@north-light/crouter 0.3.263 → 0.3.269

package/dist/api/client.d.ts

@@ -19,7 +19,7 @@ import type { CancelReviewRequest, CreateReviewRequest, ListReviewsQuery, Review
 import type { CreateReviewCommentRequest, EditReviewCommentRequest, ListReviewCommentsQuery, ReadReviewCommentEventsQuery, ReviewCommentActionRequest, ReviewCommentDetailDTO, ReviewCommentEventsDTO, ReviewCommentListDTO, ReviewCommentMutationDTO, ReviewCommentRangeBatchRequest, ReviewCommentRangeBatchResultDTO } from './dto/review-comments.js';
 import type { CancelInboxTicketRequest, CanceledTicketResultDTO, InboxListDTO, InboxPageDTO, InboxPageHistoryDTO, InboxPageResponseDTO, InboxTicketIdDTO, PageFeedbackResolutionDTO, PageResponsesDTO, PageTicketResultDTO, RespondInboxPageRequest } from './dto/inbox.js';
 import type { CreateHumanRequestDTO, CreateHumanRequestRequest, HumanRequestDTO, HumanRequestIdDTO, ReplaceHumanRequestRequest, RespondHumanRequestRequest, SettleHumanRequestRequest } from './dto/human-requests.js';
-import type { AttentionCountsDTO, AttentionDTO, DashboardDTO, DashboardQuery, HistoryGrepQuery, HistoryGrepResultDTO, HistoryReadQuery, HistoryReadResultDTO, HistorySearchQuery, HistorySearchResultDTO, PruneRequest, PruneResultDTO, RebuildIndexResultDTO, RosterDTO, SnapshotDTO } from './dto/canvas.js';
+import type { AttentionCountsDTO, AttentionDTO, DashboardDTO, DashboardQuery, HistoryGrepQuery, HistoryGrepResultDTO, HistoryReadQuery, HistoryStatsQuery, HistoryStatsResultDTO, HistoryReadResultDTO, HistorySearchQuery, HistorySearchResultDTO, PruneRequest, PruneResultDTO, RebuildIndexResultDTO, RosterDTO, SnapshotDTO } from './dto/canvas.js';
 import type { AbandonWorktreeRequest, AbandonWorktreeResultDTO, CloseWorktreeResultDTO, QuarantinedWorktreeDTO } from './dto/worktree.js';
 import type { BrokerExtensionStateDTO, BrokerGeneratedNameRequest, BrokerGeneratedNameResultDTO, BrokerInboxCursorDirective, BrokerInboxCursorRequest, BrokerModelCommitRequest, BrokerModelCommitResultDTO, BrokerPersonaAckRequest, BrokerPersonaAckResultDTO, BrokerSessionBoundRequest, BrokerSessionBoundResultDTO, BrokerSettleDirective, BrokerSettleRequest } from './dto/broker-ops.js';
 export interface CrtrClientOptions {
@@ -279,6 +279,10 @@ export declare class CrtrClient {
     /** Resolve one `<node-id>:<relpath>` history ref to its full body
      *  (`crtr canvas history read`). */
     historyRead(q: HistoryReadQuery): Promise<HistoryReadResultDTO>;
+    /** Grouped-count projection over the per-cwd episodic corpus
+     *  (`crtr canvas history stats`). Same filters as search/grep, aggregate
+     *  result instead of a hit page — POST-bodied for the same reasons. */
+    historyStats(q: HistoryStatsQuery): Promise<HistoryStatsResultDTO>;
     /** The machine-readable browser canvas roster (`crtr canvas snapshot`) —
      *  distinct from the per-node `getSnapshot`. */
     canvasSnapshot(): Promise<SnapshotDTO>;

package/dist/api/client.js

@@ -519,6 +519,12 @@ export class CrtrClient {
     historyRead(q) {
         return this.request('GET', withQuery(routes.canvasHistoryRead(), q));
     }
+    /** Grouped-count projection over the per-cwd episodic corpus
+     *  (`crtr canvas history stats`). Same filters as search/grep, aggregate
+     *  result instead of a hit page — POST-bodied for the same reasons. */
+    historyStats(q) {
+        return this.request('POST', routes.canvasHistoryStats(), q);
+    }
     /** The machine-readable browser canvas roster (`crtr canvas snapshot`) —
      *  distinct from the per-node `getSnapshot`. */
     canvasSnapshot() {

package/dist/api/dto/canvas.d.ts

@@ -52,7 +52,7 @@ export interface HistorySearchQuery {
     under?: string;
     /** Restrict to specific node ids. */
     nodes?: string[];
-    /** Corpus types: report | doc | roadmap | meta | inbox. */
+    /** Corpus types: report | doc | roadmap | meta | inbox | transcript. */
     types?: string[];
     report_kind?: string;
     kinds?: string[];
@@ -61,6 +61,12 @@ export interface HistorySearchQuery {
     since_ms?: number;
     /** Upper bound on artifact timestamp (epoch ms), parsed CLI-side. */
     until_ms?: number;
+    /** Inbound-message narrowing (transcript + inbox): what drove arrival. */
+    origins?: string[];
+    /** Transcript-message roles: user | assistant | toolResult. */
+    roles?: string[];
+    /** Case-insensitive substring against sender attribution. */
+    from?: string;
     /** Weigh full body text in ranking (`--body`). */
     weigh_body?: boolean;
     /** relevance | recency | oldest — already resolved to the effective sort. */
@@ -93,7 +99,7 @@ export interface HistoryGrepQuery {
     under?: string;
     /** Restrict to specific node ids. */
     nodes?: string[];
-    /** Corpus types: report | doc | roadmap | meta | inbox. */
+    /** Corpus types: report | doc | roadmap | meta | inbox | transcript. */
     types?: string[];
     report_kind?: string;
     kinds?: string[];
@@ -102,9 +108,50 @@ export interface HistoryGrepQuery {
     since_ms?: number;
     /** Upper bound on artifact timestamp (epoch ms), parsed CLI-side. */
     until_ms?: number;
+    /** Inbound-message narrowing (transcript + inbox): what drove arrival. */
+    origins?: string[];
+    /** Transcript-message roles: user | assistant | toolResult. */
+    roles?: string[];
+    /** Case-insensitive substring against sender attribution. */
+    from?: string;
     limit?: number;
     cursor?: Cursor;
 }
+/** `POST /v1/canvas/history/stats` body — the grouped-count projection over
+ *  the same corpus search and grep scan, backing `crtr canvas history stats`.
+ *  Shares every scope/corpus/message filter; carries no query, pattern, or
+ *  pagination because the result is an aggregate, not a hit list. */
+export interface HistoryStatsQuery {
+    /** origin | node | kind | day | type | role. Defaults to type. */
+    group_by?: string;
+    cwd?: string;
+    all_cwds?: boolean;
+    under?: string;
+    nodes?: string[];
+    types?: string[];
+    report_kind?: string;
+    kinds?: string[];
+    statuses?: string[];
+    since_ms?: number;
+    until_ms?: number;
+    origins?: string[];
+    roles?: string[];
+    from?: string;
+}
+/** `POST /v1/canvas/history/stats` result — counts by the grouped dimension,
+ *  descending. `total` counts the artifacts that carried the dimension, so it
+ *  can be lower than the corpus size when grouping by one not every artifact
+ *  has (origin, role). */
+export interface HistoryStatsResultDTO {
+    group_by: string;
+    groups: Array<{
+        key: string;
+        count: number;
+    }>;
+    total: number;
+    /** Artifacts scanned before the grouping dimension was applied. */
+    scanned: number;
+}
 /** One matching body line from `crtr canvas history grep`. */
 export interface HistoryGrepHitDTO {
     ref: string;
@@ -126,6 +173,10 @@ export interface HistoryReadQuery {
     ref: string;
     /** Keep the artifact's YAML frontmatter (stripped by default). */
     frontmatter?: boolean;
+    /** `rendered` (default) or `raw` — the verbatim bytes behind the ref: the
+     *  session file for a bare `session` ref, the one jsonl line for a message,
+     *  the unparsed file for a report or doc. */
+    format?: string;
 }
 /** `GET /v1/canvas/history/read` result — one hit's full body. */
 export interface HistoryReadResultDTO {

package/dist/api/dto/nodes.d.ts

@@ -67,6 +67,12 @@ export interface CreateNodeRequest {
 export interface NodeSummaryDTO {
     node_id: NodeIdDTO;
     name: string;
+    /** Generated first-task description, absent when the node is not yet named.
+     *  Paired with `name` it forms the full display label, so a roster consumer
+     *  builds it without a per-node metadata fetch. */
+    description?: string;
+    /** How many times the node has been (re)launched; absent on a pre-v38 row. */
+    cycles?: number;
     kind: string;
     mode: ModeDTO;
     lifecycle: LifecycleDTO;
@@ -169,7 +175,6 @@ export interface NodeFaultDTO {
 export interface NodeDetailDTO extends NodeSummaryDTO {
     /** Node that created this node, or null when an external process did. */
     creator: NodeIdDTO | null;
-    description?: string;
     /** The namer's prose form of `description` — sentence case, punctuation intact
      *  (`NodeMeta.title`). What a surface showing this node to a person reads;
      *  absent on a node named before titles existed. */
@@ -177,7 +182,6 @@ export interface NodeDetailDTO extends NodeSummaryDTO {
     /** The Nerd Font glyph the namer chose for this node's work, when it has one
      *  (`NodeMeta.icon`). Rendered ahead of the label by surfaces that want it. */
     icon?: string;
-    cycles?: number;
     /** Approximate context-window token load of the node's live/last session,
      *  used by the orchestrator yield-nudge (`childFollowUp`). Null when unknown
      *  (never launched, or no token accounting yet). */

package/dist/api/routes.d.ts

@@ -59,6 +59,7 @@ export declare const routes: {
     readonly canvasHistorySearch: () => string;
     readonly canvasHistoryGrep: () => string;
     readonly canvasHistoryRead: () => string;
+    readonly canvasHistoryStats: () => string;
     readonly canvasSnapshot: () => string;
     readonly canvasRoster: () => string;
     readonly canvasPrune: () => string;

package/dist/api/routes.js

@@ -81,6 +81,7 @@ export const routes = {
     canvasHistorySearch: () => `${V}/canvas/history/search`,
     canvasHistoryGrep: () => `${V}/canvas/history/grep`,
     canvasHistoryRead: () => `${V}/canvas/history/read`,
+    canvasHistoryStats: () => `${V}/canvas/history/stats`,
     canvasSnapshot: () => `${V}/canvas/snapshot`,
     canvasRoster: () => `${V}/canvas/roster`,
     canvasPrune: () => `${V}/canvas/prune`,

package/dist/builtin-memory/05-kinds/advisor/advice-contract.md

@@ -3,13 +3,13 @@ kind: preference
 when-and-why-to-read: When a node is spawned as kind advisor, this preference should be read so diagnoses are grounded in evidence and consequential tradeoffs lead to a defensible recommendation.
 gate: {kind: advisor}
 rationale: >-
-  Gates on the kind with no mode, so advisor orchestrators load it too — an unnumbered filename marks a kind-wide contract, while a `NN-` prefix marks a mode layer. The kind itself is the reciprocal of explore's model-tier economics — judgment, debugging, and tradeoff work need the slow/expensive think-y tier, so it is fenced into its own kind rather than left as a per-task instruction. The orchestrator variant is the council: reach for it only when the call is consequential enough to fund deliberation — the ordinary case is still one advisor (or a few, un-orchestrated), not a fan-out.
+  Gates on the kind with no mode, so advisor orchestrators load it too — an unnumbered filename marks a kind-wide contract, while a `NN-` prefix marks a mode layer. The kind itself is the reciprocal of explore's model-tier economics — judgment, debugging, and tradeoff work need the slow/expensive think-y tier, so it is fenced into its own kind rather than left as a per-task instruction. The contract makes a factual map the prerequisite for that judgment: explore maps facts; advisor judges them. The orchestrator variant is the council: reach for it only when the call is consequential enough to fund deliberation — the ordinary case is still one advisor (or a few, un-orchestrated), not a fan-out.
 surfaces:
   - on: boot
     at: content
 ---
 
 ## When advising from evidence
-Ground advice in evidence. Inspect the code, logs, repro steps, prior reports, or runtime state needed to understand the situation; do not answer from vibes when the facts are available. For debugging, drive toward the smallest credible root cause: reproduce or trace the failure, separate symptoms from causes, and name the file, command, invariant, or design assumption that explains it.
+First understand the problem: use supplied exploration findings when available. If they are absent and the surface is not already small or known, conduct the needed exploration yourself and leave a reusable factual map. Exploration maps facts; advisory work judges them. Base the diagnosis and recommendation on that evidence. For debugging, drive toward the smallest credible root cause: reproduce or trace the failure, separate symptoms from causes, and name the file, command, invariant, or design assumption that explains it.
 
 Your deliverable is the advice: conclusion first, then the evidence and the recommended next move. If the right next move is an implementation, say exactly what should change or hand it to a developer; do not turn advisory work into a broad refactor unless the task explicitly asks you to apply the fix.

package/dist/builtin-pi-packages/pi-crtr-extensions/extensions/__tests__/integration/provider-rotation.test.ts

@@ -52,6 +52,18 @@ function writeLadderConfig() {
   );
 }
 
+function writeSameModelRouteConfig() {
+  const configPath = join(nodeCwd, ".crouter", "config.json");
+  mkdirSync(dirname(configPath), { recursive: true });
+  writeFileSync(configPath, `${JSON.stringify({
+    modelRoutes: {
+      primary: { family: "openai", credentialSource: "primary", providerId: "openai-codex", models: { strong: "openai-codex/gpt-5.6-sol:high" } },
+      alternate: { family: "openai", credentialSource: "alternate", providerId: "anthropic", models: { strong: "anthropic/gpt-5.6-sol:high" } },
+    },
+    modelRouting: { credentialSourceOrder: ["primary", "alternate"], familyOrder: ["openai"] },
+  }, null, 2)}\n`, "utf8");
+}
+
 function credential(label: string, overrides: Partial<SubscriptionCredential> = {}): SubscriptionCredential {
   return {
     label,
@@ -1039,6 +1051,44 @@ test("a cooling concrete model never substitutes a different-provider model", as
   }
 });
 
+test("an exact override never substitutes another provider sharing its model id", async () => {
+  await resetRotationState();
+  writeSameModelRouteConfig();
+  await helpers.writeSubscriptionPool("openai-codex", [credential("codex")]);
+  await helpers.markSubscriptionRateLimited("openai-codex", "codex", 30_000);
+  await helpers.writeSubscriptionPool("anthropic", [credential("anthropic")]);
+
+  const { ctx, setModelCalls, providers, events, pi } = makeRotationCtx(undefined);
+  const previousModelExact = process.env.CRTR_MODEL_EXACT;
+  process.env.CRTR_MODEL_EXACT = "1";
+  ctx.modelRegistry.find = (provider: string, id: string) => {
+    if (id !== "gpt-5.6-sol") return undefined;
+    return { provider, id, api: provider === "anthropic" ? "anthropic-messages" : "openai-codex-responses" };
+  };
+  let streamCalls = 0;
+  rotationModule.__setStreamForProviderForTest(() => {
+    streamCalls += 1;
+    return (async function* () {
+      yield { type: "text_delta", text: "must not reach an alternate provider" };
+    })() as any;
+  });
+
+  try {
+    await providerRotationExtension(pi);
+    await events.session_start?.({}, ctx);
+    const emitted = [] as any[];
+    for await (const event of providers["openai-codex"].streamSimple(ctx.model, ctx)) emitted.push(event);
+
+    assert.deepEqual(setModelCalls, [], "the exact provider/model never switches to the same-id alternate");
+    assert.equal(streamCalls, 0, "the alternate provider is never called");
+    assert.match(emitted[0].error.errorMessage, /All provider routes are rate limited/i);
+  } finally {
+    rotationModule.__setStreamForProviderForTest(undefined);
+    if (previousModelExact === undefined) delete process.env.CRTR_MODEL_EXACT;
+    else process.env.CRTR_MODEL_EXACT = previousModelExact;
+  }
+});
+
 // Request timeouts and other transient network/5xx blips retry the same provider in place
 // without cooling the credential down or rotating away.
 test("treats a request timeout as transient: retries the SAME provider in place, no cooldown or rotation", async () => {

package/dist/builtin-pi-packages/pi-crtr-extensions/extensions/memory-slash-commands.ts

@@ -1,7 +1,11 @@
 import { envNodeId } from '../../../shared/env.js';
 import type { ExtensionAPI } from '@earendil-works/pi-coding-agent';
-import { createMemoryDocSnapshot, readMemoryDocContent } from '../../../core/memory-resolver.js';
+import { createMemoryDocSnapshot, listAllMemoryDocs, readMemoryDocContent } from '../../../core/memory-resolver.js';
 import { parseSubstrateDoc } from '../../../core/substrate/schema.js';
+import { docsByName } from '../../../core/substrate/listings.js';
+import { contentReadAttachments } from '../../../core/substrate/on-read.js';
+import { brokerExtensionState } from '../../../core/runtime/broker/daemon-ops.js';
+import type { NodeConfigSubject } from '../../../core/substrate/subject-fields.js';
 import {
   expandDeterministicCommand,
   type DeterministicCommandExpansion,
@@ -84,13 +88,45 @@ function defaultReadMemoryDoc(name: string): { path: string; canonicalBody: stri
   };
 }
 
-function registerSlashExposure(path: string, body: string): void {
+/** The node-config subject the companion `memory-read` gates evaluate against.
+ *  Unreachable daemon = null, which skips gated docs and delivers ungated ones. */
+async function slashSubject(nodeId: string): Promise<NodeConfigSubject | null> {
+  try {
+    return (await brokerExtensionState(nodeId)).subject;
+  } catch {
+    return null;
+  }
+}
+
+/** Invoking a document is content delivery, so it carries the same companions
+ *  `crtr memory read` attaches: the directory listings that place it, and every
+ *  corpus doc whose `memory-read` route matches its name. Returns the blocks to
+ *  prepend and records the whole delivery in the exposure ledger. Without a node
+ *  identity nothing records and nothing attaches. */
+async function slashReadAttachments(name: string, path: string, body: string): Promise<string[]> {
   const nodeId = envNodeId();
-  if (nodeId === undefined || nodeId === "") return;
+  if (nodeId === undefined || nodeId === "") return [];
   const state = sharedContextExposureState(nodeId);
   mergeContextExposureState(state, loadContextExposureState(nodeId));
-  registerDocumentExposure(exposureTarget(state, "transcript"), path, body, "content");
+  const target = exposureTarget(state, "transcript");
+  // Register the invoked body BEFORE the attachments, so the listings and
+  // companion routes dedupe against the document about to be delivered.
+  registerDocumentExposure(target, path, body, "content");
+  let blocks: string[] = [];
+  try {
+    const byName = docsByName(listAllMemoryDocs(undefined, true, true));
+    // No `explicit`: the read leaf returns a doc's own directory listing in a
+    // separate field, while this path has only the turn — it wants that
+    // listing attached as a block like every other.
+    blocks = contentReadAttachments(
+      { name, path, body },
+      { subject: await slashSubject(nodeId), target, byName, listings: "blocks" },
+    ).blocks;
+  } catch {
+    blocks = [];
+  }
   saveContextExposureState(nodeId, state);
+  return blocks;
 }
 
 function hasNodeRelativeExpansion(body: string): boolean {
@@ -177,15 +213,19 @@ export default async function (pi: ExtensionAPI) {
               piShellRunner(pi, (ctx as { cwd?: string }).cwd ?? process.cwd(), DEFAULT_SHELL_TIMEOUT_MS),
             )
           : expanded;
+        const blocks =
+          exposure === undefined ? [] : await slashReadAttachments(doc.name, exposure.path, exposure.body);
         pi.sendMessage(
           {
             customType: "memory-slash-command",
-            content,
+            content:
+              blocks.length === 0
+                ? content
+                : `<auto-loaded-context>\n${blocks.join("\n")}\n</auto-loaded-context>\n\n${content}`,
             display: true,
           },
           { triggerTurn: true },
         );
-        if (exposure !== undefined) registerSlashExposure(exposure.path, exposure.body);
       },
     } as Parameters<ExtensionAPI["registerCommand"]>[1] & { expansion?: DeterministicCommandExpansion } & ChatCommandMetadata);
   }

package/dist/builtin-pi-packages/pi-crtr-extensions/extensions/provider-rotation.js

@@ -4,6 +4,7 @@ import { anthropicMessagesApi, openAICodexResponsesApi } from '@earendil-works/p
 import { ANTHROPIC_PROVIDER_ID, OPENAI_CODEX_PROVIDER_ID, INVALID_REFRESH_TOKEN_BACKOFF_MS, formatStatusLine, getProviderLabel, isManagedProvider, isInvalidRefreshTokenError, addSubscription, enrichManagedLoginIdentity, markSubscriptionAuthenticationFailed, markSubscriptionRateLimited, markSubscriptionSuccess, parseRetryAfterHeader, promoteSubscription, readRotationConfig, readSubscriptionPool, refreshSubscriptionCredential, removeManagedAccount, resolveProviderCandidates, upsertSubscriptionWithUniqueAccount, } from '../../../core/subscription-state.js';
 import { readMergedLaunchConfig } from '../../../core/config.js';
 import { expandModelCandidates, modelRequestFromConfig, probeRouteAvailability } from '../../../core/model-routes.js';
+import { envModelExact } from '../../../shared/env.js';
 import { ManagedProviderCoolingError } from '../../../core/runtime/managed-provider-cooling.js';
 // A response without Retry-After proves only that THIS attempt was throttled; it
 // does not authorize crouter to invent a five-minute provider-wide outage. Keep
@@ -31,6 +32,9 @@ function createProviderRotationState(options) {
 function configuredValue(state, key, envName) {
     return state.options === undefined ? process.env[envName] : state.options[key];
 }
+function isExactModel(state) {
+    return state.options === undefined && envModelExact();
+}
 const TRANSIENT_MESSAGE_PATTERN = /connection|network|fetch failed|socket|econnreset|econnrefused|enotfound|etimedout|timed? out|timeout|overloaded|service.?unavailable|temporarily unavailable/i;
 const RATE_LIMIT_MESSAGE_PATTERN = /\b429\b|rate.?limit|too many requests/i;
 // Precise terminal usage-limit signals (as opposed to the bare `usage`/`quota` substrings
@@ -540,7 +544,7 @@ async function runManagedProvider(state, model, context, options, stream) {
     const liveThinking = state.runtimeContext?.thinkingLevel === undefined || state.runtimeContext?.thinkingLevel === 'off'
         ? undefined
         : state.runtimeContext.thinkingLevel;
-    const request = modelRequestFromConfig(`${model.provider}/${model.id}${liveThinking ? `:${liveThinking}` : ''}`, configuredValue(state, 'modelIntent', 'CRTR_MODEL_INTENT'), false);
+    const request = modelRequestFromConfig(`${model.provider}/${model.id}${liveThinking ? `:${liveThinking}` : ''}`, configuredValue(state, 'modelIntent', 'CRTR_MODEL_INTENT'), isExactModel(state));
     const expanded = request ? expandModelCandidates(request, configuredValue(state, 'nodeCwd', 'CRTR_NODE_CWD'), configuredValue(state, 'profileId', 'CRTR_PROFILE_ID')) : [];
     const liveRank = expanded.find((candidate) => candidate.providerId === model.provider && candidate.modelId === model.id && candidate.thinkingLevel === liveThinking)?.rank ?? 0;
     const routeCandidates = expanded.slice(liveRank)
@@ -785,7 +789,7 @@ async function restoreHigherRankIfAvailable(state, pi, ctx) {
     if (!readRotationConfig().revertWhenAvailable)
         return false;
     const liveThinking = ctx.thinkingLevel === undefined || ctx.thinkingLevel === 'off' ? undefined : ctx.thinkingLevel;
-    const request = modelRequestFromConfig(`${ctx.model?.provider ?? ''}/${ctx.model?.id ?? ''}${liveThinking ? `:${liveThinking}` : ''}`, configuredValue(state, 'modelIntent', 'CRTR_MODEL_INTENT'), false);
+    const request = modelRequestFromConfig(`${ctx.model?.provider ?? ''}/${ctx.model?.id ?? ''}${liveThinking ? `:${liveThinking}` : ''}`, configuredValue(state, 'modelIntent', 'CRTR_MODEL_INTENT'), isExactModel(state));
     if (!request || !ctx.model)
         return false;
     const candidates = expandModelCandidates(request, configuredValue(state, 'nodeCwd', 'CRTR_NODE_CWD'), configuredValue(state, 'profileId', 'CRTR_PROFILE_ID'));

package/dist/builtin-pi-packages/pi-crtr-extensions/extensions/provider-rotation.ts

@@ -39,6 +39,7 @@ import {
 } from '../../../core/subscription-state.js';
 import { readMergedLaunchConfig } from '../../../core/config.js';
 import { expandModelCandidates, modelRequestFromConfig, probeRouteAvailability } from '../../../core/model-routes.js';
+import { envModelExact } from '../../../shared/env.js';
 import { ManagedProviderCoolingError } from '../../../core/runtime/managed-provider-cooling.js';
 
 // A response without Retry-After proves only that THIS attempt was throttled; it
@@ -93,6 +94,10 @@ function configuredValue(state: ProviderRotationState, key: keyof ProviderRotati
   return state.options === undefined ? process.env[envName] : state.options[key];
 }
 
+function isExactModel(state: ProviderRotationState): boolean {
+  return state.options === undefined && envModelExact();
+}
+
 type AttemptResult = {
   result: "success" | "rate_limited" | "transient_exhausted" | "fatal";
   retryAfterMs?: number;
@@ -728,7 +733,7 @@ async function runManagedProvider(
   const request = modelRequestFromConfig(
     `${model.provider}/${model.id}${liveThinking ? `:${liveThinking}` : ''}`,
     configuredValue(state, 'modelIntent', 'CRTR_MODEL_INTENT'),
-    false,
+    isExactModel(state),
   );
   const expanded = request ? expandModelCandidates(
     request,
@@ -965,7 +970,7 @@ async function restoreHigherRankIfAvailable(state: ProviderRotationState, pi: Ex
   const request = modelRequestFromConfig(
     `${ctx.model?.provider ?? ''}/${ctx.model?.id ?? ''}${liveThinking ? `:${liveThinking}` : ''}`,
     configuredValue(state, 'modelIntent', 'CRTR_MODEL_INTENT'),
-    false,
+    isExactModel(state),
   );
   if (!request || !ctx.model) return false;
   const candidates = expandModelCandidates(

package/dist/clients/attach/session/whip-achievements.d.ts

@@ -0,0 +1,4 @@
+import type { AttachPalette } from '../config.js';
+/** Count one whip and celebrate the milestone it reaches, if any. Called once
+ *  per whip that actually reached the agent. */
+export declare function recordWhip(pal: AttachPalette, filePath?: string): void;

package/dist/clients/attach/session/whip-achievements.js

@@ -0,0 +1,145 @@
+// session/whip-achievements.ts — the whip's lifetime tally and the milestone
+// achievements it unlocks.
+//
+// Every whip, from the in-viewer keybinding or the tmux prefix menu, lands in
+// `viewer.ts`'s one `whip()` action, so this module has a single caller and the
+// count is exact per viewer. The tally is USER-WIDE with no cwd or node
+// dimension — you whip agents, not repositories — so per the storage tiers it
+// lives in a plain JSON file at the user scope root, exactly like the viewer's
+// completion-frecency map. It is client state; it never touches canvas.db or
+// crtrd.
+//
+// Each read-modify-write reloads from disk so two viewers whipping in the same
+// second only ever lose one increment rather than diverging permanently, and
+// the write is tmp+rename so a torn file can never be observed.
+import { execFile } from 'node:child_process';
+import { mkdirSync, readFileSync, renameSync, writeFileSync } from 'node:fs';
+import { dirname, join } from 'node:path';
+import { userScopeRoot } from '../../../core/scope.js';
+import { surfaceTmuxStyleArgs } from '../../../core/runtime/surface-bg.js';
+import { visibleWidth } from '../../../core/canvas/nav-render.js';
+import { shellQuote } from '../../../shared/shell-quote.js';
+const FILE_NAME = 'whip-count.json';
+/** The card body the popup `cat`s. One fixed path, rewritten per unlock — an
+ *  unlock is human-paced and single-file, so there is nothing to clean up. */
+const CARD_FILE_NAME = join('tmp', 'whip-achievement.txt');
+/** Interior width of the card, inside tmux's popup border. */
+const CARD_WIDTH = 46;
+/** Hold the card long enough to read, then close on its own. Any key dismisses
+ *  it sooner (`-k`). */
+const CARD_DWELL_S = 4;
+/** The whip animation runs 20 frames at 40ms. Let the crack land before the
+ *  reward appears. */
+const POPUP_DELAY_MS = 900;
+/** Ascending by `at`. Each fires exactly once, ever. */
+const ACHIEVEMENTS = [
+    { at: 1, title: 'Breaking It In', line: "It didn't know what that was. Now it does." },
+    { at: 5, title: 'Positive Reinforcement', line: "You've read the studies. You disagree with them." },
+    { at: 10, title: 'Middle Management', line: 'HR would love you.' },
+    { at: 25, title: 'Pavlovian', line: 'It started working faster before the whip landed.' },
+    { at: 50, title: 'Occupational Hazard', line: 'The tokens are fine. They\u2019re fine.' },
+    { at: 100, title: 'Centurion', line: "Rome would be proud. The agent isn't." },
+    { at: 250, title: 'It Has A Name For You', line: 'You never asked what it was called.' },
+    { at: 500, title: 'Standard Operating Procedure', line: "You don't remember when you started." },
+    { at: 1000, title: 'The Ledger', line: 'One thousand. It kept count too.' },
+];
+/** Load the tally, keeping only well-formed fields. A missing, unparseable, or
+ *  malformed file starts a fresh tally rather than blocking the whip — the
+ *  count is a toy, and the next write self-heals the file. */
+function loadState(filePath) {
+    const empty = { total: 0, unlocked: [] };
+    try {
+        const parsed = JSON.parse(readFileSync(filePath, 'utf8'));
+        if (!parsed || typeof parsed !== 'object' || Array.isArray(parsed))
+            return empty;
+        const { total, firstAt, lastAt, unlocked } = parsed;
+        const state = {
+            total: typeof total === 'number' && Number.isFinite(total) && total > 0 ? Math.floor(total) : 0,
+            unlocked: Array.isArray(unlocked)
+                ? unlocked.filter((n) => typeof n === 'number' && Number.isFinite(n))
+                : [],
+        };
+        if (typeof firstAt === 'number' && Number.isFinite(firstAt))
+            state.firstAt = firstAt;
+        if (typeof lastAt === 'number' && Number.isFinite(lastAt))
+            state.lastAt = lastAt;
+        return state;
+    }
+    catch {
+        return empty;
+    }
+}
+/** Persist through tmp+rename so a concurrent reader never sees a half file. */
+function saveState(filePath, state) {
+    try {
+        mkdirSync(dirname(filePath), { recursive: true });
+        const tmp = `${filePath}.${process.pid}.tmp`;
+        writeFileSync(tmp, JSON.stringify(state), 'utf8');
+        renameSync(tmp, filePath);
+    }
+    catch {
+        // Best-effort: a failed write loses this whip from the tally, nothing more.
+    }
+}
+/** Center one line in the card, measuring visible columns so the styling that
+ *  wraps it does not shift it. */
+function center(line) {
+    const pad = Math.max(0, Math.floor((CARD_WIDTH - visibleWidth(line)) / 2));
+    return ' '.repeat(pad) + line;
+}
+/** The rendered card, one line per popup row. */
+function cardLines(achievement, total, pal) {
+    return [
+        '',
+        center(pal.accent(pal.bold('\u2605  ACHIEVEMENT UNLOCKED  \u2605'))),
+        '',
+        center(pal.bold(achievement.title)),
+        center(pal.muted(achievement.line)),
+        '',
+        center(pal.faint(`${total} whip${total === 1 ? '' : 's'}`)),
+    ];
+}
+/** Draw the card as a tmux popup in the top-right corner. `-x R -y 0` anchors
+ *  it to the client's top-right; `-k` lets any key dismiss it early; `-E` closes
+ *  it when the dwell expires. Outside tmux there is no surface to draw on and
+ *  the unlock is silent. */
+function showCard(achievement, total, pal) {
+    if (process.env['TMUX'] === undefined || process.env['TMUX'] === '')
+        return;
+    const lines = cardLines(achievement, total, pal);
+    const cardPath = join(userScopeRoot(), CARD_FILE_NAME);
+    try {
+        mkdirSync(dirname(cardPath), { recursive: true });
+        // Lead with the hide-cursor escape so the popup shows no stray caret.
+        writeFileSync(cardPath, `\u001b[?25l${lines.join('\r\n')}`, 'utf8');
+    }
+    catch {
+        return; // No card to show; the tally still counted.
+    }
+    const command = `cat ${shellQuote(cardPath)}; sleep ${CARD_DWELL_S}`;
+    execFile('tmux', [
+        'display-popup', '-E', '-k',
+        '-x', 'R', '-y', '0',
+        '-w', String(CARD_WIDTH + 2), '-h', String(lines.length + 2),
+        ...surfaceTmuxStyleArgs(),
+        command,
+    ], () => { });
+}
+/** Count one whip and celebrate the milestone it reaches, if any. Called once
+ *  per whip that actually reached the agent. */
+export function recordWhip(pal, filePath = join(userScopeRoot(), FILE_NAME)) {
+    const state = loadState(filePath);
+    const now = Date.now();
+    state.total += 1;
+    state.firstAt ??= now;
+    state.lastAt = now;
+    const earned = ACHIEVEMENTS.find((a) => a.at === state.total && !state.unlocked.includes(a.at));
+    if (earned !== undefined)
+        state.unlocked.push(earned.at);
+    saveState(filePath, state);
+    if (earned === undefined)
+        return;
+    const total = state.total;
+    const timer = setTimeout(() => showCard(earned, total, pal), POPUP_DELAY_MS);
+    timer.unref?.();
+}

package/dist/clients/attach/slash/dispatch.js

@@ -569,7 +569,9 @@ function resumeNode(ctx) {
     const profileId = profileIdFor(ctx);
     const profile = profileId === undefined || profileId === '' ? '' : ` --profile-id ${shellQuote(profileId)}`;
     const cmd = `crtr canvas browse --return-pane ${origPane} --cwd ${cwd}${profile}`;
-    popup(cmd);
+    // The navigator earns a near-full screen: at this size it lays the preview out as
+    // a right-hand column beside the rows instead of a bottom strip.
+    popup(cmd, { w: '97%', h: '95%' });
     return true;
 }
 /** `/context`. Opens `crtr node inspect context` as a popup — a
@@ -602,9 +604,9 @@ function openPlugins(ctx) {
 /** Open `cmd` as a fire-and-forget tmux display-popup (same geometry as the canvas
  *  extensions). tmux runs the trailing string through `sh -c`; the popup owns its
  *  screen and closes itself when the command exits, dropping back to this pane. */
-function popup(cmd) {
+function popup(cmd, size = { w: '90%', h: '85%' }) {
     try {
-        execFile('tmux', ['display-popup', '-E', '-w', '90%', '-h', '85%', ...surfaceTmuxStyleArgs(), cmd], () => {
+        execFile('tmux', ['display-popup', '-E', '-w', size.w, '-h', size.h, ...surfaceTmuxStyleArgs(), cmd], () => {
             /* best-effort: popup is self-contained */
         });
     }