pi-crew 0.10.1 → 0.10.3

package/src/extension/registration/lifecycle-handlers.ts

@@ -21,9 +21,10 @@ import { loadConfig } from "../../config/config.ts";
 import { DEFAULT_UI } from "../../config/defaults.ts";
 import { getCrewEnv } from "../../config/env-vars.ts";
 import { pruneFinishedRuns, pruneUserLevelRuns } from "../../extension/run-maintenance.ts";
-import { type BrokerSpawnCredentials, setActiveBrokerIssuer } from "../../runtime/broker/broker-issuer.ts";
+import { type BrokerSpawnCredentials, setActiveBrokerIssuer, setActiveBrokerRevoker } from "../../runtime/broker/broker-issuer.ts";
 import { CrewBroker } from "../../runtime/broker/crew-broker.ts";
 import { terminateActiveChildPiProcesses } from "../../runtime/child-pi/child-pi.ts";
+import { forgetDetachedRun, hasDetachedRuns, peekFinishedDetachedRunResults } from "../../runtime/detached-run-results.ts";
 import { listLiveAgents } from "../../runtime/live-session/live-agent-manager.ts";
 import type { createManifestCache } from "../../runtime/manifest-cache.ts";
 import { configuredModelInfosFromPiConfig } from "../../runtime/model/model-fallback.ts";
@@ -39,7 +40,9 @@ import { applyCrewSettingsTiersToConfig, loadCrewSettingsTiers } from "../../run
 import { loadRunManifestById } from "../../state/stores/state-store.ts";
 import type { TeamRunManifest } from "../../state/types.ts";
 import { summarizeHeartbeats } from "../../ui/heartbeat-aggregator.ts";
-import { requestRender, setExtensionWidget } from "../../ui/pi-ui-compat.ts";
+import { installInlinePanel } from "../../ui/inline-panel/index.ts";
+import { clearSessionSwitchInFlight, markSessionSwitchInFlight } from "../../ui/inline-panel/view-session-store.ts";
+import { requestRender, setExtensionWidget, toPiWidgetPlacement } from "../../ui/pi-ui-compat.ts";
 import {
 	registerPiCrewPowerbarSegments,
 	requestPowerbarUpdate,
@@ -75,6 +78,36 @@ export function installSessionLifecycleHandlers(pi: ExtensionAPI, ctx: Registrat
 	installModelTrackingHandlers(pi);
 }
 
+/**
+ * Hand over the outcome of runs detached by an agent-view switch.
+ *
+ * Delivered as a DISPLAYED session entry (not a follow-up queue item): an idle
+ * session never flushes a follow-up, so the queued variant left the result
+ * invisible. Each result is dropped from the registry only after its send
+ * succeeded, and only while the owning session is current — a worker's view
+ * session must never receive the parent run's report.
+ */
+function deliverDetachedRunResults(pi: ExtensionAPI, extensionCtx: ExtensionContext): void {
+	if (!hasDetachedRuns()) return;
+	try {
+		// Agent views are in-document panes now, never sessions: the current
+		// session is always the main one, so detached results always deliver.
+		const inViewSession = false;
+		for (const { runId, text } of peekFinishedDetachedRunResults({ inViewSession })) {
+			pi.sendMessage({ customType: "pi-crew-run-result", content: text, display: true });
+			forgetDetachedRun(runId);
+			try {
+				extensionCtx.ui.notify(text.split("\n")[0] ?? `pi-crew run finished: ${runId}`, "info");
+			} catch {
+				/* toast is secondary to the session entry */
+			}
+		}
+	} catch (error) {
+		// Keep the entry: the next tick retries rather than losing the outcome.
+		logInternalError("register.detachedRunResults", error);
+	}
+}
+
 /**
  * model_select / thinking_level_select:
  *   Track what the MAIN session is *actually* running so subagents that
@@ -125,6 +158,12 @@ function installSessionShutdownHandler(pi: ExtensionAPI, ctx: RegistrationContex
  */
 function installSessionBeforeSwitchHandler(pi: ExtensionAPI, ctx: RegistrationContext): void {
 	pi.on("session_before_switch", () => {
+		// The switch tears the current turn down right after this handler
+		// (teardownCurrent → session.abort()). That turn-abort must NOT cancel
+		// a foreground team run that is still forming (see run-deadline.ts):
+		// foreground runs survive session switches (P0). Cleared on the next
+		// session_start.
+		markSessionSwitchInFlight();
 		ctx.sessionGeneration++;
 		const pendingCount = ctx.lifecycleState.deliveryCoordinator?.getPendingCount() ?? 0;
 		try {
@@ -167,6 +206,9 @@ function installSessionBeforeSwitchHandler(pi: ExtensionAPI, ctx: RegistrationCo
  */
 function installSessionStartHandler(pi: ExtensionAPI, ctx: RegistrationContext): void {
 	pi.on("session_start", (_event, extensionCtx) => {
+		// Any session start means a pending switch landed — the turn-abort
+		// suppression window for that switch is over.
+		clearSessionSwitchInFlight();
 		runArtifactCleanup(extensionCtx.cwd);
 
 		// Restore brief mode state from session entries (best-effort).
@@ -273,6 +315,13 @@ function installSessionStartHandler(pi: ExtensionAPI, ctx: RegistrationContext):
 		});
 		const cache = ctx.getManifestCache(extensionCtx.cwd);
 		updateCrewWidget(extensionCtx, ctx.widgetState, loadedConfig.config.ui, cache, ctx.getRunSnapshotCache(extensionCtx.cwd));
+		// Inline agent panel: keyboard-navigable rows under the prompt + per-agent
+		// transcript pane. Installed after the widget so the row projection sees
+		// the same caches the widget paint uses.
+		installInlinePanel(pi, extensionCtx, loadedConfig.config.ui);
+		// Returning from an agent view lands here: report any detached run that
+		// finished while the view was open, without waiting for a render tick.
+		deliverDetachedRunResults(pi, extensionCtx);
 		updatePiCrewPowerbar(
 			pi.events,
 			extensionCtx.cwd,
@@ -632,8 +681,13 @@ function setupRenderLoop(
 				// file just changed on disk, so force a fresh snapshot while keeping
 				// the entry populated — deleting it left a window where the widget's
 				// `get()` returned undefined and dropped the run to "(loading…)".
+				// PERF (2026-08-24): route through the coalesced ASYNC refresh —
+				// fs.watch can fire many times per second and the sync rebuild
+				// blocked the UI event loop. The entry stays populated until the
+				// async rebuild re-sets it in place; the render schedule below
+				// repaints while it lands.
 				try {
-					ctx.getRunSnapshotCache(ctx.currentCtx?.cwd ?? process.cwd()).refresh(runId);
+					ctx.getRunSnapshotCache(ctx.currentCtx?.cwd ?? process.cwd()).scheduleRefresh(runId);
 				} catch (error) {
 					logInternalError("register.runWatcher.refresh", error, runId);
 				}
@@ -681,13 +735,14 @@ function setupRenderLoop(
 
 	const renderTick = (): void => {
 		if (!ctx.currentCtx) return;
+		deliverDetachedRunResults(pi, ctx.currentCtx);
 		const config = lastPreloadedConfig?.config.ui;
 		const activeCache = lastFrameManifestCache ?? ctx.getManifestCache(ctx.currentCtx.cwd);
 		const snapshotCache = lastFrameSnapshotCache ?? ctx.getRunSnapshotCache(ctx.currentCtx.cwd);
 		const manifests = lastPreloadedManifests;
 		if (!lastPreloadedConfig) backgroundPreload();
 		if (ctx.uiState.liveSidebarRunId || ctx.uiState.dashboardOpen) {
-			const placement = config?.widgetPlacement ?? DEFAULT_UI.widgetPlacement;
+			const placement = toPiWidgetPlacement(config?.widgetPlacement ?? DEFAULT_UI.widgetPlacement);
 			if (ctx.widgetState.lastVisibility !== "hidden" || ctx.widgetState.lastPlacement !== placement) {
 				setExtensionWidget(ctx.currentCtx, "pi-crew", undefined, { placement });
 				setExtensionWidget(ctx.currentCtx, "pi-crew-active", undefined, { placement });
@@ -880,8 +935,11 @@ function setupRenderLoop(
 		// FLICKER FIX: rebuild-in-place instead of deleting the entry (see
 		// onRunChange above). A hard delete left `get()` returning undefined for
 		// a frame, dropping the run to "(loading…)" and causing visible flicker.
+		// PERF (2026-08-24): coalesced ASYNC refresh — fs.watch can fire many
+		// times per second and the sync rebuild blocked the UI event loop; the
+		// render schedule below repaints while the rebuild lands.
 		try {
-			ctx.getRunSnapshotCache(ctx.currentCtx?.cwd ?? process.cwd()).refresh(runId);
+			ctx.getRunSnapshotCache(ctx.currentCtx?.cwd ?? process.cwd()).scheduleRefresh(runId);
 		} catch (error) {
 			logInternalError("register.crewRunWatcher.refresh", error, runId);
 		}
@@ -1027,10 +1085,11 @@ export function installCrewBrokerLifecycleController(_pi: ExtensionAPI, _ctx: Re
 					// config.broker.waitMethodsEnabled a dead knob and the ADR-0
 					// "then true" flip a silent no-op. Fail-closed when unset.
 					waitMethodsEnabled: cfg?.waitMethodsEnabled ?? false,
-					// T3/R5 (ADR-5 §10): governed-nesting capability gate — fail-closed
-					// default; production threads config.nesting (sensitive: user config
-					// only). Nested-slot sizing + admission-time model catalog (ADR-5 §7 —
-					// the production wiring MUST supply it) + workspace gate mirror.
+					// T3/R5 (ADR-5 §10): governed-nesting capability gate — default-on
+					// since D8 (loadConfig layers DEFAULT_NESTING.enabled=true; sensitive
+					// flag, so only USER config may flip it). Nested-slot sizing +
+					// admission-time model catalog (ADR-5 §7 — the production wiring
+					// MUST supply it) + workspace gate mirror.
 					nestingEnabled: nestingCfg?.nesting?.enabled ?? false,
 					...(nestingCfg?.nesting?.maxSlots !== undefined ? { nestingMaxSlots: nestingCfg.nesting.maxSlots } : {}),
 					...(nestingCfg?.nesting?.maxDepth !== undefined ? { nestingMaxDepth: nestingCfg.nesting.maxDepth } : {}),
@@ -1070,8 +1129,8 @@ export function installCrewBrokerLifecycleController(_pi: ExtensionAPI, _ctx: Re
 		if (!effectiveEnabled()) return undefined;
 		// ADR-5 §4 (governed nesting): tokens are minted ONLY for children that
 		// may themselves delegate — childDepth < resolved maxDepth. At the default
-		// maxDepth=2 a delegate-spawned depth-2 grandchild gets NO credentials
-		// (env containment: no PI_CREW_BROKER_SOCKET/TOKEN at depth 2; identity
+		// maxDepth=4 a delegate-spawned depth-4 grandchild gets NO credentials
+		// (env containment: no PI_CREW_BROKER_SOCKET/TOKEN at the cap depth; identity
 		// routing via PI_CREW_BROKER_RUN_ID/TASK_ID is threaded unconditionally
 		// elsewhere). Undefined childDepth = legacy worker spawn (depth 1).
 		if (childDepth !== undefined && childDepth >= resolveCrewMaxDepth(undefined)) return undefined;
@@ -1086,6 +1145,27 @@ export function installCrewBrokerLifecycleController(_pi: ExtensionAPI, _ctx: Re
 		}
 	};
 
+	// MuxSurface A1 (spec §7 D3 step 2): publish the revoker alongside the
+	// issuer — team-runner's degrade controller calls it when a pane is lost.
+	// Best-effort and self-gated: no broker bound (never started / session
+	// switched) means nothing to revoke; re-issue after respawn mints fresh (T10).
+	const revokeForTask = (taskId: string): void => {
+		if (!taskId || typeof taskId !== "string") return;
+		if (!isRootSession(process.env)) return;
+		if (!broker || brokerSessionId !== cachedSessionId) return;
+		try {
+			broker.revokeTaskToken(taskId);
+		} catch (error) {
+			logInternalError(
+				"broker.revoke-for-task",
+				error instanceof Error ? error : new Error(String(error)),
+				`taskId=${taskId}`,
+				"warn",
+			);
+		}
+	};
+	setActiveBrokerRevoker(revokeForTask);
+
 	// Publish this issuer as the process-local active issuer so runChildPi can
 	// default `brokerIssuer` without the registration context being threaded
 	// through every runner call site. The issuer self-gates (root + flag), so
@@ -1096,6 +1176,7 @@ export function installCrewBrokerLifecycleController(_pi: ExtensionAPI, _ctx: Re
 		issueForChild,
 		stop: async () => {
 			setActiveBrokerIssuer(undefined);
+			setActiveBrokerRevoker(undefined);
 			if (broker) {
 				try {
 					await broker.stop();

package/src/extension/registration/runtime-cleanup.ts

@@ -20,12 +20,12 @@
 import type { ExtensionAPI } from "@earendil-works/pi-coding-agent";
 import { loadConfig } from "../../config/config.ts";
 import { clearHooksScoped } from "../../hooks/registry.ts";
-import { terminateActiveChildPiProcesses } from "../../runtime/child-pi/child-pi.ts";
 import { stopAllWatchdogs } from "../../runtime/foreground-watchdog.ts";
 import { clearPiCrewPowerbar, disposePowerbarCoalescer } from "../../ui/powerbar-publisher.ts";
 import { stopCrewWidget } from "../../ui/widget/index.ts";
 import { logInternalError } from "../../utils/internal-error.ts";
 import { clearProjectRootCache } from "../../utils/paths.ts";
+import { safeAbortAll } from "../../utils/safe-abort.ts";
 import { extractSessionId } from "../../utils/session-utils.ts";
 import { stopAsyncRunNotifier } from "../async-notifier.ts";
 import { uninstallCrewGlobalRegistry } from "../team-tool.ts";
@@ -135,7 +135,9 @@ function buildCleanupRuntime(ctx: RegistrationContext): () => void {
 		ctx.stopSessionBoundSubagents();
 		// P0 fix: also abort foreground team runs on session shutdown (not on session switch).
 		// This is the only place where foreground team run controllers should be aborted.
-		for (const controller of ctx.foregroundTeamRunControllers.values()) controller.abort();
+		// safe-abort: shutdown races completed runs whose spawned children already
+		// exited — abort() would throw AbortError from Node's child_process listener.
+		safeAbortAll(ctx.foregroundTeamRunControllers.values(), "cleanup-runtime.foreground-team");
 		ctx.foregroundTeamRunControllers.clear();
 		// RC-01: stop the foreground-run watchdog timers on full shutdown — they were
 		// never cleared, so an active (non-terminal) foreground run left its watchdog
@@ -219,10 +221,26 @@ function buildStopSessionBoundSubagents(ctx: RegistrationContext): () => void {
 		// Only abort subagent controllers — NOT foreground team runs.
 		// Foreground team runs are bound to the session lifecycle; they will be aborted
 		// by cleanupRuntime during session_shutdown.
-		for (const controller of ctx.foregroundControllers.values()) controller.abort();
+		// safe-abort: these signals may be linked to spawned children (pipelines pass
+		// them into spawn options.signal); aborting after a child exited makes Node's
+		// child_process listener throw AbortError synchronously — inside a session
+		// event handler that would surface as uncaughtException and kill pi.
+		safeAbortAll(ctx.foregroundControllers.values(), "stop-session-bound.foreground");
 		ctx.foregroundControllers.clear();
-		ctx.subagentManager.abortAll("Session switching — foreground subagents cancelled.");
-		terminateActiveChildPiProcesses();
+		try {
+			ctx.subagentManager.abortAll("Session switching — foreground subagents cancelled.");
+		} catch (error) {
+			logInternalError("stop-session-bound.abortAll", error);
+		}
+		// Deliberately NOT terminateActiveChildPiProcesses() here: the active
+		// child registry holds EVERY child pi spawned in this process —
+		// including foreground team-run workers. Killing them on a session
+		// switch (resume/new/fork) is exactly the regression "jumping into any
+		// session stops the run" (exit 143). Session-bound subagents are
+		// cancelled above via their own controllers; foreground runs must
+		// survive switches (P0) and are aborted only by cleanupRuntime on real
+		// shutdown; the process-exit hook (tryRegisterSessionCleanup) drains
+		// the registry when pi actually exits.
 		ctx.disposeRenderSchedulerSubscriptions();
 		ctx.renderScheduler?.dispose();
 		ctx.renderScheduler = undefined;

package/src/extension/registration/team-tool.ts

@@ -13,6 +13,7 @@ import type { createRunSnapshotCache } from "../../ui/run-snapshot-cache.ts";
 import { statusIcon, type ToolRenderContext, teamToolRenderer } from "../../ui/tool-renderers/index.ts";
 import type { CrewWidgetState } from "../../ui/widget/index.ts";
 import { updateCrewWidget } from "../../ui/widget/index.ts";
+import { safeAbort } from "../../utils/safe-abort.ts";
 import { resolveRealContainedPath } from "../../utils/safe-paths.ts";
 // Team tool handler — lazy-loaded because team-tool.ts imports many modules
 import type { handleTeamTool as HandleTeamToolFn } from "../team-tool.ts";
@@ -146,6 +147,52 @@ export function detectUnrecognizedParams(schema: TObject, params: unknown): stri
 	].join("\n");
 }
 
+// PERF (2026-08-24): cheap read actions (status/summary/events/get/list) re-rendered
+// the widget + powerbar after every call; the event bus and render tick already
+// reflect run-state changes. Refresh only on actions that mutate run state
+// outside the watched files. Names mirror the five domain dispatcher tables in
+// src/schema/team-tool-schema.ts (RUN/STATUS/CONTROL/MANAGE/AUTOMATE). Actions
+// whose effect depends on sub-params (api: approve-plan/agent-control/mailbox;
+// plans: approve/reject; anchor/auto-summarize/auto_boomerang: set/clear/toggle;
+// config/autonomy: show vs write) are included — a redundant refresh on their
+// read sub-actions is cheap, a missed refresh after a write leaves stale UI.
+const MUTATING_ACTIONS = new Set([
+	// run domain
+	"run",
+	"parallel",
+	"orchestrate",
+	"resume",
+	"retry",
+	"steer",
+	"goal",
+	"plans",
+	// control domain
+	"cancel",
+	"invalidate",
+	"respond",
+	"cleanup",
+	"prune",
+	"forget",
+	// manage domain
+	"create",
+	"update",
+	"delete",
+	"init",
+	"config",
+	"autonomy",
+	"settings",
+	"workflow-create",
+	"workflow-save",
+	"workflow-delete",
+	"import",
+	// automate domain
+	"schedule",
+	"anchor",
+	"auto-summarize",
+	"auto_boomerang",
+	"api",
+]);
+
 export function registerTeamTool(pi: ExtensionAPI, deps: RegisterTeamToolDeps): void {
 	const tool: ToolDefinition = {
 		name: "team",
@@ -174,7 +221,10 @@ export function registerTeamTool(pi: ExtensionAPI, deps: RegisterTeamToolDeps):
 			const controller = new AbortController();
 			const toolKey = Symbol();
 			deps.foregroundControllers.set(toolKey, controller);
-			const abort = (): void => controller.abort();
+			// safe-abort: pi's tool-call abort can race a completed run whose
+			// spawned children already exited — Node's child_process signal
+			// listener throws AbortError out of abort() and kills the host.
+			const abort = (): void => safeAbort(controller, "team-tool.caller-abort");
 			signal?.addEventListener("abort", abort, { once: true });
 			const stopProgress = startTeamToolProgressBinder(onUpdate as OnUpdate | undefined);
 			try {
@@ -225,11 +275,13 @@ export function registerTeamTool(pi: ExtensionAPI, deps: RegisterTeamToolDeps):
 						timestamp: Date.now(),
 					});
 				}
-				const config = loadConfig(toolCtx.cwd).config.ui;
-				const cache = deps.getManifestCache(toolCtx.cwd);
-				const snapshotCache = deps.getRunSnapshotCache?.(toolCtx.cwd);
-				updateCrewWidget(toolCtx, deps.widgetState, config, cache, snapshotCache);
-				updatePiCrewPowerbar(pi.events, toolCtx.cwd, config, cache, snapshotCache, toolCtx);
+				if (MUTATING_ACTIONS.has(resolved.action ?? "list")) {
+					const config = loadConfig(toolCtx.cwd).config.ui;
+					const cache = deps.getManifestCache(toolCtx.cwd);
+					const snapshotCache = deps.getRunSnapshotCache?.(toolCtx.cwd);
+					updateCrewWidget(toolCtx, deps.widgetState, config, cache, snapshotCache);
+					updatePiCrewPowerbar(pi.events, toolCtx.cwd, config, cache, snapshotCache, toolCtx);
+				}
 				return output;
 			} finally {
 				signal?.removeEventListener("abort", abort);

package/src/extension/registration/ui.ts

@@ -15,7 +15,7 @@ import type { ExtensionAPI, ExtensionContext } from "@earendil-works/pi-coding-a
 import { loadConfig } from "../../config/config.ts";
 import { DEFAULT_UI } from "../../config/defaults.ts";
 import type { LiveRunSidebar as LiveRunSidebarType } from "../../ui/live-run-sidebar.ts";
-import { requestRender, setExtensionWidget, showCustom } from "../../ui/pi-ui-compat.ts";
+import { requestRender, setExtensionWidget, showCustom, toPiWidgetPlacement } from "../../ui/pi-ui-compat.ts";
 import {
 	clearPiCrewPowerbar,
 	registerPiCrewPowerbarSegments,
@@ -76,10 +76,11 @@ export async function installLiveSidebar(ctx: ExtensionContext, runId: string, s
 	state.liveSidebarRunId = runId;
 	state.dashboardOpened = true;
 	const widgetPlacement = uiConfig?.widgetPlacement ?? DEFAULT_UI.widgetPlacement;
-	setExtensionWidget(ctx, "pi-crew", undefined, { placement: widgetPlacement });
-	setExtensionWidget(ctx, "pi-crew-active", undefined, { placement: widgetPlacement });
+	const placement = toPiWidgetPlacement(widgetPlacement);
+	setExtensionWidget(ctx, "pi-crew", undefined, { placement });
+	setExtensionWidget(ctx, "pi-crew-active", undefined, { placement });
 	deps.widgetState.lastVisibility = "hidden";
-	deps.widgetState.lastPlacement = widgetPlacement;
+	deps.widgetState.lastPlacement = placement;
 	deps.widgetState.lastKey = "pi-crew-active";
 	deps.widgetState.model = undefined;
 	const width = Math.min(90, Math.max(40, uiConfig?.dashboardWidth ?? DEFAULT_UI.dashboardWidth));