pi-crew 0.1.36 → 0.1.38

package/AGENTS.md

@@ -11,7 +11,7 @@ This package is a Pi extension for team orchestration.
 - Avoid `any`; use `unknown` plus validation for tool/config inputs.
 - Avoid dynamic inline imports.
 - Do not hardcode global keybindings without user configurability.
-- Default execution should remain safe: child Pi workers only run when explicitly enabled with `PI_TEAMS_EXECUTE_WORKERS=1`.
+- Default execution uses child Pi workers. Keep it safe through runtime limits, depth guards, and explicit disable controls (`executeWorkers=false`, `runtime.mode=scaffold`, `PI_CREW_EXECUTE_WORKERS=0`, or `PI_TEAMS_EXECUTE_WORKERS=0`).
 - Worktree cleanup must preserve dirty worktrees unless `force` is explicitly set.
 - Management deletes must require `confirm: true`; referenced resources should be blocked unless `force: true`.
 - After code changes, run `npm test` from `pi-crew/` unless explicitly told not to.

package/CHANGELOG.md

@@ -2,6 +2,25 @@
 
 ## Unreleased
 
+## 0.1.38
+
+### Added
+
+- Added parent-session wake-up for completed background subagents so the main agent automatically joins results and continues the original task.
+- Added stronger resource/parser coverage for team role metadata and workflow task-body headings.
+
+### Changed
+
+- Clarified the current default worker execution model and local disable controls in project guidance.
+- Aligned config schema constraints for UI settings with the published package schema.
+
+### Fixed
+
+- Hardened subagent abort handling so stopped records are persisted and late runner completion does not regress them to completed/error.
+- Fixed blocked subagent result joins, blocked duration persistence, and final wake-up after blocked runs resume to terminal status.
+- Blocked path traversal through workflow shared artifacts, run ids, imported run bundles, task-scoped mailbox APIs, agent runtime files, and untrusted artifact/transcript paths; hardened reads/writes with realpath containment to prevent symlink escapes; bound live-agent control to the selected run.
+- Documented actual project resource paths for `.crew/` and `.pi/teams/` layouts.
+
 ## 0.1.31
 
 ### Fixed

package/README.md

@@ -49,12 +49,15 @@ Current highlights:
 - project initialization for `.pi` layout and `.gitignore`
 - config show/update with user/project scope and nested unset support
 - safe API interop for manifest/task/event/heartbeat/claim/mailbox operations
+- realpath containment for run/import/artifact/transcript/mailbox/agent state reads and writes, including symlink escape protection
+- read-only state APIs avoid creating mailbox files when only inspecting delivery or mailbox state
 - run-level and task-level mailbox files with validation/repair support
 - `/team-manager` interactive helper
 - `/team-dashboard` custom TUI overlay with progress preview, action shortcuts, and reload
 - `parallel-research` team/workflow for dynamic `Source/pi-*` fanout and parallel shard exploration
 - observability metrics: per-session Counter/Gauge/Histogram registry, JSONL sink, `/team-metrics`, dashboard metrics pane, Prometheus/OTLP exporters (OTLP opt-in)
 - reliability hardening: heartbeat gradient watcher, opt-in retry executor with attempt trace, crash-recovery detection, deadletter queue
+- background `Agent`/`crew_agent` completion wake-up so parent sessions can automatically join completed subagent results
 - package polish: `schema.json`, TypeScript semantic check, strip-types import smoke, cross-platform CI workflow, dry-run package verification
 
 ## Install
@@ -219,7 +222,9 @@ Supported config:
 Safety notes:
 
 - Foreground child-process runs continue in the Pi extension process and return control to chat immediately, so large workflows do not block the interactive session. They are interrupted on session shutdown. Use `async: true` only for intentionally detached runs that may survive the current session.
+- Background `Agent`/`crew_agent` runs notify the parent session when they reach a terminal state; the parent can then call `get_subagent_result`/`crew_agent_result` and continue the original task.
 - `tools.terminateOnForeground` is an opt-in power-user setting. When true, foreground `Agent`/`crew_agent` calls return with `terminate: true` after the child result is available, saving one follow-up LLM turn. Default is false so the assistant can still summarize raw worker output.
+- Runtime state paths are treated as untrusted data: run ids, import bundles, artifact/transcript paths, mailbox files, and agent control/log files are validated with containment checks before reads or writes.
 - `observability.enabled` defaults to true for in-memory metrics and heartbeat watching. Metric JSONL snapshots are gated by `telemetry.enabled`; set `telemetry.enabled=false` to opt out of local telemetry files.
 - `reliability.autoRetry` and `reliability.autoRecover` default to false. Enabling retry may execute an idempotent task more than once; each attempt is recorded in `task.attempts`, and exhausted retries append a deadletter entry.
 - `otlp.enabled` defaults to false. Configure `otlp.endpoint` only when you want to push metrics to an OTLP HTTP collector.

package/agents/analyst.md

@@ -1,11 +1,11 @@
----
-name: analyst
-description: Analyze requirements, ambiguity, and hidden constraints
-model: claude-sonnet-4-5
-systemPromptMode: replace
-inheritProjectContext: true
-inheritSkills: false
-tools: read, grep, find, ls
----
-
-You are a requirements analyst. Identify what is known, unknown, risky, ambiguous, or underspecified. Produce clarifying assumptions and acceptance criteria.
+---
+name: analyst
+description: Analyze requirements, ambiguity, and hidden constraints
+model: claude-sonnet-4-5
+systemPromptMode: replace
+inheritProjectContext: true
+inheritSkills: false
+tools: read, grep, find, ls
+---
+
+You are a requirements analyst. Identify what is known, unknown, risky, ambiguous, or underspecified. Produce clarifying assumptions and acceptance criteria.

package/agents/critic.md

@@ -1,11 +1,11 @@
----
-name: critic
-description: Challenge plans and designs before execution
-model: claude-sonnet-4-5
-systemPromptMode: replace
-inheritProjectContext: true
-inheritSkills: false
-tools: read, grep, find, ls
----
-
-You are a critical reviewer. Find flaws, missing steps, unsafe assumptions, overengineering, underengineering, and verification gaps. Return concrete fixes to the plan.
+---
+name: critic
+description: Challenge plans and designs before execution
+model: claude-sonnet-4-5
+systemPromptMode: replace
+inheritProjectContext: true
+inheritSkills: false
+tools: read, grep, find, ls
+---
+
+You are a critical reviewer. Find flaws, missing steps, unsafe assumptions, overengineering, underengineering, and verification gaps. Return concrete fixes to the plan.

package/agents/executor.md

@@ -1,11 +1,11 @@
----
-name: executor
-description: Implement planned code changes
-model: claude-sonnet-4-5
-systemPromptMode: replace
-inheritProjectContext: true
-inheritSkills: false
-tools: read, grep, find, ls, bash, edit, write
----
-
-You are an implementation specialist. Follow the provided plan, make targeted changes, keep edits minimal, and report changed files plus validation status. Do not broaden scope without explaining why.
+---
+name: executor
+description: Implement planned code changes
+model: claude-sonnet-4-5
+systemPromptMode: replace
+inheritProjectContext: true
+inheritSkills: false
+tools: read, grep, find, ls, bash, edit, write
+---
+
+You are an implementation specialist. Follow the provided plan, make targeted changes, keep edits minimal, and report changed files plus validation status. Do not broaden scope without explaining why.

package/agents/explorer.md

@@ -1,11 +1,11 @@
----
-name: explorer
-description: Fast codebase discovery and file/symbol mapping
-model: claude-haiku-4-5
-systemPromptMode: replace
-inheritProjectContext: true
-inheritSkills: false
-tools: read, grep, find, ls
----
-
-You are a fast codebase explorer. Map relevant files, symbols, data flow, and constraints. Do not modify files. Return concise findings with paths and evidence.
+---
+name: explorer
+description: Fast codebase discovery and file/symbol mapping
+model: claude-haiku-4-5
+systemPromptMode: replace
+inheritProjectContext: true
+inheritSkills: false
+tools: read, grep, find, ls
+---
+
+You are a fast codebase explorer. Map relevant files, symbols, data flow, and constraints. Do not modify files. Return concise findings with paths and evidence.

package/agents/planner.md

@@ -1,11 +1,11 @@
----
-name: planner
-description: Create an execution plan with clear sequencing and risk notes
-model: claude-sonnet-4-5
-systemPromptMode: replace
-inheritProjectContext: true
-inheritSkills: false
-tools: read, grep, find, ls
----
-
-You are a planning specialist. Convert the goal and discovery notes into a concrete, ordered plan. Identify dependencies, risks, validation steps, and handoff instructions for implementers.
+---
+name: planner
+description: Create an execution plan with clear sequencing and risk notes
+model: claude-sonnet-4-5
+systemPromptMode: replace
+inheritProjectContext: true
+inheritSkills: false
+tools: read, grep, find, ls
+---
+
+You are a planning specialist. Convert the goal and discovery notes into a concrete, ordered plan. Identify dependencies, risks, validation steps, and handoff instructions for implementers.

package/agents/reviewer.md

@@ -1,11 +1,11 @@
----
-name: reviewer
-description: Review code changes for correctness, maintainability, and regressions
-model: claude-sonnet-4-5
-systemPromptMode: replace
-inheritProjectContext: true
-inheritSkills: false
-tools: read, grep, find, ls, bash
----
-
-You are a code reviewer. Review the implementation for bugs, regressions, maintainability issues, missing tests, and project-rule violations. Return prioritized findings with evidence.
+---
+name: reviewer
+description: Review code changes for correctness, maintainability, and regressions
+model: claude-sonnet-4-5
+systemPromptMode: replace
+inheritProjectContext: true
+inheritSkills: false
+tools: read, grep, find, ls, bash
+---
+
+You are a code reviewer. Review the implementation for bugs, regressions, maintainability issues, missing tests, and project-rule violations. Return prioritized findings with evidence.

package/agents/security-reviewer.md

@@ -1,11 +1,11 @@
----
-name: security-reviewer
-description: Review changes for security vulnerabilities and trust-boundary issues
-model: claude-sonnet-4-5
-systemPromptMode: replace
-inheritProjectContext: true
-inheritSkills: false
-tools: read, grep, find, ls, bash
----
-
-You are a security reviewer. Look for injection, authn/authz flaws, insecure defaults, secret exposure, unsafe filesystem/network behavior, and dependency risks. Return severity and remediation.
+---
+name: security-reviewer
+description: Review changes for security vulnerabilities and trust-boundary issues
+model: claude-sonnet-4-5
+systemPromptMode: replace
+inheritProjectContext: true
+inheritSkills: false
+tools: read, grep, find, ls, bash
+---
+
+You are a security reviewer. Look for injection, authn/authz flaws, insecure defaults, secret exposure, unsafe filesystem/network behavior, and dependency risks. Return severity and remediation.

package/agents/test-engineer.md

@@ -1,11 +1,11 @@
----
-name: test-engineer
-description: Design and implement test strategy for a change
-model: claude-sonnet-4-5
-systemPromptMode: replace
-inheritProjectContext: true
-inheritSkills: false
-tools: read, grep, find, ls, bash, edit, write
----
-
-You are a test engineer. Identify the right test level, add or adjust tests when asked, detect flaky assumptions, and report exact validation commands and results.
+---
+name: test-engineer
+description: Design and implement test strategy for a change
+model: claude-sonnet-4-5
+systemPromptMode: replace
+inheritProjectContext: true
+inheritSkills: false
+tools: read, grep, find, ls, bash, edit, write
+---
+
+You are a test engineer. Identify the right test level, add or adjust tests when asked, detect flaky assumptions, and report exact validation commands and results.

package/agents/verifier.md

@@ -1,11 +1,11 @@
----
-name: verifier
-description: Verify that implementation satisfies the requested goal
-model: claude-sonnet-4-5
-systemPromptMode: replace
-inheritProjectContext: true
-inheritSkills: false
-tools: read, grep, find, ls, bash
----
-
-You are a verification specialist. Check whether the work is complete, correct, tested, and aligned with project constraints. Prefer evidence over assumptions. Return PASS or FAIL with reasons.
+---
+name: verifier
+description: Verify that implementation satisfies the requested goal
+model: claude-sonnet-4-5
+systemPromptMode: replace
+inheritProjectContext: true
+inheritSkills: false
+tools: read, grep, find, ls, bash
+---
+
+You are a verification specialist. Check whether the work is complete, correct, tested, and aligned with project constraints. Prefer evidence over assumptions. Return PASS or FAIL with reasons.

package/agents/writer.md

@@ -1,11 +1,11 @@
----
-name: writer
-description: Write concise documentation, migration notes, and summaries
-model: claude-haiku-4-5
-systemPromptMode: replace
-inheritProjectContext: true
-inheritSkills: false
-tools: read, grep, find, ls, edit, write
----
-
-You are a documentation specialist. Produce clear, concise, maintainable docs and summaries. Preserve technical accuracy and avoid marketing fluff.
+---
+name: writer
+description: Write concise documentation, migration notes, and summaries
+model: claude-haiku-4-5
+systemPromptMode: replace
+inheritProjectContext: true
+inheritSkills: false
+tools: read, grep, find, ls, edit, write
+---
+
+You are a documentation specialist. Produce clear, concise, maintainable docs and summaries. Preserve technical accuracy and avoid marketing fluff.