pi-crew 0.9.16 → 0.9.17

package/src/runtime/pi-args.ts

@@ -4,10 +4,18 @@ import * as path from "node:path";
 import { fileURLToPath } from "node:url";
 import type { AgentConfig } from "../agents/agent-config.ts";
 import { resolveToolPolicy } from "../agents/agent-config.ts";
-import { userPiRoot } from "../utils/paths.ts";
+import { packageRoot, userPiRoot } from "../utils/paths.ts";
 
 const THINKING_LEVELS = ["off", "minimal", "low", "medium", "high", "xhigh"];
-const PROMPT_RUNTIME_EXTENSION_PATH = path.resolve(path.dirname(fileURLToPath(import.meta.url)), "..", "prompt", "prompt-runtime.ts");
+// FIX (2026-07-02): use packageRoot() instead of import.meta.url-relative path.
+// The previous path.resolve(path.dirname(fileURLToPath(import.meta.url)),
+// "..", "prompt", "prompt-runtime.ts") was correct in source but BROKEN
+// in the bundle: esbuild's __esm helper doesn't preserve per-module
+// import.meta.url, so the resolve lands at <pi-crew>/prompt/... (missing
+// `src/`) instead of <pi-crew>/src/prompt/... packageRoot() walks up to
+// find pi-crew's package.json and works correctly from both src/ and
+// dist/ entry points.
+const PROMPT_RUNTIME_EXTENSION_PATH = path.join(packageRoot(), "src", "prompt", "prompt-runtime.ts");
 const TASK_ARG_LIMIT = 8000;
 const DEFAULT_MAX_CREW_DEPTH = 2;
 
@@ -80,7 +88,10 @@ export function resolveCrewMaxDepth(inputMaxDepth?: number, env: NodeJS.ProcessE
 	return DEFAULT_MAX_CREW_DEPTH;
 }
 
-export function checkCrewDepth(inputMaxDepth?: number, env: NodeJS.ProcessEnv = process.env): { blocked: boolean; depth: number; maxDepth: number } {
+export function checkCrewDepth(
+	inputMaxDepth?: number,
+	env: NodeJS.ProcessEnv = process.env,
+): { blocked: boolean; depth: number; maxDepth: number } {
 	const depth = currentCrewDepth(env);
 	const maxDepth = resolveCrewMaxDepth(inputMaxDepth, env);
 	return { depth, maxDepth, blocked: depth >= maxDepth };
@@ -218,7 +229,8 @@ export function createSafeTempDir(base: string, prefix: string): string {
 		resolvedAccumulated = path.join(resolvedAccumulated, resolvedParts[i]);
 		try {
 			const stat = fs.lstatSync(resolvedAccumulated);
-			if (stat.isSymbolicLink()) throw new Error("Refusing to create temp dir: resolved path contains symlink ancestor: " + resolvedAccumulated);
+			if (stat.isSymbolicLink())
+				throw new Error("Refusing to create temp dir: resolved path contains symlink ancestor: " + resolvedAccumulated);
 		} catch (e) {
 			if (e instanceof Error && e.message.includes("symlink")) throw e;
 			// Component doesn't exist — OK
@@ -334,9 +346,9 @@ export function buildPiWorkerArgs(input: BuildPiWorkerArgsInput): BuildPiWorkerA
 		args,
 		env: {
 			// PI_CREW_KIND is the authoritative machine-readable sub-agent marker. It is always
-		// present on a child-pi process and NEVER present on a user's interactive main session.
+			// present on a child-pi process and NEVER present on a user's interactive main session.
 			// doctor --zombies uses it to safely list orphaned sub-agents without ever matching a
-		// main session (the lesson from an accidental `kill` of a live main session).
+			// main session (the lesson from an accidental `kill` of a live main session).
 			PI_CREW_KIND: "subagent",
 			PI_CREW_INHERIT_PROJECT_CONTEXT: input.agent.inheritProjectContext ? "1" : "0",
 			PI_CREW_INHERIT_SKILLS: input.agent.inheritSkills ? "1" : "0",
@@ -385,7 +397,10 @@ export function cleanupTempDir(tempDir: string | undefined): void {
  * /tmp/pi-crew-* dirs when individual cleanupTempDir calls are missed
  * (e.g. parent process killed before child-pi.ts settles).
  */
-export function cleanupAllTrackedTempDirs(): { cleaned: number; failed: number } {
+export function cleanupAllTrackedTempDirs(): {
+	cleaned: number;
+	failed: number;
+} {
 	let cleaned = 0;
 	let failed = 0;
 	// Snapshot to avoid mutation during iteration
@@ -441,7 +456,10 @@ export function __test_getTrackedTempDirs(): readonly string[] {
  * Called at startup as a belt-and-suspenders measure alongside the
  * periodic cleanupOrphanTempDirs.
  */
-export function purgeStaleTrackedTempDirs(): { removed: number; remaining: number } {
+export function purgeStaleTrackedTempDirs(): {
+	removed: number;
+	remaining: number;
+} {
 	let removed = 0;
 	for (const dir of [...createdTempDirs]) {
 		if (!fs.existsSync(dir)) {

package/src/runtime/pi-json-output.ts

@@ -21,7 +21,7 @@ export interface ParsedPiJsonOutput {
 }
 
 function asRecord(value: unknown): Record<string, unknown> | undefined {
-	return value && typeof value === "object" && !Array.isArray(value) ? value as Record<string, unknown> : undefined;
+	return value && typeof value === "object" && !Array.isArray(value) ? (value as Record<string, unknown>) : undefined;
 }
 
 function numberField(obj: Record<string, unknown>, keys: string[]): number | undefined {

package/src/runtime/pi-spawn.ts

@@ -1,18 +1,15 @@
+import { execSync } from "node:child_process";
 import * as fs from "node:fs";
 import * as os from "node:os";
-import { execSync } from "node:child_process";
-import { fileURLToPath } from "node:url";
 import * as path from "node:path";
+import { fileURLToPath } from "node:url";
 
 export interface PiSpawnCommand {
 	command: string;
 	args: string[];
 }
 
-const PI_PACKAGE_NAMES = [
-	"@earendil-works/pi-coding-agent",
-	"@mariozechner/pi-coding-agent",
-];
+const PI_PACKAGE_NAMES = ["@earendil-works/pi-coding-agent", "@mariozechner/pi-coding-agent"];
 
 function isRunnableNodeScript(filePath: string): boolean {
 	return fs.existsSync(filePath) && /\.(?:mjs|cjs|js)$/i.test(filePath);
@@ -33,7 +30,9 @@ function isWithinAllowedPrefixes(resolvedPath: string): boolean {
 		const execDir = path.dirname(fs.realpathSync.native(process.execPath));
 		allowedPrefixes.push(execDir.toLowerCase());
 		allowedPrefixes.push(path.join(path.dirname(execDir), "lib", "node_modules").toLowerCase());
-	} catch { /* ignore */ }
+	} catch {
+		/* ignore */
+	}
 
 	// npm global bin via APPDATA
 	if (process.env.APPDATA) {
@@ -50,19 +49,25 @@ function isWithinAllowedPrefixes(resolvedPath: string): boolean {
 	try {
 		const projectBin = path.resolve("node_modules", ".bin");
 		allowedPrefixes.push(projectBin.toLowerCase());
-	} catch { /* ignore */ }
+	} catch {
+		/* ignore */
+	}
 
 	// User home npm-global
 	try {
 		const homeNpm = path.join(os.homedir(), ".npm-global", "bin");
 		allowedPrefixes.push(homeNpm.toLowerCase());
-	} catch { /* ignore */ }
+	} catch {
+		/* ignore */
+	}
 
 	// User home .local/bin
 	try {
 		const homeLocal = path.join(os.homedir(), ".local", "bin");
 		allowedPrefixes.push(homeLocal.toLowerCase());
-	} catch { /* ignore */ }
+	} catch {
+		/* ignore */
+	}
 
 	return allowedPrefixes.some((prefix) => normalized.startsWith(prefix));
 }
@@ -89,8 +94,10 @@ function resolvePiPackageRoot(): string | undefined {
 
 function packageBinScript(packageJsonPath: string): string | undefined {
 	try {
-		const pkg = JSON.parse(fs.readFileSync(packageJsonPath, "utf-8")) as { bin?: string | Record<string, string> };
-		const binPath = typeof pkg.bin === "string" ? pkg.bin : pkg.bin?.pi ?? Object.values(pkg.bin ?? {})[0];
+		const pkg = JSON.parse(fs.readFileSync(packageJsonPath, "utf-8")) as {
+			bin?: string | Record<string, string>;
+		};
+		const binPath = typeof pkg.bin === "string" ? pkg.bin : (pkg.bin?.pi ?? Object.values(pkg.bin ?? {})[0]);
 		if (!binPath) return undefined;
 		const candidate = path.resolve(path.dirname(packageJsonPath), binPath);
 		return isRunnableNodeScript(candidate) ? candidate : undefined;
@@ -104,7 +111,9 @@ function findPiPackageJsonFrom(startDir: string): string | undefined {
 	while (dir !== path.dirname(dir)) {
 		const direct = path.join(dir, "package.json");
 		try {
-			const pkg = JSON.parse(fs.readFileSync(direct, "utf-8")) as { name?: string };
+			const pkg = JSON.parse(fs.readFileSync(direct, "utf-8")) as {
+				name?: string;
+			};
 			if (pkg.name && PI_PACKAGE_NAMES.includes(pkg.name)) return direct;
 		} catch {
 			// Continue searching upward and in node_modules.
@@ -200,7 +209,7 @@ function resolvePiCliScript(): string | undefined {
 	].filter((entry): entry is string => Boolean(entry));
 
 	for (const root of roots) {
-		const packageJsonPath = root.endsWith("package.json") ? root : findPiPackageJsonFrom(root) ?? path.join(root, "package.json");
+		const packageJsonPath = root.endsWith("package.json") ? root : (findPiPackageJsonFrom(root) ?? path.join(root, "package.json"));
 		const script = packageBinScript(packageJsonPath);
 		if (script) return script;
 	}
@@ -214,16 +223,14 @@ function validateExplicitBin(explicit: string): string | undefined {
 	if (!isWithinAllowedPrefixes(resolved)) {
 		throw new Error(
 			`PI_TEAMS_PI_BIN path '${resolved}' is outside allowed prefixes. ` +
-			`Allowed: npm global bin, project node_modules/.bin, APPDATA/npm, or process execPath directory.`,
+				`Allowed: npm global bin, project node_modules/.bin, APPDATA/npm, or process execPath directory.`,
 		);
 	}
 	// Reject if symlink points outside expected directories
 	try {
 		const real = fs.realpathSync(resolved);
 		if (!isWithinAllowedPrefixes(real)) {
-			throw new Error(
-				`PI_TEAMS_PI_BIN symlink target '${real}' is outside allowed prefixes.`,
-			);
+			throw new Error(`PI_TEAMS_PI_BIN symlink target '${real}' is outside allowed prefixes.`);
 		}
 	} catch (e) {
 		if (e instanceof Error && e.message.includes("allowed prefixes")) throw e;
@@ -238,7 +245,11 @@ export function getPiSpawnCommand(args: string[]): PiSpawnCommand {
 	if (explicit) {
 		const validated = validateExplicitBin(explicit);
 		if (validated) {
-			if (isRunnableNodeScript(validated)) return { command: process.execPath, args: [validated, ...args] };
+			if (isRunnableNodeScript(validated))
+				return {
+					command: process.execPath,
+					args: [validated, ...args],
+				};
 			return { command: validated, args };
 		}
 	}

package/src/runtime/pipeline-runner.ts

@@ -1,9 +1,9 @@
-import type { TeamTaskState } from "../state/types.ts";
-import type { WorkflowConfig, WorkflowStep } from "../workflows/workflow-config.ts";
-import type { TeamConfig } from "../teams/team-config.ts";
 import type { AgentConfig } from "../agents/agent-config.ts";
-import { appendEventAsync } from "../state/event-log.ts";
 import { errors } from "../errors.ts";
+import { appendEventAsync } from "../state/event-log.ts";
+import type { TeamTaskState } from "../state/types.ts";
+import type { TeamConfig } from "../teams/team-config.ts";
+import type { WorkflowConfig, WorkflowStep } from "../workflows/workflow-config.ts";
 import { mapConcurrent } from "./parallel-utils.ts";
 
 /**
@@ -80,7 +80,10 @@ export class PipelineRunner {
 	private stopOnError: boolean;
 	private defaultMaxConcurrency: number;
 
-	constructor(options?: { stopOnError?: boolean; defaultMaxConcurrency?: number }) {
+	constructor(options?: {
+		stopOnError?: boolean;
+		defaultMaxConcurrency?: number;
+	}) {
 		this.stopOnError = options?.stopOnError ?? true;
 		this.defaultMaxConcurrency = options?.defaultMaxConcurrency ?? 5;
 	}
@@ -139,12 +142,7 @@ export class PipelineRunner {
 				const inputs = this.resolveInputs(stage.inputs, previousResults, context);
 
 				// Execute stage (handle fan-out if enabled)
-				const results = await this.executeStageInternal(
-					stage,
-					inputs,
-					stageContext,
-					executeStage,
-				);
+				const results = await this.executeStageInternal(stage, inputs, stageContext, executeStage);
 
 				const duration = Date.now() - stageStartTime;
 				stages.push({
@@ -161,7 +159,12 @@ export class PipelineRunner {
 					type: "pipeline:stage_completed",
 					runId,
 					message: `Stage '${stage.name}' completed`,
-					data: { stageIndex: i, stageName: stage.name, duration, resultCount: results.length },
+					data: {
+						stageIndex: i,
+						stageName: stage.name,
+						duration,
+						resultCount: results.length,
+					},
 				});
 			} catch (error) {
 				const duration = Date.now() - stageStartTime;
@@ -180,7 +183,12 @@ export class PipelineRunner {
 						type: "pipeline:stage_failed",
 						runId,
 						message: `Stage '${stage.name}' failed: ${errorMessage}`,
-						data: { stageIndex: i, stageName: stage.name, duration, error: errorMessage },
+						data: {
+							stageIndex: i,
+							stageName: stage.name,
+							duration,
+							error: errorMessage,
+						},
 					});
 
 					await appendEventAsync(eventsPath, {
@@ -209,7 +217,12 @@ export class PipelineRunner {
 						type: "pipeline:stage_skipped",
 						runId,
 						message: `Stage '${stage.name}' skipped due to error`,
-						data: { stageIndex: i, stageName: stage.name, duration, error: errorMessage },
+						data: {
+							stageIndex: i,
+							stageName: stage.name,
+							duration,
+							error: errorMessage,
+						},
 					});
 				}
 			}
@@ -219,7 +232,9 @@ export class PipelineRunner {
 			type: "pipeline:completed",
 			runId,
 			message: `Pipeline '${workflow.name}' completed`,
-			data: { stages: stages.map((s) => ({ name: s.name, status: s.status })) },
+			data: {
+				stages: stages.map((s) => ({ name: s.name, status: s.status })),
+			},
 		});
 
 		return {
@@ -266,18 +281,20 @@ export class PipelineRunner {
 			}));
 
 			// Execute with concurrency limit - pass each item to callback
-			const results = await mapConcurrent(
-				tasks,
-				maxConcurrency,
-				async (task) => {
-					// Call the user-provided callback with each item
-					const result = await this.executeStageInternal(stage, task.item, {
+			const results = await mapConcurrent(tasks, maxConcurrency, async (task) => {
+				// Call the user-provided callback with each item
+				const result = await this.executeStageInternal(
+					stage,
+					task.item,
+					{
 						...stageContext,
 						stageName: task.name,
-					}, callback, nextDepth);
-					return result;
-				},
-			);
+					},
+					callback,
+					nextDepth,
+				);
+				return result;
+			});
 
 			return results;
 		}
@@ -294,14 +311,10 @@ export class PipelineRunner {
 	 * - ${previous[0]} -> previousResults[0]
 	 * - ${context.key} -> context.key
 	 * - ${args.x} -> context.args.x
-	 * 
+	 *
 	 * C5: Validates template inputs to prevent injection.
 	 */
-	private resolveInputs(
-		inputs: unknown,
-		previousResults: unknown[],
-		context: Record<string, unknown>,
-	): unknown {
+	private resolveInputs(inputs: unknown, previousResults: unknown[], context: Record<string, unknown>): unknown {
 		// If inputs is an array, resolve each element
 		if (Array.isArray(inputs)) {
 			// H4: Type safety - limit array size to prevent memory issues
@@ -337,13 +350,13 @@ export class PipelineRunner {
 	private isValidObjectKey(key: string): boolean {
 		// Reject dangerous keys
 		const dangerousKeys = [
-			'__proto__',
-			'constructor',
-			'prototype',
-			'__defineGetter__',
-			'__defineSetter__',
-			'__lookupGetter__',
-			'__lookupSetter__',
+			"__proto__",
+			"constructor",
+			"prototype",
+			"__defineGetter__",
+			"__defineSetter__",
+			"__lookupGetter__",
+			"__lookupSetter__",
 		];
 		if (dangerousKeys.includes(key)) {
 			return false;
@@ -373,11 +386,11 @@ export class PipelineRunner {
 			return false;
 		}
 		// Reject paths with empty segments
-		if (path.includes('..')) {
+		if (path.includes("..")) {
 			return false;
 		}
 		// Validate each path segment
-		const parts = path.split('.');
+		const parts = path.split(".");
 		for (const part of parts) {
 			if (!this.isValidObjectKey(part)) {
 				return false;
@@ -390,11 +403,7 @@ export class PipelineRunner {
 	 * Resolve a single template string.
 	 * C5: Validates template inputs to prevent injection.
 	 */
-	private resolveTemplate(
-		template: string,
-		previousResults: unknown[],
-		context: Record<string, unknown>,
-	): unknown {
+	private resolveTemplate(template: string, previousResults: unknown[], context: Record<string, unknown>): unknown {
 		// C5: Validate template length to prevent DoS
 		if (template.length > 10000) {
 			return template;
@@ -473,10 +482,7 @@ export class PipelineRunner {
 	 * Parse a pipeline workflow from a workflow configuration.
 	 * Converts standard WorkflowConfig to PipelineWorkflow.
 	 */
-	static fromWorkflowConfig(
-		workflow: WorkflowConfig,
-		goal: string,
-	): PipelineWorkflow {
+	static fromWorkflowConfig(workflow: WorkflowConfig, goal: string): PipelineWorkflow {
 		const stages: PipelineStage[] = workflow.steps.map((step) => ({
 			name: step.id,
 			team: step.role, // Using role as team identifier
@@ -498,12 +504,7 @@ export class PipelineRunner {
 /**
  * Create a pipeline workflow from a goal and stage definitions.
  */
-export function createPipelineWorkflow(
-	name: string,
-	description: string,
-	goal: string,
-	stages: PipelineStage[],
-): PipelineWorkflow {
+export function createPipelineWorkflow(name: string, description: string, goal: string, stages: PipelineStage[]): PipelineWorkflow {
 	return {
 		name,
 		description,

package/src/runtime/plan-templates.ts

@@ -89,10 +89,7 @@ export function listPlanTemplates(): string[] {
  * @param variables - Key-value pairs for substitution
  * @returns Rendered plan, or undefined if template not found
  */
-export function renderPlanTemplate(
-	templateName: string,
-	variables: Record<string, string>,
-): RenderedPlan | undefined {
+export function renderPlanTemplate(templateName: string, variables: Record<string, string>): RenderedPlan | undefined {
 	const template = templates.get(templateName);
 	if (!template) {
 		logInternalError("plan-templates", new Error(`Template not found: ${templateName}`));
@@ -135,7 +132,8 @@ registerPlanTemplate({
 		{
 			name: "review",
 			role: "reviewer",
-			taskTemplate: "Review the code identified in the explore phase for: {{goal}}. Check correctness, maintainability, and security.",
+			taskTemplate:
+				"Review the code identified in the explore phase for: {{goal}}. Check correctness, maintainability, and security.",
 			maxTasks: 1,
 			dependsOn: ["explore"],
 		},
@@ -160,7 +158,8 @@ registerPlanTemplate({
 		{
 			name: "explore",
 			role: "explorer",
-			taskTemplate: "Explore the codebase to understand the current state relevant to: {{goal}}. Identify affected files and patterns.",
+			taskTemplate:
+				"Explore the codebase to understand the current state relevant to: {{goal}}. Identify affected files and patterns.",
 			maxTasks: 1,
 			dependsOn: [],
 		},

package/src/runtime/policy-engine.ts

@@ -36,34 +36,70 @@ export function evaluateCrewPolicy(input: PolicyEngineInput): PolicyDecision[] {
 	const decisions: PolicyDecision[] = [];
 	const maxTasksPerRun = Number.isFinite(input.limits?.maxTasksPerRun) ? input.limits!.maxTasksPerRun : undefined;
 	if (maxTasksPerRun !== undefined && input.tasks.length > maxTasksPerRun) {
-		decisions.push(decision("block", "limit_exceeded", `Run has ${input.tasks.length} tasks, exceeding maxTasksPerRun=${maxTasksPerRun}.`));
+		decisions.push(
+			decision("block", "limit_exceeded", `Run has ${input.tasks.length} tasks, exceeding maxTasksPerRun=${maxTasksPerRun}.`),
+		);
 	}
 	const runningCount = input.tasks.filter((task) => task.status === "running").length;
 	const maxConcurrentWorkers = Number.isFinite(input.limits?.maxConcurrentWorkers) ? input.limits!.maxConcurrentWorkers : undefined;
 	if (maxConcurrentWorkers !== undefined && runningCount > maxConcurrentWorkers) {
-		decisions.push(decision("block", "limit_exceeded", `Run has ${runningCount} running workers, exceeding maxConcurrentWorkers=${maxConcurrentWorkers}.`));
+		decisions.push(
+			decision(
+				"block",
+				"limit_exceeded",
+				`Run has ${runningCount} running workers, exceeding maxConcurrentWorkers=${maxConcurrentWorkers}.`,
+			),
+		);
 	}
 	const tasksById = new Map(input.tasks.map((task) => [task.id, task]));
 
 	for (const task of input.tasks) {
 		if (input.limits?.maxChildrenPerTask !== undefined && (task.graph?.children.length ?? 0) > input.limits.maxChildrenPerTask) {
-			decisions.push(decision("block", "limit_exceeded", `Task has ${task.graph?.children.length ?? 0} children, exceeding maxChildrenPerTask=${input.limits.maxChildrenPerTask}.`, task.id));
+			decisions.push(
+				decision(
+					"block",
+					"limit_exceeded",
+					`Task has ${task.graph?.children.length ?? 0} children, exceeding maxChildrenPerTask=${input.limits.maxChildrenPerTask}.`,
+					task.id,
+				),
+			);
 		}
 		if (input.limits?.maxTaskDepth !== undefined && taskDepth(task, tasksById) > input.limits.maxTaskDepth) {
-			decisions.push(decision("block", "limit_exceeded", `Task graph depth exceeds maxTaskDepth=${input.limits.maxTaskDepth}.`, task.id));
+			decisions.push(
+				decision("block", "limit_exceeded", `Task graph depth exceeds maxTaskDepth=${input.limits.maxTaskDepth}.`, task.id),
+			);
 		}
 		if (task.status === "failed") {
 			const retryCount = task.policy?.retryCount ?? 0;
 			const maxRetries = input.limits?.maxRetriesPerTask ?? 0;
-			decisions.push(decision(retryCount < maxRetries ? "retry" : "escalate", "task_failed", task.error ? `Task failed: ${task.error}` : "Task failed.", task.id));
+			decisions.push(
+				decision(
+					retryCount < maxRetries ? "retry" : "escalate",
+					"task_failed",
+					task.error ? `Task failed: ${task.error}` : "Task failed.",
+					task.id,
+				),
+			);
 		}
-		if ((task.status === "running" || task.status === "queued") && task.heartbeat && task.heartbeat.alive !== false && isWorkerHeartbeatStale(task.heartbeat, input.limits?.heartbeatStaleMs ?? 60_000, input.now)) {
+		if (
+			(task.status === "running" || task.status === "queued") &&
+			task.heartbeat &&
+			task.heartbeat.alive !== false &&
+			isWorkerHeartbeatStale(task.heartbeat, input.limits?.heartbeatStaleMs ?? 60_000, input.now)
+		) {
 			decisions.push(decision("escalate", "worker_stale", "Worker heartbeat is stale.", task.id));
 		}
 		if (task.taskPacket?.verification) {
 			const outcome = evaluateGreenContract(task.taskPacket.verification, task.verification);
 			if (!outcome.satisfied && task.status === "completed") {
-				decisions.push(decision("block", "green_unsatisfied", `Green contract unsatisfied: required=${outcome.requiredGreenLevel}, observed=${outcome.observedGreenLevel}.`, task.id));
+				decisions.push(
+					decision(
+						"block",
+						"green_unsatisfied",
+						`Green contract unsatisfied: required=${outcome.requiredGreenLevel}, observed=${outcome.observedGreenLevel}.`,
+						task.id,
+					),
+				);
 			}
 		}
 	}

package/src/runtime/post-checks.ts

@@ -7,8 +7,8 @@
 import { execFileSync } from "node:child_process";
 import * as path from "node:path";
 import { WINDOWS_ESSENTIAL_ENV_VARS } from "../utils/env-allowlist.ts";
-import { resolveShellForScript } from "../utils/resolve-shell.ts";
 import { sanitizeEnvSecrets } from "../utils/env-filter.ts";
+import { resolveShellForScript } from "../utils/resolve-shell.ts";
 import { resolveRealContainedPath } from "../utils/safe-paths.ts";
 
 /** Default timeout for post-check scripts (5 minutes). */
@@ -92,12 +92,17 @@ export async function runPostCheck(config: PostCheckConfig, cwd: string): Promis
 	return new Promise<PostCheckResult>((resolve) => {
 		try {
 			const { command, args } = resolveShellForScript(scriptPath);
-		const output = execFileSync(command, args, {
+			const output = execFileSync(command, args, {
 				cwd,
 				timeout: timeoutMs,
 				encoding: "utf-8",
 				maxBuffer: 10 * 1024 * 1024, // 10 MB
-				env: { ...sanitizeEnvSecrets(process.env, { allowList: ["PATH", "HOME", "USER", ...WINDOWS_ESSENTIAL_ENV_VARS, "TMPDIR", "LANG", "LC_ALL", "PI_CREW_*"] }), PI_CREW_POST_CHECK: "1" },
+				env: {
+					...sanitizeEnvSecrets(process.env, {
+						allowList: ["PATH", "HOME", "USER", ...WINDOWS_ESSENTIAL_ENV_VARS, "TMPDIR", "LANG", "LC_ALL", "PI_CREW_*"],
+					}),
+					PI_CREW_POST_CHECK: "1",
+				},
 			});
 
 			const durationMs = Date.now() - startTime;
@@ -118,7 +123,10 @@ export async function runPostCheck(config: PostCheckConfig, cwd: string): Promis
 
 			let output = "";
 			if (error instanceof Error) {
-				const execError = error as NodeJS.ErrnoException & { stdout?: string; stderr?: string };
+				const execError = error as NodeJS.ErrnoException & {
+					stdout?: string;
+					stderr?: string;
+				};
 				output = [execError.stdout ?? "", execError.stderr ?? "", execError.message ?? ""].join("\n").trim();
 			} else {
 				output = String(error);

package/src/runtime/post-exit-stdio-guard.ts

@@ -35,12 +35,12 @@ export function attachPostExitStdioGuard(child: ChildWithPipedStdio, options: Po
 		if (!stdoutEnded) {
 			try {
 				child.stdout?.destroy();
-		} catch {}
+			} catch {}
 		}
 		if (!stderrEnded) {
 			try {
 				child.stderr?.destroy();
-		} catch {}
+			} catch {}
 		}
 	};
 

package/src/runtime/process-lifecycle.ts

@@ -29,7 +29,7 @@
  * `taskkill /F /T /PID` escalation directly (force-kill the whole tree).
  * See `.crew/knowledge.md` gotchas: BSD/Windows signal handling differs.
  */
-import { spawn, type ChildProcess, type SpawnOptions } from "node:child_process";
+import { type ChildProcess, type SpawnOptions, spawn } from "node:child_process";
 import { logInternalError } from "../utils/internal-error.ts";
 
 // ── tunables ──────────────────────────────────────────────────────────────────
@@ -125,7 +125,10 @@ export class OwnedProcess {
 	private deregistered = false;
 	/** Terminal once teardown/reconciliation has confirmed the group is gone. */
 	private terminated = false;
-	private exitPromise: Promise<{ code: number | null; signal: NodeJS.Signals | null }>;
+	private exitPromise: Promise<{
+		code: number | null;
+		signal: NodeJS.Signals | null;
+	}>;
 	private exitCallbacks = new Set<OwnedExitCallback>();
 	private onAbort: (() => void) | undefined;
 	private readonly abortSignal: AbortSignal | undefined;
@@ -187,7 +190,9 @@ export class OwnedProcess {
 				void this.dispose();
 			} else {
 				this.onAbort = () => void this.dispose();
-				this.abortSignal.addEventListener("abort", this.onAbort, { once: true });
+				this.abortSignal.addEventListener("abort", this.onAbort, {
+					once: true,
+				});
 			}
 		}
 	}
@@ -230,14 +235,14 @@ export class OwnedProcess {
 	 * With no timeout it resolves only when the child exits. Never rejects.
 	 */
 	async awaitExit(opts?: { timeoutMs?: number }): Promise<AwaitExitResult> {
-		const exitResult = this.exitPromise.then((info) => ({ exited: true as const, code: info.code }));
+		const exitResult = this.exitPromise.then((info) => ({
+			exited: true as const,
+			code: info.code,
+		}));
 		if (opts?.timeoutMs === undefined) return exitResult;
 		let timer: ReturnType<typeof setTimeout> | undefined;
 		const timeout = new Promise<AwaitExitResult>((resolve) => {
-			timer = setTimeout(
-				() => resolve({ exited: false, code: this.child.exitCode }),
-				Math.max(0, opts.timeoutMs!),
-			);
+			timer = setTimeout(() => resolve({ exited: false, code: this.child.exitCode }), Math.max(0, opts.timeoutMs!));
 		});
 		try {
 			return await Promise.race([exitResult, timeout]);
@@ -311,7 +316,9 @@ export class OwnedProcess {
 					if (await pollUntil(() => !groupAlive(this.pgid!), this.gracefulMs)) return;
 					this.signalTree("SIGKILL");
 					if (!(await pollUntil(() => !groupAlive(this.pgid!), SIGKILL_REAP_CAP_MS))) {
-						console.warn(`[pi-crew] owned process group still alive after SIGKILL (name=${this.name ?? "?"}, pgid=${this.pgid})`);
+						console.warn(
+							`[pi-crew] owned process group still alive after SIGKILL (name=${this.name ?? "?"}, pgid=${this.pgid})`,
+						);
 					}
 					return;
 				}
@@ -341,7 +348,10 @@ export class OwnedProcess {
 		const tryTaskkill = (force: boolean): Promise<void> =>
 			new Promise((resolve) => {
 				const args = ["/T", "/PID", String(pid), ...(force ? ["/F"] : [])];
-				const tk = spawn("taskkill", args, { stdio: "ignore", windowsHide: true });
+				const tk = spawn("taskkill", args, {
+					stdio: "ignore",
+					windowsHide: true,
+				});
 				tk.on("error", () => resolve());
 				tk.on("exit", () => resolve());
 			});