pi-crew 0.11.4 → 0.11.5

package/CHANGELOG.md

@@ -1,5 +1,44 @@
 # Changelog
 
+## [0.11.5] — Phase A + Buổi 1 quick wins: G1 fence, NEW-1 data-loss, G18 breakdown, Node-24 matrix (2026-09-30)
+
+### fix(security): G1 — sanitize the dependency-output fence body (mirror ADR-5 seams)
+
+- `renderDependencyOutputContext` (`src/runtime/task-output-context.ts`) inlined worker-controlled text (dependency `resultSummary`, `structuredResults` JSON, sharedRead content) into the next worker's prompt with only a `.trim()` — the last of the 4 prompt seams without the trust fence. A malicious/compromised dependency could smuggle a literal `</dependency-context>` to close the fence early and promote its payload to the instruction channel, or smuggle control chars. Now a local `sanitizeFencedBody()` (mirroring `renderAskAnswer`/`renderDelegateResult` in `src/prompt/prompt-runtime.ts`) strips control chars and neutralizes the closing-tag literal, applied once at the return so future fields are covered automatically. Pinned RED-first by `test/unit/runtime/core/task-output-context-fence.test.ts` (6 cases: 3 smuggling sinks, control-char strip, benign-unchanged snapshot, wrapper-opens/closes-once).
+
+### fix(state): NEW-1 — persist the FULL task array on individual-stale repair (data-loss)
+
+- The individual-stale branch of `reconcileStaleRun` returned `repairedTasks` already FILTERED to the stale subset, and the crash-recovery caller full-overwrote `tasks.json` with it — every healthy task silently vanished from disk until the parent merged (permanent loss if the parent crashed in that window; the 12m27s heartbeat-freeze trigger was observed live). New `persistTasks` field (option A2): the individual-stale branch also returns the full mutated array, the caller persists `persistTasks ?? repairedTasks`, while `repairedTasks` keeps its exact meaning (what was repaired — the upsert/detail loop is untouched). Pinned RED-first by 3 new cases in `test/unit/runtime/core/stale-reconciler.test.ts` (full-shape, caller-persists-all-4-tasks via `reconcileAllStaleRuns`, regression guard that the other 4 branches leave `persistTasks` unset).
+
+### feat(inspect): G18 — `breakdown` action reads per-task prompt-breakdown artifacts
+
+- New status-domain action `{ action: 'breakdown', runId, taskId? }` (57th schema action) surfaces the opt-in `metadata/<taskId>.prompt-breakdown.json` artifacts (recorded when the host session starts with `PI_CREW_PROMPT_BREAKDOWN=1`): per-task `estTokens` totals, top-5 largest sections, run total — text table + structured `data.perTask`/`data.runTotal` for the leader prompt and W-F token decisions. Runs without breakdowns get a pointer to the env gate instead of an error. Schema/dispatch/docs synced in one commit: `STATUS_ACTIONS` + `STATUS_DOMAIN_ACTIONS` + `domainForAction`, `docs/actions-reference.md` Quick Reference + section, CLAUDE.md domain table (status 16→17), README count, `team-tool-schema-actions.test.ts` 56→57 derivation guard. Follow-up fix in this release: `pre-execution.ts` used to discard the breakdown `writeArtifact` descriptor, so live-run manifests never indexed it — the descriptor now flows through `ctx.breakdownArtifact` into the manifest merge (pinned by `post-execution-breakdown-index.test.ts`, 2 cases).
+
+### docs: correct stale bundle comments
+
+- `index.ts` + `scripts/bench-cold-start.mjs` carried 2025-era numbers: "2.9MB single file", "1100 .ts files", "src/ is excluded by the files field, ~5MB instead of ~16MB", "~19% faster total cold-start". Re-measured 2026-09-30 at this commit: `dist/index.mjs` = 1,614,662 B ≈ 1.6MB, `src/` = 520 `.ts` files, and the `files` field DOES include `src/`. Comments now state the tarball ships the bundle as entry AND includes src/, and the bundle's value is correctness + deterministic startup (warm `NODE_COMPILE_CACHE` shrinks the speed gap to ~2%).
+
+### fix(test): Node-24 compatible cancelled-suite fixtures
+
+- Node 24 changed `node:test` to hold event-loop refs while subtests are pending, so the RR-021 unref'd-timer loop-drain fixtures no longer produced cancelled tests (verified: v24.21.0 `cancelled 0` vs v22 `cancelled 2`) — caught by the first-ever Node-24 CI run of the matrix added earlier in this release. The two empirical cancelled-suite cases in `test-runner-exit.test.ts` now use the AbortSignal-abort shape, which yields `# cancelled 2` deterministically on BOTH Node 22 and Node 24 (21/21 on both locally; CI 33/33 green).
+
+### ci: Node 24 added to the test matrices
+
+- `.github/workflows/ci.yml`: both matrix jobs (`unit`, `test`) now run `[22, 24]` — Node 24 (LTS since 2025-10) gets first-class coverage while engines stay `>=22.0.0` and `.nvmrc` stays `22`. Nightly/smoke/weekly pins intentionally untouched. Opens the door for the strip-types-flag removal and tsconfig ES2023 bump once the ≥22.18 floor decision lands (upgrade plan §5 Q3).
+
+### chore(deps): semver-in-range batch
+
+- In-range bumps only: `@biomejs/biome` 2.5.3→2.5.14, `@sinclair/typebox` 0.34.50→0.34.52, `acorn` 8.17.0→8.18.0, `esbuild` 0.28.1→0.28.2, `yaml` 2.9.0→2.9.1, `tsx` 4.23.0→4.23.15, `@types/node` 25.9.5→25.9.8. Deliberately NOT bumped (per plan): `diff` (P1-4), `@earendil-works/*` (Phase D), `@types/node` 26 (floor decision). `test:critical` 116/116 green under the new deps.
+
+### docs: action-count truth-sync + drift gate
+
+- The repo carried five different action totals (53/54/55/56, and "28 total" in CLAUDE.md). Verified programmatically via `allActionLiterals.length === 56` (10 run + 16 status + 7 control + 17 manage + 6 automate, incl. `compare`), then synced the header comment in `src/schema/team-tool-schema.ts`, `README.md`, `CLAUDE.md`, `docs/actions-reference.md`, and `skills/real-test-pi-crew/SKILL.md`; fixed the `child-pi.ts`→`child-pi/` reference drift and backfilled the missing `compare` row in the actions reference.
+- New gate `test/unit/schema/team-tool-docs-sync.test.ts` (precedent: `config-schema-sync.test.ts`) fails when docs drift from `allActionLiterals` again — negative-tested before landing.
+
+### chore(perf): perf-report runtime writes leave `docs/` root
+
+- `scripts/analyze-run.mjs` now writes runtime perf reports to `docs/perf/` (existed, now the default write target) with a narrow `.gitignore` pattern (`docs/perf/perf-report-team_*`) so curated `docs/perf/` content stays tracked. Verified 0 runtime perf-report files tracked; audit suite 28/28 + live smoke confirm the new path.
+
 ## [0.11.4] — test-gate hardening + RR-023 battery fixes (2026-09-29)
 
 ### fix: grandchild relay empty — inherit the parent task's model on model-less delegate (RR-023, 2026-09-29 battery finding #3)

package/README.md

@@ -34,7 +34,7 @@ repo:  https://github.com/baphuongna/pi-crew
 
 ## Features
 
-- **One `team` tool, 55 actions** — run, monitor, steer, schedule, and manage agents/teams/workflows ([actions reference](docs/actions-reference.md)).
+- **One `team` tool, 57 actions** — run, monitor, steer, schedule, and manage agents/teams/workflows ([actions reference](docs/actions-reference.md)).
 - **Real child Pi workers** — each task spawns an isolated `pi` process; `runtime.mode: "scaffold"` gives a dry-run with prompts only.
 - **Built-in teams & adaptive planning** — 6 teams and 11 workflows ship in the box; the `default` and `implementation` workflows let a planner agent pick the smallest effective crew.
 - **Parallel execution + worktree isolation** — tasks in the same phase run concurrently; `workspaceMode: "worktree"` gives each task its own git worktree for safe parallel edits.