pi-crew 0.11.47 → 0.11.48

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "pi-crew",
-	"version": "0.11.47",
+	"version": "0.11.48",
 	"description": "Pi extension for coordinated AI teams, workflows, worktrees, and async task orchestration",
 	"author": "baphuongna",
 	"license": "MIT",

package/src/config/env-vars.ts

@@ -668,7 +668,7 @@ export const CREW_ENV_VARS: Record<string, CrewEnvVarSpec> = {
 	},
 	PI_CREW_BROKER_STDIN: {
 		name: "PI_CREW_BROKER_STDIN",
-		doc: "LOW-1 closure (2026-10-27) broker-credential transport gate: unset/non-'0' (default) sends the per-task compound PI_CREW_BROKER_TOKEN to the headless JSON worker over the spawn STDIN pipe (one buildBrokerStdinLine v2 payload; heap → pipe → heap — child-pi-spawn.ts writer, crew-broker-child.ts startChildBrokerClientAsync reader) so the token never appears in the child env; '0' rolls back to the legacy env route (token in built.env, stdin stays 'ignore') on BOTH sides. RPC-mode workers and surface TUI panes are unaffected (they keep the env route; the worker-side stdin read skips --mode rpc argv and TTY stdin by design)",
+		doc: "LOW-1 closure (2026-10-27) broker-credential transport gate, OPT-IN since v0.11.48 (2026-10-28): '1' sends the per-task compound PI_CREW_BROKER_TOKEN to the headless JSON worker over the spawn STDIN pipe (one buildBrokerStdinLine v2 payload; heap → pipe → heap — child-pi-spawn.ts writer, crew-broker-child.ts startChildBrokerClientAsync reader) so the token never appears in the child env; unset/any-other-value (default) keeps the LEGACY ENV ROUTE (token in built.env, stdin stays 'ignore') on BOTH sides — the stdin reader path was caught by the live battery (real-test-pi-crew T7) killing real headless workers with a silent exit 0 and is disabled-by-default until root-caused. RPC-mode workers and surface TUI panes are unaffected (they keep the env route; the worker-side stdin read skips --mode rpc argv and TTY stdin by design)",
 	},
 	PI_CREW_GUEST: {
 		name: "PI_CREW_GUEST",

package/src/prompt/surface-worker.ts

@@ -182,7 +182,7 @@ export function parentAlive(pid: number, expectedStartTime: string | undefined,
 		// workers at the first 5s tick.
 		readerThrew = true;
 	}
-	if (readerThrew) return expectedStartTime ? false : true;
+	if (readerThrew) return !expectedStartTime;
 	// Reader returned "no entry" (default /proc reader ENOENT = dead on
 	// Linux) — dead-parent detection stays intact.
 	if (stat === undefined) return false;

package/src/runtime/broker/crew-broker-child.ts

@@ -139,8 +139,11 @@ export async function startChildBrokerClientAsync(options: StartChildBrokerClien
 }
 
 /** Worker-side mirror of the parent gate (child-pi-spawn
- * .resolveBrokerStdinHandshakeEnabled): PI_CREW_BROKER_STDIN=0 keeps the
- * fallback OFF so a forced rollback is env-only on both sides. Default ON. */
+ * .resolveBrokerStdinHandshakeEnabled). **OPT-IN since v0.11.48** (live
+ * battery caught the reader path killing real headless workers — see the
+ * parent gate's doc block): the default is now OFF, so a new parent that set
+ * the env token travels the legacy env route. PI_CREW_BROKER_STDIN=1 opts
+ * BOTH sides into the stdin route. */
 function resolveBrokerStdinFallbackEnabled(): boolean {
-	return getCrewEnv("PI_CREW_BROKER_STDIN") !== "0";
+	return getCrewEnv("PI_CREW_BROKER_STDIN") === "1";
 }

package/src/runtime/broker/crew-broker-delegate-request.ts

@@ -43,14 +43,14 @@ import { loadRunManifestById, saveRunTasks } from "../../state/stores/state-stor
 import type { TeamRunManifest, TeamTaskState } from "../../state/types.ts";
 import { type GrandchildSpawnResult, spawnDelegateGrandchild } from "../delegate-spawn.ts";
 import { resolveCrewMaxDepth } from "../model/pi-args.ts";
-import { NestedSlotBudget } from "../scheduling/nested-slots.ts";
+import type { NestedSlotBudget } from "../scheduling/nested-slots.ts";
 import { evaluateDelegateAdmission } from "../spawn-policy.ts";
-import { DelegateAbortRegistry } from "./delegate/delegate-abort.ts";
-import { type DelegateEventTarget, type DelegateEventType } from "./delegate/delegate-event.ts";
+import type { DelegateAbortRegistry } from "./delegate/delegate-abort.ts";
+import type { DelegateEventTarget, DelegateEventType } from "./delegate/delegate-event.ts";
 import { delegateTerminalEvent, finalizeDelegateResult } from "./delegate/delegate-finalize.ts";
 import { promoteShadowToRunning } from "./delegate/shadow-lifecycle.ts";
-import { type CrewBrokerOptions, type ServerConnection } from "./protocol/connection-state.ts";
-import { type LockBusyOutcome } from "./protocol/lock-busy.ts";
+import type { CrewBrokerOptions, ServerConnection } from "./protocol/connection-state.ts";
+import type { LockBusyOutcome } from "./protocol/lock-busy.ts";
 import { parseDelegateRequestParams } from "./protocol/request-parsers.ts";
 
 /** Options slice the delegate handler reads off the broker's RESOLVED

package/src/runtime/child-pi/child-pi-spawn.ts

@@ -46,17 +46,24 @@ import {
 // NOT set this (their sessions persist and benefit from long-lived cache).
 export const PI_CACHE_RETENTION_ENV = "PI_CACHE_RETENTION";
 
-/** LOW-1 residual closure (2026-10-27): when the inter-pi broker credentials
- * are present, the per-task compound TOKEN travels over the spawn stdin pipe
- * (one `buildBrokerStdinLine` payload, heap → pipe → heap — same shape as the
- * F4 background-runner handshake) instead of the child env. Set
- * PI_CREW_BROKER_STDIN=0 to roll back to the legacy env route (token in
- * built.env, stdin stays "ignore"). Default ON. Only the headless JSON spawn
- * branch consumes the payload: the RPC branch (stdin is the JSONL protocol
- * channel) and the surface TUI panes keep the env route, so their env is
- * untouched. */
+/** LOW-1 residual closure (2026-10-27, DISABLED-DEFAULT 2026-10-28 v0.11.48):
+ * when the inter-pi broker credentials are present, the per-task compound TOKEN
+ * can travel over the spawn stdin pipe (one `buildBrokerStdinLine` payload,
+ * heap → pipe → heap — same shape as the F4 background-runner handshake)
+ * instead of the child env. **EXPERIMENTAL / OPT-IN since v0.11.48**: the
+ * worker-side stdin reader path (startChildBrokerClientAsync →
+ * readStdinFirstLine) was caught by the live battery (real-test-pi-crew T7)
+ * making REAL headless JSON workers exit 0 silently with zero stdout — only
+ * when the reader activates (env broker identity + no env token + gate ON).
+ * Unit tests missed it because they inject the `readStdinLine` seam instead of
+ * running process.stdin in a real pi process. Until that is root-caused, the
+ * default is OFF (legacy env route, bit-for-bit pre-0.11.46 behavior); set
+ * PI_CREW_BROKER_STDIN=1 to opt the parent into the stdin route. Only the
+ * headless JSON spawn branch consumes the payload: the RPC branch (stdin is
+ * the JSONL protocol channel) and the surface TUI panes keep the env route,
+ * so their env is untouched either way. */
 export function resolveBrokerStdinHandshakeEnabled(): boolean {
-	return getCrewEnv("PI_CREW_BROKER_STDIN") !== "0";
+	return getCrewEnv("PI_CREW_BROKER_STDIN") === "1";
 }
 
 // ── Env allowlist (base set always passed to children) ──────────────────
@@ -452,12 +459,13 @@ export function prepareSpawnContext(
 	// safe under assertOnlyControlEnvKeys). Only when the parent broker issued
 	// credentials for this run — i.e. the broker is enabled AND this run is
 	// eligible. NEVER persisted to disk.
-	// LOW-1 closure: by default the TOKEN leaves the env entirely — it rides the
+	// LOW-1 closure (OPT-IN since v0.11.48): when PI_CREW_BROKER_STDIN=1 the
+	// TOKEN leaves the env entirely — it rides the
 	// spawn stdin pipe as a single buildBrokerStdinLine payload (ctx
 	// .brokerStdinPayload; the headless JSON branch pipes stdin and writes it
 	// right after spawn). SOCKET/RUN_ID/TASK_ID stay in env (non-secret, needed
-	// by the worker bootstrap to bind + validate the stdin payload). Rollback
-	// gate PI_CREW_BROKER_STDIN=0 (or a legacy shape without runId/taskId to
+	// by the worker bootstrap to bind and validate the stdin payload). Default
+	// (gate off, or a legacy shape without runId/taskId to
 	// bind the payload to) keeps the env route bit-for-bit.
 	if (input.brokerSpawn?.socketPath && input.brokerSpawn.token) {
 		built.env.PI_CREW_BROKER_SOCKET = input.brokerSpawn.socketPath;