pi-crew 0.9.38 → 0.9.40

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "pi-crew",
-  "version": "0.9.38",
+  "version": "0.9.40",
   "description": "Pi extension for coordinated AI teams, workflows, worktrees, and async task orchestration",
   "author": "baphuongna",
   "license": "MIT",

package/src/extension/register.ts

@@ -702,6 +702,58 @@ export function registerPiTeams(pi: ExtensionAPI): void {
 		};
 	});
 
+	/**
+	 * Cleanup session resources WITHOUT aborting foreground team runs.
+	 * Used during session switch (reason="resume"/"new"/"fork") to let foreground
+	 * runs complete naturally when the session context is torn down.
+	 */
+	const cleanupSessionResourcesOnly = (): void => {
+		if (cleanedUp) return;
+		cleanedUp = true;
+		if (preloadTimer) {
+			clearTimeout(preloadTimer);
+			preloadTimer = undefined;
+		}
+		crewRunWatchers?.closeAll();
+		crewRunWatchers = undefined;
+		userCrewWatchers?.closeAll();
+		userCrewWatchers = undefined;
+		stopSessionBoundSubagents();
+		// P0 fix: Do NOT abort foreground team runs on session switch.
+		// Foreground team runs run in the same process as the session; they naturally clean up
+		// when the session context is torn down. Only subagents need explicit abort on switch.
+		// Foreground runs will be aborted by cleanupRuntime() during actual session shutdown.
+		crewScheduler?.stop();
+		stopAsyncRunNotifier(notifierState);
+
+		// P0: Purge all stale active-run-index entries on session cleanup.
+		purgeStaleActiveRunIndexSyncIfLoaded();
+
+		stopCrewWidget(currentCtx, widgetState, currentCtx ? loadConfig(currentCtx.cwd).config.ui : undefined);
+		clearPiCrewPowerbar(pi.events);
+		disposePowerbarCoalescer();
+		disposeObservability(observabilityState, cleanedUp);
+		lifecycleState.deliveryCoordinator?.dispose();
+		clearHooksScoped();
+		uninstallCrewGlobalRegistry();
+		lifecycleState.overflowTracker?.dispose();
+		lifecycleState.deliveryCoordinator = undefined;
+		lifecycleState.overflowTracker = undefined;
+		manifestCache.dispose();
+		runSnapshotCache.dispose?.();
+		clearProjectRootCache();
+		renderScheduler?.dispose();
+		renderScheduler = undefined;
+		autoRecoveryLast.clear();
+		disposeNotifications(lifecycleState);
+		rpcHandle?.unsubscribe();
+		rpcHandle = undefined;
+		disposeI18n();
+		sessionGeneration += 1;
+		currentCtx = undefined;
+		if (globalStore[runtimeCleanupStoreKey] === cleanupSessionResourcesOnly) delete globalStore[runtimeCleanupStoreKey];
+	};
+
 	const cleanupRuntime = (): void => {
 		if (cleanedUp) return;
 		cleanedUp = true;
@@ -774,6 +826,20 @@ export function registerPiTeams(pi: ExtensionAPI): void {
 	};
 	globalStore[runtimeCleanupStoreKey] = cleanupRuntime;
 
+	// P0 fix: Check session_shutdown reason to determine whether to abort foreground runs.
+	// - reason="quit" or "reload": Actual shutdown — abort foreground runs.
+	// - reason="resume"/"new"/"fork": Session switch — let foreground runs complete.
+	pi.on("session_shutdown", (event) => {
+		const reason = typeof event === "object" && event !== null && "reason" in event ? (event as { reason: string }).reason : undefined;
+		if (reason === "quit" || reason === "reload") {
+			// Actual shutdown — abort foreground runs and cleanup everything
+			cleanupRuntime();
+		} else {
+			// Session switch (resume/new/fork) — cleanup resources but preserve foreground runs
+			cleanupSessionResourcesOnly();
+		}
+	});
+
 	pi.on("session_start", (_event, ctx) => {
 		runArtifactCleanup(ctx.cwd);
 
@@ -1385,7 +1451,6 @@ export function registerPiTeams(pi: ExtensionAPI): void {
 		stopAsyncRunNotifier(notifierState);
 		stopSessionBoundSubagents();
 	});
-	pi.on("session_shutdown", () => cleanupRuntime());
 
 	// Phase 11a: Dynamic resource discovery — inject pi-crew skill paths.
 	try {

package/src/runtime/run-coalesced-task-group.ts

@@ -14,7 +14,7 @@ import path from "node:path";
 import type { AgentConfig } from "../agents/agent-config.ts";
 import { writeArtifact } from "../state/artifact-store.ts";
 import { appendEventAsync } from "../state/event-log.ts";
-import { saveRunTasks, updateRunStatus } from "../state/state-store.ts";
+import { saveRunTasksAsync, updateRunStatus } from "../state/state-store.ts";
 import type { TeamRunManifest, TeamTaskState } from "../state/types.ts";
 import type { WorkflowStep } from "../workflows/workflow-config.ts";
 import { runChildPi } from "./child-pi.ts";
@@ -62,7 +62,7 @@ export async function runCoalescedTaskGroup(input: CoalescedTaskGroupInput): Pro
 		}
 		return t;
 	});
-	saveRunTasks(manifest, updatedTasks);
+	await saveRunTasksAsync(manifest, updatedTasks);
 	await appendEventAsync(manifest.eventsPath, {
 		type: "task.coalesced_dispatch_start",
 		runId: manifest.runId,
@@ -87,7 +87,7 @@ export async function runCoalescedTaskGroup(input: CoalescedTaskGroupInput): Pro
 			heartbeat: t.heartbeat ?? createWorkerHeartbeat(t.id),
 		};
 	});
-	saveRunTasks(manifest, updatedTasks);
+	await saveRunTasksAsync(manifest, updatedTasks);
 
 	let rawOutput = "";
 	let success = false;
@@ -98,7 +98,7 @@ export async function runCoalescedTaskGroup(input: CoalescedTaskGroupInput): Pro
 		// Heartbeat refresher: touch every task's heartbeat every 15s while the
 		// worker is alive. Set `alive: true` explicitly so post-completion
 		// staleness checks immediately recognize liveness.
-		const heartbeatTimer = setInterval(() => {
+		const heartbeatTimer = setInterval(async () => {
 			const now = new Date().toISOString();
 			updatedTasks = updatedTasks.map((t) => {
 				if (!taskIds.includes(t.id)) return t;
@@ -108,7 +108,7 @@ export async function runCoalescedTaskGroup(input: CoalescedTaskGroupInput): Pro
 				};
 			});
 			try {
-				saveRunTasks(manifest, updatedTasks);
+				await saveRunTasksAsync(manifest, updatedTasks);
 			} catch {
 				// Run may have been pruned mid-dispatch — best-effort only.
 			}
@@ -168,7 +168,7 @@ export async function runCoalescedTaskGroup(input: CoalescedTaskGroupInput): Pro
 			resultArtifact,
 		};
 	});
-	saveRunTasks(manifest, updatedTasks);
+	await saveRunTasksAsync(manifest, updatedTasks);
 	let updatedManifest: TeamRunManifest = {
 		...manifest,
 		artifacts: mergeArtifacts([...manifest.artifacts, ...newArtifacts]),

package/src/runtime/stale-reconciler.ts

@@ -70,7 +70,7 @@ function checkResultFile(manifest: TeamRunManifest, tasks: TeamTaskState[]): { f
 		// All tasks are terminal but manifest status was not updated — repair it.
 		// Derive the run status from task outcomes instead of blindly marking
 		// "completed": a run where every task failed/cancelled is NOT a success.
-		const hasFailed = tasks.some((t) => t.status === "failed");
+		const hasFailed = tasks.some((t) => t.status === "failed" || t.status === "needs_attention");
 		const onlyCancelledOrSkipped = tasks.every((t) => t.status === "cancelled" || t.status === "skipped");
 		manifest.status = hasFailed ? "failed" : onlyCancelledOrSkipped ? "cancelled" : "completed";
 		// Persist manifest status change immediately to make checkResultFile self-contained.

package/src/state/locks.ts

@@ -79,6 +79,29 @@ function isLockHolderAlive(filePath: string): boolean {
  * Returns `{ canSteal: true }` if the lock is stale OR the holder is dead
  * (safe to forcibly remove); `{ canSteal: false }` if it is fresh AND held by
  * a live process (must keep waiting).
+ *
+ * ## EPERM Handling (Accepted Risk)
+ *
+ * When `process.kill(pid, 0)` returns EPERM, it means the holder process
+ * EXISTS but we lack permission to signal it. We treat this as "not alive"
+ * (stealable) because:
+ *
+ * 1. **Blocking indefinitely is worse** — on shared systems, a holder running
+ *    under a different user/permission context would block us forever.
+ * 2. **EPERM requires elevated privileges** — on single-user workstations
+ *    (the typical pi-crew environment), EPERM is rare.
+ * 3. **Defense in depth** — the lock staleness check provides a secondary
+ *    safeguard; we only steal if the lock is also stale.
+ *
+ * **Trade-off:** On multi-user systems, this could theoretically allow two
+ * processes in the critical section simultaneously if: (a) holder is alive
+ * under different permissions, AND (b) our steal attempt races with holder's
+ * release. The practical risk is low because:
+ * - Lock holders typically complete quickly
+ * - Stale timeout provides a safety window
+ * - Critical sections are designed to tolerate rare races
+ *
+ * See also: SECURITY-ISSUES.md SEC-008 for documented acceptance.
  */
 function readLockSnapshot(filePath: string, staleMs: number): { canSteal: boolean } {
 	let stat: fs.Stats | undefined;

package/src/state/state-store.ts

@@ -203,6 +203,9 @@ function validateRunManifestPaths(cwd: string, runId: string, manifest: TeamRunM
 }
 
 export function createRunPaths(cwd: string, runId = createRunId()): RunPaths {
+	if (!cwd || typeof cwd !== "string") {
+		throw new Error(`Invalid cwd: ${cwd}`);
+	}
 	assertSafePathId("runId", runId);
 	const baseRoot = scopeBaseRoot(cwd);
 	const stateRoot = resolveContainedRelativePath(path.join(baseRoot, DEFAULT_PATHS.state.runsSubdir), runId, "runId");