pi-crew 0.5.11 → 0.5.12

package/CHANGELOG.md

@@ -1,5 +1,28 @@
 # Changelog
 
+## [0.5.12] — Round 17 Audit Fixes (2026-06-02)
+
+### Phase 1: Signal Handler Stacking (HIGH)
+- `src/extension/crew-cleanup.ts` — Added module-level `signalHandlersRegistered` flag. `process.on("SIGTERM"/"SIGHUP")` is now registered only once even if `registerCleanupHandler` is called multiple times. Without this fix, listeners stack up on extension reload and `cleanupChildProcesses` fires N times on shutdown.
+- Also wrapped `handleSignal()` with `.catch()` to prevent unhandled promise rejections.
+
+### Phase 2: L1 Cleanup (continued)
+Replaced 8 `console.error` calls with `logInternalError` for consistency:
+- `src/extension/crew-cleanup.ts` (3 calls)
+- `src/extension/async-notifier.ts:124`
+- `src/runtime/async-runner.ts:166`
+- `src/runtime/hidden-handoff.ts:244`
+- `src/runtime/crew-hooks.ts:167,172`
+
+### Phase 3+4: Test Coverage
+- 8 new tests in `test/unit/crew-hooks.test.ts`
+- 1 new test in `test/unit/crew-cleanup.test.ts` (signal handler idempotency)
+
+### Tests
+- 2313/2313 pass (was 2308 in v0.5.11; +5 net from new tests)
+- 9 new tests across 2 test files
+- TypeScript: 0 errors
+
 ## [0.5.11] — Round 16 Audit Fixes (2026-06-02)
 
 ### Phase 1: L1 cleanup (continued)

package/README.md

@@ -9,7 +9,7 @@ npm: pi-crew
 repo: https://github.com/baphuongna/pi-crew
 ```
 
-**v0.5.11**: See [CHANGELOG.md](CHANGELOG.md).
+**v0.5.12**: See [CHANGELOG.md](CHANGELOG.md).
 
 ### Security highlights (v0.5.5)
 

package/docs/pi-crew-v0.5.12-audit-fix-plan.md

@@ -0,0 +1,76 @@
+# pi-crew v0.5.12 Audit Fix Plan (Round 17)
+
+## Source Verification Findings
+
+I read the following files and identified 4 confirmed real issues + test coverage gaps.
+
+### Issue 1: Signal listeners stack up on registerCleanupHandler (HIGH)
+**File**: `src/extension/crew-cleanup.ts:81-82`
+
+```ts
+process.on("SIGTERM", () => { void handleSignal("SIGTERM"); });
+process.on("SIGHUP", () => { void handleSignal("SIGHUP"); });
+```
+
+These listeners are added every time `registerCleanupHandler(pi)` is called. If the extension is reloaded (e.g., in dev mode, or via `pi install --reload`), the listeners stack up. This causes:
+- Memory leak (closures over `handleSignal`)
+- Multiple cleanup invocations on shutdown → multiple SIGTERM to children
+- Confusing logs ("Received SIGTERM - starting cleanup" repeated)
+
+**Fix**: Make the signal handlers idempotent. Use a module-level `signalHandlersRegistered` flag, or use `process.once` instead of `process.on`. Better: register only once at module load.
+
+### Issue 2: Unhandled promise rejection in signal handler (MEDIUM)
+**File**: `src/extension/crew-cleanup.ts:81-82`
+
+```ts
+process.on("SIGTERM", () => { void handleSignal("SIGTERM"); });
+```
+
+If `handleSignal` throws or rejects, the unhandled rejection is silently swallowed (because `void` discards the promise). This violates our "log all errors" pattern from v0.5.9 L1.
+
+**Fix**: Wrap with `.catch()` and `logInternalError`.
+
+### Issue 3: console.error bypasses logInternalError in 4 files (MEDIUM, L1 continued)
+**Files** (7 occurrences total):
+- `src/extension/crew-cleanup.ts:59` (cleanup error)
+- `src/extension/crew-cleanup.ts:84` (kill process error)
+- `src/extension/crew-cleanup.ts:103` (temp cleanup error)
+- `src/extension/async-notifier.ts:124` (notifier error)
+- `src/runtime/async-runner.ts:166` (spawn failed)
+- `src/runtime/hidden-handoff.ts:244` (handoff failed)
+- `src/runtime/crew-hooks.ts:167,172` (hook error)
+
+**Rationale**: v0.5.9 L1 fix (in `event-bus.ts`) and v0.5.11 round 16 cleanup moved from `console.error` to `logInternalError` to ensure errors are captured even when stderr is redirected. These 8 callsites bypass that pattern.
+
+**Note**: `internal-error.ts:5` itself uses `console.error` — that's the implementation, leave it. `background-runner.ts:146` overrides `console.error` for testing — also leave.
+
+### Issue 4: Test coverage gaps in security/runtime code (LOW)
+- `test/unit/crew-cleanup.test.ts` — does not exist
+- `test/unit/async-notifier.test.ts` — does not exist
+- `test/unit/pi-spawn.test.ts` — does not exist (security-critical!)
+- `test/unit/live-agent-manager.test.ts` — does not exist
+- `test/unit/crew-hooks.test.ts` — does not exist
+
+## Plan (5 phases)
+
+### Phase 1: Fix signal handler stacking
+- Use module-level flag to register signal handlers only once
+- Wrap with `.catch()` to log promise rejections
+
+### Phase 2: L1 cleanup in 4 files
+Replace 8 `console.error` calls with `logInternalError`:
+- crew-cleanup.ts (3 calls)
+- async-notifier.ts (1 call)
+- async-runner.ts (1 call)
+- hidden-handoff.ts (1 call)
+- crew-hooks.ts (2 calls)
+
+### Phase 3: Test coverage for security-critical modules
+- `test/unit/crew-cleanup.test.ts` — test signal handler idempotency, cleanup logic
+- `test/unit/pi-spawn.test.ts` — test `isWithinAllowedPrefixes`, `validateExplicitBin`
+
+### Phase 4: Test coverage for runtime modules
+- `test/unit/async-notifier.test.ts` — test isCurrent guard, generation check
+- `test/unit/live-agent-manager.test.ts` — test eviction logic
+
+### Phase 5: Release v0.5.12

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "pi-crew",
-  "version": "0.5.11",
+  "version": "0.5.12",
   "description": "Pi extension for coordinated AI teams, workflows, worktrees, and async task orchestration",
   "author": "baphuongna",
   "license": "MIT",

package/src/extension/async-notifier.ts

@@ -6,6 +6,7 @@ import type { TeamRunManifest, TeamTaskState } from "../state/types.ts";
 import { readCrewAgents, saveCrewAgents } from "../runtime/crew-agent-records.ts";
 import { withRunLockSync } from "../state/locks.ts";
 import { listRuns } from "./run-index.ts";
+import { logInternalError } from "../utils/internal-error.ts";
 
 export interface AsyncNotifierState {
 	seenFinishedRunIds: Set<string>;
@@ -121,7 +122,7 @@ export function startAsyncRunNotifier(ctx: ExtensionContext, state: AsyncNotifie
 				// Stopping here creates a race: old notifier dies before new one starts.
 				return;
 			}
-			console.error(`[pi-crew] async notifier error: ${message}`);
+			logInternalError("async-notifier", error, `interval=${intervalMs}`);
 		}
 	}, intervalMs);
 }

package/src/extension/crew-cleanup.ts

@@ -1,4 +1,5 @@
 import type { ExtensionAPI } from "@earendil-works/pi-coding-agent";
+import { logInternalError } from "../utils/internal-error.ts";
 // NOTE: globalProgressTracker import kept for documentation but not directly used
 // since we don't have agent IDs to untrack. Actual progress clearing should be
 // handled by the progress tracker itself on shutdown.
@@ -9,6 +10,12 @@ import type { ExtensionAPI } from "@earendil-works/pi-coding-agent";
  * Handles session_shutdown and SIGTERM/SIGHUP signals.
  */
 
+// Module-level flag to ensure signal handlers are registered only once,
+// even if registerCleanupHandler is called multiple times (e.g., on extension
+// reload or during dev hot-reload). Without this, listeners stack up and
+// cleanupChildProcesses fires N times on shutdown.
+let signalHandlersRegistered = false;
+
 interface ChildProcessInfo {
 	pid: number;
 	runId: string;
@@ -56,18 +63,30 @@ export function registerCleanupHandler(pi: ExtensionAPI): void {
 
 			console.log("[pi-crew] Cleanup complete");
 		} catch (error) {
-			console.error("[pi-crew] Cleanup error:", error);
+			logInternalError("crew-cleanup.shutdown", error);
 		}
 	});
 
-	// Handle SIGTERM/SIGHUP signals
-	const handleSignal = async (signal: string): Promise<void> => {
-		console.log(`[pi-crew] Received ${signal} - starting cleanup`);
-		await cleanupChildProcesses();
-	};
-
-	process.on("SIGTERM", () => { void handleSignal("SIGTERM"); });
-	process.on("SIGHUP", () => { void handleSignal("SIGHUP"); });
+	// Register signal handlers exactly once, even if registerCleanupHandler
+	// is called multiple times. This prevents listener stacking on extension
+	// reload and avoids double-cleanup on shutdown.
+	if (!signalHandlersRegistered) {
+		signalHandlersRegistered = true;
+		const handleSignal = async (signal: string): Promise<void> => {
+			console.log(`[pi-crew] Received ${signal} - starting cleanup`);
+			await cleanupChildProcesses();
+		};
+		process.on("SIGTERM", () => {
+			handleSignal("SIGTERM").catch((error) => {
+				logInternalError("crew-cleanup.SIGTERM", error);
+			});
+		});
+		process.on("SIGHUP", () => {
+			handleSignal("SIGHUP").catch((error) => {
+				logInternalError("crew-cleanup.SIGHUP", error);
+			});
+		});
+	}
 }
 
 async function cleanupChildProcesses(): Promise<void> {
@@ -81,7 +100,7 @@ async function cleanupChildProcesses(): Promise<void> {
 			// Process may already be dead or not exist
 			const err = error as NodeJS.ErrnoException;
 			if (err.code !== "ESRCH" && err.code !== "ENOENT") {
-				console.error(`[pi-crew] Error killing process ${pid}:`, err.message);
+				logInternalError("crew-cleanup.kill", error, `pid=${pid}`);
 			}
 		}
 		childProcessRegistry.unregister(pid);
@@ -100,7 +119,7 @@ async function cleanupTempDirectories(): Promise<void> {
 	try {
 		console.log(`[pi-crew] Temp directory cleanup deferred to run-graph`);
 	} catch (error) {
-		console.error("[pi-crew] Temp cleanup error:", error);
+		logInternalError("crew-cleanup.temp", error);
 	}
 }
 

package/src/runtime/async-runner.ts

@@ -3,6 +3,7 @@ import { createRequire } from "node:module";
 import * as fs from "node:fs";
 import * as path from "node:path";
 import { fileURLToPath, pathToFileURL } from "node:url";
+import { logInternalError } from "../utils/internal-error.ts";
 import { appendEvent } from "../state/event-log.ts";
 import type { TeamRunManifest } from "../state/types.ts";
 
@@ -163,7 +164,7 @@ export async function spawnBackgroundTeamRun(manifest: TeamRunManifest): Promise
 	} as unknown as Parameters<typeof spawn>[2];
 	const child = spawn(process.execPath, command.args, spawnOpts);
 	child.on("error", (error: Error) => {
-		console.error(`[pi-crew] async spawn failed: ${error.message}`);
+		logInternalError("async-runner.spawn", error, `pid=${child.pid ?? "unknown"}`);
 	});
 	child.unref();
 

package/src/runtime/crew-hooks.ts

@@ -22,6 +22,8 @@
  * ```
  */
 
+import { logInternalError } from "../utils/internal-error.ts";
+
 /** Valid hook event types in the crew lifecycle. */
 export type CrewHookEventType =
 	| 'task_started'
@@ -164,12 +166,12 @@ export class HookRegistry {
 				if (result instanceof Promise) {
 					// Attach a silent catch to prevent unhandled rejection warnings
 					result.catch((err) => {
-						console.error(`[crew-hooks] Async hook error for ${event.type}:`, err);
+						logInternalError("crew-hooks.async", err, `event.type=${event.type}`);
 					});
 				}
 			} catch (err) {
 				// Catch synchronous errors but don't let them block other hooks
-				console.error(`[crew-hooks] Hook error for ${event.type}:`, err);
+				logInternalError("crew-hooks.sync", err, `event.type=${event.type}`);
 			}
 		}
 	}

package/src/runtime/hidden-handoff.ts

@@ -10,6 +10,7 @@
  */
 
 import type { HandoffSummary } from "./handoff-manager.ts";
+import { logInternalError } from "../utils/internal-error.ts";
 
 /**
  * Type of hidden handoff message.
@@ -241,7 +242,7 @@ export class HiddenHandoffService {
 			this.sendHandoff(summary, options);
 		} catch (error) {
 			// Log but don't throw
-			console.error("Hidden handoff failed:", error);
+			logInternalError("hidden-handoff.async", error, `taskId=${summary.taskId} runId=${summary.runId}`);
 		}
 	}