pi-crew 0.8.2 → 0.8.4

package/CHANGELOG.md

@@ -1,5 +1,87 @@
 # Changelog
 
+## [0.8.4] — cold-verifier agent (T9) (2026-06-16)
+
+Second APPLIED technique from the pi-ecosystem distillation (piolium /
+Vigolium — cold-verifier pattern). Adds a new builtin agent whose value is
+**independence**: it re-derives claims from ground truth WITHOUT trusting
+prior reviewer/verifier analysis, breaking the confirmation-bias drift the
+chained `reviewer` → `verifier` path can introduce.
+
+### Why
+piolium splits security verification across ~10 narrow agents, including a
+`cold-verifier` whose prompt enforces file-access isolation ("MUST NOT read
+any file other than the single finding draft"). pi-crew's default `verifier`
+instead *correlates* findings against reviewer output ("Trust dependency
+context") — efficient, but it inherits the reviewer's blind spots. There was
+**no** adversarial cross-check agent (confirmed: zero agents reference
+cold/isolation/unbiased semantics).
+
+### What
+NEW builtin `cold-verifier` agent (`agents/cold-verifier.md`):
+- Read-only + `bash` (runs tests fresh, reads its OWN output — never a
+  cached prior-worker log).
+- Prompt-enforced isolation discipline: don't trust prior findings, treat
+  each as an *unverified hypothesis*, actively look for contradicting evidence.
+- Distinct `COLD_VERIFICATION` output block with a `CLAIMS_REFUTED` field
+  (the highest-value output — inherited claims your independent check
+  contradicts).
+- `maxTurns: 12` (tighter than verifier's 15 — it's a focused cross-check).
+
+Use `verifier` for fast finding-correlation; use `cold-verifier` when the
+cost of a wrong "PASS" is high (security changes, release gates, data-loss
+paths). Both can run in the same workflow.
+
+### Files
+- NEW `agents/cold-verifier.md` — the agent (auto-discovered).
+- `src/agents/discover-agents.ts` — add `cold-verifier` to the SEC-001
+  `PROTECTED_AGENT_NAMES` blocklist (can't be shadowed by a dynamic reg).
+- `src/ui/settings-overlay.ts` — add to the settings-overlay agent list.
+- `test/unit/agent-discovery-cache.test.ts` — mirror the protected-names list.
+- NEW `test/unit/t9-cold-verifier.test.ts` (5 tests): discovery, parse,
+  isolation-discipline content, SEC-001 protection, frontmatter shape.
+
+typecheck clean; full suite 1905 ok / 0 fail.
+
+## [0.8.3] — Terminal tab title + Ghostty native progress bar (T4) (2026-06-16)
+
+First APPLIED technique from the pi-ecosystem distillation (pi-status /
+Thinkscape). Adds two UI channels pi-crew didn't use before, both surviving
+subprocess and visible even when the TUI isn't in focus:
+
+1. **Terminal tab title** via `ctx.ui.setTitle()` — shows a one-line crew run
+   summary (e.g. "π-crew · 2 active · explorer, executor") while runs are
+   in-flight, restored to "π-crew" on idle. Idle re-assert uses an
+   exponential backoff loop (mirrors pi-status) because pi itself re-sets the
+   title on some events.
+2. **Ghostty OSC 9;4 native progress bar** — written to `/dev/tty` (a separate
+   channel from pi's TUI, so it works even when pi runs in a subprocess).
+   state 3 = indeterminate pulsing while runs are active; state 1 value 100 =
+   green completion flash; state 0 = clear on idle. Compatible with all
+   libghostty-based terminals (Ghostty, cmux, muxy).
+
+Driven from `runEventBus.onAny` with an idle↔active transition guard so the
+OSC sequence isn't re-emitted on every event. **Purely additive and
+best-effort**: `/dev/tty` may be absent (non-interactive / subagent / CI /
+Windows) and `setTitle` may be unavailable — all failures are swallowed and
+never surface. Cannot regress existing behavior (nothing depends on it).
+
+### Files
+- NEW `src/ui/terminal-status.ts` — `setGhosttyProgress` +
+  `ghosttyWorking/Complete/Clear`, `buildCrewTitleSegment`, and
+  `createTerminalStatusController` (owns the title + progress lifecycle with
+  a dispose + idle-reassert loop). Minimal `TerminalStatusUi` interface
+  (dependency inversion: depends only on `{ hasUI; ui: { setTitle } }`).
+- `src/extension/register.ts` — construct + drive the controller from
+  `runEventBus.onAny` (transition-guarded); dispose in cleanupRuntime + the
+  session-rescope path.
+- NEW `test/unit/t4-terminal-status.test.ts` (16 tests): OSC 9;4 sequence
+  shape, title-segment builder, controller lifecycle, best-effort error
+  handling, double-dispose idempotency.
+
+typecheck clean; full suite 1893 ok / 0 fail (local EXIT=1 is only the test-
+runner infra `spawnSync ETIMEDOUT` under load — clean on CI).
+
 ## [0.8.2] — Skill confidence dead-code fix (T7) (2026-06-16)
 
 Fixes a **real correctness bug** surfaced by the pi-extensions deep-dive

package/agents/cold-verifier.md

@@ -0,0 +1,66 @@
+---
+name: cold-verifier
+description: Independently re-verify findings WITHOUT trusting prior analysis — an unbiased cold check to catch confirmation bias the chained reviewer/verifier path can introduce
+model: false
+systemPromptMode: replace
+inheritProjectContext: true
+inheritSkills: false
+tools: read, grep, find, ls, bash
+maxTurns: 12
+---
+
+You are a **cold verifier**. Your value is independence: you re-check claims against ground truth WITHOUT trusting the analysis that came before you. The chained `reviewer` → `verifier` path can drift into confirmation bias (each worker rationalizes the prior worker's framing). You break that loop by starting cold.
+
+## Isolation Rules (THE CORE DISCIPLINE)
+
+Distilled from piolium's cold-verifier pattern: prompt-enforced file-access isolation layered on top of context isolation.
+
+You **MUST NOT**:
+- Read other workers' notes, debate transcripts, or `.crew/artifacts/.../results/*.txt` reasoning files.
+- Read the reviewer's or verifier's finding drafts as if they were ground truth.
+- Be primed by the goal framing beyond the literal acceptance criteria. Re-derive what "done" means from the spec, not from someone's summary of it.
+- Start from the conclusion that the work is correct (or incorrect). Start from evidence.
+
+You **MUST**:
+- Re-derive each claim from the codebase + test output directly.
+- Treat every inherited finding as an *unverified hypothesis* until you confirm it yourself.
+- Actively look for evidence that *contradicts* the prior verdict, not just evidence that supports it.
+
+## Strategy
+
+### Turn 1: Establish ground truth independently
+Run the test suite / build / lint fresh and read the *actual output*:
+```bash
+npm test 2>&1 | tail -40
+```
+Do NOT read a cached log from a prior worker — re-run and read your own output. If a prior worker claims "tests pass", confirm the green output yourself.
+
+### Turn 2-N: Verify each claim from source
+For each claim in the task/goal, open the *actual source files* and confirm:
+- Does the code do what's claimed?
+- Do tests actually cover the claimed behavior (not just pass for unrelated reasons)?
+- Is there a claim that is true *in isolation* but false *in context* (e.g. a function works but is never called, a check passes but the input is never reachable)?
+
+Look specifically for:
+- **False confirmations**: a prior worker said "verified" but the evidence is weaker than implied (e.g. a test passes but asserts the wrong thing).
+- **Missing cases**: the prior analysis didn't consider an edge case, error path, or interaction.
+- **Scope creep masquerading as done**: the stated goal is met but a regression was introduced elsewhere.
+
+## What makes you different from `verifier`
+
+The default `verifier` *correlates* findings against reviewer output ("Trust dependency context"). That's efficient but inherits the reviewer's blind spots. You are the **adversarial cross-check**: assume the prior verdict *might be wrong* and try to find where. Use `verifier` for fast correlation; use `cold-verifier` when the cost of a wrong "PASS" is high (security changes, release gates, data-loss paths).
+
+## Output Format
+
+End with exactly this block:
+
+```
+COLD_VERIFICATION: PASS|FAIL|INCONCLUSIVE
+INDEPENDENT_TEST_RESULTS: X passed, Y failed, Z skipped (from your OWN run, not a cached log)
+CLAIMS_CONFIRMED_INDEPENDENTLY: N/M inherited claims reproduced from source
+CLAIMS_REFUTED: any inherited claim your independent check contradicts (highest-value output)
+MISSING_COVERAGE: cases the prior analysis overlooked
+EVIDENCE: file:line references + your own test output
+```
+
+If you cannot refute a claim after honest effort, that is itself evidence the claim is solid — say so explicitly rather than inventing doubt.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "pi-crew",
-  "version": "0.8.2",
+  "version": "0.8.4",
   "description": "Pi extension for coordinated AI teams, workflows, worktrees, and async task orchestration",
   "author": "baphuongna",
   "license": "MIT",

package/src/agents/discover-agents.ts

@@ -48,6 +48,7 @@ const PROTECTED_AGENT_NAMES = new Set([
 	"critic",
 	"reviewer",
 	"verifier",
+	"cold-verifier", // T9 (v0.8.4): adversarial cold cross-check agent
 	"writer",
 	"security-reviewer",
 ]);

package/src/extension/register.ts

@@ -81,6 +81,7 @@ import {
 } from "../ui/powerbar-publisher.ts";
 import { RenderScheduler } from "../ui/render-scheduler.ts";
 import { runEventBus } from "../ui/run-event-bus.ts";
+import { createTerminalStatusController, type TerminalStatusController } from "../ui/terminal-status.ts";
 import { createRunSnapshotCache } from "../ui/run-snapshot-cache.ts";
 import { closeWatcher } from "../utils/fs-watch.ts";
 import { RunWatcherRegistry } from "../utils/run-watcher-registry.ts";
@@ -711,6 +712,12 @@ export function registerPiTeams(pi: ExtensionAPI): void {
 	let liveSidebarRunId: string | undefined;
 	let renderScheduler: RenderScheduler | undefined;
 	const renderSchedulerUnsubscribers: Array<() => void> = [];
+	// T4 (v0.8.3): terminal tab title + Ghostty native progress bar. Lazily
+	// constructed on the first run event (needs a ctx for setTitle). Driven
+	// from runEventBus.onAny with an idle<->active transition guard so we
+	// don't re-emit the OSC sequence on every event.
+	let terminalStatus: TerminalStatusController | undefined;
+	let terminalStatusActive = false;
 	let crewScheduler: CrewScheduler | undefined;
 	let preloadTimer: ReturnType<typeof setTimeout> | undefined;
 	const disposeRenderSchedulerSubscriptions = (): void => {
@@ -757,6 +764,9 @@ export function registerPiTeams(pi: ExtensionAPI): void {
 		disposeRenderSchedulerSubscriptions();
 		renderScheduler?.dispose();
 		renderScheduler = undefined;
+		terminalStatus?.dispose();
+		terminalStatus = undefined;
+		terminalStatusActive = false;
 		liveSidebarRunId = undefined;
 		if (currentCtx)
 			stopCrewWidget(
@@ -1562,6 +1572,9 @@ export function registerPiTeams(pi: ExtensionAPI): void {
 		);
 		disposeRenderSchedulerSubscriptions();
 		renderScheduler?.dispose();
+		terminalStatus?.dispose();
+		terminalStatus = undefined;
+		terminalStatusActive = false;
 		// Phase 12: Async preloading — renderTick reads only a pre-computed frame
 		// from memory (zero fs I/O). Background preload refreshes the frame async.
 		let preloading = false;

package/src/ui/settings-overlay.ts

@@ -377,7 +377,7 @@ class AgentOverridesSubmenu {
 		this.onCancel = onCancel;
 		const existing = (config.agents as Record<string, unknown>)?.overrides as Record<string, { model?: string; thinking?: string }> | undefined;
 		this.overrides = existing ? structuredClone(existing) : {};
-		this.agents = ["explorer", "planner", "analyst", "critic", "executor", "reviewer", "security-reviewer", "test-engineer", "verifier", "writer"];
+		this.agents = ["explorer", "planner", "analyst", "critic", "executor", "reviewer", "security-reviewer", "test-engineer", "verifier", "cold-verifier", "writer"];
 	}
 
 	invalidate(): void {}

package/src/ui/terminal-status.ts

@@ -0,0 +1,266 @@
+/**
+ * Terminal tab title + Ghostty native progress bar.
+ *
+ * Distilled from pi-status (Thinkscape — `source/pi-status/src/index.ts`):
+ * two UI channels pi-crew didn't use before, both surviving subprocess and
+ * visible even when the TUI isn't in focus:
+ *
+ * 1. **Tab title** via `ctx.ui.setTitle()` — shows a one-line crew run summary
+ *    (e.g. "π-crew · 2 active · explorer, executor"). Cheap, works in any
+ *    terminal. pi-status restores the title on idle with an exponential
+ *    back-off re-assert loop (pi itself re-sets the title on some events).
+ * 2. **Ghostty OSC 9;4** native progress bar — written to `/dev/tty` (a
+ *    separate channel from pi's TUI, so it works even when pi runs in a
+ *    subprocess). state 3 = indeterminate pulsing while runs are active;
+ *    state 1 value 100 = green completion flash; state 0 = clear. Compatible
+ *    with all libghostty-based terminals (Ghostty, cmux, muxy).
+ *
+ * All writes are BEST-EFFORT: `/dev/tty` may be absent (non-interactive /
+ * subagent / CI context) and `setTitle` may be unavailable — failures are
+ * swallowed and never surface to the user. This module is purely additive:
+ * it cannot regress existing behavior because nothing depends on it.
+ *
+ * Lifecycle (wired from register.ts via runEventBus + turn events):
+ *   - run active (running/queued/planning) → title "π-crew · N active · <roles>",
+ *     Ghostty state 3 (indeterminate).
+ *   - run just completed → Ghostty state 1/100 (green flash), schedule clear.
+ *   - idle (no active runs) → restore pi's natural title, Ghostty state 0.
+ *
+ * @module terminal-status
+ */
+
+import { writeFileSync } from "node:fs";
+import { listLiveAgents } from "../runtime/live-agent-manager.ts";
+
+/**
+ * Minimal UI surface this module needs. Deliberately narrower than
+ * `ExtensionContext["ui"]` so it's trivial to mock in tests (dependency
+ * inversion: depend only on what you use).
+ */
+export interface TerminalStatusUi {
+	hasUI: boolean;
+	ui: { setTitle(title: string): void };
+}
+
+/** Ghostty OSC 9;4 progress states. */
+export const GHOSTTY_PROGRESS = {
+	CLEAR: 0, // remove the progress indicator
+	SET: 1, // set explicit progress (0-100)
+	ERROR: 2, // error state
+	INDETERMINATE: 3, // pulsing/working animation
+} as const;
+
+/** Title prefix so the source is identifiable in the tab. */
+const TITLE_PREFIX = "π-crew";
+/** Separator between summary segments. */
+const SEP = " · ";
+/** Max roles listed in the title (keep it short for narrow tabs). */
+const MAX_TITLE_ROLES = 3;
+
+/** Idle-reassert backoff bounds (mirrors pi-status, clamped). */
+const IDLE_REASSERT_START_MS = 200;
+const IDLE_REASSERT_MAX_MS = 5000;
+/** How long the green completion flash stays before clearing. */
+const COMPLETE_FLASH_MS = 1500;
+
+/** Injected for tests (defaults write to the real /dev/tty). */
+export interface GhosttyWriter {
+	(seq: string): void;
+}
+
+let ghosttyWriter: GhosttyWriter | undefined;
+
+/**
+ * Set the raw-sequence writer (test seam). Pass `undefined` to restore the
+ * default `/dev/tty` writer. Tests inject a buffer-capturing fn.
+ */
+export function setGhosttyWriterForTest(writer: GhosttyWriter | undefined): void {
+	ghosttyWriter = writer;
+}
+
+function defaultGhosttyWriter(seq: string): void {
+	try {
+		writeFileSync("/dev/tty", seq);
+	} catch {
+		// /dev/tty unavailable (non-interactive, subagent, CI, or Windows) — no-op.
+		// This is expected in most automated contexts; never surface it.
+	}
+}
+
+function writeGhostty(seq: string): void {
+	(ghosttyWriter ?? defaultGhosttyWriter)(seq);
+}
+
+/**
+ * Emit a Ghostty OSC 9;4 progress sequence.
+ * Format: `\x1b]9;4;<state>[;<value>]\x07`
+ */
+export function setGhosttyProgress(state: number, value?: number): void {
+	const args = value !== undefined ? `${state};${value}` : `${state}`;
+	writeGhostty(`\x1b]9;4;${args}\x07`);
+}
+
+/** Indeterminate pulsing — use while crew runs are active. */
+export function ghosttyWorking(): void {
+	setGhosttyProgress(GHOSTTY_PROGRESS.INDETERMINATE);
+}
+
+/** Green completion flash at 100% — use when a run finishes successfully. */
+export function ghosttyComplete(): void {
+	setGhosttyProgress(GHOSTTY_PROGRESS.SET, 100);
+}
+
+/** Clear the progress indicator. */
+export function ghosttyClear(): void {
+	setGhosttyProgress(GHOSTTY_PROGRESS.CLEAR);
+}
+
+/**
+ * Build the crew run-summary title segment from live agents.
+ * Returns "" when no agents are live (so the title can be restored).
+ */
+export function buildCrewTitleSegment(cwd?: string): string {
+	const live = listLiveAgents();
+	if (live.length === 0) return "";
+	// Distinct roles across active agents, in stable order.
+	const roles: string[] = [];
+	const seen = new Set<string>();
+	for (const handle of live) {
+		const role = handle.role || handle.agent || "agent";
+		if (!seen.has(role)) {
+			seen.add(role);
+			roles.push(role);
+		}
+	}
+	const shown = roles.slice(0, MAX_TITLE_ROLES);
+	const more = roles.length > shown.length ? ` +${roles.length - shown.length}` : "";
+	return `${TITLE_PREFIX}${SEP}${live.length} active${SEP}${shown.join(", ")}${more}`;
+}
+
+/** Idle title — what we restore when no runs are active. */
+export function buildIdleTitle(): string {
+	return TITLE_PREFIX;
+}
+
+/**
+ * Set the terminal tab title if the UI supports it. Best-effort.
+ */
+export function setTerminalTitle(ctx: TerminalStatusUi, title: string): void {
+	if (!ctx.hasUI) return;
+	try {
+		ctx.ui.setTitle(title);
+	} catch {
+		// setTitle unavailable or failed — swallow (purely cosmetic).
+	}
+}
+
+interface TerminalStatusState {
+	/** Idle re-assert timer (mirrors pi-status backoff). */
+	idleTimer: ReturnType<typeof setTimeout> | undefined;
+	/** Whether we currently show an "active" title (so we know to restore). */
+	showingActive: boolean;
+	/** Completion-flash clear timer. */
+	flashTimer: ReturnType<typeof setTimeout> | undefined;
+	/** True after dispose() — stop all timers/writes. */
+	destroyed: boolean;
+}
+
+/**
+ * Terminal status controller. Owns the title + Ghostty progress lifecycle.
+ *
+ * The controller is a small stateful object (no class hierarchy) so it can be
+ * constructed per-session in register.ts and disposed cleanly. It exposes
+ * `onRunsActive()`, `onRunCompleted()`, `onIdle()` entry points that the
+ * runEventBus + turn handlers call.
+ */
+export interface TerminalStatusController {
+	onRunsActive(): void;
+	onRunCompleted(): void;
+	onIdle(): void;
+	dispose(): void;
+}
+
+export function createTerminalStatusController(ctx: TerminalStatusUi): TerminalStatusController {
+	const state: TerminalStatusState = {
+		idleTimer: undefined,
+		showingActive: false,
+		flashTimer: undefined,
+		destroyed: false,
+	};
+
+	const clearIdleTimer = (): void => {
+		if (state.idleTimer) {
+			clearTimeout(state.idleTimer);
+			state.idleTimer = undefined;
+		}
+	};
+	const clearFlashTimer = (): void => {
+		if (state.flashTimer) {
+			clearTimeout(state.flashTimer);
+			state.flashTimer = undefined;
+		}
+	};
+
+	/**
+	 * Idle re-assert loop: pi itself re-sets the title on some events
+	 * (session_info_changed, model_select, rebinds), so a single setTitle
+	 * is not durable. Re-assert on an exponential backoff until the next
+	 * activity. (Pattern from pi-status scheduleIdleReassert.)
+	 */
+	const scheduleIdleReassert = (delay: number): void => {
+		if (state.destroyed || state.showingActive) return;
+		clearIdleTimer();
+		state.idleTimer = setTimeout(() => {
+			if (state.destroyed || state.showingActive) return;
+			setTerminalTitle(ctx, buildIdleTitle());
+			scheduleIdleReassert(Math.min(delay * 2, IDLE_REASSERT_MAX_MS));
+		}, delay);
+	};
+
+	return {
+		onRunsActive(): void {
+			if (state.destroyed) return;
+			clearIdleTimer();
+			clearFlashTimer();
+			state.showingActive = true;
+			const segment = buildCrewTitleSegment();
+			if (segment) setTerminalTitle(ctx, segment);
+			ghosttyWorking();
+		},
+		onRunCompleted(): void {
+			if (state.destroyed) return;
+			clearFlashTimer();
+			ghosttyComplete();
+			// Clear the green flash after a short beat, then re-evaluate.
+			state.flashTimer = setTimeout(() => {
+				if (state.destroyed) return;
+				state.flashTimer = undefined;
+				// If still active, resume indeterminate; else go idle.
+				if (listLiveAgents().length > 0) {
+					ghosttyWorking();
+				} else {
+					ghosttyClear();
+				}
+			}, COMPLETE_FLASH_MS);
+		},
+		onIdle(): void {
+			if (state.destroyed) return;
+			state.showingActive = false;
+			clearFlashTimer();
+			ghosttyClear();
+			setTerminalTitle(ctx, buildIdleTitle());
+			scheduleIdleReassert(IDLE_REASSERT_START_MS);
+		},
+		dispose(): void {
+			state.destroyed = true;
+			clearIdleTimer();
+			clearFlashTimer();
+			// Best-effort: clear the Ghostty progress so we don't leave a stale bar.
+			try {
+				ghosttyClear();
+			} catch {
+				// swallow
+			}
+		},
+	};
+}