@north-light/crouter 0.3.311 → 0.3.313

package/dist/core/canvas/executions.js

@@ -0,0 +1,68 @@
+import { randomUUID } from 'node:crypto';
+import { openDb, withCanvasWrite } from './db.js';
+import { capturePidIdentities, identitiesMatch, isBootScopedIdentity, isLegacyTicksIdentity } from './pid.js';
+function now() {
+    return new Date().toISOString();
+}
+function hydrate(row) {
+    return {
+        executionId: row['execution_id'],
+        nodeId: row['node_id'],
+        daemonEpoch: row['daemon_epoch'] ?? null,
+        pid: row['pid'] ?? null,
+        processIdentity: row['process_identity'] ?? null,
+        state: row['state'],
+        startedAt: row['started_at'],
+        endedAt: row['ended_at'] ?? null,
+        exitReason: row['exit_reason'] ?? null,
+    };
+}
+export function liveExecutionForNode(nodeId) {
+    const row = openDb().prepare("SELECT * FROM executions WHERE node_id = ? AND state != 'exited'").get(nodeId);
+    return row === undefined ? null : hydrate(row);
+}
+export function beginExecution(nodeId, input) {
+    return withCanvasWrite((db) => {
+        const at = now();
+        db.prepare("UPDATE executions SET state = 'exited', ended_at = ?, exit_reason = 'superseded' WHERE node_id = ? AND state != 'exited'").run(at, nodeId);
+        const executionId = randomUUID();
+        db.prepare("INSERT INTO executions (execution_id, node_id, daemon_epoch, pid, process_identity, state, started_at, ended_at, exit_reason) VALUES (?, ?, ?, NULL, NULL, 'launching', ?, NULL, NULL)").run(executionId, nodeId, input.daemonEpoch, at);
+        return executionId;
+    });
+}
+/** Returns shutdown when a late broker references an execution no longer live. */
+export function recordExecutionPid(executionId, nodeId, pid) {
+    const identity = capturePidIdentities([pid])?.get(pid) ?? null;
+    return withCanvasWrite((db) => {
+        const launching = db.prepare("UPDATE executions SET pid = ?, process_identity = ?, state = 'running' WHERE execution_id = ? AND node_id = ? AND state = 'launching'").run(pid, identity, executionId, nodeId);
+        if (launching.changes > 0)
+            return 'recorded';
+        const running = db.prepare("SELECT pid FROM executions WHERE execution_id = ? AND node_id = ? AND state = 'running'").get(executionId, nodeId);
+        return running?.pid === pid ? 'recorded' : 'shutdown';
+    });
+}
+export function endExecution(executionId, input) {
+    return Number(openDb().prepare("UPDATE executions SET state = 'exited', ended_at = ?, exit_reason = ? WHERE execution_id = ? AND state != 'exited'").run(now(), input.reason, executionId).changes) === 1;
+}
+export function abortExecution(executionId, input) {
+    return endExecution(executionId, input);
+}
+export function endLiveExecution(nodeId, input) {
+    return Number(openDb().prepare("UPDATE executions SET state = 'exited', ended_at = ?, exit_reason = ? WHERE node_id = ? AND state != 'exited'").run(now(), input.reason, nodeId).changes) === 1;
+}
+export function migrateLegacyExecutionIdentities(captureIdentity = (pid) => capturePidIdentities([pid])?.get(pid)) {
+    const db = openDb();
+    const rows = db.prepare("SELECT execution_id, pid, process_identity FROM executions WHERE state = 'running' AND pid IS NOT NULL AND process_identity IS NOT NULL").all();
+    const update = db.prepare("UPDATE executions SET process_identity = ? WHERE execution_id = ? AND pid = ? AND process_identity = ? AND state = 'running'");
+    const migrated = [];
+    for (const row of rows) {
+        if (!isLegacyTicksIdentity(row.process_identity))
+            continue;
+        const current = captureIdentity(row.pid);
+        if (current === undefined || !isBootScopedIdentity(current) || !identitiesMatch(current, row.process_identity))
+            continue;
+        if (update.run(current, row.execution_id, row.pid, row.process_identity).changes > 0)
+            migrated.push(row.execution_id);
+    }
+    return { migrated };
+}

package/dist/core/canvas/history.js

@@ -4,16 +4,16 @@
 // there plus the artifacts it left — its `reports/` (append-only push history:
 // final/update/urgent outcome summaries) and `context/` docs (specs, designs,
 // roadmaps, findings). This module is the ONE place that scans that corpus; it
-// lives in the canvas data-access layer, so it resolves every node + path
-// through canvas.ts + paths.ts and never hand-joins. No persistent index —
-// node facets (cwd/kind/status) are filtered cheaply against the db FIRST, then
-// only the surviving nodes' artifact files are read. FTS5/bm25 is the future
-// upgrade; the surface above is backend-independent.
+// lives in the canvas data-access layer, so it resolves every node and artifact
+// path through canvas.ts + paths.ts. Node facets (cwd/kind/status) are filtered
+// in SQL first, then only the surviving nodes' artifact files are read. FTS5/bm25
+// is the future upgrade; the surface above is backend-independent.
 import { envNodeId } from '../../shared/env.js';
 import { statSync, readdirSync } from 'node:fs';
 import { join, relative, sep } from 'node:path';
 import { getNode, listNodes, view } from './canvas.js';
-import { contextDir, reportsDir, nodeDir, inboxPath, sessionPtrPath } from './paths.js';
+import { contextDir, reportsDir, nodeDir } from './paths.js';
+import { openDb } from './db.js';
 import { readTextIfExists, walkFiles, pathExists } from '../fs-utils.js';
 import { parseFrontmatterGeneric } from '../frontmatter.js';
 import { warn } from '../output.js';
@@ -149,17 +149,23 @@ function docArtifact(row, desc, abs) {
         loadBody: load,
     };
 }
-/** Every entry ever appended to a node's inbox.jsonl, oldest first, cursor-
- *  independent (the cursor only gates the live wake path, not this read).
- *  Empty when the node has no inbox file yet. */
+/** Every active-inbox delivery ever recorded for a node, including canceled
+ *  and acknowledged deliveries. Message sequence is the durable replacement
+ *  for the old file's physical append order. */
 function allInboxEntries(nodeId) {
-    const raw = readTextIfExists(inboxPath(nodeId));
-    if (raw === null)
-        return [];
-    return raw
-        .split('\n')
-        .filter((l) => l.trim() !== '')
-        .map((l) => JSON.parse(l));
+    const rows = openDb().prepare(`SELECT m.created_at, m.sender_node_id, d.urgency, m.kind, m.label, m.body_ref, m.body_json
+       FROM deliveries d JOIN messages m ON m.message_id = d.message_id
+      WHERE d.destination_kind = 'node_inbox' AND d.destination_id = ? AND d.wake = 1
+      ORDER BY m.seq, d.created_at, d.delivery_id`).all(nodeId);
+    return rows.map((row) => ({
+        ts: row.created_at,
+        from: row.sender_node_id,
+        tier: row.urgency,
+        kind: row.kind,
+        label: row.label,
+        ref: row.body_ref,
+        data: row.body_json === null ? null : JSON.parse(row.body_json),
+    }));
 }
 function reportBodyFromRef(ref) {
     try {
@@ -187,16 +193,19 @@ function reportBodyFromRef(ref) {
 function inboxEntryBody(e) {
     const meta = [`from: ${e.from ?? 'system'}`, `tier: ${e.tier}`].join('\n');
     const header = `[${e.kind}] ${e.label}`;
-    const inlinePreview = typeof e.data?.['body'] === 'string' ? e.data['body'].trim() : '';
-    const isSpilledMessage = typeof e.data?.['body'] === 'string';
-    const full = e.ref !== undefined
+    const dataBody = typeof e.data === 'object' && e.data !== null && !Array.isArray(e.data)
+        ? e.data['body']
+        : undefined;
+    const inlinePreview = typeof dataBody === 'string' ? dataBody.trim() : '';
+    const isSpilledMessage = typeof dataBody === 'string';
+    const full = e.ref !== null
         ? isSpilledMessage
             ? (readTextIfExists(e.ref) ?? '')
             : reportBodyFromRef(e.ref) ?? fileBodyLoader(e.ref).load()
         : inlinePreview;
     const hasBody = full !== '' && full !== e.label;
     const parts = [meta, header];
-    if (e.ref !== undefined)
+    if (e.ref !== null)
         parts.push(`ref: ${e.ref}`);
     if (hasBody)
         parts.push(full);
@@ -229,21 +238,12 @@ function inboxArtifact(row, desc, entry, index) {
         a.from = entry.from;
     return a;
 }
-/** The node's session `.jsonl`, or null when nothing has been written yet. pi
- *  binds the path at session creation but writes the file on the FIRST appended
- *  entry, so a fresh node has a bound path that is not yet on disk. Mirrors
- *  `runtime/node-read.ts`'s resolution: the recorded path first, then the
- *  `session.ptr` the node dir carries. */
+/** The node's SQL-recorded session `.jsonl`, or null when nothing has been
+ *  written yet. Pi binds the path at session creation but writes the file on the
+ *  first appended entry, so a fresh node may have a path that is not on disk. */
 function resolveSessionFile(nodeId) {
-    const node = getNode(nodeId);
-    const recorded = node?.pi_session_file;
-    if (typeof recorded === 'string' && recorded !== '' && pathExists(recorded))
-        return recorded;
-    const raw = readTextIfExists(sessionPtrPath(nodeId));
-    if (raw === null)
-        return null;
-    const target = raw.trim();
-    return target !== '' && pathExists(target) ? target : null;
+    const recorded = getNode(nodeId)?.pi_session_file;
+    return typeof recorded === 'string' && recorded !== '' && pathExists(recorded) ? recorded : null;
 }
 /** The searchable text of a message's content blocks. `thinking` blocks are
  *  deliberately dropped: private model reasoning is excluded from every human
@@ -478,7 +478,7 @@ function warnInvalidFrontmatter(path, error) {
     const message = (error instanceof Error ? error.message : String(error)).split('\n')[0];
     warn(`invalid frontmatter in ${path}: ${message}`);
 }
-/** The node desc lives in meta.json, not the row — read it once per survivor. */
+/** Read a node description once for each surviving SQL row. */
 function nodeDescOf(nodeId) {
     const n = getNode(nodeId);
     return n?.description ?? '';

package/dist/core/canvas/index.d.ts

@@ -2,10 +2,12 @@ export * from './types.js';
 export * from './labels.js';
 export * from './paths.js';
 export * from './canvas.js';
+export * from './executions.js';
+export * from './sessions.js';
+export * from './worktrees.js';
 export * from './source.js';
 export * from './history.js';
 export * from './focuses.js';
 export * from './crons.js';
-export * from './node-outcome-deliveries.js';
 export * from './telemetry.js';
 export { openDb, closeDb } from './db.js';

package/dist/core/canvas/index.js

@@ -4,10 +4,12 @@ export * from './types.js';
 export * from './labels.js';
 export * from './paths.js';
 export * from './canvas.js';
+export * from './executions.js';
+export * from './sessions.js';
+export * from './worktrees.js';
 export * from './source.js';
 export * from './history.js';
 export * from './focuses.js';
 export * from './crons.js';
-export * from './node-outcome-deliveries.js';
 export * from './telemetry.js';
 export { openDb, closeDb } from './db.js';

package/dist/core/canvas/migrations.js

@@ -3,7 +3,7 @@
 // `PRAGMA user_version`: schema DDL, one-time data backfills, and the
 // journaled on-disk-lane splice (`../../migrations/registry.ts`'s
 // `journaled` entries, appended at the tail of `MIGRATIONS`). A step here
-// runs inside `db.ts`'s per-open `migrate()`, exactly once per database,
+// runs through the daemon's explicit `migrate()` startup call, exactly once per database,
 // transactionally.
 //
 // The other two homes:
@@ -21,6 +21,10 @@
 // `db.ts` itself keeps only connection management (`openDb`/`withCanvasWrite`
 // /`closeDb`) and re-exports `migrate`/`MIGRATIONS` from here so external
 // imports are unaffected by this split.
+import { importNodeSqlAuthority } from './node-sql-migration.js';
+import { migrateRecoveryWitnesses } from './recovery.js';
+import { migrateMessagingState } from './deliveries.js';
+import { migrateHumanRequestsState } from '../human/requests.js';
 import { existsSync, readFileSync, readdirSync, realpathSync } from 'node:fs';
 import { basename, join, resolve } from 'node:path';
 import { crtrHome, isSafeNodeId, nodesRoot, nodeMetaPath } from './paths.js';
@@ -730,9 +734,8 @@ function reapRunningPredicateEvaluations(db) {
 /** v22 — migrate each scheduled action into a shell cron, preserving its id and
  * execution context, then remove the superseded table.
  *
- * SKIP-AND-RECORD, never throw. `migrate()` runs on every `openDb()`, so a
- * migration that hard-fails on data shape would make EVERY crtr process fail to
- * open the canvas forever. Rows the retired schema declared legal but this step
+ * SKIP-AND-RECORD, never throw. A migration that hard-fails on data shape would
+ * block daemon startup. Rows the retired schema declared legal but this step
  * cannot express (unknown action/timing pairs, a missing fire time, drifted
  * JSON) are skipped, named in the `canvas_meta` ledger under
  * `migration.v22.skipped`, and warned about — the schema always advances.
@@ -974,11 +977,7 @@ CREATE INDEX IF NOT EXISTS idx_warm_pool_recipe ON warm_pool(recipe_key, created
  *  crtrd re-verify that a Visual event arrived through crouter's own
  *  registered handler argv — that registry is deleted in this landing, so
  *  there is nothing left to bind. `dir`/`root` collapse into `ticket_node_id`,
- *  the bridge node id a ticket's directory is derived from at every call site
- *  (`ticketDir(nodeId)` in `src/core/human/root.ts`) — `basename(dir)` IS that
- *  node id today, already relied on as such at
- *  `src/daemon/api/handlers/human.ts:290` (`const jobId = basename(dir)`) and
- *  `src/core/canvas/attention.ts:21`.
+ *  the bridge node id stored as `basename(dir)` in the input rows.
  *
  *  THIS IS A TABLE REBUILD, NOT `ALTER TABLE … DROP COLUMN`: six of the nine
  *  existing indexes are on `dir` (`idx_consult_outbox_dir`,
@@ -1459,6 +1458,12 @@ export const MIGRATIONS = [
     /* v38 */ addNodeLabelColumns,
     /* v39 */ addNodeOutcomeAndDeadline,
     ...JOURNALED_STATE_MIGRATIONS,
+    (db) => {
+        importNodeSqlAuthority(db);
+        migrateRecoveryWitnesses(db);
+        migrateMessagingState(db);
+        migrateHumanRequestsState(db);
+    },
 ];
 /** Migration indexes that manage their OWN transaction and therefore must not
  *  be wrapped by `migrate()` — `node:sqlite` rejects a nested BEGIN. Index 3
@@ -1467,8 +1472,7 @@ export const MIGRATIONS = [
  *  documents its own crash-safety: a partial rebuild rolls back and a re-run
  *  over an already-rebuilt table is idempotent. (Entering `migrate()` from
  *  INSIDE a caller's transaction with `user_version` still at 3 would make that
- *  internal BEGIN nest and throw — pre-existing and unreachable from `openDb()`,
- *  which migrates in autocommit.) */
+ *  internal BEGIN nest and throw; daemon startup calls it in autocommit.) */
 const SELF_TRANSACTIONAL_MIGRATIONS = new Set([3]);
 function currentUserVersion(db) {
     return db.prepare('PRAGMA user_version').get().user_version;
@@ -1492,7 +1496,11 @@ function applyMigration(db, v) {
  *  acquiring it so a step another process just applied is skipped rather than
  *  re-run. */
 export function migrate(db) {
-    if (currentUserVersion(db) >= MIGRATIONS.length)
+    const version = currentUserVersion(db);
+    if (version > MIGRATIONS.length) {
+        throw new Error(`unsupported canvas schema version ${version} (latest supported ${MIGRATIONS.length})`);
+    }
+    if (version === MIGRATIONS.length)
         return;
     // Pending work: a step now holds the write lock for its whole duration, and
     // the fs-heavy legacy steps (v3/v14/v15) can outlast the ordinary 5s busy

package/dist/core/canvas/nav-model.js

@@ -11,8 +11,6 @@
 // `FoldState`) so this layer owns no singletons and each consumer keeps its own
 // state.
 import { getNode, subscribersOf, subscriptionsOf } from './index.js';
-import { activeFaultForDisplay } from './render-source.js';
-import { readFault } from '../runtime/fault.js';
 import { faultSummary } from './status-glyph.js';
 import { statusRank } from './node-order.js';
 import { nodeGlyph, navLabel, shortId, tokensCell, activityCell, cycleBadge, askBadge, liveBelowBadge, truncate, fillBar, fillWidth, isAttached, BOLD, DIM, RESET, REVERSE, BG_ATTACHED, } from './nav-render.js';
@@ -226,7 +224,7 @@ export function renderGraphRow(r, isCursor, focused, activeBelow, asks) {
     // reads purely as "this unfolds".
     const expandable = r.hasKids && r.collapsed;
     const caret = !isCursor && expandable ? `${DIM}▸${RESET} ` : '  ';
-    const fault = node !== null ? activeFaultForDisplay(node, readFault(r.id)) : null;
+    const fault = node?.fault ?? null;
     const faultSuffix = fault !== null ? ` · ${faultSummary(fault)}` : '';
     const line = `${r.branch}${caret}${dot} ${name} ${kind} ${tokens}${cycleBadge(node)}${childBadge(node)}${liveBelowBadge(node, activeBelow)}${askBadge(r.id, asks)}${activityCell(r.id, node)}${faultSuffix}`;
     return wrap(line, isAttached(r.id, node, focused));

package/dist/core/canvas/nav-render.d.ts

@@ -19,10 +19,10 @@ export declare const YELLOW = "\u001B[33m";
 export declare const CYAN = "\u001B[36m";
 export declare const GRAY = "\u001B[90m";
 /** Overlay-aware glyph for a node: hanging ⚠ outranks streaming ⟳, which
- *  outranks the base status glyph. `remote` skips the local `readFault` /
- *  `isPidAlive` / `isBusy` reads entirely (a remote node id may collide with a
- *  local one) and renders the bare status glyph instead. */
-export declare function nodeGlyph(node: NodeMeta | null, remote?: boolean): string;
+ *  outranks the base status glyph. Every input is a projected row field — the
+ *  owning daemon computed `fault`/`streaming` — so this holds for a remote node
+ *  too, with no local read keyed on a node id that may collide. */
+export declare function nodeGlyph(node: NodeMeta | null): string;
 /** Drop every SGR sequence, keeping the visible text. The selection bar uses
  *  this: reverse-video INVERTS a coloured cell into a coloured block, so a row
  *  built from tinted spans highlights as a patchwork of background swatches

package/dist/core/canvas/nav-render.js

@@ -1,8 +1,8 @@
 // nav-render.ts — the PURE render + telemetry half of the nav model.
 //
 // Everything here is canvas-db-free: it reads node telemetry (job/telemetry.json,
-// attach.json — pure `jobDir` fs reads), per-node fault/busy/pid marker files, and
-// produces ANSI-styled strings. No `getNode`/`subscriptionsOf`/`listFocuses` — the
+// attach.json — pure `jobDir` fs reads) plus the fault/streaming fields already
+// projected onto the node row, and produces ANSI-styled strings. No `getNode`/`subscriptionsOf`/`listFocuses` — the
 // graph-walking half lives in nav-model.ts (which re-exports these helpers for its
 // own callers). This split lets the attach viewer's pure chrome pull render helpers
 // without dragging the canvas state-store into its bundle.
@@ -10,10 +10,6 @@ import { execFileSync } from 'node:child_process';
 import { existsSync, readFileSync } from 'node:fs';
 import { join } from 'node:path';
 import { jobDir } from './paths.js';
-import { isPidAlive } from './pid.js';
-import { isBusy } from '../runtime/busy.js';
-import { readFault } from '../runtime/fault.js';
-import { activeFaultForDisplay } from './render-source.js';
 import { isFrozenRow, resolveNodeVisual } from './status-glyph.js';
 // Tuning constants
 /** pi's InteractiveMode.MAX_WIDGET_LINES — the hard cap on lines in a string
@@ -41,30 +37,24 @@ export const RED = `${ESC}31m`;
 export const YELLOW = `${ESC}33m`;
 export const CYAN = `${ESC}36m`;
 export const GRAY = `${ESC}90m`;
-function hangingFor(node) {
-    return activeFaultForDisplay(node, readFault(node.node_id));
-}
 function streamingFor(node) {
     if (node.status !== 'active' && node.status !== 'idle')
         return false;
-    if (!isPidAlive(node.pi_pid))
-        return false;
-    // `isBusy` (the canonical mid-turn marker) AND-ed with the live pid above —
-    // a stale marker from a crashed pi fails the pid check, never the existsSync.
-    return isBusy(node.node_id);
+    // The projected field is the live execution's open turn AND-ed with broker-pid
+    // liveness, so a witness left by a crashed pi reads false.
+    return node.streaming === true;
 }
 /** Overlay-aware glyph for a node: hanging ⚠ outranks streaming ⟳, which
- *  outranks the base status glyph. `remote` skips the local `readFault` /
- *  `isPidAlive` / `isBusy` reads entirely (a remote node id may collide with a
- *  local one) and renders the bare status glyph instead. */
-export function nodeGlyph(node, remote = false) {
+ *  outranks the base status glyph. Every input is a projected row field — the
+ *  owning daemon computed `fault`/`streaming` — so this holds for a remote node
+ *  too, with no local read keyed on a node id that may collide. */
+export function nodeGlyph(node) {
     if (node === null)
         return '?';
     const v = resolveNodeVisual(node.status, {
-        streaming: remote ? false : streamingFor(node),
-        // Durable row state, so it holds for a remote node too.
+        streaming: streamingFor(node),
         frozen: isFrozenRow(node),
-        hanging: remote ? null : hangingFor(node),
+        hanging: node.fault ?? null,
     });
     return `${ESC}${v.color}m${v.glyph}${RESET}`;
 }

package/dist/core/canvas/node-sql-migration.d.ts

@@ -0,0 +1,3 @@
+import { DatabaseSync } from 'node:sqlite';
+/** Imported by the shared appended consolidation transaction. The caller owns the transaction and user_version. */
+export declare function importNodeSqlAuthority(db: DatabaseSync): void;