@north-light/crouter 0.3.198 → 0.3.200

package/dist/daemon/cron-run.js

@@ -30,26 +30,24 @@
 // promises for graceful-teardown drain but never blocks on a slow run.
 import { spawn } from 'node:child_process';
 import { createHash, randomBytes, randomUUID } from 'node:crypto';
-import { join } from 'node:path';
 import { setTimeout as delay } from 'node:timers/promises';
 import { rmSync } from 'node:fs';
 import { synthesizedPageDocument, writeSynthesizedPage } from '../core/human/page-synth.js';
 import { ticketDir } from '../core/human/root.js';
 import { preparePage, publishPage } from '../core/human/tickets.js';
-import { readConfig } from '../core/config.js';
+import { resolvePageComponents } from '../core/config.js';
 import { dueClockCrons, dueOverlapCrons, expiredIdleCrons, runningCrons, acquireCronRunLease, releaseCronRunLease, recordCronRun, listCronRuns, advanceCron, consumeCron, cancelCron, killLeasedCronRun, verifyLeasedCronRun, getCron, setCronState, setCronLastOutputHash, } from '../core/canvas/crons.js';
 import { getNode } from '../core/canvas/canvas.js';
 import { fullName } from '../core/canvas/labels.js';
 import { killProcessGroup } from '../core/canvas/pid.js';
 import { appendInbox } from '../core/feed/inbox.js';
-import { atomicWriteJson } from '../core/fs-utils.js';
 import { emitEvent } from '../core/events/emit.js';
 import { loadProfileManifest } from '../core/profiles/manifest.js';
 import { hasNoNaturalCycle } from '../core/runtime/revive-all.js';
 import { spawnChild } from '../core/runtime/spawn.js';
 import { cronWakeOrigin } from '../core/runtime/bearings.js';
 import { nextSlotAfter, cadenceDisplay } from '../core/wake.js';
-import { buildOperationalEnvBase } from '../core/runtime/spawn-env.js';
+import { ADMITTED_HOST_PATH_ENV, buildOperationalEnvBase, resolveAdmittedHostCommand } from '../core/runtime/spawn-env.js';
 import { parseSink } from './cron-sink.js';
 import { readProfileEnvVars } from '../core/profiles/env-store.js';
 /** Output head caps for the run log (spec: "capped, e.g. 4KB"). */
@@ -223,9 +221,9 @@ async function deliverSpawnSink(c, kind, stdout) {
     });
     return res.node.node_id;
 }
-/** Deliver stdout through crouter as a durable notify page (fire-and-forget
- *  inbox state — jobs whose output is a person's call). Mirrors `crtr human
- *  notify` minus the CLI-env source stamp: the page names the cron instead. */
+/** Deliver stdout through crouter as a standalone human page. Mirrors
+ * `crtr human send --inbox` for a display-only page, minus the CLI-env source
+ * stamp: the page names the cron instead. */
 function deliverHumanSink(c, stdout) {
     const synthesized = writeSynthesizedPage(synthesizedPageDocument(`⏰ cron ${c.name}`, `Scheduled cron "${c.name}" delivered output for your attention.`, stdout, false));
     // Cron stdout rides into the page verbatim, so it can carry invalid page
@@ -236,20 +234,18 @@ function deliverHumanSink(c, stdout) {
         const profileName = resolveLiveProfileName(c);
         prepared = preparePage({
             sourceFile: synthesized.path,
-            dialect: 'html',
             source: {
                 sessionName: `cron ${c.name} (${c.cron_id})`,
                 ...(profileName === undefined ? {} : { profileName }),
             },
-            productKinds: readConfig('user').page_components,
+            productKinds: resolvePageComponents(),
+            delivery: { placement: 'inline', inbox: true, reply: false },
         });
     }
     finally {
         rmSync(synthesized.dir, { recursive: true, force: true });
     }
-    const id = `nfy-${randomBytes(4).toString('hex')}`;
-    const rc = { mode: 'notify' };
-    atomicWriteJson(join(ticketDir(id), 'run.json'), rc);
+    const id = `page-${randomBytes(4).toString('hex')}`;
     publishPage(ticketDir(id), prepared);
 }
 /** Route stdout to the cron's armed sink. Returns the delivered string on
@@ -267,7 +263,7 @@ async function deliverToSink(c, stdout) {
         return `delivered: spawned ${nodeId}`;
     }
     deliverHumanSink(c, stdout);
-    return 'delivered: human notify';
+    return 'delivered: human send --inbox';
 }
 function failureSummary(ctx, deliveryFailure) {
     if (deliveryFailure !== null)
@@ -328,7 +324,7 @@ function buildEscalationKickoff(c, ctx, deliveryFailure) {
         `Diagnose why it failed and decide what to do:`,
         `- Transient or fixable: fix the environment/command context, verify with \`crtr cron run ${c.cron_id}\` (fires now, out of band, shows you the result), then \`crtr cron resume ${c.cron_id}\` to re-arm it.`,
         `- Obsolete: \`crtr cron cancel ${c.cron_id}\`.`,
-        `- The user's call (or the fix needs a change you cannot make): \`crtr human ask\`.`,
+        `- The user's call (or the fix needs a change you cannot make): \`crtr human send\`.`,
         '',
         'The cron stays paused until someone resumes it — nothing refires while you work.',
     ].join('\n');
@@ -639,8 +635,9 @@ export function executeCron(c, opts) {
         // Layering: profile store < the arm-time `--env` snapshot (an explicit
         // choice) < crtr's own constructed CRTR_* names, which always win.
         const profileId = resolveLiveProfile(c);
+        const operationalEnv = buildOperationalEnvBase({ targetCwd: c.cwd, targetProfileId: profileId });
         const env = {
-            ...buildOperationalEnvBase({ targetCwd: c.cwd, targetProfileId: profileId }),
+            ...operationalEnv,
             ...readProfileEnvVars(profileId),
             ...extraEnv,
             ...(profileId !== null ? { CRTR_PROFILE_ID: profileId } : {}),
@@ -660,11 +657,12 @@ export function executeCron(c, opts) {
         }
         if (c.anchor_node != null)
             env['CRTR_ANCHOR'] = c.anchor_node;
+        env[ADMITTED_HOST_PATH_ENV] = operationalEnv[ADMITTED_HOST_PATH_ENV];
         const startedAtMs = Date.now();
         const startedAtIso = new Date(startedAtMs).toISOString();
         let child;
         try {
-            child = spawn('bash', ['-c', c.command], {
+            child = spawn(resolveAdmittedHostCommand('bash', env, c.cwd), ['-c', c.command], {
                 cwd: c.cwd,
                 env,
                 detached: true, // own process group — killProcessGroup(-pid) reaps the whole tree

package/dist/daemon/human/finish.d.ts

@@ -1,14 +1,19 @@
-import type { ProductPageComponents } from '../../types.js';
 import type { TicketResult } from '../../core/human/types.js';
+/** Every ticket-ending action retires the ticket's feedback companion — done
+ * when active or idle, never left resident. Idempotent and replay-safe; a
+ * corrupt feedback file must not block result publication. Exported for the
+ * daemon-start sweep, which must settle terminal tickets whether or not a
+ * reply bridge exists. */
+export declare function settleFeedbackCompanion(ticketId: string): void;
 /**
  * The one completion path for a page ticket: claim takeover, exclusive result
- * publication, then the asking node's wake. Every addressing surface — the
- * node-addressed resolve route and the ticket-id-addressed inbox respond route —
- * finishes a page here, so an answer always reaches the node that asked.
+ * publication, then optional reply delivery. Every addressing surface routes
+ * through this function, so the reply-route descriptor is the sole authority
+ * on whether completion reaches a bridge.
  */
-export declare function resolvePageTicket(nodeId: string, responses: unknown, productKinds?: ProductPageComponents): Promise<TicketResult>;
+export declare function resolvePageTicket(ticketId: string, responses: unknown): Promise<TicketResult>;
 /** Cancel a ticket with the store's first-writer-wins publication. */
-export declare function cancelHumanTicket(nodeId: string, opts: {
+export declare function cancelHumanTicket(ticketId: string, opts: {
     reason?: string;
     actor?: string;
 }): Promise<TicketResult>;
@@ -17,4 +22,4 @@ export declare function cancelHumanTicket(nodeId: string, opts: {
  * receipt: every action below is replay-safe, so lost delivery can be retried
  * by a later resolve/cancel attempt or the daemon-start sweep.
  */
-export declare function deliverTerminalResult(nodeId: string): Promise<boolean>;
+export declare function deliverTerminalResult(ticketId: string): Promise<boolean>;

package/dist/daemon/human/finish.js

@@ -1,17 +1,67 @@
-import { join } from 'node:path';
 import { ApiError } from '../../api/index.js';
 import { getRow, subscribersOf } from '../../core/canvas/canvas.js';
-import { readConfig } from '../../core/config.js';
 import { ticketDir } from '../../core/human/root.js';
 import { parsePage } from '../../core/human/page.js';
 import { cancelTicket, projectReviewOutput, readTicketResult, takeoverAndCompletePage, } from '../../core/human/tickets.js';
 import { describePageAnswer } from '../../core/human/answer.js';
 import { renderAnswerText } from '../../core/human/answer-text.js';
-import { responsePath } from '../../core/human/convention.js';
-import { readJsonOrNull } from '../../core/fs-utils.js';
+import { pagePath, readTicketReplyRoute, responsePath } from '../../core/human/convention.js';
+import { readPageFeedback } from '../../core/human/feedback.js';
+import { pageDocumentSha256 } from '../../core/human/feedback-companion.js';
 import { appendInbox } from '../../core/feed/inbox.js';
 import { FinalDeliveryError, pushFinal } from '../../core/feed/feed.js';
 import { transition } from '../../core/runtime/lifecycle.js';
+import { emitEvent } from '../../core/events/emit.js';
+import { retireCompanion } from '../companion-retire.js';
+/** Every ticket-ending action retires the ticket's feedback companion — done
+ * when active or idle, never left resident. Idempotent and replay-safe; a
+ * corrupt feedback file must not block result publication. Exported for the
+ * daemon-start sweep, which must settle terminal tickets whether or not a
+ * reply bridge exists. */
+export function settleFeedbackCompanion(ticketId) {
+    try {
+        const companionNodeId = readPageFeedback(ticketDir(ticketId)).companionNodeId;
+        if (companionNodeId !== undefined)
+            retireCompanion(companionNodeId, 'approved');
+    }
+    catch (error) {
+        emitEvent({ level: 'warn', event: 'human.feedback_companion.retire_failed', error });
+    }
+}
+/** The settle-time feedback addendum to a page completion — answer and
+ * cancellation alike: a change notice when the final page differs from the
+ * version first commented on, and each still-open item's quote and note.
+ * Silent when the page is unchanged and no feedback remains open; never a
+ * manufactured prose diff. */
+function feedbackAddendum(dir) {
+    let sections;
+    try {
+        const feedback = readPageFeedback(dir);
+        if (feedback.companionNodeId === undefined)
+            return '';
+        sections = [];
+        if (feedback.firstCommentedSha256 !== undefined && pageDocumentSha256(dir) !== feedback.firstCommentedSha256) {
+            sections.push(`The page changed during feedback: the person commented on it and its companion conversation (node ${feedback.companionNodeId}) revised it in place. ` +
+                `Reread the final page at ${pagePath(dir, 'jsx')} before interpreting this outcome.`);
+        }
+        const open = feedback.comments.filter((comment) => comment.status === 'open');
+        if (open.length > 0) {
+            const items = open.map((comment) => [
+                ...comment.quote.split('\n').map((line) => `> ${line}`),
+                comment.note,
+            ].join('\n'));
+            sections.push([
+                `Feedback left unresolved at settlement — the companion conversation (node ${feedback.companionNodeId}) had not dealt with these items:`,
+                ...items,
+            ].join('\n\n'));
+        }
+    }
+    catch {
+        // The answer itself is the deliverable; a broken feedback record adds nothing.
+        return '';
+    }
+    return sections.length === 0 ? '' : `\n\n${sections.join('\n\n')}`;
+}
 /** A corrupt manifest must not strand the asking node: the raw response remains its escape hatch. */
 function renderCorruptPageAnswer(result, resultPath) {
     return [
@@ -24,22 +74,21 @@ function renderCorruptPageAnswer(result, resultPath) {
 }
 function pageTitle(dir) {
     try {
-        return parsePage(dir, readConfig('user').page_components).title;
+        return parsePage(dir).title;
     }
     catch {
         return undefined;
     }
 }
 function renderPageAnswer(dir, result, resultPath) {
-    const productKinds = readConfig('user').page_components;
     let manifest;
     try {
-        manifest = parsePage(dir, productKinds);
+        manifest = parsePage(dir);
     }
     catch {
         return renderCorruptPageAnswer(result, resultPath);
     }
-    return renderAnswerText(describePageAnswer(manifest, result.responses, { completedAt: result.completedAt, productKinds }), resultPath);
+    return renderAnswerText(describePageAnswer(manifest, result.responses, { completedAt: result.completedAt }), resultPath) + feedbackAddendum(dir);
 }
 function deliveryFailed(error) {
     // A canonical final is committed inside its own write boundary and can never
@@ -51,9 +100,9 @@ function deliveryFailed(error) {
     const detail = error instanceof Error ? error.message : String(error);
     return new ApiError(500, 'delivery_failed', `The answer is recorded and delivery will be retried: ${detail}`);
 }
-async function deliverOrConflict(nodeId) {
+async function deliverOrConflict(ticketId) {
     try {
-        await deliverTerminalResult(nodeId);
+        await deliverTerminalResult(ticketId);
     }
     catch (error) {
         throw deliveryFailed(error);
@@ -62,16 +111,16 @@ async function deliverOrConflict(nodeId) {
 }
 /**
  * The one completion path for a page ticket: claim takeover, exclusive result
- * publication, then the asking node's wake. Every addressing surface — the
- * node-addressed resolve route and the ticket-id-addressed inbox respond route —
- * finishes a page here, so an answer always reaches the node that asked.
+ * publication, then optional reply delivery. Every addressing surface routes
+ * through this function, so the reply-route descriptor is the sole authority
+ * on whether completion reaches a bridge.
  */
-export async function resolvePageTicket(nodeId, responses, productKinds = []) {
-    const completed = takeoverAndCompletePage(ticketDir(nodeId), responses, { host: 'crtrd', pid: process.pid }, { productKinds });
+export async function resolvePageTicket(ticketId, responses) {
+    const completed = takeoverAndCompletePage(ticketDir(ticketId), responses, { host: 'crtrd', pid: process.pid });
     if (!completed.won)
-        return deliverOrConflict(nodeId);
+        return deliverOrConflict(ticketId);
     try {
-        await deliverTerminalResult(nodeId);
+        await deliverTerminalResult(ticketId);
     }
     catch (error) {
         throw deliveryFailed(error);
@@ -79,12 +128,12 @@ export async function resolvePageTicket(nodeId, responses, productKinds = []) {
     return completed.result;
 }
 /** Cancel a ticket with the store's first-writer-wins publication. */
-export async function cancelHumanTicket(nodeId, opts) {
-    const canceled = cancelTicket(ticketDir(nodeId), opts);
+export async function cancelHumanTicket(ticketId, opts) {
+    const canceled = cancelTicket(ticketDir(ticketId), opts);
     if (canceled.status === 'already_resolved')
-        return deliverOrConflict(nodeId);
+        return deliverOrConflict(ticketId);
     try {
-        await deliverTerminalResult(nodeId);
+        await deliverTerminalResult(ticketId);
     }
     catch (error) {
         throw deliveryFailed(error);
@@ -96,41 +145,55 @@ export async function cancelHumanTicket(nodeId, opts) {
  * receipt: every action below is replay-safe, so lost delivery can be retried
  * by a later resolve/cancel attempt or the daemon-start sweep.
  */
-export async function deliverTerminalResult(nodeId) {
-    const dir = ticketDir(nodeId);
-    const run = readJsonOrNull(join(dir, 'run.json'));
-    if (run?.mode === 'notify')
-        return false;
+export async function deliverTerminalResult(ticketId) {
+    const dir = ticketDir(ticketId);
     const result = readTicketResult(dir);
     if (result === null)
         return false;
+    // Companion retirement rides the committed result, BEFORE the reply-route
+    // gate: every ticket-ending path (resolve, cancel, conflict replay) funnels
+    // through here, and an inbox-only page with no reply bridge still settles
+    // its companion. The daemon-start sweep settles the tickets that die before
+    // reaching this call.
+    settleFeedbackCompanion(ticketId);
+    const replyRoute = readTicketReplyRoute(dir);
+    if (replyRoute === null)
+        return false;
+    const bridgeNodeId = replyRoute.bridge_node_id;
     projectReviewOutput(dir);
-    // The ROW, not `getNode`: a ticket directory IS the bridge's node directory,
-    // so a bridge whose row has been pruned still answers `getNode` from its
-    // surviving meta.json — with no status at all, which passed every guard below
-    // and then threw out of `transition` on every sweep, re-fanning the
-    // cancellation notice each time. No row means nothing left to deliver to.
-    const node = getRow(nodeId);
+    // The ROW, not node metadata: a bridge whose row has been pruned may retain
+    // its ticket files, but no lifecycle target remains. No row means nothing is
+    // left to deliver to.
+    const node = getRow(bridgeNodeId);
     if (node === null || node.status === 'dead' || node.status === 'canceled' || (node.status === 'done' && node.final_report !== null)) {
         return true;
     }
     if (result.kind === 'canceled') {
         const title = pageTitle(dir);
         const reason = result.reason !== undefined && result.reason !== '' ? result.reason : 'no reason was given';
-        const subject = title === undefined ? `human interaction ${nodeId} canceled — no answer is coming` : `human interaction ${nodeId} — “${title}” canceled, no answer is coming`;
-        const body = title === undefined ? `The human interaction ${nodeId} was canceled — ${reason}. No response will arrive, and any partial answers the human had entered were discarded unsent.` : `The page “${title}” was canceled — ${reason}. No response will arrive, and any partial answers the human had entered were discarded unsent.`;
+        // A human dismissal is a rejection, not a routing event: say so plainly so
+        // the agent acts on the "no" instead of re-raising the same ask.
+        const dismissed = result.actor === 'human';
+        const subject = dismissed
+            ? (title === undefined ? `human interaction ${ticketId} dismissed without answering` : `human interaction ${ticketId} — “${title}” dismissed without answering`)
+            : (title === undefined ? `human interaction ${ticketId} canceled — no answer is coming` : `human interaction ${ticketId} — “${title}” canceled, no answer is coming`);
+        // Dismissal and withdrawal are settlement paths too: the sender still
+        // needs any unresolved feedback and the exceptional page-change notice.
+        const body = (dismissed
+            ? `The user dismissed ${title === undefined ? `the human interaction ${ticketId}` : `“${title}”`} without answering — a deliberate “no, I'm not answering this.” Treat it as a rejection: no response will arrive, no partial answer exists, and the same ask must not be raised again.`
+            : (title === undefined ? `The human interaction ${ticketId} was canceled — ${reason}. No response will arrive, and any partial answers the user had entered were discarded unsent.` : `The page “${title}” was canceled — ${reason}. No response will arrive, and any partial answers the user had entered were discarded unsent.`)) + feedbackAddendum(dir);
         // One failing subscriber must not silence the rest, and the bridge stays
         // live until every notice lands: a partial fanout leaves the ticket for the
         // next resolve/cancel attempt or the daemon-start sweep to replay. A
         // subscriber notified twice reads the same idempotent "no answer is coming";
         // a subscriber never notified waits forever.
         const failedTo = [];
-        for (const subscriber of subscribersOf(nodeId)) {
+        for (const subscriber of subscribersOf(bridgeNodeId)) {
             if (result.actor !== undefined && subscriber.node_id === result.actor)
                 continue;
             try {
                 appendInbox(subscriber.node_id, {
-                    from: nodeId,
+                    from: bridgeNodeId,
                     tier: 'normal',
                     kind: 'message',
                     label: subject,
@@ -143,11 +206,11 @@ export async function deliverTerminalResult(nodeId) {
         }
         if (failedTo.length > 0)
             throw new Error(`cancellation notice failed for ${failedTo.join(', ')}`);
-        transition(nodeId, 'finish');
+        transition(bridgeNodeId, 'finish');
         return true;
     }
     if (result.kind === 'page') {
-        await pushFinal(nodeId, renderPageAnswer(dir, result, responsePath(dir)));
+        await pushFinal(bridgeNodeId, renderPageAnswer(dir, result, responsePath(dir)));
     }
     return true;
 }

package/dist/daemon/human/sweep.js

@@ -5,7 +5,7 @@ import { getReviewByBridge } from '../../core/review/store.js';
 import { emitEvent } from '../../core/events/emit.js';
 import { ticketsRoot } from '../../core/human/root.js';
 import { readTicketResult } from '../../core/human/tickets.js';
-import { deliverTerminalResult } from './finish.js';
+import { deliverTerminalResult, settleFeedbackCompanion } from './finish.js';
 function isTerminalBridge(status) {
     return status === 'done' || status === 'dead' || status === 'canceled';
 }
@@ -27,6 +27,10 @@ export async function reconcileUndeliveredTickets() {
             // finisher retries only when its winning operation is explicitly repeated.
             if (getReviewByBridge(entry) !== null)
                 continue;
+            // A terminal page ticket retires its feedback companion whether or not a
+            // reply bridge exists: inbox-only pages have no bridge row, yet the
+            // daemon can die between result publication and companion retirement.
+            settleFeedbackCompanion(entry);
             // The ROW is what carries status; `getNode` would answer from a pruned
             // bridge's surviving meta.json with no status at all.
             const bridge = getRow(entry);

package/dist/daemon/profile-delete.d.ts

@@ -0,0 +1,7 @@
+import type { DeleteProfileResultDTO } from '../api/index.js';
+/** Validate and enact one forced profile deletion. A request from a node that
+ *  belongs to the target profile is acknowledged before its broker is stopped. */
+export declare function requestProfileDeletion(name: string, body: unknown): Promise<{
+    status: 200 | 202;
+    body: DeleteProfileResultDTO;
+}>;