@north-light/crouter 0.3.311 → 0.3.313

package/dist/core/human/tickets.js

@@ -1,15 +1,11 @@
-import { existsSync, mkdirSync, readFileSync, realpathSync, unlinkSync, writeFileSync } from 'node:fs';
+import { mkdirSync, readFileSync, realpathSync } from 'node:fs';
 import { basename, isAbsolute, resolve } from 'node:path';
-import { randomUUID } from 'node:crypto';
 import { z } from 'zod';
-import { buildPageSummary } from './summary.js';
-import { atomicWriteJson, atomicWriteText, clearProgress, claimPath, pageManifestPath, pageModulePath, pagePath, progressPath, publishJsonExclusive, requireTicket, responsePath, reviewPath } from './convention.js';
-import { validateReviewDescriptor, validateReviewProjection } from './review-schema.js';
-import { compilePage, deriveHtmlPageManifest, derivePageManifestFromDocument, parsePage, parsePageDelivery, PageAuthoringError } from './page.js';
-import { isResponseBearingSlot, validatePageResponses, validatePartialPageResponses } from './page-schema.js';
+import { pageModulePath, pagePath } from './convention.js';
+import { parsePage } from './page.js';
+import { validatePageResponses, validatePartialPageResponses } from './page-schema.js';
 import { signalInboxActivity } from './root.js';
-import { readTicketClaim, releaseClaimLocked, withTicketLock } from './claim.js';
-import { checkReviewableFile } from './visible-paths.js';
+import { createPageRequest, getRequestByDirectory, presentationDir, publishPageRevision, revisePageRequest, writeProgress as writeRequestProgress } from './requests.js';
 const feedbackCommentSchema = z.object({ id: z.string().min(1), line: z.number().int().positive(), endLine: z.number().int().positive(), quote: z.string().optional(), colStart: z.number().int().nonnegative().optional(), colEnd: z.number().int().nonnegative().optional(), lineText: z.string(), comment: z.string().min(1), createdAt: z.string().min(1) }).strict();
 const iso = z.string().datetime({ offset: true });
 const feedbackSchema = z.object({ file: z.string().min(1).refine(isAbsolute, 'file must be absolute').refine((file) => resolve(file) === file, 'file must be canonical'), submitted: z.literal(true), approved: z.boolean(), comments: z.array(feedbackCommentSchema), submittedAt: iso, savedAt: iso, reviewId: z.string().optional(), changed: z.boolean().optional(), baselineSha256: z.string().optional(), approvedSha256: z.string().optional(), companionNodeId: z.string().optional(), commentsTotal: z.number().int().nonnegative().optional(), commentsUnresolved: z.number().int().nonnegative().optional() }).strict().superRefine((result, ctx) => {
@@ -27,20 +23,21 @@ const pageResultSchema = z.object({ schema: z.literal('crtr.page-response/v1'),
 const pageProgressSchema = z.object({ kind: z.literal('page'), responses: z.record(z.string(), slotResponseSchema), savedAt: iso }).strict();
 const reviewResultSchema = z.object({ schema: z.literal('humanloop.review-response/v1'), kind: z.literal('review'), result: feedbackSchema, completedAt: iso }).strict();
 const canceledResultSchema = z.object({ schema: z.literal('humanloop.cancel/v1'), kind: z.literal('canceled'), canceledAt: iso, reason: z.string().optional(), actor: z.string().optional(), disposition: z.enum(['canceled', 'dismissed']).optional() }).strict();
-/** Strict decoder for the only canonical final marker. Only a missing file reads
- *  as absent — a corrupt (unparseable) response is a real anomaly and throws,
- *  since silently treating it as "no result yet" would mask data loss instead
- *  of surfacing it to whichever caller owns the failure boundary. */
+/** Strict decoder for the canonical SQL terminal result. A corrupt result throws
+ *  rather than being treated as absent, because that would hide data loss from
+ *  the caller that owns the failure boundary. */
 export function readTicketResult(dir) {
-    const path = responsePath(dir);
-    if (!existsSync(path))
+    const request = getRequestByDirectory(dir);
+    if (request === null)
+        throw new Error(`unknown human request directory: ${dir}`);
+    if (request.state !== 'settled' || request.result_json === null)
         return null;
     let raw;
     try {
-        raw = JSON.parse(readFileSync(path, 'utf8'));
+        raw = JSON.parse(request.result_json);
     }
     catch (error) {
-        throw new Error(`corrupt ticket result: ${path}`, { cause: error });
+        throw new Error(`corrupt human request result: ${request.request_id}`, { cause: error });
     }
     const page = pageResultSchema.safeParse(raw);
     if (page.success)
@@ -49,107 +46,43 @@ export function readTicketResult(dir) {
     if (review.success)
         return review.data;
     const canceled = canceledResultSchema.safeParse(raw);
-    return canceled.success ? canceled.data : null;
+    if (canceled.success)
+        return canceled.data;
+    throw new Error(`human request has an invalid terminal result: ${request.request_id}`);
 }
-function hasTicketProtocolState(dir) {
-    return [pageManifestPath(dir), pagePath(dir), pageModulePath(dir), reviewPath(dir), responsePath(dir), progressPath(dir), claimPath(dir)].some(existsSync);
-}
-function publishRequest(path, value) {
-    if (!publishJsonExclusive(path, value))
-        throw new Error(`ticket request already exists: ${path}`);
-}
-/** Validate one authored page document into publishable form. The single
- *  validation path: `preparePage` reads a file and lands here, and a
- *  programmatic request supplies the same text inline. */
-export function preparePageSource(opts) {
-    const stamped = { ...(opts.source ?? {}), emittedAt: opts.source?.emittedAt ?? new Date().toISOString() };
-    const delivery = opts.delivery ?? { placement: 'inline', inbox: false, reply: false };
-    if (opts.dialect === 'html')
-        return { document: opts.document, manifest: deriveHtmlPageManifest(opts.document, stamped, delivery) };
-    return { document: opts.document, module: compilePage(opts.document), manifest: derivePageManifestFromDocument(opts.document, opts.productKinds ?? [], stamped, delivery) };
-}
-/** Validate one authored page source file into publishable form. Reads only: a
- *  page that fails authoring leaves nothing behind, so a caller that must create
- *  a bridge node prepares first and creates it only once the page is known good.
- *  The source is read exactly once, so the published document is the same bytes
- *  the manifest was derived from even if the file changes underneath. */
-export function preparePage(opts) {
-    const html = /\.html?$/i.test(opts.sourceFile);
-    if (!html && !opts.sourceFile.endsWith('.tsx'))
-        throw new PageAuthoringError(`page source file must be .tsx, .html, or .htm: ${opts.sourceFile}`);
-    if (!existsSync(opts.sourceFile))
-        throw new PageAuthoringError(`page source file does not exist: ${opts.sourceFile}`);
-    const { sourceFile: _sourceFile, ...rest } = opts;
-    return preparePageSource({ ...rest, dialect: html ? 'html' : 'jsx', document: readFileSync(opts.sourceFile, 'utf8') });
-}
-/** Remove a stale generation file. The manifest always switches first, so a
- * failed cleanup leaves one valid current record plus harmless old source. */
-function unlinkIfPresent(path) {
-    try {
-        unlinkSync(path);
-    }
-    catch (error) {
-        if (error.code !== 'ENOENT')
-            throw error;
-    }
-}
-/** Publish one prepared page ticket: the authored source plus its manifest.
- * These writes are overwrites. A ticket's REQUEST is whatever page the agent
- * currently wants on screen, and `crtr human send --replace` revises it in
- * place while the human watches; only the ANSWER is write-once, which
- * `publishJsonExclusive` still guarantees for response.json alone. The manifest
- * switches after all new generation files exist, then stale media is removed. */
+/** Publish an immutable revision, then atomically select it with its matching specification. */
 export function publishPage(dir, prepared) {
     mkdirSync(dir, { recursive: true, mode: 0o700 });
     const ticket = realpathSync(dir);
-    atomicWriteText(pagePath(ticket, prepared.manifest.dialect), prepared.document);
-    if (prepared.manifest.dialect === 'jsx')
-        atomicWriteText(pageModulePath(ticket), prepared.module);
-    atomicWriteJson(pageManifestPath(ticket), prepared.manifest);
-    if (prepared.manifest.dialect === 'jsx')
-        unlinkIfPresent(pagePath(ticket, 'html'));
-    else {
-        unlinkIfPresent(pagePath(ticket, 'jsx'));
-        unlinkIfPresent(pageModulePath(ticket));
+    const request = getRequestByDirectory(ticket);
+    if (request === null) {
+        const created = createPageRequest({ request_id: basename(ticket), prepared });
+        signalInboxActivity();
+        return { id: created.request_id, dir: created.request_dir, kind: 'page', manifest: prepared.manifest };
     }
-    // Unconditional: a no-inbox page still lives in an attached viewer's transcript, and
-    // --replace promises every open surface reloads it.
+    const revision = publishPageRevision(ticket, prepared);
+    if (!revisePageRequest(request.request_id, {
+        presentation_dir: revision,
+        specification_json: JSON.stringify(prepared.manifest),
+        title: prepared.manifest.title,
+        subtitle: prepared.manifest.subtitle ?? null,
+        inbox_listed: prepared.manifest.delivery.inbox,
+        settleable: prepared.manifest.delivery.inbox || prepared.manifest.delivery.reply,
+    }))
+        throw new Error(`page request is not open: ${request.request_id}`);
     signalInboxActivity();
-    return { id: basename(ticket), dir: ticket, kind: 'page', manifest: prepared.manifest };
+    return { id: request.request_id, dir: ticket, kind: 'page', manifest: prepared.manifest };
 }
-/** Validate and publish one page ticket in a single step, for callers that own
- *  the ticket directory before they have a page. */
-export function submitPage(opts) {
-    if (existsSync(opts.dir) && hasTicketProtocolState(opts.dir) && !existsSync(pageManifestPath(opts.dir)))
-        throw new Error(`ticket protocol state already exists: ${opts.dir}`);
-    return publishPage(opts.dir, preparePage(opts));
+function pageRequest(dir) {
+    const request = getRequestByDirectory(dir);
+    if (request === null || request.kind !== 'page')
+        throw new Error(`unknown page request directory: ${dir}`);
+    return request;
 }
-export function submitReview(opts) {
-    // A review takes any reviewable text file: a .md artifact renders as a document,
-    // and source code renders as a syntax-highlighted code panel.
-    if (!isAbsolute(opts.review.file) || !existsSync(opts.review.file))
-        throw new Error('review file must be an existing absolute path');
-    const reviewable = checkReviewableFile(opts.review.file);
-    if (!reviewable.ok)
-        throw new Error(`review file is not reviewable: ${reviewable.reason}`);
-    const source = realpathSync(opts.review.file);
-    mkdirSync(opts.dir, { recursive: true, mode: 0o700 });
-    const dir = realpathSync(opts.dir);
-    if (hasTicketProtocolState(dir))
-        throw new Error(`ticket protocol state already exists: ${dir}`);
-    const descriptor = validateReviewProjection(dir, { schema: 'humanloop.review/v1', file: source, output: resolve(opts.review.output ?? `${dir}/feedback.json`), title: opts.review.title, subtitle: opts.review.subtitle, source: opts.review.source, blockedSince: opts.review.blockedSince ?? new Date().toISOString() });
-    publishRequest(reviewPath(dir), descriptor);
-    signalInboxActivity();
-    return { id: basename(dir), dir, kind: 'review' };
-}
-function exclusiveResult(dir, result) {
-    return publishJsonExclusive(responsePath(dir), result);
-}
-function requireReview(dir) { return validateReviewDescriptor(JSON.parse(readFileSync(reviewPath(dir), 'utf8'))); }
+/** Resolve a stable request directory to the SQL-selected immutable page revision. */
+export function selectedPageDir(dir) { return presentationDir(pageRequest(dir)); }
 function requirePage(dir) {
-    if (!existsSync(pageManifestPath(dir)))
-        throw new Error(`not a page ticket: ${dir}`);
-    return parsePage(dir);
+    return parsePage(selectedPageDir(dir));
 }
 function requireSettleablePage(dir) {
     const manifest = requirePage(dir);
@@ -157,166 +90,82 @@ function requireSettleablePage(dir) {
         throw new Error('page_has_no_response_lifecycle');
     return manifest;
 }
-function requireCancelablePage(dir) {
-    // Cancellation never interprets answers. Reading only this stable envelope
-    // keeps an older resident daemon able to retract a page authored by a newer CLI.
-    const delivery = parsePageDelivery(dir);
-    if (!delivery.inbox && !delivery.reply)
-        throw new Error('page_has_no_response_lifecycle');
-}
 function isEmptyResponseMap(responses) {
     return typeof responses === 'object' && responses !== null && !Array.isArray(responses) && Object.keys(responses).length === 0;
 }
 /** Validate a final page response against its ticket's reply contract. */
-function validateFinalPageTicketResponses(dir, responses) {
-    const manifest = requireSettleablePage(dir);
-    // An inbox-only page accepts an empty acknowledgement without requiring an answer
-    // from every response-bearing component.
-    if (!manifest.delivery.reply && isEmptyResponseMap(responses)) {
+export function validateFinalPageResponses(manifest, responses) {
+    if (!manifest.delivery.reply && isEmptyResponseMap(responses))
         return validatePartialPageResponses(manifest, responses);
-    }
     return validatePageResponses(manifest, responses);
 }
-/** Validate a page resolution against its canonical ticket before claim takeover. */
+function validateFinalPageTicketResponses(dir, responses) {
+    return validateFinalPageResponses(requireSettleablePage(dir), responses);
+}
+/** Validate a page resolution against its SQL-selected immutable revision. */
 export function validatePageTicketResponses(dir, responses) {
-    const ticket = requireTicket(dir);
-    return validateFinalPageTicketResponses(ticket, responses);
+    return validateFinalPageTicketResponses(dir, responses);
 }
-/** The three terminal states of a page ticket, derived from its published result. */
+/** Page state is derived from the SQL request row. */
 export function pageTicketState(dir) {
-    const manifest = requirePage(dir);
-    if (!manifest.delivery.inbox && !manifest.delivery.reply)
+    const request = pageRequest(dir);
+    if (!request.settleable)
         return 'passive';
-    const result = readTicketResult(dir);
-    if (result === null)
+    if (request.state !== 'settled')
         return 'pending';
-    return result.kind === 'canceled' ? 'canceled' : 'resolved';
-}
-function readPageProgressFor(dir, manifest) {
-    let raw;
-    try {
-        raw = JSON.parse(readFileSync(progressPath(dir), 'utf8'));
-    }
-    catch (error) {
-        if (error.code === 'ENOENT')
-            return null;
-        throw new Error(`page progress is not valid JSON: ${progressPath(dir)}`);
-    }
-    const parsed = pageProgressSchema.safeParse(raw);
-    if (!parsed.success)
-        throw new Error(`page progress is malformed: ${progressPath(dir)}`);
-    // A pending page's request can be replaced under saved work, so progress may
-    // name a component the current page no longer declares. Those entries are dropped
-    // and everything still declared hydrates; what remains is validated, so a
-    // saved answer that no longer fits its own component is still an error.
-    const declared = new Set(manifest.slots.filter(isResponseBearingSlot).map((slot) => slot.id));
-    const current = Object.fromEntries(Object.entries(parsed.data.responses).filter(([id]) => declared.has(id)));
-    return validatePartialPageResponses(manifest, current);
+    return request.outcome === 'canceled' || request.outcome === 'dismissed' ? 'canceled' : 'resolved';
 }
 /** Autosave partial page work. Every supplied response is validated; omitted components are permitted. */
 export function writePageProgress(dir, responses) {
-    const ticket = requireTicket(dir);
-    const validated = validatePartialPageResponses(requireSettleablePage(ticket), responses);
-    atomicWriteJson(progressPath(ticket), { kind: 'page', responses: validated, savedAt: new Date().toISOString() });
+    const request = pageRequest(dir);
+    const validated = validatePartialPageResponses(requireSettleablePage(dir), responses);
+    if (!writeRequestProgress(request.inbox_ticket_id, validated))
+        throw new Error(`page request is not open and settleable: ${request.request_id}`);
     return validated;
 }
-/** Saved partial work, or null when none exists. Malformed progress is an error, never silently discarded. */
+/** Saved partial work from the request row, or null when none exists. */
 export function readPageProgress(dir) {
-    const ticket = requireTicket(dir);
-    return readPageProgressFor(ticket, requireSettleablePage(ticket));
+    const request = pageRequest(dir);
+    if (request.progress_json === null)
+        return null;
+    try {
+        const progress = JSON.parse(request.progress_json);
+        if (progress.kind !== 'page')
+            throw new Error('wrong kind');
+        return progress.responses;
+    }
+    catch (error) {
+        throw new Error(`page progress is malformed for ${request.request_id}`, { cause: error });
+    }
 }
 /** Read one addressable page ticket — pending, resolved or canceled alike. */
 export function readPageTicket(dir) {
-    const ticket = requireTicket(dir);
-    const manifest = requirePage(ticket);
+    const request = pageRequest(dir);
+    const presentation = presentationDir(request);
+    const manifest = parsePage(presentation);
     return {
-        dir: ticket,
-        id: basename(ticket),
+        dir: request.request_dir,
+        id: request.request_id,
         manifest,
-        document: readFileSync(pagePath(ticket, manifest.dialect), 'utf8'),
-        ...(manifest.dialect === 'jsx' ? { module: readFileSync(pageModulePath(ticket), 'utf8') } : { module: undefined }),
-        state: pageTicketState(ticket),
-        progress: manifest.delivery.inbox || manifest.delivery.reply ? readPageProgressFor(ticket, manifest) : null,
+        document: readFileSync(pagePath(presentation, manifest.dialect), 'utf8'),
+        ...(manifest.dialect === 'jsx' ? { module: readFileSync(pageModulePath(presentation), 'utf8') } : { module: undefined }),
+        state: pageTicketState(request.request_dir),
+        progress: manifest.delivery.inbox || manifest.delivery.reply ? readPageProgress(request.request_dir) : null,
     };
 }
-function requireClaimOwnership(dir, token) {
-    if (readTicketClaim(dir)?.token !== token)
-        throw new Error('only the current claim holder may submit a result');
-}
-function clearOwnedWork(dir, claimToken) { clearProgress(dir); releaseClaimLocked(dir, claimToken); }
-/** Caller holds `.ticket-lock`. */
-function completePageLocked(dir, responses, claimToken, opts) {
-    requireClaimOwnership(dir, claimToken);
-    const manifest = requirePage(dir);
-    const parsedResponses = validateFinalPageTicketResponses(dir, responses);
-    const result = { schema: 'crtr.page-response/v1', kind: 'page', responses: parsedResponses, summary: buildPageSummary(manifest, parsedResponses), completedAt: opts.completedAt ?? new Date().toISOString(), ...(opts.actor === undefined ? {} : { actor: opts.actor }) };
-    const won = exclusiveResult(dir, result);
-    clearOwnedWork(dir, claimToken);
-    // Lost the race: the winner's result must already be on disk, so a null read
-    // here is an anomaly worth surfacing rather than silently falling back to
-    // this loser's own uncommitted result.
-    return { won, result: won ? result : (readTicketResult(dir) ?? (() => { throw new Error(`lost the completion race but no winning result is on disk: ${dir}`); })()) };
-}
-export function completePage(dir, responses, claimToken, opts = {}) {
-    const ticket = requireTicket(dir);
-    const completed = withTicketLock(ticket, () => completePageLocked(ticket, responses, claimToken, opts));
-    if (completed.won)
-        signalInboxActivity();
-    return completed;
-}
-function takeoverClaim(dir, owner) {
-    const existing = readTicketClaim(dir);
-    if (existing !== null)
-        unlinkSync(claimPath(dir));
-    const token = randomUUID();
-    const now = new Date().toISOString();
-    writeFileSync(claimPath(dir), `${JSON.stringify({ token, host: owner.host, pid: owner.pid, claimedAt: now, heartbeatAt: now })}\n`, { flag: 'wx', mode: 0o600 });
-    return token;
+/** Page settlement must go through daemon/human/finish, which records its SQL result and direct obligations together. */
+export function completePage(_dir, _responses, _claimToken, _opts = {}) {
+    throw new Error('page completion must use settleHumanRequest');
 }
-/** Atomically take a page ticket's claim over, complete it, and release the takeover claim. */
-export function takeoverAndCompletePage(dir, responses, owner, opts = {}) {
-    const ticket = requireTicket(dir);
-    const completed = withTicketLock(ticket, () => {
-        const token = takeoverClaim(ticket, owner);
-        try {
-            return completePageLocked(ticket, responses, token, opts);
-        }
-        finally {
-            releaseClaimLocked(ticket, token);
-        }
-    });
-    if (completed.won)
-        signalInboxActivity();
-    return completed;
+/** Page settlement must go through daemon/human/finish, which records its SQL result and direct obligations together. */
+export function takeoverAndCompletePage(_dir, _responses, _owner, _opts = {}) {
+    throw new Error('page completion must use settleHumanRequest');
 }
-/** Cancellation races finalization but never requires or removes another claim. */
-export function cancelTicket(dir, opts = {}) {
-    const ticket = requireTicket(dir);
-    const canceled = withTicketLock(ticket, () => {
-        if (existsSync(pageManifestPath(ticket)))
-            requireCancelablePage(ticket);
-        const result = { schema: 'humanloop.cancel/v1', kind: 'canceled', canceledAt: new Date().toISOString(), ...(opts.reason === undefined ? {} : { reason: opts.reason }), ...(opts.actor === undefined ? {} : { actor: opts.actor }), ...(opts.disposition === undefined ? {} : { disposition: opts.disposition }) };
-        const won = exclusiveResult(ticket, result);
-        // Same anomaly as completePageLocked: losing the race with no winning
-        // result on disk means the ticket state is broken, not just contended.
-        return {
-            status: won ? 'canceled' : 'already_resolved',
-            result: won ? result : (readTicketResult(ticket) ?? (() => { throw new Error(`lost the cancellation race but no winning result is on disk: ${ticket}`); })()),
-        };
-    });
-    if (canceled.status === 'canceled')
-        signalInboxActivity();
-    return canceled;
+/** Page settlement must go through daemon/human/finish, which records its SQL result and direct obligations together. */
+export function cancelTicket(_dir, _opts = {}) {
+    throw new Error('page cancellation must use settleHumanRequest');
 }
-/** Write the validated review output once its review result is published. */
-export function projectReviewOutput(dir) {
-    const result = readTicketResult(dir);
-    if (result === null)
-        return 'no_result';
-    if (result.kind !== 'review')
-        return 'not_a_review';
-    const ticket = requireTicket(dir);
-    const descriptor = validateReviewProjection(ticket, requireReview(ticket));
-    atomicWriteJson(descriptor.output, result.result);
-    return 'projected';
+/** Review projection is performed by daemon/review/finish after its SQL terminal transition. */
+export function projectReviewOutput(_dir) {
+    throw new Error('review projection must use projectReviewResult');
 }

package/dist/core/human/types.d.ts

@@ -36,6 +36,8 @@ export interface ClaimSummary {
 interface TicketSummaryBase {
     dir: string;
     id: string;
+    /** Stored opaque inbox identity. It may differ from `id` after legacy migration. */
+    inboxTicketId: string;
     title: string;
     subtitle: string;
     blockedSince: string;
@@ -51,6 +53,8 @@ export interface ReviewTicketSummary extends TicketSummaryBase {
 export interface PageTicketSummary {
     dir: string;
     id: string;
+    /** Stored opaque inbox identity. It may differ from `id` after legacy migration. */
+    inboxTicketId: string;
     kind: 'page';
     title: string;
     subtitle: string;
@@ -109,6 +113,6 @@ export interface CanceledTicketResult {
      * requester (`canceled`). Absent on records written before the field. */
     disposition?: 'canceled' | 'dismissed';
 }
-/** The sole canonical response.json union. */
+/** The canonical terminal-result union stored in the human request row. */
 export type TicketResult = PageTicketResult | ReviewTicketResult | CanceledTicketResult;
 export {};

package/dist/core/installed-plugins.js

@@ -12,8 +12,13 @@ import { CONFIG_FILE } from '../types.js';
 import { listDirs, pathExists, readJsonIfExists } from './fs-utils.js';
 import { readPluginManifest } from './manifest.js';
 import { awaitBundleSwap, bundleSwapInFlightElsewhere } from './plugin-swap-lock.js';
-function pluginConfigForRoot(root) {
-    const cfg = readJsonIfExists(join(root, CONFIG_FILE));
+import { userStore } from './scoped-state/paths.js';
+import { readRawSettings } from './scoped-state/settings.js';
+function pluginConfigForRoot(scope, root) {
+    const store = scope === 'user' ? userStore(root) : undefined;
+    const cfg = store
+        ? readRawSettings({ store, key: 'user', kind: 'user', root: store.root })
+        : readJsonIfExists(join(root, CONFIG_FILE));
     return cfg && cfg.plugins && typeof cfg.plugins === 'object' ? cfg.plugins : {};
 }
 /**
@@ -38,7 +43,7 @@ export function listInstalledPluginsInRoot(scope, scopeRootPath) {
     const dir = join(scopeRootPath, 'plugins');
     if (!pathExists(dir))
         return [];
-    const cfg = pluginConfigForRoot(scopeRootPath);
+    const cfg = pluginConfigForRoot(scope, scopeRootPath);
     const first = collectInstalledPlugins(scope, dir, cfg);
     const waiting = swapsToWaitOut(scopeRootPath, cfg, new Set(first.map((plugin) => plugin.name)));
     if (waiting.length === 0)

package/dist/core/keybindings/__tests__/resolve.test.js

@@ -1,10 +1,12 @@
 import { after, before, beforeEach, test } from 'node:test';
 import assert from 'node:assert/strict';
-import { mkdtempSync, mkdirSync, readFileSync, rmSync, writeFileSync } from 'node:fs';
+import { mkdtempSync, mkdirSync, rmSync, writeFileSync } from 'node:fs';
 import { tmpdir } from 'node:os';
 import { join } from 'node:path';
 import { KeybindingConcurrentEditError, KeybindingValidationError, canonicalTerminalStroke, matchesTerminalInput, normalizeSparseOverrides, persistUserKeybindings, resolveKeybindings, resolveUserKeybindings, } from '../index.js';
-import { readConfig } from '../../config.js';
+import { ensureScopeInitialized, readConfig, readRawScopeConfig, updateRawConfigAtomically, writeRawConfig } from '../../config.js';
+import { closeScopedStores } from '../../scoped-state/db.js';
+import { resetScopeCache } from '../../scope.js';
 const typeCheckedBindingId = 'crtr.graph.down';
 // @ts-expect-error The catalog type rejects IDs that are not built in.
 const rejectedBindingId = 'crtr.graph.not-real';
@@ -24,15 +26,21 @@ beforeEach(() => {
     home = mkdtempSync(join(tmpdir(), 'crtr-keybindings-'));
     process.env['HOME'] = home;
     process.chdir(realCwd);
+    resetScopeCache();
+    ensureScopeInitialized('user', join(home, '.crouter'));
 });
 after(() => {
+    closeScopedStores();
     process.chdir(realCwd);
     if (realHome === undefined)
         delete process.env['HOME'];
     else
         process.env['HOME'] = realHome;
 });
-test.afterEach(() => rmSync(home, { recursive: true, force: true }));
+test.afterEach(() => {
+    closeScopedStores();
+    rmSync(home, { recursive: true, force: true });
+});
 test('terminal literal space matches named space bindings', () => {
     const raw = { input: ' ' };
     assert.equal(canonicalTerminalStroke(raw), 'space');
@@ -106,8 +114,7 @@ test('sparsification omits defaults, preserves explicit unbinds, and reset remov
     assert.throws(() => normalizeSparseOverrides({ 'crtr.graph.down': ['k'] }), KeybindingValidationError);
 });
 test('user resolution ignores project keybindings', () => {
-    mkdirSync(join(home, '.crouter'), { recursive: true });
-    writeFileSync(join(home, '.crouter', 'config.json'), JSON.stringify({ keybindings: { 'crtr.graph.down': ['down'] } }));
+    writeRawConfig('user', { keybindings: { 'crtr.graph.down': ['down'] } });
     const project = mkdtempSync(join(tmpdir(), 'crtr-keybindings-project-'));
     mkdirSync(join(project, '.crouter'), { recursive: true });
     writeFileSync(join(project, '.crouter', 'config.json'), JSON.stringify({ keybindings: { 'crtr.graph.down': ['up'] } }));
@@ -121,8 +128,7 @@ test('user resolution ignores project keybindings', () => {
     }
 });
 test('config hard cut exposes only sparse keybindings and ignores unsupported raw fields', () => {
-    mkdirSync(join(home, '.crouter'), { recursive: true });
-    writeFileSync(join(home, '.crouter', 'config.json'), JSON.stringify({
+    updateRawConfigAtomically('user', () => ({
         canvasNav: { prefixKey: 'alt+x' },
         keybindings: { 'crtr.graph.down': ['down'], bad: 3 },
     }));
@@ -131,9 +137,7 @@ test('config hard cut exposes only sparse keybindings and ignores unsupported ra
     assert.equal(Object.hasOwn(config, 'canvasNav'), false);
 });
 test('atomic persistence preserves latest unrelated fields and writes only sparse normalized overrides', () => {
-    mkdirSync(join(home, '.crouter'), { recursive: true });
-    const path = join(home, '.crouter', 'config.json');
-    writeFileSync(path, JSON.stringify({
+    updateRawConfigAtomically('user', () => ({
         customFutureField: { retained: true },
         max_panes_per_window: 4,
         canvasNav: { prefixKey: 'alt+z' },
@@ -143,7 +147,7 @@ test('atomic persistence preserves latest unrelated fields and writes only spars
         'crtr.graph.close-subtree': [],
         'crtr.graph.down': ['j'],
     });
-    const raw = JSON.parse(readFileSync(path, 'utf8'));
+    const raw = readRawScopeConfig('user');
     assert.deepEqual(raw.customFutureField, { retained: true });
     assert.equal(raw.max_panes_per_window, 4);
     assert.deepEqual(raw.keybindings, {
@@ -153,17 +157,15 @@ test('atomic persistence preserves latest unrelated fields and writes only spars
     assert.equal(raw.canvasNav, undefined);
 });
 test('reset-all removes the top-level member and concurrent keybinding edits are refused', () => {
-    mkdirSync(join(home, '.crouter'), { recursive: true });
-    const path = join(home, '.crouter', 'config.json');
     const original = { 'crtr.graph.down': ['down'] };
-    writeFileSync(path, JSON.stringify({ keybindings: original, retained: 1 }));
+    updateRawConfigAtomically('user', () => ({ keybindings: original, retained: 1 }));
     persistUserKeybindings({}, { expectedKeybindings: original });
-    let raw = JSON.parse(readFileSync(path, 'utf8'));
+    let raw = readRawScopeConfig('user');
     assert.equal(raw.keybindings, undefined);
     assert.equal(raw.retained, 1);
-    writeFileSync(path, JSON.stringify({ keybindings: { 'crtr.graph.up': ['up'] }, retained: 2 }));
+    updateRawConfigAtomically('user', () => ({ keybindings: { 'crtr.graph.up': ['up'] }, retained: 2 }));
     assert.throws(() => persistUserKeybindings({}, { expectedKeybindings: original }), KeybindingConcurrentEditError);
-    raw = JSON.parse(readFileSync(path, 'utf8'));
+    raw = readRawScopeConfig('user');
     assert.deepEqual(raw.keybindings, { 'crtr.graph.up': ['up'] });
     assert.equal(raw.retained, 2);
 });

package/dist/core/locked-file.d.ts

@@ -6,8 +6,9 @@ export type LockResult<T> = {
  *  from INSIDE the critical section must call it immediately before that write, because the
  *  post-`fn` check cannot un-write a file the callback already replaced. */
 export type LockHeldGuard = () => void;
+export type LockedFilePublish = (next: string) => void;
 export interface LockedFileBackend {
-    withLockAsync<T>(fn: (current: string | undefined, assertLockHeld: LockHeldGuard) => Promise<LockResult<T>>): Promise<T>;
+    withLockAsync<T>(fn: (current: string | undefined, assertLockHeld: LockHeldGuard, publish: LockedFilePublish) => Promise<LockResult<T>>): Promise<T>;
     /** The current whole-file contents, or undefined when the file does not exist yet.
      *  Lock-free: every writer replaces the file by atomic rename. */
     readUnlocked(): string | undefined;
@@ -15,10 +16,12 @@ export interface LockedFileBackend {
 /** A 0600 JSON file guarded by a cross-process `proper-lockfile` lock on its own path. */
 export declare class LockedJsonFile implements LockedFileBackend {
     private readonly path;
-    constructor(path: string);
+    private readonly durable;
+    private readonly initialContent;
+    constructor(path: string, durable?: boolean, initialContent?: string);
     readUnlocked(): string | undefined;
     private ensureFile;
     /** Acquire the lock without blocking the event loop, keeping every read-modify-write
      *  callback on the same asynchronous path. */
-    withLockAsync<T>(fn: (current: string | undefined, assertLockHeld: LockHeldGuard) => Promise<LockResult<T>>): Promise<T>;
+    withLockAsync<T>(fn: (current: string | undefined, assertLockHeld: LockHeldGuard, publish: LockedFilePublish) => Promise<LockResult<T>>): Promise<T>;
 }