pi-crew 0.9.41 → 0.9.44

package/docs/migration/atomic-write-v2-migration.md

@@ -1,5 +1,7 @@
 # atomic-write-v2 migration plan
 
+> **Note:** `atomic-write-v2.ts` was consolidated into `atomic-write.ts` as of v0.9.42. This document is preserved as historical record — the migration was completed with v1 winning on simplicity + symlink-safety + link+unlink atomicity. The v2 class was never adopted; no v2 API surface ships with pi-crew.
+
 > Status: **PROPOSED** — decision RECOMMEND MIGRATE (staged, feature-flagged).
 > Source: performance review `docs/perf/performance-review-2026-07.md` (findings F3–F6).
 > Scope: replace the standalone-function module `src/state/atomic-write.ts`

package/docs/superpowers/plans/2026-06-09-fallow-patterns-adoption.md

@@ -1,5 +1,7 @@
 # Fallow Patterns Adoption - Implementation Plan
 
+> **Note:** `atomic-write-v2` / `AtomicWriter` mentioned in this plan was consolidated into `atomic-write.ts` as of v0.9.42. This document is preserved as historical record — the v2 class was never adopted; v1 won on simplicity + symlink-safety + link+unlink atomicity. See `docs/migration/atomic-write-v2-migration.md` for the decision rationale.
+
 > **For agentic workers:** REQUIRED SUB-SKILL: Use superpowers:subagent-driven-development (recommended) or superpowers:executing-plans to implement this plan task-by-task. Steps use checkbox (`- [ ]`) syntax for tracking.
 
 **Goal:** Adopt 5 high-value patterns from fallow (Rust static analyzer) into pi-crew: structured error codes, atomic write v2 with fsync, health score system, plugin registry, and stable task ID refinement.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "pi-crew",
-  "version": "0.9.41",
+  "version": "0.9.44",
   "description": "Pi extension for coordinated AI teams, workflows, worktrees, and async task orchestration",
   "author": "baphuongna",
   "license": "MIT",
@@ -55,7 +55,7 @@
   ],
   "scripts": {
     "check": "npm run ci",
-    "ci": "npm run typecheck && npm run lint && npm run format:check && npm run check:conflict-markers && npm run check:lazy-imports && npm run check:bundle-staleness && npm test && npm pack --dry-run",
+    "ci": "npm run typecheck && npm run lint && npm run format:check && npm run check:conflict-markers && npm run check:lazy-imports && npm run check:bundle-staleness && npm run build:bundle && npm run test:bundle && npm test && npm pack --dry-run",
     "check:lazy-imports": "node scripts/check-lazy-imports.mjs",
     "check:bundle-staleness": "node scripts/check-bundle-staleness.mjs",
     "check:conflict-markers": "node scripts/check-conflict-markers.mjs",
@@ -68,8 +68,10 @@
     "test:integration": "node scripts/test-runner.mjs --test-concurrency=1 --test-timeout=300000 test/integration/*.test.ts",
     "test:smoke": "node scripts/test-runner.mjs --test-concurrency=1 --test-timeout=180000 test/smoke/*.smoke.ts",
     "build:bundle": "node scripts/build-bundle.mjs",
+    "test:bundle": "node --experimental-strip-types --test --test-force-exit test/unit/bundle-load.test.ts",
     "watch:bundle": "node scripts/watch-bundle.mjs",
     "build:bundle:once": "node scripts/watch-bundle.mjs --once",
+    "dev": "node scripts/dev-runner.mjs",
     "postinstall": "node scripts/postinstall.mjs",
     "install:crew-font": "node scripts/install-crew-vibes-font.mjs",
     "build:crew-font": "python scripts/build-crew-vibes-font.py",

package/scripts/README.md

@@ -0,0 +1,6 @@
+# Scripts
+
+> **Note:** Many scripts in this directory are one-off fix scripts (e.g.,
+> `fix-*.cjs`, `patch-*.cjs`) that were used for specific migrations or
+> bugfixes and could be archived. Only `postinstall.mjs`, `build-bundle.mjs`,
+> and `watch-bundle.mjs` are actively used by the project.

package/scripts/build-bundle.mjs

@@ -55,7 +55,8 @@ const result = await build({
 		"cli-highlight",
 		"diff",
 		"jiti",
-		"typebox",
+		"@sinclair/typebox",
+		"acorn",
 	],
 	// All node:* and Node-builtin modules are external by default for
 	// platform=node, but list explicitly for clarity.

package/scripts/check-all-skills.ts

@@ -9,9 +9,9 @@
  *   node scripts/check-all-skills.ts
  */
 
-import { spawnSync } from "child_process";
-import * as fs from "fs";
-import * as path from "path";
+import { spawnSync } from "node:child_process";
+import * as fs from "node:fs";
+import * as path from "node:path";
 
 interface SkillSummary {
 	name: string;

package/scripts/dev-runner.mjs

@@ -0,0 +1,106 @@
+#!/usr/bin/env node
+/**
+ * Dev runner — spawn `watch:bundle` and `test:watch` in parallel.
+ *
+ * Replaces the `npm-run-all --parallel watch:bundle test:watch` form that
+ * would require an additional dev-dependency. Uses Node's stdlib
+ * `child_process.spawn` so we keep the dev tooling dependency-free.
+ *
+ * Behavior:
+ *   - Spawns both child processes with stdio: inherit (the parent's TTY
+ *     sees both streams interleaved).
+ *   - Forwards Ctrl+C (SIGINT) and SIGTERM to both children so they shut
+ *     down cleanly when the user aborts.
+ *   - Exits with a non-zero code if EITHER child exits with a non-zero
+ *     status (mimics `npm-run-all --parallel` semantics).
+ *
+ * Usage:
+ *   npm run dev
+ *   node scripts/dev-runner.mjs
+ */
+
+import { spawn } from "node:child_process";
+import process from "node:process";
+
+const tasks = [
+	{ name: "watch:bundle", script: "watch:bundle" },
+	{ name: "test:watch", script: "test:watch" },
+];
+
+/**
+ * @typedef {{name: string, child: import("node:child_process").ChildProcess, exited: boolean, code: number|null, signal: NodeJS.Signals|null}} Task
+ */
+
+/** @type {Task[]} */
+const children = tasks.map((t) => ({
+	name: t.name,
+	child: spawnNpm(t.script),
+	exited: false,
+	code: null,
+	signal: null,
+}));
+
+let shuttingDown = false;
+let exitCode = 0;
+
+function spawnNpm(script) {
+	return spawn("npm", ["run", "--silent", script], {
+		stdio: "inherit",
+		env: process.env,
+	});
+}
+
+function maybeExit() {
+	if (!shuttingDown) return;
+	if (children.some((c) => !c.exited)) return;
+	process.exit(exitCode);
+}
+
+function shutdown(reason) {
+	if (shuttingDown) return;
+	shuttingDown = true;
+	process.stderr.write(`\n[dev-runner] received ${reason}, forwarding to children...\n`);
+	for (const c of children) {
+		if (c.exited) continue;
+		try {
+			c.child.kill("SIGTERM");
+		} catch {
+			/* already dead */
+		}
+	}
+	// Hard-kill grace window: if children ignore SIGTERM for 3s, send SIGKILL.
+	setTimeout(() => {
+		for (const c of children) {
+			if (c.exited) continue;
+			try {
+				c.child.kill("SIGKILL");
+			} catch {
+				/* already dead */
+			}
+		}
+	}, 3000).unref();
+	maybeExit();
+}
+
+for (const c of children) {
+	c.child.on("exit", (code, signal) => {
+		c.exited = true;
+		c.code = code;
+		c.signal = signal;
+		const note = signal ? `signal=${signal}` : `code=${code}`;
+		process.stderr.write(`[dev-runner] ${c.name} exited (${note})\n`);
+		// Non-zero is only meaningful when the child exited via code (not signal).
+		if (signal === null && code !== 0) exitCode = exitCode || (code ?? 1);
+		maybeExit();
+	});
+
+	c.child.on("error", (err) => {
+		process.stderr.write(`[dev-runner] failed to spawn ${c.name}: ${err.message}\n`);
+		c.exited = true;
+		exitCode = exitCode || 1;
+		maybeExit();
+	});
+}
+
+process.on("SIGINT", () => shutdown("SIGINT"));
+process.on("SIGTERM", () => shutdown("SIGTERM"));

package/scripts/postinstall.mjs

@@ -32,8 +32,12 @@ function main() {
 		// dist/index.mjs, so this best-effort build simply no-ops.
 		const bundleStatus = run("scripts/build-bundle.mjs");
 		if (bundleStatus !== 0) {
-			console.warn(
-				"[pi-crew] postinstall: bundle build skipped or failed; using committed dist/ (or strip-types fallback). Run npm run build:bundle to retry.",
+			// TB-11: Surface bundle failures loudly to stderr instead of console.warn,
+			// which can scroll off in noisy install logs. We still don't `process.exit(1)`
+			// here — the install itself must succeed via the strip-types fallback —
+			// but the failure must be obvious to whoever runs `npm install`.
+			process.stderr.write(
+				"\u001b[31m[pi-crew] postinstall: bundle build FAILED\u001b[0m — using committed dist/ (or strip-types fallback). Run 'npm run build:bundle' to retry. See logs above for esbuild errors.\n",
 			);
 		}
 		// Font install is best-effort and must never fail the install.

package/scripts/verify-skill.ts

@@ -12,8 +12,8 @@
  *   node scripts/verify-skill.ts skills/                                   # batch mode
  */
 
-import * as fs from "fs";
-import * as path from "path";
+import * as fs from "node:fs";
+import * as path from "node:path";
 
 interface Gate {
 	type: "red" | "green";

package/src/agents/agent-config.ts

@@ -83,7 +83,7 @@ export interface AgentConfig {
 	contextMode?: "fresh" | "fork";
 	/** Maximum turns for this agent. Overrides runtime config if set. */
 	maxTurns?: number;
-	/** Cap on output tokens per API call. Set via PI_CREW_MAX_OUTPUT_TOKENS env in child. */
+	/** Cap on output tokens per API call. Set via PI_CREW_MAX_OUTPUT env in child. */
 	maxTokens?: number;
 	/** Effort level for this agent. Controls how much work the agent puts in. */
 	effort?: "low" | "medium" | "high";

package/src/config/config.ts

@@ -169,7 +169,7 @@ export function invalidateConfigCache(): void {
 }
 
 function resolveHomeDir(): string {
-	const envValue = process.env.PI_TEAMS_HOME?.trim();
+	const envValue = (process.env.PI_TEAMS_HOME ?? process.env.PI_CREW_HOME)?.trim();
 	const defaultHome = os.homedir();
 	if (!envValue) return defaultHome;
 	// FIX (Round 14): When PI_TEAMS_HOME is explicitly set, validate that
@@ -676,6 +676,7 @@ function parseLimitsConfig(value: unknown): CrewLimitsConfig | undefined {
 		maxRetriesPerTask: parsePositiveInteger(obj.maxRetriesPerTask, LIMIT_CEILINGS.maxRetriesPerTask),
 		maxTasksPerRun: parsePositiveInteger(obj.maxTasksPerRun, LIMIT_CEILINGS.maxTasksPerRun),
 		heartbeatStaleMs: parsePositiveInteger(obj.heartbeatStaleMs, LIMIT_CEILINGS.heartbeatStaleMs),
+		serializeOnPathOverlap: parseWithSchema(Type.Boolean(), obj.serializeOnPathOverlap),
 	};
 	return Object.values(limits).some((entry) => entry !== undefined) ? limits : undefined;
 }
@@ -717,6 +718,17 @@ function parseRuntimeConfig(value: unknown): CrewRuntimeConfig | undefined {
 			Type.Union([Type.Literal("off"), Type.Literal("warn"), Type.Literal("block"), Type.Literal("fail")]),
 			obj.effectivenessGuard,
 		),
+		yield: (() => {
+			const y = asRecord(obj.yield);
+			if (!y) return undefined;
+			const parsed: NonNullable<CrewRuntimeConfig["yield"]> = {
+				enabled: parseWithSchema(Type.Boolean(), y.enabled),
+				maxReminders: parseWithSchema(Type.Integer({ minimum: 0 }), y.maxReminders),
+				reminderPrompt: parseWithSchema(Type.String({ maxLength: 1000 }), y.reminderPrompt),
+			};
+			return Object.values(parsed).some((v) => v !== undefined) ? parsed : undefined;
+		})(),
+		excludeContextBash: parseWithSchema(Type.Boolean(), obj.excludeContextBash),
 		isolationPolicy: parseIsolationPolicy(obj.isolationPolicy),
 	};
 	return Object.values(runtime).some((entry) => entry !== undefined) ? runtime : undefined;
@@ -815,6 +827,7 @@ function parseUiConfig(value: unknown): CrewUiConfig | undefined {
 		dashboardLiveRefreshMs: parseIntegerInRange(obj.dashboardLiveRefreshMs, 250, 60_000),
 		autoOpenDashboard: parseWithSchema(Type.Boolean(), obj.autoOpenDashboard),
 		autoOpenDashboardForForegroundRuns: parseWithSchema(Type.Boolean(), obj.autoOpenDashboardForForegroundRuns),
+		autoCloseDashboardMs: parseWithSchema(Type.Integer({ minimum: 0 }), obj.autoCloseDashboardMs),
 		showModel: parseWithSchema(Type.Boolean(), obj.showModel),
 		showTokens: parseWithSchema(Type.Boolean(), obj.showTokens),
 		showTools: parseWithSchema(Type.Boolean(), obj.showTools),
@@ -932,6 +945,11 @@ function parseReliabilityConfig(value: unknown): CrewReliabilityConfig | undefin
 		autoRecover: parseWithSchema(Type.Boolean(), obj.autoRecover),
 		deadletterThreshold: parsePositiveInteger(obj.deadletterThreshold),
 		cleanupOrphanedTempDirs: parseWithSchema(Type.Boolean(), obj.cleanupOrphanedTempDirs),
+		autoRepairIntervalMs: parseWithSchema(Type.Integer({ minimum: 0 }), obj.autoRepairIntervalMs),
+		forcePreflight: parseWithSchema(Type.Boolean(), obj.forcePreflight),
+		ambientStatusInjection: parseWithSchema(Type.Boolean(), obj.ambientStatusInjection),
+		perWriteValidation: parseWithSchema(Type.Boolean(), obj.perWriteValidation),
+		scopeModels: parseWithSchema(Type.Boolean(), obj.scopeModels),
 	};
 	return Object.values(reliability).some((entry) => entry !== undefined) ? reliability : undefined;
 }
@@ -985,6 +1003,7 @@ export function parseConfig(raw: unknown): PiTeamsConfig {
 		executeWorkers: parseWithSchema(Type.Boolean(), obj.executeWorkers),
 		notifierIntervalMs: parseWithSchema(Type.Number({ minimum: 1_000 }), obj.notifierIntervalMs),
 		requireCleanWorktreeLeader: parseWithSchema(Type.Boolean(), obj.requireCleanWorktreeLeader),
+		ignoreMethod: parseWithSchema(Type.Union([Type.Literal("gitignore"), Type.Literal("exclude")]), obj.ignoreMethod),
 		autonomous: parseAutonomousConfig(obj.autonomous),
 		limits: parseLimitsConfig(obj.limits),
 		runtime: parseRuntimeConfig(obj.runtime),

package/src/config/drift-detector.ts

@@ -50,10 +50,92 @@ export interface ConfigReferences {
 	workflows: Set<string>;
 }
 
+const MAX_CONFIG_KEY_DEPTH = 3;
+
+type ConfigSchemaNode = Record<string, unknown>;
+
+interface SchemaKeyResolution {
+	allowed: boolean;
+	childSchema?: unknown;
+}
+
+function isRecord(value: unknown): value is Record<string, unknown> {
+	return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+
+function schemaAlternatives(schema: unknown): ConfigSchemaNode[] {
+	if (!isRecord(schema)) return [];
+	const alternatives = Array.isArray(schema.anyOf) ? schema.anyOf.flatMap((entry) => schemaAlternatives(entry)) : [];
+	return [schema, ...alternatives];
+}
+
+function resolveSchemaKey(schema: unknown, key: string): SchemaKeyResolution {
+	let sawObjectSchema = false;
+	let allowsAdditionalProperties = false;
+	const childSchemas: unknown[] = [];
+
+	for (const candidate of schemaAlternatives(schema)) {
+		const properties = isRecord(candidate.properties) ? candidate.properties : undefined;
+		const patternProperties = isRecord(candidate.patternProperties) ? candidate.patternProperties : undefined;
+		if (candidate.type !== "object" && !properties && !patternProperties) continue;
+		sawObjectSchema = true;
+
+		if (properties && Object.hasOwn(properties, key)) {
+			childSchemas.push(properties[key]);
+			continue;
+		}
+
+		let matchedPattern = false;
+		if (patternProperties) {
+			for (const [pattern, childSchema] of Object.entries(patternProperties)) {
+				try {
+					if (new RegExp(pattern).test(key)) {
+						childSchemas.push(childSchema);
+						matchedPattern = true;
+						break;
+					}
+				} catch {
+					// Schema patterns are trusted constants; an invalid one simply cannot match.
+				}
+			}
+		}
+		if (!matchedPattern && candidate.additionalProperties !== false) {
+			allowsAdditionalProperties = true;
+		}
+	}
+
+	return {
+		allowed: !sawObjectSchema || childSchemas.length > 0 || allowsAdditionalProperties,
+		childSchema: childSchemas[0],
+	};
+}
+
 /**
- * Known top-level config keys allowed by the schema.
+ * Recursively compare object keys with their TypeBox schema nodes. Root is
+ * depth 0; nested objects are traversed through depth 3, which covers the
+ * deepest current config shapes (`goalWrap.<workflow>.verification` and
+ * `agents.overrides.<agent>`) without allowing attacker-controlled recursion.
  */
-const SCHEMA_KEYS: ReadonlySet<string> = new Set<string>(Object.keys(PiTeamsConfigSchema.properties ?? {}));
+function findUnknownConfigKeyPaths(value: unknown, schema: unknown, depth = 0, path: readonly string[] = []): string[][] {
+	if (!isRecord(value) || depth > MAX_CONFIG_KEY_DEPTH) return [];
+	const unknownPaths: string[][] = [];
+	for (const [key, childValue] of Object.entries(value)) {
+		const childPath = [...path, key];
+		const resolution = resolveSchemaKey(schema, key);
+		if (!resolution.allowed) {
+			unknownPaths.push(childPath);
+			continue;
+		}
+		if (resolution.childSchema !== undefined && depth < MAX_CONFIG_KEY_DEPTH) {
+			unknownPaths.push(...findUnknownConfigKeyPaths(childValue, resolution.childSchema, depth + 1, childPath));
+		}
+	}
+	return unknownPaths;
+}
+
+function isAgentOverrideKeyPath(path: readonly string[]): boolean {
+	return path.length === 4 && path[0] === "agents" && path[1] === "overrides";
+}
 
 /**
  * Extract all agent, team, and workflow names referenced in a raw config object.
@@ -94,7 +176,7 @@ function extractConfigReferences(config: Record<string, unknown>): ConfigReferen
  * 1. **Missing**: resource referenced in config (e.g. agents.overrides) but not discovered → error
  * 2. **Extra**: discovered resource not referenced anywhere in config → warning
  * 3. **Mismatched**: resource exists in both but with structural differences → warning
- * 4. **Config keys**: config keys not present in the schema → warning
+ * 4. **Config keys**: config keys not present in the schema, recursively through depth 3 → warning
  *
  * For agents: compares against `agents.overrides` in config. Discovered agents not in overrides
  * are NOT considered extra (they may be built-in). Only agents referenced in overrides but not
@@ -140,18 +222,18 @@ export function detectDrift(discovered: DiscoveredResources, config: PiTeamsConf
 	// No extra/missing checks for workflows from config alone.
 
 	// --- Config-key drift ---
-	const configKeys = Object.keys(configRaw);
-	for (const key of configKeys) {
-		if (!SCHEMA_KEYS.has(key)) {
-			items.push({
-				kind: "config-key",
-				name: key,
-				status: "extra",
-				expected: `key not in schema`,
-				actual: `present in config`,
-				severity: "warning",
-			});
-		}
+	for (const keyPath of findUnknownConfigKeyPaths(configRaw, PiTeamsConfigSchema)) {
+		// Preserve the existing, more specific agent/mismatched finding for
+		// agents.overrides.<agent>.<key> instead of reporting the same key twice.
+		if (isAgentOverrideKeyPath(keyPath)) continue;
+		items.push({
+			kind: "config-key",
+			name: keyPath.join("."),
+			status: "extra",
+			expected: `key not in schema`,
+			actual: `present in config`,
+			severity: "warning",
+		});
 	}
 
 	// --- Mismatched config-key check ---

package/src/config/resilient-parser.ts

@@ -86,11 +86,11 @@ export function parseConfigResilient(raw: unknown): ResilientParseResult {
 		const value = raw[key];
 		const subSchema = (PiTeamsConfigSchema.properties as Record<string, unknown>)[key];
 		if (subSchema && !Value.Check(subSchema as TSchema, value)) {
-			// Collect the first error for this field
+			// Collect ALL errors for this field
 			const fieldErrors = [...Value.Errors(subSchema as TSchema, value)];
-			if (fieldErrors.length > 0) {
-				const first = fieldErrors[0] as unknown as Record<string, unknown>;
-				const msg = typeof first.message === "string" ? first.message : "invalid value";
+			for (const err of fieldErrors) {
+				const errObj = err as unknown as Record<string, unknown>;
+				const msg = typeof errObj.message === "string" ? errObj.message : "invalid value";
 				errors.push({
 					field: key,
 					message: msg,

package/src/config/types.ts

@@ -15,8 +15,6 @@ export interface PiTeamsAutonomousConfig {
 	preferAsyncForLongTasks?: boolean;
 	allowWorktreeSuggestion?: boolean;
 	magicKeywords?: Record<string, string[]>;
-	/** Mark certain bash commands as excludeFromContext to reduce context tokens. Default: false */
-	excludeContextBash?: boolean;
 }
 
 export interface CrewLimitsConfig {

package/src/extension/crew-cleanup.ts

@@ -93,11 +93,25 @@ export function registerCleanupHandler(pi: ExtensionAPI): void {
 
 async function cleanupChildProcesses(): Promise<void> {
 	const pids = childProcessRegistry.getAllPids();
-
+	if (pids.length === 0) return;
+	// Lazy-import to avoid eagerly pulling the heavy runtime/child-pi chain into the
+	// extension load path (check-lazy-imports) AND to avoid a static import cycle
+	// (child-pi.ts already imports registerChildProcess from this module).
+	// LAZY: defer child-pi.ts load (heavy runtime chain) + avoid static import cycle.
+	const { killProcessPid } = await import("../runtime/child-pi.ts");
 	for (const pid of pids) {
+		// killProcessPid signals the whole process GROUP (-pid on POSIX, taskkill /T on
+		// Windows) and escalates to SIGKILL after HARD_KILL_MS. A bare
+		// process.kill(pid, "SIGTERM") only reaches the direct child — grandchildren
+		// (bash/MCP the worker spawned) in the child's group survive as orphans, and
+		// a child that lags SIGTERM would linger forever with no escalation.
+		// NOTE: on graceful session_shutdown (reason=quit/reload) register.ts ALSO runs
+		// terminateActiveChildPiProcesses(); both are idempotent for a dying pid. This
+		// signal handler (SIGTERM/SIGHUP) is the SOLE teardown path when the Pi process
+		// is killed by signal, so it must be robust on its own.
 		try {
-			process.kill(pid, "SIGTERM");
-			console.log(`[pi-crew] Sent SIGTERM to child process ${pid}`);
+			killProcessPid(pid);
+			console.log(`[pi-crew] Sent group SIGTERM (+SIGKILL escalation) to child process ${pid}`);
 		} catch (error: unknown) {
 			// Process may already be dead or not exist
 			const err = error as NodeJS.ErrnoException;

package/src/extension/crew-vibes/config.ts

@@ -13,7 +13,7 @@ export const CAPACITY_STATUS_ID = "pi-crew-bar";
 export const PROVIDER_STATUS_ID = "pi-crew-bar";
 
 function resolveHome(): string {
-	return process.env.PI_TEAMS_HOME?.trim() || process.env.HOME || process.env.USERPROFILE || "";
+	return (process.env.PI_TEAMS_HOME ?? process.env.PI_CREW_HOME)?.trim() || process.env.HOME || process.env.USERPROFILE || "";
 }
 
 export function configPath(): string {

package/src/extension/crew-vibes/font-detect.ts

@@ -33,18 +33,30 @@ export function hasCrewFontFile(): boolean {
 	return _hasFontFile;
 }
 
+let _isWebTerminal: boolean | null = null;
+
 /** Returns true when running in a web-based terminal (gotty, wetty, etc.)
  * where system fonts are not available for PUA rendering. */
 export function isWebTerminal(): boolean {
-	if (process.env.GOTTY || process.env.WEBTERM) return true;
-	if (process.env.TERM === "dumb") return true;
+	if (_isWebTerminal !== null) return _isWebTerminal;
+	if (process.env.GOTTY || process.env.WEBTERM) {
+		_isWebTerminal = true;
+		return true;
+	}
+	if (process.env.TERM === "dumb") {
+		_isWebTerminal = true;
+		return true;
+	}
 	try {
 		// Check current process and ancestors — gotty is often the grandparent
 		// (gotty → tmux → pi), so /proc/self/cgroup may not contain it.
 		let pid = process.pid;
 		for (let i = 0; i < 6 && pid > 1; i++) {
 			const cgroup = readFileSync(`/proc/${pid}/cgroup`, "utf8");
-			if (cgroup.includes("gotty") || cgroup.includes("wetty")) return true;
+			if (cgroup.includes("gotty") || cgroup.includes("wetty")) {
+				_isWebTerminal = true;
+				return true;
+			}
 			const match = cgroup.match(/\d+:.*:(.*)/);
 			// Read PPid from status
 			const status = readFileSync(`/proc/${pid}/status`, "utf8");
@@ -54,5 +66,6 @@ export function isWebTerminal(): boolean {
 	} catch {
 		// not Linux or /proc not available
 	}
+	_isWebTerminal = false;
 	return false;
 }

package/src/extension/crew-vibes/index.ts

@@ -19,7 +19,7 @@ function safeUiCall(scope: string, fn: () => void): void {
 	}
 }
 
-import { type CrewVibesConfig, loadConfig, PROVIDER_STATUS_ID, saveConfig } from "./config.ts";
+import { type CrewVibesConfig, loadConfig, saveConfig } from "./config.ts";
 import { intervalForSpeed } from "./figures.ts";
 import { type CrewVibesFooterSource, createCrewVibesFooter } from "./footer.ts";
 import { clearProviderUsageCache, fetchProviderUsage, type ProviderUsage } from "./provider-usage.ts";

package/src/extension/cross-extension-rpc.ts

@@ -1,6 +1,6 @@
 import type { ExtensionContext } from "@earendil-works/pi-coding-agent";
 import type { TeamToolParamsValue } from "../schema/team-tool-schema.ts";
-import { resolveContainedPath } from "../utils/safe-paths.ts";
+import { resolveRealContainedPath } from "../utils/safe-paths.ts";
 import { withHmacVerification } from "./rpc-hmac.ts";
 // Lazy-loaded to avoid pulling team-tool.ts (and its entire runtime chain) into module load.
 import type { handleTeamTool as HandleTeamToolFn } from "./team-tool.ts";
@@ -109,7 +109,10 @@ export function resetRpcRateLimit(): void {
 	rpcRunTimestamps.length = 0;
 }
 
-function isAllowedRpcRunParams(params: TeamToolParamsValue): {
+export function isAllowedRpcRunParams(
+	params: TeamToolParamsValue,
+	ctx: ExtensionContext,
+): {
 	ok: boolean;
 	error?: string;
 } {
@@ -123,10 +126,16 @@ function isAllowedRpcRunParams(params: TeamToolParamsValue): {
 			error: "RPC run requires config.intent (a non-empty intent string)",
 		};
 	}
-	// SECURITY: Validate cwd is within the project directory if provided.
+	// SECURITY: Validate cwd, if provided, resolves WITHIN the project directory (ctx.cwd).
+	// Arg order is (baseDir=ctx.cwd, targetPath=params.cwd): the project dir is the container,
+	// the caller-supplied cwd is the contained target. (Previously the args were swapped —
+	// resolveContainedPath(params.cwd, ".") — which validates that "." is inside params.cwd,
+	// trivially true for ANY path, so the check never rejected anything.)
+	// NOTE: defense-in-depth — handleTeamTool currently uses ctx.cwd and ignores params.cwd,
+	// but a correct guard here prevents a future regression from silently enabling cwd escape.
 	if (params.cwd && typeof params.cwd === "string") {
 		try {
-			resolveContainedPath(params.cwd, ".");
+			resolveRealContainedPath(ctx.cwd, params.cwd);
 		} catch {
 			return {
 				ok: false,
@@ -152,6 +161,10 @@ export function registerPiCrewRpc(
 	getCtx: () => ExtensionContext | undefined,
 ): PiCrewRpcHandle | undefined {
 	if (!events) return undefined;
+	// Note: the prior loud startup warning has been replaced by a soft, opt-out
+	// info note emitted lazily by withHmacVerification only when an actual RPC
+	// request is processed (see rpc-hmac.ts). This avoids noisy output during
+	// every pi load for users who never wire cross-extension RPC.
 	const unsubs = [
 		on(
 			events,
@@ -214,7 +227,7 @@ export function registerPiCrewRpc(
 					} else {
 						params = { action: "run" };
 					}
-					const permission = isAllowedRpcRunParams(params);
+					const permission = isAllowedRpcRunParams(params, ctx);
 					if (!permission.ok) {
 						reply(events, "pi-crew:rpc:run", id, {
 							success: false,
@@ -269,10 +282,14 @@ export function registerPiCrewRpc(
 				}
 			}, "pi-crew:rpc:status"),
 		),
-		on(events, "pi-crew:live-control", (raw) => {
-			const request = parseLiveControlRealtimeMessage(raw);
-			if (request) publishLiveControlRealtime(request);
-		}),
+		on(
+			events,
+			"pi-crew:live-control",
+			withHmacVerification((raw) => {
+				const request = parseLiveControlRealtimeMessage(raw);
+				if (request) publishLiveControlRealtime(request);
+			}, "pi-crew:live-control"),
+		),
 		on(
 			events,
 			"pi-crew:rpc:live-control",