@north-light/crouter 0.3.318 → 0.3.320

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@north-light/crouter",
-  "version": "0.3.318",
+  "version": "0.3.320",
   "description": "crtr — agent runtime with memory, plugins, and marketplaces",
   "type": "module",
   "main": "dist/index.js",
@@ -62,11 +62,13 @@
   },
   "files": [
     "dist",
+    "!dist/**/__tests__/**",
     "bin",
     "docs",
     "scripts/postinstall.mjs",
     "scripts/patch-pi-tree-root-ordering.mjs",
     "scripts/install-runtime.mjs",
+    "scripts/pack-minify.mjs",
     "scripts/runtime-lock.mjs",
     "scripts/self-update.mjs",
     "runtime.lock.json"
@@ -86,8 +88,8 @@
     "check:quote-style": "node scripts/check-quote-style.mjs",
     "postinstall": "node scripts/postinstall.mjs",
     "install-runtime": "node scripts/install-runtime.mjs",
-    "prepack": "node scripts/runtime-lock.mjs prepack",
-    "postpack": "node scripts/runtime-lock.mjs postpack",
+    "prepack": "node scripts/runtime-lock.mjs prepack && node scripts/pack-minify.mjs prepack",
+    "postpack": "node scripts/pack-minify.mjs postpack && node scripts/runtime-lock.mjs postpack",
     "dev": "tsx --conditions=crtr-src src/cli.ts",
     "link": "npm link",
     "prepublishOnly": "npm run build",
@@ -107,7 +109,7 @@
     "url": "git+https://github.com/vallum-security/crouter.git"
   },
   "publishConfig": {
-    "access": "restricted"
+    "access": "public"
   },
   "license": "MIT",
   "dependencies": {

package/runtime.lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@north-light/crouter",
-  "version": "0.3.318",
+  "version": "0.3.320",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@north-light/crouter",
-      "version": "0.3.318",
+      "version": "0.3.320",
       "hasInstallScript": true,
       "license": "MIT",
       "workspaces": [
@@ -5206,17 +5206,17 @@
     },
     "packages/crouter-api": {
       "name": "@north-light/crouter-api",
-      "version": "0.3.318",
+      "version": "0.3.320",
       "license": "UNLICENSED"
     },
     "packages/crouter-env-docker": {
       "name": "@north-light/crouter-env-docker",
-      "version": "0.3.318",
+      "version": "0.3.320",
       "license": "UNLICENSED"
     },
     "packages/crouter-sdk": {
       "name": "@north-light/crouter-sdk",
-      "version": "0.3.318",
+      "version": "0.3.320",
       "license": "UNLICENSED",
       "dependencies": {
         "@north-light/crouter-api": "^0.3.295"

package/scripts/pack-minify.mjs

@@ -0,0 +1,108 @@
+#!/usr/bin/env node
+// Minify the packed dist, and ONLY when CRTR_PACK_MINIFY=1.
+//
+// OFF BY DEFAULT because `npm run install-runtime` builds every local
+// generation by running `npm pack` on this repo (scripts/install-runtime.mjs,
+// `pack()`). An unconditional prepack minify would therefore minify the
+// runtime a developer actually runs, and with no source maps emitted and
+// `src/` not packed, every stack trace in a live daemon log would collapse to
+// `file.js:1:<column>`. The flag keeps local generations readable and moves
+// minification to the published tarball alone.
+//
+// .github/workflows/publish.yml sets the flag in BOTH places that produce a
+// release tarball — the `publish` job and the docker job's `npm pack` step —
+// because docker/README.md's CRTR_PACKAGE_FILE path depends on those two
+// tarballs being identical.
+//
+// This script must stay listed in package.json#files. `prepack` runs it, and
+// scripts/install-runtime.mjs builds a generation by running `npm pack` on the
+// INSTALLED package — so a published tarball without this file makes both the
+// crtrd image build and `crtr sys self-update` fail on a missing module.
+//
+// `keepNames` is not optional. Function and class names survive into stack
+// traces and are what makes a daemon log from a published generation legible
+// at all, since no source maps are emitted and `src/` is not packed.
+import { cp, readFile, rename, rm, stat, writeFile } from 'node:fs/promises';
+import { globSync } from 'node:fs';
+import { dirname, join, resolve } from 'node:path';
+import { fileURLToPath } from 'node:url';
+import { transform } from 'esbuild';
+
+const ROOT = resolve(dirname(fileURLToPath(import.meta.url)), '..');
+const DIST = join(ROOT, 'dist');
+const BACKUP = join(ROOT, '.dist-unminified');
+
+async function isDirectory(path) {
+  try {
+    return (await stat(path)).isDirectory();
+  } catch {
+    return false;
+  }
+}
+
+/** Files the tarball ships as executable JavaScript.
+ *
+ *  - `builtin-pi-packages/` is copied source that pi loads on its own terms,
+ *    not part of the compiled graph.
+ *  - `clients/attach/viewer.js` is already an esbuild bundle built with
+ *    `minify: true`; re-minifying 9 MiB buys nothing and risks its banner.
+ *  - `__tests__/` is excluded from `package.json#files`, so it is not packed. */
+function packedJavaScript() {
+  return globSync('**/*.js', { cwd: DIST }).filter(
+    (rel) =>
+      !rel.startsWith('builtin-pi-packages/') &&
+      rel !== 'clients/attach/viewer.js' &&
+      !rel.split('/').includes('__tests__'),
+  );
+}
+
+async function restore() {
+  if (!(await isDirectory(BACKUP))) return false;
+  await rm(DIST, { recursive: true, force: true });
+  await rename(BACKUP, DIST);
+  return true;
+}
+
+const mode = process.argv[2];
+
+if (mode === 'prepack') {
+  // A pack that crashed before postpack leaves a minified dist beside the
+  // backup. Restore first — unconditionally, even when minification is off —
+  // so this run minifies readable input rather than minifying already-minified
+  // output and losing the readable tree for good.
+  await restore();
+  if (process.env.CRTR_PACK_MINIFY !== '1') process.exit(0);
+  if (!(await isDirectory(DIST))) throw new Error('dist/ is missing — run `npm run build` before packing');
+
+  await cp(DIST, BACKUP, { recursive: true });
+  try {
+    const files = packedJavaScript();
+    let before = 0;
+    let after = 0;
+    await Promise.all(
+      files.map(async (rel) => {
+        const path = join(DIST, rel);
+        const source = await readFile(path, 'utf8');
+        before += Buffer.byteLength(source);
+        const { code } = await transform(source, {
+          minify: true,
+          keepNames: true,
+          format: 'esm',
+          target: 'node22',
+          loader: 'js',
+        });
+        after += Buffer.byteLength(code);
+        await writeFile(path, code);
+      }),
+    );
+    const mib = (bytes) => (bytes / 1048576).toFixed(1);
+    console.log(`pack-minify: ${files.length} files, ${mib(before)} MiB -> ${mib(after)} MiB`);
+  } catch (error) {
+    await restore();
+    throw error;
+  }
+} else if (mode === 'postpack') {
+  await restore();
+} else {
+  throw new Error('usage: pack-minify.mjs <prepack|postpack>');
+}

package/dist/api/__tests__/integration/client.test.d.ts

@@ -1 +0,0 @@
-export {};

package/dist/api/__tests__/integration/client.test.js

@@ -1,163 +0,0 @@
-// Client availability recovery regressions.
-import { test } from 'node:test';
-import assert from 'node:assert/strict';
-import { createServer } from 'node:http';
-import { mkdirSync, mkdtempSync, rmSync } from 'node:fs';
-import { tmpdir } from 'node:os';
-import { join } from 'node:path';
-import { CrtrClient, safeColdStartDiagnostic } from '../../client.js';
-import { ApiError } from '../../errors.js';
-function startDelayedHealthzServer(socketPath, delayMs) {
-    const server = createServer((_req, res) => {
-        res.writeHead(200, { 'content-type': 'application/json' });
-        res.end(JSON.stringify({ ok: true }));
-    });
-    const timer = setTimeout(() => server.listen(socketPath), delayMs);
-    return { server, cancel: () => clearTimeout(timer) };
-}
-// A dropped response is distinct from a refused connect. Its cause is unknown, so reads may wait and retry but mutations never replay.
-function startHandoverServer(socketPath) {
-    let dropped = false;
-    const server = createServer((req, res) => {
-        if (!dropped) {
-            dropped = true; // model the old server dying mid-request
-            req.socket.destroy();
-            return;
-        }
-        res.writeHead(200, { 'content-type': 'application/json' });
-        res.end(JSON.stringify({ ok: true, method: req.method }));
-    });
-    return {
-        server,
-        ready: new Promise((resolvePromise) => server.listen(socketPath, resolvePromise)),
-    };
-}
-test('a hang-up mid-request rides out the daemon handover and replays the idempotent call', async () => {
-    const dir = mkdtempSync(join(tmpdir(), 'crtr-client-handover-'));
-    const socketPath = join(dir, 'crtrd.sock');
-    const { server, ready } = startHandoverServer(socketPath);
-    try {
-        await ready;
-        const client = new CrtrClient({ socketPath, autostart: false, coldStartPollWindowMs: 2_000 });
-        assert.deepEqual(await client.request('GET', '/v1/nodes'), { ok: true, method: 'GET' });
-    }
-    finally {
-        server.close();
-        rmSync(dir, { recursive: true, force: true });
-    }
-});
-test('an interrupted mutation is not replayed or labelled a daemon handover', async () => {
-    const dir = mkdtempSync(join(tmpdir(), 'crtr-client-handover-'));
-    const socketPath = join(dir, 'crtrd.sock');
-    const { server, ready } = startHandoverServer(socketPath);
-    try {
-        await ready;
-        const client = new CrtrClient({ socketPath, autostart: false, coldStartPollWindowMs: 2_000 });
-        await assert.rejects(() => client.request('POST', '/v1/nodes', {}), 
-        // Replaying is unsafe (the daemon may have applied it), so this one is the
-        // caller's call — but it must not be reported as a daemon that is down.
-        (err) => err instanceof ApiError && err.code === 'daemon_request_interrupted');
-    }
-    finally {
-        server.close();
-        rmSync(dir, { recursive: true, force: true });
-    }
-});
-test('a non-socket cold-start path surfaces its diagnostic after autostart times out', async () => {
-    const dir = mkdtempSync(join(tmpdir(), 'crtr-client-nonsocket-'));
-    const socketPath = join(dir, 'crtrd.sock');
-    mkdirSync(socketPath);
-    const diagnostic = 'crtrd.log (tail):\napi.server.failed: EADDRINUSE';
-    const client = new CrtrClient({
-        socketPath,
-        autostart: true,
-        onColdSocket: async () => { },
-        coldStartPollWindowMs: 50,
-        coldStartDiagnostic: () => diagnostic,
-    });
-    try {
-        await assert.rejects(() => client.healthz(), (error) => error instanceof ApiError
-            && error.code === 'daemon_unavailable'
-            && error.message.includes(diagnostic));
-    }
-    finally {
-        rmSync(dir, { recursive: true, force: true });
-    }
-});
-test('cliClient-style cold start fails loud when the injected poll window is shorter than the (valid) startup delay', async () => {
-    const dir = mkdtempSync(join(tmpdir(), 'crtr-client-coldstart-'));
-    const socketPath = join(dir, 'crtrd.sock');
-    const { server, cancel } = startDelayedHealthzServer(socketPath, 300);
-    try {
-        const client = new CrtrClient({
-            socketPath,
-            autostart: true,
-            onColdSocket: async () => {
-                /* fire-and-forget: the delayed listen() above models ensureDaemon() */
-            },
-            coldStartPollWindowMs: 100, // shorter than the 300ms the daemon actually needs
-        });
-        await assert.rejects(() => client.healthz(), (err) => err instanceof ApiError && err.code === 'daemon_unavailable');
-    }
-    finally {
-        cancel(); // the client already timed out at 100ms; never let listen() fire at 300ms
-        server.close();
-        rmSync(dir, { recursive: true, force: true });
-    }
-});
-test('a disabled-autostart client waits for an externally managed listener without invoking its spawn hook', async () => {
-    const dir = mkdtempSync(join(tmpdir(), 'crtr-client-coldstart-'));
-    const socketPath = join(dir, 'crtrd.sock');
-    const { server, cancel } = startDelayedHealthzServer(socketPath, 100);
-    let spawnAttempts = 0;
-    try {
-        const client = new CrtrClient({
-            socketPath,
-            autostart: false,
-            onColdSocket: async () => { spawnAttempts += 1; },
-            coldStartPollWindowMs: 1_000,
-        });
-        assert.deepEqual(await client.request('GET', '/v1/nodes'), { ok: true });
-        assert.equal(spawnAttempts, 0, 'disabled autostart only waits; it never invokes the spawn hook');
-    }
-    finally {
-        cancel();
-        server.close();
-        rmSync(dir, { recursive: true, force: true });
-    }
-});
-test('availability expiry keeps the final transport failure inside one wall-clock budget', async () => {
-    const dir = mkdtempSync(join(tmpdir(), 'crtr-client-coldstart-'));
-    const socketPath = join(dir, 'crtrd.sock');
-    const server = createServer((_req, _res) => { });
-    let listenTimer;
-    try {
-        const client = new CrtrClient({
-            socketPath,
-            autostart: true,
-            timeoutMs: 5_000,
-            coldStartPollWindowMs: 250,
-            onColdSocket: async () => { listenTimer = setTimeout(() => server.listen(socketPath), 10); },
-        });
-        const started = Date.now();
-        await assert.rejects(() => client.healthz(), (error) => error instanceof ApiError && error.code === 'request_timeout' && error.message.includes('request timed out'));
-        assert.ok(Date.now() - started < 500, 'a probe cannot extend the 250ms availability budget');
-    }
-    finally {
-        if (listenTimer !== undefined)
-            clearTimeout(listenTimer);
-        server.close();
-        rmSync(dir, { recursive: true, force: true });
-    }
-});
-test('safeColdStartDiagnostic returns undefined for an absent hook', () => {
-    assert.equal(safeColdStartDiagnostic(undefined), undefined);
-});
-test('safeColdStartDiagnostic returns the hook result when it succeeds', () => {
-    assert.equal(safeColdStartDiagnostic(() => 'crtrd.log (tail):\nboom'), 'crtrd.log (tail):\nboom');
-});
-test('safeColdStartDiagnostic treats a THROWING hook as absent, not a propagated error', () => {
-    assert.equal(safeColdStartDiagnostic(() => {
-        throw new Error('custom hook blew up');
-    }), undefined);
-});

package/dist/builtin-pi-packages/pi-crtr-extensions/__tests__/insights-active-init.test.ts

@@ -1,98 +0,0 @@
-import { test } from 'node:test';
-import { strict as assert } from 'node:assert';
-
-// Integration test: /insights:init --active spawns an explorer and coordinates
-// insight capture flow. This test verifies that:
-// 1. The active mode doc exists and has slash: true
-// 2. The active mode instructions are present and executable
-// 3. A reader following the instructions can spawn an explorer
-
-test('insights/init has active mode documentation with executable commands', async () => {
-  const { readFileSync } = await import('fs');
-  const initPath = new URL('../../../builtin-memory/insights/init.md', import.meta.url);
-  const content = readFileSync(initPath, 'utf-8');
-
-  // Must be marked as a slash command
-  assert(content.includes('slash: true'), 'init.md must have slash: true frontmatter');
-
-  // Must have active mode section
-  assert(
-    content.includes('## Active mode: research and surface claims'),
-    'init.md must document active mode'
-  );
-
-  // Must have active flag check
-  assert(
-    content.includes('Check for --active flag') || content.includes('--active'),
-    'init.md must explain --active flag'
-  );
-
-  // Must have executable crtr commands for spawning explorer
-  assert(
-    content.includes('crtr node new --kind explore'),
-    'init.md must include crtr command to spawn explorer'
-  );
-
-  // Must reference the capture workflow
-  assert(
-    content.includes('[[insights/capture]]'),
-    'init.md must link to capture workflow'
-  );
-
-  // Must document waiting for explorer report
-  assert(
-    content.includes('Wait for the explorer to report') || content.includes('explorer'),
-    'init.md must explain waiting for explorer'
-  );
-
-  // Must document coordinating user responses
-  assert(
-    content.includes('user response') || content.includes('Turn user responses'),
-    'init.md must explain handling user responses'
-  );
-});
-
-test('active mode provides concrete bash commands agent can execute', async () => {
-  const { readFileSync } = await import('fs');
-  const initPath = new URL('../../../builtin-memory/insights/init.md', import.meta.url);
-  const content = readFileSync(initPath, 'utf-8');
-
-  // The active mode section should have a bash code block
-  const bashBlockMatch = content.match(/```bash\n([\s\S]*?)\n```/);
-  assert(bashBlockMatch, 'active mode must have a bash code block');
-
-  const bashContent = bashBlockMatch[1];
-
-  // Must have the crtr node new command
-  assert(bashContent.includes('crtr node new'), 'bash block must invoke crtr node new');
-
-  // Must specify --kind explore
-  assert(
-    bashContent.includes('--kind explore'),
-    'bash command must spawn explore kind'
-  );
-
-  // Must have the task heredoc
-  assert(
-    bashContent.includes('<<') || bashContent.includes('TASK'),
-    'bash command must include task definition'
-  );
-
-  // Must document the explorer task
-  assert(
-    bashContent.includes('investigate') || bashContent.includes('domain'),
-    'explorer task must mention domain investigation'
-  );
-
-  // Must ask explorer to surface claims
-  assert(
-    bashContent.includes('claim') || bashContent.includes('surface'),
-    'explorer task must ask for claims/surface evidence'
-  );
-
-  // Must reference output location
-  assert(
-    bashContent.includes('$CRTR_CONTEXT_DIR') || bashContent.includes('context'),
-    'explorer task must reference context directory output'
-  );
-});

package/dist/builtin-pi-packages/pi-crtr-extensions/extensions/__tests__/crtr-commands.test.ts

@@ -1,93 +0,0 @@
-// Regression for the 2026-07-27 "new nodes time out" outage: this extension
-// used to discover the crtr surface at BROKER BOOT by spawning one `crtr X -h`
-// subprocess per node and caching the result next to its own install dir. Every
-// `npm run build` wiped that cache out of the dist brokers load, so the next
-// boot blocked >30s on the crawl and the daemon's readiness reaper SIGTERMed
-// the young broker — dead node, request_timeout. Setup must therefore spawn
-// NOTHING: the tree is derived in-process from crtr's own buildRoot().
-import { after, before, test } from "node:test";
-import assert from "node:assert/strict";
-import { chmodSync, existsSync, mkdtempSync, readdirSync, rmSync, writeFileSync } from "node:fs";
-import { dirname, join } from "node:path";
-import { tmpdir } from "node:os";
-import { fileURLToPath } from "node:url";
-
-const EXTENSION_DIR = join(dirname(fileURLToPath(import.meta.url)), "..", "crtr-commands");
-
-let mod: typeof import("../crtr-commands/index.ts");
-
-before(async () => {
-  mod = await import("../crtr-commands/index.ts");
-});
-
-test("enumerateCommands walks the in-memory tree, skipping hidden and internal nodes", () => {
-  const root = {
-    kind: "root" as const,
-    subtrees: [
-      {
-        kind: "branch" as const,
-        name: "node",
-        children: [
-          { kind: "leaf" as const, name: "new", description: "create a node" },
-          { kind: "leaf" as const, name: "_internal" },
-          { kind: "leaf" as const, name: "secret", tier: "hidden" },
-          {
-            kind: "branch" as const,
-            name: "wait",
-            children: [{ kind: "leaf" as const, name: "deadline" }],
-          },
-        ],
-      },
-      { kind: "branch" as const, name: "buried", tier: "hidden", children: [{ kind: "leaf" as const, name: "leaf" }] },
-    ],
-  };
-
-  const paths = mod.enumerateCommands(root).map((n) => n.path.join(":"));
-  assert.deepEqual(paths, ["node", "node:new", "node:wait", "node:wait:deadline"]);
-  assert.equal(mod.enumerateCommands(root).find((n) => n.path.join(":") === "node:new")?.description, "create a node");
-});
-
-test("filters match a node and its descendants; exclude wins over include", () => {
-  assert.equal(mod.isAllowed("node:new", { include: ["node"], exclude: [] }), true);
-  assert.equal(mod.isAllowed("push:final", { include: ["node"], exclude: [] }), false);
-  assert.equal(mod.isAllowed("node:new", { include: ["node"], exclude: ["node:new"] }), false);
-  assert.equal(mod.isAllowed("anything", {}), true);
-});
-
-test("setup spawns no subprocess and writes no cache, and disables itself when crtr's dist is unlocatable", async () => {
-  const fakeBin = mkdtempSync(join(tmpdir(), "crtr-commands-path-"));
-  const spawnLog = join(fakeBin, "spawned.log");
-  // A `crtr` on PATH with no runtime next to it: resolution fails, so setup
-  // must register nothing. If setup ever shells out again, this records it.
-  writeFileSync(join(fakeBin, "crtr"), `#!/bin/sh\necho "$@" >> ${spawnLog}\n`, "utf8");
-  chmodSync(join(fakeBin, "crtr"), 0o755);
-  const before = new Set(readdirSync(EXTENSION_DIR));
-  const savedPath = process.env.PATH;
-  process.env.PATH = fakeBin;
-
-  const registered: string[] = [];
-  const statuses: string[] = [];
-  const listeners: Record<string, (e: unknown, ctx: unknown) => Promise<void>> = {};
-  const pi = {
-    registerCommand: (name: string) => registered.push(name),
-    on: (event: string, handler: (e: unknown, ctx: unknown) => Promise<void>) => {
-      listeners[event] = handler;
-    },
-    sendMessage: () => {},
-  };
-
-  try {
-    await mod.default(pi as never);
-    await listeners.session_start?.(undefined, {
-      ui: { setStatus: (_k: string, v: string) => statuses.push(v), notify: () => {} },
-    });
-  } finally {
-    process.env.PATH = savedPath;
-    rmSync(fakeBin, { recursive: true, force: true });
-  }
-
-  assert.equal(existsSync(spawnLog), false, "setup must not spawn `crtr` subprocesses");
-  assert.deepEqual(readdirSync(EXTENSION_DIR).filter((f) => !before.has(f)), [], "setup must write nothing to disk");
-  assert.deepEqual(registered, []);
-  assert.deepEqual(statuses, ["crtr-commands off"]);
-});