@north-light/crouter 0.3.221 → 0.3.223

package/dist/core/human/completion.js

@@ -0,0 +1,27 @@
+// The `crtr.human-completion/v1` document handed to a completion action on
+// stdin. Composed at settlement from the canonical terminal result, so the
+// delivered document reflects the settlement instant and the delivery lane
+// never reads ticket storage.
+/** The one place a cancellation record without `disposition` reads as
+ * `canceled`. Every other reader treats both dispositions alike. */
+export function completionEventFor(result) {
+    if (result.kind === 'canceled')
+        return result.disposition ?? 'canceled';
+    return 'answered';
+}
+/** Build the complete document with `delivery.attempt` as the lane's placeholder. */
+export function composeHumanCompletion(args) {
+    const { requestId, result, binding, source } = args;
+    const event = completionEventFor(result);
+    const actor = result.actor;
+    return {
+        schema: 'crtr.human-completion/v1',
+        requestId,
+        event,
+        settledAt: result.kind === 'page' ? result.completedAt : result.canceledAt,
+        ...(result.kind === 'page' ? { responses: result.responses } : {}),
+        action: { name: binding.name, payload: binding.payload },
+        provenance: { source, ...(actor === undefined ? {} : { actor }) },
+        delivery: { attempt: 0 },
+    };
+}

package/dist/core/human/convention.d.ts

@@ -8,6 +8,8 @@ export declare function responsePath(dir: string): string;
 export declare function progressPath(dir: string): string;
 export declare function claimPath(dir: string): string;
 export declare function replyRoutePath(dir: string): string;
+/** The frozen completion-action binding, written once at request creation. */
+export declare function actionBindingPath(dir: string): string;
 export interface TicketReplyRoute {
     bridge_node_id: string;
 }

package/dist/core/human/convention.js

@@ -10,6 +10,8 @@ export function responsePath(dir) { return `${dir}/response.json`; }
 export function progressPath(dir) { return `${dir}/progress.json`; }
 export function claimPath(dir) { return `${dir}/claim.json`; }
 export function replyRoutePath(dir) { return `${dir}/reply-route.json`; }
+/** The frozen completion-action binding, written once at request creation. */
+export function actionBindingPath(dir) { return `${dir}/action.json`; }
 /** A reply route exists only when completing the ticket must finish a human
  * bridge and fan its result back to subscribers. Its absence is the complete
  * representation of a standalone page. */

package/dist/core/human/tickets.d.ts

@@ -19,9 +19,22 @@ export interface PreparedPage {
     module?: string;
     manifest: PageManifest;
 }
-/** Validate one authored page source into publishable form. Reads only: a page
- *  that fails authoring leaves nothing behind, so a caller that must create a
- *  bridge node prepares first and creates it only once the page is known good.
+export interface PreparePageSourceOptions {
+    /** `jsx` carries .tsx semantics; `html` is a complete document. */
+    dialect: 'jsx' | 'html';
+    /** The complete authored page text, inline. */
+    document: string;
+    source?: PageSource;
+    productKinds?: ProductPageComponents;
+    delivery?: PageDelivery;
+}
+/** Validate one authored page document into publishable form. The single
+ *  validation path: `preparePage` reads a file and lands here, and a
+ *  programmatic request supplies the same text inline. */
+export declare function preparePageSource(opts: PreparePageSourceOptions): PreparedPage;
+/** Validate one authored page source file into publishable form. Reads only: a
+ *  page that fails authoring leaves nothing behind, so a caller that must create
+ *  a bridge node prepares first and creates it only once the page is known good.
  *  The source is read exactly once, so the published document is the same bytes
  *  the manifest was derived from even if the file changes underneath. */
 export declare function preparePage(opts: Omit<SubmitPageOptions, 'dir'>): PreparedPage;
@@ -81,6 +94,8 @@ export interface PageTicket {
 export declare function readPageTicket(dir: string): PageTicket;
 export interface CompletePageOptions {
     completedAt?: string;
+    /** Recorded when an authorized programmatic writer answered instead of a person. */
+    actor?: string;
 }
 export declare function completePage(dir: string, responses: unknown, claimToken: string, opts?: CompletePageOptions): {
     won: boolean;
@@ -94,11 +109,15 @@ export declare function takeoverAndCompletePage(dir: string, responses: unknown,
     won: boolean;
     result: TicketResult;
 };
-/** Cancellation races finalization but never requires or removes another claim. */
-export declare function cancelTicket(dir: string, opts?: {
+export interface CancelTicketOptions {
     reason?: string;
     actor?: string;
-}): {
+    /** The recipient closing it writes `dismissed`; the requester withdrawing it
+     * writes `canceled`. Omitted where the caller is neither. */
+    disposition?: 'canceled' | 'dismissed';
+}
+/** Cancellation races finalization but never requires or removes another claim. */
+export declare function cancelTicket(dir: string, opts?: CancelTicketOptions): {
     status: 'canceled' | 'already_resolved';
     result: TicketResult;
 };

package/dist/core/human/tickets.js

@@ -23,10 +23,10 @@ const feedbackSchema = z.object({ file: z.string().min(1).refine(isAbsolute, 'fi
     });
 });
 const slotResponseSchema = z.record(z.string(), z.unknown());
-const pageResultSchema = z.object({ schema: z.literal('crtr.page-response/v1'), kind: z.literal('page'), responses: z.record(z.string(), slotResponseSchema), summary: z.string(), completedAt: iso }).strict();
+const pageResultSchema = z.object({ schema: z.literal('crtr.page-response/v1'), kind: z.literal('page'), responses: z.record(z.string(), slotResponseSchema), summary: z.string(), completedAt: iso, actor: z.string().optional() }).strict();
 const pageProgressSchema = z.object({ kind: z.literal('page'), responses: z.record(z.string(), slotResponseSchema), savedAt: iso }).strict();
 const reviewResultSchema = z.object({ schema: z.literal('humanloop.review-response/v1'), kind: z.literal('review'), result: feedbackSchema, completedAt: iso }).strict();
-const canceledResultSchema = z.object({ schema: z.literal('humanloop.cancel/v1'), kind: z.literal('canceled'), canceledAt: iso, reason: z.string().optional(), actor: z.string().optional() }).strict();
+const canceledResultSchema = z.object({ schema: z.literal('humanloop.cancel/v1'), kind: z.literal('canceled'), canceledAt: iso, reason: z.string().optional(), actor: z.string().optional(), disposition: z.enum(['canceled', 'dismissed']).optional() }).strict();
 /** Strict decoder for the only canonical final marker. */
 export function readTicketResult(dir) {
     let raw;
@@ -52,9 +52,19 @@ function publishRequest(path, value) {
     if (!publishJsonExclusive(path, value))
         throw new Error(`ticket request already exists: ${path}`);
 }
-/** Validate one authored page source into publishable form. Reads only: a page
- *  that fails authoring leaves nothing behind, so a caller that must create a
- *  bridge node prepares first and creates it only once the page is known good.
+/** Validate one authored page document into publishable form. The single
+ *  validation path: `preparePage` reads a file and lands here, and a
+ *  programmatic request supplies the same text inline. */
+export function preparePageSource(opts) {
+    const stamped = { ...(opts.source ?? {}), emittedAt: opts.source?.emittedAt ?? new Date().toISOString() };
+    const delivery = opts.delivery ?? { placement: 'inline', inbox: false, reply: false };
+    if (opts.dialect === 'html')
+        return { document: opts.document, manifest: deriveHtmlPageManifest(opts.document, stamped, delivery) };
+    return { document: opts.document, module: compilePage(opts.document), manifest: derivePageManifestFromDocument(opts.document, opts.productKinds ?? [], stamped, delivery) };
+}
+/** Validate one authored page source file into publishable form. Reads only: a
+ *  page that fails authoring leaves nothing behind, so a caller that must create
+ *  a bridge node prepares first and creates it only once the page is known good.
  *  The source is read exactly once, so the published document is the same bytes
  *  the manifest was derived from even if the file changes underneath. */
 export function preparePage(opts) {
@@ -63,12 +73,8 @@ export function preparePage(opts) {
         throw new PageAuthoringError(`page source file must be .tsx, .html, or .htm: ${opts.sourceFile}`);
     if (!existsSync(opts.sourceFile))
         throw new PageAuthoringError(`page source file does not exist: ${opts.sourceFile}`);
-    const document = readFileSync(opts.sourceFile, 'utf8');
-    const stamped = { ...(opts.source ?? {}), emittedAt: opts.source?.emittedAt ?? new Date().toISOString() };
-    const delivery = opts.delivery ?? { placement: 'inline', inbox: false, reply: false };
-    if (html)
-        return { document, manifest: deriveHtmlPageManifest(document, stamped, delivery) };
-    return { document, module: compilePage(document), manifest: derivePageManifestFromDocument(document, opts.productKinds ?? [], stamped, delivery) };
+    const { sourceFile: _sourceFile, ...rest } = opts;
+    return preparePageSource({ ...rest, dialect: html ? 'html' : 'jsx', document: readFileSync(opts.sourceFile, 'utf8') });
 }
 /** Remove a stale generation file. The manifest always switches first, so a
  * failed cleanup leaves one valid current record plus harmless old source. */
@@ -237,7 +243,7 @@ function completePageLocked(dir, responses, claimToken, opts) {
     requireClaimOwnership(dir, claimToken);
     const manifest = requirePage(dir);
     const parsedResponses = validateFinalPageTicketResponses(dir, responses);
-    const result = { schema: 'crtr.page-response/v1', kind: 'page', responses: parsedResponses, summary: buildPageSummary(manifest, parsedResponses), completedAt: opts.completedAt ?? new Date().toISOString() };
+    const result = { schema: 'crtr.page-response/v1', kind: 'page', responses: parsedResponses, summary: buildPageSummary(manifest, parsedResponses), completedAt: opts.completedAt ?? new Date().toISOString(), ...(opts.actor === undefined ? {} : { actor: opts.actor }) };
     const won = exclusiveResult(dir, result);
     clearOwnedWork(dir, claimToken);
     return { won, result: won ? result : readTicketResult(dir) ?? result };
@@ -280,7 +286,7 @@ export function cancelTicket(dir, opts = {}) {
     const canceled = withTicketLock(ticket, () => {
         if (existsSync(pageManifestPath(ticket)))
             requireCancelablePage(ticket);
-        const result = { schema: 'humanloop.cancel/v1', kind: 'canceled', canceledAt: new Date().toISOString(), ...(opts.reason === undefined ? {} : { reason: opts.reason }), ...(opts.actor === undefined ? {} : { actor: opts.actor }) };
+        const result = { schema: 'humanloop.cancel/v1', kind: 'canceled', canceledAt: new Date().toISOString(), ...(opts.reason === undefined ? {} : { reason: opts.reason }), ...(opts.actor === undefined ? {} : { actor: opts.actor }), ...(opts.disposition === undefined ? {} : { disposition: opts.disposition }) };
         const won = exclusiveResult(ticket, result);
         return { status: won ? 'canceled' : 'already_resolved', result: won ? result : readTicketResult(ticket) ?? result };
     });

package/dist/core/human/types.d.ts

@@ -89,6 +89,8 @@ export interface PageTicketResult {
     responses: PageResponses;
     summary: string;
     completedAt: string;
+    /** Recorded when an authorized programmatic writer answered instead of a person. */
+    actor?: string;
 }
 export interface ReviewTicketResult {
     schema: 'humanloop.review-response/v1';
@@ -102,6 +104,9 @@ export interface CanceledTicketResult {
     canceledAt: string;
     reason?: string;
     actor?: string;
+    /** Who ended it without an answer: the recipient (`dismissed`) or the
+     * requester (`canceled`). Absent on records written before the field. */
+    disposition?: 'canceled' | 'dismissed';
 }
 /** The sole canonical response.json union. */
 export type TicketResult = PageTicketResult | ReviewTicketResult | CanceledTicketResult;

package/dist/core/human-actions.d.ts

@@ -0,0 +1,25 @@
+export interface ResolvedHumanAction {
+    name: string;
+    /** Absolute path of the config file that won resolution. */
+    configOrigin: string;
+    /** Fully resolved argv; argv[0] is an absolute executable path. */
+    argv: string[];
+    /** Fully resolved absolute working directory. */
+    cwd: string;
+}
+export type HumanActionIssue = {
+    kind: 'unknown_action';
+    name: string;
+} | {
+    kind: 'invalid_action';
+    name: string;
+    configOrigin: string;
+    reason: string;
+    block?: true;
+};
+/** Resolve one declared action from a creator's absolute cwd: nearest project
+ * ancestor first, then farther project ancestors, then user scope. Never
+ * consults plugin or profile config. Read-only; never executes anything. */
+export declare function resolveHumanAction(name: string, creatorCwd: string): ResolvedHumanAction | HumanActionIssue;
+/** Every declared action reachable from a cwd, with its issues, for doctor. */
+export declare function inspectHumanActions(creatorCwd: string): Array<ResolvedHumanAction | HumanActionIssue>;

package/dist/core/human-actions.js

@@ -0,0 +1,101 @@
+import { statSync } from 'node:fs';
+import { dirname, join, resolve } from 'node:path';
+import { CONFIG_FILE } from '../types.js';
+import { humanActionDeclarationIssues, readRawConfigAtRoot } from './config.js';
+import { findProjectScopeRoots, scopeRoot } from './scope.js';
+function actionContributors(creatorCwd) {
+    const contributors = [];
+    for (const scopeRootPath of findProjectScopeRoots(creatorCwd, null)) {
+        const raw = readRawConfigAtRoot(scopeRootPath)?.humanActions;
+        if (raw !== undefined) {
+            contributors.push({
+                configOrigin: join(scopeRootPath, CONFIG_FILE),
+                authoringRoot: dirname(scopeRootPath),
+                raw,
+            });
+        }
+    }
+    const userRoot = scopeRoot('user');
+    if (userRoot !== null) {
+        const raw = readRawConfigAtRoot(userRoot)?.humanActions;
+        if (raw !== undefined) {
+            contributors.push({ configOrigin: join(userRoot, CONFIG_FILE), authoringRoot: userRoot, raw });
+        }
+    }
+    return contributors;
+}
+function declarationIssue(name, raw) {
+    return humanActionDeclarationIssues({ [name]: raw }).find((issue) => issue.name === name)?.reason;
+}
+function resolveDeclaredAction(name, declaration, contributor) {
+    const cwd = resolve(contributor.authoringRoot, declaration.cwd);
+    try {
+        if (!statSync(cwd).isDirectory()) {
+            return { kind: 'invalid_action', name, configOrigin: contributor.configOrigin, reason: `cwd is not a directory: ${cwd}` };
+        }
+    }
+    catch {
+        return { kind: 'invalid_action', name, configOrigin: contributor.configOrigin, reason: `cwd does not exist: ${cwd}` };
+    }
+    const executable = resolve(contributor.authoringRoot, declaration.argv[0]);
+    try {
+        const stat = statSync(executable);
+        if (!stat.isFile()) {
+            return { kind: 'invalid_action', name, configOrigin: contributor.configOrigin, reason: `argv[0] is not a regular file: ${executable}` };
+        }
+        if ((stat.mode & 0o111) === 0) {
+            return { kind: 'invalid_action', name, configOrigin: contributor.configOrigin, reason: `argv[0] lacks the POSIX exec bit: ${executable}` };
+        }
+    }
+    catch {
+        return { kind: 'invalid_action', name, configOrigin: contributor.configOrigin, reason: `argv[0] does not exist: ${executable}` };
+    }
+    return {
+        name,
+        configOrigin: contributor.configOrigin,
+        argv: [executable, ...declaration.argv.slice(1)],
+        cwd,
+    };
+}
+/** Resolve one declared action from a creator's absolute cwd: nearest project
+ * ancestor first, then farther project ancestors, then user scope. Never
+ * consults plugin or profile config. Read-only; never executes anything. */
+export function resolveHumanAction(name, creatorCwd) {
+    for (const contributor of actionContributors(creatorCwd)) {
+        if (contributor.raw === null || typeof contributor.raw !== 'object' || Array.isArray(contributor.raw))
+            continue;
+        const declarations = contributor.raw;
+        if (!Object.hasOwn(declarations, name))
+            continue;
+        const raw = declarations[name];
+        const issue = declarationIssue(name, raw);
+        if (issue !== undefined) {
+            return { kind: 'invalid_action', name, configOrigin: contributor.configOrigin, reason: issue };
+        }
+        return resolveDeclaredAction(name, raw, contributor);
+    }
+    return { kind: 'unknown_action', name };
+}
+/** Every declared action reachable from a cwd, with its issues, for doctor. */
+export function inspectHumanActions(creatorCwd) {
+    const results = [];
+    for (const contributor of actionContributors(creatorCwd)) {
+        const issues = humanActionDeclarationIssues(contributor.raw);
+        const invalid = new Map(issues.map((issue) => [issue.name, issue.reason]));
+        if (contributor.raw === null || typeof contributor.raw !== 'object' || Array.isArray(contributor.raw)) {
+            for (const issue of issues) {
+                results.push({ kind: 'invalid_action', name: issue.name, configOrigin: contributor.configOrigin, reason: issue.reason, ...(issue.block === true ? { block: true } : {}) });
+            }
+            continue;
+        }
+        for (const [name, raw] of Object.entries(contributor.raw)) {
+            const issue = invalid.get(name);
+            if (issue !== undefined) {
+                results.push({ kind: 'invalid_action', name, configOrigin: contributor.configOrigin, reason: issue });
+                continue;
+            }
+            results.push(resolveDeclaredAction(name, raw, contributor));
+        }
+    }
+    return results;
+}

package/dist/core/memory-resolver.js

@@ -313,7 +313,7 @@ function matchNormalizedChild(dir, segment, want, ext = '.md') {
  *  directory by normalized name, then resolve the final segment as either a
  *  `.md` file or a directory. Either half is null when
  *  the segment path does not resolve that way. This is what makes
- *  `00-runtime-base.md` findable as `runtime-base` and `01-spine/00-has-manager`
+ *  `00-runtime-base/00-authoring.md` findable as `runtime-base/authoring` and `01-spine/00-has-manager`
  *  findable as `spine/has-manager` — the physical path keeps its pins, only
  *  lookup is prefix-blind. */
 function resolveNormalizedPath(baseDir, segments, ext = '.md') {

package/dist/core/profiles/select.d.ts

@@ -9,6 +9,8 @@ export declare function resolveProfileSearchAction(bindings: BindingResolution<B
  *  `crtr profile default set`, which rejects pinning a profile that doesn't
  *  cover cwd (the selector would ignore/self-heal such a pin anyway). */
 export declare function profileCoversCwd(entry: ProfileEntry, cwd: string): boolean;
+/** Resolve the headless selector against existing state without changing it. */
+export declare function selectProfileForCwdReadOnly(cwd: string): string;
 /** Select the profile a node about to boot at `cwd` should run under.
  *
  *  1. `explicitProfile` present → resolve id/name via `loadProfileManifest`. If

package/dist/core/profiles/select.js

@@ -93,6 +93,26 @@ function isMoreRecent(a, b) {
 function pickMostRecent(entries) {
     return entries.reduce((best, cur) => isMoreRecent(cur.manifest.last_used_at, best.manifest.last_used_at) ? cur : best);
 }
+function profileSelectionState(cwd) {
+    const resolvedCwd = resolveCwd(cwd);
+    const covering = listProfiles().filter((profile) => profileCoversCwd(profile, resolvedCwd));
+    const exact = covering.filter((profile) => profile.manifest.projects.some((project) => project.path === resolvedCwd));
+    const pinnedId = getDefaultProfileId(resolvedCwd);
+    const pinned = pinnedId === null ? null : covering.find((profile) => profile.profileId === pinnedId) ?? null;
+    return { covering, exact, pinnedId, pinned };
+}
+/** Resolve the headless selector against existing state without changing it. */
+export function selectProfileForCwdReadOnly(cwd) {
+    const { covering, exact, pinned } = profileSelectionState(cwd);
+    if (pinned !== null)
+        return pinned.profileId;
+    if (exact.length === 1)
+        return exact[0].profileId;
+    const pool = exact.length > 0 ? exact : covering;
+    if (pool.length > 0)
+        return pickMostRecent(pool).profileId;
+    return ROOT_PROFILE_ID;
+}
 function isInteractive() {
     return Boolean(process.stdin.isTTY) && Boolean(process.stdout.isTTY);
 }
@@ -620,14 +640,11 @@ export async function selectProfileForCwd(cwd, explicitProfile, forcePicker = fa
         updateProfileLastUsed(entry.profileId);
         return entry.profileId;
     }
-    const covering = listProfiles().filter((p) => profileCoversCwd(p, resolvedCwd));
-    const exact = covering.filter((p) => p.manifest.projects.some((proj) => proj.path === resolvedCwd));
+    const { covering, exact, pinnedId, pinned } = profileSelectionState(resolvedCwd);
     // A per-cwd pinned default (set from the menu with `d`) is the user's
     // explicit "default to THIS profile HERE". It outranks both the exact-single
     // auto-pick and global-MRU, so long as it still covers cwd; a stale pin
     // (profile deleted, or its dir removed from purview) is self-healed away.
-    const pinnedId = getDefaultProfileId(resolvedCwd);
-    const pinned = pinnedId !== null ? covering.find((p) => p.profileId === pinnedId) ?? null : null;
     if (pinnedId !== null && pinned === null)
         clearDefaultProfile(resolvedCwd);
     // A valid pin decides it outright and STOPS ASKING — the whole point of

package/dist/core/runtime/broker/frame-dispatch.js

@@ -9,7 +9,7 @@ import { operationIdContext } from '../../events/operation-id.js';
 import { buildRefInventory } from '../../memory/inline-ref-inventory.js';
 import { buildGuidance } from '../../memory/inline-ref-guidance.js';
 import { clearSessionCache } from '../../substrate/session-cache.js';
-import { captureSessionPromptTemplateChatSurfaces } from '../command-surface.js';
+import { captureSessionChatCapabilities } from '../command-surface.js';
 import { promptWithAdvertisedCommandInvocation } from '../advertised-command-invocation.js';
 export { promptWithAdvertisedCommandInvocation } from '../advertised-command-invocation.js';
 import { configuredLadderProviders, isProviderPinnedModelToken, nextLadderModel, normalizeModel, } from '../launch.js';
@@ -1210,7 +1210,7 @@ export function createFrameDispatchContext(deps) {
                 // cached docs. A FAILED reload (`.catch`) leaves both untouched: nothing
                 // about the corpus is known to have changed.
                 void currentSession()
-                    .reload()
+                    .reload({ beforeSessionStart: () => captureSessionChatCapabilities(currentSession()) })
                     .then(() => {
                     // pi's reload() re-syncs queue modes from the shared settings.json
                     // (its ONE post-bind syncQueueModesFromSettings call site) —
@@ -1221,9 +1221,6 @@ export function createFrameDispatchContext(deps) {
                         agent.steeringMode = 'all';
                         agent.followUpMode = 'all';
                     }
-                    // `session.reload()` has replaced pi's loaded template objects;
-                    // capture their crouter-only metadata before any observer refresh.
-                    captureSessionPromptTemplateChatSurfaces(currentSession());
                     memoizedRefInventory = null;
                     clearSessionCache();
                     registry.forEachHelloed((observer) => {

package/dist/core/runtime/broker-inventory.d.ts

@@ -1,5 +1,4 @@
-import type { ChatInventoryDTO, ChatInventoryMemoryRefDTO } from '../../api/dto/chat-inventory.js';
-export declare function gatewayMemoryRows(refs: unknown): ChatInventoryMemoryRefDTO[];
+import type { ChatInventoryDTO } from '../../api/dto/chat-inventory.js';
 /** Collect the chat inventories for one node. Always resolves — every failure
  *  mode is expressed in the returned document, not thrown. */
 export declare function readChatInventory(nodeId: string): Promise<ChatInventoryDTO>;

package/dist/core/runtime/broker-inventory.js

@@ -24,7 +24,7 @@
 import { randomUUID } from 'node:crypto';
 import { getNode } from '../canvas/canvas.js';
 import { BrokerClient } from '../broker-client/index.js';
-import { isDeterministicCommandExpansion } from './command-expansion.js';
+import { gatewayCommandRowsFromDetail, gatewayMemoryRows } from './chat-inventory-rows.js';
 import { isBrokerLive } from './model-swap.js';
 /** Same budget as `broker-request.ts`: this is local engine work, so it is
  *  generous slack rather than a tuned deadline. One budget covers BOTH answers —
@@ -36,81 +36,6 @@ const READ_TIMEOUT_MS = 15_000;
  *  throws away — on every activation and reconnect, worst on the longest
  *  conversations. One entry is the smallest legal request. */
 const SNAPSHOT_TAIL = 1;
-const MEMORY_KINDS = new Set(['knowledge', 'preference']);
-const MEMORY_SCOPES = new Set(['node', 'project', 'profile', 'user', 'builtin']);
-function nonEmptyString(value) {
-    return typeof value === 'string' && value !== '';
-}
-/** Keep the rows a chat surface can actually use and drop the rest. Malformed
- *  rows are discarded individually so one bad registration cannot take down the
- *  whole inventory.
- *
- *  This validation lives here rather than reusing the attach viewer's parser:
- *  `src/core` does not import `src/clients`, and adding that import would invert
- *  the layering. */
-function commandRows(detail) {
-    if (detail === undefined)
-        return [];
-    let parsed;
-    try {
-        parsed = JSON.parse(detail);
-    }
-    catch {
-        return [];
-    }
-    if (!Array.isArray(parsed))
-        return [];
-    const out = [];
-    for (const row of parsed) {
-        if (typeof row !== 'object' || row === null)
-            continue;
-        const record = row;
-        if (record['gatewayCapable'] !== true)
-            continue;
-        const source = record['source'];
-        if (source !== 'command' && source !== 'template')
-            continue;
-        if (!nonEmptyString(record['name']) || typeof record['description'] !== 'string')
-            continue;
-        const expansion = record['expansion'];
-        const template = record['template'];
-        const argumentHint = record['argumentHint'];
-        out.push({
-            name: record['name'],
-            description: record['description'],
-            source,
-            ...(nonEmptyString(argumentHint) ? { argument_hint: argumentHint } : {}),
-            ...(isDeterministicCommandExpansion(expansion) ? { expansion } : {}),
-            ...(typeof template === 'string' ? { template } : {}),
-        });
-    }
-    return out;
-}
-export function gatewayMemoryRows(refs) {
-    if (!Array.isArray(refs))
-        return [];
-    const out = [];
-    for (const row of refs) {
-        if (typeof row !== 'object' || row === null)
-            continue;
-        const record = row;
-        if (record['gatewayVisible'] !== true)
-            continue;
-        if (!nonEmptyString(record['name']) || typeof record['shortForm'] !== 'string')
-            continue;
-        if (typeof record['kind'] !== 'string' || !MEMORY_KINDS.has(record['kind']))
-            continue;
-        if (typeof record['scope'] !== 'string' || !MEMORY_SCOPES.has(record['scope']))
-            continue;
-        out.push({
-            name: record['name'],
-            kind: record['kind'],
-            scope: record['scope'],
-            shortForm: record['shortForm'],
-        });
-    }
-    return out;
-}
 const empty = (nodeId) => ({
     node_id: nodeId,
     broker_live: false,
@@ -174,7 +99,7 @@ export function readChatInventory(nodeId) {
         client.on('frame', (frame) => {
             // `get_commands` carries no id, so its ack is matched on `for` alone.
             if (frame.type === 'ack' && frame.for === 'get_commands') {
-                commands = frame.ok ? commandRows(frame.detail) : [];
+                commands = frame.ok ? gatewayCommandRowsFromDetail(frame.detail) : [];
                 settleWhenComplete();
                 return;
             }

package/dist/core/runtime/broker-persona-guidance.js

@@ -44,7 +44,7 @@ export function transitionGuidanceFromBrokerState(node, from, to) {
         sections.push(to.mode === 'orchestrator' ? orchestrationGuidance(node) : baseModeGuidance());
     }
     if (from.lifecycle !== to.lifecycle) {
-        sections.push(loadMemoryBody(to.lifecycle === 'resident' ? 'lifecycle/resident' : 'lifecycle/terminal'));
+        sections.push(loadMemoryBody(to.lifecycle === 'resident' ? 'turn-lifecycle/resident' : 'turn-lifecycle/terminal'));
     }
     return sections.join('\n\n');
 }

package/dist/core/runtime/broker.js

@@ -31,7 +31,7 @@ import { FRONT_DOOR_ENV } from './front-door.js';
 import { CANVAS_EXTENSIONS, piInvocationToSdkConfig, } from './launch.js';
 import { assertEngineVersion, loadBrokerEngine } from './broker-sdk.js';
 import { resolveBundledPiPackageDir } from './pi-cli.js';
-import { captureSessionPromptTemplateChatSurfaces } from './command-surface.js';
+import { captureSessionChatCapabilities } from './command-surface.js';
 import { PoolCredentialStore } from '../pool-credential-store.js';
 import { clearCleanAbort, markBusy, markCleanAbort } from './busy.js';
 import { recordFaultForCurrentNode } from './fault.js';
@@ -899,9 +899,9 @@ export async function buildBrokerSession(engine, cfg) {
             sessionStartEvent: o.sessionStartEvent,
         });
         installAdvertisedCommandInvocationContract(created.session);
-        // The resource loader has completed its initial template load. Capture
-        // crouter-only template metadata before command disclosure can observe it.
-        captureSessionPromptTemplateChatSurfaces(created.session);
+        // The resource loader has completed its initial load, but extensions have
+        // not received session_start yet. Freeze the Gateway capability boundary.
+        captureSessionChatCapabilities(created.session);
         // CONSTRUCTION-ONLY MASK — see modelLessRegistry: reveal now that model
         // selection (construction-time only) is done, so a later /login re-drive's
         // list_models/cycle_model/provider-rotation see the real registry.

package/dist/core/runtime/chat-inventory-rows.d.ts

@@ -0,0 +1,8 @@
+import type { ChatInventoryCommandDTO, ChatInventoryMemoryRefDTO } from '../../api/dto/chat-inventory.js';
+/** Keep the command rows a Gateway can use. Malformed registrations are
+ * discarded individually so one producer cannot take down the inventory. */
+export declare function gatewayCommandRows(rows: unknown): ChatInventoryCommandDTO[];
+export declare function chatInventoryCommandRows(rows: unknown): ChatInventoryCommandDTO[];
+export declare function gatewayCommandRowsFromDetail(detail: string | undefined): ChatInventoryCommandDTO[];
+export declare function chatInventoryMemoryRows(rows: unknown): ChatInventoryMemoryRefDTO[];
+export declare function gatewayMemoryRows(refs: unknown): ChatInventoryMemoryRefDTO[];