pi-crew 0.11.22 → 0.11.23

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "pi-crew",
-	"version": "0.11.22",
+	"version": "0.11.23",
 	"description": "Pi extension for coordinated AI teams, workflows, worktrees, and async task orchestration",
 	"author": "baphuongna",
 	"license": "MIT",

package/src/extension/team-tool/respond.ts

@@ -327,12 +327,14 @@ export function handleRespond(params: TeamToolParamsValue, ctx: TeamContext): Pi
 		if (requeuedIds.length > 0) {
 			try {
 				const existingRuntimes = new Map(readCrewAgents(fresh.manifest).map((a) => [a.taskId, a.runtime]));
-				saveCrewAgents(
-					fresh.manifest,
-					updatedTasks
-						.filter((task) => requeuedIds.includes(task.id))
-						.map((task) => recordFromTask(fresh.manifest, task, existingRuntimes.get(task.id) ?? "child-process")),
-				);
+				// R4-A1 (fix): merge requeued records into the existing index — the
+				// subset-only save wiped sibling agent records (team-runner.ts:525 pattern).
+				const mergedById = new Map(readCrewAgents(fresh.manifest).map((record) => [record.id, record] as const));
+				for (const task of updatedTasks.filter((task) => requeuedIds.includes(task.id))) {
+					const record = recordFromTask(fresh.manifest, task, existingRuntimes.get(task.id) ?? "child-process");
+					mergedById.set(record.id, record);
+				}
+				saveCrewAgents(fresh.manifest, [...mergedById.values()]);
 			} catch (error) {
 				logInternalError("team-tool.handleRespond.crewAgents", error, `runId=${fresh.manifest.runId}`);
 			}

package/src/extension/team-tool/run.ts

@@ -137,7 +137,7 @@ function scheduleBackgroundEarlyExitGuard(cwd: string, runId: string, pid: numbe
 					runId: failed.runId,
 					message,
 					data: { pid, detail: liveness.detail },
-				});
+				}).catch((error) => logInternalError("team-tool.run.asyncFailedEvent", error, `runId=${failed.runId}`)); // R5-M-B3 (fix)
 			});
 		} catch (error) {
 			// One-shot unref'd timer — a lock-contention error must not escape and
@@ -589,7 +589,7 @@ export async function handleRun(params: TeamToolParamsValue, ctx: TeamContext):
 						envTeams: getCrewEnv("PI_TEAMS_EXECUTE_WORKERS"),
 					},
 				},
-			});
+			}).catch((error) => logInternalError("team-tool.run.blockedEvent", error, `runId=${blocked.runId}`)); // R5-M-B3 (fix)
 			unregisterActiveRun(blocked.runId);
 			return result(
 				[
@@ -622,7 +622,7 @@ export async function handleRun(params: TeamToolParamsValue, ctx: TeamContext):
 			type: "async.spawned",
 			runId: effectiveManifest.runId,
 			data: { pid: spawned.pid, logPath: spawned.logPath },
-		});
+		}).catch((error) => logInternalError("team-tool.run.asyncSpawnedEvent", error, `runId=${effectiveManifest.runId}`)); // R5-M-B3 (fix)
 		ctx.onRunStarted?.(effectiveManifest.runId);
 		scheduleBackgroundEarlyExitGuard(resolvedCtx.cwd, effectiveManifest.runId, spawned.pid, spawned.logPath);
 		// CORE-8: unified deadline for waitForRun timeout (background process is detached).
@@ -684,7 +684,7 @@ export async function handleRun(params: TeamToolParamsValue, ctx: TeamContext):
 					envTeams: getCrewEnv("PI_TEAMS_EXECUTE_WORKERS"),
 				},
 			},
-		});
+		}).catch((error) => logInternalError("team-tool.run.blockedEvent", error, `runId=${blocked.runId}`)); // R5-M-B3 (fix)
 		unregisterActiveRun(blocked.runId);
 		return result(
 			[

package/src/prompt/surface-worker.ts

@@ -142,11 +142,23 @@ export function parentAlive(pid: number, expectedStartTime: string | undefined,
 			}
 		});
 	let stat: string | undefined;
+	let readerThrew = false;
 	try {
 		stat = reader(pid);
 	} catch {
-		stat = undefined;
+		// R7-P1 guard-gate fix (deep-review round 7/9): a THROWING/unreadable
+		// stat reader (macOS-shaped: /proc absent → read error) with NO
+		// recorded expectedStartTime cannot PROVE the parent died. The doc
+		// contract above ("Never kills on … an unreadable clock field — a
+		// false 'alive' falls back to the host watchdog") demands the
+		// alive-with-caveat tolerance here; the pre-fix code fell through to
+		// `return false` BEFORE the tolerance check and killed healthy
+		// workers at the first 5s tick.
+		readerThrew = true;
 	}
+	if (readerThrew) return expectedStartTime ? false : true;
+	// Reader returned "no entry" (default /proc reader ENOENT = dead on
+	// Linux) — dead-parent detection stays intact.
 	if (stat === undefined) return false;
 	if (!expectedStartTime) return true;
 	const observed = procStartTimeTicks(stat);

package/src/runtime/broker/crew-broker.ts

@@ -73,6 +73,7 @@ import {
 	BROKER_PROTOCOL,
 	isHelloParams,
 	isRequestObject,
+	parseDelegateRequestParams,
 	parseMsgSendParams,
 	parseWaitRequestParams,
 	safeStringify,
@@ -1455,28 +1456,16 @@ export class CrewBroker {
 			this.sendError(conn, id, "forbidden", "delegate requires a task-scoped token; re-dispatch with PI_CREW_BROKER_TASK_ID");
 			return;
 		}
-		const p = (params ?? {}) as {
-			description?: unknown;
-			prompt?: unknown;
-			role?: unknown;
-			model?: unknown;
-			maxTurns?: unknown;
-			budgetTokens?: unknown;
-			timeoutSec?: unknown;
-		};
-		if (typeof p.prompt !== "string" || p.prompt.trim().length === 0) {
-			this.sendError(conn, id, "bad-params", "delegate.request: 'prompt' (non-empty string) is required");
+		// R7-H1 fix: parse params through the protocol-level parser (mirrors
+		// parseWaitRequestParams discipline) — non-integer/non-finite/negative/
+		// over-ceiling maxTurns/budgetTokens never reach admission or the
+		// budget reservation (durable-negative tokensSpent escape).
+		const parsed = parseDelegateRequestParams(params);
+		if (!parsed) {
+			this.sendError(conn, id, "bad-params", "delegate.request: invalid params");
 			return;
 		}
-		const requested = {
-			prompt: p.prompt,
-			...(typeof p.description === "string" ? { description: p.description } : {}),
-			...(typeof p.role === "string" ? { role: p.role } : {}),
-			...(typeof p.model === "string" ? { model: p.model } : {}),
-			...(typeof p.maxTurns === "number" ? { maxTurns: p.maxTurns } : {}),
-			...(typeof p.budgetTokens === "number" ? { budgetTokens: p.budgetTokens } : {}),
-			...(typeof p.timeoutSec === "number" ? { timeoutSec: p.timeoutSec } : {}),
-		};
+		const requested = parsed;
 		const cwd = this.options.cwd;
 		if (!cwd) {
 			this.sendError(conn, id, "no-manifest", "broker has no cwd configured");

package/src/runtime/broker/protocol/request-parsers.ts

@@ -176,6 +176,74 @@ export function parseWaitRequestParams(value: unknown): WaitRequestParams | unde
 	};
 }
 
+// ============================================================================
+// R7-H1 fix (deep-review round 8): delegate.request parameter parser.
+// Mirrors parseWaitRequestParams discipline — the handler previously spread
+// `typeof x === "number"` values straight into `requested`, so non-integer,
+// non-finite, negative and over-ceiling maxTurns/budgetTokens reached
+// admission (e.g. raw-wire -1e9 budget → durable negative tokensSpent;
+// 1e999 → Infinity maxTurns → dead child-pi turn caps).
+// ============================================================================
+
+/** Server-side ceiling for grandchild turn caps (client tool schema: 1..200). */
+export const DELEGATE_MAX_TURNS_CEILING = 200;
+/** Server-side ceiling for grandchild token budgets (client schema: <=100M). */
+export const DELEGATE_BUDGET_TOKENS_CEILING = 100_000_000;
+/** Bounded delegate prompt (defense-in-depth under the frame cap). */
+export const DELEGATE_PROMPT_MAX_CHARS = 100_000;
+
+export interface DelegateRequestParams {
+	prompt: string;
+	description?: string;
+	role?: string;
+	model?: string;
+	maxTurns?: number;
+	budgetTokens?: number;
+	timeoutSec?: number;
+}
+
+export function parseDelegateRequestParams(value: unknown): DelegateRequestParams | undefined {
+	if (!value || typeof value !== "object" || Array.isArray(value)) return undefined;
+	const v = value as Record<string, unknown>;
+	if (typeof v.prompt !== "string" || v.prompt.trim().length === 0 || v.prompt.length > DELEGATE_PROMPT_MAX_CHARS) {
+		return undefined;
+	}
+	if (v.description !== undefined && typeof v.description !== "string") return undefined;
+	if (v.role !== undefined && !(typeof v.role === "string" && ["explorer", "analyst", "executor"].includes(v.role))) {
+		return undefined;
+	}
+	if (v.model !== undefined && typeof v.model !== "string") return undefined;
+	if (v.maxTurns !== undefined) {
+		if (typeof v.maxTurns !== "number" || !Number.isInteger(v.maxTurns) || v.maxTurns < 1 || v.maxTurns > DELEGATE_MAX_TURNS_CEILING) {
+			return undefined;
+		}
+	}
+	if (v.budgetTokens !== undefined) {
+		if (
+			typeof v.budgetTokens !== "number" ||
+			!Number.isInteger(v.budgetTokens) || // R8 lane-B correction: client Type.Integer parity (0.5/3.5 pass isFinite)
+			v.budgetTokens < 0 ||
+			v.budgetTokens > DELEGATE_BUDGET_TOKENS_CEILING
+		) {
+			return undefined;
+		}
+	}
+	// timeoutSec stays finite-only here; the 1..MAX range enforcement remains
+	// in spawn-policy §7 (evaluateDelegateAdmission).
+	if (v.timeoutSec !== undefined && (typeof v.timeoutSec !== "number" || !Number.isFinite(v.timeoutSec))) {
+		return undefined;
+	}
+	return {
+		prompt: v.prompt,
+		...(typeof v.description === "string" ? { description: v.description } : {}),
+		...(typeof v.role === "string" ? { role: v.role } : {}),
+		...(typeof v.model === "string" ? { model: v.model } : {}),
+		...(v.maxTurns !== undefined ? { maxTurns: v.maxTurns as number } : {}),
+		...(v.budgetTokens !== undefined ? { budgetTokens: v.budgetTokens as number } : {}),
+		...(v.timeoutSec !== undefined ? { timeoutSec: v.timeoutSec as number } : {}),
+	};
+}
+
 export interface WaitResolveParams {
 	to: string;
 	questionId: string;

package/src/runtime/crew-agent-records.ts

@@ -698,6 +698,21 @@ function writeSeqToSidecar(filePath: string, seq: number): void {
 	}
 }
 
+function scanMaxAgentEventSeq(filePath: string): number {
+	let max = 0;
+	for (const line of fs.readFileSync(filePath, "utf-8").split(/\r?\n/)) {
+		if (!line.trim()) continue;
+		try {
+			const parsed = JSON.parse(line) as { seq?: unknown };
+			if (typeof parsed.seq === "number" && Number.isFinite(parsed.seq)) max = Math.max(max, parsed.seq);
+			else max += 1;
+		} catch {
+			max += 1;
+		}
+	}
+	return max;
+}
+
 function nextAgentEventSeq(filePath: string): number {
 	if (!fs.existsSync(filePath)) {
 		// Clean up stale sidecar when main file is gone.
@@ -714,24 +729,21 @@ function nextAgentEventSeq(filePath: string): number {
 	// FIX: Try sidecar file for O(1) lookup before falling back to O(n) scan.
 	const sidecarSeq = readSeqFromSidecar(filePath);
 	if (sidecarSeq !== undefined) {
+		// FS1 (fix, EL-1 port from event-log sequence-cache.ts): a REGRESSED
+		// sidecar (crash between append and sidecar advance, or lost best-effort
+		// durability) must never re-mint used seqs — trust it only as
+		// max(sidecar, tail-scan), else cursor consumers (seq > sinceSeq)
+		// permanently drop the duplicate-seq events.
+		const safeSeq = Math.max(sidecarSeq, scanMaxAgentEventSeq(filePath));
 		setAgentEventSeqCache(filePath, {
 			size: stat.size,
 			mtimeMs: stat.mtimeMs,
-			seq: sidecarSeq,
+			seq: safeSeq,
 		});
-		return sidecarSeq + 1;
-	}
-	let max = 0;
-	for (const line of fs.readFileSync(filePath, "utf-8").split(/\r?\n/)) {
-		if (!line.trim()) continue;
-		try {
-			const parsed = JSON.parse(line) as { seq?: unknown };
-			if (typeof parsed.seq === "number" && Number.isFinite(parsed.seq)) max = Math.max(max, parsed.seq);
-			else max += 1;
-		} catch {
-			max += 1;
-		}
+		if (safeSeq !== sidecarSeq) writeSeqToSidecar(filePath, safeSeq);
+		return safeSeq + 1;
 	}
+	const max = scanMaxAgentEventSeq(filePath);
 	setAgentEventSeqCache(filePath, {
 		size: stat.size,
 		mtimeMs: stat.mtimeMs,

package/src/runtime/dispatch-batch.ts

@@ -202,12 +202,15 @@ export async function sweepExpiredWaitingTasks(
 		}
 		try {
 			const existingRuntimes = new Map(readCrewAgents(fresh.manifest).map((a) => [a.taskId, a.runtime]));
-			saveCrewAgents(
-				fresh.manifest,
-				tasks
-					.filter((t) => requeuedTaskIds.includes(t.id))
-					.map((t) => recordFromTask(fresh.manifest, t, existingRuntimes.get(t.id) ?? "child-process")),
-			);
+			// R4-A1 (fix): agents.json is a full-index overwrite — merge the requeued
+			// records into the existing set (team-runner.ts:525 pattern) instead of
+			// persisting the subset alone (siblings incl. RUNNING agents were wiped).
+			const mergedById = new Map(readCrewAgents(fresh.manifest).map((record) => [record.id, record] as const));
+			for (const task of tasks.filter((t) => requeuedTaskIds.includes(t.id))) {
+				const record = recordFromTask(fresh.manifest, task, existingRuntimes.get(task.id) ?? "child-process");
+				mergedById.set(record.id, record);
+			}
+			saveCrewAgents(fresh.manifest, [...mergedById.values()]);
 		} catch (error) {
 			logInternalError("dispatch-batch.ask-timeout.crewAgents", error, `runId=${runId}`);
 		}

package/src/runtime/process/zombie-scanner.ts

@@ -179,8 +179,12 @@ function isPidAlive(pid: number): boolean {
 		// process.kill(pid, 0) throws if the pid is not alive (or not ours).
 		process.kill(pid, 0);
 		return true;
-	} catch {
-		return false;
+	} catch (error) {
+		// R7-A2 (2026-10-17): only ESRCH/ENOENT mean the process is gone.
+		// EPERM means the process is alive but protected (different security
+		// context); treat as alive — mirror of active-run-registry.ts fix.
+		const code = (error as NodeJS.ErrnoException).code;
+		return code !== "ESRCH" && code !== "ENOENT";
 	}
 }
 

package/src/runtime/scheduling/run-coalesced-task-group.ts

@@ -61,7 +61,9 @@ export async function runCoalescedTaskGroup(input: CoalescedTaskGroupInput): Pro
 		}
 		return t;
 	});
-	await saveRunTasksAsync(manifest, updatedTasks);
+	// R3-H1 (fix): fresh-read group-scoped merge — never persist the dispatch-time
+	// full-array snapshot over concurrent sibling state changes.
+	await repairGroupTerminalWrite(manifest, taskIds, updatedTasks);
 	await appendEventAsync(manifest.eventsPath, {
 		type: "task.coalesced_dispatch_start",
 		runId: manifest.runId,
@@ -86,7 +88,9 @@ export async function runCoalescedTaskGroup(input: CoalescedTaskGroupInput): Pro
 			heartbeat: t.heartbeat ?? createWorkerHeartbeat(t.id),
 		};
 	});
-	await saveRunTasksAsync(manifest, updatedTasks);
+	// R3-H1 (fix): fresh-read group-scoped merge — never persist the dispatch-time
+	// full-array snapshot over concurrent sibling state changes.
+	await repairGroupTerminalWrite(manifest, taskIds, updatedTasks);
 
 	let rawOutput = "";
 	let success = false;
@@ -398,7 +402,9 @@ export async function runCoalescedTaskGroup(input: CoalescedTaskGroupInput): Pro
 			if (drainTimeout !== undefined) clearTimeout(drainTimeout);
 		}
 	}
-	await saveRunTasksAsync(manifest, updatedTasks);
+	// R3-H1 (fix): fresh-read group-scoped merge — never persist the dispatch-time
+	// full-array snapshot over concurrent sibling state changes.
+	await repairGroupTerminalWrite(manifest, taskIds, updatedTasks);
 	let updatedManifest: TeamRunManifest = {
 		...manifest,
 		artifacts: mergeArtifacts([...manifest.artifacts, ...newArtifacts]),

package/src/runtime/stale-reconciler.ts

@@ -713,7 +713,10 @@ export function reconcileOrphanedTempWorkspaces(
 						const result = reconcileStaleRun(manifest, tasks, now);
 						if (result.repaired && result.repairedTasks) {
 							// Persist repaired tasks (atomic — temp+rename to survive mid-write crash)
-							atomicWriteJson(tasksPath, result.repairedTasks);
+							// R2-H1 (fix): persist the FULL array (NEW-1 persistTasks), not the filtered
+							// stale subset — the subset write destroyed every sibling record (mirror
+							// crash-recovery.ts:1066).
+							atomicWriteJson(tasksPath, result.persistTasks ?? result.repairedTasks);
 							// Update manifest status
 							const updated = {
 								...manifest,

package/src/state/event-log/cursor.ts

@@ -522,7 +522,15 @@ function cursorResultFromEvents(
 	// streaming consumers. No-rotation case: no archives exist → behavior is
 	// byte-identical to before (mergeArchiveTailEvents returns liveEvents).
 	const merged = mergeArchiveTailEvents(readArchiveTailEvents(eventsPath, sinceSeq), filtered);
-	const events = limit !== undefined ? merged.slice(0, limit) : merged;
+	// FS3 (fix): seq-sort before the limit slice. File-order slicing on a
+	// documented non-monotonic log can deliver an early high seq inside the
+	// first `limit` events; nextSeq=max-delivered then permanently skips every
+	// undelivered lower-seq event for paging consumers resuming from nextSeq.
+	// Sort ONLY under a limit: the no-limit path delivers every event (nextSeq
+	// = true max ⇒ nothing skippable) and keeps its historical FILE-order
+	// contract (pinned by event-log-torn-poison.test.ts AC7, U22 Phase 1).
+	const events =
+		limit !== undefined ? [...merged].sort((a, b) => (a.metadata?.seq ?? 0) - (b.metadata?.seq ?? 0)).slice(0, limit) : merged;
 	const returnedMaxSeq = events.reduce((max, event) => Math.max(max, event.metadata?.seq ?? 0), sinceSeq);
 	return {
 		events,
@@ -782,7 +790,11 @@ export function readEventsCursor(eventsPath: string, options: EventCursorOptions
 		const filtered = safeItems.filter((event) => (event.metadata?.seq ?? 0) > sinceSeq);
 		const merged = mergeArchiveTailEvents(drainedArchiveEvents, filtered);
 		const limit = positiveInteger(options.limit);
-		const events = limit !== undefined ? merged.slice(0, limit) : merged;
+		// FS3 (fix): seq-sort before the limit slice — see cursorResultFromEvents.
+		// Sort ONLY under a limit (no-limit keeps the historical file-order
+		// contract; nothing is skippable when everything is delivered).
+		const events =
+			limit !== undefined ? [...merged].sort((a, b) => (a.metadata?.seq ?? 0) - (b.metadata?.seq ?? 0)).slice(0, limit) : merged;
 		const returnedMaxSeq = events.reduce((max, event) => Math.max(max, event.metadata?.seq ?? 0), sinceSeq);
 		// BR-08: `read.state.byteOffset` sits past the ENTIRE delta read above —
 		// including the events the `limit` slice just dropped. Handing that back