@north-light/crouter 0.3.220 → 0.3.222

package/dist/commands/profile/default.js

@@ -1,8 +1,4 @@
-// `crtr profile default` — the per-cwd default-profile pin. A pin says "when a
-// node boots in THIS directory, use THIS profile" and stops the startup
-// chooser from asking. It is directory-scoped, not manifest state: independent
-// of a profile's project purview (`crtr profile project`). The startup menu's
-// `d` action writes the same pin; these verbs are the explicit surface for it.
+// `crtr profile default` manages the per-cwd profile-selection pin.
 import { defineLeaf, defineBranch } from '../../core/command.js';
 import { InputError } from '../../core/io.js';
 import { loadProfileManifest } from '../../core/profiles/manifest.js';
@@ -11,7 +7,7 @@ import { getDefaultProfileId, setDefaultProfileId, clearDefaultProfile, resolveB
 const setLeaf = defineLeaf({
     name: 'set',
     description: 'pin a profile as the default for the current directory',
-    whenToUse: 'you want crtr to stop asking which profile to use here and always default to a chosen one — the command form of the startup menu\u2019s `d` action. The profile must already cover this directory (add it with `crtr profile project add` first if not).',
+    whenToUse: 'you want crtr to stop asking which profile to use here and always default to a chosen one — the command form of the startup menu\u2019s `d` action. The profile must already cover this directory (add its purview relationship with `profile project add` and required `--memory` first if not).',
     help: {
         name: 'profile default set',
         summary: "pin a profile as the current directory's default, so the startup chooser stops asking",
@@ -20,7 +16,7 @@ const setLeaf = defineLeaf({
                 kind: 'positional',
                 name: 'profile',
                 required: true,
-                constraint: 'Exact profile id, or a unique manifest name. Must already cover the current directory (be at/above/below it in its project purview).',
+                constraint: 'Exact profile id, or a unique manifest name. Must already cover the current directory (be at/above/below it in its project purview); this pin does not change automatic memory disclosure.',
             },
         ],
         output: [
@@ -40,7 +36,7 @@ const setLeaf = defineLeaf({
             throw new InputError({
                 error: 'not_covered',
                 message: `profile "${entry.manifest.name}" does not cover ${resolved}, so a default pinned here would be ignored.`,
-                next: `Widen its purview first: \`crtr profile project add ${entry.profileId} --dir ${resolved}\`, then re-run this.`,
+                next: `Widen its purview and choose its automatic memory disclosure cap first: \`crtr profile project add ${entry.profileId} --dir ${resolved} --memory <none|name|preview|content>\`, then re-run this.`,
             });
         }
         setDefaultProfileId(cwd, entry.profileId);
@@ -133,11 +129,11 @@ const showLeaf = defineLeaf({
 export const defaultBranch = defineBranch({
     name: 'default',
     description: "manage this directory's default-profile pin",
-    whenToUse: "setting, clearing, or inspecting which profile a directory defaults to at startup — so crtr stops asking. Directory-scoped, independent of a profile's project purview.",
+    whenToUse: "setting, clearing, or inspecting which profile a directory defaults to at startup — so crtr stops asking. Directory-scoped, independent of project purview and automatic memory disclosure.",
     help: {
         name: 'profile default',
         summary: "the per-directory default profile — pin one so the startup chooser stops asking",
-        model: "A pin binds the CURRENT directory to a profile: launches here auto-pick it with no prompt (`crtr --pick-profile` reopens the chooser once). `set` pins a profile (which must already cover this dir), `clear` removes the pin, `show` reports it. This is directory-scoped selection, NOT manifest state — independent of `crtr profile project` (a profile's purview). The startup menu's `d` action writes the same pin.",
+        model: "A pin binds the CURRENT directory to a profile: launches here auto-pick it with no prompt (`crtr --pick-profile` reopens the chooser once). `set` pins a profile (which must already cover this dir), `clear` removes the pin, `show` reports it. This is directory-scoped selection, independent of `crtr profile project`: project `path` values govern purview and each `memory` value caps automatic disclosure. The startup menu's `d` action writes the same pin.",
     },
     children: [setLeaf, clearLeaf, showLeaf],
 });

package/dist/commands/profile/list.js

@@ -3,15 +3,16 @@ import { emitLine } from '../../core/io.js';
 import { listProfiles } from '../../core/profiles/manifest.js';
 export const listLeaf = defineLeaf({
     name: 'list',
-    description: 'inventory every profile',
-    whenToUse: 'browse every profile that exists — one line each with its id, name, project count, home directory, paused state, and last-used time. Reach for `profile show` once you have picked one, for its full manifest.',
+    description: 'inventory every profile and its project relationships',
+    whenToUse: 'browse every profile that exists — one line each with its id, name, explicit project relationships, home directory, paused state, and last-used time. Reach for `profile show` once you have picked one, for its full manifest.',
     help: {
         name: 'profile list',
         summary: 'every profile as JSONL, one line each, sorted by name then profile_id',
         output: [
             { name: 'profile_id', type: 'string', required: true, constraint: 'Stable directory id.' },
             { name: 'name', type: 'string', required: true, constraint: 'Manifest name.' },
-            { name: 'projects_count', type: 'int', required: true, constraint: 'Number of project directories on the manifest.' },
+            { name: 'projects_count', type: 'int', required: true, constraint: 'Number of `{path, memory}` project relationships on the manifest.' },
+            { name: 'projects', type: 'ProfileProject[]', required: true, constraint: 'Explicit `{path, memory}` relationships in manifest order. `path` defines profile purview; `memory` caps automatic boot and workspace-open disclosure.' },
             { name: 'home', type: 'string | null', required: true, constraint: 'Directory the profile\u2019s nodes are pinned to, or null when it owns no projects.' },
             { name: 'paused_at', type: 'string | null', required: true, constraint: 'ISO 8601 pause timestamp, or null when the profile is active.' },
             { name: 'default_kind', type: 'string | null', required: true, constraint: 'Stored default node kind, or null when creates default to general.' },
@@ -30,6 +31,7 @@ export const listLeaf = defineLeaf({
                 profile_id: profileId,
                 name: manifest.name,
                 projects_count: manifest.projects.length,
+                projects: manifest.projects,
                 home: manifest.home,
                 paused_at: manifest.paused_at,
                 default_kind: manifest.default_kind ?? null,

package/dist/commands/profile/new.js

@@ -2,6 +2,7 @@ import { defineLeaf } from '../../core/command.js';
 import { usage } from '../../core/errors.js';
 import { assertInstalledKind } from '../../core/config.js';
 import { createProfile, ensureRootProfile, profileRoot } from '../../core/profiles/manifest.js';
+import { PROFILE_PROJECT_MEMORY_VALUES } from '../../api/dto/profiles.js';
 import { resolveMetaPairs } from './meta.js';
 export const newLeaf = defineLeaf({
     name: 'new',
@@ -23,14 +24,22 @@ export const newLeaf = defineLeaf({
                 name: 'root',
                 type: 'bool',
                 required: false,
-                constraint: 'Provision the canonical stable root profile (fixed id `root-00000000`, name `root`) — the fallback default identity for a home — instead of a fresh named one. Idempotent: re-running returns the existing root. Node-free (no `node new --root` needed). Mutually exclusive with `--name`/`--project`/`--default-kind`/`--meta`.',
+                constraint: 'Provision the canonical stable root profile (fixed id `root-00000000`, name `root`) — the fallback default identity for a home — instead of a fresh named one. Idempotent: re-running returns the existing root. Node-free (no `node new --root` needed). Mutually exclusive with `--name`/`--project`/`--memory`/`--default-kind`/`--meta`.',
             },
             {
                 kind: 'flag',
                 name: 'project',
                 type: 'path',
                 required: false,
-                constraint: "One initial project directory. Must already exist and be a directory; resolved to its absolute real path before storing. Also becomes the profile's home — where its nodes are pinned. Singular — add more with `crtr profile project add` after creation.",
+                constraint: "One initial project directory. Must already exist and be a directory; resolved to its absolute real path before storing. Creates a purview relationship and becomes the profile's home — where its nodes are pinned. Requires paired `--memory`; singular — add more with `crtr profile project add` after creation.",
+            },
+            {
+                kind: 'flag',
+                name: 'memory',
+                type: 'enum',
+                choices: [...PROFILE_PROJECT_MEMORY_VALUES],
+                required: false,
+                constraint: 'Required with `--project`; invalid without it. Maximum automatic memory disclosure from this project at boot and workspace-open: `none`, `name`, `preview`, or `content`. Does not change purview or explicit `crtr memory read` access.',
             },
             {
                 kind: 'flag',
@@ -52,7 +61,7 @@ export const newLeaf = defineLeaf({
             { name: 'profile_id', type: 'string', required: true, constraint: 'Stable directory id (`<slug>-<shortid>`). Pass this, or the name, to every other `profile` verb and to `--profile` elsewhere.' },
             { name: 'name', type: 'string', required: true, constraint: 'The manifest name as given.' },
             { name: 'path', type: 'string', required: true, constraint: 'Absolute path to the profile directory.' },
-            { name: 'projects', type: 'string[]', required: true, constraint: 'Resolved absolute project directories, in manifest order. Empty when --project was omitted.' },
+            { name: 'projects', type: 'ProfileProject[]', required: true, constraint: 'Explicit `{path, memory}` project relationships in manifest order. `path` defines purview; `memory` caps automatic boot and workspace-open disclosure. Empty when --project was omitted.' },
             { name: 'home', type: 'string | null', required: true, constraint: 'Directory the profile\u2019s nodes are pinned to — the initial project, or null when none was given.' },
             { name: 'default_kind', type: 'string | null', required: true, constraint: 'Stored default persona kind, or null when node creates default to general.' },
             { name: 'metadata', type: 'object', required: true, constraint: 'Stored metadata map; empty when --meta was omitted.' },
@@ -65,12 +74,13 @@ export const newLeaf = defineLeaf({
     run: async (input) => {
         const name = input['name'];
         const project = input['project'];
+        const memory = input['memory'];
         const defaultKind = input['defaultKind'];
         const metadata = resolveMetaPairs(input['meta'], 'meta');
         const root = input['root'] === true;
         if (root) {
-            if (name !== undefined || project !== undefined || defaultKind !== undefined || Object.keys(metadata).length > 0) {
-                throw usage('`--root` provisions the canonical stable root profile and takes no `--name`/`--project`/`--default-kind`/`--meta`.');
+            if (name !== undefined || project !== undefined || memory !== undefined || defaultKind !== undefined || Object.keys(metadata).length > 0) {
+                throw usage('`--root` provisions the canonical stable root profile and takes no `--name`/`--project`/`--memory`/`--default-kind`/`--meta`.');
             }
             const { profileId, manifest } = ensureRootProfile();
             return {
@@ -82,14 +92,17 @@ export const newLeaf = defineLeaf({
                 default_kind: manifest.default_kind ?? null,
                 metadata: manifest.metadata ?? {},
                 created_at: manifest.created_at,
-                follow_up: `Root profile ensured. Spawn nodes under it with \`--profile ${profileId}\`, or widen its purview with \`crtr profile project add ${profileId} --dir <path>\`.`,
+                follow_up: `Root profile ensured. Spawn nodes under it with \`--profile ${profileId}\`, or widen its purview and choose its automatic memory disclosure cap with \`crtr profile project add ${profileId} --dir <path> --memory <none|name|preview|content>\`.`,
             };
         }
         if (name === undefined)
             throw usage('provide `--name <name>` to create a profile, or `--root` to provision the stable root profile.');
+        if ((project === undefined) !== (memory === undefined)) {
+            throw usage('`--project` and `--memory` must be supplied together: `--project` establishes purview and `--memory` sets its automatic boot and workspace-open disclosure cap.');
+        }
         if (defaultKind !== undefined)
             assertInstalledKind(defaultKind);
-        const { profileId, manifest } = createProfile(name, project !== undefined ? [project] : [], {
+        const { profileId, manifest } = createProfile(name, project !== undefined && memory !== undefined ? [{ path: project, memory }] : [], {
             defaultKind,
             ...(Object.keys(metadata).length > 0 ? { metadata } : {}),
         });
@@ -102,7 +115,7 @@ export const newLeaf = defineLeaf({
             default_kind: manifest.default_kind ?? null,
             metadata: manifest.metadata ?? {},
             created_at: manifest.created_at,
-            follow_up: `Show it with \`crtr profile show ${profileId}\`, add another project with \`crtr profile project add ${profileId} --dir <path>\`, or list every profile with \`crtr profile list\`.`,
+            follow_up: `Show it with \`crtr profile show ${profileId}\`, add purview and choose its automatic memory disclosure cap with \`crtr profile project add ${profileId} --dir <path> --memory <none|name|preview|content>\`, or list every profile with \`crtr profile list\`.`,
         };
     },
 });

package/dist/commands/profile/project.js

@@ -1,17 +1,14 @@
-// `crtr profile project` — the project-purview sub-noun of `profile`. A
-// profile's `projects` list is what it can SEE (memory + config resolution),
-// and its `home` — one of those dirs — is where its nodes actually run. These
-// two verbs widen or narrow that list after creation and re-point the home;
-// `crtr profile show` reads both back.
+// `crtr profile project` manages purview relationships and their automatic-memory caps.
 import { defineLeaf, defineBranch } from '../../core/command.js';
 import { addProfileProject, removeProfileProject, loadProfileManifest } from '../../core/profiles/manifest.js';
+import { PROFILE_PROJECT_MEMORY_VALUES } from '../../api/dto/profiles.js';
 const addLeaf = defineLeaf({
     name: 'add',
-    description: "add a project directory to a profile's purview",
-    whenToUse: "a profile needs to see (memory + config from) another project directory — extend its purview after creation, including mid-session from a node already running under that profile. Also the way to re-point the profile's home, with --home.",
+    description: "add or update a project's purview relationship",
+    whenToUse: "a profile needs purview over another project directory, or its automatic memory disclosure cap needs changing — extend or update the relationship after creation. Also the way to re-point the profile's home, with --home.",
     help: {
         name: 'profile project add',
-        summary: "append a project directory to a profile's manifest, deduped by real path",
+        summary: "add or update a project relationship in a profile's manifest, deduped by real path",
         params: [
             {
                 kind: 'positional',
@@ -24,7 +21,15 @@ const addLeaf = defineLeaf({
                 name: 'dir',
                 type: 'path',
                 required: true,
-                constraint: 'Directory to add. Must exist and be a directory; resolved to its absolute real path before storing. A path already on the manifest is a no-op, not an error.',
+                constraint: 'Directory to add. Must exist and be a directory; resolved to its absolute real path before storing. A path already on the manifest keeps its position and updates its `memory` value.',
+            },
+            {
+                kind: 'flag',
+                name: 'memory',
+                type: 'enum',
+                choices: [...PROFILE_PROJECT_MEMORY_VALUES],
+                required: true,
+                constraint: 'Maximum automatic memory disclosure from this project at boot and workspace-open: `none`, `name`, `preview`, or `content`. Does not change the profile’s purview or explicit `crtr memory read` access.',
             },
             {
                 kind: 'flag',
@@ -36,16 +41,17 @@ const addLeaf = defineLeaf({
         ],
         output: [
             { name: 'profile_id', type: 'string', required: true, constraint: 'Stable directory id.' },
-            { name: 'projects', type: 'string[]', required: true, constraint: 'The updated, deduped project list in manifest order.' },
+            { name: 'projects', type: 'ProfileProject[]', required: true, constraint: 'The updated `{path, memory}` relationships in manifest order. `path` defines purview; `memory` caps automatic boot and workspace-open disclosure.' },
             { name: 'home', type: 'string | null', required: true, constraint: "The profile's home directory after the change." },
             { name: 'follow_up', type: 'string', required: true, constraint: 'Concrete next commands.' },
         ],
         outputKind: 'object',
-        effects: ["Appends to the profile manifest's `projects` array, and rewrites `home` when --home is given. Invalidates the process scope cache."],
+        effects: ["Appends a new project relationship or updates an existing relationship’s `memory` in the profile manifest, and rewrites `home` when --home is given. Purview follows `path`; `memory` caps automatic boot and workspace-open disclosure. Invalidates the process scope cache."],
     },
     run: async (input) => {
         const { profileId } = loadProfileManifest(input['profile']);
         const { manifest } = addProfileProject(profileId, input['dir'], {
+            memory: input['memory'],
             home: input['home'] === true,
         });
         return {
@@ -58,7 +64,7 @@ const addLeaf = defineLeaf({
 });
 const removeLeaf = defineLeaf({
     name: 'remove',
-    description: "remove a project directory from a profile's purview",
+    description: "remove a project relationship from a profile's purview",
     whenToUse: "a profile no longer needs purview over one of its listed project directories — narrow it back. Works even if the directory itself was since deleted.",
     help: {
         name: 'profile project remove',
@@ -75,17 +81,17 @@ const removeLeaf = defineLeaf({
                 name: 'dir',
                 type: 'path',
                 required: true,
-                constraint: 'Directory to remove, matched by its resolved real path against the manifest. Does not require the directory to still exist on disk. Removing the home dir re-points the home at the first remaining project.',
+                constraint: 'Directory to remove, matched against the stored project `path`. Does not require the directory to still exist on disk. Removing the home dir re-points the home at the first remaining project.',
             },
         ],
         output: [
             { name: 'profile_id', type: 'string', required: true, constraint: 'Stable directory id.' },
-            { name: 'projects', type: 'string[]', required: true, constraint: 'The updated project list in manifest order.' },
+            { name: 'projects', type: 'ProfileProject[]', required: true, constraint: 'The updated `{path, memory}` relationships in manifest order.' },
             { name: 'home', type: 'string | null', required: true, constraint: "The profile's home directory after the change." },
             { name: 'follow_up', type: 'string', required: true, constraint: 'Concrete next commands.' },
         ],
         outputKind: 'object',
-        effects: ["Removes an entry from the profile manifest's `projects` array, re-pointing `home` when that entry was it. Invalidates the process scope cache."],
+        effects: ["Removes a project relationship from the profile manifest, re-pointing `home` when that entry was it. This narrows purview and removes its automatic memory disclosure cap. Invalidates the process scope cache."],
     },
     run: async (input) => {
         const { profileId } = loadProfileManifest(input['profile']);
@@ -100,12 +106,12 @@ const removeLeaf = defineLeaf({
 });
 export const projectBranch = defineBranch({
     name: 'project',
-    description: "widen or narrow a profile's project purview",
-    whenToUse: "changing which project directories a profile can see (its memory + config resolution) after creation — add or remove one.",
+    description: "manage a profile's project purview and automatic memory disclosure",
+    whenToUse: "changing a profile’s project purview or one relationship’s automatic memory disclosure cap after creation — add, update, or remove one.",
     help: {
         name: 'profile project',
-        summary: "manage a profile's project purview — the directories it resolves memory and config from",
-        model: "A profile's `projects` list is the set of directories it inherits memory and config from, and its `home` — the first project unless `add --home` says otherwise — is the directory its nodes are pinned to. `add` widens that purview by one directory (deduped by real path) and optionally re-points the home; `remove` narrows it, re-pointing the home when it removed it. Read both back with `crtr profile show`. Purview is independent of a per-cwd default pin (`crtr profile default`) — widening purview never changes which profile a directory defaults to.",
+        summary: "manage project purview and automatic memory disclosure caps",
+        model: "Each `{path, memory}` relationship widens purview: the profile resolves memory and config from `path`. Its `memory` value separately caps only automatic boot and workspace-open delivery; explicit reads remain available through purview. `add` appends a new real path or updates an existing relationship’s cap without moving it, and can re-point `home`; `remove` narrows purview and re-points `home` when needed. Purview and automatic disclosure are both independent of a per-cwd default pin (`crtr profile default`).",
     },
     children: [addLeaf, removeLeaf],
 });

package/dist/commands/profile/show.js

@@ -21,7 +21,7 @@ export const showLeaf = defineLeaf({
         output: [
             { name: 'profile_id', type: 'string', required: true, constraint: 'Stable directory id.' },
             { name: 'name', type: 'string', required: true, constraint: 'Manifest name.' },
-            { name: 'projects', type: 'string[]', required: true, constraint: 'Absolute project directories, in manifest order.' },
+            { name: 'projects', type: 'ProfileProject[]', required: true, constraint: 'Explicit `{path, memory}` relationships in manifest order. `path` defines profile purview; `memory` caps automatic boot and workspace-open disclosure without limiting explicit reads.' },
             { name: 'home', type: 'string | null', required: true, constraint: 'Where a node under this profile runs when its create names no directory at all — an explicit --cwd and the directory a root is launched from both win over it. Defaults to the first project; re-point it with `profile project add --home`. Null when the profile owns no projects (the root profile).' },
             { name: 'paused_at', type: 'string | null', required: true, constraint: 'ISO 8601 pause timestamp, or null when the profile is active.' },
             { name: 'default_kind', type: 'string | null', required: true, constraint: 'Stored default node kind, or null when creates default to general.' },
@@ -53,8 +53,8 @@ export const showLeaf = defineLeaf({
             config_path: configPath,
             config_exists: existsSync(configPath),
             follow_up: manifest.paused_at === null
-                ? `Pause it with \`crtr profile pause ${profileId}\`, or set its default kind with \`crtr profile kind ${profileId} <kind>\`.`
-                : `Resume it with \`crtr profile resume ${profileId}\`.`,
+                ? `Manage its purview and automatic memory disclosure with \`crtr profile project add ${profileId} --dir <path> --memory <none|name|preview|content>\`, pause it with \`crtr profile pause ${profileId}\`, or set its default kind with \`crtr profile kind ${profileId} <kind>\`.`
+                : `Manage its purview and automatic memory disclosure with \`crtr profile project add ${profileId} --dir <path> --memory <none|name|preview|content>\`, or resume it with \`crtr profile resume ${profileId}\`.`,
         };
     },
 });

package/dist/commands/surface-inbox.js

@@ -51,6 +51,7 @@ export const surfaceInboxLeaf = defineLeaf({
     description: 'human inbox toggle dispatcher (bound to the inbox-toggle key; not run by hand)',
     whenToUse: 'never directly — the inbox-toggle keybinding routes the user’s own request through it. An agent that wants a decision uses crtr human send; how the user reaches their inbox is theirs.',
     tier: 'hidden',
+    hookEligible: false,
     help: {
         name: 'surface inbox',
         summary: 'deliver the human inbox toggle to a live viewer',

package/dist/commands/sys/__tests__/migrate.test.js

@@ -25,16 +25,17 @@ function write(path, content) {
     writeFileSync(path, content);
 }
 function manifest(name, projects) {
+    const first = projects[0];
     return JSON.stringify({
         schema_version: 1,
         name,
         projects,
-        home: projects[0] ?? null,
+        home: (typeof first === 'string' ? first : first?.path) ?? null,
         created_at: '2026-01-01T00:00:00.000Z',
         last_used_at: null,
     });
 }
-test('sys migrate covers profile-aware refs and every descendant project/plugin store', () => {
+test('sys migrate converges profile manifests, then profile-aware refs and every descendant project/plugin store', () => {
     const home = mkdtempSync(join(tmpdir(), 'crtr-sys-migrate-'));
     const userRoot = join(home, '.crouter');
     const rootProfile = join(userRoot, 'profiles', 'root-00000000');
@@ -52,8 +53,11 @@ test('sys migrate covers profile-aware refs and every descendant project/plugin
     const pluginDoc = join(pluginRoot, 'memory', 'plugin.md');
     const embeddedPluginDoc = join(embeddedPluginRoot, 'memory', 'plugin.md');
     try {
-        write(join(rootProfile, 'profile.json'), manifest('root', []));
-        write(join(appletProfile, 'profile.json'), manifest('applet-inactive', [appletProject, nestedOnlyProject]));
+        // Root's string entries migrate to `preview`; every other profile's to
+        // `content`. The applet manifest is mixed: its already-current entry must
+        // survive untouched while the string beside it converts.
+        write(join(rootProfile, 'profile.json'), manifest('root', [appletProject]));
+        write(join(appletProfile, 'profile.json'), manifest('applet-inactive', [{ path: appletProject, memory: 'name' }, nestedOnlyProject]));
         write(userDoc, `${OLD_DOC}\nSee [[user/scoped]].\n`);
         write(join(userRoot, 'memory', 'scoped', 'INDEX.md'), CURRENT_DOC);
         write(rootDoc, `${OLD_DOC}\nSee [[shared]].\n`);
@@ -78,8 +82,15 @@ test('sys migrate covers profile-aware refs and every descendant project/plugin
         const result = spawnSync(process.execPath, ['--conditions=crtr-src', '--import', TSX_LOADER, CLI, 'sys', 'migrate', '--json'], { cwd: home, env, encoding: 'utf8' });
         assert.equal(result.status, 0, result.stderr);
         const output = JSON.parse(result.stdout);
+        assert.equal(output.profiles, 2);
         assert.equal(output.stores, 7);
-        assert.equal(output.changed, 7);
+        assert.equal(output.changed, 9);
+        const readProjects = (dir) => JSON.parse(readFileSync(join(dir, 'profile.json'), 'utf8')).projects;
+        assert.deepEqual(readProjects(rootProfile), [{ path: appletProject, memory: 'preview' }]);
+        assert.deepEqual(readProjects(appletProfile), [
+            { path: appletProject, memory: 'name' },
+            { path: nestedOnlyProject, memory: 'content' },
+        ]);
         for (const path of [userDoc, rootDoc, appletDoc, projectDoc, deepDoc, pluginDoc, embeddedPluginDoc]) {
             const migrated = readFileSync(path, 'utf8');
             assert.doesNotMatch(migrated, /system-prompt-visibility|file-read-visibility/);

package/dist/commands/sys/config.js

@@ -181,7 +181,7 @@ const configSet = defineLeaf({
         name: 'sys config set',
         summary: 'write a config value by dotted key',
         params: [
-            { kind: 'positional', name: 'key', type: 'string', required: true, constraint: `Dotted key path. User-scope scalar settings: ${SCALAR_SETTING_HELP}. Also supported: working_gerunds and whip_messages (non-empty JSON string arrays), brokerThresholds.warning and brokerThresholds.automaticReviveCap (user scope; integer >= 1), modelLadders.defaultProvider, and modelLadders.<anthropic|openai>.<ultra|strong|medium|light>. Keybindings are edited only through sys settings.` },
+            { kind: 'positional', name: 'key', type: 'string', required: true, constraint: `Dotted key path. User-scope scalar settings: ${SCALAR_SETTING_HELP}. Also supported: working_gerunds and whip_messages (non-empty JSON string arrays), brokerThresholds.warning and brokerThresholds.automaticReviveCap (user scope; integer >= 1), modelLadders.defaultProvider, and modelLadders.<anthropic|openai>.<ultra|strong|medium|light>. Keybindings are edited only through sys settings. humanActions is an object map edited directly in ~/.crouter/config.json or <repo>/.crouter/config.json.` },
             { kind: 'flag', name: 'value', type: 'string', required: true, constraint: 'value VALUE — string, required. working_gerunds and whip_messages accept JSON arrays; other values are stored as-is if quoted and coerced to number or boolean when unambiguous.' },
             { kind: 'flag', name: 'scope', type: 'enum', choices: ['user', 'project'], required: false, constraint: 'Scope to write to. Default: user. Project scope is supported only for modelLadders.' },
         ],
@@ -261,7 +261,7 @@ export const configBranch = defineBranch({
     whenToUse: 'inspecting crtr settings, changing supported scalar values, or locating config.json. Keybinding changes belong in sys settings.',
     help: {
         name: 'sys config',
-        summary: 'read and write crtr configuration, including model ladders',
+        summary: 'read and write crtr configuration, including model ladders; edit humanActions maps directly in ~/.crouter/config.json or <repo>/.crouter/config.json',
     },
     children: [configGet, configSet, configPath],
 });

package/dist/commands/sys/doctor.js

@@ -13,11 +13,14 @@ import { readFault } from '../../core/runtime/fault.js';
 import { detectNerdFont, nerdFontInstallCommand, NERD_FONT_SELECT_HINT } from '../../core/runtime/nerd-font.js';
 import { detectPackageManager } from './setup-core.js';
 import { validateEffectiveCommandPlugins } from '../../core/command-plugins/discovery.js';
+import { discoverHookRegistry } from '../../core/command-hooks/discovery.js';
 import { resolveBinContributions } from '../../core/runtime/bin-contributions.js';
+import { inspectHumanActions } from '../../core/human-actions.js';
 import { buildBrokerEnv, resolvePathExecutable } from '../../core/runtime/spawn-env.js';
 import { listAllPlugins } from '../../core/resolver.js';
-import { SUBTREE_NAMES, coreCommandPaths } from '../../build-root.js';
+import { SUBTREE_NAMES, coreCommandPaths, coreHookCatalog } from '../../build-root.js';
 import { processGeneration, processLocatedGeneration, runtimeManifest, selectedGeneration } from './shared.js';
+import { CONFIG_FILE } from '../../types.js';
 function pass(scope, name, message) {
     return { scope, name, status: 'pass', message };
 }
@@ -141,6 +144,34 @@ async function runCommandPluginChecks(scopes) {
     }
     return results;
 }
+/** Statically inspect the complete effective hook registry. This shares the
+ * runtime target catalog but never enters hook execution, preserving doctor as
+ * the recovery path for broken hooks. */
+async function runHookPluginChecks(scopes) {
+    const inScope = new Set(scopes);
+    const registry = discoverHookRegistry(await coreHookCatalog());
+    const results = [];
+    for (const validation of registry.validations) {
+        const plugin = validation.plugin;
+        if (!inScope.has(plugin.scope))
+            continue;
+        const issues = registry.issues.filter((issue) => issue.plugin === plugin.name && issue.scope === plugin.scope);
+        if (issues.length === 0) {
+            const declarations = validation.hooks.map((hook) => `${hook.target} [${hook.phase} ${hook.op}]`).join('; ');
+            results.push(pass(plugin.scope, `plugin:${plugin.name}:hooks`, `effective hook declaration(s): ${declarations}`));
+            continue;
+        }
+        issues.forEach((issue, index) => {
+            const source = validation.manifestPath ?? join(plugin.root, '.crouter-plugin', 'plugin.json');
+            const detail = issue.path !== undefined ? `${source}:${issue.path}` : source;
+            results.push(failCheck(plugin.scope, `plugin:${plugin.name}:hooks[${index}]`, `${issue.code} at ${detail}: ${issue.message} (received ${issue.received}, expected ${issue.expected})`, {
+                kind: 'human_action',
+                description: `${issue.next} Inspect with \`crtr pkg plugin show ${plugin.name}\`; then disable (\`crtr pkg plugin disable ${plugin.name} --scope ${plugin.scope}\`), update (\`crtr pkg plugin update --name ${plugin.name}\`), or remove (\`crtr pkg plugin remove ${plugin.name}\`) the plugin.`,
+            }));
+        });
+    }
+    return results;
+}
 /**
  * Report every bare-binary contribution (`bin` in a plugin manifest or a scope
  * `config.json`) that failed to reach a node's PATH, plus the ones that did.
@@ -169,6 +200,55 @@ function runBinContributionChecks(scopes) {
     }
     return results;
 }
+/** Validate every scope-configured completion action without executing it. */
+function runHumanActionChecks(scopes) {
+    const inScope = new Set(scopes);
+    const userConfig = join(scopeRoot('user'), CONFIG_FILE);
+    const results = [];
+    const winningOrigins = new Map();
+    for (const action of inspectHumanActions(process.cwd())) {
+        if ('kind' in action) {
+            if (action.kind === 'unknown_action')
+                continue;
+            const scope = action.configOrigin === userConfig ? 'user' : 'project';
+            const block = action.block === true;
+            const winningOrigin = block ? undefined : winningOrigins.get(action.name);
+            if (!block && winningOrigin === undefined)
+                winningOrigins.set(action.name, action.configOrigin);
+            if (!inScope.has(scope))
+                continue;
+            const checkName = block ? `humanActions:block@${action.configOrigin}` : `humanActions:${action.name}@${action.configOrigin}`;
+            const remediation = {
+                kind: 'human_action',
+                description: block
+                    ? `Fix or remove the \`humanActions\` block in ${action.configOrigin}. Actions run argv directly without a shell.`
+                    : `Fix or remove the \`humanActions.${action.name}\` declaration in ${action.configOrigin}. Actions run argv directly without a shell.`,
+            };
+            if (winningOrigin !== undefined) {
+                results.push({
+                    scope,
+                    name: checkName,
+                    status: 'pass',
+                    message: `warning: shadowed by ${winningOrigin}; ${action.configOrigin}: ${action.reason}`,
+                    remediation,
+                });
+            }
+            else {
+                results.push(failCheck(scope, checkName, `${action.configOrigin}: ${action.reason}`, remediation));
+            }
+            continue;
+        }
+        const scope = action.configOrigin === userConfig ? 'user' : 'project';
+        const winningOrigin = winningOrigins.get(action.name);
+        if (winningOrigin === undefined)
+            winningOrigins.set(action.name, action.configOrigin);
+        if (!inScope.has(scope))
+            continue;
+        const shadowedPrefix = winningOrigin === undefined ? '' : `shadowed by ${winningOrigin}; `;
+        results.push(pass(scope, `humanActions:${action.name}@${action.configOrigin}`, `${shadowedPrefix}${action.configOrigin} → ${action.argv[0]} (cwd ${action.cwd})`));
+    }
+    return results;
+}
 /** Check each enabled plugin's advisory PATH requirements against the exact
  *  broker environment a node launched from this cwd/profile receives. */
 function runRequiresChecks(scopes) {
@@ -467,7 +547,7 @@ function runChecksForScope(scope, opts) {
 export const sysDoctorLeaf = defineLeaf({
     name: 'doctor',
     description: 'diagnose installation health',
-    whenToUse: 'something in your crtr install looks off and you want it diagnosed — a plugin or marketplace manifest is missing, a config entry points at a directory that no longer exists, or a plugin command manifest/transport is malformed. Reports each problem with a structured remediation, and can apply the safe repairs for you.',
+    whenToUse: 'something in your crtr install looks off and you want it diagnosed — a plugin or marketplace manifest is missing, a config entry points at a directory that no longer exists, or a plugin command/hook declaration is malformed. Reports each problem with a structured remediation, and can apply the safe repairs for you.',
     help: {
         name: 'sys doctor',
         summary: 'diagnose runtime integrity, missing manifests, and broken config entries',
@@ -477,13 +557,13 @@ export const sysDoctorLeaf = defineLeaf({
             { kind: 'flag', name: 'remote', type: 'bool', required: false, constraint: 'Check git remotes with ls-remote (slow — makes network calls).' },
         ],
         output: [
-            { name: 'checks', type: 'object[]', required: true, constraint: 'Each: {scope, name, status, message, fixed?, remediation?}. status: pass | fail. scope may be user | project | canvas. bin:<name> checks report bare-binary contributions (a `bin` block in a plugin manifest or a scope config.json): a pass names the contributor and the resolved target, a fail names an unsafe/reserved command name, malformed target declaration, missing/non-executable/escaping target, or same-precedence name collision that installed nothing; their remediation is always a human_action. requires:<name> checks report each enabled plugin manifest PATH requirement: a pass names the plugin and resolved executable path; a fail names the plugin and carries its declared install hint as remediation. Runtime checks validate selected and process generation manifests, sealing/containment, and full SHA-256 inventories. terminal:nerd-font (user scope) reports whether a Nerd Font is installed for the viewer\'s icon glyphs; its remediation is always a human_action carrying the platform install command, never auto-fixed. Plugin manifest checks appear as plugin:<name>:commands (validated statically, never executed); their remediation is always a human_action (disable/update/remove the plugin). remediation (when present) is {kind, description, ...payload} where kind is remove_config_key | rm_path | human_action; fault human_action remediations include the canonical logs command. Sorted by scope then name.' },
+            { name: 'checks', type: 'object[]', required: true, constraint: 'Each: {scope, name, status, message, fixed?, remediation?}. status: pass | fail. scope may be user | project | canvas. bin:<name> checks report bare-binary contributions (a `bin` block in a plugin manifest or a scope config.json): a pass names the contributor and the resolved target, a fail names an unsafe/reserved command name, malformed target declaration, missing/non-executable/escaping target, or same-precedence name collision that installed nothing; their remediation is always a human_action. humanActions:<name>@<config-origin> checks validate each user/project scope completion-action declaration: action-name and argv shape, cwd directory, argv[0] regular-file existence, and execute permission; they never execute an action. A malformed effective declaration fails; a malformed shadowed declaration is a pass-level warning that names the winning and shadowed origins. requires:<name> checks report each enabled plugin manifest PATH requirement: a pass names the plugin and resolved executable path; a fail names the plugin and carries its declared install hint as remediation. Runtime checks validate selected and process generation manifests, sealing/containment, and full SHA-256 inventories. terminal:nerd-font (user scope) reports whether a Nerd Font is installed for the viewer\'s icon glyphs; its remediation is always a human_action carrying the platform install command, never auto-fixed. Plugin checks appear as plugin:<name>:commands and plugin:<name>:hooks; both are validated statically and never execute plugin code. Hook failures identify manifest/path/target/collision problems and carry disable/update/remove/show remediation; healthy hooks list effective target, phase, and op. remediation (when present) is {kind, description, ...payload} where kind is remove_config_key | rm_path | human_action; fault human_action remediations include the canonical logs command. Sorted by scope then name.' },
             { name: 'ok', type: 'boolean', required: true, constraint: 'True when no unresolved fail checks remain.' },
         ],
         outputKind: 'object',
         effects: [
-            'Read-only unless --fix is passed. Runtime verification reads and hashes every selected/process generation file; plugin command manifests, bare-binary (`bin`) declarations, and advisory `requires` PATH checks never execute plugin or contributed binaries.',
-            'With --fix: applies each non-pass check\'s `remediation` — removes stale config entries and deletes dangling plugin/marketplace directories; canvas fault findings and plugin command findings stay read-only (--fix never chmods or rewrites third-party plugin content).',
+            'Read-only unless --fix is passed. Runtime verification reads and hashes every selected/process generation file; plugin command and hook manifests, bare-binary (`bin`) declarations, humanActions declarations, and advisory `requires` PATH checks never execute plugin or contributed binaries.',
+            'With --fix: applies each non-pass check\'s `remediation` — removes stale config entries and deletes dangling plugin/marketplace directories; canvas fault findings and plugin command/hook findings stay read-only (--fix never chmods or rewrites third-party plugin content).',
             'Each non-pass result carries a structured `remediation` describing the fix action (absolute paths, exact config keys, or a human_action with its command) so callers can apply it directly without --fix.',
         ],
     },
@@ -500,7 +580,9 @@ export const sysDoctorLeaf = defineLeaf({
         if (scopes.includes('user'))
             allResults.push(runNerdFontCheck());
         allResults.push(...await runCommandPluginChecks(scopes));
+        allResults.push(...await runHookPluginChecks(scopes));
         allResults.push(...runBinContributionChecks(scopes));
+        allResults.push(...runHumanActionChecks(scopes));
         allResults.push(...runRequiresChecks(scopes));
         allResults.push(...await runFaultChecks());
         const processLocation = processGeneration();