pi-crew 0.10.1 → 0.10.2

package/src/ui/widget/widget-renderer.ts

@@ -4,19 +4,30 @@
  * Extracted from crew-widget.ts.
  */
 
+import type { CrewAgentRecord } from "../../runtime/crew-agent-runtime.ts";
 import { listLiveAgents } from "../../runtime/live-session/live-agent-manager.ts";
 import { isPlanApprovalStatePending } from "../../runtime/plan-approval.ts";
 import { isFinishedRunStatus } from "../../runtime/process-status.ts";
+import type { TeamRunManifest } from "../../state/types.ts";
 import { truncate } from "../../utils/visual.ts";
 import { Box, Text } from "../layout-primitives.ts";
 import { spinnerFrame } from "../spinner.ts";
 import { colorizeStatusGlyphs, iconForStatus } from "../status-colors.ts";
 import type { CrewTheme } from "../theme-adapter.ts";
-import { agentActivity, agentStats, notificationBadge } from "./widget-formatters.ts";
+import {
+	agentActivity,
+	agentStats,
+	budgetedRow,
+	dockElapsed,
+	dockStatusIcon,
+	dockStatusLabel,
+	dockUsageText,
+	notificationBadge,
+} from "./widget-formatters.ts";
 import { activeWidgetRuns, shortRunLabel } from "./widget-model.ts";
 import type { WidgetRun } from "./widget-types.ts";
 
-const MAX_AGENTS_DISPLAY = 3;
+export const MAX_AGENTS_DISPLAY = 3;
 const FINISHED_LINGER_MAX_AGE = 1;
 /** Default terminal width when caller doesn't pass one explicitly. Keep <= 116
  * (the same default used elsewhere in pi-crew tool renderers) so we never paint
@@ -43,8 +54,192 @@ export function widgetHeader(runs: WidgetRun[], runningGlyph: string, maxLines =
 	return `${runningGlyph} Crew agents${notificationBadge(notificationCount)} · ${parts.join(" · ")} · /team-dashboard`;
 }
 
+// ── Agent ordering (shared with the inline panel) ──────────────────────
+
+/**
+ * L-4: prioritize RUNNING > QUEUED > WAITING so the most relevant live workers
+ * are always shown first. Finished rows fill only the leftover budget and never
+ * steal a slot from an active agent.
+ */
+const ACTIVE_PRIORITY: Record<string, number> = { running: 0, queued: 1, waiting: 2 };
+
+function isActiveStatus(status: string): boolean {
+	return status === "running" || status === "queued" || status === "waiting";
+}
+
+/**
+ * The agent order the widget paints, split into its two sections.
+ *
+ * Exported because the inline panel navigates the same list: if the panel
+ * derived its own order, the cursor index would drift from the rendered rows.
+ * One function, one order.
+ */
+export function orderWidgetAgents(entry: WidgetRun, now = Date.now()): { active: CrewAgentRecord[]; finished: CrewAgentRecord[] } {
+	const runDone = isFinishedRunStatus(entry.run.status);
+	const active = entry.agents.filter((agent) => isActiveStatus(agent.status));
+	const finished = entry.agents.filter((agent) => {
+		if (isActiveStatus(agent.status)) return false;
+		if (!agent.completedAt) return false;
+		// Mid-run, finished agents are the run's HISTORY: they must stay in
+		// the dock until the RUN itself is done, not age out after a minute
+		// while later phases are still working. The linger windows below only
+		// apply once the run reached a terminal status (and the run-level
+		// visibility grace then decides how much longer the dock shows at all).
+		if (!runDone) return true;
+		const maxAgeMs = (ERROR_STATUSES.has(agent.status) ? ERROR_LINGER_MAX_AGE : FINISHED_LINGER_MAX_AGE) * 60_000;
+		const age = now - new Date(agent.completedAt).getTime();
+		return Number.isFinite(age) && age < maxAgeMs;
+	});
+	return {
+		active: [...active].sort((a, b) => (ACTIVE_PRIORITY[a.status] ?? 9) - (ACTIVE_PRIORITY[b.status] ?? 9)),
+		finished,
+	};
+}
+
 // ── Line builder ──────────────────────────────────────────────────────
 
+/**
+ * Row layout for the per-agent lines.
+ *
+ * - `detailed` — the historical two-line tree (name row + `⊶ activity` row).
+ * - `compact`  — one width-budgeted line per agent, so a wide terminal shows the
+ *   full description instead of the same clip a narrow one gets.
+ */
+export type WidgetRowStyle = "compact" | "detailed";
+
+export interface WidgetRenderOptions {
+	rowStyle?: WidgetRowStyle;
+	/** Task id under the inline panel cursor, if any. */
+	selectedTaskId?: string;
+	/** Task id whose transcript pane is open, if any. */
+	viewedTaskId?: string;
+	/**
+	 * True while the inline panel holds the cursor. Every agent is then listed
+	 * (no MAX_AGENTS_DISPLAY cap) so keyboard navigation can reach all of them;
+	 * the idle widget stays capped to keep the prompt area small.
+	 */
+	focused?: boolean;
+}
+
+/** Short display form of a model id: `zai/glm-5.3` → `glm-5.3`. */
+function shortModelLabel(agent: CrewAgentRecord, run: TeamRunManifest): string | undefined {
+	const model = agent.model ?? run.modelContext?.parentModel ?? run.modelContext?.override;
+	if (typeof model !== "string" || !model) return undefined;
+	return model.split("/").at(-1) ?? model;
+}
+
+/** One flat dock row (pi-subtask style) for an agent — active or finished. */
+function compactAgentRow(
+	run: TeamRunManifest,
+	agent: CrewAgentRecord,
+	finished: boolean,
+	runs: readonly WidgetRun[],
+	options: WidgetRenderOptions,
+	width: number,
+	liveHandle: ReturnType<typeof listLiveAgents>[number] | undefined,
+): string {
+	const marker = options.selectedTaskId === agent.taskId ? "❯" : " ";
+	const dockGlyph = options.viewedTaskId === agent.taskId ? "⏺" : dockStatusIcon(agent.status);
+	const name = liveHandle?.agent ?? agent.agent;
+	const label = liveHandle?.description ?? agent.role ?? "";
+	// Task-first: the agent exists to run its task, so the row names the task
+	// right after the agent. With multiple runs, prefix each row with its run
+	// label so the flat dock still says which run an agent belongs to.
+	const runTag = runs.length > 1 ? `${shortRunLabel(run)} · ` : "";
+	const taskTag = agent.taskId ? ` · ${agent.taskId}` : "";
+	const roleTag = label && label !== agent.taskId && label !== name ? ` · ${label}` : "";
+	const nameText = runTag + name + taskTag + roleTag;
+	// pi-subtask activity: the worker's latest line while running, otherwise
+	// the status word.
+	const liveLine = liveHandle?.activity?.responseText
+		?.split("\n")
+		.find((line) => line.trim())
+		?.trim();
+	const activity =
+		!finished && liveHandle?.status === "running" && liveLine
+			? liveLine.length > 60
+				? `${liveLine.slice(0, 60)}…`
+				: liveLine
+			: finished
+				? dockStatusLabel(agent.status)
+				: agentActivity(agent, liveHandle);
+	const usage = dockUsageText(agent, liveHandle, { viewed: options.viewedTaskId === agent.taskId });
+	const ageText = dockElapsed(agent.completedAt ?? agent.startedAt);
+	const model = shortModelLabel(agent, run);
+	// Stats tail: `· glm-5.3 · ↑1.2k ↓350 · 41s` — the model the worker is
+	// actually on first, then usage, then elapsed.
+	const suffix = `${model ? ` · ${model}` : ""}${usage ? ` · ${usage}` : ""}${ageText ? ` · ${ageText}` : ""}`;
+	return budgetedRow({ lead: `${marker} ${dockGlyph} `, name: nameText, activity, suffix }, width);
+}
+
+/**
+ * The compact dock: hint line, the `main` conversation row, then a
+ * MAX_AGENTS_DISPLAY-row SCROLL WINDOW over the flat agent list (exactly the
+ * order the inline panel navigates — `panelRowsFromRuns` parity). The window
+ * follows the panel selection bottom-pinned: moving the cursor past the
+ * window scrolls one row at a time and the ❯ marker is always painted; idle
+ * (no selection) shows the top of the list, which the shared ordering puts at
+ * the highest-priority live agents. Hidden rows surface as `… ↑N earlier` /
+ * `… +N more` indicators.
+ */
+function compactDockLines(
+	runs: WidgetRun[],
+	options: WidgetRenderOptions,
+	width: number,
+	maxLines: number,
+	notificationCount: number,
+	runningGlyph: string,
+): string[] {
+	const now = Date.now();
+	const flat: Array<{
+		run: TeamRunManifest;
+		agent: CrewAgentRecord;
+		finished: boolean;
+		liveHandle: ReturnType<typeof listLiveAgents>[number] | undefined;
+	}> = [];
+	for (const entry of runs) {
+		const { active, finished } = orderWidgetAgents(entry, now);
+		const liveForRun = listLiveAgents().filter((a) => a.runId === entry.run.runId);
+		for (const agent of active) {
+			flat.push({ run: entry.run, agent, finished: false, liveHandle: liveForRun.find((h) => h.taskId === agent.taskId) });
+		}
+		for (const agent of finished) {
+			flat.push({ run: entry.run, agent, finished: true, liveHandle: liveForRun.find((h) => h.taskId === agent.taskId) });
+		}
+	}
+
+	// No agents at all: fall back to the legacy header so the space under the
+	// editor is never just blank.
+	if (flat.length === 0) return [widgetHeader(runs, runningGlyph, maxLines, notificationCount)];
+
+	const lines: string[] = [];
+	let hint: string;
+	if (options.viewedTaskId) {
+		const viewedName = flat.find((row) => row.agent.taskId === options.viewedTaskId)?.agent.agent ?? "agent";
+		hint = `viewing @${viewedName} — typing goes to the agent · ↓ switch · esc back`;
+	} else if (options.focused) {
+		hint = "enter to view · x to stop/cancel · esc back";
+	} else {
+		hint = `agents (${flat.length}) — ↓ to select`;
+	}
+	lines.push(truncate(hint, width));
+	// Filled ● = you're on the main conversation; hollow ◯ = an agent view is
+	// open (same convention as pi-subtask's main row).
+	const mainMarker = options.focused && !options.selectedTaskId ? "❯" : " ";
+	const mainIcon = options.viewedTaskId ? "◯" : "●";
+	lines.push(truncate(`${mainMarker} ${mainIcon} main`, width));
+
+	const selectedIndex = options.selectedTaskId ? flat.findIndex((row) => row.agent.taskId === options.selectedTaskId) : -1;
+	const windowStart = selectedIndex >= 0 ? Math.max(0, selectedIndex - MAX_AGENTS_DISPLAY + 1) : 0;
+	const windowEnd = Math.min(flat.length, windowStart + MAX_AGENTS_DISPLAY);
+	if (windowStart > 0) lines.push(truncate(`  … ↑${windowStart} earlier (↑ to scroll)`, width));
+	for (const row of flat.slice(windowStart, windowEnd)) {
+		lines.push(compactAgentRow(row.run, row.agent, row.finished, runs, options, width, row.liveHandle));
+	}
+	if (windowEnd < flat.length) lines.push(truncate(`  … +${flat.length - windowEnd} more (↓ to scroll)`, width));
+	return lines;
+}
+
 export function buildWidgetLines(
 	cwd: string,
 	frame = 0,
@@ -52,7 +247,10 @@ export function buildWidgetLines(
 	providedRuns?: WidgetRun[],
 	notificationCount = 0,
 	width = DEFAULT_WIDGET_WIDTH,
+	options: WidgetRenderOptions = {},
 ): string[] {
+	const rowStyle: WidgetRowStyle = options.rowStyle ?? "detailed";
+	const focused = options.focused === true;
 	// Match the legacy `buildCrewWidgetLines` API: when no runs are supplied,
 	// auto-fetch via activeWidgetRuns(cwd). Otherwise widgets calling with
 	// only `(cwd, frame)` would render an empty line set (regression vs. the
@@ -61,18 +259,20 @@ export function buildWidgetLines(
 	if (!runs.length) return [];
 
 	const runningGlyph = spinnerFrame("widget-header");
+
+	// Compact = pi-subtask's dock: NO "Crew agents" header, NO tree — hint
+	// line, `main` row, then a 3-row scroll window over the flat agent list.
+	if (rowStyle === "compact") {
+		const lines = compactDockLines(runs, options, width, maxLines, notificationCount, runningGlyph);
+		return focused ? lines : lines.slice(0, maxLines);
+	}
+
 	const lines: string[] = [widgetHeader(runs, runningGlyph, maxLines, notificationCount)];
 
-	for (const { run, agents, snapshot } of runs) {
-		const activeAgents = agents.filter((a) => a.status === "running" || a.status === "queued" || a.status === "waiting");
+	for (const entry of runs) {
+		const { run, agents } = entry;
 		const now = Date.now();
-		const finishedAgents = agents.filter((item) => {
-			if (item.status === "running" || item.status === "queued" || item.status === "waiting") return false;
-			if (!item.completedAt) return false;
-			const maxAgeMs = (ERROR_STATUSES.has(item.status) ? ERROR_LINGER_MAX_AGE : FINISHED_LINGER_MAX_AGE) * 60_000;
-			const age = now - new Date(item.completedAt).getTime();
-			return Number.isFinite(age) && age < maxAgeMs;
-		});
+		const { active: activeAgents, finished: finishedAgents } = orderWidgetAgents(entry, now);
 		const completed = agents.filter((a) => a.status === "completed").length;
 		// WP-3 (H4): while a run is parked awaiting plan approval, the spinner
 		// glyph is replaced by a `⚠ plan:<last-8 runId>` badge. Plain-unicode ⚠
@@ -90,11 +290,6 @@ export function buildWidgetLines(
 		// activity line) and is GUARANTEED stable across ticks:
 		//   - agents count — from `agents` array, always populated, never empty.
 		//   - run elapsed   — from `run.createdAt`, always set on manifest.
-		// Both come from sources with no race window — `agents` is read from
-		// snapshot.agents OR agentsFor(run) (both always return same length
-		// for a healthy run), and `run.createdAt` is immutable. The format
-		// shape `"X/Y agents · Ns"` is therefore truly invariant: same number
-		// of `·`-separated fields, same field meanings, every render tick.
 		//
 		// Bug 022 (timer-fix + label): for TERMINAL runs (failed/cancelled/
 		// completed) the elapsed counter previously kept ticking up forever
@@ -112,56 +307,58 @@ export function buildWidgetLines(
 
 		const liveForRun = listLiveAgents().filter((a) => a.runId === run.runId);
 
-		// L-4: prioritize RUNNING > QUEUED > WAITING within the visible window so the
-		// most relevant live workers are always shown. Finished rows fill only the
-		// leftover budget and never steal slots from running agents.
-		const ACTIVE_PRIORITY: Record<string, number> = {
-			running: 0,
-			queued: 1,
-			waiting: 2,
-		};
-		const prioritizedActive = [...activeAgents].sort((a, b) => (ACTIVE_PRIORITY[a.status] ?? 9) - (ACTIVE_PRIORITY[b.status] ?? 9));
+		// Focused: list every agent so the keyboard cursor can reach it. Idle: keep
+		// the historical cap so the prompt area stays small.
+		const activeCap = focused ? activeAgents.length : MAX_AGENTS_DISPLAY;
 		// Finished rows only appear in slots not used by active agents (max 2). When
 		// there are >= MAX_AGENTS_DISPLAY live workers, finished rows are suppressed
 		// entirely so they cannot push a live agent's activity line off-screen.
-		const finishedSlots = Math.max(0, Math.min(2, MAX_AGENTS_DISPLAY - activeAgents.length));
+		const finishedSlots = focused ? finishedAgents.length : Math.max(0, Math.min(2, MAX_AGENTS_DISPLAY - activeAgents.length));
+
+		/** Cursor marker column, mirroring the inline panel's selection. */
+		const markerFor = (taskId: string): string => (options.selectedTaskId === taskId ? "❯" : " ");
 
-		const visibleAgents = prioritizedActive.slice(0, MAX_AGENTS_DISPLAY);
+		const visibleAgents = activeAgents.slice(0, activeCap);
 		for (const [index, agent] of visibleAgents.entries()) {
-			const last = index === visibleAgents.length - 1 && activeAgents.length <= MAX_AGENTS_DISPLAY && finishedSlots === 0;
+			const last = index === visibleAgents.length - 1 && activeAgents.length <= activeCap && finishedSlots === 0;
 			const branch = last ? "└─" : "├─";
-			const agentGlyph = iconForStatus(agent.status, { runningGlyph });
 			const liveHandle = liveForRun.find((h) => h.taskId === agent.taskId);
+			const legacyGlyph = options.viewedTaskId === agent.taskId ? "◉" : iconForStatus(agent.status, { runningGlyph });
 			const stats = agentStats(agent, liveHandle);
 			const name = liveHandle?.agent ?? agent.agent;
+			const activity = agentActivity(agent, liveHandle);
 			const desc = truncate(liveHandle?.description ?? agent.role ?? "", TASK_DESC_MAX);
-			const _activeMain = truncate(`│  ${branch} ${agentGlyph} ${name}${desc ? ` · ${desc}` : ` · ${agent.role}`}`, width);
+			const _activeMain = truncate(`│  ${branch} ${legacyGlyph} ${name}${desc ? ` · ${desc}` : ` · ${agent.role}`}`, width);
 			lines.push(_activeMain);
-			const _activity = truncate(`│     ⊶ ${agentActivity(agent, liveHandle)}${stats ? ` · ${stats}` : ""}`, width);
+			const _activity = truncate(`│     ⊶ ${activity}${stats ? ` · ${stats}` : ""}`, width);
 			lines.push(_activity);
 		}
 
-		if (activeAgents.length > MAX_AGENTS_DISPLAY) {
-			lines.push(truncate(`│  └─ … +${activeAgents.length - MAX_AGENTS_DISPLAY} more agents`, width));
+		if (activeAgents.length > activeCap) {
+			lines.push(truncate(`│  └─ … +${activeAgents.length - activeCap} more agents`, width));
 		}
 
 		for (const [index, agent] of finishedAgents.slice(0, finishedSlots).entries()) {
 			const liveHandle = liveForRun.find((h) => h.taskId === agent.taskId);
 			const name = liveHandle?.agent ?? agent.agent;
-			const icon =
+			const legacyIcon =
 				agent.status === "completed" ? "✓" : agent.status === "failed" ? "✗" : agent.status === "needs_attention" ? "⚠" : "▪";
 			const stats = agentStats(agent, liveHandle);
 			const desc = truncate(liveHandle?.description ?? agent.role ?? "", TASK_DESC_MAX);
 			const isLastFinished = index === Math.min(finishedAgents.length, finishedSlots) - 1;
 			const branch = isLastFinished ? "└─" : "├─";
-			const _finished = truncate(`│  ${branch} ${icon} ${name} · ${desc}${stats ? ` · ${stats}` : ""}`, width);
+			const _finished = truncate(`│  ${branch} ${legacyIcon} ${name} · ${desc}${stats ? ` · ${stats}` : ""}`, width);
 			lines.push(_finished);
 		}
 
-		if (lines.length >= maxLines) break;
+		// Focused (inline panel cursor active): the keyboard can reach every
+		// agent, so the renderer must list them ALL — clipping here would put
+		// the cursor marker (❯) on rows that are never painted. The idle
+		// widget keeps its historical cap to hold the prompt area small.
+		if (lines.length >= maxLines && !focused) break;
 	}
 
-	return lines.slice(0, maxLines);
+	return focused ? lines : lines.slice(0, maxLines);
 }
 
 // ── Colorization ──────────────────────────────────────────────────────

package/src/ui/widget/widget-types.ts

@@ -24,16 +24,27 @@ export interface CrewWidgetModel {
 	/** P3 (#9): workspace/session ID for filtering runs by ownerSessionId
 	 * on every render, not just the first frame. */
 	workspaceId?: string;
+	/** Per-agent row layout; defaults to the historical two-line tree. */
+	rowStyle?: import("./widget-renderer.ts").WidgetRowStyle;
 }
 
 export interface CrewWidgetState {
 	frame: number;
 	lastPlacement?: string;
 	lastVisibility?: "hidden" | "visible";
+	/** Whether the aboveEditor task-list widget (pi-crew-tasks) is mounted. */
+	lastTasksVisibility?: "hidden" | "visible";
 	lastKey?: string;
 	lastMaxLines?: number;
 	lastCwd?: string;
 	legacyCleared?: boolean;
 	model?: CrewWidgetModel;
 	notificationCount?: number;
+	/**
+	 * Non-serializable dock host used when `widgetPlacement` is `"bottom"`:
+	 * the dock renders through the crew-vibes footer instead of a pi widget
+	 * slot. Kept off `model` so serialization/persistence of the rest of the
+	 * state stays unaffected.
+	 */
+	footerDock?: { render(width: number): string[]; dispose(): void };
 }

package/src/utils/child-process-shield.ts

@@ -0,0 +1,106 @@
+/**
+ * child-process-shield.ts — stop abort-driven child-process errors from
+ * killing the host pi process.
+ *
+ * THE CRASH
+ * ---------
+ * Node spawns a child with `options.signal` and the signal fires while that
+ * child is still tracked (before its 'exit' event has dispatched), Node runs:
+ *
+ *   abortChildProcess(child, killSignal, reason)
+ *     try { if (child.kill(killSignal)) {
+ *       child.emit("error", new AbortError(...))   // node:child_process
+ *     } } catch (err) { child.emit("error", err); }
+ *
+ * `child.emit("error", ...)` THROWS synchronously when the ChildProcess has
+ * no 'error' listener (EventEmitter 'error'-event semantics). That throw is
+ * captured by the AbortSignal dispatch machinery and re-thrown on the next
+ * tick (`process.nextTick(() => { throw err; })`, node:internal/event_target)
+ * — OUTSIDE any try/catch, so it surfaces as `uncaughtException` and pi dies
+ * (`pi exiting due to uncaughtException: AbortError: The operation was
+ * aborted`). This is exactly the crash seen on /crew-view session switches
+ * mid-foreground-run: the run's signal propagates into the vendored pi SDK's
+ * session machinery, an internal controller abort reaches a signal-spawned
+ * child with no error listener, and the terminal dies.
+ *
+ * IMPORTANT: because the rethrow is asynchronous (next tick), wrapping the
+ * AbortController.abort() call in try/catch (see safe-abort.ts) CANNOT stop
+ * it. The only reliable fix is to make sure the spawned child ALWAYS has an
+ * 'error' listener before an abort can fire, so child.emit("error", ...)
+ * dispatches instead of throwing.
+ *
+ * THE SHIELD
+ * ----------
+ * 1. `ChildProcess.prototype.kill` — every abort path in node runs through
+ *    `child.kill()` FIRST (abortChildProcess calls it before emitting), so a
+ *    no-op 'error' listener attached inside kill() protects every signal-
+ *    spawned child IN THE PROCESS, regardless of when the spawning module
+ *    captured its `spawn` reference (the vendored SDK may bind `spawn` at a
+ *    point we cannot observe).
+ * 2. `child_process.spawn` wrapper — attaches the same no-op 'error' listener
+ *    at spawn time when `options.signal` is present, so the listener exists
+ *    before Node's pre-aborted-signal nextTick abort and before spawn-failure
+ *    errors (ENOENT) are emitted.
+ *
+ * The no-op listener never swallows anything a consumer cares about: 'error'
+ * events still reach every other listener (multiple listeners run), and code
+ * that previously died on an unhandled 'error' event keeps its semantics for
+ * genuinely broken spawns — it just no longer takes down the whole pi process
+ * for the abort-after-exit case, which is a semantic no-op by definition (the
+ * child was already gone).
+ */
+import type { ChildProcess } from "node:child_process";
+import { createRequire } from "node:module";
+
+const require = createRequire(import.meta.url);
+const childProcessModule = require("node:child_process") as {
+	spawn: (file: string, args?: readonly string[] | undefined, options?: object) => ChildProcess;
+	ChildProcess: { prototype: { kill: (signal?: number | string) => boolean } };
+};
+
+const SHIELD_MARKER = Symbol.for("pi-crew.childProcessAbortShieldInstalled");
+
+/** No-op 'error' listener: prevents the EventEmitter throw, never filters data. */
+function shieldErrorListener(): void {
+	/* deliberately empty — see module docstring */
+}
+
+/**
+ * Install the child-process abort shield. Idempotent: subsequent calls are
+ * no-ops. MUST be called at extension registration, before any team run can
+ * start (the vendored SDK is imported lazily later, so any spawn it binds
+ * afterwards already sees the shielded spawn).
+ */
+export function installChildProcessAbortShield(): void {
+	const proto = childProcessModule.ChildProcess.prototype as typeof childProcessModule.ChildProcess.prototype & {
+		[SHIELD_MARKER]?: boolean;
+	};
+	if (proto[SHIELD_MARKER]) return;
+
+	const originalKill = proto.kill;
+	proto.kill = function shieldedKill(this: ChildProcess, signal?: number | string): boolean {
+		// A signal-spawned child may be aborted synchronously by node's
+		// abortChildProcess right after this kill() returns; guarantee a
+		// listener is present so child.emit("error", AbortError) dispatches
+		// instead of throwing.
+		if (this.listenerCount("error") === 0) this.on("error", shieldErrorListener);
+		return originalKill.call(this, signal);
+	};
+
+	const moduleObject = childProcessModule as {
+		spawn: typeof childProcessModule.spawn;
+	};
+	const originalSpawn = moduleObject.spawn;
+	moduleObject.spawn = function shieldedSpawn(this: unknown, ...args: Parameters<typeof childProcessModule.spawn>) {
+		const child = originalSpawn.apply(this, args);
+		// Attach at spawn time: covers pre-aborted signals (node defers the
+		// abort to the next tick) and spawn-failure errors (ENOENT etc.)
+		// before any abort could fire.
+		if (child && (args[2] as { signal?: unknown } | undefined)?.signal !== undefined) {
+			child.on("error", shieldErrorListener);
+		}
+		return child;
+	};
+
+	proto[SHIELD_MARKER] = true;
+}

package/src/utils/redaction.ts

@@ -34,7 +34,14 @@ export const PEM_PRIVATE_KEY_PATTERN = /-----BEGIN [A-Z ]+PRIVATE KEY-----[\s\S]
 // keyword-scan matches '_token' in 'prompt_tokens' (underscore + "token"),
 // falsely classifying usage counts as secrets. See performance/quality
 // assessment fix #5.
+//
+// `tokens` alone must stay too: pi-crew state records use
+// `progress.tokens` / `status.tokens` as the per-task usage total; the
+// camelCase fallback scan in isSecretKey() matches the bare keyword at
+// start+end of the name and would otherwise rewrite `15` to the literal
+// "***" on disk, which the widget then renders verbatim as `*** tok`.
 const TOKEN_COUNT_KEYS = new Set([
+	"tokens",
 	"prompt_tokens",
 	"completion_tokens",
 	"total_tokens",

package/src/utils/safe-abort.ts

@@ -0,0 +1,45 @@
+/**
+ * safe-abort.ts — abort helpers that cannot crash the host process.
+ *
+ * When a child process was spawned with `options.signal` and the signal fires
+ * AFTER that child already exited (fast workers, cleanup-after-completion,
+ * session switches mid-run), Node's child_process abort listener throws
+ * `AbortError: The operation was aborted` SYNCHRONOUSLY from
+ * `AbortController.abort()` (node:child_process abortChildProcess).
+ *
+ * In pi extension event handlers that throw propagates straight into pi's
+ * `uncaughtException` handling and kills the whole terminal session — the
+ * crash seen here: session_before_switch → stopSessionBoundSubagents → abort
+ * → AbortError → "pi exiting due to uncaughtException".
+ *
+ * Abort-after-exit is a semantic no-op (the work is already gone), so every
+ * controller abort that can be linked to a spawned child MUST go through
+ * these helpers: swallow the throw, log it, carry on.
+ */
+
+import { logInternalError } from "./internal-error.ts";
+
+/** Minimal controller shape — anything with an `abort()` method. */
+export interface Abortable {
+	abort(): void;
+}
+
+/**
+ * Abort a controller, tolerating Node's abort-after-child-exit AbortError.
+ * Never throws. `scope` names the call site for the internal error log.
+ */
+export function safeAbort(controller: Abortable | undefined, scope: string): void {
+	if (!controller) return;
+	try {
+		controller.abort();
+	} catch (error) {
+		logInternalError(`safe-abort.${scope}`, error);
+	}
+}
+
+/** Abort every controller in an iterable; a throwing controller does not
+ *  prevent the remaining ones from being aborted. */
+export function safeAbortAll(controllers: Iterable<Abortable> | undefined, scope: string): void {
+	if (!controllers) return;
+	for (const controller of controllers) safeAbort(controller, scope);
+}

package/src/workflows/discover-workflows.ts

@@ -191,6 +191,7 @@ function parseWorkflowFile(filePath: string, source: ResourceSource): WorkflowCo
 			topology: parseTopology(frontmatter.topology),
 			coalesceMicroTasks: parseOptionalBoolean(frontmatter.coalesceMicroTasks),
 			specStrict: parseOptionalBoolean(frontmatter.specStrict),
+			adaptive: parseOptionalBoolean(frontmatter.adaptive),
 			steps,
 		};
 	} catch {

package/src/workflows/workflow-config.ts

@@ -75,6 +75,13 @@ export interface WorkflowConfig {
 	 *  Requires a verifier-role step (reject-start, §5) and fails the write-gate
 	 *  on coverage gaps or machine-check failures (§4). */
 	specStrict?: boolean;
+	/** Frontmatter `adaptive: true` — the workflow's `assess` step (planner role)
+	 *  emits an ADAPTIVE_PLAN_JSON block that the runtime parses and injects as
+	 *  concrete tasks, so the plan painted in the task list is derived from the
+	 *  goal, not from fixed phase templates. The `implementation` workflow is
+	 *  adaptive by name (backward compat); this flag extends the mechanism to
+	 *  any workflow. See src/runtime/goal-workflow/adaptive-plan.ts. */
+	adaptive?: boolean;
 }
 
 /** A dynamic workflow (runtime === "dynamic"). steps is empty — the script is the source of truth. */

package/workflows/default.workflow.md

@@ -1,31 +1,41 @@
 ---
 name: default
-description: Explore, plan, execute, and verify
-topology: sequential
+description: Plan the goal into concrete tasks, execute them in parallel phases, verify
+topology: complex-dag
+adaptive: true
 ---
 
-## explore
-role: explorer
-
-Explore the codebase for the goal: {goal}
-
-## plan
+## assess
 role: planner
-dependsOn: explore
-output: plan.md
-
-Create a concise implementation plan for: {goal}
-
-## execute
-role: executor
-dependsOn: plan
-
-Implement the plan for: {goal}
-
-## verify
-role: verifier
-dependsOn: execute
-verify: true
-
-Verify completion for: {goal}
-Run FAST checks ONCE (cache output to .crew/cache/): `npm run test:critical && npx tsc --noEmit` (completes in <60s). Do NOT run `npm run test:unit` or `npm test` — too slow (642 files, >4 min). Cross-reference cached output with the changes. Do NOT re-run tests. Give PASS or FAIL with specific test evidence.
+output: adaptive-plan.json
+
+Plan the concrete task list for: {goal}
+
+You are the orchestration planner. Inspect the repository enough to break the goal into specific, executable tasks; do not use a fixed template. Small tasks may need one executor plus one verifier; broader tasks may need parallel explorers, executors, and a verification phase.
+
+Return a concise rationale, then include exactly one JSON block between these markers:
+
+ADAPTIVE_PLAN_JSON_START
+{
+  "phases": [
+    {
+      "name": "short-phase-name",
+      "tasks": [
+        {
+          "role": "explorer|executor|verifier",
+          "title": "short task title",
+          "task": "specific autonomous task prompt for this subagent"
+        }
+      ]
+    }
+  ]
+}
+ADAPTIVE_PLAN_JSON_END
+
+Rules:
+- **MAXIMIZE PARALLELISM**: Put independent tasks in the SAME phase so they run concurrently. Never create sequential phases when tasks are independent.
+- Task titles name the concrete piece of work — they become the task list the user watches.
+- Choose the smallest effective number of tasks per phase; a simple goal may have 1-2 phases with 1-2 tasks.
+- End implementation plans with a verification phase (`verifier` role): run FAST targeted checks only (e.g. the affected test files), never the full suite.
+- Tasks within the same phase run in parallel; phases run sequentially.
+- Do not include more than 12 tasks per phase; split or summarize oversized plans instead.