@north-light/crouter 0.3.318 → 0.3.320

package/dist/daemon/companion-retire.js

@@ -1,34 +1 @@
-// Companion retirement — the one lifecycle exit shared by human-review and
-// page-feedback companions. Lives outside review/finish.ts so human/finish.ts
-// can retire a feedback companion without importing the review finisher (which
-// itself imports human/finish.ts).
-import { getNode } from '../core/canvas/canvas.js';
-import { FinalizationError, pushFinal } from '../core/feed/feed.js';
-import { transition } from '../core/runtime/lifecycle.js';
-import { requestBrokerTeardown } from '../core/runtime/host.js';
-/** Retire a companion only through the terminal transition legal for its current status. */
-export async function retireCompanion(nodeId, outcome) {
-    const node = getNode(nodeId);
-    if (node === null)
-        return 'missing';
-    if (node.status === 'canceled' || (outcome === 'canceled' && node.status === 'done'))
-        return 'already';
-    if (outcome === 'approved' && (node.status === 'active' || node.status === 'idle' || node.status === 'done')) {
-        let result = 'retired';
-        try {
-            await pushFinal(nodeId, 'The companion conversation is complete.');
-        }
-        catch (error) {
-            if (!(error instanceof FinalizationError) || error.code !== 'already_finalized')
-                throw error;
-            result = 'already';
-        }
-        requestBrokerTeardown(nodeId);
-        return result;
-    }
-    transition(nodeId, 'cancel', { reason: 'retired' });
-    if (node.status === 'active' || node.status === 'idle') {
-        requestBrokerTeardown(nodeId);
-    }
-    return 'retired';
-}
+var s=Object.defineProperty;var n=(t,e)=>s(t,"name",{value:e,configurable:!0});import{getNode as c}from"../core/canvas/canvas.js";import{FinalizationError as l,pushFinal as u}from"../core/feed/feed.js";import{transition as f}from"../core/runtime/lifecycle.js";import{requestBrokerTeardown as o}from"../core/runtime/host.js";async function v(t,e){const r=c(t);if(r===null)return"missing";if(r.status==="canceled"||e==="canceled"&&r.status==="done")return"already";if(e==="approved"&&(r.status==="active"||r.status==="idle"||r.status==="done")){let i="retired";try{await u(t,"The companion conversation is complete.")}catch(a){if(!(a instanceof l)||a.code!=="already_finalized")throw a;i="already"}return o(t),i}return f(t,"cancel",{reason:"retired"}),(r.status==="active"||r.status==="idle")&&o(t),"retired"}n(v,"retireCompanion");export{v as retireCompanion};

package/dist/daemon/control.js

@@ -1,22 +1 @@
-// The daemon's self-control seam — how an API handler reaches the ONE live
-// `runDaemon` closure that owns this process's epoch, fleet, and claim.
-//
-// Handlers are module-level route tables built before (and independently of)
-// `runDaemon`, so they cannot close over its internals. `bindDaemonControl` is
-// the same pattern `bindFleet` uses for the fleet registry: crtrd binds exactly
-// one control surface at startup, and a handler calls it through
-// `boundDaemonControl()`. Unbound (a test harness, or an API server hosted
-// outside crtrd) reads as null so the handler answers 503 rather than throwing.
-let bound = null;
-/** Bind this process's control surface. Called once, by `runDaemon`. */
-export function bindDaemonControl(control) {
-    bound = control;
-}
-/** Release the binding (cleanup, and test isolation). */
-export function clearDaemonControl() {
-    bound = null;
-}
-/** The bound control surface, or null when this process is not a live daemon. */
-export function boundDaemonControl() {
-    return bound;
-}
+var l=Object.defineProperty;var n=(o,e)=>l(o,"name",{value:e,configurable:!0});let t=null;function u(o){t=o}n(u,"bindDaemonControl");function a(){t=null}n(a,"clearDaemonControl");function c(){return t}n(c,"boundDaemonControl");export{u as bindDaemonControl,c as boundDaemonControl,a as clearDaemonControl};

package/dist/daemon/cron/armed-context.js

@@ -1,100 +1 @@
-import { envHomeOverride } from '../../shared/env.js';
-import { loadProfileManifest, lookupProfile } from '../../core/profiles/manifest.js';
-import { readProfileEnvVars } from '../../core/profiles/env-store.js';
-import { ADMITTED_HOST_PATH_ENV, buildOperationalEnvBase } from '../../core/runtime/spawn-env.js';
-/** The cron's profile, re-validated now and returned in canonical id form.
- *
- *  A DELETED profile is the spec's root fallback: null. An UNREADABLE one is
- *  not — the profile is still there, so running as root would execute the
- *  command under an identity nobody armed, with the profile's own env store and
- *  purview silently replaced. That throws, and the run fails loudly once
- *  instead of running wrong on every tick. */
-export function resolveLiveProfile(c) {
-    if (c.profile == null)
-        return null;
-    let lookup;
-    try {
-        lookup = lookupProfile(c.profile);
-    }
-    catch {
-        return null; // an ambiguous NAME resolves no better than a deleted profile
-    }
-    if (lookup.kind === 'resolved')
-        return lookup.entry.profileId;
-    if (lookup.kind === 'absent')
-        return null;
-    throw new ArmedContextError(`the armed profile "${c.profile}" is still on this host but its manifest could not be read (${lookup.manifestPath}) — running as root would silently give this cron a different identity, env store, and purview. Repair the manifest, or re-arm the cron under a profile that resolves.`);
-}
-// The escalation node must still report an unreadable manifest, so its own spawn falls back to root.
-export function resolveLiveProfileOrRoot(c) {
-    try {
-        return resolveLiveProfile(c);
-    }
-    catch {
-        return null;
-    }
-}
-export function resolveLiveProfileName(c) {
-    if (c.profile == null)
-        return undefined;
-    try {
-        return loadProfileManifest(c.profile).manifest.name;
-    }
-    catch {
-        return undefined;
-    }
-}
-/** A stored context cannot be rebuilt; the run fails rather than running under a context nobody armed. */
-export class ArmedContextError extends Error {
-    constructor(message) {
-        super(message);
-        this.name = 'ArmedContextError';
-    }
-}
-// Invalid snapshots are corruption: dropping `--env` would run under an environment nobody armed, so fail instead.
-function parseArmedEnv(envJson) {
-    if (envJson == null)
-        return {};
-    let parsed;
-    try {
-        parsed = JSON.parse(envJson);
-    }
-    catch (err) {
-        throw new ArmedContextError(`the armed env snapshot is not valid JSON (${err.message}) — this cron's stored env_json is corrupt, so the run would silently drop every armed variable. Re-arm the cron with a valid --env.`);
-    }
-    if (typeof parsed !== 'object' || parsed === null || Array.isArray(parsed)) {
-        throw new ArmedContextError("the armed env snapshot is not a JSON object — this cron's stored env_json is corrupt. Re-arm the cron with a valid --env.");
-    }
-    const extraEnv = {};
-    for (const [k, v] of Object.entries(parsed)) {
-        if (typeof v !== 'string') {
-            throw new ArmedContextError(`the armed env snapshot's value for "${k}" is not a string — this cron's stored env_json is corrupt, so the run would silently drop that variable. Re-arm the cron with a valid --env.`);
-        }
-        extraEnv[k] = v;
-    }
-    return extraEnv;
-}
-/** Rebuild the armed context. Corrupt snapshots and unreadable profiles fail rather than silently changing its identity or environment. */
-export function buildArmedRunContext(c, runId) {
-    const extraEnv = parseArmedEnv(c.env_json);
-    const profileId = resolveLiveProfile(c);
-    const operationalEnv = buildOperationalEnvBase({ targetCwd: c.cwd, targetProfileId: profileId });
-    const env = {
-        ...operationalEnv,
-        ...readProfileEnvVars(profileId),
-        ...extraEnv,
-        ...(profileId !== null ? { CRTR_PROFILE_ID: profileId } : {}),
-        CRTR_CRON_ID: c.cron_id,
-        CRTR_CRON_NAME: c.name,
-        CRTR_RUN_ID: runId,
-    };
-    // Preserve the daemon identity: otherwise child `crtr` resolves the default canvas.
-    const canvasHomeOverride = envHomeOverride();
-    if (canvasHomeOverride !== undefined && canvasHomeOverride !== '') {
-        env['CRTR_HOME'] = canvasHomeOverride;
-    }
-    if (c.anchor_node != null)
-        env['CRTR_ANCHOR'] = c.anchor_node;
-    env[ADMITTED_HOST_PATH_ENV] = operationalEnv[ADMITTED_HOST_PATH_ENV];
-    return { profileId, env };
-}
+var f=Object.defineProperty;var n=(e,r)=>f(e,"name",{value:r,configurable:!0});import{envHomeOverride as v}from"../../shared/env.js";import{loadProfileManifest as p,lookupProfile as h}from"../../core/profiles/manifest.js";import{readProfileEnvVars as c}from"../../core/profiles/env-store.js";import{ADMITTED_HOST_PATH_ENV as d,buildOperationalEnvBase as m}from"../../core/runtime/spawn-env.js";function u(e){if(e.profile==null)return null;let r;try{r=h(e.profile)}catch{return null}if(r.kind==="resolved")return r.entry.profileId;if(r.kind==="absent")return null;throw new a(`the armed profile "${e.profile}" is still on this host but its manifest could not be read (${r.manifestPath}) \u2014 running as root would silently give this cron a different identity, env store, and purview. Repair the manifest, or re-arm the cron under a profile that resolves.`)}n(u,"resolveLiveProfile");function C(e){try{return u(e)}catch{return null}}n(C,"resolveLiveProfileOrRoot");function x(e){if(e.profile!=null)try{return p(e.profile).manifest.name}catch{return}}n(x,"resolveLiveProfileName");class a extends Error{static{n(this,"ArmedContextError")}constructor(r){super(r),this.name="ArmedContextError"}}function R(e){if(e==null)return{};let r;try{r=JSON.parse(e)}catch(t){throw new a(`the armed env snapshot is not valid JSON (${t.message}) \u2014 this cron's stored env_json is corrupt, so the run would silently drop every armed variable. Re-arm the cron with a valid --env.`)}if(typeof r!="object"||r===null||Array.isArray(r))throw new a("the armed env snapshot is not a JSON object \u2014 this cron's stored env_json is corrupt. Re-arm the cron with a valid --env.");const i={};for(const[t,o]of Object.entries(r)){if(typeof o!="string")throw new a(`the armed env snapshot's value for "${t}" is not a string \u2014 this cron's stored env_json is corrupt, so the run would silently drop that variable. Re-arm the cron with a valid --env.`);i[t]=o}return i}n(R,"parseArmedEnv");function b(e,r){const i=R(e.env_json),t=u(e),o=m({targetCwd:e.cwd,targetProfileId:t}),s={...o,...c(t),...i,...t!==null?{CRTR_PROFILE_ID:t}:{},CRTR_CRON_ID:e.cron_id,CRTR_CRON_NAME:e.name,CRTR_RUN_ID:r},l=v();return l!==void 0&&l!==""&&(s.CRTR_HOME=l),e.anchor_node!=null&&(s.CRTR_ANCHOR=e.anchor_node),s[d]=o[d],{profileId:t,env:s}}n(b,"buildArmedRunContext");export{a as ArmedContextError,b as buildArmedRunContext,u as resolveLiveProfile,x as resolveLiveProfileName,C as resolveLiveProfileOrRoot};

package/dist/daemon/cron/capture.js

@@ -1,45 +1,2 @@
-// src/daemon/cron/capture.ts — output capture for a cron run's child process,
-// plus the timing/hash constants the capture and kill mechanics share.
-import { createHash } from 'node:crypto';
-/** Output head caps for the run log (spec: "capped, e.g. 4KB"). */
-export const CRON_OUTPUT_HEAD_BYTES = 4 * 1024;
-/** Bound between the run-timeout SIGTERM and a forced SIGKILL escalation, so
- *  a signal-trapping command cannot stall teardown's detached drain. */
-export const CRON_KILL_GRACE_MS = 2000;
-/** Poll interval while waiting for a SIGTERMed stale-lease run to actually die
- *  (each probe is a `ps` call, so this is deliberately coarse). */
-export const CRON_DEATH_POLL_MS = 250;
-/** sha256 of empty stdout — the change-detection hash a run that produced no
- *  output carries (a failed spawn, a recovered stale lease). */
-export const EMPTY_STDOUT_SHA256 = createHash('sha256').update('').digest('hex');
-/** A byte-capped capture of one output stream's head. Bytes are buffered and
- *  decoded exactly once, at the end — decoding per chunk both mis-measured the
- *  cap (UTF-16 code units, not bytes) and corrupted any multi-byte sequence
- *  that straddled a chunk boundary. Truncation is MARKED, never silent: a
- *  clipped body reads as complete output to whoever receives the delivery. */
-export function newHeadCapture() {
-    const chunks = [];
-    let bytes = 0;
-    let truncated = false;
-    return {
-        take(chunk) {
-            const room = CRON_OUTPUT_HEAD_BYTES - bytes;
-            if (room <= 0) {
-                truncated = true;
-                return;
-            }
-            if (chunk.length > room) {
-                chunks.push(chunk.subarray(0, room));
-                bytes = CRON_OUTPUT_HEAD_BYTES;
-                truncated = true;
-                return;
-            }
-            chunks.push(chunk);
-            bytes += chunk.length;
-        },
-        decode() {
-            const text = Buffer.concat(chunks).toString('utf8');
-            return truncated ? `${text}\n[… output truncated at ${CRON_OUTPUT_HEAD_BYTES} bytes]` : text;
-        },
-    };
-}
+var a=Object.defineProperty;var u=(e,r)=>a(e,"name",{value:r,configurable:!0});import{createHash as c}from"node:crypto";const s=4*1024,f=2e3,d=250,x=c("sha256").update("").digest("hex");function T(){const e=[];let r=0,o=!1;return{take(t){const n=s-r;if(n<=0){o=!0;return}if(t.length>n){e.push(t.subarray(0,n)),r=s,o=!0;return}e.push(t),r+=t.length},decode(){const t=Buffer.concat(e).toString("utf8");return o?`${t}
+[\u2026 output truncated at ${s} bytes]`:t}}}u(T,"newHeadCapture");export{d as CRON_DEATH_POLL_MS,f as CRON_KILL_GRACE_MS,s as CRON_OUTPUT_HEAD_BYTES,x as EMPTY_STDOUT_SHA256,T as newHeadCapture};

package/dist/daemon/cron/disposition.js

@@ -1,55 +1 @@
-import { getCron, setCronLastOutputHash } from '../../core/canvas/crons.js';
-import { escalateFailure, failureSummary } from './escalation.js';
-import { resolveCronSink } from './sinks.js';
-export async function disposeSettledRun(c, ctx, outOfBand, selfCanceled = false) {
-    const prefix = outOfBand ? 'out-of-band: ' : '';
-    // A self-cancel still delivers its already-produced output; an external cancellation does not.
-    const fresh = getCron(c.cron_id);
-    if (fresh === null && !selfCanceled)
-        return { delivered: `${prefix}cron canceled mid-run — nothing delivered`, paused: false };
-    const effective = fresh ?? c;
-    const failed = ctx.timedOut || ctx.processErrorMessage !== null || ctx.exitCode !== 0;
-    // `cron run` compares but never rewrites the scheduled baseline.
-    let changed = true;
-    if (effective.on_output === 'on-change') {
-        changed = effective.last_output_hash !== ctx.stdoutSha256;
-        if (!outOfBand && fresh !== null)
-            setCronLastOutputHash(c.cron_id, ctx.stdoutSha256);
-    }
-    if (failed) {
-        if (effective.on_output === 'silent')
-            return { delivered: `${prefix}silent`, paused: false };
-        if (outOfBand)
-            return { delivered: `out-of-band: ${failureSummary(ctx, null)} — not escalated`, paused: false };
-        return { delivered: await escalateFailure(effective, ctx, null), paused: true };
-    }
-    switch (effective.on_output) {
-        case 'silent':
-            return { delivered: `${prefix}silent`, paused: false };
-        case 'on-failure':
-            return { delivered: `${prefix}ok — nothing to deliver (on-failure)`, paused: false };
-        case 'on-change':
-            if (!changed)
-                return { delivered: `${prefix}unchanged — not delivered (on-change)`, paused: false };
-            return resolveOrEscalate(effective, ctx, outOfBand, prefix);
-        case 'always':
-            return resolveOrEscalate(effective, ctx, outOfBand, prefix);
-    }
-}
-async function resolveOrEscalate(c, ctx, outOfBand, prefix) {
-    if (ctx.stdoutHead.trim() === '') {
-        return { delivered: `${prefix}empty stdout — nothing delivered`, paused: false };
-    }
-    try {
-        const obligation = resolveCronSink(c, ctx.runId, ctx.stdoutHead);
-        return obligation.kind === 'none'
-            ? { delivered: `${prefix}${obligation.delivered}`, paused: false }
-            : { delivered: '', paused: false, obligation };
-    }
-    catch (err) {
-        const why = `delivery failed: ${err.message}`;
-        if (outOfBand)
-            return { delivered: `out-of-band: ${why} — not escalated`, paused: false };
-        return { delivered: await escalateFailure(c, ctx, why), paused: true };
-    }
-}
+var p=Object.defineProperty;var l=(n,e)=>p(n,"name",{value:e,configurable:!0});import{getCron as v,setCronLastOutputHash as c}from"../../core/canvas/crons.js";import{escalateFailure as u,failureSummary as h}from"./escalation.js";import{resolveCronSink as m}from"./sinks.js";async function w(n,e,t,s=!1){const r=t?"out-of-band: ":"",a=v(n.cron_id);if(a===null&&!s)return{delivered:`${r}cron canceled mid-run \u2014 nothing delivered`,paused:!1};const d=a??n,f=e.timedOut||e.processErrorMessage!==null||e.exitCode!==0;let i=!0;if(d.on_output==="on-change"&&(i=d.last_output_hash!==e.stdoutSha256,!t&&a!==null&&c(n.cron_id,e.stdoutSha256)),f)return d.on_output==="silent"?{delivered:`${r}silent`,paused:!1}:t?{delivered:`out-of-band: ${h(e,null)} \u2014 not escalated`,paused:!1}:{delivered:await u(d,e,null),paused:!0};switch(d.on_output){case"silent":return{delivered:`${r}silent`,paused:!1};case"on-failure":return{delivered:`${r}ok \u2014 nothing to deliver (on-failure)`,paused:!1};case"on-change":return i?o(d,e,t,r):{delivered:`${r}unchanged \u2014 not delivered (on-change)`,paused:!1};case"always":return o(d,e,t,r)}}l(w,"disposeSettledRun");async function o(n,e,t,s){if(e.stdoutHead.trim()==="")return{delivered:`${s}empty stdout \u2014 nothing delivered`,paused:!1};try{const r=m(n,e.runId,e.stdoutHead);return r.kind==="none"?{delivered:`${s}${r.delivered}`,paused:!1}:{delivered:"",paused:!1,obligation:r}}catch(r){const a=`delivery failed: ${r.message}`;return t?{delivered:`out-of-band: ${a} \u2014 not escalated`,paused:!1}:{delivered:await u(n,e,a),paused:!0}}}l(o,"resolveOrEscalate");export{w as disposeSettledRun};

package/dist/daemon/cron/escalation.js

@@ -1,124 +1,3 @@
-// src/daemon/cron/escalation.ts — the cron failure path: pause the row and
-// spawn a terminal node holding everything it needs to deal with the failure.
-// Pausing IS the dedup — a paused row is never due, so nothing refires while
-// the escalation node works.
-import { getNode } from '../../core/canvas/canvas.js';
-import { fullName } from '../../core/canvas/labels.js';
-import { listCronRuns, setCronState } from '../../core/canvas/crons.js';
-import { emitEvent } from '../../core/events/emit.js';
-import { spawnChild } from '../../core/runtime/spawn.js';
-import { cronWakeOrigin } from '../../core/runtime/bearings.js';
-import { cadenceDisplay } from '../../core/wake.js';
-import { resolveLiveProfileOrRoot } from './armed-context.js';
-export function failureSummary(ctx, deliveryFailure) {
-    if (deliveryFailure !== null)
-        return deliveryFailure;
-    if (ctx.timedOut)
-        return `run timed out after ${ctx.runTimeoutS}s (killed; recorded exit -1)`;
-    if (ctx.processErrorMessage !== null)
-        return `run process error: ${ctx.processErrorMessage}`;
-    return `command exited ${ctx.exitCode ?? '(no exit observed)'}`;
-}
-/** The escalation node's kickoff: the cron's identity/config, this failure,
- *  the run-log ring, the creating-node reference, and a mandate that names its
- *  actual options (resume after verifying / cancel / ask the human). */
-function buildEscalationKickoff(c, ctx, deliveryFailure) {
-    const creator = c.created_by != null ? getNode(c.created_by) : null;
-    const creatorLine = c.created_by == null
-        ? 'created by: (no creating node recorded)'
-        : creator !== null
-            ? `created by: node ${c.created_by} ("${fullName(creator)}") — still on the canvas; consider telling it what happened`
-            : `created by: node ${c.created_by} (now gone)`;
-    const schedule = c.recur != null ? `every ${cadenceDisplay(c.recur)}` : `one-shot at ${c.fire_at}`;
-    const priorRuns = listCronRuns(c.cron_id)
-        .slice(0, 10)
-        .map((r) => {
-        const exit = r.exit_code === null ? 'no exit' : `exit ${r.exit_code}`;
-        const head = (r.stderr_head ?? r.stdout_head ?? '').split('\n')[0]?.slice(0, 120) ?? '';
-        return `- ${r.started} — ${exit}, ${r.duration_ms}ms — ${r.delivered ?? ''}${head !== '' ? ` — ${head}` : ''}`;
-    });
-    return [
-        `A scheduled cron FAILED and has paused itself. You were spawned to deal with it.`,
-        '',
-        `- cron: "${c.name}" (${c.cron_id})`,
-        `- schedule: ${schedule}${c.tz != null ? ` (tz ${c.tz})` : ''}`,
-        `- context: cwd ${c.cwd}${c.profile != null ? `, profile ${c.profile}` : ''}`,
-        `- ${creatorLine}`,
-        `- this failure: ${failureSummary(ctx, deliveryFailure)}`,
-        '',
-        '## The command',
-        '',
-        '```bash',
-        c.command,
-        '```',
-        '',
-        '## This run',
-        '',
-        `- exit: ${ctx.timedOut ? '-1 (timeout)' : String(ctx.exitCode)}`,
-        `- stdout (head): ${ctx.stdoutHead === '' ? '(empty)' : ''}`,
-        ...(ctx.stdoutHead !== '' ? ['```', ctx.stdoutHead, '```'] : []),
-        `- stderr (head): ${ctx.stderrHead === '' ? '(empty)' : ''}`,
-        ...(ctx.stderrHead !== '' ? ['```', ctx.stderrHead, '```'] : []),
-        '',
-        '## Recent runs (most recent first, this failure not yet recorded)',
-        '',
-        ...(priorRuns.length > 0 ? priorRuns : ['(no prior runs recorded)']),
-        '',
-        '## Your mandate',
-        '',
-        `Diagnose why it failed and decide what to do:`,
-        `- Transient or fixable: fix the environment/command context, verify with \`crtr cron run ${c.cron_id}\` (fires now, out of band, shows you the result), then \`crtr cron resume ${c.cron_id}\` to re-arm it.`,
-        `- Obsolete: \`crtr cron cancel ${c.cron_id}\`.`,
-        `- The user's call (or the fix needs a change you cannot make): \`crtr human send\`.`,
-        '',
-        'The cron stays paused until someone resumes it — nothing refires while you work.',
-    ].join('\n');
-}
-/** Pause the cron and spawn the escalation node in the cron's originating
- *  profile (root fallback). Returns the run-log `delivered` string. Never
- *  throws: an escalation spawn failure is recorded and logged, the pause
- *  stands (the row must not keep refiring a broken command). */
-export async function escalateFailure(c, ctx, deliveryFailure) {
-    setCronState(c.cron_id, 'paused');
-    const creatorAlive = c.created_by != null && getNode(c.created_by) !== null;
-    try {
-        const res = await spawnChild({
-            kind: 'general',
-            cwd: c.cwd,
-            prompt: buildEscalationKickoff(c, ctx, deliveryFailure),
-            // The spec's word is TERMINAL: a node that deals with this failure and
-            // reaps. With the creator gone there is nobody to parent it, but
-            // parentless must not mean resident-and-forefront — see deliverSpawnSink.
-            ...(creatorAlive ? { parent: c.created_by } : { root: true, rootLifecycle: 'terminal' }),
-            readiness: 'launch',
-            profile: resolveLiveProfileOrRoot(c),
-            wakeOrigin: cronWakeOrigin(c, 'node_birth'),
-        });
-        emitEvent({
-            level: 'info',
-            event: 'cron.failure.escalated',
-            fields: { cron_id: c.cron_id, name: c.name, escalation_node: res.node.node_id },
-        });
-        return `failure: cron paused, escalation node ${res.node.node_id} spawned`;
-    }
-    catch (err) {
-        emitEvent({
-            level: 'error',
-            event: 'cron.escalation.spawn_failed',
-            error: err,
-            fields: { cron_id: c.cron_id, name: c.name },
-        });
-        return `failure: cron paused; escalation spawn failed: ${err.message}`;
-    }
-}
-/** The delivery-failure line an escalated crashed ONE-SHOT carries: its side
- *  effects may already have landed in full, so a human/agent decides whether to
- *  redo it rather than the daemon re-firing it. */
-export function crashedOneShotSummary(why) {
-    return [
-        `${why}.`,
-        'This is a ONE-SHOT, so it has been PAUSED rather than released: its side effects may have completed in full,',
-        'and re-firing would enact them a second time. Determine whether the work actually landed, then either',
-        '`crtr cron run` it to redo it deliberately, or `crtr cron cancel` it.',
-    ].join(' ');
-}
+var f=Object.defineProperty;var o=(e,r)=>f(e,"name",{value:r,configurable:!0});import{getNode as l}from"../../core/canvas/canvas.js";import{fullName as h}from"../../core/canvas/labels.js";import{listCronRuns as p,setCronState as $}from"../../core/canvas/crons.js";import{emitEvent as u}from"../../core/events/emit.js";import{spawnChild as y}from"../../core/runtime/spawn.js";import{cronWakeOrigin as _}from"../../core/runtime/bearings.js";import{cadenceDisplay as w}from"../../core/wake.js";import{resolveLiveProfileOrRoot as b}from"./armed-context.js";function g(e,r){return r!==null?r:e.timedOut?`run timed out after ${e.runTimeoutS}s (killed; recorded exit -1)`:e.processErrorMessage!==null?`run process error: ${e.processErrorMessage}`:`command exited ${e.exitCode??"(no exit observed)"}`}o(g,"failureSummary");function v(e,r,a){const i=e.created_by!=null?l(e.created_by):null,t=e.created_by==null?"created by: (no creating node recorded)":i!==null?`created by: node ${e.created_by} ("${h(i)}") \u2014 still on the canvas; consider telling it what happened`:`created by: node ${e.created_by} (now gone)`,c=e.recur!=null?`every ${w(e.recur)}`:`one-shot at ${e.fire_at}`,d=p(e.cron_id).slice(0,10).map(n=>{const m=n.exit_code===null?"no exit":`exit ${n.exit_code}`,s=(n.stderr_head??n.stdout_head??"").split(`
+`)[0]?.slice(0,120)??"";return`- ${n.started} \u2014 ${m}, ${n.duration_ms}ms \u2014 ${n.delivered??""}${s!==""?` \u2014 ${s}`:""}`});return["A scheduled cron FAILED and has paused itself. You were spawned to deal with it.","",`- cron: "${e.name}" (${e.cron_id})`,`- schedule: ${c}${e.tz!=null?` (tz ${e.tz})`:""}`,`- context: cwd ${e.cwd}${e.profile!=null?`, profile ${e.profile}`:""}`,`- ${t}`,`- this failure: ${g(r,a)}`,"","## The command","","```bash",e.command,"```","","## This run","",`- exit: ${r.timedOut?"-1 (timeout)":String(r.exitCode)}`,`- stdout (head): ${r.stdoutHead===""?"(empty)":""}`,...r.stdoutHead!==""?["```",r.stdoutHead,"```"]:[],`- stderr (head): ${r.stderrHead===""?"(empty)":""}`,...r.stderrHead!==""?["```",r.stderrHead,"```"]:[],"","## Recent runs (most recent first, this failure not yet recorded)","",...d.length>0?d:["(no prior runs recorded)"],"","## Your mandate","","Diagnose why it failed and decide what to do:",`- Transient or fixable: fix the environment/command context, verify with \`crtr cron run ${e.cron_id}\` (fires now, out of band, shows you the result), then \`crtr cron resume ${e.cron_id}\` to re-arm it.`,`- Obsolete: \`crtr cron cancel ${e.cron_id}\`.`,"- The user's call (or the fix needs a change you cannot make): `crtr human send`.","","The cron stays paused until someone resumes it \u2014 nothing refires while you work."].join(`
+`)}o(v,"buildEscalationKickoff");async function A(e,r,a){$(e.cron_id,"paused");const i=e.created_by!=null&&l(e.created_by)!==null;try{const t=await y({kind:"general",cwd:e.cwd,prompt:v(e,r,a),...i?{parent:e.created_by}:{root:!0,rootLifecycle:"terminal"},readiness:"launch",profile:b(e),wakeOrigin:_(e,"node_birth")});return u({level:"info",event:"cron.failure.escalated",fields:{cron_id:e.cron_id,name:e.name,escalation_node:t.node.node_id}}),`failure: cron paused, escalation node ${t.node.node_id} spawned`}catch(t){return u({level:"error",event:"cron.escalation.spawn_failed",error:t,fields:{cron_id:e.cron_id,name:e.name}}),`failure: cron paused; escalation spawn failed: ${t.message}`}}o(A,"escalateFailure");function L(e){return[`${e}.`,"This is a ONE-SHOT, so it has been PAUSED rather than released: its side effects may have completed in full,","and re-firing would enact them a second time. Determine whether the work actually landed, then either","`crtr cron run` it to redo it deliberately, or `crtr cron cancel` it."].join(" ")}o(L,"crashedOneShotSummary");export{L as crashedOneShotSummary,A as escalateFailure,g as failureSummary};

package/dist/daemon/cron/held.js

@@ -1,20 +1 @@
-import { getCron } from '../../core/canvas/crons.js';
-// Exit 75 parks an owed occurrence; the daemon honors the gate but does not implement it.
-export const EXIT_HELD = 75;
-export const HELD_DELIVERED = 'deferred (exit 75) — held for poke';
-// A held one-shot without expiry is poke-only; leaving it past due would re-fire every tick.
-const HELD_ONE_SHOT_FAR_FUTURE = '9999-12-31T23:59:59.999Z';
-// Re-read `last_poke_at`: a poke can land while the gate check runs.
-export function decideHeldSettle(c, startedAtIso, finishedAtMs) {
-    const fresh = getCron(c.cron_id);
-    if (fresh === null)
-        return undefined;
-    if (fresh.state === 'active' && fresh.last_poke_at !== null && startedAtIso < fresh.last_poke_at) {
-        // A mid-run poke cannot unpark a lease, so re-due an active row; paused rows must remain parked.
-        return { kind: 'redue', nowIso: new Date(finishedAtMs).toISOString() };
-    }
-    if (c.recur != null) {
-        return { kind: 'park' };
-    }
-    return { kind: 'park', fireAt: fresh.expires_at ?? HELD_ONE_SHOT_FAR_FUTURE };
-}
+var i=Object.defineProperty;var n=(t,r)=>i(t,"name",{value:r,configurable:!0});import{getCron as d}from"../../core/canvas/crons.js";const a=75,f="deferred (exit 75) \u2014 held for poke",_="9999-12-31T23:59:59.999Z";function p(t,r,o){const e=d(t.cron_id);if(e!==null)return e.state==="active"&&e.last_poke_at!==null&&r<e.last_poke_at?{kind:"redue",nowIso:new Date(o).toISOString()}:t.recur!=null?{kind:"park"}:{kind:"park",fireAt:e.expires_at??_}}n(p,"decideHeldSettle");export{a as EXIT_HELD,f as HELD_DELIVERED,p as decideHeldSettle};

package/dist/daemon/cron/lease-recovery.js

@@ -1,119 +1 @@
-import { randomUUID } from 'node:crypto';
-import { setTimeout as delay } from 'node:timers/promises';
-import { CRON_DEATH_POLL_MS, CRON_KILL_GRACE_MS, EMPTY_STDOUT_SHA256 } from './capture.js';
-import { cronDaemonInstanceId } from './live-runs.js';
-import { crashedOneShotSummary, escalateFailure } from './escalation.js';
-import { settleRun } from './settle.js';
-import { killLeasedCronRun, runningCrons, setCronState, verifyLeasedCronRun, } from '../../core/canvas/crons.js';
-import { emitEvent } from '../../core/events/emit.js';
-/** Recover leases from prior daemon instances. Verify launch identity, not pid liveness: a reboot can recycle the pid, and killing its new owner would signal a stranger. */
-export function recoverStaleCronLeases(now, options = {}) {
-    for (const c of runningCrons()) {
-        if (c.run_lease_owner === cronDaemonInstanceId)
-            continue;
-        if (!verifyLeasedCronRun(c)) {
-            settleCrashedRun(c, now, options);
-            continue;
-        }
-        const startedAtMs = c.run_started_at != null ? new Date(c.run_started_at).getTime() : now;
-        if (now - startedAtMs < c.run_timeout_s * 1000)
-            continue;
-        if (!killLeasedCronRun(c)) {
-            settleCrashedRun(c, now, options);
-            continue;
-        }
-        const ctx = {
-            runId: randomUUID(),
-            startedAtIso: c.run_started_at ?? new Date(now).toISOString(),
-            exitCode: -1,
-            timedOut: true,
-            runTimeoutS: c.run_timeout_s,
-            processErrorMessage: null,
-            stdoutHead: '',
-            stdoutSha256: EMPTY_STDOUT_SHA256,
-            stderrHead: `run timed out after ${c.run_timeout_s}s (recovered stale lease from a prior daemon instance)`,
-        };
-        const settlement = (async () => {
-            await awaitLeasedRunDeath(c);
-            await settleRun(c, {
-                outOfBand: false,
-                outcome: { kind: 'disposed', ctx },
-                record: {
-                    runId: ctx.runId,
-                    startedAtIso: ctx.startedAtIso,
-                    finishedAtMs: now,
-                    durationMs: now - startedAtMs,
-                    exitCode: -1,
-                    stdoutHead: null,
-                    stderrHead: ctx.stderrHead,
-                },
-                lease: { kind: 'clear' },
-            });
-        })();
-        options.register?.(settlement);
-        void settlement.catch((err) => {
-            emitEvent({ level: 'error', event: 'cron.stale_lease.settle_failed', error: err, fields: { cron_id: c.cron_id } });
-        });
-    }
-}
-// Wait after SIGTERM: a signal-trapping command can still produce side effects.
-async function awaitLeasedRunDeath(c) {
-    const deadline = Date.now() + CRON_KILL_GRACE_MS;
-    while (Date.now() < deadline) {
-        await delay(CRON_DEATH_POLL_MS);
-        if (!verifyLeasedCronRun(c))
-            return; // gone
-    }
-    killLeasedCronRun(c, 'SIGKILL');
-}
-/** Record an unobserved crashed run. Pause one-shots rather than re-fire them: their side effects may already have landed. */
-function settleCrashedRun(c, now, options) {
-    const oneShot = c.recur == null;
-    const startedAtMs = c.run_started_at != null ? new Date(c.run_started_at).getTime() : now;
-    const why = 'the daemon life that owned this run ended before it settled — the process is gone and its outcome was never observed';
-    const ctx = {
-        runId: randomUUID(),
-        startedAtIso: c.run_started_at ?? new Date(now).toISOString(),
-        exitCode: null,
-        timedOut: false,
-        runTimeoutS: c.run_timeout_s,
-        processErrorMessage: why,
-        stdoutHead: '',
-        stdoutSha256: EMPTY_STDOUT_SHA256,
-        stderrHead: `run outcome unobserved: ${why}`,
-    };
-    const settlement = (async () => {
-        let delivered = `crashed: ${why}${oneShot ? '' : ' — the next occurrence is unaffected'}`;
-        if (oneShot) {
-            // Pause before escalation so a throw cannot re-fire the past-due one-shot.
-            setCronState(c.cron_id, 'paused');
-            delivered =
-                c.on_output === 'silent'
-                    ? `crashed: ${why} — one-shot paused, not re-fired (silent: not escalated)`
-                    : `crashed one-shot: ${await escalateFailure(c, ctx, crashedOneShotSummary(why))}`;
-        }
-        await settleRun(c, {
-            outOfBand: false,
-            outcome: { kind: 'stated', delivered, paused: oneShot },
-            record: {
-                runId: ctx.runId,
-                startedAtIso: ctx.startedAtIso,
-                finishedAtMs: now,
-                durationMs: Math.max(0, now - startedAtMs),
-                exitCode: null,
-                stdoutHead: null,
-                stderrHead: ctx.stderrHead,
-            },
-            lease: 'release',
-        });
-        emitEvent({
-            level: 'warn',
-            event: 'cron.run.unobserved',
-            fields: { cron_id: c.cron_id, name: c.name, one_shot: oneShot },
-        });
-    })();
-    options.register?.(settlement);
-    void settlement.catch((err) => {
-        emitEvent({ level: 'error', event: 'cron.crashed_run.settle_failed', error: err, fields: { cron_id: c.cron_id } });
-    });
-}
+var S=Object.defineProperty;var i=(e,r)=>S(e,"name",{value:r,configurable:!0});import{randomUUID as c}from"node:crypto";import{setTimeout as v}from"node:timers/promises";import{CRON_DEATH_POLL_MS as p,CRON_KILL_GRACE_MS as A,EMPTY_STDOUT_SHA256 as m}from"./capture.js";import{cronDaemonInstanceId as C}from"./live-runs.js";import{crashedOneShotSummary as H,escalateFailure as M}from"./escalation.js";import{settleRun as _}from"./settle.js";import{killLeasedCronRun as f,runningCrons as D,setCronState as O,verifyLeasedCronRun as h}from"../../core/canvas/crons.js";import{emitEvent as u}from"../../core/events/emit.js";function k(e,r={}){for(const t of D()){if(t.run_lease_owner===C)continue;if(!h(t)){I(t,e,r);continue}const s=t.run_started_at!=null?new Date(t.run_started_at).getTime():e;if(e-s<t.run_timeout_s*1e3)continue;if(!f(t)){I(t,e,r);continue}const o={runId:c(),startedAtIso:t.run_started_at??new Date(e).toISOString(),exitCode:-1,timedOut:!0,runTimeoutS:t.run_timeout_s,processErrorMessage:null,stdoutHead:"",stdoutSha256:m,stderrHead:`run timed out after ${t.run_timeout_s}s (recovered stale lease from a prior daemon instance)`},n=(async()=>{await g(t),await _(t,{outOfBand:!1,outcome:{kind:"disposed",ctx:o},record:{runId:o.runId,startedAtIso:o.startedAtIso,finishedAtMs:e,durationMs:e-s,exitCode:-1,stdoutHead:null,stderrHead:o.stderrHead},lease:{kind:"clear"}})})();r.register?.(n),n.catch(a=>{u({level:"error",event:"cron.stale_lease.settle_failed",error:a,fields:{cron_id:t.cron_id}})})}}i(k,"recoverStaleCronLeases");async function g(e){const r=Date.now()+A;for(;Date.now()<r;)if(await v(p),!h(e))return;f(e,"SIGKILL")}i(g,"awaitLeasedRunDeath");function I(e,r,t){const s=e.recur==null,o=e.run_started_at!=null?new Date(e.run_started_at).getTime():r,n="the daemon life that owned this run ended before it settled \u2014 the process is gone and its outcome was never observed",a={runId:c(),startedAtIso:e.run_started_at??new Date(r).toISOString(),exitCode:null,timedOut:!1,runTimeoutS:e.run_timeout_s,processErrorMessage:n,stdoutHead:"",stdoutSha256:m,stderrHead:`run outcome unobserved: ${n}`},l=(async()=>{let d=`crashed: ${n}${s?"":" \u2014 the next occurrence is unaffected"}`;s&&(O(e.cron_id,"paused"),d=e.on_output==="silent"?`crashed: ${n} \u2014 one-shot paused, not re-fired (silent: not escalated)`:`crashed one-shot: ${await M(e,a,H(n))}`),await _(e,{outOfBand:!1,outcome:{kind:"stated",delivered:d,paused:s},record:{runId:a.runId,startedAtIso:a.startedAtIso,finishedAtMs:r,durationMs:Math.max(0,r-o),exitCode:null,stdoutHead:null,stderrHead:a.stderrHead},lease:"release"}),u({level:"warn",event:"cron.run.unobserved",fields:{cron_id:e.cron_id,name:e.name,one_shot:s}})})();t.register?.(l),l.catch(d=>{u({level:"error",event:"cron.crashed_run.settle_failed",error:d,fields:{cron_id:e.cron_id}})})}i(I,"settleCrashedRun");export{k as recoverStaleCronLeases};

package/dist/daemon/cron/live-runs.js

@@ -1,23 +1 @@
-import { randomUUID } from 'node:crypto';
-export const cronDaemonInstanceId = randomUUID();
-const liveRuns = new Map();
-export function liveRunFor(cronId) {
-    return liveRuns.get(cronId);
-}
-export function registerLiveRun(cronId, run) {
-    liveRuns.set(cronId, run);
-}
-// An earlier close handler must not evict a later run.
-export function clearLiveRun(cronId, runId) {
-    const live = liveRuns.get(cronId);
-    if (live !== undefined && live.runId === runId)
-        liveRuns.delete(cronId);
-}
-// Only that exact process may finish after its row is removed.
-export function markSelfCanceledCronRun(cronId, runId) {
-    const live = liveRuns.get(cronId);
-    if (live === undefined || live.runId !== runId)
-        return false;
-    live.selfCanceled = true;
-    return true;
-}
+var u=Object.defineProperty;var r=(e,n)=>u(e,"name",{value:n,configurable:!0});import{randomUUID as i}from"node:crypto";const l=i(),o=new Map;function d(e){return o.get(e)}r(d,"liveRunFor");function s(e,n){o.set(e,n)}r(s,"registerLiveRun");function a(e,n){const t=o.get(e);t!==void 0&&t.runId===n&&o.delete(e)}r(a,"clearLiveRun");function p(e,n){const t=o.get(e);return t===void 0||t.runId!==n?!1:(t.selfCanceled=!0,!0)}r(p,"markSelfCanceledCronRun");export{a as clearLiveRun,l as cronDaemonInstanceId,d as liveRunFor,p as markSelfCanceledCronRun,s as registerLiveRun};