@north-light/crouter 0.3.198 → 0.3.200

package/dist/core/runtime/stop-signals.js

@@ -1,7 +1,7 @@
 import { existsSync, mkdirSync, readFileSync, rmSync, writeFileSync } from 'node:fs';
 import { join } from 'node:path';
 import { jobDir } from '../canvas/paths.js';
-const SIGNALS = ['pushedFinal', 'askedHuman'];
+const SIGNALS = ['pushedFinal', 'requestedHumanReply'];
 function signalPath(nodeId, signal) {
     return join(jobDir(nodeId), `.${signal}`);
 }
@@ -24,7 +24,7 @@ export function markStopSignal(nodeId, signal) {
 /** Consume command outcomes from this broker's just-settled turn. Markers from
  * an earlier crashed broker are discarded rather than bleeding into its successor. */
 export function consumeStopSignals(nodeId) {
-    const signals = { pushedFinal: false, askedHuman: false };
+    const signals = { pushedFinal: false, requestedHumanReply: false };
     for (const signal of SIGNALS) {
         const path = signalPath(nodeId, signal);
         if (!existsSync(path))

package/dist/core/runtime/tmux-bindings.js

@@ -522,7 +522,7 @@ function restoreWrappedBinding(wrapper) {
 // not the sealed generation that installed it. The neighboring `crtr surface node cycle` builders
 // share that property.
 export function inboxToggleTmuxCommand() {
-    return ['run-shell', '-b', 'crtr human inbox toggle --quiet --tmux-socket "#{socket_path}" --tmux-client "#{client_name}" --target-pane "#{pane_id}"'];
+    return ['run-shell', '-b', 'crtr surface inbox --quiet --tmux-socket "#{socket_path}" --tmux-client "#{client_name}" --target-pane "#{pane_id}"'];
 }
 function actionCommand(id) {
     switch (id) {

package/dist/core/session-model/session-state.d.ts

@@ -24,9 +24,10 @@ export interface SessionState {
     /** Live context occupancy in prompt tokens: seeded from the snapshot's
      *  contextUsage, then tracked off each assistant `message_end`. */
     contextTokens: number | undefined;
-    /** Queued steering + follow-up messages, from `queue_update`. A fresh broker
-     *  with an empty queue emits no `queue_update`, so every welcome resets this
-     *  rather than leaving a dead broker's rows on screen. */
+    /** Queued steering + follow-up messages: seeded from `welcome.snapshot.queued`
+     *  and tracked off `queue_update`. Every welcome REPLACES this — the attaching
+     *  broker's own queue is the whole truth, so a dead broker's rows never survive
+     *  and a client attaching mid-queue still sees what is waiting. */
     queued: Array<{
         text: string;
     }>;

package/dist/core/session-model/session-state.js

@@ -48,7 +48,7 @@ export function applySnapshot(frame) {
         agentDir: frame.agentDir,
         engine: snapshot.state,
         contextTokens: contextUsage?.tokens ?? undefined,
-        queued: [],
+        queued: snapshotQueued(snapshot),
         display: {
             statuses: { ...display.statuses },
             widgets: Object.fromEntries(Object.entries(display.widgets).map(([k, w]) => [k, { lines: [...w.lines], placement: w.placement }])),
@@ -140,6 +140,19 @@ export function reduce(state, frame) {
             return state;
     }
 }
+/** The queue a `welcome` reports, composed exactly as `queue_update` composes
+ *  it. Absent on a snapshot from a broker generation older than the field, and
+ *  on an offline node (no engine, so no queue) — both mean nothing is waiting. */
+function snapshotQueued(snapshot) {
+    const queued = snapshot.queued;
+    if (typeof queued !== 'object' || queued === null)
+        return [];
+    const { steering, followUp } = queued;
+    return [...texts(steering), ...texts(followUp)].map((text) => ({ text }));
+}
+function texts(value) {
+    return Array.isArray(value) ? value.filter((entry) => typeof entry === 'string') : [];
+}
 /** Apply a partial patch to pi's state, preserving reference identity when the
  *  patch changes nothing (and when no welcome has seeded `engine` yet). */
 function patchEngine(state, patch) {

package/dist/core/user-settings.d.ts

@@ -147,10 +147,10 @@ export declare const CONFIG_SETTINGS_COVERAGE: {
             setFromString: (config: ScopeConfig, raw: string) => string | null;
         };
     };
-    html_surface: {
+    page_surface: {
         surface: "settings";
         setting: {
-            key: "html_surface";
+            key: "page_surface";
             label: string;
             description: string;
             valueConstraint: string;
@@ -166,6 +166,21 @@ export declare const CONFIG_SETTINGS_COVERAGE: {
         surface: "specialized";
         owner: string;
     };
+    whip_message_mode: {
+        surface: "settings";
+        setting: {
+            key: "whip_message_mode";
+            label: string;
+            description: string;
+            valueConstraint: string;
+            applies: string;
+            group: "display";
+            order: number;
+            format: (config: ScopeConfig) => "random" | "go faster";
+            cycle: (config: ScopeConfig, delta: number) => void;
+            setFromString: (config: ScopeConfig, raw: string) => string | null;
+        };
+    };
     mouse_mode_default: {
         surface: "settings";
         setting: {
@@ -307,6 +322,10 @@ export declare const CONFIG_SETTINGS_COVERAGE: {
         surface: "specialized";
         owner: string;
     };
+    bin: {
+        surface: "specialized";
+        owner: string;
+    };
 };
 /** The exhaustive top-level key list used by config persistence and help. */
 export declare const SCOPE_CONFIG_KEYS: (keyof ScopeConfig)[];

package/dist/core/user-settings.js

@@ -1,4 +1,4 @@
-import { CONDENSED_HISTORY_MODES, MOUSE_MODE_DEFAULTS } from '../types.js';
+import { CONDENSED_HISTORY_MODES, MOUSE_MODE_DEFAULTS, WHIP_MESSAGE_MODES } from '../types.js';
 function cycleChoice(choices, current, delta) {
     const index = choices.indexOf(current);
     const start = index >= 0 ? index : 0;
@@ -158,7 +158,7 @@ export const CONFIG_SETTINGS_COVERAGE = {
             valueConstraint: 'true|false',
             applies: 'Applies on the next turn end.',
             group: 'display',
-            order: 40,
+            order: 41,
             format: (config) => config.completion_bell ? 'on' : 'off',
             cycle: (config) => { config.completion_bell = !config.completion_bell; },
             setFromString: (config, raw) => {
@@ -192,28 +192,48 @@ export const CONFIG_SETTINGS_COVERAGE = {
             },
         },
     },
-    html_surface: {
+    page_surface: {
         surface: 'settings',
         setting: {
-            key: 'html_surface',
-            label: 'HTML human surface',
-            description: 'Prompt agents to use HTML pages by default for structured or interactive content shown to you.',
+            key: 'page_surface',
+            label: 'Page human surface',
+            description: 'Prompt agents to use JSX pages by default for structured or interactive content shown to you.',
             valueConstraint: 'true|false',
             applies: 'Applies when human command help is assembled.',
             group: 'display',
             order: 37,
-            format: (config) => config.html_surface ? 'on' : 'off',
-            cycle: (config) => { config.html_surface = !config.html_surface; },
+            format: (config) => config.page_surface ? 'on' : 'off',
+            cycle: (config) => { config.page_surface = !config.page_surface; },
             setFromString: (config, raw) => {
-                const value = booleanFromString(raw, 'html_surface');
+                const value = booleanFromString(raw, 'page_surface');
                 if (typeof value === 'string')
                     return value;
-                config.html_surface = value;
+                config.page_surface = value;
                 return null;
             },
         },
     },
     whip_messages: { surface: 'specialized', owner: 'sys config set whip_messages' },
+    whip_message_mode: {
+        surface: 'settings',
+        setting: {
+            key: 'whip_message_mode',
+            label: 'Whip message',
+            description: 'What the whip action sends: a random line from whip_messages, or the fixed “Go faster”.',
+            valueConstraint: WHIP_MESSAGE_MODES.join('|'),
+            applies: 'Applies on the next attach.',
+            group: 'display',
+            order: 40,
+            format: (config) => config.whip_message_mode === 'go-faster' ? 'go faster' : 'random',
+            cycle: (config, delta) => { config.whip_message_mode = cycleChoice(WHIP_MESSAGE_MODES, config.whip_message_mode, delta); },
+            setFromString: (config, raw) => {
+                if (!WHIP_MESSAGE_MODES.includes(raw))
+                    return `whip_message_mode must be one of: ${WHIP_MESSAGE_MODES.join('|')}`;
+                config.whip_message_mode = raw;
+                return null;
+            },
+        },
+    },
     mouse_mode_default: {
         surface: 'settings',
         setting: {
@@ -365,9 +385,10 @@ export const CONFIG_SETTINGS_COVERAGE = {
     modelRoutes: { surface: 'specialized', owner: 'Models route declarations' },
     modelRouting: { surface: 'specialized', owner: 'Models route declarations' },
     kinds: { surface: 'specialized', owner: 'Models tab and kind registry' },
-    page_components: { surface: 'specialized', owner: 'Page component catalog: product-registered page slot kinds' },
+    page_components: { surface: 'specialized', owner: 'Page component catalog: product-registered page component kinds' },
     remoteCanvas: { surface: 'specialized', owner: 'canvas config commands' },
     spawnEnv: { surface: 'specialized', owner: 'spawn environment allow-list' },
+    bin: { surface: 'specialized', owner: 'bare-binary contributions on every node PATH' },
 };
 /** The exhaustive top-level key list used by config persistence and help. */
 export const SCOPE_CONFIG_KEYS = Object.keys(CONFIG_SETTINGS_COVERAGE);

package/dist/core/worktree.d.ts

@@ -1,4 +1,3 @@
-import { type GitResult, type GitSyncOptions } from './git.js';
 import { type NodeMeta, type ManagedWorktree } from './canvas/index.js';
 export interface WorktreeCommandResult {
     ok: boolean;
@@ -23,32 +22,24 @@ export interface CloseManagedWorktreeResult {
     branch: string;
     worktree_path: string;
     landed_sha: string;
-    /** False when the landing happened but the worktree checkout could not be
-     *  removed automatically afterward — the close still counts as done (state is
-     *  closed, push-final is unblocked); `worktree_remove_error` carries the
-     *  manual cleanup note. */
+    /** Always false for a live caller: cleanup is deliberately pending until
+     * the caller exits and the reported manual command can safely remove it. */
     worktree_removed: boolean;
     worktree_remove_error?: string;
-    /** False when the landing happened but the local branch could not be deleted
-     *  afterward — same non-fatal treatment as worktree_removed. */
+    /** Always false while the pending-cleanup checkout has this branch checked out. */
     branch_deleted: boolean;
     branch_delete_error?: string;
 }
 export declare function closeManagedWorktree(nodeId: string): CloseManagedWorktreeResult;
-type WorktreeCleanupRunner = (args: string[], cwd: string, options: GitSyncOptions) => GitResult;
-/** Test seam for the bounded post-land cleanup regression. */
-export declare function setWorktreeCleanupRunnerForTest(runner?: WorktreeCleanupRunner): void;
 /** Recovery guidance for a vanished checkout whose refs do not prove that its
  * work is delivered. This deliberately never recommends `worktree close`:
  * that command cannot operate on the absent checkout. */
 export declare function missingWorktreeRecoveryHint(wt: ManagedWorktree): string;
 interface CleanEmptyProof {
-    /** The branch's HEAD SHA at the moment this was proven clean-and-contained
-     *  — the exact value the destructive delete must be conditioned on. */
+    /** The branch's HEAD SHA at the moment this was proven clean and contained
+     * in the current base. */
     branchSha: string;
-    /** The base branch tip the proof was made against; re-resolved and
-     *  re-checked immediately before the destructive delete, since the proof
-     *  and the delete are two different points in time. */
+    /** The current base tip, retained for race diagnostics. */
     baseSha: string;
 }
 /** Fix B's shared "nothing to land" test — the SAME clean-worktree definition
@@ -58,20 +49,11 @@ interface CleanEmptyProof {
  *  be a git-ancestor of (or equal to) the CURRENT tip of its recorded base
  *  branch — i.e. landing it would be a pure no-op. Any ambiguity (missing
  *  path, mid-rebase, wrong branch, an unresolvable base, or a real ancestry
- *  divergence) returns null: this function only ever proves "safe to drop"
+ *  divergence) returns null: this function only ever proves a no-op land
  *  when a live git check establishes it, never on a heuristic guess, so real
- *  unlanded work always falls through to the existing explicit-close guard.
- *  This proof is NOT itself the safety boundary — it only decides whether
- *  auto-drop is even attempted. `autoDropCleanManagedWorktreeLocked` below
- *  re-proves containment against the LIVE base immediately before the
- *  destructive delete, refuses outright if the checkout cannot be removed,
- *  and conditions the delete itself on BOTH `branchSha` and that same live
- *  base SHA via `bestEffortDeleteBranchWithBaseProof`'s atomic multi-ref
- *  transaction — those checks, not this one, are what close the TOCTOU gap.
- *  Exported (alongside
- *  `autoDropCleanManagedWorktreeLocked`) purely so regression tests can
- *  inject a race in the window between proving and cleanup; production code
- *  must always go through `autoDropCleanManagedWorktree`. */
+ *  unlanded work always falls through to the explicit-close guard. The locked
+ *  path re-checks this predicate before recording deferred cleanup; production
+ *  code must always go through `autoDropCleanManagedWorktree`. */
 export declare function proveCleanEmptyManagedWorktree(wt: ManagedWorktree): CleanEmptyProof | null;
 export interface AutoDroppedWorktree {
     node_id: string;
@@ -82,22 +64,10 @@ export interface AutoDroppedWorktree {
     branch_deleted: boolean;
     branch_delete_error?: string;
 }
-/** Exported (see `proveCleanEmptyManagedWorktree`'s doc) so regression tests
- *  can call it directly with a proof captured before injecting a race.
- *  Returns null — persisting NO state change — when the immediate base
- *  re-verification, the checkout removal, or the atomic base+branch delete
- *  refuses: the caller (`autoDropCleanManagedWorktree`, and `push final`
- *  above it) then falls through to the existing `open_managed_worktree`
- *  guard exactly as if this worktree had never looked droppable. In every
- *  refusal case the branch, and every commit reachable from it, is
- *  unconditionally preserved — that is the actual safety property this
- *  function guarantees. A checkout-removal refusal in particular must be
- *  treated as a full refusal, not a partial success: if the checkout cannot
- *  be removed (e.g. a file reappeared after the clean predicate ran), the
- *  branch is still checked out somewhere, so this function must never reach
- *  the ref-deletion transaction or mutate managed-worktree state — both the
- *  branch and the live checkout stay fully recoverable and the caller's
- *  `open_managed_worktree` guard fires. */
+/** Re-check a clean auto-drop before closing its record. `push final` runs
+ * inside the owner broker, so it has the same destructive-cwd boundary as
+ * explicit close: removal and branch deletion are deferred until that owner
+ * has exited. */
 export declare function autoDropCleanManagedWorktreeLocked(nodeId: string, wt: ManagedWorktree, proof: CleanEmptyProof): AutoDroppedWorktree | null;
 /** `push final`'s escape hatch: a managed worktree that has
  *  nothing to land is auto-dropped instead of blocking on an explicit
@@ -106,7 +76,7 @@ export declare function autoDropCleanManagedWorktreeLocked(nodeId: string, wt: M
  *  that never had anything to close in the first place (a read-only
  *  review node). Returns null and changes nothing when the worktree is not
  *  PROVABLY empty-and-clean by `proveCleanEmptyManagedWorktree`, OR when a
- *  concurrent mutation invalidates that proof before the destructive delete
+ *  concurrent mutation invalidates that proof before the record is closed
  *  (see `autoDropCleanManagedWorktreeLocked`); the caller's existing
  *  `open_managed_worktree` guard then still applies unchanged — real
  *  commits, real uncommitted changes, and a lost race all require the