pi-crew 0.9.19 → 0.9.21

package/src/runtime/child-pi.ts

@@ -7,7 +7,7 @@ import { DEFAULT_CHILD_PI } from "../config/defaults.ts";
 import { registerChildProcess, unregisterChildProcess } from "../extension/crew-cleanup.ts";
 import type { WorkerExitStatus } from "../state/types.ts";
 import { WINDOWS_ESSENTIAL_ENV_VARS } from "../utils/env-allowlist.ts";
-import { sanitizeEnvSecrets } from "../utils/env-filter.ts";
+import { buildScopedAllowList, sanitizeEnvSecrets } from "../utils/env-filter.ts";
 import { logInternalError } from "../utils/internal-error.ts";
 import { redactJsonLine, redactSecretString } from "../utils/redaction.ts";
 import { resolveRealContainedPath } from "../utils/safe-paths.ts";
@@ -254,7 +254,53 @@ export interface ChildPiRunResult {
 	intermediateFindings?: string;
 }
 
-export function buildChildPiSpawnOptions(cwd: string, env: NodeJS.ProcessEnv): SpawnOptions {
+// Base allowlist of non-provider env vars always passed to child workers.
+// Provider API keys are injected dynamically via buildScopedAllowList() only
+// when a model is assigned to the task (per-task key scoping).
+const BASE_ALLOWLIST: string[] = [
+	"PATH",
+	"HOME",
+	"USER",
+	"SHELL",
+	"TERM",
+	"LANG",
+	"LC_ALL",
+	"LC_COLLATE",
+	"LC_CTYPE",
+	"LC_MESSAGES",
+	"LC_MONETARY",
+	"LC_NUMERIC",
+	"LC_TIME",
+	"XDG_CONFIG_HOME",
+	"XDG_DATA_HOME",
+	"XDG_CACHE_HOME",
+	"XDG_RUNTIME_DIR",
+	// Windows essentials — see WINDOWS_ESSENTIAL_ENV_VARS (src/utils/env-allowlist.ts).
+	...WINDOWS_ESSENTIAL_ENV_VARS,
+	"NVM_BIN",
+	"NVM_DIR",
+	"NVM_INC",
+	"NODE_DISABLE_COLORS",
+	"NODE_EXTRA_CA_CERTS",
+	"NPM_CONFIG_REGISTRY",
+	"NPM_CONFIG_USERCONFIG",
+	"NPM_CONFIG_GLOBALCONFIG",
+	"PI_CREW_DEPTH",
+	"PI_CREW_MAX_DEPTH",
+	"PI_CREW_INHERIT_PROJECT_CONTEXT",
+	"PI_CREW_INHERIT_SKILLS",
+	"PI_CREW_KIND",
+	"PI_CREW_PARENT_PID",
+	"PI_TEAMS_DEPTH",
+	"PI_TEAMS_MAX_DEPTH",
+	"PI_TEAMS_INHERIT_PROJECT_CONTEXT",
+	"PI_TEAMS_INHERIT_SKILLS",
+	"PI_TEAMS_PI_BIN",
+	"PI_TEAMS_MOCK_CHILD_PI",
+	"PI_CREW_ALLOW_MOCK",
+];
+
+export function buildChildPiSpawnOptions(cwd: string, env: NodeJS.ProcessEnv, model?: string): SpawnOptions {
 	// SECURITY FIX (Issue #1): Validate cwd before passing to spawn.
 	// If cwd comes from an untrusted source (user input, workspace config), a malicious cwd
 	// could cause the child process to operate in an attacker-controlled directory,
@@ -284,81 +330,12 @@ export function buildChildPiSpawnOptions(cwd: string, env: NodeJS.ProcessEnv): S
 	// IMPORTANT: preserve model provider API keys — they are needed by the child Pi to call the LLM.
 	// Also preserve essential non-secret vars (PATH, HOME, USER, etc.) so the child process can function.
 	// Bug #12 fix: essential env vars (PATH, HOME, etc.) are always preserved so child can find npm/node.
-	const filteredEnv = sanitizeEnvSecrets(env, {
-		allowList: [
-			/*
-			 * SECURITY WARNING: All model provider API keys below are passed to EVERY child worker.
-			 * If any child is compromised (e.g. via prompt injection), all listed keys are exposed.
-			 * This is a deliberate trade-off: multi-provider setups require the child Pi process to
-			 * authenticate with whichever provider the model routes to. Reducing keys per-child
-			 * would break multi-provider functionality. Mitigations:
-			 *   - sanitizeEnvSecrets strips all env vars NOT on this list.
-			 *   - Do NOT add wildcards ("*_API_KEY") — only explicit, intended provider keys.
-			 *   - Consider per-task key scoping if the architecture allows it in the future.
-			 *
-			 * MAINTENANCE REQUIREMENT: When new secret env vars are added to the Pi ecosystem,
-			 * they MUST be explicitly added to this allowlist to be passed to child processes.
-			 * A CI check should fail if a secret-like env var (matching patterns like *_API_KEY,
-			 * *_TOKEN, *_SECRET) is detected in the codebase but not present in this list.
-			 */
-			// NOTE: Model provider API keys are NOT needed here — child Pi uses the same
-			// config file as parent Pi. Passing keys via env is a security risk.
-			"PATH",
-			"HOME",
-			"USER",
-			"SHELL",
-			"TERM",
-			"LANG",
-			// FIX: Replaced broad wildcards (LC_*, XDG_*, NVM_*, NODE_*, npm_*) with
-			// specific names. Previously NPM_TOKEN, NODE_ENV=production, NVM_RC_VERSION
-			// all leaked through wildcards.
-			"LC_ALL",
-			"LC_COLLATE",
-			"LC_CTYPE",
-			"LC_MESSAGES",
-			"LC_MONETARY",
-			"LC_NUMERIC",
-			"LC_TIME",
-			"XDG_CONFIG_HOME",
-			"XDG_DATA_HOME",
-			"XDG_CACHE_HOME",
-			"XDG_RUNTIME_DIR",
-			// Windows essentials — see WINDOWS_ESSENTIAL_ENV_VARS (src/utils/env-allowlist.ts).
-			...WINDOWS_ESSENTIAL_ENV_VARS,
-			"NVM_BIN",
-			"NVM_DIR",
-			"NVM_INC",
-			// NODE_PATH is intentionally omitted from the allowlist.
-			// NODE_PATH can reveal user environment information (e.g., NVM paths under $HOME)
-			// and the validation at lines 286-298 only filters to standard system prefixes.
-			// Removing it entirely is cleaner than best-effort filtering.
-			"NODE_DISABLE_COLORS",
-			"NODE_EXTRA_CA_CERTS",
-			"NPM_CONFIG_REGISTRY",
-			"NPM_CONFIG_USERCONFIG",
-			"NPM_CONFIG_GLOBALCONFIG",
-			// FIX: Replace PI_CREW_*/PI_TEAMS_* wildcards with explicit list of
-			// safe vars. Wildcards are fragile — any new secret var would leak.
-			// Only non-secret execution-control vars that children legitimately need.
-			"PI_CREW_DEPTH",
-			"PI_CREW_MAX_DEPTH",
-			"PI_CREW_INHERIT_PROJECT_CONTEXT",
-			"PI_CREW_INHERIT_SKILLS",
-			// PI_CREW_KIND marks this process as a crew sub-agent (vs the user's main session).
-			// doctor --zombies matches it to safely list orphaned sub-agents only.
-			"PI_CREW_KIND",
-			// PI_CREW_PARENT_PID is needed by child-pi's parent-guard (uses
-			// process.kill(pid, 0) liveness check). The PID is not a secret.
-			"PI_CREW_PARENT_PID",
-			"PI_TEAMS_DEPTH",
-			"PI_TEAMS_MAX_DEPTH",
-			"PI_TEAMS_INHERIT_PROJECT_CONTEXT",
-			"PI_TEAMS_INHERIT_SKILLS",
-			"PI_TEAMS_PI_BIN",
-			"PI_TEAMS_MOCK_CHILD_PI",
-			"PI_CREW_ALLOW_MOCK",
-		],
-	});
+	//
+	// PER-TASK KEY SCOPING: when a model is provided, only the env keys for that
+	// provider are injected (via buildScopedAllowList). When no model is given,
+	// only BASE_ALLOWLIST system vars pass through — no provider keys leak.
+	const allowList = model ? buildScopedAllowList(BASE_ALLOWLIST, [model]) : BASE_ALLOWLIST;
+	const filteredEnv = sanitizeEnvSecrets(env, { allowList });
 	// FIX: Removed delete workarounds — with explicit allowlist, these vars
 	// are no longer auto-leaked. The wildcard approach was fragile.
 
@@ -900,10 +877,14 @@ export async function runChildPi(input: ChildPiRunInput): Promise<ChildPiRunResu
 			const child = spawn(
 				spawnSpec.command,
 				spawnSpec.args,
-				buildChildPiSpawnOptions(input.cwd, {
-					...process.env,
-					...built.env,
-				}),
+				buildChildPiSpawnOptions(
+					input.cwd,
+					{
+						...process.env,
+						...built.env,
+					},
+					input.model,
+				),
 			);
 			if (child.pid) {
 				activeChildProcesses.set(child.pid, child);

package/src/runtime/cross-extension-rpc.ts

@@ -1,4 +1,5 @@
 import * as crypto from "node:crypto";
+import { isHmacEnabled, extractSignaturePayload, verifyRpcSignature } from "../extension/rpc-hmac.ts";
 
 export interface EventBus {
 	on(event: string, handler: (data: unknown) => void): () => void;
@@ -47,6 +48,25 @@ function handleRpc<P extends { requestId: string }>(
 		if (!/^[a-zA-Z0-9_-]+$/.test(params.requestId)) {
 			throw new Error("Security: invalid requestId format");
 		}
+		// SECURITY: HMAC signature verification (when enabled).
+		if (isHmacEnabled()) {
+			const sigPayload = extractSignaturePayload(params);
+			if (!sigPayload) {
+				throw new Error("[pi-crew HMAC] Missing HMAC signature in RPC request.");
+			}
+			// Strip HMAC fields before verification (HMAC was signed over original params)
+			const originalParams = { ...params };
+			delete (originalParams as Record<string, unknown>).hmacVersion;
+			delete (originalParams as Record<string, unknown>).hmacOrigin;
+			delete (originalParams as Record<string, unknown>).hmacTimestamp;
+			delete (originalParams as Record<string, unknown>).hmacChannel;
+			delete (originalParams as Record<string, unknown>).hmacNonce;
+			delete (originalParams as Record<string, unknown>).hmacSignature;
+			const verification = verifyRpcSignature(sigPayload, originalParams);
+			if (!verification.valid) {
+				throw new Error(`[pi-crew HMAC] ${verification.reason}`);
+			}
+		}
 		try {
 			const data = await fn(params);
 			const reply: { success: true; data?: unknown } = { success: true };
@@ -72,9 +92,8 @@ export function registerCrewRpcHandlers(deps: RpcDeps): RpcHandle {
 	// operations that create or terminate child processes. Any subscriber on
 	// the shared event bus can emit these events. In a multi-extension
 	// environment, this means a malicious extension could spawn/stop agents.
-	// Mitigation (H-2): require an unguessable per-process token in addition to
-	// the legacy `source` identifier. Log all invocations for audit. A full fix
-	// still requires event-bus-level origin signing.
+	// Mitigations: HMAC origin signing (see rpc-hmac.ts) + per-process token
+	// (H-2) + legacy `source` identifier.
 	const CREW_RPC_SOURCE = "pi-crew";
 	const EXPECTED_TOKEN = getCrewRpcToken();
 

package/src/runtime/dynamic-workflow-context.ts

@@ -32,7 +32,7 @@ import { appendMailboxMessage, readMailbox } from "../state/mailbox.ts";
 import type { TeamRunManifest } from "../state/types.ts";
 import type { TeamConfig } from "../teams/team-config.ts";
 import { logInternalError } from "../utils/internal-error.ts";
-import { cleanupAgentWorktree, prepareAgentWorktree } from "../worktree/worktree-manager.ts";
+import { cleanupAgentWorktreeAsync, prepareAgentWorktreeAsync } from "../worktree/worktree-manager.ts";
 import { runChildPi } from "./child-pi.ts";
 import type { DwfCheckpointState } from "./dwf-state-store.ts";
 import { mapConcurrent } from "./parallel-utils.ts";
@@ -342,7 +342,7 @@ export function makeWorkflowCtx(manifest: TeamRunManifest, opts: MakeWorkflowCtx
 				// when worktree creation is unavailable (no git repo, dirty leader).
 				let agentCwd = manifest.cwd;
 				if (call.worktree === true) {
-					const wt = prepareAgentWorktree(manifest, `dwf-agent-${Date.now()}-${randomBytes(4).toString("hex")}`);
+					const wt = await prepareAgentWorktreeAsync(manifest, `dwf-agent-${Date.now()}-${randomBytes(4).toString("hex")}`);
 					if (wt?.worktreePath) {
 						agentCwd = wt.cwd;
 						worktreePath = wt.worktreePath;
@@ -431,7 +431,7 @@ export function makeWorkflowCtx(manifest: TeamRunManifest, opts: MakeWorkflowCtx
 				// — a leak must never crash the workflow.
 				if (worktreePath) {
 					try {
-						cleanupAgentWorktree(manifest, worktreePath, worktreeBranch);
+						await cleanupAgentWorktreeAsync(manifest, worktreePath, worktreeBranch);
 					} catch (cleanupError) {
 						logInternalError("dynamic-workflow-context.worktree-cleanup", cleanupError, `worktreePath=${worktreePath}`);
 					}

package/src/runtime/task-runner.ts

@@ -20,7 +20,7 @@ import type {
 import { logInternalError } from "../utils/internal-error.ts";
 import { resolveRealContainedPath } from "../utils/safe-paths.ts";
 import type { WorkflowStep } from "../workflows/workflow-config.ts";
-import { captureWorktreeDiff, captureWorktreeDiffStat, prepareTaskWorkspace } from "../worktree/worktree-manager.ts";
+import { captureWorktreeDiffAsync, captureWorktreeDiffStatAsync, prepareTaskWorkspaceAsync } from "../worktree/worktree-manager.ts";
 import { reserveControlChannel } from "./agent-control.ts";
 import { appendTaskAttentionEvent } from "./attention-events.ts";
 import { buildSyntheticTerminalEvidence, cancellationReasonFromSignal } from "./cancellation.ts";
@@ -122,7 +122,7 @@ export async function runTeamTask(input: TaskRunnerInput): Promise<{ manifest: T
 	let streamBridge: ReturnType<typeof registerStreamBridge> | undefined;
 	try {
 		streamBridge = registerStreamBridge(manifest.runId);
-		const workspace = prepareTaskWorkspace(manifest, input.task, input.step.seedPaths);
+		const workspace = await prepareTaskWorkspaceAsync(manifest, input.task, input.step.seedPaths);
 		const worktree =
 			workspace.worktreePath && workspace.branch
 				? {
@@ -905,7 +905,7 @@ export async function runTeamTask(input: TaskRunnerInput): Promise<{ manifest: T
 			? writeArtifact(manifest.artifactsRoot, {
 					kind: "diff",
 					relativePath: `diffs/${task.id}.diff`,
-					content: captureWorktreeDiff(workspace.worktreePath),
+					content: await captureWorktreeDiffAsync(workspace.worktreePath),
 					producer: task.id,
 				})
 			: undefined;
@@ -913,7 +913,7 @@ export async function runTeamTask(input: TaskRunnerInput): Promise<{ manifest: T
 			? writeArtifact(manifest.artifactsRoot, {
 					kind: "metadata",
 					relativePath: `metadata/${task.id}.diff-stat.json`,
-					content: `${JSON.stringify({ ...captureWorktreeDiffStat(workspace.worktreePath), syntheticPaths: workspace.syntheticPaths ?? [], nodeModulesLinked: workspace.nodeModulesLinked ?? false }, null, 2)}\n`,
+					content: `${JSON.stringify({ ...(await captureWorktreeDiffStatAsync(workspace.worktreePath)), syntheticPaths: workspace.syntheticPaths ?? [], nodeModulesLinked: workspace.nodeModulesLinked ?? false }, null, 2)}\n`,
 					producer: task.id,
 				})
 			: undefined;

package/src/runtime/team-runner.ts

@@ -13,7 +13,7 @@ import { HealthStore } from "../state/health-store.ts";
 import { withRunLock } from "../state/locks.ts";
 import { loadRunManifestById, saveRunManifest, saveRunManifestAsync, saveRunTasksAsync, updateRunStatus } from "../state/state-store.ts";
 import type { ArtifactDescriptor, PolicyDecision, TaskAttemptState, TeamRunManifest, TeamTaskState } from "../state/types.ts";
-import { aggregateUsage, formatUsage } from "../state/usage.ts";
+import { aggregateUsage, formatTokens, formatUsage } from "../state/usage.ts";
 import type { TeamConfig } from "../teams/team-config.ts";
 import { logInternalError } from "../utils/internal-error.ts";
 import type { WorkflowConfig, WorkflowStep } from "../workflows/workflow-config.ts";
@@ -130,6 +130,60 @@ export interface ExecuteTeamRunInput {
 	onJsonEvent?: (taskId: string, runId: string, event: unknown) => void;
 	/** Workspace where this run was initiated — used for session-scoped live-agent visibility. */
 	workspaceId: string;
+	/** Total token budget for the run. When set, enables per-task budget enforcement. */
+	budgetTotal?: number;
+	/** Budget warning threshold as a fraction (0-1). Default: 0.8 (80%). */
+	budgetWarning?: number;
+	/** Budget abort threshold as a fraction (0-1). Default: 0.95 (95%). */
+	budgetAbort?: number;
+	/** When true, skip budget enforcement entirely. */
+	budgetUnlimited?: boolean;
+}
+
+/**
+ * Result of a per-task budget check against cumulative run usage.
+ */
+export interface PerTaskBudgetCheckResult {
+	/** Whether the abort threshold was exceeded. */
+	abort: boolean;
+	/** Whether the warning threshold was exceeded. */
+	warning: boolean;
+	/** IDs of tasks that exceeded their fair share (>50% of remaining budget). */
+	fairShareViolators: string[];
+	/** Total tokens used so far. */
+	totalUsed: number;
+}
+
+/**
+ * Check cumulative token usage against per-task budget thresholds.
+ * Returns a structured result — callers decide how to act (warn vs abort).
+ *
+ * Exported for unit testing.
+ */
+export function checkPerTaskBudget(
+	tasks: TeamTaskState[],
+	budgetTotal: number,
+	budgetWarning: number,
+	budgetAbort: number,
+	fairShareFraction = 0.5,
+): PerTaskBudgetCheckResult {
+	const usage = aggregateUsage(tasks);
+	const totalUsed = (usage?.input ?? 0) + (usage?.output ?? 0) + (usage?.cacheWrite ?? 0);
+	const abort = totalUsed >= budgetAbort * budgetTotal;
+	const warning = !abort && totalUsed >= budgetWarning * budgetTotal;
+	const remainingBudget = Math.max(0, budgetTotal - totalUsed);
+	const fairShareThreshold = remainingBudget * fairShareFraction;
+	const fairShareViolators: string[] = [];
+	for (const task of tasks) {
+		if (!task.usage) continue;
+		const taskTotal = (task.usage.input ?? 0) + (task.usage.output ?? 0) + (task.usage.cacheWrite ?? 0);
+		// Only flag tasks that individually consumed a significant portion of the
+		// budget (>10% of total) AND exceeded the fair share of remaining budget.
+		if (fairShareThreshold > 0 && taskTotal > fairShareThreshold && taskTotal > budgetTotal * 0.1) {
+			fairShareViolators.push(task.id);
+		}
+	}
+	return { abort, warning, fairShareViolators, totalUsed };
 }
 
 function findStep(workflow: WorkflowConfig, task: TeamTaskState): WorkflowStep {
@@ -586,6 +640,18 @@ export async function executeTeamRun(input: ExecuteTeamRunInput): Promise<{ mani
 		input.executeWorkers ? "Executing team workflow." : "Creating workflow prompts and placeholder results.",
 	);
 
+	// Persist budget fields on the manifest so all subsequent saveRunManifest
+	// calls (there are many in executeTeamRunCore) preserve the budget config.
+	// Without this, the spread in updateRunStatus and other transformations
+	// can drop budget fields before they reach the persistence layer.
+	if (input.budgetTotal !== undefined) manifest.budgetTotal = input.budgetTotal;
+	if (input.budgetWarning !== undefined) manifest.budgetWarning = input.budgetWarning;
+	if (input.budgetAbort !== undefined) manifest.budgetAbort = input.budgetAbort;
+	if (input.budgetUnlimited !== undefined) manifest.budgetUnlimited = input.budgetUnlimited;
+	if (manifest.budgetTotal !== undefined && manifest.budgetTotal > 0 && !manifest.budgetUnlimited) {
+		saveRunManifest(manifest);
+	}
+
 	void registerRunPromise(manifest.runId);
 
 	// FIX (Round 15, regression): Start a team-level heartbeat so the stale
@@ -1444,6 +1510,69 @@ async function executeTeamRunCore(
 			wfMachine = { ...wfMachine, currentPhaseIndex: pi + 1 };
 		}
 
+		// Per-task budget enforcement: check cumulative usage after each batch merge.
+		// This prevents a single task from consuming 100% of the budget before
+		// abort triggers (the goal-loop only checks at turn boundaries).
+		if (input.budgetTotal !== undefined && input.budgetTotal > 0 && input.budgetUnlimited !== true) {
+			const warnThreshold = input.budgetWarning ?? 0.8;
+			const abortThreshold = input.budgetAbort ?? 0.95;
+			const budgetCheck = checkPerTaskBudget(tasks, input.budgetTotal, warnThreshold, abortThreshold);
+
+			if (budgetCheck.abort) {
+				const message = `Per-task budget abort threshold exceeded: ${formatTokens(budgetCheck.totalUsed)}/${formatTokens(input.budgetTotal)} (${Math.round((budgetCheck.totalUsed / input.budgetTotal) * 100)}%)`;
+				console.warn(`[team-runner] ${message}`);
+				await appendEventAsync(manifest.eventsPath, {
+					type: "run.budget_abort",
+					runId: manifest.runId,
+					message,
+					data: {
+						budgetTotal: input.budgetTotal,
+						budgetUsed: budgetCheck.totalUsed,
+						threshold: "abort",
+					},
+				});
+				tasks = markBlocked(tasks, `Budget abort threshold exceeded: ${message}`);
+				await saveRunTasksAsync(manifest, tasks);
+				manifest = updateRunStatus(manifest, "failed", message);
+				return { manifest, tasks };
+			}
+
+			if (budgetCheck.warning) {
+				const message = `Per-task budget warning threshold crossed: ${formatTokens(budgetCheck.totalUsed)}/${formatTokens(input.budgetTotal)} (${Math.round((budgetCheck.totalUsed / input.budgetTotal) * 100)}%)`;
+				console.warn(`[team-runner] ${message}`);
+				await appendEventAsync(manifest.eventsPath, {
+					type: "run.budget_warning",
+					runId: manifest.runId,
+					message,
+					data: {
+						budgetTotal: input.budgetTotal,
+						budgetUsed: budgetCheck.totalUsed,
+						threshold: "warning",
+					},
+				});
+			}
+
+			// Fair-share warning: flag tasks that consumed >50% of remaining budget
+			// without killing them mid-execution.
+			for (const violatorId of budgetCheck.fairShareViolators) {
+				const violator = tasks.find((t) => t.id === violatorId);
+				if (!violator) continue;
+				const taskTotal = (violator.usage?.input ?? 0) + (violator.usage?.output ?? 0) + (violator.usage?.cacheWrite ?? 0);
+				const message = `Task '${violatorId}' consumed ${formatTokens(taskTotal)} (${Math.round((taskTotal / input.budgetTotal) * 100)}% of total budget) — exceeds fair share`;
+				console.warn(`[team-runner.fair-share] ${message}`);
+				await appendEventAsync(manifest.eventsPath, {
+					type: "task.budget_fair_share",
+					runId: manifest.runId,
+					taskId: violatorId,
+					message,
+					data: {
+						budgetTotal: input.budgetTotal,
+						taskUsage: taskTotal,
+					},
+				});
+			}
+		}
+
 		const cancelledResult = results.find((item) => item.manifest.status === "cancelled");
 		if (cancelledResult || input.signal?.aborted) {
 			const reason = input.signal?.aborted ? cancellationReasonFromSignal(input.signal) : undefined;

package/src/runtime/tool-output-pruner.ts

@@ -90,8 +90,10 @@ export interface PruneResult {
 // Token estimation (rough char/4 heuristic, matching gajae-code)
 // ---------------------------------------------------------------------------
 
+import { countTokens } from "../utils/token-counter";
+
 function estimateTokens(text: string): number {
-	return Math.ceil(text.length / 4);
+	return countTokens(text);
 }
 
 // ---------------------------------------------------------------------------
@@ -146,7 +148,7 @@ function createPrunedNotice(tokens: number, entry: ToolResultEntry): string {
 	const generic = `[Output pruned — ${tokens} tokens]`;
 	const digest = resultDigest(entry.toolName, entry.content, entry.isError);
 	if (!digest) return generic;
-	const genericTokens = Math.ceil(generic.length / 4);
+	const genericTokens = countTokens(generic);
 	const maxTokens = Math.max(genericTokens, Math.floor(genericTokens * DIGEST_NOTICE_TOKEN_CAP_MULTIPLIER));
 	const prefix = `[Output pruned — ${tokens} tokens; `;
 	const suffix = "]";
@@ -303,7 +305,7 @@ export function pruneToolOutputs(results: ToolResultEntry[], config: PruneConfig
 			entry,
 			tokens,
 			notice,
-			savings: Math.max(0, tokens - Math.ceil(notice.length / 4)),
+			savings: Math.max(0, tokens - countTokens(notice)),
 		});
 		accumulatedTokens += tokens;
 	}

package/src/state/event-log.ts

@@ -350,6 +350,11 @@ export function checkSequenceGaps(eventsPath: string): { missing: number }[] {
  * from firing and degrading live-agent responsiveness.
  */
 export function appendEvent(eventsPath: string, event: AppendTeamEvent): TeamEvent {
+	// NOTE: appendEvent is a sync function that uses withEventLogLockSync (sleepSync).
+	// It cannot route through appendEventBuffered because the buffer timer requires
+	// the event loop to fire, which sleepSync blocks. Both terminal and non-terminal
+	// events use the direct sync path here. For non-terminal events, callers should
+	// prefer appendEventAsync (which routes through the buffer for coalesced writes).
 	return withEventLogLockSync(eventsPath, () => appendEventInsideLock(eventsPath, event));
 }
 
@@ -405,6 +410,19 @@ export function resetEventLogMode(): void {
  * foreground-control, etc.), prefer this over the sync `appendEvent()`.
  */
 export async function appendEventAsync(eventsPath: string, event: AppendTeamEvent): Promise<TeamEvent> {
+	// Non-terminal events: route through buffer for coalesced writes (20ms default).
+	// This eliminates per-event fsync + persistSequence overhead for high-frequency events.
+	if (!TERMINAL_EVENT_TYPES.has(event.type)) {
+		const result = appendEventBuffered(eventsPath, event);
+		// FIX: appendEventBuffered uses unref()'d timers. Keep the event loop alive
+		// so the promise resolves in standalone/test contexts where nothing else
+		// keeps the loop running. Without this, the event loop drains before the
+		// timer fires and the promise never resolves.
+		const keepAlive = setInterval(() => {}, 200);
+		void result.finally(() => clearInterval(keepAlive));
+		return result;
+	}
+	// Terminal events: direct async path for immediate durability guarantee
 	const queueKey = eventsPath;
 	const prev = asyncQueues.get(queueKey) ?? Promise.resolve();
 	const next = prev.then(async (): Promise<TeamEvent> => {

package/src/state/types.ts

@@ -208,6 +208,11 @@ export interface TeamRunManifest {
 	runKind?: "team-run" | "goal-loop" | "dynamic-workflow";
 	/** round-14 P1-5: typed workflow arguments accessible in .dwf.ts scripts via ctx.args<T>(). Any JSON value; default {} when unset. */
 	args?: unknown;
+	/** Per-run token budget snapshot. budgetTotal is the cap; budgetWarning/budgetAbort are fractions in [0,1] at which the team-runner emits run.budget_warning / run.budget_abort. budgetUnlimited=true opts out of enforcement. Optional for backward compat. */
+	budgetTotal?: number;
+	budgetWarning?: number;
+	budgetAbort?: number;
+	budgetUnlimited?: boolean;
 	summary?: string;
 	policyDecisions?: PolicyDecision[];
 	/** #2 (assessment): goal-achievement verdict — kills the silent false-green. */

package/src/tools/safe-bash-extension.ts

@@ -14,7 +14,7 @@
 import type { ExtensionAPI } from "@earendil-works/pi-coding-agent";
 import { createBashTool } from "@earendil-works/pi-coding-agent";
 import { Type } from "@sinclair/typebox";
-import { isDangerous } from "./safe-bash.ts";
+import { checkCommand } from "./safe-bash.ts";
 
 export default function safeBashExtension(pi: ExtensionAPI): void {
 	const cwd = process.cwd();
@@ -35,7 +35,7 @@ export default function safeBashExtension(pi: ExtensionAPI): void {
 			),
 		}),
 		async execute(toolCallId, params, signal, onUpdate, ctx) {
-			const danger = isDangerous(params.command);
+			const danger = checkCommand(params.command);
 			if (danger) {
 				return {
 					details: {},

package/src/tools/safe-bash.ts

@@ -403,3 +403,103 @@ export const SAFE_BASH_PRESETS = {
 		allowPatterns: [],
 	},
 };
+
+/**
+ * === Whitelist Mode (opt-in, additive) ===
+ *
+ * A deny-by-default mode that checks the first token of a command against an
+ * explicit allowlist of read-only utilities. Enabled via
+ * `PI_CREW_SAFE_BASH_MODE=whitelist`. When NOT enabled, the legacy blacklist
+ * `isDangerous()` path is used unchanged.
+ */
+
+/** Commands permitted under whitelist mode (read-only utilities only). */
+const WHITELISTED_COMMANDS = new Set<string>([
+	"ls",
+	"cat",
+	"head",
+	"tail",
+	"wc",
+	"grep",
+	"find",
+	"echo",
+	"pwd",
+	"date",
+	"whoami",
+	"uname",
+	"df",
+	"du",
+	"file",
+	"stat",
+]);
+
+/**
+ * Shell operators/metacharacters that could chain or substitute a command past
+ * the first token. Their presence anywhere in the raw command causes the
+ * whitelist check to reject, so e.g. `ls; rm file` cannot smuggle `rm` through
+ * under a permitted first token.
+ */
+const SHELL_METACHARACTER_RE = /[|;&`()<>]|\$\(/;
+
+/**
+ * Simple shell tokenizer: extract the first token (command name) of a command,
+ * respecting single and double quotes. Leading whitespace is skipped. Quote
+ * characters are not included in the returned token (`"ls"` → `ls`). An
+ * UNMATCHED quote is treated as malformed input and returns an empty string,
+ * causing `isAllowedWhitelist()` to reject the command (unmatched quotes can
+ * indicate malformed injection attempts).
+ */
+function shellFirstToken(command: string): string {
+	let i = 0;
+	const len = command.length;
+	while (i < len && /\s/.test(command[i])) i++;
+	let token = "";
+	while (i < len) {
+		const ch = command[i];
+		if (/\s/.test(ch)) break;
+		if (ch === "'" || ch === '"') {
+			const quote = ch;
+			i++;
+			while (i < len && command[i] !== quote) {
+				token += command[i];
+				i++;
+			}
+			// Unmatched quote → malformed input, reject by returning empty string.
+			if (i >= len) return "";
+			i++; // skip closing quote
+			continue;
+		}
+		token += ch;
+		i++;
+	}
+	return token;
+}
+
+/**
+ * Whitelist check (deny-by-default). Returns true only when the command's first
+ * token is in the allowlist AND no shell operators/metacharacters are present.
+ * Quoted first tokens (e.g. `"ls" -la`) are resolved before checking.
+ */
+export function isAllowedWhitelist(command: string): boolean {
+	if (command.trim() === "") return false;
+	if (SHELL_METACHARACTER_RE.test(command)) return false;
+	const firstToken = shellFirstToken(command);
+	if (firstToken === "") return false;
+	return WHITELISTED_COMMANDS.has(firstToken);
+}
+
+/** Current safe-bash mode, controlled by the `PI_CREW_SAFE_BASH_MODE` env var. */
+export function getSafeBashMode(): "blacklist" | "whitelist" {
+	return process.env.PI_CREW_SAFE_BASH_MODE === "whitelist" ? "whitelist" : "blacklist";
+}
+
+/**
+ * Unified command check that dispatches on the active mode.
+ * @returns Error message if the command should be blocked, null if allowed.
+ */
+export function checkCommand(command: string, options: SafeBashOptions = {}): string | null {
+	if (getSafeBashMode() === "whitelist") {
+		return isAllowedWhitelist(command) ? null : "Command blocked by safe_bash whitelist: command not in allowlist";
+	}
+	return isDangerous(command, options);
+}