pi-crew 0.6.1 → 0.6.4

package/src/extension/register.ts

@@ -5,7 +5,7 @@ import type {
 	ExtensionAPI,
 	ExtensionContext,
 } from "@earendil-works/pi-coding-agent";
-import { loadConfig } from "../config/config.ts";
+import { asRecord, loadConfig } from "../config/config.ts";
 import { applyCrewSettingsToConfig, loadCrewSettings } from "../runtime/settings-store.ts";
 // 2.7: Lazy-load LiveRunSidebar — only constructed when the user actually opens
 // a live run sidebar overlay. The class pulls in transcript-viewer and other
@@ -19,7 +19,7 @@ import {
 import { registerAutonomousPolicy } from "./autonomous-policy.ts";
 import { registerCleanupHandler } from "./crew-cleanup.ts";
 import type { ScheduledJob } from "../runtime/scheduler.ts";
-import { clearHooks } from "../hooks/registry.ts";
+import { clearHooksScoped } from "../hooks/registry.ts";
 import { uninstallCrewGlobalRegistry } from "./team-tool.ts";
 import { notifyActiveRuns } from "./session-summary.ts";
 
@@ -61,7 +61,7 @@ import {
 	type CrewWidgetState,
 	stopCrewWidget,
 	updateCrewWidget,
-} from "../ui/crew-widget.ts";
+} from "../ui/widget/index.ts";
 import { summarizeHeartbeats } from "../ui/heartbeat-aggregator.ts";
 import {
 	requestRender,
@@ -87,6 +87,7 @@ import {
 	projectCrewRoot,
 	userCrewRoot,
 } from "../utils/paths.ts";
+import { resolveContainedPath } from "../utils/safe-paths.ts";
 import { resetTimings, time } from "../utils/timings.ts";
 import {
 	type PiCrewRpcHandle,
@@ -99,6 +100,7 @@ import {
 import { createJsonlSink, type NotificationSink } from "./notification-sink.ts";
 import { runArtifactCleanup } from "./registration/artifact-cleanup.ts";
 import { registerTeamCommands } from "./registration/commands.ts";
+import { registerBriefToolOverrides } from "./registration/brief-tool-overrides.ts";
 import { registerCompactionGuard } from "./registration/compaction-guard.ts";
 import {
 	__test__subagentSpawnParams,
@@ -108,6 +110,7 @@ import {
 import { registerSubagentTools } from "./registration/subagent-tools.ts";
 import { registerTeamTool } from "./registration/team-tool.ts";
 import { handleTeamTool } from "./team-tool.ts";
+import { persistScheduledJobUpdate } from "./team-tool/handle-schedule.ts";
 
 let _cachedOTLPExporter: typeof OTLPExporterType | undefined;
 async function importOTLPExporter(): Promise<typeof OTLPExporterType> {
@@ -132,6 +135,8 @@ import {
 } from "../runtime/crash-recovery.ts";
 import { appendDeadletter } from "../runtime/deadletter.ts";
 import { HeartbeatWatcher } from "../runtime/heartbeat-watcher.ts";
+import { cleanupOrphanTempDirs, cleanupLegacyOrphanTempDirs } from "../runtime/pi-args.ts";
+import { cleanupOrphanWorkers } from "../runtime/orphan-worker-registry.ts";
 import { reconcileOrphanedTempWorkspaces } from "../runtime/stale-reconciler.ts";
 
 let _cachedCrashRecovery:
@@ -183,10 +188,14 @@ export function registerPiTeams(pi: ExtensionAPI): void {
 	const disposeI18n = initI18n(pi);
 	resetTimings();
 	time("register:start");
-	const globalStore = globalThis as Record<string, unknown>;
-	const runtimeCleanupStoreKey = "__piCrewRuntimeCleanup";
+	const globalStore = globalThis as Record<string | symbol, unknown>;
+	const runtimeCleanupStoreKey = Symbol("__piCrewRuntimeCleanup");
 	const previousRuntimeCleanup = globalStore[runtimeCleanupStoreKey];
 	time("register:init");
+	// Best-effort cleanup of the previous runtime instance. Errors are logged but
+	// do not halt new registration — a failing cleanup from a prior instance is
+	// preferable to leaving pi-crew unregistered, and any stale state from the
+	// previous instance will be reconciled when the new instance initializes.
 	if (typeof previousRuntimeCleanup === "function") {
 		try {
 			previousRuntimeCleanup();
@@ -443,6 +452,34 @@ export function registerPiTeams(pi: ExtensionAPI): void {
 						cleanupOrphanedTempDirs:
 							config.reliability?.cleanupOrphanedTempDirs,
 					});
+					// Layer 4: also clean orphan temp dirs under
+					// ~/.pi/agent/pi-crew/tmp/ that the SIGKILL'd parent
+					// processes left behind. Catches anything Layers 1-3 missed.
+					const orphanResult = cleanupOrphanTempDirs();
+					if (orphanResult.cleaned > 0) {
+						notifyOperator({
+							id: `layer4_temp_cleanup_${Date.now()}`,
+							severity: "info",
+							source: "temp-cleanup",
+							title: `Layer 4: cleaned ${orphanResult.cleaned} orphan temp dir(s)`,
+							body: `~/.pi/agent/pi-crew/tmp/ orphans older than 24h removed (scanned ${orphanResult.scanned}, failed ${orphanResult.failed}).`,
+						});
+					}
+					// Layer 5: clean legacy /tmp/pi-crew-* prompt/task orphans
+					// from before commit 8ba270d moved temp dirs out of /tmp.
+					// The existing reconcileOrphanedTempWorkspaces only cleans
+					// dirs containing .crew/state/runs/ (run-state dirs), so
+					// prompt/task orphans are never touched by Layer 3.
+					const legacyResult = cleanupLegacyOrphanTempDirs();
+					if (legacyResult.cleaned > 0) {
+						notifyOperator({
+							id: `layer5_legacy_temp_cleanup_${Date.now()}`,
+							severity: "info",
+							source: "temp-cleanup",
+							title: `Layer 5: cleaned ${legacyResult.cleaned} legacy /tmp/pi-crew-* orphan(s)`,
+							body: `Pre-fix /tmp/pi-crew-* prompt/task orphans (no .crew/state/runs/, >24h) removed (scanned ${legacyResult.scanned}, failed ${legacyResult.failed}).`,
+						});
+					}
 				} catch (error) {
 					logInternalError("register.tempAutoRepair", error);
 				}
@@ -478,13 +515,15 @@ export function registerPiTeams(pi: ExtensionAPI): void {
 				);
 		}
 	};
-	const autoRecoveryLast = new Map<string, number>();
+	const autoRecoveryLast = new Map<string, { insertedAt: number; lastAccessAt: number }>();
 	// FIX (Round 22, defensive cap): Bound the cooldown-gate Map. Each run
 	// contributes up to 4 keys (one per maybeNotifyHealth kind). Without a cap,
 	// a long-running pi session that runs thousands of teams accumulates
-	// thousands of entries. Eviction: oldest insertion first — matches the
-	// 5-minute cooldown gate semantics, since once the gate has expired the
-	// entry is irrelevant.
+	// thousands of entries. Eviction: oldest lastAccessAt first — uses LRU-like
+	// semantics so entries that are still being actively accessed (re-accessed
+	// before eviction) survive longer. This is fairer than insertion-order
+	// eviction under high churn where many entries expire naturally before
+	// being re-accessed.
 	const AUTO_RECOVERY_LAST_MAX_ENTRIES = 1000;
 	const configureDeliveryCoordinator = (): void => {
 		deliveryCoordinator?.dispose();
@@ -812,8 +851,8 @@ export function registerPiTeams(pi: ExtensionAPI): void {
 				.then(({ startForegroundWatchdog }) => {
 					startForegroundWatchdog({ pi, cwd: ctx.cwd, runId });
 				})
-				.catch(() => {
-					/* non-critical */
+				.catch((error) => {
+					logInternalError("register.foreground-watchdog-import", error);
 				});
 		}
 		setImmediate(() => {
@@ -823,7 +862,7 @@ export function registerPiTeams(pi: ExtensionAPI): void {
 						error instanceof Error ? error.message : String(error);
 					if (runId) {
 						try {
-							const loaded = loadRunManifestById(ctx.cwd, runId);
+							const loaded = loadRunManifestById(ctx.cwd, runId); // NOTE: no withRunLock - best-effort only; concurrent writes may cause inconsistency. Post-run status updates tolerate slight staleness.
 							if (
 								loaded &&
 								loaded.manifest.status !== "completed" &&
@@ -877,7 +916,7 @@ export function registerPiTeams(pi: ExtensionAPI): void {
 						}
 					}
 					if (ownerCurrent && runId) {
-						const loaded = loadRunManifestById(ctx.cwd, runId);
+						const loaded = loadRunManifestById(ctx.cwd, runId); // NOTE: no withRunLock - best-effort only; concurrent writes may cause inconsistency. Post-run status updates tolerate slight staleness.
 						const status = loaded?.manifest.status ?? "finished";
 						const level =
 							status === "failed" || status === "blocked"
@@ -971,9 +1010,25 @@ export function registerPiTeams(pi: ExtensionAPI): void {
 			const registry = (globalThis as Record<symbol | string, unknown>)[
 				CREW_REGISTRY_KEY
 			] as Record<string, unknown>;
-			registry.getRecord = (runId: string) =>
+			// Phase 3b (defensive): Validate registry structure before patching methods.
+			// If a previous occupant left a non-conforming object, replace it entirely.
+			// This prevents runtime failures if getRecord/listRuns/etc. are called on a
+			// malformed predecessor value.
+			if (
+				registry === null ||
+				typeof registry !== "object" ||
+				Array.isArray(registry)
+			) {
+				(globalThis as Record<symbol | string, unknown>)[
+					CREW_REGISTRY_KEY
+				] = {};
+			}
+			const validatedRegistry = (globalThis as Record<symbol | string, unknown>)[
+				CREW_REGISTRY_KEY
+			] as Record<string, unknown>;
+			validatedRegistry.getRecord = (runId: string) =>
 				manifestCacheForRegistry.get(runId);
-			registry.listRuns = () =>
+			validatedRegistry.listRuns = () =>
 				manifestCacheForRegistry
 					.list(100)
 					.map(
@@ -987,7 +1042,7 @@ export function registerPiTeams(pi: ExtensionAPI): void {
 							goal: m.goal,
 						}),
 					);
-			registry.appendEvent = (
+			validatedRegistry.appendEvent = (
 				runId: string,
 				event: Record<string, unknown>,
 			) => {
@@ -1003,7 +1058,7 @@ export function registerPiTeams(pi: ExtensionAPI): void {
 							),
 					);
 			};
-			registry.waitForAll = async (runId: string) => {
+			validatedRegistry.waitForAll = async (runId: string) => {
 				// LAZY: state-store only needed for post-completion polling (waitForAll) and sync hasRunning check; avoid at startup.
 				const { loadRunManifestById } = await import(
 					"../state/state-store.ts"
@@ -1022,7 +1077,7 @@ export function registerPiTeams(pi: ExtensionAPI): void {
 				while (!check())
 					await new Promise((resolve) => setTimeout(resolve, 500));
 			};
-			registry.hasRunning = async (runId: string) => {
+			validatedRegistry.hasRunning = async (runId: string) => {
 				const manifest = manifestCacheForRegistry.get(runId);
 				if (!manifest) return false;
 				// LAZY: state-store only needed in hasRunning; avoid at startup.
@@ -1112,7 +1167,7 @@ export function registerPiTeams(pi: ExtensionAPI): void {
 		otlpExporter = undefined;
 		metricRegistry = undefined;
 		deliveryCoordinator?.dispose();
-		clearHooks();
+		clearHooksScoped();
 		uninstallCrewGlobalRegistry();
 		overflowTracker?.dispose();
 		deliveryCoordinator = undefined;
@@ -1140,6 +1195,17 @@ export function registerPiTeams(pi: ExtensionAPI): void {
 
 	pi.on("session_start", (_event, ctx) => {
 		runArtifactCleanup(ctx.cwd);
+
+		// Restore brief mode state from session entries
+		try {
+			const entries = ctx.sessionManager?.getEntries?.();
+			if (entries) {
+				import("../ui/tool-renderers/brief-mode.ts").then(({ restoreBriefState }) => {
+					restoreBriefState(entries);
+				}).catch(() => {/* non-critical */});
+			}
+		} catch { /* non-critical */ }
+
 		time("register.session-start");
 		cleanedUp = false;
 		sessionGeneration++;
@@ -1150,10 +1216,11 @@ export function registerPiTeams(pi: ExtensionAPI): void {
 		notifyActiveRuns(ctx);
 
 		// Auto-cancel orphaned runs from dead sessions
-		// Extract sessionId from context — validate runtime type instead of unsafe cast.
+		// Extract sessionId from context — use Object.getOwnPropertyDescriptor
+		// to safely access property without triggering Proxy traps, then validate.
 		const rawSessionId =
-			typeof ctx === "object" && ctx !== null && "sessionId" in ctx
-				? (ctx as Record<string, unknown>).sessionId
+			typeof ctx === "object" && ctx !== null
+				? Object.getOwnPropertyDescriptor(ctx, "sessionId")?.value
 				: undefined;
 		const currentSessionId =
 			typeof rawSessionId === "string" && rawSessionId.length > 0
@@ -1219,6 +1286,54 @@ export function registerPiTeams(pi: ExtensionAPI): void {
 					}
 				}
 
+				// Startup cleanup (Fix A): run orphan-temp-dir cleanup
+				// immediately on session_start so we don't wait 5 minutes
+				// for the first timer tick. Especially important after
+				// a SIGKILL'd previous session that left thousands of
+				// orphan temp dirs behind.
+				try {
+					const orphanTmp = cleanupOrphanTempDirs();
+					const legacyTmp = cleanupLegacyOrphanTempDirs();
+					if (orphanTmp.cleaned > 0 || legacyTmp.cleaned > 0) {
+						notifyOperator({
+							id: `startup_temp_cleanup_${Date.now()}`,
+							severity: "info",
+							source: "temp-cleanup",
+							title: `Startup cleanup: removed ${orphanTmp.cleaned + legacyTmp.cleaned} orphan temp dir(s)`,
+							body: `${orphanTmp.cleaned} from ~/.pi/agent/pi-crew/tmp/ + ${legacyTmp.cleaned} legacy /tmp/pi-crew-*`,
+						});
+					}
+				} catch (error) {
+					logInternalError(
+						"register.sessionStart.startupTempCleanup",
+						error,
+					);
+				}
+
+				// Orphan worker cleanup (Fix B): kill stale background-runner
+				// processes from previous (SIGKILL'd) sessions. Workers
+				// detached via setsid+unref outlive the spawning pi
+				// session, and the per-worker parent-guard is intentionally
+				// disabled for background-runner (BUG #17 design). So
+				// orphans can only be cleaned from the next session_start.
+				try {
+					const orphanWorkers = cleanupOrphanWorkers(currentSessionId);
+					if (orphanWorkers.killed > 0) {
+						notifyOperator({
+							id: `orphan_workers_cleanup`,
+							severity: "info",
+							source: "worker-cleanup",
+							title: `Cleaned up ${orphanWorkers.killed} orphan worker(s)`,
+							body: `Background workers from previous (SIGKILL'd) sessions were terminated (pruned ${orphanWorkers.pruned} dead, kept ${orphanWorkers.kept}).`,
+						});
+					}
+				} catch (error) {
+					logInternalError(
+						"register.sessionStart.orphanWorkers",
+						error,
+					);
+				}
+
 				// Global purge of stale active-run-index entries
 				try {
 					const { purged } = purgeStaleActiveRunIndexFn();
@@ -1324,19 +1439,60 @@ export function registerPiTeams(pi: ExtensionAPI): void {
 					runParams = { action: "run", team: "default", goal: job.prompt };
 				}
 				if (runParams.action !== "run") return `scheduled-${job.id}-${Date.now()}`;
+				const agentId = `scheduled-${job.id}-${Date.now()}`;
 				setImmediate(async () => {
 					try {
-						await handleTeamTool(
+						const runResult = await handleTeamTool(
 							{ action: "run", team: runParams.team, goal: runParams.goal, async: true },
 							{ cwd: ctx.cwd, sessionId },
 						);
+						// Track the runId so remove() can cancel spawned runs
+						const runId = runResult?.details?.runId;
+						if (runId && typeof runId === "string") {
+							crewScheduler?.recordSpawnedRun(job.id, runId);
+							// Update run manifest with scheduler provenance for traceability
+							try {
+								const cwd = ctx.cwd ?? process.cwd();
+								const loaded = loadRunManifestById(cwd, runId);
+								if (loaded) {
+									const { atomicWriteJson } = await import("../state/atomic-write.ts");
+									atomicWriteJson(loaded.manifest.stateRoot + "/manifest.json", {
+										...loaded.manifest,
+										schedulerJobId: job.id,
+										schedulerName: job.name,
+									});
+								}
+							} catch { /* best-effort provenance tracking */ }
+						}
+						// Persist updated job with spawnedRunIds to settings
+						try {
+							const updatedJob = crewScheduler?.list().find((j) => j.id === job.id);
+							if (updatedJob) persistScheduledJobUpdate(ctx.cwd, updatedJob);
+						} catch { /* best-effort */ }
+						// Update run count
+						crewScheduler?.update(job.id, {
+							runCount: job.runCount + 1,
+							lastRun: new Date().toISOString(),
+							lastStatus: "success",
+						});
 					} catch (err) {
 						logInternalError("scheduler.execute", err);
+						crewScheduler?.update(job.id, { lastStatus: "error" });
 					}
 				});
-				return `scheduled-${job.id}-${Date.now()}`;
+				return agentId;
 			},
 			finalizer: () => {},
+			runCancelFn: (runId: string) => {
+				try {
+					handleTeamTool(
+						{ action: "cancel", runId, confirm: true },
+						{ cwd: ctx.cwd, sessionId },
+					).catch((err) => logInternalError("scheduler.runCancelFn", err, `runId=${runId}`));
+				} catch (err) {
+					logInternalError("scheduler.runCancelFn.sync", err, `runId=${runId}`);
+				}
+			},
 		});
 		// Wire scheduler into handle-schedule.ts so handlers can add/list jobs.
 		// Uses a global symbol so the module doesn't need a direct circular import.
@@ -1534,18 +1690,26 @@ export function registerPiTeams(pi: ExtensionAPI): void {
 						const previous = autoRecoveryLast.get(key);
 						if (
 							previous !== undefined &&
-							now - previous < 5 * 60_000
+							now - previous.lastAccessAt < 5 * 60_000
 						)
 							return;
-						// Defensive cap: evict oldest entries before inserting
-						// when size exceeds the limit. Map's natural insertion
-						// order means the first key is the oldest.
+						// Defensive cap: evict entry with oldest lastAccessAt before
+						// inserting/updating when size exceeds the limit. Uses LRU
+						// semantics so entries that are still being actively
+						// accessed survive longer than insertion-order eviction.
 						while (autoRecoveryLast.size >= AUTO_RECOVERY_LAST_MAX_ENTRIES) {
-							const oldest = autoRecoveryLast.keys().next().value;
-							if (oldest === undefined) break;
-							autoRecoveryLast.delete(oldest);
+							let oldestKey: string | undefined;
+							let oldestAccess = Infinity;
+							for (const [k, v] of autoRecoveryLast) {
+								if (v.lastAccessAt < oldestAccess) {
+									oldestAccess = v.lastAccessAt;
+									oldestKey = k;
+								}
+							}
+							if (oldestKey === undefined) break;
+							autoRecoveryLast.delete(oldestKey);
 						}
-						autoRecoveryLast.set(key, now);
+						autoRecoveryLast.set(key, { insertedAt: now, lastAccessAt: now });
 						notifyOperator({
 							id: key,
 							severity: "warning",
@@ -1752,8 +1916,15 @@ export function registerPiTeams(pi: ExtensionAPI): void {
 			);
 			const paths: string[] = [];
 			if (fs.existsSync(extSkillDir)) paths.push(extSkillDir);
-			if (skillDir !== extSkillDir && fs.existsSync(skillDir))
-				paths.push(skillDir);
+			if (skillDir !== extSkillDir && fs.existsSync(skillDir)) {
+				// Validate skillDir is within sessionCwd to prevent path traversal
+				try {
+					resolveContainedPath(sessionCwd, "skills");
+					paths.push(skillDir);
+				} catch {
+					// skillDir outside sessionCwd boundary — skip
+				}
+			}
 			return paths.length > 0 ? { skillPaths: paths } : {};
 		});
 	} catch {
@@ -1777,7 +1948,8 @@ export function registerPiTeams(pi: ExtensionAPI): void {
 		if (event.toolName !== "team") return;
 		const rawInput = event.input;
 		if (!rawInput || typeof rawInput !== "object") return;
-		const input = rawInput as { action?: unknown; confirm?: unknown; force?: unknown };
+		const input = asRecord(rawInput);
+		if (!input) return;
 		const action = typeof input.action === "string" ? input.action : undefined;
 		const destructiveActions = new Set(["delete", "forget", "prune", "cleanup"]);
 		if (!action || !destructiveActions.has(action)) return;
@@ -1814,6 +1986,12 @@ export function registerPiTeams(pi: ExtensionAPI): void {
 
 	registerCleanupHandler(pi);
 
+	// Brief tool overrides DISABLED: re-registering built-in tools replaced Pi's
+	// superior native renderers (syntax highlighting, diff views, full file
+	// content) with inferior custom ones, and caused renderCall/renderResult
+	// to duplicate path/command info. Pi's native rendering is better.
+	// To re-enable, uncomment: registerBriefToolOverrides(pi, process.cwd());
+
 	registerTeamCommands(pi, {
 		startForegroundRun,
 		abortForegroundRun,