pi-crew 0.11.27 → 0.11.28

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "pi-crew",
-	"version": "0.11.27",
+	"version": "0.11.28",
 	"description": "Pi extension for coordinated AI teams, workflows, worktrees, and async task orchestration",
 	"author": "baphuongna",
 	"license": "MIT",

package/src/runtime/dwf-state-store.ts

@@ -49,6 +49,13 @@ export interface DwfCheckpointState {
 	 *  Uses Record (not Map) for JSON serialization safety. Optional: legacy
 	 *  checkpoints (and fresh states) omit it. */
 	completedAgentCalls?: Record<string, AgentResult>;
+	/** R14-C3 (wave 7, 2026-10-20): dispatch-time run context fingerprint. On
+	 * save the runner stamps {modelOverride, team}; on resume a mismatch with
+	 * the CURRENT dispatch context emits dwf.resume_context_mismatch — replayed
+	 * agent results were produced under a different model/team and the operator
+	 * should know (fail-open with visibility; the completed-call cache is still
+	 * intentional work-skip). Absent on legacy checkpoints → check skipped. */
+	dispatchContext?: { modelOverride?: string; team?: string };
 	updatedAt: string;
 }
 

package/src/runtime/goal-workflow/dynamic-workflow-runner.ts

@@ -210,6 +210,36 @@ export async function runDynamicWorkflow(input: RunDynamicWorkflowInput): Promis
 	const dwfStore = new DwfStore(manifest.stateRoot);
 	const resumedState = dwfStore.load();
 	if (resumedState) {
+		// R14-C3 (wave 7): fingerprint check — a resume that changes the dispatch
+		// context (modelOverride/team) still replays the completed-call cache, but
+		// that replay now carries an operator-visible mismatch warning instead of
+		// silently passing off old-model results as current-model work.
+		const savedCtx2 = resumedState.dispatchContext;
+		const norm = (v: string | undefined): string | undefined => (v && v.length > 0 ? v : undefined);
+		if (savedCtx2 && norm(savedCtx2.modelOverride) !== norm(input.modelOverride)) {
+			await appendEventAsync(eventsPath, {
+				type: "dwf.resume_context_mismatch",
+				runId: manifest.runId,
+				data: {
+					axis: "modelOverride",
+					checkpoint: savedCtx2.modelOverride ?? null,
+					current: input.modelOverride ?? null,
+				},
+				message: `resume modelOverride differs from checkpoint (was ${savedCtx2.modelOverride ?? "default"}, now ${input.modelOverride ?? "default"}) — replayed agent results were produced under the checkpoint's model`,
+			});
+		}
+		if (savedCtx2 && norm(savedCtx2.team) !== norm(input.team?.name)) {
+			await appendEventAsync(eventsPath, {
+				type: "dwf.resume_context_mismatch",
+				runId: manifest.runId,
+				data: {
+					axis: "team",
+					checkpoint: savedCtx2.team ?? null,
+					current: input.team?.name ?? null,
+				},
+				message: `resume team differs from checkpoint (was ${savedCtx2.team ?? "default"}, now ${input.team?.name ?? "default"}) — replayed agent results were produced under the checkpoint's team`,
+			});
+		}
 		await appendEventAsync(eventsPath, {
 			type: "dwf.resumed",
 			runId: manifest.runId,
@@ -228,6 +258,14 @@ export async function runDynamicWorkflow(input: RunDynamicWorkflowInput): Promis
 	const timeoutController = new AbortController();
 	const combinedSignal = AbortSignal.any([signal, timeoutController.signal]);
 
+	// R14-C3 (wave 7): dispatch-time fingerprint stamped into every checkpoint
+	// save; the resume path above compares it against the CURRENT dispatch
+	// context and emits dwf.resume_context_mismatch on drift.
+	const dispatchContext: { modelOverride?: string; team?: string } = {
+		...(input.modelOverride ? { modelOverride: input.modelOverride } : {}),
+		...(input.team?.name ? { team: input.team.name } : {}),
+	};
+
 	const ctx = makeWorkflowCtx(manifest, {
 		concurrency: input.concurrency ?? workflow.maxConcurrency ?? 4,
 		signal: combinedSignal,
@@ -241,9 +279,11 @@ export async function runDynamicWorkflow(input: RunDynamicWorkflowInput): Promis
 		resumedState,
 		// round-18 P2-3: checkpoint after each ctx.agent() call so a crash between calls
 		// leaves durable state. onCheckpoint captures the closure values at call time.
+		// R14-C3 (wave 7): dispatchContext (declared above the ctx) is stamped into
+		// every save so a later resume can compare against the current dispatch.
 		onCheckpoint: (state) => {
 			try {
-				dwfStore.save(state);
+				dwfStore.save({ ...state, dispatchContext });
 			} catch (error) {
 				logInternalError("dynamic-workflow-runner.checkpoint-save", error, `runId=${manifest.runId}`);
 			}

package/src/runtime/pi-spawn.ts

@@ -289,7 +289,15 @@ function validateExplicitBin(explicit: string): string | undefined {
 		}
 	} catch (e) {
 		if (e instanceof Error && e.message.includes("allowed prefixes")) throw e;
-		logInternalError("pi-spawn", e, "validateExplicitBin: unexpected realpathSync error", "error");
+		// R2-L-A2 (wave 7): the drop is now stated explicitly in the message — the
+		// operator sees that their explicit pin was IGNORED and which fallback ran,
+		// not just the raw realpath error.
+		logInternalError(
+			"pi-spawn",
+			e,
+			`validateExplicitBin: unexpected realpathSync error — explicit PI_TEAMS_PI_BIN='${resolved}' IGNORED, falling back to default pi resolution`,
+			"error",
+		);
 		return undefined;
 	}
 	return resolved;

package/src/runtime/scheduling/scheduler.ts

@@ -92,7 +92,12 @@ export class CrewScheduler {
 		//	update() (never add()), so a normal fire's stale nextRun cannot reach here.
 		this.reportMissedCronOccurrences(job);
 		if (job.enabled) this.arm(job);
-		this.emit?.({ type: "added", job });
+		// R14-C4 (wave 7, 2026-10-20): arm() can mutate the stored entry BEFORE the
+		// added event fires (e.g. a past `once` job flips to enabled:false,
+		// lastStatus:"error" via update()). Emitting the ORIGINAL stale object
+		// confused event-order consumers (disk converged; the event stream didn't).
+		// Emit the post-arm truth from the map instead.
+		this.emit?.({ type: "added", job: this.jobs.get(job.id) ?? job });
 	}
 
 	remove(id: string): boolean {
@@ -189,6 +194,12 @@ export class CrewScheduler {
 	private arm(job: ScheduledJob): void {
 		if (this.timers.has(job.id)) return;
 		if (job.scheduleType === "interval" && job.intervalMs) {
+			// R2-L-B10 (wave 7, documented design choice): interval jobs re-arm from
+			// FIRE time via the chained hop, but the fire() → update() → disarm/arm
+			// lifecycle only re-arms after the run COMPLETES — the effective period is
+			// intervalMs + run duration, NOT schedule-aligned wall-clock spacing.
+			// Deliberate (no overlap between occurrences of the same job); recorded
+			// here so the semantics are discoverable at the arm site.
 			// 2026-09-22 spawn-storm root cause: this branch used
 			// setInterval(fire, intervalMs). Node timers are 32-bit — a LEGAL long
 			// interval (e.g. 90d = 7,776,000,000ms > 2^31-1) overflows and Node

package/src/state/contracts.ts

@@ -234,6 +234,9 @@ export const TEAM_EVENT_TYPES = [
 	"crew.task.retry_attempt",
 	// Dynamic workflow resume
 	"dwf.resumed",
+	// R14-C3 (wave 7): resume dispatch-context drift (modelOverride/team) —
+	// replayed agent results were produced under a different context.
+	"dwf.resume_context_mismatch",
 	// Foreground interrupt
 	"foreground.interrupt_requested",
 	// Goal loop (P0/P1) additional outcomes

package/src/state/stores/artifact-store.ts

@@ -206,6 +206,16 @@ export function pruneExpiredArtifacts(descriptors: ArtifactDescriptor[], options
 		if (!lstat.isDirectory()) throw new Error(`artifacts root is not a directory`);
 		realAnchor = fs.realpathSync(options.artifactsRoot);
 	} catch (error) {
+		// W7-C2 (2026-10-20): a MISSING anchor directory means the run's whole
+		// artifacts tree is already gone (age-based cleanup, an earlier prune, or
+		// operator removal) — there is nothing under it left to delete, so this is
+		// success-shaped silence, not a failure. Fail-closed behavior is unchanged
+		// (return 0, nothing deleted). Session start walks EVERY retained manifest,
+		// so warning here printed one line per stale run per boot (battery
+		// 2026-10-19 observation #4). Other anchor failures (symlink anchor,
+		// non-directory, permissions) stay visible warns.
+		const code = (error as NodeJS.ErrnoException).code;
+		if (code === "ENOENT") return 0;
 		logInternalError(
 			"artifact-store.prune-anchor",
 			error instanceof Error ? error : new Error(String(error)),

package/src/state/stores/state-store.ts

@@ -1243,7 +1243,18 @@ export function loadRunManifestById(cwd: string, runId: string): { manifest: Tea
 	let manifest: TeamRunManifest | undefined;
 	let tasks: TeamTaskState[] | undefined;
 	while (attempts < LOAD_MANIFEST_RETRY_LIMIT) {
-		const freshStat = fs.statSync(manifestPath);
+		let freshStat: fs.Stats;
+		try {
+			freshStat = fs.statSync(manifestPath);
+		} catch (error) {
+			// R2-L-A1 (wave 7, 2026-10-20): the run dir can vanish between the
+			// caller's listing and this load (crash-recovery sweeps, artifact
+			// cleanup, operator rm). A thrown ENOENT aborted the WHOLE best-effort
+			// sweep for the session; "cannot be loaded" is undefined — the loop's
+			// own missing-file contract.
+			if ((error as NodeJS.ErrnoException).code === "ENOENT") return undefined;
+			throw error;
+		}
 		// PERF (2026-08-24, Task 12 realized): after saveRunTasksCoalesced the
 		// cache keeps the manifest half of the entry while zeroing only the
 		// tasks stamps, so this slow path runs solely to refresh tasks. When the
@@ -1421,7 +1432,15 @@ export async function loadRunManifestByIdAsync(
 	let tasks: TeamTaskState[] | undefined;
 	let attempts = 0;
 	while (attempts < LOAD_MANIFEST_RETRY_LIMIT) {
-		const freshStat = await fs.promises.stat(manifestPath);
+		let freshStat: fs.Stats;
+		try {
+			freshStat = await fs.promises.stat(manifestPath);
+		} catch (error) {
+			// R2-L-A1 (wave 7): async twin — ENOENT mid-sweep returns undefined
+			// instead of aborting the caller's best-effort sweep.
+			if ((error as NodeJS.ErrnoException).code === "ENOENT") return undefined;
+			throw error;
+		}
 		// PERF (2026-08-24, Task 12 realized): async twin of the sync reuse —
 		// after saveRunTasksCoalesced only the tasks stamps are zeroed, so when
 		// the retained manifest stamps match the fresh stat (same verification

package/src/ui/theme-adapter.ts

@@ -195,8 +195,20 @@ function startThemeSourceSubscription(theme: object, subscription: ThemeSourceSu
 		subscription.unsubscribeSource = removeListener;
 		return;
 	}
+	// R2-L-B9 (wave 7, 2026-10-20): the poll closure previously held a STRONG
+	// ref to the theme — an abandoned subscription (consumer never calls the
+	// returned unsubscribe) kept the theme + subscription + callbacks alive
+	// forever with a permanent 1s poll. Hold only a WeakRef: once the theme is
+	// collected, the next tick self-terminates the interval (≤1s later), after
+	// which the closure chain is collectable.
+	const weakTheme = new WeakRef<object>(theme);
 	subscription.pollTimer = setInterval(() => {
-		const nextSignature = themeSignature(theme);
+		const live = weakTheme.deref();
+		if (!live) {
+			clearInterval(subscription.pollTimer);
+			return;
+		}
+		const nextSignature = themeSignature(live);
 		if (nextSignature === subscription.lastSignature) return;
 		subscription.lastSignature = nextSignature;
 		emit();