pi-crew 0.6.0 → 0.6.3

package/src/plugins/plugin-define.ts

@@ -0,0 +1,6 @@
+/**
+ * Simplifies plugin struct definition.
+ */
+export function definePlugin<T extends { name: string; enablers: readonly string[] }>(spec: T): T {
+  return spec;
+}

package/src/plugins/plugin-registry.ts

@@ -0,0 +1,32 @@
+export interface Plugin {
+  readonly name: string;
+  readonly enablers: readonly string[];
+  readonly entryPatterns?: readonly string[];
+  readonly configPatterns?: readonly string[];
+  readonly toolingDependencies?: readonly string[];
+  readonly pathAliases?: readonly string[][];
+  readonly virtualModulePrefixes?: readonly string[];
+}
+
+export class PluginRegistry {
+  private plugins: Plugin[] = [];
+
+  register(plugin: Plugin): void {
+    this.plugins.push(plugin);
+  }
+
+  activePlugins(allDeps: string[]): Plugin[] {
+    return this.plugins.filter((p) =>
+      p.enablers.some((enabler) => {
+        if (enabler.endsWith("/")) {
+          return allDeps.some((d) => d.startsWith(enabler));
+        }
+        return allDeps.includes(enabler);
+      }),
+    );
+  }
+
+  allPlugins(): Plugin[] {
+    return [...this.plugins];
+  }
+}

package/src/plugins/plugins/index.ts

@@ -0,0 +1,3 @@
+export { NextJsPlugin } from "./nextjs.ts";
+export { VitestPlugin } from "./vitest.ts";
+export { VitePlugin } from "./vite.ts";

package/src/plugins/plugins/nextjs.ts

@@ -0,0 +1,19 @@
+import { definePlugin } from "../plugin-define.ts";
+
+export const NextJsPlugin = definePlugin({
+  name: "nextjs",
+  enablers: ["next"],
+  entryPatterns: [
+    "src/app/**/*.{ts,tsx}",
+    "src/pages/**/*.{ts,tsx}",
+    "src/app/**/page.{ts,tsx}",
+    "src/app/**/layout.{ts,tsx}",
+    "src/app/**/route.{ts,tsx}",
+    "middleware.{ts,js}",
+    "next.config.{ts,js,mjs}",
+  ],
+  configPatterns: ["next.config.{ts,js,mjs}"],
+  toolingDependencies: ["next", "@next/font", "@next/mdx"],
+  pathAliases: [["~", "src"]],
+  virtualModulePrefixes: ["next:"],
+});

package/src/plugins/plugins/vite.ts

@@ -0,0 +1,14 @@
+import { definePlugin } from "../plugin-define.ts";
+
+export const VitePlugin = definePlugin({
+  name: "vite",
+  enablers: ["vite", "rolldown-vite"],
+  entryPatterns: [
+    "src/main.{ts,tsx,js,jsx}",
+    "src/index.{ts,tsx,js,jsx}",
+    "index.html",
+  ],
+  configPatterns: ["vite.config.{ts,js,mts,mjs}"],
+  toolingDependencies: ["vite"],
+  virtualModulePrefixes: ["virtual:"],
+});

package/src/plugins/plugins/vitest.ts

@@ -0,0 +1,14 @@
+import { definePlugin } from "../plugin-define.ts";
+
+export const VitestPlugin = definePlugin({
+  name: "vitest",
+  enablers: ["vitest"],
+  entryPatterns: [
+    "**/*.test.{ts,tsx}",
+    "**/*.spec.{ts,tsx}",
+    "src/**/*.test.{ts,tsx}",
+    "src/**/*.spec.{ts,tsx}",
+  ],
+  configPatterns: ["vitest.config.{ts,js,mjs}", "vite.config.ts"],
+  toolingDependencies: ["vitest"],
+});

package/src/runtime/adaptive-plan.ts

@@ -22,6 +22,7 @@ import type { TeamConfig } from "../teams/team-config.ts";
 import type { WorkflowConfig, WorkflowStep } from "../workflows/workflow-config.ts";
 import type { TeamRunManifest, TeamTaskState } from "../state/types.ts";
 import { refreshTaskGraphQueues } from "./task-graph-scheduler.ts";
+import { getPlanTemplate, renderPlanTemplate, listPlanTemplates } from "./plan-templates.ts";
 
 export interface AdaptivePlanTask {
 	role: string;
@@ -70,6 +71,29 @@ export function extractAdaptivePlanJson(text: string): string | undefined {
 }
 
 export function parseAdaptivePlan(text: string, allowedRoles: string[]): AdaptivePlan | undefined {
+	// Check if the text is a plan template reference: "template:<name>" with optional JSON variables
+	const templateRefMatch = text.match(/^template:([a-zA-Z0-9_-]+)/);
+	if (templateRefMatch?.[1]) {
+		const template = getPlanTemplate(templateRefMatch[1]);
+		if (template) {
+			// Try to extract variables from the remaining text
+			let variables: Record<string, string> = {};
+			try {
+				const varsJson = text.slice(templateRefMatch[0].length).trim();
+				if (varsJson) variables = JSON.parse(varsJson);
+			} catch { /* use empty variables */ }
+			const rendered = renderPlanTemplate(templateRefMatch[1], variables);
+			if (rendered) {
+				// Convert RenderedPlan → AdaptivePlan
+				const phases: AdaptivePlanPhase[] = rendered.phases.map(phase => ({
+					name: phase.name,
+					tasks: [{ role: phase.role, task: phase.task }],
+				}));
+				return phases.length ? { phases } : undefined;
+			}
+		}
+	}
+
 	const raw = extractAdaptivePlanJson(text);
 	if (!raw) return undefined;
 	let parsed: unknown;

package/src/runtime/agent-control.ts

@@ -69,7 +69,8 @@ export function applyAttentionState(manifest: TeamRunManifest, agent: CrewAgentR
 	return updated;
 }
 
-export function applyLongRunningCheck(
+/** @internal */
+function applyLongRunningCheck(
 	manifest: TeamRunManifest,
 	agent: CrewAgentRecord,
 	config: CrewControlConfig,
@@ -105,7 +106,8 @@ export function applyLongRunningCheck(
 	return updated;
 }
 
-export function trackConsecutiveToolFailure(
+/** @internal */
+function trackConsecutiveToolFailure(
 	manifest: TeamRunManifest,
 	agent: CrewAgentRecord,
 	toolName: string,
@@ -140,7 +142,8 @@ export function trackConsecutiveToolFailure(
 	return updated;
 }
 
-export function resetConsecutiveToolFailures(
+/** @internal */
+function resetConsecutiveToolFailures(
 	manifest: TeamRunManifest,
 	agent: CrewAgentRecord,
 ): void {

package/src/runtime/async-runner.ts

@@ -5,6 +5,11 @@ import * as path from "node:path";
 import { fileURLToPath, pathToFileURL } from "node:url";
 import { logInternalError } from "../utils/internal-error.ts";
 import { appendEvent } from "../state/event-log.ts";
+import { sanitizeEnvSecrets } from "../utils/env-filter.ts";
+import {
+	registerWorker,
+	unregisterWorker,
+} from "./orphan-worker-registry.ts";
 import type { TeamRunManifest } from "../state/types.ts";
 
 
@@ -131,8 +136,71 @@ export async function spawnBackgroundTeamRun(manifest: TeamRunManifest): Promise
 	const logPath = path.join(manifest.stateRoot, "background.log");
 	fs.mkdirSync(manifest.stateRoot, { recursive: true });
 
-	// NOTE: Do NOT set PI_CREW_PARENT_PID for the background runner.
-	const { PI_CREW_PARENT_PID: _, ...envWithoutParentPid } = process.env;
+	// SECURITY FIX: Use sanitizeEnvSecrets with same allow-list as child-pi.ts
+	// to prevent leaking all env vars (including secrets) to detached background runner.
+	// Previously, destructuring only removed PI_CREW_PARENT_PID but kept everything else.
+	const filteredEnv = sanitizeEnvSecrets(process.env, {
+		allowList: [
+			// Model provider API keys (same as child-pi.ts)
+			"MINIMAX_API_KEY",
+			"MINIMAX_GROUP_ID",
+			"OPENAI_API_KEY",
+			"OPENAI_ORG_ID",
+			"ANTHROPIC_API_KEY",
+			"GOOGLE_API_KEY",
+			"GOOGLE_GENERATIVE_LANGUAGE_API_KEY",
+			"AZURE_OPENAI_API_KEY",
+			"AZURE_OPENAI_ENDPOINT",
+			"AWS_ACCESS_KEY_ID",
+			"AWS_SECRET_ACCESS_KEY",
+			"AWS_REGION",
+			"ZEU_API_KEY",
+			"ZERODEV_API_KEY",
+			// Essential non-secret vars
+			"PATH",
+			"HOME",
+			"USER",
+			"SHELL",
+			"TERM",
+			"LANG",
+			"LC_ALL",
+			"LC_COLLATE",
+			"LC_CTYPE",
+			"LC_MESSAGES",
+			"LC_MONETARY",
+			"LC_NUMERIC",
+			"LC_TIME",
+			"XDG_CONFIG_HOME",
+			"XDG_DATA_HOME",
+			"XDG_CACHE_HOME",
+			"XDG_RUNTIME_DIR",
+			"NVM_BIN",
+			"NVM_DIR",
+			"NVM_INC",
+			"NODE_PATH",
+			"NODE_DISABLE_COLORS",
+			"NODE_EXTRA_CA_CERTS",
+			"NPM_CONFIG_REGISTRY",
+			"NPM_CONFIG_USERCONFIG",
+			"NPM_CONFIG_GLOBALCONFIG",
+			// FIX: explicit list matches child-pi.ts to prevent regression.
+			// PI_CREW_PARENT_PID is needed for parent-guard (liveness check).
+			"PI_CREW_DEPTH",
+			"PI_CREW_MAX_DEPTH",
+			"PI_CREW_INHERIT_PROJECT_CONTEXT",
+			"PI_CREW_INHERIT_SKILLS",
+			"PI_CREW_PARENT_PID",
+			"PI_TEAMS_DEPTH",
+			"PI_TEAMS_MAX_DEPTH",
+			"PI_TEAMS_INHERIT_PROJECT_CONTEXT",
+			"PI_TEAMS_INHERIT_SKILLS",
+			"PI_TEAMS_PI_BIN",
+			"PI_TEAMS_MOCK_CHILD_PI",
+			"PI_CREW_ALLOW_MOCK",
+		],
+	});
+	// FIX: removed delete workarounds — with explicit allowlist, these vars
+	// are no longer auto-leaked. Matches child-pi.ts.
 
 	const loader = resolveTypeScriptLoader();
 	if (!loader) {
@@ -159,7 +227,7 @@ export async function spawnBackgroundTeamRun(manifest: TeamRunManifest): Promise
 		detached: true,
 		setsid: true,
 		stdio: ["ignore", "pipe", "pipe"],
-		env: envWithoutParentPid,
+		env: filteredEnv,
 		windowsHide: true,
 	} as unknown as Parameters<typeof spawn>[2];
 	const child = spawn(process.execPath, command.args, spawnOpts);
@@ -168,6 +236,21 @@ export async function spawnBackgroundTeamRun(manifest: TeamRunManifest): Promise
 	});
 	child.unref();
 
+	// Track this worker in the orphan registry so it can be killed on
+	// session_start of a future session if the parent pi process is killed.
+	if (child.pid) {
+		registerWorker(
+			child.pid,
+			manifest.ownerSessionId ?? "unknown",
+			manifest.runId,
+			process.pid, // parentPid — used by cleanup to verify session is dead
+		);
+		// Best-effort: unregister when child exits. Background-runner writes
+		// the marker file before it dies, so we unregister on the next
+		// cleanup tick. But the child "exit" event won't fire because we
+		// unref'd and the stdio is piped + ignored.
+	}
+
 	return { pid: child.pid, logPath };
 }