beatrina 0.8.6 → 0.9.43

package/engines/python/bootstrap.py

@@ -1,7 +1,8 @@
 """bootstrap.py — code executed silently inside the ipykernel at startup.
 
-Ported from `../carmar-python/py/carmapy/bootstrap.py` (read 2026-09-14), with
-one addition: `__carmapy_reply` now also answers `env`, so the notebook's
+Ported from carmapy's `py/carmapy/bootstrap.py` (read 2026-09-14; the closed
+repository github.com/mohsaqr/carmar-python, see docs/python-kernel-records/), with
+one addition: `__beatrina_reply` now also answers `env`, so the notebook's
 Environment pane has something to show for a Python session.
 
 This is how a pandas DataFrame becomes Beatrix's `dataframe` frame rather than
@@ -26,14 +27,14 @@ correctness, not polish:
 import base64 as _base64
 from pathlib import Path as _Path
 
-CARMAR_MIME = "application/vnd.carmar.dataframe+json"
+BEATRINA_MIME = "application/vnd.beatrina.dataframe+json"
 # The reply channel, and the kernel's own housekeeping, each on their own
 # private MIME. Two, not one: a `view` reply is a REPLY the worker is waiting
 # on by wire id, while the cwd is UNSOLICITED state the worker records and
 # never forwards. Folding them together would make "is anyone waiting for
 # this?" a field rather than a type.
-REPLY_MIME = "application/vnd.carmapy.reply+json"
-CONTROL_MIME = "application/vnd.carmapy.control+json"
+REPLY_MIME = "application/vnd.beatrina.reply+json"
+CONTROL_MIME = "application/vnd.beatrina.control+json"
 
 # `dataview.py` is shipped into the kernel as SOURCE, base64-encoded.
 #
@@ -56,7 +57,7 @@ _HANDOFF_B64 = _base64.b64encode(
     _Path(__file__).with_name("handoff.py").read_bytes()).decode()
 
 BOOTSTRAP = r'''
-def __carmar_install_formatters():
+def __beatrina_install_formatters():
     import json
 
     PREVIEW_ROWS = 200
@@ -121,21 +122,21 @@ def __carmar_install_formatters():
     except NameError:
         return
     fmts = ip.display_formatter.formatters
-    if "__CARMAR_MIME__" not in fmts:
+    if "__BEATRINA_MIME__" not in fmts:
         from IPython.core.formatters import BaseFormatter
         from traitlets import Unicode, ObjectName
-        class _CarmarDF(BaseFormatter):
-            format_type = Unicode("__CARMAR_MIME__")
-            print_method = ObjectName("_repr_carmar_df_")
+        class _BeatrinaDF(BaseFormatter):
+            format_type = Unicode("__BEATRINA_MIME__")
+            print_method = ObjectName("_repr_beatrina_df_")
             _return_type = str
-        fmts["__CARMAR_MIME__"] = _CarmarDF(parent=ip.display_formatter)
+        fmts["__BEATRINA_MIME__"] = _BeatrinaDF(parent=ip.display_formatter)
     # pandas 3.0 sets DataFrame.__module__ = "pandas"; every older example in
     # the ecosystem says "pandas.core.frame", which on pandas 3.x matches
     # NOTHING and fails silently — the formatter registers, reports active, and
     # is never called. Register both spellings; a deferred name that never
     # resolves costs nothing.
     for mod in ("pandas", "pandas.core.frame"):
-        fmts["__CARMAR_MIME__"].for_type_by_name(mod, "DataFrame", _frame)
+        fmts["__BEATRINA_MIME__"].for_type_by_name(mod, "DataFrame", _frame)
 
     # ---- figures -------------------------------------------------------
     # The R worker captures a plot without being asked; Python must too, or
@@ -179,12 +180,12 @@ def __carmar_install_formatters():
     # the frame is built outside the kernel, so the kernel has to volunteer the
     # value, and post_run_cell is the one place it is certainly current: the
     # cell that moved it has finished.
-    def _carmapy_cwd(*a, **k):
+    def _beatrina_cwd(*a, **k):
         import os, json
         from IPython.display import publish_display_data
-        publish_display_data({"__CARMAPY_CONTROL__": json.dumps({"cwd": os.getcwd()})})
+        publish_display_data({"__BEATRINA_CONTROL__": json.dumps({"cwd": os.getcwd()})})
 
-    ip.events.register("post_run_cell", _carmapy_cwd)
+    ip.events.register("post_run_cell", _beatrina_cwd)
 
     # ---- the data viewer, and the environment listing ----------------------
     # `dataview.py`'s source, exec'd on FIRST USE and never at boot. Lazy so a
@@ -194,8 +195,8 @@ def __carmar_install_formatters():
     def _dataview():
         if state["ns"] is None:
             import base64
-            ns = {"__name__": "carmapy_dataview"}
-            exec(compile(base64.b64decode("__CARMAPY_DATAVIEW_B64__").decode("utf-8"),
+            ns = {"__name__": "beatrina_dataview"}
+            exec(compile(base64.b64decode("__BEATRINA_DATAVIEW_B64__").decode("utf-8"),
                          "<beatrina dataview>", "exec"), ns)
             state["ns"] = ns
         return state["ns"]
@@ -214,7 +215,7 @@ def __carmar_install_formatters():
         hidden = {"In", "Out", "get_ipython", "exit", "quit", "open", "share", "use"}
         rows = []
         for name, value in list(user_ns.items()):
-            if name.startswith("_") or name in hidden or name.startswith("__carmapy"):
+            if name.startswith("_") or name in hidden or name.startswith("__beatrina"):
                 continue
             # An `import pandas as pd` IS a binding the user made, but a pane
             # that lists every module buries the three variables the notebook
@@ -249,7 +250,7 @@ def __carmar_install_formatters():
         rows.sort(key=lambda r: r["name"])
         return {"objects": rows}
 
-    def __carmapy_reply(op, spec_json):
+    def __beatrina_reply(op, spec_json):
         """Answer one request into a private MIME on iopub.
 
         NOT a return value and not stdout. A display_data message carries the
@@ -280,17 +281,17 @@ def __carmar_install_formatters():
             # a 40-column frame of fitted models is a normal thing to do by
             # accident, and it must cost a message, not the session.
             payload = {"error": "%s: %s" % (type(exc).__name__, exc)}
-        publish_display_data({"__CARMAPY_REPLY__": json.dumps(payload, allow_nan=False)})
+        publish_display_data({"__BEATRINA_REPLY__": json.dumps(payload, allow_nan=False)})
 
-    ip.user_ns["__carmapy_reply"] = __carmapy_reply
+    ip.user_ns["__beatrina_reply"] = __beatrina_reply
 
     # ---- the debugger (docs/wp/wp8b-python-debugger.md) ------------------
     import base64 as _b64
-    dbg = {"__name__": "carmar_debugger"}
-    exec(compile(_b64.b64decode("__CARMAR_DEBUGGER_B64__").decode("utf-8"),
+    dbg = {"__name__": "beatrina_debugger"}
+    exec(compile(_b64.b64decode("__BEATRINA_DEBUGGER_B64__").decode("utf-8"),
                  "<beatrina debugger>", "exec"), dbg)
     dbg["install"](ip)
-    ip.user_ns["__carmar_debug_prepare"] = dbg["prepare"]
+    ip.user_ns["__beatrina_debug_prepare"] = dbg["prepare"]
 
     # ---- share / use (engines/python/handoff.py) -------------------------
     hand = {"__name__": "beatrix_handoff"}
@@ -299,11 +300,11 @@ def __carmar_install_formatters():
     ip.user_ns["share"] = hand["share"]
     ip.user_ns["use"] = hand["use"]
 
-__carmar_install_formatters()
-del __carmar_install_formatters
-'''.replace("__CARMAR_MIME__", CARMAR_MIME) \
-   .replace("__CARMAPY_REPLY__", REPLY_MIME) \
-   .replace("__CARMAPY_CONTROL__", CONTROL_MIME) \
-   .replace("__CARMAPY_DATAVIEW_B64__", _DATAVIEW_B64) \
-   .replace("__CARMAR_DEBUGGER_B64__", _DEBUGGER_B64) \
+__beatrina_install_formatters()
+del __beatrina_install_formatters
+'''.replace("__BEATRINA_MIME__", BEATRINA_MIME) \
+   .replace("__BEATRINA_REPLY__", REPLY_MIME) \
+   .replace("__BEATRINA_CONTROL__", CONTROL_MIME) \
+   .replace("__BEATRINA_DATAVIEW_B64__", _DATAVIEW_B64) \
+   .replace("__BEATRINA_DEBUGGER_B64__", _DEBUGGER_B64) \
    .replace("__BEATRIX_HANDOFF_B64__", _HANDOFF_B64)

package/engines/python/debugger.py

@@ -41,18 +41,22 @@ import sys as _sys
 
 #: The prompt marker. ESC bytes: nothing a person types into `input()` starts
 #: with it, and the worker strips it before anything reaches the page.
-PROMPT = "\x1bcarmar-debug\x1b"
+PROMPT = "\x1bbeatrina-debug\x1b"
 
 MAX_VARS = 40
 MAX_CALL = 300
 MAX_VALUE = 60
-HIDDEN = {"In", "Out", "get_ipython", "exit", "quit", "open"}
+# The names Beatrix itself puts in the user namespace and the Environment pane
+# hides (bootstrap.py, `env`): IPython's, plus `share`/`use` from handoff.py.
+# A top-level pause lists the USER's variables, so the same names are hidden
+# here; test/host-python-debug.test.mjs pins that the two sets agree.
+HIDDEN = {"In", "Out", "get_ipython", "exit", "quit", "open", "share", "use"}
 
 
-class CarmarDebugAbort(BaseException):
+class BeatrinaDebugAbort(BaseException):
     """The debugger's Stop. BASE exception, not Exception: a user's
     `except Exception:` around the paused line must not swallow it and carry
-    on, which is the promise R keeps with its `carmar_abort_cell` restart."""
+    on, which is the promise R keeps with its `beatrina_abort_cell` restart."""
 
 
 class _State:
@@ -253,7 +257,7 @@ def _eval_in(frame, expr):
         value = eval(code, glb, loc)
         if value is not None:
             print(repr(value))
-    except (KeyboardInterrupt, CarmarDebugAbort):
+    except (KeyboardInterrupt, BeatrinaDebugAbort):
         raise
     except BaseException:
         text = traceback.format_exception_only(*_sys.exc_info()[:2])
@@ -295,7 +299,7 @@ def _pause(frame, reason):
                 S.mode, S.target = "out", frame
                 return
             if action == "abort":
-                raise CarmarDebugAbort("Stopped from the debugger")
+                raise BeatrinaDebugAbort("Stopped from the debugger")
             if action == "where":
                 payload = {"event": "where", **_position(frame),
                            "stack": _stack(frame), "locals": _locals(frame)}

package/engines/python/engine.json

@@ -7,7 +7,7 @@
   "worker": "engines/python/worker.py",
   "boot": "on-demand",
   "runtime": {
-    "env": "CARMAR_PYTHON",
+    "env": "BEATRINA_PYTHON",
     "ladder": [
       "VIRTUAL_ENV",
       "CONDA_PREFIX",

package/engines/python/handoff.py

@@ -2,7 +2,8 @@
 
 The explicit bridge between a Beatrix session's languages (engines/r/handoff.R,
 engines/js/worker.mjs): a value crosses only when a chunk names it. The format
-is one JSON file per name in CARMAR_HANDOFF_DIR:
+is one JSON file per name in BEATRINA_HANDOFF_DIR (its older spelling is read
+too):
 
     {"format": "beatrix-columns-v1", "name": ..., "from": "python",
      "columns": [...], "data": {"<column>": [values]}}
@@ -28,7 +29,8 @@ _NAME_RE = _re.compile(r"^[A-Za-z_][A-Za-z0-9_.]*$")
 
 
 def _handoff_path(name):
-    folder = _os.environ.get("CARMAR_HANDOFF_DIR", "")
+    folder = (_os.environ.get("BEATRINA_HANDOFF_DIR")
+              or _os.environ.get("CARMAR_HANDOFF_DIR", ""))  # beatrina-names: keep
     if not folder or not _os.path.isdir(folder):
         raise RuntimeError("share()/use() need the Beatrina host's hand-off directory; "
                            "this Python was started without one.")

package/engines/python/worker.py

@@ -25,9 +25,10 @@ does, one process further out. It does not open a port (the kernel's own ZMQ
 sockets are jupyter_client's, on loopback, and are not Beatrix's wire). It does
 not interpret chunk options; the host coordinates, the engine executes.
 
-Ported from `../carmar-python/py/carmapy/` — `adapter.py` from
-`kernel_adapter.py`, `bootstrap.py`, `dataview.py` and `document_exec.py`
-verbatim or nearly so. That repository is read-only to this one.
+Ported from carmapy's `py/carmapy/` — `adapter.py` from `kernel_adapter.py`,
+`bootstrap.py`, `dataview.py` and `document_exec.py` verbatim or nearly so.
+That repository is closed (github.com/mohsaqr/carmar-python, 2026-09-16); the
+records Beatrix cites from it are under docs/python-kernel-records/.
 """
 
 from __future__ import annotations
@@ -45,9 +46,23 @@ from adapter import PythonSession                      # noqa: E402
 from document_exec import (DocumentExecError,          # noqa: E402
                            DocumentSetups, FEATURE)
 
-SENTINEL = os.environ.get("CARMAR_SENTINEL", "")
-CMD_TAG = os.environ.get("CARMAR_CMD_TAG", "")
-KERNEL_NAME = os.environ.get("CARMAR_PYTHON_KERNEL", "python3")
+
+
+# beatrina-names: keep-start — the reader of the older spelling
+def _env(suffix, default=""):
+    """A product variable: BEATRINA_<suffix>, else its old CARMAR_ spelling.
+
+    The host sets both (host/env-names.mjs mirrorEnv); a test that starts this
+    worker by hand may still set only the old one.
+    """
+    v = os.environ.get("BEATRINA_" + suffix)
+    return v if v is not None else os.environ.get("CARMAR_" + suffix, default)
+# beatrina-names: keep-end
+
+
+SENTINEL = _env("SENTINEL")
+CMD_TAG = _env("CMD_TAG")
+KERNEL_NAME = _env("PYTHON_KERNEL", "python3")
 
 #: Every verb this engine answers. The host merges it into `ready.commands`,
 #: and `lib/kernel-capability.js` is the reason it matters: an op a kernel
@@ -542,15 +557,29 @@ def _parse_state(source) -> dict:
     return {"complete": result is not None, "message": None}
 
 
+def install_signal_handlers(loop, worker) -> None:
+    """Schedule signals on the loop, including Windows' ProactorEventLoop.
+
+    Windows does not implement add_signal_handler. Its Python signal handler
+    must only enqueue the callback; the worker's asyncio state stays on the
+    loop just as it does on Unix.
+    """
+    for signum, callback in ((signal.SIGINT, worker.on_interrupt),
+                             (signal.SIGTERM, worker._eof)):
+        try:
+            loop.add_signal_handler(signum, callback)
+        except NotImplementedError:
+            def schedule(_signum, _frame, callback=callback):
+                loop.call_soon_threadsafe(callback)
+            signal.signal(signum, schedule)
+
+
 async def main() -> None:
     worker = Worker()
     loop = asyncio.get_running_loop()
     worker.loop = loop            # before the handlers, or an early signal has none
-    # add_signal_handler, not signal.signal: the C-level handler runs between
-    # bytecodes and cannot touch the loop safely.
-    loop.add_signal_handler(signal.SIGINT, worker.on_interrupt)
-    loop.add_signal_handler(signal.SIGTERM, worker._eof)
     try:
+        install_signal_handlers(loop, worker)
         await worker.start()
     except Exception as exc:
         emit({"type": "ready-error", "error": f"{type(exc).__name__}: {exc}"})

package/engines/r/engine.json

@@ -6,7 +6,7 @@
   "adapter": "host/engine-r.mjs",
   "worker": "spike/worker-boot.R",
   "runtime": {
-    "env": "CARMAR_RSCRIPT",
+    "env": "BEATRINA_RSCRIPT",
     "ladder": [
       "/Library/Frameworks/R.framework/Versions/Current/Resources/bin/Rscript",
       "/opt/homebrew/bin/Rscript",

package/engines/r/handoff.R

@@ -3,7 +3,8 @@
 # Beatrix runs R, Python and JavaScript as separate processes with separate
 # memories (docs/worker-protocol.md §6.1). A value crosses only when a chunk
 # names it: share(df) writes a column table to the host's hand-off directory
-# (CARMAR_HANDOFF_DIR) and use("df") in another language reads it back.
+# (BEATRINA_HANDOFF_DIR; its older spelling is read too) and use("df")
+# in another language reads it back.
 # The JavaScript half is engines/js/worker.mjs; the format is shared:
 #
 #   {"format": "beatrix-columns-v1", "name": ..., "from": "r",
@@ -28,7 +29,7 @@ share <- function(x, name = deparse1(substitute(x))) {
     name <- x
     x <- swapped
   }
-  dir <- Sys.getenv("CARMAR_HANDOFF_DIR", "")
+  dir <- Sys.getenv("BEATRINA_HANDOFF_DIR", Sys.getenv("CARMAR_HANDOFF_DIR", ""))  # beatrina-names: keep
   stopifnot(
     "share() needs the Beatrina host's hand-off directory" = nzchar(dir) && dir.exists(dir),
     "`name` must be letters, digits, dots and underscores, starting with a letter or underscore" =
@@ -61,7 +62,7 @@ share <- function(x, name = deparse1(substitute(x))) {
 #' @param name The name it was shared under.
 #' @return A data frame, one row per shared row, columns in the shared order.
 use <- function(name) {
-  dir <- Sys.getenv("CARMAR_HANDOFF_DIR", "")
+  dir <- Sys.getenv("BEATRINA_HANDOFF_DIR", Sys.getenv("CARMAR_HANDOFF_DIR", ""))  # beatrina-names: keep
   stopifnot(
     "use() needs the Beatrina host's hand-off directory" = nzchar(dir) && dir.exists(dir),
     "`name` must be a single string" = is.character(name) && length(name) == 1L

package/failsafe/ai-policy.R

@@ -1,9 +1,9 @@
-# ai-policy.R — which AI providers an administrator permits, and what CarmaR
+# ai-policy.R — which AI providers an administrator permits, and what Beatrina
 # can actually do about it.
 #
 # ── the honest scope, first, because everything else depends on it ──────────
 #
-# CarmaR runs in a browser the user controls, and the AI request for a
+# Beatrina runs in a browser the user controls, and the AI request for a
 # key-based provider is a `fetch()` from that page. No kernel can prevent a
 # determined user with devtools and their own API key from calling any endpoint
 # they like. Any document promising otherwise would be lying.
@@ -21,7 +21,7 @@
 #   · `ai-key` — the provider key lives in the user's R config directory and is
 #     handed out by the supervisor. Under a local-only policy the supervisor
 #     stops handing it out at all. A user can still paste a key into the tab,
-#     but CarmaR will not keep one for them, and the refusal is audited.
+#     but Beatrina will not keep one for them, and the refusal is audited.
 #   · `agent-chat` — Claude Code and Codex turns are processes the SUPERVISOR
 #     spawns. A policy that does not permit them means they are never spawned.
 #     There is no page-side bypass, because there is no page-side spawn.
@@ -31,9 +31,9 @@
 #
 # ── where a policy comes from ──────────────────────────────────────────────
 #
-#   CARMAR_AI_POLICY=/etc/carmar/ai-policy.json   a file the user cannot write
-#   CARMAR_AI_PROVIDERS=anthropic,lmstudio        the quick form
-#   CARMAR_AI_LOCAL_ONLY=1                        only on-machine providers
+#   BEATRINA_AI_POLICY=/etc/beatrina/ai-policy.json   a file the user cannot write
+#   BEATRINA_AI_PROVIDERS=anthropic,lmstudio        the quick form
+#   BEATRINA_AI_LOCAL_ONLY=1                        only on-machine providers
 #
 # The file wins where both are set, because a file is the form an administrator
 # can own (root-owned, 0644) while an environment variable is inherited from
@@ -121,18 +121,18 @@ policy_split <- function(value) {
 #' @return a list with `set` (is there a policy at all?), `source`,
 #'   `providers` (the permitted ids — every id when unset), `local_only`,
 #'   `note` (an administrator's sentence for the UI), `unknown` (ids named by
-#'   the policy that CarmaR does not have, reported rather than silently
+#'   the policy that Beatrina does not have, reported rather than silently
 #'   dropped) and `errors`.
 #'
 #'   A policy that names NOTHING valid is an error, never an empty allow-list:
-#'   silently permitting no provider would look identical to CarmaR's AI being
+#'   silently permitting no provider would look identical to Beatrina's AI being
 #'   broken, and an administrator would have no way to tell which it was.
-carmar_ai_policy <- function(env = Sys.getenv) {
-  path <- trimws(env("CARMAR_AI_POLICY", ""))
+beatrina_ai_policy <- function(env = Sys.getenv) {
+  path <- trimws(env("BEATRINA_AI_POLICY", ""))
   named <- character(0)
   models <- list()
   base_urls <- list()
-  local_only <- identical(env("CARMAR_AI_LOCAL_ONLY", ""), "1")
+  local_only <- identical(env("BEATRINA_AI_LOCAL_ONLY", ""), "1")
   note <- ""
   source <- ""
   errors <- character(0)
@@ -140,12 +140,12 @@ carmar_ai_policy <- function(env = Sys.getenv) {
   if (nzchar(path)) {
     source <- path
     if (!file.exists(path)) {
-      errors <- c(errors, paste0("CARMAR_AI_POLICY names a file that does not exist: ", path))
+      errors <- c(errors, paste0("BEATRINA_AI_POLICY names a file that does not exist: ", path))
     } else {
       doc <- tryCatch(jsonlite::fromJSON(path, simplifyVector = TRUE),
                       error = function(e) e)
       if (inherits(doc, "error")) {
-        errors <- c(errors, paste0("CARMAR_AI_POLICY is not valid JSON: ", conditionMessage(doc)))
+        errors <- c(errors, paste0("BEATRINA_AI_POLICY is not valid JSON: ", conditionMessage(doc)))
       } else {
         named <- as.character(doc$providers %||% character(0))
         if (isTRUE(doc$local_only)) local_only <- TRUE
@@ -163,9 +163,9 @@ carmar_ai_policy <- function(env = Sys.getenv) {
         errors <- c(errors, endpoints$errors)
       }
     }
-  } else if (nzchar(env("CARMAR_AI_PROVIDERS", ""))) {
+  } else if (nzchar(env("BEATRINA_AI_PROVIDERS", ""))) {
     source <- "env"
-    named <- policy_split(env("CARMAR_AI_PROVIDERS", ""))
+    named <- policy_split(env("BEATRINA_AI_PROVIDERS", ""))
   } else if (local_only) {
     source <- "env"
   }
@@ -249,7 +249,7 @@ ai_provider_allowed <- function(provider, policy) {
 #' administrator has limited this" without saying who or why is the worst
 #' version of a policy message.
 ai_policy_reason <- function(policy, what = "provider") {
-  base <- sprintf("This CarmaR is configured to allow only: %s.",
+  base <- sprintf("This Beatrina is configured to allow only: %s.",
                   paste(policy$providers, collapse = ", "))
   if (nzchar(policy$note)) paste(base, policy$note) else base
 }

package/failsafe/ai-store.R

@@ -40,16 +40,16 @@
 # state survives, because the rename either happened or did not.
 
 ai_store_root <- function() {
-  root <- Sys.getenv("CARMAR_AI_STORE_DIR", "")
+  root <- Sys.getenv("BEATRINA_AI_STORE_DIR", "")
   if (!nzchar(root)) {
-    state <- Sys.getenv("CARMAR_STATE", "")
-    if (!nzchar(state)) state <- tools::R_user_dir("carmar", "data")
+    state <- Sys.getenv("BEATRINA_STATE", "")
+    if (!nzchar(state)) state <- tools::R_user_dir("beatrina", "data")
     root <- file.path(state, "ai")
   }
   root
 }
 
-AI_STORE_ENABLED <- !identical(Sys.getenv("CARMAR_NO_AI_STORE", ""), "1")
+AI_STORE_ENABLED <- !identical(Sys.getenv("BEATRINA_NO_AI_STORE", ""), "1")
 
 # The SAME key shape the journal uses, deliberately: a conversation belongs to
 # the document it was had about, and two stores disagreeing about what a
@@ -136,7 +136,7 @@ ai_write_private <- function(path, text) {
 
 #' Atomic replace within the same directory: write a sibling, rename over.
 ai_replace <- function(path, text) {
-  temp <- tempfile(pattern = ".carmar-ai-", tmpdir = dirname(path))
+  temp <- tempfile(pattern = ".beatrina-ai-", tmpdir = dirname(path))
   ai_write_private(temp, text)
   if (!isTRUE(suppressWarnings(file.rename(temp, path)))) {
     unlink(temp)
@@ -233,7 +233,7 @@ answer_ai_store_op <- function(cmd) {
   type <- cmd$type; id <- cmd$id
   if (!AI_STORE_ENABLED) {
     return(ai_error(type, id, "disabled",
-                    "Conversation storage is switched off on this machine (CARMAR_NO_AI_STORE=1)."))
+                    "Conversation storage is switched off on this machine (BEATRINA_NO_AI_STORE=1)."))
   }
 
   # Every op but `ai_keys` names a document, and the key is checked BEFORE the

package/failsafe/cite.R

@@ -44,7 +44,7 @@ CITE_KEY_RE <- "^[A-Za-z0-9_]([A-Za-z0-9_:.#$%&+?<>~/-]*[A-Za-z0-9_])?$"
 # A style is one plugin of kind `csl`: a folder holding `<id>.csl` and its
 # manifest, in one of three layers — the person's own (what the picker
 # imports from the CSL project's repository, ~10,900 styles), an
-# administrator's `CARMAR_PLUGIN_DIR`, and the six shipped beside the kernel
+# administrator's `BEATRINA_PLUGIN_DIR`, and the six shipped beside the kernel
 # (plugins/csl/). plugins.R owns the layers, the manifest, the integrity
 # check, the atomic install and the policy; this file owns what a CSL file
 # IS (its title, its parent), the repository search, and pandoc. On the wire
@@ -54,8 +54,8 @@ CITE_KEY_RE <- "^[A-Za-z0-9_]([A-Za-z0-9_:.#$%&+?<>~/-]*[A-Za-z0-9_])?$"
 # session, a style on the click that imports it, both through the policy's
 # host list.
 
-CSL_INDEX_URL <- function() Sys.getenv("CARMAR_CSL_INDEX_URL", "https://www.zotero.org/styles-files/styles.json")
-CSL_STYLE_BASE <- function() Sys.getenv("CARMAR_CSL_STYLE_BASE", "https://www.zotero.org/styles/")
+CSL_INDEX_URL <- function() Sys.getenv("BEATRINA_CSL_INDEX_URL", "https://www.zotero.org/styles-files/styles.json")
+CSL_STYLE_BASE <- function() Sys.getenv("BEATRINA_CSL_STYLE_BASE", "https://www.zotero.org/styles/")
 CSL_MAX_INDEX_BYTES <- 8000000
 CSL_INDEX_MAX_AGE_DAYS <- 7
 CSL_SEARCH_LIMIT <- 40L
@@ -65,7 +65,7 @@ CSL_SEARCH_LIMIT <- 40L
 CSL_NAME_RE <- "^[a-z0-9][a-z0-9.-]{0,118}$"
 CSL_NS <- "http://purl.org/net/xbiblio/csl"
 
-csl_cache_dir <- function() tools::R_user_dir("carmar", "cache")
+csl_cache_dir <- function() tools::R_user_dir("beatrina", "cache")
 
 #' A style's own <title>, and the parent a DEPENDENT style names.
 #'
@@ -243,7 +243,7 @@ csl_remove <- function(here, policy, file) {
 #' PATH, one inside RStudio's Quarto.
 #' @return Path to pandoc, or "".
 find_pandoc <- function() {
-  explicit <- Sys.getenv("CARMAR_PANDOC", "")
+  explicit <- Sys.getenv("BEATRINA_PANDOC", "")
   if (nzchar(explicit) && file.exists(explicit)) return(explicit)
   from_env <- Sys.getenv("RSTUDIO_PANDOC", "")
   if (nzchar(from_env)) {
@@ -334,14 +334,14 @@ cite_document <- function(yaml, groups) {
   paras <- vapply(groups, function(g) {
     cite <- if (g$narrative) paste0("@", g$keys[[1L]])
             else paste0("[", paste0("@", g$keys, collapse = "; "), "]")
-    paste0("[", cite, "]{.carmar-cite-group}")
+    paste0("[", cite, "]{.beatrina-cite-group}")
   }, character(1))
   paste0("---\n", yaml, "\n---\n\n", paste(paras, collapse = "\n\n"), "\n")
 }
 
 #' Split pandoc's HTML into the group labels and the bibliography.
 #'
-#' Positional: the i-th `carmar-cite-group` span is the i-th group. The
+#' Positional: the i-th `beatrina-cite-group` span is the i-th group. The
 #' bibliography is pandoc's `<div id="refs">`, whole. Anything else pandoc
 #' printed is dropped.
 cite_split <- function(html, n_groups) {
@@ -349,10 +349,10 @@ cite_split <- function(html, n_groups) {
   # A group span holds no nested span of its own class, so a non-greedy
   # match to the first closing </span> after the citation's inner spans is
   # wrong; count nesting instead by walking span tags.
-  starts <- gregexpr('<span class="carmar-cite-group">', html, fixed = TRUE)[[1L]]
+  starts <- gregexpr('<span class="beatrina-cite-group">', html, fixed = TRUE)[[1L]]
   if (starts[[1L]] != -1L) {
     for (i in seq_len(min(length(starts), n_groups))) {
-      from <- starts[[i]] + nchar('<span class="carmar-cite-group">')
+      from <- starts[[i]] + nchar('<span class="beatrina-cite-group">')
       rest <- substring(html, from)
       depth <- 1L
       pos <- 0L
@@ -383,8 +383,8 @@ cite_split <- function(html, n_groups) {
 #'
 #' @return list(ok, labels, bibliography, engine) or list(ok = FALSE, error).
 cite_run <- function(bin, valid, timeout_ms = CITE_TIMEOUT_MS) {
-  if (!nzchar(bin)) return(list(ok = FALSE, error = "pandoc is not installed, or CarmaR could not find it."))
-  input <- tempfile("carmar-cite-", fileext = ".md")
+  if (!nzchar(bin)) return(list(ok = FALSE, error = "pandoc is not installed, or Beatrina could not find it."))
+  input <- tempfile("beatrina-cite-", fileext = ".md")
   on.exit(unlink(input), add = TRUE)
   writeLines(cite_document(valid$yaml, valid$groups), input, useBytes = TRUE)
   Sys.chmod(input, "0600")

package/failsafe/journal.R

@@ -41,24 +41,24 @@
 #
 # What is NOT promised, in words: R has no fsync. `close()` hands the bytes to
 # the operating system; a power cut before the OS writes them loses the tail,
-# and the next open says so. The store is safe against the CarmaR process
+# and the next open says so. The store is safe against the Beatrina process
 # dying, not against the machine dying.
 
 journal_root <- function() {
-  root <- Sys.getenv("CARMAR_HISTORY_DIR", "")
+  root <- Sys.getenv("BEATRINA_HISTORY_DIR", "")
   if (!nzchar(root)) {
-    state <- Sys.getenv("CARMAR_STATE", "")
-    if (!nzchar(state)) state <- tools::R_user_dir("carmar", "data")
+    state <- Sys.getenv("BEATRINA_STATE", "")
+    if (!nzchar(state)) state <- tools::R_user_dir("beatrina", "data")
     root <- file.path(state, "history")
   }
   root
 }
-JOURNAL_ENABLED <- !identical(Sys.getenv("CARMAR_NO_JOURNAL", ""), "1")
+JOURNAL_ENABLED <- !identical(Sys.getenv("BEATRINA_NO_JOURNAL", ""), "1")
 # Per-document byte budget for the journal file. Above it, records at or
 # below the newest checkpoint are compacted away (the checkpoint holds the
 # state and both Undo stacks; pins hold their own content), never the tail.
 journal_budget <- function() {
-  v <- suppressWarnings(as.numeric(Sys.getenv("CARMAR_HISTORY_BUDGET", "")))
+  v <- suppressWarnings(as.numeric(Sys.getenv("BEATRINA_HISTORY_BUDGET", "")))
   if (!length(v) || is.na(v) || v < 65536) 64 * 1024 * 1024 else v
 }
 JOURNAL_KEY_RE <- "^[a-z]+:[A-Za-z0-9._~-]{1,200}$"
@@ -151,7 +151,7 @@ journal_write_private <- function(path, text) {
 
 #' Atomic replace within the same directory: write a sibling, rename over.
 journal_replace <- function(path, text) {
-  temp <- tempfile(pattern = ".carmar-journal-", tmpdir = dirname(path))
+  temp <- tempfile(pattern = ".beatrina-journal-", tmpdir = dirname(path))
   journal_write_private(temp, text)
   if (!isTRUE(suppressWarnings(file.rename(temp, path)))) {
     unlink(temp)
@@ -208,7 +208,7 @@ journal_cache <- new.env(parent = emptyenv())
 # exists to prevent. `journal_frame()` splices them into the reply by hand.
 
 journal_open <- function(id, key = NULL, meta = NULL, takeover = FALSE) {
-  if (!JOURNAL_ENABLED) return(journal_error("journal_open", id, "unavailable", "The document journal is disabled (CARMAR_NO_JOURNAL=1)."))
+  if (!JOURNAL_ENABLED) return(journal_error("journal_open", id, "unavailable", "The document journal is disabled (BEATRINA_NO_JOURNAL=1)."))
   if (!journal_valid_key(key)) return(journal_error("journal_open", id, "invalid_key", "A journal needs a durable document key."))
   st <- tryCatch(journal_state(key), error = function(e) e)
   if (inherits(st, "error")) return(journal_error("journal_open", id, "io", conditionMessage(st)))
@@ -239,7 +239,7 @@ journal_open <- function(id, key = NULL, meta = NULL, takeover = FALSE) {
 #' takes no lease and CREATES NOTHING — a probe of an unknown key must not
 #' leave an empty history directory behind, so it never calls `journal_state`.
 journal_probe <- function(id, key = NULL) {
-  if (!JOURNAL_ENABLED) return(journal_error("journal_probe", id, "unavailable", "The document journal is disabled (CARMAR_NO_JOURNAL=1)."))
+  if (!JOURNAL_ENABLED) return(journal_error("journal_probe", id, "unavailable", "The document journal is disabled (BEATRINA_NO_JOURNAL=1)."))
   if (!journal_valid_key(key)) return(journal_error("journal_probe", id, "invalid_key", "A journal needs a durable document key."))
   dir <- journal_dir(key)
   if (!dir.exists(dir)) return(list(type = "journal_probe", id = id, key = key, exists = FALSE, path = NULL, pathExists = FALSE))
@@ -276,7 +276,7 @@ journal_lease <- function(dir, key, takeover = FALSE) {
     isTRUE(tryCatch(tools::pskill(as.integer(prior$pid), 0L), error = function(e) FALSE))
   if (alive && !isTRUE(takeover)) return(list(held = list(pid = as.integer(prior$pid), port = prior$port, epoch = prior$epoch), epoch = NULL))
   epoch <- if (is.list(prior) && is.numeric(prior$epoch)) as.integer(prior$epoch) + 1L else 1L
-  me <- list(pid = me_pid, port = as.integer(Sys.getenv("CARMAR_PORT", "0")), epoch = epoch, at = as.numeric(Sys.time()) * 1000)
+  me <- list(pid = me_pid, port = as.integer(Sys.getenv("BEATRINA_PORT", "0")), epoch = epoch, at = as.numeric(Sys.time()) * 1000)
   ok <- tryCatch({ journal_replace(path, as.character(jsonlite::toJSON(me, auto_unbox = TRUE, digits = NA))); TRUE }, error = function(e) FALSE)
   if (!ok) return(list(held = NULL, epoch = NULL, error = "The writer lease could not be written."))
   list(held = NULL, epoch = epoch, takenOver = alive)
@@ -649,7 +649,7 @@ journal_export <- function(id, key = NULL) {
   scan <- journal_scan(st$path)
   cp_path <- file.path(st$dir, "checkpoint.json")
   envelope <- if (file.exists(cp_path)) { raw <- readBin(cp_path, "raw", n = file.info(cp_path)$size); s <- rawToChar(raw); Encoding(s) <- "UTF-8"; s } else NULL
-  head <- list(format = "carmar-history-export", schema = 1L, key = key, exported = as.numeric(Sys.time()) * 1000,
+  head <- list(format = "beatrina-history-export", schema = 1L, key = key, exported = as.numeric(Sys.time()) * 1000,
                checkpointRevision = if (is.na(st$checkpoint)) NULL else st$checkpoint, meta = journal_read_meta(st$dir))
   text <- as.character(jsonlite::toJSON(head, auto_unbox = TRUE, null = "null", digits = NA))
   text <- paste0(substr(text, 1L, nchar(text) - 1L),