@north-light/crouter 0.3.253 → 0.3.254

package/dist/daemon/manage.js

@@ -14,7 +14,7 @@ import { hostExecPath } from '../core/runtime/branded-host.js';
 // Pulled from the lean db-free pidfile module (NOT crtrd.js, whose module graph
 // reaches openDb) so the CLI daemon front door stays canvas.db-free (plan B-0).
 import { isDaemonRunning, readPidfile, isPidAlive } from './pidfile.js';
-import { DAEMON_STARTUP_WINDOW_MS } from './startup-policy.js';
+import { DAEMON_EXIT_STARTUP_BLOCKED, DAEMON_STARTUP_WINDOW_MS } from './startup-policy.js';
 import { envNoDaemonAutostart } from '../shared/env.js';
 import { CrtrClient } from '../api/index.js';
 // Daemon env sanitization
@@ -225,6 +225,16 @@ function sleepMs(ms) {
         setTimeout(resolve, ms);
     });
 }
+/** Thrown when the spawned daemon exited on `DAEMON_EXIT_STARTUP_BLOCKED` — a
+ *  standing condition (a blocked on-disk migration) that the very next spawn
+ *  would hit identically. Callers must stop retrying and surface the repair;
+ *  the daemon has already written the detail to `crtrd.err`. */
+export class DaemonStartupBlockedError extends Error {
+    constructor(pid) {
+        super(`daemon ${pid} exited: startup is blocked by a standing condition that retrying cannot clear. See crtrd.err, then run \`crtr sys migrate\`.`);
+        this.name = 'DaemonStartupBlockedError';
+    }
+}
 /** Tiny bounded post-spawn guard: wait for the daemon pidfile and live pid to
  *  appear before reporting success. This catches the "started:true but not yet
  *  plausibly alive" race without turning startup into a retry loop.
@@ -255,6 +265,9 @@ export async function verifyDaemonStartup(pid, timeoutMs = DAEMON_STARTUP_WINDOW
             if (exitState.signal !== null) {
                 throw new Error(`daemon ${pid} exited before becoming ready (by ${exitState.signal})`);
             }
+            if (exitState.code === DAEMON_EXIT_STARTUP_BLOCKED) {
+                throw new DaemonStartupBlockedError(pid);
+            }
             if (exitState.code !== 0) {
                 throw new Error(`daemon ${pid} exited before becoming ready (with exit code ${exitState.code ?? '?'})`);
             }
@@ -286,6 +299,9 @@ export async function waitForDaemonExit(pid, timeoutMs = DAEMON_SHUTDOWN_WINDOW_
  *  `stopDaemonProcess` gives up. A killed process is reaped by the kernel, so
  *  this only absorbs scheduling latency (or an uninterruptible wait). */
 const DAEMON_KILL_WINDOW_MS = 2_000;
+/** How long a failed-to-start daemon gets to go down before the reap gives up.
+ *  Short on purpose: nothing is waiting on this process any more. */
+const DAEMON_REAP_WINDOW_MS = 5_000;
 /** Stop the RECORDED daemon: SIGTERM, and if it does not exit within the wait
  *  window, escalate to SIGKILL exactly as `sweepStrayDaemons` does for a stray.
  *
@@ -390,9 +406,29 @@ export async function spawnDaemon() {
         exitState = { code, signal };
     });
     child.unref();
-    const existingPid = await verifyDaemonStartup(pid, DAEMON_STARTUP_WINDOW_MS, {
-        childExited: () => exitState,
-    });
+    // Reap on failure. verifyDaemonStartup gives up at its deadline but the child
+    // it was watching is still running — and a daemon that failed to become ready
+    // is typically parked deep in startup (blocked on the migration lock, whose
+    // own window is DAEMON_STARTUP_WINDOW_MS), so it lingers long after the
+    // spawner walked away. Leaving it is what let repeated autostarts ACCUMULATE
+    // instead of merely repeating: each attempt added a resident process that
+    // outlived the attempt, and the machine went down under the pile rather than
+    // under any single failure.
+    let existingPid;
+    try {
+        existingPid = await verifyDaemonStartup(pid, DAEMON_STARTUP_WINDOW_MS, {
+            childExited: () => exitState,
+        });
+    }
+    catch (error) {
+        if (exitState === null) {
+            try {
+                await stopDaemonProcess(pid, DAEMON_REAP_WINDOW_MS);
+            }
+            catch { /* best effort */ }
+        }
+        throw error;
+    }
     if (existingPid !== null) {
         return { started: false, existing_pid: existingPid };
     }
@@ -415,17 +451,67 @@ export async function spawnDaemon() {
 export function autostartDisabled() {
     return envNoDaemonAutostart() || process.argv.includes('--no-autostart');
 }
-/** Start the daemon if it is not already running. No-op if already up, or if
- *  autostart is suppressed for this invocation.
+// Autostart rate limiting. `ensureDaemon` is the one implicit spawn path and is
+// reached on every cold socket — including each redial of a long-lived attach
+// client. Unguarded that is an open loop: a daemon that cannot start is retried
+// forever, by every client, with nothing tracking that the last attempt failed
+// for a reason the next one will hit too.
+const AUTOSTART_BACKOFF_BASE_MS = 5_000;
+const AUTOSTART_BACKOFF_MAX_MS = 60_000;
+let autostartInFlight = false;
+let autostartFailures = 0;
+let autostartNextAttemptAt = 0;
+let autostartBlocked = null;
+function autostartBackoffMs(failures) {
+    return Math.min(AUTOSTART_BACKOFF_BASE_MS * 2 ** (failures - 1), AUTOSTART_BACKOFF_MAX_MS);
+}
+/** Why implicit autostart is currently suppressed, or null when it is free to
+ *  run. Set only by a `DaemonStartupBlockedError`, which no retry can clear —
+ *  an explicit `crtr sys daemon start` still calls `spawnDaemon` directly and
+ *  reports the failure in full. */
+export function daemonAutostartSuppression() {
+    return autostartBlocked;
+}
+/** Clear the suppression and the backoff — for a caller that has repaired the
+ *  standing condition and wants autostart live again without a new process. */
+export function resetDaemonAutostart() {
+    autostartFailures = 0;
+    autostartNextAttemptAt = 0;
+    autostartBlocked = null;
+}
+/** Start the daemon if it is not already running. No-op if already up, if
+ *  autostart is suppressed for this invocation, while an attempt is in flight,
+ *  or while backing off from a recent failure.
  *  Silently swallows spawn errors (the canvas still works without the daemon;
  *  nodes just won't be auto-revived). */
-export function ensureDaemon() {
+export function ensureDaemon(deps = {}) {
+    const running = deps.isDaemonRunning ?? isDaemonRunning;
+    const spawn = deps.spawnDaemon ?? spawnDaemon;
+    const now = deps.now ?? Date.now;
     if (autostartDisabled())
         return;
-    if (!isDaemonRunning()) {
-        void spawnDaemon().catch(() => {
-            // Intentionally silent — a missing dist/daemon/crtrd-cli.js (dev mode,
-            // pre-build) must not break the calling command.
-        });
+    if (autostartBlocked !== null)
+        return;
+    if (autostartInFlight)
+        return;
+    if (now() < autostartNextAttemptAt)
+        return;
+    if (running()) {
+        resetDaemonAutostart();
+        return;
     }
+    autostartInFlight = true;
+    void spawn().then(() => {
+        autostartFailures = 0;
+        autostartNextAttemptAt = 0;
+    }, (error) => {
+        // Intentionally silent — a missing dist/daemon/crtrd-cli.js (dev mode,
+        // pre-build) must not break the calling command.
+        autostartFailures += 1;
+        autostartNextAttemptAt = now() + autostartBackoffMs(autostartFailures);
+        if (error instanceof DaemonStartupBlockedError)
+            autostartBlocked = error.message;
+    }).finally(() => {
+        autostartInFlight = false;
+    });
 }

package/dist/daemon/startup-policy.d.ts

@@ -1 +1,6 @@
 export declare const DAEMON_STARTUP_WINDOW_MS: number;
+/** Exit code a daemon uses when startup hit a STANDING condition that retrying
+ *  cannot clear (today: a blocked on-disk migration). Distinct from a generic
+ *  failure so the spawner can stop retrying and surface the repair instead of
+ *  respawning into the same wall. 78 is sysexits' EX_CONFIG. */
+export declare const DAEMON_EXIT_STARTUP_BLOCKED = 78;

package/dist/daemon/startup-policy.js

@@ -1 +1,6 @@
 export const DAEMON_STARTUP_WINDOW_MS = 5 * 60 * 1_000;
+/** Exit code a daemon uses when startup hit a STANDING condition that retrying
+ *  cannot clear (today: a blocked on-disk migration). Distinct from a generic
+ *  failure so the spawner can stop retrying and surface the repair instead of
+ *  respawning into the same wall. 78 is sysexits' EX_CONFIG. */
+export const DAEMON_EXIT_STARTUP_BLOCKED = 78;

package/dist/migrations/activation.d.ts

@@ -8,6 +8,15 @@ export interface ForcedMigrationOptions extends CoordinationOptions {
     dryRun?: boolean;
     explicitDirs?: readonly string[];
 }
+/** A migration blocker is a STANDING condition, not a transient fault: the same
+ *  corpus produces the same blockers on every boot, so a caller that retries a
+ *  daemon start against one retries forever. Typing it lets the startup path
+ *  tell "try again" apart from "this needs a human", and carry the repair line
+ *  to whoever can act on it. */
+export declare class MigrationBlockedError extends Error {
+    readonly blockerPaths: readonly string[];
+    constructor(message: string, blockerPaths: readonly string[]);
+}
 /** Run startup migration only when this home lacks the current completion marker. */
 export declare function activateOnDiskMigrations(options?: CoordinationOptions): Promise<OnDiskMigrationRunResult | null>;
 export declare function ensureOnDiskMigrations(): Promise<void>;

package/dist/migrations/activation.js

@@ -20,6 +20,19 @@ function blockerPaths(result) {
             ...(blocker.storeRoot === undefined ? [] : [blocker.storeRoot]),
         ]))];
 }
+/** A migration blocker is a STANDING condition, not a transient fault: the same
+ *  corpus produces the same blockers on every boot, so a caller that retries a
+ *  daemon start against one retries forever. Typing it lets the startup path
+ *  tell "try again" apart from "this needs a human", and carry the repair line
+ *  to whoever can act on it. */
+export class MigrationBlockedError extends Error {
+    blockerPaths;
+    constructor(message, blockerPaths) {
+        super(message);
+        this.name = 'MigrationBlockedError';
+        this.blockerPaths = blockerPaths;
+    }
+}
 function activationError(result) {
     const paths = blockerPaths(result);
     const findings = result.blockers.map((blocker) => `${blocker.kind}: ${blocker.message}`);
@@ -37,7 +50,7 @@ function activationError(result) {
     if (writes.length > 0)
         lines.push(`Writes completed before failure: ${writes.join(', ')}`);
     lines.push('Repair: crtr sys migrate');
-    return new Error(lines.join('\n'));
+    return new MigrationBlockedError(lines.join('\n'), paths);
 }
 async function coordinate(mode, options) {
     const lockPath = onDiskMigrationLockPath();

package/dist/pi-extensions/canvas-bash-valve.js

@@ -322,6 +322,10 @@ export function createValveOperations(nodeId, contextDir, takePurpose = () => nu
                 let childEnv = env ?? process.env;
                 if (previewPath !== undefined) {
                     mkdirSync(dirname(previewPath), { recursive: true });
+                    // crtr APPENDS one JSONL record per invocation, so this call starts
+                    // from an empty file: a path left behind by a call whose result event
+                    // never arrived must not fold its records into this one's.
+                    rmSync(previewPath, { force: true });
                     childEnv = { ...childEnv, [PREVIEW_RESULT_PATH_ENV]: previewPath };
                 }
                 const shellPath = resolveAdmittedHostCommand('bash', childEnv, execution.cwd);

package/dist/pi-extensions/canvas-preview-result.js

@@ -2,10 +2,16 @@
 //
 // A crtr leaf returns a record, but the CLI normally renders that record to
 // stdout for the agent. stdout is model context, so the bash valve hands every
-// bash call a private file path in the child environment, crtr atomically
-// mirrors its record there, and this hook attaches the record to Pi's
-// ToolResult.details. The attach viewer can render a structured preview
-// without parsing the agent-facing text.
+// bash call a private file path in the child environment, crtr mirrors its
+// record there, and this hook attaches the record to Pi's ToolResult.details.
+// The attach viewer can render a structured preview without parsing the
+// agent-facing text.
+//
+// One bash call may run several crtr invocations, so the file is JSONL — one
+// record per invocation, in order. Two fields are attached: `crtrPreview` is
+// the LAST record, the single-object shape every already-persisted transcript
+// and the inline command card were written against; `crtrPreviews` is the full
+// list, for consumers that must see every invocation in the call.
 import { envNodeId } from '../shared/env.js';
 import { existsSync, readFileSync, rmSync } from 'node:fs';
 import { previewResultPath } from '../core/preview-result-path.js';
@@ -17,6 +23,24 @@ function isPreviewRecord(value) {
         || (Array.isArray(record.jsonl) && record.jsonl.every((item) => item !== null && typeof item === 'object' && !Array.isArray(item)))
         || (record.error !== undefined && record.error !== null && typeof record.error === 'object' && !Array.isArray(record.error));
 }
+/** Every valid record in the mirror file. A single-object file (every record
+ * written before the channel became JSONL) parses as one line, so historical
+ * transcripts and a mid-upgrade broker read identically. One malformed line is
+ * skipped rather than discarding the invocations around it. */
+function readPreviewRecords(path) {
+    const records = [];
+    for (const line of readFileSync(path, 'utf8').split('\n')) {
+        if (line.trim() === '')
+            continue;
+        try {
+            const record = JSON.parse(line);
+            if (isPreviewRecord(record))
+                records.push(record);
+        }
+        catch { /* one unreadable record never costs the others */ }
+    }
+    return records;
+}
 /** Loaded into every canvas broker. Plain Pi sessions have no node id and
  * deliberately receive no filesystem transport. */
 export function registerCanvasPreviewResult(pi) {
@@ -29,10 +53,11 @@ export function registerCanvasPreviewResult(pi) {
         if (!existsSync(path))
             return;
         try {
-            const record = JSON.parse(readFileSync(path, 'utf8'));
-            if (!isPreviewRecord(record))
+            const records = readPreviewRecords(path);
+            const last = records.at(-1);
+            if (last === undefined)
                 return;
-            return { details: { ...(event.details ?? {}), crtrPreview: record } };
+            return { details: { ...(event.details ?? {}), crtrPreview: last, crtrPreviews: records } };
         }
         catch {
             // A malformed side-channel record is not agent-visible output and must

package/dist/shared/generated-context.js

@@ -29,7 +29,7 @@ export const PARK_SUMMARY_PROMPT = 'This conversation has been idle with nothing
     + '3. Put supporting material in your context directory only when the roadmap would become bulky without it. Rewrite existing living documents rather than leave superseded versions. Name every supporting file the next cycle must read from the roadmap and say what it is for—the revive shows filenames but does not inject their contents. Task state, identifiers, and recovery detail belong here, not in memory.\n\n'
     + '4. Use memory only for a non-obvious, reusable lesson that should survive this task and is not already recorded. Read `crtr memory write -h`, find before writing, and choose the narrowest scope that will reach the next agent who needs it. Do not put a conversation recap, task status, recovery handles, or facts already captured in code or docs into memory.\n\n'
     + '5. Push exactly one regular update with `crtr push update --tier deferred`, never `crtr push final`. Write it for subscribers and history, not as a second roadmap. Its first line must stand alone as the current outcome, blocker, or decision that matters; then include only unfinished work, a needed decision, and concrete handles a subscriber may need. This concludes the conversation; it does not finish the mandate.\n\n'
-    + '6. End with a short sign-off to the reader in second person: say you are putting your notes in order and pausing here until they come back, and mention anything genuinely worth their attention, such as unfinished work or an open question. Keep all visible text this turn—including the update\'s first line—about their work, not crouter\'s machinery: do not mention roadmap or context paths, filing a report, parking, idling, residency, or node ids. Then stop. A later message reopens you on a fresh context window grounded in your goal and roadmap, so the inheritance you leave now is what you get back.';
+    + '6. End with a short, one-sentence sign-off to the reader in second person: say you are putting your notes in order and pausing here until they come back. If you saved any memories, describe what you did extremely briefly (i.e. "I noted your preference for XYZ" or "I updated my memories on ABC"). Keep all visible text this turn—including the update — about their work, not crouter\'s machinery: do not mention roadmap or context paths, filing a report, parking, idling, residency, or node ids. Then stop. A later message reopens you on a fresh context window grounded in your goal and roadmap, so the inheritance you leave now is what you get back.';
 /** Static recovery prompts shared by the broker producer and display classifier. */
 export const AUTH_FAULT_RECOVERY_BODY = 'Provider credentials were just updated (a new login landed). Your previous turn stopped on a provider authentication failure. Continue from where you left off and retry the work that failed.';
 export const CONNECTION_FAULT_RECOVERY_BODY = 'The network connection is back online. Your previous turn stopped on a connection error (the network was down). Continue from where you left off and retry the work that failed.';

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@north-light/crouter",
-  "version": "0.3.253",
+  "version": "0.3.254",
   "description": "crtr — agent runtime with memory, plugins, and marketplaces",
   "type": "module",
   "main": "dist/index.js",

package/runtime.lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@north-light/crouter",
-  "version": "0.3.253",
+  "version": "0.3.254",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@north-light/crouter",
-      "version": "0.3.253",
+      "version": "0.3.254",
       "hasInstallScript": true,
       "license": "MIT",
       "dependencies": {