pi-crew 0.10.1 → 0.10.3

package/src/ui/widget/widget-types.ts

@@ -24,16 +24,27 @@ export interface CrewWidgetModel {
 	/** P3 (#9): workspace/session ID for filtering runs by ownerSessionId
 	 * on every render, not just the first frame. */
 	workspaceId?: string;
+	/** Per-agent row layout; defaults to the historical two-line tree. */
+	rowStyle?: import("./widget-renderer.ts").WidgetRowStyle;
 }
 
 export interface CrewWidgetState {
 	frame: number;
 	lastPlacement?: string;
 	lastVisibility?: "hidden" | "visible";
+	/** Whether the aboveEditor task-list widget (pi-crew-tasks) is mounted. */
+	lastTasksVisibility?: "hidden" | "visible";
 	lastKey?: string;
 	lastMaxLines?: number;
 	lastCwd?: string;
 	legacyCleared?: boolean;
 	model?: CrewWidgetModel;
 	notificationCount?: number;
+	/**
+	 * Non-serializable dock host used when `widgetPlacement` is `"bottom"`:
+	 * the dock renders through the crew-vibes footer instead of a pi widget
+	 * slot. Kept off `model` so serialization/persistence of the rest of the
+	 * state stays unaffected.
+	 */
+	footerDock?: { render(width: number): string[]; dispose(): void };
 }

package/src/utils/child-process-shield.ts

@@ -0,0 +1,106 @@
+/**
+ * child-process-shield.ts — stop abort-driven child-process errors from
+ * killing the host pi process.
+ *
+ * THE CRASH
+ * ---------
+ * Node spawns a child with `options.signal` and the signal fires while that
+ * child is still tracked (before its 'exit' event has dispatched), Node runs:
+ *
+ *   abortChildProcess(child, killSignal, reason)
+ *     try { if (child.kill(killSignal)) {
+ *       child.emit("error", new AbortError(...))   // node:child_process
+ *     } } catch (err) { child.emit("error", err); }
+ *
+ * `child.emit("error", ...)` THROWS synchronously when the ChildProcess has
+ * no 'error' listener (EventEmitter 'error'-event semantics). That throw is
+ * captured by the AbortSignal dispatch machinery and re-thrown on the next
+ * tick (`process.nextTick(() => { throw err; })`, node:internal/event_target)
+ * — OUTSIDE any try/catch, so it surfaces as `uncaughtException` and pi dies
+ * (`pi exiting due to uncaughtException: AbortError: The operation was
+ * aborted`). This is exactly the crash seen on /crew-view session switches
+ * mid-foreground-run: the run's signal propagates into the vendored pi SDK's
+ * session machinery, an internal controller abort reaches a signal-spawned
+ * child with no error listener, and the terminal dies.
+ *
+ * IMPORTANT: because the rethrow is asynchronous (next tick), wrapping the
+ * AbortController.abort() call in try/catch (see safe-abort.ts) CANNOT stop
+ * it. The only reliable fix is to make sure the spawned child ALWAYS has an
+ * 'error' listener before an abort can fire, so child.emit("error", ...)
+ * dispatches instead of throwing.
+ *
+ * THE SHIELD
+ * ----------
+ * 1. `ChildProcess.prototype.kill` — every abort path in node runs through
+ *    `child.kill()` FIRST (abortChildProcess calls it before emitting), so a
+ *    no-op 'error' listener attached inside kill() protects every signal-
+ *    spawned child IN THE PROCESS, regardless of when the spawning module
+ *    captured its `spawn` reference (the vendored SDK may bind `spawn` at a
+ *    point we cannot observe).
+ * 2. `child_process.spawn` wrapper — attaches the same no-op 'error' listener
+ *    at spawn time when `options.signal` is present, so the listener exists
+ *    before Node's pre-aborted-signal nextTick abort and before spawn-failure
+ *    errors (ENOENT) are emitted.
+ *
+ * The no-op listener never swallows anything a consumer cares about: 'error'
+ * events still reach every other listener (multiple listeners run), and code
+ * that previously died on an unhandled 'error' event keeps its semantics for
+ * genuinely broken spawns — it just no longer takes down the whole pi process
+ * for the abort-after-exit case, which is a semantic no-op by definition (the
+ * child was already gone).
+ */
+import type { ChildProcess } from "node:child_process";
+import { createRequire } from "node:module";
+
+const require = createRequire(import.meta.url);
+const childProcessModule = require("node:child_process") as {
+	spawn: (file: string, args?: readonly string[] | undefined, options?: object) => ChildProcess;
+	ChildProcess: { prototype: { kill: (signal?: number | string) => boolean } };
+};
+
+const SHIELD_MARKER = Symbol.for("pi-crew.childProcessAbortShieldInstalled");
+
+/** No-op 'error' listener: prevents the EventEmitter throw, never filters data. */
+function shieldErrorListener(): void {
+	/* deliberately empty — see module docstring */
+}
+
+/**
+ * Install the child-process abort shield. Idempotent: subsequent calls are
+ * no-ops. MUST be called at extension registration, before any team run can
+ * start (the vendored SDK is imported lazily later, so any spawn it binds
+ * afterwards already sees the shielded spawn).
+ */
+export function installChildProcessAbortShield(): void {
+	const proto = childProcessModule.ChildProcess.prototype as typeof childProcessModule.ChildProcess.prototype & {
+		[SHIELD_MARKER]?: boolean;
+	};
+	if (proto[SHIELD_MARKER]) return;
+
+	const originalKill = proto.kill;
+	proto.kill = function shieldedKill(this: ChildProcess, signal?: number | string): boolean {
+		// A signal-spawned child may be aborted synchronously by node's
+		// abortChildProcess right after this kill() returns; guarantee a
+		// listener is present so child.emit("error", AbortError) dispatches
+		// instead of throwing.
+		if (this.listenerCount("error") === 0) this.on("error", shieldErrorListener);
+		return originalKill.call(this, signal);
+	};
+
+	const moduleObject = childProcessModule as {
+		spawn: typeof childProcessModule.spawn;
+	};
+	const originalSpawn = moduleObject.spawn;
+	moduleObject.spawn = function shieldedSpawn(this: unknown, ...args: Parameters<typeof childProcessModule.spawn>) {
+		const child = originalSpawn.apply(this, args);
+		// Attach at spawn time: covers pre-aborted signals (node defers the
+		// abort to the next tick) and spawn-failure errors (ENOENT etc.)
+		// before any abort could fire.
+		if (child && (args[2] as { signal?: unknown } | undefined)?.signal !== undefined) {
+			child.on("error", shieldErrorListener);
+		}
+		return child;
+	};
+
+	proto[SHIELD_MARKER] = true;
+}

package/src/utils/redaction.ts

@@ -34,7 +34,14 @@ export const PEM_PRIVATE_KEY_PATTERN = /-----BEGIN [A-Z ]+PRIVATE KEY-----[\s\S]
 // keyword-scan matches '_token' in 'prompt_tokens' (underscore + "token"),
 // falsely classifying usage counts as secrets. See performance/quality
 // assessment fix #5.
+//
+// `tokens` alone must stay too: pi-crew state records use
+// `progress.tokens` / `status.tokens` as the per-task usage total; the
+// camelCase fallback scan in isSecretKey() matches the bare keyword at
+// start+end of the name and would otherwise rewrite `15` to the literal
+// "***" on disk, which the widget then renders verbatim as `*** tok`.
 const TOKEN_COUNT_KEYS = new Set([
+	"tokens",
 	"prompt_tokens",
 	"completion_tokens",
 	"total_tokens",

package/src/utils/safe-abort.ts

@@ -0,0 +1,45 @@
+/**
+ * safe-abort.ts — abort helpers that cannot crash the host process.
+ *
+ * When a child process was spawned with `options.signal` and the signal fires
+ * AFTER that child already exited (fast workers, cleanup-after-completion,
+ * session switches mid-run), Node's child_process abort listener throws
+ * `AbortError: The operation was aborted` SYNCHRONOUSLY from
+ * `AbortController.abort()` (node:child_process abortChildProcess).
+ *
+ * In pi extension event handlers that throw propagates straight into pi's
+ * `uncaughtException` handling and kills the whole terminal session — the
+ * crash seen here: session_before_switch → stopSessionBoundSubagents → abort
+ * → AbortError → "pi exiting due to uncaughtException".
+ *
+ * Abort-after-exit is a semantic no-op (the work is already gone), so every
+ * controller abort that can be linked to a spawned child MUST go through
+ * these helpers: swallow the throw, log it, carry on.
+ */
+
+import { logInternalError } from "./internal-error.ts";
+
+/** Minimal controller shape — anything with an `abort()` method. */
+export interface Abortable {
+	abort(): void;
+}
+
+/**
+ * Abort a controller, tolerating Node's abort-after-child-exit AbortError.
+ * Never throws. `scope` names the call site for the internal error log.
+ */
+export function safeAbort(controller: Abortable | undefined, scope: string): void {
+	if (!controller) return;
+	try {
+		controller.abort();
+	} catch (error) {
+		logInternalError(`safe-abort.${scope}`, error);
+	}
+}
+
+/** Abort every controller in an iterable; a throwing controller does not
+ *  prevent the remaining ones from being aborted. */
+export function safeAbortAll(controllers: Iterable<Abortable> | undefined, scope: string): void {
+	if (!controllers) return;
+	for (const controller of controllers) safeAbort(controller, scope);
+}

package/src/utils/visual.ts

@@ -4,6 +4,12 @@ export const ANSI_PATTERN = /\u001b\[[0-?]*[ -/]*[@-~]/g;
 
 const WIDTH_CACHE_LIMIT = 256;
 const widthCache = new Map<string, number>();
+// PERF (2026-08-24): truncateToWidth/wrapHard measure ONE codepoint at a time;
+// those 1-2 char keys thrashed the 256-entry LRU, evicting every long-string
+// entry that could actually hit. Short keys get their own cache (bounded
+// alphabet — hit rate ~100%) so the LRU serves only whole lines/segments.
+const SHORT_WIDTH_CACHE_LIMIT = 1024;
+const shortWidthCache = new Map<string, number>();
 
 // NOTE: width measurement is delegated to pi-tui's `visibleWidth` (see below).
 // pi-tui is the renderer that HARD-ABORTS the session if any line exceeds the
@@ -20,6 +26,17 @@ export function visibleWidth(value: string): number {
 	// LRU cache on top (pi-tui caches too, but this avoids repeated calls for the
 	// hot render path).
 	if (value.length > 4096) return tuiVisibleWidth(value);
+	if (value.length <= 2) {
+		const s = shortWidthCache.get(value);
+		if (s !== undefined) return s;
+		const w = tuiVisibleWidth(value);
+		if (shortWidthCache.size >= SHORT_WIDTH_CACHE_LIMIT) {
+			const first = shortWidthCache.keys().next().value;
+			if (first !== undefined) shortWidthCache.delete(first);
+		}
+		shortWidthCache.set(value, w);
+		return w;
+	}
 	const cached = widthCache.get(value);
 	if (cached !== undefined) return cached;
 	const length = tuiVisibleWidth(value);
@@ -33,6 +50,7 @@ export function visibleWidth(value: string): number {
 
 export function __test__clearVisibleWidthCache(): void {
 	widthCache.clear();
+	shortWidthCache.clear();
 }
 
 export function __test__visibleWidthCacheSize(): number {
@@ -205,3 +223,28 @@ export function truncateToVisualLines(text: string, maxVisualLines: number, widt
 	const truncated = visualLines.slice(-limit);
 	return { visualLines: truncated, skippedCount: visualLines.length - limit };
 }
+
+/**
+ * PERF (2026-08-24): tail-windowed twin of truncateToVisualLines. Wraps lines
+ * from the END backwards and stops as soon as `maxVisualLines` visual lines
+ * exist — O(visible window) instead of O(whole transcript). `skippedCount`
+ * counts skipped SOURCE lines (a lower bound on skipped visual lines; the
+ * caller's total display therefore reads "≥ N lines" when scrolled to bottom).
+ */
+export function truncateToVisualLinesTail(text: string, maxVisualLines: number, width: number, paddingX = 0): VisualTruncateResult {
+	if (!text) return { visualLines: [], skippedCount: 0 };
+	const effectiveWidth = Math.max(1, width - paddingX * 2);
+	const limit = Math.max(1, maxVisualLines);
+	const sourceLines = text.split("\n");
+	const wrapped: string[][] = [];
+	let collected = 0;
+	let index = sourceLines.length - 1;
+	while (index >= 0 && collected < limit) {
+		const w = wrapHard(pad(sourceLines[index]!, Math.max(0, effectiveWidth)).trimEnd(), effectiveWidth);
+		wrapped.push(w);
+		collected += w.length;
+		index -= 1;
+	}
+	const visualLines = wrapped.reverse().flat().slice(-limit);
+	return { visualLines, skippedCount: index + 1 };
+}

package/src/workflows/discover-workflows.ts

@@ -191,6 +191,7 @@ function parseWorkflowFile(filePath: string, source: ResourceSource): WorkflowCo
 			topology: parseTopology(frontmatter.topology),
 			coalesceMicroTasks: parseOptionalBoolean(frontmatter.coalesceMicroTasks),
 			specStrict: parseOptionalBoolean(frontmatter.specStrict),
+			adaptive: parseOptionalBoolean(frontmatter.adaptive),
 			steps,
 		};
 	} catch {

package/src/workflows/workflow-config.ts

@@ -75,6 +75,13 @@ export interface WorkflowConfig {
 	 *  Requires a verifier-role step (reject-start, §5) and fails the write-gate
 	 *  on coverage gaps or machine-check failures (§4). */
 	specStrict?: boolean;
+	/** Frontmatter `adaptive: true` — the workflow's `assess` step (planner role)
+	 *  emits an ADAPTIVE_PLAN_JSON block that the runtime parses and injects as
+	 *  concrete tasks, so the plan painted in the task list is derived from the
+	 *  goal, not from fixed phase templates. The `implementation` workflow is
+	 *  adaptive by name (backward compat); this flag extends the mechanism to
+	 *  any workflow. See src/runtime/goal-workflow/adaptive-plan.ts. */
+	adaptive?: boolean;
 }
 
 /** A dynamic workflow (runtime === "dynamic"). steps is empty — the script is the source of truth. */

package/src/worktree/worktree-manager.ts

@@ -129,19 +129,59 @@ function sanitizeBranchPart(value: string): string {
 	);
 }
 
+// PERF (2026-08-24): the sync path (prepareTaskWorkspace — per task!) ran
+// findGitRoot (rev-parse spawn) + assertCleanLeader (status --porcelain spawn)
+// on every call, and the reuse path ran assertCleanLeader twice. Mirror the
+// async caches below (_gitRootCache/_cleanLeaderCache): same repoRoot → same
+// answer within a run.
+//
+// Mirrored invalidation semantics (from the async caches below):
+// - gitRoot: plain Map, NO TTL — the async _gitRootCache is process-lifetime with
+//   a FIFO cap; a cwd's repo root cannot change without moving .git itself.
+// - cleanLeader: ONLY clean verdicts are cached — the async _cleanLeaderCache is
+//   a Set of verified-clean repoRoots and a dirty verdict throws BEFORE caching,
+//   so every call while dirty re-probes (mirrored here). The async cache has NO
+//   TTL (a clean verdict is trusted for the whole process), so the 30s TTL below
+//   is strictly MORE conservative than the async path: a leader dirtied after a
+//   cached clean verdict can slip through for at most 30s here vs. forever on
+//   the async path. The reuse-path re-check in prepareTaskWorkspace deletes the
+//   entry first, mirroring `_cleanLeaderCache.delete(repoRoot)` in the async variant.
+const SYNC_WT_CACHE_TTL_MS = 30_000;
+const MAX_SYNC_GIT_ROOT_CACHE = 256;
+const MAX_SYNC_CLEAN_LEADER_CACHE = 256;
+const syncGitRootCache = new Map<string, string>();
+const syncCleanLeaderCache = new Map<string, { clean: boolean; expiresAt: number }>();
+
 export function findGitRoot(cwd: string): string {
-	return git(cwd, ["rev-parse", "--show-toplevel"]);
+	const cached = syncGitRootCache.get(cwd);
+	if (cached) return cached;
+	const root = git(cwd, ["rev-parse", "--show-toplevel"]);
+	syncGitRootCache.set(cwd, root);
+	if (syncGitRootCache.size > MAX_SYNC_GIT_ROOT_CACHE) {
+		const oldest = syncGitRootCache.keys().next().value;
+		if (oldest !== undefined) syncGitRootCache.delete(oldest);
+	}
+	return root;
 }
 
 export function assertCleanLeader(repoRoot: string): void {
+	const cached = syncCleanLeaderCache.get(repoRoot);
+	if (cached?.clean && Date.now() < cached.expiresAt) return;
 	// H-7 follow-up: --untracked-files=no so pi-crew's own auto-created .gitignore
 	// (and any other untracked files the user hasn't staged) doesn't block worktree mode.
 	// The worktree contract is "no tracked changes" — untracked files are safe since
 	// they're either in .gitignore or the user can decide later.
 	const status = git(repoRoot, ["status", "--porcelain", "--untracked-files=no"]);
 	if (status.trim()) {
+		// Dirty verdicts are never cached (async mirror): the user may commit/stash
+		// seconds later, so the next call must re-probe.
 		throw new Error("Worktree mode requires a clean leader repository. Commit/stash changes or use workspaceMode: 'single'.");
 	}
+	syncCleanLeaderCache.set(repoRoot, { clean: true, expiresAt: Date.now() + SYNC_WT_CACHE_TTL_MS });
+	if (syncCleanLeaderCache.size > MAX_SYNC_CLEAN_LEADER_CACHE) {
+		const oldest = syncCleanLeaderCache.keys().next().value;
+		if (oldest !== undefined) syncCleanLeaderCache.delete(oldest);
+	}
 }
 
 // --- Async versions ---
@@ -453,6 +493,25 @@ function pruneStaleWorktrees(repoRoot: string): void {
 	}
 }
 
+// PERF (2026-08-24): worktree prune is a repo-level write; running it per
+// task in a 50-task run is 50 prunes. At most once per repoRoot per minute.
+// (The async variant memoizes at-most-once per process — see P1-11 above —
+// so a 60s window prunes strictly more often than the async path already does.)
+// R5-L2 mirror: FIFO-cap the key set so the map cannot grow unbounded.
+const PRUNE_MIN_INTERVAL_MS = 60_000;
+const MAX_PRUNE_THROTTLE_KEYS = 128;
+const lastPruneAt = new Map<string, number>();
+function pruneStaleWorktreesThrottled(repoRoot: string): void {
+	const last = lastPruneAt.get(repoRoot) ?? 0;
+	if (Date.now() - last < PRUNE_MIN_INTERVAL_MS) return;
+	lastPruneAt.set(repoRoot, Date.now());
+	if (lastPruneAt.size > MAX_PRUNE_THROTTLE_KEYS) {
+		const oldest = lastPruneAt.keys().next().value;
+		if (oldest !== undefined) lastPruneAt.delete(oldest);
+	}
+	pruneStaleWorktrees(repoRoot); // original body — best-effort, failures swallowed
+}
+
 async function branchExistsAsync(repoRoot: string, branch: string): Promise<{ local: boolean; remoteOnly: boolean }> {
 	let local = false;
 	try {
@@ -818,11 +877,13 @@ export function prepareTaskWorkspace(manifest: TeamRunManifest, task: TeamTaskSt
 		if (mergedReused.length > 0) {
 			overlaySeedPaths(repoRoot, worktreePath, mergedReused);
 		}
-		// Re-validate leader is still clean before reusing — leader state may have changed since first preparation
+		// Re-validate leader is still clean before reusing — leader state may have changed since first preparation.
+		// Mirrors prepareTaskWorkspaceAsync: delete the cached verdict so this re-check probes live state.
+		syncCleanLeaderCache.delete(repoRoot);
 		assertCleanLeader(repoRoot);
 		return { cwd: worktreePath, worktreePath, branch, reused: true };
 	}
-	pruneStaleWorktrees(repoRoot);
+	pruneStaleWorktreesThrottled(repoRoot);
 	const exists = branchExists(repoRoot, branch);
 	let worktreeCreated = false;
 	try {
@@ -1141,7 +1202,7 @@ export function prepareAgentWorktree(manifest: TeamRunManifest, agentId: string)
 	const stamp = `${Date.now()}-${randomBytes(4).toString("hex")}`;
 	const worktreePath = path.join(worktreeRoot, `${sanitizedAgentId}-${stamp}`);
 	const branch = `pi-crew/${sanitizedRunId}/${sanitizedAgentId}-${stamp}`;
-	pruneStaleWorktrees(repoRoot);
+	pruneStaleWorktreesThrottled(repoRoot);
 	git(repoRoot, ["worktree", "add", "-b", branch, worktreePath, "HEAD"]);
 	const nodeModulesLinked =
 		loadedConfig.config.worktree?.linkNodeModules === true ? linkNodeModulesIfPresent(repoRoot, worktreePath) : false;

package/workflows/default.workflow.md

@@ -1,31 +1,41 @@
 ---
 name: default
-description: Explore, plan, execute, and verify
-topology: sequential
+description: Plan the goal into concrete tasks, execute them in parallel phases, verify
+topology: complex-dag
+adaptive: true
 ---
 
-## explore
-role: explorer
-
-Explore the codebase for the goal: {goal}
-
-## plan
+## assess
 role: planner
-dependsOn: explore
-output: plan.md
-
-Create a concise implementation plan for: {goal}
-
-## execute
-role: executor
-dependsOn: plan
-
-Implement the plan for: {goal}
-
-## verify
-role: verifier
-dependsOn: execute
-verify: true
-
-Verify completion for: {goal}
-Run FAST checks ONCE (cache output to .crew/cache/): `npm run test:critical && npx tsc --noEmit` (completes in <60s). Do NOT run `npm run test:unit` or `npm test` — too slow (642 files, >4 min). Cross-reference cached output with the changes. Do NOT re-run tests. Give PASS or FAIL with specific test evidence.
+output: adaptive-plan.json
+
+Plan the concrete task list for: {goal}
+
+You are the orchestration planner. Inspect the repository enough to break the goal into specific, executable tasks; do not use a fixed template. Small tasks may need one executor plus one verifier; broader tasks may need parallel explorers, executors, and a verification phase.
+
+Return a concise rationale, then include exactly one JSON block between these markers:
+
+ADAPTIVE_PLAN_JSON_START
+{
+  "phases": [
+    {
+      "name": "short-phase-name",
+      "tasks": [
+        {
+          "role": "explorer|executor|verifier",
+          "title": "short task title",
+          "task": "specific autonomous task prompt for this subagent"
+        }
+      ]
+    }
+  ]
+}
+ADAPTIVE_PLAN_JSON_END
+
+Rules:
+- **MAXIMIZE PARALLELISM**: Put independent tasks in the SAME phase so they run concurrently. Never create sequential phases when tasks are independent.
+- Task titles name the concrete piece of work — they become the task list the user watches.
+- Choose the smallest effective number of tasks per phase; a simple goal may have 1-2 phases with 1-2 tasks.
+- End implementation plans with a verification phase (`verifier` role): run FAST targeted checks only (e.g. the affected test files), never the full suite.
+- Tasks within the same phase run in parallel; phases run sequentially.
+- Do not include more than 12 tasks per phase; split or summarize oversized plans instead.

package/workflows/strict-fast-fix.workflow.md

@@ -0,0 +1,26 @@
+---
+name: strict-fast-fix
+description: T4 follow-up — fast-fix variant with strict spec binding (ADR-6 §5). Use this to exercise provenance v2 / freeze-at-dispatch / strict-mode gate end-to-end. Imports the spec via `scripts/spec-import.mjs` first.
+topology: sequential
+---
+
+## explore
+role: explorer
+specRefs: b5-t4-strict-probe
+specStrict: true
+
+Find the likely source of the issue: {goal}. You are held to the SPEC-EVIDENCE contract for the referenced spec — emit a `=== SPEC-EVIDENCE ===` block with `cited: <id>:<id>` lines for each requirement the work touches, then `=== END ===`.
+
+## execute
+role: executor
+dependsOn: explore
+
+Make the smallest safe fix. Continue the SPEC-EVIDENCE contract from explore: cite every requirement the implementation satisfies.
+
+## verify
+role: verifier
+dependsOn: execute
+verify: true
+
+Verify the fix with available evidence, AND cross-reference the SPEC-EVIDENCE footer from explore+execute against the spec's requirements (machine-check the citations vs the spec id set).
+Run FAST checks ONCE (cache output to .crew/cache/): `npm run test:critical && npx tsc --noEmit` (completes in <60s). Do NOT run `npm run test:unit` or `npm test` — too slow (642 files, >4 min). Cross-reference cached output with the fix. Do NOT re-run tests. Give PASS or FAIL with specific test evidence + spec gate verdict.