pi-crew 0.11.6 → 0.11.8

package/src/schema/config-schema.ts

@@ -75,6 +75,29 @@ export const PiTeamsRuntimeConfigSchema = Type.Object(
 		graceTurns: Type.Optional(Type.Integer({ minimum: 1 })),
 		taskTimeoutMs: Type.Optional(Type.Integer({ minimum: 1 })),
 		inheritContext: Type.Optional(Type.Boolean({ sensitive: true })),
+		// W2 (session-file recovery): when a worker dies without a final assistant
+		// event (exitCode null / killed), tail-replay its session JSONL and attach
+		// the last complete assistant record to the run result. Default ON; env
+		// PI_CREW_SESSION_RECOVERY overrides. Kill switch, not a secret — no
+		// sensitive mark (same policy as surface: picks behavior, not authority).
+		sessionRecovery: Type.Optional(Type.Boolean()),
+		// R3-19/D5 reversal: hermetic worker spawns (--no-extensions on worker
+		// argv; explicit -e prompt-runtime + --skill flags unaffected). Default
+		// TRUE — off-switch for operators who want the old ambient-stack parity.
+		// Env PI_CREW_HERMETIC_WORKERS overrides either way. Behavior pick, not
+		// authority — no sensitive mark.
+		hermeticWorkers: Type.Optional(Type.Boolean()),
+		// P2-1 (pi 1.0.4 adoption): host-process retry-triage classifier seam
+		// (src/runtime/classifier/). DORMANT — default FALSE; enabling turns on
+		// transient-vs-permanent classification before expensive re-attempts.
+		// Env PI_CREW_CLASSIFIER_ENABLED overrides either way. Behavior pick,
+		// not authority — no sensitive mark.
+		classifierEnabled: Type.Optional(Type.Boolean()),
+		// P2-1: classifier model id for the seam above. Default resolved at the
+		// consumer (resolveClassifierModel → "opencode/jev-1.13-free"); env
+		// PI_CREW_CLASSIFIER_MODEL overrides. Catalog ids only — availability
+		// depends on provider credentials at runtime.
+		classifierModel: Type.Optional(Type.String({ minLength: 1 })),
 		promptMode: Type.Optional(Type.Union([Type.Literal("replace"), Type.Literal("append")])),
 		groupJoin: Type.Optional(Type.Union([Type.Literal("off"), Type.Literal("group"), Type.Literal("smart")])),
 		groupJoinAckTimeoutMs: Type.Optional(Type.Integer({ minimum: 1 })),
@@ -94,6 +117,10 @@ export const PiTeamsRuntimeConfigSchema = Type.Object(
 			),
 		),
 		excludeContextBash: Type.Optional(Type.Boolean()),
+		// Handoff budget: est-token (chars/4) cap on the dynamic.dependencyContext
+		// prompt layer. Matches parseHandoffBudgetTokens in config-validation.ts
+		// (out-of-range values are dropped → render default 1800).
+		handoffBudgetTokens: Type.Optional(Type.Integer({ minimum: 1, maximum: 1_000_000 })),
 		agentExtensions: Type.Optional(Type.Array(Type.String({ minLength: 1 }), { sensitive: true })),
 		// Mux-surface policy (spec v0.7 §8.2.4): no sensitive marks — surface
 		// picks where worker processes live, not what they may do.
@@ -118,6 +145,16 @@ export const PiTeamsRuntimeConfigSchema = Type.Object(
 			),
 		),
 		modelFallback: Type.Optional(PiTeamsModelFallbackConfigSchema),
+		// W7 (P2-3) EXPERIMENTAL: worker transport selector, WIRED at the
+		// run-worker seam since e2728f68 (D1/DR2 plumbing, 2026-10-06): "rpc"
+		// selects the prototype RPC frame-client transport (src/runtime/rpc/),
+		// "stdio" (absent/default) is the production child-pi path. Env
+		// PI_CREW_WORKER_TRANSPORT=rpc overrides this config (env wins —
+		// established precedence; an invalid env value fails safe to stdio).
+		// Callers carrying runtimeConfig (child-executor, run-coalesced-task-
+		// group) thread it to the seam; callers without runtimeConfig keep the
+		// default. Not sensitive — picks a transport, not authority.
+		workerTransport: Type.Optional(Type.Union([Type.Literal("stdio"), Type.Literal("rpc")])),
 	},
 	{ additionalProperties: false },
 );

package/src/schema/team-tool-schema.ts

@@ -280,6 +280,14 @@ const sharedFields = {
 			description: "Mark certain bash commands as excludeFromContext to reduce context tokens (default: false).",
 		}),
 	),
+	handoffBudgetTokens: Type.Optional(
+		Type.Integer({
+			minimum: 1,
+			maximum: 1_000_000,
+			description:
+				"Est-token (chars/4) budget cap on the dependency-context layer of worker prompts (default 1800). When exceeded, later dependencies are trimmed to summary head + artifact pointer. Out-of-range values are ignored.",
+		}),
+	),
 	budgetTotal: Type.Optional(
 		// Empty-string unset marker accepted (Tier-9: models emit "" when unset).
 		// 0 accepted as "unset/disabled" (models emit 0 for off); still rejects 1-999
@@ -414,7 +422,7 @@ const sharedFields = {
 	focus: Type.Optional(
 		Type.String({
 			description:
-				"Sub-focus for the doctor action. 'zombies' runs a READ-ONLY scan for orphaned pi-crew sub-agent processes (identified by PI_CREW_KIND=subagent); it never kills and never matches the user's interactive main session.",
+				"Sub-focus for the doctor action. 'zombies' runs a READ-ONLY scan for orphaned pi-crew sub-agent processes (identified by PI_CREW_KIND=subagent); it never kills and never matches the user's interactive main session. Also WARN-lists foreign CLI-spawned pi processes (AI_AGENT=pi markers, R3-16) — report-only, never kill candidates.",
 		}),
 	),
 };
@@ -568,7 +576,9 @@ export interface TeamToolParamsValue {
 	config?: Record<string, unknown>;
 	/** Sub-focus for the `doctor` action. `"zombies"` runs a READ-ONLY scan for
 	 *  orphaned pi-crew sub-agent processes (identified by PI_CREW_KIND=subagent);
-	 *  it never kills and never matches the user's interactive main session. */
+	 *  it never kills and never matches the user's interactive main session. Also
+	 *  WARN-lists foreign CLI-spawned pi processes (AI_AGENT=pi markers, R3-16) —
+	 *  report-only, never kill candidates. */
 	focus?: string;
 	dryRun?: boolean;
 	confirm?: boolean;
@@ -596,6 +606,8 @@ export interface TeamToolParamsValue {
 	b?: number;
 	/** Mark certain bash commands as excludeFromContext to reduce context tokens (default: false). */
 	excludeContextBash?: boolean;
+	/** Est-token (chars/4) budget cap on the dependency-context layer of worker prompts (default 1800). Later dependencies get trimmed to summary head + artifact pointer when exceeded. */
+	handoffBudgetTokens?: number;
 	/** Total token budget for the run. When set, enables budget tracking (minimum 1000). */
 	budgetTotal?: number;
 	/** When true, skip budget enforcement entirely (explicit opt-out). */

package/src/state/contracts.ts

@@ -106,6 +106,11 @@ export const TEAM_EVENT_TYPES = [
 	"task.respond_delivered",
 	"task.respond_missed",
 	"task.retried",
+	// P2-1 (pi 1.0.4 adoption, 2026-10-07): retry-triage classifier decision —
+	// fired by child-executor's triageRetryWithClassifier ONLY when a real
+	// classifier answer informed the retry-vs-skip decision (dormant unless
+	// runtime.classifierEnabled). Diagnostic only — never transitions state.
+	"task.retry_triage",
 	// WP-2/R2 waiting-producer (ADR-0 2026-08-17-waiting-producer-ask item 10):
 	// `ask` tool lifecycle — requested on park acceptance, answered on delivery
 	// (mailbox or requeue+inject), timedout on deadline expiry (both the

package/src/ui/format-helpers.ts

@@ -12,6 +12,17 @@ export function formatTokens(n: number): string {
 	return `${(n / 1_000_000).toFixed(1)}M`;
 }
 
+/**
+ * Canonical generic duration formatter (QW#5 collision resolution):
+ * `45ms` / `12.3s` / `3m5s` / `75m` — minutes are unbounded (no hours
+ * bucket) and there is no invalid-input guard. Two same-stemmed helpers are
+ * DELIBERATELY separate dialects and must not be merged into this one
+ * (their output formats are design-pinned):
+ *   - `formatTaskElapsed` (ui/widget/task-list.ts) — plan-card elapsed:
+ *     `2m 49s` / `1h 03m`, empty string on invalid input.
+ *   - `formatRelativeCompact` (utils/relative-time.ts) — relative-time
+ *     ladder buckets `84m` / `14h` / `2d14h`.
+ */
 export function formatDuration(ms: number): string {
 	if (ms < 1000) return `${ms}ms`;
 	if (ms < 60_000) return `${(ms / 1000).toFixed(1)}s`;

package/src/ui/overlays/mailbox-compose-overlay.ts

@@ -14,11 +14,16 @@
  * canopy/hint rows are NOT part of the split any more, so the hint keeps its
  * full width instead of being cropped to 60% of the overlay.
  *
+ * R3-6 (IME): the ACTIVE field emits pi-tui's zero-width `CURSOR_MARKER` at
+ * its value end — the host TUI strips it and parks the hardware cursor there
+ * so the IME candidate window follows the logical text cursor (CJK input).
+ *
  * Keys/behaviour are unchanged (same `overlay:*` dispatch, same free-text
  * passthrough, same validation errors, same discard confirmation). Hints come
  * from `formatHint` (discard LAST, keys through `keyToken`).
  */
 
+import { CURSOR_MARKER } from "@earendil-works/pi-tui";
 import type { MailboxDirection } from "../../state/coordination/mailbox.ts";
 import { pad, sanitizeLine, truncate } from "../../utils/visual.ts";
 import { overlayActionForKey } from "../keybinding-map.ts";
@@ -117,7 +122,16 @@ export class MailboxComposeOverlay {
 		// (the field is a single-line cell; multi-line content belongs to the
 		// preview column).
 		const value = sanitizeLine(this.fields[field] ?? "");
-		return `${active ? CURSOR : " "} ${label}: ${truncate(value, Math.max(8, width - label.length - 5))}`;
+		// R3-6 (IME): CURSOR_MARKER is pi-tui's zero-width APC sequence — the host
+		// TUI finds it, positions the HARDWARE cursor there (IME candidate window
+		// anchor for CJK input), and strips it before painting. This overlay's
+		// fields append/backspace at end-of-value only, so the logical cursor IS
+		// the value end — same pattern as pi-tui's own Input component
+		// (marker + fake cursor). The `›` prefix stays: it is the RAIL list-selection
+		// glyph, orthogonal to the text cursor. Direction checkbox row gets NO
+		// marker — it toggles on space and has no text insertion point.
+		const marker = active && !this.confirm ? CURSOR_MARKER : "";
+		return `${active ? CURSOR : " "} ${label}: ${truncate(value, Math.max(8, width - label.length - 5))}${marker}`;
 	}
 
 	private activeName(): FieldName {

package/src/ui/pi-ui-compat.ts

@@ -1,5 +1,21 @@
 import type { ExtensionContext } from "@earendil-works/pi-coding-agent";
 
+/**
+ * Host-compatibility shims for the `ExtensionContext["ui"]` surface.
+ *
+ * RETENTION POLICY (W4 2026-10-03): these typeof-based capability guards are
+ * deliberate no-ops, NOT version guards, and must be kept. pi-crew declares
+ * `"@earendil-works/pi-coding-agent": "*"` and `"@earendil-works/pi-tui": "*"`
+ * as optional peerDependencies with no minimum-version floor
+ * (package.json peerDependencies/peerDependenciesMeta), so host installs older
+ * than any SDK floor we verify against must keep working — retiring these
+ * shims would crash hosts whose UI predates
+ * `setWidget`/`setFooter`/`custom`/`setStatus`/`setWorkingIndicator`.
+ * Verified live: each guard is a pure feature check; there is no version
+ * constant or gate in this file. New host UI APIs should be added here
+ * (feature-detected), not called directly from src/.
+ */
+
 export interface WorkingIndicatorOptions {
 	frames?: string[];
 	intervalMs?: number;
@@ -9,7 +25,6 @@ type UiContext = Pick<ExtensionContext, "ui">;
 type ExtensionUi = ExtensionContext["ui"];
 type WidgetContent = string[] | ((tui: unknown, theme: unknown) => unknown);
 type WidgetOptions = Parameters<ExtensionUi["setWidget"]>[2];
-type WidgetOptionsWithPersist = WidgetOptions & { persist?: boolean };
 
 type CustomOptions = Parameters<ExtensionUi["custom"]>[1];
 
@@ -38,16 +53,10 @@ export function setWorkingIndicator(ctx: UiContext, options?: WorkingIndicatorOp
 
 /** Install or update an extension widget slot.
  * No-op when the host UI predates the `setWidget` API. */
-export function setExtensionWidget(
-	ctx: UiContext,
-	key: string,
-	content: WidgetContent | undefined,
-	options?: WidgetOptionsWithPersist,
-): void {
-	const { persist: _persist, ...widgetOptions } = options ?? {};
+export function setExtensionWidget(ctx: UiContext, key: string, content: WidgetContent | undefined, options?: WidgetOptions): void {
 	const record = maybeRecord(ctx.ui);
 	const fn = record?.setWidget;
-	if (typeof fn === "function") fn.call(ctx.ui, key, content as never, widgetOptions as WidgetOptions);
+	if (typeof fn === "function") fn.call(ctx.ui, key, content as never, options);
 }
 
 /**

package/src/ui/rail.ts

@@ -58,7 +58,20 @@ export const RAIL = { open: "┏", section: "┣", body: "┃", close: "┗" } a
  */
 export const PI_EXPAND_CHORD = "ctrl+o";
 
-/** Selection cursor (lists) and active/step marker (sections, goals). */
+/** Selection cursor (lists) and active/step marker (sections, goals).
+ *
+ * R3-6 audit (2026-10-04): this glyph marks LIST SELECTION in dashboards,
+ * pickers, settings menus, and compose field rows — a navigation affordance,
+ * not a text insertion point. It therefore deliberately does NOT adopt
+ * pi-tui's `CURSOR_MARKER` (the zero-width APC sequence that anchors the
+ * IME candidate window at a TEXT cursor). Sites that DO own a text cursor —
+ * mailbox-compose field values, settings text-input/edit buffers — emit
+ * `CURSOR_MARKER` at their buffer end in addition to any visual glyph.
+ * Not converted, by design: run-dashboard run rows, settings menu rows,
+ * agents-jobs-browser rows, mailbox-detail rows, agent-picker rows,
+ * schedules-pane job rows (all list selection); widget dock `❯` (a
+ * single-line focus acknowledgement, not an input); mascot `█` frames
+ * (animation glyphs). */
 export const CURSOR = "›";
 export const ACTIVE = "▸";
 

package/src/ui/settings-overlay.ts

@@ -4,6 +4,7 @@
  * label/value alignment, inline toggle, select submenu, and text input.
  */
 
+import { CURSOR_MARKER } from "@earendil-works/pi-tui";
 import { truncateToWidth, visibleWidth } from "../utils/visual.ts";
 import { keyOf, matchesKey } from "./key-utils.ts";
 import { CURSOR, canopyLine, formatHint, overflowHint, RAIL, railLine } from "./rail.ts";
@@ -601,7 +602,12 @@ class TextinputSubmenu {
 			lines.push(this.theme.fg("muted", this.description));
 		}
 		lines.push("");
-		lines.push(`  ${this.buffer}█`);
+		// R3-6 (IME): the marker before the fake `█` cursor is pi-tui's
+		// zero-width CURSOR_MARKER — the host TUI strips it and positions the
+		// hardware cursor there so the IME candidate window tracks the buffer
+		// end (this submenu's buffer appends/erases at end only). Emitted
+		// unconditionally: the row renders only while this input owns keys.
+		lines.push(`  ${this.buffer}${CURSOR_MARKER}█`);
 		lines.push("");
 		lines.push(
 			this.theme.fg(
@@ -730,7 +736,10 @@ class AgentOverridesSubmenu {
 		const lines: string[] = [];
 		lines.push(this.theme.bold(this.theme.fg("accent", `Edit ${agent} ${field}`)));
 		lines.push("");
-		lines.push(`  ${this.editBuffer}█`);
+		// R3-6 (IME): same CURSOR_MARKER contract as TextinputSubmenu — the
+		// edit buffer is end-append only, so the marker rides immediately before
+		// the fake `█` cursor (pi-tui Input's marker+cursorChar pattern).
+		lines.push(`  ${this.editBuffer}${CURSOR_MARKER}█`);
 		lines.push("");
 		lines.push(
 			this.theme.fg(

package/src/ui/widget/index.ts

@@ -522,7 +522,6 @@ export function updateCrewWidget(
 		const model = state.model;
 		setExtensionWidget(ctx, WIDGET_KEY, ((_tui: unknown, theme: unknown) => new CrewWidgetComponent(model, theme, _tui)) as never, {
 			placement: piPlacement,
-			persist: true,
 		});
 		state.lastVisibility = "visible";
 		state.lastPlacement = placement;

package/src/ui/widget/task-list.ts

@@ -84,8 +84,15 @@ function taskStatusIcon(task: TeamTaskState): string {
 	}
 }
 
-/** `45s` / `2m 49s` / `1h 03m`. */
-function formatDuration(ms: number): string {
+/**
+ * Plan-card elapsed dialect (QW#5): `45s` / `2m 49s` / `1h 03m`, empty
+ * string for non-finite/negative input. Deliberately NOT ui/format-helpers'
+ * canonical `formatDuration` (that one renders `12.3s`/`3m5s` with no hours
+ * bucket and no invalid-input guard) — the spaced, zero-padded, hour-capable
+ * format here is pinned by the pi-tasks plan-card display. Renamed from a
+ * local `formatDuration` to end the three-way name collision.
+ */
+function formatTaskElapsed(ms: number): string {
 	if (!Number.isFinite(ms) || ms < 0) return "";
 	const totalSeconds = Math.floor(ms / 1000);
 	if (totalSeconds < 60) return `${totalSeconds}s`;
@@ -110,7 +117,7 @@ function runningSuffix(task: TeamTaskState): string {
 	const start = Date.parse(task.startedAt ?? "");
 	if (Number.isFinite(start) && start > 0) {
 		const end = task.finishedAt ? Date.parse(task.finishedAt) : Date.now();
-		const elapsed = formatDuration(end - start);
+		const elapsed = formatTaskElapsed(end - start);
 		if (elapsed) parts.push(elapsed);
 	}
 	const input = task.usage?.input ?? 0;

package/src/ui/widget/widget-renderer.ts

@@ -4,11 +4,14 @@
  * Extracted from crew-widget.ts.
  */
 
+import { pathToFileURL } from "node:url";
+import * as piTui from "@earendil-works/pi-tui";
 import { getCrewScheduler, getScheduledJobs, getScheduledJobsHiddenCountView } from "../../extension/team-tool/handle-schedule.ts";
 import type { CrewAgentRecord } from "../../runtime/crew-agent-runtime.ts";
 import { isPlanApprovalStatePending } from "../../runtime/plan-approval.ts";
 import { isFinishedRunStatus } from "../../runtime/process-status.ts";
 import type { ScheduledJob } from "../../runtime/scheduling/scheduler.ts";
+import type { TeamRunManifest } from "../../state/types.ts";
 import { formatRelativeTime } from "../../utils/relative-time.ts";
 import { truncate, visibleWidth } from "../../utils/visual.ts";
 import { Box, Text } from "../layout-primitives.ts";
@@ -95,9 +98,52 @@ export function widgetRailSlot(runs: readonly WidgetRun[]): RailSlot {
 /** `<team>` (or `team/workflow` when they differ); several live runs collapse
  *  to `<n> runs` — the counts on the row stay aggregate. */
 function dockSubject(runs: WidgetRun[]): string {
-	if (runs.length > 1) return `${runs.length} runs`;
-	const first = runs[0];
-	return first ? shortRunLabel(first.run) : "idle";
+	if (runs.length === 0) return "idle";
+	const label = runs.length > 1 ? `${runs.length} runs` : shortRunLabel(runs[0]!.run);
+	// R3-9: the dock's ONE clickable action — the subject opens the LATEST
+	// run's artifacts directory (`file://` OSC-8 link). Terminals without
+	// OSC-8 support ignore the escapes and render the plain label.
+	return linkify(label, latestArtifactsUrl(runs));
+}
+
+// ── R3-9: OSC-8 dock link ─────────────────────────────────────────────
+
+type TuiHyperlink = (text: string, url: string) => string;
+
+/** pi-tui's OSC-8 helper, resolved defensively: the peer range is `*`, so a
+ *  host running a pi-tui build without the export must still render the
+ *  plain dock instead of failing the namespace import. */
+const tuiHyperlink: TuiHyperlink | undefined = (() => {
+	const candidate = (piTui as { hyperlink?: unknown }).hyperlink;
+	return typeof candidate === "function" ? (candidate as TuiHyperlink) : undefined;
+})();
+
+/** `file://` URL for an artifacts dir; `undefined` keeps the label plain. */
+function artifactsDirUrl(artifactsRoot: string | undefined): string | undefined {
+	if (!artifactsRoot) return undefined;
+	try {
+		return pathToFileURL(artifactsRoot).href;
+	} catch {
+		return undefined;
+	}
+}
+
+/** Latest (by createdAt) run's artifacts dir — the dock link target. */
+function latestArtifactsUrl(runs: readonly WidgetRun[]): string | undefined {
+	let latest: TeamRunManifest | undefined;
+	for (const entry of runs) {
+		const candidate = entry.run;
+		if (!candidate.artifactsRoot) continue;
+		if (!latest || (candidate.createdAt ?? "") > (latest.createdAt ?? "")) latest = candidate;
+	}
+	return artifactsDirUrl(latest?.artifactsRoot);
+}
+
+/** Wrap in OSC-8 when both the pi-tui helper and a target exist; plain text
+ *  otherwise (clean degrade on non-hyperlink terminals and older hosts). */
+function linkify(text: string, url: string | undefined): string {
+	if (!url || !tuiHyperlink) return text;
+	return tuiHyperlink(text, url);
 }
 
 /**
@@ -389,7 +435,10 @@ export function buildWidgetLines(
  */
 export function colorWidgetLine(line: string, index: number, theme: CrewTheme, slot: RailSlot = "border"): string {
 	let result = line;
-	if (index === 0 && !result.includes("\u001b")) {
+	// R3-9: the guard detects THEME styling (CSI `ESC[`), not any escape — the
+	// dock's OSC-8 artifacts link (introduced by `dockSubject`) is not styling
+	// and must NOT opt the line out of the identity paint pass.
+	if (index === 0 && !result.includes("\u001b[")) {
 		// `┏|┃ <WORD> ▸ <subject>`: rail glyph takes the state slot, the identity
 		// word accent+bold, the subject toolTitle+bold. The subject is bounded by
 		// the first ` ·` so a count segment can never be swallowed.

package/src/utils/relative-time.ts

@@ -15,11 +15,19 @@
 export function formatRelativeTime(now: Date, target: Date): string {
 	const deltaMs = target.getTime() - now.getTime();
 	if (deltaMs === 0) return "now";
-	if (deltaMs > 0) return `in ${formatDurationCompact(deltaMs)}`;
-	return `${formatDurationCompact(-deltaMs)} ago`;
+	if (deltaMs > 0) return `in ${formatRelativeCompact(deltaMs)}`;
+	return `${formatRelativeCompact(-deltaMs)} ago`;
 }
 
-function formatDurationCompact(ms: number): string {
+/**
+ * Relative-time bucket ladder (dialect D6-T4): `45s` / `84m` / `14h` /
+ * `2d14h`, zero-hour remainder collapses to `3d`. A distinct dialect from
+ * ui/format-helpers' canonical `formatDuration` (QW#5 collision resolution):
+ * the bucket boundaries (60s / 120m / 48h) are design-approved for relative
+ * timestamps and must not adopt the generic `3m5s` rendering. Formerly named
+ * `formatDurationCompact`; private to this module.
+ */
+function formatRelativeCompact(ms: number): string {
 	const totalSeconds = Math.floor(ms / 1000);
 	if (totalSeconds < 60) return `${totalSeconds}s`;
 	const totalMinutes = Math.floor(totalSeconds / 60);

package/src/utils/visual.ts

@@ -60,11 +60,41 @@ export function __test__visibleWidthCacheSize(): number {
 function consumeAnsi(input: string, index: number): number {
 	const char = input[index];
 	if (!char || char !== "\u001b") return 0;
-	if (input[index + 1] !== "[") return 0;
+	const next = input[index + 1];
+	if (next === "[") {
+		let i = index + 2;
+		while (i < input.length) {
+			const code = input.charCodeAt(i);
+			if (code >= 0x40 && code <= 0x7e) return i - index + 1;
+			i++;
+		}
+		return 0;
+	}
+	// R3-9: OSC sequences (`ESC ] … BEL` or `ESC ] … ESC \`) — OSC-8 hyperlinks
+	// (pi-tui `hyperlink()`, used by the crew widget) ride this branch. The
+	// truncation/wrap/sanitize helpers must treat the whole sequence as ONE
+	// zero-width unit, matching pi-tui's `visibleWidth` (which already strips
+	// OSC), or a clipped line would slice mid-escape and leak raw bytes into
+	// the terminal. Malformed payloads (stray control char) fall back to the
+	// pre-existing behaviour of treating the ESC as ordinary data.
+	//
+	// U6/DR4 (pi 1.0.4 adoption, 2026-10-06): APC sequences (`ESC _ … BEL` or
+	// `ESC _ … ESC \`) share the exact same grammar, so they ride the same
+	// scanner. pi-tui's `CURSOR_MARKER` — now a documented public contract —
+	// is an APC string (`\u001b_pi:c\u0007`) that focused components emit at
+	// the cursor position. Without this branch, truncateToWidth/wrapHard
+	// walked the marker's `_pi:c` payload as ordinary text (~6 visible
+	// columns) and could slice the sequence in half; with it, the whole
+	// marker is consumed as ONE zero-width unit, matching pi-tui's
+	// `visibleWidth` (which already zero-widths APC). Same malformed fallback:
+	// a stray control char cannot belong to an OSC/APC payload either.
+	if (next !== "]" && next !== "_") return 0;
 	let i = index + 2;
 	while (i < input.length) {
 		const code = input.charCodeAt(i);
-		if (code >= 0x40 && code <= 0x7e) return i - index + 1;
+		if (code === 0x07) return i - index + 1; // BEL terminator
+		if (code === 0x1b && input[i + 1] === "\\") return i - index + 2; // ST terminator
+		if (code < 0x20) return 0; // control char cannot belong to an OSC/APC payload
 		i++;
 	}
 	return 0;