@north-light/crouter 0.3.232 → 0.3.234

package/dist/api/client.js

@@ -9,6 +9,7 @@
 //
 // TRANSPORT (spec O-1): `node:http`/`node:https` `request()` — NO `undici`.
 // unix socket via `{ socketPath }`; TCP/remote via a parsed `baseUrl`.
+import { envHomeOverride } from '../shared/env.js';
 import { request as httpRequest } from 'node:http';
 import { request as httpsRequest } from 'node:https';
 import { homedir } from 'node:os';
@@ -27,7 +28,7 @@ const SOCKET_BASENAME = 'crtrd.sock';
 /** Resolve crtrd's default unix socket path the same way `apiSocketPath()` does,
  *  via Node built-ins only (no `core/canvas/paths.ts` import). */
 function defaultSocketPath() {
-    const override = process.env['CRTR_HOME'];
+    const override = envHomeOverride();
     const home = override !== undefined && override !== ''
         ? override
         : join(homedir(), CRTR_DIR_NAME, 'canvas');
@@ -74,7 +75,7 @@ export class CrtrClient {
     static forLocalSocket(opts) {
         return new CrtrClient({ socketPath: defaultSocketPath(), autostart: true, ...opts });
     }
-    // ---- Health / status ---------------------------------------------------
+    // Health / status
     healthz() {
         return this.request('GET', routes.healthz());
     }
@@ -88,7 +89,7 @@ export class CrtrClient {
     restartDaemon() {
         return this.request('POST', routes.daemonRestart());
     }
-    // ---- Nodes -------------------------------------------------------------
+    // Nodes
     createNode(req) {
         return this.request('POST', routes.nodes(), req);
     }
@@ -178,7 +179,7 @@ export class CrtrClient {
     subscribe(id, req) {
         return this.request('POST', routes.nodeSubscriptions(this.nodePath(id)), req);
     }
-    // ---- Focuses (viewer registry) ----------------------------------------
+    // Focuses (viewer registry)
     // The tmux verbs that open/move/close a viewer pane run LOCALLY in the
     // caller's session (placement-tmux); only the canvas.db focus rows route here.
     // Reads GC lazily server-side, so a returned row is always live; a `null` body
@@ -245,7 +246,7 @@ export class CrtrClient {
     ensureAttach(id, req) {
         return this.request('POST', routes.nodeAttach(this.nodePath(id)), req ?? {});
     }
-    // ---- Reads / feed ------------------------------------------------------
+    // Reads / feed
     getReports(id, q) {
         return this.request('GET', withQuery(routes.nodeReports(this.nodePath(id)), q));
     }
@@ -283,20 +284,20 @@ export class CrtrClient {
     getContext(id) {
         return this.request('GET', routes.nodeContext(this.nodePath(id)));
     }
-    // ---- Host file read ----------------------------------------------------
+    // Host file read
     /** Read an absolute host path as UTF-8 (capped, `truncated` when clipped) for
      *  the browser file-peek panel. */
     peekFile(path) {
         return this.request('GET', withQuery(routes.filePeek(), { path }));
     }
-    // ---- Memory documents --------------------------------------------------
+    // Memory documents
     /** Resolve an exact canonical `[[name]]` memory-document link to the winning
      *  document's physical origin for the given node — the node's own precedence
      *  chain, not this process's. Pair with `peekFile` to render the document. */
     resolveMemoryDoc(name, nodeId) {
         return this.request('GET', withQuery(routes.memoryResolve(), { name, node: nodeId }));
     }
-    // ---- Profiles ----------------------------------------------------------
+    // Profiles
     /** Create-or-return by name. Supplied `projects` are shape-checked even when
      *  the profile already exists; their directories are only required to exist
      *  when this call creates the profile. */
@@ -317,7 +318,7 @@ export class CrtrClient {
     deleteProfile(name, req) {
         return this.request('DELETE', routes.profile(name), req);
     }
-    // ---- Model auth --------------------------------------------------------
+    // Model auth
     listModelAuth() {
         return this.request('GET', routes.modelAuths());
     }
@@ -327,7 +328,7 @@ export class CrtrClient {
     removeCredential(provider) {
         return this.request('DELETE', routes.modelAuth(provider));
     }
-    // ---- Human bridge + completion-handler forwarding (spec §6.5) ----------
+    // Human bridge + completion-handler forwarding (spec §6.5)
     /** Create a terminal `kind:'human'` bridge node with NO broker engine
      *  (`spawnNode` server-side). Distinct from `createNode` (which launches a
      *  broker) precisely because a human bridge must never have one. */
@@ -344,7 +345,7 @@ export class CrtrClient {
     cancelHumanTicket(ticketId, body) {
         return this.request('POST', routes.humanTicketCancel(this.interactionPath(ticketId)), body);
     }
-    // ---- Daemon-owned document reviews and comments -----------------------
+    // Daemon-owned document reviews and comments
     createReview(req) {
         return this.request('POST', routes.humanReviews(), req);
     }
@@ -433,7 +434,7 @@ export class CrtrClient {
     cancelHumanInboxTicket(ticketId, request) {
         return this.request('POST', routes.humanInboxCancel(this.ticketId(ticketId)), request ?? {});
     }
-    // ---- Durable programmatic human requests -------------------------------
+    // Durable programmatic human requests
     /** Create one durable human request. Its `request_id` is the same opaque id
      *  the inbox routes address, so the request and the inbox ticket are one
      *  record. An unresolvable `action.name` is rejected before the page is
@@ -474,7 +475,7 @@ export class CrtrClient {
         }
         return this.request('POST', routes.humanInboxFeedbackResolve(this.ticketId(ticketId), commentId), { node_id: nodeId });
     }
-    // ---- Canvas reads / maintenance ---------------------------------------
+    // Canvas reads / maintenance
     /** Composed client-side from `GET /v1/nodes` + `GET /v1/status` (spec §6.3 —
      *  the dashboard is absorbed into those two reads; there is no single route).
      *  `generated_at` is the client-side capture instant of the composition. */
@@ -527,7 +528,7 @@ export class CrtrClient {
     rebuildIndex() {
         return this.request('POST', routes.canvasRebuildIndex(), {});
     }
-    // ---- Escape hatch ------------------------------------------------------
+    // Escape hatch
     /** Raw request for routes not yet method-wrapped. Applies the same
      *  autostart + error-mapping semantics. */
     async request(method, path, body) {
@@ -549,7 +550,7 @@ export class CrtrClient {
             throw toTransportApiError(err);
         }
     }
-    // ---- internals ---------------------------------------------------------
+    // internals
     nodePath(id) {
         if (!isSafeNodeId(id)) {
             throw new ApiError(400, 'invalid_node_id', `invalid node id: ${JSON.stringify(id)}`);

package/dist/builtin-memory/internal/memory-loading.md

@@ -9,7 +9,7 @@ surfaces:
 
 # How memory loads
 
-Every memory doc declares its own delivery in frontmatter `surfaces` entries; the runtime never guesses. Delivery is five events, one rung per entry, document and entry gates, and structural ordering. The authoring contract (flags, routing-line craft) is `crtr memory write -h`; which scope to write to is `internal/agent-shaping`; physical paths are `internal/storage-tiers`. This doc is the mechanics between those: what actually fires, when, and in what order.
+Every memory doc declares its own delivery in frontmatter `surfaces` entries; the runtime never guesses. Delivery is six events, one rung per entry, document and entry gates, and structural ordering. The authoring contract (flags, routing-line craft) is `crtr memory write -h`; which scope to write to is `internal/agent-shaping`; physical paths are `internal/storage-tiers`. This doc is the mechanics between those: what actually fires, when, and in what order.
 
 ## Surfaces entries
 
@@ -19,7 +19,8 @@ A doc with no `surfaces` does exactly one thing: appears in its directory's list
 - **workspace-open** — first-message context when cwd/profile mounts the doc's project store. Project stores only.
 - **read** — a `read` tool call returned a matching file: path globs vs the file's absolute path and basename, `./`-anchored globs vs its path relative to the store's owning repo dir, `match-frontmatter` predicates over the read file's own YAML frontmatter.
 - **memory-read** — a `crtr memory read` resolved a matching doc: name globs vs its canonical name, `./` anchored to this doc's canonical routing anchor (a collapsed directory document anchors at its own directory name).
-- **command** — a matching shell command ran: globs vs the whole command string, `*` crossing `/`. Delivery is post-execution — right for "you are now in this territory," never for "don't run this at all."
+- **command** — a matching shell command ran: globs vs the whole command string, `*` crossing `/`. Delivery is post-execution — right for "you are now in this territory"; when the point is "don't run this at all," use `pre-command` instead.
+- **pre-command** — a matching `bash` command is about to run. When the memory has not been read yet, the command does not execute — the memory comes back as the tool result instead, and the agent re-issues the command, which then runs. Use it to guarantee a memory is seen before a sensitive action is taken. Same globs as `command`, matched at command position; `match` is required. A guardrail against the faithful-but-uninformed action, not an enforcement boundary.
 
 Nothing positional fires from where a doc happens to sit on disk — only from its declared entries and its listing.
 
@@ -49,7 +50,7 @@ At boot/first-message assembly the runtime mounts: builtin docs, the user store
 
 Each project the selected profile has a relationship with carries a `memory` value — `none`, `name`, `preview`, or `content` — and that value is the maximum rung anything in that project's stores delivers at boot and workspace-open, whatever directory the node is working in. It only lowers: an entry authored below the maximum delivers at its authored rung. `none` contributes nothing to either automatic event, so a `none` project cannot shadow a same-named doc from a wider scope — that wider doc becomes the winner. A project store the selected profile has no relationship with delivers exactly what it authored.
 
-The maximum reaches those two events and nothing else. Read, memory-read, and command entries fire at their authored rungs; directory listings, `crtr memory read`, `crtr memory find`, config resolution, and plugin discovery all see the full corpus. An explicit `crtr memory read` is itself a content delivery, so reading a capped or document-gated doc returns its whole body and records content — the upgrade path for a doc the automatic events disclosed only by name or preview. Entry gates apply to companion docs routed by the `memory-read` event, not to the deliberate read or its listings.
+The maximum reaches those two events and nothing else. Read, memory-read, command, and pre-command entries fire at their authored rungs; directory listings, `crtr memory read`, `crtr memory find`, config resolution, and plugin discovery all see the full corpus. An explicit `crtr memory read` is itself a content delivery, so reading a capped or document-gated doc returns its whole body and records content — the upgrade path for a doc the automatic events disclosed only by name or preview. Entry gates apply to companion docs routed by the `memory-read` event, not to the deliberate read or its listings.
 
 A workspace's front door is an ordinary doc carrying the entry pair `{on: workspace-open, at: content}` + `{on: read, match: "./**", at: content}` — the operating guide loads when that workspace mounts or its files are read, not in every boot catalog. `crtr memory lint` requires exactly one workspace-open content doc per profile-managed project store. Multiple mounted roots render broad-to-specific.
 

package/dist/builtin-pi-packages/pi-crtr-extensions/extensions/__tests__/integration/provider-rotation.test.ts

@@ -2223,7 +2223,7 @@ test("a concrete model's headerless usage-limit stays turn-local and carries its
   }
 });
 
-// --- Provider-management removal routing and login coordination ---
+// Provider-management removal routing and login coordination
 
 function readAuthRecord(providerId: string): unknown {
   const authPath = join(home, ".pi", "agent", "auth.json");

package/dist/builtin-pi-packages/pi-crtr-extensions/extensions/claude-plugin-commands.ts

@@ -1,4 +1,5 @@
-import type { ExtensionAPI } from "@earendil-works/pi-coding-agent";
+import { envProfileId } from '../../../shared/env.js';
+import type { ExtensionAPI } from '@earendil-works/pi-coding-agent';
 import {
   readFileSync,
   readdirSync,
@@ -8,15 +9,14 @@ import {
   rmSync,
   writeFileSync,
   realpathSync,
-} from "node:fs";
-import { homedir } from "node:os";
-import { join, resolve, dirname } from "node:path";
-import { loadProfileManifest } from "../../../core/profiles/manifest.js";
-import { stripMarkdownComments } from "../../../core/runtime/command-expansion.js";
-import { expandShellBlocks, DEFAULT_SHELL_TIMEOUT_MS } from "../../../core/runtime/shell-expansion.js";
-import { piShellRunner } from "./pi-shell-runner.js";
-
-// ---------------------------------------------------------------------------
+} from 'node:fs';
+import { homedir } from 'node:os';
+import { join, resolve, dirname } from 'node:path';
+import { loadProfileManifest } from '../../../core/profiles/manifest.js';
+import { stripMarkdownComments } from '../../../core/runtime/command-expansion.js';
+import { expandShellBlocks, DEFAULT_SHELL_TIMEOUT_MS } from '../../../core/runtime/shell-expansion.js';
+import { piShellRunner } from './pi-shell-runner.js';
+
 // claude-plugin-commands: surfaces Claude Code commands AND skills as pi slash
 // commands, with Claude's `plugin:command` namespacing AND full runtime
 // behavior: `$1/$ARGUMENTS` argument substitution and `!`cmd` / ```! shell
@@ -43,7 +43,6 @@ import { piShellRunner } from "./pi-shell-runner.js";
 //      BEFORE expansion, read the ORIGINAL source file, substitute args, run
 //      the embedded shell, and `transform` the input to the resolved text.
 //      Shell-execution logic mirrors @juicesharp/rpiv-args.
-// ---------------------------------------------------------------------------
 
 const HOME = homedir();
 const CLAUDE = join(HOME, ".claude");
@@ -67,7 +66,7 @@ type InstallRecord = { installPath?: string };
 type InstalledPlugins = { plugins?: Record<string, InstallRecord[]> };
 type Shim = { name: string; target: string; kind: Kind; baseDir: string };
 
-// ---- discovery ------------------------------------------------------------
+// discovery
 
 function collectCommands(root: string, prefix: string[], rel: string[], out: Shim[]): void {
   if (!existsSync(root)) return;
@@ -161,7 +160,7 @@ export function projectClaudeDirs(cwd: string, profileProjectDirs: readonly stri
 }
 
 function selectedProfileProjects(): string[] {
-  const profileId = process.env["CRTR_PROFILE_ID"] ?? "";
+  const profileId = envProfileId() ?? "";
   if (profileId === "") return [];
   try {
     return loadProfileManifest(profileId).manifest.projects.map((project) => project.path);
@@ -289,7 +288,7 @@ function buildShims(cwd: string): string {
   return SHIM_DIR;
 }
 
-// ---- argument substitution (mirrors pi's prompt-template engine) -----------
+// argument substitution (mirrors pi's prompt-template engine)
 
 function parseCommandArgs(s: string): string[] {
   const args: string[] = [];
@@ -367,7 +366,7 @@ function shellTimeoutMs(fm: string): number {
   return v === 0 ? 0 : v * 1000;
 }
 
-// ---- shell execution (mirrors @juicesharp/rpiv-args) -----------------------
+// shell execution (mirrors @juicesharp/rpiv-args)
 //
 // The `!`cmd`` / ```! grammar and substitution order are shared with every
 // other surface that expands a Markdown body (`core/runtime/shell-expansion`);
@@ -377,8 +376,6 @@ async function executeShell(body: string, pi: ExtensionAPI, cwd: string, timeout
   return expandShellBlocks(body, piShellRunner(pi, cwd, timeoutMs));
 }
 
-// ---------------------------------------------------------------------------
-
 export default function (pi: ExtensionAPI) {
   pi.on("resources_discover", async (event: { cwd?: string }) => {
     const dir = buildShims(event?.cwd ?? process.cwd());

package/dist/builtin-pi-packages/pi-crtr-extensions/extensions/crtr-commands/index.ts

@@ -1,14 +1,13 @@
-import type { ExtensionAPI } from "@earendil-works/pi-coding-agent";
-import { execFile } from "node:child_process";
-import { promisify } from "node:util";
-import { readFileSync, existsSync, realpathSync } from "node:fs";
-import { fileURLToPath, pathToFileURL } from "node:url";
-import { dirname, join } from "node:path";
-import type { ChatCommandMetadata } from "../../../../core/runtime/command-surface.js";
+import type { ExtensionAPI } from '@earendil-works/pi-coding-agent';
+import { execFile } from 'node:child_process';
+import { promisify } from 'node:util';
+import { readFileSync, existsSync, realpathSync } from 'node:fs';
+import { fileURLToPath, pathToFileURL } from 'node:url';
+import { dirname, join } from 'node:path';
+import type { ChatCommandMetadata } from '../../../../core/runtime/command-surface.js';
 
 const exec = promisify(execFile);
 
-// ---------------------------------------------------------------------------
 // crtr-commands: auto-generates a slash command for every node in the crtr
 // CLI tree. `/node:new` runs `crtr node new -h`; `/node:list`
 // runs `crtr node list -h`, and so on.
@@ -26,7 +25,6 @@ const exec = promisify(execFile);
 //
 // Registered handlers still shell out to the real `crtr` binary, but only
 // when the user invokes one — never on the boot path.
-// ---------------------------------------------------------------------------
 
 const HERE = dirname(fileURLToPath(import.meta.url));
 const FILTERS_PATH = join(HERE, "filters.json");
@@ -76,9 +74,7 @@ export function isAllowed(name: string, filters: Filters): boolean {
   return true;
 }
 
-// ---------------------------------------------------------------------------
 // Locate + import crtr's real command tree (mirrors crtr-help-gate.ts).
-// ---------------------------------------------------------------------------
 
 async function resolveCrtrDist(): Promise<string | null> {
   const dirs = (process.env.PATH ?? "").split(":");

package/dist/builtin-pi-packages/pi-crtr-extensions/extensions/frontmatter-rules/index.ts

@@ -65,12 +65,12 @@
  * .pi/extensions/. Run `npm install` here once so `yaml` resolves.
  */
 
-import type { ExtensionAPI, ToolResultEvent } from "@earendil-works/pi-coding-agent";
-import * as fs from "node:fs";
-import * as os from "node:os";
-import * as path from "node:path";
-import { parse as parseYaml } from "yaml";
-import { mergeAutoLoadedContext } from "../../../../pi-extensions/envelope-merge.js";
+import type { ExtensionAPI, ToolResultEvent } from '@earendil-works/pi-coding-agent';
+import * as fs from 'node:fs';
+import * as os from 'node:os';
+import * as path from 'node:path';
+import { parse as parseYaml } from 'yaml';
+import { mergeAutoLoadedContext } from '../../../../pi-extensions/envelope-merge.js';
 
 const MARKDOWN_EXTS = new Set([".md", ".mdx", ".markdown"]);
 
@@ -198,7 +198,7 @@ function parseRuleFile(filePath: string): Rule {
 	return { name, description, when: front.when, body: (m[2] ?? "").trim() };
 }
 
-// ---- Condition language ----------------------------------------------------
+// Condition language
 
 function asArray(v: unknown): unknown[] {
 	if (Array.isArray(v)) return v;
@@ -323,7 +323,7 @@ function evalCondition(cond: unknown, fm: Frontmatter): boolean {
 	return keys.every((k) => matchField(getField(fm, k), c[k]));
 }
 
-// ---- Extension -------------------------------------------------------------
+// Extension
 
 export default function frontmatterRules(pi: ExtensionAPI) {
 	const seen = new Set<string>();

package/dist/builtin-pi-packages/pi-crtr-extensions/extensions/memory-slash-commands.ts

@@ -1,12 +1,13 @@
-import type { ExtensionAPI } from "@earendil-works/pi-coding-agent";
-import { createMemoryDocSnapshot, readMemoryDocContent } from "../../../commands/memory/read.js";
-import { parseSubstrateDoc } from "../../../core/substrate/schema.js";
+import { envNodeId } from '../../../shared/env.js';
+import type { ExtensionAPI } from '@earendil-works/pi-coding-agent';
+import { createMemoryDocSnapshot, readMemoryDocContent } from '../../../core/memory-resolver.js';
+import { parseSubstrateDoc } from '../../../core/substrate/schema.js';
 import {
   expandDeterministicCommand,
   type DeterministicCommandExpansion,
-} from "../../../core/runtime/command-expansion.js";
-import { expandShellBlocks, hasShellBlocks, DEFAULT_SHELL_TIMEOUT_MS } from "../../../core/runtime/shell-expansion.js";
-import type { ChatCommandMetadata } from "../../../core/runtime/command-surface.js";
+} from '../../../core/runtime/command-expansion.js';
+import { expandShellBlocks, hasShellBlocks, DEFAULT_SHELL_TIMEOUT_MS } from '../../../core/runtime/shell-expansion.js';
+import type { ChatCommandMetadata } from '../../../core/runtime/command-surface.js';
 import {
   exposureTarget,
   loadContextExposureState,
@@ -14,10 +15,9 @@ import {
   registerDocumentExposure,
   saveContextExposureState,
   sharedContextExposureState,
-} from "../../../core/substrate/injected-store.js";
-import { piShellRunner } from "./pi-shell-runner.js";
+} from '../../../core/substrate/injected-store.js';
+import { piShellRunner } from './pi-shell-runner.js';
 
-// ---------------------------------------------------------------------------
 // memory-slash-commands: any memory doc frontmatter-flagged `slash: true`
 // becomes an invocable slash command (`/<name>`). This mirrors Hermes Agent's
 // "every skill is automatically a slash command" — /research-alpha injects
@@ -28,7 +28,6 @@ import { piShellRunner } from "./pi-shell-runner.js";
 // resolution. The snapshot already resolves exact canonical identities in
 // source precedence; this file does not walk memory directories or reimplement
 // scope resolution.
-// ---------------------------------------------------------------------------
 
 interface MemoryListItem {
   name: string;
@@ -86,7 +85,7 @@ function defaultReadMemoryDoc(name: string): { path: string; canonicalBody: stri
 }
 
 function registerSlashExposure(path: string, body: string): void {
-  const nodeId = process.env["CRTR_NODE_ID"];
+  const nodeId = envNodeId();
   if (nodeId === undefined || nodeId === "") return;
   const state = sharedContextExposureState(nodeId);
   mergeContextExposureState(state, loadContextExposureState(nodeId));

package/dist/builtin-pi-packages/pi-crtr-extensions/extensions/pi-shell-runner.ts

@@ -1,5 +1,5 @@
-import type { ExtensionAPI } from "@earendil-works/pi-coding-agent";
-import { truncateTail, formatSize, DEFAULT_MAX_LINES, DEFAULT_MAX_BYTES } from "@earendil-works/pi-coding-agent";
+import type { ExtensionAPI } from '@earendil-works/pi-coding-agent';
+import { truncateTail, formatSize, DEFAULT_MAX_LINES, DEFAULT_MAX_BYTES } from '@earendil-works/pi-coding-agent';
 
 // The broker-side execution strategy for `core/runtime/shell-expansion`. Every
 // command surface that expands a Markdown body inside a pi engine shares it, so

package/dist/builtin-pi-packages/pi-crtr-extensions/extensions/provider-rotation.d.ts

@@ -1,6 +1,6 @@
-import type { ExtensionAPI, ExtensionContext } from "@earendil-works/pi-coding-agent";
-import { type AssistantMessageEventStream, type Context, type Model, type SimpleStreamOptions } from "@earendil-works/pi-ai";
-import { type ManagedProviderId, type SubscriptionCredential } from "../../../core/subscription-state.js";
+import type { ExtensionAPI, ExtensionContext } from '@earendil-works/pi-coding-agent';
+import { type AssistantMessageEventStream, type Context, type Model, type SimpleStreamOptions } from '@earendil-works/pi-ai';
+import { type ManagedProviderId, type SubscriptionCredential } from '../../../core/subscription-state.js';
 export interface ProviderRotationOptions {
     modelIntent?: string;
     nodeCwd?: string;

package/dist/builtin-pi-packages/pi-crtr-extensions/extensions/provider-rotation.js

@@ -1,10 +1,10 @@
-import { spawn } from "node:child_process";
-import { createAssistantMessageEventStream, } from "@earendil-works/pi-ai";
-import { streamSimpleAnthropic, streamSimpleOpenAICodexResponses } from "@earendil-works/pi-ai/compat";
-import { ANTHROPIC_PROVIDER_ID, OPENAI_CODEX_PROVIDER_ID, INVALID_REFRESH_TOKEN_BACKOFF_MS, formatStatusLine, getProviderLabel, isManagedProvider, isInvalidRefreshTokenError, addSubscription, enrichManagedLoginIdentity, markSubscriptionAuthenticationFailed, markSubscriptionRateLimited, markSubscriptionSuccess, parseRetryAfterHeader, promoteSubscription, readRotationConfig, readSubscriptionPool, refreshSubscriptionCredential, removeManagedAccount, resolveProviderCandidates, upsertSubscriptionWithUniqueAccount, } from "../../../core/subscription-state.js";
-import { readMergedLaunchConfig } from "../../../core/config.js";
-import { expandModelCandidates, modelRequestFromConfig, probeRouteAvailability } from "../../../core/model-routes.js";
-import { ManagedProviderCoolingError } from "../../../core/runtime/managed-provider-cooling.js";
+import { spawn } from 'node:child_process';
+import { createAssistantMessageEventStream, } from '@earendil-works/pi-ai';
+import { streamSimpleAnthropic, streamSimpleOpenAICodexResponses } from '@earendil-works/pi-ai/compat';
+import { ANTHROPIC_PROVIDER_ID, OPENAI_CODEX_PROVIDER_ID, INVALID_REFRESH_TOKEN_BACKOFF_MS, formatStatusLine, getProviderLabel, isManagedProvider, isInvalidRefreshTokenError, addSubscription, enrichManagedLoginIdentity, markSubscriptionAuthenticationFailed, markSubscriptionRateLimited, markSubscriptionSuccess, parseRetryAfterHeader, promoteSubscription, readRotationConfig, readSubscriptionPool, refreshSubscriptionCredential, removeManagedAccount, resolveProviderCandidates, upsertSubscriptionWithUniqueAccount, } from '../../../core/subscription-state.js';
+import { readMergedLaunchConfig } from '../../../core/config.js';
+import { expandModelCandidates, modelRequestFromConfig, probeRouteAvailability } from '../../../core/model-routes.js';
+import { ManagedProviderCoolingError } from '../../../core/runtime/managed-provider-cooling.js';
 // A response without Retry-After proves only that THIS attempt was throttled; it
 // does not authorize crouter to invent a five-minute provider-wide outage. Keep
 // a short turn-local probe backoff to avoid an immediate retry loop, then let a

package/dist/builtin-pi-packages/pi-crtr-extensions/extensions/provider-rotation.ts

@@ -1,5 +1,5 @@
-import { spawn } from "node:child_process";
-import type { ExtensionAPI, ExtensionContext } from "@earendil-works/pi-coding-agent";
+import { spawn } from 'node:child_process';
+import type { ExtensionAPI, ExtensionContext } from '@earendil-works/pi-coding-agent';
 import {
   createAssistantMessageEventStream,
   type AssistantMessage,
@@ -11,8 +11,8 @@ import {
   type Model,
   type OAuthAuth,
   type SimpleStreamOptions,
-} from "@earendil-works/pi-ai";
-import { streamSimpleAnthropic, streamSimpleOpenAICodexResponses } from "@earendil-works/pi-ai/compat";
+} from '@earendil-works/pi-ai';
+import { streamSimpleAnthropic, streamSimpleOpenAICodexResponses } from '@earendil-works/pi-ai/compat';
 import {
   ANTHROPIC_PROVIDER_ID,
   OPENAI_CODEX_PROVIDER_ID,
@@ -36,10 +36,10 @@ import {
   upsertSubscriptionWithUniqueAccount,
   type ManagedProviderId,
   type SubscriptionCredential,
-} from "../../../core/subscription-state.js";
-import { readMergedLaunchConfig } from "../../../core/config.js";
-import { expandModelCandidates, modelRequestFromConfig, probeRouteAvailability } from "../../../core/model-routes.js";
-import { ManagedProviderCoolingError } from "../../../core/runtime/managed-provider-cooling.js";
+} from '../../../core/subscription-state.js';
+import { readMergedLaunchConfig } from '../../../core/config.js';
+import { expandModelCandidates, modelRequestFromConfig, probeRouteAvailability } from '../../../core/model-routes.js';
+import { ManagedProviderCoolingError } from '../../../core/runtime/managed-provider-cooling.js';
 
 // A response without Retry-After proves only that THIS attempt was throttled; it
 // does not authorize crouter to invent a five-minute provider-wide outage. Keep

package/dist/builtin-pi-packages/pi-crtr-extensions/extensions/statusline.ts

@@ -11,10 +11,10 @@
  * navigation and interactive chrome live in crouter's attach viewer.
  */
 
-import { execFile } from "node:child_process";
-import type { ExtensionAPI } from "@earendil-works/pi-coding-agent";
-import { CustomEditor, type ExtensionContext } from "@earendil-works/pi-coding-agent";
-import { truncateToWidth, visibleWidth } from "@earendil-works/pi-tui";
+import { execFile } from 'node:child_process';
+import type { ExtensionAPI } from '@earendil-works/pi-coding-agent';
+import { CustomEditor, type ExtensionContext } from '@earendil-works/pi-coding-agent';
+import { truncateToWidth, visibleWidth } from '@earendil-works/pi-tui';
 
 function lastDir(cwd: string): string {
 	const trimmed = cwd.replace(/\/+$/, "");
@@ -178,7 +178,7 @@ function borderWithBadge(
 
 export default function (pi: ExtensionAPI) {
 	pi.on("session_start", (_event, ctx) => {
-		// --- Statusline (footer): model · [subscription] · tokens · cycle, with cwd/git right-aligned ---
+		// Statusline (footer): model · [subscription] · tokens · cycle, with cwd/git right-aligned
 		ctx.ui.setFooter((tui, theme, footerData) => {
 			let gitStatus: GitStatus | null = null;
 
@@ -217,7 +217,7 @@ export default function (pi: ExtensionAPI) {
 			};
 		});
 
-		// --- Input bar border: session-name badge with solid background ---
+		// Input bar border: session-name badge with solid background
 		// Compose with whatever editor is already installed instead of replacing it:
 		// wrap the previous factory in a Proxy that overrides only render
 		// (session-name badge on the top border). Other editor decorations keep

package/dist/builtin-pi-packages/pi-crtr-extensions/extensions/sysprompt-window.ts

@@ -1,6 +1,6 @@
-import type { ExtensionAPI } from "@earendil-works/pi-coding-agent";
-import { execFile } from "node:child_process";
-import { promisify } from "node:util";
+import type { ExtensionAPI } from '@earendil-works/pi-coding-agent';
+import { execFile } from 'node:child_process';
+import { promisify } from 'node:util';
 
 const exec = promisify(execFile);
 const CRTR = "crtr";

package/dist/builtin-pi-packages/pi-crtr-extensions/lib/subscription-state.ts

@@ -1,2 +1,2 @@
 // Provider pool state belongs to crouter core so every human surface and the rotation runtime share one invariant-preserving implementation.
-export * from "../../../core/subscription-state.js";
+export * from '../../../core/subscription-state.js';

package/dist/clients/attach/chrome/ticket-panel.js

@@ -145,7 +145,15 @@ export function createTicketPanel(s, hooks) {
                     reload(entry);
                     return;
                 }
-                const result = readTicketResult(entry.dir);
+                let result;
+                try {
+                    result = readTicketResult(entry.dir);
+                }
+                catch (error) {
+                    closeSession(true);
+                    hooks.setNotice(`ticket result is unreadable: ${error instanceof Error ? error.message : String(error)}`);
+                    return;
+                }
                 if (result !== null) {
                     closeSession(true);
                     hooks.setNotice(result.kind === 'canceled' ? 'Ticket was canceled by its requester' : 'Ticket was resolved elsewhere');
@@ -203,7 +211,12 @@ export function createTicketPanel(s, hooks) {
     };
 }
 function resolvedElsewhereNotice(dir) {
-    return readTicketResult(dir)?.kind === 'canceled' ? 'Ticket was already canceled' : 'Ticket was already resolved';
+    try {
+        return readTicketResult(dir)?.kind === 'canceled' ? 'Ticket was already canceled' : 'Ticket was already resolved';
+    }
+    catch (error) {
+        return `ticket result is unreadable: ${error instanceof Error ? error.message : String(error)}`;
+    }
 }
 /** The SGR opening the theme's `customMessageBg` — the background the crouter
  *  context cards use. pi shares its live theme across module loaders on this

package/dist/clients/attach/overlays/graph.js

@@ -203,7 +203,6 @@ export class GraphOverlay {
     invalidate() {
         this.refresh();
     }
-    // -------------------------------------------------------------------------
     async buildSnapshot() {
         beginFrameTelem();
         const nodes = new Map();
@@ -444,7 +443,6 @@ export class GraphOverlay {
         const fill = Math.max(0, width - 5 - visibleWidth(lbl));
         return `${B(`${lc}─`)} ${lbl} ${B('─'.repeat(fill) + rc)}`;
     }
-    // -------------------------------------------------------------------------
     handleInput(data) {
         try {
             this.dispatch(data);
@@ -611,7 +609,6 @@ export class GraphOverlay {
         // Modal: swallow everything else so a stray
         // key never reaches the editor underneath.
     }
-    // -------------------------------------------------------------------------
     /** Focus node `id` from the overlay by shelling `crtr surface node focus <id> --pane <here>`.
      *  Under the one-viewer-per-node model `--pane` is the ANCHOR to open beside: if
      *  `id` has no viewer yet a fresh one splits beside this pane; if it already has

package/dist/clients/attach/overlays/mcp.js

@@ -147,7 +147,7 @@ function readConfigSource(path, cwd, home) {
     }
     return mergeServerMaps(imported, own);
 }
-// --- configHash recomputation — mirrors pi-mcp-adapter metadata-cache.ts ----
+// configHash recomputation — mirrors pi-mcp-adapter metadata-cache.ts
 function interpolateEnvVars(value) {
     return value
         .replace(/\$\{(\w+)\}/g, (_, name) => process.env[name] ?? '')
@@ -204,7 +204,6 @@ function computeServerHash(spec) {
     };
     return createHash('sha256').update(stableStringify(identity)).digest('hex');
 }
-// ---------------------------------------------------------------------------
 /** Read + merge the adapter's config sources (see file header) and join the
  *  tool cache into display rows. Returns [] when nothing is configured. */
 export function readMcpServers(home = homedir(), cwd = process.cwd()) {