pi-crew 0.10.5 → 0.11.0

package/skills/resource-discovery-config/SKILL.md

@@ -1,6 +1,9 @@
 ---
 name: resource-discovery-config
-description: "pi-crew resource and configuration discovery workflow."
+description: >
+  pi-crew resource and configuration discovery workflow.
+  When NOT to use: runtime state questions (use runtime-state-reader); model-specific config (use model-routing-context).
+
 origin: pi-crew
 triggers:
   - "discover agents"
@@ -58,3 +61,9 @@ node --experimental-strip-types --test test/unit/config-schema-validation.test.t
 npm test
 npm pack --dry-run
 ```
+
+## Self-restraint
+
+"Creating nothing is a valid result." If the evidence does not support a meaningful change, say so explicitly rather than inventing one. The next attempt may find stronger evidence; an invented change now damages trust in every future report.
+
+"Creating nothing" here means the current discovery already finds what consumers need. Registering resources nobody uses pollutes the discovery surface and slows every lookup.

package/skills/runtime-state-reader/SKILL.md

@@ -1,6 +1,9 @@
 ---
 name: runtime-state-reader
-description: Safe read-only navigation of pi-crew run state.
+description: >
+  Safe read-only navigation of pi-crew run state.
+  When NOT to use: write actions or mutations (use state-mutation-locking); configuration changes (use resource-discovery-config).
+
 origin: pi-crew
 triggers:
   - "inspect manifest"

package/skills/safe-bash/SKILL.md

@@ -1,6 +1,9 @@
 ---
 name: safe-bash
-description: "Safe shell-command workflow."
+description: >
+  Safe shell-command workflow.
+  When NOT to use: subprocess orchestration (use child-pi-spawning); destructive operations without sandbox (use ownership-session-security).
+
 origin: pi-crew
 triggers:
   - "run this command"

package/skills/scrutinize/SKILL.md

@@ -1,6 +1,9 @@
 ---
 name: scrutinize
-description: "Outsider-perspective review questioning intent before tracing code."
+description: >
+  Outsider-perspective review questioning intent before tracing code.
+  When NOT to use: implementation work (use systematic-debugging); trivial one-line fixes that don't warrant outsider review.
+
 origin: pi-crew
 triggers:
   - "scrutinize this"
@@ -84,3 +87,23 @@ If ANY answer is NO → Stop. Complete scrutiny requirements before reporting.
 - **One simpler-alternative pass is MANDATORY.** Skip only if user says "don't question scope."
 - **Distinguish claim from verification.** "The PR says X" and "I traced X and confirmed" are different.
 - **No flattery, no hedging.** State the finding.
+
+## Budget
+
+This skill applies a 3-attempt budget: 1 initial + max 2 re-attempts.
+
+Stamp every invocation:
+
+```
+attempt X of 3 (Y attempts remaining)
+```
+
+An attempt is one full outsider-perspective review pass. Re-attempt when the review uncovers intent-level questions that change the approach.
+
+Re-attempts only when the previous attempt materially changes the decision or risk. Do NOT spend a re-attempt on mechanical changes or already-resolved findings. When exhausted, escalate to the user with options (accept risk / change scope / exceptional budget).
+
+## Self-restraint
+
+"Creating nothing is a valid result." If the evidence does not support a meaningful change, say so explicitly rather than inventing one. The next attempt may find stronger evidence; an invented change now damages trust in every future report.
+
+"Creating nothing" here means concluding the intent was sound and the approach justified — no findings needed. An invented finding to justify the review round damages trust in every future review.

package/skills/secure-agent-orchestration-review/SKILL.md

@@ -1,6 +1,9 @@
 ---
 name: secure-agent-orchestration-review
-description: "Use when reviewing delegation, skill loading, tool access, worker prompts, artifacts, runtime config, state, ownership, or subprocess execution."
+description: >
+  Use when reviewing delegation, skill loading, tool access, worker prompts, artifacts, runtime config, state, ownership, or subprocess execution.
+  When NOT to use: pure code quality issues without security implications (use multi-perspective-review); single-file fixes (use scrutinize).
+
 origin: pi-crew
 triggers:
   - "review delegation"

package/skills/state-mutation-locking/SKILL.md

@@ -1,6 +1,9 @@
 ---
 name: state-mutation-locking
-description: "Durable state mutation and locking workflow."
+description: >
+  Durable state mutation and locking workflow.
+  When NOT to use: read-only inspection (use runtime-state-reader); single-process non-concurrent edits.
+
 origin: pi-crew
 triggers:
   - "modify manifest"

package/skills/systematic-debugging/SKILL.md

@@ -1,6 +1,9 @@
 ---
 name: systematic-debugging
-description: "Four-phase debugging discipline with refuse gates."
+description: >
+  Four-phase debugging discipline with refuse gates.
+  When NOT to use: trivial fixes where root cause is obvious; production incidents needing immediate rollback (use post-mortem after).
+
 origin: pi-crew
 triggers:
   - "debug this"

package/skills/verification-before-done/SKILL.md

@@ -1,6 +1,9 @@
 ---
 name: verification-before-done
-description: "Evidence before claims."
+description: >
+  Evidence before claims.
+  When NOT to use: mid-task self-correction (use scrutinize); pure execution tasks where output IS evidence.
+
 origin: pi-crew
 triggers:
   - "done"
@@ -80,3 +83,17 @@ Stop before saying done if you are using words like "should", "probably", "looks
 - **Don't** use fuzzy language like "seems", "probably", "looks like"
 - **Don't** skip providing verification commands for claims
 - **Don't** claim done if you're still using hypotheses instead of evidence
+
+## Budget
+
+This skill applies a 3-attempt budget: 1 initial + max 2 re-attempts.
+
+Stamp every invocation:
+
+```
+attempt X of 3 (Y attempts remaining)
+```
+
+An attempt is one fresh verification run (identify command → run → read output → compare to claim). Re-attempt when output contradicts the claim or reveals a new failure mode.
+
+Re-attempts only when the previous attempt materially changes the decision or risk. Do NOT spend a re-attempt on mechanical changes or already-resolved findings. When exhausted, escalate to the user with options (accept risk / change scope / exceptional budget).

package/skills/widget-rendering/SKILL.md

@@ -1,6 +1,9 @@
 ---
 name: widget-rendering
-description: "Pi TUI crew widget data sources, display priority, and rendering performance."
+description: >
+  Pi TUI crew widget data sources, display priority, and rendering performance.
+  When NOT to use: non-TUI displays; backend data sources without widget context (use runtime-state-reader).
+
 origin: pi-crew
 triggers:
   - "empty agent"

package/skills/workspace-isolation/SKILL.md

@@ -1,6 +1,9 @@
 ---
 name: workspace-isolation
-description: "Workspace isolation boundaries."
+description: >
+  Workspace isolation boundaries.
+  When NOT to use: concurrent edits within same repo (use worktree-isolation); non-git projects.
+
 origin: pi-crew
 triggers:
   - "workspace isolation"

package/skills/worktree-isolation/SKILL.md

@@ -1,6 +1,9 @@
 ---
 name: worktree-isolation
-description: "Conflict-safe git worktree workflow."
+description: >
+  Conflict-safe git worktree workflow.
+  When NOT to use: non-git changes (use direct edit); single-commit patches (use git-master).
+
 origin: pi-crew
 triggers:
   - "create worktree"

package/src/config/config-validation.ts

@@ -640,6 +640,7 @@ function parseReliabilityConfig(value: unknown): CrewReliabilityConfig | undefin
 		forcePreflight: parseWithSchema(Type.Boolean(), obj.forcePreflight),
 		ambientStatusInjection: parseWithSchema(Type.Boolean(), obj.ambientStatusInjection),
 		perWriteValidation: parseWithSchema(Type.Boolean(), obj.perWriteValidation),
+		loopGuard: parseWithSchema(Type.Boolean(), obj.loopGuard),
 		scopeModels: parseWithSchema(Type.Boolean(), obj.scopeModels),
 	};
 	return Object.values(reliability).some((entry) => entry !== undefined) ? reliability : undefined;

package/src/config/types.ts

@@ -274,6 +274,14 @@ export interface CrewReliabilityConfig {
 	 * Set to `false` to disable.
 	 */
 	perWriteValidation?: boolean;
+	/**
+	 * Tool loop guard (ARCH-1). Warns at 3 consecutive identical tool results
+	 * (identical args + byte-identical output) and hard-blocks read-only file
+	 * tools (read/grep/glob/find/ls) at 5 — the model-side infinite-loop
+	 * failure mode. `ask` repeats within a turn are warned at 2 and the 3rd
+	 * call refused. Default: true (opt-out). Set to `false` to disable.
+	 */
+	loopGuard?: boolean;
 	/**
 	 * Opt-in model scope enforcement (F7). When true, subagent model choices
 	 * that fall outside the user's pi `enabledModels` allowlist are flagged:

package/src/errors.ts

@@ -64,7 +64,7 @@ const DEFAULT_HELP: Record<ErrorCode, string | undefined> = {
 	[ErrorCode.RunStale]:
 		"The worker stopped heartbeating and was treated as a zombie. Re-run the team (resume or fresh); if it recurs, check `runtime.executeWorkers` / system load.",
 	[ErrorCode.ModelOutOfScope]:
-		"The requested model is not in your pi `enabledModels` allowlist. Either pick a model listed in `enabledModels` (settings.json) or extend the allowlist. The scope gate is opt-in — disable `runtime.reliability.scopeModels` to allow any model.",
+		"The requested model is not in your pi `enabledModels` allowlist. Either pick a model listed in `enabledModels` (settings.json) or extend the allowlist. The scope gate is opt-in — disable `reliability.scopeModels` to allow any model.",
 };
 
 /**

package/src/extension/context-status-injection.ts

@@ -28,7 +28,7 @@
  * - `emitContext` already wraps handlers in try/catch and emits errors instead
  *   of crashing the loop (Pi `runner.ts:933`), so a throw here can't break the
  *   agent — but we also guard defensively.
- * - Opt-out: `runtime.reliability.ambientStatusInjection: false` in config.
+ * - Opt-out: `reliability.ambientStatusInjection: false` in config.
  */
 
 import type { AgentMessage } from "@earendil-works/pi-agent-core";
@@ -163,7 +163,7 @@ export function handleContextEvent(event: ContextEvent, cwd: string, sessionId?:
  * Register the ambient-status `context` event handler. Reads the project cwd
  * from the session context on each call (crew state is per-project).
  *
- * Pass `enabled: false` (from `runtime.reliability.ambientStatusInjection`) to
+ * Pass `enabled: false` (from `reliability.ambientStatusInjection`) to
  * disable the feature without unwiring the handler.
  */
 export function registerContextStatusInjection(pi: ExtensionAPI, opts: { enabled?: boolean } = {}): void {

package/src/extension/crew-input-router.ts

@@ -34,6 +34,8 @@ export const CREW_PHRASES: ReadonlyArray<{ phrase: string; command: string }> =
 	{ phrase: "crew commands", command: "/team-help" },
 	{ phrase: "crew doctor", command: "/team-doctor" },
 	{ phrase: "crew diagnose", command: "/team-doctor" },
+	{ phrase: "crew schedule", command: "/schedules" },
+	{ phrase: "scheduled jobs", command: "/schedules" },
 	{ phrase: "teams", command: "/teams" },
 ];
 

package/src/extension/crew-vibes/config.ts

@@ -4,12 +4,11 @@ import { getCrewEnv } from "../../config/env-vars.ts";
 import { hasCrewFontFile, isWebTerminal } from "./font-detect.ts";
 
 /**
- * Self-contained config for the crew-vibes module (speed + capacity meters).
+ * Self-contained config for the crew-vibes module (provider quota).
  * Stored in its own JSON file so it never touches the strict typebox schema
  * used by the rest of pi-crew.
  */
 
-export const SPEED_STATUS_ID = "pi-crew-speed";
 export const CAPACITY_STATUS_ID = "pi-crew-bar";
 export const PROVIDER_STATUS_ID = "pi-crew-bar";
 
@@ -23,21 +22,6 @@ export function configPath(): string {
 
 export type TokenDisplay = "off" | "tokens" | "percentage";
 
-export interface SpeedConfig {
-	enabled: boolean;
-	footer: boolean;
-	indicator: boolean;
-	label: string;
-	renderIntervalMs: number;
-	slidingWindowMs: number;
-	minReliableDurationMs: number;
-	maxDisplayTokS: number;
-	defaultIntervalMs: number;
-	minIntervalMs: number;
-	maxIntervalMs: number;
-	scale: number;
-}
-
 export interface CapacityConfig {
 	enabled: boolean;
 	tokenDisplay: TokenDisplay;
@@ -51,26 +35,11 @@ export interface CapacityConfig {
 
 export interface CrewVibesConfig {
 	enabled: boolean;
-	speed: SpeedConfig;
 	capacity: CapacityConfig;
 }
 
 export const DEFAULT_CONFIG: CrewVibesConfig = {
 	enabled: true,
-	speed: {
-		enabled: true,
-		footer: false,
-		indicator: true,
-		label: "tok/s",
-		renderIntervalMs: 250,
-		slidingWindowMs: 1000,
-		minReliableDurationMs: 1000,
-		maxDisplayTokS: 500,
-		defaultIntervalMs: 167,
-		minIntervalMs: 50,
-		maxIntervalMs: 250,
-		scale: 6000,
-	},
 	capacity: {
 		enabled: true,
 		tokenDisplay: "tokens",
@@ -133,29 +102,6 @@ function tokenDisplayFrom(raw: unknown, fallback: TokenDisplay): TokenDisplay {
 	return raw === "off" || raw === "tokens" || raw === "percentage" ? raw : fallback;
 }
 
-function normalizeSpeed(raw: unknown): SpeedConfig {
-	const input = asRecord(raw);
-	const speed: SpeedConfig = {
-		enabled: boolFrom(input.enabled, DEFAULT_CONFIG.speed.enabled),
-		footer: boolFrom(input.footer, DEFAULT_CONFIG.speed.footer),
-		indicator: boolFrom(input.indicator, DEFAULT_CONFIG.speed.indicator),
-		label: stringFrom(input.label, DEFAULT_CONFIG.speed.label),
-		renderIntervalMs: positiveFrom(input.renderIntervalMs, DEFAULT_CONFIG.speed.renderIntervalMs),
-		slidingWindowMs: positiveFrom(input.slidingWindowMs, DEFAULT_CONFIG.speed.slidingWindowMs),
-		minReliableDurationMs: positiveFrom(input.minReliableDurationMs, DEFAULT_CONFIG.speed.minReliableDurationMs),
-		maxDisplayTokS: positiveFrom(input.maxDisplayTokS, DEFAULT_CONFIG.speed.maxDisplayTokS),
-		defaultIntervalMs: positiveFrom(input.defaultIntervalMs, DEFAULT_CONFIG.speed.defaultIntervalMs),
-		minIntervalMs: positiveFrom(input.minIntervalMs, DEFAULT_CONFIG.speed.minIntervalMs),
-		maxIntervalMs: positiveFrom(input.maxIntervalMs, DEFAULT_CONFIG.speed.maxIntervalMs),
-		scale: positiveFrom(input.scale, DEFAULT_CONFIG.speed.scale),
-	};
-	if (speed.minIntervalMs > speed.maxIntervalMs) {
-		speed.minIntervalMs = DEFAULT_CONFIG.speed.minIntervalMs;
-		speed.maxIntervalMs = DEFAULT_CONFIG.speed.maxIntervalMs;
-	}
-	return speed;
-}
-
 function normalizeCapacity(raw: unknown): CapacityConfig {
 	const input = asRecord(raw);
 	return {
@@ -174,7 +120,6 @@ export function normalizeConfig(raw: unknown): CrewVibesConfig {
 	const input = asRecord(raw);
 	return {
 		enabled: boolFrom(input.enabled, DEFAULT_CONFIG.enabled),
-		speed: normalizeSpeed(input.speed),
 		capacity: normalizeCapacity(input.capacity),
 	};
 }

package/src/extension/crew-vibes/figures.ts

@@ -1,91 +1,12 @@
-import type { SpeedConfig } from "./config.ts";
-import { hasCrewFontFile, isWebTerminal } from "./font-detect.ts";
-
 /**
- * Crew figures replacing the original cat glyphs from pi-speeed / pi-chonk.
- *
- * The working indicator uses braille spinner characters by default — the
- * same characters pi uses for its built-in loading animation (loaders.ts
- * DEFAULT_FRAMES).  These render on ANY terminal with basic Unicode support,
- * no custom font required.
+ * Capacity-stage helpers (shared by renderCapacity, which remains exported
+ * for its unit tests after the footer retirement).
  *
- * PUA glyphs (U+E700..U+E70F) from the bundled crew-vibes.ttf font are
- * available as an opt-in alternative (set speed.indicatorStyle = "pua" in
- * config).  Requires the font to be installed via `npm run install:crew-font`
- * AND a terminal that renders Private Use Area codepoints.
+ * The speed-UI parts of this module (braille/PUA spinner frames,
+ * intervalForSpeed) were REMOVED with the tok/s speed UI (maintainer
+ * decision 2026-09-14) — pi's built-in working indicator is always used.
  */
 
-// ── Braille spinner frames (web terminal fallback) ───────────────────
-// Standard Unicode braille spinner — same characters pi uses for its
-// built-in loading animation.  Renders on ANY terminal.
-const BRAILLE_FRAMES: readonly string[] = [
-	"\u280B ", // ⠋
-	"\u2819 ", // ⠙
-	"\u2839 ", // ⠹
-	"\u2838 ", // ⠸
-	"\u283C ", // ⠼
-	"\u2834 ", // ⠴
-	"\u2826 ", // ⠦
-	"\u2827 ", // ⠧
-	"\u2807 ", // ⠇
-	"\u280F ", // ⠏
-] as const;
-
-// ── PUA runner frames (opt-in) ────────────────────────────────────────
-// 16 runner poses from the bundled crew-vibes.ttf font.  Only usable when
-// the font is installed AND the terminal renders PUA codepoints correctly.
-// Each frame is one glyph + trailing space for constant 2-cell width.
-const PUA_CREW_FRAMES: readonly string[] = [
-	"\uE700 ",
-	"\uE701 ",
-	"\uE702 ",
-	"\uE703 ",
-	"\uE704 ",
-	"\uE705 ",
-	"\uE706 ",
-	"\uE707 ",
-	"\uE708 ",
-	"\uE709 ",
-	"\uE70A ",
-	"\uE70B ",
-	"\uE70C ",
-	"\uE70D ",
-	"\uE70E ",
-	"\uE70F ",
-] as const;
-
-/**
- * Return the indicator frames for the given style.
- *
- * Default is `"braille"` — standard Unicode braille spinner (⠋⠙⠹⠸⠼⠴⠦⠧⠇⠏)
- * that renders correctly on every terminal, every platform, with zero
- * font dependency. PUA runner-glyphs require crew-vibes.ttf installed AND
- * a terminal that does font fallback for Private Use Area codepoints —
- * Windows Terminal does NOT do this reliably, showing garbage chars even
- * with the font installed.
- *
- * To opt into the PUA runner look, pass `style: "pua"` explicitly.
- */
-export function crewFrames(style: "braille" | "pua" = "braille"): readonly string[] {
-	// Even when explicitly requested, fall back to braille if the font is
-	// missing or we're on a web terminal (which can't render PUA at all).
-	if (style === "pua" && (isWebTerminal() || !hasCrewFontFile())) return BRAILLE_FRAMES;
-	return style === "pua" ? PUA_CREW_FRAMES : BRAILLE_FRAMES;
-}
-
-// Re-export PUA frames for backward compatibility and direct consumers.
-export const RUN_CREW_FRAMES = PUA_CREW_FRAMES;
-
-/**
- * Map a tok/s reading to a working-indicator frame interval in ms.
- * Ported from pi-speeed's runcatInterval: interval = scale / speed, clamped
- * to [min, max]. A null/zero speed falls back to the default (idle) cadence.
- */
-export function intervalForSpeed(config: SpeedConfig, speed: number | null): number {
-	if (speed === null || !Number.isFinite(speed) || speed <= 0) return config.defaultIntervalMs;
-	return Math.max(config.minIntervalMs, Math.min(config.maxIntervalMs, Math.round(config.scale / speed)));
-}
-
 /**
  * Pick the capacity stage index (0..levels-1) for a context-fill percent.
  * Ported from pi-chonk's chonkIndex.

package/src/extension/crew-vibes/font-detect.ts

@@ -8,7 +8,7 @@ import { join } from "node:path";
  * guarantee the terminal can render PUA glyphs (many terminals have their
  * own font stacks).  For reliable animation, braille fallback frames are
  * used by default; PUA frames are only activated when the user explicitly
- * enables them via config (speed.indicatorStyle = "pua").
+ * (used by the capacity icons).
  */
 
 function fontPath(): string {