pi-crew 0.9.20 → 0.9.22

package/dist/index.mjs

@@ -11703,6 +11703,9 @@ function resetEventLogMode() {
   asyncQueues.clear();
 }
 async function appendEventAsync(eventsPath, event) {
+  if (!TERMINAL_EVENT_TYPES.has(event.type)) {
+    return appendEventBuffered(eventsPath, event);
+  }
   const queueKey = eventsPath;
   const prev = asyncQueues.get(queueKey) ?? Promise.resolve();
   const next = prev.then(async () => {
@@ -11853,6 +11856,101 @@ async function appendEventAsync(eventsPath, event) {
   );
   return next;
 }
+async function appendEventBatchInsideLock(eventsPath, queue) {
+  if (queue.length === 0) return;
+  fs8.mkdirSync(path6.dirname(eventsPath), { recursive: true });
+  try {
+    if (fs8.existsSync(eventsPath)) {
+      const stat2 = fs8.statSync(eventsPath);
+      if (stat2.size > MAX_EVENTS_BYTES) {
+        try {
+          const prepared = prepareCompaction(eventsPath);
+          if (prepared) applyCompactionUnlocked(eventsPath, prepared);
+        } catch (error) {
+          logInternalError("event-log.batch-immediate-compact", error, `eventsPath=${eventsPath}`);
+        }
+        if (fs8.existsSync(eventsPath) && fs8.statSync(eventsPath).size > MAX_EVENTS_BYTES) {
+          rotateEventLogUnlocked(eventsPath);
+        }
+      }
+    }
+  } catch (error) {
+    logInternalError("event-log.batch-size-check", error, `eventsPath=${eventsPath}`);
+  }
+  const startingSeq = queue[0]?.event.metadata?.seq ?? nextSequence(eventsPath);
+  let nextSeq = startingSeq;
+  const finalized = [];
+  let lastSeq = 0;
+  for (const item of queue) {
+    const baseMetadata = item.event.metadata;
+    const seq = baseMetadata?.seq ?? nextSeq++;
+    let metadata = {
+      seq,
+      provenance: baseMetadata?.provenance ?? "team_runner",
+      ...baseMetadata?.parentEventId ? { parentEventId: baseMetadata.parentEventId } : {},
+      ...baseMetadata?.attemptId ? { attemptId: baseMetadata.attemptId } : {},
+      ...baseMetadata?.branchId ? { branchId: baseMetadata.branchId } : {},
+      ...baseMetadata?.causationId ? { causationId: baseMetadata.causationId } : {},
+      ...baseMetadata?.correlationId ? { correlationId: baseMetadata.correlationId } : {},
+      ...baseMetadata?.sessionIdentity ? { sessionIdentity: baseMetadata.sessionIdentity } : {},
+      ...baseMetadata?.ownership ? { ownership: baseMetadata.ownership } : {},
+      ...baseMetadata?.nudgeId ? { nudgeId: baseMetadata.nudgeId } : {},
+      ...baseMetadata?.confidence ? { confidence: baseMetadata.confidence } : {}
+    };
+    const fullEvent = {
+      time: (/* @__PURE__ */ new Date()).toISOString(),
+      ...item.event,
+      metadata
+    };
+    if (baseMetadata?.fingerprint || TERMINAL_EVENT_TYPES.has(fullEvent.type)) {
+      metadata = {
+        ...metadata,
+        fingerprint: baseMetadata?.fingerprint ?? computeEventFingerprint(fullEvent)
+      };
+      fullEvent.metadata = metadata;
+    }
+    finalized.push({ item, line: `${JSON.stringify(redactSecrets(fullEvent))}
+`, fullEvent });
+    lastSeq = seq;
+  }
+  try {
+    if (fs8.existsSync(eventsPath) && fs8.statSync(eventsPath).size > MAX_EVENTS_BYTES) {
+      logInternalError(
+        "event-log.size-limit",
+        new Error(`events file ${eventsPath} exceeds ${MAX_EVENTS_BYTES} bytes after compaction`),
+        `eventsPath=${eventsPath}`
+      );
+      for (const { item } of finalized) item.reject(new Error("event log size limit exceeded"));
+      return;
+    }
+  } catch (error) {
+    logInternalError("event-log.batch-size-check-post", error, `eventsPath=${eventsPath}`);
+  }
+  fs8.appendFileSync(eventsPath, finalized.map((f) => f.line).join(""), "utf-8");
+  const fd = fs8.openSync(eventsPath, "r+");
+  try {
+    fs8.fsyncSync(fd);
+  } catch {
+  } finally {
+    fs8.closeSync(fd);
+  }
+  persistSequence(eventsPath, lastSeq);
+  try {
+    const stat2 = fs8.statSync(eventsPath);
+    if (sequenceCache.size >= MAX_SEQUENCE_CACHE_ENTRIES) {
+      evictOldestSequenceCacheEntries();
+    }
+    sequenceCache.set(eventsPath, {
+      size: stat2.size,
+      mtimeMs: stat2.mtimeMs,
+      seq: lastSeq,
+      lastAccessMs: Date.now()
+    });
+  } catch (error) {
+    logInternalError("event-log.batch-cache-update", error, `eventsPath=${eventsPath}`);
+  }
+  for (const { item, fullEvent } of finalized) item.resolve(fullEvent);
+}
 function appendEventInsideLock(eventsPath, event) {
   fs8.mkdirSync(path6.dirname(eventsPath), { recursive: true });
   const baseMetadata = event.metadata;
@@ -11967,8 +12065,11 @@ function appendEventBuffered(eventsPath, event, bufferMs = DEFAULT_BUFFER_MS) {
     queue.push({ event, resolve: resolve21, reject });
     bufferedQueues.set(eventsPath, queue);
     if (!bufferedTimers.has(eventsPath)) {
-      const timer = setTimeout(() => flushOneEventLogBuffer(eventsPath), bufferMs);
-      timer.unref();
+      const timer = setTimeout(() => {
+        flushOneEventLogBuffer(eventsPath).catch((error) => {
+          logInternalError("event-log.buffered-flush", error, `eventsPath=${eventsPath}`);
+        });
+      }, bufferMs);
       bufferedTimers.set(eventsPath, timer);
     }
   });
@@ -12000,14 +12101,7 @@ async function flushOneEventLogBuffer(eventsPath) {
       }
     }
     await withEventLogLockAsync(eventsPath, async () => {
-      for (const item of queue) {
-        try {
-          const ev = appendEventInsideLock(eventsPath, item.event);
-          item.resolve(ev);
-        } catch (error) {
-          item.reject(error);
-        }
-      }
+      await appendEventBatchInsideLock(eventsPath, queue);
     });
   } catch (error) {
     if (queue) for (const item of queue) item.reject(error);
@@ -12108,8 +12202,14 @@ var init_event_log = __esm({
     bufferedTimers = /* @__PURE__ */ new Map();
     DEFAULT_BUFFER_MS = 20;
     process.on("exit", () => {
-      flushEventLogBuffer();
-      drainAsyncQueues();
+      if (bufferedQueues.size > 0) {
+        flushEventLogBuffer().catch(() => {
+        });
+      }
+      if (asyncQueues.size > 0) {
+        drainAsyncQueues().catch(() => {
+        });
+      }
       asyncQueues.clear();
     });
     process.on("SIGTERM", () => setImmediate(() => flushEventLogBuffer()));
@@ -17462,6 +17562,22 @@ var init_env_allowlist = __esm({
 function isKnownProviderKey(key) {
   return KNOWN_PROVIDER_KEYS.has(key);
 }
+function providerEnvKeys(modelId) {
+  if (!modelId) return [];
+  const separatorIndex = modelId.indexOf("/");
+  if (separatorIndex <= 0) return [];
+  const provider = modelId.substring(0, separatorIndex).toLowerCase();
+  return PROVIDER_ENV_KEY_MAP[provider] ?? [];
+}
+function buildScopedAllowList(baseAllowList, models) {
+  const providerKeys = /* @__PURE__ */ new Set();
+  for (const model of models) {
+    for (const key of providerEnvKeys(model)) {
+      providerKeys.add(key);
+    }
+  }
+  return [...baseAllowList, ...providerKeys];
+}
 function isDangerousGlob(pattern) {
   if (!pattern.endsWith("*")) return false;
   const prefix = pattern.slice(0, -1);
@@ -17502,7 +17618,7 @@ function sanitizeEnvSecrets(env, options) {
   }
   return filtered;
 }
-var KNOWN_PROVIDER_KEYS, SECRET_SUFFIXES;
+var KNOWN_PROVIDER_KEYS, PROVIDER_ENV_KEY_MAP, SECRET_SUFFIXES;
 var init_env_filter = __esm({
   "src/utils/env-filter.ts"() {
     "use strict";
@@ -17523,6 +17639,19 @@ var init_env_filter = __esm({
       "ZEU_API_KEY",
       "ZERODEV_API_KEY"
     ]);
+    PROVIDER_ENV_KEY_MAP = {
+      minimax: ["MINIMAX_API_KEY", "MINIMAX_GROUP_ID"],
+      openai: ["OPENAI_API_KEY", "OPENAI_ORG_ID"],
+      anthropic: ["ANTHROPIC_API_KEY"],
+      google: ["GOOGLE_API_KEY", "GOOGLE_GENERATIVE_LANGUAGE_API_KEY"],
+      gemini: ["GOOGLE_API_KEY", "GOOGLE_GENERATIVE_LANGUAGE_API_KEY"],
+      azure: ["AZURE_OPENAI_API_KEY", "AZURE_OPENAI_ENDPOINT"],
+      "azure-openai": ["AZURE_OPENAI_API_KEY", "AZURE_OPENAI_ENDPOINT"],
+      aws: ["AWS_ACCESS_KEY_ID", "AWS_SECRET_ACCESS_KEY", "AWS_REGION"],
+      bedrock: ["AWS_ACCESS_KEY_ID", "AWS_SECRET_ACCESS_KEY", "AWS_REGION"],
+      zai: ["ZEU_API_KEY"],
+      zerodev: ["ZERODEV_API_KEY"]
+    };
     SECRET_SUFFIXES = ["token", "api", "key", "password", "passwd", "secret", "credential", "authorization", "private"];
   }
 });
@@ -18194,7 +18323,7 @@ function terminateActiveChildPiProcesses() {
   for (const [pid, child] of entries) killProcessTree(pid, child);
   return entries.length;
 }
-function buildChildPiSpawnOptions(cwd, env) {
+function buildChildPiSpawnOptions(cwd, env, model) {
   let validatedCwd;
   try {
     validatedCwd = fs27.realpathSync(cwd);
@@ -18209,81 +18338,8 @@ function buildChildPiSpawnOptions(cwd, env) {
       throw new Error(`Invalid cwd: ${cwd} \u2014 ${error instanceof Error ? error.message : String(error)}`);
     }
   }
-  const filteredEnv = sanitizeEnvSecrets(env, {
-    allowList: [
-      /*
-       * SECURITY WARNING: All model provider API keys below are passed to EVERY child worker.
-       * If any child is compromised (e.g. via prompt injection), all listed keys are exposed.
-       * This is a deliberate trade-off: multi-provider setups require the child Pi process to
-       * authenticate with whichever provider the model routes to. Reducing keys per-child
-       * would break multi-provider functionality. Mitigations:
-       *   - sanitizeEnvSecrets strips all env vars NOT on this list.
-       *   - Do NOT add wildcards ("*_API_KEY") — only explicit, intended provider keys.
-       *   - Consider per-task key scoping if the architecture allows it in the future.
-       *
-       * MAINTENANCE REQUIREMENT: When new secret env vars are added to the Pi ecosystem,
-       * they MUST be explicitly added to this allowlist to be passed to child processes.
-       * A CI check should fail if a secret-like env var (matching patterns like *_API_KEY,
-       * *_TOKEN, *_SECRET) is detected in the codebase but not present in this list.
-       */
-      // NOTE: Model provider API keys are NOT needed here — child Pi uses the same
-      // config file as parent Pi. Passing keys via env is a security risk.
-      "PATH",
-      "HOME",
-      "USER",
-      "SHELL",
-      "TERM",
-      "LANG",
-      // FIX: Replaced broad wildcards (LC_*, XDG_*, NVM_*, NODE_*, npm_*) with
-      // specific names. Previously NPM_TOKEN, NODE_ENV=production, NVM_RC_VERSION
-      // all leaked through wildcards.
-      "LC_ALL",
-      "LC_COLLATE",
-      "LC_CTYPE",
-      "LC_MESSAGES",
-      "LC_MONETARY",
-      "LC_NUMERIC",
-      "LC_TIME",
-      "XDG_CONFIG_HOME",
-      "XDG_DATA_HOME",
-      "XDG_CACHE_HOME",
-      "XDG_RUNTIME_DIR",
-      // Windows essentials — see WINDOWS_ESSENTIAL_ENV_VARS (src/utils/env-allowlist.ts).
-      ...WINDOWS_ESSENTIAL_ENV_VARS,
-      "NVM_BIN",
-      "NVM_DIR",
-      "NVM_INC",
-      // NODE_PATH is intentionally omitted from the allowlist.
-      // NODE_PATH can reveal user environment information (e.g., NVM paths under $HOME)
-      // and the validation at lines 286-298 only filters to standard system prefixes.
-      // Removing it entirely is cleaner than best-effort filtering.
-      "NODE_DISABLE_COLORS",
-      "NODE_EXTRA_CA_CERTS",
-      "NPM_CONFIG_REGISTRY",
-      "NPM_CONFIG_USERCONFIG",
-      "NPM_CONFIG_GLOBALCONFIG",
-      // FIX: Replace PI_CREW_*/PI_TEAMS_* wildcards with explicit list of
-      // safe vars. Wildcards are fragile — any new secret var would leak.
-      // Only non-secret execution-control vars that children legitimately need.
-      "PI_CREW_DEPTH",
-      "PI_CREW_MAX_DEPTH",
-      "PI_CREW_INHERIT_PROJECT_CONTEXT",
-      "PI_CREW_INHERIT_SKILLS",
-      // PI_CREW_KIND marks this process as a crew sub-agent (vs the user's main session).
-      // doctor --zombies matches it to safely list orphaned sub-agents only.
-      "PI_CREW_KIND",
-      // PI_CREW_PARENT_PID is needed by child-pi's parent-guard (uses
-      // process.kill(pid, 0) liveness check). The PID is not a secret.
-      "PI_CREW_PARENT_PID",
-      "PI_TEAMS_DEPTH",
-      "PI_TEAMS_MAX_DEPTH",
-      "PI_TEAMS_INHERIT_PROJECT_CONTEXT",
-      "PI_TEAMS_INHERIT_SKILLS",
-      "PI_TEAMS_PI_BIN",
-      "PI_TEAMS_MOCK_CHILD_PI",
-      "PI_CREW_ALLOW_MOCK"
-    ]
-  });
+  const allowList = model ? buildScopedAllowList(BASE_ALLOWLIST, [model]) : BASE_ALLOWLIST;
+  const filteredEnv = sanitizeEnvSecrets(env, { allowList });
   if (filteredEnv.NODE_PATH) {
     const validPrefixes = ["/opt/", "/lib/", "/usr/local/", "/usr/", "/home/"];
     const validPaths = filteredEnv.NODE_PATH.split(":").filter((p) => {
@@ -18620,10 +18676,14 @@ ${JSON.stringify({ type: "message_end", usage: { input: 10, output: 5, cost: 1e-
       const child = spawn(
         spawnSpec.command,
         spawnSpec.args,
-        buildChildPiSpawnOptions(input.cwd, {
-          ...process.env,
-          ...built.env
-        })
+        buildChildPiSpawnOptions(
+          input.cwd,
+          {
+            ...process.env,
+            ...built.env
+          },
+          input.model
+        )
       );
       if (child.pid) {
         activeChildProcesses.set(child.pid, child);
@@ -19110,7 +19170,7 @@ ${JSON.stringify({ type: "message_end", usage: { input: 10, output: 5, cost: 1e-
     }
   }
 }
-var POST_EXIT_STDIO_GUARD_MS, FINAL_DRAIN_MS, HARD_KILL_MS, RESPONSE_TIMEOUT_MS, MAX_CAPTURE_BYTES, MAX_ASSISTANT_TEXT_CHARS, MAX_TOOL_RESULT_CHARS, MAX_TOOL_INPUT_CHARS, MAX_COMPACT_CONTENT_CHARS, activeChildProcesses, childHardKillTimers, ChildPiLineObserver;
+var POST_EXIT_STDIO_GUARD_MS, FINAL_DRAIN_MS, HARD_KILL_MS, RESPONSE_TIMEOUT_MS, MAX_CAPTURE_BYTES, MAX_ASSISTANT_TEXT_CHARS, MAX_TOOL_RESULT_CHARS, MAX_TOOL_INPUT_CHARS, MAX_COMPACT_CONTENT_CHARS, activeChildProcesses, childHardKillTimers, BASE_ALLOWLIST, ChildPiLineObserver;
 var init_child_pi = __esm({
   "src/runtime/child-pi.ts"() {
     "use strict";
@@ -19139,6 +19199,48 @@ var init_child_pi = __esm({
     MAX_COMPACT_CONTENT_CHARS = DEFAULT_CHILD_PI.maxCompactContentChars;
     activeChildProcesses = /* @__PURE__ */ new Map();
     childHardKillTimers = /* @__PURE__ */ new Map();
+    BASE_ALLOWLIST = [
+      "PATH",
+      "HOME",
+      "USER",
+      "SHELL",
+      "TERM",
+      "LANG",
+      "LC_ALL",
+      "LC_COLLATE",
+      "LC_CTYPE",
+      "LC_MESSAGES",
+      "LC_MONETARY",
+      "LC_NUMERIC",
+      "LC_TIME",
+      "XDG_CONFIG_HOME",
+      "XDG_DATA_HOME",
+      "XDG_CACHE_HOME",
+      "XDG_RUNTIME_DIR",
+      // Windows essentials — see WINDOWS_ESSENTIAL_ENV_VARS (src/utils/env-allowlist.ts).
+      ...WINDOWS_ESSENTIAL_ENV_VARS,
+      "NVM_BIN",
+      "NVM_DIR",
+      "NVM_INC",
+      "NODE_DISABLE_COLORS",
+      "NODE_EXTRA_CA_CERTS",
+      "NPM_CONFIG_REGISTRY",
+      "NPM_CONFIG_USERCONFIG",
+      "NPM_CONFIG_GLOBALCONFIG",
+      "PI_CREW_DEPTH",
+      "PI_CREW_MAX_DEPTH",
+      "PI_CREW_INHERIT_PROJECT_CONTEXT",
+      "PI_CREW_INHERIT_SKILLS",
+      "PI_CREW_KIND",
+      "PI_CREW_PARENT_PID",
+      "PI_TEAMS_DEPTH",
+      "PI_TEAMS_MAX_DEPTH",
+      "PI_TEAMS_INHERIT_PROJECT_CONTEXT",
+      "PI_TEAMS_INHERIT_SKILLS",
+      "PI_TEAMS_PI_BIN",
+      "PI_TEAMS_MOCK_CHILD_PI",
+      "PI_CREW_ALLOW_MOCK"
+    ];
     ChildPiLineObserver = class {
       buffer = "";
       input;
@@ -46743,7 +46845,7 @@ function buildTeamDoctorReport(input) {
   );
   const sections = [
     section("Runtime", () => {
-      const git4 = commandExists("git", ["--version"]);
+      const git3 = commandExists("git", ["--version"]);
       const pi = piCommandExists();
       return [
         { label: "cwd", ok: true, detail: input.cwd },
@@ -46753,7 +46855,7 @@ function buildTeamDoctorReport(input) {
           detail: `${process.platform}/${process.arch} node=${process.version}`
         },
         { label: "pi command", ok: pi.ok, detail: pi.detail },
-        { label: "git command", ok: git4.ok, detail: git4.detail },
+        { label: "git command", ok: git3.ok, detail: git3.detail },
         {
           label: "config",
           ok: input.configErrors.length === 0,
@@ -53491,9 +53593,41 @@ var init_goal_achievement = __esm({
   }
 });
 
+// src/utils/token-counter.ts
+function isWhitespace(c) {
+  return c === 32 || c === 9 || c === 10 || c === 13;
+}
+function isAlphanumeric(c) {
+  return c >= 48 && c <= 57 || // 0-9
+  c >= 65 && c <= 90 || // A-Z
+  c >= 97 && c <= 122 || // a-z
+  c === 95;
+}
+function countTokens(text) {
+  if (!text || text.length === 0) return 0;
+  let alpha = 0;
+  let punct = 0;
+  const len = text.length;
+  for (let i2 = 0; i2 < len; i2++) {
+    const c = text.charCodeAt(i2);
+    if (isWhitespace(c)) continue;
+    if (isAlphanumeric(c)) {
+      alpha++;
+    } else {
+      punct++;
+    }
+  }
+  return Math.ceil(alpha / 4) + punct;
+}
+var init_token_counter = __esm({
+  "src/utils/token-counter.ts"() {
+    "use strict";
+  }
+});
+
 // src/runtime/tool-output-pruner.ts
 function estimateTokens(text) {
-  return Math.ceil(text.length / 4);
+  return countTokens(text);
 }
 function firstErrorLine(text) {
   return text.split(/\r?\n/).find((line4) => /error|failed|exception|panic/i.test(line4))?.trim();
@@ -53524,7 +53658,7 @@ function createPrunedNotice(tokens, entry) {
   const generic = `[Output pruned \u2014 ${tokens} tokens]`;
   const digest = resultDigest(entry.toolName, entry.content, entry.isError);
   if (!digest) return generic;
-  const genericTokens = Math.ceil(generic.length / 4);
+  const genericTokens = countTokens(generic);
   const maxTokens = Math.max(genericTokens, Math.floor(genericTokens * DIGEST_NOTICE_TOKEN_CAP_MULTIPLIER));
   const prefix = `[Output pruned \u2014 ${tokens} tokens; `;
   const suffix = "]";
@@ -53599,7 +53733,7 @@ function pruneToolOutputs(results, config = DEFAULT_PRUNE_CONFIG) {
       entry,
       tokens,
       notice,
-      savings: Math.max(0, tokens - Math.ceil(notice.length / 4))
+      savings: Math.max(0, tokens - countTokens(notice))
     });
     accumulatedTokens += tokens;
   }
@@ -53624,6 +53758,7 @@ var DEFAULT_PRUNE_CONFIG, DIGEST_NOTICE_TOKEN_CAP_MULTIPLIER, READ_SELECTOR_SUFF
 var init_tool_output_pruner = __esm({
   "src/runtime/tool-output-pruner.ts"() {
     "use strict";
+    init_token_counter();
     DEFAULT_PRUNE_CONFIG = {
       protectTokens: 4e4,
       minimumSavings: 2e4,
@@ -55008,60 +55143,70 @@ var init_task_graph_scheduler = __esm({
 });
 
 // src/worktree/worktree-manager.ts
-import { execFileSync as execFileSync6, spawnSync as spawnSync3 } from "node:child_process";
+import { execFile, execFileSync as execFileSync6, spawnSync as spawnSync3 } from "node:child_process";
 import { randomBytes as randomBytes2 } from "node:crypto";
 import * as fs75 from "node:fs";
 import * as path63 from "node:path";
-function git3(cwd, args) {
-  return execFileSync6("git", args, {
+import { promisify } from "node:util";
+function gitEnv() {
+  return {
+    ...sanitizeEnvSecrets(process.env, {
+      allowList: [
+        "PATH",
+        "HOME",
+        "USER",
+        ...WINDOWS_ESSENTIAL_ENV_VARS,
+        "SHELL",
+        "TERM",
+        "LANG",
+        "LC_ALL",
+        "LC_COLLATE",
+        "LC_CTYPE",
+        "LC_MESSAGES",
+        "XDG_CONFIG_HOME",
+        "XDG_DATA_HOME",
+        "XDG_CACHE_HOME",
+        "NVM_BIN",
+        "NVM_DIR",
+        "NODE_PATH",
+        "GIT_CONFIG_GLOBAL",
+        "GIT_CONFIG_SYSTEM",
+        "GIT_AUTHOR_NAME",
+        "GIT_AUTHOR_EMAIL",
+        "GIT_COMMITTER_NAME",
+        "GIT_COMMITTER_EMAIL"
+      ]
+    }),
+    LANG: "en_US.UTF-8",
+    LC_ALL: "en_US.UTF-8"
+  };
+}
+async function gitAsync(cwd, args) {
+  const { stdout } = await execFileAsync("git", args, {
     cwd,
     encoding: "utf-8",
-    stdio: ["ignore", "pipe", "pipe"],
-    env: {
-      ...sanitizeEnvSecrets(process.env, {
-        allowList: [
-          "PATH",
-          "HOME",
-          "USER",
-          ...WINDOWS_ESSENTIAL_ENV_VARS,
-          "SHELL",
-          "TERM",
-          "LANG",
-          "LC_ALL",
-          "LC_COLLATE",
-          "LC_CTYPE",
-          "LC_MESSAGES",
-          "XDG_CONFIG_HOME",
-          "XDG_DATA_HOME",
-          "XDG_CACHE_HOME",
-          "NVM_BIN",
-          "NVM_DIR",
-          "NODE_PATH",
-          "GIT_CONFIG_GLOBAL",
-          "GIT_CONFIG_SYSTEM",
-          "GIT_AUTHOR_NAME",
-          "GIT_AUTHOR_EMAIL",
-          "GIT_COMMITTER_NAME",
-          "GIT_COMMITTER_EMAIL"
-        ]
-      }),
-      LANG: "en_US.UTF-8",
-      LC_ALL: "en_US.UTF-8"
-    },
+    env: gitEnv(),
     windowsHide: true
-  }).trim();
+  });
+  return stdout.trim();
 }
 function sanitizeBranchPart2(value) {
   return value.toLowerCase().replace(/[^a-z0-9_/-]+/g, "-").replace(/^-+|-+$/g, "") || "task";
 }
-function findGitRoot(cwd) {
-  return git3(cwd, ["rev-parse", "--show-toplevel"]);
+async function findGitRootAsync(cwd) {
+  const cached = _gitRootCache.get(cwd);
+  if (cached) return cached;
+  const root = await gitAsync(cwd, ["rev-parse", "--show-toplevel"]);
+  _gitRootCache.set(cwd, root);
+  return root;
 }
-function assertCleanLeader(repoRoot) {
-  const status = git3(repoRoot, ["status", "--porcelain"]);
+async function assertCleanLeaderAsync(repoRoot) {
+  if (_cleanLeaderCache.has(repoRoot)) return;
+  const status = await gitAsync(repoRoot, ["status", "--porcelain"]);
   if (status.trim()) {
     throw new Error("Worktree mode requires a clean leader repository. Commit/stash changes or use workspaceMode: 'single'.");
   }
+  _cleanLeaderCache.add(repoRoot);
 }
 function linkNodeModulesIfPresent(repoRoot, worktreePath) {
   const source = path63.join(repoRoot, "node_modules");
@@ -55233,31 +55378,30 @@ function runSetupHook(manifest, task, repoRoot, worktreePath, branch) {
     return [];
   }
 }
-function branchExists(repoRoot, branch) {
+async function branchExistsAsync(repoRoot, branch) {
   let local = false;
   try {
-    git3(repoRoot, ["rev-parse", "--verify", `refs/heads/${branch}`]);
+    await gitAsync(repoRoot, ["rev-parse", "--verify", `refs/heads/${branch}`]);
     local = true;
   } catch {
   }
   if (local) return { local: true, remoteOnly: false };
   try {
-    const out = execFileSync6("git", ["for-each-ref", "--format=%(refname)", `refs/remotes/*/${branch}`], {
+    const out = (await execFileAsync("git", ["for-each-ref", "--format=%(refname)", `refs/remotes/*/${branch}`], {
       cwd: repoRoot,
       encoding: "utf-8",
-      stdio: ["ignore", "pipe", "pipe"],
       windowsHide: true
-    }).trim();
+    })).stdout.trim();
     return { local: false, remoteOnly: out.length > 0 };
   } catch {
     return { local: false, remoteOnly: false };
   }
 }
-function pruneStaleWorktrees(repoRoot) {
+async function pruneStaleWorktreesAsync(repoRoot) {
   try {
-    execFileSync6("git", ["worktree", "prune"], {
+    await execFileAsync("git", ["worktree", "prune"], {
       cwd: repoRoot,
-      stdio: "ignore"
+      windowsHide: true
     });
   } catch {
   }
@@ -55322,11 +55466,11 @@ function overlaySeedPaths(repoRoot, worktreePath, seedPaths) {
     });
   }
 }
-function prepareTaskWorkspace(manifest, task, stepSeedPaths) {
+async function prepareTaskWorkspaceAsync(manifest, task, stepSeedPaths) {
   if (manifest.workspaceMode !== "worktree") return { cwd: task.cwd };
-  const repoRoot = findGitRoot(manifest.cwd);
+  const repoRoot = await findGitRootAsync(manifest.cwd);
   const loadedConfig = loadConfig(manifest.cwd);
-  if (loadedConfig.config.requireCleanWorktreeLeader !== false) assertCleanLeader(repoRoot);
+  if (loadedConfig.config.requireCleanWorktreeLeader !== false) await assertCleanLeaderAsync(repoRoot);
   const sanitizedRunId = manifest.runId.replace(/[^a-zA-Z0-9._-]/g, "-").replace(/^-+|-+$/g, "") || "run";
   const worktreeRoot = path63.join(projectCrewRoot(manifest.cwd), DEFAULT_PATHS.state.worktreesSubdir, sanitizedRunId);
   fs75.mkdirSync(worktreeRoot, { recursive: true });
@@ -55345,7 +55489,7 @@ function prepareTaskWorkspace(manifest, task, stepSeedPaths) {
   const branch = `pi-crew/${sanitizeBranchPart2(manifest.runId)}/${sanitizeBranchPart2(task.id)}`;
   let worktreeExists = false;
   try {
-    const worktreeList = git3(repoRoot, ["worktree", "list", "--porcelain"]);
+    const worktreeList = await gitAsync(repoRoot, ["worktree", "list", "--porcelain"]);
     const normalizedWtPath = process.platform === "win32" ? (() => {
       try {
         const r = fs75.realpathSync.native(worktreePath);
@@ -55368,7 +55512,7 @@ function prepareTaskWorkspace(manifest, task, stepSeedPaths) {
   if (worktreeExists) {
     let currentBranch;
     try {
-      currentBranch = git3(worktreePath, ["rev-parse", "--abbrev-ref", "HEAD"]);
+      currentBranch = await gitAsync(worktreePath, ["rev-parse", "--abbrev-ref", "HEAD"]);
     } catch (gitError) {
       throw new Error(
         `Existing worktree at ${worktreePath} is not a valid git repository; cannot verify branch: ${gitError instanceof Error ? gitError.message : String(gitError)}`
@@ -55377,30 +55521,31 @@ function prepareTaskWorkspace(manifest, task, stepSeedPaths) {
     if (currentBranch !== branch) {
       throw new Error(`Existing worktree branch mismatch at ${worktreePath}: expected '${branch}', got '${currentBranch}'.`);
     }
-    const dirtyStatus = git3(worktreePath, ["status", "--porcelain"]);
+    const dirtyStatus = await gitAsync(worktreePath, ["status", "--porcelain"]);
     if (dirtyStatus.trim()) {
       logInternalError(
         "worktree.reused.dirty",
         new Error(`Discarding uncommitted changes in reused worktree at ${worktreePath}`),
         `runId=${manifest.runId}, taskId=${task.id}, dirtyStatus=${dirtyStatus.trim()}`
       );
-      git3(worktreePath, ["checkout", "--", "."]);
-      git3(worktreePath, ["clean", "-fd"]);
+      await gitAsync(worktreePath, ["checkout", "--", "."]);
+      await gitAsync(worktreePath, ["clean", "-fd"]);
     }
     const globalSeedPaths2 = loadedConfig.config.worktree?.seedPaths ?? [];
     const mergedReused = normalizeSeedPaths([...globalSeedPaths2, ...stepSeedPaths ?? []], repoRoot);
     if (mergedReused.length > 0) {
       overlaySeedPaths(repoRoot, worktreePath, mergedReused);
     }
-    assertCleanLeader(repoRoot);
+    _cleanLeaderCache.delete(repoRoot);
+    await assertCleanLeaderAsync(repoRoot);
     return { cwd: worktreePath, worktreePath, branch, reused: true };
   }
-  pruneStaleWorktrees(repoRoot);
-  const exists = branchExists(repoRoot, branch);
+  await pruneStaleWorktreesAsync(repoRoot);
+  const exists = await branchExistsAsync(repoRoot, branch);
   let worktreeCreated = false;
   try {
     if (exists.local) {
-      git3(repoRoot, ["worktree", "add", worktreePath, branch]);
+      await gitAsync(repoRoot, ["worktree", "add", worktreePath, branch]);
     } else {
       if (exists.remoteOnly) {
         logInternalError(
@@ -55409,7 +55554,7 @@ function prepareTaskWorkspace(manifest, task, stepSeedPaths) {
           `branch=${branch}`
         );
       }
-      git3(repoRoot, ["worktree", "add", "-b", branch, worktreePath, "HEAD"]);
+      await gitAsync(repoRoot, ["worktree", "add", "-b", branch, worktreePath, "HEAD"]);
     }
     worktreeCreated = true;
   } catch (error) {
@@ -55443,10 +55588,10 @@ function prepareTaskWorkspace(manifest, task, stepSeedPaths) {
     syntheticPaths
   };
 }
-function captureWorktreeDiffStat(worktreePath) {
+async function captureWorktreeDiffStatAsync(worktreePath) {
   try {
-    const diffStat = git3(worktreePath, ["diff", "--stat"]);
-    const numstat = git3(worktreePath, ["diff", "--numstat"]);
+    const diffStat = await gitAsync(worktreePath, ["diff", "--stat"]);
+    const numstat = await gitAsync(worktreePath, ["diff", "--numstat"]);
     let filesChanged = 0;
     let insertions = 0;
     let deletions = 0;
@@ -55461,36 +55606,37 @@ function captureWorktreeDiffStat(worktreePath) {
     return { filesChanged: 0, insertions: 0, deletions: 0, diffStat: "" };
   }
 }
-function captureWorktreeDiff(worktreePath) {
+async function captureWorktreeDiffAsync(worktreePath) {
   try {
-    return git3(worktreePath, ["diff", "--stat"]) + "\n\n" + git3(worktreePath, ["diff"]);
+    const [stat2, full] = await Promise.all([gitAsync(worktreePath, ["diff", "--stat"]), gitAsync(worktreePath, ["diff"])]);
+    return stat2 + "\n\n" + full;
   } catch (error) {
     const message = error instanceof Error ? error.message : String(error);
     return `Failed to capture worktree diff: ${message}`;
   }
 }
-function prepareAgentWorktree(manifest, agentId) {
+async function prepareAgentWorktreeAsync(manifest, agentId) {
   try {
-    const repoRoot = findGitRoot(manifest.cwd);
+    const repoRoot = await findGitRootAsync(manifest.cwd);
     const loadedConfig = loadConfig(manifest.cwd);
-    if (loadedConfig.config.requireCleanWorktreeLeader !== false) assertCleanLeader(repoRoot);
+    if (loadedConfig.config.requireCleanWorktreeLeader !== false) await assertCleanLeaderAsync(repoRoot);
     const sanitizedRunId = manifest.runId.replace(/[^a-zA-Z0-9._-]/g, "-").replace(/^-+|-+$/g, "") || "run";
     const worktreeRoot = path63.join(projectCrewRoot(manifest.cwd), DEFAULT_PATHS.state.worktreesSubdir, sanitizedRunId);
     fs75.mkdirSync(worktreeRoot, { recursive: true });
     const sanitizedAgentId = sanitizeBranchPart2(agentId);
     const worktreePath = path63.join(worktreeRoot, sanitizedAgentId);
     const branch = `pi-crew/${sanitizedRunId}/${sanitizedAgentId}`;
-    pruneStaleWorktrees(repoRoot);
-    git3(repoRoot, ["worktree", "add", "-b", branch, worktreePath, "HEAD"]);
+    await pruneStaleWorktreesAsync(repoRoot);
+    await gitAsync(repoRoot, ["worktree", "add", "-b", branch, worktreePath, "HEAD"]);
     const nodeModulesLinked = loadedConfig.config.worktree?.linkNodeModules === true ? linkNodeModulesIfPresent(repoRoot, worktreePath) : false;
     return { cwd: worktreePath, worktreePath, branch, nodeModulesLinked };
   } catch {
     return void 0;
   }
 }
-function cleanupAgentWorktree(manifest, worktreePath, branch) {
+async function cleanupAgentWorktreeAsync(manifest, worktreePath, branch) {
   try {
-    const diff = captureWorktreeDiff(worktreePath);
+    const diff = await captureWorktreeDiffAsync(worktreePath);
     if (diff.trim() && !diff.startsWith("Failed to capture worktree diff")) {
       writeArtifact(manifest.artifactsRoot, {
         kind: "diff",
@@ -55502,9 +55648,19 @@ function cleanupAgentWorktree(manifest, worktreePath, branch) {
   } catch (error) {
     logInternalError("worktree.agent-cleanup.diff", error, `worktreePath=${worktreePath}`);
   }
+  let repoRoot;
+  try {
+    repoRoot = await findGitRootAsync(manifest.cwd);
+  } catch {
+    try {
+      fs75.rmSync(worktreePath, { recursive: true, force: true });
+    } catch (rmError) {
+      logInternalError("worktree.agent-cleanup.rm", rmError, `worktreePath=${worktreePath}`);
+    }
+    return;
+  }
   try {
-    const repoRoot = findGitRoot(manifest.cwd);
-    git3(repoRoot, ["worktree", "remove", "--force", worktreePath]);
+    await gitAsync(repoRoot, ["worktree", "remove", "--force", worktreePath]);
   } catch (error) {
     logInternalError("worktree.agent-cleanup.remove", error, `worktreePath=${worktreePath}`);
     try {
@@ -55515,19 +55671,18 @@ function cleanupAgentWorktree(manifest, worktreePath, branch) {
   }
   if (branch) {
     try {
-      const repoRoot = findGitRoot(manifest.cwd);
-      git3(repoRoot, ["branch", "-D", branch]);
+      await gitAsync(repoRoot, ["branch", "-D", branch]);
     } catch (error) {
       logInternalError("worktree.agent-cleanup.branch", error, `branch=${branch}`);
     }
   }
   try {
-    const repoRoot = findGitRoot(manifest.cwd);
-    git3(repoRoot, ["worktree", "prune"]);
+    await gitAsync(repoRoot, ["worktree", "prune"]);
   } catch (error) {
     logInternalError("worktree.agent-cleanup.prune", error, `worktreePath=${worktreePath}`);
   }
 }
+var execFileAsync, _gitRootCache, _cleanLeaderCache;
 var init_worktree_manager = __esm({
   "src/worktree/worktree-manager.ts"() {
     "use strict";
@@ -55538,6 +55693,9 @@ var init_worktree_manager = __esm({
     init_env_filter();
     init_internal_error();
     init_paths();
+    execFileAsync = promisify(execFile);
+    _gitRootCache = /* @__PURE__ */ new Map();
+    _cleanLeaderCache = /* @__PURE__ */ new Set();
   }
 });
 
@@ -57496,7 +57654,7 @@ async function runTeamTask(input) {
   let streamBridge;
   try {
     streamBridge = registerStreamBridge(manifest.runId);
-    const workspace = prepareTaskWorkspace(manifest, input.task, input.step.seedPaths);
+    const workspace = await prepareTaskWorkspaceAsync(manifest, input.task, input.step.seedPaths);
     const worktree = workspace.worktreePath && workspace.branch ? {
       path: workspace.worktreePath,
       branch: workspace.branch,
@@ -58154,13 +58312,13 @@ async function runTeamTask(input) {
     const diffArtifact = workspace.worktreePath ? writeArtifact(manifest.artifactsRoot, {
       kind: "diff",
       relativePath: `diffs/${task.id}.diff`,
-      content: captureWorktreeDiff(workspace.worktreePath),
+      content: await captureWorktreeDiffAsync(workspace.worktreePath),
       producer: task.id
     }) : void 0;
     const diffStatArtifact = workspace.worktreePath ? writeArtifact(manifest.artifactsRoot, {
       kind: "metadata",
       relativePath: `metadata/${task.id}.diff-stat.json`,
-      content: `${JSON.stringify({ ...captureWorktreeDiffStat(workspace.worktreePath), syntheticPaths: workspace.syntheticPaths ?? [], nodeModulesLinked: workspace.nodeModulesLinked ?? false }, null, 2)}
+      content: `${JSON.stringify({ ...await captureWorktreeDiffStatAsync(workspace.worktreePath), syntheticPaths: workspace.syntheticPaths ?? [], nodeModulesLinked: workspace.nodeModulesLinked ?? false }, null, 2)}
 `,
       producer: task.id
     }) : void 0;
@@ -59399,6 +59557,7 @@ __export(team_runner_exports, {
   __test__mergeTaskUpdates: () => __test__mergeTaskUpdates,
   __test__parseAdaptivePlan: () => __test__parseAdaptivePlan,
   __test__repairAdaptivePlan: () => __test__repairAdaptivePlan,
+  checkPerTaskBudget: () => checkPerTaskBudget,
   executeTeamRun: () => executeTeamRun,
   hasPendingMutatingTaskAtBoundary: () => hasPendingMutatingTaskAtBoundary,
   mergeTaskUpdatesPreservingTerminal: () => mergeTaskUpdatesPreservingTerminal,
@@ -59429,6 +59588,23 @@ function startTeamRunHeartbeat(stateRoot, runId) {
   const interval = setInterval(writeHeartbeat, 3e4);
   return () => clearInterval(interval);
 }
+function checkPerTaskBudget(tasks, budgetTotal, budgetWarning, budgetAbort, fairShareFraction = 0.5) {
+  const usage = aggregateUsage(tasks);
+  const totalUsed = (usage?.input ?? 0) + (usage?.output ?? 0) + (usage?.cacheWrite ?? 0);
+  const abort = totalUsed >= budgetAbort * budgetTotal;
+  const warning = !abort && totalUsed >= budgetWarning * budgetTotal;
+  const remainingBudget = Math.max(0, budgetTotal - totalUsed);
+  const fairShareThreshold = remainingBudget * fairShareFraction;
+  const fairShareViolators = [];
+  for (const task of tasks) {
+    if (!task.usage) continue;
+    const taskTotal = (task.usage.input ?? 0) + (task.usage.output ?? 0) + (task.usage.cacheWrite ?? 0);
+    if (fairShareThreshold > 0 && taskTotal > fairShareThreshold && taskTotal > budgetTotal * 0.1) {
+      fairShareViolators.push(task.id);
+    }
+  }
+  return { abort, warning, fairShareViolators, totalUsed };
+}
 function findStep(workflow, task) {
   const step = workflow.steps.find((candidate) => candidate.id === task.stepId);
   if (!step) throw new Error(`Workflow step '${task.stepId}' not found for task '${task.id}'.`);
@@ -59737,6 +59913,13 @@ async function executeTeamRun(input) {
     "running",
     input.executeWorkers ? "Executing team workflow." : "Creating workflow prompts and placeholder results."
   );
+  if (input.budgetTotal !== void 0) manifest.budgetTotal = input.budgetTotal;
+  if (input.budgetWarning !== void 0) manifest.budgetWarning = input.budgetWarning;
+  if (input.budgetAbort !== void 0) manifest.budgetAbort = input.budgetAbort;
+  if (input.budgetUnlimited !== void 0) manifest.budgetUnlimited = input.budgetUnlimited;
+  if (manifest.budgetTotal !== void 0 && manifest.budgetTotal > 0 && !manifest.budgetUnlimited) {
+    saveRunManifest(manifest);
+  }
   void registerRunPromise(manifest.runId);
   const stopTeamHeartbeat = startTeamRunHeartbeat(manifest.stateRoot, manifest.runId);
   const cleanupUsage = () => {
@@ -60434,6 +60617,60 @@ async function executeTeamRunCore(input, manifest, workflow) {
       }
       wfMachine = { ...wfMachine, currentPhaseIndex: pi + 1 };
     }
+    if (input.budgetTotal !== void 0 && input.budgetTotal > 0 && input.budgetUnlimited !== true) {
+      const warnThreshold = input.budgetWarning ?? 0.8;
+      const abortThreshold = input.budgetAbort ?? 0.95;
+      const budgetCheck = checkPerTaskBudget(tasks, input.budgetTotal, warnThreshold, abortThreshold);
+      if (budgetCheck.abort) {
+        const message = `Per-task budget abort threshold exceeded: ${formatTokens(budgetCheck.totalUsed)}/${formatTokens(input.budgetTotal)} (${Math.round(budgetCheck.totalUsed / input.budgetTotal * 100)}%)`;
+        console.warn(`[team-runner] ${message}`);
+        await appendEventAsync(manifest.eventsPath, {
+          type: "run.budget_abort",
+          runId: manifest.runId,
+          message,
+          data: {
+            budgetTotal: input.budgetTotal,
+            budgetUsed: budgetCheck.totalUsed,
+            threshold: "abort"
+          }
+        });
+        tasks = markBlocked(tasks, `Budget abort threshold exceeded: ${message}`);
+        await saveRunTasksAsync(manifest, tasks);
+        manifest = updateRunStatus(manifest, "failed", message);
+        return { manifest, tasks };
+      }
+      if (budgetCheck.warning) {
+        const message = `Per-task budget warning threshold crossed: ${formatTokens(budgetCheck.totalUsed)}/${formatTokens(input.budgetTotal)} (${Math.round(budgetCheck.totalUsed / input.budgetTotal * 100)}%)`;
+        console.warn(`[team-runner] ${message}`);
+        await appendEventAsync(manifest.eventsPath, {
+          type: "run.budget_warning",
+          runId: manifest.runId,
+          message,
+          data: {
+            budgetTotal: input.budgetTotal,
+            budgetUsed: budgetCheck.totalUsed,
+            threshold: "warning"
+          }
+        });
+      }
+      for (const violatorId of budgetCheck.fairShareViolators) {
+        const violator = tasks.find((t2) => t2.id === violatorId);
+        if (!violator) continue;
+        const taskTotal = (violator.usage?.input ?? 0) + (violator.usage?.output ?? 0) + (violator.usage?.cacheWrite ?? 0);
+        const message = `Task '${violatorId}' consumed ${formatTokens(taskTotal)} (${Math.round(taskTotal / input.budgetTotal * 100)}% of total budget) \u2014 exceeds fair share`;
+        console.warn(`[team-runner.fair-share] ${message}`);
+        await appendEventAsync(manifest.eventsPath, {
+          type: "task.budget_fair_share",
+          runId: manifest.runId,
+          taskId: violatorId,
+          message,
+          data: {
+            budgetTotal: input.budgetTotal,
+            taskUsage: taskTotal
+          }
+        });
+      }
+    }
     const cancelledResult = results.find((item) => item.manifest.status === "cancelled");
     if (cancelledResult || input.signal?.aborted) {
       const reason = input.signal?.aborted ? cancellationReasonFromSignal(input.signal) : void 0;
@@ -68838,7 +69075,7 @@ function makeWorkflowCtx(manifest, opts) {
         const task = composeAgentTask(call);
         let agentCwd = manifest.cwd;
         if (call.worktree === true) {
-          const wt = prepareAgentWorktree(manifest, `dwf-agent-${Date.now()}-${randomBytes3(4).toString("hex")}`);
+          const wt = await prepareAgentWorktreeAsync(manifest, `dwf-agent-${Date.now()}-${randomBytes3(4).toString("hex")}`);
           if (wt?.worktreePath) {
             agentCwd = wt.cwd;
             worktreePath = wt.worktreePath;
@@ -68913,7 +69150,7 @@ function makeWorkflowCtx(manifest, opts) {
       } finally {
         if (worktreePath) {
           try {
-            cleanupAgentWorktree(manifest, worktreePath, worktreeBranch);
+            await cleanupAgentWorktreeAsync(manifest, worktreePath, worktreeBranch);
           } catch (cleanupError) {
             logInternalError("dynamic-workflow-context.worktree-cleanup", cleanupError, `worktreePath=${worktreePath}`);
           }
@@ -69609,7 +69846,7 @@ async function handleRun(params, ctx) {
   let resolvedCtx = ctx;
   if (workingDir) {
     try {
-      const gitRoot = findGitRoot(workingDir);
+      const gitRoot = await findGitRootAsync(workingDir);
       if (gitRoot && gitRoot !== workingDir) {
         resolvedCtx = { ...ctx, cwd: gitRoot };
       }
@@ -69619,7 +69856,7 @@ async function handleRun(params, ctx) {
   if (params.workspaceMode === "worktree") {
     let gitRoot;
     try {
-      gitRoot = findGitRoot(resolvedCtx.cwd);
+      gitRoot = await findGitRootAsync(resolvedCtx.cwd);
     } catch {
     }
     if (!gitRoot) {
@@ -69633,7 +69870,7 @@ Use workspaceMode: 'single' or run from a git repository.`,
     const preCheckConfig = loadConfig(resolvedCtx.cwd);
     if (preCheckConfig.config.requireCleanWorktreeLeader !== false) {
       try {
-        assertCleanLeader(gitRoot);
+        await assertCleanLeaderAsync(gitRoot);
       } catch (err2) {
         const msg = err2 instanceof Error ? err2.message : String(err2);
         return result(
@@ -69885,10 +70122,30 @@ ${dwfResult.manifest.summary ?? ""}`,
   const executedConfig = effectiveRunConfig(loadedConfig.config, params.config);
   const runtime = await resolveCrewRuntime(executedConfig);
   const runtimeResolution = runtimeResolutionState(runtime);
+  if (process.env.PI_CREW_DEBUG_BUDGET === "1") {
+    console.log(
+      "[DEBUG budget] params keys:",
+      Object.keys(params),
+      "budgetTotal:",
+      params.budgetTotal,
+      "budgetWarning:",
+      params.budgetWarning,
+      "budgetAbort:",
+      params.budgetAbort
+    );
+  }
   const executionManifest = {
     ...updatedManifest,
     runtimeResolution,
     runConfig: executedConfig,
+    // Persist budget config on the manifest so it's observable post-run
+    // (events.jsonl, status reads, audits). The team-runner reads these
+    // from the input, but persisting them means consumers can verify
+    // enforcement was armed without re-parsing the original call params.
+    ...params.budgetTotal !== void 0 ? { budgetTotal: params.budgetTotal } : {},
+    ...params.budgetWarning !== void 0 ? { budgetWarning: params.budgetWarning } : {},
+    ...params.budgetAbort !== void 0 ? { budgetAbort: params.budgetAbort } : {},
+    ...params.budgetUnlimited !== void 0 ? { budgetUnlimited: params.budgetUnlimited } : {},
     updatedAt: (/* @__PURE__ */ new Date()).toISOString()
   };
   atomicWriteJson(paths.manifestPath, executionManifest);
@@ -70153,7 +70410,11 @@ ${dwfResult.manifest.summary ?? ""}`,
           reliability: executedConfig.reliability,
           metricRegistry: ctx.metricRegistry,
           onJsonEvent: ctx.onJsonEvent,
-          workspaceId: ctx.sessionId ?? ctx.cwd
+          workspaceId: ctx.sessionId ?? ctx.cwd,
+          budgetTotal: params.budgetTotal,
+          budgetWarning: params.budgetWarning,
+          budgetAbort: params.budgetAbort,
+          budgetUnlimited: params.budgetUnlimited
         });
       } finally {
         unregisterActiveRun(updatedManifest.runId);
@@ -70280,7 +70541,11 @@ ${dwfResult.manifest.summary ?? ""}`,
       reliability: executedConfig.reliability,
       metricRegistry: ctx.metricRegistry,
       onJsonEvent: ctx.onJsonEvent,
-      workspaceId: ctx.cwd
+      workspaceId: ctx.cwd,
+      budgetTotal: params.budgetTotal,
+      budgetWarning: params.budgetWarning,
+      budgetAbort: params.budgetAbort,
+      budgetUnlimited: params.budgetUnlimited
     });
   } finally {
     unregisterActiveRun(updatedManifest.runId);
@@ -77264,7 +77529,7 @@ __export(otlp_exporter_exports, {
   convertToOTLP: () => convertToOTLP,
   validateEndpoint: () => validateEndpoint
 });
-import { promisify } from "node:util";
+import { promisify as promisify2 } from "node:util";
 import { gzip } from "node:zlib";
 function validateEndpoint(endpoint) {
   let url;
@@ -77382,7 +77647,7 @@ var init_otlp_exporter = __esm({
     "use strict";
     init_internal_error();
     init_redaction();
-    gzipAsync = promisify(gzip);
+    gzipAsync = promisify2(gzip);
     MAX_SNAPSHOTS_PER_PUSH = 5e3;
     OTLPExporter = class {
       name = "otlp";
@@ -81215,6 +81480,104 @@ var CREW_SHORTCUT_KEYS = CREW_SHORTCUTS.map((s) => s.key);
 
 // src/extension/cross-extension-rpc.ts
 init_safe_paths();
+
+// src/extension/rpc-hmac.ts
+import { createHmac, randomBytes as randomBytes4, timingSafeEqual as timingSafeEqual3 } from "node:crypto";
+var RPC_HMAC_VERSION = 1;
+var SECRET_ENV_VAR = "PI_CREW_RPC_SECRET";
+var CLOCK_SKEW_TOLERANCE_MS = 5 * 60 * 1e3;
+var SIGNATURE_VALIDITY_MS = 10 * 60 * 1e3;
+function getRpcSecret() {
+  return process.env[SECRET_ENV_VAR];
+}
+function isHmacEnabled() {
+  return typeof process.env[SECRET_ENV_VAR] === "string" && process.env[SECRET_ENV_VAR].length > 0;
+}
+function verifyRpcSignature(payload, body) {
+  const secret = getRpcSecret();
+  if (!secret) {
+    return { valid: false, reason: `[pi-crew HMAC] ${SECRET_ENV_VAR} not configured.` };
+  }
+  if (payload.version !== RPC_HMAC_VERSION) {
+    return { valid: false, reason: `HMAC version mismatch: expected ${RPC_HMAC_VERSION}, got ${payload.version}` };
+  }
+  const now = Date.now();
+  const age = now - payload.timestamp;
+  if (age < -CLOCK_SKEW_TOLERANCE_MS) {
+    return { valid: false, reason: `HMAC timestamp in the future by ${Math.abs(age)}ms` };
+  }
+  if (age > SIGNATURE_VALIDITY_MS) {
+    return { valid: false, reason: `HMAC signature expired (${age}ms old)` };
+  }
+  const expected = computeHmac(secret, payload, body);
+  return timingSafeCompare(payload.signature, expected) ? { valid: true } : { valid: false, reason: "HMAC signature mismatch" };
+}
+function withHmacVerification(handler, _channel) {
+  return (params) => {
+    if (!isHmacEnabled()) {
+      return handler(params);
+    }
+    const sigPayload = extractSignaturePayload(params);
+    if (!sigPayload) {
+      throw new Error("[pi-crew HMAC] Missing HMAC signature in RPC request.");
+    }
+    const originalBody = stripHmacFields(params);
+    const verification = verifyRpcSignature(sigPayload, originalBody);
+    if (!verification.valid) {
+      throw new Error(`[pi-crew HMAC] ${verification.reason}`);
+    }
+    return handler(originalBody);
+  };
+}
+function stripHmacFields(params) {
+  const result4 = { ...params };
+  delete result4.hmacVersion;
+  delete result4.hmacOrigin;
+  delete result4.hmacTimestamp;
+  delete result4.hmacChannel;
+  delete result4.hmacNonce;
+  delete result4.hmacSignature;
+  return result4;
+}
+function computeHmac(secret, payload, body) {
+  const payloadForHmac = {
+    version: payload.version,
+    origin: payload.origin,
+    timestamp: payload.timestamp,
+    channel: payload.channel,
+    nonce: payload.nonce
+  };
+  const message = `${JSON.stringify(payloadForHmac)}:${JSON.stringify(body)}`;
+  return createHmac("sha256", secret).update(message).digest("hex");
+}
+function timingSafeCompare(a, b) {
+  const bufA = Buffer.from(a, "hex");
+  const bufB = Buffer.from(b, "hex");
+  const maxLen = Math.max(bufA.length, bufB.length);
+  const safeA = Buffer.alloc(maxLen);
+  const safeB = Buffer.alloc(maxLen);
+  bufA.copy(safeA);
+  bufB.copy(safeB);
+  const equal = timingSafeEqual3(safeA, safeB);
+  return equal && bufA.length === bufB.length;
+}
+function extractSignaturePayload(params) {
+  if (!params || typeof params !== "object" || Array.isArray(params)) return null;
+  const obj = params;
+  if (typeof obj.hmacVersion !== "number" || typeof obj.hmacOrigin !== "string" || typeof obj.hmacTimestamp !== "number" || typeof obj.hmacChannel !== "string" || typeof obj.hmacNonce !== "string" || typeof obj.hmacSignature !== "string") {
+    return null;
+  }
+  return {
+    version: obj.hmacVersion,
+    origin: obj.hmacOrigin,
+    timestamp: obj.hmacTimestamp,
+    channel: obj.hmacChannel,
+    nonce: obj.hmacNonce,
+    signature: obj.hmacSignature
+  };
+}
+
+// src/extension/cross-extension-rpc.ts
 init_live_control_realtime();
 var _cachedHandleTeamTool5;
 async function handleTeamTool6(params, ctx) {
@@ -81312,139 +81675,167 @@ function registerPiCrewRpc(events, getCtx) {
     on(
       events,
       "pi-crew:rpc:ping",
-      (raw) => reply(events, "pi-crew:rpc:ping", requestId2(raw), {
-        success: true,
-        data: { version: PI_CREW_RPC_VERSION }
-      })
+      withHmacVerification(
+        (raw) => reply(events, "pi-crew:rpc:ping", requestId2(raw), {
+          success: true,
+          data: { version: PI_CREW_RPC_VERSION }
+        }),
+        "pi-crew:rpc:ping"
+      )
     ),
-    on(events, "pi-crew:rpc:run", async (raw) => {
-      const id = requestId2(raw);
-      try {
-        const rateLimit = checkRpcRateLimit();
-        if (!rateLimit.allowed) {
+    on(
+      events,
+      "pi-crew:rpc:run",
+      withHmacVerification(async (raw) => {
+        const id = requestId2(raw);
+        try {
+          const rateLimit = checkRpcRateLimit();
+          if (!rateLimit.allowed) {
+            reply(events, "pi-crew:rpc:run", id, {
+              success: false,
+              error: `RPC run rate limit exceeded. Max ${RPC_RATE_LIMIT_MAX} requests per ${RPC_RATE_LIMIT_WINDOW_MS / 1e3}s. Retry after ${Math.ceil((rateLimit.retryAfterMs ?? 6e4) / 1e3)}s.`
+            });
+            return;
+          }
+          recordRpcRun();
+          const ctx = getCtx();
+          if (!ctx) throw new Error("No active pi-crew session context.");
+          const ALLOWED_RPC_RUN_KEYS = /* @__PURE__ */ new Set([
+            "goal",
+            "team",
+            "workflow",
+            "async",
+            "cwd",
+            "config",
+            "skill",
+            "model",
+            "budgetTotal",
+            "budgetWarning",
+            "budgetAbort",
+            "budgetUnlimited"
+          ]);
+          let params;
+          if (raw && typeof raw === "object" && !Array.isArray(raw)) {
+            const filtered = {
+              ...raw
+            };
+            for (const key of Object.keys(filtered)) {
+              if (!ALLOWED_RPC_RUN_KEYS.has(key)) delete filtered[key];
+            }
+            params = {
+              ...filtered,
+              action: "run"
+            };
+          } else {
+            params = { action: "run" };
+          }
+          const permission = isAllowedRpcRunParams(params);
+          if (!permission.ok) {
+            reply(events, "pi-crew:rpc:run", id, {
+              success: false,
+              error: permission.error ?? "permission denied"
+            });
+            return;
+          }
+          const result4 = await handleTeamTool6(params, ctx);
+          reply(
+            events,
+            "pi-crew:rpc:run",
+            id,
+            result4.isError ? { success: false, error: textOf(result4) } : { success: true, data: result4.details }
+          );
+        } catch (error) {
           reply(events, "pi-crew:rpc:run", id, {
             success: false,
-            error: `RPC run rate limit exceeded. Max ${RPC_RATE_LIMIT_MAX} requests per ${RPC_RATE_LIMIT_WINDOW_MS / 1e3}s. Retry after ${Math.ceil((rateLimit.retryAfterMs ?? 6e4) / 1e3)}s.`
+            error: error instanceof Error ? error.message : String(error)
           });
-          return;
-        }
-        recordRpcRun();
-        const ctx = getCtx();
-        if (!ctx) throw new Error("No active pi-crew session context.");
-        const ALLOWED_RPC_RUN_KEYS = /* @__PURE__ */ new Set(["goal", "team", "workflow", "async", "cwd", "config", "skill", "model"]);
-        let params;
-        if (raw && typeof raw === "object" && !Array.isArray(raw)) {
-          const filtered = {
-            ...raw
-          };
-          for (const key of Object.keys(filtered)) {
-            if (!ALLOWED_RPC_RUN_KEYS.has(key)) delete filtered[key];
-          }
-          params = {
-            ...filtered,
-            action: "run"
-          };
-        } else {
-          params = { action: "run" };
         }
-        const permission = isAllowedRpcRunParams(params);
-        if (!permission.ok) {
-          reply(events, "pi-crew:rpc:run", id, {
+      }, "pi-crew:rpc:run")
+    ),
+    on(
+      events,
+      "pi-crew:rpc:status",
+      withHmacVerification(async (raw) => {
+        const id = requestId2(raw);
+        try {
+          const ctx = getCtx();
+          if (!ctx) throw new Error("No active pi-crew session context.");
+          const runId = raw && typeof raw === "object" && !Array.isArray(raw) ? raw.runId : void 0;
+          const result4 = await handleTeamTool6({ action: "status", runId }, ctx);
+          reply(
+            events,
+            "pi-crew:rpc:status",
+            id,
+            result4.isError ? { success: false, error: textOf(result4) } : {
+              success: true,
+              data: {
+                text: textOf(result4),
+                details: result4.details
+              }
+            }
+          );
+        } catch (error) {
+          reply(events, "pi-crew:rpc:status", id, {
             success: false,
-            error: permission.error ?? "permission denied"
+            error: error instanceof Error ? error.message : String(error)
           });
-          return;
         }
-        const result4 = await handleTeamTool6(params, ctx);
-        reply(
-          events,
-          "pi-crew:rpc:run",
-          id,
-          result4.isError ? { success: false, error: textOf(result4) } : { success: true, data: result4.details }
-        );
-      } catch (error) {
-        reply(events, "pi-crew:rpc:run", id, {
-          success: false,
-          error: error instanceof Error ? error.message : String(error)
-        });
-      }
-    }),
-    on(events, "pi-crew:rpc:status", async (raw) => {
-      const id = requestId2(raw);
-      try {
-        const ctx = getCtx();
-        if (!ctx) throw new Error("No active pi-crew session context.");
-        const runId = raw && typeof raw === "object" && !Array.isArray(raw) ? raw.runId : void 0;
-        const result4 = await handleTeamTool6({ action: "status", runId }, ctx);
-        reply(
-          events,
-          "pi-crew:rpc:status",
-          id,
-          result4.isError ? { success: false, error: textOf(result4) } : {
-            success: true,
-            data: {
-              text: textOf(result4),
-              details: result4.details
-            }
-          }
-        );
-      } catch (error) {
-        reply(events, "pi-crew:rpc:status", id, {
-          success: false,
-          error: error instanceof Error ? error.message : String(error)
-        });
-      }
-    }),
+      }, "pi-crew:rpc:status")
+    ),
     on(events, "pi-crew:live-control", (raw) => {
       const request = parseLiveControlRealtimeMessage(raw);
       if (request) publishLiveControlRealtime(request);
     }),
-    on(events, "pi-crew:rpc:live-control", async (raw) => {
-      const id = requestId2(raw);
-      try {
-        const ctx = getCtx();
-        if (!ctx) throw new Error("No active pi-crew session context.");
-        const obj = raw && typeof raw === "object" && !Array.isArray(raw) ? raw : {};
-        const rawOp = typeof obj.operation === "string" ? obj.operation : "steer-agent";
-        if (!isAllowedRpcOperation(rawOp)) {
+    on(
+      events,
+      "pi-crew:rpc:live-control",
+      withHmacVerification(async (raw) => {
+        const id = requestId2(raw);
+        try {
+          const ctx = getCtx();
+          if (!ctx) throw new Error("No active pi-crew session context.");
+          const obj = raw && typeof raw === "object" && !Array.isArray(raw) ? raw : {};
+          const rawOp = typeof obj.operation === "string" ? obj.operation : "steer-agent";
+          if (!isAllowedRpcOperation(rawOp)) {
+            reply(events, "pi-crew:rpc:live-control", id, {
+              success: false,
+              error: `RPC operation '${rawOp}' is not allowed. Allowed: ${[...RPC_ALLOWED_OPERATIONS].join(", ")}`
+            });
+            return;
+          }
+          const result4 = await handleTeamTool6(
+            {
+              action: "api",
+              runId: typeof obj.runId === "string" ? obj.runId : void 0,
+              config: {
+                operation: rawOp,
+                agentId: obj.agentId,
+                message: obj.message,
+                prompt: obj.prompt
+              }
+            },
+            ctx
+          );
+          reply(
+            events,
+            "pi-crew:rpc:live-control",
+            id,
+            result4.isError ? { success: false, error: textOf(result4) } : {
+              success: true,
+              data: {
+                text: textOf(result4),
+                details: result4.details
+              }
+            }
+          );
+        } catch (error) {
           reply(events, "pi-crew:rpc:live-control", id, {
             success: false,
-            error: `RPC operation '${rawOp}' is not allowed. Allowed: ${[...RPC_ALLOWED_OPERATIONS].join(", ")}`
+            error: error instanceof Error ? error.message : String(error)
           });
-          return;
         }
-        const result4 = await handleTeamTool6(
-          {
-            action: "api",
-            runId: typeof obj.runId === "string" ? obj.runId : void 0,
-            config: {
-              operation: rawOp,
-              agentId: obj.agentId,
-              message: obj.message,
-              prompt: obj.prompt
-            }
-          },
-          ctx
-        );
-        reply(
-          events,
-          "pi-crew:rpc:live-control",
-          id,
-          result4.isError ? { success: false, error: textOf(result4) } : {
-            success: true,
-            data: {
-              text: textOf(result4),
-              details: result4.details
-            }
-          }
-        );
-      } catch (error) {
-        reply(events, "pi-crew:rpc:live-control", id, {
-          success: false,
-          error: error instanceof Error ? error.message : String(error)
-        });
-      }
-    })
+      }, "pi-crew:rpc:live-control")
+    )
   ];
   return { unsubscribe: () => unsubs.forEach((unsub) => unsub()) };
 }