pi-crew 0.9.29 → 0.9.31

package/CHANGELOG.md

@@ -1,5 +1,53 @@
 # Changelog
 
+## [0.9.30] — observability hardening + steering injection guards (2026-07-10)
+
+Cold-verified review of 12 findings across security, code quality, and explorer passes yielded 11 confirmed bugs (1 NOT-A-BUG). This release ships 9 of those fixes; the remaining 2 are documented as deferred follow-ups.
+
+### Security (HIGH)
+- **Steering content sanitization** (`src/prompt/prompt-runtime.ts`): `sanitizeSteerMessage()` rejects messages > 4096 chars, with > 50 newlines, or containing C0 control characters before injection via `pi.sendMessage({ deliverAs: "steer" })`. Rejection logged via `logInternalError(..., "warn")`. Closes SEC-01 prompt-injection vector.
+- **Steering file path containment** (`src/prompt/prompt-runtime.ts`): `validateSteeringFile()` uses `resolveRealContainedPath` from `src/utils/safe-paths.ts` to verify `PI_CREW_STEERING_FILE` stays inside the session's artifacts root, plus `lstatSync` to reject symlinks at the path itself. Closes F-07 defense-in-depth gap.
+
+### Observability (HIGH)
+- **`logInternalError` severity tiers** (`src/utils/internal-error.ts`): added optional 4th `severity` parameter (`"error" | "warn" | "debug"`). `"error"` and `"warn"` always emit to `console.error` regardless of `PI_TEAMS_DEBUG`; `"debug"` (default) preserves the existing gated behavior. Backward-compatible — all 100+ existing callers default to `"debug"`. Closes F-01 root cause (silent internal-error suppression in production).
+- **Critical callers upgraded** to `severity="error"`:
+  - `task-runner/state-helpers.ts` — CAS convergence failure
+  - `child-pi.ts` — Windows taskkill zombie (after retry exhaustion)
+  - `team-runner.ts` — false-green goal-achievement downgrade
+  - `atomic-write.ts` — coalesced flush failure (potential data loss)
+  - `crash-recovery.ts` — orphan/PID-dead/reconcile termination failures upgraded to `"warn"`
+
+### Correctness (MED)
+- **CAS retry error message accuracy** (`src/runtime/task-runner/state-helpers.ts`): extracted `MAX_CAS_ATTEMPTS = 100` constant; loop bound and error message now both interpolate the constant. Previously the message said "50 attempts" while the loop ran 100 — misleading post-mortem debug. Closes F-03.
+- **Stale skill-instructions comment removed** (`src/runtime/skill-instructions.ts`): deleted the 6-line `SECURITY NOTE` block that claimed project-level skills were "FOUND FIRST" — superseded by SEC-003 fix which made package skills trusted-first. Closes F-06 (maintainability hazard).
+- **Symlink cache TTL 30s → 10s** (`src/state/atomic-write.ts`): reduced `SYMLINK_SAFE_TTL_MS` and replaced misleading "invalidated explicitly via `invalidateSymlinkSafeCache(dir)`" comment with accurate TTL-only trust-model documentation. `invalidateSymlinkSafeCache()` remains exported but is intentionally unused (the `.crew/` state directory is trusted — single-user, non-shared). Closes F-02.
+
+### Performance (MED — partial)
+- **`appendEvent` → `appendEventAsync` migration** (`src/runtime/async-runner.ts`): migrated the single hot-path call site in `spawnBackgroundTeamRun` from sync `appendEvent` (which routes through `withEventLogLockSync` → `sleepSync(10)`, blocking the event loop on contention) to async `appendEventAsync`. Remaining 23 call sites in `goal-loop-runner.ts` (12) and `team-tool/api.ts` (11) deferred to follow-up — each requires per-site ordering analysis.
+
+### Reverted
+- **FIX-07 withRunLockSync retry wrapper** (`src/state/locks.ts`): implementation reverted. The retry wrapper extended failure time from instant to 60s (`staleMs × 2`) on hard-fail lock contention, breaking the existing `api-locks.test.ts:37` expectation that mutating API operations fail fast when the lock file holds stale content. Original fast-fail behavior is correct: a fresh-alive lock is a hard-fail signal that the caller (not the lock library) should decide whether to retry.
+
+### Deferred
+- **FIX-09 verification-gates `sh -c` → `execFile` migration**: existing newline + `DANGEROUS_SHELL_PATTERNS` validation covers the known injection vectors. Migration deferred as defense-in-depth — commands are user-supplied, not worker-injected.
+
+### Tests added
+- `test/unit/internal-error.test.ts` — severity tier coverage (4 tests).
+- `test/unit/prompt-runtime-steering.test.ts` — FIX-02 + FIX-03 validation (6 tests covering length, newline, control char, path containment, symlink, valid-content passthrough).
+- `test/unit/state-helpers.test.ts` — FIX-01b + FIX-05 validation (2 tests).
+
+### Verification
+- 2995 unit tests passing, 0 failures (via `node scripts/test-runner.mjs`).
+- End-to-end smoke test: `fast-fix` and `research` workflows completed successfully against the fixed runtime, all state-persistence paths working.
+
+---
+
+## [0.9.29] — version bump only (2026-07-10)
+
+> Maintenance release — no source changes. Version bumped to 0.9.29 prior to v0.9.30 development. CHANGELOG entry retroactively added for completeness.
+
+---
+
 ## [0.9.28] — maxTokens cap + real-time steering + provider-per-model (2026-07-09)
 
 ### Features

package/dist/build-meta.json

@@ -6087,7 +6087,7 @@
       "format": "esm"
     },
     "src/utils/internal-error.ts": {
-      "bytes": 384,
+      "bytes": 554,
       "imports": [],
       "format": "esm"
     },
@@ -6129,7 +6129,7 @@
       "format": "esm"
     },
     "src/state/atomic-write.ts": {
-      "bytes": 34938,
+      "bytes": 34941,
       "imports": [
         {
           "path": "node:crypto",
@@ -6814,7 +6814,7 @@
       "format": "esm"
     },
     "src/runtime/crash-recovery.ts": {
-      "bytes": 22623,
+      "bytes": 22655,
       "imports": [
         {
           "path": "node:fs",
@@ -7356,7 +7356,7 @@
       "format": "esm"
     },
     "src/runtime/child-pi.ts": {
-      "bytes": 66015,
+      "bytes": 66030,
       "imports": [
         {
           "path": "node:child_process",
@@ -12301,7 +12301,7 @@
       "format": "esm"
     },
     "src/runtime/skill-instructions.ts": {
-      "bytes": 13808,
+      "bytes": 13449,
       "imports": [
         {
           "path": "node:fs",
@@ -12839,7 +12839,7 @@
       "format": "esm"
     },
     "src/runtime/async-runner.ts": {
-      "bytes": 14599,
+      "bytes": 14704,
       "imports": [
         {
           "path": "node:child_process",
@@ -14676,7 +14676,7 @@
       "format": "esm"
     },
     "src/runtime/task-runner/state-helpers.ts": {
-      "bytes": 5519,
+      "bytes": 5684,
       "imports": [
         {
           "path": "node:fs",
@@ -15139,7 +15139,7 @@
       "format": "esm"
     },
     "src/runtime/team-runner.ts": {
-      "bytes": 76143,
+      "bytes": 76156,
       "imports": [
         {
           "path": "node:fs",
@@ -18390,7 +18390,7 @@
       "imports": [],
       "exports": [],
       "inputs": {},
-      "bytes": 6636234
+      "bytes": 6636624
     },
     "dist/index.mjs": {
       "imports": [
@@ -20589,7 +20589,7 @@
           "bytesInOutput": 12069
         },
         "src/utils/internal-error.ts": {
-          "bytesInOutput": 443
+          "bytesInOutput": 502
         },
         "src/utils/sleep.ts": {
           "bytesInOutput": 948
@@ -20598,7 +20598,7 @@
           "bytesInOutput": 5243
         },
         "src/state/atomic-write.ts": {
-          "bytesInOutput": 17427
+          "bytesInOutput": 17436
         },
         "src/config/defaults.ts": {
           "bytesInOutput": 4426
@@ -20685,7 +20685,7 @@
           "bytesInOutput": 580
         },
         "src/runtime/crash-recovery.ts": {
-          "bytesInOutput": 15270
+          "bytesInOutput": 15302
         },
         "src/runtime/deadletter.ts": {
           "bytesInOutput": 592
@@ -20769,7 +20769,7 @@
           "bytesInOutput": 1801
         },
         "src/runtime/child-pi.ts": {
-          "bytesInOutput": 45369
+          "bytesInOutput": 45390
         },
         "src/runtime/heartbeat-gradient.ts": {
           "bytesInOutput": 953
@@ -21447,7 +21447,7 @@
           "bytesInOutput": 8715
         },
         "src/runtime/skill-instructions.ts": {
-          "bytesInOutput": 11480
+          "bytesInOutput": 11101
         },
         "src/state/run-cache.ts": {
           "bytesInOutput": 2142
@@ -21507,7 +21507,7 @@
           "bytesInOutput": 2699
         },
         "src/runtime/async-runner.ts": {
-          "bytesInOutput": 8931
+          "bytesInOutput": 8942
         },
         "src/subagents/async-entry.ts": {
           "bytesInOutput": 119
@@ -21759,7 +21759,7 @@
           "bytesInOutput": 767
         },
         "src/runtime/task-runner/state-helpers.ts": {
-          "bytesInOutput": 2576
+          "bytesInOutput": 2756
         },
         "src/runtime/task-runner/tail-read.ts": {
           "bytesInOutput": 762
@@ -21792,7 +21792,7 @@
           "bytesInOutput": 3398
         },
         "src/runtime/team-runner.ts": {
-          "bytesInOutput": 57487
+          "bytesInOutput": 57504
         },
         "src/runtime/pipeline-runner.ts": {
           "bytesInOutput": 12070
@@ -22095,7 +22095,7 @@
           "bytesInOutput": 81
         }
       },
-      "bytes": 3161826
+      "bytes": 3161776
     }
   }
 }

package/dist/index.mjs

@@ -8493,8 +8493,10 @@ var init_config_schema = __esm({
 });
 
 // src/utils/internal-error.ts
-function logInternalError(scope, error, details) {
-  if (!process.env.PI_TEAMS_DEBUG) return;
+function logInternalError(scope, error, details, severity) {
+  if (!severity || severity === "debug") {
+    if (!process.env.PI_TEAMS_DEBUG) return;
+  }
   const message = error instanceof Error ? error.message : typeof error === "object" && error !== null ? JSON.stringify(error) : String(error);
   const suffix = details ? `: ${details}` : "";
   console.error(`[pi-crew:${scope}] ${message}${suffix}`);
@@ -9096,7 +9098,7 @@ function flushOnePendingAtomicWrite(filePath) {
       pendingAtomicWrites.delete(filePath);
     }
   } catch (error) {
-    logInternalError("atomic-write.coalesced-flush", error, filePath);
+    logInternalError("atomic-write.coalesced-flush", error, filePath, "error");
     const current2 = pendingAtomicWrites.get(filePath);
     if (current2?.generation === savedGeneration) {
       current2.retryCount++;
@@ -9145,7 +9147,7 @@ var init_atomic_write = __esm({
     init_worker_atomic_writer();
     RETRYABLE_RENAME_CODES = /* @__PURE__ */ new Set(["EPERM", "EBUSY", "EACCES"]);
     RETRYABLE_LINK_CODES = /* @__PURE__ */ new Set(["EPERM", "EBUSY", "EACCES", "ENOENT"]);
-    SYMLINK_SAFE_TTL_MS = 3e4;
+    SYMLINK_SAFE_TTL_MS = 1e4;
     SYMLINK_SAFE_MAX_ENTRIES = 128;
     symlinkSafeCache = /* @__PURE__ */ new Map();
     __test__renameWithRetry = renameWithRetry;
@@ -15399,7 +15401,7 @@ function cancelOrphanedRuns(cwd, manifestCache2, currentSessionId, staleThreshol
     });
     if (cancelledRun)
       void terminateLiveAgentsForRun(manifest.runId, "cancelled", appendEvent, loaded.manifest.eventsPath).catch(
-        (error) => logInternalError("crash-recovery.orphan.terminate", error, `runId=${manifest.runId}`)
+        (error) => logInternalError("crash-recovery.orphan.terminate", error, `runId=${manifest.runId}`, "warn")
       );
   }
   return { cancelled, skipped };
@@ -15494,7 +15496,7 @@ function purgeStaleActiveRunIndex(staleThresholdMs = 3e5, now = Date.now()) {
               appendEvent,
               fullLoaded.manifest.eventsPath
             ).catch(
-              (error) => logInternalError("crash-recovery.pid-dead.terminate", error, `runId=${fullLoaded.manifest.runId}`)
+              (error) => logInternalError("crash-recovery.pid-dead.terminate", error, `runId=${fullLoaded.manifest.runId}`, "warn")
             );
           }
         } catch {
@@ -15539,7 +15541,7 @@ function purgeStaleActiveRunIndex(staleThresholdMs = 3e5, now = Date.now()) {
               appendEvent,
               fullLoaded.manifest.eventsPath
             ).catch(
-              (error) => logInternalError("crash-recovery.pid-dead.terminate", error, `runId=${fullLoaded.manifest.runId}`)
+              (error) => logInternalError("crash-recovery.pid-dead.terminate", error, `runId=${fullLoaded.manifest.runId}`, "warn")
             );
           }
         } catch {
@@ -15586,7 +15588,7 @@ function reconcileAllStaleRuns(cwd, manifestCache2, now = Date.now()) {
         }
         updateRunStatus(fresh.manifest, "failed", `Stale run reconciled: ${result4.detail}`);
         void terminateLiveAgentsForRun(fresh.manifest.runId, "failed", appendEvent, fresh.manifest.eventsPath).catch(
-          (error) => logInternalError("crash-recovery.reconcile.terminate", error, `runId=${fresh.manifest.runId}`)
+          (error) => logInternalError("crash-recovery.reconcile.terminate", error, `runId=${fresh.manifest.runId}`, "warn")
         );
         appendEvent(fresh.manifest.eventsPath, {
           type: "crew.run.reconciled_stale",
@@ -18376,7 +18378,8 @@ function killProcessPid(pid) {
           logInternalError(
             "child-pi.taskkill-stuck",
             new Error(`process ${pid} still alive 2s after taskkill /T /F; retrying`),
-            `pid=${pid}`
+            `pid=${pid}`,
+            "error"
           );
           try {
             spawnTaskkillSafe(pid);
@@ -44860,13 +44863,9 @@ var init_skill_instructions = __esm({
       critic: ["read-only-explorer", "multi-perspective-review"],
       executor: ["state-mutation-locking", "safe-bash", "verification-before-done"],
       reviewer: ["read-only-explorer", "multi-perspective-review"],
-      // SECURITY NOTE: The following skill names are trusted package-level skills.
-      // If a project has a skills/ directory containing subdirectories with these names,
-      // those project-level SKILL.md files will be FOUND FIRST (readSkillMarkdown checks
-      // project dir before package dir) and their content injected verbatim into prompts.
-      // The "Applicable Skills" block will add an untrusted-content warning for project skills,
-      // but be aware this is a potential supply-chain risk in multi-contributor projects.
       "security-reviewer": ["secure-agent-orchestration-review", "ownership-session-security"],
+      // SECURITY NOTE: Package skills are checked FIRST (SEC-003). Project-level
+      // skills with the same name will NOT override the trusted package version.
       "test-engineer": ["verification-before-done", "safe-bash"],
       verifier: ["verification-before-done", "runtime-state-reader"],
       writer: ["context-artifact-hygiene", "verification-before-done"]
@@ -47999,7 +47998,7 @@ async function spawnBackgroundTeamRun(manifest) {
   const loader = resolveTypeScriptLoader();
   if (!loader) {
     const message = buildLoaderUnavailableMessage(packageRootFromRuntime());
-    appendEvent(manifest.eventsPath, {
+    await appendEventAsync(manifest.eventsPath, {
       type: "async.failed",
       runId: manifest.runId,
       message
@@ -57483,6 +57482,7 @@ function updateTask(tasks, updated) {
   return tasks.map((task) => task.id === updated.id ? updated : task);
 }
 function persistSingleTaskUpdate(manifest, fallbackTasks, updated, checkpointPhase) {
+  const MAX_CAS_ATTEMPTS = 100;
   let baseMtime = 0;
   try {
     baseMtime = fs80.statSync(manifest.tasksPath).mtimeMs;
@@ -57499,7 +57499,7 @@ function persistSingleTaskUpdate(manifest, fallbackTasks, updated, checkpointPha
   } : updated;
   try {
     return withRunLockSync(manifest, () => {
-      for (let attempt = 0; attempt < 100; attempt++) {
+      for (let attempt = 0; attempt < MAX_CAS_ATTEMPTS; attempt++) {
         flushPendingAtomicWrites();
         const latest = loadRunManifestById(manifest.cwd, manifest.runId)?.tasks ?? fallbackTasks;
         merged = updateTask(latest, taskWithCheckpoint);
@@ -57516,20 +57516,25 @@ function persistSingleTaskUpdate(manifest, fallbackTasks, updated, checkpointPha
         break;
       }
       if (merged === void 0) {
-        logInternalError("persistSingleTaskUpdate", new Error("failed to converge after 50 attempts"));
-        throw new Error("persistSingleTaskUpdate: failed to converge after 50 attempts");
+        logInternalError(
+          "persistSingleTaskUpdate",
+          new Error(`failed to converge after ${MAX_CAS_ATTEMPTS} attempts`),
+          void 0,
+          "error"
+        );
+        throw new Error(`persistSingleTaskUpdate: failed to converge after ${MAX_CAS_ATTEMPTS} attempts`);
       }
       try {
         saveRunTasksCoalesced(manifest, merged);
       } catch (err2) {
-        logInternalError("persistSingleTaskUpdate", err2);
+        logInternalError("persistSingleTaskUpdate", err2, void 0, "error");
         throw err2;
       }
       return merged;
     });
   } catch (err2) {
     if (merged === void 0) {
-      logInternalError("persistSingleTaskUpdate", err2);
+      logInternalError("persistSingleTaskUpdate", err2, void 0, "error");
     }
     throw err2;
   }
@@ -60356,7 +60361,8 @@ async function executeTeamRun(input) {
       logInternalError(
         "team-runner.goalAchievement.falseGreen",
         new Error(gaApplied.manifest.goalAchievementNote ?? "false-green detected"),
-        `runId=${manifest.runId}`
+        `runId=${manifest.runId}`,
+        "error"
       );
     stopTeamHeartbeat();
     resolveRunPromise(manifest.runId, result4);