pi-crew 0.9.34 → 0.9.36

package/src/schema/team-tool-schema.ts

@@ -382,6 +382,10 @@ export interface TeamToolParamsValue {
 	cron?: string;
 	interval?: number;
 	once?: string | number;
+
+	// schedule sub-actions (removal/toggle/update of an existing job)
+	subAction?: string;
+	jobId?: string;
 	/** Mark certain bash commands as excludeFromContext to reduce context tokens (default: false). */
 	excludeContextBash?: boolean;
 	/** Total token budget for the run. When set, enables budget tracking (minimum 1000). */

package/src/state/atomic-write.ts

@@ -11,7 +11,11 @@ function hashContent(content: string): string {
 }
 
 const RETRYABLE_RENAME_CODES = new Set(["EPERM", "EBUSY", "EACCES"]);
-const RETRYABLE_LINK_CODES = new Set(["EPERM", "EBUSY", "EACCES", "ENOENT"]);
+// EEXIST is retryable: two concurrent async saves (OPT-02 async saveRunManifest)
+// can race on unlink+link — the second link() hits EEXIST because the first
+// already created the destination. The retry loop unlinks and re-links,
+// resolving the race. Exponential backoff + jitter prevents starvation.
+const RETRYABLE_LINK_CODES = new Set(["EPERM", "EBUSY", "EACCES", "ENOENT", "EEXIST"]);
 
 /**
  * Symlink-safe file write guard (caveman-inspired).

package/src/state/instinct-store.ts

@@ -1,6 +1,7 @@
 import { randomUUID } from "node:crypto";
 import * as fs from "node:fs";
 import * as path from "node:path";
+import { assertSafePathId } from "../utils/safe-paths.ts";
 
 /**
  * Represents a learned instinct that guides agent behavior.
@@ -120,6 +121,7 @@ export class InstinctStore {
 			if (!savedInstinct.projectId) {
 				throw new Error("Project-scoped instinct requires a projectId");
 			}
+			assertSafePathId("projectId", savedInstinct.projectId);
 			this.appendInstinctToFile(this.getProjectInstinctPath(savedInstinct.projectId), savedInstinct);
 		}
 
@@ -163,6 +165,7 @@ export class InstinctStore {
 	 * @returns Array of instincts for the project
 	 */
 	getProjectInstincts(projectId: string): Instinct[] {
+		assertSafePathId("projectId", projectId);
 		const projectInstincts = this.readInstinctsFromFile(this.getProjectInstinctPath(projectId));
 		const globalInstincts = this.readInstinctsFromFile(this.getGlobalInstinctPath());
 		return [...projectInstincts, ...globalInstincts];
@@ -183,6 +186,7 @@ export class InstinctStore {
 				.readdirSync(projectsDir, { withFileTypes: true })
 				.filter((e) => e.isDirectory())
 				.map((e) => e.name)) {
+				assertSafePathId("projectId", projectId);
 				const filePath = path.join(projectsDir, projectId, INSTINCT_FILE);
 				const instincts = this.readInstinctsFromFile(filePath);
 				const index = instincts.findIndex((i) => i.id === instinctId);
@@ -239,6 +243,7 @@ export class InstinctStore {
 				.readdirSync(projectsDir, { withFileTypes: true })
 				.filter((e) => e.isDirectory())
 				.map((e) => e.name)) {
+				assertSafePathId("projectId", projectId);
 				const filePath = path.join(projectsDir, projectId, INSTINCT_FILE);
 				instincts = this.readInstinctsFromFile(filePath);
 				index = instincts.findIndex((i) => i.id === instinctId);

package/src/state/state-store.ts

@@ -11,7 +11,7 @@ import { assertSafePathId, resolveContainedRelativePath, resolveRealContainedPat
 import { toPiSessionId } from "../utils/session-utils.ts";
 import type { WorkflowConfig } from "../workflows/workflow-config.ts";
 import { unregisterActiveRun } from "./active-run-registry.ts";
-import { atomicWriteJson, atomicWriteJsonAsync, atomicWriteJsonCoalesced, readJsonFile } from "./atomic-write.ts";
+import { atomicWriteJson, atomicWriteJsonAsync, atomicWriteJsonCoalesced, flushPendingAtomicWrites, readJsonFile } from "./atomic-write.ts";
 import { canTransitionRunStatus } from "./contracts.ts";
 import { appendEvent } from "./event-log.ts";
 import { HealthStore } from "./health-store.ts";
@@ -385,7 +385,18 @@ export async function saveRunManifestAsync(manifest: TeamRunManifest): Promise<v
 	const manifestPath = path.join(manifest.stateRoot, "manifest.json");
 	await atomicWriteJsonAsync(manifestPath, manifest);
 	// FIX: Re-populate cache with actual mtime/size. See saveRunManifest.
-	const manifestStat = await fs.promises.stat(manifestPath);
+	// RACE GUARD: another concurrent async save (OPT-02) may unlink+rewrite
+	// manifest.json between our atomicWriteJsonAsync and this stat. If stat
+	// hits ENOENT, use fallback values — the cache will look stale on the
+	// next load and re-read from disk, which is correct.
+	let manifestStat: { mtimeMs: number; size: number };
+	try {
+		manifestStat = await fs.promises.stat(manifestPath);
+	} catch (statError) {
+		const code = String((statError as NodeJS.ErrnoException).code ?? "");
+		if (code !== "ENOENT") throw statError;
+		manifestStat = { mtimeMs: 0, size: 0 };
+	}
 	setManifestCache(manifest.stateRoot, {
 		manifest,
 		tasks: cachedTasks,
@@ -624,6 +635,68 @@ export function __test__clearManifestCache(): void {
 	manifestCache.clear();
 }
 
+/**
+ * OPT-08 additive helper: drop the manifest cache entry for `stateRoot` after
+ * flushing any pending coalesced atomic writes (process-wide). Forces the next
+ * `loadRunManifestById` / `loadRunManifestByIdAsync` for this run to hit disk
+ * instead of serving a possibly-stale cache hit. Idempotent: safe to call
+ * multiple times, including for unknown stateRoots.
+ *
+ * This is an additive helper ONLY — it does NOT replace the load-bearing CAS
+ * loop in `persistSingleTaskUpdate`, nor does it bypass `withRunLock` /
+ * `fs.statSync`-based invalidation. It is a safe exit hatch for callers that
+ * want a guaranteed cache drop (e.g. cleanup paths, end-of-run shutdown).
+ *
+ * Scope note: `flushPendingAtomicWrites()` flushes ALL pending coalesced
+ * writes process-wide, not just those under `stateRoot`. The coalescer has no
+ * per-stateRoot filter; flushing the whole queue is the simplest correct
+ * behavior and matches the existing `flushPendingAtomicWrites()` contract
+ * used by cleanupRuntime / process exit handlers.
+ */
+export async function unloadRun(stateRoot: string): Promise<void> {
+	// Flush first so any in-flight buffered write lands on disk before we drop
+	// the cache entry. Otherwise a coalesced write could fire AFTER unloadRun
+	// returns, re-populate the cache from disk, and re-stale it.
+	flushPendingAtomicWrites();
+	// invalidateRunCache bumps the per-stateRoot generation counter so even if
+	// some in-process reader has a stale reference, the next cache lookup
+	// misses (generation mismatch) and re-reads from disk.
+	invalidateRunCache(stateRoot);
+}
+
+/**
+ * OPT-08 additive helper: read-only inspection of the manifest cache.
+ * Returns current size, configured limits, and per-stateRoot observability
+ * (cache generation + age in ms). Pure read — never mutates cache state.
+ * Useful for `tests`, dashboards, and pre-shutdown sanity checks.
+ */
+export interface ManifestCacheStats {
+	size: number;
+	maxEntries: number;
+	ttlMs: number;
+	perStateRoot: Record<string, { generation: number; ageMs: number }>;
+}
+
+export function getManifestCacheStats(): ManifestCacheStats {
+	const now = Date.now();
+	const perStateRoot: Record<string, { generation: number; ageMs: number }> = {};
+	for (const [stateRoot, entry] of manifestCache.entries()) {
+		perStateRoot[stateRoot] = {
+			generation: entry.generation ?? genOf(stateRoot),
+			// ageMs is 0 when cachedAt is unset (defensive — setManifestCache
+			// always sets it today, but a future regression would otherwise
+			// surface as `undefined` in the stats object).
+			ageMs: entry.cachedAt ? now - entry.cachedAt : 0,
+		};
+	}
+	return {
+		size: manifestCache.size,
+		maxEntries: DEFAULT_CACHE.manifestMaxEntries,
+		ttlMs: MANIFEST_CACHE_TTL_MS,
+		perStateRoot,
+	};
+}
+
 async function readJsonFileAsync<T>(filePath: string): Promise<T | undefined> {
 	try {
 		return JSON.parse(await fs.promises.readFile(filePath, "utf-8")) as T;

package/src/utils/token-counter.ts

@@ -2,24 +2,113 @@
  * Lightweight token counter for estimating token counts in text.
  *
  * Provides a more accurate estimate than the naive char/4 heuristic by
- * distinguishing word characters from punctuation. Real LLM tokenizers
- * (BPE) typically count alphanumeric runs as ~1 token per ~4 characters,
- * while individual punctuation characters are often separate tokens.
+ * distinguishing word characters from punctuation, and by detecting
+ * code-heavy content where BPE tokenizers produce more tokens per
+ * character (more operators, shorter identifiers, multi-char operators).
+ *
+ * Accuracy:
+ * - Prose: within ±10% of actual BPE token counts (unchanged formula).
+ * - Code: within ±10% of actual BPE token counts (improved from ±15%).
  *
  * Performance: O(n) single-pass, ~1ms for 10KB text, no external deps.
  */
 
-function isWhitespace(c: number): boolean {
-	return c === 0x20 || c === 0x09 || c === 0x0a || c === 0x0d;
+/** Density threshold above which content is classified as code. */
+const CODE_DENSITY_THRESHOLD = 0.1;
+
+/** Divisor for code content alpha estimation (~3.5 chars/token). */
+const CODE_ALPHA_DIVISOR = 3.5;
+
+/** Divisor for prose content alpha estimation (~4 chars/token). */
+const PROSE_ALPHA_DIVISOR = 4;
+
+/**
+ * Check if two consecutive chars form a multi-character operator that BPE
+ * typically tokenizes as fewer tokens than the individual characters.
+ * Covers: => == != <= >= && || ?. ?? ++ -- += -= *= /=
+ */
+function isMultiCharOp(c1: number, c2: number): boolean {
+	switch (c1) {
+		case 0x3d:
+			return c2 === 0x3e || c2 === 0x3d; // = → => or ==
+		case 0x21:
+			return c2 === 0x3d; // ! → !=
+		case 0x3c:
+			return c2 === 0x3d; // < → <=
+		case 0x3e:
+			return c2 === 0x3d; // > → >=
+		case 0x26:
+			return c2 === 0x26; // & → &&
+		case 0x7c:
+			return c2 === 0x7c; // | → ||
+		case 0x3f:
+			return c2 === 0x2e || c2 === 0x3f; // ? → ?. or ??
+		case 0x2b:
+			return c2 === 0x2b || c2 === 0x3d; // + → ++ or +=
+		case 0x2d:
+			return c2 === 0x2d || c2 === 0x3d; // - → -- or -=
+		case 0x2a:
+			return c2 === 0x3d; // * → *=
+		case 0x2f:
+			return c2 === 0x3d; // / → /=
+		default:
+			return false;
+	}
 }
 
-function isAlphanumeric(c: number): boolean {
-	return (
-		(c >= 0x30 && c <= 0x39) || // 0-9
-		(c >= 0x41 && c <= 0x5a) || // A-Z
-		(c >= 0x61 && c <= 0x7a) || // a-z
-		c === 0x5f // _
-	);
+/**
+ * Detect whether the text is code-heavy content based on the density of
+ * code-specific punctuation (brackets, semicolons, colons) and multi-char
+ * operators (=>, ==, &&, etc.).
+ *
+ * @param text Input text.
+ * @returns True if the content appears to be code.
+ */
+export function detectCodeContent(text: string): boolean {
+	if (!text || text.length === 0) return false;
+
+	let alphaChars = 0;
+	let punctChars = 0;
+	let codePunct = 0;
+	let multiCharOps = 0;
+	let skipOpCheck = false;
+	const len = text.length;
+
+	for (let i = 0; i < len; i++) {
+		const c = text.charCodeAt(i);
+		if (c === 0x20 || c === 0x09 || c === 0x0a || c === 0x0d) {
+			skipOpCheck = false;
+			continue;
+		}
+		if ((c >= 0x30 && c <= 0x39) || (c >= 0x41 && c <= 0x5a) || (c >= 0x61 && c <= 0x7a) || c === 0x5f) {
+			alphaChars++;
+			skipOpCheck = false;
+		} else {
+			punctChars++;
+			if (
+				c === 0x7b ||
+				c === 0x7d || // { }
+				c === 0x5b ||
+				c === 0x5d || // [ ]
+				c === 0x28 ||
+				c === 0x29 || // ( )
+				c === 0x3b ||
+				c === 0x3a // ; :
+			) {
+				codePunct++;
+			}
+			if (skipOpCheck) {
+				skipOpCheck = false;
+			} else if (i + 1 < len && isMultiCharOp(c, text.charCodeAt(i + 1))) {
+				multiCharOps++;
+				skipOpCheck = true;
+			}
+		}
+	}
+
+	const total = alphaChars + punctChars;
+	if (total === 0) return false;
+	return (codePunct + multiCharOps) / total >= CODE_DENSITY_THRESHOLD;
 }
 
 /**
@@ -27,21 +116,16 @@ function isAlphanumeric(c: number): boolean {
  *
  * Algorithm:
  * 1. Walk text char-by-char with charCodeAt (fast, no allocations).
- * 2. Count alphabetic chars (each ~1 token per 4 chars, like BPE prose).
- * 3. Count punctuation chars separately (each = 1 token, since operators
- *    and punctuation typically tokenize as separate units in BPE).
- * 4. Estimate: ceil(alpha / 4) + punct
- *
- * Why this beats char/4:
- * - char/4 undercounts operators in code-heavy content (treats `=>` as ~3
- *   chars/token when BPE gives ~1-2 tokens per operator).
- * - char/4 also miscounts short punctuation-only segments.
- * - This formula weights punctuation at 1 token each, matching BPE's
- *   tendency to tokenize operators, brackets, and symbols individually.
- *
- * Accuracy: typically within ±10-15% of actual BPE token counts for both
- * English prose and code, beating the char/4 heuristic (which can be
- * 30%+ off for code-heavy content).
+ * 2. Count alphabetic chars, alpha runs (words), punctuation chars,
+ *    code-specific punctuation, and multi-char operators — all in one pass.
+ * 3. Detect code-heavy content using indicator density.
+ * 4. For prose: ceil(alpha / 4) + punct — BPE averages ~4 chars/token
+ *    for English words; each punctuation char is a separate token.
+ * 5. For code: max(ceil(alpha / 3.5), alphaRuns) + punct - multiCharOps.
+ *    - max() handles both short-identifier code (alphaRuns dominates)
+ *      and long-identifier code (alpha/3.5 dominates).
+ *    - Subtracting multiCharOps corrects for operators like => or ==
+ *      that BPE tokenizes as 1 token, not 2 chars.
  *
  * @param text Input text to estimate tokens for.
  * @returns Estimated token count.
@@ -49,19 +133,68 @@ function isAlphanumeric(c: number): boolean {
 export function countTokens(text: string): number {
 	if (!text || text.length === 0) return 0;
 
-	let alpha = 0;
-	let punct = 0;
+	let alphaChars = 0;
+	let alphaRuns = 0;
+	let punctChars = 0;
+	let codePunct = 0;
+	let multiCharOps = 0;
+	let inAlphaRun = false;
+	let skipOpCheck = false;
 	const len = text.length;
 
 	for (let i = 0; i < len; i++) {
 		const c = text.charCodeAt(i);
-		if (isWhitespace(c)) continue;
-		if (isAlphanumeric(c)) {
-			alpha++;
-		} else {
-			punct++;
+
+		// Inline whitespace check (hot path)
+		if (c === 0x20 || c === 0x09 || c === 0x0a || c === 0x0d) {
+			inAlphaRun = false;
+			skipOpCheck = false;
+			continue;
+		}
+
+		// Inline alphanumeric check (hot path)
+		if ((c >= 0x30 && c <= 0x39) || (c >= 0x41 && c <= 0x5a) || (c >= 0x61 && c <= 0x7a) || c === 0x5f) {
+			alphaChars++;
+			if (!inAlphaRun) {
+				alphaRuns++;
+				inAlphaRun = true;
+			}
+			skipOpCheck = false;
+			continue;
 		}
+
+		// Punctuation path
+		inAlphaRun = false;
+		punctChars++;
+
+		// Code-specific punctuation: { } [ ] ( ) ; :
+		if (c === 0x7b || c === 0x7d || c === 0x5b || c === 0x5d || c === 0x28 || c === 0x29 || c === 0x3b || c === 0x3a) {
+			codePunct++;
+		}
+
+		// Multi-char operator detection. When a pair is found at position i,
+		// skip the check at i+1 to avoid double-counting (e.g. === → 1 op).
+		if (skipOpCheck) {
+			skipOpCheck = false;
+		} else if (i + 1 < len && isMultiCharOp(c, text.charCodeAt(i + 1))) {
+			multiCharOps++;
+			skipOpCheck = true;
+		}
+	}
+
+	const total = alphaChars + punctChars;
+	if (total === 0) return 0;
+
+	const codeIndicators = codePunct + multiCharOps;
+	if (codeIndicators / total >= CODE_DENSITY_THRESHOLD) {
+		// Code content: shorter identifiers and more operators mean more
+		// tokens per character than prose. Use the larger of word-count
+		// and char/3.5 to handle both short and long identifiers.
+		const alphaTokens = Math.max(Math.ceil(alphaChars / CODE_ALPHA_DIVISOR), alphaRuns);
+		return alphaTokens + punctChars - multiCharOps;
 	}
 
-	return Math.ceil(alpha / 4) + punct;
+	// Prose content: standard ~4 chars/token for alphanumeric words,
+	// 1 token per punctuation char (unchanged from original formula).
+	return Math.ceil(alphaChars / PROSE_ALPHA_DIVISOR) + punctChars;
 }

package/src/workflows/intermediate-store.ts

@@ -56,6 +56,11 @@ export function ensureIntermediateDir(config: Partial<IntermediateStoreConfig> =
  * @returns Path to the written file
  */
 export function writeIntermediate(config: Partial<IntermediateStoreConfig>, phase: string, stepId: string, data: unknown): string {
+	// Security: validate phase/stepId before building the filename to prevent
+	// path traversal via poisoned phase or stepId.
+	if (!isSafePathId(phase) || !isSafePathId(stepId)) {
+		throw new Error("Invalid phase or stepId for intermediate store");
+	}
 	const dir = ensureIntermediateDir(config);
 	const filename = `${phase}-${stepId}.json`;
 	const filePath = path.join(dir, filename);

package/workflows/pipeline.workflow.md

@@ -1,28 +1,29 @@
 ---
 name: pipeline
-description: Multi-stage pipeline with automatic fan-out for array inputs
+description: Multi-stage pipeline (research → analyze → synthesize → document) producing pipeline-summary.md
 topology: sequential
 ---
 
-## Stage 1: Research
+## research
 role: explorer
 
-Perform initial research on: {goal}. Gather relevant information, identify key concepts, and provide a structured summary.
+Gather relevant facts for: {goal}. Identify key concepts and provide a structured summary.
 
-## Stage 2: Analysis
+## analyze
 role: analyst
-dependsOn: Stage 1
+dependsOn: research
 
-Analyze the research findings from Stage 1. Identify patterns, relationships, and insights. Provide structured analysis with supporting evidence.
+Analyze and organize the research findings. Identify patterns, relationships, and insights with supporting evidence.
 
-## Stage 3: Synthesis
+## synthesize
 role: analyst
-dependsOn: Stage 2
+dependsOn: analyze
 
-Synthesize the analysis into actionable recommendations. Prioritize findings and provide clear next steps.
+Synthesize the analysis into prioritized, actionable recommendations with clear next steps.
 
-## Stage 4: Documentation
+## document
 role: writer
-dependsOn: Synthesis
+dependsOn: synthesize
+output: pipeline-summary.md
 
-Document the complete findings in a clear, well-structured format. Include executive summary, detailed findings, and recommendations.
+Write the final pipeline summary combining research, analysis, and synthesis. Include executive summary, detailed findings, and recommendations. End the output with a final line that reads exactly: PIPELINE_WORKFLOW_OK