@north-light/crouter 0.3.215 → 0.3.217

package/dist/core/human/tickets.js

@@ -5,7 +5,7 @@ import { z } from 'zod';
 import { buildPageSummary } from './summary.js';
 import { atomicWriteJson, atomicWriteText, clearProgress, claimPath, pageManifestPath, pageModulePath, pagePath, progressPath, publishJsonExclusive, requireTicket, responsePath, reviewPath } from './convention.js';
 import { validateReviewDescriptor, validateReviewProjection } from './review-schema.js';
-import { compilePage, deriveHtmlPageManifest, derivePageManifestFromDocument, parsePage, PageAuthoringError } from './page.js';
+import { compilePage, deriveHtmlPageManifest, derivePageManifestFromDocument, parsePage, parsePageDelivery, PageAuthoringError } from './page.js';
 import { isResponseBearingSlot, validatePageResponses, validatePartialPageResponses } from './page-schema.js';
 import { signalInboxActivity } from './root.js';
 import { readTicketClaim, releaseClaimLocked, withTicketLock } from './claim.js';
@@ -145,6 +145,13 @@ function requireSettleablePage(dir) {
         throw new Error('page_has_no_response_lifecycle');
     return manifest;
 }
+function requireCancelablePage(dir) {
+    // Cancellation never interprets answers. Reading only this stable envelope
+    // keeps an older resident daemon able to retract a page authored by a newer CLI.
+    const delivery = parsePageDelivery(dir);
+    if (!delivery.inbox && !delivery.reply)
+        throw new Error('page_has_no_response_lifecycle');
+}
 function isEmptyResponseMap(responses) {
     return typeof responses === 'object' && responses !== null && !Array.isArray(responses) && Object.keys(responses).length === 0;
 }
@@ -272,7 +279,7 @@ export function cancelTicket(dir, opts = {}) {
     const ticket = requireTicket(dir);
     const canceled = withTicketLock(ticket, () => {
         if (existsSync(pageManifestPath(ticket)))
-            requireSettleablePage(ticket);
+            requireCancelablePage(ticket);
         const result = { schema: 'humanloop.cancel/v1', kind: 'canceled', canceledAt: new Date().toISOString(), ...(opts.reason === undefined ? {} : { reason: opts.reason }), ...(opts.actor === undefined ? {} : { actor: opts.actor }) };
         const won = exclusiveResult(ticket, result);
         return { status: won ? 'canceled' : 'already_resolved', result: won ? result : readTicketResult(ticket) ?? result };

package/dist/core/profiles/manifest.d.ts

@@ -39,7 +39,19 @@ export declare function loadProfileManifest(profileIdOrName: string): ProfileEnt
  *  below run inside this. */
 export declare function withProfileManifestLock<T>(profileId: string, fn: () => T): T;
 export declare function ensureRootProfile(): ProfileEntry;
-export declare function assertProfileMetadata(entries: Record<string, string>): void;
+/** The env name a metadata entry surfaces as (spawn-env source F). Also the
+ *  uniqueness domain for keys: the fold is lossy (`a-b`, `a_b`, `A_B` →
+ *  `CRTR_PROFILE_META_A_B`), so two stored keys may not share a fold. */
+export declare function metadataEnvName(key: string): string;
+/** Reject anything a valid metadata map may not carry. Takes `unknown`
+ *  because the API route hands over a caller-supplied body slice — the
+ *  TypeScript type on the DTO proves nothing at runtime. */
+export declare function assertProfileMetadata(entries: unknown): asserts entries is Record<string, string>;
+/** Drop entries no valid mutation could have written — a manifest is
+ *  hand-editable, so a projection or merge base must never trust it raw.
+ *  Never throws; on an env-name collision the first entry wins (matching
+ *  injection, where a deterministic winner beats insertion-order luck). */
+export declare function sanitizeProfileMetadata(stored: unknown): Record<string, string>;
 export declare function createProfile(name: string, projects?: string[], opts?: {
     defaultKind?: string;
     metadata?: Record<string, string>;

package/dist/core/profiles/manifest.js

@@ -295,7 +295,23 @@ export function ensureRootProfile() {
  *  (`CRTR_PROFILE_META_<KEY>`, see `core/runtime/spawn-env.ts`) by
  *  construction. */
 const METADATA_KEY_SHAPE = /^[A-Za-z0-9][A-Za-z0-9_-]*$/;
+/** The env name a metadata entry surfaces as (spawn-env source F). Also the
+ *  uniqueness domain for keys: the fold is lossy (`a-b`, `a_b`, `A_B` →
+ *  `CRTR_PROFILE_META_A_B`), so two stored keys may not share a fold. */
+export function metadataEnvName(key) {
+    return `CRTR_PROFILE_META_${key.toUpperCase().replace(/[^A-Z0-9]+/g, '_')}`;
+}
+/** Reject anything a valid metadata map may not carry. Takes `unknown`
+ *  because the API route hands over a caller-supplied body slice — the
+ *  TypeScript type on the DTO proves nothing at runtime. */
 export function assertProfileMetadata(entries) {
+    if (typeof entries !== 'object' || entries === null || Array.isArray(entries)) {
+        throw usage('metadata must be a map of string keys to string values', {
+            field: 'metadata',
+            next: 'Pass an object, e.g. {"role": "support"}.',
+        });
+    }
+    const claimed = new Map();
     for (const [key, value] of Object.entries(entries)) {
         if (!METADATA_KEY_SHAPE.test(key)) {
             throw usage(`invalid metadata key: ${JSON.stringify(key)}`, {
@@ -304,14 +320,54 @@ export function assertProfileMetadata(entries) {
                 next: 'Keys start with a letter or digit, followed by letters, digits, `_`, or `-`.',
             });
         }
+        if (typeof value !== 'string') {
+            throw usage(`metadata value for ${key} must be a string`, {
+                received: typeof value,
+                field: 'metadata',
+                next: 'Every metadata value is an env-var value — pass strings only.',
+            });
+        }
         if (value.includes('\0')) {
             throw usage(`metadata value for ${key} contains a NUL byte, which no OS accepts in an environment variable`, {
                 field: 'metadata',
                 next: 'Remove NUL bytes from the value and retry.',
             });
         }
+        const envName = metadataEnvName(key);
+        const prior = claimed.get(envName);
+        if (prior !== undefined) {
+            throw usage(`metadata keys ${JSON.stringify(prior)} and ${JSON.stringify(key)} both surface as ${envName}`, {
+                field: 'metadata',
+                next: 'Rename or drop one — keys must stay distinct after uppercasing and `_`-folding.',
+            });
+        }
+        claimed.set(envName, key);
     }
 }
+/** Drop entries no valid mutation could have written — a manifest is
+ *  hand-editable, so a projection or merge base must never trust it raw.
+ *  Never throws; on an env-name collision the first entry wins (matching
+ *  injection, where a deterministic winner beats insertion-order luck). */
+export function sanitizeProfileMetadata(stored) {
+    if (typeof stored !== 'object' || stored === null || Array.isArray(stored))
+        return {};
+    const out = {};
+    const claimed = new Set();
+    for (const [key, value] of Object.entries(stored)) {
+        if (typeof value !== 'string')
+            continue;
+        if (!METADATA_KEY_SHAPE.test(key))
+            continue;
+        if (value.includes('\0'))
+            continue;
+        const envName = metadataEnvName(key);
+        if (claimed.has(envName))
+            continue;
+        claimed.add(envName);
+        out[key] = value;
+    }
+    return out;
+}
 export function createProfile(name, projects = [], opts = {}) {
     const trimmed = name.trim();
     if (trimmed === '')
@@ -420,9 +476,13 @@ export function setProfileDefaultKind(profileId, defaultKind) {
 export function updateProfileMetadata(profileId, set, unset = []) {
     assertProfileMetadata(set);
     return mutateManifest(profileId, (m) => {
-        const next = { ...(m.metadata ?? {}), ...set };
+        const next = { ...sanitizeProfileMetadata(m.metadata), ...set };
         for (const key of unset)
             delete next[key];
+        // Re-assert the merged result: a set key may collide with a STORED key in
+        // the env-name domain (`a-b` over stored `a_b`), which per-argument
+        // validation cannot see.
+        assertProfileMetadata(next);
         const { metadata: _dropped, ...rest } = m;
         return { ...rest, ...(Object.keys(next).length > 0 ? { metadata: next } : {}) };
     });
@@ -436,18 +496,7 @@ export function readProfileMetadata(profileId) {
     if (profileId === null || profileId === '')
         return {};
     try {
-        const stored = loadExactProfileManifest(profileId).manifest.metadata ?? {};
-        const out = {};
-        for (const [key, value] of Object.entries(stored)) {
-            if (typeof value !== 'string')
-                continue;
-            if (!METADATA_KEY_SHAPE.test(key))
-                continue;
-            if (value.includes('\0'))
-                continue;
-            out[key] = value;
-        }
-        return out;
+        return sanitizeProfileMetadata(loadExactProfileManifest(profileId).manifest.metadata);
     }
     catch {
         return {};

package/dist/core/runtime/spawn-env.js

@@ -33,7 +33,7 @@ import { statSync } from 'node:fs';
 import { delimiter, resolve } from 'node:path';
 import { readMergedLaunchConfig } from '../config.js';
 import { readProfileEnvVars } from '../profiles/env-store.js';
-import { readProfileMetadata } from '../profiles/manifest.js';
+import { metadataEnvName, readProfileMetadata } from '../profiles/manifest.js';
 import { binShimDirFor } from './bin-contributions.js';
 import { FRONT_DOOR_ENV } from './front-door-env.js';
 /** A1 — literal env-var names copied verbatim (no value inspection): a login
@@ -220,7 +220,7 @@ export function buildOperationalEnvBase(opts) {
 export function profileMetadataEnv(profileId) {
     const out = {};
     for (const [key, value] of Object.entries(readProfileMetadata(profileId))) {
-        out[`CRTR_PROFILE_META_${key.toUpperCase().replace(/[^A-Z0-9]+/g, '_')}`] = value;
+        out[metadataEnvName(key)] = value;
     }
     return out;
 }

package/dist/daemon/api/handlers/profiles.js

@@ -6,6 +6,7 @@
 //   GET    /v1/profiles          list all profiles
 //   GET    /v1/profiles/:name    resolve one profile by name or id
 //   DELETE /v1/profiles/:name    required-force cascade or detach
+import { assertInstalledKind } from '../../../core/config.js';
 import { createProfile, ensureRootProfile, listProfiles, loadProfileManifest, } from '../../../core/profiles/manifest.js';
 import { requestProfileDeletion } from '../../profile-delete.js';
 import { toProfileDTO } from '../map.js';
@@ -25,6 +26,10 @@ function handleEnsure(ctx) {
     if (existing !== undefined) {
         return { status: 200, body: toProfileDTO(existing) };
     }
+    // Same gate as `profile new`/`profile kind`: a persisted unknown kind would
+    // poison every future omitted-kind create under this profile.
+    if (req.default_kind !== undefined)
+        assertInstalledKind(req.default_kind);
     const created = createProfile(name, req.projects ?? [], {
         defaultKind: req.default_kind,
         metadata: req.metadata,

package/dist/daemon/api/map.js

@@ -10,6 +10,7 @@
 // reasonable projections; this module is what makes them concrete, so any DTO
 // field that projection proves wrong is corrected here at the source.
 import { ReviewOperationError as ReviewOperationErrorClass } from '../../core/review/types.js';
+import { sanitizeProfileMetadata } from '../../core/profiles/manifest.js';
 import { contextDir, inboxPath, nodeDir, nodeMetaPath, reportsDir, reviewResultPath, transcriptPath, viewSocketPath, } from '../../core/canvas/paths.js';
 import { FinalizationError } from '../../core/feed/feed.js';
 import { NodeIdConflictError } from '../../core/runtime/nodes.js';
@@ -266,7 +267,7 @@ export function toProfileDTO(entry) {
         home: entry.manifest.home,
         paused_at: entry.manifest.paused_at,
         default_kind: entry.manifest.default_kind ?? 'general',
-        metadata: { ...(entry.manifest.metadata ?? {}) },
+        metadata: sanitizeProfileMetadata(entry.manifest.metadata),
         default_dir: null,
     };
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@north-light/crouter",
-  "version": "0.3.215",
+  "version": "0.3.217",
   "description": "crtr — agent runtime with memory, plugins, and marketplaces",
   "type": "module",
   "main": "dist/index.js",

package/runtime.lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@north-light/crouter",
-  "version": "0.3.215",
+  "version": "0.3.217",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@north-light/crouter",
-      "version": "0.3.215",
+      "version": "0.3.217",
       "hasInstallScript": true,
       "license": "MIT",
       "dependencies": {