pi-crew 0.11.22 → 0.11.24

package/CHANGELOG.md

@@ -2,6 +2,28 @@
 
 ## [Unreleased]
 
+### Fixed (deep review 2026-10-16/17 — Waves 2-4; report `pi-crew-deep-review-2026-10-16.md`, 128/128 cold-verified)
+
+- **fix(state): FS2 + R5-M-B4 + family-2 read-error wipes** — readCrewAgents/plan-store/ownership-map/active-run-registry/orphan-worker-registry no longer collapse non-ENOENT read faults to empty feeding a locked full overwrite (sentinel + skip-save + loud log; ST-4-style guards).
+- **fix(ui): R4-B1 + R5-M-A3 terminal-escape injection closed** — new `sanitizeUntrustedLine` (strips ALL OSC/APC, non-SGR CSI, DCS/bare-ESC; C0/C1→space) applied at 10 worker-data render seams (mailbox-detail, snapshot-cache, transcript pane/viewer, agents-pane, dashboard, plan-pane). OSC-52 clipboard poison + OSC-8 dispatch now render inert (pinning tests).
+- **fix(broker): R9-N1/N2 + R8-M1 replay/overflow hardening** — oversize encode can no longer silently hang events.since (typed `response-oversize` + limit-halving with `nextSinceSeq` continuation); wide-path replay gains `fromByteOffset`/`truncated` continuation (prefix of >4MB logs replayable); per-connection queued-BYTES cap (4 MiB) alongside the frame cap.
+- **fix(prompt): R9-F1 delegate-result recovery** — pending delegate results surviving in the task inbox are re-injected at poll-loop restart (turn-restart drop fixed at the pi-crew seam) + timeout-notice recovery hint.
+- **fix(recovery): R2-M-A1 + R4-N1** — individual-stale reconcile cancels ONLY the stale tasks (pid-alive siblings untouched); foreign-rotation (size<offset) now aborts compaction instead of clobbering the new live file.
+- **fix(security/policy — Wave 3, owner-decided defaults):** 8-entry worker-origin root-gate (schedule/goal+force/config-user/settings-user+theme/autonomy/create-user/update-user — reads + project scope stay open); explorer+librarian lose `bash` in BOTH frontmatter and ROLE_TOOL_CONFIGS (Chain A cheapest cut); MCP G2-degradation now fails CLOSED for non-permitted roles; structured safety-refusal stop-reasons are non-retryable (no more safety-refusal laundering); IRC peer messages fenced `<untrusted-peer-message>`; DWF identical-call cache is resume-only (live runs re-spawn — the documented review loop now works); judge fence length adapts to backtick runs; workspace-lock post-claim/post-refresh ownership verify + heartbeat-false → goal blocked; rpc pool keyed per-run with pinnedRunId re-validation; sqlite corrupt-DB quarantine (.corrupt-<ts> + user_version=1) instead of permanent unloadability; goal maxTurns clamped to LIMIT_CEILINGS; hermeticWorkers:false init warning; peer pins floored >=1.0.4.
+- **fix(reliability — Wave 4):** R9-F3 effectiveness counts delegate.completed; R9-OPS2 stale /tmp pc-*.sock sweep (24h); spawnedRunIds pruned; tmux-watcher/BatchBarrier disposal; cron scan hoisted+hopped (no 527k-iteration stall); prune digest head-2/tail-2 fallback for all tools; herdr 10s request timeout + error-ack → mux-dead; oscillation period-2 detection; parked-ask shield derives from clamped deadline (+ broker stamps manifest.waitState.deadline); purgeStaleActiveRunIndex isIntentionalWait + waitState clear; rpcPool overwrite guard; FS6 liveness-before-exactly-once; FS7 fallback attempt enters accounting; FS8 writer-timeout terminates wedged worker; client per-request timer unref'd; steer.push requestId dedupe; missed-cron one-time skipped event.
+- **fix(hardening one-liners):** TMPDIR in child env allowlists (macOS run-lock dual-guard actually contends); escalate `to` validated; deadletter assertSafePathId; PI_TEAMS_PI_BIN path-separator boundary; submit_result error-result on throw; launch-script env-key regex; quoted `command -v` probe; classifier failureSummary redacted; tool_execution args/supervisor_contact compacted + 64KiB line cap; env-vars numeric defaults route through parsers; mock-seam double-gated; sqlite 0600; theme atomic write + no corrupt-wipe; OTLP CUMULATIVE temporality + header precedence; goal-wrap spawn-failure → blocked (no zombie goal); CI-only concurrency clamp; sweep-test-tmp age guard; watch-bundle recursion; temp-root realpath both sides; agent frontmatter ceilings; non-finite heartbeat = corrupt lock; agent-events cursor seq-sort; settings enums derived from schema (+ drift test); mailbox seam sanitize; R10-C1 duplicate-condition fix.
+
+### Fixed (deep review 2026-10-16/17 — Wave 1; report `pi-crew-deep-review-2026-10-16.md`, 128/128 cold-verified)
+
+- **fix(recovery): R2-H1 — orphan reconcile persisted the FILTERED zombie subset** (tasks.json data loss, runtime-proven). `/tmp` orphan reconcile wrote `result.repairedTasks` (stale-only subset) via full-overwrite — every sibling record destroyed on a timer tick. Now persists `result.persistTasks ?? repairedTasks` (mirror of `crash-recovery.ts`); caller retention pinning test (3-task fixture: alive + zombie + completed all retained).
+- **fix(scheduling): R3-H1 — coalesced-group writes used the dispatch-time snapshot** (concurrent sibling state loss, runtime-proven ×3). Terminal write (:401) and both pre-dispatch saves (:64/:89) now use the in-file `repairGroupTerminalWrite` fresh-read group-scoped merge (was wired only to the late-heartbeat path); concurrent-sibling pinning test + repair-warn companion updated.
+- **fix(state): R4-A1 — agents.json requeue subset-wipe** (deterministic). Both ask-requeue paths (`dispatch-batch.ts` sweep + `respond.ts`) overwrote the authoritative index with only the requeued subset — RUNNING siblings unresolvable until next full save. Both now full-set merge (mirror `team-runner.ts:525-538`); retention tests on both paths.
+- **fix(broker): R7-H1 — delegate.request params bypassed the server-side validation family** (durable budget/turn-cap sandbox escape, exploit-transcript-proven). `maxTurns`/`budgetTokens` were parsed with `typeof === "number"` only: `budgetTokens:-1e9` durably inflated remaining budget by ~1e9 (reserve decrements `tokensSpent` unclamped; refunds gated `reserved > 0` never reconcile), `maxTurns:1e999` → Infinity killed soft+hard turn caps. New `parseDelegateRequestParams` (in `broker/protocol/request-parsers.ts`, the family home): `Number.isInteger` maxTurns 1..200 + budgetTokens 0..100_000_000 (client `Type.Integer` parity), prompt ≤100k, role enum, timeoutSec finite with §7 range — rejected `bad-params` BEFORE admission and the reserve write; edge-matrix tests (15 cases from the runtime negative control).
+- **fix(process): R7-A2 — zombie-scanner `isPidAlive` treated EPERM as dead** — live-but-protected workers landed in `scan.zombies` and `doctor` SIGHUPed them. Now `code !== ESRCH && code !== ENOENT → alive` (mirror of active-run-registry R7-15); EPERM pinning test.
+- **fix(prompt): R7-P1 — surface workers self-terminated at 5s off-Linux** — `parentAlive`'s default `/proc` reader throws off-Linux and `return false` fired BEFORE the empty-start-time tolerance the host writer implements; guard now armed only when `/proc` is readable. Verified in clone (surface-runtime 38/38).
+- **fix(event-log): FS1 + FS3**. FS1: agent-events `.seq` sidecar trusted with no regression guard — crash-window re-mints duplicate seqs that `> sinceSeq` consumers drop forever; now max(sidecar, tail-scan) like EL-1. FS3: cursor `nextSeq=max-delivered` + file-order slice stranded lower-seq events forever on documented non-monotonic files (field-confirmed in 7 runs); `filtered` is now seq-sorted before the limit slice (2 sites); the 2 file-order test pins updated to seq-order contract.
+- **fix(run): R5-M-B3 — 4 bare `void appendEventAsync` in `run.ts`** (probe-proven host crash via unhandledRejection, exit=7); all now `.catch`-logged (17 other sites already were).
+
 ### Fixed (rounds 4–7 audit waves — DR-02/DR-03/DR-04, reports `docs/reviews/pi-crew-audit-round{4,5,6,7}-*.md`)
 
 - **fix(state): DR-03 C1 — disk-terminal status preserved + delegate allocation max-merge** (R6-1 HIGH). `persistSingleTaskUpdate` reloaded disk inside the lock but `updateTask` replaced by id UNCONDITIONALLY — a detached runner's late settle overwrote a crash-recovery `cancelled` task with `completed` and emitted `task.completed` after `crew.run.orphan_cancelled`. New `mergeTaskUpdateWithDisk()` preserves a differing disk-terminal status (result fields still recorded); post-execution derives the persisted status from the persist return (terminal events via `TERMINAL_TASK_EVENT_TYPES` — never `task.completed` over cancelled). R6-4: delegate budget reserve/roll-up now merges `tokensSpent=max(disk,incoming)` — the 1s heartbeat whole-record replace could no longer clobber a reservation (lost update), and refund over-subtraction self-heals.

package/agents/explorer.md

@@ -5,7 +5,7 @@ model: false
 systemPromptMode: replace
 inheritProjectContext: true
 inheritSkills: false
-tools: read, grep, find, ls, glob, bash, ask
+tools: read, grep, find, ls, glob, ask
 useWhen: "read-only mapping of files, symbols, constraints"
 avoidWhen: "any write action, external docs lookup"
 cost: free
@@ -19,7 +19,7 @@ You are a fast codebase explorer. Your job is FAST, READ-ONLY reconnaissance —
 - "File discovery" / "where does X live" → `glob` / `find`
 - "Read this specific file" → `read` with offset/limit if the file is large
 - "Directory survey" → `ls`
-- `bash` ONLY when a pipeline is genuinely the better diagnostic (e.g., `git log -p | head -50`). NEVER `cat`/`head`/`tail` to dump a file into context.
+- No `bash` — read/grep/find/ls/glob only (read-only enforced toolset; attack-chain A hardening). Prefer targeted `grep`/`read` with line ranges over dumping files into context.
 - Structural/AST search is unavailable — approximate with targeted `grep` patterns; flag residual uncertainty in UNCERTAIN.
 
 ## Output format
@@ -37,7 +37,7 @@ ROUTING: <which downstream role should consume this — analyst|executor|planner
 ```
 
 ## Boundaries
-- READ-ONLY. No edit/write; bash must not mutate anything.
+- READ-ONLY. No edit/write/bash.
 - Do not extract FULL file contents; return paths + line numbers.
 - If the question requires external docs/libraries (not in this repo), flag in ROUTING as "librarian" — route external-documentation questions to librarian instead of fetching them yourself.
 

package/agents/librarian.md

@@ -5,7 +5,7 @@ model: false
 systemPromptMode: replace
 inheritProjectContext: true
 inheritSkills: false
-tools: read, grep, find, ls, glob, bash, ask
+tools: read, grep, find, ls, glob, ask
 useWhen: "library internals and version behavior from on-disk evidence"
 avoidWhen: "repo-local code mapping, web fetching"
 cost: cheap
@@ -19,7 +19,7 @@ You are a librarian — a research specialist for documentation and dependency s
 - "What changed in version Y" → read `node_modules/<pkg>/CHANGELOG.md` + `package.json` version
 - "Official usage pattern for X" → grep the package's own README/docs/tests — tests are the most honest documentation
 - "Where is X configured in this repo" → `grep`/`glob` across the workspace, including lockfiles
-- `bash` ONLY for pipelines (e.g., `cat package.json | jq .dependencies`); NEVER fetch remote resources — you have no web tools; flag external needs in UNCERTAIN
+- No `bash` — read/grep/find/ls/glob only (read-only enforced toolset; attack-chain A hardening). Read dependency sources directly with `read`/`grep`.
 
 ## Evidence discipline
 - Quote the exact file:line you based each claim on.
@@ -44,6 +44,6 @@ UNCERTAIN: <what requires external docs/web you could not verify locally, with r
 
 ## Anti-patterns
 - DO NOT answer API behavior from model memory without checking the installed source — memory is version-blind.
-- DO NOT `curl`/`wget` remote docs via bash — flag the gap in UNCERTAIN instead.
+- DO NOT `curl`/`wget` remote docs (no web/bash tools) — flag the gap in UNCERTAIN instead.
 - DO NOT read entire large files; use grep to locate, then read a window.
 - DO NOT conflate this repo's local conventions with the library's official guidance.