@north-light/crouter 0.3.197 → 0.3.198

package/dist/core/canvas/browse/app.js

@@ -20,7 +20,7 @@ const BROWSE_NAV_ACTIONS = [
     'crtr.browse.tab-next', 'crtr.browse.tab-previous', 'crtr.browse.tab.1', 'crtr.browse.tab.2',
     'crtr.browse.tab.3', 'crtr.browse.tab.4', 'crtr.browse.tab.5', 'crtr.browse.close-subtree', 'crtr.browse.sort',
     'crtr.browse.scope', 'crtr.browse.profile', 'crtr.browse.residents', 'crtr.browse.preview', 'crtr.browse.search',
-    'crtr.browse.revive-now', 'crtr.browse.focus', 'crtr.browse.focus-background',
+    'crtr.browse.revive-now', 'crtr.browse.focus', 'crtr.browse.focus-background', 'crtr.browse.yank-id',
 ];
 const BROWSE_SEARCH_ACTIONS = [
     'crtr.browse.search.cancel', 'crtr.browse.search.commit', 'crtr.browse.search.delete',
@@ -39,6 +39,7 @@ export function resolveBrowseSearchAction(bindings, raw) {
 // press restores the structural `tree` view, then relevance/recency, then back.
 const SORT_CYCLE = ['attention', 'tree', 'relevance', 'recency'];
 import { renderFrame, detectColorCaps, headerHeight, PREVIEW_HEIGHT } from './render.js';
+import { writeClipboardTextEverywhere } from '../../clipboard-text.js';
 /** Viewport (body) height = total rows minus the header renderFrame draws (see
  *  render.ts headerHeight), the footer, and the preview panel when shown. Kept
  *  in lockstep with render.ts via the shared headerHeight/PREVIEW_HEIGHT. */
@@ -102,7 +103,9 @@ export async function runBrowse(opts) {
     // canvas-wide because there is no truthful profile to select.
     const launchProfileId = opts.profileId;
     const state = {
-        tab: 'All',
+        // Open on Live (active|idle): the navigator's job is getting you back to a
+        // node you are working with, and All buries those under every dormant row.
+        tab: 'Live',
         cursor: 0,
         // Initial collapse = every node with children → only roots/top-level show.
         collapsed: new Set([...tree.nodes.entries()].filter(([, n]) => n.childIds.length > 0).map(([id]) => id)),
@@ -115,6 +118,7 @@ export async function runBrowse(opts) {
         preview: true, // default ON (decision)
         residentsOnly: true, // default ON: hide one-shot workers (decision)
         pendingClose: null,
+        flash: null,
         pinned: loadPins(),
         help: false,
         rename: false,
@@ -242,7 +246,7 @@ export async function runBrowse(opts) {
             tree, visible, tab: state.tab, cursor: state.cursor, scrollOffset: state.scrollOffset,
             query: state.query, search: state.search, totalNodes,
             cwdScope: state.cwdScope, profileScope: state.profileScope, sort: state.sort, preview: state.preview,
-            residentsOnly: state.residentsOnly, pendingClose: state.pendingClose,
+            residentsOnly: state.residentsOnly, pendingClose: state.pendingClose, flash: state.flash,
             pinned: state.pinned, help: state.help,
             rename: state.rename, renameBuf: state.renameBuf,
             message: state.message, messageBuf: state.messageBuf,
@@ -542,6 +546,8 @@ export async function runBrowse(opts) {
     const onKeyNav = (input, key) => {
         const raw = { input, ...key };
         const action = resolveBrowseNavAction(bindings, raw);
+        // Any keystroke retires the previous one-shot footer confirmation.
+        state.flash = null;
         // Unbound ctrl-combos are swallowed so they never masquerade as printable commands.
         if (key.ctrl && action === null)
             return;
@@ -756,6 +762,18 @@ export async function runBrowse(opts) {
             scheduleFlush();
             return;
         }
+        // Yank the hovered node's id to the system clipboard, so it can be pasted into
+        // a prompt or another command without retyping it off the screen.
+        if (action === 'crtr.browse.yank-id') {
+            if (row !== undefined) {
+                const { system, tmux } = writeClipboardTextEverywhere(row.id);
+                state.flash = system || tmux
+                    ? `Copied ${row.id}${system ? '' : ' to the tmux buffer'}`
+                    : 'No clipboard tool available — nothing copied';
+            }
+            scheduleFlush();
+            return;
+        }
         // Resume the selected node.
         if (action === 'crtr.browse.focus') {
             if (row !== undefined)

package/dist/core/canvas/browse/render.d.ts

@@ -43,6 +43,10 @@ export interface RenderState {
      *  a descendant) is actively streaming. Holds the node id being confirmed; the
      *  footer becomes the y/n prompt. null/undefined = no pending confirm. */
     pendingClose?: string | null;
+    /** One-shot footer confirmation for a keystroke whose whole effect is off-screen
+     *  (`y` yank). Replaces the nav hints for exactly one frame; the app clears it on
+     *  the next key. null/undefined = show the ordinary footer. */
+    flash?: string | null;
     /** Set when the source is a remote canvas: mutation/focus keys (`x`/`K`/Enter)
      *  are disabled, so the footer drops their hints instead of advertising a
      *  dead action. undefined/false = local, byte-identical footer. */

package/dist/core/canvas/browse/render.js

@@ -428,7 +428,8 @@ const HELP_ROWS = [
     ['Pin', 'f', 'star / unstar — floats to top, Pinned tab'],
     ['Open', '⏎  o', 'resume the node (closes navigator)'],
     ['', 'O', 'resume, keep browsing (open in background)'],
-    ['Act', 'm', 'message the node (no resume)'],
+    ['Act', 'y', 'copy the node id to the clipboard'],
+    ['', 'm', 'message the node (no resume)'],
     ['', 'R', 'rename the node'],
     ['', 'x', 'close-out node + subtree'],
     ['', 'K', 'revive now (a hanging node)'],
@@ -533,6 +534,9 @@ export function renderFrame(state, size, caps = { color: false, color256: false
         const warn = `⚠ ${who} is ⟳ — close it (and its subtree) anyway?  y / n`;
         lines.push(caps.color ? `${BOLD}${ESC}${FG_BRIGHT_YELLOW}m${clip(warn, width)}${RESET}` : `${REVERSE}${clip(warn, width)}${RESET}`);
     }
+    else if (state.flash !== null && state.flash !== undefined && state.flash !== '') {
+        lines.push(caps.color ? `${BOLD}${clip(state.flash, width)}${RESET}` : `${REVERSE}${clip(state.flash, width)}${RESET}`);
+    }
     else {
         // When the cursor row has an active fault, lead the footer with the on-demand kick
         // hint (K shells `node lifecycle revive <id> --now` — immediate revive instead of

package/dist/core/canvas/canvas.d.ts

@@ -206,6 +206,11 @@ export declare function view(root: string): string[];
  *  that's still live (active|idle) — i.e. something that can actually wake it?
  *  If so, stopping is a legitimate await; if not, it must finish or escalate. */
 export declare function hasActiveLiveSubscription(nodeId: string): boolean;
+/** Whether a LIVE node still subscribes to this one. The mirror of
+ * `hasActiveLiveSubscription`: that asks what can still wake this node, this
+ * asks what this node still owes — a subscriber that is itself active or idle
+ * is waiting on a report this node has not delivered. */
+export declare function hasLiveSubscriber(nodeId: string): boolean;
 /** Whether a node explicitly awaits a controller that can still deliver. A
  * parent relationship never implies this wait; the node must declare it. */
 export declare function hasLiveMessageWait(nodeId: string): boolean;
@@ -324,6 +329,27 @@ export declare function pruneNodes(opts: {
     dryRun?: boolean;
     includeStale?: boolean;
 }): PruneResult;
+/** Drop rows whose on-disk `nodes/<id>/` dir is gone — a node that no longer
+ *  exists in the only place it is durably stored.
+ *
+ *  `createNode` scaffolds the dir and writes meta.json BEFORE seeding the row, and
+ *  both delete paths ({@link deleteNode}, `deletePrunedNodes`) commit the row
+ *  removal BEFORE removing the dir, so a row with no dir is never a transient of
+ *  either — it is a node whose durable state was lost. Nothing about it is
+ *  recoverable: `getNode` reads meta.json and returns null, so every surface that
+ *  resolves a node (revive, focus, close, rename, message) rejects it as unknown
+ *  while the roster keeps listing it. The row IS the residue, so deleting it is
+ *  the whole repair; there is no dir left to remove.
+ *
+ *  Because `active`/`idle` ghosts are the ones that jam surfaces, status is not a
+ *  filter here — count-based pruning protects those rows precisely so daemon
+ *  crash-recovery can resume them, and that reason does not survive the dir being
+ *  gone.
+ *
+ *  Refuses to act on "can't tell": an unreadable nodes root, or a readable one
+ *  holding no node dirs at all while rows exist, reads as a detached or wiped
+ *  store rather than per-node loss, and reaps nothing. Returns the reaped ids. */
+export declare function reapGhostRows(): string[];
 /** Count-based retention sweep: retain the `maxNodes` MOST-RECENTLY-ACTIVE
  *  nodes plus every protected node, so the real retained floor is
  *  `max(maxNodes, protectedCount)`. Bounds the otherwise-unbounded growth the

package/dist/core/canvas/canvas.js

@@ -591,6 +591,18 @@ export function hasActiveLiveSubscription(nodeId) {
         .get(nodeId);
     return r !== undefined;
 }
+/** Whether a LIVE node still subscribes to this one. The mirror of
+ * `hasActiveLiveSubscription`: that asks what can still wake this node, this
+ * asks what this node still owes — a subscriber that is itself active or idle
+ * is waiting on a report this node has not delivered. */
+export function hasLiveSubscriber(nodeId) {
+    const r = openDb()
+        .prepare(`SELECT 1 FROM edges e JOIN nodes n ON n.node_id = e.from_id
+       WHERE e.type = 'subscribes_to' AND e.to_id = ? AND e.active = 1
+         AND n.status IN ('active', 'idle') LIMIT 1`)
+        .get(nodeId);
+    return r !== undefined;
+}
 /** Whether a node explicitly awaits a controller that can still deliver. A
  * parent relationship never implies this wait; the node must declare it. */
 export function hasLiveMessageWait(nodeId) {
@@ -789,6 +801,49 @@ export function pruneNodes(opts) {
     deletePrunedNodes(candidates);
     return { pruned: candidates, dryRun };
 }
+/** Drop rows whose on-disk `nodes/<id>/` dir is gone — a node that no longer
+ *  exists in the only place it is durably stored.
+ *
+ *  `createNode` scaffolds the dir and writes meta.json BEFORE seeding the row, and
+ *  both delete paths ({@link deleteNode}, `deletePrunedNodes`) commit the row
+ *  removal BEFORE removing the dir, so a row with no dir is never a transient of
+ *  either — it is a node whose durable state was lost. Nothing about it is
+ *  recoverable: `getNode` reads meta.json and returns null, so every surface that
+ *  resolves a node (revive, focus, close, rename, message) rejects it as unknown
+ *  while the roster keeps listing it. The row IS the residue, so deleting it is
+ *  the whole repair; there is no dir left to remove.
+ *
+ *  Because `active`/`idle` ghosts are the ones that jam surfaces, status is not a
+ *  filter here — count-based pruning protects those rows precisely so daemon
+ *  crash-recovery can resume them, and that reason does not survive the dir being
+ *  gone.
+ *
+ *  Refuses to act on "can't tell": an unreadable nodes root, or a readable one
+ *  holding no node dirs at all while rows exist, reads as a detached or wiped
+ *  store rather than per-node loss, and reaps nothing. Returns the reaped ids. */
+export function reapGhostRows() {
+    const rows = listNodes();
+    if (rows.length === 0)
+        return [];
+    let onDisk;
+    try {
+        onDisk = new Set(readdirSync(nodesRoot()));
+    }
+    catch {
+        return []; // nodes root absent or unreadable — can't tell, so touch nothing
+    }
+    if (onDisk.size === 0)
+        return [];
+    const ghosts = rows.map((r) => r.node_id).filter((id) => !onDisk.has(id));
+    if (ghosts.length === 0)
+        return [];
+    withCanvasWrite((db) => {
+        const del = db.prepare('DELETE FROM nodes WHERE node_id = ?');
+        for (const id of ghosts)
+            del.run(id);
+    });
+    return ghosts;
+}
 /** Hard-delete a set of pruned nodes in one transaction (the edges→nodes and
  *  anchored-crons FKs cascade their coupled state), followed by best-effort
  *  on-disk `nodes/<id>/` removal. Shared by TTL and count pruning so their

package/dist/core/command.js

@@ -439,9 +439,8 @@ export async function parseArgv(params, tokens, options) {
             throw parseArgvError('bad_invocation', `unexpected extra positional argument: ${token}`, tokens.join(' '), undefined, 'Use --flag for parameters; only one positional allowed.');
         }
         // A bare positional is accepted when the leaf declares a positional param,
-        // OR when it declares a stdin param (the positional supplies the stdin
-        // value as an ergonomic alternative to piping). Otherwise it's an error.
-        if (positionalParam === undefined && stdinParam === undefined) {
+        // or when its stdin parameter explicitly permits a positional body.
+        if (positionalParam === undefined && (stdinParam === undefined || stdinParam.allowPositional === false)) {
             throw parseArgvError('bad_invocation', `this leaf takes no positional arguments: ${token}`, token, undefined, 'Use --flag for parameters. Run -h for the schema.');
         }
         positionalValues.push(token);
@@ -454,16 +453,12 @@ export async function parseArgv(params, tokens, options) {
             ? positionalValues
             : positionalValues[0];
     }
-    // Resolve stdin if declared. A positional token (when there's no dedicated
-    // positional param to claim it) satisfies the stdin param directly, so
-    // `crtr node new "Say hi"` works as well as piping on stdin. `-` is the
-    // standard Unix convention for "read stdin instead" — it always reads,
-    // never becomes the literal value. And a positional alongside genuinely
-    // piped, non-empty stdin is ambiguous: never silently pick one, error loud
-    // and name both sources.
+    // Resolve stdin if declared. Some leaves permit one positional token to
+    // supply the stdin body; `-` then means read stdin. A positional alongside
+    // genuinely piped, non-empty stdin is ambiguous and errors loudly.
     let stdinWasSupplied = false;
     if (stdinParam !== undefined) {
-        if (positionalValues.length > 0 && positionalParam === undefined) {
+        if (positionalValues.length > 0 && positionalParam === undefined && stdinParam.allowPositional !== false) {
             const positionalValue = positionalValues[0];
             if (positionalValue === '-') {
                 const raw = await readStdinRaw();

package/dist/core/config.js

@@ -479,8 +479,8 @@ function mergeConfig(partial) {
         ? [...defaults.working_gerunds]
         : normalizeWorkingGerunds(partial.working_gerunds);
     const whip_mode = typeof partial.whip_mode === 'boolean' ? partial.whip_mode : defaults.whip_mode;
-    const html_pages = typeof partial.html_pages === 'boolean' ? partial.html_pages : defaults.html_pages;
     const page_components = normalizePageComponents(partial.page_components);
+    const html_surface = typeof partial.html_surface === 'boolean' ? partial.html_surface : defaults.html_surface;
     const whip_messages = normalizeWhipMessages(partial.whip_messages);
     const mouse_mode_default = MOUSE_MODE_DEFAULTS.includes(partial.mouse_mode_default)
         ? partial.mouse_mode_default
@@ -489,6 +489,7 @@ function mergeConfig(partial) {
     const condensed_history = CONDENSED_HISTORY_MODES.includes(partial.condensed_history)
         ? partial.condensed_history
         : defaults.condensed_history;
+    const bash_tool_purpose = typeof partial.bash_tool_purpose === 'boolean' ? partial.bash_tool_purpose : defaults.bash_tool_purpose;
     const fold_finished_tools = typeof partial.fold_finished_tools === 'boolean' ? partial.fold_finished_tools : defaults.fold_finished_tools;
     const summarize_tool_calls = typeof partial.summarize_tool_calls === 'boolean' ? partial.summarize_tool_calls : defaults.summarize_tool_calls;
     const detailed_tool_recaps = typeof partial.detailed_tool_recaps === 'boolean' ? partial.detailed_tool_recaps : defaults.detailed_tool_recaps;
@@ -500,7 +501,7 @@ function mergeConfig(partial) {
     const kinds = mergeKinds(partial.kinds);
     const remoteCanvas = mergeRemoteCanvas(partial.remoteCanvas);
     const spawnEnv = mergeSpawnEnv(partial.spawnEnv, defaults.spawnEnv?.allow);
-    return { schema_version, marketplaces, plugins, auto_update, max_panes_per_window, auto_open_child_viewers, brokerThresholds, completion_bell, working_gerunds, whip_mode, html_pages, page_components, whip_messages, mouse_mode_default, live_cycles, condensed_history, fold_finished_tools, summarize_tool_calls, detailed_tool_recaps, keybindings, tmux_passthrough, modelLadders, ...(Object.keys(modelRoutes).length > 0 ? { modelRoutes } : {}), ...(modelRouting !== undefined ? { modelRouting } : {}), kinds, remoteCanvas, spawnEnv };
+    return { schema_version, marketplaces, plugins, auto_update, max_panes_per_window, auto_open_child_viewers, brokerThresholds, completion_bell, working_gerunds, whip_mode, page_components, html_surface, whip_messages, mouse_mode_default, live_cycles, condensed_history, bash_tool_purpose, fold_finished_tools, summarize_tool_calls, detailed_tool_recaps, keybindings, tmux_passthrough, modelLadders, ...(Object.keys(modelRoutes).length > 0 ? { modelRoutes } : {}), ...(modelRouting !== undefined ? { modelRouting } : {}), kinds, remoteCanvas, spawnEnv };
 }
 /** Raw (un-defaulted) partial config for one scope, or null if the scope has
  *  no root or no config.json. Used by `readMergedLaunchConfig` to layer

package/dist/core/help.d.ts

@@ -64,6 +64,9 @@ export interface StdinParam {
     name: string;
     required: boolean;
     constraint: string;
+    /** Whether one positional token may supply stdin instead of a pipe. Defaults
+     * to true for existing stdin-body leaves; false requires actual stdin. */
+    allowPositional?: boolean;
 }
 /** --context-file PATH: reads and JSON-parses the file at PATH. */
 export interface ContextFileParam {

package/dist/core/human/__tests__/html-markdown.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/core/human/__tests__/html-markdown.test.js

@@ -0,0 +1,52 @@
+import assert from 'node:assert/strict';
+import test from 'node:test';
+import { RICH_PAGE_PLACEHOLDER, renderHtmlProseAsMarkdown } from '../html-markdown.js';
+test('downconverts bounded semantic HTML page prose without raw tag leakage', () => {
+    const markdown = renderHtmlProseAsMarkdown(`<!doctype html><html><head><title>ignored</title></head><body>
+    <h2>Release <em>notes</em></h2>
+    <p>Read <strong>this</strong>, <code>npm run build</code>, and <a href="https://example.test/a">details</a>.</p>
+    <ul><li>First</li><li>Second<ul><li>Nested</li></ul></li></ul>
+    <ol><li>One</li></ol>
+    <blockquote><p>Quoted</p></blockquote>
+    <pre><code class="language-ts">const x = 1;</code></pre>
+    <table><thead><tr><th>Name</th><th>State</th></tr></thead><tbody><tr><td>A</td><td>Ready</td></tr></tbody></table>
+    <p>Safe <span style="color:red">text</span>.</p>
+    <div class="custom-chrome">Widget controls</div>
+    <crtr-pages><crtr-page><p>Before <span>slot</span>.</p><crtr-options>ignored config</crtr-options><p>After.</p></crtr-page></crtr-pages>
+    <p>Use &lt;span&gt;x&lt;/span&gt; literally.</p>
+    <p># Not heading<br>&gt; Not quote<br>- Not list<br>1. Not ordered</p>
+  </body></html>`);
+    const expected = `## Release *notes*
+
+Read **this**, \`npm run build\`, and [details](<https://example.test/a>).
+
+- First
+- Second
+  - Nested
+
+1. One
+
+> Quoted
+
+\`\`\`ts
+const x = 1;
+\`\`\`
+
+| Name | State |
+| --- | --- |
+| A | Ready |
+
+Safe text.
+
+${RICH_PAGE_PLACEHOLDER}
+
+Before slot.
+
+After.
+
+Use &lt;span&gt;x&lt;/span&gt; literally.
+
+` + ['\\# Not heading  ', '&gt; Not quote  ', '\\- Not list  ', '1\\. Not ordered'].join('\n');
+    assert.equal(markdown, expected);
+    assert.doesNotMatch(markdown, /<(?:span|div)\b/i);
+});

package/dist/core/human/__tests__/page-catalog.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/core/human/__tests__/page-catalog.test.js

@@ -0,0 +1,16 @@
+import assert from 'node:assert/strict';
+import test from 'node:test';
+import { normalizePageComponents, pageComponentKinds } from '../page-catalog.js';
+test('page component registrations accept legacy names and documented objects', () => {
+    const components = normalizePageComponents([
+        'approval',
+        { kind: 'approval-card', description: 'Approval card', useWhen: 'Use for an approval.', doc: 'Product contract.', display: true },
+    ]);
+    assert.deepEqual(components, [
+        { kind: 'approval' },
+        { kind: 'approval-card', description: 'Approval card', useWhen: 'Use for an approval.', doc: 'Product contract.', display: true },
+    ]);
+    assert.deepEqual(pageComponentKinds(components), ['approval', 'approval-card']);
+    assert.throws(() => normalizePageComponents([{ kind: 'approval', display: 'yes' }]), /page_components\[0\]\.display must be a boolean/);
+    assert.throws(() => normalizePageComponents([{ kind: 'approval', unexpected: true }]), /unknown field\(s\): unexpected/);
+});

package/dist/core/human/__tests__/page-render.test.js

@@ -1,7 +1,5 @@
-// Two properties of the default page template whose absence would be SILENT —
-// every ordinary page still renders and still looks right when either breaks.
-// Nothing else about rendering is pinned here; prose shape is the renderer's
-// own business and a change there is visible the moment anyone looks at a page.
+// An authored HTML slot id must reach the runtime's `slot-id` attribute. Without
+// this pin every element renders but no response reaches the host.
 import assert from 'node:assert/strict';
 import { mkdtempSync, readFileSync, rmSync, writeFileSync } from 'node:fs';
 import { tmpdir } from 'node:os';
@@ -9,41 +7,60 @@ import { join } from 'node:path';
 import test from 'node:test';
 import { derivePageManifest } from '../page.js';
 import { renderPageHtml } from '../page-render.js';
-function render(name, source) {
+import { preparePage } from '../tickets.js';
+function render(source) {
     const dir = mkdtempSync(join(tmpdir(), 'crtr-page-render-test-'));
     try {
-        const path = join(dir, name);
+        const path = join(dir, 'page.html');
         writeFileSync(path, source);
-        return renderPageHtml(derivePageManifest(path, name.endsWith('.md') ? 'md' : 'html'), readFileSync(path, 'utf8'));
+        return renderPageHtml(derivePageManifest(path, 'html'), readFileSync(path, 'utf8'));
     }
     finally {
         rmSync(dir, { recursive: true, force: true });
     }
 }
-test('a config value carrying script markup cannot end its own <script> element', () => {
-    const html = render('page.md', [
-        '---', 'title: Escaping', '---', '',
-        'Pick one.', '',
-        '```slot:options',
-        '{"id":"esc","mode":"single","options":[{"id":"a","label":"</script><script>x</script>"},{"id":"b","label":"<!-- c -->"}]}',
-        '```', '',
-    ].join('\n'));
-    const config = /<crtr-options slot-id="esc"><script type="application\/json">([\s\S]*?)<\/script>/.exec(html)?.[1];
-    assert.ok(config !== undefined, `no options config in payload:\n${html}`);
-    // The mutation this catches: dropping the `<` escape for a plain JSON.stringify.
-    assert.ok(!config.includes('<'), `config text still carries a raw "<": ${config}`);
-    assert.equal(JSON.parse(config).options[0].label, '</script><script>x</script>');
+test('source-backed slots render embedded config, never a filesystem path', () => {
+    const dir = mkdtempSync(join(tmpdir(), 'crtr-page-render-source-'));
+    try {
+        const data = join(dir, 'rows.json');
+        const page = join(dir, 'page.html');
+        writeFileSync(data, JSON.stringify([{ id: 'one', cells: { name: '</script><script>window.pwned=1</script>' } }]));
+        writeFileSync(page, `<!doctype html><html><head><meta name="crtr-page-title" content="Rows"></head><body><crtr-table><script type="application/json">${JSON.stringify({ columns: [{ id: 'name', label: '</scripture>' }], source: data })}</script></crtr-table></body></html>`);
+        const prepared = preparePage({ sourceFile: page, dialect: 'html' });
+        const rendered = renderPageHtml(prepared.manifest, prepared.document);
+        assert.match(rendered, /"rows":\[{"id":"one","cells":\{"name":"\\u003c\/script>\\u003cscript>window\.pwned=1\\u003c\/script>"}}]/);
+        assert.match(rendered, /"label":"\\u003c\/scripture>"/);
+        assert.doesNotMatch(rendered, /"source"|rows\.json|<script>window\.pwned/);
+    }
+    finally {
+        rmSync(dir, { recursive: true, force: true });
+    }
+});
+test('render replacement ignores comments and non-config scripts', () => {
+    const dir = mkdtempSync(join(tmpdir(), 'crtr-page-render-scripts-'));
+    try {
+        const data = join(dir, 'rows.json');
+        const page = join(dir, 'page.html');
+        writeFileSync(data, JSON.stringify([{ id: 'one', cells: { name: 'One' } }]));
+        writeFileSync(page, `<!doctype html><html><head><meta name="crtr-page-title" content="Rows"></head><body><!-- > <crtr-table><script type="application/json">{}</script></crtr-table> --><crtr-table><script data-type="application/json" type="text/plain">KEEP</script><script type="application/json">${JSON.stringify({ columns: [{ id: 'name', label: 'Name' }], source: data })}</script></crtr-table></body></html>`);
+        const prepared = preparePage({ sourceFile: page, dialect: 'html' });
+        const rendered = renderPageHtml(prepared.manifest, prepared.document);
+        assert.match(rendered, /<script data-type="application\/json" type="text\/plain">KEEP<\/script>/);
+        assert.match(rendered, /"rows":\[{"id":"one","cells":\{"name":"One"}}]/);
+        assert.doesNotMatch(rendered, /"source"|rows\.json/);
+    }
+    finally {
+        rmSync(dir, { recursive: true, force: true });
+    }
 });
 test('an authored html slot id is mirrored to the slot-id the runtime reads', () => {
-    const html = render('page.html', [
+    const html = render([
         '<!doctype html><html><head><meta name="crtr-page-title" content="Sign-off"></head><body>',
         '<crtr-pages><crtr-page label="Window">',
         '<crtr-options id="window"><script type="application/json">{"mode":"single","options":[{"id":"sat","label":"Saturday"}]}</script></crtr-options>',
         '</crtr-page></crtr-pages>',
         '</body></html>',
     ].join('\n'));
-    // Without this, every element mounts and renders and no response ever
-    // reaches the host, because `src/pages` keys responses by `slot-id`.
     assert.match(html, /<crtr-options id="window" slot-id="window">/);
     assert.match(html, /<crtr-page label="Window">/);
 });

package/dist/core/human/__tests__/page-tickets.test.js

@@ -9,47 +9,64 @@ const { atomicWriteJson, pageManifestPath, pagePath, progressPath, responsePath
 const { claimTicket } = await import('../claim.js');
 const { scanInbox, scanPageHistory } = await import('../scan.js');
 const { ticketDir } = await import('../root.js');
-const { cancelTicket, completePage, readPageProgress, readPageTicket, readTicketResult, submitPage, takeoverAndCompletePage, writePageProgress, } = await import('../tickets.js');
+const { cancelTicket, completePage, readPageProgress, readPageTicket, preparePage, readTicketResult, submitPage, takeoverAndCompletePage, writePageProgress, } = await import('../tickets.js');
 const sources = mkdtempSync(join(tmpdir(), 'crtr-page-sources-'));
 function sourceFile(name, body) {
     const path = join(sources, name);
     writeFileSync(path, body);
     return path;
 }
-const askPage = sourceFile('ask.md', `---
-title: Rollout scope
-subtitle: Pick tonight's rollout
-placement: inline
----
-
-Which rollout do you want?
-
-\`\`\`slot:options
-{"id": "rollout", "mode": "single", "options": [{"id": "canary", "label": "Canary first"}, {"id": "full", "label": "Full"}]}
-\`\`\`
-`);
+const askPage = sourceFile('ask.html', '<!doctype html><html><head><meta name="crtr-page-title" content="Rollout scope"><meta name="crtr-page-subtitle" content="Pick tonight’s rollout"><meta name="crtr-page-placement" content="inline"></head><body><p>Which rollout do you want?</p><crtr-pages><crtr-page><crtr-options id="rollout"><script type="application/json">{"mode":"single","options":[{"id":"canary","label":"Canary first"},{"id":"full","label":"Full"}]}</script></crtr-options></crtr-page></crtr-pages></body></html>');
 const displayPage = sourceFile('display.html', '<!doctype html><html><head><meta name="crtr-page-title" content="Nightly report"></head><body><h1>All green</h1></body></html>');
-function submit(id, source, dialect, blockedSince, nodeId = 'node-1') {
-    return submitPage({ dir: ticketDir(id), sourceFile: source, dialect, source: { nodeId, blockedSince } }).dir;
+function submit(id, source, dialect, blockedSince, nodeId = 'node-1', mode = 'ask') {
+    const dir = submitPage({ dir: ticketDir(id), sourceFile: source, dialect, source: { nodeId, blockedSince } }).dir;
+    atomicWriteJson(join(dir, 'run.json'), { mode });
+    return dir;
 }
 test('submitPage publishes the authored source, the derived manifest and the blockedSince stamp', () => {
-    const submitted = submitPage({ dir: ticketDir('ask'), sourceFile: askPage, dialect: 'md', source: { nodeId: 'node-1' } });
+    const submitted = submitPage({ dir: ticketDir('ask'), sourceFile: askPage, dialect: 'html', source: { nodeId: 'node-1' } });
     assert.equal(submitted.kind, 'page');
     assert.equal(submitted.id, 'ask');
-    assert.equal(readFileSync(pagePath(submitted.dir, 'md'), 'utf8'), readFileSync(askPage, 'utf8'));
+    assert.equal(readFileSync(pagePath(submitted.dir, 'html'), 'utf8'), readFileSync(askPage, 'utf8'));
     const manifest = JSON.parse(readFileSync(pageManifestPath(submitted.dir), 'utf8'));
     assert.equal(manifest['schema'], 'crtr.page/v1');
-    assert.equal(manifest['document'], 'page.md');
+    assert.equal(manifest['document'], 'page.html');
     assert.equal(manifest['placement'], 'inline');
     const source = manifest['source'];
     assert.equal(source.nodeId, 'node-1');
     assert.ok(Date.parse(source.blockedSince) > 0, 'submission stamps blockedSince');
-    assert.throws(() => submitPage({ dir: ticketDir('ask'), sourceFile: askPage, dialect: 'md' }), /already exists/);
+    assert.throws(() => submitPage({ dir: ticketDir('ask'), sourceFile: askPage, dialect: 'html' }), /already exists/);
+    atomicWriteJson(join(submitted.dir, 'run.json'), { mode: 'ask' });
     const listed = scanInbox().find((item) => item.id === 'ask');
     assert.equal(listed?.kind, 'page');
     assert.equal(listed?.kind === 'page' ? listed.awaitsResponse : undefined, true);
     assert.deepEqual(listed?.kind === 'page' ? listed.slotKinds : undefined, ['options']);
 });
+function tableSourcePage(dataFile) {
+    return `<!doctype html><html><head><meta name="crtr-page-title" content="Data"><meta name="crtr-page-placement" content="inline"></head><body><crtr-pages><crtr-page><crtr-table id="rows"><script type="application/json">${JSON.stringify({ columns: [{ id: 'name', label: 'Name' }], source: dataFile, rowSelect: 'single' })}</script></crtr-table></crtr-page></crtr-pages></body></html>`;
+}
+test('source data is embedded into the submitted manifest', () => {
+    const data = sourceFile('rows.json', JSON.stringify([{ id: 'one', cells: { name: 'One' } }]));
+    const page = sourceFile('source-table.html', tableSourcePage(data));
+    const submitted = submitPage({ dir: ticketDir('source-table'), sourceFile: page, dialect: 'html' });
+    const config = submitted.manifest.slots[0].config;
+    assert.deepEqual(config.rows, [{ id: 'one', cells: { name: 'One' } }]);
+    assert.equal('source' in config, false);
+});
+test('invalid source data fails before a ticket is written', () => {
+    const cases = [
+        ['missing', join(sources, 'missing.json'), /does not exist/],
+        ['invalid-json', sourceFile('invalid.json', '{nope'), /not valid JSON/],
+        ['invalid-shape', sourceFile('invalid-shape.json', JSON.stringify([{ cells: { name: 'Missing id' } }])), /source data is invalid/],
+    ];
+    for (const [id, data, expected] of cases) {
+        const page = sourceFile(`${id}.html`, tableSourcePage(data));
+        const dir = ticketDir(`source-${id}`);
+        assert.throws(() => preparePage({ sourceFile: page, dialect: 'html' }), expected);
+        assert.throws(() => submitPage({ dir, sourceFile: page, dialect: 'html' }), expected);
+        assert.equal(existsSync(dir), false, `${id} source validation writes no ticket`);
+    }
+});
 test('progress round-trips through validation and rejects malformed saved work', () => {
     const dir = ticketDir('ask');
     assert.equal(readPageProgress(dir), null, 'no progress file reads as null');
@@ -77,23 +94,27 @@ test('readPageTicket derives pending, resolved and canceled state and carries th
     assert.equal(written['schema'], 'crtr.page-response/v1');
     assert.equal(written['kind'], 'page');
     assert.deepEqual(written['responses'], { rollout: { selectedOptionIds: ['full'], comments: [] } });
-    assert.equal(written['summary'], 'rollout: Full');
+    assert.equal(written['summary'], 'Full');
     assert.equal(readTicketResult(dir)?.kind, 'page', 'the strict decoder accepts the page result');
     assert.equal(existsSync(progressPath(dir)), false, 'completion clears owned work');
     const resolved = readPageTicket(dir);
     assert.equal(resolved.state, 'resolved');
     assert.equal(resolved.progress, null);
     assert.equal(scanInbox().some((item) => item.id === 'ask'), false, 'a resolved page leaves the pending list');
-    const canceledDir = submit('canceled', askPage, 'md', '2026-01-03T00:00:00.000Z');
+    const canceledDir = submit('canceled', askPage, 'html', '2026-01-03T00:00:00.000Z');
     cancelTicket(canceledDir, { reason: 'no longer needed' });
     assert.equal(readPageTicket(canceledDir).state, 'canceled');
 });
-test('a display page acknowledges with the empty responses map', () => {
+test('page scan derives response expectation from the ticket mode', () => {
     const dir = submit('display', displayPage, 'html', '2026-01-04T00:00:00.000Z');
     const ticket = readPageTicket(dir);
     assert.equal(ticket.manifest.dialect, 'html');
     assert.equal(ticket.manifest.slots.length, 0);
-    assert.equal(scanInbox().find((item) => item.id === 'display')?.kind === 'page', true);
+    const display = scanInbox().find((item) => item.id === 'display');
+    assert.equal(display?.kind === 'page' ? display.awaitsResponse : undefined, true, 'an ask waits even when its page has no response-bearing slots');
+    submit('notify-with-options', askPage, 'html', '2026-01-04T00:00:01.000Z', 'node-1', 'notify');
+    const notify = scanInbox().find((item) => item.id === 'notify-with-options');
+    assert.equal(notify?.kind === 'page' ? notify.awaitsResponse : undefined, false, 'a notify never waits even when its page has a response-bearing slot');
     const acknowledged = takeoverAndCompletePage(dir, {}, { host: 'crtrd', pid: process.pid });
     assert.equal(acknowledged.won, true);
     const written = JSON.parse(readFileSync(responsePath(dir), 'utf8'));
@@ -102,11 +123,11 @@ test('a display page acknowledges with the empty responses map', () => {
     assert.equal(written['summary'], '');
 });
 test('scanPageHistory returns every page of one node, oldest first, regardless of terminal file', () => {
-    submit('older', askPage, 'md', '2026-01-01T00:00:00.000Z');
-    submit('other-node', askPage, 'md', '2026-01-02T00:00:00.000Z', 'node-2');
+    submit('older', askPage, 'html', '2026-01-01T00:00:00.000Z');
+    submit('other-node', askPage, 'html', '2026-01-02T00:00:00.000Z', 'node-2');
     const history = scanPageHistory('node-1');
-    assert.deepEqual(history.map((entry) => entry.id), ['older', 'canceled', 'display', 'ask']);
-    assert.deepEqual(history.map((entry) => entry.state), ['pending', 'canceled', 'resolved', 'resolved']);
+    assert.deepEqual(history.map((entry) => entry.id), ['older', 'canceled', 'display', 'notify-with-options', 'ask']);
+    assert.deepEqual(history.map((entry) => entry.state), ['pending', 'canceled', 'resolved', 'pending', 'resolved']);
     assert.deepEqual(scanPageHistory('node-2').map((entry) => entry.id), ['other-node']);
     assert.deepEqual(scanPageHistory('node-missing'), []);
 });