@north-light/crouter 0.3.198 → 0.3.199

package/dist/core/runtime/broker-protocol.d.ts

@@ -46,6 +46,20 @@ export interface BrokerSnapshot {
         }>;
         title: string | undefined;
     };
+    /** The engine's UNRUN queue — the steer/follow-up texts a writable client
+     *  sent mid-turn that have not started yet (pi's `_steeringMessages` +
+     *  `_followUpMessages`, read non-destructively). `state.pendingMessageCount`
+     *  is the same queue's SIZE; without the texts a (re)attaching viewer can say
+     *  how many messages are waiting but not which, so it cannot render the
+     *  queued rows it renders from `queue_update` while attached — the welcome
+     *  would no longer fully determine viewer state.
+     *
+     *  Ingest defensively: a broker pinned to a pre-`queued` runtime generation is
+     *  still live and sends `welcome` without it. */
+    queued?: {
+        steering: string[];
+        followUp: string[];
+    };
     /** Broker-owned summaries keyed by the first tool-call id in each group.
      * Structured objects with bullets and filesDeleted.
      * Optional so snapshots from an older live runtime remain readable. */

package/dist/core/runtime/broker.d.ts

@@ -29,7 +29,7 @@ interface PendingDialog {
  *  bash children. No-op before the session is built or after a clean dispose. */
 export declare function disposeActiveSession(): void;
 export declare function runBroker(nodeId: string, startupAt?: bigint, startupTs?: string): Promise<void>;
-export declare function snapshotMessages(session: CreateAgentSessionResult['session'], reviewCompanion?: boolean): BrokerSnapshot['messages'];
+export declare function snapshotMessages(session: CreateAgentSessionResult['session'], boundaryReviewId?: string): BrokerSnapshot['messages'];
 export declare function buildBrokerSession(engine: BrokerEngine, cfg: BrokerSdkConfig): Promise<{
     session: CreateAgentSessionResult['session'];
     services: AgentSessionServices;

package/dist/core/runtime/broker.js

@@ -216,8 +216,11 @@ export async function runBroker(nodeId, startupAt = process.hrtime.bigint(), sta
     let { session, services, resuming, runtime } = await buildBrokerSession(engine, cfg);
     // Review identity is immutable for the broker's lifetime. Snapshot producers
     // close over this one construction-time classification rather than re-reading
-    // canvas metadata for every welcome or session replacement.
-    const reviewCompanion = (await brokerExtensionState(nodeId)).node.review_binding != null;
+    // canvas metadata for every welcome or session replacement. The BOUND review
+    // id (not a mere boolean) is what selects this companion's own boundary
+    // marker — a fork of another companion inherits that companion's earlier
+    // marker, and slicing at any marker would reveal its transcript.
+    const boundaryReviewId = (await brokerExtensionState(nodeId)).node.review_binding?.review_id;
     // M3: name the boot session as the process-fatal disposal target immediately —
     // enqueueRebind reassigns this on every later replacement, but without this
     // initial assignment `activeSession` stays null (and disposeActiveSession() a
@@ -355,7 +358,7 @@ export async function runBroker(nodeId, startupAt = process.hrtime.bigint(), sta
     const buildSnapshot = () => {
         const liveSession = rebind.session();
         return ({
-            messages: snapshotMessages(liveSession, reviewCompanion),
+            messages: snapshotMessages(liveSession, boundaryReviewId),
             stats: liveSession.getSessionStats(),
             // pi's `get_state` (rpc-mode.js), field for field, from the same getters.
             // The ONE divergence: a model-less session (undefined OR the SDK
@@ -382,6 +385,14 @@ export async function runBroker(nodeId, startupAt = process.hrtime.bigint(), sta
             },
             toolGroupSummaries: toolGroups.summaries(),
             workingActivity: projection.currentWorkingActivity(),
+            // The UNRUN queue's texts, read non-destructively (`clearQueue()` would
+            // consume them). Same two arrays a live `queue_update` carries, so a client
+            // that attaches mid-queue lands on the state its next `queue_update` would
+            // have produced.
+            queued: {
+                steering: [...liveSession.getSteeringMessages()],
+                followUp: [...liveSession.getFollowUpMessages()],
+            },
         });
     };
     // Send a client its catch-up snapshot. welcome.pending_dialog carries a single
@@ -509,7 +520,7 @@ export async function runBroker(nodeId, startupAt = process.hrtime.bigint(), sta
     rebind.setRebindSession();
     await rebind.enqueueRebind(session, services);
     const frameDispatch = createFrameDispatchContext({
-        nodeId, cfg, registry, toolGroups, projection, rebind, reviewCompanion,
+        nodeId, cfg, registry, toolGroups, projection, rebind, boundaryReviewId,
         pendingDialogs, sendWelcome, replayExtraPendingDialogsTo, reWelcomeAll, disposeAndExit,
         persistModelChoice, broadcastModelChanged, registryOf, formatModelSpec,
         formatExactModelSpec, resolveLaunchModel,
@@ -673,13 +684,13 @@ export async function runBroker(nodeId, startupAt = process.hrtime.bigint(), sta
 // conversation instead of just the post-yield window; single-cycle sessions and
 // the fake-engine fixture (no tree accessors) fall through to plain
 // `buildSessionContext().messages` unchanged.
-export function snapshotMessages(session, reviewCompanion = false) {
+export function snapshotMessages(session, boundaryReviewId) {
     // Cast: the real SDK's `SessionEntry.data` is `unknown` (untyped custom-entry
     // payload), narrower than `CycleSessionManagerLike`'s structural read of the
     // `crtr-cycle` marker's `{cycle, fromLeaf}` shape — the fields we read off it
     // are ones ONLY this module's own `appendCustomEntry` call (above) ever writes.
     const messages = cycleAwareMessages(session.sessionManager);
-    return visibleMessages(messages, { reviewCompanion });
+    return visibleMessages(messages, { boundaryReviewId });
 }
 // ---------------------------------------------------------------------------
 // resolveLaunchModel — the SOLE launch model-selection policy, module-scoped

package/dist/core/runtime/front-door-env.d.ts

@@ -0,0 +1,5 @@
+/** Env marker set on every pi the front door boots. Its presence means we are
+ *  already inside a front-door-booted root, so a nested front-door launch must
+ *  be refused — otherwise a removed/renamed subcommand that a child pi re-runs
+ *  (e.g. `crtr node -h`) fork-bombs pi until the machine must be rebooted. */
+export declare const FRONT_DOOR_ENV = "CRTR_FRONT_DOOR";

package/dist/core/runtime/front-door-env.js

@@ -0,0 +1,16 @@
+// The front-door recursion-guard env name, alone in a dependency-free module.
+//
+// `front-door.ts` owns the boot path and reaches the canvas through the
+// dynamic imports inside `maybeBootRoot`; every module that only needs the
+// MARKER NAME must not inherit that reach. The shipped broker extensions are
+// gated on their static import graph, which cannot tell a lazily-imported boot
+// dependency from an eagerly-loaded one, so importing the constant from
+// `front-door.js` reads as an extension reaching canvas.db.
+//
+// `front-door.ts` re-exports this, so `FRONT_DOOR_ENV` stays importable from
+// either module and every pi-booting path keeps setting the same marker.
+/** Env marker set on every pi the front door boots. Its presence means we are
+ *  already inside a front-door-booted root, so a nested front-door launch must
+ *  be refused — otherwise a removed/renamed subcommand that a child pi re-runs
+ *  (e.g. `crtr node -h`) fork-bombs pi until the machine must be rebooted. */
+export const FRONT_DOOR_ENV = 'CRTR_FRONT_DOOR';

package/dist/core/runtime/front-door.d.ts

@@ -1,8 +1,4 @@
-/** Env marker set on every pi the front door boots. Its presence means we are
- *  already inside a front-door-booted root, so a nested front-door launch must
- *  be refused — otherwise a removed/renamed subcommand that a child pi re-runs
- *  (e.g. `crtr node -h`) fork-bombs pi until the machine must be rebooted. */
-export declare const FRONT_DOOR_ENV = "CRTR_FRONT_DOOR";
+export { FRONT_DOOR_ENV } from './front-door-env.js';
 /** If this invocation is a front-door (root) launch, boot it and never return.
  *  Returns false when it's a recognized subcommand / help / unknown token (let
  *  the dispatcher handle it — for unknown tokens it errors cleanly).

package/dist/core/runtime/front-door.js

@@ -21,6 +21,7 @@
 import { existsSync, statSync } from 'node:fs';
 import { resolve as resolvePath } from 'node:path';
 import { SUBTREE_NAMES } from '../../build-root.js';
+import { FRONT_DOOR_ENV } from './front-door-env.js';
 // NOTE: the boot-path deps — ./boot-root.js (bootRoot), ./resume-root.js (resumeRoot),
 // ./package-health.js (missingPackageWarning + piAgentDir) — are DYNAMICALLY
 // imported inside maybeBootRoot, NOT statically here. `cli.ts` calls
@@ -89,11 +90,7 @@ function parseRootArgs(tokens) {
     const prompt = positionals.length > 0 ? positionals.join(' ') : undefined;
     return { cwd, prompt, name, kind, profile, pickProfile, resume };
 }
-/** Env marker set on every pi the front door boots. Its presence means we are
- *  already inside a front-door-booted root, so a nested front-door launch must
- *  be refused — otherwise a removed/renamed subcommand that a child pi re-runs
- *  (e.g. `crtr node -h`) fork-bombs pi until the machine must be rebooted. */
-export const FRONT_DOOR_ENV = 'CRTR_FRONT_DOOR';
+export { FRONT_DOOR_ENV } from './front-door-env.js';
 /** If this invocation is a front-door (root) launch, boot it and never return.
  *  Returns false when it's a recognized subcommand / help / unknown token (let
  *  the dispatcher handle it — for unknown tokens it errors cleanly).

package/dist/core/runtime/host.d.ts

@@ -1,5 +1,5 @@
 import { type NodeRow } from '../canvas/index.js';
-import type { PiInvocation } from './launch.js';
+import type { PiInvocation } from './invocation.js';
 /** View-side launch hints the broker host needs beyond the PiInvocation. The
  *  broker uses `cwd` + `resuming`; `name` is carried for the node's display. */
 export interface LaunchPlacement {

package/dist/core/runtime/invocation.d.ts

@@ -0,0 +1,6 @@
+export interface PiInvocation {
+    /** argv after the `pi` binary. */
+    argv: string[];
+    /** env to merge into the process. */
+    env: Record<string, string>;
+}

package/dist/core/runtime/invocation.js

@@ -0,0 +1,10 @@
+// The broker-launch recipe shape, alone in a dependency-free module.
+//
+// `launch.ts` builds a PiInvocation and therefore reaches canvas state; the
+// modules that only need to READ the recipe shape (spawn-env, host) must not.
+// A type-only import is erased at compile time, but the shipped broker
+// extensions are gated on their STATIC import graph — the gate cannot tell an
+// erased edge from a live one, so an extension that reaches spawn-env would
+// read as reaching canvas.db through launch.ts. Keeping the interface here
+// makes the graph say what the runtime already does.
+export {};

package/dist/core/runtime/kickoff.js

@@ -20,6 +20,7 @@
 import { existsSync, readFileSync, writeFileSync, rmSync, mkdirSync, readdirSync, } from 'node:fs';
 import { join } from 'node:path';
 import { contextDir, reportsDir, getNode, subscriptionsOf, subscribersOf, } from '../canvas/index.js';
+import { activeBackgroundBashJobs, bashJobCommandLine, formatBashElapsed } from '../bash-jobs.js';
 import { readRoadmap, roadmapPath } from './roadmap.js';
 import { buildWakeBearings } from './bearings.js';
 import { personaDrift, commitPersonaAck } from './persona.js';
@@ -205,6 +206,33 @@ function feedBlock(nodeId, unreadDigest) {
     }
     return `<feed>\n${lines.join('\n')}\n</feed>`;
 }
+/** One-line label for a job: its purpose when the caller gave one, else its real
+ *  command line, clipped so a long pipeline stays scannable. */
+function jobLabel(purpose, command) {
+    const raw = (purpose ?? bashJobCommandLine(command)).trim() || '(no command)';
+    return raw.length > 120 ? `${raw.slice(0, 117)}…` : raw;
+}
+/** Live file-backed background bash jobs this node owns. A fresh revive has no
+ *  memory of handing anything off, so without this block the node cannot tell a
+ *  command it started is still running: it can neither read the log nor decide
+ *  whether to wait, and may relaunch the same work. Returns null — and the
+ *  kickoff omits the block entirely — when nothing is live. */
+function backgroundJobsBlock(nodeId) {
+    const jobs = activeBackgroundBashJobs(contextDir(nodeId));
+    if (jobs.length === 0)
+        return null;
+    const now = Date.now();
+    const one = jobs.length === 1;
+    const lines = [
+        `${jobs.length} background bash job${one ? '' : 's'} you started ${one ? 'is' : 'are'} STILL RUNNING, detached from any turn and unaffected by your refresh. ` +
+            `Each one sends you a message when it exits — that wake is automatic, so do not poll it and do not relaunch the same command.`,
+    ];
+    for (const job of jobs) {
+        lines.push(`  - ${job.jobId} — ${jobLabel(job.purpose, job.command)} · running ${formatBashElapsed(now - job.startedAtMs)} · log ${job.logPath}`);
+    }
+    lines.push('', 'Read output so far: `tail -n 50 <log>` (or `crtr node bash list --tail 20`). Abandon one: `crtr node bash kill <job-id>`.');
+    return `<background-jobs>\n${lines.join('\n')}\n</background-jobs>`;
+}
 // ---------------------------------------------------------------------------
 // buildReviveKickoff — assemble the full fresh-revive first message.
 // ---------------------------------------------------------------------------
@@ -257,6 +285,12 @@ export function buildReviveKickoff(meta, bearings, wakeReason) {
     // revive (a new pi process boot) and re-injects buildContextIntro(), which
     // already carries the sidecar as a hidden sibling of <crtr-bearings>; that seam
     // covers this path, so duplicating it into the visible prompt would leak it.
+    // Live background bash jobs sit beside the context-dir listing: both describe
+    // this node's OWN in-flight state, and both precede <feed>, which is about the
+    // other nodes it awaits. Absent when nothing is running.
+    const jobsBlock = backgroundJobsBlock(nodeId);
+    if (jobsBlock !== null)
+        parts.push(jobsBlock);
     parts.push(feedBlock(nodeId, bearings.unreadDigest));
     parts.push(bearings.yieldMsg !== null
         ? `<yield-message>\n${bearings.yieldMsg.trim()}\n</yield-message>`

package/dist/core/runtime/launch.d.ts

@@ -1,3 +1,4 @@
+import type { PiInvocation } from './invocation.js';
 export { CANVAS_EXTENSIONS, CANVAS_STOPHOOK_PATH, CANVAS_INBOX_WATCHER_PATH, CANVAS_RECAP_PATH, CANVAS_GOAL_CAPTURE_PATH, CANVAS_PASSIVE_CONTEXT_PATH, CANVAS_CONTEXT_INTRO_PATH, CANVAS_TOOL_GUIDE_PATH, CANVAS_DOC_SUBSTRATE_PATH, CANVAS_STRUCTURED_OUTPUT_PATH, CANVAS_BASH_VALVE_PATH, } from './canvas-extensions.js';
 import type { NodeMeta, LaunchSpec, Mode, Lifecycle } from '../canvas/index.js';
 import type { ModelProvider, ModelStrength, ScopeConfig } from '../../types.js';
@@ -104,12 +105,7 @@ export declare function buildLaunchSpec(kind: string, mode: Mode, opts: {
     launch: LaunchSpec;
     lifecycle: 'terminal' | 'resident';
 };
-export interface PiInvocation {
-    /** argv after the `pi` binary. */
-    argv: string[];
-    /** env to merge into the process. */
-    env: Record<string, string>;
-}
+export type { PiInvocation } from './invocation.js';
 /** Construct the pi invocation for a node.
  *  - fresh start: pass `prompt` (the node's first user message), no resume.
  *  - fork start: pass `forkFrom` (absolute .jsonl path or partial uuid) to `--fork`

package/dist/core/runtime/node-read.js

@@ -152,7 +152,7 @@ export async function readNodeSnapshot(nodeId) {
         copyFileSync(sessionFile, copy);
         const manager = SessionManager.open(copy);
         const context = manager.buildSessionContext();
-        const messages = visibleMessages(cycleAwareMessages(manager), { reviewCompanion: node.review_binding != null });
+        const messages = visibleMessages(cycleAwareMessages(manager), { boundaryReviewId: node.review_binding?.review_id });
         const sessionId = manager.getSessionId();
         const sessionName = manager.getSessionName();
         const snapshot = {
@@ -179,6 +179,9 @@ export async function readNodeSnapshot(nodeId) {
             // process state (last setStatus/setWidget/setTitle) and is not persisted,
             // so an offline read has none.
             display: { statuses: {}, widgets: {}, title: undefined },
+            // The unrun queue lives in the engine's memory; a dormant node has no
+            // engine, so nothing is waiting to run.
+            queued: { steering: [], followUp: [] },
             // Sidecar summaries survive broker exit so a dormant transcript receives
             // the same completed-group data as a live welcome snapshot. Malformed or
             // absent sidecars are deliberately ignored: tool calls remain visible.

package/dist/core/runtime/nodes.js

@@ -19,6 +19,7 @@ import { memoryDir } from './memory.js';
 import { resolveInstallId } from '../canvas/install-id.js';
 import { canvasDbPath } from '../canvas/paths.js';
 import { usage } from '../errors.js';
+import { assertProfileAvailableForBirth } from '../profiles/deletion-reservation.js';
 // crtrd sets this once at boot (setInstallId) and it wins unconditionally —
 // a daemon process only ever serves one canvas home for its whole lifetime,
 // so no keying is needed there. Every OTHER in-process caller (tests,
@@ -259,6 +260,7 @@ export function spawnNode(opts) {
     if (parent !== null && getNode(parent) === null) {
         throw new Error(`cannot spawn under unknown parent node: ${parent}`);
     }
+    assertProfileAvailableForBirth(meta.profile_id ?? null);
     createNode(meta);
     // Create the node-local memory directory so substrate docs can be written
     // directly into it without a separate mkdir. Skip for ephemeral human-bridge

package/dist/core/runtime/promote.d.ts

@@ -19,6 +19,7 @@ export declare function reshapeNode(nodeId: string, opts?: {
     model?: string;
     mode?: Mode;
     lifecycle?: Lifecycle;
+    profileId?: string | null;
 }, beforePersist?: () => void): NodeMeta;
 /** Promote a node to an orchestrator (mode→orchestrator), optionally
  *  specializing its kind (e.g. a `general` worker becoming a

package/dist/core/runtime/promote.js

@@ -42,6 +42,7 @@ export function reshapeNode(nodeId, opts = {}, beforePersist) {
     const targetModel = opts.model ?? node.model_override ?? undefined;
     const targetMode = opts.mode ?? node.mode;
     const targetLifecycle = opts.lifecycle ?? node.lifecycle;
+    const targetProfileId = opts.profileId === undefined ? node.profile_id : opts.profileId;
     // Rewrite the launch spec to the target kind/mode's persona so the *next*
     // revive comes back as this exact shape (polymorph stage 2). nodeEnv reads
     // meta.{kind,mode}, so CRTR_KIND/CRTR_MODE flip immediately for the live
@@ -66,7 +67,7 @@ export function reshapeNode(nodeId, opts = {}, beforePersist) {
         // Resolve kind/ladder config against the NODE's own cwd + profile, not
         // this process's ambient scope.
         cwd: node.cwd,
-        profileId: node.profile_id,
+        profileId: targetProfileId,
     });
     // Promotion seeds after its target launch has been built but before the
     // mutation is persisted, preserving the original promote() failure order.
@@ -81,6 +82,7 @@ export function reshapeNode(nodeId, opts = {}, beforePersist) {
         kind: targetKind,
         mode: targetMode,
         lifecycle: targetLifecycle,
+        profile_id: targetProfileId,
         launch,
         ...(carriesDefaultHandle ? { name: targetKind } : {}),
         // Persist a newly-chosen tier so it is durable across future revives; omit

package/dist/core/runtime/session-cycles.d.ts

@@ -20,6 +20,12 @@ export interface CycleSessionManagerLike {
      *  path root-first. */
     getBranch?(fromId?: string): SessionEntry[];
 }
+/** True when an assistant turn ended because its own abort fired — an ESC, a
+ *  critical-tier interrupt, or the self-abort a refresh-yield performs. */
+export declare function endedByAbort(message: {
+    stopReason?: string;
+    errorMessage?: string;
+}): boolean;
 /** A refresh-yield deliberately aborts its own turn before the next cycle is
  * rooted. Preserve that assistant message (including tool calls and prose), but
  * omit the failure annotation: the cycle divider is the truthful visible seam. */

package/dist/core/runtime/session-cycles.js

@@ -32,11 +32,25 @@ function cycleDivider(cycle, timestamp) {
         timestamp: new Date(timestamp).getTime(),
     };
 }
+/** Text a provider attaches when the request's own AbortSignal fired. Pi's
+ *  providers stamp `stopReason: 'aborted'` when they observe the signal
+ *  themselves, but an abort that lands while the next request is starting
+ *  reaches their catch as a bare AbortError instead, and is recorded as
+ *  `stopReason: 'error'` carrying this text. Both spellings are the same healthy
+ *  event — a turn that stopped because something asked it to stop. */
+const ABORT_ERROR_TEXT = /\b(?:request|operation) was aborted\b|\bthe user aborted\b/i;
+/** True when an assistant turn ended because its own abort fired — an ESC, a
+ *  critical-tier interrupt, or the self-abort a refresh-yield performs. */
+export function endedByAbort(message) {
+    if (message.stopReason === 'aborted')
+        return true;
+    return message.stopReason === 'error' && ABORT_ERROR_TEXT.test(message.errorMessage ?? '');
+}
 /** A refresh-yield deliberately aborts its own turn before the next cycle is
  * rooted. Preserve that assistant message (including tool calls and prose), but
  * omit the failure annotation: the cycle divider is the truthful visible seam. */
 export function withoutYieldAbort(message) {
-    if (message.role !== 'assistant' || message.stopReason !== 'aborted')
+    if (message.role !== 'assistant' || !endedByAbort(message))
         return message;
     const { stopReason: _stopReason, errorMessage: _errorMessage, ...visible } = message;
     return visible;

package/dist/core/runtime/session-visibility.d.ts

@@ -12,18 +12,23 @@ export declare function isReviewBoundary(entry: unknown, reviewId?: string): boo
 /**
  * Project snapshot messages to the visible window for a review companion.
  *
+ * A companion passes its binding's review id so the slice starts at ITS OWN
+ * boundary marker: a node forked from another companion inherits that
+ * companion's earlier marker, and slicing at the first marker of any review
+ * would reveal the origin companion's transcript.
+ *
  * Contract (in evaluation order):
- * 1. Marker present → slice from the **first** occurrence (marker included) to
- *    the end. Everything before the marker is inherited context, hidden from
- *    the person.
- * 2. Not a review companion → return input unchanged (same reference). Ordinary
- *    nodes are not filtered.
- * 3. No marker and review companion → a leading compaction summary is replaced
+ * 1. This binding's marker present (any marker when the node has no binding) →
+ *    slice from the **first** occurrence (marker included) to the end.
+ *    Everything before the marker is inherited context, hidden from the person.
+ * 2. Not a companion (`boundaryReviewId` undefined) → return input unchanged
+ *    (same reference). Ordinary nodes are not filtered.
+ * 3. Bound but no matching marker → a leading compaction summary is replaced
  *    with a synthetic boundary while its retained tail remains visible. Every
  *    other markerless shape fails closed with the synthetic boundary alone.
  */
 export declare function visibleMessages(messages: BrokerSnapshot['messages'], opts: {
-    reviewCompanion: boolean;
+    boundaryReviewId: string | undefined;
 }): BrokerSnapshot['messages'];
 /**
  * Project a session tree to the review companion's visible transcript boundary.
@@ -33,5 +38,9 @@ export declare function visibleMessages(messages: BrokerSnapshot['messages'], op
  * boundary is crossed, its complete descendant subtree remains navigable. An
  * absent boundary produces an empty tree, so picker previews never disclose an
  * inherited entry before a mutation guard can reject its selection.
+ *
+ * `boundaryReviewId` selects only this binding's marker as a root, so a
+ * companion forked from another companion never navigates into the inherited
+ * subtree rooted at the origin's earlier marker.
  */
-export declare function boundaryRootedTree(tree: readonly WireSessionTreeNode[]): WireSessionTreeNode[];
+export declare function boundaryRootedTree(tree: readonly WireSessionTreeNode[], boundaryReviewId?: string): WireSessionTreeNode[];

package/dist/core/runtime/session-visibility.js

@@ -38,21 +38,26 @@ function syntheticBoundary(timestamp) {
 /**
  * Project snapshot messages to the visible window for a review companion.
  *
+ * A companion passes its binding's review id so the slice starts at ITS OWN
+ * boundary marker: a node forked from another companion inherits that
+ * companion's earlier marker, and slicing at the first marker of any review
+ * would reveal the origin companion's transcript.
+ *
  * Contract (in evaluation order):
- * 1. Marker present → slice from the **first** occurrence (marker included) to
- *    the end. Everything before the marker is inherited context, hidden from
- *    the person.
- * 2. Not a review companion → return input unchanged (same reference). Ordinary
- *    nodes are not filtered.
- * 3. No marker and review companion → a leading compaction summary is replaced
+ * 1. This binding's marker present (any marker when the node has no binding) →
+ *    slice from the **first** occurrence (marker included) to the end.
+ *    Everything before the marker is inherited context, hidden from the person.
+ * 2. Not a companion (`boundaryReviewId` undefined) → return input unchanged
+ *    (same reference). Ordinary nodes are not filtered.
+ * 3. Bound but no matching marker → a leading compaction summary is replaced
  *    with a synthetic boundary while its retained tail remains visible. Every
  *    other markerless shape fails closed with the synthetic boundary alone.
  */
 export function visibleMessages(messages, opts) {
-    const markerIndex = messages.findIndex((message) => isReviewBoundary(message));
+    const markerIndex = messages.findIndex((message) => isReviewBoundary(message, opts.boundaryReviewId));
     if (markerIndex !== -1)
         return messages.slice(markerIndex);
-    if (!opts.reviewCompanion)
+    if (opts.boundaryReviewId === undefined)
         return messages;
     const [first, ...retainedTail] = messages;
     if (first?.role === 'compactionSummary') {
@@ -68,14 +73,18 @@ export function visibleMessages(messages, opts) {
  * boundary is crossed, its complete descendant subtree remains navigable. An
  * absent boundary produces an empty tree, so picker previews never disclose an
  * inherited entry before a mutation guard can reject its selection.
+ *
+ * `boundaryReviewId` selects only this binding's marker as a root, so a
+ * companion forked from another companion never navigates into the inherited
+ * subtree rooted at the origin's earlier marker.
  */
-export function boundaryRootedTree(tree) {
+export function boundaryRootedTree(tree, boundaryReviewId) {
     const retainSubtree = (node) => ({
         ...node,
         children: node.children.map(retainSubtree),
     });
     const project = (node) => {
-        if (isReviewBoundary(node.entry))
+        if (isReviewBoundary(node.entry, boundaryReviewId))
             return [retainSubtree(node)];
         return node.children.flatMap(project);
     };

package/dist/core/runtime/spawn-env.d.ts

@@ -1,4 +1,12 @@
-import type { PiInvocation } from './launch.js';
+import type { PiInvocation } from './invocation.js';
+/** The unshimmed PATH admitted from the host. Broker and cron shells resolve
+ *  crouter-owned executables from this value, while commands those shells run
+ *  still receive the shim-prepended PATH. */
+export declare const ADMITTED_HOST_PATH_ENV = "CRTR_ADMITTED_HOST_PATH";
+/** Resolve a regular executable against a shell PATH without executing it.
+ *  The result is absolute, or null when no PATH entry supplies the command. */
+export declare function resolvePathExecutable(name: string, env: NodeJS.ProcessEnv, cwd: string): string | null;
+export declare function resolveAdmittedHostCommand(name: string, env: NodeJS.ProcessEnv, cwd: string): string;
 /** Sources A–C: the operational base shared by the broker boundary (this
  *  module's `buildBrokerEnv`) and cron executor — the single shared definition
  *  of "non-secret host state the runtime exposes to any spawned shell." Does not include

package/dist/core/runtime/spawn-env.js

@@ -15,6 +15,13 @@
 // `spawnEnv.allow` entry. `inv.env` (D) is crtr-constructed and trusted, so
 // it overlays unconditionally, layered after E.
 //
+// One name IS rewritten rather than merely admitted: `PATH`. Bare-binary
+// contributions (`bin` in a plugin manifest or a scope `config.json`) are
+// materialized into a crouter-owned shim directory by
+// `core/runtime/bin-contributions.ts`, and that directory is PREPENDED here so
+// a declared bare command wins its name in every node's bash. The admitted
+// host PATH stays intact behind it.
+//
 // `GIT_*` is deliberately absent from the allowlist: the whole namespace is an
 // auth/config-injection surface (`GIT_CONFIG_KEY_*`/`GIT_CONFIG_VALUE_*`,
 // `GIT_ASKPASS`, `GIT_SSH_COMMAND`), not a non-secret operational family, and
@@ -22,9 +29,12 @@
 // `~/.gitconfig`, reached through the allowlisted `HOME`; SSH remotes via the
 // allowlisted `SSH_AUTH_SOCK`). A deliberate `GIT_*` need goes through
 // `spawnEnv.allow`.
+import { statSync } from 'node:fs';
+import { delimiter, resolve } from 'node:path';
 import { readMergedLaunchConfig } from '../config.js';
 import { readProfileEnvVars } from '../profiles/env-store.js';
-import { FRONT_DOOR_ENV } from './front-door.js';
+import { binShimDirFor } from './bin-contributions.js';
+import { FRONT_DOOR_ENV } from './front-door-env.js';
 /** A1 — literal env-var names copied verbatim (no value inspection): a login
  *  shell plus dev toolchain needs exactly these, and none of them can carry a
  *  credential. */
@@ -54,6 +64,39 @@ const OPERATIONAL_LITERAL_NAMES = new Set([
  *  file-backed in `auth.json`, never an env value). `GIT_` is NOT here — see
  *  module comment. */
 const OPERATIONAL_PREFIXES = ['LC_', 'XDG_', 'PI_'];
+/** The unshimmed PATH admitted from the host. Broker and cron shells resolve
+ *  crouter-owned executables from this value, while commands those shells run
+ *  still receive the shim-prepended PATH. */
+export const ADMITTED_HOST_PATH_ENV = 'CRTR_ADMITTED_HOST_PATH';
+/** Resolve a regular executable against a shell PATH without executing it.
+ *  The result is absolute, or null when no PATH entry supplies the command. */
+export function resolvePathExecutable(name, env, cwd) {
+    const pathValue = env['PATH'];
+    if (pathValue === undefined || pathValue === '')
+        return null;
+    for (const directory of pathValue.split(delimiter)) {
+        const candidate = resolve(cwd, directory === '' ? '.' : directory, name);
+        try {
+            const stat = statSync(candidate);
+            if (stat.isFile() && (stat.mode & 0o111) !== 0)
+                return candidate;
+        }
+        catch {
+            // Keep searching exactly as PATH resolution does.
+        }
+    }
+    return null;
+}
+export function resolveAdmittedHostCommand(name, env, cwd) {
+    const pathValue = env[ADMITTED_HOST_PATH_ENV] ?? env['PATH'];
+    if (pathValue === undefined || pathValue === '') {
+        throw new Error(`cannot resolve crouter-owned ${name}: the admitted host PATH is empty`);
+    }
+    const command = resolvePathExecutable(name, { PATH: pathValue }, cwd);
+    if (command !== null)
+        return command;
+    throw new Error(`cannot resolve crouter-owned ${name} from the admitted host PATH`);
+}
 /** A2 — proxy var names. Admitted only when the value's URL authority carries
  *  no userinfo component (no `user@` / `user:pass@`) — the one value-inspected
  *  entry in the whole builder, because a proxy var is the single operational
@@ -151,6 +194,21 @@ export function buildOperationalEnvBase(opts) {
                 out[key] = value;
         }
     }
+    // Preserve the unshimmed admitted host PATH across broker and cron children.
+    // A nested `crtr` launched from an agent inherits this constructed value,
+    // rather than mistaking its shim-prepended PATH for the host path.
+    const admittedHostPath = host[ADMITTED_HOST_PATH_ENV] ?? out['PATH'];
+    if (admittedHostPath !== undefined && admittedHostPath !== '')
+        out[ADMITTED_HOST_PATH_ENV] = admittedHostPath;
+    // Bare-binary contributions (`core/runtime/bin-contributions.ts`): the shim
+    // dir holding one symlink per declared bare command, PREPENDED so a
+    // contribution wins its name, with the host PATH admitted above left intact
+    // behind it. Resolved from the TARGET's own cwd/profile like source C.
+    const shimDir = binShimDirFor(opts.targetCwd, opts.targetProfileId);
+    if (shimDir !== null) {
+        const hostPath = out['PATH'];
+        out['PATH'] = hostPath === undefined || hostPath === '' ? shimDir : `${shimDir}:${hostPath}`;
+    }
     return out;
 }
 /** The one authoritative broker child env: sources A–C (the operational
@@ -170,10 +228,12 @@ export function buildOperationalEnvBase(opts) {
 export function buildBrokerEnv(inv) {
     const targetCwd = inv.env['CRTR_NODE_CWD'] ?? process.cwd();
     const targetProfileId = inv.env['CRTR_PROFILE_ID'] || null;
+    const operational = buildOperationalEnvBase({ targetCwd, targetProfileId });
     return {
-        ...buildOperationalEnvBase({ targetCwd, targetProfileId }),
+        ...operational,
         ...readProfileEnvVars(targetProfileId),
         ...inv.env,
+        [ADMITTED_HOST_PATH_ENV]: operational[ADMITTED_HOST_PATH_ENV],
         [FRONT_DOOR_ENV]: '1',
     };
 }

package/dist/core/runtime/stop-guard.d.ts

@@ -2,8 +2,8 @@ export { STALL_REPROMPT } from '../../shared/generated-context.js';
 export interface StopSignals {
     /** Did the node call `push --final` (finish) this turn? */
     pushedFinal: boolean;
-    /** Did the node call `crtr ask` (escalate to the human) this turn? */
-    askedHuman: boolean;
+    /** Did the node call `crtr ask` (escalate to the user) this turn? */
+    requestedHumanReply: boolean;
 }
 export type StopAction = {
     action: 'allow';

package/dist/core/runtime/stop-guard.js

@@ -37,7 +37,7 @@ function formatInvalidStructuredOutputReprompt(error) {
         `1. Remove the invalid file (the output-schema.json in your node directory has been corrupted)\n` +
         `2. Fix the corruption if you know the original request schema\n\n` +
         `After resolving the file, retry the submission. ` +
-        `If this is unexpected, escalate to the human using \`crtr human ask\`.`);
+        `If this is unexpected, escalate to the user using \`crtr human send\`.`);
 }
 /** Decide what to do when a node stops. crtrd supplies every current-canvas
  * fact; the broker contributes only whether its Pi-owned background job registry
@@ -45,7 +45,7 @@ function formatInvalidStructuredOutputReprompt(error) {
 export function evaluateStop(nodeId, signals, backgroundJobsRunning = activeBackgroundBashJobs(contextDir(nodeId)).length > 0) {
     if (signals.pushedFinal)
         return { action: 'allow', reason: 'finished' };
-    if (signals.askedHuman)
+    if (signals.requestedHumanReply)
         return { action: 'allow', reason: 'escalated' };
     // A pending structured-output request overrides every stored-state dormancy
     // path: a post-final one-off follow-up still owes `submit` before it may stop.

package/dist/core/runtime/stop-signals.d.ts

@@ -1,6 +1,6 @@
 export interface StopSignals {
     pushedFinal: boolean;
-    askedHuman: boolean;
+    requestedHumanReply: boolean;
 }
 export type StopSignal = keyof StopSignals;
 /** Record a successful command outcome for this broker process. The stophook