@north-light/crouter 0.3.219 → 0.3.221

package/dist/migrations/profile-manifests.js

@@ -0,0 +1,70 @@
+// The profile-manifest lane runner: fold every registered profile-manifest
+// migration over each stored `profile.json`, one profile at a time, under the
+// caller-supplied per-profile lock.
+//
+// This lane reads RAW BYTES. The current manifest reader treats a manifest
+// whose projects are not the current shape exactly like corrupt JSON, so a
+// pre-migration home has no readable profiles at all — every profile surface,
+// `listProfiles()` included, is blind until this lane has run. That is why the
+// runner enumerates the profiles root itself, why `crtr sys migrate` runs it
+// before any other profile read, and why its snapshots (not `listProfiles()`)
+// are what the rest of that command's discovery works from.
+//
+// The lock arrives as a callback rather than an import: a migration file may
+// not reach into the profile module, and a lane runner that did would be one
+// import away from the same blind reader.
+import { existsSync, readFileSync, readdirSync } from 'node:fs';
+import { join } from 'node:path';
+import { atomicWriteJson } from '../core/fs-utils.js';
+import { STATE_MIGRATIONS } from './registry.js';
+/** Frozen copy of the generated-profile-id shape (core/profiles/manifest.ts),
+ *  so enumeration matches `listProfiles()`: a hand-made directory crtr can
+ *  never resolve is skipped here too, rather than failing the whole run. */
+const ID_SHAPE = /^[a-z0-9]+(?:-[a-z0-9]+)*-[0-9a-f]{8}$/;
+export function runProfileManifestMigrations(profilesRoot, opts) {
+    const migrations = (opts.migrations ?? STATE_MIGRATIONS).filter((m) => m.lane === 'profile-manifest');
+    const result = { profiles: 0, applied: [], snapshots: [], skipped: [] };
+    if (!existsSync(profilesRoot))
+        return result;
+    for (const dirent of readdirSync(profilesRoot, { withFileTypes: true })) {
+        if (!dirent.isDirectory())
+            continue;
+        const profileId = dirent.name;
+        if (!ID_SHAPE.test(profileId))
+            continue;
+        const path = join(profilesRoot, profileId, 'profile.json');
+        if (!existsSync(path))
+            continue;
+        result.profiles += 1;
+        opts.withLock(profileId, () => {
+            let raw;
+            try {
+                const parsed = JSON.parse(readFileSync(path, 'utf8'));
+                if (typeof parsed !== 'object' || parsed === null || Array.isArray(parsed)) {
+                    throw new Error('manifest is not a JSON object');
+                }
+                raw = parsed;
+            }
+            catch (e) {
+                result.skipped.push({ profileId, path, error: (e instanceof Error ? e.message : String(e)).split('\n')[0] });
+                return;
+            }
+            let current = raw;
+            let changed = false;
+            for (const migration of migrations) {
+                const next = migration.apply({ profileId, path, raw: current });
+                if (next === null)
+                    continue;
+                current = next;
+                changed = true;
+                result.applied.push({ profileId, path, migration: migration.description });
+            }
+            if (changed && opts.dryRun !== true)
+                atomicWriteJson(path, current);
+            // Every migration guarantees a current manifest or throws, so the folded
+            // record is the post-migration contract by construction.
+            result.snapshots.push({ profileId, path, manifest: current });
+        });
+    }
+    return result;
+}

package/dist/migrations/registry.js

@@ -3,10 +3,11 @@
 //
 // Authoring contract (each migration is one file, `NNN-<desc>.ts`, appended
 // here in order):
-//   • Idempotent. A convergent migration re-runs on every `crtr sys migrate`,
-//     so applying it to an already-migrated store must plan zero changes. A
-//     journaled migration runs once per database via user_version, but its
-//     body must still tolerate a crash-resume re-run of any filesystem work.
+//   • Idempotent. A convergent or profile-manifest migration re-runs on every
+//     `crtr sys migrate`, so applying it to already-migrated state must plan
+//     zero changes. A journaled migration runs once per database via
+//     user_version, but its body must still tolerate a crash-resume re-run of
+//     any filesystem work.
 //   • Journaled filesystem steps are crash-resumable: fs writes happen outside
 //     the db transaction, so a step interrupted mid-fs-work must complete
 //     (never corrupt) when the chain re-runs it.
@@ -16,4 +17,8 @@
 //     This keeps the registry legal in every CLI leaf's import graph (the
 //     build's V-1 gate).
 import { surfacesFrontmatterMigration } from './001-surfaces-frontmatter.js';
-export const STATE_MIGRATIONS = [surfacesFrontmatterMigration];
+import { profileProjectMemoryMigration } from './002-profile-project-memory.js';
+export const STATE_MIGRATIONS = [
+    surfacesFrontmatterMigration,
+    profileProjectMemoryMigration,
+];

package/dist/migrations/types.d.ts

@@ -1,4 +1,5 @@
 import type { DatabaseSync } from 'node:sqlite';
+import type { ProfileManifest } from '../types.js';
 export interface JournaledMigration {
     lane: 'journaled';
     description: string;
@@ -19,7 +20,33 @@ export interface ConvergentMigration {
      *  runner filters no-op changes and performs the writes. */
     apply(store: StoreSnapshot, context?: ConvergentMigrationContext): DocChange[];
 }
-export type StateMigration = JournaledMigration | ConvergentMigration;
+/** One stored `profile.json` handed to the profile-manifest lane. */
+export interface ProfileManifestInput {
+    /** The immediate directory name under the profiles root. The only root
+     *  classifier a migration may key on — a manifest `name` is mutable. */
+    profileId: string;
+    /** Absolute path to the `profile.json`. */
+    path: string;
+    /** Parsed JSON exactly as stored, historical shapes included. */
+    raw: Record<string, unknown>;
+}
+export interface ProfileManifestMigration {
+    lane: 'profile-manifest';
+    description: string;
+    /** Pure planning: the full replacement record, or null when this manifest is
+     *  already current. A structure the migration cannot convert THROWS — the
+     *  run fails rather than persisting a guessed value. */
+    apply(input: ProfileManifestInput): Record<string, unknown> | null;
+}
+export type StateMigration = JournaledMigration | ConvergentMigration | ProfileManifestMigration;
+/** One profile's manifest after every profile-manifest migration folded —
+ *  the bytes on disk after a write run, and the bytes a write run WOULD have
+ *  produced under `--dry-run`. */
+export interface ProfileManifestSnapshot {
+    profileId: string;
+    path: string;
+    manifest: ProfileManifest;
+}
 /** One parsed markdown doc in a store snapshot. */
 export interface StoreDoc {
     /** Absolute file path. */

package/dist/migrations/types.js

@@ -1,11 +1,17 @@
-// State-migration shapes. Two lanes, split by which store owns the state:
+// State-migration shapes. Three lanes, split by which store owns the state:
 //
-//   journaled  — canvas-db state. Runs inside the db's ordered migration chain
-//                (core/canvas/db.ts appends these to MIGRATIONS), so each step
-//                gets the chain's BEGIN IMMEDIATE/COMMIT + user_version gating
-//                and runs exactly once per database.
-//   convergent — on-disk memory documents. No journal exists over a user's
-//                stores (files appear, sync in, get hand-edited), so these
-//                CONVERGE instead: every run re-scans and rewrites whatever
-//                still matches the old shape. `crtr sys migrate` is the runner.
+//   journaled        — canvas-db state. Runs inside the db's ordered migration
+//                      chain (core/canvas/db.ts appends these to MIGRATIONS), so
+//                      each step gets the chain's BEGIN IMMEDIATE/COMMIT +
+//                      user_version gating and runs exactly once per database.
+//   convergent       — on-disk memory documents. No journal exists over a user's
+//                      stores (files appear, sync in, get hand-edited), so these
+//                      CONVERGE instead: every run re-scans and rewrites whatever
+//                      still matches the old shape.
+//   profile-manifest — `~/.crouter/profiles/<id>/profile.json`. Converges like
+//                      the document lane, but each manifest folds under the same
+//                      per-profile lock add/remove take, and a structure the
+//                      migration cannot convert throws instead of being guessed.
+//
+// `crtr sys migrate` runs both on-disk lanes, profile manifests first.
 export {};

package/dist/pi-extensions/__tests__/canvas-structured-output.test.js

@@ -26,7 +26,7 @@ after(() => {
     else
         process.env['CRTR_NODE_ID'] = previous.nodeId;
 });
-test('optional submit fields remain optional through a strict provider tool schema', () => {
+test('strict provider schema stays portable while original constraints validate submit', async () => {
     home = mkdtempSync(join(tmpdir(), 'crtr-structured-output-'));
     process.env['CRTR_HOME'] = home;
     process.env['CRTR_NODE_ID'] = 'structured-output-test';
@@ -44,8 +44,14 @@ test('optional submit fields remain optional through a strict provider tool sche
                 },
                 required: ['summary'],
             },
+            tags: {
+                type: 'array',
+                items: { type: 'string' },
+                minItems: 2,
+                maxItems: 5,
+            },
         },
-        required: ['status', 'verification', 'details'],
+        required: ['status', 'verification', 'details', 'tags'],
     };
     writeOutputSchema('structured-output-test', 'oneoff', schema);
     let definition;
@@ -57,15 +63,26 @@ test('optional submit fields remain optional through a strict provider tool sche
     });
     assert.ok(definition, 'the pending request registers submit');
     const parameters = definition['parameters'];
-    assert.deepEqual(parameters.required, ['status', 'commit', 'verification', 'blocker', 'details']);
+    assert.deepEqual(parameters.required, ['status', 'commit', 'verification', 'blocker', 'details', 'tags']);
     assert.deepEqual(parameters.properties.commit, { anyOf: [{ type: 'string' }, { type: 'null' }] });
     assert.deepEqual(parameters.properties.blocker, { anyOf: [{ type: 'string' }, { type: 'null' }] });
     assert.equal(parameters.additionalProperties, false);
     assert.equal(parameters.properties.details.additionalProperties, false);
-    assert.deepEqual(schema.required, ['status', 'verification', 'details'], 'the stored request keeps its original optionality');
+    assert.equal(parameters.properties.tags['minItems'], undefined);
+    assert.equal(parameters.properties.tags['maxItems'], undefined);
+    assert.match(parameters.properties.tags['description'], /minItems: 2/);
+    assert.match(parameters.properties.tags['description'], /maxItems: 5/);
+    assert.deepEqual(schema.required, ['status', 'verification', 'details', 'tags'], 'the stored request keeps its original constraints');
     const [providerTool] = convertResponsesTools([definition], {
         strict: false,
         supportsStrictMode: true,
     });
     assert.equal(providerTool['strict'], true);
+    const execute = definition['execute'];
+    await assert.rejects(execute('call', {
+        status: 'done',
+        verification: 'verified',
+        details: { summary: 'ok' },
+        tags: ['only-one'],
+    }, new AbortController().signal), /must not have fewer than 2 items/);
 });

package/dist/pi-extensions/canvas-structured-output.js

@@ -5,6 +5,7 @@
 // stop-guard will reprompt the node with an explicit error about the invalid file.
 import { mkdirSync, writeFileSync } from 'node:fs';
 import { dirname } from 'node:path';
+import { validateToolArguments } from '@earendil-works/pi-ai';
 import { emitEvent } from '../core/events/emit.js';
 import { publishBrokerReport } from '../core/runtime/broker/daemon-ops.js';
 import { outputResultPath, readOutputRequest, removeOutputSchema, } from '../core/runtime/structured-output.js';
@@ -30,6 +31,85 @@ function retireTool(pi) {
         /* best-effort; the execute handler is inert when no schema file exists */
     }
 }
+const STRICT_STRING_FORMATS = new Set([
+    'date-time', 'time', 'date', 'duration', 'email', 'hostname', 'uri', 'ipv4', 'ipv6', 'uuid',
+]);
+// Provider strict modes accept a structural subset; omitted constraints stay visible in descriptions.
+function providerStrictSchema(schema) {
+    const transform = (value) => {
+        if (value === null || typeof value !== 'object' || Array.isArray(value))
+            return value;
+        const source = { ...value };
+        const take = (key) => {
+            const child = source[key];
+            delete source[key];
+            return child;
+        };
+        const transformed = {};
+        const ref = take('$ref');
+        if (ref !== undefined)
+            return { $ref: ref };
+        const defs = take('$defs');
+        if (defs !== null && typeof defs === 'object' && !Array.isArray(defs)) {
+            transformed['$defs'] = Object.fromEntries(Object.entries(defs).map(([name, definition]) => [name, transform(definition)]));
+        }
+        const type = take('type');
+        const anyOf = take('anyOf');
+        const oneOf = take('oneOf');
+        const allOf = take('allOf');
+        if (Array.isArray(anyOf))
+            transformed['anyOf'] = anyOf.map(transform);
+        else if (Array.isArray(oneOf))
+            transformed['anyOf'] = oneOf.map(transform);
+        else if (Array.isArray(allOf))
+            transformed['allOf'] = allOf.map(transform);
+        else if (type !== undefined)
+            transformed['type'] = type;
+        else
+            return value;
+        const description = take('description');
+        if (description !== undefined)
+            transformed['description'] = description;
+        const title = take('title');
+        if (title !== undefined)
+            transformed['title'] = title;
+        if (type === 'object') {
+            const properties = take('properties');
+            transformed['properties'] = properties !== null && typeof properties === 'object' && !Array.isArray(properties)
+                ? Object.fromEntries(Object.entries(properties).map(([name, property]) => [name, transform(property)]))
+                : {};
+            take('additionalProperties');
+            transformed['additionalProperties'] = false;
+            const required = take('required');
+            if (required !== undefined)
+                transformed['required'] = required;
+        }
+        else if (type === 'string') {
+            const format = take('format');
+            if (typeof format === 'string' && STRICT_STRING_FORMATS.has(format))
+                transformed['format'] = format;
+            else if (format !== undefined)
+                source['format'] = format;
+        }
+        else if (type === 'array') {
+            const items = take('items');
+            if (items !== undefined)
+                transformed['items'] = transform(items);
+            const minItems = take('minItems');
+            if (minItems === 0 || minItems === 1)
+                transformed['minItems'] = minItems;
+            else if (minItems !== undefined)
+                source['minItems'] = minItems;
+        }
+        if (Object.keys(source).length > 0) {
+            const existing = typeof transformed['description'] === 'string' ? transformed['description'] : '';
+            const constraints = `{${Object.entries(source).map(([key, child]) => `${key}: ${JSON.stringify(child)}`).join(', ')}}`;
+            transformed['description'] = existing === '' ? constraints : `${existing}\n\n${constraints}`;
+        }
+        return transformed;
+    };
+    return transform(schema);
+}
 function strictToolSchema(schema) {
     const transform = (value) => {
         if (Array.isArray(value))
@@ -61,7 +141,10 @@ function strictToolSchema(schema) {
         transformed['required'] = Object.keys(properties);
         return transformed;
     };
-    return transform(schema);
+    return providerStrictSchema(transform(schema));
+}
+function validateResult(value, schema) {
+    return validateToolArguments({ name: 'submit', description: '', parameters: schema }, { type: 'toolCall', id: 'structured-output', name: 'submit', arguments: value });
 }
 function omitStrictNulls(value, schema) {
     if (value === null || typeof value !== 'object' || Array.isArray(value) || schema === null || typeof schema !== 'object' || Array.isArray(schema))
@@ -156,7 +239,7 @@ export function registerCanvasStructuredOutput(pi) {
                             details: { submitted: false, reason: 'schema_replaced' },
                         };
                     }
-                    const result = omitStrictNulls(params, current.request.schema);
+                    const result = validateResult(omitStrictNulls(params, current.request.schema), current.request.schema);
                     const resultPath = outputResultPath(nodeId);
                     const json = JSON.stringify(result, null, 2);
                     mkdirSync(dirname(resultPath), { recursive: true });

package/dist/types.d.ts

@@ -1,4 +1,5 @@
 import type { BindingId } from './core/keybindings/catalog.js';
+import type { ProfileProject } from './api/dto/profiles.js';
 export type Scope = 'user' | 'project' | 'builtin';
 export declare const ExitCode: {
     readonly SUCCESS: 0;
@@ -94,6 +95,13 @@ export interface PluginManifest {
      *  crtr owns parse/help/render/errors and direct-spawns the plugin's one
      *  executable per leaf invocation. See `src/core/command-plugins/`. */
     commands?: string;
+    /** Plugin-root-relative path to a declarative hook manifest (`hooks.json`).
+     *  Must be declared together with `hookExecutable`; hooks are trusted local
+     *  code and are unavailable to endpoint archive plugins. */
+    hooks?: string;
+    /** Plugin-root-relative executable that dispatches declarations in `hooks`.
+     *  Must be a regular file with a POSIX executable permission bit. */
+    hookExecutable?: string;
     /** Bare-callable executables this plugin ships, keyed by the bare command
      *  name a node's bash sees. Each value is a PLUGIN-ROOT-relative path to a
      *  regular executable file when the effective set resolves. These are trusted
@@ -411,9 +419,9 @@ export interface InstalledMarketplace {
 }
 /** The on-disk manifest at `~/.crouter/profiles/<slug>-<id>/profile.json`
  *  (spec §2.1). A profile is an agent identity defined at the user root: it
- *  names N project directories and owns its own `memory/` store. `projects`
- *  are absolute, real-path-resolved directories in manifest order — the
- *  pointer set `findProjectScopeRoots` walks, after the node's own
+ *  names N project directories and owns its own `memory/` store. Project
+ *  `path`s are absolute, real-path-resolved directories in manifest order —
+ *  the pointer set `findProjectScopeRoots` walks, after the node's own
  *  cwd. `name` is the mutable display name (and the gateable `profile` subject
  *  field); `<slug>-<id>` in the directory name is the stable id and
  *  never changes on rename. See `src/core/profiles/manifest.ts` for every
@@ -422,10 +430,11 @@ export interface InstalledMarketplace {
 export interface ProfileManifest {
     schema_version: number;
     name: string;
-    projects: string[];
+    projects: ProfileProject[];
     /** The directory nodes under this profile are pinned to (see
-     *  `profileHome`). Normalized on read to the first project when the manifest
-     *  carries none, so a profile written before homes existed still has one. */
+     *  `profileHome`). Normalized on read to the first project's path when the
+     *  manifest carries none, so a profile written before homes existed still
+     *  has one. */
     home: string | null;
     /** ISO timestamp while the profile is inert; null (or absent on older manifests) means active. */
     paused_at: string | null;

package/dist/types.js

@@ -77,7 +77,11 @@ export function defaultScopeConfig() {
         auto_update: { crtr: 'notify', content: 'notify', interval_hours: 24 },
         max_panes_per_window: DEFAULT_MAX_PANES_PER_WINDOW,
         auto_open_child_viewers: true,
-        brokerThresholds: { warning: 128, automaticReviveCap: 256 },
+        // Every live broker is a whole pi engine. 256 of them is not a bound any
+        // real host survives — an 8 GB guest dies around a few dozen — so these are
+        // sized as a backstop that actually engages before the machine does.
+        // Override per host with CRTR_MAX_LIVE_BROKERS / CRTR_WARN_LIVE_BROKERS.
+        brokerThresholds: { warning: 16, automaticReviveCap: 32 },
         completion_bell: true,
         working_gerunds: [...DEFAULT_WORKING_GERUNDS],
         whip_mode: false,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@north-light/crouter",
-  "version": "0.3.219",
+  "version": "0.3.221",
   "description": "crtr — agent runtime with memory, plugins, and marketplaces",
   "type": "module",
   "main": "dist/index.js",

package/runtime.lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@north-light/crouter",
-  "version": "0.3.219",
+  "version": "0.3.221",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@north-light/crouter",
-      "version": "0.3.219",
+      "version": "0.3.221",
       "hasInstallScript": true,
       "license": "MIT",
       "dependencies": {

package/dist/clients/attach/__tests__/file-review-focus.test.js

@@ -1,49 +0,0 @@
-import { fileURLToPath } from 'node:url';
-import { test } from 'node:test';
-import assert from 'node:assert/strict';
-import { initTheme } from '@earendil-works/pi-coding-agent';
-import { InputController } from '../input/controller.js';
-import { createViewerCapabilities } from '../input/capabilities.js';
-initTheme(undefined, false);
-function fakeEditor() {
-    const obj = {
-        onSubmit: undefined,
-        onEscape: undefined,
-        onPasteImage: undefined,
-        onAction: () => { },
-        getText: () => '',
-        setText: () => { },
-        addToHistory: () => { },
-        insertTextAtCursor: () => { },
-    };
-    return obj;
-}
-test('choosing a review file closes the inline picker before the review surface takes focus', () => {
-    const editor = fakeEditor();
-    let focused = null;
-    let mountedPicker;
-    const tui = {
-        requestRender: () => { },
-        setFocus: (component) => { focused = component; },
-        showOverlay: () => ({ hide: () => { } }),
-        start: () => { },
-        stop: () => { },
-    };
-    const reviewSurface = {
-        render: () => [],
-        invalidate: () => { },
-        handleInput: () => { },
-    };
-    const controller = new InputController(tui, editor, {}, {
-        onCommand: () => { },
-        onDialogResponse: () => { },
-        onMountPicker: (component) => { mountedPicker = component; },
-        onUnmountPicker: () => { },
-    }, createViewerCapabilities({ role: 'controller', remote: false, nodeId: 'test', profileId: undefined }));
-    controller.openFileReviewPicker([fileURLToPath(import.meta.url)], process.cwd(), () => {
-        tui.setFocus(reviewSurface);
-    });
-    assert.ok(mountedPicker?.handleInput);
-    mountedPicker.handleInput('\n');
-    assert.equal(focused, reviewSurface, 'picker close must not restore editor focus over the review surface');
-});