pi-crew 0.11.5 → 0.11.7

package/src/extension/crew-vibes/index.ts

@@ -34,6 +34,13 @@ export function registerCrewVibes(pi: ExtensionAPI): void {
 	let providerTimer: ReturnType<typeof setInterval> | undefined;
 	let lastProviderUsage: ProviderUsage | null = null;
 	let currentProvider: string | undefined;
+	// Latest ctx of the CURRENT session, re-fetched at every publish/tick.
+	// Never hold a ctx captured from an earlier event across a session
+	// replacement (newSession/fork/switchSession/reload): pi invalidates every
+	// prior ctx, and even reading ctx.hasUI then throws the stale-ctx error.
+	// session_shutdown clears this so in-flight fetch continuations no-op
+	// instead of publishing into a dead session (WI-1, SDD-4).
+	let sessionCtx: ExtensionContext | undefined;
 
 	function themeOf(ctx: ExtensionContext) {
 		return asCrewTheme(ctx.hasUI ? ctx.ui.theme : undefined);
@@ -57,29 +64,37 @@ export function registerCrewVibes(pi: ExtensionAPI): void {
 	/** Fetch provider usage for currentProvider and publish the quota status.
 	 *  Called on start, on each timer tick, and immediately when the
 	 *  provider changes (model_select) so the quota reflects the new
-	 *  provider without waiting for the next tick. */
-	async function fetchProviderAndRefresh(ctx: ExtensionContext): Promise<void> {
+	 *  provider without waiting for the next tick. The ctx is resolved at
+	 *  call time (never captured) and re-checked after the await: if the
+	 *  session was replaced while the fetch was in flight, the continuation
+	 *  is dropped — the new session re-arms its own publish. */
+	async function fetchProviderAndRefresh(): Promise<void> {
+		const ctx = sessionCtx;
+		if (!ctx) return; // session already shut down or replaced — nothing to publish to
 		if (!config.enabled || !config.capacity.providerUsage) {
 			lastProviderUsage = null;
 			publishQuotaStatus(ctx);
 			return;
 		}
+		let usage: ProviderUsage | null = null;
 		try {
-			lastProviderUsage = await fetchProviderUsage(config.capacity.providerRefreshMs, currentProvider);
+			usage = await fetchProviderUsage(config.capacity.providerRefreshMs, currentProvider);
 		} catch {
 			// Never crash on provider fetch failure
-			lastProviderUsage = null;
+			usage = null;
 		}
+		if (sessionCtx !== ctx) return; // replaced mid-fetch: old ctx must never be used
+		lastProviderUsage = usage;
 		publishQuotaStatus(ctx);
 	}
 
-	function startProviderTimer(ctx: ExtensionContext): void {
+	function startProviderTimer(): void {
 		if (providerTimer) return;
 		if (!config.capacity.providerUsage) return;
 		const interval = Math.max(10000, config.capacity.providerRefreshMs);
 
-		fetchProviderAndRefresh(ctx); // Fetch immediately on start
-		providerTimer = setInterval(() => fetchProviderAndRefresh(ctx), interval);
+		fetchProviderAndRefresh(); // Fetch immediately on start
+		providerTimer = setInterval(() => fetchProviderAndRefresh(), interval);
 		providerTimer.unref?.();
 	}
 
@@ -90,12 +105,13 @@ export function registerCrewVibes(pi: ExtensionAPI): void {
 			clearVibesStatus(ctx);
 			return;
 		}
-		if (config.capacity.providerUsage) startProviderTimer(ctx);
+		if (config.capacity.providerUsage) startProviderTimer();
 		else publishQuotaStatus(ctx); // clears the stale status when disabled
 	}
 
 	pi.on("session_start", (_event, ctx) => {
 		stopProviderTimer();
+		sessionCtx = ctx; // fresh ctx of the current session — any prior ctx is invalid now
 		config = loadConfig();
 		clearProviderUsageCache();
 		// Initialize provider from current model — model_select only fires on manual switch
@@ -104,19 +120,22 @@ export function registerCrewVibes(pi: ExtensionAPI): void {
 			clearVibesStatus(ctx);
 			return;
 		}
-		startProviderTimer(ctx);
+		startProviderTimer();
 	});
 
 	pi.on("model_select", (event, ctx) => {
+		sessionCtx = ctx;
 		currentProvider = (event as { model?: { provider?: string } }).model?.provider;
 		clearProviderUsageCache();
 		// Fetch immediately so the quota reflects the new provider without
 		// waiting for the next timer tick.
-		fetchProviderAndRefresh(ctx);
+		fetchProviderAndRefresh();
 	});
 
 	pi.on("session_shutdown", (_event, ctx) => {
 		stopProviderTimer();
+		sessionCtx = undefined; // later continuations must no-op, never touch a disposed ctx
+		// ctx is still valid here: pi emits session_shutdown before dispose().
 		clearVibesStatus(ctx);
 	});
 

package/src/extension/pi-api.ts

@@ -34,6 +34,7 @@ export type {
 	ExtensionAPI,
 	ExtensionCommandContext,
 	ExtensionContext,
+	ExtensionToolContext,
 	ToolDefinition,
 } from "@earendil-works/pi-coding-agent";
 

package/src/extension/registration/lifecycle-handlers.ts

@@ -42,6 +42,7 @@ import { CrewScheduler, type ScheduledJob } from "../../runtime/scheduling/sched
 import { tryRegisterSessionCleanup } from "../../runtime/session-resources.ts";
 import { createSessionSnapshot } from "../../runtime/session-snapshot.ts";
 import { applyCrewSettingsTiersToConfig, loadCrewSettingsTiers, scheduledJobsHiddenCountOf } from "../../runtime/settings-store.ts";
+import type { ReconcileResult } from "../../runtime/stale-reconciler.ts";
 import { loadTasksWithRecovery } from "../../state/stores/manifest-io.ts";
 import { loadRunManifestById } from "../../state/stores/state-store.ts";
 import type { TeamRunManifest } from "../../state/types.ts";
@@ -88,6 +89,62 @@ export function installSessionLifecycleHandlers(pi: ExtensionAPI, ctx: Registrat
 	installModelTrackingHandlers(pi);
 }
 
+// ─── NEW-2 (SDD-4 follow-up, P3 review MAJOR 1): honest stale-reconcile notify ──
+
+/**
+ * Repaired runIds already surfaced by the session-start stale-reconcile
+ * notify in THIS process, bounded so a long-lived session cannot grow the set
+ * unboundedly (overflow clears — a re-notify after 256+ distinct repairs is
+ * acceptable noise, an unbounded leak is not).
+ *
+ * Cross-restart dedupe is structural, not tracked here: a real repair persists
+ * a terminal run status, so the run drops out of the reconcile input and can
+ * never re-notify. The set guards the two in-process repeat windows — session
+ * reload/fork re-firing session_start, and a repair whose persistence failed
+ * (disk error / lock steal leaves the run reconcileable while the notify still
+ * claimed it). Observed pre-fix (2026-09-29): 77 dishonest notifies/day,
+ * ~3x per runId, because non-repaired verdicts (blocked_awaiting_approval,
+ * waiting_answer, result_exists) never persist anything and re-fired the
+ * "Found and repaired ghost runs" text on every session start.
+ */
+const notifiedRepairedRunIds = new Set<string>();
+const NOTIFIED_REPAIRED_RUN_IDS_CAP = 256;
+
+/** What the session-start stale-reconcile notify should say (or null: say nothing). */
+export interface StaleReconcileNotifyPlan {
+	title: string;
+	body: string;
+}
+
+/**
+ * NEW-2: decide the operator notification for a session-start reconcile
+ * batch. Honest by construction — a notify is emitted ONLY when reconcile
+ * actually repaired something (`repaired === true`): non-repaired verdicts
+ * are intentional states (plan approval pending, ask parked, result already
+ * exists) that the run dashboard already surfaces, so claiming "repaired"
+ * for them was a false system statement. The title says exactly what
+ * happened ("Repaired N stale run(s)"), the body names each repaired runId
+ * with its verdict, and each repaired runId notifies at most once per
+ * process (bounded set above).
+ */
+export function decideStaleReconcileNotification(staleResults: ReconcileResult[]): StaleReconcileNotifyPlan | null {
+	const repaired = staleResults.filter((r) => r.repaired === true && !notifiedRepairedRunIds.has(r.runId));
+	if (repaired.length === 0) return null;
+	for (const r of repaired) {
+		if (notifiedRepairedRunIds.size >= NOTIFIED_REPAIRED_RUN_IDS_CAP) notifiedRepairedRunIds.clear();
+		notifiedRepairedRunIds.add(r.runId);
+	}
+	return {
+		title: `Repaired ${repaired.length} stale run(s)`,
+		body: `Repaired stale runs from previous sessions: ${repaired.map((r) => `${r.runId} (${r.verdict})`).join(", ")}`,
+	};
+}
+
+/** Test seam: reset the per-process dedupe set between unit tests. */
+export function __test__resetNotifiedRepairedRunIds(): void {
+	notifiedRepairedRunIds.clear();
+}
+
 /**
  * Hand over the outcome of runs detached by an agent-view switch.
  *
@@ -460,13 +517,18 @@ async function runDeferredSessionCleanup(
 		// session_start callback synchronous; notify when the result lands.
 		void reconcileAllStaleRuns(extensionCtx.cwd, ctx.getManifestCache(extensionCtx.cwd), Date.now(), currentSessionId)
 			.then((staleResults) => {
-				if ((staleResults ?? []).length > 0) {
+				// NEW-2 (SDD-4 follow-up): honest notify — only actual repairs are
+				// reported, each repaired runId at most once per process. Non-repaired
+				// verdicts (blocked_awaiting_approval / waiting_answer /
+				// result_exists) must NEVER be claimed as "repaired".
+				const plan = decideStaleReconcileNotification(staleResults ?? []);
+				if (plan) {
 					ctx.notifyOperator({
 						id: "stale_reconcile",
 						severity: "info",
 						source: "crash-recovery",
-						title: `Reconciled ${staleResults.length} stale run(s)`,
-						body: `Found and repaired ghost runs from previous sessions: ${staleResults.map((r) => r.runId).join(", ")}`,
+						title: plan.title,
+						body: plan.body,
 					});
 				}
 			})

package/src/extension/team-tool/respond.ts

@@ -1,6 +1,7 @@
 import { renderAskAnswer } from "../../prompt/prompt-runtime.ts";
 import { readCrewAgents, recordFromTask, saveCrewAgents } from "../../runtime/crew-agent-records.ts";
 import { isWaitingWorkerAlive } from "../../runtime/dispatch-batch.ts";
+import { checkProcessLiveness } from "../../runtime/process-status.ts";
 import type { TeamToolParamsValue } from "../../schema/team-tool-schema.ts";
 import { withRunLockSync } from "../../state/coordination/locks.ts";
 import { appendMailboxMessage, readMailbox, updateMailboxMessageReply } from "../../state/coordination/mailbox.ts";
@@ -142,6 +143,17 @@ export function handleRespond(params: TeamToolParamsValue, ctx: TeamContext): Pi
 		/** Exactly-once no-ops: a mailbox response already exists for the questionId. */
 		const noopIds: string[] = [];
 		const answeredEvents: Array<{ taskId: string; questionId: string; delivery: "mailbox" | "requeue" }> = [];
+		/** G5 (deep-review 2026-10-01): DEAD parks — the questionId-tagged response
+		 *  can never be picked up (the parked poller is gone); recorded with the
+		 *  liveness pid evidence so the leader sees the respond fell into the void.
+		 *  Twin of the broker-side task.respond_delivered ack. */
+		const missedEvents: Array<{
+			taskId: string;
+			questionId: string;
+			workerPid: number | undefined;
+			pidAlive: boolean;
+			pidDetail: string;
+		}> = [];
 		let updatedTasks = fresh.tasks;
 
 		for (const task of targetTasks) {
@@ -206,6 +218,21 @@ export function handleRespond(params: TeamToolParamsValue, ctx: TeamContext): Pi
 			updatedTasks = requeueWaitingTask(updatedTasks, task.id, message, renderAskAnswer(questionId, message));
 			requeuedIds.push(task.id);
 			answeredEvents.push({ taskId: task.id, questionId, delivery: "requeue" });
+			// G5: liveness evidence for respond_missed — the same pid source + probe
+			// the stale-reconciler / heartbeat-watcher use (heartbeat pid, fallback
+			// checkpoint childPid, then process.kill(pid,0) via checkProcessLiveness).
+			// A live pid here (stale heartbeat but process alive) is still recorded
+			// verbatim — the discriminator already ruled DEAD for delivery; the event
+			// reports what the pid probe saw, it does not re-decide the branch.
+			const missedPid = task.heartbeat?.pid ?? task.checkpoint?.childPid;
+			const liveness = checkProcessLiveness(missedPid);
+			missedEvents.push({
+				taskId: task.id,
+				questionId,
+				workerPid: missedPid,
+				pidAlive: liveness.alive,
+				pidDetail: liveness.detail,
+			});
 		}
 
 		// If this respond includes a replyTo, update the original message with reply metadata.
@@ -255,6 +282,33 @@ export function handleRespond(params: TeamToolParamsValue, ctx: TeamContext): Pi
 				),
 			);
 		}
+		// G5 (deep-review 2026-10-01): respond_missed — the DEAD-branch twin of
+		// the broker's respond_delivered ack. Same H1 fire-and-forget discipline
+		// (sync run-lock callback, never await/block); carries the questionId and
+		// the pid/liveness evidence the discrimination was based on.
+		for (const missed of missedEvents) {
+			void appendEventAsync(manifest.eventsPath, {
+				type: "task.respond_missed",
+				runId: manifest.runId,
+				taskId: missed.taskId,
+				message: `Leader respond missed: worker for question ${missed.questionId} is not alive to receive the mailbox response (pid ${
+					missed.workerPid ?? "none recorded"
+				}: ${missed.pidDetail}); delivery rides the requeue+inject path.`,
+				data: {
+					questionId: missed.questionId,
+					...(missed.workerPid !== undefined ? { workerPid: missed.workerPid } : {}),
+					pidAlive: missed.pidAlive,
+					pidDetail: missed.pidDetail,
+					delivery: "requeue",
+				},
+			}).catch((error) =>
+				logInternalError(
+					"respond.respond-missed-event",
+					error instanceof Error ? error : new Error(String(error)),
+					`runId=${manifest.runId}`,
+				),
+			);
+		}
 		for (const requeuedId of requeuedIds) {
 			void appendEventAsync(manifest.eventsPath, {
 				type: "task.resumed",

package/src/extension/team-tool/status.ts

@@ -15,6 +15,7 @@ import { appendEvent, readEventsCursor } from "../../state/event-log/event-log.t
 import { loadRunManifestById, saveRunTasks, updateRunStatus } from "../../state/stores/state-store.ts";
 import { aggregateUsage, formatCost, formatUsage } from "../../state/usage.ts";
 import { formatDuration } from "../../ui/format-helpers.ts";
+import { goalAchievedStatusLabel } from "../../ui/goal-flag.ts";
 import { locateRunCwd } from "../team-tool.ts";
 import type { PiTeamsToolResult } from "../tool-result.ts";
 import { result, type TeamContext } from "./context.ts";
@@ -236,11 +237,16 @@ export function handleStatus(params: TeamToolParamsValue, ctx: TeamContext): PiT
 	const waitingTasks = tasks.filter((task) => task.status === "queued" || task.status === "waiting");
 	const agentLine = (agent: (typeof crewAgents)[number]): string =>
 		`- ${agent.id} [${agent.status}] ${agent.role} -> ${agent.agent} runtime=${agent.runtime}${agent.model ? ` model=${agent.model}` : ""}${agent.usage ? ` usage=${formatUsage(agent.usage)}` : ""}${agent.usage?.cost ? ` cost=${formatCost(agent.usage.cost)}` : ""}${agent.progress?.activityState ? ` activityState=${agent.progress.activityState}` : ""}${formatActivityAge(agent) ? ` activity=${formatActivityAge(agent)}` : ""}${agent.progress?.currentTool ? ` tool=${agent.progress.currentTool}` : ""}${agent.toolUses ? ` tools=${agent.toolUses}` : ""}${!agent.usage && agent.progress?.tokens ? ` tokens=${agent.progress.tokens}` : ""}${agent.progress?.turns ? ` turns=${agent.progress.turns}` : ""}${agent.jsonEvents !== undefined ? ` jsonEvents=${agent.jsonEvents}` : ""}${agent.outputPath ? ` output=${agent.outputPath}` : ""}${agent.transcriptPath ? ` transcript=${agent.transcriptPath}` : ""}${agent.statusPath ? ` status=${agent.statusPath}` : ""}${agent.error ? ` error=${agent.error}` : ""}`;
+	// G19 (W-E Phase 1): surface the goal-achievement verdict on terminal runs —
+	// ⚠ false-green warning line; silent while running, when achieved, or when
+	// the run predates the assessment (goalAchieved undefined).
+	const goalLine = goalAchievedStatusLabel(manifest);
 	const lines = [
 		`Run: ${manifest.runId}`,
 		`Team: ${manifest.team}`,
 		`Workflow: ${manifest.workflow ?? "(none)"}`,
 		`Status: ${manifest.status}`,
+		...(goalLine ? [goalLine] : []),
 		`Progress: ${phaseProgress.overallPercentage}% (~${formatDuration(phaseProgress.estimatedRemainingMs)} remaining)`,
 		`Workspace mode: ${manifest.workspaceMode}`,
 		...(manifest.runtimeResolution
@@ -347,6 +353,8 @@ export function buildCompactStatus(
 		status: string;
 		goal: string;
 		workspaceMode?: string;
+		goalAchieved?: boolean | "unknown";
+		goalAchievementNote?: string;
 	},
 	tasks: Array<{
 		id: string;
@@ -360,10 +368,12 @@ export function buildCompactStatus(
 	progress?: { overallPercentage: number; estimatedRemainingMs: number },
 ): string[] {
 	const failedOrAttention = tasks.filter((t) => t.status === "failed" || t.status === "needs_attention" || t.status === "cancelled");
+	const goalLine = goalAchievedStatusLabel(manifest);
 	const lines = [
 		`Run: ${manifest.runId}`,
 		`Team: ${manifest.team}${manifest.workflow ? ` (${manifest.workflow})` : ""}`,
 		`Status: ${manifest.status}`,
+		...(goalLine ? [goalLine] : []),
 		...(progress ? [`Progress: ${progress.overallPercentage}% (~${formatDuration(progress.estimatedRemainingMs)} remaining)`] : []),
 		`Goal: ${manifest.goal}`,
 		...(asyncLivenessLine ? [asyncLivenessLine] : []),