pi-crew 0.9.13 → 0.9.15

package/src/runtime/child-pi.ts

@@ -231,6 +231,12 @@ export interface ChildPiRunResult {
 	aborted?: boolean;
 	/** True if the agent was steered to wrap up (hit soft turn limit) but finished in time. */
 	steered?: boolean;
+	/** #7 hardening: bounded digest of intermediate findings (last N tool results or
+	 *  assistant text lines) from the run. Populated by ChildPiLineObserver so that
+	 *  workers that exhaust their budget on tool calls (never emit final assistant
+	 *  text) still produce a non-empty result. Consumers should prefer rawFinalText
+	 *  first — this is a last-resort fallback. */
+	intermediateFindings?: string;
 }
 
 export function buildChildPiSpawnOptions(cwd: string, env: NodeJS.ProcessEnv): SpawnOptions {
@@ -526,6 +532,12 @@ export class ChildPiLineObserver {
 	 *  This is the source of the AUTHORITATIVE result.txt; the transcript stays
 	 *  compacted (memory bound). */
 	private readonly rawTextEvents: string[] = [];
+	/** #7 hardening: bounded digest of intermediate findings. When a worker spends
+	 *  its entire budget on tool calls (never emits a final assistant text),
+	 *  getRawFinalText() returns undefined but this digest captures the last
+	 *  display lines (tool results, stdout fragments) before budget exhaustion.
+	 *  Capped at MAX_INTERMEDIATE_DIGEST_LINES so result artifacts stay bounded. */
+	private readonly intermediateFindings: string[] = [];
 
 	constructor(input: ChildPiRunInput) {
 		this.input = input;
@@ -553,6 +565,22 @@ export class ChildPiLineObserver {
 		return this.rawTextEvents.length > 0 ? this.rawTextEvents[this.rawTextEvents.length - 1] : undefined;
 	}
 
+	/** #7 hardening: returns a bounded digest of intermediate findings accumulated
+	 *  during the run. This is NOT the final answer — it is a best-effort capture
+	 *  of the last assistant text or tool-result display lines before budget
+	 *  exhaustion. Only populated when getRawFinalText() would return undefined.
+	 *  @param maxChars - maximum total characters to return (default 500). */
+	getIntermediateFindings(maxChars = 500): string {
+		const MAX_INTERMEDIATE_DIGEST_LINES = 20;
+		if (this.intermediateFindings.length === 0) return "";
+		// Take the last N lines and join, then cap.
+		const lines = this.intermediateFindings.slice(-MAX_INTERMEDIATE_DIGEST_LINES);
+		const joined = lines.join("\n");
+		if (joined.length <= maxChars) return joined;
+		// Return the tail within the budget.
+		return joined.slice(-maxChars);
+	}
+
 	private emitLine(line: string): void {
 		if (!line.trim()) return;
 		// Parse the RAW line once so we can BOTH compact it (telemetry transcript,
@@ -561,7 +589,15 @@ export class ChildPiLineObserver {
 		try {
 			const rawParsed = JSON.parse(line);
 			const rawTexts = extractText(rawParsed);
-			if (rawTexts.length > 0) this.rawTextEvents.push(...rawTexts);
+			if (rawTexts.length > 0) {
+				this.rawTextEvents.push(...rawTexts);
+				// Also capture raw assistant text as intermediate findings — the last raw
+				// text may be a partial answer before the worker ran out of budget.
+				const last = rawTexts[rawTexts.length - 1];
+				if (last.trim().length > 0) {
+					this.intermediateFindings.push(last.trim());
+				}
+			}
 		} catch {
 			// Not valid JSON — compactChildPiLine handles the raw-text fallback below.
 		}
@@ -580,6 +616,10 @@ export class ChildPiLineObserver {
 			} catch (error) {
 				logInternalError("child-pi.on-stdout-line", error, `line=${compact.displayLine}`);
 			}
+			// #7 hardening: capture display lines (tool results, stdout) as intermediate
+			// findings. This ensures we capture tool output even when no assistant text
+			// is emitted (budget exhausted on tool calls).
+			this.intermediateFindings.push(compact.displayLine!.trim());
 		}
 	}
 }
@@ -827,6 +867,51 @@ export async function runChildPi(input: ChildPiRunInput): Promise<ChildPiRunResu
 					} catch (error) {
 						logInternalError("child-pi.response-timeout-term", error, `pid=${child.pid}`);
 					}
+					// #3 hardening: if the child never exits (zombie) and neither the
+					// 'exit' nor 'close' event ever fires, the promise would hang forever.
+					// SIGKILL fires ~3s after SIGTERM via hardKillTimer in killProcessPid,
+					// but on platforms where SIGKILL also fails (e.g. permission issues),
+					// add a bounded safety settle so the promise always resolves. Using
+					// hardKillMs + 2s as the safety window: enough for SIGKILL to work
+					// normally, but forces settle if the process is truly immortal.
+					// NOTE: we do NOT clear hardKillTimer here (that would defeat its purpose);
+					// we intentionally add a parallel safety path.
+					const SAFETY_SETTLE_MS = HARD_KILL_MS + 2000;
+					const safetyTimer = setTimeout(() => {
+						if (settled || childExited) return;
+						logInternalError(
+							"child-pi.settle-safety-fired",
+							new Error(`Child did not exit within ${SAFETY_SETTLE_MS}ms of kill; forcing settle`),
+							`pid=${child.pid}, responseTimeoutMs=${responseTimeoutMs}`,
+						);
+						// Verify the child is still alive before forcing settle.
+						// If it somehow exited between childExited=false and here, the
+						// settled/childExited guard prevents double-settle (harmless but noisy).
+						try {
+							process.kill(child.pid!, 0);
+							// Child still alive — force settle with timeout error.
+							const timeoutErr = `Child Pi produced no new output for ${responseTimeoutMs}ms; killed but did not exit within ${SAFETY_SETTLE_MS}ms (possible zombie).`;
+							settle({
+								exitCode: null,
+								stdout,
+								stderr,
+								error: timeoutErr,
+								exitStatus: {
+									exitCode: null,
+									cancelled: abortRequested,
+									timedOut: true,
+									killed: hardKilled,
+									cleanupErrors,
+									finalDrainMs,
+									crashClass: "timeout",
+								},
+							});
+						} catch {
+							// ESRCH / EPERM — child is already gone. The 'exit'/'close' handler
+							// will fire shortly (or already fired in a race). Let it settle normally.
+						}
+					}, SAFETY_SETTLE_MS);
+					safetyTimer.unref();
 				}, responseTimeoutMs);
 				noResponseTimer.unref();
 			};
@@ -952,6 +1037,7 @@ export async function runChildPi(input: ChildPiRunInput): Promise<ChildPiRunResu
 					resolve({
 						...result,
 						rawFinalText: lineObserver.getRawFinalText(),
+						intermediateFindings: lineObserver.getIntermediateFindings(),
 						exitStatus: result.exitStatus ?? {
 							exitCode: result.exitCode,
 							cancelled: abortRequested,

package/src/runtime/goal-achievement.ts

@@ -0,0 +1,131 @@
+/**
+ * #2 (assessment): goal-achievement detection — kills the "false-green" lie.
+ *
+ * The v0.9.13 assessment found run team_20260626170635 reported terminal-success
+ * ("completed") while its verifier wrote: "did NOT apply ANY of the three
+ * security fixes. git diff --stat for all 6 target files is empty… Tests are
+ * green only because nothing was changed." The run status LIED.
+ *
+ * This module assesses whether a completed run actually achieved its goal, so
+ * the false-green is no longer SILENT. It is deliberately conservative:
+ *   - read-only / doc-only workflows are never accused (they legitimately make
+ *     no project-code edits; their outputs land in gitignored .crew/),
+ *   - a false-green is only flagged for CODE-MUTATING runs (executor /
+ *     test-engineer steps) in a git repo whose working tree is empty,
+ *   - status is downgraded to "failed" ONLY when a corroborating signal (a
+ *     task that actually failed) confirms it; otherwise the suspicion is
+ *     exposed via `goalAchieved=false` + a prominent event + manifest note,
+ *     without breaking a legitimately-no-op run.
+ */
+import { spawnSync } from "node:child_process";
+import type { TeamRunManifest, TeamTaskState } from "../state/types.ts";
+import type { WorkflowConfig } from "../workflows/workflow-config.ts";
+import { findRepoRoot } from "../utils/paths.ts";
+
+/**
+ * Roles whose job is to EDIT project source/test files (changes that appear in
+ * `git status`). Deliberately NARROW: writer/verifier/security-reviewer write
+ * reports (often to gitignored .crew/), so an empty diff is NOT a failure
+ * signal for them. Only executor/test-engineer MUST touch project code.
+ */
+export const MUTATING_ROLES = new Set<string>(["executor", "test-engineer"]);
+
+export type GoalAchieved = boolean | "unknown";
+
+export interface GoalAchievementAssessment {
+	achieved: GoalAchieved;
+	reason: string;
+	/** human-readable corroborating signals (for events/manifest) */
+	signals: string[];
+}
+
+/** Does this workflow contain any code-mutating role step? */
+export function workflowIsMutating(workflow: WorkflowConfig | undefined): boolean {
+	const steps = workflow?.steps ?? [];
+	return steps.some((step) => typeof step?.role === "string" && MUTATING_ROLES.has(step.role));
+}
+
+/** Is the working tree of the repo containing `cwd` clean (no changes)? Throws-safe. */
+export function isGitWorkingTreeClean(cwd: string): { clean: boolean; repoRoot: string } | { clean: "unknown"; repoRoot: undefined } {
+	try {
+		const repoRoot = findRepoRoot(cwd);
+		if (!repoRoot) return { clean: "unknown", repoRoot: undefined };
+		// `git status --porcelain` → empty stdout means a clean working tree.
+		const res = spawnSync("git", ["-C", repoRoot, "status", "--porcelain"], { encoding: "utf8", timeout: 5_000 });
+		if (res.error || res.status !== 0) return { clean: "unknown", repoRoot: undefined };
+		return { clean: res.stdout.trim().length === 0, repoRoot };
+	} catch {
+		return { clean: "unknown", repoRoot: undefined };
+	}
+}
+
+/**
+ * Assess whether a completed run achieved its goal. Pure function over manifest
+ * + tasks + workflow — no side effects, easy to unit-test.
+ */
+export function assessGoalAchievement(
+	manifest: TeamRunManifest,
+	tasks: TeamTaskState[],
+	workflow: WorkflowConfig | undefined,
+): GoalAchievementAssessment {
+	// (1) Only code-mutating workflows can be false-green. Read-only/doc runs
+	//     legitimately make no project edits — never accuse them.
+	if (!workflowIsMutating(workflow)) {
+		return { achieved: "unknown", reason: "read-only / doc-only workflow (no executor/test-engineer steps)", signals: [] };
+	}
+
+	// (2) Need a git repo to inspect the working tree.
+	const tree = isGitWorkingTreeClean(manifest.cwd);
+	if (tree.clean === "unknown" || !tree.repoRoot) {
+		return { achieved: "unknown", reason: "not a git repo or git unavailable", signals: [] };
+	}
+
+	// (3) Non-empty working tree → the mutating run made edits. Achieved.
+	if (!tree.clean) {
+		return { achieved: true, reason: "git working tree has changes (mutating run edited project files)", signals: [`repoRoot=${tree.repoRoot}`] };
+	}
+
+	// (4) Mutating run + CLEAN working tree → suspicious. The executor's job was
+	//     to edit code and it left zero diff. This is the false-green signature.
+	const failedTask = tasks.find((t) => t.status === "failed");
+	const signals = ["git working tree clean despite mutating workflow"];
+	if (failedTask) signals.push(`corroborating failed task: ${failedTask.id} (${failedTask.role})`);
+
+	return {
+		// `false` = false-green detected. Whether to downgrade status is decided
+		// by the caller based on the corroborating failed-task signal.
+		achieved: false,
+		reason: "code-mutating run completed but made no project edits (false-green)",
+		signals,
+	};
+}
+
+/**
+ * Apply an assessment to a run result: set manifest.goalAchieved + note, and
+ * decide whether to downgrade status. Returns the (possibly mutated) manifest.
+ *
+ * Downgrade rule (conservative): only flip "completed" → "failed" when a
+ * corroborating failed-task signal is present. Otherwise expose goalAchieved
+ * = false + a manifest note + let the caller emit an event, but leave status
+ * intact so a legitimately-no-op mutating run is not broken.
+ */
+export function applyGoalAchievement(
+	manifest: TeamRunManifest,
+	assessment: GoalAchievementAssessment,
+): { manifest: TeamRunManifest; downgraded: boolean } {
+	const note = assessment.achieved === false
+		? `goal-achievement: FALSE-GREEN — ${assessment.reason}. ${assessment.signals.join("; ")}`
+		: assessment.achieved === true
+			? `goal-achievement: OK — ${assessment.reason}`
+			: `goal-achievement: unknown — ${assessment.reason}`;
+
+	const updated: TeamRunManifest = { ...manifest, goalAchieved: assessment.achieved, goalAchievementNote: note };
+
+	// Downgrade only on the highest-confidence false-green: a failed task
+	// corroborates that the run genuinely did not succeed.
+	const hasCorroboratingFailure = assessment.signals.some((s) => s.startsWith("corroborating failed task"));
+	if (assessment.achieved === false && hasCorroboratingFailure && updated.status === "completed") {
+		return { manifest: { ...updated, status: "failed" }, downgraded: true };
+	}
+	return { manifest: updated, downgraded: false };
+}

package/src/runtime/recovery-recipes.ts

@@ -72,3 +72,38 @@ export function buildRecoveryLedger(decisions: PolicyDecision[], previous: Recov
 	}
 	return { entries };
 }
+
+/**
+ * #4 (assessment): decide whether a FAILED task should be re-queued for a
+ * whole-task rerun, honoring limits.maxRetriesPerTask.
+ *
+ * Before #4, buildRecoveryLedger recorded `rerun_task` entries with
+ * state:"planned" but NOTHING ever executed them — the recovery ledger was
+ * decorative. This pure function drives the actual re-queue decision used in
+ * the run loop: when a task returns a failed STATUS (not a retryable throw,
+ * which #1's autoRetry/executeWithRetry already handles), re-queue it for a
+ * bounded whole-task rerun instead of immediately aborting the run.
+ *
+ * Default-off: maxRetriesPerTask defaults to 0 → never rerun (preserves prior
+ * behavior unless explicitly opted in). Bounded by retryCount < maxRetries.
+ */
+export interface RerunDecision {
+	rerun: boolean;
+	newRetryCount: number;
+	reason: string;
+}
+
+export function shouldRerunFailedTask(
+	task: { policy?: { retryCount?: number } },
+	limits?: { maxRetriesPerTask?: number },
+): RerunDecision {
+	const maxRetries = limits?.maxRetriesPerTask ?? 0;
+	const retryCount = task.policy?.retryCount ?? 0;
+	if (maxRetries <= 0) {
+		return { rerun: false, newRetryCount: retryCount, reason: "maxRetriesPerTask not set (opt-in) — no whole-task rerun" };
+	}
+	if (retryCount >= maxRetries) {
+		return { rerun: false, newRetryCount: retryCount, reason: `retryCount ${retryCount} >= maxRetriesPerTask ${maxRetries} — rerun budget exhausted` };
+	}
+	return { rerun: true, newRetryCount: retryCount + 1, reason: `whole-task rerun ${retryCount + 1}/${maxRetries}` };
+}

package/src/runtime/task-runner.ts

@@ -343,6 +343,7 @@ export async function runTeamTask(
 		let modelAttempts: ModelAttemptSummary[] | undefined;
 		let parsedOutput: ParsedPiJsonOutput | undefined;
 	let rawFinalText: string | undefined;
+		let intermediateFindings: string | undefined;
 		let finalStdout = "";
 		let transcriptPath: string | undefined;
 		let terminalEvidence: OperationTerminalEvidence[] = [];
@@ -719,6 +720,7 @@ export async function runTeamTask(
 				);
 				parsedOutput = parsePiJsonOutput(transcriptText);
 				rawFinalText = childResult.rawFinalText;
+				intermediateFindings = childResult.intermediateFindings;
 				error =
 					childResult.error ||
 					(childResult.exitCode && childResult.exitCode !== 0
@@ -846,6 +848,10 @@ export async function runTeamTask(
 					cleanResultText(parsedOutput?.finalText) ??
 					cleanResultText(finalStdout) ??
 					cleanResultText(finalStderr) ??
+					// #7 hardening: if all real output paths are empty (worker exhausted
+					// budget on tool calls, no assistant text), use intermediate findings.
+					// intermediateFindings captures the last N tool-result display lines.
+					cleanResultText(intermediateFindings) ??
 					"(no output)",
 				producer: task.id,
 			});