@north-light/crouter 0.3.223 → 0.3.225

package/dist/core/__tests__/preview-mirror-cap.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/core/__tests__/preview-mirror-cap.test.js

@@ -0,0 +1,37 @@
+// Regression: the preview mirror is bounded. A `crtr integration run` in a
+// canvas bash call once mirrored a 3 MB CRM dump into ToolResult.details via
+// this channel — bypassing pi's 50 KB stdout truncation entirely — and five
+// such calls made a 16 MB transcript that Northlight could no longer open.
+// The writer is the one choke point, so the writer is what this pins.
+import { strict as assert } from 'node:assert';
+import { existsSync, mkdtempSync, readFileSync, rmSync } from 'node:fs';
+import { tmpdir } from 'node:os';
+import { join } from 'node:path';
+import { after, test } from 'node:test';
+import { beginPreview, publishPreviewResult, PREVIEW_RESULT_MAX_BYTES } from '../io.js';
+import { PREVIEW_RESULT_PATH_ENV } from '../preview-result-path.js';
+const dir = mkdtempSync(join(tmpdir(), 'crtr-preview-cap-'));
+const priorEnv = process.env[PREVIEW_RESULT_PATH_ENV];
+after(() => {
+    rmSync(dir, { recursive: true, force: true });
+    if (priorEnv === undefined)
+        delete process.env[PREVIEW_RESULT_PATH_ENV];
+    else
+        process.env[PREVIEW_RESULT_PATH_ENV] = priorEnv;
+});
+test('a record over PREVIEW_RESULT_MAX_BYTES is dropped, not mirrored', () => {
+    const resultPath = join(dir, 'oversized.json');
+    process.env[PREVIEW_RESULT_PATH_ENV] = resultPath;
+    beginPreview('integration run');
+    publishPreviewResult({ ok: true, output: 'x'.repeat(PREVIEW_RESULT_MAX_BYTES) });
+    assert.equal(existsSync(resultPath), false);
+});
+test('a bounded record still mirrors verbatim', () => {
+    const resultPath = join(dir, 'bounded.json');
+    process.env[PREVIEW_RESULT_PATH_ENV] = resultPath;
+    beginPreview('integration run');
+    publishPreviewResult({ ok: true, output: 'small' });
+    const record = JSON.parse(readFileSync(resultPath, 'utf8'));
+    assert.equal(record.path, 'integration run');
+    assert.equal(record.result.output, 'small');
+});

package/dist/core/__tests__/seam/dormancy-release.test.js

@@ -19,7 +19,7 @@
 // they belong to the compiled seam tier; neither needs tmux.
 import { after, before, test } from 'node:test';
 import assert from 'node:assert/strict';
-import { readFileSync, writeFileSync } from 'node:fs';
+import { existsSync, readFileSync, writeFileSync } from 'node:fs';
 import { join } from 'node:path';
 import { appendInbox, readCursor, readInboxSince } from '../../feed/inbox.js';
 import { registerWarmSpare, subscribe, updateNode } from '../../canvas/index.js';
@@ -243,9 +243,15 @@ test('a connected broker viewer keeps an obligation-free resident live', { timeo
     });
     reviveNode(nodeId, { resume: true });
     const boot = await h.awaitBoot(nodeId);
+    // awaitBoot returns on the boot proof, which is written BEFORE the broker's
+    // own `persistAttachState()` lays down the truthful zero state. Writing our
+    // presence first lets that boot write clobber it, and the daemon then parks a
+    // node the test believes is attended — wait for the broker's file to exist.
+    const attachPath = join(h.home, 'nodes', nodeId, 'job', 'attach.json');
+    await h.waitFor(() => existsSync(attachPath), { timeoutMs: 20_000, intervalMs: 20, label: 'broker persists its boot attach state' });
     // This is the presence written by a helloed direct attach, which has no
     // focuses-table row because it did not pass through the focus opener.
-    writeFileSync(join(h.home, 'nodes', nodeId, 'job', 'attach.json'), JSON.stringify({ viewers: 1 }));
+    writeFileSync(attachPath, JSON.stringify({ viewers: 1 }));
     try {
         const seenAt = 15_000;
         await h.tick(seenAt);

package/dist/core/io.d.ts

@@ -10,6 +10,15 @@ export interface CrtrPreviewRecord {
     jsonl?: Record<string, unknown>[];
     error?: ErrorPayload;
 }
+/** A preview is bounded UI metadata, never a bulk-data channel. One
+ * `crtr integration run` once mirrored a 3 MB CRM dump into every copy of the
+ * transcript that contains its tool result — the session file, every replay
+ * frame, and the host product's stored conversation — because pi's 50 KB
+ * stdout truncation never sees this channel. The mirror write is the one
+ * choke point every record passes, so the bound lives here: an oversized
+ * record is dropped, and the viewer falls back to rendering the agent-facing
+ * stdout text, which pi bounds itself. */
+export declare const PREVIEW_RESULT_MAX_BYTES: number;
 /** Begin collecting the current leaf's structured response, if its caller
  * supplied the private per-tool-call result path. */
 export declare function beginPreview(path: string): void;

package/dist/core/io.js

@@ -14,6 +14,15 @@ import { ApiError } from '../api/index.js';
 // ---------------------------------------------------------------------------
 let jsonOutput = false;
 let preview;
+/** A preview is bounded UI metadata, never a bulk-data channel. One
+ * `crtr integration run` once mirrored a 3 MB CRM dump into every copy of the
+ * transcript that contains its tool result — the session file, every replay
+ * frame, and the host product's stored conversation — because pi's 50 KB
+ * stdout truncation never sees this channel. The mirror write is the one
+ * choke point every record passes, so the bound lives here: an oversized
+ * record is dropped, and the viewer falls back to rendering the agent-facing
+ * stdout text, which pi bounds itself. */
+export const PREVIEW_RESULT_MAX_BYTES = 256 * 1024;
 /** Begin collecting the current leaf's structured response, if its caller
  * supplied the private per-tool-call result path. */
 export function beginPreview(path) {
@@ -24,9 +33,12 @@ function publishPreview(record) {
     const resultPath = process.env[PREVIEW_RESULT_PATH_ENV];
     if (resultPath === undefined || resultPath === '')
         return;
+    const line = `${JSON.stringify({ path: preview?.path ?? '', ...record })}\n`;
+    if (Buffer.byteLength(line, 'utf8') > PREVIEW_RESULT_MAX_BYTES)
+        return;
     const tempPath = `${resultPath}.${process.pid}.tmp`;
     try {
-        writeFileSync(tempPath, `${JSON.stringify({ path: preview?.path ?? '', ...record })}\n`, 'utf8');
+        writeFileSync(tempPath, line, 'utf8');
         renameSync(tempPath, resultPath);
     }
     catch {

package/dist/core/runtime/node-read.js

@@ -55,6 +55,19 @@ function resolveSessionFile(nodeId, metaFile) {
         return raw;
     return null;
 }
+/** The node's readable session file, or `null` when the node exists but nothing
+ *  has been written to its session yet. pi's SessionManager computes a session's
+ *  `.jsonl` path at `newSession()` and writes the file on the FIRST appended
+ *  entry, so a freshly created node carries a bound `pi_session_file` that is
+ *  not on disk until something is said. Throws only when the node itself is
+ *  unknown. */
+function readableSessionFile(nodeId) {
+    const node = getNode(nodeId);
+    if (node === null) {
+        throw new InputError({ error: 'not_found', message: `no node: ${nodeId}`, field: 'id', next: 'List nodes with `crtr node inspect list`.' });
+    }
+    return resolveSessionFile(nodeId, node.pi_session_file);
+}
 function emptyStats(sessionId, sessionFile) {
     return {
         sessionFile,
@@ -266,6 +279,19 @@ export async function readNodeMessagesPage(nodeId, { cursor, limit = 200 }) {
             next: 'Use a limit from 1 through 500.',
         });
     }
+    // A node that exists but has said nothing has an EMPTY history, not a fault:
+    // its session file is not on disk until the first entry is appended, and a
+    // transcript read is how a UI opens a new conversation. Only this paged read
+    // can answer honestly — `/snapshot` would have to invent the engine state a
+    // never-run node does not have, so it and the raw `/session` export still
+    // reject the same state through `reconstructVisibleMessages`.
+    // Same shape a session-file-backed empty read produces: `messageIds` stays
+    // aligned 1:1 with `messages` (an absent `message_ids` would claim this read
+    // cannot identify entries, which is a different statement than "there are
+    // none"), and `nextCursor: null` is the same end-of-history marker an
+    // exhausted backward walk returns.
+    if (readableSessionFile(nodeId) === null)
+        return { messages: [], messageIds: [], nextCursor: null };
     const { messages, identified } = await reconstructVisibleMessages(nodeId);
     const before = cursor === undefined ? messages.length : decodeMessagesCursor(cursor, messages.length);
     let start = Math.max(0, before - limit);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@north-light/crouter",
-  "version": "0.3.223",
+  "version": "0.3.225",
   "description": "crtr — agent runtime with memory, plugins, and marketplaces",
   "type": "module",
   "main": "dist/index.js",

package/runtime.lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@north-light/crouter",
-  "version": "0.3.223",
+  "version": "0.3.225",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@north-light/crouter",
-      "version": "0.3.223",
+      "version": "0.3.225",
       "hasInstallScript": true,
       "license": "MIT",
       "dependencies": {