@north-light/crouter 0.3.234 → 0.3.235

package/dist/core/runtime/stop-guard.js

@@ -17,8 +17,10 @@
 //   • finished/asked → it pushed --final (done) or called `crtr ask` this turn.
 //                      Also fine.
 //   • structured     → a TERMINAL node has a pending structured-output request.
-//                      Valid requests reprompt with the schema; invalid requests
-//                      reprompt with an error and require manual cleanup.
+//                      A valid request reprompts with the schema unless the node
+//                      also holds a wake source, which it may sleep on first;
+//                      an invalid request reprompts with an error and requires
+//                      manual cleanup.
 //   • otherwise      → a TERMINAL node with nothing live to wait for and no
 //                      final pushed. Re-prompt it to finish or escalate.
 import { hasActiveLiveSubscription, hasLiveMessageWait, hasPendingCancelOnWakeCron, getNode, contextDir } from '../canvas/index.js';
@@ -39,6 +41,19 @@ function formatInvalidStructuredOutputReprompt(error) {
         `After resolving the file, retry the submission. ` +
         `If this is unexpected, escalate to the user using \`crtr human send\`.`);
 }
+/** The wake sources that legitimize a terminal node's dormancy: a pending
+ * cancel-on-wake deadline, an active subscription to a live publisher, an
+ * explicit live controller wait, or a live background bash job whose completion
+ * sends an inbox message. Parentage alone is deliberately absent. */
+function wakeCapableWait(nodeId, backgroundJobsRunning) {
+    if (hasPendingCancelOnWakeCron(nodeId))
+        return 'scheduled';
+    if (hasActiveLiveSubscription(nodeId)
+        || hasLiveMessageWait(nodeId)
+        || backgroundJobsRunning)
+        return 'awaiting';
+    return null;
+}
 /** Decide what to do when a node stops. crtrd supplies every current-canvas
  * fact; the broker contributes only whether its Pi-owned background job registry
  * is still running work. */
@@ -49,9 +64,14 @@ export function evaluateStop(nodeId, signals, backgroundJobsRunning = activeBack
         return { action: 'allow', reason: 'escalated' };
     // A pending structured-output request overrides every stored-state dormancy
     // path: a post-final one-off follow-up still owes `submit` before it may stop.
-    // Invalid requests surface an explicit error and require manual cleanup.
+    // A wake source is the exception — the request outlives the sleep, so
+    // reprompting instead would busy-wait the node against its own child, deadline,
+    // or job. Invalid requests surface an explicit error and require manual cleanup.
     const outputState = readOutputRequest(nodeId);
     if (outputState.state === 'valid') {
+        const pendingWait = wakeCapableWait(nodeId, backgroundJobsRunning);
+        if (pendingWait !== null)
+            return { action: 'allow', reason: pendingWait };
         return {
             action: 'reprompt',
             reason: 'stalled',
@@ -82,19 +102,11 @@ export function evaluateStop(nodeId, signals, backgroundJobsRunning = activeBack
     if (node !== null && node.lifecycle === 'resident') {
         return { action: 'allow', reason: 'dormant' };
     }
-    // A terminal node with a pending cancel-on-wake deadline is legitimately
-    // waiting on the clock, so it should idle-release rather than busy-wait
-    // holding its broker.
-    if (hasPendingCancelOnWakeCron(nodeId))
-        return { action: 'allow', reason: 'scheduled' };
-    // A terminal node holding something live to wake it is legitimately awaiting.
-    // Parentage alone is deliberately absent: only an active subscription, an
-    // explicit controller wait, or a live background bash job whose completion
-    // sends an inbox message can suppress the stall guard.
-    if (hasActiveLiveSubscription(nodeId)
-        || hasLiveMessageWait(nodeId)
-        || backgroundJobsRunning)
-        return { action: 'allow', reason: 'awaiting' };
+    // A terminal node holding a wake source is legitimately waiting: it should
+    // idle-release rather than busy-wait holding its broker.
+    const pendingWait = wakeCapableWait(nodeId, backgroundJobsRunning);
+    if (pendingWait !== null)
+        return { action: 'allow', reason: pendingWait };
     // A terminal node with nothing live and no final pushed has stalled.
     return {
         action: 'reprompt',

package/dist/core/substrate/frontmatter-validation.d.ts

@@ -1,4 +1,5 @@
 import { type SurfaceEntry } from './schema.js';
+export declare const SUPPRESSIBLE_RULES: readonly string[];
 /** Strict validation of one raw routing entry. Runtime parsing deliberately
  * tolerates malformed docs; this authoring/preflight contract does not. */
 export declare function lintSubstrateSurfaces(value: unknown): string | null;

package/dist/core/substrate/frontmatter-validation.js

@@ -1,7 +1,7 @@
 import { isDocKind, parseSubstrateFrontmatter, SURFACE_EVENTS, SURFACE_RUNGS } from './schema.js';
 const RETIRED_FIELDS = ['system-prompt-visibility', 'file-read-visibility', 'applies-to', 'read-when'];
 const SURFACE_ENTRY_KEYS = ['on', 'match', 'match-frontmatter', 'gate', 'at'];
-const SUPPRESSIBLE_RULES = ['length', 'broad-memory-read'];
+export const SUPPRESSIBLE_RULES = ['length', 'broad-memory-read'];
 /** Strict validation of one raw routing entry. Runtime parsing deliberately
  * tolerates malformed docs; this authoring/preflight contract does not. */
 export function lintSubstrateSurfaces(value) {

package/dist/daemon/api/__tests__/error-seam.test.js

@@ -1,9 +1,13 @@
 import assert from 'node:assert/strict';
 import { test } from 'node:test';
+import { mkdtempSync, rmSync } from 'node:fs';
+import { tmpdir } from 'node:os';
+import { join } from 'node:path';
 import { toErrorBody } from '../map.js';
 import { ApiError } from '../../../api/errors.js';
 import { apiErrorToCliError, InputError } from '../../../core/io.js';
 import { brokerLaunchFailed } from '../../../core/errors.js';
+import { createManagedWorktree } from '../../../core/worktree.js';
 // Regression for crouter#521: choosing the root profile on a virgin machine
 // died with a bare `<error code="internal">\ninternal error` and ZERO cause —
 // the front-door `createNode({root:true})` boot failure was thrown as a plain
@@ -41,6 +45,29 @@ test('an unanticipated 500 surfaces its cause instead of a causeless "internal e
     // ...and the next-hint is the crtr-bug guidance, not "adjust the call".
     assert.match(cli.payload.next, /crtr bug/);
 });
+// Regression for crouter#811: a `crtr node new --worktree` against a cwd that is
+// not inside a git repository reached the caller as `500 internal`, hiding the
+// domain error the worktree layer already raised for exactly that input.
+test('a non-git cwd round-trips the worktree layer\'s own code + next-hint, never a 500', () => {
+    const outside = mkdtempSync(join(tmpdir(), 'crtr-nongit-'));
+    try {
+        let thrown;
+        try {
+            createManagedWorktree(outside, 'node-that-needs-a-repo');
+        }
+        catch (err) {
+            thrown = err;
+        }
+        assert.ok(thrown !== undefined, 'a worktree create outside a repository must fail');
+        assert.equal(toErrorBody(thrown).status, 400);
+        const cli = roundTrip(thrown);
+        assert.equal(cli.payload.error, 'not_git_repo');
+        assert.match(cli.payload.next, /--cwd/);
+    }
+    finally {
+        rmSync(outside, { recursive: true, force: true });
+    }
+});
 test('a 500 body carries only the bounded first line, never a multi-line stack', () => {
     const withStack = new Error('top cause of the failure');
     withStack.stack = 'Error: top cause of the failure\n    at foo (bar.js:1:1)\n    at baz (qux.js:2:2)';

package/dist/daemon/api/handlers/messages.js

@@ -309,18 +309,18 @@ async function handleMessage(ctx) {
     // nothing will ever bring back on its own, and a deferred entry appended to it
     // would wait forever. Reopen widens the WAKE-CAPABLE tiers to a finalized
     // target; deferred stays rejected, and the rejection names those tiers.
-    let entry;
-    if (tier === 'deferred') {
-        const outcome = withFreshTerminalGuard(id, hasNoNaturalCycle, deliverImmediate);
-        if (outcome.kind === 'missing')
-            throw notFound(`unknown node: ${id}`, { received: id });
-        if (outcome.kind === 'terminal')
-            throw deferredNoNaturalCycle(id, outcome.status);
-        entry = outcome.result;
-    }
-    else {
-        entry = deliverImmediate();
-    }
+    const deliver = () => {
+        if (tier === 'deferred') {
+            const outcome = withFreshTerminalGuard(id, hasNoNaturalCycle, deliverImmediate);
+            if (outcome.kind === 'missing')
+                throw notFound(`unknown node: ${id}`, { received: id });
+            if (outcome.kind === 'terminal')
+                throw deferredNoNaturalCycle(id, outcome.status);
+            return outcome.result;
+        }
+        return deliverImmediate();
+    };
+    const entry = deliver();
     // A wake-capable tier revives a dormant target so its inbox-watcher delivers
     // this; deferred never wakes — it rides the target's next natural cycle.
     let revived = false;

package/dist/daemon/api/handlers/nodes.js

@@ -32,6 +32,8 @@ import { renameWindow } from '../../../core/runtime/placement.js';
 import { buildLaunchSpecAsync, isProviderPinnedModelToken, normalizeModel, readMergedLaunchConfigAsync } from '../../../core/runtime/launch.js';
 import { modelRequestFromConfig } from '../../../core/model-routes.js';
 import { BrokerUnreachableError } from '../../../core/runtime/broker-request.js';
+import { readFault } from '../../../core/runtime/fault.js';
+import { activeFaultForDisplay } from '../../../core/canvas/render-source.js';
 import { isBrokerLive, persistDormantModel, setModelLive } from '../../../core/runtime/model-swap.js';
 import { writeOutputSchema } from '../../../core/runtime/structured-output.js';
 import { claimWarmNode, refillWarmPool, warmPoolEnabled } from '../../../core/runtime/warm-pool.js';
@@ -62,7 +64,17 @@ function edgesFor(id) {
 }
 /** Re-read a node fresh and project its detail DTO (post-action response). */
 function detailOf(id) {
-    return toNodeDetailDTO(requireMeta(id), edgesFor(id));
+    const meta = requireMeta(id);
+    const fault = activeFaultForDisplay(meta, readFault(id));
+    return {
+        ...toNodeDetailDTO(meta, edgesFor(id)),
+        fault: fault === null ? null : {
+            link: fault.link,
+            kind: fault.kind,
+            retry: { disposition: fault.retry.disposition },
+            since: fault.since,
+        },
+    };
 }
 /** Count context + report files under a node (the context-roster `files`). */
 function countFiles(id) {

package/dist/daemon/api/handlers/worktree.js

@@ -8,32 +8,16 @@
 //
 // Error parity: `closeManagedWorktree` throws `WorktreeError` with a SPECIFIC
 // code (`dirty_worktree`, `rebase_failed`, `unknown_node`, `no_managed_worktree`,
-// …) plus a `next` remediation and an optional `detail`. We rethrow it as a
-// `CrtrError` carrying that exact code + `details.{next,received}`, which
-// survive `toErrorBody` — so the CLI leaf can reconstruct the original
-// agent-facing contract instead of collapsing to a generic status code.
-import { closeManagedWorktree, WorktreeError } from '../../../core/worktree.js';
-import { CrtrError } from '../../../core/errors.js';
-import { ExitCode } from '../../../types.js';
-function worktreeErrorToCrtrError(err) {
-    const exitCode = err.code === 'unknown_node' ? ExitCode.NOT_FOUND : ExitCode.GENERAL;
-    const details = { next: err.next };
-    if (err.detail !== undefined)
-        details['received'] = err.detail;
-    return new CrtrError(err.code, err.message, exitCode, details);
-}
+// …) plus a `next` remediation and an optional `detail`. The error map projects
+// all of that onto `CrtrError` for every route that can raise it — so the CLI
+// leaf can reconstruct the original agent-facing contract instead of collapsing
+// to a generic status code.
+import { closeManagedWorktree } from '../../../core/worktree.js';
 function handleWorktreeClose(ctx) {
     const id = ctx.params['id'];
     // No requireMeta: closeManagedWorktree already throws the precise
     // `unknown_node` / `no_managed_worktree` WorktreeError for a bad id.
-    try {
-        return { status: 200, body: closeManagedWorktree(id) };
-    }
-    catch (err) {
-        if (err instanceof WorktreeError)
-            throw worktreeErrorToCrtrError(err);
-        throw err;
-    }
+    return { status: 200, body: closeManagedWorktree(id) };
 }
 export const worktreeRoutes = [
     { method: 'POST', pattern: '/v1/nodes/:id/worktree/close', handler: handleWorktreeClose },

package/dist/daemon/api/map.d.ts

@@ -94,6 +94,8 @@ export declare const REVIEW_ERROR_MAP: Readonly<Record<ReviewErrorCode, {
  *     `finalization_forbidden`, or 404 `node_not_found`;
  *   - a `NodeIdConflictError` (a `--node-id`/`node_id` spawn at an id that
  *     already exists) → 409 `node_id_exists`;
+ *   - a `WorktreeError` → its own code at 400 (404 for `unknown_node`), with
+ *     `next` + git `detail` preserved as CrtrError details;
  *   - `reviveNode`'s finalization-latch throw → 409 `already_finalized`;
  *   - an "unknown node" throw (reviveNode / transition / getNode-null handler) →
  *     404 `node_not_found`;
@@ -104,7 +106,7 @@ export declare const REVIEW_ERROR_MAP: Readonly<Record<ReviewErrorCode, {
  *  The recognized plain-`Error` cases match on the throw sites' messages (the
  *  only signal those sites carry); the source sites are named above so a message
  *  change there is caught by the A-11 tests. */
-export declare function errorToStatus(err: unknown): {
+export declare function errorToStatus(thrown: unknown): {
     status: number;
     code: string;
 };
@@ -115,7 +117,7 @@ export declare function errorToStatus(err: unknown): {
  *  `internal error`: it surfaces the bounded cause (`boundedCause`) so a caller
  *  is never left with a causeless internal, while the router logs the full
  *  error (with stack) server-side. */
-export declare function toErrorBody(err: unknown): {
+export declare function toErrorBody(thrown: unknown): {
     status: number;
     body: ErrorBody;
 };

package/dist/daemon/api/map.js

@@ -16,6 +16,7 @@ import { FinalizationError } from '../../core/feed/feed.js';
 import { NodeIdConflictError } from '../../core/runtime/nodes.js';
 import { readContextTokens } from '../../core/canvas/telemetry.js';
 import { CrtrError } from '../../core/errors.js';
+import { WorktreeError } from '../../core/worktree.js';
 import { ExitCode } from '../../types.js';
 import { sinkDisplay } from '../cron-sink.js';
 import { responsePath } from '../../core/human/convention.js';
@@ -430,6 +431,8 @@ export const REVIEW_ERROR_MAP = Object.freeze({
  *     `finalization_forbidden`, or 404 `node_not_found`;
  *   - a `NodeIdConflictError` (a `--node-id`/`node_id` spawn at an id that
  *     already exists) → 409 `node_id_exists`;
+ *   - a `WorktreeError` → its own code at 400 (404 for `unknown_node`), with
+ *     `next` + git `detail` preserved as CrtrError details;
  *   - `reviveNode`'s finalization-latch throw → 409 `already_finalized`;
  *   - an "unknown node" throw (reviveNode / transition / getNode-null handler) →
  *     404 `node_not_found`;
@@ -440,7 +443,8 @@ export const REVIEW_ERROR_MAP = Object.freeze({
  *  The recognized plain-`Error` cases match on the throw sites' messages (the
  *  only signal those sites carry); the source sites are named above so a message
  *  change there is caught by the A-11 tests. */
-export function errorToStatus(err) {
+export function errorToStatus(thrown) {
+    const err = normalizeThrow(thrown);
     // An already-shaped API-style throw (e.g. a re-thrown ApiError) — trust it.
     if (typeof err === 'object' &&
         err !== null &&
@@ -479,6 +483,21 @@ export function errorToStatus(err) {
     }
     return { status: 500, code: 'internal' };
 }
+/** A `WorktreeError` is bad input or a repository-state conflict, never a daemon
+ *  fault, so it is projected onto the `CrtrError` contract: its specific code,
+ *  its `next` remediation, and its git `detail` all survive to the caller
+ *  instead of collapsing into an opaque 500. The details carry the FULL
+ *  `{error, message, next}` payload so `apiErrorToCliError` reconstructs the
+ *  worktree contract verbatim rather than degrading to `invalid_request`. */
+function normalizeThrow(err) {
+    if (!(err instanceof WorktreeError))
+        return err;
+    const exitCode = err.code === 'unknown_node' ? ExitCode.NOT_FOUND : ExitCode.GENERAL;
+    const details = { error: err.code, message: err.message, next: err.next };
+    if (err.detail !== undefined)
+        details['received'] = err.detail;
+    return new CrtrError(err.code, err.message, exitCode, details);
+}
 /** Remove the store row from a terminal-conflict detail before it reaches the wire.
  * Only the approved `ReviewDTO` fields cross this boundary; all other review
  * errors retain their explicitly specified internal detail object. */
@@ -539,7 +558,8 @@ function boundedCause(err) {
  *  `internal error`: it surfaces the bounded cause (`boundedCause`) so a caller
  *  is never left with a causeless internal, while the router logs the full
  *  error (with stack) server-side. */
-export function toErrorBody(err) {
+export function toErrorBody(thrown) {
+    const err = normalizeThrow(thrown);
     const { status, code } = errorToStatus(err);
     if (status >= 500) {
         return { status, body: { error: { code, message: boundedCause(err) } } };

package/dist/daemon/reconcilers/broker-supervision.js

@@ -550,7 +550,7 @@ export class BrokerSupervisionReconciler {
             ? `Child failed — ${name} (${id}) exceeded its model context window and is now dead. ` +
                 `Shrink the task or loaded context, or choose a larger-context model before spawning it again. Error: ${firstLine}`
             : `Child hit a fatal provider fault — ${name} (${id}) got a non-retryable ${fault.kind} error and will NOT recover on its own; ` +
-                `it stays alive but every wake re-fails until the fault clears. ` +
+                `it stays alive, and waking it clears the fault as soon as one turn completes — a wake that hits the same cause fails again. ` +
                 (isAuth
                     ? `Its provider credential is dead — re-authenticate (\`/login\`, or re-auth crtr); the child recovers on its next wake once the auth reloads. `
                     : ``) +

package/dist/pi-extensions/canvas-bash-valve.js

@@ -29,6 +29,7 @@ import { spawn } from 'node:child_process';
 import { closeSync, existsSync, mkdirSync, openSync, readFileSync, readSync, rmSync, statSync, writeFileSync, } from 'node:fs';
 import { homedir } from 'node:os';
 import { dirname } from 'node:path';
+import { performance } from 'node:perf_hooks';
 import { backgroundBashJob, bashJobPaths, formatBashElapsed, newBashJobId, normalizeBashJobPurpose } from '../core/bash-jobs.js';
 import { readConfig } from '../core/config.js';
 import { PREVIEW_RESULT_PATH_ENV, previewResultPath } from '../core/preview-result-path.js';
@@ -237,7 +238,7 @@ export function createValveOperations(nodeId, contextDir, takePurpose = () => nu
                 let offset = 0;
                 let settled = false;
                 let pgid;
-                const startedAt = Date.now();
+                const startedAt = performance.now();
                 const valveMs = resolveValveMs();
                 let interval;
                 const teardown = () => {
@@ -255,7 +256,7 @@ export function createValveOperations(nodeId, contextDir, takePurpose = () => nu
                     act();
                 };
                 function finishBackground(auto = false) {
-                    const elapsed = formatBashElapsed(Date.now() - startedAt);
+                    const elapsed = formatBashElapsed(performance.now() - startedAt);
                     const notice = `\n[backgrounded as job ${paths.jobId} after ${elapsed} in the foreground${auto ? ' (auto)' : ''}. ` +
                         `It will interrupt you with a message when it exits. ` +
                         `Watch: tail -f ${paths.jobLog} ; stop: kill -- -${pgid}]`;
@@ -344,7 +345,7 @@ export function createValveOperations(nodeId, contextDir, takePurpose = () => nu
                     // time out or delete the directory during that in-progress exit.
                     if (existsSync(paths.jobExit))
                         return;
-                    const elapsedMs = Date.now() - startedAt;
+                    const elapsedMs = performance.now() - startedAt;
                     if (timeout !== undefined && timeout > 0) {
                         if (elapsedMs >= timeout * 1000) {
                             if (pgid)

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@north-light/crouter",
-  "version": "0.3.234",
+  "version": "0.3.235",
   "description": "crtr — agent runtime with memory, plugins, and marketplaces",
   "type": "module",
   "main": "dist/index.js",

package/runtime.lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@north-light/crouter",
-  "version": "0.3.234",
+  "version": "0.3.235",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@north-light/crouter",
-      "version": "0.3.234",
+      "version": "0.3.235",
       "hasInstallScript": true,
       "license": "MIT",
       "dependencies": {