pi-crew 0.9.51 → 0.9.53

package/src/runtime/task-packet.ts

@@ -1,268 +0,0 @@
-import * as path from "node:path";
-import type { TaskPacket, TaskScope, TeamRunManifest, VerificationContract } from "../state/types.ts";
-import type { WorkflowStep } from "../workflows/workflow-config.ts";
-import { generateTaskHashId } from "./task-id.ts";
-
-// ═══════════════════════════════════════════════════════════════════════════
-// SEC-007 Fix: Workflow Step Task Sanitization
-// Context provided by workers comes from workflow definitions that could
-// be user-controlled. Sanitize task text to prevent injection.
-// See: SECURITY-ISSUES.md SEC-007
-// ═══════════════════════════════════════════════════════════════════════════
-
-/**
- * Sanitize workflow step task text to reduce injection risk.
- *
- * The task text is used as a prompt for worker agents. In a multi-tenant
- * or shared workflow scenario, malicious workflow definitions could
- * embed injection instructions.
- *
- * Sanitization:
- * - Strip zero-width Unicode characters
- * - Strip known prompt injection directive patterns
- * - Strip base64/hex encoded payloads
- * - Collapse excessive whitespace
- */
-export function sanitizeTaskText(task: string): string {
-	let sanitized = task;
-
-	// 1. Strip zero-width and invisible Unicode characters
-	sanitized = sanitized.replace(/[\u200B-\u200F\u2028-\u202F\u2060-\u206F\uFEFF]/g, "");
-
-	// 2. Strip known prompt injection directive patterns
-	sanitized = sanitized.replace(
-		/^\s*(?:SYSTEM|INSTRUCTION|IGNORE(?:\s+ALL)?\s+INSTRUCTIONS|OVERRIDE|YOUR\s+ROLE\s+IS|MALICIOUS)\s*:.*$/gim,
-		"",
-	);
-
-	// 3. Strip base64/hex encoded command payloads
-	sanitized = sanitized.replace(/\b(?:base64|base32|hex)\s*['":]\s*([A-Za-z0-9+\/=]{16,})/gi, "[encoded-redacted]");
-
-	// 4. Strip embedded instruction patterns in brackets
-	sanitized = sanitized.replace(/\[(?:SYSTEM|INSTRUCTION|OVERRIDE)\s*:[^\]]*\]/gi, "");
-
-	// 5. Collapse multiple blank lines
-	sanitized = sanitized.replace(/\n{3,}/g, "\n\n");
-
-	return sanitized.trim();
-}
-
-export interface BuildTaskPacketInput {
-	manifest: TeamRunManifest;
-	step: WorkflowStep;
-	taskId: string;
-	cwd: string;
-	worktreePath?: string;
-}
-
-export interface TaskPacketValidationResult {
-	valid: boolean;
-	errors: string[];
-}
-
-export function inferTaskScope(step: WorkflowStep): TaskScope {
-	const reads = step.reads === false ? [] : (step.reads ?? []);
-	if (reads.length === 1) return "single_file";
-	if (reads.length > 1) return "module";
-	return "workspace";
-}
-
-export function defaultVerificationContract(step: WorkflowStep): VerificationContract {
-	return {
-		requiredGreenLevel: step.verify ? "targeted" : "none",
-		commands: [],
-		allowManualEvidence: true,
-	};
-}
-
-export function buildTaskPacket(input: BuildTaskPacketInput): TaskPacket {
-	const scope = inferTaskScope(input.step);
-	const reads = input.step.reads === false ? [] : (input.step.reads ?? []);
-	const scopePath = reads.length === 1 ? reads[0] : reads.length > 1 ? reads.join(", ") : undefined;
-	// SEC-007: Sanitize task text before inserting into task packet
-	const sanitizedTask = sanitizeTaskText(input.step.task);
-	const sanitizedGoal = sanitizeTaskText(input.manifest.goal);
-
-	// Generate a deterministic hash-based task ID for traceability and logging.
-	// Uses goal + step ID + run ID as content parts.
-	// TODO(hashId): tracked — add hashId to TaskPacket when the schema supports it.
-	const _taskHashId = generateTaskHashId([input.manifest.goal, input.step.id, input.manifest.runId]);
-
-	return {
-		objective: sanitizedTask.replaceAll("{goal}", sanitizedGoal),
-		scope,
-		scopePath,
-		repo: path.basename(input.manifest.cwd) || input.manifest.cwd,
-		worktree: input.worktreePath,
-		branchPolicy:
-			input.manifest.workspaceMode === "worktree"
-				? "Use the assigned task worktree and avoid modifying the leader checkout."
-				: "Use the current checkout; do not create branches unless explicitly requested.",
-		acceptanceTests: [],
-		commitPolicy: "Do not commit unless explicitly requested by the user or workflow.",
-		reportingContract: "Report intended/changed files, verification evidence, blockers, conflict risks, and next recommended action.",
-		escalationPolicy:
-			"Stop and report if scope is ambiguous, destructive action is needed, permissions are missing, verification cannot be completed, or edits may overlap with another worker/task.",
-		constraints: [
-			"Stay within the assigned task scope.",
-			"Do not claim completion without verification evidence.",
-			"Use mailbox/API state for coordination when available.",
-			"Do not make overlapping edits to the same file/symbol without explicit leader sequencing or ownership guidance.",
-		],
-		expectedArtifacts: ["prompt", "result", "verification"],
-		verification: defaultVerificationContract(input.step),
-	};
-}
-
-export function validateTaskPacket(packet: TaskPacket): TaskPacketValidationResult {
-	const errors: string[] = [];
-	if (!packet.objective.trim()) errors.push("objective must not be empty");
-	if (!packet.repo.trim()) errors.push("repo must not be empty");
-	if (!packet.branchPolicy.trim()) errors.push("branchPolicy must not be empty");
-	if (!packet.commitPolicy.trim()) errors.push("commitPolicy must not be empty");
-	if (!packet.reportingContract.trim()) errors.push("reportingContract must not be empty");
-	if (!packet.escalationPolicy.trim()) errors.push("escalationPolicy must not be empty");
-	if ((packet.scope === "module" || packet.scope === "single_file" || packet.scope === "custom") && !packet.scopePath?.trim()) {
-		errors.push(`scopePath is required for scope '${packet.scope}'`);
-	}
-	if (packet.constraints.length === 0) errors.push("constraints must contain at least one entry");
-	for (const [index, constraint] of packet.constraints.entries()) {
-		if (!constraint.trim()) errors.push(`constraints contains an empty value at index ${index}`);
-	}
-	if (packet.expectedArtifacts.length === 0) errors.push("expectedArtifacts must contain at least one entry");
-	for (const [index, artifact] of packet.expectedArtifacts.entries()) {
-		if (!artifact.trim()) errors.push(`expectedArtifacts contains an empty value at index ${index}`);
-	}
-	for (const [index, test] of packet.acceptanceTests.entries()) {
-		if (!test.trim()) errors.push(`acceptanceTests contains an empty value at index ${index}`);
-	}
-	return { valid: errors.length === 0, errors };
-}
-
-/**
- * Structured handoff template for task completion reports.
- * Distilled from ECC dmux-workflows pattern — workers use this format
- * so verifiers and downstream consumers can parse output predictably.
- */
-export const HANDOFF_TEMPLATE = [
-	"## Handoff",
-	"",
-	"### Summary",
-	"<!-- 2-3 sentences describing what was done -->",
-	"",
-	"### Files Changed",
-	"<!-- List each file changed with brief description -->",
-	"<!-- - path/to/file.ts: description -->",
-	"",
-	"### Tests / Verification",
-	"<!-- What tests pass? What was manually verified? -->",
-	"",
-	"### Follow-ups",
-	"<!-- Any remaining issues or next steps -->",
-].join("\n");
-
-export interface ParsedHandoff {
-	summary: string[];
-	filesChanged: string[];
-	tests: string[];
-	followups: string[];
-}
-
-/**
- * Extract text between a ### heading and the next ### heading or end of text.
- */
-function extractSection(content: string, heading: string): string {
-	const lines = content.split("\n");
-	const headingMarker = `### ${heading}`;
-	const startIndex = lines.findIndex((line) => line.trim() === headingMarker);
-	if (startIndex === -1) return "";
-
-	const collected: string[] = [];
-	for (let i = startIndex + 1; i < lines.length; i++) {
-		const trimmed = lines[i].trim();
-		if (trimmed.startsWith("### ") || trimmed.startsWith("## ")) break;
-		// Stop at paragraph text (non-bullet, non-comment, non-empty) that follows
-		// a blank line — signals end of subsection content.
-		if (
-			trimmed.length > 0 &&
-			!trimmed.startsWith("- ") &&
-			!trimmed.startsWith("<!--") &&
-			i > startIndex + 1 &&
-			lines[i - 1].trim() === "" &&
-			collected.some((l) => l.trim().length > 0)
-		) {
-			break;
-		}
-		collected.push(lines[i]);
-	}
-
-	return collected.join("\n").trim();
-}
-
-/**
- * Parse bullet list items from a section, stripping leading "- " and backtick wrapping.
- */
-function parseBullets(section: string): string[] {
-	if (!section) return [];
-	return section
-		.split("\n")
-		.map((line) => line.trim())
-		.filter((line) => line.startsWith("- "))
-		.map((line) => {
-			let item = line.replace(/^- /, "").trim();
-			// Strip surrounding backticks
-			if (item.startsWith("`") && item.endsWith("`") && item.length >= 2) {
-				item = item.slice(1, -1);
-			}
-			return item;
-		});
-}
-
-/**
- * Parse a handoff section that may contain bullets AND free-text paragraphs.
- * Returns all non-empty lines as individual items (bullets get their marker stripped).
- */
-function parseMixedContent(section: string): string[] {
-	if (!section) return [];
-	return section
-		.split("\n")
-		.map((line) => line.trim())
-		.filter((line) => line.length > 0 && !line.startsWith("<!--")) // skip HTML comments
-		.map((line) => {
-			if (line.startsWith("- ")) return line.slice(2).trim();
-			return line;
-		})
-		.map((item) => {
-			// Strip surrounding backticks
-			if (item.startsWith("`") && item.endsWith("`") && item.length >= 2) {
-				return item.slice(1, -1);
-			}
-			return item;
-		});
-}
-
-/**
- * Parse structured handoff data from agent output text.
- * Looks for the "## Handoff" heading and extracts subsections.
- * Returns empty arrays for sections not found.
- */
-export function parseHandoffFromOutput(output: string): ParsedHandoff {
-	if (!output || typeof output !== "string") {
-		return { summary: [], filesChanged: [], tests: [], followups: [] };
-	}
-
-	// Find the handoff section — look for ## Handoff
-	const handoffIndex = output.indexOf("## Handoff");
-	const content = handoffIndex >= 0 ? output.slice(handoffIndex) : output;
-
-	return {
-		summary: parseMixedContent(extractSection(content, "Summary")),
-		filesChanged: parseMixedContent(extractSection(content, "Files Changed")),
-		tests: parseMixedContent(extractSection(content, "Tests / Verification")),
-		followups: parseMixedContent(extractSection(content, "Follow-ups")),
-	};
-}
-
-export function renderTaskPacket(packet: TaskPacket): string {
-	return ["# Task Packet", "", "```json", JSON.stringify(packet, null, 2), "```", ""].join("\n");
-}

package/src/runtime/task-quality.ts

@@ -1,199 +0,0 @@
-/**
- * Task quality scoring — simple additive heuristic for evaluating task
- * completion quality based on diagnostics, metrics, artifacts, and duration.
- *
- * Distilled from pi-autoresearch's quality scoring pattern.
- */
-import * as fs from "node:fs";
-import * as path from "node:path";
-import type { TeamTaskState } from "../state/types.ts";
-
-/** Letter grade for task quality. */
-export type QualityGrade = "A" | "B" | "C" | "D";
-
-/** Breakdown of individual quality criteria. */
-export interface QualityBreakdown {
-	/** Task has a non-empty diagnostics object. */
-	hasDiagnostics: boolean;
-	/** Task has a non-empty metrics object. */
-	hasMetrics: boolean;
-	/** Task produced files in the artifacts directory. */
-	producedArtifacts: boolean;
-	/** Task has a non-empty result/description. */
-	hasDescription: boolean;
-	/** Task duration is reasonable (> 0 and < 1 hour). */
-	durationReasonable: boolean;
-}
-
-/** Scored quality result for a task. */
-export interface TaskQualityScore {
-	/** Numeric score (0–5). */
-	score: number;
-	/** Individual criterion breakdown. */
-	breakdown: QualityBreakdown;
-	/** Letter grade based on score thresholds. */
-	grade: QualityGrade;
-}
-
-/** One hour in milliseconds. */
-const ONE_HOUR_MS = 3_600_000;
-
-/**
- * Determine the letter grade for a given numeric score.
- *
- * A: 4–5, B: 3, C: 2, D: 0–1
- */
-function scoreToGrade(score: number): QualityGrade {
-	if (score >= 4) return "A";
-	if (score === 3) return "B";
-	if (score === 2) return "C";
-	return "D";
-}
-
-/**
- * Check whether the artifacts directory contains files for the given task.
- *
- * Looks for a subdirectory named after the task ID, or files containing
- * the task ID prefix in the artifacts directory.
- */
-function hasTaskArtifacts(taskId: string, artifactsDir: string): boolean {
-	try {
-		if (!fs.existsSync(artifactsDir)) return false;
-
-		// Check for a task-specific subdirectory
-		const taskDir = path.join(artifactsDir, taskId);
-		if (fs.existsSync(taskDir)) {
-			const stat = fs.statSync(taskDir);
-			if (stat.isDirectory()) {
-				const entries = fs.readdirSync(taskDir);
-				return entries.length > 0;
-			}
-		}
-
-		// Check for files containing the task ID prefix
-		const entries = fs.readdirSync(artifactsDir);
-		const safePrefix = taskId.replace(/[^a-zA-Z0-9_-]/g, "");
-		return entries.some((entry) => entry.includes(safePrefix));
-	} catch {
-		return false;
-	}
-}
-
-/**
- * Check if a task result string is a non-empty description.
- *
- * A result is considered descriptive if any of these sources have non-empty content:
- * - task.resultArtifact exists with a path
- * - task.error is a non-empty string (workers often set this with result info)
- * - task.verification.satisfied is true
- * - task.diagnostics contains a 'result' string
- */
-function isResultDescriptive(task: TeamTaskState): boolean {
-	// Check resultArtifact — presence of a result artifact indicates output was produced
-	if (task.resultArtifact?.path) return true;
-
-	// Check error field — workers often put result info here
-	if (typeof task.error === "string" && task.error.trim().length > 0) return true;
-
-	// Check verification — satisfied verification indicates meaningful output
-	if (task.verification?.satisfied) return true;
-
-	// Check diagnostics for an explicit result string
-	if (
-		task.diagnostics &&
-		typeof task.diagnostics === "object" &&
-		typeof task.diagnostics.result === "string" &&
-		(task.diagnostics.result as string).trim().length > 0
-	)
-		return true;
-
-	return false;
-}
-
-/**
- * Check if the task duration is reasonable (started, finished, > 0, < 1 hour).
- */
-function isDurationReasonable(task: TeamTaskState): boolean {
-	if (!task.startedAt || !task.finishedAt) return false;
-
-	const started = new Date(task.startedAt).getTime();
-	const finished = new Date(task.finishedAt).getTime();
-
-	if (Number.isNaN(started) || Number.isNaN(finished)) return false;
-
-	const duration = finished - started;
-	return duration > 0 && duration < ONE_HOUR_MS;
-}
-
-/**
- * Compute the quality score for a completed task.
- *
- * Uses simple additive scoring across 5 criteria:
- * - hasDiagnostics: +1 if task.diagnostics exists and has keys
- * - hasMetrics: +1 if task.metrics exists and has keys
- * - producedArtifacts: +1 if artifactsDir has files for this task
- * - hasDescription: +1 if task has a non-empty result/description
- * - durationReasonable: +1 if task has both startedAt and finishedAt, duration > 0 and < 1 hour
- *
- * @param task - The task state to evaluate
- * @param artifactsDir - Optional path to the run artifacts directory
- * @returns TaskQualityScore with numeric score, breakdown, and letter grade
- */
-export function computeTaskQuality(task: TeamTaskState, artifactsDir?: string): TaskQualityScore {
-	const hasDiagnostics =
-		task.diagnostics !== undefined && typeof task.diagnostics === "object" && Object.keys(task.diagnostics).length > 0;
-
-	const hasMetrics = task.metrics !== undefined && typeof task.metrics === "object" && Object.keys(task.metrics).length > 0;
-
-	const producedArtifacts = artifactsDir !== undefined && hasTaskArtifacts(task.id, artifactsDir);
-
-	const hasDescription = isResultDescriptive(task);
-
-	const durationReasonable = isDurationReasonable(task);
-
-	const breakdown: QualityBreakdown = {
-		hasDiagnostics,
-		hasMetrics,
-		producedArtifacts,
-		hasDescription,
-		durationReasonable,
-	};
-
-	const score =
-		(hasDiagnostics ? 1 : 0) +
-		(hasMetrics ? 1 : 0) +
-		(producedArtifacts ? 1 : 0) +
-		(hasDescription ? 1 : 0) +
-		(durationReasonable ? 1 : 0);
-
-	return {
-		score,
-		breakdown,
-		grade: scoreToGrade(score),
-	};
-}
-
-/** Human-readable labels for each quality criterion. */
-const CRITERION_LABELS: Record<keyof QualityBreakdown, string> = {
-	hasDiagnostics: "diagnostics",
-	hasMetrics: "metrics",
-	producedArtifacts: "artifacts",
-	hasDescription: "description",
-	durationReasonable: "duration",
-};
-
-/**
- * Format a quality score as a human-readable one-line string.
- *
- * Format: "Quality: B (3/5: diagnostics, metrics, description)"
- *
- * @param score - The quality score to format
- * @returns Formatted string
- */
-export function formatQualityScore(score: TaskQualityScore): string {
-	const metCriteria = Object.entries(score.breakdown)
-		.filter(([, met]) => met)
-		.map(([key]) => CRITERION_LABELS[key as keyof QualityBreakdown]);
-
-	return `Quality: ${score.grade} (${score.score}/5${metCriteria.length > 0 ? `: ${metCriteria.join(", ")}` : ""})`;
-}

package/src/runtime/task-runner/capabilities.ts

@@ -1,78 +0,0 @@
-import type { AgentConfig } from "../../agents/agent-config.ts";
-import type { CrewRuntimeKind } from "../crew-agent-runtime.ts";
-
-export interface WorkerCapabilityInventory {
-	schemaVersion: 1;
-	taskId: string;
-	role: string;
-	agent: string;
-	runtime: CrewRuntimeKind;
-	permissionMode: string;
-	tools: string[];
-	extensions: string[];
-	skills: {
-		names: string[];
-		paths: string[];
-		disabled: boolean;
-	};
-	model: {
-		requested?: string;
-		agentDefault?: string;
-		fallbacks: string[];
-		teamRole?: string;
-		step?: string;
-	};
-	inheritance: {
-		projectContext: boolean;
-		skills: boolean;
-		systemPromptMode: "replace" | "append";
-	};
-}
-
-export interface BuildWorkerCapabilityInventoryInput {
-	taskId: string;
-	role: string;
-	agent: AgentConfig;
-	runtime: CrewRuntimeKind;
-	permissionMode: string;
-	skillNames?: string[];
-	skillPaths?: string[];
-	skillsDisabled: boolean;
-	modelOverride?: string;
-	teamRoleModel?: string;
-	stepModel?: string;
-}
-
-function uniqueSorted(values: readonly string[] | undefined): string[] {
-	return [...new Set((values ?? []).map((value) => value.trim()).filter(Boolean))].sort((a, b) => a.localeCompare(b));
-}
-
-export function buildWorkerCapabilityInventory(input: BuildWorkerCapabilityInventoryInput): WorkerCapabilityInventory {
-	return {
-		schemaVersion: 1,
-		taskId: input.taskId,
-		role: input.role,
-		agent: input.agent.name,
-		runtime: input.runtime,
-		permissionMode: input.permissionMode,
-		tools: uniqueSorted(input.agent.tools),
-		extensions: uniqueSorted(input.agent.extensions),
-		skills: {
-			names: uniqueSorted(input.skillNames),
-			paths: uniqueSorted(input.skillPaths),
-			disabled: input.skillsDisabled,
-		},
-		model: {
-			requested: input.modelOverride,
-			agentDefault: input.agent.model,
-			fallbacks: uniqueSorted(input.agent.fallbackModels),
-			teamRole: input.teamRoleModel,
-			step: input.stepModel,
-		},
-		inheritance: {
-			projectContext: input.agent.inheritProjectContext === true,
-			skills: input.agent.inheritSkills === true,
-			systemPromptMode: input.agent.systemPromptMode ?? "replace",
-		},
-	};
-}