@north-light/crouter 0.3.233 → 0.3.235

package/dist/core/runtime/broker.js

@@ -16,6 +16,7 @@
 // + model registry are real SDK construction helpers (NOT part of the swappable
 // engine seam — the fake engine receives the real, extension-loaded loader so
 // the real canvas-stophook fires session_start).
+import { envModelIntent, envNodeCwd, envProfileId } from '../../shared/env.js';
 import { createServer } from 'node:net';
 import { existsSync, readFileSync, unlinkSync } from 'node:fs';
 import { join } from 'node:path';
@@ -54,7 +55,7 @@ import { FrameOverflowError, normalizeSnapshotTail, } from './broker-protocol.js
 /** A review companion may only navigate or fork within a branch whose ancestry
  * has crossed its durable transcript boundary. The broker sends this typed local
  * failure as a dedicated error frame without invoking pi's tree mutation. */
-export { ReviewBoundaryNavigationError, REVIEW_BOUNDARY_NAVIGATION_CODE } from './broker/frame-dispatch.js';
+export { ReviewBoundaryNavigationError, REVIEW_BOUNDARY_NAVIGATION_CODE } from './broker/frame-replies.js';
 /**
  * pi 0.82 made `ModelRuntime` the canonical model/auth surface and demoted
  * `ModelRegistry` to the synchronous facade over it (`find`/`getAll`/
@@ -83,9 +84,7 @@ function formatExactModelSpec(model, thinkingLevel) {
     const base = formatModelSpec(model, undefined);
     return base === null ? null : `${base}:${thinkingLevel === undefined || thinkingLevel === '' ? 'off' : thinkingLevel}`;
 }
-// ---------------------------------------------------------------------------
 // Tunables (backpressure / dialog anti-deadlock)
-// ---------------------------------------------------------------------------
 /** Broker-side default dialog timeout (anti-deadlock). When an extension
  *  dialog is forwarded to every writable client, the broker ALWAYS arms a timeout
  *  (this default, or a shorter per-dialog `opts.timeout` if the extension passed
@@ -93,14 +92,12 @@ function formatExactModelSpec(model, thinkingLevel) {
  *  — can never hang the agent turn forever. On fire it resolves to the SAFE default
  *  (deny for confirm; cancel/undefined for select/input/editor). */
 const DEFAULT_DIALOG_TIMEOUT_MS = 120_000; // 120 s
-// ---------------------------------------------------------------------------
 // M3 (scout mq5thyli): the active engine session, exposed so broker-cli's FATAL
 // handlers (uncaughtException / unhandledRejection / the runBroker reject) can
 // dispose it before process.exit. The bash tool spawns children `detached` (own
 // pgid); only session.dispose() (→ abortBash / agent.abort → killProcessTree)
 // reaps them. The graceful exit path already disposes; without this the crash
 // path would `process.exit(1)` and ORPHAN every in-flight bash subprocess.
-// ---------------------------------------------------------------------------
 let activeSession = null;
 /** Dispose the live engine session if one exists (idempotent). Called by
  *  broker-cli's fatal handlers before exit so a crash never orphans detached
@@ -117,9 +114,7 @@ export function disposeActiveSession() {
         }
     }
 }
-// ---------------------------------------------------------------------------
 // runBroker — the broker process body (plan T4 steps 1–6)
-// ---------------------------------------------------------------------------
 export async function runBroker(nodeId, startupAt = process.hrtime.bigint(), startupTs = new Date().toISOString()) {
     // A clean-abort certificate belongs only to the dead broker that wrote it.
     // Fleet classification consumes it as proof that the dead broker had a turn
@@ -275,9 +270,7 @@ export async function runBroker(nodeId, startupAt = process.hrtime.bigint(), sta
     // N3: the node's display name is re-applied by the rebind lane below so it
     // survives a session replacement (new_session/switch_session/fork), not only at
     // boot.
-    // -------------------------------------------------------------------------
     // Socket fan-out, dialogs, and transcript tool groups
-    // -------------------------------------------------------------------------
     const sockPath = viewSocketPath(nodeId);
     const registry = new BrokerClientRegistry(nodeId);
     const pendingDialogs = new Map();
@@ -445,10 +438,8 @@ export async function runBroker(nodeId, startupAt = process.hrtime.bigint(), sta
     const reWelcomeAll = () => {
         registry.forEachHelloed(sendWelcome);
     };
-    // -------------------------------------------------------------------------
     // The single exit helper: dispose the engine, close + unlink the
     // socket, exit 0. Idempotent — every trigger converges here.
-    // -------------------------------------------------------------------------
     const completeExit = (status) => {
         if (disposed)
             return;
@@ -509,7 +500,6 @@ export async function runBroker(nodeId, startupAt = process.hrtime.bigint(), sta
         }
         completeExit(status);
     };
-    // -------------------------------------------------------------------------
     // Extension-dialog routing (C2). makeBrokerUiContext owns the dialogPromise;
     // here we just give it the three broker-side hooks it needs: the live set of
     // writable clients (empty = nobody can answer → noOp fallback), how to forward a
@@ -517,7 +507,6 @@ export async function runBroker(nodeId, startupAt = process.hrtime.bigint(), sta
     // first settles through. The zero-writable path NEVER hangs and NEVER waits on a
     // per-dialog timeout (design §5.4's timeout premise is false — see
     // makeBrokerUiContext).
-    // -------------------------------------------------------------------------
     uiContext = makeBrokerUiContext({
         writable: () => registry.writableClients(),
         forward: (client, request) => registry.sendFrame(client, request),
@@ -542,9 +531,7 @@ export async function runBroker(nodeId, startupAt = process.hrtime.bigint(), sta
     });
     notifyTurnAccepted = frameDispatch.notifyTurnAccepted;
     resetFrameState = frameDispatch.resetForSession;
-    // -------------------------------------------------------------------------
     // 4 (plan): the socket listener — unlink any stale socket first.
-    // -------------------------------------------------------------------------
     try {
         if (existsSync(sockPath))
             unlinkSync(sockPath);
@@ -671,7 +658,6 @@ export async function runBroker(nodeId, startupAt = process.hrtime.bigint(), sta
     process.on('SIGTERM', () => { void abortAndExit('SIGTERM'); });
     process.on('SIGINT', () => { void abortAndExit('SIGINT'); });
 }
-// ---------------------------------------------------------------------------
 // snapshotMessages — the catch-up snapshot's ordered message history.
 //
 // The broker is the SOLE writer of the node's session `.jsonl`, so the session
@@ -722,7 +708,6 @@ export function snapshotMessages(session, boundaryReviewId) {
     }
     return messages === undefined ? undefined : visibleMessages(messages, { boundaryReviewId });
 }
-// ---------------------------------------------------------------------------
 // resolveLaunchModel — the SOLE launch model-selection policy, module-scoped
 // so both buildForManager (initial boot, inside buildBrokerSession below) and
 // the reload_auth re-drive (inside runBroker, a DIFFERENT function scope) can
@@ -731,15 +716,14 @@ export function snapshotMessages(session, boundaryReviewId) {
 // viable at all (tier 3) — this is NOT a fault; the caller decides what to do
 // with it (construct a model-less session at boot, or leave a running session
 // alone on a failed re-drive attempt).
-// ---------------------------------------------------------------------------
 async function resolveLaunchModel(services, cfg) {
-    const routeRequest = modelRequestFromConfig(cfg.model, process.env['CRTR_MODEL_INTENT'], cfg.modelExact === true);
+    const routeRequest = modelRequestFromConfig(cfg.model, envModelIntent(), cfg.modelExact === true);
     if (routeRequest === undefined)
         return undefined;
     const registry = registryOf(services);
     const routeOptions = {
-        cwd: process.env['CRTR_NODE_CWD'] ?? cfg.cwd,
-        profileId: process.env['CRTR_PROFILE_ID'],
+        cwd: envNodeCwd() ?? cfg.cwd,
+        profileId: envProfileId(),
     };
     const unknown = unregisteredConcreteModel(routeRequest, registry, routeOptions);
     if (unknown !== undefined) {
@@ -812,11 +796,9 @@ function modelLessRegistry(real) {
     });
     return { runtime, reveal: () => { masked = false; } };
 }
-// ---------------------------------------------------------------------------
 // buildBrokerSession (plan T4 steps 2–4) — turn the launch recipe into a live
 // engine session via the pi SDK SERVICES path. Exported so the C3/C4 real-SDK
 // regression tests can drive the EXACT production wiring (not the mock).
-// ---------------------------------------------------------------------------
 export async function buildBrokerSession(engine, cfg) {
     // 2. Build cwd-bound runtime services via the SERVICES path (C3) — NOT plain
     //    createAgentSession. createAgentSessionServices builds + reloads the

package/dist/core/runtime/fault.js

@@ -1,3 +1,4 @@
+import { envNodeId } from '../../shared/env.js';
 import { existsSync, mkdirSync, readFileSync, rmSync, writeFileSync } from 'node:fs';
 import { join } from 'node:path';
 import { jobDir } from '../canvas/paths.js';
@@ -140,7 +141,7 @@ export function recordFault(nodeId, input) {
     updateMarker(nodeId, fault);
 }
 export function recordFaultForCurrentNode(input) {
-    const nodeId = process.env['CRTR_NODE_ID'];
+    const nodeId = envNodeId();
     if (nodeId === undefined || nodeId.trim() === '')
         return false;
     if (!existsSync(jobDir(nodeId)))
@@ -186,7 +187,7 @@ export function clearFault(nodeId, opts) {
     }
 }
 export function clearFaultForCurrentNode(opts) {
-    const nodeId = process.env['CRTR_NODE_ID'];
+    const nodeId = envNodeId();
     if (nodeId === undefined || nodeId.trim() === '')
         return false;
     if (!existsSync(jobDir(nodeId)))

package/dist/core/runtime/headless-pi.js

@@ -3,6 +3,7 @@
 // Each call uses crouter's credential pool and route policy, an in-memory session,
 // and only the inline provider-rotation extension. No conversation resources or
 // canvas lifecycle hooks enter the helper session.
+import { envNodeCwd, envProfileId } from '../../shared/env.js';
 import { join } from 'node:path';
 import { PoolCredentialStore } from '../pool-credential-store.js';
 import { modelRequestFromConfig, selectInitialModelRoute } from '../model-routes.js';
@@ -55,8 +56,8 @@ async function runHeadless(request, fallback, collect) {
             ]);
             if (timedOut)
                 return fallback;
-            const nodeCwd = process.env['CRTR_NODE_CWD'] ?? process.cwd();
-            const profileId = process.env['CRTR_PROFILE_ID'];
+            const nodeCwd = envNodeCwd() ?? process.cwd();
+            const profileId = envProfileId();
             const agentDir = sdk.getAgentDir();
             const modelRuntime = await sdk.ModelRuntime.create({
                 credentials: new PoolCredentialStore(join(agentDir, 'auth.json')),

package/dist/core/runtime/host.js

@@ -25,12 +25,11 @@ import { assertMandatoryCanvasExtensions } from './canvas-extensions.js';
 import { boundFleet } from './fleet.js';
 import { emitEvent } from '../events/emit.js';
 import { bindBrokerEventSource, eventSource } from '../events/source.js';
-// ---------------------------------------------------------------------------
+import { envBrokerEngine } from '../../shared/env.js';
 // HeadlessBrokerHost (design §3.3): a detached broker PROCESS, no tmux pane. It
 // boots the dedicated broker-cli entry directly (NEVER src/cli.ts), supervises
 // via the broker pid recorded as pi_pid, and tears down over the node's unix
 // socket (graceful `shutdown` frame, SIGTERM fallback).
-// ---------------------------------------------------------------------------
 /** Resolve the broker entry beside this module. A broker must run from the
  *  same generation as the crtrd launching it, so module-relative resolution
  *  preserves that invariant. */
@@ -48,7 +47,7 @@ const DEFAULT_BROKER_ENGINE = '@earendil-works/pi-coding-agent';
  *  why: the default-deny allowlist in spawn-env.ts strips `CRTR_*` from
  *  ambient env, so the child can no longer re-derive this itself). */
 function resolveEngineSpec(inv) {
-    return inv.env['CRTR_BROKER_ENGINE'] ?? process.env['CRTR_BROKER_ENGINE'] ?? DEFAULT_BROKER_ENGINE;
+    return inv.env['CRTR_BROKER_ENGINE'] ?? envBrokerEngine();
 }
 function isPlainLaunchSessionPath(token) {
     return token.includes('/') || token.endsWith('.jsonl');

package/dist/core/runtime/kickoff.js

@@ -30,10 +30,8 @@ import { formatCard } from '../../shared/generated-context.js';
 /** The runtime-restart continuation exactly as delivered. `revive.ts` injects
  *  it as the prompt of a strict resume that follows a cleanly aborted turn. */
 export const RUNTIME_RESTART_CONTINUATION = formatCard('restart-continuation', {}, 'continue');
-// ---------------------------------------------------------------------------
 // Companion context files: the goal (the spawning mandate) and the one-shot
 // yield message (a note from the prior self to the revived self).
-// ---------------------------------------------------------------------------
 /** The goal file — the prompt/task a node was spawned with, persisted at birth
  *  so a fresh revive can re-read its mandate. */
 export function goalPath(nodeId) {
@@ -230,9 +228,7 @@ function backgroundJobsBlock(nodeId) {
     lines.push('', 'Read output so far: `tail -n 50 <log>` (or `crtr node bash list --tail 20`). Abandon one: `crtr node bash kill <job-id>`.');
     return `<background-jobs>\n${lines.join('\n')}\n</background-jobs>`;
 }
-// ---------------------------------------------------------------------------
 // buildReviveKickoff — assemble the full fresh-revive first message.
-// ---------------------------------------------------------------------------
 /** Assemble the auto-injected first message for a FRESH revive of `meta` from its
  *  already-drained `bearings` (see drainBearings) plus pure on-disk reads of the
  *  node's goal, roadmap, and context dir, framed so the revived node can rebuild

package/dist/core/runtime/launch-target.js

@@ -1,3 +1,4 @@
+import { envProfileId } from '../../shared/env.js';
 import { resolve } from 'node:path';
 import { getNode } from '../canvas/canvas.js';
 import { usage } from '../errors.js';
@@ -10,7 +11,7 @@ export function resolveCreateKind(kind, profile) {
 /** Validate a kind against the same cwd/profile configuration used to build its launch.
  *  Resolution is subprocess-isolated: crtrd is single-threaded and a config read can
  *  block indefinitely on a network filesystem. */
-export async function assertLaunchKind(kind, cwd = process.cwd(), profileId = process.env['CRTR_PROFILE_ID'] || null) {
+export async function assertLaunchKind(kind, cwd = process.cwd(), profileId = envProfileId() || null) {
     const kinds = Object.keys((await readMergedLaunchConfigAsync(cwd, profileId)).kinds);
     if (!kinds.includes(kind)) {
         throw usage(`unknown kind: ${kind}`, { received: kind, next: `Valid kinds: ${kinds.sort().join(', ')}.` });

package/dist/core/runtime/launch.d.ts

@@ -15,8 +15,8 @@ export type { PortableModelSelection } from './model-selection.js';
  *  stays unpinned. */
 export declare function isProviderPinnedModelToken(model: string): boolean;
 /** True when `model` is a PORTABLE ladder token — a bare strength/alias
- *  (`ultra`, `normal`, `opus`, …) or a `anthropic|openai / strength` pair —
- *  i.e. a form `normalizeModel` resolves through the ladders rather than
+ *  (`ultra`, `normal`, `opus`, …), an `anthropic|openai / strength` pair, or
+ *  an anthropic family alias — i.e. a form `normalizeModel` resolves through the ladders rather than
  *  passing through as a concrete id. Portable tokens are safe to PERSIST as
  *  defaults (`persistDefaultKindModel`): they re-resolve against whatever
  *  ladder the running build ships, so they never freeze a stale concrete

package/dist/core/runtime/launch.js

@@ -8,6 +8,7 @@
 // fresh cycle as a new branch rather than starting a new file.
 // The spec is rewritten on every polymorph (base→orchestrator) so a node
 // always comes back as its *current* self.
+import { envProfileId } from '../../shared/env.js';
 import { mkdirSync, writeFileSync } from 'node:fs';
 import { join } from 'node:path';
 import { readMergedLaunchConfig } from '../config.js';
@@ -25,7 +26,6 @@ import { modelLadders, defaultProvider, STRENGTH_ALIASES, MODEL_PROVIDER_KEYS, M
 // file's openDb-reaching graph. Re-exported here so existing importers of these
 // launch.ts symbols keep working.
 export { OPENAI_PROVIDER_ENV, configuredLadderProviders, inferPortableModelSelection } from './model-selection.js';
-// ---------------------------------------------------------------------------
 // Two-axis model resolution: (provider × strength) → concrete `model:thinking`.
 //
 // A persona declares ONE `model:` field valued `provider/strength` (e.g.
@@ -36,7 +36,6 @@ export { OPENAI_PROVIDER_ENV, configuredLadderProviders, inferPortableModelSelec
 // pi accepts the `:thinking` suffix on `--model` (off,minimal,low,medium,high,
 // xhigh — confirmed via `pi --help`), so the resolved spec is exactly the
 // string buildPiArgv passes to `--model`; no extra launch plumbing.
-// ---------------------------------------------------------------------------
 /** Model-ladder resolution goes through `readMergedLaunchConfig` — the SAME
  *  project-stack > profile > user > builtin precedence `resolveKindConfig`
  *  already uses for `kinds` — so a project/profile override of `modelLadders`
@@ -86,10 +85,14 @@ function findLadderCell(normalized, ladders, providers) {
  *      strong/medium/light, ALWAYS anthropic (ignores the env/config default).
  *   4. Anything else → pass through unchanged. */
 function modelTokenStrength(model) {
-    const rest = model.includes('/') ? model.slice(model.indexOf('/') + 1) : model;
+    const slash = model.indexOf('/');
+    const provider = slash === -1 ? undefined : model.slice(0, slash);
+    const rest = slash === -1 ? model : model.slice(slash + 1);
     const strength = STRENGTH_ALIASES[rest];
     if (strength !== undefined)
         return strength;
+    if (provider !== undefined && provider !== 'anthropic')
+        return null;
     if (rest === 'opus')
         return 'strong';
     if (rest === 'sonnet')
@@ -134,8 +137,8 @@ export function isProviderPinnedModelToken(model) {
     return model.includes('/') && !isPortableModelToken(model);
 }
 /** True when `model` is a PORTABLE ladder token — a bare strength/alias
- *  (`ultra`, `normal`, `opus`, …) or a `anthropic|openai / strength` pair —
- *  i.e. a form `normalizeModel` resolves through the ladders rather than
+ *  (`ultra`, `normal`, `opus`, …), an `anthropic|openai / strength` pair, or
+ *  an anthropic family alias — i.e. a form `normalizeModel` resolves through the ladders rather than
  *  passing through as a concrete id. Portable tokens are safe to PERSIST as
  *  defaults (`persistDefaultKindModel`): they re-resolve against whatever
  *  ladder the running build ships, so they never freeze a stale concrete
@@ -145,7 +148,8 @@ export function isPortableModelToken(model) {
         const slash = model.indexOf('/');
         const provider = model.slice(0, slash);
         const rest = model.slice(slash + 1);
-        return (provider === 'anthropic' || provider === 'openai') && STRENGTH_ALIASES[rest] !== undefined;
+        return (provider === 'anthropic' || provider === 'openai') && (STRENGTH_ALIASES[rest] !== undefined
+            || (provider === 'anthropic' && (rest === 'opus' || rest === 'sonnet' || rest === 'haiku')));
     }
     return STRENGTH_ALIASES[model] !== undefined || model === 'opus' || model === 'sonnet' || model === 'haiku';
 }
@@ -169,6 +173,14 @@ export function normalizeModel(model, ladders = modelLadders()) {
         if (strength !== undefined && (provider === 'anthropic' || provider === 'openai')) {
             return ladderFor(provider, ladders)[strength];
         }
+        if (provider === 'anthropic') {
+            if (rest === 'opus')
+                return ladders.anthropic.strong;
+            if (rest === 'sonnet')
+                return ladders.anthropic.medium;
+            if (rest === 'haiku')
+                return ladders.anthropic.light;
+        }
         // Concrete `provider/id` (optionally `...:thinking`) — pass through.
         return model;
     }
@@ -258,7 +270,7 @@ function buildLaunchSpecFromMerged(kind, mode, opts, merged) {
 }
 /** Build a launch recipe for callers that are not on crtrd's event loop. */
 export function buildLaunchSpec(kind, mode, opts) {
-    return buildLaunchSpecFromMerged(kind, mode, opts, readMergedLaunchConfig(opts.cwd ?? process.cwd(), opts.profileId !== undefined ? opts.profileId : (process.env['CRTR_PROFILE_ID'] || null)));
+    return buildLaunchSpecFromMerged(kind, mode, opts, readMergedLaunchConfig(opts.cwd ?? process.cwd(), opts.profileId !== undefined ? opts.profileId : (envProfileId() || null)));
 }
 /**
  * Resolve launch config in a bounded subprocess before building a recipe.
@@ -268,7 +280,7 @@ export function buildLaunchSpec(kind, mode, opts) {
  */
 export async function buildLaunchSpecAsync(kind, mode, opts) {
     const cwd = opts.cwd ?? process.cwd();
-    const profileId = opts.profileId !== undefined ? opts.profileId : (process.env['CRTR_PROFILE_ID'] || null);
+    const profileId = opts.profileId !== undefined ? opts.profileId : (envProfileId() || null);
     const merged = await readMergedLaunchConfigAsync(cwd, profileId);
     return buildLaunchSpecFromMerged(kind, mode, opts, merged);
 }
@@ -308,9 +320,7 @@ export function readMergedLaunchConfigAsync(cwd, profileId) {
         });
     });
 }
-// ---------------------------------------------------------------------------
 // Build the pi argv to launch / revive a node
-// ---------------------------------------------------------------------------
 /** Persist a node's (possibly large) system prompt to a file in its node dir and
  *  return the absolute path, so callers can pass a short path to pi instead of
  *  the inline text. Returns null if the write fails — the caller then falls back

package/dist/core/runtime/lifecycle.js

@@ -25,11 +25,13 @@
 // `cancel`.
 //
 // Layering note: lifecycle.ts is runtime, but it is the canvas write surface's
-// `transition` verb (the only writer of status+intent), so it owns its atomic
-// row UPDATE directly via openDb — the one sanctioned exception to "only
-// canvas.ts touches the db" (see src/core/canvas/.crouter/memory/INDEX.md),
-// exactly as db.ts's backfill is the sanctioned exception for a data migration.
-import { openDb, getNode, cancelCronsOnWake } from '../canvas/index.js';
+// `transition` verb (the only writer of status+intent), so it drives the
+// atomic status+intent write through canvas.ts's `transitionStatusIntent`
+// (its own decision logic — the legality table below, and the
+// unknown-node/illegal-move/already-finalized-cancel branching — stays here;
+// only the raw conditional UPDATE lives in canvas.ts, keeping every `.prepare(`
+// inside `core/canvas/`).
+import { getNode, cancelCronsOnWake, transitionStatusIntent } from '../canvas/index.js';
 const ANY = '*';
 /** The supervised statuses — a live node the daemon watches. */
 const LIVE = ['active', 'idle'];
@@ -71,28 +73,17 @@ export function transition(nodeId, event) {
     const spec = TRANSITIONS[event];
     const writeStatus = Object.prototype.hasOwnProperty.call(spec, 'status');
     const writeIntent = Object.prototype.hasOwnProperty.call(spec, 'intent');
-    const assignments = [];
-    const values = [];
-    if (writeStatus) {
-        assignments.push('status = ?');
-        values.push(spec.status ?? null);
-    }
-    if (writeIntent) {
-        assignments.push('intent = ?');
-        values.push(spec.intent ?? null);
-    }
-    const predicates = ['node_id = ?'];
-    values.push(nodeId);
-    if (spec.from !== ANY) {
-        predicates.push(`status IN (${spec.from.map(() => '?').join(', ')})`);
-        values.push(...spec.from);
-    }
+    const fields = {};
+    if (writeStatus)
+        fields.status = spec.status;
+    if (writeIntent)
+        fields.intent = spec.intent ?? null;
     // A committed canonical result is protected from a concurrent close.
-    if (event === 'cancel')
-        predicates.push('final_report IS NULL');
-    const db = openDb();
-    const result = db.prepare(`UPDATE nodes SET ${assignments.join(', ')} WHERE ${predicates.join(' AND ')}`).run(...values);
-    if (result.changes === 0) {
+    const changes = transitionStatusIntent(nodeId, fields, {
+        fromStatuses: spec.from === ANY ? undefined : spec.from,
+        requireNoFinalReport: event === 'cancel',
+    });
+    if (changes === 0) {
         const cur = getNode(nodeId);
         if (cur === null)
             throw new Error(`transition: unknown node ${nodeId}`);

package/dist/core/runtime/managed-provider-cooling.d.ts

@@ -1,4 +1,4 @@
-import type { AssistantMessageDiagnostic } from "@earendil-works/pi-ai";
+import type { AssistantMessageDiagnostic } from '@earendil-works/pi-ai';
 /** Diagnostic `type` tag carrying the cooling deadline; also the wire contract the
  *  stophook matches on. */
 export declare const MANAGED_PROVIDER_COOLING_DIAGNOSTIC = "crtr:managed-provider-cooling";

package/dist/core/runtime/naming.js

@@ -217,10 +217,8 @@ export async function headlessName(body, sourceCap = PROMPT_CAP) {
 export function headlessNameFromConversation(conversation) {
     return headlessName(conversation, 30_000);
 }
-// ---------------------------------------------------------------------------
 // Issue titles — turn a free-text todo/idea/bug note into a short, human-readable
 // GitHub-issue title (sentence case, NOT kebab). Used by `crtr canvas issue new`.
-// ---------------------------------------------------------------------------
 const TITLE_SYSTEM_PROMPT = 'You write GitHub issue titles. Given a free-text note (a todo, idea, or bug ' +
     'report), reply with ONLY a concise issue title: sentence case, 4-10 words, no ' +
     'trailing period, no quotes, no prefix like "Bug:" or "Idea:", no markdown. ' +

package/dist/core/runtime/nodes.js

@@ -12,6 +12,7 @@
 //             learns when the work finishes — this seeds the subscription
 //             graph to mirror the spawn structure. A `spawned_by` audit edge
 //             is also recorded.
+import { envHomeOverride } from '../../shared/env.js';
 import { randomBytes } from 'node:crypto';
 import { mkdirSync } from 'node:fs';
 import { createNode, getNode, getRow, subscribe, recordSpawn, contextDir, } from '../canvas/index.js';
@@ -200,7 +201,7 @@ export function nodeEnv(meta) {
     if (meta.parent)
         env['CRTR_PARENT_NODE_ID'] = meta.parent;
     // Propagate an explicit canvas home so children share the same canvas.
-    const home = process.env['CRTR_HOME'];
+    const home = envHomeOverride();
     if (home !== undefined && home !== '')
         env['CRTR_HOME'] = home;
     // Propagate the subtree-root node id. The broker uses it to group a subtree;

package/dist/core/runtime/persona.js

@@ -4,9 +4,7 @@
 import { getNode, updateNode } from '../canvas/index.js';
 import { readRoadmap, roadmapPath } from './roadmap.js';
 import { orchestratorContextNote } from './bearings.js';
-// ---------------------------------------------------------------------------
 // Base → orchestrator guidance
-// ---------------------------------------------------------------------------
 /** Fresh-context framing for a base → orchestrator change. */
 function orchestrationGuidance(nodeId, kind) {
     const roadmap = readRoadmap(nodeId) ?? '(no roadmap yet)';
@@ -18,9 +16,7 @@ function orchestrationGuidance(nodeId, kind) {
     parts.push('', `Your roadmap scaffold (\`${rmPath}\`) — author it now: state the goal, exit criteria, and the phase skeleton, using your orchestration protocol. Current contents:`, '', roadmap, '', orchestratorContextNote(nodeId), '', 'Your three long-term memory scopes (user-global, project, node-local) already surface in your bearings at boot. What promotion changes is USE, not access: you now persist across refresh cycles, so node-local carries what THIS goal needs between your refreshes, and durable facts you commit to user-global or project outlive this node. Use `crtr memory write` to save a document; `crtr memory list` to browse; `crtr memory find` to search (see "Your long-term memory" above for the full substrate flow).', '', 'Then delegate each phase with `crtr node new --kind <kind>`. When your context fills, run `crtr node yield` to refresh against this roadmap.');
     return parts.join('\n');
 }
-// ---------------------------------------------------------------------------
 // Orchestrator → base guidance
-// ---------------------------------------------------------------------------
 /** orchestrator → base (demote): hands-on again, finish in-window. */
 function baseModeGuidance() {
     return ('You are HANDS-ON again — base mode. Do the work yourself in THIS window and finish it here; ' +
@@ -36,9 +32,7 @@ export function transitionGuidance(nodeId, from, to) {
     const node = getNode(nodeId);
     return orchestrationGuidance(nodeId, node?.kind ?? 'general');
 }
-// ---------------------------------------------------------------------------
 // Detector + ack commit.
-// ---------------------------------------------------------------------------
 /** Compare the live persona with the last acknowledged context delivery.
  * `guidance` contains only fresh-context framing; current snapshots supply its
  * documents. An absent or pre-kind acknowledgment cannot fabricate drift. */

package/dist/core/runtime/placement-tmux.js

@@ -15,19 +15,16 @@
 // §5.1 import-lint: placement-tmux.ts is an allowed direct importer of
 // tmux-driver.ts — it is the sanctioned pure-tmux seam, re-exporting the driver
 // verbs other modules need so they never import the driver directly.
+import { envHomeOverride } from '../../shared/env.js';
 import { paneLocation, ensureSession, openNodeWindow, splitWindow, selectLayout, } from './tmux-driver.js';
 import { BROKER_VIEW_SOCKET_WAIT_MS } from './view-socket.js';
 // Re-export the pure tmux driver verbs the CLI/viewer consumers need without
 // exposing the canvas focuses table or sending command modules to the raw driver.
 export { paneExists, paneLocation, paneOfNode, paneCurrentPath, paneSize, paneRunning, ensureSession, openNodeWindow, splitWindow, closePane, currentTmux, switchClient, selectWindow, selectLayout, selectPane, getPaneOption, setPaneOption, breakPane, inTmux, piCommand, shellQuote, renameWindow, displayPopup, windowOfPane, respawnPaneSync, respawnPaneInBackground, respawnPaneInPlace, paneStartCommand, panePid, windowAlive, listLivePanes, VIEWER_STAMP_OPTION, stampViewerPaneAsync, liveViewerPanes, sendAttachControl, displayClientMessage, } from './tmux-driver.js';
 export { installTmuxBindings } from './tmux-bindings.js';
-// ---------------------------------------------------------------------------
 // view.sock readiness — the one shared broker-cold-start primitive
-// ---------------------------------------------------------------------------
 export { BROKER_VIEW_SOCKET_WAIT_MS, waitForBrokerViewSocket } from './view-socket.js';
-// ---------------------------------------------------------------------------
 // Viewer pane opener (tmux half, NO focus-row write)
-// ---------------------------------------------------------------------------
 /** Env for a `crtr surface attach` VIEWER pane (the focus split, the spawn viewer
  *  window, AND recycle's re-attach respawn): propagate CRTR_HOME so the viewer
  *  resolves the SAME canvas home — and thus the right view.sock — under a
@@ -35,7 +32,7 @@ export { BROKER_VIEW_SOCKET_WAIT_MS, waitForBrokerViewSocket } from './view-sock
  *  server env, like every other crtr chrome pane). One helper so the viewer-pane
  *  sites can't drift. */
 export function viewerSplitEnv() {
-    const crtrHome = process.env['CRTR_HOME'];
+    const crtrHome = envHomeOverride();
     return crtrHome !== undefined ? { CRTR_HOME: crtrHome } : {};
 }
 /** Open a `crtr surface attach` VIEWER pane for `nodeId` — the PURE tmux half of

package/dist/core/runtime/placement.js

@@ -22,8 +22,9 @@
 //   • The chrome/viewer tmux re-exports (§2.1): placement stays the sanctioned
 //     model-over-driver. Raw driver access is confined to placement, its pure
 //     tmux half, the bindings owner, and tmux chrome.
+import { envNodeId } from '../../shared/env.js';
 import { getNode, fullName, deleteNode, listNodes, openFocusRow, closeFocusRow, getFocusByNode, getFocusByPane, getFocusById, listFocuses as listFocusRows, } from '../canvas/index.js';
-import { nodeHasAssistantMessage, isNodeStreaming } from '../canvas/render.js';
+import { nodeHasAssistantMessage, isStreaming } from '../canvas/render-source.js';
 import { headlessBrokerHost } from './host.js';
 import { paneExists, paneLocation, closePane, currentTmux, switchClient, selectWindow, selectLayout, selectPane, getPaneOption, setPaneOption, respawnPaneSync, windowOfPane, renameWindow, } from './tmux-driver.js';
 // The PURE tmux + broker-socket half now lives in placement-tmux.ts. placement
@@ -47,7 +48,6 @@ import { isPidAlive } from '../canvas/pid.js';
 // tmux-driver.ts directly.
 export { splitWindow, breakPane, selectLayout, selectPane, focusWindow, selectWindow, switchClient, openNodeWindow, ensureSession, paneLocation, paneExists, paneRunning, paneCurrentPath, currentTmux, inTmux, paneOfNode, setPaneOption, getPaneOption, piCommand, shellQuote, respawnPaneSync, closePane, displayPopup, windowOfPane, renameWindow, paneOfWindow, windowAlive, listLivePanes, } from './tmux-driver.js';
 export { installTmuxBindings } from './tmux-bindings.js';
-// ---------------------------------------------------------------------------
 // Viewer registry reads — COMPOSE over the canvas focuses table (§2.3/§4).
 //
 // placement is the front door for "which nodes have a viewer on screen"; the SQL
@@ -57,7 +57,6 @@ export { installTmuxBindings } from './tmux-bindings.js';
 // GC is lazy on read: a row whose viewer pane no longer exists (the user closed
 // the window, the attach client died) is pruned the next time it is read, so the
 // registry self-heals without a sweeper.
-// ---------------------------------------------------------------------------
 /** Prune a viewer row whose pane is gone; return it iff its pane is still live. */
 function liveOrPrune(f) {
     if (f === null)
@@ -131,9 +130,7 @@ export function openViewerWindow(nodeId, session, opts = {}) {
         return null;
     return registerViewerFocus(nodeId, opened.pane, opened.session, opened.window);
 }
-// ---------------------------------------------------------------------------
 // focus — the front door for `surface node focus` / `surface node cycle` / nav (§A.4)
-// ---------------------------------------------------------------------------
 /** Bring a node's ONE viewer pane forefront (§A.4). Every node is a detached
  *  broker, so there is no engine pane to swap into the caller's viewport — focus
  *  instead ensures the node's single surface-attach viewer is on screen beside (or
@@ -283,9 +280,7 @@ export async function focus(nodeId, opts) {
         surfaceNewPane(opened.pane);
     return { focused: true, session: opened.session, inPlace: false, revived };
 }
-// ---------------------------------------------------------------------------
 // Teardown / detach — close a node's viewer pane + row
-// ---------------------------------------------------------------------------
 /** Tear a node off its viewer (close/reset/cancel teardown). The broker engine
  *  is killed by its own host teardown over view.sock — this only closes the
  *  on-screen viewer: kill its pane (the window collapses once its last pane goes)
@@ -326,9 +321,7 @@ export function detachToBackground(nodeId, pane) {
     reapIfEmpty(nodeId);
     return closed;
 }
-// ---------------------------------------------------------------------------
 // Reaping empty nodes (no AI output) on close / detach
-// ---------------------------------------------------------------------------
 /** Is this node an EMPTY SHELL right now — a node whose engine never produced an
  *  assistant message? Such nodes are pure dead weight on the graph. A node
  *  actively generating its FIRST turn is NOT empty (its output just hasn't landed
@@ -337,7 +330,7 @@ function isEmptyNode(nodeId) {
     const m = getNode(nodeId);
     if (m === null)
         return false;
-    if (isNodeStreaming(nodeId))
+    if (isStreaming(nodeId, getNode(nodeId)?.pi_pid ?? null))
         return false;
     return !nodeHasAssistantMessage(m.pi_session_file);
 }
@@ -366,7 +359,7 @@ export function reapIfEmpty(nodeId, keepPane) {
  *  deleting. Returns the reaped (or, under dryRun, reapable) node ids. */
 export function reapEmptyNodes(opts = {}) {
     const dryRun = opts.dryRun ?? false;
-    const selfId = process.env['CRTR_NODE_ID'] ?? '';
+    const selfId = envNodeId() ?? '';
     const reaped = [];
     for (const row of listNodes()) {
         const id = row.node_id;

package/dist/core/runtime/recap.js

@@ -11,6 +11,7 @@
 // there is no local fallback, unlike naming, because a wrong recap is worse than
 // none.
 import { headlessText } from './headless-pi.js';
+import { envRecapModelOverride } from '../../shared/env.js';
 /** Wall-clock budget for the headless pi call before we give up (no recap). */
 const RECAP_TIMEOUT_MS = 25_000;
 /** Fallback model when the live session has not resolved one yet. Ordinarily the
@@ -59,9 +60,9 @@ function recapUserPrompt(conversation, roadmap) {
 /** Model precedence is explicit env override → the conversation's live
  *  working model → the small fallback. */
 function recapModel(liveModel) {
-    const override = process.env['CRTR_RECAP_MODEL'];
-    if (override !== undefined && override.trim() !== '')
-        return override.trim();
+    const override = envRecapModelOverride();
+    if (override !== undefined)
+        return override;
     if (liveModel !== undefined && liveModel.trim() !== '')
         return liveModel.trim();
     return DEFAULT_RECAP_MODEL;