pi-crew 0.9.40 → 0.9.42

package/src/runtime/live-agent-manager.ts

@@ -2,6 +2,7 @@ import type { appendEvent } from "../state/event-log.ts";
 import { logInternalError } from "../utils/internal-error.ts";
 import type { CrewAgentRecord } from "./crew-agent-runtime.ts";
 import type { IrcMessage } from "./live-irc.ts";
+import { checkProcessLiveness } from "./process-status.ts";
 
 const MAX_PENDING_MESSAGES = 1000;
 
@@ -83,14 +84,6 @@ export function listLiveAgentsByWorkspace(workspaceId: string): LiveAgentHandle[
 	return listLiveAgents().filter((a) => a.workspaceId === workspaceId);
 }
 
-/**
- * List only active agents (running/queued/waiting) for a specific workspace.
- */
-/** @internal */
-function listActiveLiveAgentsByWorkspace(workspaceId: string): LiveAgentHandle[] {
-	return listActiveLiveAgents().filter((a) => a.workspaceId === workspaceId);
-}
-
 export function registerLiveAgent(
 	input: Omit<LiveAgentHandle, "createdAt" | "updatedAt" | "pendingSteers" | "pendingFollowUps" | "pendingMessages" | "activity"> & {
 		workspaceId: string;
@@ -189,15 +182,6 @@ function safeDisposeLiveSession(handle: LiveAgentHandle): void {
 	}
 }
 
-/** @internal */
-function removeLiveAgentHandle(agentId: string): LiveAgentHandle | undefined {
-	const handle = liveAgents.get(agentId);
-	if (!handle) return undefined;
-	liveAgents.delete(agentId);
-	safeDisposeLiveSession(handle);
-	return handle;
-}
-
 export function disposeLiveAgentSession(agentIdOrTaskId: string): void {
 	const handle = getLiveAgent(agentIdOrTaskId);
 	if (!handle) return;
@@ -280,10 +264,16 @@ export function evictStaleLiveAgentHandles(now = Date.now()): number {
 				evicted++;
 			}
 		} else if (age > STALE_RUNNING_HANDLE_MS) {
-			// Active-status handle with no update for 30min — presumed dead
-			liveAgents.delete(agentId);
-			safeDisposeLiveSession(handle);
-			evicted++;
+			// Active-status handle with no update for 30min — check process liveness
+			// before evicting. Only evict if the process is dead, to avoid evicting
+			// slow-but-alive agents.
+			const sessionPid = (handle.session as Record<string, unknown>)?.pid as number | undefined;
+			const liveness = checkProcessLiveness(sessionPid);
+			if (!liveness.alive) {
+				liveAgents.delete(agentId);
+				safeDisposeLiveSession(handle);
+				evicted++;
+			}
 		}
 	}
 	return evicted;
@@ -299,7 +289,7 @@ export function listActiveLiveAgents(): LiveAgentHandle[] {
 
 export function getLiveAgentContextPercent(agentIdOrTaskId: string): number | null {
 	const handle = getLiveAgent(agentIdOrTaskId);
-	if (!handle || handle.status !== "running") return null;
+	if (handle?.status !== "running") return null;
 	try {
 		return handle.session.getSessionStats?.().contextUsage?.percent ?? null;
 	} catch {
@@ -492,16 +482,6 @@ export function broadcastIrcMessage(fromAgentId: string, message: IrcMessage): s
 	return recipients;
 }
 
-/** Phase 7: Get pending IRC messages for an agent (and clear them). */
-/** @internal */
-function drainIrcMessages(agentIdOrTaskId: string): IrcMessage[] {
-	const handle = getLiveAgent(agentIdOrTaskId);
-	if (!handle) return [];
-	const messages = [...handle.pendingMessages];
-	handle.pendingMessages.length = 0;
-	return messages;
-}
-
 /* ── IRC reply support (side-channel Q&A) ─────────────────────────── */
 
 /** Default timeout for awaiting a side-channel reply (60s). */

package/src/runtime/live-extension-bridge.ts

@@ -29,8 +29,6 @@
  *   - setActiveTools / getActiveTools / getAllTools
  */
 
-import type { YieldResult } from "./yield-handler.ts";
-
 export interface ExtensionBridgeApis {
 	sendMessage: (message: unknown, options?: Record<string, unknown>) => void;
 	sendUserMessage: (content: unknown, options?: Record<string, unknown>) => void;

package/src/runtime/live-session-runtime.ts

@@ -27,7 +27,7 @@ import {
 } from "./live-agent-manager.ts";
 import { subscribeLiveControlRealtime } from "./live-control-realtime.ts";
 import { buildExtensionBridge } from "./live-extension-bridge.ts";
-import { collectLiveSessionHealth, formatLiveSessionDiagnostics, type LiveSessionHealth } from "./live-session-health.ts";
+import { collectLiveSessionHealth, formatLiveSessionDiagnostics } from "./live-session-health.ts";
 import { buildMcpProxyFromSession } from "./mcp-proxy.ts";
 import { buildConfiguredModelRouting } from "./model-fallback.ts";
 import { readEnabledModelsPatterns } from "./model-scope.ts";
@@ -231,7 +231,7 @@ function eventText(event: unknown): string[] {
 
 function finalAssistantText(event: unknown): string[] {
 	const obj = asRecord(event);
-	if (!obj || obj.type !== "message_end") return [];
+	if (obj?.type !== "message_end") return [];
 	const message = asRecord(obj.message);
 	if (message?.role !== "assistant") return [];
 	return textFromContent(message.content);
@@ -266,7 +266,7 @@ async function resolveScopeModelsPatterns(cwd: string, agentDir?: string): Promi
 }
 
 function modelFromRegistry(modelRegistry: unknown, modelId: string | undefined): unknown {
-	if (!modelId || !modelId.includes("/")) return undefined;
+	if (!modelId?.includes("/")) return undefined;
 	const registry = asRecord(modelRegistry);
 	const find = registry?.find;
 	if (typeof find !== "function") return undefined;
@@ -450,7 +450,7 @@ function filterActiveTools(session: LiveSessionLike, agent: AgentConfig, role?:
 	const allowed = policy.tools?.length ? new Set(policy.tools) : undefined;
 	const active = session
 		.getActiveToolNames()
-		.filter((name) => !recursiveTools.has(name) && (!disallowed || !disallowed.has(name)) && (!allowed || allowed.has(name)));
+		.filter((name) => !recursiveTools.has(name) && !disallowed?.has(name) && (!allowed || allowed.has(name)));
 	session.setActiveToolsByName(active);
 }
 
@@ -822,61 +822,69 @@ export async function runLiveSessionTask(input: LiveSessionSpawnInput): Promise<
 		});
 		if (typeof session.subscribe === "function") {
 			unsubscribe = session.subscribe((event) => {
-				if (!isCurrent()) return;
-				jsonEvents += 1;
-				appendTranscript(input.transcriptPath, event);
-				const sidechainType = eventToSidechainType(event);
-				if (sidechainType)
-					writeSidechainEntry(sidechainPath, {
-						agentId,
-						type: sidechainType,
-						message: event,
-						cwd: input.task.cwd,
-					});
-				const obj = asRecord(event);
-				if (obj?.type === "turn_end") {
-					turnCount += 1;
-					trackLiveAgentTurnEnd(agentId);
-					if (maxTurns !== undefined && !softLimitReached && turnCount >= maxTurns) {
-						softLimitReached = true;
-						void session?.steer?.("You have reached your turn limit. Wrap up immediately — provide your final answer now.");
-					} else if (maxTurns !== undefined && softLimitReached && turnCount >= maxTurns + graceTurns) {
-						void session?.abort?.();
-					}
-				}
-				// Accumulate lifetime usage that survives compaction
-				if (obj?.type === "message_end" && extractMessageRole(obj) === "assistant") {
-					const u = extractMessageUsage(obj);
-					if (u) {
-						trackTaskUsage(input.task.id, {
-							input: typeof u.input === "number" ? u.input : 0,
-							output: typeof u.output === "number" ? u.output : 0,
-							cacheWrite: typeof u.cacheWrite === "number" ? u.cacheWrite : 0,
+				// Wrap callback body in try/catch to prevent unguarded exceptions from
+				// propagating into the session internals and crashing the live session.
+				try {
+					if (!isCurrent()) return;
+					jsonEvents += 1;
+					appendTranscript(input.transcriptPath, event);
+					const sidechainType = eventToSidechainType(event);
+					if (sidechainType)
+						writeSidechainEntry(sidechainPath, {
+							agentId,
+							type: sidechainType,
+							message: event,
+							cwd: input.task.cwd,
 						});
+					const obj = asRecord(event);
+					if (obj?.type === "turn_end") {
+						turnCount += 1;
+						trackLiveAgentTurnEnd(agentId);
+						if (maxTurns !== undefined && !softLimitReached && turnCount >= maxTurns) {
+							softLimitReached = true;
+							void session?.steer?.("You have reached your turn limit. Wrap up immediately — provide your final answer now.");
+						} else if (maxTurns !== undefined && softLimitReached && turnCount >= maxTurns + graceTurns) {
+							void session?.abort?.();
+						}
 					}
-				}
-				input.onEvent?.(event);
-				const text = [...eventText(event), ...finalAssistantText(event)].join("\n");
-				if (text.trim()) {
-					stdout += `${text}\n`;
-					streamOut?.write(text + "\n");
-					trackLiveAgentResponseText(agentId, text);
-					input.onOutput?.(text);
-				}
-				// G2: Track tool start/end for activity display
-				if (obj?.type === "tool_use" || obj?.type === "tool_execution_start") {
-					const toolName = extractToolName(obj) ?? "unknown";
-					trackLiveAgentToolStart(agentId, toolName);
-				}
-				if (obj?.type === "tool_result" || obj?.type === "tool_execution_end") {
-					const toolName = extractToolName(obj) ?? "unknown";
-					trackLiveAgentToolEnd(agentId, toolName);
-				}
-				// Phase 1: collect events for yield detection
-				if (collectedJsonEvents && event && typeof event === "object" && !Array.isArray(event)) {
-					collectedJsonEvents.push(event as Record<string, unknown>);
-					if (collectedJsonEvents.length > maxCollectedJsonEvents)
-						collectedJsonEvents.splice(0, collectedJsonEvents.length - maxCollectedJsonEvents);
+					// Accumulate lifetime usage that survives compaction
+					if (obj?.type === "message_end" && extractMessageRole(obj) === "assistant") {
+						const u = extractMessageUsage(obj);
+						if (u) {
+							trackTaskUsage(input.task.id, {
+								input: typeof u.input === "number" ? u.input : 0,
+								output: typeof u.output === "number" ? u.output : 0,
+								cacheWrite: typeof u.cacheWrite === "number" ? u.cacheWrite : 0,
+							});
+						}
+					}
+					input.onEvent?.(event);
+					const text = [...eventText(event), ...finalAssistantText(event)].join("\n");
+					if (text.trim()) {
+						stdout += `${text}\n`;
+						streamOut?.write(text + "\n");
+						trackLiveAgentResponseText(agentId, text);
+						input.onOutput?.(text);
+					}
+					// G2: Track tool start/end for activity display
+					if (obj?.type === "tool_use" || obj?.type === "tool_execution_start") {
+						const toolName = extractToolName(obj) ?? "unknown";
+						trackLiveAgentToolStart(agentId, toolName);
+					}
+					if (obj?.type === "tool_result" || obj?.type === "tool_execution_end") {
+						const toolName = extractToolName(obj) ?? "unknown";
+						trackLiveAgentToolEnd(agentId, toolName);
+					}
+					// Phase 1: collect events for yield detection
+					if (collectedJsonEvents && event && typeof event === "object" && !Array.isArray(event)) {
+						collectedJsonEvents.push(event as Record<string, unknown>);
+						if (collectedJsonEvents.length > maxCollectedJsonEvents)
+							collectedJsonEvents.splice(0, collectedJsonEvents.length - maxCollectedJsonEvents);
+					}
+				} catch (error) {
+					// Prevent unguarded exceptions in the subscribe callback from crashing
+					// the live session or propagating into the session internals.
+					logInternalError("live-session.subscribe-callback", error, `agentId=${agentId}`);
 				}
 			});
 		}

package/src/runtime/manifest-cache.ts

@@ -9,6 +9,15 @@ import { isSafePathId, resolveContainedRelativePath, resolveRealContainedPath }
 
 export interface ManifestCache {
 	list(limit?: number): TeamRunManifest[];
+	/**
+	 * Return ONLY running manifests, capped only by `limit`.
+	 *
+	 * RT-F3: unlike `list(limit)`, this filters `status === "running"` BEFORE
+	 * the limit is applied so stale orphaned runs that have been pushed past
+	 * the top-N by recent activity are not silently hidden from crash-recovery
+	 * and zombie-detection scans.
+	 */
+	listActive(limit: number): TeamRunManifest[];
 	get(runId: string): TeamRunManifest | undefined;
 	clear(runId?: string): void;
 	dispose(): void;
@@ -203,6 +212,15 @@ export function createManifestCache(cwd: string, options: ManifestCacheOptions =
 		return undefined;
 	}
 
+	/**
+	 * NOTE (RT-F10): This function performs a full FS scan + JSON.parse of all
+	 * manifests on every TTL expiry (default 500ms). This is a known performance
+	 * tradeoff: fs.watch provides real-time invalidation (see constructor above)
+	 * so the TTL cache is only consulted when the watcher fires, but the list()
+	 * call itself still re-reads all entries to pick up changes. Incremental
+	 * updates via fs.watch-driven delta tracking are planned for a future
+	 * iteration to avoid the full scan on each expiry.
+	 */
 	function list(limit = DEFAULT_CACHE.manifestMaxEntries): TeamRunManifest[] {
 		const now = Date.now();
 		const cached = listCache.get(limit);
@@ -248,6 +266,46 @@ export function createManifestCache(cwd: string, options: ManifestCacheOptions =
 		return undefined;
 	}
 
+	/**
+	 * RT-F3: filter to `status === "running"` BEFORE applying the limit so an
+	 * orphaned run that has been pushed past the top-N by recent successful
+	 * runs is still surfaced to crash-recovery. The cap is the LIMIT, not the
+	 * "top-N most recent"; callers (e.g. zombie detection) explicitly want
+	 * EVERY currently-running run, in any order.
+	 *
+	 * Internally performs a full scan (NOT via list()) so the cap doesn't
+	 * silently drop "running" runs that fell past the top-N createdAt cutoff.
+	 * Still goes through parseManifestIfChanged for stat+size memoization, so
+	 * the per-run I/O cost is the same as list().
+	 */
+	function listActive(limit: number): TeamRunManifest[] {
+		const cap = Math.max(0, limit);
+		const parsedEntries = [
+			...roots.flatMap((root) => collectRoots(root)),
+			...activeRunEntries().map((entry) => ({
+				runId: entry.runId,
+				path: entry.manifestPath,
+			})),
+		];
+		const unique = new Map<string, CachedManifest | undefined>();
+		for (const entry of parsedEntries) {
+			if (entry.runId.length === 0) continue;
+			let cached = manifestIndex.get(entry.runId);
+			const root = path.dirname(path.dirname(entry.path));
+			const parsed = parseManifestIfChanged(root, entry.runId, entry.path, cached);
+			if (parsed) {
+				cached = parsed;
+				manifestIndex.set(entry.runId, cached);
+			}
+			if (cached) unique.set(entry.runId, cached);
+		}
+		const running = [...unique.values()]
+			.filter((value): value is CachedManifest => value !== undefined)
+			.map((value) => value.manifest)
+			.filter((manifest) => manifest.status === "running");
+		return running.slice(0, cap);
+	}
+
 	if (options.watch ?? true) {
 		for (const root of roots) {
 			const watcher = watchWithErrorHandler(
@@ -268,6 +326,7 @@ export function createManifestCache(cwd: string, options: ManifestCacheOptions =
 
 	return {
 		list,
+		listActive,
 		get,
 		clear(runId) {
 			invalidate(runId);

package/src/runtime/mcp-proxy.ts

@@ -17,7 +17,7 @@
  */
 
 import type { ToolDefinition } from "@earendil-works/pi-coding-agent";
-import type { Static, TSchema } from "@sinclair/typebox";
+import type { TSchema } from "@sinclair/typebox";
 
 export interface McpProxyConfig {
 	/** Whether to enable MCP in the child session. */

package/src/runtime/orphan-worker-registry.ts

@@ -22,10 +22,10 @@
  * writes from causing lost updates.
  */
 
-import { execFileSync, execSync } from "node:child_process";
+import { execFileSync } from "node:child_process";
 import * as fs from "node:fs";
 import * as path from "node:path";
-import { isSymlinkSafePath } from "../state/atomic-write.ts";
+import { atomicWriteFile, isSymlinkSafePath } from "../state/atomic-write.ts";
 import { withFileLockSync } from "../state/locks.ts";
 import { logInternalError } from "../utils/internal-error.ts";
 import { userPiRoot } from "../utils/paths.ts";
@@ -252,7 +252,7 @@ function writeRegistry(entries: OrphanWorkerEntry[]): void {
 		fs.mkdirSync(dir, { recursive: true, mode: 0o700 });
 	}
 	try {
-		fs.writeFileSync(p, JSON.stringify(entries, null, 2), { mode: 0o600 });
+		atomicWriteFile(p, JSON.stringify(entries, null, 2), { mode: 0o600 });
 	} catch (error) {
 		logInternalError("orphan-worker-registry.write", error, `path=${p} entries=${entries.length}`);
 	}

package/src/runtime/output-validator.ts

@@ -42,7 +42,7 @@ export function validateWorkerOutput(role: string, output: string): OutputValida
 	const issues: string[] = [];
 
 	// Empty output always fails
-	if (!output || !output.trim()) {
+	if (!output?.trim()) {
 		return {
 			valid: false,
 			formatMatch: false,

package/src/runtime/path-overlap.ts

@@ -124,7 +124,7 @@ export function filterReadyByWriteOverlap(
 	for (const taskId of readyTaskIds) {
 		if (pickedTaskIds.length >= maxCount) break;
 		const task = taskById.get(taskId);
-		if (!task || !task.stepId) {
+		if (!task?.stepId) {
 			// No step reference: treat as no declared write path → never conflicts.
 			pickedTaskIds.push(taskId);
 			continue;

package/src/runtime/pi-args.ts

@@ -1,9 +1,9 @@
 import * as fs from "node:fs";
 import * as os from "node:os";
 import * as path from "node:path";
-import { fileURLToPath } from "node:url";
 import type { AgentConfig } from "../agents/agent-config.ts";
 import { resolveToolPolicy } from "../agents/agent-config.ts";
+import { atomicWriteFile } from "../state/atomic-write.ts";
 import { packageRoot, userPiRoot } from "../utils/paths.ts";
 
 const THINKING_LEVELS = ["off", "minimal", "low", "medium", "high", "xhigh"];
@@ -323,7 +323,7 @@ export function buildPiWorkerArgs(input: BuildPiWorkerArgsInput): BuildPiWorkerA
 		const tmpBase = getPiTempBase();
 		tempDir = createSafeTempDir(tmpBase, `pi-crew-${process.pid}-`);
 		const promptPath = path.join(tempDir, `${input.agent.name.replace(/[^\w.-]/g, "_")}.md`);
-		fs.writeFileSync(promptPath, input.agent.systemPrompt, { mode: 0o600 });
+		atomicWriteFile(promptPath, input.agent.systemPrompt, { mode: 0o600 });
 		args.push(input.agent.systemPromptMode === "append" ? "--append-system-prompt" : "--system-prompt", promptPath);
 	}
 
@@ -333,7 +333,7 @@ export function buildPiWorkerArgs(input: BuildPiWorkerArgsInput): BuildPiWorkerA
 			tempDir = createSafeTempDir(tmpBase, `pi-crew-${process.pid}-`);
 		}
 		const taskPath = path.join(tempDir, "task.md");
-		fs.writeFileSync(taskPath, input.task, { mode: 0o600 });
+		atomicWriteFile(taskPath, input.task, { mode: 0o600 });
 		args.push(`@${taskPath}`);
 	} else {
 		args.push(`Task: ${input.task}`);

package/src/runtime/pi-json-output.ts

@@ -151,14 +151,14 @@ function extractErrorMessage(event: unknown): string | undefined {
  */
 function extractPatch(event: unknown, patches: string[]): void {
 	const obj = asRecord(event);
-	if (!obj || obj.type !== "tool_result") return;
+	if (obj?.type !== "tool_result") return;
 
 	const content = obj.content;
 	if (!Array.isArray(content)) return;
 
 	for (const item of content) {
 		const part = asRecord(item);
-		if (!part || part.type !== "text") continue;
+		if (part?.type !== "text") continue;
 		const text = typeof part.text === "string" ? part.text : "";
 
 		// Check if this looks like a unified patch (starts with "---" or "+++")

package/src/runtime/pipeline-runner.ts

@@ -1,9 +1,6 @@
-import type { AgentConfig } from "../agents/agent-config.ts";
 import { errors } from "../errors.ts";
 import { appendEventAsync, flushEventLogBuffer } from "../state/event-log.ts";
-import type { TeamTaskState } from "../state/types.ts";
-import type { TeamConfig } from "../teams/team-config.ts";
-import type { WorkflowConfig, WorkflowStep } from "../workflows/workflow-config.ts";
+import type { WorkflowConfig } from "../workflows/workflow-config.ts";
 import { mapConcurrent } from "./parallel-utils.ts";
 
 /**

package/src/runtime/post-checks.ts

@@ -5,7 +5,6 @@
  * Distilled from pi-autoresearch's post-check / backpressure pattern.
  */
 import { execFileSync } from "node:child_process";
-import * as path from "node:path";
 import { WINDOWS_ESSENTIAL_ENV_VARS } from "../utils/env-allowlist.ts";
 import { sanitizeEnvSecrets } from "../utils/env-filter.ts";
 import { resolveShellForScript } from "../utils/resolve-shell.ts";

package/src/runtime/retry-runner.ts

@@ -70,10 +70,10 @@ export interface TaskRunnerLike {
  */
 export class RetryRunner {
 	private _disposed = false;
-	private _handoffs: HandoffSummary[] = [];
 
 	private taskRunner: TaskRunnerLike;
 	private handoffManager: HandoffManager;
+	private _handoffs: HandoffSummary[] = [];
 
 	constructor(taskRunner: TaskRunnerLike, handoffManager: HandoffManager) {
 		this.taskRunner = taskRunner;

package/src/runtime/run-coalesced-task-group.ts

@@ -1,16 +1,3 @@
-/**
- * run-coalesced-task-group.ts — M6 real-dispatch MVP worker spawn.
- *
- * Spawns ONE child Pi process for an entire coalesced group of N tasks
- * (sharing role + cwd per `planCoalescedGroups`). The combined prompt
- * instructs the worker to wrap each task's result in `<<<TASK_RESULT:id>>>`
- * ... `<<<END_TASK_RESULT>>>` delimiters. Output is split back into N
- * per-task results via `splitCoalescedOutput`, each written to its own
- * result artifact + state update.
- */
-
-import { writeFile } from "node:fs/promises";
-import path from "node:path";
 import type { AgentConfig } from "../agents/agent-config.ts";
 import { writeArtifact } from "../state/artifact-store.ts";
 import { appendEventAsync } from "../state/event-log.ts";

package/src/runtime/scheduler.ts

@@ -111,6 +111,7 @@ export class CrewScheduler {
 		if (this.timers.has(job.id)) return;
 		if (job.scheduleType === "interval" && job.intervalMs) {
 			const t = setInterval(() => this.fire(job.id), job.intervalMs);
+			t.unref();
 			this.timers.set(job.id, t);
 		} else if (job.scheduleType === "once") {
 			const target = new Date(job.schedule).getTime();
@@ -120,6 +121,7 @@ export class CrewScheduler {
 					this.fire(job.id);
 					this.update(job.id, { enabled: false });
 				}, delay);
+				t.unref();
 				this.timers.set(job.id, t);
 			} else {
 				this.update(job.id, { enabled: false, lastStatus: "error" });

package/src/runtime/session-resources.ts

@@ -9,7 +9,7 @@ import { logInternalError } from "../utils/internal-error.ts";
  */
 export function tryRegisterSessionCleanup(pi: ExtensionAPI, cleanup: () => void): (() => void) | undefined {
 	const api = pi as unknown as Record<string, unknown>;
-	const registerFn = api["registerSessionResourceCleanup"];
+	const registerFn = api.registerSessionResourceCleanup;
 	if (typeof registerFn === "function") {
 		try {
 			const unregister = (registerFn as (fn: () => void) => (() => void) | void)(cleanup);

package/src/runtime/settings-store.ts

@@ -1,6 +1,8 @@
 import * as fs from "node:fs";
 import { homedir } from "node:os";
 import * as path from "node:path";
+import { atomicWriteJson } from "../state/atomic-write.ts";
+import { withFileLockSync } from "../state/locks.ts";
 import { logInternalError } from "../utils/internal-error.ts";
 import type { JoinMode } from "./group-join.ts";
 
@@ -98,13 +100,41 @@ export function saveCrewSettings(s: CrewSettings, cwd: string = process.cwd()):
 	const p = projectPath(cwd);
 	try {
 		fs.mkdirSync(path.dirname(p), { recursive: true });
-		fs.writeFileSync(p, JSON.stringify(s, null, 2), "utf-8");
+		// Atomic (temp + rename + fsync) instead of raw writeFileSync: a crash/SIGKILL
+		// mid-write would otherwise truncate <cwd>/.pi/crew-settings.json, and the
+		// reader silently resets to {} on parse failure — losing ALL crew settings +
+		// scheduledJobs.
+		atomicWriteJson(p, s);
 		return true;
 	} catch {
 		return false;
 	}
 }
 
+/**
+ * Atomically read-modify-write crew settings under a file lock.
+ *
+ * Fixes two issues vs a plain loadCrewSettings → saveCrewSettings sequence:
+ *  1. Cross-session lost-update race: <cwd>/.pi/crew-settings.json is project-scoped,
+ *     so two Pi sessions on the same project concurrently scheduling jobs would each
+ *     load-modify-save and the second save clobbers the first (lost job). The lock
+ *     serializes the whole transaction.
+ *  2. Crash truncation: the write uses atomicWriteJson (temp + rename + fsync).
+ *
+ * `mutator` receives the freshly-loaded (merged) settings and returns the new value
+ * to persist. Returns the persisted settings.
+ */
+export function updateCrewSettings(cwd: string, mutator: (settings: CrewSettings) => CrewSettings): CrewSettings {
+	const p = projectPath(cwd);
+	fs.mkdirSync(path.dirname(p), { recursive: true });
+	return withFileLockSync(p, () => {
+		const fresh = loadCrewSettings(cwd); // re-read inside the lock (TOCTOU-safe vs other updaters)
+		const next = mutator(fresh);
+		atomicWriteJson(p, next);
+		return next;
+	});
+}
+
 export function applyCrewSettingsToConfig(
 	config: {
 		limits?: { maxConcurrentWorkers?: number };

package/src/runtime/skill-effectiveness.ts

@@ -10,8 +10,8 @@
  * @module skill-effectiveness
  */
 
-import { existsSync, mkdirSync, readFileSync, writeFileSync } from "fs";
-import { dirname, join } from "path";
+import { existsSync, mkdirSync, readFileSync, writeFileSync } from "node:fs";
+import { dirname, join } from "node:path";
 import { projectCrewRoot } from "../utils/paths.ts";
 import { crewHooks } from "./crew-hooks.ts";