pi-crew 0.11.1 → 0.11.4

package/src/extension/registration/lifecycle-handlers.ts

@@ -20,7 +20,12 @@ import type { ExtensionAPI, ExtensionContext } from "@earendil-works/pi-coding-a
 import { loadConfig } from "../../config/config.ts";
 import { DEFAULT_UI } from "../../config/defaults.ts";
 import { getCrewEnv } from "../../config/env-vars.ts";
-import { pruneFinishedRuns, pruneUserLevelRuns } from "../../extension/run-maintenance.ts";
+import {
+	pruneFinishedRuns,
+	pruneUserLevelRuns,
+	resolveAutoPruneAgeFloorMs,
+	resolveAutoPruneKeep,
+} from "../../extension/run-maintenance.ts";
 import { type BrokerSpawnCredentials, setActiveBrokerIssuer, setActiveBrokerRevoker } from "../../runtime/broker/broker-issuer.ts";
 import { CrewBroker } from "../../runtime/broker/crew-broker.ts";
 import { terminateActiveChildPiProcesses } from "../../runtime/child-pi/child-pi.ts";
@@ -37,9 +42,10 @@ import { CrewScheduler, type ScheduledJob } from "../../runtime/scheduling/sched
 import { tryRegisterSessionCleanup } from "../../runtime/session-resources.ts";
 import { createSessionSnapshot } from "../../runtime/session-snapshot.ts";
 import { applyCrewSettingsTiersToConfig, loadCrewSettingsTiers, scheduledJobsHiddenCountOf } from "../../runtime/settings-store.ts";
+import { loadTasksWithRecovery } from "../../state/stores/manifest-io.ts";
 import { loadRunManifestById } from "../../state/stores/state-store.ts";
 import type { TeamRunManifest } from "../../state/types.ts";
-import { summarizeHeartbeats } from "../../ui/heartbeat-aggregator.ts";
+import { overlayFreshTaskStatuses, summarizeHeartbeats } from "../../ui/heartbeat-aggregator.ts";
 import { installInlinePanel } from "../../ui/inline-panel/index.ts";
 import { clearSessionSwitchInFlight, markSessionSwitchInFlight } from "../../ui/inline-panel/view-session-store.ts";
 import { requestRender, setExtensionWidget, toPiWidgetPlacement } from "../../ui/pi-ui-compat.ts";
@@ -64,8 +70,11 @@ import { notifyActiveRuns } from "../session-summary.ts";
 import { persistScheduledJobUpdate, registerCrewScheduler, stashScheduledJobsHiddenCount } from "../team-tool/handle-schedule.ts";
 import { handleTeamTool } from "../team-tool.ts";
 import { runArtifactCleanup } from "./artifact-cleanup.ts";
+import { healthNotifyFingerprint, recordHealthNotifyDecision, resetHealthNotifyEntry } from "./health-notify-policy.ts";
 import type { RegistrationContext } from "./registration-types.ts";
 import { createScheduleEventNotifier } from "./schedule-toast-bridge.ts";
+import { purgeQueuedAmbientNotifications } from "./subagent-helpers.ts";
+import { refreshCrossExtensionWiringForSession } from "./wire-cross-extension.ts";
 
 /**
  * Register all session-lifecycle handlers on the ExtensionAPI. The caller
@@ -251,6 +260,10 @@ function installSessionStartHandler(pi: ExtensionAPI, ctx: RegistrationContext):
 		// it can issue tokens for child runs in this session. The controller
 		// already gates by flag + root-session; this is a no-op when disabled.
 		ctx.brokerController?.setSessionId(currentSessionId);
+		// F13 (RR-018): RPC wiring is extension-lifetime and survives session
+		// switches; rebind the crew global registry to THIS session's manifest
+		// cache (idempotent — see wire-cross-extension.ts).
+		refreshCrossExtensionWiringForSession(pi, ctx);
 
 		// Defer ALL heavy cleanup to after the session_start handler returns.
 		// These operations involve synchronous directory scanning (readdirSync, readFileSync)
@@ -443,24 +456,35 @@ async function runDeferredSessionCleanup(
 
 	// Reconcile stale runs found on disk
 	try {
-		const staleResults =
-			reconcileAllStaleRuns(extensionCtx.cwd, ctx.getManifestCache(extensionCtx.cwd), Date.now(), currentSessionId) ?? [];
-		if (staleResults.length > 0) {
-			ctx.notifyOperator({
-				id: "stale_reconcile",
-				severity: "info",
-				source: "crash-recovery",
-				title: `Reconciled ${staleResults.length} stale run(s)`,
-				body: `Found and repaired ghost runs from previous sessions: ${staleResults.map((r) => r.runId).join(", ")}`,
+		// RR-021 WI-1.5: reconcile is async (mapConcurrent bound 4) — keep this
+		// session_start callback synchronous; notify when the result lands.
+		void reconcileAllStaleRuns(extensionCtx.cwd, ctx.getManifestCache(extensionCtx.cwd), Date.now(), currentSessionId)
+			.then((staleResults) => {
+				if ((staleResults ?? []).length > 0) {
+					ctx.notifyOperator({
+						id: "stale_reconcile",
+						severity: "info",
+						source: "crash-recovery",
+						title: `Reconciled ${staleResults.length} stale run(s)`,
+						body: `Found and repaired ghost runs from previous sessions: ${staleResults.map((r) => r.runId).join(", ")}`,
+					});
+				}
+			})
+			.catch((error) => {
+				logInternalError("register.sessionStart.reconcileStale", error);
 			});
-		}
 	} catch (error) {
 		logInternalError("register.sessionStart.reconcileStale", error);
 	}
 
 	// Auto-prune finished project-level run directories
 	try {
-		const { removed } = pruneFinishedRuns(extensionCtx.cwd, 10);
+		// DP-01: keep + age-floor are env-driven; the age floor means a run
+		// finished <24h ago survives a session restart even beyond top-keep.
+		const { removed } = pruneFinishedRuns(extensionCtx.cwd, resolveAutoPruneKeep(), {
+			ageFloorMs: resolveAutoPruneAgeFloorMs(),
+			intent: "session-start-auto",
+		});
 		if (removed.length > 0) {
 			ctx.notifyOperator({
 				id: `auto_prune_project`,
@@ -476,7 +500,10 @@ async function runDeferredSessionCleanup(
 
 	// Auto-prune finished user-level run directories
 	try {
-		const { removed } = pruneUserLevelRuns(10);
+		const { removed } = pruneUserLevelRuns(resolveAutoPruneKeep(), {
+			ageFloorMs: resolveAutoPruneAgeFloorMs(),
+			intent: "session-start-auto",
+		});
 		if (removed.length > 0) {
 			ctx.notifyOperator({
 				id: `auto_prune_user`,
@@ -648,6 +675,18 @@ export function evictRunFromManifests(manifests: TeamRunManifest[], runId: strin
 	return manifests.filter((m) => m.runId !== runId);
 }
 
+/**
+ * F14 (RR-019): cheap signature of the preloaded-manifest frame. Only a
+ * CHANGED signature lets `backgroundPreload` count as render activity
+ * (`schedule()`); an identical signature means "nothing the widget would
+ * paint differently" and must NOT reset the render scheduler's idle
+ * counters (that defeated the R1 idle stop — see setupRenderLoop). Covers
+ * run identity, status transitions, and updatedAt bumps. Exported for tests.
+ */
+export function manifestsFrameSignature(manifests: TeamRunManifest[]): string {
+	return manifests.map((m) => `${m.runId}:${m.status}:${m.updatedAt}`).join("|");
+}
+
 /**
  * Apply a runEventBus payload to a preloaded-manifest frame: evict the run on
  * terminal events, pass through unchanged otherwise. This is the exact logic
@@ -677,16 +716,24 @@ function setupRenderLoop(
 	let lastPreloadedManifests: TeamRunManifest[] = [];
 	let lastFrameManifestCache: ReturnType<typeof createManifestCache> | undefined;
 	let lastFrameSnapshotCache: ReturnType<typeof createRunSnapshotCache> | undefined;
+	// F14: signature of the last frame backgroundPreload saw — only a change
+	// here counts as render activity.
+	let lastFrameSignature: string | undefined;
 
 	const ownerGeneration = ctx.sessionGeneration;
 
-	const buildFrame = async (): Promise<boolean> => {
-		if (!ctx.currentCtx) return false;
+	const buildFrame = async (): Promise<{ ok: boolean; changed: boolean }> => {
+		if (!ctx.currentCtx) return { ok: false, changed: false };
 		lastPreloadedConfig = loadConfig(ctx.currentCtx.cwd);
 		lastFrameManifestCache = ctx.getManifestCache(ctx.currentCtx.cwd);
 		lastFrameSnapshotCache = ctx.getRunSnapshotCache(ctx.currentCtx.cwd);
 		const manifests = lastFrameManifestCache.list(20);
 		lastPreloadedManifests = manifests;
+		// F14 (RR-019): compute the frame signature BEFORE the preload await so
+		// `changed` reflects what this tick saw, not a mid-preload mutation.
+		const frameSignature = manifestsFrameSignature(manifests);
+		const frameChanged = frameSignature !== lastFrameSignature;
+		lastFrameSignature = frameSignature;
 		// pts/2 hang fix: reconcile per-run watchers against the ACTIVE set only.
 		{
 			const onRunChange = (runId: string): void => {
@@ -718,16 +765,23 @@ function setupRenderLoop(
 		}
 		const runIds = manifests.map((r) => r.runId);
 		await lastFrameSnapshotCache.preloadAllStale(runIds);
-		return true;
+		return { ok: true, changed: frameChanged };
 	};
 
 	const backgroundPreload = (): void => {
 		if (!ctx.currentCtx || preloading) return;
 		preloading = true;
 		buildFrame()
-			.then((ok) => {
+			.then(({ ok, changed }) => {
 				preloading = false;
-				if (ok) ctx.renderScheduler?.schedule();
+				// F14 (RR-019): preload completion is maintenance, NOT user activity.
+				// Only a genuinely CHANGED frame may call schedule() — an unchanged
+				// frame calling schedule() reset `lastEventAt`/`idleFallbackRenders`
+				// and re-armed the fallback loop that fallbackLoop() had just
+				// deliberately stopped (R1), rendering forever while idle. Real
+				// work still animates: runEventBus + fs.watch subscriptions call
+				// schedule() directly on genuine events.
+				if (ok && changed) ctx.renderScheduler?.schedule();
 			})
 			.catch((error: unknown) => {
 				preloading = false;
@@ -796,7 +850,16 @@ function setupRenderLoop(
 		const clearHealthNotifications = (runId: string): void => {
 			for (const kind of ["recovery_dead_workers", "recovery_missing_heartbeat"]) {
 				const key = `${kind}_${runId}`;
-				ctx.autoRecoveryLast.delete(key);
+				// FINDING 6: reset the fire budget (a genuine recurrence after
+				// this clear re-notifies) AND opportunistically purge
+				// still-QUEUED host follow-up copies of the original warning —
+				// the host drains the queue one message per turn boundary, so
+				// stale copies otherwise drip in for hours after the clear
+				// (live: 5h of "missing heartbeat" replays after the 2026-09-23
+				// zombie cleanup). The purge is feature-detected: hosts without
+				// clearQueuedUserMessagesMatching (e.g. 0.87.0) no-op here; the
+				// fire-cap policy bounds the backlog on every host.
+				resetHealthNotifyEntry({ entries: ctx.autoRecoveryLast, maxEntries: ctx.AUTO_RECOVERY_LAST_MAX_ENTRIES }, key);
 				ctx.notifyOperator({
 					id: key,
 					clear: true,
@@ -805,6 +868,10 @@ function setupRenderLoop(
 					runId,
 					title: `Cleared ${kind} for ${runId}`,
 				});
+				purgeQueuedAmbientNotifications(
+					pi,
+					(text) => text.includes(runId) && (text.includes("dead worker") || text.includes("missing heartbeat")),
+				);
 			}
 		};
 		for (const run of sessionManifests) {
@@ -838,29 +905,29 @@ function setupRenderLoop(
 					clearHealthNotifications(run.runId);
 					continue;
 				}
-				const summary = summarizeHeartbeats(snapshot, { now });
+				// GATE 3 (FINDING 5) — task-status truth lives on DISK, not in the
+				// snapshot cache. A worker parked on `ask` writes running → waiting
+				// to tasks.json immediately, but the cached snapshot can lag that
+				// transition; in the window a parked (alive, silent-by-design)
+				// worker counted as active-without-heartbeat and fired a false
+				// "dead worker" (live: team_20260923100114, 01_explore parked on
+				// ask). Overlay FRESH statuses before summarizing; divergence also
+				// invalidates the stale cache entry so the next tick rebuilds it.
+				const freshTasks = loadTasksWithRecovery(freshManifest.tasksPath, freshManifest.eventsPath, run.runId);
+				const overlaid = overlayFreshTaskStatuses(snapshot, freshTasks);
+				if (overlaid !== snapshot) snapshotCache.invalidate(run.runId);
+				const summary = summarizeHeartbeats(overlaid, { now });
+				const fingerprint = healthNotifyFingerprint(summary, overlaid.tasks.length);
 				const maybeNotifyHealth = (kind: string, count: number, title: string, body: string): void => {
 					if (count <= 0) return;
 					const key = `${kind}_${run.runId}`;
-					const previous = ctx.autoRecoveryLast.get(key);
-					if (previous !== undefined && now - previous.lastAccessAt < 5 * 60_000) return;
-					// Defensive cap: evict entry with oldest lastAccessAt before inserting/updating.
-					while (ctx.autoRecoveryLast.size >= ctx.AUTO_RECOVERY_LAST_MAX_ENTRIES) {
-						let oldestKey: string | undefined;
-						let oldestAccess = Infinity;
-						for (const [k, v] of ctx.autoRecoveryLast) {
-							if (v.lastAccessAt < oldestAccess) {
-								oldestAccess = v.lastAccessAt;
-								oldestKey = k;
-							}
-						}
-						if (oldestKey === undefined) break;
-						ctx.autoRecoveryLast.delete(oldestKey);
-					}
-					ctx.autoRecoveryLast.set(key, {
-						insertedAt: now,
-						lastAccessAt: now,
-					});
+					// FINDING 6: bounded re-fire — ≤ MAX_HEALTH_NOTIFY_FIRES per
+					// UNCHANGED fingerprint (5-min cooldown between fires). The
+					// old forever-re-arming cooldown fed the host follow-up queue
+					// duplicates that drained one-per-turn-boundary for hours.
+					// Policy detail + LRU eviction: health-notify-policy.ts.
+					const state = { entries: ctx.autoRecoveryLast, maxEntries: ctx.AUTO_RECOVERY_LAST_MAX_ENTRIES };
+					if (!recordHealthNotifyDecision(state, key, fingerprint, now)) return;
 					ctx.notifyOperator({
 						id: key,
 						severity: "warning",

package/src/extension/registration/lifecycle.ts

@@ -22,6 +22,7 @@ import { projectCrewRoot } from "../../utils/paths.ts";
 import type { AsyncNotifierState } from "../async-notifier.ts";
 import type { NotificationDescriptor, NotificationRouter } from "../notification-router.ts";
 import type { NotificationSink } from "../notification-sink.ts";
+import { createWebhookNotifier } from "../webhook-notify.ts";
 
 /**
  * Mutable state owned by register.ts and read/written by this module.
@@ -59,13 +60,39 @@ export function startLifecycleWatchers(ctx: ExtensionContext, state: LifecycleSt
 	const loadedConfig = loadConfig(ctx.cwd);
 	state.notifierStarted = true;
 	try {
+		// US-030 (docs/specs/US-030.md): outbound webhook sink built from config.
+		// Gated on the notifications master switch (`notifications.enabled !== false`,
+		// same gate as configureNotifications), opt-in per `webhook.url`, and
+		// SSRF-guarded inside the factory. Inactive config → shared no-op
+		// singleton (zero network calls, zero hot-path allocation).
+		const notificationsConfig = loadedConfig.config.notifications;
+		const webhookNotifier =
+			notificationsConfig?.enabled === false
+				? undefined
+				: createWebhookNotifier(
+						{ webhook: notificationsConfig?.webhook, quietHours: notificationsConfig?.quietHours },
+						{
+							onFailure: (failure) => {
+								// Spec: failures surface as a `webhook.failed` event (crew.*-prefixed
+								// pi event, mirroring crew.run.completed / crew.task.overflow).
+								// logInternalError already fired inside the notifier.
+								deps.pi.events?.emit?.("crew.webhook.failed", {
+									runId: failure.runId,
+									attempts: failure.attempts,
+									error: failure.error,
+								});
+							},
+						},
+					);
 		// LAZY: async-notifier pulls in debounce + cron helpers — defer
 		// until the first lifecycle install (deferred import within module).
 		void import("../async-notifier.ts").then(({ startAsyncRunNotifier }) => {
+			// LAZY: defer async-notifier until the lifecycle event fires
 			if (deps.isCleanedUp()) return;
 			startAsyncRunNotifier(ctx, deps.notifierState, loadedConfig.config.notifierIntervalMs ?? DEFAULT_UI.notifierIntervalMs, {
 				generation: deps.ownerGeneration,
 				isCurrent: (generation) => generation === deps.ownerGeneration && deps.isContextCurrent(ctx, deps.ownerGeneration),
+				webhookNotifier,
 			});
 		});
 		return true;
@@ -84,6 +111,7 @@ export function stopLifecycleWatchers(state: LifecycleState, deps: LifecycleDeps
 	state.notifierStarted = false;
 	try {
 		void import("../async-notifier.ts").then(({ stopAsyncRunNotifier }) => {
+			// LAZY: defer async-notifier until the lifecycle event fires
 			stopAsyncRunNotifier(deps.notifierState);
 		});
 	} catch (error) {
@@ -107,6 +135,13 @@ export interface NotificationsDeps {
 		ctx: ExtensionContext,
 		notificationCount: number,
 	) => void;
+	/**
+	 * F11 (RR-018): ownership predicate — true only while the session that
+	 * started this configure is still current. Checked after every lazy-import
+	 * await boundary before publishing into shared state. Optional for older
+	 * hand-built deps; defaults to "still owner".
+	 */
+	isOwnerSession?: () => boolean;
 }
 
 /**
@@ -117,6 +152,11 @@ export interface NotificationsDeps {
  *  - `config.notifications?.enabled === false` → no-op.
  */
 export async function configureNotifications(ctx: ExtensionContext, state: LifecycleState, deps: NotificationsDeps): Promise<void> {
+	// F11 (RR-018): ownership predicate — re-verified after every await below.
+	// A continuation whose session was cleaned up or superseded must not
+	// publish resources into shared state. Optional so hand-built deps from
+	// older call sites keep working (defaults to "still owner").
+	const stillOwns = deps.isOwnerSession ?? (() => true);
 	state.notificationRouter?.dispose();
 	state.notificationSink?.dispose();
 	state.notificationRouter = undefined;
@@ -126,26 +166,29 @@ export async function configureNotifications(ctx: ExtensionContext, state: Lifec
 
 	// LAZY: notification router — wires events to sinks
 	const { NotificationRouter } = await import("../notification-router.ts");
+	if (!stillOwns()) return;
 	// LAZY: JSONL sink — file-backed notification storage
 	const { createJsonlSink } = await import("../notification-sink.ts");
+	if (!stillOwns()) return;
 	// LAZY: follow-up helpers — shared with subagent handoff
 	const { sendFollowUp } = await import("./subagent-helpers.ts");
+	if (!stillOwns()) return;
 	// LAZY: widget updater — refreshes the TUI status widget
 	const { updateCrewWidget } = await import("../../ui/widget/index.ts");
+	if (!stillOwns()) return;
 
-	if (config.telemetry?.enabled !== false) {
-		state.notificationSink = createJsonlSink(
-			projectCrewRoot(ctx.cwd),
-			config.notifications?.sinkRetentionDays ?? DEFAULT_NOTIFICATIONS.sinkRetentionDays,
-		);
-	}
-	state.notificationRouter = new NotificationRouter(
+	// F11: create into locals — publish only while ownership still holds.
+	const notificationSink =
+		config.telemetry?.enabled !== false
+			? createJsonlSink(projectCrewRoot(ctx.cwd), config.notifications?.sinkRetentionDays ?? DEFAULT_NOTIFICATIONS.sinkRetentionDays)
+			: undefined;
+	const notificationRouter = new NotificationRouter(
 		{
 			dedupWindowMs: config.notifications?.dedupWindowMs ?? DEFAULT_NOTIFICATIONS.dedupWindowMs,
 			batchWindowMs: config.notifications?.batchWindowMs ?? DEFAULT_NOTIFICATIONS.batchWindowMs,
 			quietHours: config.notifications?.quietHours,
 			severityFilter: config.notifications?.severityFilter ?? [...DEFAULT_NOTIFICATIONS.severityFilter],
-			sink: (notification) => state.notificationSink?.write(notification),
+			sink: (notification) => notificationSink?.write(notification),
 		},
 		(notification: NotificationDescriptor) => {
 			if (notification.clear) {
@@ -183,6 +226,15 @@ export async function configureNotifications(ctx: ExtensionContext, state: Lifec
 			}
 		},
 	);
+	if (!stillOwns()) {
+		// F11: ownership lost while suspended — dispose what was just created
+		// instead of publishing (no orphans).
+		notificationRouter.dispose();
+		notificationSink?.dispose();
+		return;
+	}
+	state.notificationSink = notificationSink;
+	state.notificationRouter = notificationRouter;
 }
 
 /** Dispose notification router + sink. */
@@ -200,6 +252,8 @@ export interface DeliveryDeps {
 	notifyOperator: (notification: NotificationDescriptor) => void;
 	sendFollowUp: (pi: ExtensionAPI, message: string) => void;
 	sendAgentWakeUp: (pi: ExtensionAPI, message: string) => void;
+	/** F11 (RR-018): same ownership predicate as NotificationsDeps.isOwnerSession. */
+	isOwnerSession?: () => boolean;
 }
 
 /**
@@ -207,15 +261,19 @@ export interface DeliveryDeps {
  * register.ts as part of H3-L2 (delivery lifecycle service).
  */
 export async function configureDeliveryCoordinator(state: LifecycleState, deps: DeliveryDeps): Promise<void> {
+	// F11: ownership predicate — re-verified after the lazy imports below.
+	const stillOwns = deps.isOwnerSession ?? (() => true);
 	state.deliveryCoordinator?.dispose();
 	state.deliveryCoordinator = undefined;
 	state.overflowTracker?.dispose();
 	state.overflowTracker = undefined;
 	// LAZY: delivery coordinator — batches notification fan-out
 	const { DeliveryCoordinator } = await import("../../runtime/delivery-coordinator.ts");
+	if (!stillOwns()) return;
 	// LAZY: overflow tracker — recovers from backlog overflow
 	const { OverflowRecoveryTracker } = await import("../../runtime/recovery/overflow-recovery.ts");
-	state.deliveryCoordinator = new DeliveryCoordinator({
+	if (!stillOwns()) return;
+	const deliveryCoordinator = new DeliveryCoordinator({
 		emit: (event, data) => {
 			deps.pi.events?.emit?.(event, data);
 		},
@@ -226,7 +284,7 @@ export async function configureDeliveryCoordinator(state: LifecycleState, deps:
 			deps.sendAgentWakeUp(deps.pi, message);
 		},
 	});
-	state.overflowTracker = new OverflowRecoveryTracker({
+	const overflowTracker = new OverflowRecoveryTracker({
 		onPhaseChange: (phaseState, previousPhase) => {
 			if (deps.observabilityState.metricRegistry) {
 				deps.observabilityState.metricRegistry
@@ -254,6 +312,15 @@ export async function configureDeliveryCoordinator(state: LifecycleState, deps:
 			});
 		},
 	});
+	if (!stillOwns()) {
+		// F11: ownership lost while suspended — dispose what was just created
+		// instead of publishing (no orphans).
+		deliveryCoordinator.dispose();
+		overflowTracker.dispose();
+		return;
+	}
+	state.deliveryCoordinator = deliveryCoordinator;
+	state.overflowTracker = overflowTracker;
 }
 
 /** Dispose delivery coordinator + overflow tracker. */