@north-light/crouter 0.3.281 → 0.3.283

package/dist/commands/pkg/plugin-manage.js

@@ -6,7 +6,9 @@ import { defineLeaf } from '../../core/command.js';
 import { notFound, usage, general, network } from '../../core/errors.js';
 import { findMarketplaceByName, findPluginByName, listAllPlugins } from '../../core/resolver.js';
 import { NEUTRAL_PROJECT_MEMORY, pluginsDir, ensureProjectScopeRoot, userScopeRoot, resolveScopeArg, projectScopeRoot, requireScopeRoot, } from '../../core/scope.js';
-import { updateConfig, updateState, ensureScopeInitialized, invalidPluginKindsReasons, invalidPluginBinReasons, invalidPluginRequiresReasons, normalizeRequires } from '../../core/config.js';
+import { readConfig, readState, updateConfig, updateState, ensureScopeInitialized, invalidPluginKindsReasons, invalidPluginBinReasons, invalidPluginRequiresReasons, normalizeRequires } from '../../core/config.js';
+import { withExclusiveDirectoryLockAsync } from '../../core/exclusive-lock.js';
+import { bundleSwapLockPath } from '../../core/plugin-swap-lock.js';
 import { invalidPageComponentsReasons } from '../../core/human/page-catalog.js';
 import { pathExists, ensureDir, removePath, nowIso, linkOrCopy, isSymlink, readSymlinkTarget, atomicWriteJson, readText, realpathOrSelf, walkFiles } from '../../core/fs-utils.js';
 import { clone, deriveNameFromUrl, currentSha, gitSync, isGitRepo } from '../../core/git.js';
@@ -317,26 +319,163 @@ function existingBundleRoot(name, scope, root) {
         rejectLegacyHttpPlugin(name);
     throw general(`plugin "${name}" already exists at ${root}; run \`crtr pkg plugin remove ${name}\` before installing the archive plugin.`);
 }
-async function replaceBundlePlugin(name, bundleSource, scope, options) {
+function resolveBundleTarget(name, bundleSource, scope, scopeRootPath) {
     const fetchTransport = validateHttpInstall(name, bundleSource.endpoint, bundleSource.authEnv);
     const bundle = { endpoint: fetchTransport.endpoint, ...(fetchTransport.authEnv !== undefined ? { authEnv: fetchTransport.authEnv } : {}) };
-    const transport = invocationTransport(bundle);
-    const scopeRootPath = scope === 'project' ? ensureProjectScopeRoot() : userScopeRoot();
     const root = join(scopeRootPath, 'plugins', name);
     existingBundleRoot(name, scope, root);
-    const fetched = await fetchHttpPluginBundle({ name, endpoint: bundle.endpoint, ...(bundle.authEnv !== undefined ? { authEnv: bundle.authEnv } : {}) });
-    if (fetched.status !== 200) {
-        const message = `HTTP plugin bundle fetch failed for "${name}": ${fetched.message}`;
-        if (fetched.status === 'auth_env_missing')
-            throw usage(message);
-        if (fetched.status === 'cli_unreachable')
-            throw network(message);
-        throw general(message);
-    }
-    const validated = await validatePluginBundle(fetched.raw, { reservedCoreNames: new Set(SUBTREE_NAMES), coreCommandPaths: await coreCommandPaths() });
+    return { bundle, transport: invocationTransport(bundle), scopeRootPath, root };
+}
+function fetchTarget(name, bundle) {
+    return { name, endpoint: bundle.endpoint, ...(bundle.authEnv !== undefined ? { authEnv: bundle.authEnv } : {}) };
+}
+/** A user-initiated install or update waits out another process's swap; the
+ *  background pass waits a shorter time, because a wait that long there means
+ *  the holder is wedged rather than merely slow. */
+const INSTALL_SWAP_WAIT_MS = 60_000;
+const REVALIDATE_SWAP_WAIT_MS = 10_000;
+/**
+ * Serialize a plugin's package replacement against every other crtr process.
+ *
+ * The whole transition runs inside — re-reading the stored validator, the
+ * conditional fetch, the identity check, the directory swap, and both ledger
+ * writes. Holding it across the FETCH is the point: a process that queued
+ * behind another's swap re-reads the validator the winner just stored, so it
+ * sends the fresh ETag and is answered 304, instead of downloading the archive
+ * it waited for and swapping in a package identical to the one already there.
+ *
+ * The lock lives beside the staging and `.prev` directories the swap itself
+ * uses, and a holder that dies releases it immediately (its marker names a dead
+ * pid), so a crashed swap cannot wedge the next one.
+ */
+async function withBundleSwapLock(name, scope, timeoutMs, run) {
+    const scopeRootPath = scope === 'project' ? ensureProjectScopeRoot() : userScopeRoot();
+    ensureDir(join(scopeRootPath, 'tmp'));
+    return withExclusiveDirectoryLockAsync(bundleSwapLockPath(scopeRootPath, name), () => run(scopeRootPath), {
+        timeoutMs,
+        timeoutError: () => general(`timed out waiting for another crtr process to finish replacing plugin "${name}"`, {
+            next: `Re-run once that process has finished, or check for a stalled crtr holding ${bundleSwapLockPath(scopeRootPath, name)}.`,
+        }),
+    });
+}
+async function replaceBundlePlugin(name, bundleSource, scope, options) {
+    return withBundleSwapLock(name, scope, INSTALL_SWAP_WAIT_MS, async (scopeRootPath) => {
+        const target = resolveBundleTarget(name, bundleSource, scope, scopeRootPath);
+        const fetched = await fetchHttpPluginBundle(fetchTarget(name, target.bundle));
+        if (fetched.status !== 200) {
+            const message = `HTTP plugin bundle fetch failed for "${name}": ${fetched.message}`;
+            if (fetched.status === 'auth_env_missing')
+                throw usage(message);
+            if (fetched.status === 'cli_unreachable')
+                throw network(message);
+            throw general(message);
+        }
+        return applyBundleArchive(name, scope, target, fetched.raw, fetched.etag, options);
+    });
+}
+/**
+ * Re-check an installed bundle plugin against its endpoint. A `conditional`
+ * check sends the validator stored for the package currently on disk, so an
+ * unchanged package is answered 304 and left untouched; an unconditional one
+ * asks for the archive outright, which is how recovery from a `manifest_stale`
+ * answer gets past a validator that is itself out of date.
+ *
+ * Returns the swap's report, or `undefined` when the package on disk is already
+ * the generation the server serves — whether the server said so with a 304 or
+ * we proved it by hashing bytes it re-sent.
+ *
+ * Every outcome, including a failure, records that the check happened, so an
+ * unreachable endpoint costs one timed-out probe per TTL rather than one per
+ * command. Failures throw; the caller decides whether a stale-but-present
+ * package is still good enough to run on.
+ */
+export async function revalidateBundlePlugin(name, bundleSource, scope, options) {
+    return withBundleSwapLock(name, scope, REVALIDATE_SWAP_WAIT_MS, async (scopeRootPath) => {
+        try {
+            const target = resolveBundleTarget(name, bundleSource, scope, scopeRootPath);
+            // Read INSIDE the lock: a process that queued behind another's swap must
+            // send the validator that swap stored, not the one it read before waiting.
+            const etag = options.conditional ? readState(scope).plugins[name]?.etag : undefined;
+            const fetchOptions = {
+                ...(etag !== undefined ? { ifNoneMatch: etag } : {}),
+                ...(options.timeoutMs !== undefined ? { timeoutMs: options.timeoutMs } : {}),
+            };
+            const fetched = await fetchHttpPluginBundle(fetchTarget(name, target.bundle), fetchOptions);
+            if (fetched.status === 304)
+                return undefined;
+            if (fetched.status !== 200) {
+                throw general(`HTTP plugin bundle revalidation failed for "${name}": ${fetched.message}`);
+            }
+            // A server with no validator, or one whose validator moved without the
+            // archive changing, re-sends bytes we already have unpacked. Swapping
+            // them in would rewrite the package root and republish an identical
+            // command tree for nothing, so hash first: identical bytes are a 304 that
+            // cost a download, and get a 304's answer.
+            const version = bundleVersion(fetched.raw);
+            if (isInstalledGeneration(name, scope, target.root, version)) {
+                recordCheckedGeneration(scope, name, fetched.etag, { swapped: false });
+                return undefined;
+            }
+            return await applyBundleArchive(name, scope, target, fetched.raw, fetched.etag, options, version);
+        }
+        finally {
+            // Widened to cover `resolveBundleTarget` as well as the fetch: a plugin
+            // whose endpoint no longer validates throws on every invocation, and
+            // without a recorded check it would throw on every invocation forever.
+            recordPluginCheck(scope, name);
+        }
+    });
+}
+/** Mark that the revalidation pass reached this plugin, whatever came of it.
+ *  Separate from the etag write, which only a served archive earns. */
+function recordPluginCheck(scope, name) {
+    updateState(scope, (state) => {
+        if (state.plugins[name] === undefined)
+            state.plugins[name] = {};
+        state.plugins[name].checked_at = nowIso();
+    });
+}
+/** The ledger for a check that reached a served archive. `swapped` says whether
+ *  that archive replaced the package on disk; the validator and the check time
+ *  are recorded either way, because both describe the bytes now at the root. */
+function recordCheckedGeneration(scope, name, etag, options) {
+    updateState(scope, (state) => {
+        if (state.plugins[name] === undefined)
+            state.plugins[name] = {};
+        if (options.swapped)
+            state.plugins[name].last_updated = nowIso();
+        state.plugins[name].checked_at = nowIso();
+        // The validator names the bytes now unpacked at `root`. A response that
+        // carried none clears it, so the next check cannot claim to hold a
+        // validator for a package it never received one for.
+        if (etag === undefined)
+            delete state.plugins[name].etag;
+        else
+            state.plugins[name].etag = etag;
+    });
+}
+/** The hash recorded as a bundle package's `version`: the exact archive bytes
+ *  unpacked at its root. Same bytes, same version — which is what lets a
+ *  re-sent archive be recognized as the generation already installed. */
+function bundleVersion(raw) {
+    return createHash('sha256').update(raw).digest('hex').slice(0, 12);
+}
+/** Whether `version` is the generation already unpacked at `root`. Both halves
+ *  matter: the recorded version says the config agrees, and `commands.json`
+ *  says the tree that config describes is actually on disk. A swap that died
+ *  between the rename and the config write leaves the second false, and that is
+ *  exactly the case a no-op must not claim. */
+function isInstalledGeneration(name, scope, root, version) {
+    if (readConfig(scope).plugins[name]?.version !== version)
+        return false;
+    return pathExists(join(root, 'commands.json'));
+}
+async function applyBundleArchive(name, scope, target, raw, etag, options, knownVersion) {
+    const { bundle, transport, scopeRootPath, root } = target;
+    const validated = await validatePluginBundle(raw, { reservedCoreNames: new Set(SUBTREE_NAMES), coreCommandPaths: await coreCommandPaths() });
     if (validated.bundle === undefined)
         throw invalidBundleError(`HTTP plugin bundle for "${name}" is invalid`, validated.issues);
-    const version = createHash('sha256').update(fetched.raw).digest('hex').slice(0, 12);
+    const version = knownVersion ?? bundleVersion(raw);
     const manifest = {
         name,
         version,
@@ -388,15 +527,19 @@ async function replaceBundlePlugin(name, bundleSource, scope, options) {
     finally {
         removePath(staging);
     }
+    // Directory swap, then the config's version, then the state's validator — in
+    // that order, and never the reverse. A process killed mid-sequence leaves the
+    // ledger naming an OLDER generation than the disk, which the next check
+    // repairs: the server 200s against a stale-or-absent validator, the hash says
+    // the tree on disk is already that generation, and only the ledger is
+    // rewritten. The forbidden state — a validator for a generation the disk does
+    // not have, and so a permanent 304 against a package that was never unpacked
+    // — is unreachable from this order.
     ensureScopeInitialized(scope, scopeRootPath);
     updateConfig(scope, (cfg) => {
         cfg.plugins[name] = { enabled: options.enable ? true : (cfg.plugins[name]?.enabled ?? true), version };
     });
-    updateState(scope, (state) => {
-        if (state.plugins[name] === undefined)
-            state.plugins[name] = {};
-        state.plugins[name].last_updated = nowIso();
-    });
+    recordCheckedGeneration(scope, name, etag, { swapped: true });
     const commands = await commandReport(name, scope);
     if (commands === undefined)
         throw general(`bundle plugin "${name}" has no staged command report`);
@@ -838,6 +981,13 @@ export const pluginRemove = defineLeaf({
             updateConfig(scope, (cfg) => {
                 delete cfg.plugins[name];
             });
+            // The state record describes a package that no longer exists. Leaving it
+            // would hand a later reinstall of the same name a validator for bytes it
+            // never fetched, and keep the revalidation pass considering a plugin that
+            // is gone.
+            updateState(scope, (state) => {
+                delete state.plugins[name];
+            });
             removedFrom.push(scope);
         }
         if (removedFrom.length === 0) {

package/dist/commands/profile/pause.js

@@ -1,5 +1,6 @@
 import { defineLeaf } from '../../core/command.js';
-import { resolveProfileOperand, pauseProfile, resumeProfile } from '../../core/profiles/manifest.js';
+import { resolveProfileOperand } from '../../core/profiles/manifest.js';
+import { cliClient, rethrowAsCliError } from '../api-client.js';
 const profileParam = {
     kind: 'positional',
     name: 'profile',
@@ -9,7 +10,7 @@ const profileParam = {
 export const pauseLeaf = defineLeaf({
     name: 'pause',
     description: 'make a profile inert',
-    whenToUse: 'new nodes and revives under a profile must stop while its running broker is allowed to finish its current turn.',
+    whenToUse: 'all work under a profile must stop now while in-flight bash commands continue under their detached supervisors.',
     help: {
         name: 'profile pause',
         summary: 'pause a profile so it creates and revives no nodes',
@@ -19,15 +20,16 @@ export const pauseLeaf = defineLeaf({
             { name: 'paused_at', type: 'string', required: true, constraint: 'ISO 8601 timestamp when the profile became inert.' },
         ],
         outputKind: 'object',
-        effects: ['Writes `paused_at` to the profile manifest. Existing brokers continue their current turn; queued inbox messages do not revive nodes until resume.'],
+        effects: ['Writes `paused_at`, SIGTERMs every live broker under the profile so its foreground bash hands off to its detached supervisor, and holds cron, deadline, revive, and inbox delivery until resume.'],
     },
     run: async (input) => {
         const { profileId } = resolveProfileOperand(input['profile']);
-        const { manifest } = pauseProfile(profileId);
-        return {
-            profile_id: profileId,
-            paused_at: manifest.paused_at,
-        };
+        try {
+            return { ...await cliClient().pauseProfile(profileId) };
+        }
+        catch (error) {
+            rethrowAsCliError(error);
+        }
     },
 });
 export const resumeLeaf = defineLeaf({
@@ -43,14 +45,15 @@ export const resumeLeaf = defineLeaf({
             { name: 'paused_at', type: 'null', required: true, constraint: 'Always null after resume; null means active.' },
         ],
         outputKind: 'object',
-        effects: ['Clears `paused_at` in the profile manifest. Future creates and revives are allowed.'],
+        effects: ['Clears `paused_at`, credits active node deadlines for the paused interval, and lets retained inbox mail, due crons, and interrupted turns resume.'],
     },
     run: async (input) => {
         const { profileId } = resolveProfileOperand(input['profile']);
-        const { manifest } = resumeProfile(profileId);
-        return {
-            profile_id: profileId,
-            paused_at: manifest.paused_at,
-        };
+        try {
+            return { ...await cliClient().resumeProfile(profileId) };
+        }
+        catch (error) {
+            rethrowAsCliError(error);
+        }
     },
 });

package/dist/commands/push.js

@@ -2,6 +2,7 @@
 //
 //   crtr push update [body]   — report progress to subscribers
 //   crtr push final  [body]   — finish: write result, mark node done, close window
+//   crtr push result [json]   — answer a pending structured-output request
 //
 // "push" is THE verb a node uses to talk to its managers. `update` reports
 // progress; its --tier sets delivery urgency. The caller's node is resolved from
@@ -39,6 +40,106 @@ const PUSH_WHEN_TO_USE = {
     update: 'you have progress worth surfacing to your managers while work remains in flight. Use normal delivery unless it can wait for their next real wake (--tier deferred) or needs immediate attention (--tier urgent); use push final only when the work is actually done.',
     final: 'the work this node was spawned to do is complete and you are ready to hand back the canonical result — this writes that result, marks the node done, and closes its window, so it is the LAST thing you do here, not a progress note. Use push update while work is still in flight, and do not reach for final on a node working directly with the user: it has no manager to report up to and would close mid-conversation (the guard blocks it unless you pass --force after the user confirms).',
 };
+/** `crtr push result` — submit the JSON answer to a pending structured-output
+ *  request. A pure API client like its siblings: JSON is parsed client-side
+ *  only to fail fast with a clean error; validation against the schema, the
+ *  result write, the report push, and the schema clear all happen server-side
+ *  in `POST /nodes/{id}/result`. */
+function makeResultLeaf() {
+    return defineLeaf({
+        name: 'result',
+        description: 'answer a pending structured-output request with the required JSON result, or decline it',
+        whenToUse: 'your system prompt names a pending structured-output request you must answer. The value is validated against the required schema server-side; a mismatch rejects with field errors and records nothing, so fix and rerun. When the schema cannot be honestly satisfied (blocked, unavailable, bad input), pass `--decline "<reason>" --code <token>` (plus `--retryable` when the same request could succeed later) instead of inventing a value; your requester names the code tokens it accepts. For a terminal request either path IS how the node finishes — never call `crtr push final` alongside it.',
+        help: {
+            name: 'push result',
+            summary: 'answer a pending structured-output request',
+            params: [
+                { kind: 'stdin', name: 'value', required: false, constraint: "The JSON result. Pipe it from a single-quoted heredoc (`<<'EOF'`) to preserve literal bytes. Required unless `--decline` is passed." },
+                { kind: 'flag', name: 'decline', type: 'string', required: false, constraint: 'Decline instead of answering: one plain sentence on why the schema cannot be honestly satisfied (blocked, unavailable, bad input). Requires `--code`. Records a failure outcome with reason `declined` carrying the reason, code, and retryable flag, and clears the request; for a terminal request this finishes the node.' },
+                { kind: 'flag', name: 'code', type: 'string', required: false, constraint: 'With `--decline`: one whitespace-free token (≤ 64 chars) naming the decline class. crouter carries it verbatim; the requester validates it against the tokens it documented for you.' },
+                { kind: 'flag', name: 'retryable', type: 'bool', required: false, default: false, constraint: 'With `--decline`: the same request could succeed if issued again later (a transient block). Omit when the decline is final for this input.' },
+            ],
+            output: [
+                { name: 'mode', type: 'string', required: true, constraint: 'Which request this answered: `terminal` finished the node; `oneoff` left it working.' },
+                { name: 'result_path', type: 'string', required: true, constraint: 'Absolute path of the recorded artifact: the result JSON, or the declined marker when `--decline` was passed.' },
+                { name: 'declined', type: 'object', required: false, constraint: 'Present only when the request was declined: { reason, code, retryable } as recorded.' },
+                { name: 'report_path', type: 'string', required: true, constraint: 'Absolute path of the report pushed alongside the result.' },
+                { name: 'notified', type: 'string[]', required: true, constraint: 'Subscriber node ids that received an inbox pointer.' },
+                { name: 'transitioned', type: 'object', required: false, constraint: 'Present only for a terminal request that flipped the node — { from, to } lifecycle-status transition applied server-side.' },
+            ],
+            outputKind: 'object',
+            effects: [
+                'Validates the value against the pending schema server-side; a mismatch records nothing and the request stays pending.',
+                'Writes the accepted result to nodes/<nodeId>/context/result.json (or the decline to context/declined.json) and clears the pending request.',
+                'A terminal decline records a `failure` outcome with reason `declined` whose `declined` field carries { reason, code, retryable }; the requester sees no value.',
+                'Pushes the mode-matched report: final for a terminal request (the node finishes — same effects as `push final`), update for a one-off request (the node keeps working).',
+            ],
+        },
+        run: async (input) => {
+            const nodeId = requireCallerNode();
+            const decline = typeof input['decline'] === 'string' ? input['decline'].trim() : '';
+            const code = typeof input['code'] === 'string' ? input['code'].trim() : '';
+            let request;
+            if (decline !== '') {
+                if (code === '') {
+                    throw new InputError({ error: 'missing_decline_code', message: 'a decline needs a code', field: 'code', next: 'Pass `--code <token>` — the whitespace-free token your requester documented for this decline class.' });
+                }
+                request = { decline, code, retryable: input['retryable'] === true };
+            }
+            else {
+                if (code !== '' || input['retryable'] === true) {
+                    throw new InputError({ error: 'decline_flags_without_decline', message: '--code and --retryable only apply with --decline', next: 'Pass `--decline "<reason>"` alongside them, or drop them and submit the JSON result.' });
+                }
+                let raw = typeof input['value'] === 'string' ? input['value'].trim() : '';
+                if (raw === '')
+                    raw = (await readStdinRaw()).trim();
+                if (raw === '') {
+                    throw new InputError({ error: 'missing_value', message: 'no result value', field: 'value', next: 'Pass the JSON result as an argument or on stdin, or `--decline "<reason>" --code <token>` when the schema cannot be honestly satisfied.' });
+                }
+                let value;
+                try {
+                    value = JSON.parse(raw);
+                }
+                catch (err) {
+                    throw new InputError({
+                        error: 'bad_result_json',
+                        message: `the result is not valid JSON: ${err.message}`,
+                        field: 'value',
+                        next: 'Pass one valid JSON value matching the requested schema.',
+                    });
+                }
+                request = { value };
+            }
+            try {
+                const result = await cliClient().submitResult(nodeId, request);
+                if (result.mode === 'terminal')
+                    markStopSignal(nodeId, 'pushedFinal');
+                return {
+                    mode: result.mode,
+                    result_path: result.result_path,
+                    report_path: result.report_path,
+                    notified: result.notified,
+                    ...(result.declined === undefined ? {} : { declined: result.declined }),
+                    ...(result.transitioned !== undefined ? { transitioned: result.transitioned } : {}),
+                    ...(result.worktree_auto_dropped === true
+                        ? { worktree_auto_dropped: true, worktree_auto_dropped_path: result.worktree_auto_dropped_path }
+                        : {}),
+                };
+            }
+            catch (err) {
+                rethrowAsCliError(err);
+            }
+        },
+        render: (r) => {
+            const declined = r['declined'];
+            const line = r['mode'] === 'terminal'
+                ? `${declined ? 'Decline recorded' : 'Result recorded'} — node finished; its engine shuts down on next stop. Nothing more to do here: STOP your turn immediately. Reply with just "Done." and nothing else.`
+                : `${declined ? 'One-off request declined' : 'One-off result recorded'} and pushed — the structured-output gate is cleared; continue working normally.`;
+            const declinedLine = declined === undefined ? '' : `\n- code: ${declined.code} (${declined.retryable ? 'retryable' : 'not retryable'})`;
+            return `${line}\n\n- ${declined ? 'declined' : 'result'}: ${r['result_path']}${declinedLine}\n- report: ${r['report_path']}`;
+        },
+    });
+}
 function makePushLeaf(kind) {
     return defineLeaf({
         name: kind,
@@ -159,6 +260,6 @@ export function registerPush() {
             summary: 'push a report to your subscribers',
             model: "A push writes a markdown report to the node's reports/ history and fans a lightweight pointer to every subscriber's inbox. Delivery inlines reports under 1,000 characters with their absolute path; larger reports remain pointers to dereference. Nothing is pushed automatically — the feed contains only what a node pushes explicitly, so push whenever you want a manager to see something. Pipe markdown via a single-quoted heredoc so it reaches the report literally. `push final` is how ANY node finishes: write the canonical result, mark done, close the window.",
         },
-        children: [makePushLeaf('update'), makePushLeaf('final')],
+        children: [makePushLeaf('update'), makePushLeaf('final'), makeResultLeaf()],
     });
 }

package/dist/commands/sys/__tests__/setup-core.test.js

@@ -14,7 +14,10 @@ test('resolveBundledPiCliPath uses crouter bundled pi instead of a standalone pi
     try {
         const cliPath = resolveBundledPiCliPath();
         assert.equal(existsSync(cliPath), true);
-        assert.match(cliPath, /@earendil-works[\/]pi-coding-agent[\/]dist[\/]cli\.js$/);
+        // The path INSIDE the package is pi's own layout (0.84.4 moved it to
+        // dist/bundle/cli.js) and is read from its package.json `bin.pi` — assert
+        // only that we resolved into the bundled package.
+        assert.match(cliPath, /@earendil-works[\/]pi-coding-agent[\/].*cli\.js$/);
     }
     finally {
         if (prevPath === undefined)

package/dist/commands/sys/panels/broker-limits-panel.js

@@ -69,8 +69,14 @@ export class BrokerLimitsPanel {
             this.move(1);
         else if (matches("crtr.setup.list-up", data))
             this.move(-1);
+        // DEL (\x7f) is what terminals send for backspace and its code point sits
+        // above the control range, so it has to be excluded here or editing an
+        // existing value is refused as a non-digit keystroke.
         else if (data.length > 0 &&
-            [...data].every((char) => char.codePointAt(0) >= 32))
+            [...data].every((char) => {
+                const code = char.codePointAt(0);
+                return code >= 32 && code !== 127;
+            }))
             this.notice = "Broker limits accept digits only.";
         else {
             this.selected().handleInput(data);

package/dist/commands/sys/panels/models-panel.js

@@ -1,5 +1,5 @@
 import { envProfileId } from '../../../shared/env.js';
-import { ModelSelectorComponent, SettingsManager, ThinkingSelectorComponent, } from '@earendil-works/pi-coding-agent';
+import { ModelSelectorComponent, ThinkingSelectorComponent, } from '@earendil-works/pi-coding-agent';
 import { Input, truncateToWidth } from '@earendil-works/pi-tui';
 import { basename, dirname, join } from 'node:path';
 import { ANTHROPIC_PROVIDER_ID, OPENAI_CODEX_PROVIDER_ID, isManagedProvider, readSubscriptionPool, } from '../../../core/subscription-state.js';
@@ -744,7 +744,7 @@ export class ModelsPanel {
         this.notify();
     }
     showModelSelector(scoped, current, onPick) {
-        this.modelSelector = new ModelSelectorComponent(this.tui, current, SettingsManager.inMemory(), this.runtime, scoped.map((model) => ({ model })), onPick, () => this.closePicker());
+        this.modelSelector = new ModelSelectorComponent(this.tui, current, this.runtime, scoped.map((model) => ({ model })), onPick, () => this.closePicker());
         this.modelSelector.focused = true;
         this.mode = "model-picker";
         this.notify();

package/dist/commands/sys/settings-shell.d.ts

@@ -1,7 +1,7 @@
 import { ModelRegistry, ModelRuntime } from '@earendil-works/pi-coding-agent';
 import { TUI, type Component, type Focusable } from '@earendil-works/pi-tui';
 import { type BindingId, type BindingResolution } from '../../core/keybindings/index.js';
-export type DestinationId = "providers" | "models" | "keybindings" | "display" | "profiles" | "panes" | "broker-limits" | "updates";
+export type DestinationId = "providers" | "models" | "provider-options" | "keybindings" | "display" | "profiles" | "panes" | "broker-limits" | "updates";
 export declare class SettingsShell implements Component, Focusable {
     private readonly tui;
     private readonly bindings;

package/dist/commands/sys/settings-shell.js

@@ -66,6 +66,12 @@ export class SettingsShell {
                 label: "Models",
                 panel: this.models,
             },
+            {
+                id: "provider-options",
+                group: "Intelligence",
+                label: "Provider options",
+                panel: prefs("providers", "Provider options", "How a provider serves your turns, once it is authenticated."),
+            },
             {
                 id: "keybindings",
                 group: "Interface",

package/dist/commands/sys/settings.js

@@ -9,11 +9,11 @@ import { BROKER_LIMIT_OVERRIDE_PRECEDENCE } from './setup.js';
 /** Rail destinations, in rail order. Kept here rather than imported from the
  *  shell so registering the `sys` subtree still costs no pi module graph. */
 const PAGES = [
-    'providers', 'models', 'keybindings', 'display', 'profiles', 'panes', 'broker-limits', 'updates',
+    'providers', 'models', 'provider-options', 'keybindings', 'display', 'profiles', 'panes', 'broker-limits', 'updates',
 ];
 export const sysSettingsLeaf = defineLeaf({
     name: 'settings',
-    description: 'open the settings page — providers, models, keybindings, display, profiles, panes, broker limits, updates',
+    description: 'open the settings page — providers, models, provider options, keybindings, display, profiles, panes, broker limits, updates',
     whenToUse: 'the user wants to change crouter configuration interactively. Agents should use sys config get/set, which is scriptable; sys setup installs a fresh machine.',
     help: {
         name: 'sys settings',
@@ -31,7 +31,7 @@ export const sysSettingsLeaf = defineLeaf({
         output: [],
         outputKind: 'object',
         effects: [
-            'Opens a pi-tui page whose left rail groups ongoing configuration: Intelligence (providers, models), Interface (keybindings, display), and Workspace (profiles, panes, broker limits, updates).',
+            'Opens a pi-tui page whose left rail groups ongoing configuration: Intelligence (providers, models, provider options), Interface (keybindings, display), and Workspace (profiles, panes, broker limits, updates).',
             'Profiles edits are immediate: adding or removing a project directory, cycling its memory rung, setting a home, renaming, pausing and pinning a directory default all write the same profile manifests and pin file as the `crtr profile` leaves; deleting a profile runs the same cascade as `crtr profile delete --force`.',
             'Preference, model-ladder and keybinding edits save to the user config as you make them; saved keybinding changes also refresh crouter-owned tmux bindings without overwriting occupied user keys.',
             `Broker warning and automatic-revive hard-cap values save under user config brokerThresholds; crtrd reads them on its next supervision tick. ${BROKER_LIMIT_OVERRIDE_PRECEDENCE}`,

package/dist/core/__tests__/fixtures/fake-engine.d.ts

@@ -171,6 +171,8 @@ declare class FakeSession {
     get model(): FakeModel | undefined;
     private currentModel;
     private currentThinkingLevel;
+    private bashAbort;
+    private bashRun;
     get thinkingLevel(): ThinkingLevel | undefined;
     setThinkingLevel(level: ThinkingLevel): void;
     cycleThinkingLevel(): ThinkingLevel;

package/dist/core/__tests__/fixtures/fake-engine.js

@@ -35,6 +35,7 @@ import { join, dirname } from 'node:path';
 import { randomUUID } from 'node:crypto';
 import { DefaultResourceLoader, getAgentDir } from '@earendil-works/pi-coding-agent';
 import { MANAGED_PROVIDER_COOLING_DIAGNOSTIC } from '../../runtime/managed-provider-cooling.js';
+import registerCanvasBashValve, { createValveOperations } from '../../../pi-extensions/canvas-bash-valve.js';
 /** Test seams for prompt-scoped failures before session_start. The one-shot
  *  variant records its first failure per node so the next cycling retry can
  *  reach boot confirmation. */
@@ -369,6 +370,8 @@ class FakeSession {
     // this getter — store whatever it hands us.
     currentModel;
     currentThinkingLevel;
+    bashAbort;
+    bashRun;
     get thinkingLevel() {
         return this.currentThinkingLevel;
     }
@@ -517,10 +520,12 @@ class FakeSession {
     }
     abort() {
         const held = this.heldTurn;
-        if (held === undefined)
-            return Promise.resolve();
-        held.release();
-        return held.settled;
+        if (held !== undefined) {
+            held.release();
+            return held.settled;
+        }
+        this.bashAbort?.abort();
+        return this.bashRun ?? Promise.resolve();
     }
     /** In-place tree rewind (broker `navigate_tree`). Mirrors the real SDK's
      *  contract: the session file is unchanged, the live history is truncated,
@@ -975,6 +980,39 @@ class FakeSession {
                     tool: cmd.tool,
                 });
                 break;
+            case 'bash': {
+                const nodeId = process.env['CRTR_NODE_ID'];
+                const contextDir = process.env['CRTR_CONTEXT_DIR'];
+                if (nodeId === undefined || contextDir === undefined)
+                    throw new Error('bash control requires canvas node paths');
+                this.streaming = true;
+                await this.fire('agent_start', {}, ctx);
+                this.emit({ type: 'agent_start' });
+                // The resource loader imports extensions through jiti while this fixture
+                // imports its valve operations through Node. Register the same module
+                // instance here so its SIGTERM listener owns this real test job too.
+                registerCanvasBashValve({ on: () => { } });
+                const controller = new AbortController();
+                this.bashAbort = controller;
+                const run = createValveOperations(nodeId, contextDir).exec(cmd.command ?? 'true', process.cwd(), {
+                    onData: () => { },
+                    signal: controller.signal,
+                }).then(() => { });
+                this.bashRun = run;
+                try {
+                    await run;
+                }
+                finally {
+                    this.bashAbort = undefined;
+                    this.bashRun = undefined;
+                    this.streaming = false;
+                }
+                await this.fire('agent_end', { messages: [] }, ctx);
+                this.emit({ type: 'agent_end', messages: [], willRetry: false });
+                await this.fire('agent_settled', { type: 'agent_settled' }, ctx);
+                this.emit({ type: 'agent_settled' });
+                break;
+            }
             case 'turn':
                 this.streaming = true;
                 await this.fire('agent_start', {}, ctx);

package/dist/core/__tests__/helpers/harness.d.ts

@@ -49,6 +49,7 @@ export interface SpawnOpts {
     mode?: Mode;
     lifecycle?: Lifecycle;
     model?: string;
+    profile?: string | null;
     id?: string;
 }
 /** Fabricate a broker-hosted node row directly — tmux-free, boot-free, NO

package/dist/core/__tests__/helpers/harness.js

@@ -514,6 +514,7 @@ export async function createHarness(opts = {}) {
                 ...(o.mode !== undefined ? { mode: o.mode } : {}),
                 ...(o.lifecycle !== undefined ? { rootLifecycle: o.lifecycle } : {}),
                 ...(o.model !== undefined ? { model: o.model } : {}),
+                ...(o.profile !== undefined ? { profile: o.profile } : {}),
             });
             await harness.awaitBoot(result.node.node_id);
             return result.node.node_id;
@@ -572,6 +573,14 @@ export async function createHarness(opts = {}) {
                     `pi_pid_identity=${n?.pi_pid_identity ?? 'null'} status=${n?.status ?? 'null'} ` +
                     `intent=${n?.intent ?? 'null'} pi_session_id=${n?.pi_session_id ?? 'null'} ` +
                     `bootCount=${bootCount(nodeId)} minCount=${minCount}\n`);
+                // Diagnostic (2026-09-03 CI investigation): confirm or rule out the
+                // backoff-gated respawn path (fleet.ts #respawn's `assess` branch)
+                // stranding this row behind a `respawn_not_before` window that never
+                // gets a further h.tick() to clear it, since awaitBoot itself never
+                // ticks. Remove once the real CI failure is diagnosed.
+                process.stderr.write(`[awaitBoot] respawn state: respawn_failures=${n?.respawn_failures ?? 'null'} ` +
+                    `respawn_not_before=${n?.respawn_not_before ?? 'null'} launched_at=${n?.launched_at ?? 'null'} ` +
+                    `last_settled_at=${n?.last_settled_at ?? 'null'} now=${new Date().toISOString()}\n`);
                 // Identity-aware liveness: what does the current process state say about recorded identity?
                 if (n?.pi_pid !== null && n?.pi_pid !== undefined) {
                     const liveness = recordedPidLiveness(n.pi_pid, n.pi_pid_identity);

package/dist/core/__tests__/integration/plugin-revalidate.test.d.ts

@@ -0,0 +1 @@
+export {};