pi-crew 0.11.0 → 0.11.2

package/src/prompt/prompt-runtime.ts

@@ -82,7 +82,11 @@ const SEEN_STEER_ID_CAP = 1024;
  * Factory-shaped so multiple prompt-runtime instances (tests, parallel
  * workers) get independent sets.
  */
-export function createSeenSteerIdSet(): { markOrSkip: (id?: string) => boolean; size: () => number } {
+export function createSeenSteerIdSet(): {
+	markOrSkip: (id?: string) => boolean;
+	unmark: (id?: string) => void;
+	size: () => number;
+} {
 	const seen: string[] = [];
 	const set = new Set<string>();
 	return {
@@ -98,6 +102,15 @@ export function createSeenSteerIdSet(): { markOrSkip: (id?: string) => boolean;
 			}
 			return true;
 		},
+		unmark(id?: string): void {
+			// F-L2: a steer whose DELIVERY failed must release its dedup mark so
+			// the retry (after the poll's offset rewind) is not skipped as a
+			// duplicate — that would silently drop the steer instead.
+			if (id === undefined) return;
+			if (!set.delete(id)) return;
+			const idx = seen.indexOf(id);
+			if (idx !== -1) seen.splice(idx, 1);
+		},
 		size: () => set.size,
 	};
 }
@@ -861,42 +874,80 @@ export default function registerPiTeamsPromptRuntime(pi: ExtensionAPI): void {
 					try {
 						const buf = Buffer.alloc(stat.size - lastOffset);
 						fs.readSync(fd, buf, 0, buf.length, lastOffset);
-						lastOffset = stat.size;
-						const lines = buf.toString("utf8").split("\n").filter(Boolean);
-						for (const line of lines) {
+						const offsetBefore = lastOffset;
+						let cursor = 0;
+						// F-L2 (live battery 2026-09-21, run team_20260921035840): a steer
+						// written while the extension is still LOADING makes pi.sendMessage
+						// throw ("Extension runtime not initialized" — pi's loader gates
+						// action methods until bindExtensions). The old code advanced
+						// lastOffset to stat.size BEFORE the line loop and its per-line
+						// catch swallowed that throw as "malformed line" — the entry was
+						// then silently lost forever (the offset was already past it).
+						// Walk the buffer by byte offset and advance only past lines with
+						// a terminal verdict (delivered / non-steer / rejected / malformed);
+						// a DELIVERY failure rewinds to the failing line's start so the
+						// next tick re-reads it (with its dedup id unmarked).
+						while (cursor < buf.length) {
+							const nl = buf.indexOf(10, cursor);
+							const end = nl === -1 ? buf.length : nl;
+							const line = buf.subarray(cursor, end).toString("utf8");
+							if (line.length === 0) {
+								cursor = end + 1;
+								continue;
+							}
 							try {
 								const entry = JSON.parse(line) as SteerEntry;
-								if (entry.type !== "steer") continue;
-								// FIX-S1: cross-channel dedup. The broker writes the
-								// same steer to both the mailbox (live fanout via the
-								// onSteer callback below) and this JSONL file. A
-								// connected worker receives it via the broker first
-								// and via this poll second; the seen-id set ensures
-								// only the first arrival reaches pi.sendMessage.
-								const entryId =
-									typeof (entry as { id?: unknown }).id === "string" ? (entry as { id: string }).id : undefined;
-								if (!seenSteers.markOrSkip(entryId)) continue;
-								// FIX-02: sanitize each steer entry before forwarding
-								// to pi.sendMessage. Reject oversized payloads,
-								// excessive newlines, and control characters.
-								const sanitized = sanitizeSteerMessage(entry);
-								if (!sanitized.valid || sanitized.message === undefined) {
-									logInternalError(
-										"prompt-runtime.steer-rejected",
-										new Error(sanitized.reason ?? "steer-sanitization-failed"),
-										`line-preview=${line.slice(0, 64)}`,
-										"warn",
-									);
-									continue;
+								if (entry.type === "steer") {
+									// FIX-S1: cross-channel dedup. The broker writes the
+									// same steer to both the mailbox (live fanout via the
+									// onSteer callback below) and this JSONL file. A
+									// connected worker receives it via the broker first
+									// and via this poll second; the seen-id set ensures
+									// only the first arrival reaches pi.sendMessage.
+									const entryId =
+										typeof (entry as { id?: unknown }).id === "string" ? (entry as { id: string }).id : undefined;
+									if (seenSteers.markOrSkip(entryId)) {
+										// FIX-02: sanitize each steer entry before forwarding
+										// to pi.sendMessage. Reject oversized payloads,
+										// excessive newlines, and control characters.
+										const sanitized = sanitizeSteerMessage(entry);
+										if (sanitized.valid && sanitized.message !== undefined) {
+											try {
+												pi.sendMessage(
+													{ customType: "crew-steer", content: sanitized.message, display: false },
+													{ deliverAs: "steer" },
+												);
+											} catch (sendErr) {
+												// Delivery failed (e.g. pre-bind notInitialized).
+												// Release the dedup mark so the retry after the
+												// offset rewind is not skipped as a duplicate, then
+												// rewind: cursor stays at this line's start so the
+												// next tick re-reads the entry.
+												seenSteers.unmark(entryId);
+												logInternalError(
+													"prompt-runtime.steer-delivery-failed",
+													sendErr instanceof Error ? sendErr : new Error(String(sendErr)),
+													`line-preview=${line.slice(0, 64)}`,
+													"warn",
+												);
+												break;
+											}
+										} else {
+											logInternalError(
+												"prompt-runtime.steer-rejected",
+												new Error(sanitized.reason ?? "steer-sanitization-failed"),
+												`line-preview=${line.slice(0, 64)}`,
+												"warn",
+											);
+										}
+									}
 								}
-								pi.sendMessage(
-									{ customType: "crew-steer", content: sanitized.message, display: false },
-									{ deliverAs: "steer" },
-								);
 							} catch {
-								// Malformed line — skip
+								// Malformed line — skip (terminal verdict — advance past)
 							}
+							cursor = end + 1;
 						}
+						lastOffset = offsetBefore + Math.min(cursor, buf.length);
 					} finally {
 						try {
 							fs.closeSync(fd);

package/src/prompt/worker-events-channel.ts

@@ -107,6 +107,18 @@ export function createWorkerEventsChannel(options: WorkerEventsChannelOptions =
 	const write = (item: { type: string; data: Record<string, unknown>; droppedSinceLast: number }): boolean => {
 		try {
 			appendEvent(eventsPath as string, {
+				// TeamEvent contract: `time` (ISO string) is REQUIRED — the import
+				// bundle validator (run-bundle-schema.ts validateEvent) rejects the
+				// whole bundle when any event lacks it, and event readers sort by it.
+				// The channel's default appender is a raw O_APPEND writer (NOT
+				// event-log.ts appendEvent, which stamps time itself), so the stamp
+				// must happen HERE — once, at the single choke point both emit()
+				// and emitTerminal() pass through. Found live 2026-09-21: every
+				// worker.started/completed of a tmux-surface run was written
+				// time-less, and exporting that run produced an un-importable bundle
+				// ("events[i].time must be a string"). Uses the injected clock so
+				// tests stay deterministic.
+				time: new Date(now()).toISOString(),
 				type: item.type,
 				runId,
 				taskId,

package/src/runtime/README.md

@@ -32,4 +32,4 @@ clusters are extracted into subdirectories; the remaining files stay at the root
 - **observability** — `effectiveness.ts`, `agent-observability.ts`, `command-trace.ts`
 - **misc** — `stale-reconciler.ts`, `parent-guard.ts`, `manifest-cache.ts`, `event-stream-bridge.ts`, `policy-engine.ts`, `role-permission.ts`, `workspace-lock.ts`, `workspace-tree.ts`, `session-*.ts`, ...
 
-See `docs/COVERAGE-ASSESSMENT-2026-08-01.md` § "Source reorganization" for the reorg history + remaining-cluster plan.
+See `docs/archive/COVERAGE-ASSESSMENT-2026-08-01.md` § "Source reorganization" for the reorg history + remaining-cluster plan.

package/src/runtime/async-runner.ts

@@ -209,6 +209,9 @@ export const BACKGROUND_RUNNER_ENV_ALLOWLIST: string[] = [
 	"PI_TEAMS_PI_BIN",
 	"PI_TEAMS_MOCK_CHILD_PI",
 	"PI_CREW_ALLOW_MOCK",
+	// Entry guard for the detached runner main() (background-runner.ts skips main()
+	// on plain imports — the inline async test seam lazy-imports it).
+	"PI_CREW_BACKGROUND_RUNNER_ENTRY",
 	// Phase 1.5: worker-thread atomic writer opt-in (RFC 15).
 	"PI_CREW_WORKER_ATOMIC_WRITER",
 	"PI_TEAMS_WORKER_ATOMIC_WRITER",
@@ -262,7 +265,87 @@ export function buildBrokerStdinLine(runId: string, socketPath: string, tasks: R
 	return `${JSON.stringify({ v: 2, runId, socketPath, tasks })}\n`;
 }
 
+/**
+ * IN-PROCESS ASYNC TEST SEAM (kills two classes of test pain):
+ *  1. Windows Defender first-spawn stall — CI ground truth (run 36093514388
+ *     attempt 3): the detached background-runner spawn stalled >300s with the
+ *     task left "queued" while the event loop stayed healthy. No second
+ *     process to come up = no per-file-hash AV scan inside a test deadline.
+ *  2. Orphan-tmpdir leak — a detached runner survives the test's rmSync and
+ *     keeps writing run state into a deleted tree (source of the ~3.4k
+ *     pi-crew-* debris, 2026-09-26 triage). In-process, the run dies with the
+ *     test process.
+ *
+ * Gated by BOTH PI_CREW_TEST_ASYNC_INLINE=1 AND the existing test-fixture
+ * gate PI_CREW_ALLOW_MOCK=1 (defense-in-depth: production never sets either).
+ * The inline host reuses background-runner's executeBackgroundRun core —
+ * same code path as the detached runner, no drift.
+ */
+export function isInlineAsyncTestSeamActive(): boolean {
+	return getCrewEnv("PI_CREW_TEST_ASYNC_INLINE") === "1" && getCrewEnv("PI_CREW_ALLOW_MOCK") === "1";
+}
+
+async function runInlineBackgroundTeamRun(manifest: TeamRunManifest, logPath: string): Promise<SpawnBackgroundTeamRunResult> {
+	const log = (message: string): void => {
+		try {
+			fs.appendFileSync(logPath, `${message}\n`, "utf-8");
+		} catch {
+			/* best-effort */
+		}
+	};
+	log(`[pi-crew] inline test seam: executing run ${manifest.runId} in-process (no detached runner) pid=${process.pid}`);
+	await appendEventAsync(manifest.eventsPath, {
+		type: "async.spawned",
+		runId: manifest.runId,
+		data: { pid: process.pid, logPath, inline: true },
+	});
+	// Fire-and-forget — spawn() semantics: the caller must NOT await the run.
+	// Catch-all: a late rejection after the test ended must not become an
+	// unhandledRejection that fails the whole file.
+	void (async () => {
+		try {
+			// LAZY: defer the core import — background-runner must not load in the
+			// normal spawn path (and its module-scope main() is entry-guarded).
+			const { executeBackgroundRun } = await import("./background-runner.ts"); // LAZY: defer the core import — background-runner must not load in the normal spawn path
+			const { loadRunManifestById } = await import("../state/stores/state-store.ts"); // LAZY: state-store pulls the whole stores chain
+			const { withRunLockSync } = await import("../state/coordination/locks.ts"); // LAZY: coordination locks only needed on the inline path
+			const loaded = withRunLockSync(manifest, () => loadRunManifestById(manifest.cwd, manifest.runId), { staleMs: 30_000 });
+			const effectiveManifest = loaded?.manifest ?? manifest;
+			const tasks = loaded?.tasks ?? [];
+			await executeBackgroundRun({ manifest: effectiveManifest, tasks }, { log: (message) => log(`[inline] ${message}`) });
+		} catch (error) {
+			const message = error instanceof Error ? error.message : String(error);
+			log(`[pi-crew] inline test seam run ${manifest.runId} FAILED: ${message}`);
+			try {
+				const { loadRunManifestByIdAsync: reload, updateRunStatus } = await import("../state/stores/state-store.ts"); // LAZY: failure-path imports only
+				const fresh = (await reload(manifest.cwd, manifest.runId))?.manifest;
+				if (fresh) updateRunStatus(fresh, "failed", `inline test seam: ${message}`);
+				else
+					await appendEventAsync(manifest.eventsPath, {
+						type: "async.failed",
+						runId: manifest.runId,
+						message: `inline test seam: ${message}`,
+					});
+				if (fresh)
+					await appendEventAsync(fresh.eventsPath, {
+						type: "async.failed",
+						runId: fresh.runId,
+						message: `inline test seam: ${message}`,
+					});
+			} catch {
+				/* best-effort */
+			}
+		}
+	})();
+	return { pid: process.pid, logPath };
+}
+
 export async function spawnBackgroundTeamRun(manifest: TeamRunManifest): Promise<SpawnBackgroundTeamRunResult> {
+	if (isInlineAsyncTestSeamActive()) {
+		const logPath = path.join(manifest.stateRoot, "background.log");
+		fs.mkdirSync(manifest.stateRoot, { recursive: true });
+		return runInlineBackgroundTeamRun(manifest, logPath);
+	}
 	// FIX (2026-07-02, perf review F-critical): use packageRoot() instead of
 	// import.meta.url-relative path. The previous path.resolve walks
 	// <bundleDir>/background-runner.ts, which is correct in src/ but BROKEN
@@ -291,7 +374,10 @@ export async function spawnBackgroundTeamRun(manifest: TeamRunManifest): Promise
 	// `npm root -g` probe. No-op when pi-crew and pi are co-located. See
 	// src/runtime/peer-dep.ts.
 	const peerDepDir = resolvePeerDepDir();
-	const childEnv = buildBackgroundRunnerEnv(peerDepDir ? { ...filteredEnv, [PEER_DEP_DIR_ENV]: peerDepDir } : filteredEnv);
+	const childEnv = buildBackgroundRunnerEnv({
+		...(peerDepDir ? { ...filteredEnv, [PEER_DEP_DIR_ENV]: peerDepDir } : filteredEnv),
+		PI_CREW_BACKGROUND_RUNNER_ENTRY: "1",
+	});
 
 	const loader = resolveTypeScriptLoader();
 	if (!loader) {