pi-crew 0.11.19 → 0.11.21

package/src/state/coordination/locks.ts

@@ -578,9 +578,23 @@ function runLockSocketSupplementEnabled(): boolean {
  * U21: the kernel-socket lock name for a run-lock file path. Derived from the
  * ABSOLUTE run dir path so every process agrees on the name for the same run
  * regardless of cwd/relative-path spelling.
+ *
+ * F2 (2026-10-14): the name is prefixed with the process uid. The socket
+ * namespace is SYSTEM-WIDE (abstract sockets / named pipes are not
+ * per-user), so two different users working on the same run path would
+ * otherwise collide — user A's live holder would lock user B out of B's own
+ * run. The uid prefix removes that cross-user same-path collision. `"noid"`
+ * covers runtimes without `process.getuid` (e.g. Windows).
+ *
+ * Deploy-window: a live holder started on the OLD (uid-less) name is NOT
+ * visible to new code during the transition — SAFE, because the file lock
+ * stays the PRIMARY guard and the socket is only the U21 dual-guard
+ * supplement; once every process runs the new code, all holders use the
+ * unified uid-prefixed name.
  */
 export function runLockSocketName(filePath: string): string {
-	return `run:${path.resolve(filePath)}`;
+	const uid = typeof process.getuid === "function" ? process.getuid() : "noid";
+	return `${uid}:run:${path.resolve(filePath)}`;
 }
 
 /**

package/src/state/coordination/process-lock.ts

@@ -15,6 +15,11 @@
  * forked children via env): pi-crew's child env allowlist strips PI_CREW_*
  * ambient keys (§12.2.1), and nothing about the lock needs to be inherited.
  *
+ * NAME CONVENTION: the socket/pipe namespace is system-wide, NOT per-user —
+ * callers namespace their names by uid when the protected path can be shared
+ * across users (see locks.ts `runLockSocketName`, F2 2026-10-14) so two users
+ * on the same path do not collide.
+ *
  * VENDORED (adapted, not copied verbatim) from `@earendil-works/chord` (MIT),
  * packages/chord/src/manager.ts:82-170 @ a4d040d30 — see NOTICE.md.
  * Adaptations beyond renaming the namespace:
@@ -100,8 +105,20 @@ function socketAddress(name: string): SocketAddress {
 	return { address: fileSocketAddress(key), file: true };
 }
 
-/** True when a live server accepts connections on `address` (leftover-corpse probe). */
-function accepting(address: string): Promise<boolean> {
+/**
+ * Probe whether a live server accepts connections on `address` (leftover-corpse
+ * check). A single refusal is NOT trusted on file-socket platforms: macOS can
+ * return ECONNREFUSED transiently against a LIVE listener (e.g. a momentarily
+ * full listen backlog under load — live-caught in CI 2026-10-14: a foreign
+ * child flipped a held lock to "corpse", DELETED the live socket file and
+ * rebound, stealing the lock). We require TAKEOVER_REFUSALS consecutive
+ * refusals, spaced TAKEOVER_RETRY_MS apart, before declaring a corpse.
+ */
+const TAKEOVER_REFUSALS = 3;
+const TAKEOVER_RETRY_MS = 150;
+
+/** One connect-probe: true = somebody accepts; false = refused (corpse-ish). */
+function acceptingOnce(address: string): Promise<boolean> {
 	return new Promise((resolve) => {
 		const socket = net.connect(address);
 		socket.unref();
@@ -116,6 +133,14 @@ function accepting(address: string): Promise<boolean> {
 	});
 }
 
+async function accepting(address: string): Promise<boolean> {
+	for (let attempt = 0; attempt < TAKEOVER_REFUSALS; attempt++) {
+		if (attempt > 0) await new Promise((r) => setTimeout(r, TAKEOVER_RETRY_MS));
+		if (await acceptingOnce(address)) return true;
+	}
+	return false;
+}
+
 /**
  * Acquire the process lock for `name`. Resolves with a handle once THIS process
  * owns the kernel socket; rejects with {@link ProcessLockHeldError}

package/src/state/usage.ts

@@ -1,28 +1,18 @@
 import type { TeamTaskState, UsageState } from "./types.ts";
 
 /**
- * Lifetime usage — accumulated via message_end events, survives compaction.
- * cacheRead is excluded because each turn's cacheRead is the cumulative cached
- * prefix re-read on that one call — summing across turns would count it N times.
- * See: https://github.com/nichekate/pi-subagents3/issues/38
+ * Usage aggregation helpers for the run ledger and cost reporting.
+ *
+ * The ledger (aggregateUsage / RoleUsage) carries the FULL 5-field usage set
+ * (input, output, cacheRead, cacheWrite, cost) for accurate cost attribution.
+ * The canonical 5-field `LifetimeUsage` type lives in `src/runtime/usage-tracker.ts`.
+ *
+ * Token-sum displays and the budget proxy deliberately EXCLUDE cacheRead:
+ * each turn's cacheRead is the cumulative cached prefix re-read on that one
+ * call — summing across turns would count it N times.
+ * See: https://github.com/nichekate/pi-subagents3/issues/38 and
+ * docs/archive/pi-subagents3-deep-analysis.md
  */
-export type LifetimeUsage = {
-	input: number;
-	output: number;
-	cacheWrite: number;
-};
-
-/** Sum of lifetime usage components, or 0 if undefined. */
-export function getLifetimeTotal(u?: LifetimeUsage): number {
-	return u ? u.input + u.output + u.cacheWrite : 0;
-}
-
-/** Add a usage delta into a target accumulator (mutates target). */
-export function addUsage(into: LifetimeUsage, delta: LifetimeUsage): void {
-	into.input += delta.input;
-	into.output += delta.output;
-	into.cacheWrite += delta.cacheWrite;
-}
 
 export function aggregateUsage(tasks: TeamTaskState[]): UsageState | undefined {
 	const total: UsageState = {};
@@ -71,6 +61,8 @@ export interface RoleUsage {
 	role: string;
 	input: number;
 	output: number;
+	/** Ledger field — full cacheRead sum for cost attribution (not shown in token-sum displays). */
+	cacheRead: number;
 	cacheWrite: number;
 	cost: number;
 	turns: number;
@@ -88,6 +80,7 @@ export function aggregateUsageByRole(tasks: TeamTaskState[]): RoleUsage[] {
 				role,
 				input: 0,
 				output: 0,
+				cacheRead: 0,
 				cacheWrite: 0,
 				cost: 0,
 				turns: 0,
@@ -99,6 +92,7 @@ export function aggregateUsageByRole(tasks: TeamTaskState[]): RoleUsage[] {
 		if (!task.usage) continue;
 		bucket.input += task.usage.input ?? 0;
 		bucket.output += task.usage.output ?? 0;
+		bucket.cacheRead += task.usage.cacheRead ?? 0;
 		bucket.cacheWrite += task.usage.cacheWrite ?? 0;
 		bucket.cost += task.usage.cost ?? 0;
 		bucket.turns += task.usage.turns ?? 0;