pi-crew 0.9.42 → 0.9.46

package/src/state/locks.ts

@@ -1,7 +1,9 @@
+import { AsyncLocalStorage } from "node:async_hooks";
 import { randomUUID, timingSafeEqual } from "node:crypto";
 import * as fs from "node:fs";
 import * as path from "node:path";
 import { DEFAULT_LOCKS } from "../config/defaults.ts";
+import { logInternalError } from "../utils/internal-error.ts";
 import { sleepSync } from "../utils/sleep.ts";
 import { isSymlinkSafePath } from "./atomic-write.ts";
 import type { TeamRunManifest } from "./types.ts";
@@ -103,41 +105,56 @@ function isLockHolderAlive(filePath: string): boolean {
  *
  * See also: SECURITY-ISSUES.md SEC-008 for documented acceptance.
  */
-function readLockSnapshot(filePath: string, staleMs: number): { canSteal: boolean } {
+function readLockSnapshot(filePath: string, staleMs: number, options?: { treatOwnPidAsStealable?: boolean }): { canSteal: boolean } {
+	const treatOwnPidAsStealable = options?.treatOwnPidAsStealable === true;
 	let stat: fs.Stats | undefined;
 	let raw: string | undefined;
 	try {
 		stat = fs.statSync(filePath);
 		raw = fs.readFileSync(filePath, "utf-8");
-	} catch {
-		// File vanished between writeLockFile's EEXIST and now (holder released).
-		// Loop will retry the create; safe to signal "nothing to steal".
+	} catch (error) {
+		// FIX (CI flake): when the lock file vanishes between writeLockFile's
+		// EEXIST and our read here, the holder has released — return canSteal:true
+		// so the acquire loop retries the create instead of throwing a false
+		// "locked" error.
+		const code = (error as NodeJS.ErrnoException).code;
+		if (code === "ENOENT") {
+			return { canSteal: true };
+		}
+		// Transient I/O error — be conservative (don't steal, retry the read on
+		// next attempt).
 		return { canSteal: false };
 	}
 	// Staleness from a single snapshot.
 	let createdAt = parseCreatedAtFromLock(raw);
 	if (createdAt === undefined) createdAt = stat.mtimeMs;
 	const isStale = Date.now() - createdAt > staleMs;
-	// Holder liveness from the SAME snapshot.
-	let isAlive = true; // Unknown holder — assume alive to be safe (matches isLockHolderAlive).
+	let holderPid: number | undefined;
+	let isAlive = true;
 	try {
 		const parsed = JSON.parse(raw) as { pid?: unknown };
-		const pid = typeof parsed.pid === "number" ? parsed.pid : undefined;
-		if (pid !== undefined) {
-			try {
-				process.kill(pid, 0);
-				isAlive = true;
-			} catch (error) {
-				const code = (error as NodeJS.ErrnoException).code;
-				// EPERM/ESRCH → treat as not-alive (stealable), see isLockHolderAlive.
-				isAlive = false;
-			}
-		}
+		holderPid = typeof parsed.pid === "number" ? parsed.pid : undefined;
 	} catch {
 		/* malformed payload — keep isAlive=true */
 	}
-	// Steal if stale OR holder dead — matches the original intent.
-	return { canSteal: isStale || !isAlive };
+	if (holderPid !== undefined) {
+		try {
+			process.kill(holderPid, 0);
+			isAlive = true;
+		} catch (error) {
+			const code = (error as NodeJS.ErrnoException).code;
+			// EPERM/ESRCH → treat as not-alive (stealable), see isLockHolderAlive.
+			isAlive = false;
+		}
+	}
+	// Steal if stale OR holder dead. Optionally steal if holder is our own pid
+	// (used by withRunLock* which is single-process — a fresh lock with our pid
+	// between acquisitions is just a leftover from a previous call that
+	// releaseOwnLock didn't get to delete yet; safe to steal).
+	const isOurOwnHolder = holderPid === process.pid;
+	return {
+		canSteal: isStale || !isAlive || (treatOwnPidAsStealable && isOurOwnHolder),
+	};
 }
 
 /**
@@ -221,6 +238,34 @@ function timingSafeTokenMatch(a: string, b: string): boolean {
 	return timingSafeEqual(bufA, bufB);
 }
 
+/**
+ * Release the lock we (this process) just acquired. Unlike releaseLock, this
+ * unconditionally removes the file because we know we created it in the same
+ * withRunLock* call — token matching is only needed for multi-process scenarios
+ * (where a different holder's token must not be deleted). Within the same process
+ * the new acquire uses a fresh randomUUID token, so token matching would falsely
+ * fail and leak the file across releases.
+ *
+ * Symlink guard is preserved: if a symlink appeared since our writeLockFile, we
+ * don't rm it (defense against attacker-planted symlinks).
+ */
+export function releaseOwnLock(filePath: string, _token: string): void {
+	try {
+		const stat = fs.lstatSync(filePath);
+		if (stat.isSymbolicLink()) return;
+	} catch {
+		/* ENOENT is fine */
+	}
+	try {
+		fs.rmSync(filePath, { force: true });
+	} catch (error) {
+		const code = (error as NodeJS.ErrnoException).code;
+		if (code !== "ENOENT") {
+			logInternalError("lock-release-own", error, filePath, "warn");
+		}
+	}
+}
+
 function releaseLock(filePath: string, token: string): void {
 	// FIX: Do not delete a symlink — it may have been planted by an attacker
 	// after our lock was released. A legitimate lock file should never be a
@@ -265,7 +310,9 @@ function acquireLockWithRetry(filePath: string, staleMs: number, kind: LockKind
 			}
 			// Round 26 (BUG 1): single-snapshot read closes the TOCTOU window between
 			// separate stale + alive reads (which could race stale→fresh).
-			const { canSteal } = readLockSnapshot(filePath, staleMs);
+			// treatOwnPidAsStealable=false (this is the sync file-lock path used
+			// by withFileLockSync — never steal a fresh lock even if it has our pid).
+			const { canSteal } = readLockSnapshot(filePath, staleMs, { treatOwnPidAsStealable: false });
 			if (!canSteal) {
 				throw new Error(`Run '${path.basename(filePath)}' is locked by another operation.`);
 			}
@@ -300,7 +347,13 @@ async function acquireLockWithRetryAsync(filePath: string, staleMs: number, kind
 				throw new Error(`Run '${path.basename(filePath)}' is locked by another operation.`);
 			}
 			// Round 26 (BUG 1): single-snapshot read (see sync variant).
-			const { canSteal } = readLockSnapshot(filePath, staleMs);
+			// FIX (CI flake): treatOwnPidAsStealable=true for the run-lock async path
+			// (withRunLock). Between acquisitions in parallel-research scaffold mode,
+			// the previous releaseOwnLock leaves a microsecond window where the
+			// file still exists with our own pid. Stealing it avoids spurious 'locked'
+			// errors. The sync file-lock path (withFileLockSync) above uses false to
+			// preserve the multi-process safety guarantee.
+			const { canSteal } = readLockSnapshot(filePath, staleMs, { treatOwnPidAsStealable: true });
 			if (!canSteal) {
 				throw new Error(`Run '${path.basename(filePath)}' is locked by another operation.`);
 			}
@@ -379,48 +432,131 @@ export function withFileLockSync<T>(filePath: string, fn: () => T, options: RunL
 	}
 }
 
+// H-1: track re-entrant run-lock acquisitions PER ASYNC CONTEXT (not process-global).
+// Previously a module-global Map caused a bug: when withRunLock (async) yielded at
+// `await fn()`, a concurrent withRunLockSync for the same run — fired from a
+// different async context (e.g. a child stdout event handler) — saw the holder's
+// token and bypassed the file lock entirely, allowing two writers in the critical
+// section simultaneously. AsyncLocalStorage scopes the "held" set to the current
+// async context, so a call from a different async context no longer bypasses and
+// properly serializes against the on-disk lock. True nested calls in the SAME
+// async context (e.g. handleResume -> executeTeamRun -> executeTeamRunCore) still
+// bypass via lockCtx.getStore(), avoiding the deadlock the bypass was designed for.
+const lockCtx = new AsyncLocalStorage<Set<string>>();
+// Round 29: parallel map for withFileLockSync re-entrance. See the comment
+// at the top of withFileLockSync for the full deadlock mechanism.
+const fileLockHeldByUs = new Map<string, string>(); // lockFile -> token
+
+// --- Async file lock (non-blocking alternative to withFileLockSync) ---
+// Uses a promise-chain pattern to serialize per-path access without blocking
+// the Node.js event loop. Unlike withFileLockSync (which uses O_EXCL +
+// sleepSync for cross-process safety), this is **in-process only** —
+// sufficient for single-process mailbox writes (team-runner is single-process).
+// Mirrors the structure of withEventLogLockAsync in event-log.ts.
+const fileAsyncLocks = new Map<string, Promise<unknown>>();
+
+// FIND-02 follow-up (P3): re-entrance guard for the async file lock, mirroring
+// the lockCtx pattern used by withRunLock. A future caller doing same-path
+// nested withFileLockAsync(path, ...) inside another withFileLockAsync(path,
+// ...) in the SAME async context would otherwise deadlock (the nested call
+// chains after the outer's still-pending promise). AsyncLocalStorage scopes
+// the held set to the current async context so cross-context callers still
+// serialize via the promise chain (Phase 1 mailbox path is unaffected).
+const fileAsyncLockCtx = new AsyncLocalStorage<Set<string>>();
+
+export async function withFileLockAsync<T>(filePath: string, fn: () => Promise<T>): Promise<T> {
+	// Re-entrant within the same async context — run fn() directly (no chaining).
+	// Same semantics as the sync guard in withFileLockSync (fileLockHeldByUs)
+	// and the async guard in withRunLock (lockCtx).
+	if (fileAsyncLockCtx.getStore()?.has(filePath)) {
+		return await fn();
+	}
+	// Merge with the parent context's held set so nested DIFFERENT-path locks
+	// also bypass correctly (prevents cross-path deadlock, matching withRunLock).
+	const prevHeld = fileAsyncLockCtx.getStore() ?? new Set<string>();
+	const held = new Set(prevHeld);
+	held.add(filePath);
+	const prev = fileAsyncLocks.get(filePath) ?? Promise.resolve();
+	// Chain fn after the previous holder. `next` may reject (propagating to the
+	// caller), but `stored` never rejects so subsequent waiters aren't blocked.
+	// fn() is wrapped in fileAsyncLockCtx.run so nested same-context calls see
+	// `held` and bypass the promise chain (re-entrant), while cross-context
+	// callers chain normally via `prev`.
+	const next = prev.then(() => fileAsyncLockCtx.run(held, () => fn()));
+	const stored = next.then(
+		() => undefined,
+		() => undefined,
+	);
+	fileAsyncLocks.set(filePath, stored);
+	try {
+		return await next;
+	} finally {
+		// Compare-and-delete: only remove our entry if it still points at `stored`.
+		// With 3+ overlapping callers, an earlier caller's finally would otherwise
+		// delete a later caller's promise, breaking mutual exclusion.
+		if (fileAsyncLocks.get(filePath) === stored) {
+			fileAsyncLocks.delete(filePath);
+		}
+	}
+}
+
 export function withRunLockSync<T>(manifest: TeamRunManifest, fn: () => T, options: RunLockOptions = {}): T {
 	const filePath = lockPath(manifest);
 	const staleMs = options.staleMs ?? DEFAULT_STALE_MS;
-	const existingToken = runLockHeldByUs.get(filePath);
-	if (existingToken) {
-		// Re-entrant: already hold this lock, just run the callback.
+	// H-1: re-entrance check is scoped to the current async context, not process-global.
+	// A call from a DIFFERENT async context (e.g. a child-stdout event handler that
+	// runs while an async holder is awaiting) sees no held set and properly serializes.
+	if (lockCtx.getStore()?.has(filePath)) {
+		// Re-entrant within the same async context — already hold this lock.
 		return fn();
 	}
 	fs.mkdirSync(path.dirname(filePath), { recursive: true });
 	const token = acquireLockWithRetry(filePath, staleMs, "run");
-	runLockHeldByUs.set(filePath, token);
-	try {
-		return fn();
-	} finally {
-		runLockHeldByUs.delete(filePath);
-		releaseLock(filePath, token);
-	}
+	const prevHeld = lockCtx.getStore() ?? new Set<string>();
+	const newHeld = new Set(prevHeld);
+	newHeld.add(filePath);
+	// Enter a new async context (or extend the current one) carrying the held set.
+	// On exit (sync return OR async resume after an awaited child), the context is
+	// restored — so the held set only contains locks acquired within fn()'s subtree.
+	return lockCtx.run(newHeld, () => {
+		try {
+			return fn();
+		} finally {
+			// FIX (CI flake): releaseLock uses token matching to prevent the
+			// "losing contender wipes winner's lock" race in multi-process scenarios.
+			// But within withRunLockSync/withRunLock (same process), the new acquire
+			// uses a FRESH random token — the previous stored token doesn't match the
+			// current token — and the lock file is never removed. Repeat acquisitions
+			// then keep failing with EEXIST because the file lingers.
+			// Since withRunLock* is always single-process, unconditionally delete
+			// (symlink guard is still applied for safety).
+			releaseOwnLock(filePath, token);
+		}
+	});
 }
 
-// Track re-entrant lock acquisitions per lock file path. When a lock is
-// already held by this call stack (handleResume -> executeTeamRun ->
-// executeTeamRunCore), we skip re-acquisition to avoid deadlock.
-const runLockHeldByUs = new Map<string, string>(); // filePath -> token
-// Round 29: parallel map for withFileLockSync re-entrance. See the comment
-// at the top of withFileLockSync for the full deadlock mechanism.
-const fileLockHeldByUs = new Map<string, string>(); // lockFile -> token
-
 export async function withRunLock<T>(manifest: TeamRunManifest, fn: () => Promise<T>, options: RunLockOptions = {}): Promise<T> {
 	const filePath = lockPath(manifest);
 	const staleMs = options.staleMs ?? DEFAULT_STALE_MS;
-	const existingToken = runLockHeldByUs.get(filePath);
-	if (existingToken) {
-		// Re-entrant: already hold this lock, just run the callback.
+	if (lockCtx.getStore()?.has(filePath)) {
+		// Re-entrant within the same async context.
 		return await fn();
 	}
 	fs.mkdirSync(path.dirname(filePath), { recursive: true });
 	const token = await acquireLockWithRetryAsync(filePath, staleMs, "run");
-	runLockHeldByUs.set(filePath, token);
-	try {
-		return await fn();
-	} finally {
-		runLockHeldByUs.delete(filePath);
-		releaseLock(filePath, token);
-	}
+	const prevHeld = lockCtx.getStore() ?? new Set<string>();
+	const newHeld = new Set(prevHeld);
+	newHeld.add(filePath);
+	// AsyncLocalStorage propagates across await boundaries, so any code that
+	// resumes after an await inside fn() (including microtasks, timers, and
+	// awaited child Pi results) still sees newHeld.
+	return await lockCtx.run(newHeld, async () => {
+		try {
+			return await fn();
+		} finally {
+			// FIX (CI flake): see withRunLockSync above — use releaseOwnLock for
+			// unconditional deletion of the lock file we created (same process).
+			releaseOwnLock(filePath, token);
+		}
+	});
 }

package/src/state/mailbox.ts

@@ -5,7 +5,7 @@ import { logInternalError } from "../utils/internal-error.ts";
 import { redactSecrets } from "../utils/redaction.ts";
 import { atomicWriteFile } from "./atomic-write.ts";
 import { withEventLogLockSync } from "./event-log.ts";
-import { withFileLockSync } from "./locks.ts";
+import { withFileLockAsync, withFileLockSync } from "./locks.ts";
 import type { TeamRunManifest } from "./types.ts";
 
 export type MailboxDirection = "inbox" | "outbox";
@@ -377,19 +377,61 @@ function readAllInboxMessages(manifest: TeamRunManifest): MailboxMessage[] {
 	return readAllMessages(manifest, "inbox");
 }
 
+// FIND-01: in-process delivery cache to avoid O(N²) re-reads on every append.
+// Keyed by delivery file path; invalidated by mtime check on read + updated on
+// write. Team-runner is single-process so in-process caching is sufficient.
+const deliveryCache = new Map<string, { mtimeMs: number; state: MailboxDeliveryState }>();
+const MAX_DELIVERY_CACHE_ENTRIES = 256;
+// R1 review fix: setDeliveryCacheEntry stores an immutable snapshot (deep
+// copy of `messages`) so callers mutating the returned state cannot corrupt
+// the cache (TOCTOU race), and bounds the map size with FIFO eviction to
+// prevent unbounded growth across runs.
+function setDeliveryCacheEntry(filePath: string, entry: { mtimeMs: number; state: MailboxDeliveryState }): void {
+	if (deliveryCache.size >= MAX_DELIVERY_CACHE_ENTRIES) {
+		const oldest = deliveryCache.keys().next().value;
+		if (oldest !== undefined) deliveryCache.delete(oldest);
+	}
+	deliveryCache.set(filePath, {
+		mtimeMs: entry.mtimeMs,
+		state: { ...entry.state, messages: { ...entry.state.messages } },
+	});
+}
+
 export function readDeliveryState(manifest: TeamRunManifest): MailboxDeliveryState {
+	const filePath = deliveryFile(manifest);
+	let stat: fs.Stats;
 	try {
-		const raw = JSON.parse(fs.readFileSync(deliveryFile(manifest), "utf-8")) as unknown;
+		stat = fs.statSync(filePath);
+	} catch (e) {
+		// R1 review fix: narrow to ENOENT so permission errors aren't silently
+		// treated as "missing file" (would wipe a valid cache entry).
+		if ((e as NodeJS.ErrnoException).code !== "ENOENT") throw e;
+		deliveryCache.delete(filePath);
+		return { messages: {}, updatedAt: new Date().toISOString() };
+	}
+	const cached = deliveryCache.get(filePath);
+	if (cached && cached.mtimeMs === stat.mtimeMs) {
+		// R2 review fix: return a copy so callers mutating the result cannot
+		// leak into the cached snapshot (residual TOCTOU: the cache holds the
+		// snapshot until the next write replaces it; without this copy, a
+		// pre-write mutation by one caller would be persisted into the
+		// post-write snapshot by the next writer's setDeliveryCacheEntry).
+		return { ...cached.state, messages: { ...cached.state.messages } };
+	}
+	try {
+		const raw = JSON.parse(fs.readFileSync(filePath, "utf-8")) as unknown;
 		if (!raw || typeof raw !== "object" || Array.isArray(raw)) throw new Error("Invalid delivery state.");
 		const obj = raw as Record<string, unknown>;
 		const messages: Record<string, MailboxMessageStatus> = {};
 		if (obj.messages && typeof obj.messages === "object" && !Array.isArray(obj.messages)) {
 			for (const [id, status] of Object.entries(obj.messages)) if (isStatus(status)) messages[id] = status;
 		}
-		return {
+		const state: MailboxDeliveryState = {
 			messages,
 			updatedAt: typeof obj.updatedAt === "string" ? obj.updatedAt : new Date().toISOString(),
 		};
+		setDeliveryCacheEntry(filePath, { mtimeMs: stat.mtimeMs, state });
+		return state;
 	} catch {
 		return { messages: {}, updatedAt: new Date().toISOString() };
 	}
@@ -414,9 +456,20 @@ function writeDeliveryState(
 	// F4: mailbox delivery is informational — accept losing the very last write on
 	// a hard crash (the next message will overwrite it on disk). Cheaper fsync on
 	// the hot path; terminal/reply paths still pass full durability below.
-	atomicWriteFile(deliveryFile(manifest, true), `${JSON.stringify(redactSecrets(state), null, 2)}\n`, {
+	const filePath = deliveryFile(manifest, true);
+	atomicWriteFile(filePath, `${JSON.stringify(redactSecrets(state), null, 2)}\n`, {
 		durability: options?.durability ?? "best-effort",
 	});
+	// FIND-01: update cache with post-write mtime so subsequent reads get a hit.
+	try {
+		const postStat = fs.statSync(filePath);
+		// setDeliveryCacheEntry stores an immutable snapshot (deep copy of
+		// messages) so subsequent read-modify-write callers mutating the
+		// returned state cannot corrupt the cache.
+		setDeliveryCacheEntry(filePath, { mtimeMs: postStat.mtimeMs, state });
+	} catch {
+		deliveryCache.delete(filePath);
+	}
 }
 
 /**
@@ -541,6 +594,114 @@ export function appendFollowUpMessage(
 	});
 }
 
+/**
+ * FIND-02: Async variant of appendMailboxMessage for the live-session path.
+ * Uses withFileLockAsync (promise-chain, no sleepSync) instead of
+ * withEventLogLockSync/withFileLockSync, preventing event-loop stalls during
+ * steering/follow-up delivery. readDeliveryState/writeDeliveryState remain
+ * sync but are cheap thanks to the FIND-01 delivery cache.
+ */
+export async function appendMailboxMessageAsync(
+	manifest: TeamRunManifest,
+	message: Omit<MailboxMessage, "id" | "runId" | "createdAt" | "status"> & {
+		id?: string;
+		status?: MailboxMessageStatus;
+	},
+): Promise<MailboxMessage> {
+	if (message.taskId) ensureTaskMailbox(manifest, message.taskId);
+	else ensureRunMailbox(manifest);
+	const createdAt = new Date().toISOString();
+	const complete: MailboxMessage = {
+		id: message.id ?? `msg_${Date.now().toString(36)}_${Math.random().toString(36).slice(2, 8)}`,
+		runId: manifest.runId,
+		direction: message.direction,
+		from: message.from,
+		to: message.to,
+		body: message.body,
+		createdAt,
+		status: message.status ?? "queued",
+		kind: message.kind,
+		priority: message.priority,
+		deliveryMode: message.deliveryMode,
+		taskId: message.taskId,
+		data: message.data,
+		replyTo: message.replyTo,
+		replyFrom: message.replyFrom,
+		replyDeadline: message.replyDeadline,
+		repliedAt: message.repliedAt,
+		replyContent: message.replyContent,
+	};
+	const mbFile = mailboxFile(manifest, complete.direction, complete.taskId);
+	await withFileLockAsync(mbFile, async () => {
+		await fs.promises.appendFile(mbFile, `${JSON.stringify(redactSecrets(complete))}\n`, "utf-8");
+		rotateMailboxFileIfNeeded(mbFile);
+	});
+	// R1 review fix / plan §5 #6: delivery RMW uses the cross-process sync
+	// lock (withFileLockSync) so sync callers (acknowledgeMailboxMessage,
+	// replayPendingMailboxMessages) serialize against this async path. The
+	// body has no await, so sync locking is safe and restores the
+	// cross-process safety net that the async lock cannot provide.
+	withFileLockSync(deliveryFile(manifest, true), () => {
+		const delivery = readDeliveryState(manifest);
+		delivery.messages[complete.id] = complete.status;
+		delivery.updatedAt = createdAt;
+		writeDeliveryState(manifest, delivery, { durability: "full" });
+	});
+	return complete;
+}
+
+export async function appendSteeringMessageAsync(
+	manifest: TeamRunManifest,
+	input: {
+		taskId: string;
+		body: string;
+		from?: string;
+		to?: string;
+		priority?: MailboxMessagePriority;
+		status?: MailboxMessageStatus;
+		data?: Record<string, unknown>;
+	},
+): Promise<MailboxMessage> {
+	return appendMailboxMessageAsync(manifest, {
+		direction: "inbox",
+		from: input.from ?? "leader",
+		to: input.to ?? input.taskId,
+		taskId: input.taskId,
+		body: input.body,
+		kind: "steer",
+		priority: input.priority ?? "urgent",
+		deliveryMode: "interrupt",
+		status: input.status,
+		data: { ...(input.data ?? {}), kind: "steer" },
+	});
+}
+
+export async function appendFollowUpMessageAsync(
+	manifest: TeamRunManifest,
+	input: {
+		taskId: string;
+		body: string;
+		from?: string;
+		to?: string;
+		priority?: MailboxMessagePriority;
+		status?: MailboxMessageStatus;
+		data?: Record<string, unknown>;
+	},
+): Promise<MailboxMessage> {
+	return appendMailboxMessageAsync(manifest, {
+		direction: "inbox",
+		from: input.from ?? "leader",
+		to: input.to ?? input.taskId,
+		taskId: input.taskId,
+		body: input.body,
+		kind: "follow-up",
+		priority: input.priority ?? "normal",
+		deliveryMode: "next_turn",
+		status: input.status,
+		data: { ...(input.data ?? {}), kind: "follow-up" },
+	});
+}
+
 export function listMailboxByKind(manifest: TeamRunManifest, kind: MailboxMessageKind, direction?: MailboxDirection): MailboxMessage[] {
 	const messages = direction
 		? readAllMessages(manifest, direction)

package/src/state/run-metrics.ts

@@ -107,6 +107,16 @@ export function loadRunMetrics(cwd: string, runId: string): RunMetrics | undefin
  * List recent metrics files up to `limit` entries (newest first).
  * Returns an array of { runId, timestamp, taskCount, completedCount, failedCount, totalTokens, totalCost, durationMs, consistencyScore }.
  * Gracefully skips files that cannot be read or parsed.
+ *
+ * FIND-04 perf: sort dirents by mtime descending BEFORE reading any of
+ * them, then read at most `limit` files. Malformed files within that
+ * selected window reduce the returned count; the scan does not continue
+ * past the window to backfill them. Previously the function read up
+ * to MAX_METRIC_FILES_TO_SCAN (500) files via loadRunMetrics() and only
+ * THEN sorted+sliced to `limit` (default 25) — wasting 475 readFileSync +
+ * JSON.parse calls on the hot dashboard path. The sort is O(N log N) and
+ * uses the run-id timestamp prefix as a cheap secondary signal when
+ * mtimes tie (e.g. multiple files saved in the same millisecond).
  */
 export function getRunMetricsSummary(cwd: string, limit = 25): RunMetrics[] {
 	const dir = metricsDir(cwd);
@@ -117,21 +127,39 @@ export function getRunMetricsSummary(cwd: string, limit = 25): RunMetrics[] {
 		return [];
 	}
 
+	// Cap the directory-order candidate set before collecting mtimes. This
+	// is a safety valve against unbounded scan cost; the mtime sort below
+	// only reorders entries within this bounded candidate window.
+	const cap = Math.max(0, limit);
+	const sorted = entries
+		.filter((entry) => entry.isFile() && entry.name.endsWith(".json"))
+		.slice(0, MAX_METRIC_FILES_TO_SCAN)
+		.map((entry) => {
+			const fullPath = path.join(dir, entry.name);
+			let mtimeMs = 0;
+			try {
+				mtimeMs = fs.statSync(fullPath).mtimeMs;
+			} catch {
+				// stat failure: fall through with mtimeMs=0; the sort still
+				// produces a deterministic order (filenames tiebreak).
+			}
+			return { name: entry.name, mtimeMs };
+		})
+		.sort((a, b) => {
+			const diff = b.mtimeMs - a.mtimeMs;
+			if (diff !== 0) return diff;
+			// Filename tiebreaker: the run-id prefix is a YYYYMMDDhhmmss
+			// timestamp (e.g. team_20260720050617_abc123) so a descending
+			// string compare yields newest-first within a tie group.
+			return b.name.localeCompare(a.name);
+		});
+
 	const metrics: RunMetrics[] = [];
-	for (const entry of entries) {
-		if (!entry.isFile() || !entry.name.endsWith(".json")) continue;
-		const runId = entry.name.replace(/\.json$/, "");
+	for (const { name } of sorted.slice(0, cap)) {
+		const runId = name.replace(/\.json$/, "");
 		const m = loadRunMetrics(cwd, runId);
 		if (m) metrics.push(m);
-		if (metrics.length >= MAX_METRIC_FILES_TO_SCAN) break;
 	}
 
-	// Sort newest first (by timestamp, then runId as tiebreaker).
-	metrics.sort((a, b) => {
-		const diff = new Date(b.timestamp).getTime() - new Date(a.timestamp).getTime();
-		if (diff !== 0) return diff;
-		return b.runId.localeCompare(a.runId);
-	});
-
-	return metrics.slice(0, limit);
+	return metrics;
 }

package/src/state/worker-atomic-writer.ts

@@ -137,6 +137,7 @@ function getWorker(): Worker {
 		// Reject ALL pending requests — worker died.
 		for (const [, entry] of pending) entry.reject(error);
 		pending.clear();
+		worker = undefined;
 	});
 	worker.unref(); // don't keep event loop alive (unless tests request it)
 	if (keepRefForTests) worker.ref();

package/src/ui/live-run-sidebar.ts

@@ -8,7 +8,6 @@ import type { TeamTaskState } from "../state/types.ts";
 import { aggregateUsage, formatUsage } from "../state/usage.ts";
 import { readJsonFileCoalesced } from "../utils/file-coalescer.ts";
 import { pad, truncate } from "../utils/visual.ts";
-import { Box, Text } from "./layout-primitives.ts";
 import { RenderScheduler } from "./render-scheduler.ts";
 import { runEventBusAsRenderScheduler } from "./run-event-bus.ts";
 import type { RunSnapshotCache, RunUiSnapshot } from "./snapshot-types.ts";
@@ -16,17 +15,10 @@ import { spinnerBucket, spinnerFrame } from "./spinner.ts";
 import { colorizeStatusGlyphs, iconForStatus } from "./status-colors.ts";
 import type { CrewTheme } from "./theme-adapter.ts";
 import { asCrewTheme, subscribeThemeChange } from "./theme-adapter.ts";
+import { renderLines } from "./widget/widget-renderer.ts";
 
 const TASK_READ_TTL_MS = 200;
 
-function renderLines(lines: string[], width: number): string[] {
-	const box = new Box(0, 0);
-	for (const line of lines) {
-		box.addChild(new Text(line));
-	}
-	return box.render(width);
-}
-
 type Done = (value: undefined) => void;
 
 function line(text: string, width: number): string {

package/src/ui/run-dashboard.ts

@@ -19,7 +19,6 @@ import { renderProgressPane } from "./dashboard-panes/progress-pane.ts";
 import { renderTranscriptPane } from "./dashboard-panes/transcript-pane.ts";
 import { DynamicCrewBorder } from "./dynamic-border.ts";
 import { dashboardActionForKey } from "./keybinding-map.ts";
-import { Box, Text } from "./layout-primitives.ts";
 import { HelpOverlay } from "./overlays/help-overlay.ts";
 import { RenderScheduler } from "./render-scheduler.ts";
 import { runEventBusAsRenderScheduler } from "./run-event-bus.ts";
@@ -28,6 +27,7 @@ import { spinnerBucket, spinnerFrame } from "./spinner.ts";
 import { applyStatusColor, colorizeStatusGlyphs, iconForStatus, type RunStatus } from "./status-colors.ts";
 import type { CrewTheme } from "./theme-adapter.ts";
 import { asCrewTheme, subscribeThemeChange } from "./theme-adapter.ts";
+import { renderLines } from "./widget/widget-renderer.ts";
 
 /** S05 — wrap a pane render in try/catch so a single pane crash does not bring down the whole dashboard. */
 function safeRenderPane(name: string, fn: () => string[]): string[] {
@@ -159,14 +159,6 @@ function formatAge(iso: string | undefined): string | undefined {
 	return `${Math.floor(ms / 3_600_000)}h`;
 }
 
-function renderLines(lines: string[], width: number): string[] {
-	const box = new Box(0, 0);
-	for (const line of lines) {
-		box.addChild(new Text(line));
-	}
-	return box.render(width);
-}
-
 function readProgressPreview(run: TeamRunManifest, maxLines = 5, snapshotCache?: RunSnapshotCache): string[] {
 	// P0-6: prefer the snapshot's `recentOutputLines` (no disk I/O) over reading the
 	// progress artifact on every render. The progress artifact content is captured