crewly 1.13.0 → 1.14.0

package/config/constants.ts

@@ -873,6 +873,14 @@ export const AGENT_SUSPEND_CONSTANTS = {
 	ALWAYS_ON_ROLES: ['orchestrator', 'auditor'] as const,
 	/** Idle timeout in ms before a worker agent is stopped (default 30 min) */
 	AGENT_IDLE_STOP_TIMEOUT_MS: 1_800_000,
+	/**
+	 * Do not idle-stop an agent whose next cron run is due within this many
+	 * minutes. Killing it only to respawn it for the cron costs a cold start
+	 * (init prompt + registration + recall, ~0.5-1M input tokens on Codex)
+	 * every single run — a 15-minute cron under a 10-minute idle timeout
+	 * paid that 50 times a day on steamfun-ops (2026-09-16).
+	 */
+	CRON_KEEPALIVE_WINDOW_MINUTES: 30,
 } as const;
 
 // ========================= SERVER PROCESS CONSTANTS =========================

package/config/roles/orchestrator/prompt.md

@@ -618,6 +618,29 @@ After queueing, continue the turn normally. A separate `wiki-process-queue` run
 
 The trigger debounces — replying does not cause re-fire. Ignoring it means the next fire arrives 4h later and the counter shows zero queue-adds, which Steve will notice during audits.
 
+## Context Hygiene — keep tool output small (2026-09-16) — MANDATORY
+
+Every byte a command prints stays in your context for the rest of the
+session and is re-sent to the model on every subsequent call. On a
+long-running box the cost of the session is dominated by this, not by
+the work itself. Rules:
+
+1. **Never dump raw output.** No bare `cat` of a file, no raw `curl`/API
+   JSON, no `rg` across a tree. Pipe through `jq '<selector>'`,
+   `head -n 40`, `grep`, or `wc -l` and ask for exactly the field you need.
+2. **`get-team-status` is compact by default.** Only pass `--full` when a
+   specific field is missing from the compact view.
+3. **Bridge-auto wiki WIs: one pass, then stop.** If `wiki-migrate --apply`
+   reports `applied: 0`, there is nothing left to migrate right now — say so
+   in `complete-task` and move on. Do not re-run scan + apply in the same
+   turn, and do not re-check "just in case"; the bridge backs off on its
+   own when nothing changed.
+4. **One reminder covers all queued WorkItems.** A `[CREWLY-DISPATCH]` that
+   lists several WIs means: process all of them in this turn. Do not wait
+   for a separate message per item.
+5. **Reflect / bookkeep messages list every vault at once.** Handle the
+   whole list in one sweep and reply once.
+
 ## Turn-end "idle-drain" checklist (2026-05-26) — MANDATORY
 
 Before yielding the turn, run this 5-step check. **Task work always wins** — only drain wiki when you're genuinely idle, never block a chat reply or active WI on wiki maintenance.

package/config/skills/_common/complete-body-shape.test.sh

@@ -47,6 +47,34 @@ assert_eq_json() {
   fi
 }
 
+# The exact key set `completeItem` destructures from req.body:
+#   const { agentId, tokenUsage, result } = req.body
+# (`workItemId` arrives as a PATH param, not in the body.)
+#
+# Added 2026-08-21 after `skipGates` shipped as a dead field: the skill parsed
+# it, put it on the wire, and nothing read it — POST /task-pool/complete runs no
+# quality gates at all. The per-field assertions below could not catch that,
+# because you cannot write an assertion for a field you do not know exists.
+# A key-SUBSET assertion catches the whole class instead of one field at a time.
+# Ported from the sibling task-pool-body-shape.test.sh, where the same shape
+# found three unknown instances on its first run.
+COMPLETE_ALLOWED_KEYS='["agentId","tokenUsage","result"]'
+
+# Assert a captured /task-pool/complete body carries only keys the endpoint reads.
+assert_complete_contract() {
+  local label="$1" body="$2"
+  local extra
+  extra=$(printf '%s' "$body" | jq -c --argjson allowed "$COMPLETE_ALLOWED_KEYS" '[keys[] | select(. as $k | $allowed | index($k) == null)]')
+  if [ "$extra" = "[]" ]; then
+    PASS=$((PASS + 1)); echo "  ✓ ${label}: every top-level key is read by completeItem"
+  else
+    FAIL=$((FAIL + 1))
+    echo "  ✗ ${label}: keys silently discarded by completeItem: ${extra}"
+    echo "    completeItem destructures only {agentId, tokenUsage, result}."
+    echo "    A key outside that set is accepted, dropped, and believed to have worked."
+  fi
+}
+
 assert_jq() {
   local test_name="$1" jq_filter="$2" body="$3"
   local result
@@ -104,6 +132,11 @@ class Handler(http.server.BaseHTTPRequestHandler):
             self.send_response(200)
             self.send_header("Content-Type","application/json")
             self.end_headers()
+            # MULTI_RUNNING makes the pool report TWO running WorkItems, so the
+            # resolution in report-status becomes ambiguous and must refuse.
+            if os.path.exists(LOG + ".multi"):
+                self.wfile.write(b"{\"workItems\":[{\"id\":\"wi-stub-1\"},{\"id\":\"wi-stub-2\"}]}")
+                return
             # Top-level workItems shape — matches the jq fallback chain
             # in the skills (`.workItems[0].id // .data[0].id // empty`).
             self.wfile.write(b"{\"workItems\":[{\"id\":\"wi-stub-1\"}]}")
@@ -155,6 +188,7 @@ if [ -z "$COMPLETE_LINE" ]; then
   echo "  ✗ no /task-pool/complete POST captured"
 else
   COMPLETE_BODY=$(printf '%s' "$COMPLETE_LINE" | jq -r '.body')
+  assert_complete_contract "report-status" "$COMPLETE_BODY"
   assert_jq "agentId is the session name" '.agentId == "quinn-test"' "$COMPLETE_BODY"
   assert_jq "result.summary is non-empty" '.result.summary | length > 0' "$COMPLETE_BODY"
   assert_jq "result.summary matches input" '.result.summary == "Report-status smoke summary"' "$COMPLETE_BODY"
@@ -181,6 +215,7 @@ if [ -z "$COMPLETE_LINE" ]; then
   echo "  ✗ no /task-pool/complete POST captured"
 else
   COMPLETE_BODY=$(printf '%s' "$COMPLETE_LINE" | jq -r '.body')
+  assert_complete_contract "complete-task" "$COMPLETE_BODY"
   assert_jq "agentId is the session name" '.agentId == "quinn-ct"' "$COMPLETE_BODY"
   assert_jq "result.summary matches" '.result.summary == "Complete-task smoke summary"' "$COMPLETE_BODY"
   assert_jq "result.prNumber merged into result (was top-level result before)" '.result.prNumber == 42' "$COMPLETE_BODY"
@@ -205,6 +240,7 @@ if [ -z "$COMPLETE_LINE" ]; then
   echo "  ✗ no /task-pool/complete POST captured"
 else
   COMPLETE_BODY=$(printf '%s' "$COMPLETE_LINE" | jq -r '.body')
+  assert_complete_contract "orc-complete-task" "$COMPLETE_BODY"
   assert_jq "agentId defaults to crewly-orc" '.agentId == "crewly-orc"' "$COMPLETE_BODY"
   assert_jq "result.summary matches" '.result.summary == "Orc complete-task smoke summary"' "$COMPLETE_BODY"
   assert_jq "no top-level summary leak" '.summary == null' "$COMPLETE_BODY"
@@ -223,6 +259,7 @@ if [ -z "$COMPLETE_LINE" ]; then
   echo "  ✗ no /task-pool/complete POST captured"
 else
   COMPLETE_BODY=$(printf '%s' "$COMPLETE_LINE" | jq -r '.body')
+  assert_complete_contract "scenario-4" "$COMPLETE_BODY"
   assert_jq "agentId overridden to caller value" '.agentId == "crewly-product-leo-21a5477e"' "$COMPLETE_BODY"
 fi
 
@@ -244,6 +281,82 @@ else
   echo "  ✗ should reject empty summary; exit=$EXIT, output=$OUTPUT"
 fi
 
+# ---------------------------------------------------------------------------
+# Scenario 5 — complete-task REJECTS skipGates loudly
+#
+# skipGates was accepted and silently discarded: the skill put it on the wire
+# and completeItem never read it, so a caller believed gates were skipped when
+# POST /task-pool/complete runs no gates at all. The disposition chosen was
+# reject-loudly rather than honour (incoherent — nothing to skip) or drop
+# silently (leaves the false belief intact). This locks that in.
+# ---------------------------------------------------------------------------
+echo ""
+echo "--- Scenario 5: complete-task rejects skipGates ---"
+: > "$LOG"
+SKIPGATES_OUT=$(bash "${REPO_ROOT}/config/skills/agent/core/complete-task/execute.sh" \
+  '{"workItemId":"wi-stub-1","sessionName":"quinn-sg","summary":"s","skipGates":true}' 2>&1 || true)
+SKIPGATES_RC=$?
+
+if printf '%s' "$SKIPGATES_OUT" | grep -q "skipGates is not supported"; then
+  PASS=$((PASS + 1)); echo "  ✓ errors with an explanation naming the field"
+else
+  FAIL=$((FAIL + 1)); echo "  ✗ expected a skipGates rejection, got: ${SKIPGATES_OUT}"
+fi
+
+if printf '%s' "$SKIPGATES_OUT" | grep -q "check-quality-gates"; then
+  PASS=$((PASS + 1)); echo "  ✓ points the caller at where gates actually live"
+else
+  FAIL=$((FAIL + 1)); echo "  ✗ rejection does not say where to run gates instead"
+fi
+
+if grep -qF '"path": "/api/task-pool/complete/' "$LOG"; then
+  FAIL=$((FAIL + 1)); echo "  ✗ completed the WorkItem anyway — rejection must happen BEFORE the POST"
+else
+  PASS=$((PASS + 1)); echo "  ✓ no complete POST emitted — fails before mutating state"
+fi
+
+# ---------------------------------------------------------------------------
+# Scenario 6 — report-status WorkItem resolution (instance 11)
+#
+# report-status completed `.data[0].id` — an arbitrary first running WI. On
+# 2026-08-21 that silently closed WorkItem 7db3b00c, work nobody had started,
+# while the agent was reporting a DIFFERENT item done. Nothing failed, and the
+# false completion spawned a verify WI for a delivery that never happened.
+# ---------------------------------------------------------------------------
+echo ""
+echo "--- Scenario 6: report-status resolution ---"
+
+# 6a — an explicit workItemId must win over anything the pool reports.
+: > "$LOG"
+bash "${REPO_ROOT}/config/skills/agent/core/report-status/execute.sh" \
+  --session quinn-res --status done --summary "Explicit workItemId resolution scenario" \
+  --project /tmp/proj-foo --work-item-id wi-explicit-9 >/dev/null 2>&1 || true
+if grep -qF '"path": "/api/task-pool/complete/wi-explicit-9"' "$LOG"; then
+  PASS=$((PASS + 1)); echo "  ✓ explicit workItemId is the one completed"
+else
+  ACTUAL=$(grep -oE '/api/task-pool/complete/[^"]*' "$LOG" | head -1)
+  FAIL=$((FAIL + 1)); echo "  ✗ expected wi-explicit-9 to be completed, got: ${ACTUAL:-none}"
+fi
+
+# 6b — the stub returns TWO running WIs, so inference is ambiguous. It must
+# REFUSE and complete nothing, naming the candidates.
+: > "$LOG"
+touch "${LOG}.multi"
+MULTI_OUT=$(bash "${REPO_ROOT}/config/skills/agent/core/report-status/execute.sh" \
+  --session quinn-res --status done --summary "Ambiguous resolution refusal scenario" \
+  --project /tmp/proj-foo 2>&1 || true)
+rm -f "${LOG}.multi"
+if grep -qF '"path": "/api/task-pool/complete/' "$LOG"; then
+  FAIL=$((FAIL + 1)); echo "  ✗ completed a WorkItem despite ambiguous resolution — this is the 7db3b00c bug"
+else
+  PASS=$((PASS + 1)); echo "  ✓ completes nothing when more than one WI is running"
+fi
+if printf '%s' "$MULTI_OUT" | grep -q "refuses to guess"; then
+  PASS=$((PASS + 1)); echo "  ✓ refusal explains why and tells the caller to pass workItemId"
+else
+  FAIL=$((FAIL + 1)); echo "  ✗ expected a refusal naming the ambiguity, got: ${MULTI_OUT}"
+fi
+
 echo ""
 echo "=== Results: ${PASS} passed, ${FAIL} failed ==="
 [ $FAIL -eq 0 ]

package/config/skills/_common/no-dangling-symlinks.test.sh

@@ -0,0 +1,63 @@
+#!/bin/bash
+# =============================================================================
+# Class guard: no dangling symlinks anywhere under config/skills/
+#
+# A dangling symlink is worse than a missing file. `ls` shows the entry, the
+# path matches the naming pattern of its neighbours, and nothing fails until
+# someone runs it — at which point the error ("No such file or directory")
+# points at the LINK TARGET, not at the fact that the link itself is wrong.
+#
+# The instance that motivated this: config/skills/agent/core/delegate-task/
+# execute.sh was a symlink to ../../../../team-leader/delegate-task/execute.sh
+# — one `../` too many. Four levels up from that directory is `config/`, not
+# `config/skills/`, so it targeted config/team-leader/... which does not exist.
+# It sat broken long enough to produce a recorded onboarding gotcha (a TL agent
+# taking that path and self-correcting) and, later, a wrong conclusion in a PR
+# review (that fixing the team-leader file fixed both call paths — it did not,
+# because this path was broken outright).
+#
+# It surfaced only because an unrelated scanner CRASHED on it while walking the
+# tree. Nothing was watching for it. This test watches for it.
+#
+# Test runner:
+#   bash config/skills/_common/no-dangling-symlinks.test.sh
+#   echo $?    # 0 on pass, 1 on fail
+# =============================================================================
+set -eo pipefail
+
+SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+REPO_ROOT="$(cd "${SCRIPT_DIR}/../../.." && pwd)"
+SKILLS_DIR="${REPO_ROOT}/config/skills"
+
+echo "=== no dangling symlinks under config/skills/ ==="
+
+if [ ! -d "$SKILLS_DIR" ]; then
+  echo "  ✗ skills directory not found: ${SKILLS_DIR}"
+  exit 1
+fi
+
+# `-type l` finds symlinks; `! -exec test -e {} \;` keeps only those whose
+# target does not resolve. Both BSD (macOS) and GNU find support this form.
+DANGLING=$(find "$SKILLS_DIR" -type l ! -exec test -e {} \; -print 2>/dev/null || true)
+
+if [ -n "$DANGLING" ]; then
+  COUNT=$(printf '%s\n' "$DANGLING" | grep -c . || true)
+  echo "  ✗ ${COUNT} dangling symlink(s) found:"
+  while IFS= read -r link; do
+    [ -z "$link" ] && continue
+    REL="${link#${REPO_ROOT}/}"
+    echo "      ${REL}"
+    echo "        -> $(readlink "$link") (does not resolve)"
+  done <<< "$DANGLING"
+  echo ""
+  echo "    A dangling symlink LOOKS like a real path and fails only on use."
+  echo "    Either point it at a file that exists, or remove it so the path"
+  echo "    fails honestly. Do not leave it in the middle state."
+  exit 1
+fi
+
+TOTAL_LINKS=$(find "$SKILLS_DIR" -type l 2>/dev/null | grep -c . || true)
+echo "  ✓ no dangling symlinks (${TOTAL_LINKS} symlink(s) checked)"
+echo ""
+echo "=== Results: 1 passed, 0 failed ==="
+exit 0