIfNeededForTest("anthropic", poolEntry),
+      rotationModule.__refreshCredentialIfNeededForTest("anthropic", poolEntry, requestController.signal),
+      rotationModule.__refreshCredentialIfNeededForTest("anthropic", poolEntry, requestController.signal),
     ]);
 
     assert.equal(refreshCalls, 1);
+    assert.deepEqual(refreshSignals, [requestController.signal], 'the request abort signal reaches the serialized token exchange');
     assert.equal(a.access, "access-fresh");
     assert.equal(b.access, "access-fresh");
 
@@ -1192,6 +1196,100 @@ test("surfaces the underlying transient error without reporting a rate limit whe
   }
 });
 
+// Regression: a transport-poisoned process (a corrupted TLS upload leaves undici's H2
+// session destroyed, so EVERY request fails with no HTTP response while fresh processes
+// succeed) must self-terminate after consecutive transport-only exhausted passes so the
+// daemon respawns the broker fresh — and any pass that saw a real HTTP status must reset
+// the counter so ordinary provider blips never kill a healthy process.
+test("self-terminates after consecutive transport-only exhausted passes; an HTTP status resets the counter", async () => {
+  await resetRotationState();
+  writeLadderConfig();
+  await helpers.writeSubscriptionPool("openai-codex", [credential("codex")]);
+
+  const { ctx, providers, events, pi } = makeRotationCtx(undefined);
+  rotationModule.__setSleepForTest(async () => {});
+  let mode: "success" | "transport" | "http503" = "success";
+  rotationModule.__setStreamForProviderForTest(() => {
+    const current = mode;
+    return (async function* () {
+      if (current === "success") {
+        yield { type: "text_delta", text: "ok" };
+        return;
+      }
+      if (current === "http503") {
+        // Transient by status — but an HTTP response nonetheless: proof the
+        // process can still reach the provider.
+        yield { type: "error", error: Object.assign(new Error("Service Unavailable"), { status: 503 }) };
+        return;
+      }
+      // No status at all — the poisoned-transport signature.
+      yield {
+        type: "error",
+        error: Object.assign(new Error("fetch failed: The session has been destroyed"), {
+          errorMessage: "fetch failed: The session has been destroyed",
+        }),
+      };
+    })() as any;
+  });
+  const terminateCalls: string[] = [];
+  let resolveTerminated: (tried: string) => void;
+  const terminated = new Promise<string>((resolve) => { resolveTerminated = resolve; });
+  rotationModule.__setTerminatePoisonedProcessForTest((tried) => {
+    terminateCalls.push(tried);
+    resolveTerminated(tried);
+    return true;
+  });
+
+  const runPass = async () => {
+    const stream = providers["openai-codex"].streamSimple(
+      { provider: "openai-codex", id: "gpt-5.6-sol", api: "openai-codex-responses" },
+      ctx,
+    );
+    const emitted: any[] = [];
+    for await (const event of stream) emitted.push(event);
+    return emitted;
+  };
+
+  try {
+    await providerRotationExtension(pi);
+    await events.session_start?.({}, ctx);
+
+    // Baseline success pass: the cross-turn counter starts at zero.
+    assert.ok((await runPass()).some((e) => e.type === "text_delta"));
+
+    // First transport-only exhaustion: ordinary terminal error, no termination.
+    mode = "transport";
+    assert.ok((await runPass()).some((e) => e.type === "error"));
+    assert.equal(terminateCalls.length, 0);
+
+    // An exhausted pass WITH an HTTP status resets the counter.
+    mode = "http503";
+    assert.ok((await runPass()).some((e) => e.type === "error"));
+
+    // One transport-only pass after the reset: still below the limit.
+    mode = "transport";
+    assert.ok((await runPass()).some((e) => e.type === "error"));
+    assert.equal(terminateCalls.length, 0);
+
+    // Second consecutive transport-only pass: terminate fires and the stream is
+    // deliberately left open (no terminal error), so the SIGTERM abort path owns
+    // how this turn settles. Don't await the never-ending stream.
+    const stream = providers["openai-codex"].streamSimple(
+      { provider: "openai-codex", id: "gpt-5.6-sol", api: "openai-codex-responses" },
+      ctx,
+    );
+    const emitted: any[] = [];
+    void (async () => { for await (const event of stream) emitted.push(event); })();
+    await within(terminated, 5_000, "poisoned-process termination never fired");
+    assert.equal(terminateCalls.length, 1);
+    assert.equal(emitted.length, 0);
+  } finally {
+    rotationModule.__setTerminatePoisonedProcessForTest(undefined);
+    rotationModule.__setStreamForProviderForTest(undefined);
+    rotationModule.__setSleepForTest(undefined);
+  }
+});
+
 // Regression: a genuine rate limit (HTTP 429) must never get the transient in-place
 // retry treatment -- it cools the credential down and rotates on the FIRST failure. The
 // cooldown duration must reflect a real Retry-After header (5s here) rather than always

package/dist/builtin-pi-packages/pi-crtr-extensions/extensions/provider-rotation.d.ts

@@ -9,6 +9,10 @@ export interface ProviderRotationOptions {
 declare function defaultSleep(ms: number): Promise<void>;
 /** Test-only seam: override the sleep implementation used for in-place/wait-out retries. Pass undefined to restore the default. */
 export declare function __setSleepForTest(fn: typeof defaultSleep | undefined): void;
+export declare const POISONED_TRANSPORT_PASS_LIMIT = 2;
+declare function defaultTerminatePoisonedProcess(tried: string): boolean;
+/** Test-only seam: override poisoned-process self-termination. Pass undefined to restore the default. */
+export declare function __setTerminatePoisonedProcessForTest(fn: typeof defaultTerminatePoisonedProcess | undefined): void;
 /** Test-only seam for the bounded, non-fatal subscription bookkeeping path. */
 export declare function __recordSubscriptionMutationForTest(description: string, mutate: () => Promise<unknown>): Promise<boolean>;
 type RefreshedCredential = {
@@ -25,12 +29,12 @@ type LoginCredential = {
 type ResolvedCredential = SubscriptionCredential & {
     access: string;
 };
-type RefreshForProvider = (providerId: ManagedProviderId, refreshToken: string) => Promise<RefreshedCredential>;
+type RefreshForProvider = (providerId: ManagedProviderId, refreshToken: string, signal?: AbortSignal) => Promise<RefreshedCredential>;
 /** Test-only seam: override the per-provider refresh function. Pass undefined to restore the default. */
 export declare function __setRefreshForProviderForTest(fn: RefreshForProvider | undefined): void;
 /** Test-only seam: exercises the real `refreshCredentialIfNeeded` (including its locked refresh
  * transaction) without duplicating its logic. */
-export declare function __refreshCredentialIfNeededForTest(providerId: ManagedProviderId, credential: SubscriptionCredential): Promise<ResolvedCredential>;
+export declare function __refreshCredentialIfNeededForTest(providerId: ManagedProviderId, credential: SubscriptionCredential, signal?: AbortSignal): Promise<ResolvedCredential>;
 declare function defaultLoginForProvider(providerId: ManagedProviderId, ctx: ExtensionContext): Promise<LoginCredential>;
 /** Test-only seam: override the per-provider login function. Pass undefined to restore the default. */
 export declare function __setLoginForProviderForTest(fn: typeof defaultLoginForProvider | undefined): void;

package/dist/builtin-pi-packages/pi-crtr-extensions/extensions/provider-rotation.js

@@ -24,7 +24,7 @@ const TRANSIENT_ROTATE_COOLDOWN_MS = 60 * 1000;
 // healthy model response into a fatal generation fault.
 const SUBSCRIPTION_LOCK_RETRY_BACKOFFS_MS = [25, 75, 150];
 function createProviderRotationState(options) {
-    return { delegatedProviderStreams: new Map(), ...(options === undefined ? {} : { options: { ...options } }) };
+    return { delegatedProviderStreams: new Map(), transportOnlyExhaustedPasses: 0, ...(options === undefined ? {} : { options: { ...options } }) };
 }
 function configuredValue(state, key, envName) {
     return state.options === undefined ? process.env[envName] : state.options[key];
@@ -83,6 +83,33 @@ let activeSleep = defaultSleep;
 export function __setSleepForTest(fn) {
     activeSleep = fn ?? defaultSleep;
 }
+// After this many CONSECUTIVE route-queue passes in which every failure was
+// transport-level (no HTTP status and no Retry-After header — the provider was
+// never reached at all), the broker process itself is presumed poisoned: a
+// corrupted large TLS upload can leave Node/undici's HTTP/2 session permanently
+// destroyed, after which EVERY provider request from this process fails while
+// curl and fresh processes on the same host succeed. There is no clean in-process
+// heal (the dispatcher cannot be safely re-instantiated), so the recovery is a
+// fresh process: self-terminate via SIGTERM and let the daemon's exit policy
+// respawn this broker against the same session. A genuine full network outage
+// also trips this — harmlessly: the respawned broker fails the same way and the
+// daemon's respawn backoff paces the loop.
+export const POISONED_TRANSPORT_PASS_LIMIT = 2;
+function defaultTerminatePoisonedProcess(tried) {
+    // Only the broker process itself may self-terminate: runBroker stamps
+    // CRTR_BROKER_PID with its own pid at boot. Any other host (tests, tooling)
+    // keeps the ordinary terminal-error path.
+    if (process.env["CRTR_BROKER_PID"] !== String(process.pid))
+        return false;
+    logRotation(`process transport poisoned: ${POISONED_TRANSPORT_PASS_LIMIT} consecutive route-queue passes failed with no HTTP response (tried ${tried}); exiting so the daemon respawns this broker fresh`);
+    process.kill(process.pid, "SIGTERM");
+    return true;
+}
+let activeTerminatePoisonedProcess = defaultTerminatePoisonedProcess;
+/** Test-only seam: override poisoned-process self-termination. Pass undefined to restore the default. */
+export function __setTerminatePoisonedProcessForTest(fn) {
+    activeTerminatePoisonedProcess = fn ?? defaultTerminatePoisonedProcess;
+}
 function isSubscriptionLockContention(error) {
     const value = error;
     return value?.code === "ELOCKED" || (typeof value?.message === "string" && /lock file is already being held/i.test(value.message));
@@ -188,8 +215,15 @@ function oauthFlow(providerId, ctx) {
 }
 // `refresh` is a pure token exchange that reads only `credential.refresh` and persists
 // nothing; crouter records the rotated token in the selected pool row.
-async function defaultRefreshForProvider(state, providerId, refreshToken) {
-    return oauthFlow(providerId, state.runtimeContext).refresh({ type: "oauth", refresh: refreshToken, access: "", expires: 0 });
+async function defaultRefreshForProvider(state, providerId, refreshToken, parentSignal) {
+    const localController = parentSignal === undefined ? new AbortController() : undefined;
+    const signal = parentSignal ?? localController.signal;
+    try {
+        return await oauthFlow(providerId, state.runtimeContext).refresh({ type: "oauth", refresh: refreshToken, access: "", expires: 0 }, signal);
+    }
+    finally {
+        localController?.abort();
+    }
 }
 // Indirection so tests can inject refresh failures without real network calls.
 let activeRefreshForProvider;
@@ -220,19 +254,19 @@ function openBrowser(url) {
 // `getApiKey`, which wraps pi-ai's `getOAuthApiKey` and collapses a refresh failure into a
 // generic message; calling `activeRefreshForProvider` directly keeps the real error intact so
 // `isInvalidRefreshTokenError` can classify it (cooldown -> reauth -> cross-provider-fallback).
-async function refreshCredentialIfNeeded(state, providerId, credential) {
+async function refreshCredentialIfNeeded(state, providerId, credential, signal) {
     if (!credential.refresh || !credential.access || credential.expires === undefined) {
         throw new Error(`${getProviderLabel(providerId)} subscription "${credential.label}" is missing its credential value`);
     }
     if (credential.expires > Date.now())
         return credential;
-    const refreshed = await refreshSubscriptionCredential(providerId, credential.label, (token) => activeRefreshForProvider?.(providerId, token) ?? defaultRefreshForProvider(state, providerId, token));
+    const refreshed = await refreshSubscriptionCredential(providerId, credential.label, (token) => activeRefreshForProvider?.(providerId, token, signal) ?? defaultRefreshForProvider(state, providerId, token, signal));
     return { ...credential, ...refreshed };
 }
 /** Test-only seam: exercises the real `refreshCredentialIfNeeded` (including its locked refresh
  * transaction) without duplicating its logic. */
-export async function __refreshCredentialIfNeededForTest(providerId, credential) {
-    return refreshCredentialIfNeeded(createProviderRotationState(), providerId, credential);
+export async function __refreshCredentialIfNeededForTest(providerId, credential, signal) {
+    return refreshCredentialIfNeeded(createProviderRotationState(), providerId, credential, signal);
 }
 async function defaultLoginForProvider(providerId, ctx) {
     return loginProvider(providerId, ctx);
@@ -535,6 +569,10 @@ async function runManagedProvider(state, model, context, options, stream) {
     const cooldownAttempts = new Map();
     let terminalModel = model;
     let lastTransientFailure;
+    // Any HTTP response observed this pass (a status, a Retry-After header, or a
+    // rate-limit classification) proves this process can still reach a provider,
+    // clearing the poisoned-transport suspicion.
+    let sawHttpEvidence = false;
     for (let candidate = candidates.shift(); candidate !== undefined; candidate = candidates.shift()) {
         const { routeId, providerId, model: candidateModel } = candidate;
         queuedRouteIds.delete(routeId);
@@ -547,14 +585,13 @@ async function runManagedProvider(state, model, context, options, stream) {
         }
         if (!isManagedProvider(providerId)) {
             const result = await streamProviderAttempt(state, providerId, candidateModel, context, options, undefined, stream);
-            if (result.result === 'success') {
-                stream.end();
-                return;
-            }
-            if (result.result === 'fatal') {
+            if (result.result === 'success' || result.result === 'fatal') {
+                state.transportOnlyExhaustedPasses = 0;
                 stream.end();
                 return;
             }
+            if (result.result === 'rate_limited' || result.classification?.status !== undefined || result.classification?.hadRetryAfterHeader === true)
+                sawHttpEvidence = true;
             const cooldownMs = result.result === 'rate_limited' ? result.retryAfterMs ?? DEFAULT_RATE_LIMIT_BACKOFF_MS : TRANSIENT_ROTATE_COOLDOWN_MS;
             if (result.result === 'transient_exhausted')
                 lastTransientFailure = result;
@@ -575,7 +612,7 @@ async function runManagedProvider(state, model, context, options, stream) {
         for (const credential of available) {
             let freshCredential;
             try {
-                freshCredential = await refreshCredentialIfNeeded(state, providerId, credential);
+                freshCredential = await refreshCredentialIfNeeded(state, providerId, credential, options?.signal);
             }
             catch (error) {
                 if (!isInvalidRefreshTokenError(error))
@@ -597,15 +634,19 @@ async function runManagedProvider(state, model, context, options, stream) {
             }
             const result = await streamProviderAttempt(state, providerId, candidateModel, context, options, freshCredential, stream);
             if (result.result === 'success') {
+                state.transportOnlyExhaustedPasses = 0;
                 if (freshCredential.rateLimitedUntil || freshCredential.authFailure)
                     await recordSubscriptionMutation(`recording ${getProviderLabel(providerId)} success`, () => markSubscriptionSuccess(providerId, freshCredential.label, result.attemptAt));
                 stream.end();
                 return;
             }
             if (result.result === 'fatal') {
+                state.transportOnlyExhaustedPasses = 0;
                 stream.end();
                 return;
             }
+            if (result.result === 'rate_limited' || result.classification?.status !== undefined || result.classification?.hadRetryAfterHeader === true)
+                sawHttpEvidence = true;
             const cooldownMs = result.result === 'rate_limited' ? result.retryAfterMs ?? DEFAULT_RATE_LIMIT_BACKOFF_MS : TRANSIENT_ROTATE_COOLDOWN_MS;
             if (result.result === 'transient_exhausted')
                 lastTransientFailure = result;
@@ -628,10 +669,21 @@ async function runManagedProvider(state, model, context, options, stream) {
     const coolingDeadline = earliestCoolingDeadline([...knownRoutes.values()], localCoolingDeadlines);
     const tried = [...attemptedRoutes].join(', ');
     if (lastTransientFailure !== undefined) {
+        state.transportOnlyExhaustedPasses = sawHttpEvidence ? 0 : state.transportOnlyExhaustedPasses + 1;
+        if (state.transportOnlyExhaustedPasses >= POISONED_TRANSPORT_PASS_LIMIT && activeTerminatePoisonedProcess(tried)) {
+            // The stream is deliberately left OPEN: the SIGTERM handler sees a live
+            // turn, so it either certifies a clean abort (→ the daemon respawns and
+            // resumes with a continuation prompt) or marks the turn dirty (→ the
+            // respawn re-cycles the turn). Ending the stream first could settle the
+            // turn idle before the signal lands, leaving the respawned node parked
+            // with a terminal error and nothing to re-drive it.
+            return;
+        }
         const detail = lastTransientFailure.failureMessage ?? lastTransientFailure.classification?.reason ?? 'unknown connection failure';
         emitTerminalError(stream, terminalModel, `Provider routes failed after transient retries: ${detail} (tried ${tried})`);
         return;
     }
+    state.transportOnlyExhaustedPasses = 0;
     if (coolingDeadline !== undefined) {
         emitCoolingError(stream, terminalModel, new ManagedProviderCoolingError(`All provider routes are rate limited (cooling down ~${Math.ceil((coolingDeadline - Date.now()) / 1000)}s; tried ${tried})`, coolingDeadline));
         return;
@@ -803,8 +855,10 @@ const MANUAL_CODE_DIALOG = {
 async function loginProvider(providerId, ctx) {
     const oauth = oauthFlow(providerId, ctx);
     const manual = MANUAL_CODE_DIALOG[providerId];
+    const controller = new AbortController();
     let authorizeUrl;
     return loginWithManualInputCleanup(ctx, (readCode, dismissManual) => oauth.login({
+        signal: controller.signal,
         notify: (event) => {
             switch (event.type) {
                 case "auth_url":
@@ -843,7 +897,7 @@ async function loginProvider(providerId, ctx) {
             }
             return (await ctx.ui.input(prompt.message, prompt.placeholder ?? "")) ?? "";
         },
-    }));
+    })).finally(() => controller.abort());
 }
 export function createProviderRotationExtension(options) {
     const state = createProviderRotationState(options);

package/dist/builtin-pi-packages/pi-crtr-extensions/extensions/provider-rotation.ts

@@ -77,10 +77,13 @@ type ProviderRotationState = {
   extensionAPI?: ExtensionAPI;
   delegatedProviderStreams: Map<string, ProviderStream>;
   options?: Readonly<ProviderRotationOptions>;
+  /** Consecutive route-queue passes that exhausted every route without a single
+   * HTTP response — the poisoned-process signature counted across turns. */
+  transportOnlyExhaustedPasses: number;
 };
 
 function createProviderRotationState(options?: ProviderRotationOptions): ProviderRotationState {
-  return { delegatedProviderStreams: new Map(), ...(options === undefined ? {} : { options: { ...options } }) };
+  return { delegatedProviderStreams: new Map(), transportOnlyExhaustedPasses: 0, ...(options === undefined ? {} : { options: { ...options } }) };
 }
 
 function configuredValue(state: ProviderRotationState, key: keyof ProviderRotationOptions, envName: string): string | undefined {
@@ -169,6 +172,38 @@ export function __setSleepForTest(fn: typeof defaultSleep | undefined): void {
   activeSleep = fn ?? defaultSleep;
 }
 
+// After this many CONSECUTIVE route-queue passes in which every failure was
+// transport-level (no HTTP status and no Retry-After header — the provider was
+// never reached at all), the broker process itself is presumed poisoned: a
+// corrupted large TLS upload can leave Node/undici's HTTP/2 session permanently
+// destroyed, after which EVERY provider request from this process fails while
+// curl and fresh processes on the same host succeed. There is no clean in-process
+// heal (the dispatcher cannot be safely re-instantiated), so the recovery is a
+// fresh process: self-terminate via SIGTERM and let the daemon's exit policy
+// respawn this broker against the same session. A genuine full network outage
+// also trips this — harmlessly: the respawned broker fails the same way and the
+// daemon's respawn backoff paces the loop.
+export const POISONED_TRANSPORT_PASS_LIMIT = 2;
+
+function defaultTerminatePoisonedProcess(tried: string): boolean {
+  // Only the broker process itself may self-terminate: runBroker stamps
+  // CRTR_BROKER_PID with its own pid at boot. Any other host (tests, tooling)
+  // keeps the ordinary terminal-error path.
+  if (process.env["CRTR_BROKER_PID"] !== String(process.pid)) return false;
+  logRotation(
+    `process transport poisoned: ${POISONED_TRANSPORT_PASS_LIMIT} consecutive route-queue passes failed with no HTTP response (tried ${tried}); exiting so the daemon respawns this broker fresh`,
+  );
+  process.kill(process.pid, "SIGTERM");
+  return true;
+}
+
+let activeTerminatePoisonedProcess = defaultTerminatePoisonedProcess;
+
+/** Test-only seam: override poisoned-process self-termination. Pass undefined to restore the default. */
+export function __setTerminatePoisonedProcessForTest(fn: typeof defaultTerminatePoisonedProcess | undefined): void {
+  activeTerminatePoisonedProcess = fn ?? defaultTerminatePoisonedProcess;
+}
+
 function isSubscriptionLockContention(error: unknown): boolean {
   const value = error as { code?: unknown; message?: unknown } | undefined;
   return value?.code === "ELOCKED" || (typeof value?.message === "string" && /lock file is already being held/i.test(value.message));
@@ -290,11 +325,22 @@ function oauthFlow(providerId: ManagedProviderId, ctx: ExtensionContext | undefi
 
 // `refresh` is a pure token exchange that reads only `credential.refresh` and persists
 // nothing; crouter records the rotated token in the selected pool row.
-async function defaultRefreshForProvider(state: ProviderRotationState, providerId: ManagedProviderId, refreshToken: string): Promise<RefreshedCredential> {
-  return oauthFlow(providerId, state.runtimeContext).refresh({ type: "oauth", refresh: refreshToken, access: "", expires: 0 });
+async function defaultRefreshForProvider(
+  state: ProviderRotationState,
+  providerId: ManagedProviderId,
+  refreshToken: string,
+  parentSignal?: AbortSignal,
+): Promise<RefreshedCredential> {
+  const localController = parentSignal === undefined ? new AbortController() : undefined;
+  const signal = parentSignal ?? localController!.signal;
+  try {
+    return await oauthFlow(providerId, state.runtimeContext).refresh({ type: "oauth", refresh: refreshToken, access: "", expires: 0 }, signal);
+  } finally {
+    localController?.abort();
+  }
 }
 
-type RefreshForProvider = (providerId: ManagedProviderId, refreshToken: string) => Promise<RefreshedCredential>;
+type RefreshForProvider = (providerId: ManagedProviderId, refreshToken: string, signal?: AbortSignal) => Promise<RefreshedCredential>;
 
 // Indirection so tests can inject refresh failures without real network calls.
 let activeRefreshForProvider: RefreshForProvider | undefined;
@@ -328,21 +374,30 @@ function openBrowser(url: string): void {
 // `getApiKey`, which wraps pi-ai's `getOAuthApiKey` and collapses a refresh failure into a
 // generic message; calling `activeRefreshForProvider` directly keeps the real error intact so
 // `isInvalidRefreshTokenError` can classify it (cooldown -> reauth -> cross-provider-fallback).
-async function refreshCredentialIfNeeded(state: ProviderRotationState, providerId: ManagedProviderId, credential: SubscriptionCredential): Promise<ResolvedCredential> {
+async function refreshCredentialIfNeeded(
+  state: ProviderRotationState,
+  providerId: ManagedProviderId,
+  credential: SubscriptionCredential,
+  signal?: AbortSignal,
+): Promise<ResolvedCredential> {
   if (!credential.refresh || !credential.access || credential.expires === undefined) {
     throw new Error(`${getProviderLabel(providerId)} subscription "${credential.label}" is missing its credential value`);
   }
   if (credential.expires > Date.now()) return credential as ResolvedCredential;
   const refreshed = await refreshSubscriptionCredential(providerId, credential.label, (token) =>
-    activeRefreshForProvider?.(providerId, token) ?? defaultRefreshForProvider(state, providerId, token),
+    activeRefreshForProvider?.(providerId, token, signal) ?? defaultRefreshForProvider(state, providerId, token, signal),
   );
   return { ...credential, ...refreshed } as ResolvedCredential;
 }
 
 /** Test-only seam: exercises the real `refreshCredentialIfNeeded` (including its locked refresh
  * transaction) without duplicating its logic. */
-export async function __refreshCredentialIfNeededForTest(providerId: ManagedProviderId, credential: SubscriptionCredential): Promise<ResolvedCredential> {
-  return refreshCredentialIfNeeded(createProviderRotationState(), providerId, credential);
+export async function __refreshCredentialIfNeededForTest(
+  providerId: ManagedProviderId,
+  credential: SubscriptionCredential,
+  signal?: AbortSignal,
+): Promise<ResolvedCredential> {
+  return refreshCredentialIfNeeded(createProviderRotationState(), providerId, credential, signal);
 }
 
 async function defaultLoginForProvider(providerId: ManagedProviderId, ctx: ExtensionContext): Promise<LoginCredential> {
@@ -706,6 +761,10 @@ async function runManagedProvider(
   const cooldownAttempts = new Map<string, number>();
   let terminalModel = model;
   let lastTransientFailure: AttemptResult | undefined;
+  // Any HTTP response observed this pass (a status, a Retry-After header, or a
+  // rate-limit classification) proves this process can still reach a provider,
+  // clearing the poisoned-transport suspicion.
+  let sawHttpEvidence = false;
 
   for (let candidate = candidates.shift(); candidate !== undefined; candidate = candidates.shift()) {
     const { routeId, providerId, model: candidateModel } = candidate;
@@ -721,8 +780,8 @@ async function runManagedProvider(
 
     if (!isManagedProvider(providerId)) {
       const result = await streamProviderAttempt(state, providerId, candidateModel, context, options, undefined, stream);
-      if (result.result === 'success') { stream.end(); return; }
-      if (result.result === 'fatal') { stream.end(); return; }
+      if (result.result === 'success' || result.result === 'fatal') { state.transportOnlyExhaustedPasses = 0; stream.end(); return; }
+      if (result.result === 'rate_limited' || result.classification?.status !== undefined || result.classification?.hadRetryAfterHeader === true) sawHttpEvidence = true;
       const cooldownMs = result.result === 'rate_limited' ? result.retryAfterMs ?? DEFAULT_RATE_LIMIT_BACKOFF_MS : TRANSIENT_ROTATE_COOLDOWN_MS;
       if (result.result === 'transient_exhausted') lastTransientFailure = result;
       localCoolingDeadlines.set(routeId, Math.max(localCoolingDeadlines.get(routeId) ?? 0, Date.now() + cooldownMs));
@@ -741,7 +800,7 @@ async function runManagedProvider(
     for (const credential of available) {
       let freshCredential: ResolvedCredential;
       try {
-        freshCredential = await refreshCredentialIfNeeded(state, providerId, credential);
+        freshCredential = await refreshCredentialIfNeeded(state, providerId, credential, options?.signal);
       } catch (error) {
         if (!isInvalidRefreshTokenError(error)) throw error;
         let reauthenticated: ResolvedCredential | undefined;
@@ -758,11 +817,13 @@ async function runManagedProvider(
       }
       const result = await streamProviderAttempt(state, providerId, candidateModel, context, options, freshCredential, stream);
       if (result.result === 'success') {
+        state.transportOnlyExhaustedPasses = 0;
         if (freshCredential.rateLimitedUntil || freshCredential.authFailure) await recordSubscriptionMutation(`recording ${getProviderLabel(providerId)} success`, () => markSubscriptionSuccess(providerId, freshCredential.label, result.attemptAt));
         stream.end();
         return;
       }
-      if (result.result === 'fatal') { stream.end(); return; }
+      if (result.result === 'fatal') { state.transportOnlyExhaustedPasses = 0; stream.end(); return; }
+      if (result.result === 'rate_limited' || result.classification?.status !== undefined || result.classification?.hadRetryAfterHeader === true) sawHttpEvidence = true;
       const cooldownMs = result.result === 'rate_limited' ? result.retryAfterMs ?? DEFAULT_RATE_LIMIT_BACKOFF_MS : TRANSIENT_ROTATE_COOLDOWN_MS;
       if (result.result === 'transient_exhausted') lastTransientFailure = result;
       if (result.result === 'rate_limited' && result.retryAfterMs !== undefined) {
@@ -782,10 +843,21 @@ async function runManagedProvider(
   const coolingDeadline = earliestCoolingDeadline([...knownRoutes.values()], localCoolingDeadlines);
   const tried = [...attemptedRoutes].join(', ');
   if (lastTransientFailure !== undefined) {
+    state.transportOnlyExhaustedPasses = sawHttpEvidence ? 0 : state.transportOnlyExhaustedPasses + 1;
+    if (state.transportOnlyExhaustedPasses >= POISONED_TRANSPORT_PASS_LIMIT && activeTerminatePoisonedProcess(tried)) {
+      // The stream is deliberately left OPEN: the SIGTERM handler sees a live
+      // turn, so it either certifies a clean abort (→ the daemon respawns and
+      // resumes with a continuation prompt) or marks the turn dirty (→ the
+      // respawn re-cycles the turn). Ending the stream first could settle the
+      // turn idle before the signal lands, leaving the respawned node parked
+      // with a terminal error and nothing to re-drive it.
+      return;
+    }
     const detail = lastTransientFailure.failureMessage ?? lastTransientFailure.classification?.reason ?? 'unknown connection failure';
     emitTerminalError(stream, terminalModel, `Provider routes failed after transient retries: ${detail} (tried ${tried})`);
     return;
   }
+  state.transportOnlyExhaustedPasses = 0;
   if (coolingDeadline !== undefined) {
     emitCoolingError(stream, terminalModel, new ManagedProviderCoolingError(`All provider routes are rate limited (cooling down ~${Math.ceil((coolingDeadline - Date.now()) / 1000)}s; tried ${tried})`, coolingDeadline));
     return;
@@ -971,9 +1043,11 @@ const MANUAL_CODE_DIALOG: Record<ManagedProviderId, { title: (url: string | unde
 async function loginProvider(providerId: ManagedProviderId, ctx: ExtensionContext): Promise<LoginCredential> {
   const oauth = oauthFlow(providerId, ctx);
   const manual = MANUAL_CODE_DIALOG[providerId];
+  const controller = new AbortController();
   let authorizeUrl: string | undefined;
   return loginWithManualInputCleanup(ctx, (readCode, dismissManual) =>
     oauth.login({
+      signal: controller.signal,
       notify: (event: AuthEvent): void => {
         switch (event.type) {
           case "auth_url":
@@ -1010,7 +1084,7 @@ async function loginProvider(providerId: ManagedProviderId, ctx: ExtensionContex
         return (await ctx.ui.input(prompt.message, prompt.placeholder ?? "")) ?? "";
       },
     }),
-  );
+  ).finally(() => controller.abort());
 }
 
 export function createProviderRotationExtension(options?: ProviderRotationOptions): (pi: ExtensionAPI) => Promise<void> {

package/dist/clients/attach/__tests__/chat-view-snapshot-ordering.test.js

@@ -17,7 +17,7 @@
 //      otherwise its unmounted Loader keeps requesting renders every 80 ms.
 import assert from 'node:assert/strict';
 import test from 'node:test';
-import { Container, TUI } from '@earendil-works/pi-tui';
+import { Container, TuiMainScreen } from '@earendil-works/pi-tui';
 import { AssistantMessageComponent, UserMessageComponent, initTheme, } from '@earendil-works/pi-coding-agent';
 import { ChatView } from '../render/chat-view.js';
 /** A headless terminal so TUI.requestRender's scheduled writes are no-ops (the
@@ -42,7 +42,7 @@ function fakeTerminal() {
     };
 }
 function makeChatView() {
-    const tui = new TUI(fakeTerminal());
+    const tui = new TuiMainScreen(fakeTerminal());
     const container = new Container();
     const view = new ChatView(tui, container);
     const internals = view;

package/dist/clients/attach/__tests__/group-activity.test.js

@@ -7,7 +7,7 @@
 //      must never leak into it.
 import assert from 'node:assert/strict';
 import test from 'node:test';
-import { Container, TUI } from '@earendil-works/pi-tui';
+import { Container, TuiMainScreen } from '@earendil-works/pi-tui';
 import { initTheme } from '@earendil-works/pi-coding-agent';
 import { ChatView } from '../render/chat-view.js';
 import { GroupActivityRecorder } from '../render/group-activity.js';
@@ -21,7 +21,7 @@ function fakeTerminal() {
 }
 initTheme(undefined, false);
 async function summarizedGroup(messages, key) {
-    const view = new ChatView(new TUI(fakeTerminal()), new Container());
+    const view = new ChatView(new TuiMainScreen(fakeTerminal()), new Container());
     const internals = view;
     internals.foldSettledTools = true;
     internals.showGroupSummaries = true;

package/dist/clients/attach/chrome/canvas-panels.d.ts

@@ -35,7 +35,7 @@ export interface CanvasPanelLines {
     items: CanvasPanelItem[];
 }
 /** Build the BASE panel line stacks for `nodeId`. `asks` is the per-node
- *  pending human-ticket count map the caller polls (deck/review/notify); pass
+ *  pending human-ticket count map the caller polls (page/review); pass
  *  `{}` to omit the ⚑ badges. `crons` are this node's armed schedules.
  *  `palette`
  *  drives the headers + dim cells; omit it and the panels render uncolored. */

package/dist/clients/attach/chrome/canvas-panels.js

@@ -39,7 +39,7 @@ function padStartVisible(s, w) {
     return s.length >= w ? s.slice(0, w) : ' '.repeat(w - s.length) + s;
 }
 /** Build the BASE panel line stacks for `nodeId`. `asks` is the per-node
- *  pending human-ticket count map the caller polls (deck/review/notify); pass
+ *  pending human-ticket count map the caller polls (page/review); pass
  *  `{}` to omit the ⚑ badges. `crons` are this node's armed schedules.
  *  `palette`
  *  drives the headers + dim cells; omit it and the panels render uncolored. */