@north-light/crouter 0.3.318 → 0.3.320

package/dist/core/runtime/broker.js

@@ -1,1214 +1 @@
-// broker.ts — the headless node broker (design §4, §5).
-//
-// One broker process per node — the SOLE host. It hosts ONE pi engine IN-PROCESS
-// via the SDK (createAgentSession), is the SOLE writer of the node's session
-// `.jsonl`, listens on `nodeDir(id)/view.sock`, fans the single engine event
-// stream out to N viewers, serializes the drive commands of EVERY writable
-// viewer through one frame loop, and fans blocking extension dialogs out to all
-// of them (first answer wins). The engine has no terminal of its own; a
-// tmux pane (or web tab) is only a viewer of this socket. It
-// runs one turn-cycle and, when the engine settles (the stophook calls
-// ctx.shutdown(), or the engine goes idle), disposes the engine and exits 0 —
-// the daemon then routes revival per the intent the bound stophook set.
-//
-// Engine resolution flows through broker-sdk.ts (`loadBrokerEngine`) so the T11
-// `CRTR_BROKER_ENGINE` test seam can swap a fake engine in. The resource loader
-// + model registry are real SDK construction helpers (NOT part of the swappable
-// engine seam — the fake engine receives the real, extension-loaded loader so
-// the real canvas-stophook fires session_start).
-import { envModelIntent, envNodeCwd, envNodeId, envProfileId } from '../../shared/env.js';
-import { createServer } from 'node:net';
-import { existsSync, readFileSync, unlinkSync } from 'node:fs';
-import { join } from 'node:path';
-import { randomUUID } from 'node:crypto';
-import { mark } from '../timing.js';
-import { getAgentDir, initTheme, ModelRegistry, ModelRuntime, } from '@earendil-works/pi-coding-agent';
-import { nodeDir, viewSocketPath } from '../canvas/paths.js';
-import { bindBrokerEventSource } from '../events/source.js';
-import { emitEvent } from '../events/emit.js';
-import { operationIdContext } from '../events/operation-id.js';
-import { findMissingPackagePaths } from './package-health.js';
-import { FRONT_DOOR_ENV } from './front-door.js';
-import { CANVAS_EXTENSIONS, piInvocationToSdkConfig, } from './launch.js';
-import { assertEngineVersion, loadBrokerEngine } from './broker-sdk.js';
-import { resolveBundledPiPackageDir } from './pi-cli.js';
-import { captureSessionChatCapabilities } from './command-surface.js';
-import { PoolCredentialStore } from '../pool-credential-store.js';
-import { mutateBrokerFault, recordBrokerTurn } from './broker/daemon-ops.js';
-import { modelRequestFromConfig, selectInitialModelRoute, unregisteredConcreteModel } from '../model-routes.js';
-import { KNOWN_STREAM_WAIT_UI } from './stream-watchdog.js';
-import { probeOnline as probeOnlineReal } from './connectivity.js';
-import { CRTR_CYCLE_CUSTOM_TYPE, cycleAwareMessages } from './session-cycles.js';
-import { projectTranscript } from './session-visibility.js';
-import { currentTurnVisibility } from './turn-visibility.js';
-import { isUnknownModel } from './model-selection.js';
-import { BrokerClientRegistry } from './broker/client-registry.js';
-import { ToolGroupTracker } from './broker/tool-groups.js';
-import { onNodeNamed } from './broker/node-named.js';
-import { FaultRetry } from './broker/fault-retry.js';
-import { createTurnAdmissionGate } from './broker/turn-admission.js';
-import { BROKER_IDLE_TURN_START } from './broker/held-deferred-inbox.js';
-import { EventProjection } from './broker/event-projection.js';
-import { createFrameDispatchContext, handleFrame, } from './broker/frame-dispatch.js';
-import { hydratePersistedAdvertisedCommandMessages, installAdvertisedCommandInvocationContract, } from './advertised-command-invocation.js';
-import { RebindDriver } from './broker/rebind.js';
-import { decodeKickoffOrigin, KICKOFF_ORIGIN_ENV } from './stamp/protocol.js';
-import { announceMessageOrigin } from './stamp/channel.js';
-import { brokerExtensionState, commitBrokerModel } from './broker/daemon-ops.js';
-import { FrameOverflowError, normalizeSnapshotTail, } from './broker-protocol.js';
-/** A review companion may only navigate or fork within a branch whose ancestry
- * has crossed its durable transcript boundary. The broker sends this typed local
- * failure as a dedicated error frame without invoking pi's tree mutation. */
-export { ReviewBoundaryNavigationError, REVIEW_BOUNDARY_NAVIGATION_CODE } from './broker/frame-replies.js';
-/**
- * pi 0.82 made `ModelRuntime` the canonical model/auth surface and demoted
- * `ModelRegistry` to the synchronous facade over it (`find`/`getAll`/
- * `getAvailable`/`hasConfiguredAuth` off the runtime's snapshot). The broker's
- * model policy is synchronous throughout, so every read goes through this
- * facade; it is a thin wrapper over the LIVE runtime, so constructing one per
- * call reads current state rather than a captured view.
- */
-function registryOf(services) {
-    return new ModelRegistry(services.modelRuntime);
-}
-/** The auth.json/models.json pair backing one agent dir's model runtime. */
-function modelRuntimePaths(agentDir) {
-    return { authPath: join(agentDir, 'auth.json'), modelsPath: join(agentDir, 'models.json') };
-}
-function formatModelSpec(model, thinkingLevel) {
-    if (model === null || model === undefined || isUnknownModel(model))
-        return null;
-    const suffix = thinkingLevel !== undefined && thinkingLevel !== '' && thinkingLevel !== 'off' ? `:${thinkingLevel}` : '';
-    return `${model.provider}/${model.id}${suffix}`;
-}
-/** The ask-time fork recipe requires an explicit thinking level: `:off` is a
- * real captured choice, not an omitted default that a future runtime may infer
- * differently. */
-function formatExactModelSpec(model, thinkingLevel) {
-    const base = formatModelSpec(model, undefined);
-    return base === null ? null : `${base}:${thinkingLevel === undefined || thinkingLevel === '' ? 'off' : thinkingLevel}`;
-}
-// Tunables (backpressure / dialog anti-deadlock)
-/** Broker-side default dialog timeout (anti-deadlock). When an extension
- *  dialog is forwarded to every writable client, the broker ALWAYS arms a timeout
- *  (this default, or a shorter per-dialog `opts.timeout` if the extension passed
- *  one) so unanswered dialogs — including ones whose writable viewers all detach
- *  — can never hang the agent turn forever. On fire it resolves to the SAFE default
- *  (deny for confirm; cancel/undefined for select/input/editor). */
-const DEFAULT_DIALOG_TIMEOUT_MS = 120_000; // 120 s
-// M3 (scout mq5thyli): the active engine session, exposed so broker-cli's FATAL
-// handlers (uncaughtException / unhandledRejection / the runBroker reject) can
-// dispose it before process.exit. The bash tool spawns children `detached` (own
-// pgid); only session.dispose() (→ abortBash / agent.abort → killProcessTree)
-// reaps them. The graceful exit path already disposes; without this the crash
-// path would `process.exit(1)` and ORPHAN every in-flight bash subprocess.
-let activeSession = null;
-/** Dispose the live engine session if one exists (idempotent). Called by
- *  broker-cli's fatal handlers before exit so a crash never orphans detached
- *  bash children. No-op before the session is built or after a clean dispose. */
-export function disposeActiveSession() {
-    const s = activeSession;
-    activeSession = null;
-    if (s !== null) {
-        try {
-            s.dispose();
-        }
-        catch {
-            /* dispose must not block the fatal exit */
-        }
-    }
-}
-// runBroker — the broker process body (plan T4 steps 1–6)
-export async function runBroker(nodeId, startupAt = process.hrtime.bigint(), startupTs = new Date().toISOString()) {
-    // The canonical broker event source (job/log.jsonl) is bound before any other
-    // work in this function — no path/env/state setup may precede it, and the
-    // binder independently validates nodeId before constructing that path.
-    bindBrokerEventSource(nodeId);
-    // One low-volume, node-correlated boot trace. It deliberately carries only
-    // timing and runtime identity — never prompts, commands, tokens, or secrets.
-    // broker-cli captures startupAt/startupTs before dynamically loading this
-    // module, so module_loaded's elapsed value includes the cold broker import
-    // graph, and cli_entry carries the exact process-spawn wall-clock time.
-    operationIdContext.fresh(() => {
-        emitEvent({
-            level: 'info',
-            event: 'broker.startup.cli_entry',
-            ts: startupTs,
-            duration_ms: 0,
-            fields: { runtime_version: process.version, engine_version: null, model: null },
-        });
-        emitEvent({
-            level: 'info',
-            event: 'broker.startup.module_loaded',
-            duration_ms: Number(process.hrtime.bigint() - startupAt) / 1_000_000,
-            fields: { runtime_version: process.version, engine_version: null, model: null },
-        });
-    });
-    // Structured, duplicate-suppressed startup milestones reached only once the
-    // engine is streaming a turn. `engineVersion` is populated below once
-    // assertEngineVersion resolves it; the milestones fire well after that.
-    const markedStartupEvents = new Set();
-    let engineVersion = null;
-    const emitStartupMilestone = (event, model = null) => {
-        if (markedStartupEvents.has(event))
-            return;
-        markedStartupEvents.add(event);
-        // Under CRTR_TIMING the same milestone also lands on the cross-process
-        // front-door timeline (stderr → this broker's broker.log), so it can be
-        // read next to the cli/viewer markers instead of only in the job log.
-        mark(event, { duration_ms: Number(process.hrtime.bigint() - startupAt) / 1_000_000 });
-        emitEvent({
-            level: 'info',
-            event,
-            duration_ms: Number(process.hrtime.bigint() - startupAt) / 1_000_000,
-            fields: { runtime_version: process.version, engine_version: engineVersion, model },
-        });
-    };
-    // Defensive: any `crtr` child the engine/extensions spawn must inherit the
-    // front-door recursion guard (see
-    // src/core/runtime/.crouter/memory/INDEX.md). The host also sets this;
-    // setting it here keeps the broker self-sufficient.
-    process.env[FRONT_DOOR_ENV] = '1';
-    // A successful in-turn crtr command stamps this process id into its stop
-    // signal, so a crash-revived broker cannot consume a prior broker's outcome.
-    process.env['CRTR_BROKER_PID'] = String(process.pid);
-    // The broker is PANELESS and detached, but a broker spawned by a tmux-resident
-    // parent inherits the parent's TMUX_PANE/TMUX in its env (the launcher spawns
-    // with {...process.env}). Left in place, every `crtr` command the engine runs
-    // (bash tool, goal-capture naming, a child spawn) would resolve `currentTmux()`
-    // to the PARENT's pane/session and act there — e.g. open viewers beside, or
-    // close, the parent's pane. Strip both so this broker's children see no tmux
-    // context and take their paneless path.
-    delete process.env['TMUX_PANE'];
-    delete process.env['TMUX'];
-    // 1. Version tripwire + load the launch recipe the host serialized.
-    const engine = await loadBrokerEngine();
-    assertEngineVersion(engine.VERSION);
-    engineVersion = engine.VERSION;
-    // M4 / M6 (scout mq5thyli) — DELIBERATELY SKIPPED on the 0.78.1 pin. Both
-    // `configureHttpDispatcher` (M4: proxy support + the undici decompression fix)
-    // and `runMigrations` (M6: config/auth migration for a box where the pi CLI
-    // never ran) are CLI-only helpers that the pinned SDK does NOT re-export: the
-    // package's `exports` map is `.`-only, neither symbol is in `dist/index.d.ts`,
-    // a deep import (`.../dist/core/http-dispatcher.js`) is blocked with
-    // ERR_PACKAGE_PATH_NOT_EXPORTED, and the only exports-map entries are `.` and
-    // `./hooks` (neither carries these symbols). Per the "verify export; skip-with-
-    // note if absent" directive we do not vendor or reach around the export wall.
-    // Revisit when the SDK pin bumps to a version that re-exports them publicly.
-    const dir = nodeDir(nodeId);
-    const launchFile = join(dir, 'broker-launch.json');
-    const inv = JSON.parse(readFileSync(launchFile, 'utf8'));
-    const cfg = piInvocationToSdkConfig(inv); // also merges inv.env
-    if (cfg.modelExact === true)
-        process.env['CRTR_MODEL_EXACT'] = '1';
-    else
-        delete process.env['CRTR_MODEL_EXACT'];
-    // 2–4. Build the engine session via the SERVICES path (C3) — see
-    //       buildBrokerSession below. Register it so the FATAL exit path (M3) can
-    //       dispose it and reap detached bash children.
-    // `session` + `services` are MUTABLE holders (session-rebind): when the
-    // controller drives new_session/switch_session/fork, the AgentSessionRuntime
-    // tears down the old session and builds the next one, then runs our rebind
-    // callback which reassigns these. Every closure below (buildSnapshot,
-    // driveEngine, handleFrame, disposeAndExit) reads through them, so they all
-    // follow the live session automatically. `runtime` is undefined for an engine
-    // that does not expose the replacement API (the fake-engine fixture).
-    // eslint-disable-next-line prefer-const
-    let { session, services, resuming, runtime } = await buildBrokerSession(engine, cfg);
-    // Review identity is immutable for the broker's lifetime. Snapshot producers
-    // close over this one construction-time classification rather than re-reading
-    // canvas metadata for every welcome or session replacement. The BOUND review
-    // id (not a mere boolean) is what selects this companion's own boundary
-    // marker — a fork of another companion inherits that companion's earlier
-    // marker, and slicing at any marker would reveal its transcript.
-    const boundaryReviewId = (await brokerExtensionState(nodeId)).node.review_binding?.review_id;
-    // M3: name the boot session as the process-fatal disposal target immediately —
-    // enqueueRebind reassigns this on every later replacement, but without this
-    // initial assignment `activeSession` stays null (and disposeActiveSession() a
-    // no-op) for every exit that happens before the FIRST session replacement,
-    // which is the common case.
-    activeSession = session;
-    const retryProbe = probeOnlineReal;
-    // Initialize pi's process-global theme. The pi binary does this at boot
-    // (main.js: initTheme(settingsManager.getTheme(), appMode === 'interactive')),
-    // but the SDK convenience path the broker uses does NOT. Without it, ANY
-    // extension hook that reads `ctx.ui.theme` throws "Theme not initialized" —
-    // and the extension runner SILENTLY swallows that throw and discards the
-    // hook's returned payload. The visible symptom was the OAuth billing adapter's
-    // before_provider_request handler throwing, so its injected Claude-Code billing
-    // header was dropped and subscription turns 400'd ("draws from extra usage").
-    // headless ⇒ no file watcher (false). Idempotent global; call once at boot.
-    // Always replace an inherited PI_PACKAGE_DIR: a viewer launched from a pnpm
-    // path may pass its `.pnpm` package copy down to the daemon/broker, but that
-    // copy can omit the JSON theme assets. The broker must use crouter's actual
-    // bundled package root, exactly like its incidental pi subprocesses.
-    try {
-        process.env['PI_PACKAGE_DIR'] = resolveBundledPiPackageDir();
-        initTheme(services.settingsManager.getTheme(), false);
-    }
-    catch (err) {
-        emitEvent({
-            level: 'error',
-            event: 'broker.theme.initialization_failed',
-            error: err,
-        });
-    }
-    // Diagnose stale local-path pi packages without persisting the human-facing
-    // formatter's prose. The front door retains that actionable presentation.
-    try {
-        for (const missing of findMissingPackagePaths(getAgentDir())) {
-            emitEvent({
-                level: 'warn',
-                event: 'broker.startup.warning',
-                fields: {
-                    stage: 'package_health',
-                    source: missing.source,
-                    resolved_path: missing.resolved,
-                },
-            });
-        }
-    }
-    catch {
-        /* best-effort */
-    }
-    // N3: the node's display name is re-applied by the rebind lane below so it
-    // survives a session replacement (new_session/switch_session/fork), not only at
-    // boot.
-    // Socket fan-out, dialogs, and transcript tool groups
-    const sockPath = viewSocketPath(nodeId);
-    const registry = new BrokerClientRegistry(nodeId);
-    const pendingDialogs = new Map();
-    const toolGroups = new ToolGroupTracker(nodeId, (frame) => registry.broadcast(frame));
-    // The naming extension commits the node's generated name a few seconds into
-    // its first turn and hands it here (broker/node-named.ts). Every attached
-    // client learns it on the pipe it already holds instead of re-reading the node
-    // on some later, unrelated trigger.
-    onNodeNamed((notice) => registry.broadcast({ type: 'node_named', ...notice }));
-    let disposed = false;
-    let disposePending = false;
-    let server;
-    let uiContext;
-    let rebind;
-    let faultRetry;
-    let projection;
-    let notifyTurnAccepted = () => { };
-    let resetFrameState = () => { };
-    rebind = new RebindDriver({
-        nodeId, cfg, session, services, runtime, registry, toolGroups,
-        uiContext: () => uiContext,
-        faultRetry: () => faultRetry,
-        projection: () => projection,
-        setActiveSession: (candidate) => { activeSession = candidate; },
-        disposeAndExit: (reason, status) => disposeAndExit(reason, status),
-        onSessionRebind: () => {
-            resetFrameState();
-        },
-        reWelcomeAll: () => reWelcomeAll(),
-    });
-    // Pi's model controls mutate only the live engine. Commit the concrete model
-    // and thinking choice through crtrd before acknowledging or broadcasting it,
-    // so the daemon remains the only durable canvas owner.
-    const persistModelChoice = async (pinnedOverride, userSelected = false) => {
-        const liveSession = rebind.session();
-        const spec = formatModelSpec(liveSession.model, liveSession.thinkingLevel);
-        if (spec === null)
-            return null;
-        const result = await commitBrokerModel(nodeId, { spec, pinnedOverride, userSelected });
-        if (userSelected) {
-            delete process.env['CRTR_MODEL_INTENT'];
-            process.env['CRTR_MODEL_EXACT'] = '1';
-            cfg.model = result.modelOverride;
-            cfg.modelExact = true;
-        }
-        return result.modelOverride;
-    };
-    // Pi emits no AgentSessionEvent for a model switch, so after a successful
-    // set_model/cycle_model the broker announces it itself. A durable change is
-    // broadcast only after crtrd returns the committed override.
-    const broadcastModelChanged = async (persist = true, pinnedOverride, userSelected = false) => {
-        const liveSession = rebind.session();
-        const liveSpec = formatModelSpec(liveSession.model, liveSession.thinkingLevel);
-        const spec = persist ? await persistModelChoice(pinnedOverride, userSelected) : liveSpec;
-        registry.broadcast({ type: 'model_changed', model: isUnknownModel(liveSession.model) ? undefined : liveSession.model, spec });
-    };
-    const turnAdmission = createTurnAdmissionGate();
-    // The inbox watcher is Jiti-loaded and cannot import this native module's
-    // gate. Its idle delivery therefore calls this narrow process-global bridge:
-    // acquire admission first, then re-read the live session before prompt() so
-    // a viewer turn that won the race is joined rather than double-started.
-    const startIdleInboxTurn = (text) => {
-        void turnAdmission.admit((release) => {
-            const liveSession = rebind.session();
-            return liveSession
-                .prompt(text, {
-                preflightResult: release,
-                ...(liveSession.isStreaming ? { streamingBehavior: 'steer' } : {}),
-            })
-                .catch((error) => {
-                emitEvent({ level: 'error', event: 'broker.inbox.idle_prompt_failed', error });
-            });
-        });
-    };
-    globalThis[BROKER_IDLE_TURN_START] = startIdleInboxTurn;
-    faultRetry = new FaultRetry({
-        nodeId,
-        cfg,
-        retryProbe,
-        currentSession: () => rebind.session(),
-        currentServices: () => rebind.services(),
-        installedGeneration: () => rebind.installedGeneration(),
-        registryOf,
-        formatModelSpec,
-        broadcastModelChanged,
-        turnAdmission,
-    });
-    projection = new EventProjection({
-        registry,
-        faultRetry,
-        installedGeneration: () => rebind.installedGeneration(),
-        currentSession: () => rebind.session(),
-        notifyTurnAccepted: () => notifyTurnAccepted(),
-        emitStartupMilestone,
-        formatModelSpec,
-    });
-    const buildSnapshot = (client) => {
-        const liveSession = rebind.session();
-        const identified = snapshotMessages(liveSession, boundaryReviewId);
-        const tail = normalizeSnapshotTail(client.snapshotTail);
-        // A tail is only usable with stable ids, which let its recipient page back
-        // to the omitted history.
-        const retained = identified === undefined || tail === undefined ? identified : identified.slice(-tail);
-        const messages = retained?.map(({ message }) => message)
-            ?? liveSession.sessionManager.buildSessionContext().messages;
-        const fullToolGroupSummaries = toolGroups.summaries();
-        const retainedToolCallIds = retained !== undefined && tail !== undefined ? toolCallIds(messages) : undefined;
-        const toolGroupSummaries = retainedToolCallIds === undefined
-            ? fullToolGroupSummaries
-            : Object.fromEntries(Object.entries(fullToolGroupSummaries).filter(([id]) => retainedToolCallIds.has(id)));
-        return ({
-            messages,
-            ...(retained === undefined ? {} : { messageIds: retained.map(({ id }) => id) }),
-            messageVisibility: retained?.map(({ visibility }) => visibility)
-                ?? messages.map(() => 'visible'),
-            turnVisibility: currentTurnVisibility(),
-            stats: liveSession.getSessionStats(),
-            // pi's `get_state` (rpc-mode.js), field for field, from the same getters.
-            // The ONE divergence: a model-less session (undefined OR the SDK
-            // unknown-stub) reports no model, matching broadcastModelChanged — never a
-            // fictitious `unknown` selection.
-            state: {
-                model: isUnknownModel(liveSession.model) ? undefined : liveSession.model,
-                thinkingLevel: liveSession.thinkingLevel,
-                isStreaming: liveSession.isStreaming,
-                isCompacting: liveSession.isCompacting,
-                steeringMode: liveSession.steeringMode,
-                followUpMode: liveSession.followUpMode,
-                sessionFile: liveSession.sessionFile,
-                sessionId: liveSession.sessionId,
-                sessionName: liveSession.sessionName,
-                autoCompactionEnabled: liveSession.autoCompactionEnabled,
-                messageCount: liveSession.messages.length,
-                pendingMessageCount: liveSession.pendingMessageCount,
-            },
-            // Broker-owned levels (see BrokerSnapshot.display). Copied out so a later
-            // mutation of the retained maps cannot alias a frame already serialized.
-            display: {
-                ...registry.displaySnapshot(),
-            },
-            toolGroupSummaries,
-            workingActivity: projection.currentWorkingActivity(),
-            // The UNRUN queue's texts, read non-destructively (`clearQueue()` would
-            // consume them). Same two arrays a live `queue_update` carries, so a client
-            // that attaches mid-queue lands on the state its next `queue_update` would
-            // have produced.
-            queued: {
-                steering: [...liveSession.getSteeringMessages()],
-                followUp: [...liveSession.getFollowUpMessages()],
-            },
-        });
-    };
-    // Send a client its catch-up snapshot. welcome.pending_dialog carries a single
-    // still-in-flight dialog to a WRITABLE client attaching mid-dialog; an observer
-    // can never answer one, so observers get null. The pendingDialogs map is
-    // insertion-ordered — the first entry is the canonical one carried here; any
-    // extras are replayed explicitly by the caller (rare: concurrent dialogs).
-    const sendWelcome = (client) => {
-        const first = client.role === 'controller' ? pendingDialogs.values().next().value : undefined;
-        registry.sendFrame(client, {
-            type: 'welcome',
-            snapshot: buildSnapshot(client),
-            role: client.role,
-            pending_dialog: first !== undefined ? first.request : null,
-            agentDir: getAgentDir(),
-        }, true);
-        // No display_* replay: the retained extension state rides IN the snapshot
-        // (`snapshot.display`), so catch-up is one atomic frame. A viewer attaching
-        // after an idle brief was painted still sees it on first paint, and there is
-        // no window between `welcome` and the replay where chrome renders blank.
-    };
-    // Attach-mid-dialog replay: a dialog raised before this client attached is
-    // still pending (a peer detaching never cancels one — see makeBrokerUiContext),
-    // so a writable client joining afterwards is handed every in-flight dialog and
-    // becomes a full peer in the race to answer it. `welcome.pending_dialog` already
-    // carried the FIRST entry, so this replays only the extras.
-    const replayExtraPendingDialogsTo = (client) => {
-        const pend = [...pendingDialogs.values()];
-        for (let i = 1; i < pend.length; i++)
-            registry.sendFrame(client, pend[i].request);
-    };
-    // After a session-replacing op (new_session/switch_session/fork) the engine's
-    // entire message history changed, so every attached viewer must rebuild from a
-    // fresh snapshot of the NEW session.
-    const reWelcomeAll = () => {
-        registry.forEachHelloed(sendWelcome);
-    };
-    // The single exit helper: dispose the engine, close + unlink the
-    // socket, exit 0. Idempotent — every trigger converges here.
-    const completeExit = (status) => {
-        if (disposed)
-            return;
-        disposed = true;
-        // Daemon teardown cannot wait for a recap's 45-second model timeout. Preserve
-        // exactly the newest already-capped input so the successor broker can finish
-        // it, persist the normal summary, and remove the handoff record.
-        toolGroups.persistPendingSummary();
-        projection.dispose();
-        // disposeActiveSession atomically clears the process-global pointer before
-        // disposing — whichever engine session (committed or an in-flight rebind
-        // candidate) it currently names, matching broker-cli's fatal-handler primitive.
-        disposeActiveSession();
-        try {
-            server?.close();
-        }
-        catch {
-            /* ignore */
-        }
-        // Destroy every viewer socket without waiting for close events.
-        registry.dispose();
-        try {
-            if (existsSync(sockPath))
-                unlinkSync(sockPath);
-        }
-        catch {
-            /* ignore */
-        }
-        // A clean exit never leaves a stale presence claim behind.
-        registry.clearAttachState();
-        process.exit(status);
-    };
-    const disposeAndExit = (reason, status = 0) => {
-        if (disposed)
-            return;
-        const graceful = reason === 'shutdown-hook' || reason === 'shutdown-after-settle';
-        // A graceful shutdown (yield, dormancy, daemon restart) is the final
-        // boundary of the conversation's last tool group. Group state lives only in
-        // this process, so a group left open here is unsummarizable forever and its
-        // calls render raw in every future view of the transcript. Close it now —
-        // generateSettledToolGroup registers its task synchronously, so the wait
-        // below covers the summary it launches. Any pending tool arguments are
-        // included without inventing a result; the visible abort remains outside
-        // the recap and Ctrl+O retains every underlying call row.
-        if (graceful)
-            toolGroups.finishOpenToolGroup(true);
-        // A normal terminal shutdown follows a visible boundary that may have just
-        // launched a capped (45s) headless summary. Keep the broker and its child
-        // alive until those already-started tasks persist/broadcast, rather than
-        // process.exit() orphaning pi and losing the sidecar. Abrupt failures and
-        // signals retain their existing immediate teardown behavior.
-        if (graceful && toolGroups.hasSummaryTasks()) {
-            if (disposePending)
-                return;
-            disposePending = true;
-            void toolGroups.waitForSummaryTasks().finally(() => completeExit(status));
-            return;
-        }
-        completeExit(status);
-    };
-    // Extension-dialog routing (C2). makeBrokerUiContext owns the dialogPromise;
-    // here we just give it the three broker-side hooks it needs: the live set of
-    // writable clients (empty = nobody can answer → noOp fallback), how to forward a
-    // dialog to one of them, and the pending-dialog registry whichever one answers
-    // first settles through. The zero-writable path NEVER hangs and NEVER waits on a
-    // per-dialog timeout (design §5.4's timeout premise is false — see
-    // makeBrokerUiContext).
-    uiContext = makeBrokerUiContext({
-        writable: () => registry.writableClients(),
-        forward: (client, request) => registry.sendFrame(client, request),
-        pending: pendingDialogs,
-        broadcast: (frame) => registry.broadcastUi(frame),
-        // A deliberate managed-provider cooldown wait is known liveness, not a wedged
-        // stream: pause the dead-stream watchdog for its duration. Only pause for a
-        // finite future deadline, and resume ONLY while the same turn is still
-        // awaiting the provider (streaming, no tool running) so a wait that outlived
-        // its turn can't rearm a stale session; otherwise fully reset.
-        onKnownStreamWait: (deadlineMs) => projection.knownStreamWait(deadlineMs),
-    });
-    // Bind the rebind driver before accepting socket frames. It owns subscription
-    // replacement and its bounded runtime-mutation admission lane.
-    rebind.setRebindSession();
-    await rebind.enqueueRebind(session, services);
-    const frameDispatch = createFrameDispatchContext({
-        nodeId, cfg, registry, toolGroups, projection, rebind, boundaryReviewId,
-        pendingDialogs, sendWelcome, replayExtraPendingDialogsTo, reWelcomeAll, disposeAndExit,
-        persistModelChoice, broadcastModelChanged, registryOf, formatModelSpec,
-        formatExactModelSpec, turnAdmission, resolveLaunchModel,
-    });
-    notifyTurnAccepted = frameDispatch.notifyTurnAccepted;
-    resetFrameState = frameDispatch.resetForSession;
-    // 4 (plan): the socket listener — unlink any stale socket first.
-    try {
-        if (existsSync(sockPath))
-            unlinkSync(sockPath);
-    }
-    catch {
-        /* a fresh listen below will surface a real problem */
-    }
-    server = createServer((socket) => {
-        const client = registry.create(socket);
-        socket.on('data', (chunk) => {
-            let frames;
-            try {
-                frames = client.decoder.push(chunk);
-            }
-            catch (err) {
-                // G7: a client frame over the bounded decoder caps (FrameOverflowError) is
-                // cap-and-dropped — best-effort error frame, then destroy the peer. The
-                // broker survives. The try/catch is around push() itself (not just the
-                // per-frame loop) because push() throws BEFORE returning any frames.
-                if (err instanceof FrameOverflowError) {
-                    registry.sendFrame(client, { type: 'error', code: 'frame_overflow', message: err.message });
-                    registry.dropClient(client, `frame overflow: ${err.message}`);
-                }
-                else {
-                    registry.dropClient(client, `decoder error: ${String(err)}`);
-                }
-                return;
-            }
-            for (const raw of frames) {
-                try {
-                    handleFrame(frameDispatch, client, raw);
-                }
-                catch {
-                    /* one bad frame never crashes the broker */
-                }
-            }
-        });
-        const drop = () => {
-            registry.removeClient(client); // a viewer disconnected
-            // A writable client detaching does NOT cancel in-flight dialogs — they stay
-            // pending under the broker-side default timeout, so a peer that is still
-            // attached (or one that attaches next and gets the replay) can still answer.
-            // Only an answer, the timeout, or an abort resolves one.
-        };
-        socket.on('close', drop);
-        socket.on('error', () => {
-            /* close follows; drop there */
-        });
-    });
-    server.on('error', (err) => {
-        // A recursive error raised during/after disposeAndExit's own server.close()
-        // (or any other exit already in flight) must not emit a second canonical
-        // failure or dispose twice.
-        if (disposed)
-            return;
-        emitEvent({ level: 'error', event: 'broker.socket.failed', error: err });
-        disposeAndExit('socket-error', 1);
-    });
-    server.listen(sockPath, async () => {
-        // Binding view.sock is the exact inverse of a `connect ENOENT view.sock`
-        // fault, so the moment the listener accepts, any socket-absence marker a
-        // viewer/relay recorded during the revive→bind gap is provably stale. The
-        // broker owns this socket, so it clears those markers here rather than
-        // waiting for a client to reconnect — a headless node with nobody attached
-        // never gets that reconnect, which is how the stale ⚠ leaked. A genuine
-        // post-bind failure is re-recorded by the next failed client op.
-        void Promise.all([
-            mutateBrokerFault(nodeId, { op: 'clear', link: 'viewer↔broker' }),
-            mutateBrokerFault(nodeId, { op: 'clear', link: 'relay↔broker' }),
-        ]).catch((error) => emitEvent({ level: 'error', event: 'broker.daemon.operation.failed', node_id: nodeId, error, fields: { operation: 'broker_socket_bound_fault_clear' } }));
-        // The listener is also the broker startup boundary: a pending or
-        // surviving-admitted provider episode is re-armed only once this
-        // replacement can accept its normal viewer/daemon traffic. Independent of
-        // the link faults cleared above — those are viewer/relay socket markers,
-        // this is the provider retry episode. An invalidated record is
-        // intentionally inert inside FaultRetry.
-        let recovery;
-        try {
-            recovery = await faultRetry.recoverOnStartup();
-        }
-        catch (error) {
-            emitEvent({ level: 'error', event: 'broker.daemon.operation.failed', node_id: nodeId, error, fields: { operation: 'recovery_startup' } });
-            disposeAndExit('recovery-startup-failed', 1);
-            return;
-        }
-        // A launch prompt delivers only after the listener is accepting, so a
-        // root-spawn readiness proof and prompt admission share one boundary. This
-        // includes the one continuation carried by a clean runtime-abort resume.
-        // A model-less tier-3 boot (session.model === undefined) leaves the prompt
-        // pending in kickoffPending; drivePendingKickoff is a no-op until the
-        // reload_auth re-drive resolves a model, at which point it fires. For the
-        // common model-present path this fires immediately — unchanged behavior.
-        //
-        // recoverOnStartup returning 'retry-armed' means a resuming, non-cycling
-        // replacement is re-driving a provider-fault recovery card instead — this
-        // can never discard a birth mandate, a wake card, or a revive kickoff,
-        // because every kickoff-composing branch other than the runtime-restart-abort
-        // continuation is either !hasSessionPath or newCycle, both of which
-        // recoverOnStartup already refuses outright by returning 'none' before an
-        // episode can even be considered. So the only prompt this suppression can
-        // ever suppress is that one continuation, and only when the episode proves
-        // the resume made no progress past its anchor.
-        if (recovery !== 'retry-armed' && cfg.firstPrompt !== undefined && cfg.firstPrompt !== '') {
-            // The spawner recorded who authored this kickoff (a birth mandate, a
-            // cron wake, a revive card); announce it against the exact text so the
-            // stamp writer claims it on the message pi persists.
-            const kickoffOrigin = decodeKickoffOrigin(process.env[KICKOFF_ORIGIN_ENV]);
-            if (kickoffOrigin !== null)
-                announceMessageOrigin(cfg.firstPrompt, kickoffOrigin);
-            frameDispatch.kickoff(cfg.firstPrompt);
-        }
-    });
-    // Initialize presence to the truthful zero state at boot — this also
-    // overwrites a stale attach.json a crashed prior incarnation left behind.
-    registry.persistAttachState();
-    // Record teardown-aborted only after Pi persists the aborted turn.
-    // Timeout or rejection leaves the SQL interrupted-turn evidence intact.
-    const ABORT_BEFORE_EXIT_MS = 2_500;
-    let signalExitInFlight = false;
-    const abortAndExit = async (reason) => {
-        if (disposed || signalExitInFlight)
-            return;
-        signalExitInFlight = true;
-        const busy = rebind.isAgentRunActive() || rebind.session().isStreaming || frameDispatch.pendingPromptDispatches() > 0;
-        if (busy) {
-            const deadline = Date.now() + ABORT_BEFORE_EXIT_MS;
-            // prompt() has a real async pre-turn window where abort() silently no-ops.
-            // Wait only within the daemon's fixed teardown budget for it to become
-            // abortable. A still-pending setup is deliberately marked dirty below so
-            // recovery starts a cycle instead of silently losing the prompt on resume.
-            while (frameDispatch.pendingPromptDispatches() > 0 && !rebind.session().isStreaming && Date.now() < deadline) {
-                await new Promise((resolve) => setTimeout(resolve, 25));
-            }
-            if (rebind.session().isStreaming) {
-                const remaining = deadline - Date.now();
-                if (remaining > 0) {
-                    let timer;
-                    try {
-                        const settled = await Promise.race([
-                            rebind.session().abort().then(() => true, () => false),
-                            new Promise((resolve) => { timer = setTimeout(() => resolve(false), remaining); }),
-                        ]);
-                        if (settled)
-                            await recordBrokerTurn(nodeId, { event: 'closed', end_reason: 'teardown-aborted' });
-                    }
-                    finally {
-                        if (timer !== undefined)
-                            clearTimeout(timer);
-                    }
-                }
-            }
-            else if (frameDispatch.pendingPromptDispatches() > 0 || rebind.isAgentRunActive()) {
-                // The engine never reached an abortable persisted turn in the budget.
-                // Preserve the dirty interrupted-turn witness so recovery resumes the
-                // saved transcript and explicitly re-drives the stopped work.
-                await recordBrokerTurn(nodeId, { event: 'interrupted' });
-            }
-        }
-        disposeAndExit(reason);
-    };
-    process.on('SIGTERM', () => { void abortAndExit('SIGTERM'); });
-    process.on('SIGINT', () => { void abortAndExit('SIGINT'); });
-}
-// snapshotMessages — the catch-up snapshot's ordered message history.
-//
-// The broker is the SOLE writer of the node's session `.jsonl`, so the session
-// manager's persisted tree (`buildSessionContext`) is the canonical, complete,
-// ordered history — byte-identical to what a dormant reader (crouter-web's static
-// normalizer) reconstructs from the same file. We serve THAT, NOT the agent's
-// live `session.messages` (`agent.state.messages`), because pi's recovery paths
-// mutate the live array away from the persisted history: auto-retry, context-
-// overflow recovery, and compaction each SLICE the errored/superseded assistant
-// message out of `state.messages` while DELIBERATELY keeping it on disk ("keep in
-// session for history", agent-session.js). So `session.messages` can OMIT — or, via
-// branch/compaction reshaping, reorder — a turn the `.jsonl` still holds. Pre-
-// close that drift is invisible (the live stream and the live array agree); after
-// a revive the welcome snapshot built from the reloaded array would diverge from
-// the on-disk history a dormant viewer just saw. Reconstructing from the session
-// manager makes the live snapshot == the persisted history (single source of
-// truth); the relayed live stream then continues from there.
-//
-// `AgentSession.sessionManager` is a public readonly field of the real pi SDK; the
-// fake-engine test fixture mirrors the same `sessionManager.buildSessionContext()`
-// surface (plus, where present, the tree accessors `cycleAwareMessages` reads).
-// A refresh-yielded node keeps every prior cycle in the SAME `.jsonl` as sibling
-// branches (session-cycles.ts) — `cycleAwareMessages` replays them ahead of the
-// live cycle's context so the welcome snapshot renders one continuous
-// conversation instead of just the post-yield window; single-cycle sessions and
-// the fake-engine fixture (no tree accessors) fall through to plain
-// `buildSessionContext().messages` unchanged.
-function toolCallIds(messages) {
-    const ids = new Set();
-    for (const message of messages) {
-        if (message.role !== 'assistant' || !Array.isArray(message.content))
-            continue;
-        for (const part of message.content) {
-            if (part !== null && typeof part === 'object' && part.type === 'toolCall' && typeof part.id === 'string')
-                ids.add(part.id);
-        }
-    }
-    return ids;
-}
-export function snapshotMessages(session, boundaryReviewId) {
-    // Cast: the real SDK's `SessionEntry.data` is `unknown` (untyped custom-entry
-    // payload), narrower than `CycleSessionManagerLike`'s structural read of the
-    // `crtr-cycle` marker's `{cycle, fromLeaf}` shape — the fields we read off it
-    // are ones ONLY this module's own `appendCustomEntry` call (above) ever writes.
-    const manager = session.sessionManager;
-    const messages = cycleAwareMessages(manager);
-    if (messages !== undefined) {
-        hydratePersistedAdvertisedCommandMessages(messages.map(({ message }) => message));
-    }
-    return messages === undefined
-        ? undefined
-        : projectTranscript(messages, {
-            boundaryReviewId,
-            sessionEntries: manager.getEntries?.(),
-        });
-}
-// resolveLaunchModel — the SOLE launch model-selection policy, module-scoped
-// so both buildForManager (initial boot, inside buildBrokerSession below) and
-// the reload_auth re-drive (inside runBroker, a DIFFERENT function scope) can
-// invoke the identical decision against a live `services`/`cfg` without
-// re-running session/service creation. Returns undefined when NO candidate is
-// viable at all (tier 3) — this is NOT a fault; the caller decides what to do
-// with it (construct a model-less session at boot, or leave a running session
-// alone on a failed re-drive attempt).
-function currentBrokerNodeId() {
-    const nodeId = envNodeId();
-    if (nodeId === undefined || nodeId === '')
-        throw new Error('broker launch is missing CRTR_NODE_ID');
-    return nodeId;
-}
-async function resolveLaunchModel(services, cfg) {
-    const routeRequest = modelRequestFromConfig(cfg.model, envModelIntent(), cfg.modelExact === true);
-    if (routeRequest === undefined)
-        return undefined;
-    const registry = registryOf(services);
-    const routeOptions = {
-        cwd: envNodeCwd() ?? cfg.cwd,
-        profileId: envProfileId(),
-    };
-    const unknown = unregisteredConcreteModel(routeRequest, registry, routeOptions);
-    if (unknown !== undefined) {
-        await mutateBrokerFault(currentBrokerNodeId(), { op: 'record', input: { link: 'crtr→pi', op: 'model resolution at launch', kind: 'model-not-found', retry: { disposition: 'fatal' }, message: `model '${unknown.request.spec}' is not registered in the serving model registry` } });
-        throw new Error(`[broker] FATAL: model '${unknown.request.spec}' is not registered in the serving model registry`);
-    }
-    const selection = selectInitialModelRoute(routeRequest, registry, routeOptions);
-    const selected = selection.selected;
-    if (selected !== undefined) {
-        const candidate = selected.candidate;
-        if ((candidate.rank ?? 0) > 0)
-            emitEvent({ level: 'warn', event: 'broker.model.launch_fallback', fields: { requested: cfg.model, selected: `${candidate.providerId}/${candidate.modelId}`, route_id: candidate.routeId, credential_source: candidate.credentialSource, rank: candidate.rank } });
-        return { model: selected.model, thinkingLevel: candidate.thinkingLevel };
-    }
-    if (cfg.modelExact === true) {
-        const rejection = selection.rejected.map(({ candidate, reason }) => `'${candidate.providerId}/${candidate.modelId}' ${reason}`).join('; ');
-        await mutateBrokerFault(currentBrokerNodeId(), { op: 'record', input: { link: 'crtr→pi', op: 'model resolution at launch', kind: 'model-not-found', retry: { disposition: 'fatal' }, message: `exact-consult model '${cfg.model}' is unavailable — refusing to substitute (${rejection})` } });
-        throw new Error(`[broker] FATAL: exact-consult model '${cfg.model}' is unavailable`);
-    }
-    emitEvent({ level: 'warn', event: 'broker.model.none_viable', fields: { rejected_candidates: selection.rejected.slice(0, 16).map(({ candidate, reason }) => ({ provider: candidate.providerId, model: candidate.modelId, reason, route_id: candidate.routeId, credential_source: candidate.credentialSource })), rejected_candidates_omitted: Math.max(0, selection.rejected.length - 16) } });
-    return undefined;
-}
-/**
- * Wrap a live ModelRuntime so a model-less `createAgentSessionFromServices`
- * call can't have the SDK's own `findInitialModel` silently pick a model
- * behind crouter's launch policy. Every model-list read the SDK performs during
- * construction must be intercepted:
- *   - `getModel()` — findInitialModel step 3 (settingsManager's durable
- *     `defaultProvider`/`defaultModel`, persisted into a GLOBAL settings.json by
- *     every `session.setModel()` call the broker itself already makes, so this
- *     is a live bypass on any machine that has ever picked a model, not a
- *     theoretical corner case) and the resume path's model restore.
- *   - `getAvailableSnapshot()` — findInitialModel step 4 and
- *     restoreModelFromSession's fallback both take the registry default off this
- *     SYNCHRONOUS snapshot (model-resolver.js:511/556).
- *   - `getAvailable()` — the async refresh-and-list sibling, masked alongside it
- *     so no construction-time list read can reach the real registry through
- *     either accessor.
- * Masking any one of them alone leaves the others wide open. Everything else
- * (`getModels`, `hasConfiguredAuth`, `refresh`, …) passes through untouched via
- * `Reflect.get`. Used ONLY
- * for the one model-less construction call; the `services` returned to every
- * other caller (reload_auth, hasConfiguredAuth checks, …) keeps the REAL
- * unwrapped registry.
- *
- * CONSTRUCTION-ONLY MASK: the SDK stores `options.services.modelRuntime` as the
- * session's private `_modelRuntime` for its ENTIRE lifetime and never replaces
- * it (agent-session-services.js:104-119, sdk.js:253). A permanent mask would
- * leave list_models (the available list→[]), cycle_model, and provider-rotation
- * fallback (getModel()→undefined) broken forever for any model-less-booted node,
- * even after a later /login selects a model. Model selection can only happen
- * DURING construction, so this proxy self-heals: it masks while `masked`, then
- * `reveal()` (called immediately after createAgentSessionFromServices returns)
- * flips the SAME retained proxy to a transparent passthrough forever after.
- */
-function modelLessRegistry(real) {
-    let masked = true;
-    const runtime = new Proxy(real, {
-        get(target, prop, receiver) {
-            // `getAvailableSnapshot` is the sync list findInitialModel reads; its
-            // async sibling `getAvailable` refreshes first and returns the same set.
-            if (masked && prop === 'getAvailableSnapshot')
-                return () => [];
-            if (masked && prop === 'getAvailable')
-                return async () => [];
-            if (masked && prop === 'getModel')
-                return () => undefined;
-            return Reflect.get(target, prop, receiver);
-        },
-    });
-    return { runtime, reveal: () => { masked = false; } };
-}
-// buildBrokerSession (plan T4 steps 2–4) — turn the launch recipe into a live
-// engine session via the pi SDK SERVICES path. Exported so the C3/C4 real-SDK
-// regression tests can drive the EXACT production wiring (not the mock).
-export async function buildBrokerSession(engine, cfg) {
-    // 2. Build cwd-bound runtime services via the SERVICES path (C3) — NOT plain
-    //    createAgentSession. createAgentSessionServices builds + reloads the
-    //    resource loader (the `-e` canvas extensions + --append-system-prompt) and
-    //    REGISTERS extension-provided model providers into the ModelRegistry (it is
-    //    also where extension flag values would be applied — the broker recipe
-    //    carries none today). Plain createAgentSession does NEITHER, so a node whose
-    //    model comes from a custom-provider extension would get NO model. Mirrors pi
-    //    main.js (createAgentSessionServices → …FromServices).
-    //
-    //    T3 session-rebind: services + model + session creation is factored into
-    //    `buildForManager` so it can serve BOTH the initial boot AND the
-    //    AgentSessionRuntime factory it is reused as below (new_session/
-    //    switch_session/fork rebuild the session by re-invoking it for a new
-    //    SessionManager). Mirrors pi main.js's `createRuntime`.
-    const agentDir = getAgentDir();
-    const buildForManager = async (o) => {
-        // pi 0.82 owns credentials through an app-supplied CredentialStore. Hand it
-        // crouter's, which serves managed providers straight from the subscription
-        // pool and everything else from auth.json — both read fresh under their lock
-        // on every call, because the rotation extension, `/provider-sub`, and the
-        // daemon's login fan all write out of band mid-session and pi's own default
-        // store would serve a cached view with no reload seam.
-        const { authPath, modelsPath } = modelRuntimePaths(o.agentDir);
-        const modelRuntime = await ModelRuntime.create({
-            credentials: new PoolCredentialStore(authPath),
-            modelsPath,
-        });
-        const services = await engine.createAgentSessionServices({
-            cwd: o.cwd,
-            agentDir: o.agentDir,
-            modelRuntime,
-            resourceLoaderOptions: {
-                additionalExtensionPaths: cfg.extensionPaths,
-                appendSystemPrompt: cfg.appendSystemPromptPath !== undefined ? [cfg.appendSystemPromptPath] : undefined,
-                // Suppress pi's <project_context> AGENTS.md/CLAUDE.md injection in the
-                // system prompt. crouter imports either source into the project's root
-                // memory INDEX and surfaces that front door in first-message context;
-                // pi's file-based loader is not a second guidance path.
-                noContextFiles: true,
-            },
-        });
-        const extensionResult = services.resourceLoader.getExtensions();
-        // buildBrokerSession also supports standalone SDK consumers (for example a
-        // custom-provider extension test) that are not canvas nodes. Production
-        // canvas invocations always carry the full mandatory set after preflight;
-        // once any canvas hook is requested, require every one to load.
-        if (cfg.extensionPaths.some((path) => CANVAS_EXTENSIONS.includes(path))) {
-            const loadedPaths = new Set(extensionResult.extensions.map((extension) => extension.path));
-            const missingHooks = CANVAS_EXTENSIONS.filter((path) => !loadedPaths.has(path));
-            if (missingHooks.length > 0) {
-                const errors = extensionResult.errors
-                    .filter((error) => CANVAS_EXTENSIONS.includes(error.path))
-                    .map((error) => `${error.path}: ${error.error}`)
-                    .join('; ');
-                throw new Error(`[broker] FATAL: mandatory canvas extensions failed to load: ${missingHooks.join(', ')}${errors === '' ? '' : ` (${errors})`}`);
-            }
-        }
-        // 3. Resolve one viable model — resolveLaunchModel (module-scoped above) is
-        // the SOLE launch selection policy, shared with the reload_auth re-drive so
-        // a later /login re-runs the identical decision against this same `services`.
-        const resolved = await resolveLaunchModel(services, cfg);
-        // Tier 3: no viable candidate at all. Do NOT fault — construct a live
-        // model-less session so the socket/listener still comes up and the user can
-        // /login; suppress the SDK's own findInitialModel auto-selection
-        // (modelLessRegistry) so a stale global settings.json default or an
-        // available-but-policy-rejected model can't sneak in behind crouter's back.
-        const model = resolved?.model;
-        const thinkingLevel = resolved?.thinkingLevel;
-        const modelLess = resolved === undefined ? modelLessRegistry(services.modelRuntime) : undefined;
-        const constructionServices = modelLess !== undefined
-            ? { ...services, modelRuntime: modelLess.runtime }
-            : services;
-        const created = await engine.createAgentSessionFromServices({
-            services: constructionServices,
-            sessionManager: o.sessionManager,
-            model,
-            thinkingLevel,
-            tools: cfg.tools,
-            sessionStartEvent: o.sessionStartEvent,
-        });
-        installAdvertisedCommandInvocationContract(created.session);
-        // The resource loader has completed its initial load, but extensions have
-        // not received session_start yet. Freeze the Gateway capability boundary.
-        captureSessionChatCapabilities(created.session);
-        // CONSTRUCTION-ONLY MASK — see modelLessRegistry: reveal now that model
-        // selection (construction-time only) is done, so a later /login re-drive's
-        // list_models/cycle_model/provider-rotation see the real registry.
-        modelLess?.reveal();
-        return { ...created, services };
-    };
-    // 4. Select the SessionManager: FORK (spawn-time --fork), OPEN (resume), or
-    //    CREATE (fresh). The broker is the sole writer of the resulting .jsonl.
-    const resumePath = cfg.resumeSessionPath;
-    const forking = cfg.forkFrom !== undefined && cfg.forkFrom !== '';
-    if (!forking &&
-        (resumePath === undefined || resumePath === '') &&
-        cfg.resumeSessionId !== undefined &&
-        cfg.resumeSessionId !== '') {
-        // SessionManager.open() takes a FILE path — it only path-normalizes; it does
-        // NOT resolve a bare uuid to its .jsonl the way pi's CLI does (via
-        // SessionManager.list). A bare-id-only resume would open a nonexistent
-        // <cwd>/<uuid> and silently start an EMPTY session. Fail loud: revive always
-        // passes the .jsonl path, so a bare id means an old node that never captured
-        // pi_session_file — mis-resuming it silently is worse than a crash.
-        throw new Error(`[broker] resume requires a session .jsonl PATH; got only a bare id ` +
-            `'${cfg.resumeSessionId}' (pi_session_file was never captured for this node)`);
-    }
-    // A fork is a fresh spawn (resuming=false) so its kickoff firstPrompt fires: a
-    // `node new --fork-from <id>` gives the new node the source's full history AND a
-    // new task to start on. An ordinary resume supplies no prompt, but a
-    // broker-certified runtime-abort resume deliberately carries a continuation.
-    //
-    // A refresh-yield CYCLES instead: `cfg.newCycle` (the `--crtr-new-cycle` token)
-    // marks a revive that reuses this SAME `.jsonl` rather than resuming it — the
-    // session manager opens the file, then resets the leaf and roots a `crtr-cycle`
-    // marker entry (data: `{cycle, fromLeaf}`) as the new cycle's ROOT before the
-    // session is built. Custom entries never enter LLM context, so the freshly
-    // rooted branch is exactly as clean as a brand-new session; `cycleAwareMessages`
-    // (session-cycles.ts) is the display-side counterpart that replays every prior
-    // cycle for snapshot rendering. cycling ⇒ resuming=false, so the kickoff
-    // firstPrompt fires below just like a true fresh launch.
-    const hasSessionPath = !forking && resumePath !== undefined && resumePath !== '';
-    const cycling = hasSessionPath && cfg.newCycle === true;
-    const resuming = hasSessionPath && !cycling;
-    let sessionManager;
-    if (forking) {
-        // Spawn-time fork via pi's REAL fork seam, SessionManager.forkFrom — the exact
-        // method pi's own `--fork` CLI flag uses (main.js forkSessionOrExit). It writes
-        // a NEW session file with a NEW id and a `parentSession` header pointing at the
-        // source, then copies the source's history into it. NOT a naïve `.jsonl` copy
-        // (which would collide session ids and drop the fork metadata), and NOT
-        // runtime.fork() (which forks an entry WITHIN an already-loaded session — there
-        // is no current session to fork at boot). The caller (spawn.ts resolveForkSource)
-        // resolves cfg.forkFrom to an absolute source .jsonl before launch, so a bad ref
-        // fails loudly here (forkFrom throws on an empty/invalid/header-less source).
-        sessionManager = engine.SessionManager.forkFrom(cfg.forkFrom, cfg.cwd);
-    }
-    else if (resuming || cycling) {
-        sessionManager = engine.SessionManager.open(resumePath);
-        if (cycling) {
-            const fromLeaf = sessionManager.getLeafId();
-            sessionManager.resetLeaf();
-            sessionManager.appendCustomEntry(CRTR_CYCLE_CUSTOM_TYPE, {
-                cycle: Number(process.env['CRTR_CYCLES']),
-                fromLeaf,
-            });
-        }
-    }
-    else {
-        sessionManager = engine.SessionManager.create(cfg.cwd);
-    }
-    // When the engine exposes the replacement API (real SDK), wrap the builder in an
-    // AgentSessionRuntime so new_session/switch_session/fork work; the runtime
-    // re-invokes `buildForManager` for each new SessionManager. The fake-engine
-    // fixture omits it — fall back to a single direct build (those three ops then
-    // reply error{engine_error}).
-    if (engine.createAgentSessionRuntime !== undefined) {
-        const factory = async (o) => {
-            const r = await buildForManager({
-                cwd: o.cwd,
-                agentDir: o.agentDir,
-                sessionManager: o.sessionManager,
-                sessionStartEvent: o.sessionStartEvent,
-            });
-            return { ...r, diagnostics: r.services.diagnostics ?? [] };
-        };
-        const runtime = await engine.createAgentSessionRuntime(factory, {
-            cwd: cfg.cwd,
-            agentDir,
-            sessionManager,
-        });
-        return { session: runtime.session, services: runtime.services, resuming, runtime };
-    }
-    const r = await buildForManager({ cwd: cfg.cwd, agentDir, sessionManager });
-    return { session: r.session, services: r.services, resuming, runtime: undefined };
-}
-export function makeBrokerUiContext(deps) {
-    // The dialog router. C2 (scout mq5thyli): the design §5.4 premise — that an
-    // unattended dialog auto-resolves on its OWN timeout — is FALSE. `timeout` is
-    // OPTIONAL on dialog opts, editor() takes none, and almost no real extension
-    // passes one (permission-gate / confirm-destructive / plan-mode / subagent all
-    // omit it). A timeout-reliant unattended node therefore deadlocks the agent
-    // turn FOREVER. So with NO WRITABLE client attached we fall back to the SDK's
-    // noOp UI behavior — resolve to the default (deny / cancel / undefined)
-    // IMMEDIATELY, never arming a timer, never waiting. With one or more, the dialog
-    // is fanned out to all of them under a broker-side timeout+abort, so viewers
-    // that attach but never answer cannot hang the turn either.
-    const dialogPromise = (defaultValue, request, parse, opts) => {
-        if (opts?.signal?.aborted)
-            return Promise.resolve(defaultValue);
-        // Snapshot the writable set ONCE, at raise time — the fan-out targets and the
-        // zero-answerer decision must agree.
-        const targets = deps.writable();
-        // C2 (Wave-0, KEEP): nobody can answer at raise time → noOp, resolved at once.
-        // No timer, no wait, no deadlock.
-        if (targets.length === 0)
-            return Promise.resolve(defaultValue);
-        // At least one writable client: register the dialog FIRST (so a client that
-        // attaches mid-dialog gets it replayed and joins the race), fan it out to every
-        // target, and ALWAYS arm a broker-side timeout (C2 anti-deadlock): viewers that
-        // never answer — or all detach — can never hang the turn. Honor a shorter
-        // per-dialog timeout if the extension passed one; otherwise the broker default.
-        // On fire it resolves to the SAFE default (deny/cancel/undefined). A detach
-        // does NOT cancel this — only an answer, the timeout, or an abort.
-        //
-        // EVERY settlement path runs the same `cleanup` (drop the entry, so a later
-        // answer for this id is a no-op) and then broadcasts `extension_ui_dismiss`
-        // keyed to this id, so all peers close their copy of exactly this dialog and
-        // nothing else.
-        return new Promise((resolve) => {
-            let timer;
-            const cleanup = () => {
-                if (timer !== undefined)
-                    clearTimeout(timer);
-                opts?.signal?.removeEventListener('abort', onAbort);
-                deps.pending.delete(request.id);
-            };
-            const onAbort = () => {
-                cleanup();
-                // The extension aborted this request out-of-band (e.g. an OAuth loopback
-                // callback won the race against a still-open manual-paste dialog). Tell
-                // every peer to tear down THIS overlay by id — an unanswered dialog whose
-                // broker entry we just dropped would otherwise linger onscreen with nothing
-                // left to answer it. Keyed to request.id so only the abandoned dialog is
-                // dismissed, never an unrelated one.
-                deps.broadcast({ type: 'extension_ui_dismiss', id: request.id });
-                resolve(defaultValue);
-            };
-            opts?.signal?.addEventListener('abort', onAbort, { once: true });
-            // N1: honor the extension's EXPLICIT per-dialog timeout if it passed one
-            // (longer or shorter than the broker default is fine — both are bounded);
-            // otherwise fall back to the broker default. The broker never RELIES on the
-            // extension having passed one (C2).
-            const ms = opts?.timeout !== undefined ? opts.timeout : DEFAULT_DIALOG_TIMEOUT_MS;
-            timer = setTimeout(() => {
-                cleanup();
-                // Same correlated teardown as onAbort: the broker resolved this dialog on
-                // its own timeout, so every peer's overlay (none of which has an
-                // independent timer) must be dismissed by id or it lingers forever.
-                deps.broadcast({ type: 'extension_ui_dismiss', id: request.id });
-                resolve(defaultValue);
-            }, ms);
-            if (typeof timer.unref === 'function')
-                timer.unref();
-            deps.pending.set(request.id, {
-                request,
-                resolve: (r) => {
-                    cleanup();
-                    // The first answer settled it; tell every OTHER client that was fanned
-                    // this dialog (and the answerer, for whom it is an idempotent no-op) to
-                    // close its copy. Without this, peers would sit on an overlay whose
-                    // answer can never arrive.
-                    deps.broadcast({ type: 'extension_ui_dismiss', id: request.id });
-                    resolve(parse(r));
-                },
-            });
-            for (const target of targets)
-                deps.forward(target, request);
-        });
-    };
-    const noop = () => { };
-    const ctx = {
-        // The broker-owned known-stream-wait control (see BrokerDialogDeps): a
-        // deliberate provider cooldown is KNOWN liveness, so the provider extension
-        // reaches this through the stable symbol to pause the dead-stream watchdog for
-        // the wait's duration. A no-op when the host supplied none.
-        [KNOWN_STREAM_WAIT_UI]: deps.onKnownStreamWait ?? ((_deadlineMs) => () => { }),
-        // pi's ExtensionUIContext exposes `theme`; package extensions (e.g. the OAuth
-        // billing adapter's status rendering) read it from ANY lifecycle hook. The
-        // SDK's noOpUIContext returns the process-global theme proxy here; we mirror
-        // that by reading the same global symbol (populated by initTheme() at broker
-        // boot — see runBroker). Without this property `ctx.ui.theme` is undefined and
-        // the hook throws, which the runner silently swallows while dropping the hook's
-        // returned payload (the OAuth 400 root cause).
-        get theme() {
-            const t = globalThis[Symbol.for('@earendil-works/pi-coding-agent:theme')];
-            if (t === undefined || t === null) {
-                throw new Error('Theme not initialized. Call initTheme() first.');
-            }
-            return t;
-        },
-        select: (title, options, opts) => dialogPromise(undefined, { type: 'extension_ui_request', id: randomUUID(), method: 'select', title, options, timeout: opts?.timeout }, (r) => ('cancelled' in r && r.cancelled ? undefined : 'value' in r ? r.value : undefined), opts),
-        confirm: (title, message, opts) => dialogPromise(false, { type: 'extension_ui_request', id: randomUUID(), method: 'confirm', title, message, timeout: opts?.timeout }, (r) => ('cancelled' in r && r.cancelled ? false : 'confirmed' in r ? r.confirmed : false), opts),
-        input: (title, placeholder, opts) => dialogPromise(undefined, { type: 'extension_ui_request', id: randomUUID(), method: 'input', title, placeholder, timeout: opts?.timeout }, (r) => ('cancelled' in r && r.cancelled ? undefined : 'value' in r ? r.value : undefined), opts),
-        editor: (title, prefill) => dialogPromise(undefined, { type: 'extension_ui_request', id: randomUUID(), method: 'editor', title, prefill }, (r) => ('cancelled' in r && r.cancelled ? undefined : 'value' in r ? r.value : undefined)),
-        // Non-blocking extension-UI relay: broadcast these to all viewers instead of
-        // dropping them, in pi's OWN `extension_ui_request` envelope (rpc-mode.js
-        // emits these three identically). The viewer owns the slots that render them,
-        // and the broker retains their last value for the welcome snapshot. The other
-        // non-blocking methods stay inert.
-        setStatus: (key, text) => deps.broadcast({
-            type: 'extension_ui_request',
-            id: randomUUID(),
-            method: 'setStatus',
-            statusKey: key,
-            statusText: text,
-        }),
-        setWidget: (key, content, options) => {
-            // setWidget's component-factory overload cannot be serialized over the
-            // socket (R1 caveat) — drop it and relay only the string[] form, exactly as
-            // pi's own RPC setWidget carries only `widgetLines`.
-            if (typeof content === 'function')
-                return;
-            deps.broadcast({
-                type: 'extension_ui_request',
-                id: randomUUID(),
-                method: 'setWidget',
-                widgetKey: key,
-                widgetLines: content,
-                widgetPlacement: options?.placement,
-            });
-        },
-        setTitle: (title) => deps.broadcast({ type: 'extension_ui_request', id: randomUUID(), method: 'setTitle', title }),
-        notify: (message, type) => {
-            const notifyType = type === 'warn' ? 'warning' : type;
-            deps.broadcast({ type: 'extension_ui_request', id: randomUUID(), method: 'notify', message, notifyType });
-        },
-        onTerminalInput: () => noop,
-        setWorkingMessage: noop,
-        setWorkingVisible: noop,
-        setWorkingIndicator: noop,
-        setHiddenThinkingLabel: noop,
-        setFooter: noop,
-        setHeader: noop,
-        custom: () => Promise.resolve(undefined),
-        pasteToEditor: noop,
-        setEditorText: noop,
-        getEditorText: () => '',
-        addAutocompleteProvider: noop,
-        setEditorComponent: noop,
-        getEditorComponent: () => undefined,
-        getAllThemes: () => [],
-        getTheme: () => undefined,
-        setTheme: noop,
-        getToolsExpanded: () => false,
-        setToolsExpanded: noop,
-    };
-    return ctx;
-}
+var ve=Object.defineProperty;var e=(t,n)=>ve(t,"name",{value:n,configurable:!0});import{envModelIntent as he,envNodeCwd as _e,envNodeId as we,envProfileId as ye}from"../../shared/env.js";import{createServer as Se}from"node:net";import{existsSync as se,readFileSync as be,unlinkSync as ae}from"node:fs";import{join as K}from"node:path";import{randomUUID as M}from"node:crypto";import{mark as Ee}from"../timing.js";import{getAgentDir as V,initTheme as Te,ModelRegistry as ke,ModelRuntime as Re}from"@earendil-works/pi-coding-agent";import{nodeDir as xe,viewSocketPath as Ce}from"../canvas/paths.js";import{bindBrokerEventSource as Ae}from"../events/source.js";import{emitEvent as E}from"../events/emit.js";import{operationIdContext as Me}from"../events/operation-id.js";import{findMissingPackagePaths as Pe}from"./package-health.js";import{FRONT_DOOR_ENV as Ie}from"./front-door.js";import{CANVAS_EXTENSIONS as X,piInvocationToSdkConfig as Oe}from"./launch.js";import{assertEngineVersion as De,loadBrokerEngine as Fe}from"./broker-sdk.js";import{resolveBundledPiPackageDir as Ne}from"./pi-cli.js";import{captureSessionChatCapabilities as Le}from"./command-surface.js";import{PoolCredentialStore as $e}from"../pool-credential-store.js";import{mutateBrokerFault as U,recordBrokerTurn as de}from"./broker/daemon-ops.js";import{modelRequestFromConfig as je,selectInitialModelRoute as Be,unregisteredConcreteModel as Ge}from"../model-routes.js";import{KNOWN_STREAM_WAIT_UI as Ue}from"./stream-watchdog.js";import{probeOnline as We}from"./connectivity.js";import{CRTR_CYCLE_CUSTOM_TYPE as qe,cycleAwareMessages as Ke}from"./session-cycles.js";import{projectTranscript as Ve}from"./session-visibility.js";import{currentTurnVisibility as Xe}from"./turn-visibility.js";import{isUnknownModel as H}from"./model-selection.js";import{BrokerClientRegistry as He}from"./broker/client-registry.js";import{ToolGroupTracker as Ye}from"./broker/tool-groups.js";import{onNodeNamed as ze}from"./broker/node-named.js";import{FaultRetry as Je}from"./broker/fault-retry.js";import{createTurnAdmissionGate as Qe}from"./broker/turn-admission.js";import{BROKER_IDLE_TURN_START as Ze}from"./broker/held-deferred-inbox.js";import{EventProjection as et}from"./broker/event-projection.js";import{createFrameDispatchContext as tt,handleFrame as nt}from"./broker/frame-dispatch.js";import{hydratePersistedAdvertisedCommandMessages as ot,installAdvertisedCommandInvocationContract as rt}from"./advertised-command-invocation.js";import{RebindDriver as it}from"./broker/rebind.js";import{decodeKickoffOrigin as st,KICKOFF_ORIGIN_ENV as at}from"./stamp/protocol.js";import{announceMessageOrigin as dt}from"./stamp/channel.js";import{brokerExtensionState as lt,commitBrokerModel as ct}from"./broker/daemon-ops.js";import{FrameOverflowError as mt,normalizeSnapshotTail as ut}from"./broker-protocol.js";import{ReviewBoundaryNavigationError as fn,REVIEW_BOUNDARY_NAVIGATION_CODE as pn}from"./broker/frame-replies.js";function Y(t){return new ke(t.modelRuntime)}e(Y,"registryOf");function ft(t){return{authPath:K(t,"auth.json"),modelsPath:K(t,"models.json")}}e(ft,"modelRuntimePaths");function L(t,n){if(t==null||H(t))return null;const s=n!==void 0&&n!==""&&n!=="off"?`:${n}`:"";return`${t.provider}/${t.id}${s}`}e(L,"formatModelSpec");function pt(t,n){const s=L(t,void 0);return s===null?null:`${s}:${n===void 0||n===""?"off":n}`}e(pt,"formatExactModelSpec");const gt=12e4;let W=null;function vt(){const t=W;if(W=null,t!==null)try{t.dispose()}catch{}}e(vt,"disposeActiveSession");async function cn(t,n=process.hrtime.bigint(),s=new Date().toISOString()){Ae(t),Me.fresh(()=>{E({level:"info",event:"broker.startup.cli_entry",ts:s,duration_ms:0,fields:{runtime_version:process.version,engine_version:null,model:null}}),E({level:"info",event:"broker.startup.module_loaded",duration_ms:Number(process.hrtime.bigint()-n)/1e6,fields:{runtime_version:process.version,engine_version:null,model:null}})});const p=new Set;let i=null;const a=e((o,r=null)=>{p.has(o)||(p.add(o),Ee(o,{duration_ms:Number(process.hrtime.bigint()-n)/1e6}),E({level:"info",event:o,duration_ms:Number(process.hrtime.bigint()-n)/1e6,fields:{runtime_version:process.version,engine_version:i,model:r}}))},"emitStartupMilestone");process.env[Ie]="1",process.env.CRTR_BROKER_PID=String(process.pid),delete process.env.TMUX_PANE,delete process.env.TMUX;const d=await Fe();De(d.VERSION),i=d.VERSION;const l=xe(t),m=K(l,"broker-launch.json"),h=JSON.parse(be(m,"utf8")),g=Oe(h);g.modelExact===!0?process.env.CRTR_MODEL_EXACT="1":delete process.env.CRTR_MODEL_EXACT;let{session:_,services:S,resuming:k,runtime:T}=await yt(d,g);const R=(await lt(t)).node.review_binding?.review_id;W=_;const B=We;try{process.env.PI_PACKAGE_DIR=Ne(),Te(S.settingsManager.getTheme(),!1)}catch(o){E({level:"error",event:"broker.theme.initialization_failed",error:o})}try{for(const o of Pe(V()))E({level:"warn",event:"broker.startup.warning",fields:{stage:"package_health",source:o.source,resolved_path:o.resolved}})}catch{}const x=Ce(t),u=new He(t),D=new Map,b=new Ye(t,o=>u.broadcast(o));ze(o=>u.broadcast({type:"node_named",...o}));let P=!1,F=!1,A,$,c,C,N,z=e(()=>{},"notifyTurnAccepted"),J=e(()=>{},"resetFrameState");c=new it({nodeId:t,cfg:g,session:_,services:S,runtime:T,registry:u,toolGroups:b,uiContext:e(()=>$,"uiContext"),faultRetry:e(()=>C,"faultRetry"),projection:e(()=>N,"projection"),setActiveSession:e(o=>{W=o},"setActiveSession"),disposeAndExit:e((o,r)=>j(o,r),"disposeAndExit"),onSessionRebind:e(()=>{J()},"onSessionRebind"),reWelcomeAll:e(()=>te(),"reWelcomeAll")});const Q=e(async(o,r=!1)=>{const f=c.session(),v=L(f.model,f.thinkingLevel);if(v===null)return null;const w=await ct(t,{spec:v,pinnedOverride:o,userSelected:r});return r&&(delete process.env.CRTR_MODEL_INTENT,process.env.CRTR_MODEL_EXACT="1",g.model=w.modelOverride,g.modelExact=!0),w.modelOverride},"persistModelChoice"),Z=e(async(o=!0,r,f=!1)=>{const v=c.session(),w=L(v.model,v.thinkingLevel),y=o?await Q(r,f):w;u.broadcast({type:"model_changed",model:H(v.model)?void 0:v.model,spec:y})},"broadcastModelChanged"),q=Qe(),me=e(o=>{q.admit(r=>{const f=c.session();return f.prompt(o,{preflightResult:r,...f.isStreaming?{streamingBehavior:"steer"}:{}}).catch(v=>{E({level:"error",event:"broker.inbox.idle_prompt_failed",error:v})})})},"startIdleInboxTurn");globalThis[Ze]=me,C=new Je({nodeId:t,cfg:g,retryProbe:B,currentSession:e(()=>c.session(),"currentSession"),currentServices:e(()=>c.services(),"currentServices"),installedGeneration:e(()=>c.installedGeneration(),"installedGeneration"),registryOf:Y,formatModelSpec:L,broadcastModelChanged:Z,turnAdmission:q}),N=new et({registry:u,faultRetry:C,installedGeneration:e(()=>c.installedGeneration(),"installedGeneration"),currentSession:e(()=>c.session(),"currentSession"),notifyTurnAccepted:e(()=>z(),"notifyTurnAccepted"),emitStartupMilestone:a,formatModelSpec:L});const ue=e(o=>{const r=c.session(),f=_t(r,R),v=ut(o.snapshotTail),w=f===void 0||v===void 0?f:f.slice(-v),y=w?.map(({message:O})=>O)??r.sessionManager.buildSessionContext().messages,G=b.summaries(),ie=w!==void 0&&v!==void 0?ht(y):void 0,ge=ie===void 0?G:Object.fromEntries(Object.entries(G).filter(([O])=>ie.has(O)));return{messages:y,...w===void 0?{}:{messageIds:w.map(({id:O})=>O)},messageVisibility:w?.map(({visibility:O})=>O)??y.map(()=>"visible"),turnVisibility:Xe(),stats:r.getSessionStats(),state:{model:H(r.model)?void 0:r.model,thinkingLevel:r.thinkingLevel,isStreaming:r.isStreaming,isCompacting:r.isCompacting,steeringMode:r.steeringMode,followUpMode:r.followUpMode,sessionFile:r.sessionFile,sessionId:r.sessionId,sessionName:r.sessionName,autoCompactionEnabled:r.autoCompactionEnabled,messageCount:r.messages.length,pendingMessageCount:r.pendingMessageCount},display:{...u.displaySnapshot()},toolGroupSummaries:ge,workingActivity:N.currentWorkingActivity(),queued:{steering:[...r.getSteeringMessages()],followUp:[...r.getFollowUpMessages()]}}},"buildSnapshot"),ee=e(o=>{const r=o.role==="controller"?D.values().next().value:void 0;u.sendFrame(o,{type:"welcome",snapshot:ue(o),role:o.role,pending_dialog:r!==void 0?r.request:null,agentDir:V()},!0)},"sendWelcome"),fe=e(o=>{const r=[...D.values()];for(let f=1;f<r.length;f++)u.sendFrame(o,r[f].request)},"replayExtraPendingDialogsTo"),te=e(()=>{u.forEachHelloed(ee)},"reWelcomeAll"),ne=e(o=>{if(!P){P=!0,b.persistPendingSummary(),N.dispose(),vt();try{A?.close()}catch{}u.dispose();try{se(x)&&ae(x)}catch{}u.clearAttachState(),process.exit(o)}},"completeExit"),j=e((o,r=0)=>{if(P)return;const f=o==="shutdown-hook"||o==="shutdown-after-settle";if(f&&b.finishOpenToolGroup(!0),f&&b.hasSummaryTasks()){if(F)return;F=!0,b.waitForSummaryTasks().finally(()=>ne(r));return}ne(r)},"disposeAndExit");$=St({writable:e(()=>u.writableClients(),"writable"),forward:e((o,r)=>u.sendFrame(o,r),"forward"),pending:D,broadcast:e(o=>u.broadcastUi(o),"broadcast"),onKnownStreamWait:e(o=>N.knownStreamWait(o),"onKnownStreamWait")}),c.setRebindSession(),await c.enqueueRebind(_,S);const I=tt({nodeId:t,cfg:g,registry:u,toolGroups:b,projection:N,rebind:c,boundaryReviewId:R,pendingDialogs:D,sendWelcome:ee,replayExtraPendingDialogsTo:fe,reWelcomeAll:te,disposeAndExit:j,persistModelChoice:Q,broadcastModelChanged:Z,registryOf:Y,formatModelSpec:L,formatExactModelSpec:pt,turnAdmission:q,resolveLaunchModel:ce});z=I.notifyTurnAccepted,J=I.resetForSession;try{se(x)&&ae(x)}catch{}A=Se(o=>{const r=u.create(o);o.on("data",v=>{let w;try{w=r.decoder.push(v)}catch(y){y instanceof mt?(u.sendFrame(r,{type:"error",code:"frame_overflow",message:y.message}),u.dropClient(r,`frame overflow: ${y.message}`)):u.dropClient(r,`decoder error: ${String(y)}`);return}for(const y of w)try{nt(I,r,y)}catch{}});const f=e(()=>{u.removeClient(r)},"drop");o.on("close",f),o.on("error",()=>{})}),A.on("error",o=>{P||(E({level:"error",event:"broker.socket.failed",error:o}),j("socket-error",1))}),A.listen(x,async()=>{Promise.all([U(t,{op:"clear",link:"viewer\u2194broker"}),U(t,{op:"clear",link:"relay\u2194broker"})]).catch(r=>E({level:"error",event:"broker.daemon.operation.failed",node_id:t,error:r,fields:{operation:"broker_socket_bound_fault_clear"}}));let o;try{o=await C.recoverOnStartup()}catch(r){E({level:"error",event:"broker.daemon.operation.failed",node_id:t,error:r,fields:{operation:"recovery_startup"}}),j("recovery-startup-failed",1);return}if(o!=="retry-armed"&&g.firstPrompt!==void 0&&g.firstPrompt!==""){const r=st(process.env[at]);r!==null&&dt(g.firstPrompt,r),I.kickoff(g.firstPrompt)}}),u.persistAttachState();const pe=2500;let oe=!1;const re=e(async o=>{if(P||oe)return;if(oe=!0,c.isAgentRunActive()||c.session().isStreaming||I.pendingPromptDispatches()>0){const f=Date.now()+pe;for(;I.pendingPromptDispatches()>0&&!c.session().isStreaming&&Date.now()<f;)await new Promise(v=>setTimeout(v,25));if(c.session().isStreaming){const v=f-Date.now();if(v>0){let w;try{await Promise.race([c.session().abort().then(()=>!0,()=>!1),new Promise(G=>{w=setTimeout(()=>G(!1),v)})])&&await de(t,{event:"closed",end_reason:"teardown-aborted"})}finally{w!==void 0&&clearTimeout(w)}}}else(I.pendingPromptDispatches()>0||c.isAgentRunActive())&&await de(t,{event:"interrupted"})}j(o)},"abortAndExit");process.on("SIGTERM",()=>{re("SIGTERM")}),process.on("SIGINT",()=>{re("SIGINT")})}e(cn,"runBroker");function ht(t){const n=new Set;for(const s of t)if(!(s.role!=="assistant"||!Array.isArray(s.content)))for(const p of s.content)p!==null&&typeof p=="object"&&p.type==="toolCall"&&typeof p.id=="string"&&n.add(p.id);return n}e(ht,"toolCallIds");function _t(t,n){const s=t.sessionManager,p=Ke(s);return p!==void 0&&ot(p.map(({message:i})=>i)),p===void 0?void 0:Ve(p,{boundaryReviewId:n,sessionEntries:s.getEntries?.()})}e(_t,"snapshotMessages");function le(){const t=we();if(t===void 0||t==="")throw new Error("broker launch is missing CRTR_NODE_ID");return t}e(le,"currentBrokerNodeId");async function ce(t,n){const s=je(n.model,he(),n.modelExact===!0);if(s===void 0)return;const p=Y(t),i={cwd:_e()??n.cwd,profileId:ye()},a=Ge(s,p,i);if(a!==void 0)throw await U(le(),{op:"record",input:{link:"crtr\u2192pi",op:"model resolution at launch",kind:"model-not-found",retry:{disposition:"fatal"},message:`model '${a.request.spec}' is not registered in the serving model registry`}}),new Error(`[broker] FATAL: model '${a.request.spec}' is not registered in the serving model registry`);const d=Be(s,p,i),l=d.selected;if(l!==void 0){const m=l.candidate;return(m.rank??0)>0&&E({level:"warn",event:"broker.model.launch_fallback",fields:{requested:n.model,selected:`${m.providerId}/${m.modelId}`,route_id:m.routeId,credential_source:m.credentialSource,rank:m.rank}}),{model:l.model,thinkingLevel:m.thinkingLevel}}if(n.modelExact===!0){const m=d.rejected.map(({candidate:h,reason:g})=>`'${h.providerId}/${h.modelId}' ${g}`).join("; ");throw await U(le(),{op:"record",input:{link:"crtr\u2192pi",op:"model resolution at launch",kind:"model-not-found",retry:{disposition:"fatal"},message:`exact-consult model '${n.model}' is unavailable \u2014 refusing to substitute (${m})`}}),new Error(`[broker] FATAL: exact-consult model '${n.model}' is unavailable`)}E({level:"warn",event:"broker.model.none_viable",fields:{rejected_candidates:d.rejected.slice(0,16).map(({candidate:m,reason:h})=>({provider:m.providerId,model:m.modelId,reason:h,route_id:m.routeId,credential_source:m.credentialSource})),rejected_candidates_omitted:Math.max(0,d.rejected.length-16)}})}e(ce,"resolveLaunchModel");function wt(t){let n=!0;return{runtime:new Proxy(t,{get(p,i,a){return n&&i==="getAvailableSnapshot"?()=>[]:n&&i==="getAvailable"?async()=>[]:n&&i==="getModel"?()=>{}:Reflect.get(p,i,a)}}),reveal:e(()=>{n=!1},"reveal")}}e(wt,"modelLessRegistry");async function yt(t,n){const s=V(),p=e(async _=>{const{authPath:S,modelsPath:k}=ft(_.agentDir),T=await Re.create({credentials:new $e(S),modelsPath:k}),R=await t.createAgentSessionServices({cwd:_.cwd,agentDir:_.agentDir,modelRuntime:T,resourceLoaderOptions:{additionalExtensionPaths:n.extensionPaths,appendSystemPrompt:n.appendSystemPromptPath!==void 0?[n.appendSystemPromptPath]:void 0,noContextFiles:!0}}),B=R.resourceLoader.getExtensions();if(n.extensionPaths.some(A=>X.includes(A))){const A=new Set(B.extensions.map(c=>c.path)),$=X.filter(c=>!A.has(c));if($.length>0){const c=B.errors.filter(C=>X.includes(C.path)).map(C=>`${C.path}: ${C.error}`).join("; ");throw new Error(`[broker] FATAL: mandatory canvas extensions failed to load: ${$.join(", ")}${c===""?"":` (${c})`}`)}}const x=await ce(R,n),u=x?.model,D=x?.thinkingLevel,b=x===void 0?wt(R.modelRuntime):void 0,P=b!==void 0?{...R,modelRuntime:b.runtime}:R,F=await t.createAgentSessionFromServices({services:P,sessionManager:_.sessionManager,model:u,thinkingLevel:D,tools:n.tools,sessionStartEvent:_.sessionStartEvent});return rt(F.session),Le(F.session),b?.reveal(),{...F,services:R}},"buildForManager"),i=n.resumeSessionPath,a=n.forkFrom!==void 0&&n.forkFrom!=="";if(!a&&(i===void 0||i==="")&&n.resumeSessionId!==void 0&&n.resumeSessionId!=="")throw new Error(`[broker] resume requires a session .jsonl PATH; got only a bare id '${n.resumeSessionId}' (pi_session_file was never captured for this node)`);const d=!a&&i!==void 0&&i!=="",l=d&&n.newCycle===!0,m=d&&!l;let h;if(a)h=t.SessionManager.forkFrom(n.forkFrom,n.cwd);else if(m||l){if(h=t.SessionManager.open(i),l){const _=h.getLeafId();h.resetLeaf(),h.appendCustomEntry(qe,{cycle:Number(process.env.CRTR_CYCLES),fromLeaf:_})}}else h=t.SessionManager.create(n.cwd);if(t.createAgentSessionRuntime!==void 0){const _=e(async k=>{const T=await p({cwd:k.cwd,agentDir:k.agentDir,sessionManager:k.sessionManager,sessionStartEvent:k.sessionStartEvent});return{...T,diagnostics:T.services.diagnostics??[]}},"factory"),S=await t.createAgentSessionRuntime(_,{cwd:n.cwd,agentDir:s,sessionManager:h});return{session:S.session,services:S.services,resuming:m,runtime:S}}const g=await p({cwd:n.cwd,agentDir:s,sessionManager:h});return{session:g.session,services:g.services,resuming:m,runtime:void 0}}e(yt,"buildBrokerSession");function St(t){const n=e((i,a,d,l)=>{if(l?.signal?.aborted)return Promise.resolve(i);const m=t.writable();return m.length===0?Promise.resolve(i):new Promise(h=>{let g;const _=e(()=>{g!==void 0&&clearTimeout(g),l?.signal?.removeEventListener("abort",S),t.pending.delete(a.id)},"cleanup"),S=e(()=>{_(),t.broadcast({type:"extension_ui_dismiss",id:a.id}),h(i)},"onAbort");l?.signal?.addEventListener("abort",S,{once:!0});const k=l?.timeout!==void 0?l.timeout:gt;g=setTimeout(()=>{_(),t.broadcast({type:"extension_ui_dismiss",id:a.id}),h(i)},k),typeof g.unref=="function"&&g.unref(),t.pending.set(a.id,{request:a,resolve:e(T=>{_(),t.broadcast({type:"extension_ui_dismiss",id:a.id}),h(d(T))},"resolve")});for(const T of m)t.forward(T,a)})},"dialogPromise"),s=e(()=>{},"noop");return{[Ue]:t.onKnownStreamWait??(i=>()=>{}),get theme(){const i=globalThis[Symbol.for("@earendil-works/pi-coding-agent:theme")];if(i==null)throw new Error("Theme not initialized. Call initTheme() first.");return i},select:e((i,a,d)=>n(void 0,{type:"extension_ui_request",id:M(),method:"select",title:i,options:a,timeout:d?.timeout},l=>"cancelled"in l&&l.cancelled?void 0:"value"in l?l.value:void 0,d),"select"),confirm:e((i,a,d)=>n(!1,{type:"extension_ui_request",id:M(),method:"confirm",title:i,message:a,timeout:d?.timeout},l=>"cancelled"in l&&l.cancelled?!1:"confirmed"in l?l.confirmed:!1,d),"confirm"),input:e((i,a,d)=>n(void 0,{type:"extension_ui_request",id:M(),method:"input",title:i,placeholder:a,timeout:d?.timeout},l=>"cancelled"in l&&l.cancelled?void 0:"value"in l?l.value:void 0,d),"input"),editor:e((i,a)=>n(void 0,{type:"extension_ui_request",id:M(),method:"editor",title:i,prefill:a},d=>"cancelled"in d&&d.cancelled?void 0:"value"in d?d.value:void 0),"editor"),setStatus:e((i,a)=>t.broadcast({type:"extension_ui_request",id:M(),method:"setStatus",statusKey:i,statusText:a}),"setStatus"),setWidget:e((i,a,d)=>{typeof a!="function"&&t.broadcast({type:"extension_ui_request",id:M(),method:"setWidget",widgetKey:i,widgetLines:a,widgetPlacement:d?.placement})},"setWidget"),setTitle:e(i=>t.broadcast({type:"extension_ui_request",id:M(),method:"setTitle",title:i}),"setTitle"),notify:e((i,a)=>{const d=a==="warn"?"warning":a;t.broadcast({type:"extension_ui_request",id:M(),method:"notify",message:i,notifyType:d})},"notify"),onTerminalInput:e(()=>s,"onTerminalInput"),setWorkingMessage:s,setWorkingVisible:s,setWorkingIndicator:s,setHiddenThinkingLabel:s,setFooter:s,setHeader:s,custom:e(()=>Promise.resolve(void 0),"custom"),pasteToEditor:s,setEditorText:s,getEditorText:e(()=>"","getEditorText"),addAutocompleteProvider:s,setEditorComponent:s,getEditorComponent:e(()=>{},"getEditorComponent"),getAllThemes:e(()=>[],"getAllThemes"),getTheme:e(()=>{},"getTheme"),setTheme:s,getToolsExpanded:e(()=>!1,"getToolsExpanded"),setToolsExpanded:s}}e(St,"makeBrokerUiContext");export{pn as REVIEW_BOUNDARY_NAVIGATION_CODE,fn as ReviewBoundaryNavigationError,yt as buildBrokerSession,vt as disposeActiveSession,St as makeBrokerUiContext,cn as runBroker,_t as snapshotMessages};