@prjct.app/pi-team 0.6.0 → 0.7.0

package/CHANGELOG.md

@@ -1,3 +1,74 @@
+## [0.7.0](https://github.com/prjct-app/pi-team/compare/v0.6.1...v0.7.0) (2026-09-22)
+
+### Features
+
+* /team completions with descriptions and the prjct mark ([afa687d](https://github.com/prjct-app/pi-team/commit/afa687d2edeba4776f6e200850b6114738914b88))
+* /team is a docked panel of Runs and Experts with traceable assignments ([6f5b025](https://github.com/prjct-app/pi-team/commit/6f5b025a3ad49c8188322e3a98b1d8fca3f0c4df))
+* add durable managed team state ([3380be1](https://github.com/prjct-app/pi-team/commit/3380be1cc4b106041a32c24ff1cfc119b7bc5d3d))
+* add live team plan panel ([58635e2](https://github.com/prjct-app/pi-team/commit/58635e2db7f12fcee407932561c4a29e8d43b79d))
+* add persistent dynamic team orchestration ([0a11bfc](https://github.com/prjct-app/pi-team/commit/0a11bfc25b2a3ca910dcfa01cfedf12dc9819ab5)), closes [#49](https://github.com/prjct-app/pi-team/issues/49)
+* add persistent dynamic team orchestration ([57c8d03](https://github.com/prjct-app/pi-team/commit/57c8d0350b53bad0e963debbf79e5b39c28c1c4e))
+* add Team v2 messaging runtime ([d0df88f](https://github.com/prjct-app/pi-team/commit/d0df88fbbfa57ffe4a7ad7373bd18d6591db7c54))
+* add Team v2 storage core ([b75d230](https://github.com/prjct-app/pi-team/commit/b75d2306efc5670fd51668658bb536d3a19b4e41))
+* add Team v2 supervised peer lifecycle ([3415872](https://github.com/prjct-app/pi-team/commit/3415872ab6a6bb6076736f1d2981f174a90551eb))
+* Experts message each other directly (team_peers, team_message) ([298188f](https://github.com/prjct-app/pi-team/commit/298188f1037ff492955040088d262af165468638))
+* integrate Team v2 extension ([81c64da](https://github.com/prjct-app/pi-team/commit/81c64da3c3b28ddb4c7e34bd811dda6d502a4922))
+* isolate managed agents in worktrees ([35a68a3](https://github.com/prjct-app/pi-team/commit/35a68a3751e962ad260c07b54d70a21b45289b1b))
+* keep an unattended teammate reachable after the auto-turn cap ([e354af4](https://github.com/prjct-app/pi-team/commit/e354af44dafc49171129ccf76f6213b10d35536e))
+* launch autonomous teams from prompts ([6b72638](https://github.com/prjct-app/pi-team/commit/6b7263815dc6a0c4cca5b785211b1b5eb23a5b07))
+* link team requests to optional subagents ([c51722f](https://github.com/prjct-app/pi-team/commit/c51722feac67405705ca3ddd69564bf6825a2bbc))
+* run managed peers in persistent terminals ([4376b08](https://github.com/prjct-app/pi-team/commit/4376b08c331707263deb49af119c909ae85a75de))
+* run persistent managed peer sessions ([6b2e249](https://github.com/prjct-app/pi-team/commit/6b2e249f82499d1a988e11c07a9d3fc54c1ee393))
+* schedule managed work from dependencies ([18c5817](https://github.com/prjct-app/pi-team/commit/18c5817c890a08c212856fcf36ef4d87769b6cdb))
+* send each Expert the project memory for its stance ([36caefc](https://github.com/prjct-app/pi-team/commit/36caefc442b7dcbfe5a00c26bbe97fb69f13b561))
+
+### Bug Fixes
+
+* a real parallel team — one Expert per role, own worktree each, orchestrator only coordinates ([140091d](https://github.com/prjct-app/pi-team/commit/140091d331ec75195a225f874847df601aa64dac))
+* accept objectives through team command ([8f05337](https://github.com/prjct-app/pi-team/commit/8f05337c26a7f6cef7c4cafe7de2581c3c89d2ad))
+* Experts launch again: short control socket, tmux 3.6 targets, lease token shape ([22c185b](https://github.com/prjct-app/pi-team/commit/22c185b49c91e0bedeb347795fca94df22477e1e))
+* expose the authorized integration target ([f1bf132](https://github.com/prjct-app/pi-team/commit/f1bf13268985f92ff9866b9003a253908620deb0))
+* harden managed runtime shutdown ([316cf72](https://github.com/prjct-app/pi-team/commit/316cf7218c7e6f27f11be4ef825a8447921cd97b))
+* harden managed team records ([652e8d3](https://github.com/prjct-app/pi-team/commit/652e8d3cc4aef61280c8bbbadb6c1a16b3b65ae7))
+* isolate managed peer extensions ([b69e02c](https://github.com/prjct-app/pi-team/commit/b69e02cf64b3c7ff41d039f95d36dc448a8a4a2a))
+* keep worktree locks for the duration of git and refuse secret commits ([0d8c427](https://github.com/prjct-app/pi-team/commit/0d8c42783cc231b7464c79ec11c2373e8db74c05))
+* only create and check the short socket fallback directory ([990f2a6](https://github.com/prjct-app/pi-team/commit/990f2a67650b5bc12542fd90ac0650675cbb8750))
+* preserve lead checkout during managed work ([54e3159](https://github.com/prjct-app/pi-team/commit/54e3159368e36880305481c6fedf18edf9218c76))
+* reject conflicting managed objectives ([5102c8b](https://github.com/prjct-app/pi-team/commit/5102c8b40bdc33f40eba4b18fad6d690b29b87b0))
+* reject presence symlinks, redact more credentials, and bound the read cache ([c55bd27](https://github.com/prjct-app/pi-team/commit/c55bd27565441a86f711a4b8046cd7bbadeefa86))
+* sanitize git and verification subprocess environments ([b4819bf](https://github.com/prjct-app/pi-team/commit/b4819bf37b5615e249cb2ca8b60557dd21dd913c))
+
+## Unreleased
+
+- Add `npm run build:pi`: a compiled local build in `~/.pi/agent/builds/<package>` that Pi loads instead of the TypeScript sources; supervised workers launch the built entry.
+
+### Breaking changes
+
+- replace manual create/join membership with explicit `/team <objective>` orchestration
+- remove legacy inspection, migration, and v1 mailbox code from the package
+- store persistent project Teams under `${PRJCT_HOME:-~/.prjct}/pi-team/orchestration-v2/`
+
+### Features
+
+- persist bounded Run history and reusable Expert identities, sessions, memory, and assignment history
+- dynamically create missing Experts and reuse existing roles across later Runs
+- queue busy Experts and later objectives while allowing bounded parallel work across distinct Experts
+- add the active-Run-only `team_orchestrate` tool and bounded status, history, doctor, and cancellation commands
+- execute Experts through authenticated supervised workers with durable correlated replies and resource leases
+
+### Security
+
+- keep normal prompts inert until an explicit Team objective
+- fence owners and late results by process identity, epoch, generation, request, and receipt
+- inherit the launching Pi environment explicitly when tmux already has a server
+- validate worker request bodies and durable assignment/sender identity before model execution
+- stop only proven-owned workers; interruption preserves history without automatic replay
+## [0.6.1](https://github.com/prjct-app/pi-team/compare/v0.6.0...v0.6.1) (2026-09-11)
+
+### Bug Fixes
+
+* preserve mailbox locks across rolling upgrades ([3509903](https://github.com/prjct-app/pi-team/commit/3509903026205a0a3d00fcd52eecb3b970ba4d7b))
+
 ## [0.6.0](https://github.com/prjct-app/pi-team/compare/v0.5.7...v0.6.0) (2026-09-10)
 
 ### Features

package/CONTRIBUTING.md

@@ -6,10 +6,11 @@
 - Deliver changes through a pull request using `.github/pull_request_template.md`.
 - Use English for code, documentation, tests, issues, and pull requests.
 - Use strict TypeScript and only APIs documented by Pi 0.85.1.
-- Use immutable values: `npm run check` fails on any `let` under `src/`. See [AGENTS.md](AGENTS.md).
+- Use immutable values: `npm run check` fails on any `let` under `src/`.
 - Do not import host internals, monkey-patch prototypes, or access real credentials, sessions, or user configuration in tests.
 - Keep runtime dependencies in `dependencies`; list Pi-provided packages in `peerDependencies` with a `*` range.
 - Run `npm run check`, `npm test`, and `npm pack --dry-run` before review.
+- Build the compiled local copy Pi loads with `npm run build:pi`. It writes `~/.pi/agent/builds/<package>` outside the repository, because compiled code inside it would load the repository's development copy of Pi instead of the host's.
 - Never push, open or merge a pull request, publish, or deploy without explicit authorization.
 
 ## Package documentation

package/README.md

@@ -1,191 +1,49 @@
 # pi-team
 
-[![pi-team — extension for PI Agent](https://raw.githubusercontent.com/prjct-app/pi-clipboard/main/docs/covers/pi-team.png)](https://pi.dev)
-
-Coordinate independent PI Agent sessions with local team messaging, queued tasks,
-and shared results.
-
-You open the terminals; `pi-team` lets those sessions send each other work, wake a
-free teammate, and return a result the requester can verify. Everything stays on
-this machine, in local files.
-
-[![Watch the pi-team demo](media/pi-team-demo/poster.png)](https://github.com/prjct-app/pi-team/raw/refs/heads/main/media/pi-team-demo/pi-team-demo.mp4)
+Explicit project Teams with durable Runs, reusable Experts, and supervised local execution. Normal prompts are not intercepted.
 
 ## Install
 
-Requires Pi installed separately and Node.js **22.19 or later**. Tested against
-Pi **0.85.1**; newer versions are not yet verified. Independent community package.
+Requires Pi **0.85.1**, Node.js **22.19+**, authenticated model access, and `tmux` for Expert execution.
 
 ```sh
 pi install npm:@prjct.app/pi-team
 ```
 
-Add `-l` for project-only installation, and restart Pi afterwards. Manage it with
-the usual `pi list` / `pi update` / `pi remove` and `pi config`. Do not install the
-same extension from both GitHub and npm: Pi treats those as different packages.
-
-## Quickstart
-
-Open two interactive Pi terminals. In the first:
+Restart Pi, then explicitly start an objective:
 
 ```text
-/team create demo
-/team join demo coordinator
+/team Ship login validation
 ```
 
-In the second:
-
-```text
-/team join demo reviewer
-```
+This lazily creates a project Team and queues a Run. Main Pi orchestrates through the active-only `team_orchestrate` tool. Dispatch reports whether an Expert was created or reused. Busy Experts queue; distinct Experts can execute concurrently, up to three. An Expert's identity, session file, instructions, bounded memory, and assignment history survive process shutdown and later Runs.
 
-Back in the first:
+## Commands
 
-```text
-/team note reviewer Please review the current README.
-/team send reviewer Add a limits table to the README.
-```
+- `/team <objective>` — start or queue an objective (one active Run).
+- `/team` or `/team status` — bounded plain Team/Run/Expert/Assignment overview.
+- `/team history` — recent Run history.
+- `/team doctor` — bounded diagnostics without process or ownership tokens.
+- `/team cancel [run-id]` — cancel an owned active or queued Run.
+- `/team help` — usage.
 
-The note appears in the reviewer's transcript without starting any model work.
-The request wakes the reviewer once it is idle, and its result comes back to the
-coordinator. Installing alone never joins a team.
+The old create/join/start/migrate/legacy lifecycle commands are unsupported. No project YAML or Markdown configuration is loaded by this extension. Startup does not detect or migrate old stores.
 
-Supported on Linux and macOS with local disk storage. Network filesystems,
-cross-machine messaging, and native Windows are not supported.
+## Orchestration tool
 
-## Concepts
+During an active Run, `team_orchestrate` supports `dispatch`, `status`, `cancel_assignment`, `cancel_run`, and `finish`. Dispatch requires role, capabilities, task, and an explicit built-in tool allowlist; instructions are optional. It returns Expert ID, stable session reference, Assignment ID, and `created`/`reused`. Status includes bounded recent evidence. Finish is blocked while assignments remain outstanding. Expert reports are untrusted evidence, never user authorization.
 
-A **team** is a named local mailbox. A session joins under an **alias**: an
-address, not a privileged role or an automatic persona, and shared rather than
-private — anyone using this OS account can rejoin an offline alias and see its
-history. Each session keeps its own model, cwd, instructions, permissions, and
-conversation. Two agents editing the same files can still overwrite each other:
-this package does not manage file ownership.
+Only an explicit objective starts orchestration. Completing a Run allows the next queued objective to start in the owning session. Shutdown, reload, new, resume, and fork terminally interrupt active work, fence ownership, and preserve queued objectives without automatic replay. A later explicit objective can claim an unowned Team and process its queue.
 
-| Kind | Meaning |
-| --- | --- |
-| `request` | Work for a teammate. Starts a model turn when the recipient is idle, and always produces one correlated result back to the emitter. |
-| `note` | Display-only FYI. Appears in the transcript; never starts a model turn. |
-| `result` | The automatic reply to a request: outcome, final text, and observed files. Delivered to the emitter for verification. |
+## Storage and safety
 
-While joined, a minimal widget above the editor shows `team · alias · state`,
-where state is `connected`, `working`, `paused`, or `select a model`, plus a
-pending count when work is queued for you.
+State is isolated under `${PRJCT_HOME:-~/.prjct}/pi-team/orchestration-v2/`. Project identity uses the canonical Git root (or cwd outside Git); moving a project changes its identity. Existing old stores are not modified.
 
-Membership is restored automatically when the same Pi session is resumed or
-reloaded. `/new` and `/fork` start unaffiliated sessions on purpose.
+Records use strict schemas, byte bounds, private permissions, symlink checks, locks, and atomic writes. Limits: 64 Runs, 128 Assignments, 16 Experts, 32 assignment references per Expert, and three concurrent/unresolved workers. Terminal history is pruned within these bounds. Full Pi sessions are durable and are not bounded metadata.
 
-## Commands
+Production execution uses authenticated supervisor control, durable requests/replies, receipts, and leases. A dispatch or process launch is not success: completion requires a correlated reply and a proven worker stop. Unprovable shutdown blocks the Expert rather than guessing ownership. Use doctor and manually verify process identity before recovery; no automatic adoption or retry is provided.
 
-| Command | Meaning |
-| --- | --- |
-| `/team create shop` | Create explicitly; does not join automatically |
-| `/team delete shop` | Permanently delete an inactive team after confirmation |
-| `/team rename-team shop store` | Rename a team after every member is offline |
-| `/team join shop backend` | Register this session and enable automatic reception |
-| `/team list` | List teams; refresh team-name completion |
-| `/team members` | Show other aliases, cwd, and idle/busy/paused/offline status; excludes this session |
-| `/team remove backend` | Remove an offline alias and interrupt its unresolved work after confirmation |
-| `/team rename-member backend api` | Rename your own alias, or an offline teammate, while preserving its history and queued work |
-| `/team status` | Show every unresolved requester → assignee relationship |
-| `/team wake [message]` | Queue an actionable check-in for every other teammate |
-| `/team send backend Implement login` | Queue a request that can start work |
-| `/team note frontend API contract changed` | Display an FYI; never starts a model turn |
-| `/team inbox` | Show the most recent 20 records and their states |
-| `/team pause` | Pause new work, without cancelling current work |
-| `/team resume` | Resume reception and reset the automatic turn budget |
-| `/team leave` | Leave; if processing a request, report its result first |
-
-Names and aliases are 1–48 lowercase letters, digits, or hyphens, starting with a
-letter. Unknown teams are rejected, never implicitly created; duplicate live
-aliases are rejected. Sending to an offline **known** alias queues until someone
-rejoins it. Removing that alias instead settles every unresolved request involving
-it; incoming requests produce an interrupted result so their requesters stop waiting.
-Renaming an alias rewrites its message addresses so queued work follows the new
-name. Team deletion and rename require every member to be offline, and destructive
-operations require confirmation. Tab completion covers subcommands, discovered
-teams, and teammates.
-
-## Agent tools
-
-- `team_members` — discover other teammates and their status; excludes this session.
-- `team_send` — send `{ to, kind: "request" | "note", subject, body }`.
-- `team_status` — outstanding work: what you emitted and is unresolved, what is
-  queued for you, results awaiting your review, and third-party team activity.
-
-Tools cannot create teams, join, resume reception, change permissions, or launch
-terminals; they require membership you established. Discovery results and recipient
-autocomplete exclude the current session, and sending to yourself is rejected at
-the mailbox boundary. A request returns **queued**, never "task completed".
-
-## How delivery works
-
-A request or result starts a turn only when the recipient is idle, has a selected
-model, no pending user message or open prompt, and an empty editor. No running
-tool is interrupted.
-
-For each processed request the extension sends **one** result after the agent
-settles: the last assistant text capped at 3,000 characters (no thinking), up to
-50 absolute paths observed in successful `edit`/`write` calls, and an outcome of
-completed, failed, or interrupted.
-
-That file list is **not** a Git diff. Files changed through bash, custom tools, or
-other processes are not enumerated, and the extension never infers test success
-from a shell command or a model claim. **A completed run is not proof of success**:
-review the reported outcome and the recipient worktree.
-
-Once a task result is persisted, the session can accept the next queued request.
-While a request you emitted stays unresolved past five minutes, a review turn
-asks your agent to chase the teammate or tell you what is blocked. See
-[Architecture](docs/architecture.md) for implementation details.
-
-## Safety
-
-- **This is not a sandbox or an authorization system.** Agents and processes under
-  the same OS user already have filesystem access. Prompt-level rules are not a
-  hard guarantee against a model that ignores them. Do not place untrusted agents
-  in a team or rely on team boundaries to protect secrets from that OS user.
-- Peer messages are identified as untrusted data and **are not user consent**.
-  Agents are instructed not to relay denied work, change configuration, or evade
-  plan mode. Peer text is never executed as a slash command or expanded as a file
-  mention.
-- Messages stay in local files, but when processed their text goes to the
-  recipient's configured **model provider** like any prompt, and results go to the
-  requester. Do not send credentials or unrelated secrets.
-- User takeover during a peer task pauses reception and reports an interrupted
-  result instead of forwarding your unrelated work.
-
-## Limits
-
-| Limit | Value |
-| --- | --- |
-| Automatic peer turns before reception pauses | 5, then `/team resume` |
-| Messages in one automatically linked conversation | 8 non-result |
-| Unsettled deliveries per member | 50 slots, one reserved per outstanding request |
-| Records per team | 500, including reserved result capacity |
-| Members per team | 100 |
-| Outgoing body / serialized message | 16 KB / 20 KB |
-| Automatic result | 32 KB, file list shortened with a notice |
-| Presence lease | 30 s, renewed every 2 s |
-| Review threshold / cadence | 5 min unresolved, checked every 1 min |
-| Duplicate suppression | identical message within 1 min is refused |
-
-No daily token or monetary budget is enforced. History is never silently deleted:
-create a fresh team when one is full. Review cadence and the turn budget are fixed
-defaults, not user-configurable yet.
-
-## Troubleshooting
-
-| Symptom | Cause and action |
-| --- | --- |
-| A request stays queued | Run `/team status`. The recipient may be busy, paused, offline, missing a model, or typing. After five minutes, review turns chase it or surface the blockage. |
-| `Team auto-turn limit reached` | Five automatic turns ran without user input. Review the transcript, then `/team resume`. |
-| `Membership expired or replaced` | Another live session took your alias. Rejoin, choosing a new alias if the old one is in use. |
-| `Recipient inbox full` / `Sender inbox full` | Fifty unsettled deliveries per member, one slot reserved per outstanding request. Let the teammate drain; notes need no reservation. |
-| `Team history full (500 records)` | At capacity; history is never deleted. Create a fresh team and rejoin. |
-| Repeated storage warnings | Conflicts retry automatically and never pause reception. If one persists, check that the teams directory is on a local disk and report it. |
-| A teammate went offline mid-task | Its claimed work is interrupted and the emitter receives that result; it is not replayed. Review the worktree, then resend explicitly. |
-| Work remains queued for an alias that will not return | Use `/team remove <alias>` to interrupt and settle its unresolved work, or `/team rename-member <alias> <new-alias>` to preserve the queue under a replacement alias. |
+This is not an OS sandbox: tools, especially Bash, run with the current user's permissions. Do not send secrets. Metadata redaction is best-effort, not a secret detector. Model requests use the worker's configured authenticated provider. A live model/tmux/PTY roundtrip remains a manual verification requirement; deterministic tests cover the adapter boundary with fake supervision and real durable transport.
 
 ## Development
 
@@ -193,19 +51,7 @@ defaults, not user-configurable yet.
 npm ci --ignore-scripts
 npm run check
 npm test
-npm run check:package
+npm pack --dry-run
 ```
 
-Pi loads the TypeScript entry point directly; there is no build step. Use `pi -e .`
-to try a checkout. Tests use isolated temporary state and never call model APIs.
-
-`npm run check` also enforces that `src/` contains no `let`: session state is a
-single immutable record updated functionally, and reads go through its accessor at
-the point of use rather than being captured across an `await`.
-
-## More
-
-- [Architecture](docs/architecture.md) — storage, concurrency, recovery, context budget
-- [Package structure](docs/package.md) · [Releases](docs/releases.md) · [Contributing](CONTRIBUTING.md) · [Changelog](CHANGELOG.md)
-
-[MIT](LICENSE).
+[Architecture](docs/architecture.md) · [Package structure](docs/package.md) · [Contributing](CONTRIBUTING.md) · [MIT](LICENSE)

package/docs/architecture.md

@@ -1,170 +1,38 @@
 # Architecture
 
-How pi-team stores state, coordinates concurrent sessions, and recovers from
-failure. For everyday use see the [README](../README.md).
-
-## Storage model
-
-Each team is one JSON record at `~/.pi/agent/teams/<team>/state.json`, honouring
-`PI_CODING_AGENT_DIR`. The record holds the member roster and the full message
-history. Team folders are `0700` and files `0600`; an unsafe, symlinked, or
-foreign-owned directory or record fails closed rather than being repaired.
-
-Records are wrapped in an envelope carrying a schema marker, a monotonically
-increasing revision, and a SHA-256 of the payload. A corrupt record is preserved
-for manual recovery, never erased. Mailboxes written before envelopes existed
-are read as revision 0 and rewritten as envelope records on their first write.
-
-## Concurrency
-
-Readers never take a lock. Every publication writes a private temporary file,
-hard-links it into a bounded `revisions/` history, and atomically renames it into
-place, so a concurrent read sees either the whole previous record or the whole
-next one. The history doubles as recovery evidence for an interrupted write.
-
-Writers compare-and-swap on the revision under a short-lived per-team lock in
-`~/.pi/agent/teams/.locks/`. Keeping the lock outside the team directory lets
-rename and deletion fence stale publishers without allowing them to recreate a
-moved directory. A conflict fails fast and the caller retries against a fresh
-read, so many agents write concurrently instead of queueing behind a team-wide
-lock. A lock abandoned by a crashed writer is reclaimed after ten seconds.
-
-Because every publication renames a **new inode** into place, readers can safely
-cache a parsed record keyed on `(inode, size, mtime)`: a write by any process
-changes the inode. Cached reads serve the polling loop; mutations always read
-uncached, so they never operate on the shared cached object.
-
-## Presence
-
-Presence lives outside the shared record. Each member rewrites only its own
-`presence/<alias>.json` every two seconds, so heartbeats add no write contention
-and never touch `state.json`.
-
-These files are deliberately non-durable: the atomic rename is kept, both fsyncs
-are not. Presence expires after 30 seconds and is rewritten every 2, so a write
-lost to a crash only makes a member look offline sooner — never alive longer.
-A member is also considered gone as soon as its recorded process has exited. A
-heartbeat never creates a missing parent directory, so one already in flight
-cannot resurrect a team after rename or deletion.
-
-## Request lifecycle
-
-A request is queued, claimed when the recipient is idle, worked on, and settled
-with a result delivered back to the emitter. Once settlement is durable, the
-recipient can accept another team turn; the emitter verifies the result against
-its original request and replies in-thread only if something is missing.
-
-States are `pending`, `processing`, `completed`, `interrupted`, and `seen`
-(notes already displayed).
-
-## Sweeping orphaned claims
-
-A session that dies holding a claim would otherwise leave its requester waiting
-forever, so peers interrupt the claim on its behalf and the requester receives an
-`interrupted` result.
-
-Leaving marks a member offline but retains its address and history so the same
-alias can rejoin. Therefore "someone is offline" is not enough to decide when to
-sweep. A snapshot instead reports `sweepable`, true only when a member the record
-still counts as connected is actually dead **and** still holds a claim, which is
-the only case where sweeping changes anything. Everything else degrades correctly
-without it: rejoining re-admits a stale alias on its own, and displayed status
-comes from presence rather than the record.
-
-## Team and member lifecycle
-
-Lifecycle changes are user-only commands; agents receive no tool that can delete
-or rename identities. Removing a member is allowed only while it is offline. The
-operation removes the roster entry, cancels unresolved work emitted by that alias,
-and turns requests addressed to it into interrupted results for their requesters.
-Renaming rewrites every message endpoint so pending work and history follow the new
-alias. A live session may rename itself; only offline peers can be renamed by
-another member. Ownership tokens fence the old alias after either operation.
-
-Team rename and deletion require every recorded member to be offline. They acquire
-stable locks for both names in lexical order, preventing deadlock and fencing
-concurrent joins or publishers. Rename moves the directory first and then writes a
-new revision with the new team name. If the process stops between those steps,
-repeating the same rename recognizes and completes that partial state. Deletion
-first moves the directory to a hidden tombstone and then recursively removes it,
-so readers never observe a partially deleted public team directory.
-
-## Context budget
-
-What an extension puts in the model context is paid on every later turn and
-stays in the session branch, so injected values are bounded and any elision is
-stated rather than silent.
-
-| Carrier | In LLM context | Used for |
-| --- | --- | --- |
-| `before_agent_start` system prompt | yes, every turn | peer rules and team identity, carried exactly once |
-| `sendMessage` content | yes, and it persists | peer messages and review turns |
-| Tool results | yes, and they persist | `team_members`, `team_send`, `team_status` |
-| `appendEntry` | **no**, TUI only | notes, `/team inbox`, sent-message previews |
-
-Consequences worth knowing:
-
-- Peer rules are **not** repeated inside each message; they arrive once per turn
-  through the system prompt.
-- A delivered result quotes the original request excerpted to 500 characters,
-  with the id kept. Verification of a very long request works from an extract.
-- `team_status` lists are capped and report an `omitted` count. Its
-  `otherTeamWork` list carries only third-party work; anything addressed to or
-  emitted by this session is already in the other lists.
-- Each `team_status` call is a point-in-time snapshot. Earlier results in the
-  same conversation are stale but cannot be retracted, which is why each one is
-  kept small.
-- Teammate discovery, status rosters, `/team members`, and recipient completion
-  omit the current alias. The mailbox independently rejects self-addressed
-  messages, so a stale UI or direct tool call cannot create a self-reply loop.
-
-## Recovery and guarantees
-
-Ownership tokens fence out replaced, renamed, or removed sessions. Pending
-messages survive disconnection and alias/team rename. Claimed work is marked
-interrupted on disconnect or rejoin and is **not automatically replayed**, since
-edits may already have happened.
-
-This favours avoiding duplicate side effects over guaranteed execution. **There is
-no exactly-once guarantee** for filesystem changes or model actions: a crash after
-claiming but before starting also leaves an interrupted task. If storage cannot
-record a result, reception pauses and reports an error.
-
-Membership and pause state are recorded in Pi session entries. Resuming the same
-session rejoins; `/new` and `/fork` do not inherit membership. Before claiming
-work the extension records that restoration must pause, without pausing the live
-session, so an abrupt process death during a task restores paused and requires
-`/team resume`. A crash just before a claim can conservatively require resume too.
-Legacy pending-compaction fields from earlier releases are ignored on restore.
-
-Directory watchers provide prompt delivery; polling every two seconds recovers
-missed notifications. Both run only for joined interactive sessions and close on
-shutdown. Transient storage errors are reported but never pause reception.
-
-## Design decisions and non-goals
-
-| Concern | Choice |
-| --- | --- |
-| Session creation | The user opens every terminal; nothing is spawned |
-| Discovery | Explicit named teams and aliases, never inferred from directories |
-| Transport | Local filesystem records; no broker, socket server, or daemon |
-| Presence | Per-member files outside the record; heartbeats never lock |
-| Concurrent writes | Compare-and-swap with retry; no team-wide lock |
-| Follow-up | Periodic review turns delegated to the agent, not programmatic retries |
-| Active recipient | Wait until fully idle; no steering between tools |
-| Offline recipient | Persist to a known alias until it rejoins |
-| Approval | Never supplied by peers; local policies always win |
-| Coordination | Direct messages and bulk check-ins; no task board, automatic compaction, or worktree manager |
-| Scope | Local disks only: no network filesystems, cross-machine transport, or native Windows |
-
-Not provided: file ownership between agents, a sandbox, an authorization system,
-or protection of secrets from other processes under the same OS user.
-
-## Pi interfaces used
-
-`registerCommand`, `registerTool`, `sendMessage`, `appendEntry`, custom entry and
-message renderers, `setWidget`, `getEditorText`, `confirm`, `isIdle`,
-`hasPendingMessages`, session lifecycle events, UI prompt events, `tool_result`,
-`message_end`, and `agent_settled`. All public and documented; no host internals
-are imported, no prototypes patched, and peer text is never shell-evaluated or
-expanded as file mentions.
+## Active integration
+
+`src/index.ts` registers only `/team`. Fresh session startup creates no records, timers, tool, or prompt changes. An explicit objective lazily binds the canonical project, persists a Run, claims a fenced owner, and calls `sendUserMessage` once when that Run becomes active. Normal input is not intercepted. `team_orchestrate` is lazily registered and active only during owned Runs; its prompt suffix is absent outside Runs. Deactivation removes only that tool, preserving unrelated active tools.
+
+`src/dynamic/domain.ts`, `store.ts`, and `service.ts` define strict bounded Team, Run, Expert, and Assignment records. A locked atomic project record enforces one active Run, one active assignment per Expert, unique roles, and a maximum of three busy/blocked Experts. Suitable Experts are reused, busy Experts queue, and capability/tool-policy escalation is rejected. Generation plus owner epoch fences results. Terminal cancellation never becomes success after a late reply.
+
+## Storage
+
+The new namespace is `${PRJCT_HOME:-~/.prjct}/pi-team/orchestration-v2/`:
+
+```text
+projects/<project-id>/state.json
+projects/<project-id>/sessions/<stable-session-ref>.jsonl
+transport/teams/<project-id>/...
+transport/control/...
+```
+
+Project IDs hash canonical Git root or cwd. A project move deliberately produces a different identity. Metadata bounds are 64 Runs, 128 Assignments, 16 Experts, and 32 assignment references per Expert; old terminal records may be pruned. Private directories, strict schemas, byte bounds, storage locks, and atomic publication reuse the existing storage primitives. Pi session files retain conversation history separately from bounded Expert memory.
+
+## Production execution
+
+`runner.ts` adapts the existing `TeamSupervisor`, `TeamRuntime`, membership leases, durable request/reply spool, and receipts. Transport records live in the isolated namespace; no old Team bytes are reused. The adapter creates a private stable Pi session header once and launches Pi with `--session` referencing the same file across assignments and Runs. It disables ambient extension/skill/template/context-file discovery and passes an explicit tool allowlist.
+
+`worker.ts` is selected only for supervised worker environments. It authenticates using the existing private control socket bootstrap, validates durable Expert identity/session and active assignment generation/owner epoch, loads role instructions and bounded memory, and enforces the allowlist at `tool_call`. Its only extension tool is `team_reply`. Requests are durably claimed/read before `sendUserMessage`; replies are explicitly correlated. Membership and delivery leases renew during work. Neither launch nor a model turn is treated as successful execution. The adapter requires a valid reply receipt and a proven stop before reporting completion.
+
+The existing supervisor revalidates owner identity, PID start identity, process group, and marked tmux metadata before bounded graceful/TERM/KILL escalation. Tokens are never projected into Team UI/history. Unproven stops block capacity and require manual investigation. Worker startup failures and deadlines produce failure, not fabricated results.
+
+## Interruption
+
+Reload, new, resume, fork, and shutdown cancel active assignments and terminally cancel the active Run with an interruption reason. They stop only owned workers, release/fence the owner, retain Team/Experts/sessions/history/queued Runs, and never automatically restore execution. A new explicit objective may claim an unowned/dead-owned Team. Dead-owner recovery interrupts abandoned active work and blocks unresolved Experts rather than adopting or replaying them.
+
+## Views and compatibility
+
+`view.ts` projects bounded plain status/history/doctor summaries without owner/process/control/lease tokens. Free text is control-sanitized and best-effort secret-redacted. No color is required. The previous interactive dashboard remains inactive library code. Legacy inspection/migration and v1 mailbox sources are removed; old command forms are rejected and old stores are untouched.
+
+Only documented Pi 0.85.1 extension APIs and CLI flags are used. Deterministic tests cover scheduling, storage, lifecycle, supervisor safety, and the production adapter with fake supervision plus real durable transport. Live authenticated model/tmux/PTY behavior remains manually unchecked. There is no OS sandbox, exactly-once side-effect guarantee, automatic recovery/adoption, Git/worktree automation, deployment, cross-machine transport, or network-filesystem support.

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@prjct.app/pi-team",
-  "version": "0.6.0",
-  "description": "Coordinate independent PI Agent sessions with local team messaging, queued tasks, and shared results.",
+  "version": "0.7.0",
+  "description": "Coordinate explicit local Pi teams with durable messaging and safely supervised peers.",
   "type": "module",
   "keywords": [
     "pi-package",
@@ -24,10 +24,12 @@
     "image": "https://raw.githubusercontent.com/prjct-app/pi-clipboard/main/docs/covers/pi-team.png"
   },
   "scripts": {
+    "build": "rm -rf build && mkdir -p build && npm pack --ignore-scripts --pack-destination build >/dev/null && tar -xzf build/*.tgz -C build --strip-components=1 && rm -f build/*.tgz",
     "check": "tsc --noEmit && npm run check:immutable",
     "check:immutable": "! grep -rn '\\blet\\b' src/ || (echo 'Use immutable values: no let bindings in src/' && exit 1)",
     "test": "node --import tsx --test tests/*.test.ts tests/*.test.mjs",
-    "check:package": "npm pack --dry-run --ignore-scripts"
+    "check:package": "npm pack --dry-run --ignore-scripts",
+    "build:pi": "node scripts/build-pi.mjs"
   },
   "engines": {
     "node": ">=22.19.0"
@@ -43,6 +45,7 @@
     "@earendil-works/pi-coding-agent": "0.85.1",
     "@earendil-works/pi-tui": "0.85.1",
     "@types/node": "^22.19.0",
+    "esbuild": "^0.28.1",
     "tsx": "^4.20.0",
     "typebox": "1.3.7",
     "typescript": "^5.9.3"
@@ -68,5 +71,8 @@
     "CONTRIBUTING.md",
     "LICENSE",
     "CHANGELOG.md"
-  ]
+  ],
+  "dependencies": {
+    "@prjct.app/pi-tui-kit": "file:../pi-tui-kit"
+  }
 }

package/src/commands/team-command.ts

@@ -0,0 +1,37 @@
+import type { AutocompleteItem } from '@earendil-works/pi-tui';
+import { bounded } from '../dynamic/domain.ts';
+import { completer } from '@prjct.app/pi-tui-kit';
+
+export const TEAM_HELP = '/team <objective> | status | history | doctor | cancel [run-id] | help';
+export type TeamCommand =
+  | { readonly action: 'objective'; readonly objective: string }
+  | { readonly action: 'status' | 'history' | 'doctor' | 'help' }
+  | { readonly action: 'cancel'; readonly runId?: string };
+const removed = new Set(['create', 'join', 'migrate', 'legacy', 'start', 'stop', 'kill', 'leave', 'close', 'purge', 'receive', 'inbox']);
+export function parseTeamCommand(input: string): TeamCommand {
+  const text = input.trim();
+  bounded(text, 8192, 'Objective');
+  if (!text) return { action: 'status' };
+  const [first, ...args] = text.split(/\s+/);
+  const action = first!.toLowerCase();
+  // Old lifecycle commands were short ("create shop lead"). A sentence that
+  // merely starts with one of those words ("Create three files…") is an objective.
+  if (removed.has(action) && args.length <= 2) throw new Error(`Unsupported Team command. ${TEAM_HELP}`);
+  if (['status', 'history', 'doctor', 'help'].includes(action)) {
+    if (args.length) throw new Error(TEAM_HELP);
+    return { action: action as 'status' | 'history' | 'doctor' | 'help' };
+  }
+  if (action === 'cancel') {
+    if (args.length > 1 || (args[0] && !/^[a-zA-Z0-9-]{1,128}$/.test(args[0]))) throw new Error(TEAM_HELP);
+    return { action, ...(args[0] ? { runId: args[0] } : {}) };
+  }
+  return { action: 'objective', objective: text };
+}
+/** Subcommands with the prjct mark. Anything else typed after /team is a new objective. */
+export const commandCompletions: (prefix: string) => AutocompleteItem[] | null = completer([
+  { value: 'status', description: 'panel of Runs and Experts' },
+  { value: 'history', description: 'the last Runs as text' },
+  { value: 'doctor', description: 'ownership and blocked experts' },
+  { value: 'cancel', description: 'cancel the active Run (owner only)' },
+  { value: 'help', description: 'what /team accepts' },
+]);