@north-light/crouter 0.3.318 → 0.3.320

package/dist/core/__tests__/parse-argv-stdin-secret.test.js

@@ -1,68 +0,0 @@
-// Run with: node --import tsx/esm --test src/core/__tests__/parse-argv-stdin-secret.test.ts
-//
-// Regression lock from the independent review of commit b6c7008e: a leaf that
-// declares BOTH a positional param and a `stdin` param (e.g. `profile env
-// set <profile>`, value piped on stdin) treats the stdin value as
-// write-only/sensitive by convention. Typing that value as an extra argv
-// token instead of piping it is the single most likely misuse, and the
-// rejection error must never echo the offending token or the full argv back.
-import { test } from 'node:test';
-import assert from 'node:assert/strict';
-import { parseArgv } from '../command.js';
-// Companion lock: `crtr node yield "note"`, `crtr push "done"` and 11 sibling
-// leaves declare a `stdin` body and NO positional param, and take that body as
-// one bare token. A parser refactor dropped the branch that accepts it while
-// leaving the resolution code below it intact, so every one of them exited 2
-// with empty stderr — caught only indirectly, two suites away.
-const YIELD_SHAPED_PARAMS = [
-    { kind: 'flag', name: 'promote', type: 'bool', required: false, constraint: 'promote too' },
-    { kind: 'stdin', name: 'message', required: true, constraint: 'note to your future self' },
-];
-const PROFILE_SET_SHAPED_PARAMS = [
-    { kind: 'positional', name: 'profile', required: true, constraint: 'profile id' },
-    { kind: 'flag', name: 'name', type: 'string', required: true, constraint: 'var name' },
-    { kind: 'stdin', name: 'value', required: true, constraint: 'value piped on stdin' },
-];
-const STRING_FLAG_PARAMS = [
-    { kind: 'flag', name: 'arg', type: 'string', required: true, constraint: 'argument' },
-];
-test('a lone positional supplies the stdin body on a leaf declaring no positional param', async () => {
-    const result = await parseArgv(YIELD_SHAPED_PARAMS, ['refresh against the original goal']);
-    assert.equal(result['message'], 'refresh against the original goal');
-});
-test('flags parse alongside the positional that supplies the stdin body', async () => {
-    const result = await parseArgv(YIELD_SHAPED_PARAMS, ['--promote', 'coordinate the fan-out']);
-    assert.equal(result['message'], 'coordinate the fan-out');
-    assert.equal(result['promote'], true);
-});
-test('allowPositional:false keeps a stdin-only leaf rejecting positionals by arity', async () => {
-    const params = [
-        { kind: 'stdin', name: 'document', required: false, allowPositional: false, constraint: 'page source on stdin' },
-    ];
-    await assert.rejects(() => parseArgv(params, ['page.tsx']), (err) => {
-        assert.equal(err.code, 'bad_invocation');
-        assert.match(err.message, /takes no positional arguments/);
-        return true;
-    });
-});
-test('a value bound with = may start with --', async () => {
-    const result = await parseArgv(STRING_FLAG_PARAMS, ['--arg=--help']);
-    assert.equal(result['arg'], '--help');
-});
-test('a separate flag value starting with -- is rejected as missing', async () => {
-    await assert.rejects(() => parseArgv(STRING_FLAG_PARAMS, ['--arg', '--help']), (err) => {
-        assert.equal(err.code, 'missing_parameter');
-        assert.equal(err.message, '--arg requires a value');
-        return true;
-    });
-});
-test('an extra positional on a stdin-bearing leaf is rejected without echoing it', async () => {
-    const secret = 'SUPERSECRET_ARGV';
-    await assert.rejects(() => parseArgv(PROFILE_SET_SHAPED_PARAMS, ['some-profile', secret, '--name', 'REVIEW_TOKEN']), (err) => {
-        const message = err instanceof Error ? err.message : String(err);
-        const details = err.details ?? {};
-        assert.ok(!message.includes(secret), `message disclosed the secret: ${message}`);
-        assert.ok(!JSON.stringify(details).includes(secret), `details disclosed the secret: ${JSON.stringify(details)}`);
-        return true;
-    });
-});

package/dist/core/__tests__/passive-subscription.test.d.ts

@@ -1 +0,0 @@
-export {};

package/dist/core/__tests__/passive-subscription.test.js

@@ -1,120 +0,0 @@
-import { after, before, beforeEach, test } from 'node:test';
-import assert from 'node:assert/strict';
-import { mkdtempSync, mkdirSync, rmSync } from 'node:fs';
-import { tmpdir } from 'node:os';
-import { basename, join } from 'node:path';
-import { createNode, subscribe } from '../canvas/canvas.js';
-import { armCron, getCron } from '../canvas/crons.js';
-import { closeDb, migrate, openDb } from '../canvas/db.js';
-import { acknowledgeNodeMail, claimNodeMail, hasUnseenWakeMail } from '../canvas/deliveries.js';
-import { beginExecution } from '../canvas/executions.js';
-import { push } from '../feed/feed.js';
-import { nodeMailEntry } from '../feed/inbox.js';
-import { formatPassive } from '../../pi-extensions/canvas-passive-context.js';
-let home;
-function node(id, over = {}) {
-    return {
-        node_id: id,
-        name: id,
-        created: new Date().toISOString(),
-        cwd: '/tmp/work',
-        kind: 'general',
-        mode: 'base',
-        lifecycle: 'terminal',
-        status: 'active',
-        ...over,
-    };
-}
-function execution(nodeId) {
-    return beginExecution(nodeId, { daemonEpoch: 'test' });
-}
-before(() => {
-    home = mkdtempSync(join(tmpdir(), 'crtr-passive-'));
-    process.env['CRTR_HOME'] = home;
-});
-beforeEach(() => {
-    closeDb();
-    rmSync(home, { recursive: true, force: true });
-    mkdirSync(home, { recursive: true });
-    migrate(openDb());
-});
-after(() => {
-    closeDb();
-    rmSync(home, { recursive: true, force: true });
-    delete process.env['CRTR_HOME'];
-});
-test('a passive subscriber receives a non-waking SQL delivery with the canonical report ref', async () => {
-    createNode(node('pub'));
-    createNode(node('observer'));
-    subscribe('observer', 'pub', false);
-    const result = await push('pub', { kind: 'update', body: 'first observation\nmore detail' });
-    const executionId = execution('observer');
-    const claim = claimNodeMail('observer', executionId, 'passive');
-    assert.equal(hasUnseenWakeMail('observer'), false, 'passive mail does not wake a node');
-    assert.equal(claim.action, 'claimed');
-    assert.equal(claim.deliveries.length, 1);
-    const entry = nodeMailEntry(claim.deliveries[0]);
-    assert.equal(entry.from, 'pub');
-    assert.equal(entry.label, 'first observation');
-    assert.equal(entry.ref, `pub:reports/${basename(result.reportPath)}`);
-    assert.match(entry.ref ?? '', /^pub:reports\/\d{8}T\d{9}-[0-9a-f]{8}-update\.md$/);
-});
-test('an active subscriber receives waking SQL mail and clears its deadline', async () => {
-    createNode(node('pub'));
-    createNode(node('worker-mgr'));
-    subscribe('worker-mgr', 'pub', true);
-    armCron({
-        cron_id: 'manager-deadline',
-        name: 'manager deadline',
-        command: 'echo stale deadline',
-        fire_at: new Date(Date.now() + 60_000).toISOString(),
-        recur: null,
-        tz: null,
-        expires_at: null,
-        anchor_node: 'worker-mgr',
-        cancel_on_wake: true,
-        created_by: null,
-        cwd: home,
-        env_json: null,
-        profile: null,
-        scope: 'profile',
-        run_timeout_s: 30,
-        overlap: 'skip',
-        on_output: 'silent',
-        sink: '{}',
-        tier: 'normal',
-    });
-    await push('pub', { kind: 'update', body: 'active report' });
-    const claim = claimNodeMail('worker-mgr', execution('worker-mgr'), 'wake');
-    assert.equal(hasUnseenWakeMail('worker-mgr'), true);
-    assert.equal(getCron('manager-deadline'), null, 'the report won the deadline race');
-    assert.equal(claim.deliveries.length, 1);
-    assert.equal(nodeMailEntry(claim.deliveries[0]).from, 'pub');
-});
-test('a passive delivery is acknowledged only after it has been claimed', async () => {
-    createNode(node('pub'));
-    createNode(node('observer'));
-    subscribe('observer', 'pub', false);
-    await push('pub', { kind: 'update', body: 'one' });
-    await push('pub', { kind: 'update', body: 'two' });
-    const executionId = execution('observer');
-    const claim = claimNodeMail('observer', executionId, 'passive');
-    assert.deepEqual(claim.deliveries.map((delivery) => nodeMailEntry(delivery).label), ['one', 'two']);
-    const receipt = acknowledgeNodeMail('observer', executionId, claim.deliveries.map((delivery) => ({
-        deliveryId: delivery.deliveryId,
-        attempts: delivery.attempts,
-        disposition: 'acknowledged',
-    })));
-    assert.deepEqual(receipt.results.map((result) => result.outcome), ['acknowledged', 'acknowledged']);
-    assert.deepEqual(claimNodeMail('observer', executionId, 'passive').deliveries, []);
-});
-test('passive SQL mail retains the existing timestamped backlog rendering', async () => {
-    createNode(node('pub'));
-    createNode(node('observer'));
-    subscribe('observer', 'pub', false);
-    await push('pub', { kind: 'update', body: 'the body of the report\nsecond line' });
-    const claim = claimNodeMail('observer', execution('observer'), 'passive');
-    const text = formatPassive(claim.deliveries.map(nodeMailEntry));
-    assert.match(text, /<passive-subscription-backlog/);
-    assert.match(text, /the body of the report/);
-});

package/dist/core/__tests__/pid-identity-match.test.d.ts

@@ -1 +0,0 @@
-export {};

package/dist/core/__tests__/pid-identity-match.test.js

@@ -1,145 +0,0 @@
-// Run with: node --import tsx/esm --test src/core/__tests__/pid-identity-match.test.ts
-//
-// Regression cover for the uncapped-revive-loop bug on Blaxel unikraft guests
-// (crouter-cloud "frozen on reconnecting", 2026-07-11): process identity is
-// `lstart#ticks`, but `lstart` is derived from the wall-clock boot epoch
-// (`/proc/stat` btime + starttime jiffies) and btime is UNSTABLE in the guest
-// (clock correction / suspend-resume). A SINGLE live broker was observed with
-// identical pid+ticks but `lstart` drifting +81s between two probes. The old
-// `identitiesMatch` compared the `lstart` base FIRST and returned false on any
-// base mismatch — so it read that still-live broker as reused/dead every
-// cycle, wedging the daemon into an uncapped revive loop that rebound the
-// node's view.sock and dropped the browser chat WS forever.
-//
-// The fix: when BOTH identities carry `#ticks`, ticks decide it ALONE (they
-// are per-boot unique, strictly finer than lstart, and — unlike lstart — do
-// not move when the wall clock does). The base is consulted only when a side
-// lacks ticks (macOS / no procfs).
-//
-// Follow-up (cross-boot false match): ticks-alone is only safe WITHIN one
-// boot — jiffies-since-boot reset and can repeat across boots. So the identity
-// base is now BOOT-SCOPED on Linux-with-procfs: it is the kernel `boot_id`
-// UUID (`<bootId>#<ticks>`), and a new-format match requires base AND ticks.
-// A legacy `lstart#ticks` row (recorded before this) still migrates cleanly:
-// when a base is NOT a boot_id UUID on either side, ticks decide alone.
-import { test } from 'node:test';
-import assert from 'node:assert/strict';
-import { identitiesMatch, composeIdentity, makeBootIdCache } from '../canvas/pid.js';
-test('equal ticks with DIFFERENT lstart bases compare EQUAL (the btime-drift bug)', () => {
-    // Same live process, same jiffies-since-boot; only the wall-clock-anchored
-    // lstart drifted because btime shifted. Must NOT read as reuse.
-    const a = 'Sat Jul 11 17:50:24 2026#53459';
-    const b = 'Sat Jul 11 17:51:45 2026#53459';
-    assert.equal(identitiesMatch(a, b), true, 'equal ticks must win over a drifting lstart base');
-});
-test('different ticks compare UNEQUAL even when lstart bases are identical (same-second reuse)', () => {
-    const a = 'Sat Jul 11 17:50:24 2026#53459';
-    const b = 'Sat Jul 11 17:50:24 2026#60536';
-    assert.equal(identitiesMatch(a, b), false, 'different ticks are proof of a reused pid');
-});
-test('identities WITHOUT ticks fall back to comparing the lstart base', () => {
-    assert.equal(identitiesMatch('Sat Jul 11 17:50:24 2026', 'Sat Jul 11 17:50:24 2026'), true, 'no ticks, equal base → match');
-    assert.equal(identitiesMatch('Sat Jul 11 17:50:24 2026', 'Sat Jul 11 17:51:45 2026'), false, 'no ticks, different base → reuse');
-});
-test('one side lacking ticks fails open to a base compare (transient /proc miss)', () => {
-    // A transient `/proc` read failure can record the SAME live process plain on
-    // one capture and with ticks on another. Bases agree → fail-open to match.
-    assert.equal(identitiesMatch('Sat Jul 11 17:50:24 2026', 'Sat Jul 11 17:50:24 2026#53459'), true, 'coarse-vs-fine with matching base → match');
-    assert.equal(identitiesMatch('Sat Jul 11 17:50:24 2026', 'Sat Jul 11 17:51:45 2026#53459'), false, 'coarse-vs-fine with different base → reuse');
-});
-// boot-scoped (new-format) identities
-const BOOT_A = '4b0c1d2e-3f40-4152-8637-a1b2c3d4e5f6';
-const BOOT_B = '9e8d7c6b-5a40-4938-9271-fedcba098765';
-test('new-format: equal boot_id + equal ticks → match', () => {
-    assert.equal(identitiesMatch(`${BOOT_A}#53459`, `${BOOT_A}#53459`), true, 'same boot, same process');
-});
-test('new-format: equal ticks + DIFFERENT boot_id → NO match (cross-boot collision)', () => {
-    // Ticks reset per boot and can repeat; a different boot_id with the same
-    // ticks is a DIFFERENT process on a DIFFERENT boot. This is the exact false
-    // match the boot-scoped base closes.
-    assert.equal(identitiesMatch(`${BOOT_A}#53459`, `${BOOT_B}#53459`), false, 'equal ticks must NOT win across boots');
-});
-test('new-format: same boot_id + DIFFERENT ticks → NO match (in-boot reuse)', () => {
-    assert.equal(identitiesMatch(`${BOOT_A}#53459`, `${BOOT_A}#60536`), false, 'reused pid within one boot');
-});
-test('migration: legacy lstart#ticks vs new bootId#ticks with equal ticks → match', () => {
-    // An in-place upgrade compares an already-recorded `lstart#ticks` row
-    // against a freshly-read `bootId#ticks`. A blanket base-mismatch verdict
-    // would false-kill the live broker; the legacy base (not a UUID) routes to
-    // ticks-alone so the live broker survives the upgrade.
-    assert.equal(identitiesMatch('Sat Jul 11 17:51:45 2026#53459', `${BOOT_A}#53459`), true, 'legacy → new migration');
-    assert.equal(identitiesMatch(`${BOOT_A}#53459`, 'Sat Jul 11 17:51:45 2026#53459'), true, 'order-independent');
-    assert.equal(identitiesMatch('Sat Jul 11 17:51:45 2026#60536', `${BOOT_A}#53459`), false, 'legacy migration still discriminates on ticks');
-});
-// --- composeIdentity composition (guards against a regression that emits the
-//     old wall-clock `lstart#ticks` on a boot_id-capable host) ---
-test('composeIdentity: procfs + boot_id host emits <bootId>#<ticks> with the base equal to the kernel boot_id', () => {
-    // The exact production-guest shape. The `deps` seam injects the boot_id and
-    // ticks so the composition is provable off-Linux (real /proc reads return
-    // null there). If composeIdentity regressed to emitting lstart#ticks, the
-    // base here would be the lstart string, not BOOT_A — this asserts it is not.
-    const id = composeIdentity(1234, 'Sat Jul 11 17:51:45 2026', { bootId: BOOT_A, ticks: '53459' });
-    assert.equal(id, `${BOOT_A}#53459`, 'base must be the kernel boot_id, not the wall-clock lstart');
-    assert.equal(splitBase(id), BOOT_A);
-});
-test('composeIdentity: procfs but NO readable boot_id falls back to <lstart>#<ticks>', () => {
-    const id = composeIdentity(1234, 'Sat Jul 11 17:51:45 2026', { bootId: null, ticks: '53459' });
-    assert.equal(id, 'Sat Jul 11 17:51:45 2026#53459', 'no boot_id → prior lstart#ticks behavior');
-});
-test('composeIdentity: no procfs ticks emits the bare <lstart> (coarse, unchanged)', () => {
-    const id = composeIdentity(1234, 'Sat Jul 11 17:51:45 2026', { bootId: BOOT_A, ticks: null });
-    assert.equal(id, 'Sat Jul 11 17:51:45 2026', 'no ticks → bare lstart regardless of boot_id');
-});
-function splitBase(identity) {
-    const i = identity.indexOf('#');
-    return i === -1 ? identity : identity.slice(0, i);
-}
-// --- boot_id cache: a TRANSIENT read failure must be retried, never cached as
-//     permanent absence (would permanently downgrade a boot_id host to legacy
-//     lstart#ticks identities). This exercises the exact memoize used by
-//     bootIdBase. ---
-test('makeBootIdCache: a null read is negative-cached, RETRIED only after the window, then a success is cached forever', () => {
-    let calls = 0;
-    const reads = [null, BOOT_A, BOOT_B];
-    let clock = 1_000;
-    const cache = makeBootIdCache(() => {
-        const v = calls < reads.length ? reads[calls] : BOOT_B;
-        calls += 1;
-        return v;
-    }, () => clock, 100);
-    assert.equal(cache(), null, 'first read failed → null (not cached)');
-    assert.equal(calls, 1);
-    assert.equal(cache(), null, 'within the negative window → NOT re-read');
-    assert.equal(calls, 1, 'the throwing read is rate-limited, not repeated every call');
-    clock += 100; // advance past the negative-cache deadline
-    assert.equal(cache(), BOOT_A, 'after the window the failure is retried → succeeds');
-    assert.equal(calls, 2);
-    clock += 10_000;
-    assert.equal(cache(), BOOT_A, 'success is now cached → reader NOT called again');
-    assert.equal(calls, 2, 'no further reads after a successful one');
-});
-test('makeBootIdCache: a permanent no-boot_id host reads null only once per negative window (bounded, not per-call)', () => {
-    let calls = 0;
-    let clock = 1_000;
-    const cache = makeBootIdCache(() => {
-        calls += 1;
-        return null;
-    }, () => clock, 100);
-    assert.equal(cache(), null);
-    assert.equal(cache(), null);
-    assert.equal(cache(), null);
-    assert.equal(calls, 1, 'repeated calls within one window do a SINGLE read — no synchronous read storm');
-    clock += 100;
-    assert.equal(cache(), null);
-    assert.equal(calls, 2, 'one read per window — still retryable for a transient miss, but bounded');
-});
-test('malformed/empty ticks suffix is treated as ABSENT (base compare applies)', () => {
-    // A garbage suffix must never be trusted as a fine discriminator; it falls
-    // back to the base compare.
-    assert.equal(identitiesMatch('A#', 'B#'), false, 'empty suffix → absent ticks → bases differ');
-    assert.equal(identitiesMatch('A#', 'A#'), true, 'empty suffix → absent ticks → bases agree');
-    assert.equal(identitiesMatch('A#bad', 'B#bad'), false, 'non-numeric suffix → absent ticks → bases differ');
-    assert.equal(identitiesMatch('A#bad', 'A#other'), true, 'non-numeric suffix → absent ticks → bases agree');
-    assert.equal(identitiesMatch(`${BOOT_A}#12#34`, `${BOOT_A}#12#34`), true, 'multiple-# suffix is non-numeric → absent ticks → boot_id bases agree');
-    assert.equal(identitiesMatch(`${BOOT_A}#12#34`, `${BOOT_B}#12#34`), false, 'multiple-# suffix → absent ticks → boot_id bases differ');
-});

package/dist/core/__tests__/pid-zombie.test.d.ts

@@ -1 +0,0 @@
-export {};

package/dist/core/__tests__/pid-zombie.test.js

@@ -1,42 +0,0 @@
-// Run with: node --import tsx/esm --test src/core/__tests__/pid-zombie.test.ts
-//
-// Regression cover for the zombie-broker revive bug: `kill(pid, 0)` reports a
-// ZOMBIE process (exited, awaiting reap by its parent) as perfectly alive —
-// its pid is still occupied in the process table. A broker's spawning process
-// that never gets to process its SIGCHLD (the real-world trigger: `bootRoot`'s
-// foreground attach session used to block its OWN event loop for the whole
-// session via a synchronous `spawnSync`, so it could never reap its detached
-// broker child in real time — see the async-spawn fix in runtime/spawn.ts)
-// leaves that broker a zombie indefinitely. The daemon's revive guard reads
-// liveness through `isPidAlive(pi_pid)` alone (`revive.ts`), so misreading a
-// zombie as alive wedges the relaunch forever. `isPidAlive` must classify a
-// genuine zombie as dead.
-//
-// Fabricates a REAL zombie: spawn a child with no exit listener, then starve
-// THIS process's own event loop with a synchronous busy-wait spanning the
-// child's exit — mirroring exactly how a blocking spawnSync parks the parent's
-// loop past a child's death, before any assertion ever runs.
-import { test } from 'node:test';
-import assert from 'node:assert/strict';
-import { spawn } from 'node:child_process';
-import { isPidAlive } from '../canvas/pid.js';
-test('isPidAlive reads a genuine zombie process as dead, not alive', () => {
-    const child = spawn('/bin/sh', ['-c', 'exit 0'], { detached: true, stdio: 'ignore' });
-    const pid = child.pid;
-    assert.ok(pid != null, 'child must have a pid');
-    child.unref(); // no exit listener attached — nothing reaps it while the loop is starved below
-    // Busy-wait SYNCHRONOUSLY (no `await`/timer — starving the event loop, not
-    // just delaying it) long enough for the child to exit and the kernel to
-    // mark it a zombie, before this process's SIGCHLD handling ever gets a turn.
-    const deadline = Date.now() + 400;
-    while (Date.now() < deadline) { /* starve the loop */ }
-    assert.equal(isPidAlive(pid), false, 'a zombie pid must read as dead, not alive');
-    // Best-effort cleanup: signaling an already-zombied pid is a harmless no-op
-    // (it's already dead) — the zombie self-clears once this test process exits
-    // and the orphan is reparented to init, same as every other fixture in this
-    // suite; nothing here relies on that timing for the assertion above.
-    try {
-        process.kill(pid, 'SIGKILL');
-    }
-    catch { /* already gone */ }
-});

package/dist/core/__tests__/plugin-kinds.test.d.ts

@@ -1 +0,0 @@
-export {};

package/dist/core/__tests__/plugin-kinds.test.js

@@ -1,182 +0,0 @@
-// Run with: node --conditions=crtr-src --import tsx/esm --test src/core/__tests__/plugin-kinds.test.ts
-//
-// Wiring pins for plugin-declared kinds — the layer whose absence is SILENT:
-// `mergeKinds` drops nothing loudly at read time, so if `readMergedLaunchConfig`
-// stopped layering enabled plugins' manifest `kinds` blocks (or layered them in
-// the wrong precedence slot), every plugin-shipped persona kind would simply
-// vanish from the registry with all suites green. Precedence under pin:
-//   builtin → user plugins → user config → profile → per project root:
-//   (root plugins → root config)
-// Plus the archive path: `validatePluginBundle` must carry a valid bundle.json
-// `kinds` block into `ValidatedBundle.kinds` (what the installer copies into
-// the synthesized manifest) and reject an invalid one loudly.
-import { test, before, beforeEach, afterEach, after } from 'node:test';
-import assert from 'node:assert/strict';
-import { mkdtempSync, mkdirSync, rmSync, writeFileSync, realpathSync } from 'node:fs';
-import { tmpdir } from 'node:os';
-import { join } from 'node:path';
-import * as tar from 'tar';
-import { resetScopeCache } from '../scope.js';
-import { readMergedLaunchConfig, updateRawConfigAtomically, writeRawConfig } from '../config.js';
-import { initializeFreshScopedStore } from '../scoped-state/migrate.js';
-import { validatePluginBundle } from '../command-plugins/bundle.js';
-let isolatedHome;
-let isolatedCwd;
-let prevHome;
-let prevCwd;
-before(() => {
-    prevHome = process.env.HOME;
-    prevCwd = process.cwd();
-});
-beforeEach(() => {
-    isolatedHome = realpathSync(mkdtempSync(join(tmpdir(), 'crtr-plugin-kinds-home-')));
-    isolatedCwd = realpathSync(mkdtempSync(join(tmpdir(), 'crtr-plugin-kinds-cwd-')));
-    process.env.HOME = isolatedHome;
-    process.chdir(isolatedCwd);
-    initializeFreshScopedStore({ kind: 'user', root: join(isolatedHome, '.crouter') });
-    resetScopeCache();
-});
-afterEach(() => {
-    process.chdir(prevCwd);
-    rmSync(isolatedHome, { recursive: true, force: true });
-    rmSync(isolatedCwd, { recursive: true, force: true });
-});
-after(() => {
-    process.chdir(prevCwd);
-    process.env.HOME = prevHome;
-    resetScopeCache();
-});
-/** Plant a manifest-only plugin (kinds need no commands or executable). */
-function plantPlugin(scopeRootPath, name, kinds) {
-    const root = join(scopeRootPath, 'plugins', name, '.crouter-plugin');
-    mkdirSync(root, { recursive: true });
-    writeFileSync(join(root, 'plugin.json'), JSON.stringify({ name, version: '0.1.0', kinds }));
-}
-function userRoot() {
-    const root = join(isolatedHome, '.crouter');
-    mkdirSync(root, { recursive: true });
-    return root;
-}
-function projectRoot() {
-    const root = join(isolatedCwd, '.crouter');
-    mkdirSync(root, { recursive: true });
-    return root;
-}
-test('an enabled user-scope plugin adds a full kind and patches a builtin kind', () => {
-    plantPlugin(userRoot(), 'northlight', {
-        'applet-builder': { whenToUse: 'Build a Northlight applet.', model: 'anthropic/strong' },
-        general: { model: 'openai/light' },
-    });
-    const kinds = readMergedLaunchConfig().kinds;
-    assert.equal(kinds['applet-builder']?.whenToUse, 'Build a Northlight applet.');
-    assert.equal(kinds['applet-builder']?.model, 'anthropic/strong');
-    assert.equal(kinds['general']?.model, 'openai/light');
-    // Patch semantics: the builtin general keeps its whenToUse.
-    assert.ok((kinds['general']?.whenToUse ?? '').length > 0);
-});
-test('the scope\u2019s own config.json overrides its plugins; a disabled plugin contributes nothing', () => {
-    const root = userRoot();
-    plantPlugin(root, 'northlight', { 'applet-builder': { whenToUse: 'plugin gloss', model: 'anthropic/strong' } });
-    plantPlugin(root, 'zzz-disabled', { ghost: { whenToUse: 'never registers' } });
-    updateRawConfigAtomically('user', () => ({
-        plugins: { 'zzz-disabled': { enabled: false } },
-        kinds: { 'applet-builder': { model: 'openai/medium' } },
-    }));
-    const kinds = readMergedLaunchConfig().kinds;
-    assert.equal(kinds['applet-builder']?.model, 'openai/medium'); // config patch wins
-    assert.equal(kinds['applet-builder']?.whenToUse, 'plugin gloss'); // patch merges, not replaces
-    assert.equal(kinds['ghost'], undefined);
-});
-test('a whenToUse-only entry re-glosses an existing kind without stripping its model tier', () => {
-    // The pre-change footgun: `{whenToUse}` parsed as a FULL entry and wholly
-    // replaced the kind, silently dropping explore off its cheap model tier.
-    // Now every entry field-merges over an existing kind; only a NEW kind
-    // requires whenToUse (a whenToUse-less new kind is dropped).
-    const root = userRoot();
-    updateRawConfigAtomically('user', () => ({ kinds: { explore: { whenToUse: 'custom explore gloss' }, 'new-glossless': { model: 'openai/light' } } }));
-    const kinds = readMergedLaunchConfig().kinds;
-    assert.equal(kinds['explore']?.whenToUse, 'custom explore gloss');
-    assert.equal(kinds['explore']?.model, 'openai/light'); // builtin tier survives
-    assert.equal(kinds['explore']?.orchestratorModel, 'anthropic/strong');
-    assert.equal(kinds['new-glossless'], undefined);
-});
-test('a project-root plugin layers above user config, and the project config above the plugin', () => {
-    const uRoot = userRoot();
-    writeRawConfig('user', { kinds: { shared: { whenToUse: 'user gloss', model: 'openai/light' } } });
-    const pRoot = projectRoot();
-    plantPlugin(pRoot, 'proj-plugin', { shared: { model: 'anthropic/strong' }, 'proj-kind': { whenToUse: 'project plugin kind' } });
-    writeFileSync(join(pRoot, 'config.json'), JSON.stringify({ kinds: { 'proj-kind': { model: 'openai/medium' } } }));
-    const kinds = readMergedLaunchConfig().kinds;
-    assert.equal(kinds['shared']?.model, 'anthropic/strong'); // project plugin > user config
-    assert.equal(kinds['shared']?.whenToUse, 'user gloss');
-    assert.equal(kinds['proj-kind']?.model, 'openai/medium'); // project config > project plugin
-    assert.equal(kinds['proj-kind']?.whenToUse, 'project plugin kind');
-});
-// archive path
-function minimalCommandsJson() {
-    return {
-        schemaVersion: 1,
-        mounts: [
-            {
-                parent: [],
-                node: {
-                    kind: 'branch',
-                    name: 'app',
-                    description: 'application lifecycle and inspection',
-                    whenToUse: 'you need to inspect an application',
-                    rootEntry: {
-                        concept: 'applications hosted by a crouter home',
-                        description: 'application lifecycle and inspection',
-                        whenToUse: 'you need to inspect an application',
-                    },
-                    summary: 'application lifecycle and inspection',
-                    model: 'Applications are product resources owned by the selected home.',
-                    children: [
-                        {
-                            kind: 'leaf',
-                            name: 'show',
-                            description: 'show one application',
-                            whenToUse: 'inspect a single application by id',
-                            tier: 'important',
-                            summary: 'show one application details',
-                            params: [{ kind: 'positional', name: 'app-id', required: true, constraint: 'the application id' }],
-                            output: [{ name: 'app_id', type: 'string', required: true, constraint: 'the echoed application id' }],
-                            effects: ['None. Read-only.'],
-                            rest: { method: 'GET', path: '/v1/apps/{app-id}', params: { 'app-id': { in: 'path' } } },
-                        },
-                    ],
-                },
-            },
-        ],
-    };
-}
-function makeArchive(bundleJson) {
-    const dir = mkdtempSync(join(tmpdir(), 'crtr-plugin-kinds-tar-'));
-    try {
-        writeFileSync(join(dir, 'bundle.json'), JSON.stringify(bundleJson));
-        writeFileSync(join(dir, 'commands.json'), JSON.stringify(minimalCommandsJson()));
-        const pack = tar.create({ sync: true, cwd: dir, portable: true }, ['bundle.json', 'commands.json']);
-        const chunks = [];
-        let chunk;
-        while ((chunk = pack.read()) !== null)
-            chunks.push(chunk);
-        return new Uint8Array(Buffer.concat(chunks));
-    }
-    finally {
-        rmSync(dir, { recursive: true, force: true });
-    }
-}
-test('validatePluginBundle carries a valid bundle.json kinds block into ValidatedBundle', async () => {
-    const archive = makeArchive({ bundleVersion: 1, kinds: { 'applet-builder': { whenToUse: 'Build an applet.', model: 'anthropic/strong' } } });
-    const validated = await validatePluginBundle(archive, { reservedCoreNames: new Set(['node']) });
-    assert.deepEqual(validated.issues, []);
-    assert.deepEqual(validated.bundle?.kinds, { 'applet-builder': { whenToUse: 'Build an applet.', model: 'anthropic/strong' } });
-});
-test('validatePluginBundle rejects an invalid kinds block loudly', async () => {
-    const archive = makeArchive({ bundleVersion: 1, kinds: { broken: { when_to_use: 'typo field' } } });
-    const validated = await validatePluginBundle(archive, { reservedCoreNames: new Set(['node']) });
-    assert.equal(validated.bundle, undefined);
-    assert.equal(validated.issues.length, 1);
-    assert.match(validated.issues[0].message, /kinds block is invalid/);
-    assert.match(validated.issues[0].received, /when_to_use/);
-});

package/dist/core/__tests__/plugin-link-symlinked-scope-root.test.d.ts

@@ -1 +0,0 @@
-export {};

package/dist/core/__tests__/plugin-link-symlinked-scope-root.test.js

@@ -1,43 +0,0 @@
-// Run with: node --conditions=crtr-src --import tsx/esm --test src/core/__tests__/plugin-link-symlinked-scope-root.test.ts
-//
-// Regression for the silent half of a local/marketplace plugin install: the
-// scope root is reached through a symlinked ancestor (the macOS /tmp →
-// /private/tmp case), so a relative link target computed from the lexical
-// directory counts `..` hops up the wrong chain. symlinkSync accepts a
-// dangling target, so `pkg plugin install` reported success and registered
-// enabled=true while the next invocation resolved zero plugins.
-import { test, describe } from 'node:test';
-import assert from 'node:assert/strict';
-import { mkdtempSync, mkdirSync, rmSync, symlinkSync, writeFileSync } from 'node:fs';
-import { tmpdir } from 'node:os';
-import { join } from 'node:path';
-import { realpathSync } from 'node:fs';
-import { linkOrCopy } from '../fs-utils.js';
-import { listInstalledPluginsInRoot } from '../resolver.js';
-import { closeScopedStores } from '../scoped-state/db.js';
-import { initializeFreshScopedStore } from '../scoped-state/migrate.js';
-describe('plugin link through a symlinked scope-root ancestor', () => {
-    test('the installed plugin resolves on the next invocation', () => {
-        const base = mkdtempSync(join(tmpdir(), 'crtr-plugin-link-'));
-        try {
-            // Source plugin package, outside the scope root.
-            const source = join(base, 'source', 'search');
-            mkdirSync(join(source, '.crouter-plugin'), { recursive: true });
-            writeFileSync(join(source, '.crouter-plugin', 'plugin.json'), JSON.stringify({ name: 'search', version: '0.1.0' }));
-            // Scope root addressed through a symlinked ancestor: `home` is a link,
-            // so the plugins directory's physical parent chain differs from its
-            // lexical one.
-            mkdirSync(join(base, 'physical', 'home'), { recursive: true });
-            symlinkSync(join('physical', 'home'), join(base, 'home'), 'dir');
-            const scopeRootPath = join(base, 'home', '.crouter');
-            mkdirSync(join(scopeRootPath, 'plugins'), { recursive: true });
-            initializeFreshScopedStore({ kind: 'user', root: scopeRootPath });
-            linkOrCopy(source, join(scopeRootPath, 'plugins', 'search'));
-            assert.deepEqual(listInstalledPluginsInRoot('user', realpathSync(scopeRootPath)).map((p) => p.name), ['search']);
-        }
-        finally {
-            closeScopedStores();
-            rmSync(base, { recursive: true, force: true });
-        }
-    });
-});

package/dist/core/__tests__/plugin-page-components.test.d.ts

@@ -1 +0,0 @@
-export {};