pi-crew 0.11.22 → 0.11.24

package/src/runtime/broker/protocol/connection-state.ts

@@ -9,7 +9,8 @@
  */
 
 import type * as net from "node:net";
-import type { NdjsonDecoder } from "../../../utils/ndjson.ts";
+import { logInternalError } from "../../../utils/internal-error.ts";
+import { encodeBrokerFrame, type NdjsonDecoder } from "../../../utils/ndjson.ts";
 import type { GrandchildSpawnInput, GrandchildSpawnResult } from "../../delegate-spawn.ts";
 import type { WaitStatusCache } from "../wait-status-cache.ts";
 
@@ -22,6 +23,10 @@ export interface CrewBrokerOptions {
 	maxFrameBytes?: number;
 	/** Per-connection outbound queue cap. Default 256. */
 	outboundQueueCap?: number;
+	/** R8-M1: per-connection queued-BYTES cap (frames can be up to
+	 *  MAX_BROKER_FRAME_BYTES each, so the frame cap alone bounds the queue
+	 *  at cap × 256 KiB ≈ 64 MiB in-app). Default 4 MiB. */
+	outboundQueueBytesCap?: number;
 	/** Required: when false, start() is a no-op and the server never binds.
 	 *  Lets the lifecycle controller install the broker unconditionally and
 	 *  have a single kill switch. */
@@ -102,6 +107,9 @@ export interface ServerConnection {
 	authedSecretHash?: string;
 	/** Outbound queue of encoded frames awaiting drain. */
 	outbound: Buffer[];
+	/** R8-M1: sum of `outbound[i].length` — maintained by writeOrQueue/
+	 *  drainOutbound so the queued-BYTES cap does not rescan the queue. */
+	queuedBytes: number;
 	/** Set when the queue has hit the cap and a frame was dropped. */
 	needsResync: boolean;
 	/** Set when the connection is closing (idempotent). */
@@ -111,3 +119,153 @@ export interface ServerConnection {
 	/** Monotonic seq counter for outbound events (diagnostic). */
 	outboundSeq: number;
 }
+
+// ---------------------------------------------------------------------------
+// Outbound queue management (moved from crew-broker.ts — M4 wc-gate ≤2000;
+// pure move, no behavior change). The broker keeps thin delegating methods.
+// ---------------------------------------------------------------------------
+
+/** Default per-connection outbound queue cap (events). */
+export const DEFAULT_OUTBOUND_QUEUE_CAP = 256;
+
+/** R8-M1 (2026-10-17): default per-connection queued-BYTES cap. The frame cap
+ *  alone lets a subscribed-but-never-reading client buffer 256 × 256 KiB ≈
+ *  64 MiB in-app before the R6-5 typed close engages (kernel backpressure
+ *  shifts frames off the queue, so the count rarely grows — the BYTES the
+ *  process holds do). ~4 MiB bounds a stuck connection's memory while a
+ *  healthy LAN client drains comfortably inside it. */
+export const DEFAULT_OUTBOUND_QUEUE_BYTES = 4 * 1024 * 1024;
+
+/** R6-5 (2026-10-16): typed protocol close-reason sent as a best-effort
+ *  `protocol.close` event frame (direct write, jumps the saturated queue)
+ *  before the connection is closed after a fanout/event frame was dropped
+ *  at the queue cap. Clients observe the reason, reconnect, and replay via
+ *  `events.since` (Phase 1.5). */
+export const OUTBOUND_OVERFLOW_RESYNC_CLOSE_REASON = "outbound-overflow-resync";
+
+/** R6-5: admission class for an outbound frame.
+ *  - `false`  — fanout/event class: drop-newest at cap → resync close.
+ *  - `true`   — close-reason class: bypass the cap, attempt an immediate
+ *    direct write (existing `sendErrorAndClose` behavior).
+ *  - `"response"` — request-response class (sendResult/sendError acks):
+ *    bypass the drop-newest cap but stay IN the queue (ordering preserved,
+ *    backpressure honored). Bounded by the client's in-flight request count
+ *    — one response frame per request — so it can never storm the way a
+ *    fanout burst can. Kept a `boolean | "response"` union (not a fresh
+ *  enum) so the external FanoutWriters interface (mailbox-fanout.ts) keeps
+ *  its `(conn, buf, force: boolean)` shape. */
+export type OutboundAdmission = boolean | "response";
+
+export interface OutboundQueueOpts {
+	outboundQueueCap?: number;
+	outboundQueueBytesCap?: number;
+	sessionId: string;
+}
+export interface OutboundQueueHooks {
+	onOverflow(conn: ServerConnection): void;
+	onClose(conn: ServerConnection): void;
+}
+
+export function writeOrQueueFrame(
+	conn: ServerConnection,
+	buf: Buffer,
+	force: OutboundAdmission,
+	opts: OutboundQueueOpts,
+	hooks: OutboundQueueHooks,
+): void {
+	if (conn.closed) return;
+	const cap = opts.outboundQueueCap ?? DEFAULT_OUTBOUND_QUEUE_CAP;
+	// R8-M1: queued-BYTES cap alongside the frame cap. Few-but-large frames
+	// (a slow reader behind a 256 KiB fanout) never trip a 256-frame cap;
+	// without this the process buffers up to ~64 MiB per stuck connection.
+	// Overflow takes the same typed-close path as the frame cap (resync +
+	// reconnect + replay) — applied to ALL admission classes because the
+	// connection is about to close anyway and the alternative is unbounded
+	// memory, not a delivered response.
+	const bytesCap = opts.outboundQueueBytesCap ?? DEFAULT_OUTBOUND_QUEUE_BYTES;
+	if (conn.queuedBytes + buf.length > bytesCap) {
+		hooks.onOverflow(conn);
+		return;
+	}
+	if (conn.outbound.length >= cap) {
+		if (force === "response") {
+			// R6-5(a): response frames queue PAST the cap instead of being
+			// drop-newest'd. Bounded: at most one response per in-flight
+			// request, and the client's request pipeline is serial — this can
+			// never grow unbounded the way a fanout burst can. Ordering is
+			// preserved (pushed at the tail; drainOutbound honors backpressure).
+			conn.outbound.push(buf);
+			conn.queuedBytes += buf.length;
+			drainOutboundFrames(conn, hooks);
+			return;
+		}
+		if (force) {
+			// Forced sends (e.g. close-reason) bypass the cap and attempt
+			// to flush directly; if the socket is busy they may still drop.
+			try {
+				conn.socket.write(buf);
+			} catch {
+				/* socket may have closed; the close handler will sweep. */
+			}
+			return;
+		}
+		// R6-5(b): fanout/event frame dropped at cap (drop-newest). The old
+		// `needsResync` marker was write-only (set, never read) — the claimed
+		// "pause + client notices" recovery did not exist, so live frames
+		// were silently dropped for the connection's remaining lifetime.
+		// Now the drop CLOSES the connection with a typed close-reason so
+		// the client reconnects and replays (events.since / msg.inbox).
+		hooks.onOverflow(conn);
+		return;
+	}
+	conn.outbound.push(buf);
+	conn.queuedBytes += buf.length;
+	drainOutboundFrames(conn, hooks);
+}
+
+export function drainOutboundFrames(conn: ServerConnection, hooks: OutboundQueueHooks): void {
+	while (conn.outbound.length > 0) {
+		const buf = conn.outbound[0];
+		if (buf === undefined) break;
+		// Try the write; if it returns false, wait for drain before pushing more.
+		try {
+			const ok = conn.socket.write(buf);
+			if (!ok) {
+				// Backpressure — re-arm on drain event.
+				conn.socket.once("drain", () => {
+					if (!conn.closed) drainOutboundFrames(conn, hooks);
+				});
+				return;
+			}
+		} catch {
+			// Write failed — close the connection (we already had it open).
+			hooks.onClose(conn);
+			return;
+		}
+		conn.outbound.shift();
+		conn.queuedBytes -= buf.length;
+		conn.outboundSeq += 1;
+	}
+}
+
+export function handleOutboundOverflowFrame(conn: ServerConnection, opts: OutboundQueueOpts, hooks: OutboundQueueHooks): void {
+	// Single-flight: fanoutMailboxMessage iterates a snapshot of the run's
+	// connections, so one burst can re-enter here for an already-overflowing
+	// conn before `closeConnection`'s `closed` guard becomes visible. The
+	// flag is the "close already initiated" bit (its only read).
+	if (conn.needsResync) return;
+	conn.needsResync = true;
+	logInternalError(
+		"crew-broker.outbound.overflow",
+		new Error("outbound queue overflow — closing connection for resync"),
+		`sessionId=${opts.sessionId}
+runId=${conn.runId ?? "?"} queued=${conn.outbound.length} seq=${conn.outboundSeq}`,
+	);
+	try {
+		const buf = encodeBrokerFrame({ event: "protocol.close", data: { reason: OUTBOUND_OVERFLOW_RESYNC_CLOSE_REASON } });
+		conn.socket.write(buf);
+	} catch {
+		/* socket may be dead; closeConnection below sweeps regardless */
+	}
+	hooks.onClose(conn);
+}

package/src/runtime/broker/protocol/events-replay.ts

@@ -11,6 +11,7 @@
 
 import { readEventsCursor } from "../../../state/event-log/event-log.ts";
 import { loadRunManifestById } from "../../../state/stores/state-store.ts";
+import { encodeBrokerFrame } from "../../../utils/ndjson.ts";
 import type { ServerConnection } from "./connection-state.ts";
 
 export interface EventWriterHelpers {
@@ -50,18 +51,57 @@ export async function handleEventsSince(
 	const v = params && typeof params === "object" && !Array.isArray(params) ? (params as Record<string, unknown>) : {};
 	const sinceSeq = typeof v.sinceSeq === "number" && Number.isFinite(v.sinceSeq) ? Math.max(0, Math.floor(v.sinceSeq)) : 0;
 	const limit = typeof v.limit === "number" && Number.isFinite(v.limit) ? Math.min(Math.max(1, Math.floor(v.limit)), 1000) : 1000;
+	// R9-N2 (2026-10-17): optional byte-offset anchor + generation echo. The
+	// default (non-offset) read only sees the last TAIL_BYTES (4 MB) of the
+	// log, so the PREFIX of a larger log is unreachable by seq alone; a client
+	// that passes fromByteOffset pages it (the cursor resumes scanning from
+	// that byte position). Omitted → exact previous behavior.
+	const fromByteOffset =
+		typeof v.fromByteOffset === "number" && Number.isFinite(v.fromByteOffset) && v.fromByteOffset >= 0
+			? Math.floor(v.fromByteOffset)
+			: undefined;
+	const generation = typeof v.generation === "number" && Number.isFinite(v.generation) ? Math.floor(v.generation) : undefined;
 	try {
-		const result = readEventsCursor(eventsPath, { sinceSeq, limit });
-		// hasMore is true iff the total filtered count exceeds the page we
-		// returned. When `total === events.length` we are at the exact end
-		// of the stream (caller will discover this on the next call when
-		// `nextSeq` is unchanged from `sinceSeq`).
-		const hasMore = result.total > result.events.length;
-		helpers.sendResult(conn, id, {
-			events: result.events,
-			nextSeq: result.nextSeq,
-			hasMore,
+		const result = readEventsCursor(eventsPath, { sinceSeq, limit, fromByteOffset, generation });
+		// R9-N1 (2026-10-17): a page whose encoded frame exceeds the broker
+		// frame limit used to make sendResult → enqueueFrame → encodeBrokerFrame
+		// throw into a debug-only log — the client hung on its id with no
+		// response (runtime-proven on >256 KiB replays). Pre-check the EXACT
+		// response frame here and binary-halve the batch until it encodes;
+		// `truncated` + `nextSinceSeq` tell the client to page the rest. Never
+		// silence — if even ONE event cannot encode, answer with a typed error.
+		let events = result.events;
+		let frameTruncated = false;
+		let response: Record<string, unknown>;
+		const buildResponse = (): Record<string, unknown> => ({
+			events,
+			nextSeq: events.length ? events.reduce((max, event) => Math.max(max, event.metadata?.seq ?? 0), sinceSeq) : result.nextSeq,
+			hasMore: result.total > events.length,
+			// Continuation contract: nextSinceSeq is the seq to pass as sinceSeq on
+			// the next call (safe resume anchor — never past an undelivered event).
+			nextSinceSeq: events.length ? events.reduce((max, event) => Math.max(max, event.metadata?.seq ?? 0), sinceSeq) : result.nextSeq,
+			truncated: frameTruncated || result.truncated === true,
+			...(result.nextByteOffset !== undefined ? { nextByteOffset: result.nextByteOffset } : {}),
+			...(result.generation !== undefined ? { generation: result.generation } : {}),
 		});
+		while (true) {
+			response = buildResponse();
+			try {
+				encodeBrokerFrame(response);
+				break;
+			} catch {
+				if (events.length <= 1) {
+					// A single event over the frame limit can never page — typed error
+					// (enqueueFrame's R9-N1 fallback would also catch this, but failing
+					// here keeps the client's paging loop coherent).
+					helpers.sendError(conn, id, "response-oversize", "events.since: single event exceeds the broker frame limit");
+					return;
+				}
+				events = events.slice(0, Math.ceil(events.length / 2));
+				frameTruncated = true;
+			}
+		}
+		helpers.sendResult(conn, id, response);
 	} catch (err) {
 		helpers.sendError(conn, id, "replay-failed", (err as Error).message);
 	}

package/src/runtime/broker/protocol/request-parsers.ts

@@ -176,6 +176,74 @@ export function parseWaitRequestParams(value: unknown): WaitRequestParams | unde
 	};
 }
 
+// ============================================================================
+// R7-H1 fix (deep-review round 8): delegate.request parameter parser.
+// Mirrors parseWaitRequestParams discipline — the handler previously spread
+// `typeof x === "number"` values straight into `requested`, so non-integer,
+// non-finite, negative and over-ceiling maxTurns/budgetTokens reached
+// admission (e.g. raw-wire -1e9 budget → durable negative tokensSpent;
+// 1e999 → Infinity maxTurns → dead child-pi turn caps).
+// ============================================================================
+
+/** Server-side ceiling for grandchild turn caps (client tool schema: 1..200). */
+export const DELEGATE_MAX_TURNS_CEILING = 200;
+/** Server-side ceiling for grandchild token budgets (client schema: <=100M). */
+export const DELEGATE_BUDGET_TOKENS_CEILING = 100_000_000;
+/** Bounded delegate prompt (defense-in-depth under the frame cap). */
+export const DELEGATE_PROMPT_MAX_CHARS = 100_000;
+
+export interface DelegateRequestParams {
+	prompt: string;
+	description?: string;
+	role?: string;
+	model?: string;
+	maxTurns?: number;
+	budgetTokens?: number;
+	timeoutSec?: number;
+}
+
+export function parseDelegateRequestParams(value: unknown): DelegateRequestParams | undefined {
+	if (!value || typeof value !== "object" || Array.isArray(value)) return undefined;
+	const v = value as Record<string, unknown>;
+	if (typeof v.prompt !== "string" || v.prompt.trim().length === 0 || v.prompt.length > DELEGATE_PROMPT_MAX_CHARS) {
+		return undefined;
+	}
+	if (v.description !== undefined && typeof v.description !== "string") return undefined;
+	if (v.role !== undefined && !(typeof v.role === "string" && ["explorer", "analyst", "executor"].includes(v.role))) {
+		return undefined;
+	}
+	if (v.model !== undefined && typeof v.model !== "string") return undefined;
+	if (v.maxTurns !== undefined) {
+		if (typeof v.maxTurns !== "number" || !Number.isInteger(v.maxTurns) || v.maxTurns < 1 || v.maxTurns > DELEGATE_MAX_TURNS_CEILING) {
+			return undefined;
+		}
+	}
+	if (v.budgetTokens !== undefined) {
+		if (
+			typeof v.budgetTokens !== "number" ||
+			!Number.isInteger(v.budgetTokens) || // R8 lane-B correction: client Type.Integer parity (0.5/3.5 pass isFinite)
+			v.budgetTokens < 0 ||
+			v.budgetTokens > DELEGATE_BUDGET_TOKENS_CEILING
+		) {
+			return undefined;
+		}
+	}
+	// timeoutSec stays finite-only here; the 1..MAX range enforcement remains
+	// in spawn-policy §7 (evaluateDelegateAdmission).
+	if (v.timeoutSec !== undefined && (typeof v.timeoutSec !== "number" || !Number.isFinite(v.timeoutSec))) {
+		return undefined;
+	}
+	return {
+		prompt: v.prompt,
+		...(typeof v.description === "string" ? { description: v.description } : {}),
+		...(typeof v.role === "string" ? { role: v.role } : {}),
+		...(typeof v.model === "string" ? { model: v.model } : {}),
+		...(v.maxTurns !== undefined ? { maxTurns: v.maxTurns as number } : {}),
+		...(v.budgetTokens !== undefined ? { budgetTokens: v.budgetTokens as number } : {}),
+		...(v.timeoutSec !== undefined ? { timeoutSec: v.timeoutSec as number } : {}),
+	};
+}
+
 export interface WaitResolveParams {
 	to: string;
 	questionId: string;

package/src/runtime/child-pi/child-pi-constants.ts

@@ -31,6 +31,15 @@ export const RESPONSE_TIMEOUT_MS = DEFAULT_CHILD_PI.responseTimeoutMs;
  */
 export const MAX_LINE_BUFFER_BYTES = 1024 * 1024; // 1 MB
 
+/**
+ * R3A-M3 (wave-2b): byte cap for a single persisted transcript line. The
+ * buffer force-flush can hand the pipeline a raw "line" of up to 1 MB, and
+ * non-JSON lines are persisted VERBATIM (no compact stage) — a worker that
+ * base64-dumps a binary into its stdout would write it whole into the
+ * transcript. Lines beyond this cap are truncated with an explicit marker.
+ */
+export const MAX_PERSISTED_LINE_BYTES = 64 * 1024; // 64 KiB
+
 /** Maximum characters for assistant text fragments in compacted events. */
 export const MAX_ASSISTANT_TEXT_CHARS = DEFAULT_CHILD_PI.maxAssistantTextChars;
 

package/src/runtime/child-pi/child-pi-rpc.ts

@@ -169,12 +169,29 @@ interface RpcPoolEntry {
 	proc: ChildProcess;
 	/** True while the pooled process is idle between runs (reusable). */
 	idle: boolean;
+	/** R2-M-A5 (Wave-3): the run that pinned this process. Reuse re-validates
+	 * the requesting run matches — a pooled worker (its env, session dir,
+	 * transcript paths) is run-scoped and must NEVER cross run boundaries. */
+	pinnedRunId: string;
 }
 
 const rpcPool = new Map<string, RpcPoolEntry>();
 
-function poolKeyFor(input: ChildPiRunInput): string {
-	return input.agentId ?? input.agent.name;
+/** @internal — exported for the R2-M-A5 run-identity pinning test. */
+export function poolKeyFor(input: ChildPiRunInput): string {
+	// R2-M-A5 (Wave-3): the pool key is RUN-SCOPED. The old key (agentId only)
+	// let two DIFFERENT runs with the same agent id reuse one process — a
+	// worker's env/session/transcript state leaking across runs (and stale
+	// run-scoped registrations pointing at the wrong run).
+	const runId = input.runId ?? "untracked";
+	const agentId = input.agentId ?? "-";
+	return `${runId}:${agentId}:${input.agent.name}`;
+}
+
+/** R2-M-A5 (Wave-3): the run id a pool lookup must match for reuse. */
+/** @internal — exported for the R2-M-A5 run-identity pinning test. */
+export function requestingRunIdFor(input: ChildPiRunInput): string {
+	return input.runId ?? "untracked";
 }
 
 /**
@@ -187,9 +204,19 @@ function poolKeyFor(input: ChildPiRunInput): string {
  * evicted (the watchdog owns their failure); busy entries are left in place
  * and the caller falls back to a fresh spawn.
  */
-function acquirePooledRpcClient(key: string): RpcPoolEntry | undefined {
+function acquirePooledRpcClient(key: string, requestingRunId?: string): RpcPoolEntry | undefined {
 	const entry = rpcPool.get(key);
 	if (!entry) return undefined;
+	// R2-M-A5 (Wave-3): belt-and-braces identity re-validation — even if the
+	// key were ever reused across runs, a pinned-runId mismatch evicts the
+	// entry (stop best-effort) and forces a fresh spawn.
+	if (requestingRunId !== undefined && entry.pinnedRunId !== requestingRunId) {
+		rpcPool.delete(key);
+		void entry.client.stop().catch(() => {
+			/* identity eviction best-effort */
+		});
+		return undefined;
+	}
 	const stdin = entry.proc.stdin;
 	const procAlive = entry.proc.exitCode === null && entry.proc.signalCode === null && !!stdin && !stdin.destroyed;
 	if (!procAlive) {
@@ -319,7 +346,10 @@ export async function tryChildPiRpcRun(plan: ChildPiRpcRunPlan): Promise<ChildPi
 	// resolves in ~0ms; only a cold standalone test pays module load.
 	// LAZY: registered with scripts/check-lazy-imports.mjs (runtime dynamic import)
 	const { RpcClient } = await import("@earendil-works/pi-coding-agent");
-	const pooled = resolveChildPiRpcPoolEnabled() ? acquirePooledRpcClient(poolKeyFor(plan.input)) : undefined;
+	// R2-M-A5 (Wave-3): pass the requesting run id so reuse re-validates the pinned run.
+	const pooled = resolveChildPiRpcPoolEnabled()
+		? acquirePooledRpcClient(poolKeyFor(plan.input), requestingRunIdFor(plan.input))
+		: undefined;
 	const Ctor = RpcClient as unknown as new (options: unknown) => RpcClientInstance;
 	return runRpcSession(Ctor, plan, cliPath, pooled);
 }
@@ -357,6 +387,20 @@ async function runRpcSession(
 	}
 
 	// ── start (fresh spawns only) ─────────────────────────────────────────
+	// R2-L-A5 rider (wave-2b): every early-failure return below (spawn-error,
+	// no-process, canary-kill) bypasses the settle/finally tempDir cleanup at
+	// the bottom of this function — a leaked per-run scratch dir each time.
+	// finally-equivalent cleanup right before each return (fresh spawns only:
+	// a pooled reuse must not delete another task's scratch dir).
+	const cleanupFreshTempDir = (): void => {
+		if (!pooled && ctx.tempDir) {
+			try {
+				cleanupTempDir(ctx.tempDir);
+			} catch {
+				/* cleanup never masks the start failure */
+			}
+		}
+	};
 	if (!pooled) {
 		// Env-splice: RpcClient spawns with `{...process.env, ...options.env}`
 		// (rpc-client.js start()) — WITHOUT this splice the child would inherit
@@ -397,6 +441,7 @@ async function runRpcSession(
 			} catch {
 				/* listener errors never mask the start failure */
 			}
+			cleanupFreshTempDir();
 			return {
 				exitCode: null,
 				stdout: "",
@@ -425,6 +470,7 @@ async function runRpcSession(
 	// runtime (rpc-client.js field) — hence the structural cast.
 	const child = (client as unknown as { process: ChildProcess | null }).process;
 	if (!child) {
+		cleanupFreshTempDir();
 		return {
 			exitCode: null,
 			stdout: "",
@@ -458,6 +504,7 @@ async function runRpcSession(
 		} catch {
 			/* listener errors never mask the leak failure */
 		}
+		cleanupFreshTempDir();
 		return {
 			exitCode: null,
 			stdout: "",
@@ -764,9 +811,27 @@ async function runRpcSession(
 					child.stdin &&
 					!child.stdin.destroyed
 				) {
-					poolEntry = { client, proc: child, idle: false };
-					rpcPool.set(poolKey, poolEntry);
-					attachPoolExitHook(poolKey, child);
+					// R2-M-A5 (Wave-3): pin the registering run — reuse re-validates.
+					poolEntry = { client, proc: child, idle: false, pinnedRunId: requestingRunIdFor(input) };
+					// R2-M-A4 (2026-10-17): NEVER overwrite a live same-key entry — the
+					// previous unconditional rpcPool.set replaced (and orphaned) a live
+					// process: stdin open, unreachable, dead only at host shutdown. Skip
+					// registration instead (the run settles through the normal close path).
+					const existing = rpcPool.get(poolKey);
+					if (existing && existing !== poolEntry && existing.proc.exitCode === null) {
+						logInternalError(
+							"child-pi.rpc-pool-overwrite-guard",
+							new Error(
+								`rpcPool registration skipped: live entry already holds pool key ${poolKey} (pinnedRunId=${existing.pinnedRunId ?? "unknown"})`,
+							),
+							`pid=${existing.proc.pid}`,
+							"warn",
+						);
+						poolEntry = undefined;
+					} else {
+						rpcPool.set(poolKey, poolEntry);
+						attachPoolExitHook(poolKey, child);
+					}
 				}
 				if (poolEntry) {
 					// Warm path (acquired OR just registered): the process STAYS alive

package/src/runtime/child-pi/child-pi-streams.ts

@@ -14,6 +14,7 @@ import type { ChildPiRunInput } from "./child-pi.ts";
 import {
 	MAX_ASSISTANT_TEXT_CHARS,
 	MAX_LINE_BUFFER_BYTES,
+	MAX_PERSISTED_LINE_BYTES,
 	MAX_THINKING_CHARS,
 	MAX_TOOL_INPUT_CHARS,
 	MAX_TOOL_RESULT_CHARS,
@@ -85,7 +86,11 @@ export function compactChildPiEvent(event: unknown): unknown | undefined {
 		return {
 			type: record.type,
 			toolName: record.toolName,
-			args: record.args,
+			// R3A-M3 (wave-2b): tool args were passed through RAW — a single
+			// tool_execution carrying a 1 MB arg (e.g. an edit diff or base64
+			// blob) landed whole in the agent event log. Route through the same
+			// compaction as message content parts.
+			args: compactValue(record.args),
 		};
 	}
 	if (record.type === "tool_result_end" || record.type === "message_end" || record.type === "message") {
@@ -124,7 +129,10 @@ export function compactChildPiEvent(event: unknown): unknown | undefined {
 			taskId: record.taskId,
 			reason: record.reason,
 			message: record.message,
-			data: record.data,
+			// R3A-M3 (wave-2b): the "full payload" pass-through kept `data` raw —
+			// compact it too (the P2-25 intent was feature fidelity, not unbounded
+			// payload retention).
+			data: compactValue(record.data),
 		};
 	}
 	return record.type ? { type: record.type } : undefined;
@@ -178,7 +186,15 @@ function nonJsonLineResult(line: string): {
 	displayLine?: string;
 	json: boolean;
 } {
-	return { json: false, persistedLine: line, displayLine: line };
+	// R3A-M3 (wave-2b): non-JSON lines persist VERBATIM — cap them so a
+	// force-flushed mega-line (up to MAX_LINE_BUFFER_BYTES) or a binary dump
+	// cannot balloon the transcript. JSON lines go through compactChildPiEvent
+	// (bounded per-field); this is the unbounded escape hatch.
+	const capped =
+		line.length > MAX_PERSISTED_LINE_BYTES
+			? `${line.slice(0, MAX_PERSISTED_LINE_BYTES)}[pi-crew truncated ${line.length - MAX_PERSISTED_LINE_BYTES} chars]`
+			: line;
+	return { json: false, persistedLine: capped, displayLine: capped };
 }
 
 function compactChildPiLine(

package/src/runtime/child-pi/postmortem-registry.ts

@@ -31,8 +31,14 @@
  *                             event-log.ts) so sync flush handlers run first.
  *   - uncaughtException/unhandledRejection → setImmediate kick, never swallow:
  *                             we add no output and no exit; existing pi-crew
- *                             fatal handlers already own crash reporting (and
- *                             already suppress Node's default, see event-log).
+ *                             fatal handlers own crash reporting. NOTE
+ *                             (R3A-M1, 2026-10-17): they do NOT suppress —
+ *                             event-log's unhandledRejection handler re-throw
+ *                             keeps the process-fatal default, so a stray
+ *                             rejection still kills the host. Call sites must
+ *                             not rely on suppression existing; guard their
+ *                             own fire-and-forget promises (see
+ *                             live-agent-control.ts / live-session-runtime.ts).
  */
 
 import { logInternalError } from "../../utils/internal-error.ts";

package/src/runtime/classifier/ambient-noise-gate.ts

@@ -34,6 +34,7 @@
 import type { MetricRegistry } from "../../observability/metric-registry.ts";
 import { appendEventAsync } from "../../state/event-log/event-log.ts";
 import { logInternalError } from "../../utils/internal-error.ts";
+import { redactSecrets } from "../../utils/redaction.ts";
 import { classifyBool } from "./classifier-service.ts";
 
 export interface AmbientNoiseGateArgs {
@@ -88,7 +89,10 @@ export async function classifyAmbientNoiseGate(args: AmbientNoiseGateArgs): Prom
 		state: {
 			// Cap the summary: classifiers reason over small JSON state — the raw
 			// error can carry multi-KB stderr tails (same cap as retry-triage).
-			failureSummary: args.failureSummary.slice(0, 2000),
+			// R2-L-B8 (wave-2b): redact BEFORE the summary (and its slice) reaches
+			// classifier state — provider/API-key echoes in an auth failure would
+			// otherwise ride into the model prompt and the observed telemetry.
+			failureSummary: String(redactSecrets(args.failureSummary)).slice(0, 2000),
 			attempt: args.attempt,
 			maxAttempts: args.maxAttempts,
 		},

package/src/runtime/compaction/tool-output-pruner.ts

@@ -168,9 +168,13 @@ export function resultDigest(toolName: string, content: string, isError?: boolea
 	return undefined;
 }
 
-function createPrunedNotice(tokens: number, entry: ToolResultEntry): string {
+export function createPrunedNotice(tokens: number, entry: ToolResultEntry): string {
 	const generic = `[Output pruned — ${tokens} tokens]`;
-	const digest = resultDigest(entry.toolName, entry.content, entry.isError, entry.exitCode);
+	// R2-L-B7 (SEV-12): tools without a known digest format (edit/write/read…)
+	// previously fell back to the content-free generic notice — dependency-context
+	// consumers lost ALL evidence the tool did anything. Generic head-2/tail-2
+	// digest keeps a bounded content signal for every tool.
+	const digest = resultDigest(entry.toolName, entry.content, entry.isError, entry.exitCode) ?? genericLineDigest(entry.content);
 	if (!digest) return generic;
 	const genericTokens = countTokens(generic);
 	const maxTokens = Math.max(genericTokens, Math.floor(genericTokens * DIGEST_NOTICE_TOKEN_CAP_MULTIPLIER));
@@ -180,6 +184,20 @@ function createPrunedNotice(tokens: number, entry: ToolResultEntry): string {
 	return `${prefix}${truncateField(digest, maxChars)}${suffix}`;
 }
 
+/** R2-L-B7: generic digest for tools without a dedicated format — first two
+ * and last two non-empty lines, deduped when the content is short. Never
+ * empty (falls back to a line count) so the pruned notice always carries a
+ * content signal. */
+function genericLineDigest(content: string): string {
+	const lines = (content ?? "")
+		.split(/\r?\n/)
+		.map((line) => line.trim())
+		.filter(Boolean);
+	if (lines.length === 0) return "empty output";
+	if (lines.length <= 4) return `${lines.length} line(s): ${lines.join(" ⏎ ")}`;
+	return `head=${lines.slice(0, 2).join(" ⏎ ")}; tail=${lines.slice(-2).join(" ⏎ ")}`;
+}
+
 // ---------------------------------------------------------------------------
 // Target key resolution
 // ---------------------------------------------------------------------------