pi-crew 0.11.1 → 0.11.4

package/CHANGELOG.md

@@ -1,5 +1,78 @@
 # Changelog
 
+## [0.11.4] — test-gate hardening + RR-023 battery fixes (2026-09-29)
+
+### fix: grandchild relay empty — inherit the parent task's model on model-less delegate (RR-023, 2026-09-29 battery finding #3)
+
+- **Root cause (run `team_20260929041427_5c40c4fd7e950443`)**: the relay/capture chain (`delegate-spawn.ts` capture → broker fence/mailbox → prompt-runtime poll) was FAITHFUL — all 3 delegate calls omitted `model`, so the broker spawned the grandchild model-less, the child pi booted on the pi GLOBAL default (`minimax/MiniMax-M3` while the parents ran `zai/glm-5.3`), and that model returned empty completions (assistant `content: []` ×3, per the gc session jsonl) — `rawFinalText` undefined + stdout `""` → the relay delivered an empty fenced body as `ok:true`. Same family as finding #1 (75502b68). **Fix**: the `delegate.request` admission now threads the parent task's `model` out of the locked record read and the spawner inherits it when the request omits `model` (explicit `model` still wins; no-model-everywhere passthrough unchanged) — the grandchild can no longer silently fall through to the global default. **Diagnosability guard**: the capture expression is extracted as pure `grandchildResultText()` and an exit-0-with-zero-assistant-text result now renders `[grandchild exited 0 with no assistant output]` instead of an empty mailbox body indistinguishable from a relay bug. Pinned RED-first by `test/unit/runtime/broker/delegate-grandchild-model.test.ts` (fake-spawner harness, 3 ACs) + `test/unit/runtime/delegate-grandchild-result-text.test.ts` (5 unit cases on the helper).
+
+### fix: broker run.lock contention — typed busy frame instead of connection kill (RR-023, 2026-09-29 battery finding #4)
+
+- **`wait.request`/`delegate.request` busy degradation**: both handlers ran their state RMW inside `withRunLockSync`; a live cross-process run.lock holder (e.g. the detached runner persisting task state) made `acquireLockWithRetry` throw immediately and the throw escaped `handleData` → `closeConnection` — direct-async workers saw an untyped `code=close` socket death within ~5ms (evidence: `team_20260929041005` ask-probe / `team_20260929041020` delegate-probe; the sync foreground run was the zero-contention control). New `protocol/lock-busy.ts` classifies the lock-busy throw by its exported message identity, retries on a bounded async-back-off schedule (new `CrewBrokerOptions.lockBusyRetryDelaysMs`, default 50/100/200/400/800ms), then answers a typed `busy` error frame with the connection SURVIVING (ping still answers); the delegate path additionally records `delegate.rejected(reason=run-lock-busy)` in events.jsonl — never silent. `locks.ts` steal semantics untouched (lock family v0.9.26 invariant). Pinned by `test/unit/runtime/broker/crew-broker-lock-contention.test.ts` (3 tests incl. the default-schedule retry-absorbs-transient-hold case).
+
+### fix: test-gate integrity (RR-021 review rounds 2-3)
+
+- **Test runner cancelled-test guard** (`scripts/test-runner.mjs`): a dual reporter keeps stdout UX unchanged (spec under TTY, TAP otherwise) while a full TAP stream is written to a temp file; `# cancelled N > 0` now fails the run loudly in BOTH the single-run and batch paths — independent of node:test's exit-code mapping. Belt-and-suspenders against the round-1 incident class (unref'd-race-timer tests cancelled while the harness reported green).
+- **Test runner missing-file pre-check** (round-3 B1): node:test v22 silently skips an explicitly-listed file that does not exist (when other files still run) and exits 0 — a renamed/deleted test file would silently drop out of `test:critical`-style gates forever. The runner now refuses to spawn and names the missing paths; glob-shaped args are left to node:test's own expansion.
+- **`test:bundle` now routes through the guarded runner** (was a bare `node --test` bypass — the only CI gate without the cancelled/missing-file/fail-closed wrappers).
+- **`check:lazy-imports` hardened**: composite `import()` forms that escaped every earlier rule are now caught (`[(,\[\{]\s*import(`, `>\s*import(`, `=\s*import(`); a zero-match `git grep` (fully-clean `src/`) no longer crashes the gate; the type-annotation skip now requires a member-access suffix `import("...").T` so compound runtime forms are never false-skipped; dist-side regex is whitespace-proof. Remaining gaps (ternary-else, object-property, case/label) are documented in the script.
+
+## [0.11.3] — optimization audit fixes: correctness, hang-risks, bundle, DX, dead code (2026-09-27)
+
+### fix: correctness + hang-risks (RR-021 M1)
+
+- **`classifyReviewOutcome` word-boundary bug**: the `"\baccept\b"`/`"\breject\b"` signals were TS string literals — `\b` is a BACKSPACE char there, so the two strongest verdict signals never matched anything. All 49 signals are now precompiled module-scope regex literals, and a negation guard stops "I cannot accept this" counting as approval. Reject-first precedence unchanged.
+- **Git precondition probes** (`rev-parse`/`status` in the verification worktree sandbox) gained a 5s timeout — a wedged git no longer blocks the extension forever; the existing catch degrades to `available:false`.
+- **`detectRipgrep` hardening**: a spawned-but-wedged `rg --version` is SIGKILLed by an unref'd 3s timer (defaults to unavailable); concurrent first calls share ONE in-flight detection promise instead of spawning one rg per caller.
+- **`markDeadAsyncRunIfNeeded`** reroutes to the async `withRunLock` (same v0.9.26 lock family — live-token interop); the 5s notifier tick no longer holds the event loop on a sync acquisition. The notifier tick keeps no-overlap semantics. `async-runner.ts`'s in-process test seam keeps its one-shot sync lock by design.
+- **`reconcileAllStaleRuns`** is async and reconciles runs with `mapConcurrent` bound 4 (per-run lock files are independent); results keep snapshot order, plan-approval re-check and re-read-inside-lock semantics unchanged.
+
+### perf: bundle + startup hygiene (RR-021 M2)
+
+- esbuild/acorn/diff load lazily through sync `createRequire` shims (model: `syntax-highlight.ts`) — three eager module-scope imports no longer paid on every extension load; `diff` wildcard import narrowed to `diffWords` (+ type-only `Change`).
+- `ajv` marked external (it is only reached via a lazy `await import`) — the bundle shrank 1.65 MB → 1.53 MB and skips parse cost for a rarely-taken path.
+- `check:lazy-imports` catches the common runtime `import()` positions (the old gate matched only `await import(` — audit blind-spot #2) and asserts the committed `dist/index.mjs` contains no module-scope hoisted import of esbuild/acorn/diff/jiti/cli-highlight/yaml/ajv. 23 runtime import sites across 9 files gained `// LAZY:` markers. (Wording corrected post-0.11.3: exotic positions — ternary-else, object-property, case/label — remain documented gaps; see Unreleased.)
+
+### perf(dx): incremental typecheck + flake-resistant waits (RR-021 M3)
+
+- `tsconfig.json` enables `incremental` + a cached `tsBuildInfoFile` (gitignored) — measured with TS 7.0.2: cold 4.10s → warm 1.41s.
+- Three flake-prone suites (`post-exit-stdio-guard`, `preload-idle-render`, `prompt-runtime-steer-boot-window`) replace fixed sleeps with poll-based `waitFor`/`waitForQuiet` (25ms poll, deadlines sized ≥2× the worst-case timer, quiet windows derived from a measured render timeline). Each file verified ×3 consecutive runs with zero flakes.
+
+### perf: scale + hygiene (RR-021 M4)
+
+- The notifier tick and run picker read a bounded `listRecentRuns` window (40→20 after the session filter) instead of scanning the full run index every debounce window; the startup seed keeps its full scan by design.
+- Dead code deleted (−1.6k lines, all verified 0-production-consumer): `src/benchmark/` + its two test files, `ui/card-colors.ts`, `utils/completion-dedupe.ts`, `utils/resolve-shell.ts` + their tests; the affected suites were trimmed to their live checks.
+- Eleven drive-by fixes: Set/Map lookups for hot `includes`/`find` loops (settled batch filter, task-list dependency labels, agents-pane first-wins live-handle map, group-join task resolution), allocation-free reverse scans replacing `[...arr].reverse().find()` copies (×3), a 256-entry cap for `stableComponentCache`, `TypeCompiler.Compile(TeamToolParams)` compiled once (STATIC) instead of per-call `Value.Check` schema walks, a 30-min WALL-CLOCK poll deadline (the old 1800-poll cap silently assumed a 1s configurable interval), a bounded `waitForRecord` (300s deadline racing wedged promises; expiry returns the current record — never undefined), collision-free `msg_<randomUUID>` mailbox ids, and module-scope precompiled regexes for the crew-input router + implicit-tag detector.
+- Spinner isolation (`run-dashboard` `spinnerBucket`/`metricsSig`) deferred to a follow-up — needs a live TUI profile first.
+
+## [0.11.2] — runtime hygiene, in-process async test seam, slash-command fixes (2026-09-26)
+
+### runtime: ambient-noise + temp-workspace hygiene + in-process async test seam
+
+- **Ambient notification false-positives (guest `gc-*` subagents)**: the heartbeat watcher and the UI heartbeat aggregator no longer treat delegate-owned guest tasks as worker heartbeats — guests have no heartbeat channel (their lifecycle is `delegate.requested/admitted/completed`); fires were observed 52ms after admit. Skipped at both independent layers (`heartbeat-watcher.ts`, `heartbeat-aggregator.ts`), each with a guard-test proving a genuinely-missing real worker is still flagged.
+- **Temp-workspace hygiene** (live triage: health `running=144`, ~3.4k `pi-crew-*` tmpdirs, frozen reconciler): the orphan sweep batch now rotates statelessly (`floor(now/60s) % batches`) so an alphabetically-first stuck cluster can no longer starve the dirs behind it; abandoned `.cleanup-in-progress` sentinels older than 10 minutes are reclaimed; the test runner sweeps pre-existing `pi-crew-*` debris (mtime < suiteStart−30min) after every suite — one choke point covering ~320 mkdtemp-using test files (opt-out `PI_CREW_TEST_NO_TMP_SWEEP=1`).
+- **In-process async test seam**: `PI_CREW_TEST_ASYNC_INLINE=1` + `PI_CREW_ALLOW_MOCK=1` (double gate; production sets neither) executes async runs in-process instead of spawning a detached background-runner — the run logic is now an exported `executeBackgroundRun()` core shared verbatim by the detached runner and the seam, and `main()` is entry-guarded (`PI_CREW_BACKGROUND_RUNNER_ENTRY` or argv entry check) so importing the module runs nothing. Kills the Windows Defender first-spawn stall (`subagent-tools-integration`: 5+min stall-prone → 14/14 in 37s) and the orphan-runner tmpdir leak (in-process runs die with the test process). See `docs/decisions/2026-09-26-inline-async-test-seam.md`.
+
+### slash-commands usability fixes
+
+- `/team-respond` now guards its arguments (`<runId> <taskId|--all> <message>`) with a usage message instead of surfacing an opaque tool error.
+- `/team-goal` metadata is honest: description lists the real sub-actions (`cancel`, `reset`, default `status`) and first-argument completions suggest them.
+- `/team-metrics` appends a hint when the snapshot is empty — naming observability as the likely cause and the `observability: true` enable path.
+- `/team-dashboard` in a headless session now notifies that it needs a UI (suggesting `/team-status`) instead of silently doing nothing.
+- Notification truncation is explicit: clipped output ends with `… [truncated]`, still capped at 800 chars; `/team-events` appends the on-disk events log path when truncated so the full log stays reachable.
+- `/skill-create` resolution is ESM-safe (`import.meta.url` walk-up replacing `require.resolve`/`__dirname`) and works identically under strip-types and the bundle; missing/unknown template ids now list the available template ids.
+- `/team-help` resynced to the real command surface (all 38 team commands + pointer to the 5 non-team commands).
+- `docs/commands-reference.md` truth-synced: phantom `/team-cleanup` removed, `/team-respond`//`/team-follow-up`//`/team-invalidate` args fixed, `/team-vibes` reduced to its real `[on|off]` surface, `/schedules`//`/skill-list`//`/skill-create`//`/crew-brief`//`/team-cleanup-menu` documented — locked by a new docs↔code set-equality parity test.
+- New handler tests: team-respond guard, team-goal metadata, command output hints (truncation/dashboard/metrics), skill-create ESM resolution, team-vibes (status/on/off/usage-error).
+
+### docs: lean docs tree
+
+- README rewritten as a lean landing page (1099 → 206 lines): the changelog-duplicate section, full config dump, and action/command tables are replaced by links to their single sources; stale claims corrected (55 actions, 18 agents). The "⚠️ IMPORTANT — Read before using" warning is restored as a compact callout (same honest framing, details delegated to trust-model/security-issues/limitations).
+- Dated point-in-time docs (audits, plans, fix specs, roadmaps, migration guides) moved to `docs/archive/`; perf analyses to `docs/perf/`; `docs/README.md` rebuilt as a three-group index (Start here / Reference / Records).
+- `runtime-flow.md` folded into `architecture.md` ("Runtime flow"); the stale `v0.10.3` version header dropped.
+- Error-code range corrected to E001–E013 everywhere (E013 `ModelOutOfScope` shipped undocumented).
+- Cross-references updated repo-wide (docs, src/test comments, runtime warning string, tarball whitelist); `migration-v0.4-v0.5.md` and `runtime-flow.md` dropped from the npm file whitelist.
+
 > **Note:** `atomic-write-v2.ts` / `AtomicWriter` mentioned in historical entries below was consolidated into `atomic-write.ts` as of v0.9.42. This changelog is preserved as historical record — the migration was completed (the v2 class was never adopted; v1 won on simplicity + symlink-safety + link+unlink atomicity). See `docs/migration/atomic-write-v2-migration.md` for the decision rationale.
 
 ## [0.11.1] — RAIL: one UI design language for every surface + UI-audit fixes (2026-09-16)
@@ -860,7 +933,7 @@ waiting-producer-ask, spec-system (+ round-1 errata).
 Branch `refactor/maintainability`: 16-round audit → 5-phase refactor →
 finding-by-finding sweep → full remediation of every open finding (Waves
 1A/1B/2A/2B/B/C). Full execution log with commit map:
-`docs/refactor-plan.md`. Audit inventory: `docs/refactor-plan.review.md`.
+`docs/archive/refactor-plan.md`. Audit inventory: `docs/archive/refactor-plan.review.md`.
 
 ### Security (config tiering)
 - Schema-driven project-config sanitize: `sensitive:true` drop-list +
@@ -923,8 +996,8 @@ finding-by-finding sweep → full remediation of every open finding (Waves
 
 ## [0.9.68] — RLM fixes after deep-review verification (2026-08-12)
 
-Fixes from `docs/rlm-deep-review-2026-08-12.md` (verified) +
-`docs/rlm-fixes-implementation-plan.md`. Each code part loop-reviewed (3
+Fixes from `docs/archive/rlm-deep-review-2026-08-12.md` (verified) +
+`docs/archive/rlm-fixes-implementation-plan.md`. Each code part loop-reviewed (3
 parallel reviewers: security/correctness/tests, read-only) before merge here.
 
 ### Fixes
@@ -971,7 +1044,7 @@ parallel reviewers: security/correctness/tests, read-only) before merge here.
 
 ## [0.9.67] — RLM/scratchpad adoption batch (I1–I7) (2026-08-11)
 
-First shippable slice of `improvement-plan-2026-08-11.md` — the scratchpad was
+First shippable slice of `docs/archive/improvement-plan-2026-08-11.md` — the scratchpad was
 armed-but-unused (0 cells in 14 runs); this batch fixes the doctrine, adds an
 adoption/value metric, and ports the pattern-12 shell guard. Each item was
 loop-reviewed (iterative-audit) before commit; `test:critical` 101/0, 129
@@ -1221,10 +1294,10 @@ Six fixes distilled from the `real-test-pi-crew` 9-tier battery (run 2026-08-10)
   - **Notifier/session-summary (`src/extension/async-notifier.ts`, `session-summary.ts`)**: filter `listRuns` theo `ownerSessionId` trước notify — session B không còn toast về run của A.
   - **Health filter (#3)**: `ctx.currentCtx?.sessionManager?.getSessionId()` + bỏ dead clause `ownerSessionGeneration` (field không tồn tại trên `TeamRunManifest`) — trước đó silently drop tất cả owned runs.
   - Verified end-to-end theo skill `real-test-pi-crew`: `test:critical` 101/101, 3-path kill-switch green, typecheck + bundle + md5 sync OK, live TUI (tmux + pty) render không crash, smoke verifier 52s (<300s, no hang), full feature battery (team tool 9a–9f + subagent tools) clean — zero `Unknown type`/`Validation failed`. 6837 unit + 214 integration tests pass.
-- Lưu ý: `#12` (DeliveryCoordinator) infrastructure staged nhưng inert — `deliver*` không có production caller, nên queue không bao giờ được feed. Documented trong `docs/cross-session-leak-fix-plan.md`.
+- Lưu ý: `#12` (DeliveryCoordinator) infrastructure staged nhưng inert — `deliver*` không có production caller, nên queue không bao giờ được feed. Documented trong `docs/archive/cross-session-leak-fix-plan.md`.
 
 ### Docs
-- `docs/cross-session-leak-audit.md` (audit re-verify: 2/2 root cause CONFIRMED, 12/13 vector CONFIRMED, #3 REFUTED) + `docs/cross-session-leak-fix-plan.md` (phased plan, reviewed).
+- `docs/archive/cross-session-leak-audit.md` (audit re-verify: 2/2 root cause CONFIRMED, 12/13 vector CONFIRMED, #3 REFUTED) + `docs/archive/cross-session-leak-fix-plan.md` (phased plan, reviewed).
 
 ## [0.9.58] — fix load crash on stale hoisted typebox: defensive guard + bundle vendoring (survives `pi update`) + round-1/round-2 fixes (2026-08-04)
 
@@ -6580,7 +6653,7 @@ Note: `src/runtime/parent-guard.ts:37` left as-is — that's an exit-time log th
 - **CHANGELOG.md** — Added the v0.5.5 entry covering all 13 rounds of code review hardening (this entry).
 - **SECURITY-ISSUES.md** — Bumped to v2.0, added v0.5.5 round-13 findings table (8 new issues closed).
 - **docs/architecture.md** — Cross-references v0.5.5 and `docs/pi-crew-v0.5.5-audit-fix-plan.md`.
-- **docs/migration-v0.4-v0.5.md** — Added v0.5.5 highlights (no breaking changes; drop-in replacement).
+- **docs/archive/migration-v0.4-v0.5.md** — Added v0.5.5 highlights (no breaking changes; drop-in replacement).
 
 ### Fixes
 
@@ -6749,7 +6822,7 @@ correctness+error-handling, and performance+architecture audits across 77 source
 - Improved consistency in section naming
 
 ### Documentation
-- Added `docs/migration-v0.4-v0.5.md` - comprehensive migration guide
+- Added `docs/archive/migration-v0.4-v0.5.md` - comprehensive migration guide
 - Updated `docs/deep-review-report.md` - complete issue tracking
 
 ### Dependencies
@@ -7431,7 +7504,7 @@ correctness+error-handling, and performance+architecture audits across 77 source
 - docs/pi-crew-bugs.md: v0.5.22 + historical note
 - docs/TEST_MATRIX.md: test count updated to 2703
 - docs/deep-review-report.md: marked historical
-- docs/migration-v0.4-v0.5.md: drop-in replacement note
+- docs/archive/migration-v0.4-v0.5.md: drop-in replacement note
 
 ### CI
 - `.github/workflows/ci.yml`: typecheck step re-enabled (was disabled since v0.3.x)