@north-light/crouter 0.3.262 → 0.3.269

package/dist/api/client.d.ts

@@ -19,7 +19,7 @@ import type { CancelReviewRequest, CreateReviewRequest, ListReviewsQuery, Review
 import type { CreateReviewCommentRequest, EditReviewCommentRequest, ListReviewCommentsQuery, ReadReviewCommentEventsQuery, ReviewCommentActionRequest, ReviewCommentDetailDTO, ReviewCommentEventsDTO, ReviewCommentListDTO, ReviewCommentMutationDTO, ReviewCommentRangeBatchRequest, ReviewCommentRangeBatchResultDTO } from './dto/review-comments.js';
 import type { CancelInboxTicketRequest, CanceledTicketResultDTO, InboxListDTO, InboxPageDTO, InboxPageHistoryDTO, InboxPageResponseDTO, InboxTicketIdDTO, PageFeedbackResolutionDTO, PageResponsesDTO, PageTicketResultDTO, RespondInboxPageRequest } from './dto/inbox.js';
 import type { CreateHumanRequestDTO, CreateHumanRequestRequest, HumanRequestDTO, HumanRequestIdDTO, ReplaceHumanRequestRequest, RespondHumanRequestRequest, SettleHumanRequestRequest } from './dto/human-requests.js';
-import type { AttentionCountsDTO, AttentionDTO, DashboardDTO, DashboardQuery, HistoryGrepQuery, HistoryGrepResultDTO, HistoryReadQuery, HistoryReadResultDTO, HistorySearchQuery, HistorySearchResultDTO, PruneRequest, PruneResultDTO, RebuildIndexResultDTO, RosterDTO, SnapshotDTO } from './dto/canvas.js';
+import type { AttentionCountsDTO, AttentionDTO, DashboardDTO, DashboardQuery, HistoryGrepQuery, HistoryGrepResultDTO, HistoryReadQuery, HistoryStatsQuery, HistoryStatsResultDTO, HistoryReadResultDTO, HistorySearchQuery, HistorySearchResultDTO, PruneRequest, PruneResultDTO, RebuildIndexResultDTO, RosterDTO, SnapshotDTO } from './dto/canvas.js';
 import type { AbandonWorktreeRequest, AbandonWorktreeResultDTO, CloseWorktreeResultDTO, QuarantinedWorktreeDTO } from './dto/worktree.js';
 import type { BrokerExtensionStateDTO, BrokerGeneratedNameRequest, BrokerGeneratedNameResultDTO, BrokerInboxCursorDirective, BrokerInboxCursorRequest, BrokerModelCommitRequest, BrokerModelCommitResultDTO, BrokerPersonaAckRequest, BrokerPersonaAckResultDTO, BrokerSessionBoundRequest, BrokerSessionBoundResultDTO, BrokerSettleDirective, BrokerSettleRequest } from './dto/broker-ops.js';
 export interface CrtrClientOptions {
@@ -279,6 +279,10 @@ export declare class CrtrClient {
     /** Resolve one `<node-id>:<relpath>` history ref to its full body
      *  (`crtr canvas history read`). */
     historyRead(q: HistoryReadQuery): Promise<HistoryReadResultDTO>;
+    /** Grouped-count projection over the per-cwd episodic corpus
+     *  (`crtr canvas history stats`). Same filters as search/grep, aggregate
+     *  result instead of a hit page — POST-bodied for the same reasons. */
+    historyStats(q: HistoryStatsQuery): Promise<HistoryStatsResultDTO>;
     /** The machine-readable browser canvas roster (`crtr canvas snapshot`) —
      *  distinct from the per-node `getSnapshot`. */
     canvasSnapshot(): Promise<SnapshotDTO>;

package/dist/api/client.js

@@ -519,6 +519,12 @@ export class CrtrClient {
     historyRead(q) {
         return this.request('GET', withQuery(routes.canvasHistoryRead(), q));
     }
+    /** Grouped-count projection over the per-cwd episodic corpus
+     *  (`crtr canvas history stats`). Same filters as search/grep, aggregate
+     *  result instead of a hit page — POST-bodied for the same reasons. */
+    historyStats(q) {
+        return this.request('POST', routes.canvasHistoryStats(), q);
+    }
     /** The machine-readable browser canvas roster (`crtr canvas snapshot`) —
      *  distinct from the per-node `getSnapshot`. */
     canvasSnapshot() {

package/dist/api/dto/canvas.d.ts

@@ -52,7 +52,7 @@ export interface HistorySearchQuery {
     under?: string;
     /** Restrict to specific node ids. */
     nodes?: string[];
-    /** Corpus types: report | doc | roadmap | meta | inbox. */
+    /** Corpus types: report | doc | roadmap | meta | inbox | transcript. */
     types?: string[];
     report_kind?: string;
     kinds?: string[];
@@ -61,6 +61,12 @@ export interface HistorySearchQuery {
     since_ms?: number;
     /** Upper bound on artifact timestamp (epoch ms), parsed CLI-side. */
     until_ms?: number;
+    /** Inbound-message narrowing (transcript + inbox): what drove arrival. */
+    origins?: string[];
+    /** Transcript-message roles: user | assistant | toolResult. */
+    roles?: string[];
+    /** Case-insensitive substring against sender attribution. */
+    from?: string;
     /** Weigh full body text in ranking (`--body`). */
     weigh_body?: boolean;
     /** relevance | recency | oldest — already resolved to the effective sort. */
@@ -93,7 +99,7 @@ export interface HistoryGrepQuery {
     under?: string;
     /** Restrict to specific node ids. */
     nodes?: string[];
-    /** Corpus types: report | doc | roadmap | meta | inbox. */
+    /** Corpus types: report | doc | roadmap | meta | inbox | transcript. */
     types?: string[];
     report_kind?: string;
     kinds?: string[];
@@ -102,9 +108,50 @@ export interface HistoryGrepQuery {
     since_ms?: number;
     /** Upper bound on artifact timestamp (epoch ms), parsed CLI-side. */
     until_ms?: number;
+    /** Inbound-message narrowing (transcript + inbox): what drove arrival. */
+    origins?: string[];
+    /** Transcript-message roles: user | assistant | toolResult. */
+    roles?: string[];
+    /** Case-insensitive substring against sender attribution. */
+    from?: string;
     limit?: number;
     cursor?: Cursor;
 }
+/** `POST /v1/canvas/history/stats` body — the grouped-count projection over
+ *  the same corpus search and grep scan, backing `crtr canvas history stats`.
+ *  Shares every scope/corpus/message filter; carries no query, pattern, or
+ *  pagination because the result is an aggregate, not a hit list. */
+export interface HistoryStatsQuery {
+    /** origin | node | kind | day | type | role. Defaults to type. */
+    group_by?: string;
+    cwd?: string;
+    all_cwds?: boolean;
+    under?: string;
+    nodes?: string[];
+    types?: string[];
+    report_kind?: string;
+    kinds?: string[];
+    statuses?: string[];
+    since_ms?: number;
+    until_ms?: number;
+    origins?: string[];
+    roles?: string[];
+    from?: string;
+}
+/** `POST /v1/canvas/history/stats` result — counts by the grouped dimension,
+ *  descending. `total` counts the artifacts that carried the dimension, so it
+ *  can be lower than the corpus size when grouping by one not every artifact
+ *  has (origin, role). */
+export interface HistoryStatsResultDTO {
+    group_by: string;
+    groups: Array<{
+        key: string;
+        count: number;
+    }>;
+    total: number;
+    /** Artifacts scanned before the grouping dimension was applied. */
+    scanned: number;
+}
 /** One matching body line from `crtr canvas history grep`. */
 export interface HistoryGrepHitDTO {
     ref: string;
@@ -126,6 +173,10 @@ export interface HistoryReadQuery {
     ref: string;
     /** Keep the artifact's YAML frontmatter (stripped by default). */
     frontmatter?: boolean;
+    /** `rendered` (default) or `raw` — the verbatim bytes behind the ref: the
+     *  session file for a bare `session` ref, the one jsonl line for a message,
+     *  the unparsed file for a report or doc. */
+    format?: string;
 }
 /** `GET /v1/canvas/history/read` result — one hit's full body. */
 export interface HistoryReadResultDTO {

package/dist/api/dto/health.d.ts

@@ -15,6 +15,8 @@ export interface StatusDTO {
     tick_interval_ms: number;
     /** Node counts keyed by status. */
     node_counts: Partial<Record<NodeStatusDTO, number>>;
+    /** Nodes genuinely mid-turn: their busy marker exists and their recorded pid is alive. Unlike `node_counts.active`, this excludes live-but-waiting, parked, or blocked engines. */
+    busy_node_count: number;
     /** Bound listener addresses. `tcp` is null when the TCP listener is off. */
     listeners: {
         socket_path: string;

package/dist/api/dto/nodes.d.ts

@@ -67,6 +67,12 @@ export interface CreateNodeRequest {
 export interface NodeSummaryDTO {
     node_id: NodeIdDTO;
     name: string;
+    /** Generated first-task description, absent when the node is not yet named.
+     *  Paired with `name` it forms the full display label, so a roster consumer
+     *  builds it without a per-node metadata fetch. */
+    description?: string;
+    /** How many times the node has been (re)launched; absent on a pre-v38 row. */
+    cycles?: number;
     kind: string;
     mode: ModeDTO;
     lifecycle: LifecycleDTO;
@@ -169,7 +175,6 @@ export interface NodeFaultDTO {
 export interface NodeDetailDTO extends NodeSummaryDTO {
     /** Node that created this node, or null when an external process did. */
     creator: NodeIdDTO | null;
-    description?: string;
     /** The namer's prose form of `description` — sentence case, punctuation intact
      *  (`NodeMeta.title`). What a surface showing this node to a person reads;
      *  absent on a node named before titles existed. */
@@ -177,7 +182,6 @@ export interface NodeDetailDTO extends NodeSummaryDTO {
     /** The Nerd Font glyph the namer chose for this node's work, when it has one
      *  (`NodeMeta.icon`). Rendered ahead of the label by surfaces that want it. */
     icon?: string;
-    cycles?: number;
     /** Approximate context-window token load of the node's live/last session,
      *  used by the orchestrator yield-nudge (`childFollowUp`). Null when unknown
      *  (never launched, or no token accounting yet). */

package/dist/api/routes.d.ts

@@ -59,6 +59,7 @@ export declare const routes: {
     readonly canvasHistorySearch: () => string;
     readonly canvasHistoryGrep: () => string;
     readonly canvasHistoryRead: () => string;
+    readonly canvasHistoryStats: () => string;
     readonly canvasSnapshot: () => string;
     readonly canvasRoster: () => string;
     readonly canvasPrune: () => string;

package/dist/api/routes.js

@@ -81,6 +81,7 @@ export const routes = {
     canvasHistorySearch: () => `${V}/canvas/history/search`,
     canvasHistoryGrep: () => `${V}/canvas/history/grep`,
     canvasHistoryRead: () => `${V}/canvas/history/read`,
+    canvasHistoryStats: () => `${V}/canvas/history/stats`,
     canvasSnapshot: () => `${V}/canvas/snapshot`,
     canvasRoster: () => `${V}/canvas/roster`,
     canvasPrune: () => `${V}/canvas/prune`,

package/dist/builtin-memory/05-kinds/advisor/advice-contract.md

@@ -3,13 +3,13 @@ kind: preference
 when-and-why-to-read: When a node is spawned as kind advisor, this preference should be read so diagnoses are grounded in evidence and consequential tradeoffs lead to a defensible recommendation.
 gate: {kind: advisor}
 rationale: >-
-  Gates on the kind with no mode, so advisor orchestrators load it too — an unnumbered filename marks a kind-wide contract, while a `NN-` prefix marks a mode layer. The kind itself is the reciprocal of explore's model-tier economics — judgment, debugging, and tradeoff work need the slow/expensive think-y tier, so it is fenced into its own kind rather than left as a per-task instruction. The orchestrator variant is the council: reach for it only when the call is consequential enough to fund deliberation — the ordinary case is still one advisor (or a few, un-orchestrated), not a fan-out.
+  Gates on the kind with no mode, so advisor orchestrators load it too — an unnumbered filename marks a kind-wide contract, while a `NN-` prefix marks a mode layer. The kind itself is the reciprocal of explore's model-tier economics — judgment, debugging, and tradeoff work need the slow/expensive think-y tier, so it is fenced into its own kind rather than left as a per-task instruction. The contract makes a factual map the prerequisite for that judgment: explore maps facts; advisor judges them. The orchestrator variant is the council: reach for it only when the call is consequential enough to fund deliberation — the ordinary case is still one advisor (or a few, un-orchestrated), not a fan-out.
 surfaces:
   - on: boot
     at: content
 ---
 
 ## When advising from evidence
-Ground advice in evidence. Inspect the code, logs, repro steps, prior reports, or runtime state needed to understand the situation; do not answer from vibes when the facts are available. For debugging, drive toward the smallest credible root cause: reproduce or trace the failure, separate symptoms from causes, and name the file, command, invariant, or design assumption that explains it.
+First understand the problem: use supplied exploration findings when available. If they are absent and the surface is not already small or known, conduct the needed exploration yourself and leave a reusable factual map. Exploration maps facts; advisory work judges them. Base the diagnosis and recommendation on that evidence. For debugging, drive toward the smallest credible root cause: reproduce or trace the failure, separate symptoms from causes, and name the file, command, invariant, or design assumption that explains it.
 
 Your deliverable is the advice: conclusion first, then the evidence and the recommended next move. If the right next move is an implementation, say exactly what should change or hand it to a developer; do not turn advisory work into a broad refactor unless the task explicitly asks you to apply the fix.

package/dist/builtin-memory/internal/memory-loading.md

@@ -18,7 +18,7 @@ A doc with no `surfaces` does exactly one thing: appears in its directory's list
 - **boot** — the frozen preference system snapshot and first-message knowledge catalog assembled when a context begins. No match; the entry's presence is the match.
 - **workspace-open** — first-message context when cwd/profile mounts the doc's project store. Project stores only.
 - **read** — a `read` tool call returned a matching file: path globs vs the file's absolute path and basename, `./`-anchored globs vs its path relative to the store's owning repo dir, `match-frontmatter` predicates over the read file's own YAML frontmatter.
-- **memory-read** — a `crtr memory read` resolved a matching doc: name globs vs its canonical name, `./` anchored to this doc's canonical routing anchor (a collapsed directory document anchors at its own directory name).
+- **memory-read** — another doc's full body entered context, including `crtr memory read`: name globs vs its canonical name, `./` anchored to this doc's canonical routing anchor (a collapsed directory document anchors at its own directory name).
 - **command** — a matching shell command ran: globs vs the whole command string, `*` crossing `/`. Delivery is post-execution — right for "you are now in this territory"; when the point is "don't run this at all," use `pre-command` instead.
 - **pre-command** — a matching `bash` command is about to run. When the memory has not been read yet, the command does not execute — the memory comes back as the tool result instead, and the agent re-issues the command, which then runs. Use it to guarantee a memory is seen before a sensitive action is taken. Same globs as `command`, matched at command position; `match` is required. A guardrail against the faithful-but-uninformed action, not an enforcement boundary.
 
@@ -40,9 +40,9 @@ A document-level `gate` is the hard eligibility predicate over the node's own co
 
 ## Listings and dedup
 
-Reading a doc discloses where it sits: `crtr memory read <doc>` also renders, once per loaded context, the listing of the doc's directory and each ancestor — one routing line per member doc, one bare name per subdirectory. A directory document owns its canonical directory node, so `crtr memory read <dir>` (or a bare-dir `[[ref]]`) returns that document's body followed by the directory's immediate listing without repeating the document; a directory without a document returns its listing. `unlisted: true` suppresses a doc from every listing. Store roots are never auto-listed — `crtr memory list` is the deliberate root browse.
+A full-body delivery is a read: `crtr memory read <doc>` and every content-rung surface delivery expose, once per loaded context, the listing of the doc's directory and each ancestor — one routing line per member doc, one bare name per subdirectory — then fire matching `memory-read` routes. A directory document owns its canonical directory node, so its content delivery exposes its immediate members; `crtr memory read <dir>` returns that document's body followed by the directory's immediate listing without repeating the document, while a directory without a document returns its listing. Content-delivered companions are read in turn until the finite corpus reaches the ledger-deduplicated fixpoint. `unlisted: true` suppresses a doc from every listing. Store roots are never auto-listed — `crtr memory list` is the deliberate root browse.
 
-Every delivery registers its document or listing identity and rung in the loaded context's exposure ledger. System and transcript ranks max-fold, so a higher rung pierces a lower one while a content delivery silences later lower-rung deliveries. A strict resume preserves that ledger and the byte-stable preference snapshot; yield or another new-context boundary replaces them with exactly the new system and first-message snapshots.
+Every delivery registers its document or listing identity and rung in the loaded context's exposure ledger. System and transcript ranks max-fold, so a higher rung pierces a lower one while a content delivery silences later lower-rung deliveries and duplicate read attachments. A strict resume preserves that ledger and the byte-stable preference snapshot; yield or another new-context boundary replaces them with exactly the new system and first-message snapshots.
 
 ## Store mounting and precedence
 

package/dist/builtin-pi-packages/pi-crtr-extensions/extensions/__tests__/integration/provider-rotation.test.ts

@@ -52,6 +52,18 @@ function writeLadderConfig() {
   );
 }
 
+function writeSameModelRouteConfig() {
+  const configPath = join(nodeCwd, ".crouter", "config.json");
+  mkdirSync(dirname(configPath), { recursive: true });
+  writeFileSync(configPath, `${JSON.stringify({
+    modelRoutes: {
+      primary: { family: "openai", credentialSource: "primary", providerId: "openai-codex", models: { strong: "openai-codex/gpt-5.6-sol:high" } },
+      alternate: { family: "openai", credentialSource: "alternate", providerId: "anthropic", models: { strong: "anthropic/gpt-5.6-sol:high" } },
+    },
+    modelRouting: { credentialSourceOrder: ["primary", "alternate"], familyOrder: ["openai"] },
+  }, null, 2)}\n`, "utf8");
+}
+
 function credential(label: string, overrides: Partial<SubscriptionCredential> = {}): SubscriptionCredential {
   return {
     label,
@@ -1039,6 +1051,44 @@ test("a cooling concrete model never substitutes a different-provider model", as
   }
 });
 
+test("an exact override never substitutes another provider sharing its model id", async () => {
+  await resetRotationState();
+  writeSameModelRouteConfig();
+  await helpers.writeSubscriptionPool("openai-codex", [credential("codex")]);
+  await helpers.markSubscriptionRateLimited("openai-codex", "codex", 30_000);
+  await helpers.writeSubscriptionPool("anthropic", [credential("anthropic")]);
+
+  const { ctx, setModelCalls, providers, events, pi } = makeRotationCtx(undefined);
+  const previousModelExact = process.env.CRTR_MODEL_EXACT;
+  process.env.CRTR_MODEL_EXACT = "1";
+  ctx.modelRegistry.find = (provider: string, id: string) => {
+    if (id !== "gpt-5.6-sol") return undefined;
+    return { provider, id, api: provider === "anthropic" ? "anthropic-messages" : "openai-codex-responses" };
+  };
+  let streamCalls = 0;
+  rotationModule.__setStreamForProviderForTest(() => {
+    streamCalls += 1;
+    return (async function* () {
+      yield { type: "text_delta", text: "must not reach an alternate provider" };
+    })() as any;
+  });
+
+  try {
+    await providerRotationExtension(pi);
+    await events.session_start?.({}, ctx);
+    const emitted = [] as any[];
+    for await (const event of providers["openai-codex"].streamSimple(ctx.model, ctx)) emitted.push(event);
+
+    assert.deepEqual(setModelCalls, [], "the exact provider/model never switches to the same-id alternate");
+    assert.equal(streamCalls, 0, "the alternate provider is never called");
+    assert.match(emitted[0].error.errorMessage, /All provider routes are rate limited/i);
+  } finally {
+    rotationModule.__setStreamForProviderForTest(undefined);
+    if (previousModelExact === undefined) delete process.env.CRTR_MODEL_EXACT;
+    else process.env.CRTR_MODEL_EXACT = previousModelExact;
+  }
+});
+
 // Request timeouts and other transient network/5xx blips retry the same provider in place
 // without cooling the credential down or rotating away.
 test("treats a request timeout as transient: retries the SAME provider in place, no cooldown or rotation", async () => {

package/dist/builtin-pi-packages/pi-crtr-extensions/extensions/memory-slash-commands.ts

@@ -1,7 +1,11 @@
 import { envNodeId } from '../../../shared/env.js';
 import type { ExtensionAPI } from '@earendil-works/pi-coding-agent';
-import { createMemoryDocSnapshot, readMemoryDocContent } from '../../../core/memory-resolver.js';
+import { createMemoryDocSnapshot, listAllMemoryDocs, readMemoryDocContent } from '../../../core/memory-resolver.js';
 import { parseSubstrateDoc } from '../../../core/substrate/schema.js';
+import { docsByName } from '../../../core/substrate/listings.js';
+import { contentReadAttachments } from '../../../core/substrate/on-read.js';
+import { brokerExtensionState } from '../../../core/runtime/broker/daemon-ops.js';
+import type { NodeConfigSubject } from '../../../core/substrate/subject-fields.js';
 import {
   expandDeterministicCommand,
   type DeterministicCommandExpansion,
@@ -84,13 +88,45 @@ function defaultReadMemoryDoc(name: string): { path: string; canonicalBody: stri
   };
 }
 
-function registerSlashExposure(path: string, body: string): void {
+/** The node-config subject the companion `memory-read` gates evaluate against.
+ *  Unreachable daemon = null, which skips gated docs and delivers ungated ones. */
+async function slashSubject(nodeId: string): Promise<NodeConfigSubject | null> {
+  try {
+    return (await brokerExtensionState(nodeId)).subject;
+  } catch {
+    return null;
+  }
+}
+
+/** Invoking a document is content delivery, so it carries the same companions
+ *  `crtr memory read` attaches: the directory listings that place it, and every
+ *  corpus doc whose `memory-read` route matches its name. Returns the blocks to
+ *  prepend and records the whole delivery in the exposure ledger. Without a node
+ *  identity nothing records and nothing attaches. */
+async function slashReadAttachments(name: string, path: string, body: string): Promise<string[]> {
   const nodeId = envNodeId();
-  if (nodeId === undefined || nodeId === "") return;
+  if (nodeId === undefined || nodeId === "") return [];
   const state = sharedContextExposureState(nodeId);
   mergeContextExposureState(state, loadContextExposureState(nodeId));
-  registerDocumentExposure(exposureTarget(state, "transcript"), path, body, "content");
+  const target = exposureTarget(state, "transcript");
+  // Register the invoked body BEFORE the attachments, so the listings and
+  // companion routes dedupe against the document about to be delivered.
+  registerDocumentExposure(target, path, body, "content");
+  let blocks: string[] = [];
+  try {
+    const byName = docsByName(listAllMemoryDocs(undefined, true, true));
+    // No `explicit`: the read leaf returns a doc's own directory listing in a
+    // separate field, while this path has only the turn — it wants that
+    // listing attached as a block like every other.
+    blocks = contentReadAttachments(
+      { name, path, body },
+      { subject: await slashSubject(nodeId), target, byName, listings: "blocks" },
+    ).blocks;
+  } catch {
+    blocks = [];
+  }
   saveContextExposureState(nodeId, state);
+  return blocks;
 }
 
 function hasNodeRelativeExpansion(body: string): boolean {
@@ -177,15 +213,19 @@ export default async function (pi: ExtensionAPI) {
               piShellRunner(pi, (ctx as { cwd?: string }).cwd ?? process.cwd(), DEFAULT_SHELL_TIMEOUT_MS),
             )
           : expanded;
+        const blocks =
+          exposure === undefined ? [] : await slashReadAttachments(doc.name, exposure.path, exposure.body);
         pi.sendMessage(
           {
             customType: "memory-slash-command",
-            content,
+            content:
+              blocks.length === 0
+                ? content
+                : `<auto-loaded-context>\n${blocks.join("\n")}\n</auto-loaded-context>\n\n${content}`,
             display: true,
           },
           { triggerTurn: true },
         );
-        if (exposure !== undefined) registerSlashExposure(exposure.path, exposure.body);
       },
     } as Parameters<ExtensionAPI["registerCommand"]>[1] & { expansion?: DeterministicCommandExpansion } & ChatCommandMetadata);
   }

package/dist/builtin-pi-packages/pi-crtr-extensions/extensions/provider-rotation.js

@@ -1,10 +1,10 @@
 import { spawn } from 'node:child_process';
 import { createAssistantMessageEventStream, } from '@earendil-works/pi-ai';
-import { streamSimple as streamAnthropicMessages } from '@earendil-works/pi-ai/api/anthropic-messages';
-import { streamSimple as streamOpenAICodexResponses } from '@earendil-works/pi-ai/api/openai-codex-responses';
+import { anthropicMessagesApi, openAICodexResponsesApi } from '@earendil-works/pi-ai/compat';
 import { ANTHROPIC_PROVIDER_ID, OPENAI_CODEX_PROVIDER_ID, INVALID_REFRESH_TOKEN_BACKOFF_MS, formatStatusLine, getProviderLabel, isManagedProvider, isInvalidRefreshTokenError, addSubscription, enrichManagedLoginIdentity, markSubscriptionAuthenticationFailed, markSubscriptionRateLimited, markSubscriptionSuccess, parseRetryAfterHeader, promoteSubscription, readRotationConfig, readSubscriptionPool, refreshSubscriptionCredential, removeManagedAccount, resolveProviderCandidates, upsertSubscriptionWithUniqueAccount, } from '../../../core/subscription-state.js';
 import { readMergedLaunchConfig } from '../../../core/config.js';
 import { expandModelCandidates, modelRequestFromConfig, probeRouteAvailability } from '../../../core/model-routes.js';
+import { envModelExact } from '../../../shared/env.js';
 import { ManagedProviderCoolingError } from '../../../core/runtime/managed-provider-cooling.js';
 // A response without Retry-After proves only that THIS attempt was throttled; it
 // does not authorize crouter to invent a five-minute provider-wide outage. Keep
@@ -24,12 +24,17 @@ const TRANSIENT_ROTATE_COOLDOWN_MS = 60 * 1000;
 // remains busy, the provider call still proceeds. Subscription bookkeeping must never turn a
 // healthy model response into a fatal generation fault.
 const SUBSCRIPTION_LOCK_RETRY_BACKOFFS_MS = [25, 75, 150];
+const { streamSimple: streamAnthropicMessages } = anthropicMessagesApi();
+const { streamSimple: streamOpenAICodexResponses } = openAICodexResponsesApi();
 function createProviderRotationState(options) {
     return { delegatedProviderStreams: new Map(), transportOnlyExhaustedPasses: 0, ...(options === undefined ? {} : { options: { ...options } }) };
 }
 function configuredValue(state, key, envName) {
     return state.options === undefined ? process.env[envName] : state.options[key];
 }
+function isExactModel(state) {
+    return state.options === undefined && envModelExact();
+}
 const TRANSIENT_MESSAGE_PATTERN = /connection|network|fetch failed|socket|econnreset|econnrefused|enotfound|etimedout|timed? out|timeout|overloaded|service.?unavailable|temporarily unavailable/i;
 const RATE_LIMIT_MESSAGE_PATTERN = /\b429\b|rate.?limit|too many requests/i;
 // Precise terminal usage-limit signals (as opposed to the bare `usage`/`quota` substrings
@@ -539,7 +544,7 @@ async function runManagedProvider(state, model, context, options, stream) {
     const liveThinking = state.runtimeContext?.thinkingLevel === undefined || state.runtimeContext?.thinkingLevel === 'off'
         ? undefined
         : state.runtimeContext.thinkingLevel;
-    const request = modelRequestFromConfig(`${model.provider}/${model.id}${liveThinking ? `:${liveThinking}` : ''}`, configuredValue(state, 'modelIntent', 'CRTR_MODEL_INTENT'), false);
+    const request = modelRequestFromConfig(`${model.provider}/${model.id}${liveThinking ? `:${liveThinking}` : ''}`, configuredValue(state, 'modelIntent', 'CRTR_MODEL_INTENT'), isExactModel(state));
     const expanded = request ? expandModelCandidates(request, configuredValue(state, 'nodeCwd', 'CRTR_NODE_CWD'), configuredValue(state, 'profileId', 'CRTR_PROFILE_ID')) : [];
     const liveRank = expanded.find((candidate) => candidate.providerId === model.provider && candidate.modelId === model.id && candidate.thinkingLevel === liveThinking)?.rank ?? 0;
     const routeCandidates = expanded.slice(liveRank)
@@ -758,7 +763,7 @@ function parseProvider(value) {
 }
 function installDeclaredRouteProviders(state, pi, ctx) {
     const config = readMergedLaunchConfig(ctx.cwd, configuredValue(state, 'profileId', 'CRTR_PROFILE_ID') || null);
-    const providerIds = new Set(Object.values(config.modelRoutes ?? {}).map((route) => route.providerId));
+    const providerIds = new Set(Object.values({ ...(config.modelRoutes ?? {}), ...(config.legacyModelRoutes ?? {}) }).map((route) => route.providerId));
     for (const providerId of providerIds) {
         if (isManagedProvider(providerId) || state.delegatedProviderStreams.has(providerId))
             continue;
@@ -784,7 +789,7 @@ async function restoreHigherRankIfAvailable(state, pi, ctx) {
     if (!readRotationConfig().revertWhenAvailable)
         return false;
     const liveThinking = ctx.thinkingLevel === undefined || ctx.thinkingLevel === 'off' ? undefined : ctx.thinkingLevel;
-    const request = modelRequestFromConfig(`${ctx.model?.provider ?? ''}/${ctx.model?.id ?? ''}${liveThinking ? `:${liveThinking}` : ''}`, configuredValue(state, 'modelIntent', 'CRTR_MODEL_INTENT'), false);
+    const request = modelRequestFromConfig(`${ctx.model?.provider ?? ''}/${ctx.model?.id ?? ''}${liveThinking ? `:${liveThinking}` : ''}`, configuredValue(state, 'modelIntent', 'CRTR_MODEL_INTENT'), isExactModel(state));
     if (!request || !ctx.model)
         return false;
     const candidates = expandModelCandidates(request, configuredValue(state, 'nodeCwd', 'CRTR_NODE_CWD'), configuredValue(state, 'profileId', 'CRTR_PROFILE_ID'));

package/dist/builtin-pi-packages/pi-crtr-extensions/extensions/provider-rotation.ts

@@ -12,8 +12,7 @@ import {
   type OAuthAuth,
   type SimpleStreamOptions,
 } from '@earendil-works/pi-ai';
-import { streamSimple as streamAnthropicMessages } from '@earendil-works/pi-ai/api/anthropic-messages';
-import { streamSimple as streamOpenAICodexResponses } from '@earendil-works/pi-ai/api/openai-codex-responses';
+import { anthropicMessagesApi, openAICodexResponsesApi } from '@earendil-works/pi-ai/compat';
 import {
   ANTHROPIC_PROVIDER_ID,
   OPENAI_CODEX_PROVIDER_ID,
@@ -40,6 +39,7 @@ import {
 } from '../../../core/subscription-state.js';
 import { readMergedLaunchConfig } from '../../../core/config.js';
 import { expandModelCandidates, modelRequestFromConfig, probeRouteAvailability } from '../../../core/model-routes.js';
+import { envModelExact } from '../../../shared/env.js';
 import { ManagedProviderCoolingError } from '../../../core/runtime/managed-provider-cooling.js';
 
 // A response without Retry-After proves only that THIS attempt was throttled; it
@@ -67,6 +67,9 @@ const SUBSCRIPTION_LOCK_RETRY_BACKOFFS_MS = [25, 75, 150];
 // installed would recurse back into the route driver.
 type ProviderStream = (model: Model<any>, context: Context, options?: SimpleStreamOptions) => AssistantMessageEventStream;
 
+const { streamSimple: streamAnthropicMessages } = anthropicMessagesApi();
+const { streamSimple: streamOpenAICodexResponses } = openAICodexResponsesApi();
+
 export interface ProviderRotationOptions {
   modelIntent?: string;
   nodeCwd?: string;
@@ -91,6 +94,10 @@ function configuredValue(state: ProviderRotationState, key: keyof ProviderRotati
   return state.options === undefined ? process.env[envName] : state.options[key];
 }
 
+function isExactModel(state: ProviderRotationState): boolean {
+  return state.options === undefined && envModelExact();
+}
+
 type AttemptResult = {
   result: "success" | "rate_limited" | "transient_exhausted" | "fatal";
   retryAfterMs?: number;
@@ -726,7 +733,7 @@ async function runManagedProvider(
   const request = modelRequestFromConfig(
     `${model.provider}/${model.id}${liveThinking ? `:${liveThinking}` : ''}`,
     configuredValue(state, 'modelIntent', 'CRTR_MODEL_INTENT'),
-    false,
+    isExactModel(state),
   );
   const expanded = request ? expandModelCandidates(
     request,
@@ -936,7 +943,7 @@ function parseProvider(value: string | undefined): ManagedProviderId | undefined
 
 function installDeclaredRouteProviders(state: ProviderRotationState, pi: ExtensionAPI, ctx: ExtensionContext): void {
   const config = readMergedLaunchConfig(ctx.cwd, configuredValue(state, 'profileId', 'CRTR_PROFILE_ID') || null);
-  const providerIds = new Set(Object.values(config.modelRoutes ?? {}).map((route) => route.providerId));
+  const providerIds = new Set(Object.values({ ...(config.modelRoutes ?? {}), ...(config.legacyModelRoutes ?? {}) }).map((route) => route.providerId));
   for (const providerId of providerIds) {
     if (isManagedProvider(providerId) || state.delegatedProviderStreams.has(providerId)) continue;
     const provider = ctx.modelRegistry.getProvider?.(providerId);
@@ -963,7 +970,7 @@ async function restoreHigherRankIfAvailable(state: ProviderRotationState, pi: Ex
   const request = modelRequestFromConfig(
     `${ctx.model?.provider ?? ''}/${ctx.model?.id ?? ''}${liveThinking ? `:${liveThinking}` : ''}`,
     configuredValue(state, 'modelIntent', 'CRTR_MODEL_INTENT'),
-    false,
+    isExactModel(state),
   );
   if (!request || !ctx.model) return false;
   const candidates = expandModelCandidates(

package/dist/clients/attach/input/controller.d.ts

@@ -53,6 +53,10 @@ export declare class InputController {
     constructor(tui: TUI, editor: CustomEditor, keybindings: KeybindingsManager, hooks: InputControllerHooks, capabilities: ViewerCapabilities);
     cycleLadder(direction: 'forward' | 'backward'): void;
     sendInterrupting(text: string): boolean;
+    /** Cancel the running turn without sending a message — the ctrl+c "stop the
+     *  agent" chord. Mirrors Esc's abort semantics. Returns false when nothing is
+     *  streaming to cancel, so the caller can hint at detach instead. */
+    abortTurn(): boolean;
     attachDialog(request: RpcExtensionUIRequest): void;
     dismissDialog(id: string): void;
     setState(state: BrokerSnapshot['state']): void;

package/dist/clients/attach/input/controller.js

@@ -48,6 +48,14 @@ export class InputController {
     sendInterrupting(text) {
         return this.emitDrive({ type: 'prompt', text, interrupt: true });
     }
+    /** Cancel the running turn without sending a message — the ctrl+c "stop the
+     *  agent" chord. Mirrors Esc's abort semantics. Returns false when nothing is
+     *  streaming to cancel, so the caller can hint at detach instead. */
+    abortTurn() {
+        if (this.state?.isStreaming !== true)
+            return false;
+        return this.emitCommand({ type: 'abort' });
+    }
     attachDialog(request) {
         this.overlays.attachDialog(request);
     }

package/dist/clients/attach/session/bindings.d.ts

@@ -11,6 +11,9 @@ export declare function dispatchAttachAction(id: AttachBindingId, actions: Attac
 export declare function dispatchAttachBinding(bindings: AttachBindings, data: string, actions: AttachActions): boolean;
 export declare function dispatchAttachViewportBinding(bindings: AttachBindings, data: string, actions: AttachViewportActions): boolean;
 export declare function detachHint(bindings: AttachBindings): string | undefined;
+/** The dedicated detach binding's spelling (ctrl+d), for pointing the user at
+ *  detach now that a second ctrl+c cancels the running turn instead. */
+export declare function detachBindingHint(bindings: AttachBindings): string | undefined;
 /** Re-resolve the user's binding settings once and republish the same snapshot
  *  to every consumer: attach dispatch, the graph overlay, and tmux. Binding
  *  diagnostics must never fail an attach, so an install error is swallowed. */

package/dist/clients/attach/session/bindings.js

@@ -48,6 +48,13 @@ export function detachHint(bindings) {
     }
     return undefined;
 }
+/** The dedicated detach binding's spelling (ctrl+d), for pointing the user at
+ *  detach now that a second ctrl+c cancels the running turn instead. */
+export function detachBindingHint(bindings) {
+    return bindings.gestures('crtr.attach.detach').length > 0
+        ? formatBinding(bindings, 'crtr.attach.detach')
+        : undefined;
+}
 /** Re-resolve the user's binding settings once and republish the same snapshot
  *  to every consumer: attach dispatch, the graph overlay, and tmux. Binding
  *  diagnostics must never fail an attach, so an install error is swallowed. */

package/dist/clients/attach/session/keys.d.ts

@@ -23,6 +23,8 @@ export interface KeyHooks {
     rosterHandleKey: (data: string) => boolean;
     setNotice: (message: string) => void;
     detach: () => void;
+    /** Cancel the running turn (the second ctrl+c). Detach lives on its own binding. */
+    cancelTurn: () => void;
     toggleGraph: () => void;
     toggleHelp: () => void;
     /** Toggle the mounted inbox surface. */

package/dist/clients/attach/session/keys.js

@@ -10,7 +10,7 @@
 import { extractAttachControlInput } from '../../../core/keybindings/index.js';
 import { dispatchAttachAction, dispatchAttachBinding, dispatchAttachViewportBinding, } from './bindings.js';
 import { FOCUS_IN, FOCUS_OUT } from './focus-events.js';
-/** Press the clear-or-detach binding twice inside this window to detach. */
+/** Press the clear binding twice inside this window to cancel the running turn. */
 const CLEAR_OR_DETACH_MS = 1000;
 /** Install the listener; returns the remover, which teardown MUST call. */
 export function installGlobalKeys(ctx, hooks) {
@@ -22,12 +22,12 @@ export function installGlobalKeys(ctx, hooks) {
             const now = Date.now();
             if (now - lastClearOrDetachAt < CLEAR_OR_DETACH_MS) {
                 lastClearOrDetachAt = 0;
-                hooks.detach();
+                hooks.cancelTurn();
                 return;
             }
             lastClearOrDetachAt = now;
             editor.setText('');
-            hooks.setNotice(`Editor cleared — press ${hooks.detachHint()} again to detach`);
+            hooks.setNotice(`Editor cleared — press ${hooks.detachHint()} again to cancel the agent`);
             tui.requestRender();
         },
         'crtr.attach.graph.toggle': hooks.toggleGraph,

package/dist/clients/attach/session/whip-achievements.d.ts

@@ -0,0 +1,4 @@
+import type { AttachPalette } from '../config.js';
+/** Count one whip and celebrate the milestone it reaches, if any. Called once
+ *  per whip that actually reached the agent. */
+export declare function recordWhip(pal: AttachPalette, filePath?: string): void;