pi-crew 0.5.2 → 0.5.6

package/src/tools/safe-bash.ts

@@ -1,50 +1,144 @@
 /**
  * Safe Bash Tool for pi-crew
  * Wraps bash with dangerous command blocking
+ * Uses linear-time scanning to prevent ReDoS attacks
  */
 
 import { Type } from "@sinclair/typebox";
 
-// Dangerous command patterns to block
+// Backward-compatible pattern array (kept for getPatterns API)
+// IMPORTANT: Line 8 (rm pattern with nested quantifiers) has been replaced
+// with linear-time checking in isDangerous() to prevent ReDoS attacks.
 const DANGEROUS_PATTERNS = [
-	// rm -rf / or rm -rf ~ (catastrophic root/home deletion)
-	/\brm\s+(-[a-zA-Z]*[rf][a-zA-Z]*\s*)+(\/|~)(\s*$)/,
-	/\brm\s+(-[a-zA-Z]*[rf][a-zA-Z]*\s*)+(\/|~)($|\s)/,
-	// Privilege escalation
+	// NOTE: rm patterns handled by matchesDangerousRm() for linear-time safety
 	/\bsudo\b/,
 	/\bsu\s+root\b/,
-	// Filesystem destruction
 	/\bmkfs\b/,
 	/\bdd\s+if=/,
-	// Fork bomb
 	/^:\s*\(\s*\)\s*\{.*\|.*&.*\}\s*;.*$/,
-	// Device writing
 	/>\s*\/dev\/[sh]d[a-z]/,
 	/\bchmod\s+(-[a-zA-Z]+\s+)?777\s+\//,
 	/\bchown\s+(-[a-zA-Z]+\s+)?root/,
-	// Pipe to shell (download and execute)
 	/\bcurl\s.*\|\s*(ba)?sh/i,
 	/\bwget\s.*\|\s*(ba)?sh/i,
-	// System shutdown/reboot
 	/\bshutdown\b/,
 	/\breboot\b/,
 	/\binit\s+0\b/,
-	// Kill critical processes
 	/\bkill\s+-9\s+1\b/,
 	/\bkillall\b/,
-	// Encoded commands
 	/\|\s*base64\s+-d/,
 	/\|\s*python.*-c/,
 	/\|\s*perl.*-e/,
 	/\|\s*ruby.*-e/,
-	// Network to shell
-	/\bbash\s+-i\s+>\s*\&/,
+	/\bbash\s+-i\s*>\s*\&/,
 	/\bexec\s+.*bash/,
-	// /etc/passwd manipulation
 	/\becho\s+.*>\s*\/etc\/passwd/,
 	/\bcat\s+.*>\s*\/etc\/passwd/,
 ];
 
+/**
+ * Linear-time check if command contains a dangerous rm pattern like "rm -rf /" or "rm -rf ~"
+ * Replaces O(n²) regex backtracking with O(n) string scanning
+ */
+function matchesDangerousRm(command: string): boolean {
+	let pos = 0;
+	const len = command.length;
+	// Find "rm" at word boundary
+	while (pos < len) {
+		const rmIdx = command.indexOf("rm", pos);
+		if (rmIdx === -1) return false;
+		// Check word boundary before "rm"
+		if (rmIdx > 0 && /\w/.test(command[rmIdx - 1])) {
+			pos = rmIdx + 1;
+			continue;
+		}
+		// Must be followed by whitespace
+		const afterRm = rmIdx + 2;
+		if (afterRm >= len || /\s/.test(command[afterRm])) {
+			// Found "rm " - now check for -rf flags followed by / or ~
+			let p = afterRm + 1;
+			while (p < len) {
+				// Skip whitespace
+				while (p < len && /\s/.test(command[p])) p++;
+				if (p >= len) break;
+				// Check for flag
+				if (command[p] !== "-") break;
+				p++;
+				let hasR = false, hasF = false;
+				while (p < len && /[a-zA-Z]/.test(command[p])) {
+					if (command[p] === "r" || command[p] === "R") hasR = true;
+					if (command[p] === "f" || command[p] === "F") hasF = true;
+					p++;
+				}
+				if (!hasR && !hasF) break; // Flag must have r or f
+				// Skip whitespace after flag
+				while (p < len && /\s/.test(command[p])) p++;
+			}
+			// Now check if followed by / or ~ (end or whitespace)
+			if (p < len && (command[p] === "/" || command[p] === "~")) {
+				const afterSlash = p + 1;
+				if (afterSlash >= len || /\s/.test(command[afterSlash]) || command[afterSlash] === ";") {
+					return true; // Dangerous!
+				}
+			}
+		}
+		pos = rmIdx + 1;
+	}
+	return false;
+}
+
+/**
+ * Linear-time check for fork bomb pattern: :() { ... | ... & ... } ; ...
+ */
+function matchesForkBomb(command: string): boolean {
+	// Must start with :
+	const trimmed = command.trimStart();
+	if (!trimmed.startsWith(":")) return false;
+	// Find () after :
+	const parenIdx = trimmed.indexOf("()");
+	if (parenIdx === -1 || parenIdx > 10) return false; // : must be close to ()
+	// Find { after ()
+	const braceIdx = trimmed.indexOf("{", parenIdx);
+	if (braceIdx === -1 || braceIdx > parenIdx + 5) return false;
+	// Find } closing brace
+	const closeBrace = trimmed.indexOf("}", braceIdx);
+	if (closeBrace === -1) return false;
+	// Check content between braces for | and &
+	const content = trimmed.slice(braceIdx + 1, closeBrace);
+	if (content.includes("|") && content.includes("&")) return true;
+	return false;
+}
+
+/**
+ * Check for encoded command patterns (pipe to shell)
+ */
+function matchesEncodedPipe(command: string): boolean {
+	const lower = command.toLowerCase();
+	const pipeIdx = lower.indexOf("|");
+	if (pipeIdx === -1) return false;
+	const afterPipe = lower.slice(pipeIdx + 1).trimStart();
+	if (afterPipe.startsWith("base64") || afterPipe.startsWith("python") || afterPipe.startsWith("perl") || afterPipe.startsWith("ruby")) {
+		// Check if followed by -d or -c or -e
+		const rest = afterPipe.slice(6).trimStart();
+		if (rest.startsWith("-d") || rest.startsWith("-c") || rest.startsWith("-e")) return true;
+	}
+	return false;
+}
+
+/**
+ * Check if command contains a specific dangerous substring
+ */
+function containsDangerous(command: string, pattern: string): boolean {
+	return command.indexOf(pattern) !== -1;
+}
+
+/**
+ * Check if command starts with dangerous prefix
+ */
+function startsWithDangerous(command: string, pattern: string): boolean {
+	return command.trimStart().startsWith(pattern);
+}
+
 export interface SafeBashOptions {
 	/** Enable/disable safe mode. Default: true */
 	enabled?: boolean;
@@ -75,9 +169,47 @@ export function isDangerous(command: string, options: SafeBashOptions = {}): str
 		}
 	}
 
-	// Check dangerous patterns
-	const allPatterns = [...DANGEROUS_PATTERNS, ...additionalPatterns];
-	for (const pattern of allPatterns) {
+	// Use linear-time scanning functions for critical patterns
+	if (matchesDangerousRm(normalized)) {
+		return "Command blocked by safe_bash: dangerous rm pattern detected";
+	}
+	if (matchesForkBomb(normalized)) {
+		return "Command blocked by safe_bash: fork bomb pattern detected";
+	}
+	if (matchesEncodedPipe(normalized)) {
+		return "Command blocked by safe_bash: encoded pipe to shell detected";
+	}
+
+	// Check remaining patterns using regex (these are safe from ReDoS)
+	for (const pattern of DANGEROUS_PATTERNS) {
+		if (pattern.test(normalized)) {
+			return `Command blocked by safe_bash: matches dangerous pattern \`${pattern}\``;
+		}
+	}
+
+	// Additional shell injection checks using regex for non-critical patterns
+	// Block command substitution $(...)
+	if (/\$\([^)]*\)/.test(command)) {
+		return "Command blocked by safe_bash: command substitution $(...) is not allowed";
+	}
+	// Block backtick substitution
+	const backtickRe = /`[^`]*`/;
+	if (backtickRe.test(command)) {
+		return "Command blocked by safe_bash: backtick substitution is not allowed";
+	}
+	// Block here-docs <<
+	if (/<<\s*['"]?[\w-]+['"]?/.test(command) || /\$<<\s*['"]?[\w-]+['"]?/.test(command)) {
+		return "Command blocked by safe_bash: here-doc is not allowed";
+	}
+	// Block ${...} variable expansion containing shell metacharacters (pipes, redirects, &&/||)
+	const varExpRe = /\$\{([^}]*)\}/;
+	const varMatch = command.match(varExpRe);
+	if (varMatch && /[|&;<>]/.test(varMatch[1])) {
+		return "Command blocked by safe_bash: variable expansion with shell metacharacters is not allowed";
+	}
+
+	// Check additional patterns (user-provided regex)
+	for (const pattern of additionalPatterns) {
 		if (pattern.test(normalized)) {
 			return `Command blocked by safe_bash: matches dangerous pattern \`${pattern}\``;
 		}
@@ -142,8 +274,8 @@ export function createSafeBash(options: SafeBashOptions = {}) {
  * These can be used in allowPatterns for specific use cases
  */
 export const COMMON_SAFE_PATTERNS = {
-	// Safe rm with specific paths
-	safeRm: /\brm\s+(-[a-zA-Z]*f[a-zA-Z]*\s+)?((?![\/~])\/)?(tmp|cache|node_modules|dist|build)\//,
+	// Safe rm with specific paths - uses simple contains check
+	safeRm: /rm\s+(-[a-zA-Z]*f[a-zA-Z]*\s+)?((?![\/~])\/)?(tmp|cache|node_modules|dist|build)\//,
 	// Safe git operations
 	safeGit: /\bgit\s+(clone|pull|push|commit|add|status|diff|log|branch|checkout|merge|rebase)/,
 	// Safe npm/yarn/pnpm

package/src/types/new-api-types.ts

@@ -0,0 +1,34 @@
+/**
+ * Type imports from pi v0.77.0
+ */
+import type { AgentSessionEvent } from "@earendil-works/pi-coding-agent";
+
+export type {
+  AgentSessionEvent,
+} from "@earendil-works/pi-coding-agent";
+
+// Note: AgentEvent is not exported by pi-coding-agent v0.77.0
+// Using AgentEndEvent and AgentStartEvent instead
+
+// Type guards for pi-crew usage
+export function isToolEvent(event: AgentSessionEvent): boolean {
+  return event.type === "tool_execution_start" || 
+         event.type === "tool_execution_update" || 
+         event.type === "tool_execution_end";
+}
+
+export function isAgentLifecycleEvent(event: AgentSessionEvent): boolean {
+  return event.type === "agent_start" || event.type === "agent_end";
+}
+
+export function isCompactionEvent(event: AgentSessionEvent): boolean {
+  return event.type === "compaction_start" || event.type === "compaction_end";
+}
+
+export function isRetryEvent(event: AgentSessionEvent): boolean {
+  return event.type === "auto_retry_start" || event.type === "auto_retry_end";
+}
+
+export function isQueueEvent(event: AgentSessionEvent): boolean {
+  return event.type === "queue_update";
+}

package/src/ui/agent-management-overlay.ts

@@ -38,6 +38,8 @@ function sourceIcon(source: ResourceSource): string {
 		case "user": return "👤";
 		case "project": return "📂";
 		case "git": return "🔗";
+		case "dynamic": return "⚡";
+		default: return "❓";
 	}
 }
 
@@ -47,6 +49,8 @@ function sourceLabel(source: ResourceSource): string {
 		case "user": return "user";
 		case "project": return "project";
 		case "git": return "git";
+		case "dynamic": return "dynamic";
+		default: return "unknown";
 	}
 }
 
@@ -61,7 +65,7 @@ export interface AgentOverlayState {
 export function createAgentOverlayState(entries: AgentEntry[], maxVisible = 20): AgentOverlayState {
 	return {
 		entries: entries.sort((a, b) => {
-			const order: Record<ResourceSource, number> = { project: 0, user: 1, git: 2, builtin: 3 };
+			const order: Record<ResourceSource, number> = { project: 0, user: 1, git: 2, builtin: 3, dynamic: 4 };
 			const diff = (order[a.source] ?? 4) - (order[b.source] ?? 4);
 			return diff !== 0 ? diff : a.name.localeCompare(b.name);
 		}),

package/src/ui/crew-widget.ts

@@ -23,14 +23,25 @@ import { SUBAGENT_SPINNER_FRAMES, spinnerBucket, spinnerFrame } from "./spinner.
 
 const SPINNER = SUBAGENT_SPINNER_FRAMES;
 const TOOL_LABELS: Record<string, string> = {
-	read: "reading",
+	head: "reading",
 	bash: "running command",
 	edit: "editing",
 	write: "writing",
-	grep: "searching",
+grep: "searching",
 	find: "finding files",
 	ls: "listing",
 };
+
+const TOOL_ICONS: Record<string, string> = {
+	read: "📖",
+	bash: ">",
+	edit: "✏",
+	write: "📝",
+	grep: "🔍",
+	find: "📁",
+	ls: "📋",
+	agent: "🤖",
+};
 const LEGACY_WIDGET_KEY = "pi-crew";
 const WIDGET_KEY = "pi-crew-active";
 const STATUS_KEY = "pi-crew";
@@ -90,16 +101,16 @@ function describeLiveActivity(handle: LiveAgentHandle): string {
 	if (act.activeTools.size > 0) {
 		const groups = new Map<string, number>();
 		for (const toolName of act.activeTools.values()) {
-			const label = TOOL_LABELS[toolName] ?? toolName;
-			groups.set(label, (groups.get(label) ?? 0) + 1);
+			groups.set(toolName, (groups.get(toolName) ?? 0) + 1);
 		}
 		const parts: string[] = [];
-		for (const [label, count] of groups) {
+		for (const [toolName, count] of groups) {
+			const icon = TOOL_ICONS[toolName] ?? "?";
+			const label = TOOL_LABELS[toolName] ?? toolName;
 			if (count > 1) {
-				const noun = label === "searching" ? "patterns" : label === "listing" ? "entries" : "files";
-				parts.push(`${label} ${count} ${noun}`);
+				parts.push(`${icon}${count} ${label}s`);
 			} else {
-				parts.push(label);
+				parts.push(`${icon} ${label}`);
 			}
 		}
 		return parts.join(", ") + "…";
@@ -241,14 +252,17 @@ export function activeWidgetRuns(cwd: string, manifestCache?: ManifestCache, sna
 function statusSummary(runs: WidgetRun[]): string {
 	const agents = runs.flatMap((item) => item.agents);
 	const runningAgents = agents.filter((agent) => agent.status === "running").length;
-	const queuedAgents = agents.filter((agent) => agent.status === "queued").length;
-	const waitingAgents = agents.filter((agent) => agent.status === "waiting").length;
+	const queuedAgents = agents.filter((agent) => agent.status === "queued" || agent.status === "waiting").length;
 	const completedAgents = agents.filter((agent) => agent.status === "completed").length;
-	const parts = [`${runningAgents} running`];
-	if (queuedAgents) parts.push(`${queuedAgents} queued`);
-	if (waitingAgents) parts.push(`${waitingAgents} waiting`);
-	if (completedAgents) parts.push(`${completedAgents}/${agents.length} done`);
-	return `Crew: ${parts.join(", ")}`;
+	const totalAgents = agents.length;
+	const totalRuns = runs.length;
+	const model = agents.find((a) => a.model)?.model?.split("/").at(-1);
+	const parts = [`⚙ ${runningAgents}r`];
+	if (queuedAgents > 0) parts.push(`${queuedAgents}q`);
+	if (completedAgents > 0) parts.push(`${completedAgents}/${totalAgents}done`);
+	if (totalRuns > 1) parts.push(`${totalRuns}runs`);
+	if (model) parts.push(model);
+	return parts.join(" · ");
 }
 
 export function notificationBadge(count: number | undefined, env: NodeJS.ProcessEnv = process.env): string {

package/src/ui/overlays/mailbox-detail-overlay.ts

@@ -20,6 +20,8 @@ export class MailboxDetailOverlay {
 	private side: "inbox" | "outbox" = "inbox";
 	private selected = 0;
 	private expanded = false;
+	private lastRefreshedTaskCount = 0;
+	private needsRefresh = true;
 
 	constructor(opts: { runId: string; cwd: string; done: (action: MailboxAction | undefined) => void; theme?: unknown }) {
 		this.runId = opts.runId;
@@ -32,6 +34,12 @@ export class MailboxDetailOverlay {
 	private refresh(): void {
 		const loaded = loadRunManifestById(this.cwd, this.runId);
 		if (!loaded) return;
+		// Track task count changes to trigger re-render
+		const taskCount = loaded.tasks.length;
+		if (taskCount !== this.lastRefreshedTaskCount) {
+			this.lastRefreshedTaskCount = taskCount;
+			this.needsRefresh = true;
+		}
 		const delivery = readDeliveryState(loaded.manifest).messages;
 		const applyDelivery = (message: MailboxMessage): MailboxMessage => ({ ...message, status: delivery[message.id] ?? message.status });
 		const taskIds = loaded.tasks.map((task) => task.id);
@@ -49,11 +57,14 @@ export class MailboxDetailOverlay {
 	}
 
 	invalidate(): void {
-		this.refresh();
+		this.needsRefresh = true;
 	}
 
 	render(width: number): string[] {
-		this.refresh();
+		if (this.needsRefresh) {
+			this.refresh();
+			this.needsRefresh = false;
+		}
 		const inner = Math.max(40, width - 4);
 		const col = Math.max(18, Math.floor((inner - 3) / 2));
 		const lines = [

package/src/ui/powerbar-publisher.ts

@@ -12,6 +12,8 @@ import type { ManifestCache } from "../runtime/manifest-cache.ts";
 import type { RunSnapshotCache, RunUiSnapshot } from "./snapshot-types.ts";
 import { notificationBadge } from "./crew-widget.ts";
 import { RenderCoalescer } from "./render-coalescer.ts";
+import { allWorkflows, discoverWorkflows } from "../workflows/discover-workflows.ts";
+import type { WorkflowConfig, WorkflowStep } from "../workflows/workflow-config.ts";
 
 type EventBus = { emit?: (event: string, data: unknown) => void; listenerCount?: (event: string) => number } | undefined;
 type StatusContext = { hasUI?: boolean; ui?: { setStatus?: (key: string, text: string | undefined) => void } } | undefined;
@@ -63,6 +65,7 @@ export function registerPiCrewPowerbarSegments(events: EventBus, config?: CrewUi
 	if (config?.powerbar === false) return;
 	safeEmit(events, "powerbar:register-segment", { id: "pi-crew-active", label: "pi-crew active agents" });
 	safeEmit(events, "powerbar:register-segment", { id: "pi-crew-progress", label: "pi-crew run progress" });
+	safeEmit(events, "powerbar:register-segment", { id: "pi-crew-steps", label: "pi-crew workflow steps" });
 }
 
 export function updatePiCrewPowerbar(events: EventBus, cwd: string, config?: CrewUiConfig, manifestCache?: ManifestCache, snapshotCache?: RunSnapshotCache, ctx?: StatusContext, notificationCount = 0, preloadedManifests?: TeamRunManifest[]): void {
@@ -90,9 +93,10 @@ export function updatePiCrewPowerbar(events: EventBus, cwd: string, config?: Cre
 	if (!active.length) {
 		lastActiveKey = undefined;
 		lastProgressKey = undefined;
+		lastStepsKey = undefined;
 		safeEmit(events, "powerbar:update", { id: "pi-crew-active" });
 		safeEmit(events, "powerbar:update", { id: "pi-crew-progress" });
-		if (useStatusFallback) setStatusFallback(ctx, undefined);
+		safeEmit(events, "powerbar:update", { id: "pi-crew-steps" });
 		return;
 	}
 	const agents = active.flatMap((item) => item.agents);
@@ -108,13 +112,33 @@ export function updatePiCrewPowerbar(events: EventBus, cwd: string, config?: Cre
 	const model = config?.showModel === false ? undefined : agents.find((agent) => agent.model)?.model?.split("/").at(-1);
 	const tokenText = config?.showTokens === false || !tokenTotal ? undefined : compactTokens(tokenTotal);
 	const liveRunning = listLiveAgents().filter((a) => a.status === "running").length;
-	const activeText = `crew ${running}a/${waiting}w${liveRunning > 0 ? `/${liveRunning}live` : ""}${notificationBadge(notificationCount)}`;
-	const activeSuffix = [model, tokenText].filter(Boolean).join(" · ") || undefined;
+	// Always show consistent status: running count + queued count from live tasks only
+	// Avoid snapshot cache for counts to prevent UI jumping
+	const runningCount = agents.filter((a) => a.status === "running").length;
+	// Count queued/waiting tasks directly from tasks array (not snapshot) for consistency
+	const queuedCount = active.reduce((sum, item) => sum + item.tasks.reduce((s, t) => s + (t.status === "queued" || t.status === "waiting" ? 1 : 0), 0), 0);
+	// Format: "1 running", "2 running · 1 queued", "3 queued", "idle"
+	const runningLabel = runningCount === 1 ? "1 running" : `${runningCount} running`;
+	const queuedLabel = queuedCount === 1 ? "1 queued" : `${queuedCount} queued`;
+	const crewStatus = runningCount > 0 && queuedCount > 0 ? `${runningLabel} · ${queuedLabel}` : runningCount > 0 ? runningLabel : queuedCount > 0 ? queuedLabel : "idle";
+	const liveSuffix = liveRunning > 0 ? ` (${liveRunning} live)` : "";
+	const notificationText = notificationBadge(notificationCount);
+	// Always show model + tokens as suffix when available (for activePayload consistency)
+	const suffixParts = [model, tokenText].filter(Boolean);
+	const activeSuffix = suffixParts.length > 0 ? suffixParts.join(" · ") : undefined;
+	// Progress always includes token count for consistency
 	const progressSuffix = `${completed}/${total}${tokenText ? ` · ${tokenText}` : ""}`;
+	// Build complete, always-consistent fallback text AND event payload to prevent UI flickering
+	// Both fallback and events must use the SAME format - no conditional display
+	// Format: "⚙ 1 running · 1 queued · model · 30k · 0/1" (never changes based on availability)
+	const progressPart = `${completed}/${total}`;
+	const allParts = [`⚙ ${crewStatus}`, model ?? "", tokenText ?? "", progressPart].filter(Boolean);
+	const unifiedText = allParts.join(" · ");
+	// activePayload.text includes notification badge for event payload
 	const activePayload = {
 		id: "pi-crew-active",
 		icon: "⚙",
-		text: activeText,
+		text: `⚙ ${crewStatus}${liveSuffix}${notificationText}${activeSuffix ? ` · ${activeSuffix}` : ""}`,
 		suffix: activeSuffix,
 		color: running ? "accent" : "warning",
 	} as const;
@@ -126,12 +150,15 @@ export function updatePiCrewPowerbar(events: EventBus, cwd: string, config?: Cre
 		color: completed === total ? "success" : "accent",
 		barSegments: 8,
 	} as const;
+	// Build step progress: "explorer > planner > executor > verifier" with current step highlighted
+	const stepsPayload = buildStepsPayload(active, tasks);
 	// 1.8: dedup per segment using a key over every visible field. Previously
 	// the dedup string only carried text/suffix/running, so changes to `bar`
 	// (progress %) or `color` could be swallowed and stale UI emitted again
 	// later as a single noisy burst.
 	const activeKey = powerbarKey(activePayload);
 	const progressKey = powerbarKey(progressPayload);
+	const stepsKey = powerbarKey(stepsPayload);
 	if (activeKey !== lastActiveKey) {
 		lastActiveKey = activeKey;
 		safeEmit(events, "powerbar:update", activePayload);
@@ -140,14 +167,21 @@ export function updatePiCrewPowerbar(events: EventBus, cwd: string, config?: Cre
 		lastProgressKey = progressKey;
 		safeEmit(events, "powerbar:update", progressPayload);
 	}
-	if (useStatusFallback) setStatusFallback(ctx, `${activeText}${activeSuffix ? ` · ${activeSuffix}` : ""} · ${progressSuffix}`);
+	if (stepsKey !== lastStepsKey) {
+		lastStepsKey = stepsKey;
+		safeEmit(events, "powerbar:update", stepsPayload);
+	}
+	// Never call setStatusFallback - crew-widget manages "pi-crew" status with its own widget format
+	// Powerbar only emits events; it does not set status directly
 }
 
 // --- Dedup state: skip emit if segment data unchanged ---
 let lastActiveKey: string | undefined;
 let lastProgressKey: string | undefined;
+let lastStepsKey: string | undefined;
 
 interface PowerbarPayloadShape {
+	id?: string;
 	text?: string;
 	suffix?: string;
 	bar?: number;
@@ -160,6 +194,63 @@ function powerbarKey(payload: PowerbarPayloadShape): string {
 	return `${payload.text ?? ""}|${payload.suffix ?? ""}|${payload.bar ?? ""}|${payload.color ?? ""}|${payload.icon ?? ""}|${payload.barSegments ?? ""}`;
 }
 
+interface ActiveItem {
+	run: TeamRunManifest;
+	agents: ReturnType<typeof readCrewAgents>;
+	tasks: TeamTaskState[];
+	snapshot?: RunUiSnapshot;
+}
+
+/**
+ * Build the workflow steps segment showing: ✓explore › →plan › ○execute › ○verify
+ * with the current/active step highlighted using → arrow.
+ */
+function buildStepsPayload(active: ActiveItem[], allTasks: TeamTaskState[]): PowerbarPayloadShape {
+	if (!active.length) {
+		return { id: "pi-crew-steps" };
+	}
+	const run = active[0]!.run;
+	const workflowName = run.workflow ?? "default";
+	// Load workflow steps
+	const workflows = allWorkflows(discoverWorkflows(run.cwd));
+	const workflow = workflows.find((w) => w.name === workflowName);
+	if (!workflow || workflow.steps.length === 0) {
+		return { id: "pi-crew-steps", text: workflowName };
+	}
+	// Build step status map from tasks
+	const stepStatus = new Map<string, "completed" | "running" | "pending">();
+	for (const task of allTasks) {
+		if (!task.stepId) continue;
+		if (!stepStatus.has(task.stepId)) {
+			if (task.status === "completed") {
+				stepStatus.set(task.stepId, "completed");
+			} else if (task.status === "running" || task.status === "queued" || task.status === "waiting") {
+				stepStatus.set(task.stepId, "running");
+			}
+		}
+	}
+	// Format: "✓explore › →plan › ○execute › ○verify"
+	// ✓ = completed, → = running (current), ○ = pending
+	const stepParts: string[] = [];
+	for (const step of workflow.steps) {
+		const status = stepStatus.get(step.id) ?? "pending";
+		const icon = status === "completed" ? "✓" : status === "running" ? "→" : "○";
+		// Shorten long step names
+		const stepName = step.id.length > 10 ? step.id.slice(0, 9) + "…" : step.id;
+		stepParts.push(`${icon}${stepName}`);
+	}
+	const stepsText = stepParts.join(" › ");
+	// Color: accent if running step exists, success if all complete, dim otherwise
+	const hasRunningStep = [...stepStatus.values()].includes("running");
+	const allComplete = stepStatus.size === workflow.steps.length && ![...stepStatus.values()].includes("running");
+	const color = allComplete ? "success" : hasRunningStep ? "accent" : "dim";
+	return {
+		id: "pi-crew-steps",
+		text: stepsText,
+		color,
+	};
+}
+
 // --- Coalesced powerbar update ---
 
 interface PowerbarUpdateArgs {
@@ -203,19 +294,22 @@ export function requestPowerbarUpdate(
 
 /** Dispose the powerbar coalescer. Call during extension cleanup. */
 export function disposePowerbarCoalescer(): void {
+	powerbarCoalescer.flush();
 	powerbarCoalescer.dispose();
 }
 
-export function clearPiCrewPowerbar(events: EventBus, ctx?: StatusContext): void {
+export function clearPiCrewPowerbar(events: EventBus): void {
 	lastActiveKey = undefined;
 	lastProgressKey = undefined;
+	lastStepsKey = undefined;
 	safeEmit(events, "powerbar:update", { id: "pi-crew-active" });
 	safeEmit(events, "powerbar:update", { id: "pi-crew-progress" });
-	setStatusFallback(ctx, undefined);
+	safeEmit(events, "powerbar:update", { id: "pi-crew-steps" });
 }
 
 /** Reset dedup state on session lifecycle events. */
 export function resetPowerbarDedupState(): void {
 	lastActiveKey = undefined;
 	lastProgressKey = undefined;
+	lastStepsKey = undefined;
 }