pi-crew 0.11.30 → 0.11.35

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "pi-crew",
-	"version": "0.11.30",
+	"version": "0.11.35",
 	"description": "Pi extension for coordinated AI teams, workflows, worktrees, and async task orchestration",
 	"author": "baphuongna",
 	"license": "MIT",

package/src/config/env-allowlist-registry.ts

@@ -198,6 +198,24 @@ const CREW_ENV_FORWARDING_DECL: Record<string, CrewEnvForwardDecision> = {
 		reason: "per-task compound broker token via built.env/pipe (F4) — secret, never allowlisted",
 	},
 	PI_CREW_BROKER_TASK_ID: { kind: "child-write", reason: "child-pi-spawn broker handshake" },
+	PI_CREW_INFERENCE_BROKER: {
+		kind: "gap",
+		reason: "v0.11.31 inference broker toggle — resolved in the PARENT only (ensureInferenceBroker); deliberately never forwarded to children (a child re-starting its own broker would be nonsensical)",
+	},
+	PI_CREW_INFERENCE_TOKEN: {
+		kind: "child-write",
+		reason: "v0.11.31 per-worker inference broker token via built.env — secret, never allowlisted",
+	},
+	PI_CREW_INFERENCE_BUDGET_TOKENS: {
+		kind: "gap",
+		reason: "v0.11.31 per-worker budget read by the parent broker at token issuance (registerInferenceWorker)",
+	},
+	PI_CREW_INFERENCE_UPSTREAM: {
+		kind: "test-only",
+		reason: "v0.11.31 broker upstream override — TESTS ONLY (local mock), production never sets it",
+	},
+	PI_CREW_INFERENCE_UPSTREAM_ANTHROPIC: { kind: "test-only", reason: "v0.11.34 anthropic-only broker upstream override — TESTS ONLY" },
+	PI_CREW_INFERENCE_UPSTREAM_OPENAI: { kind: "test-only", reason: "v0.11.34 openai-only broker upstream override — TESTS ONLY" },
 	PI_CREW_STEERING_FILE: { kind: "child-write", reason: "child-pi-spawn per-run steering JSONL" },
 	PI_CREW_MAX_OUTPUT: { kind: "child-write", reason: "pi-args emits agent.maxTokens into built.env" },
 	PI_CREW_RPC_SECRET: { kind: "child-write", reason: "shared HMAC secret handed to the child at spawn — secret name, never allowlisted" },

package/src/config/env-vars.ts

@@ -494,6 +494,32 @@ export const CREW_ENV_VARS: Record<string, CrewEnvVarSpec> = {
 		name: "PI_CREW_WORKER_TRANSPORT",
 		doc: "W7 EXPERIMENTAL worker transport override: 'rpc' selects the prototype RPC frame-client (src/runtime/rpc/) at the run-worker seam (wired e2728f68; D1/DR2 also plumbs config runtime.workerTransport to the same seam — env WINS over config when set, invalid env fails safe to stdio); anything else/unset → config value, default stdio child-pi path (rpc-worker.ts resolveWorkerTransport)",
 	},
+	PI_CREW_INFERENCE_BROKER: {
+		name: "PI_CREW_INFERENCE_BROKER",
+		parser: "boolean",
+		doc: "v0.11.31 (S-broker PoC) opt-in loopback inference broker: '1' starts a 127.0.0.1 HTTP broker in the parent; child workers get ONLY a per-worker token (PI_CREW_INFERENCE_TOKEN) + a scoped agent dir (PI_CODING_AGENT_DIR containing models.json that reroutes the built-in anthropic provider to the broker) instead of any real provider key. Real key (ANTHROPIC_API_KEY / ANTHROPIC_AUTH_TOKEN from the PARENT env only) is substituted after requests leave the worker. FAIL-CLOSED: flag set without an upstream credential throws at first spawn (inference-broker.ts). PoC: anthropic upstream only, env-credential users only (auth.json users unsupported yet)",
+	},
+	PI_CREW_INFERENCE_TOKEN: {
+		name: "PI_CREW_INFERENCE_TOKEN",
+		doc: "v0.11.31 child-side per-worker inference broker token (256-bit random, heap-only on the parent, injected via built.env by prepareSpawnContext when the broker is active; interpolated into models.json apiKey as $PI_CREW_INFERENCE_TOKEN by the child at request time). NEVER user-set; workerKey-scoped — re-registering a task id replaces (kills) the old token",
+	},
+	PI_CREW_INFERENCE_BUDGET_TOKENS: {
+		name: "PI_CREW_INFERENCE_BUDGET_TOKENS",
+		parser: "int",
+		doc: "v0.11.31 per-worker inference token budget counted from streamed Anthropic usage events; 0/unset = unlimited. Requests past the budget get 429 (inference-broker.ts registerInferenceWorker)",
+	},
+	PI_CREW_INFERENCE_UPSTREAM: {
+		name: "PI_CREW_INFERENCE_UPSTREAM",
+		doc: "v0.11.31 inference broker upstream override applied to EVERY provider (defaults: anthropic https://api.anthropic.com, openai https://api.openai.com/v1). TESTS ONLY — points the broker at a local mock upstream; production callers must never set it",
+	},
+	PI_CREW_INFERENCE_UPSTREAM_ANTHROPIC: {
+		name: "PI_CREW_INFERENCE_UPSTREAM_ANTHROPIC",
+		doc: "v0.11.34 anthropic-only broker upstream override (beats PI_CREW_INFERENCE_UPSTREAM). TESTS ONLY — local mock; production must never set it",
+	},
+	PI_CREW_INFERENCE_UPSTREAM_OPENAI: {
+		name: "PI_CREW_INFERENCE_UPSTREAM_OPENAI",
+		doc: "v0.11.34 openai-only broker upstream override (beats PI_CREW_INFERENCE_UPSTREAM). TESTS ONLY — local mock; production must never set it",
+	},
 	PI_CREW_CLASSIFIER_ENABLED: {
 		name: "PI_CREW_CLASSIFIER_ENABLED",
 		parser: "boolean",

package/src/extension/crew-cleanup.ts

@@ -1,4 +1,5 @@
 import type { ExtensionAPI } from "@earendil-works/pi-coding-agent";
+import { stopInferenceBroker } from "../runtime/child-pi/inference-broker.ts";
 import { cleanupAllTrackedTempDirs } from "../runtime/model/pi-args.ts";
 import { isSessionSwitchInFlight } from "../ui/inline-panel/view-session-store.ts";
 import { logInternalError } from "../utils/internal-error.ts";
@@ -89,6 +90,16 @@ export function registerCleanupHandler(pi: ExtensionAPI, opts?: { disposeTermina
 			// Kill all child-pi processes
 			await cleanupChildProcesses();
 
+			// v0.11.31: stop the loopback inference broker — revokes every
+			// worker token (kill-switch) and removes the scoped agent dir BEFORE
+			// generic temp cleanup (which would also catch it — this is the
+			// explicit, token-revoking path).
+			try {
+				stopInferenceBroker();
+			} catch (error) {
+				logInternalError("crew-cleanup.inference-broker", error);
+			}
+
 			// Cleanup temp directories
 			await cleanupTempDirectories();
 

package/src/runtime/child-pi/child-pi-spawn.ts

@@ -28,6 +28,13 @@ import { buildPiWorkerArgs, createSafeTempDir, getPiTempBase } from "../model/pi
 import { getPiSpawnCommand } from "../pi-spawn.ts";
 import { findLatestScratchpadSnapshot } from "../scratchpad/snapshot-lookup.ts";
 import type { ChildPiRunInput, ChildPiRunResult } from "./child-pi.ts";
+import {
+	getInferenceBrokerSnapshot,
+	INFERENCE_TOKEN_ENV,
+	PI_AGENT_DIR_ENV,
+	registerInferenceWorker,
+	requireInferenceBrokerIfEnabled,
+} from "./inference-broker.ts";
 
 // ── Env allowlist (base set always passed to children) ──────────────────
 // Provider API keys are injected dynamically via buildScopedAllowList() only
@@ -102,7 +109,13 @@ export function buildChildPiSpawnOptions(
 	// provider does not spawn keyless. When no model is given, only
 	// BASE_ALLOWLIST system vars pass through — no provider keys leak.
 	const scopeModels: (string | undefined)[] = modelChain && modelChain.length > 0 ? modelChain : model !== undefined ? [model] : [];
-	const allowList = scopeModels.length > 0 ? buildScopedAllowList(BASE_ALLOWLIST, scopeModels) : BASE_ALLOWLIST;
+	// v0.11.31 inference broker: when active, the child's ONLY credential is
+	// its per-worker broker token — provider env keys are NEVER injected (they
+	// would defeat the broker by handing the worker the real reusable key
+	// again). The broker snapshot is read-only module state (no side effects —
+	// the broker is started by prepareSpawnContext, never here).
+	const inferenceBrokerActive = getInferenceBrokerSnapshot().active;
+	const allowList = !inferenceBrokerActive && scopeModels.length > 0 ? buildScopedAllowList(BASE_ALLOWLIST, scopeModels) : BASE_ALLOWLIST;
 	// R6-8: warn when the scoped models resolve to ZERO provider env keys AND at
 	// least one is a truly-bare id (no "provider/" prefix) — env-key auth + bare
 	// id means the child worker will very likely fail authentication (observed as
@@ -244,6 +257,15 @@ export function buildFinalChildPiSpawnOptions(
 	//     process would never see steering file, kind, role, or broker creds.
 	//     Safe because step (a) just proved builtEnv holds no secret keys.
 	spawnOptions.env = { ...spawnOptions.env, ...builtEnv };
+	// (c′) v0.11.31 inference broker: pi's NATIVE agent-dir override is NOT a
+	//     control-namespace key, so it never travels through built.env (step (a)
+	//     would reject it) — it is mapped here, at the spawn-options layer, from
+	//     the broker snapshot when a per-worker token is present. The scoped dir
+	//     contains ONLY models.json (no auth.json, no extensions, no skills).
+	const inferenceSnapshot = getInferenceBrokerSnapshot();
+	if (inferenceSnapshot.active && builtEnv[INFERENCE_TOKEN_ENV]) {
+		spawnOptions.env[PI_AGENT_DIR_ENV] = inferenceSnapshot.scopedAgentDir ?? "";
+	}
 	// (d) Return the composed SpawnOptions for spawn(...).
 	return spawnOptions;
 }
@@ -265,6 +287,8 @@ export interface SpawnContext {
 	tempDir: string | undefined;
 	/** The per-call built.env (control vars only) — for security canary assertions. */
 	builtEnv: Record<string, string | undefined>;
+	/** v0.11.31: inference-broker worker key that owns this spawn's token (cleanup/revoke bookkeeping). */
+	inferenceWorkerKey?: string;
 }
 
 /**
@@ -308,6 +332,21 @@ export function prepareSpawnContext(
 		// child env gets parentDepth+1 = the true grandchild depth.
 		env: depthEnv,
 	});
+	// v0.11.31 inference broker (opt-in PI_CREW_INFERENCE_BROKER=1): the broker
+	// must already be running (child-pi.ts run() awaits maybeStartInferenceBroker()
+	// first — http listen needs an event-loop turn, so the SYNC spawn path can
+	// only require, never start). Issue this worker's token. Control-namespace
+	// key → passes assertOnlyControlEnvKeys. FAIL-CLOSED: flag on without a
+	// started broker or an upstream credential throws here (never silently
+	// spawn keyless / real-key workers). Worker key: the task id when present
+	// (retries REPLACE the old token — registerInferenceWorker semantics), else
+	// a per-spawn unique.
+	const inferenceSnapshot = requireInferenceBrokerIfEnabled();
+	let inferenceWorkerKey: string | undefined;
+	if (inferenceSnapshot.active) {
+		inferenceWorkerKey = input.agentId ? `inference:${input.agentId}` : `inference:spawn:${process.pid}:${Date.now().toString(36)}`;
+		built.env[INFERENCE_TOKEN_ENV] = registerInferenceWorker(inferenceWorkerKey);
+	}
 	// Pass steering file path to child for real-time steer injection
 	if (input.steeringFile) built.env.PI_CREW_STEERING_FILE = input.steeringFile;
 	// I5: run/task identity is threaded ALWAYS (not broker-gated) so the worker's
@@ -433,6 +472,7 @@ export function prepareSpawnContext(
 			mergedEnv: { ...process.env, ...built.env },
 			tempDir: built.tempDir,
 			builtEnv: built.env,
+			inferenceWorkerKey,
 		},
 	};
 }

package/src/runtime/child-pi/child-pi.ts

@@ -36,6 +36,7 @@ import { ChildPiSteeringController } from "./child-pi-steering.ts";
 import { ChildPiLineObserver, isFinalAssistantEvent } from "./child-pi-streams.ts";
 // Phase 2.3: the six timer constructs moved to child-pi-timers.ts (pure motion).
 import { createChildPiTimers } from "./child-pi-timers.ts";
+import { maybeStartInferenceBroker } from "./inference-broker.ts";
 import { runMockChildPi } from "./mock-fixtures.ts";
 // W2 (session-file recovery): deterministic worker session flags + crash-path
 // tail-replay of the session JSONL (see session-recovery.ts header).
@@ -777,6 +778,9 @@ export async function runChildPi(input: ChildPiRunInput): Promise<ChildPiRunResu
 	// guard below returns before the argv is ever consumed.
 	const versionedInput: ChildPiRunInput =
 		!input.signal?.aborted && !resolveHermeticWorkers(input.hermeticWorkers) ? { ...input, piVersion: await probePiVersion() } : input;
+	// v0.11.31: start the inference broker (flag-gated, fail-closed) BEFORE the
+	// sync spawn-prep path — http listen needs an event-loop turn.
+	await maybeStartInferenceBroker();
 	const spawnPrep = prepareSpawnContext(brokerSpawn ? { ...versionedInput, brokerSpawn } : versionedInput, effectiveTask, depthEnv);
 	if (spawnPrep.kind === "aborted") return spawnPrep.result;
 	const { spawnSpec, mergedEnv, tempDir, builtEnv, builtArgs } = spawnPrep.ctx;