pi-crew 0.9.41 → 0.9.44

package/src/observability/correlation.ts

@@ -1,4 +1,5 @@
 import { AsyncLocalStorage } from "node:async_hooks";
+import { randomBytes } from "node:crypto";
 
 export interface CorrelationContext {
 	traceId: string;
@@ -7,7 +8,6 @@ export interface CorrelationContext {
 }
 
 const storage = new AsyncLocalStorage<CorrelationContext>();
-let spanCounter = 0;
 
 export function withCorrelation<T>(ctx: CorrelationContext, fn: () => T): T {
 	return storage.run(ctx, fn);
@@ -18,8 +18,9 @@ export function getCurrentContext(): CorrelationContext | undefined {
 }
 
 export function newSpanId(runId: string, taskId = "main"): string {
-	spanCounter += 1;
-	return `${runId}:${taskId}:${spanCounter}`;
+	// OBS-4: random 8-hex-char suffix — bounded length, collision-resistant across
+	// module reloads (the old monotonic counter collided after HMR and grew unboundedly).
+	return `${runId}:${taskId}:${randomBytes(4).toString("hex")}`;
 }
 
 export function childCorrelation(runId: string, taskId: string): CorrelationContext {

package/src/observability/event-bus.ts

@@ -14,6 +14,7 @@ export interface CrewEvent {
 type CrewEventListener = (event: CrewEvent) => void;
 
 class EventBus {
+	private static readonly MAX_LISTENERS_PER_EVENT = 100;
 	private listeners = new Map<CrewEventType, Set<CrewEventListener>>();
 	private static _instance?: EventBus;
 
@@ -54,7 +55,15 @@ class EventBus {
 		if (!this.listeners.has(type)) {
 			this.listeners.set(type, new Set());
 		}
-		this.listeners.get(type)!.add(listener);
+		const set = this.listeners.get(type)!;
+		if (set.size >= EventBus.MAX_LISTENERS_PER_EVENT) {
+			logInternalError(
+				"event-bus.listener-cap",
+				new Error(`Max ${EventBus.MAX_LISTENERS_PER_EVENT} listeners reached for event type '${type}'`),
+				`type=${type} currentCount=${set.size}`,
+			);
+		}
+		set.add(listener);
 
 		return () => {
 			this.listeners.get(type)?.delete(listener);

package/src/observability/event-to-metric.ts

@@ -37,7 +37,7 @@ export function wireEventToMetrics(events: ExtensionAPI["events"] | undefined, r
 	const taskCount = registry.counter("crew.task.count", "Total tasks by status");
 	const subagentCount = registry.counter("crew.subagent.count", "Total subagent records by status");
 	const mailboxCount = registry.counter("crew.mailbox.count", "Total mailbox messages by direction");
-	const retryAttemptCount = registry.counter("crew.task.retry_attempt_total", "Retry attempts by run and task");
+	const retryAttemptCount = registry.counter("crew.task.retry_attempt_total", "Total retry attempts");
 	const deadletterCount = registry.counter("crew.task.deadletter_total", "Deadletter triggers by reason");
 	const overflowCount = registry.counter("crew.task.overflow_phase_total", "Overflow recovery phase transitions");
 	const supervisorContactCount = registry.counter("crew.task.supervisor_contact_total", "Supervisor contact requests by reason");
@@ -89,12 +89,12 @@ export function wireEventToMetrics(events: ExtensionAPI["events"] | undefined, r
 		[
 			"crew.task.retry_attempt",
 			(data) => {
-				const item = recordValue(data);
 				taskCount.inc({ status: "retry" });
-				retryAttemptCount.inc({
-					runId: stringValue(item.runId, "unknown"),
-					taskId: stringValue(item.taskId, "unknown"),
-				});
+				// Per-run/task detail lives in the event log (crew.task.retry_attempt).
+				// Using runId/taskId as METRIC labels would blow up cardinality (each unique
+				// run+task pair = a new series, silently LRU-evicted at MAX_LABEL_COMBINATIONS
+				// = 10_000), making the counter unreliable for aggregation.
+				retryAttemptCount.inc({});
 			},
 		],
 		[
@@ -121,8 +121,9 @@ export function wireEventToMetrics(events: ExtensionAPI["events"] | undefined, r
 			(data) => {
 				const item = recordValue(data);
 				supervisorContactCount.inc({
+					// reason is low-cardinality; taskId is NOT (unique per task) — dropped to
+					// avoid cardinality blowup (OBS-1). Per-task detail is in the event log.
 					reason: stringValue(item.reason, "unknown"),
-					taskId: stringValue(item.taskId, "unknown"),
 				});
 			},
 		],

package/src/observability/exporters/adapter.ts

@@ -3,7 +3,7 @@ import type { MetricSnapshot } from "../metrics-primitives.ts";
 export interface MetricExporter {
 	name: string;
 	push(snapshots: MetricSnapshot[]): Promise<void>;
-	dispose(): void;
+	dispose(): Promise<void>;
 }
 
 export class CompositeExporter implements MetricExporter {
@@ -18,13 +18,10 @@ export class CompositeExporter implements MetricExporter {
 		await Promise.allSettled(this.exporters.map((exporter) => exporter.push(snapshots)));
 	}
 
-	dispose(): void {
-		for (const exporter of this.exporters) {
-			try {
-				exporter.dispose();
-			} catch {
-				// Best-effort cleanup; one exporter failing shouldn't prevent others.
-			}
-		}
+	async dispose(): Promise<void> {
+		// OBS-3: await allSettled so an async exporter cleanup (e.g. OTLPExporter awaiting
+		// an in-flight HTTP push) isn't cut short. Interface contract changed from `void`
+		// to `Promise<void>` because exporters may have async teardown.
+		await Promise.allSettled(this.exporters.map((exporter) => exporter.dispose()));
 	}
 }

package/src/observability/exporters/otlp-exporter.ts

@@ -1,3 +1,4 @@
+import { lookup } from "node:dns/promises";
 import { promisify } from "node:util";
 import { gzip } from "node:zlib";
 import { logInternalError } from "../../utils/internal-error.ts";
@@ -100,6 +101,76 @@ export function validateEndpoint(endpoint: string): void {
 	}
 }
 
+/**
+ * CFG-6: classify a single IP address (IPv4 or IPv6) as private / reserved /
+ * loopback / link-local. Used by the runtime DNS-rebinding guard below to
+ * verify the addresses the endpoint hostname resolves to. Returns true for
+ * addresses that must never receive a metrics push. The full literal checks
+ * in `validateEndpoint` use the same predicates for direct IP targets.
+ */
+export function isPrivateIpAddress(address: string): boolean {
+	const lower = address.toLowerCase();
+	// IPv4 literal
+	const ipv4 = lower.match(/^(\d{1,3})\.(\d{1,3})\.(\d{1,3})\.(\d{1,3})$/);
+	if (ipv4) {
+		const o0 = Number(ipv4[1]);
+		const o1 = Number(ipv4[2]);
+		if (o0 === 127 || o0 === 0) return true;
+		if (o0 === 10) return true;
+		if (o0 === 172 && o1 >= 16 && o1 <= 31) return true;
+		if (o0 === 192 && o1 === 168) return true;
+		if (o0 === 169 && o1 === 254) return true;
+		return false;
+	}
+	// IPv6 (without surrounding brackets, as `dns.lookup` returns them)
+	if (lower === "::1" || lower === "::") return true;
+	if (lower.startsWith("fd") || lower.startsWith("fc")) return true;
+	if (lower.startsWith("fe8") || lower.startsWith("fe9") || lower.startsWith("fea") || lower.startsWith("feb")) return true;
+	if (lower.startsWith("fec") || lower.startsWith("fed") || lower.startsWith("fee") || lower.startsWith("fef")) return true;
+	if (lower.startsWith("ff")) return true;
+	if (lower.startsWith("::ffff:")) return true;
+	return false;
+}
+
+/**
+ * CFG-6: DNS-rebinding guard. `validateEndpoint` runs once at exporter
+ * construction and only inspects the literal hostname; an attacker who
+ * controls the DNS for a public hostname can rebind it to a private IP
+ * (e.g. 169.254.169.254 cloud metadata) between construction and the actual
+ * fetch. Re-resolve the hostname at push time and reject if any returned
+ * address falls into a private/reserved range. Resolution failures are
+ * allowed to fall through so the underlying `fetch` surfaces the error.
+ */
+export async function assertResolvedAddressSafe(endpoint: string): Promise<void> {
+	let url: URL;
+	try {
+		url = new URL(endpoint);
+	} catch {
+		return;
+	}
+	if (url.protocol !== "http:" && url.protocol !== "https:") return;
+	const hostname = url.hostname.toLowerCase();
+	if (!hostname) return;
+	// Locals and literal IPs are covered by `validateEndpoint`; skip the DNS
+	// round-trip so we don't double-report errors the sync check already
+	// produces.
+	if (hostname === "localhost" || hostname.endsWith(".localhost")) return;
+	if (hostname.startsWith("[")) return;
+	if (/^\d{1,3}(\.\d{1,3}){3}$/.test(hostname)) return;
+	let addresses: { address: string }[];
+	try {
+		addresses = await lookup(hostname, { all: true, verbatim: true });
+	} catch {
+		// Let the fetch fail with a clearer error from the network layer.
+		return;
+	}
+	for (const { address } of addresses) {
+		if (isPrivateIpAddress(address)) {
+			throw new Error(`OTLP endpoint resolves to private/reserved address ${address} (DNS rebinding blocked): ${endpoint}`);
+		}
+	}
+}
+
 // FIX (Round 15): Cap the number of snapshots per push to prevent OOM when
 // the metric registry has grown large. The OTLP HTTP spec allows many metrics
 // in one payload, but a single push > 10_000 metrics would balloon the
@@ -210,6 +281,16 @@ export class OTLPExporter implements MetricExporter {
 
 	async push(snapshots: MetricSnapshot[]): Promise<void> {
 		try {
+			// CFG-6: re-validate the endpoint after DNS resolution to block
+			// rebinding from a public hostname to a private/metadata IP
+			// between construction time and the actual fetch. Failures are
+			// logged and the push is skipped — no metrics reach the bad host.
+			try {
+				await assertResolvedAddressSafe(this.opts.endpoint);
+			} catch (error) {
+				logInternalError("otlp-export-ssrf", error);
+				return;
+			}
 			// FIX (Round 15): Cap snapshots to a safe size to avoid OOM and
 			// oversized HTTP payloads. Log a warning if we are truncating.
 			let toSend = snapshots;

package/src/observability/metric-retention.ts

@@ -29,6 +29,10 @@ export class TimeWindowedCounter {
 		this.prune();
 	}
 
+	// PERF (OBS-5): This method is O(N) per call because it linearly scans
+	// all events and calls labelKey() (which uses JSON.stringify) on each.
+	// A more efficient aggregation (e.g., pre-aggregated label buckets or a
+	// sliding-window histogram) is planned to replace this hot path.
 	count(labels: MetricLabels = {}, durationMs = this.windowMs): number {
 		const now = this.now();
 		this.pruneAt(now);

package/src/observability/metric-sink.ts

@@ -6,7 +6,7 @@ import type { MetricRegistry } from "./metric-registry.ts";
 import type { MetricSnapshot } from "./metrics-primitives.ts";
 
 export interface MetricSink {
-	writeSnapshot(snapshots: MetricSnapshot[]): void;
+	writeSnapshot(snapshots: MetricSnapshot[]): void | Promise<void>;
 	dispose(): void;
 }
 
@@ -54,19 +54,29 @@ export function createMetricFileSink(opts: MetricFileSinkOptions): MetricSink {
 		fdDate = date;
 		return fd;
 	};
-	const writeSnapshot = (snapshots: MetricSnapshot[]): void => {
+	const writeSnapshot = (snapshots: MetricSnapshot[]): Promise<void> => {
 		try {
 			const now = new Date();
 			const date = now.toISOString().slice(0, 10);
 			const redacted = redactSecrets(snapshots);
 			if (!Array.isArray(redacted)) {
 				logInternalError("metric-sink.type", new Error("redactSecrets did not return an array"), `got=${typeof redacted}`);
-				return;
+				return Promise.resolve();
 			}
 			const target = ensureFd(date);
-			fs.writeSync(target, `${JSON.stringify({ exportedAt: now.toISOString(), snapshots: redacted as MetricSnapshot[] })}\n`);
+			const line = `${JSON.stringify({ exportedAt: now.toISOString(), snapshots: redacted as MetricSnapshot[] })}\n`;
+			// Async write to avoid blocking the main thread on the 60s tick.
+			// Return a promise that resolves once the write callback fires so
+			// tests (and any callers awaiting) can synchronize on completion.
+			return new Promise<void>((resolve) => {
+				fs.write(target, line, (err) => {
+					if (err) logInternalError("metric-sink.asyncWrite", err);
+					resolve();
+				});
+			});
 		} catch (error) {
 			logInternalError("metric-sink.write", error);
+			return Promise.resolve();
 		}
 	};
 	const timer = setInterval(() => writeSnapshot(opts.registry.snapshot()), opts.intervalMs ?? 60_000);

package/src/prompt/prompt-runtime.ts

@@ -170,6 +170,21 @@ export default function registerPiTeamsPromptRuntime(pi: ExtensionAPI): void {
 			if (typeof payload.max_tokens === "number" && payload.max_tokens > maxTokensCap) {
 				payload.max_tokens = maxTokensCap;
 			}
+			// Also cap newer field names used by some providers
+			if (typeof payload.max_completion_tokens === "number" && payload.max_completion_tokens > maxTokensCap) {
+				payload.max_completion_tokens = maxTokensCap;
+			}
+			if (typeof payload.max_output_tokens === "number" && payload.max_output_tokens > maxTokensCap) {
+				payload.max_output_tokens = maxTokensCap;
+			}
+			const generationConfig = payload.generationConfig as Record<string, unknown> | undefined;
+			if (
+				generationConfig &&
+				typeof generationConfig.max_output_tokens === "number" &&
+				generationConfig.max_output_tokens > maxTokensCap
+			) {
+				generationConfig.max_output_tokens = maxTokensCap;
+			}
 		});
 	}
 

package/src/runtime/adaptive-plan.ts

@@ -21,7 +21,7 @@ import { saveRunManifestAsync } from "../state/state-store.ts";
 import type { TeamRunManifest, TeamTaskState } from "../state/types.ts";
 import type { TeamConfig } from "../teams/team-config.ts";
 import type { WorkflowConfig, WorkflowStep } from "../workflows/workflow-config.ts";
-import { getPlanTemplate, listPlanTemplates, renderPlanTemplate } from "./plan-templates.ts";
+import { getPlanTemplate, renderPlanTemplate } from "./plan-templates.ts";
 import { refreshTaskGraphQueues } from "./task-graph-scheduler.ts";
 
 export interface AdaptivePlanTask {

package/src/runtime/async-runner.ts

@@ -1,9 +1,9 @@
-import { type SpawnOptions, spawn } from "node:child_process";
+import { spawn } from "node:child_process";
 import * as fs from "node:fs";
 import { createRequire } from "node:module";
 import * as path from "node:path";
 import { fileURLToPath, pathToFileURL } from "node:url";
-import { appendEvent, appendEventAsync } from "../state/event-log.ts";
+import { appendEventAsync } from "../state/event-log.ts";
 import type { TeamRunManifest } from "../state/types.ts";
 import { WINDOWS_ESSENTIAL_ENV_VARS } from "../utils/env-allowlist.ts";
 import { sanitizeEnvSecrets } from "../utils/env-filter.ts";
@@ -356,8 +356,17 @@ export async function spawnBackgroundTeamRun(manifest: TeamRunManifest): Promise
 		);
 		// Best-effort: unregister when child exits. Background-runner writes
 		// the marker file before it dies, so we unregister on the next
-		// cleanup tick. But the child "exit" event won't fire because we
-		// unref'd and the stdio is piped + ignored.
+		// cleanup tick. The child "exit" event may fire after unref() when
+		// stdio is piped; register handler defensively.
+		if (child.pid) {
+			child.on("exit", () => {
+				try {
+					unregisterWorker(child.pid!);
+				} catch {
+					/* best-effort */
+				}
+			});
+		}
 	}
 
 	return { pid: child.pid, logPath };

package/src/runtime/background-runner.ts

@@ -2,6 +2,7 @@ import * as fs from "node:fs";
 import * as path from "node:path";
 import { allAgents, discoverAgents } from "../agents/discover-agents.ts";
 import { loadConfig } from "../config/config.ts";
+import { atomicWriteFile } from "../state/atomic-write.ts";
 import { appendEvent } from "../state/event-log.ts";
 import { withRunLockSync } from "../state/locks.ts";
 import { createRunPaths, loadRunManifestById, saveRunManifestAsync, updateRunStatus } from "../state/state-store.ts";
@@ -70,7 +71,7 @@ function startHeartbeat(stateRoot: string, eventsPath: string, runId: string): (
 	const writeHeartbeat = (): void => {
 		try {
 			const mem = process.memoryUsage();
-			fs.writeFileSync(
+			atomicWriteFile(
 				heartbeatPath,
 				JSON.stringify({
 					pid: process.pid,
@@ -81,7 +82,6 @@ function startHeartbeat(stateRoot: string, eventsPath: string, runId: string): (
 						rssMb: Math.round(mem.rss / 1024 / 1024),
 					},
 				}),
-				"utf-8",
 			);
 		} catch {
 			/* ignore — best-effort */
@@ -454,27 +454,36 @@ async function main(): Promise<void> {
 		}
 	}
 	// Hook Node.js abort — if process.exit is called with code 1 (uncaught exception, assert failure)
-	// we log it before exiting so it appears in background.log
-	const origExit = process.exit.bind(process);
-	// Intercept all exit(code) calls to log them as async.exit events before exiting.
-	// This surfaces uncaught exceptions / early exits that would otherwise vanish silently.
-	process.exit = ((code?: number | string): never => {
-		const runId2 = argValue("--run-id");
-		const codeStr = code === undefined ? "<none>" : String(code);
-		if (runId2 && manifest.eventsPath) {
-			try {
-				appendEvent(manifest.eventsPath, {
-					type: "async.exit",
-					runId: runId2,
-					message: `Background runner exit(${codeStr}) pid=${process.pid}`,
-					data: { code, pid: process.pid },
-				});
-			} catch {
-				/* best-effort */
+	// we log it before exiting so it appears in background.log.
+	// NOTE: process.exit is monkey-patched here (not using process.on('exit')) because
+	// we need the log write to happen synchronously before the process actually exits.
+	// process.on('exit') handlers run too late for I/O to complete reliably.
+	// Wrapped in try/catch to guard against failures in the patch itself.
+	try {
+		const origExit = process.exit.bind(process);
+		// Intercept all exit(code) calls to log them as async.exit events before exiting.
+		// This surfaces uncaught exceptions / early exits that would otherwise vanish silently.
+		process.exit = ((code?: number | string): never => {
+			const runId2 = argValue("--run-id");
+			const codeStr = code === undefined ? "<none>" : String(code);
+			if (runId2 && manifest.eventsPath) {
+				try {
+					appendEvent(manifest.eventsPath, {
+						type: "async.exit",
+						runId: runId2,
+						message: `Background runner exit(${codeStr}) pid=${process.pid}`,
+						data: { code, pid: process.pid },
+					});
+				} catch {
+					/* best-effort */
+				}
 			}
-		}
-		return origExit(code);
-	}) as typeof process.exit;
+			return origExit(code);
+		}) as typeof process.exit;
+	} catch {
+		// If patching process.exit fails (e.g. frozen process object), continue
+		// without the exit log — the run will still proceed normally.
+	}
 
 	// Setup unhandled rejection guard FIRST — must be before any async operations
 	// that might produce unhandled rejections during cleanup. Without this, any unhandled
@@ -632,7 +641,7 @@ async function main(): Promise<void> {
 				// LAZY: defer dynamic import of ../workflows/discover-workflows.ts to its call site.
 				const { allWorkflows, discoverWorkflows } = await import("../workflows/discover-workflows.ts");
 				const wf = allWorkflows(discoverWorkflows(manifest.cwd)).find((w) => w.name === manifest.workflow);
-				if (!wf || wf.runtime !== "dynamic" || !wf.dynamicScript)
+				if (wf?.runtime !== "dynamic" || !wf.dynamicScript)
 					throw new Error(
 						`runKind="dynamic-workflow" but workflow '${manifest.workflow}' is not dynamic (runId=${manifest.runId})`,
 					);

package/src/runtime/capability-inventory.ts

@@ -1,4 +1,4 @@
-import type { AgentConfig, ResourceSource } from "../agents/agent-config.ts";
+import type { AgentConfig } from "../agents/agent-config.ts";
 import { discoverAgents } from "../agents/discover-agents.ts";
 import type { PiTeamsConfig } from "../config/config.ts";
 import { discoverSkills, getLastDiscoveryDiagnostics } from "../skills/discover-skills.ts";

package/src/runtime/chain-runner.ts

@@ -301,16 +301,16 @@ export class ChainRunner {
 		};
 
 		// Set step type based on matching pattern with type safety
-		if (teamMatch && teamMatch[1]) {
+		if (teamMatch?.[1]) {
 			parsed.team = this.sanitizeIdentifier(teamMatch[1]);
 		}
-		if (workflowMatch && workflowMatch[1]) {
+		if (workflowMatch?.[1]) {
 			parsed.workflow = this.sanitizeIdentifier(workflowMatch[1]);
 		}
-		if (templateMatch && templateMatch[1]) {
+		if (templateMatch?.[1]) {
 			parsed.template = this.sanitizeIdentifier(templateMatch[1]);
 		}
-		if (inlineMatch && inlineMatch[1]) {
+		if (inlineMatch?.[1]) {
 			parsed.inlineGoal = this.sanitizeInlineGoal(inlineMatch[1]);
 		}
 
@@ -334,7 +334,7 @@ export class ChainRunner {
 		const timeoutStr = this.extractFlag(step, "timeout");
 		if (timeoutStr) {
 			const timeoutMs = parseInt(timeoutStr, 10);
-			if (!isNaN(timeoutMs) && timeoutMs > 0 && timeoutMs <= 86400000) {
+			if (!Number.isNaN(timeoutMs) && timeoutMs > 0 && timeoutMs <= 86400000) {
 				parsed.timeout = timeoutMs * 1000; // Convert seconds to ms
 			}
 		}

package/src/runtime/checkpoint.ts

@@ -1,5 +1,6 @@
 import * as fs from "node:fs";
 import * as path from "node:path";
+import { atomicWriteFile } from "../state/atomic-write.ts";
 import { logInternalError } from "../utils/internal-error.ts";
 import { projectCrewRoot } from "../utils/paths.ts";
 import { assertSafePathId } from "../utils/safe-paths.ts";
@@ -73,22 +74,11 @@ export class FileCheckpointStore implements CheckpointStore {
 		// other's data (silent corruption) and the second rename hits ENOENT
 		// (silent data loss). Including taskId + pid + timestamp guarantees
 		// uniqueness across processes and across tasks.
-		const tmp = path.join(
-			this.checkpointDir(),
-			`.tmp.${checkpoint.taskId}.${process.pid}.${Date.now()}.${Math.random().toString(36).slice(2, 8)}`,
-		);
-		fs.writeFileSync(tmp, JSON.stringify(checkpoint, null, 2), "utf-8");
-		fs.renameSync(tmp, p);
-		// fsync parent directory to ensure the rename is durable
-		const dirFd = fs.openSync(this.checkpointDir(), "r");
-		try {
-			fs.fsyncSync(dirFd);
-		} catch {
-			// EPERM on Windows: opening a directory and fsync-ing it is not supported
-			// on all Windows configurations. Best-effort — the rename is still atomic.
-		} finally {
-			fs.closeSync(dirFd);
-		}
+		// atomicWriteFile handles temp + write + fsync(data) + rename + fsync(parent)
+		// with a UUID-based unique temp name (cross-process safe). The previous
+		// hand-rolled version missed data-fsync (ST-5), risking empty/stale content
+		// after power loss.
+		atomicWriteFile(p, JSON.stringify(checkpoint, null, 2));
 	}
 
 	load(runId: string, taskId: string): Checkpoint | null {

package/src/runtime/child-pi-constants.ts

@@ -0,0 +1,42 @@
+/**
+ * child-pi-constants.ts — Shared timing and capture constants for child-pi runtime.
+ *
+ * Extracted from child-pi.ts (H-7 decomposition, step 3). Zero behavior change.
+ *
+ * These constants are shared between runChildPi (in child-pi.ts) and the kill
+ * helpers (in child-pi-kill.ts). Centralizing them here avoids circular imports
+ * and makes the timing budget configurable from one place.
+ */
+
+import { DEFAULT_CHILD_PI } from "../config/defaults.ts";
+
+/** Post-exit window during which stdio is guarded against late writes. */
+export const POST_EXIT_STDIO_GUARD_MS = DEFAULT_CHILD_PI.postExitStdioGuardMs;
+
+/** Maximum time to wait for a final assistant event after the last stdout byte. */
+export const FINAL_DRAIN_MS = DEFAULT_CHILD_PI.finalDrainMs;
+
+/** Time after SIGTERM to escalate to SIGKILL. */
+export const HARD_KILL_MS = DEFAULT_CHILD_PI.hardKillMs;
+
+/** Maximum time with no output before the child is considered unresponsive. */
+export const RESPONSE_TIMEOUT_MS = DEFAULT_CHILD_PI.responseTimeoutMs;
+
+/**
+ * Maximum size (bytes) for the ChildPiLineObserver's line accumulation buffer.
+ * When exceeded, the buffer is force-flushed to prevent unbounded memory growth
+ * from chatty child processes that produce output without newlines.
+ */
+export const MAX_LINE_BUFFER_BYTES = 1024 * 1024; // 1 MB
+
+/** Maximum characters for assistant text fragments in compacted events. */
+export const MAX_ASSISTANT_TEXT_CHARS = DEFAULT_CHILD_PI.maxAssistantTextChars;
+
+/** Maximum characters for tool-result fragments in compacted events. */
+export const MAX_TOOL_RESULT_CHARS = DEFAULT_CHILD_PI.maxToolResultChars;
+
+/** Maximum characters for tool-input fragments in compacted events. */
+export const MAX_TOOL_INPUT_CHARS = DEFAULT_CHILD_PI.maxToolInputChars;
+
+/** Maximum characters for general compactable content (used by TruncationStage). */
+export const MAX_COMPACT_CONTENT_CHARS = DEFAULT_CHILD_PI.maxCompactContentChars;