pi-crew 0.9.55 → 0.9.56

package/src/runtime/task-runner/child-executor.ts

@@ -57,7 +57,7 @@ import { type ProgressEventSummary, shouldAppendProgressEventUpdate } from "../p
 import { DEFAULT_RETRY_POLICY } from "../retry-executor.ts";
 import { runWorker } from "../run-worker.ts";
 import { parseSessionUsage } from "../session-usage.ts";
-import { parseSupervisorContactFromLine, recordSupervisorContact } from "../supervisor-contact.ts";
+import { recordSupervisorContact, supervisorContactFromEvent } from "../supervisor-contact.ts";
 import { createWorkerHeartbeat, touchWorkerHeartbeat } from "../worker-heartbeat.ts";
 import { createStartupEvidence } from "../worker-startup.ts";
 import type { TaskExecutionResult } from "./post-execution.ts";
@@ -438,19 +438,15 @@ export async function runChildProcessTask(ctx: TaskExecutionContext): Promise<Ta
 				onStdoutLine: (line) => {
 					appendCrewAgentOutput(manifest, task.id, line);
 					persistHeartbeat();
-					// Check for supervisor contact requests from child Pi
-					const contact = parseSupervisorContactFromLine(line);
-					if (contact) {
-						recordSupervisorContact(manifest, {
-							runId: manifest.runId,
-							...contact,
-						});
-					}
 				},
 				onJsonEvent: (event) => {
 					// Top-level error boundary: prevent any single event from crashing the task.
 					// Errors are logged but processing continues so subsequent events still update state.
 					try {
+						// P2-25: handle supervisor_contact here (compact pipeline now passes
+						// the full payload through); was dead on the old displayLine path.
+						const contact = supervisorContactFromEvent(event);
+						if (contact) recordSupervisorContact(manifest, { runId: manifest.runId, ...contact });
 						appendCrewAgentEvent(manifest, task.id, event);
 						if (collectedJsonEvents && event && typeof event === "object" && !Array.isArray(event))
 							collectedJsonEvents.push(event as Record<string, unknown>);

package/src/runtime/team-runner.ts

@@ -23,7 +23,7 @@ import { checkBranchFreshness } from "../worktree/branch-freshness.ts";
 import { buildSyntheticTerminalEvidence, CrewCancellationError, cancellationReasonFromSignal } from "./cancellation.ts";
 import { buildDispatchUnits, type DispatchUnit, planCoalescedGroups } from "./coalesce-tasks.ts";
 import { type BatchConcurrencyDecision, resolveBatchConcurrency } from "./concurrency.ts";
-import { readCrewAgents, saveCrewAgents } from "./crew-agent-records.ts";
+import { readCrewAgents, saveCrewAgents, saveCrewAgentsCoalesced } from "./crew-agent-records.ts";
 import type { CrewRuntimeKind } from "./crew-agent-runtime.ts";
 import { crewHooks } from "./crew-hooks.ts";
 import { appendDeadletter } from "./deadletter.ts";
@@ -918,8 +918,9 @@ export async function executeTeamRun(input: ExecuteTeamRunInput): Promise<{ mani
 			await saveRunTasksAsync(manifest, tasks);
 			const existingRuntimeByTask = new Map(readCrewAgents(manifest).map((agent) => [agent.taskId, agent.runtime]));
 			const globalRuntime = input.runtime?.kind ?? "child-process";
+			const taskById = new Map(tasks.map((item) => [item.id, item] as const));
 			const runtimeForAgent = (agent: ReturnType<typeof recordsForMaterializedTasks>[number]): CrewRuntimeKind => {
-				const task = tasks.find((item) => item.id === agent.taskId);
+				const task = taskById.get(agent.taskId);
 				return (
 					existingRuntimeByTask.get(agent.taskId) ??
 					resolveTaskRuntimeKind(globalRuntime, task?.role ?? agent.role, input.runtimeConfig?.isolationPolicy)
@@ -1059,14 +1060,17 @@ async function cancelRunFromSignal(ctx: SchedulerContext): Promise<SchedulerDeci
 		return base;
 	});
 	await saveRunTasksAsync(ctx.manifest, ctx.tasks);
-	for (const taskId of cancelledTaskIds)
-		await appendEventAsync(ctx.manifest.eventsPath, {
-			type: "task.cancelled",
-			runId: ctx.manifest.runId,
-			taskId,
-			message,
-			data: { reason: cancelReason.code },
-		});
+	await Promise.all(
+		cancelledTaskIds.map((taskId) =>
+			appendEventAsync(ctx.manifest.eventsPath, {
+				type: "task.cancelled",
+				runId: ctx.manifest.runId,
+				taskId,
+				message,
+				data: { reason: cancelReason.code },
+			}),
+		),
+	);
 	ctx.manifest = updateRunStatus(ctx.manifest, "cancelled", message, {
 		data: { reason: cancelReason.code, cancelledTaskIds },
 	});
@@ -1213,9 +1217,9 @@ async function selectDispatchBatch(ctx: SchedulerContext): Promise<SchedulerDeci
 		}
 	}
 
-	const readyRoles = readyBeforeFilter
-		.map((taskId) => ctx.tasks.find((task) => task.id === taskId)?.role)
-		.filter((role): role is string => Boolean(role));
+	// W5-4: by-id map once (was O(ready × tasks) via find-per-element).
+	const taskByIdReady = new Map(ctx.tasks.map((t) => [t.id, t] as const));
+	const readyRoles = readyBeforeFilter.map((taskId) => taskByIdReady.get(taskId)?.role).filter((role): role is string => Boolean(role));
 	const concurrency = resolveBatchConcurrency({
 		workflowName: ctx.workflow.name,
 		workflowMaxConcurrency: ctx.workflow.maxConcurrency,
@@ -1287,9 +1291,8 @@ async function selectDispatchBatch(ctx: SchedulerContext): Promise<SchedulerDeci
 	const approvalPending = isPlanApprovalPending(ctx.manifest);
 	const dispatchableReady = serializedReady.filter((id) => !inFlightTaskIds.has(id));
 	const readyIds = approvalPending ? dispatchableReady : dispatchableReady.slice(0, slotsAvailable);
-	const candidateBatch = readyIds
-		.map((id) => ctx.tasks.find((task) => task.id === id))
-		.filter((task): task is TeamTaskState => Boolean(task));
+	const taskByIdDispatch = new Map(ctx.tasks.map((t) => [t.id, t] as const));
+	const candidateBatch = readyIds.map((id) => taskByIdDispatch.get(id)).filter((task): task is TeamTaskState => Boolean(task));
 	const readyBatch = approvalPending ? candidateBatch.filter((task) => !isMutatingTask(task)).slice(0, slotsAvailable) : candidateBatch;
 	if (readyBatch.length === 0) {
 		if (ctx.pendingUnits.size > 0) {
@@ -1360,13 +1363,18 @@ async function dispatchBatch(ctx: SchedulerContext, decision: DispatchBatchDecis
 			concurrencyReason: approvalPending ? `${concurrency.reason};plan-approval-read-only` : concurrency.reason,
 		},
 	});
-	// Execute before_task_start hooks for the batch
-	for (const task of readyBatch) {
-		const taskReport = await executeHook("before_task_start", {
-			runId: ctx.manifest.runId,
-			taskId: task.id,
-			cwd: ctx.manifest.cwd,
-		});
+	// Execute before_task_start hooks for the batch — P1-10: run hooks in
+	// parallel (each may be a subprocess), then apply skip mutations in order.
+	const beforeTaskStartReports = await Promise.all(
+		readyBatch.map((task) =>
+			executeHook("before_task_start", {
+				runId: ctx.manifest.runId,
+				taskId: task.id,
+				cwd: ctx.manifest.cwd,
+			}).then((taskReport) => ({ task, taskReport })),
+		),
+	);
+	for (const { task, taskReport } of beforeTaskStartReports) {
 		appendHookEvent(ctx.manifest, taskReport);
 		if (taskReport.outcome === "block") {
 			ctx.tasks = ctx.tasks.map((t) =>
@@ -1381,7 +1389,12 @@ async function dispatchBatch(ctx: SchedulerContext, decision: DispatchBatchDecis
 			ctx.manifest = updateRunStatus(ctx.manifest, ctx.manifest.status, `Task '${task.id}' blocked by hook.`);
 		}
 	}
-	const batchTasks = readyBatch.filter((task) => ctx.tasks.find((t) => t.id === task.id && t.status !== "skipped"));
+	// W5-4: by-id map (was O(readyBatch × tasks) via find-per-element).
+	const ctxTaskById = new Map(ctx.tasks.map((t) => [t.id, t] as const));
+	const batchTasks = readyBatch.filter((task) => {
+		const t = ctxTaskById.get(task.id);
+		return t !== undefined && t.status !== "skipped";
+	});
 	if (batchTasks.length > 1) {
 		await appendEventAsync(ctx.manifest.eventsPath, {
 			type: "task.parallel_start",
@@ -1791,12 +1804,14 @@ async function advanceWorkflowPhases(ctx: SchedulerContext): Promise<void> {
 		existing.push(task.id);
 		phaseTaskMap.set(task.stepId, existing);
 	}
+	// W5-4: by-id map once for the phase loop (was O(phases × phaseTasks × tasks)).
+	const taskById = new Map(tasks.map((t) => [t.id, t] as const));
 	for (let pi = wfMachine.currentPhaseIndex; pi < wfMachine.phases.length; pi++) {
 		const phase = wfMachine.phases[pi]!;
 		const phaseTaskIds = phaseTaskMap.get(phase.name) ?? [];
 		if (phaseTaskIds.length === 0) continue;
 		const allTerminal = phaseTaskIds.every((taskId) => {
-			const task = tasks.find((t) => t.id === taskId);
+			const task = taskById.get(taskId);
 			return task ? terminalStatuses.has(task.status) : false;
 		});
 		if (!allTerminal) break;
@@ -1816,7 +1831,7 @@ async function advanceWorkflowPhases(ctx: SchedulerContext): Promise<void> {
 			};
 			// Determine phase transition status based on individual task outcomes
 			const phaseTasks = phaseTaskIds
-				.map((taskId) => tasks.find((t) => t.id === taskId))
+				.map((taskId) => taskById.get(taskId))
 				.filter((t): t is NonNullable<typeof t> => t !== undefined);
 			const hasFailedOrCancelled = phaseTasks.some((t) => t.status === "failed" || t.status === "cancelled");
 			const phaseStatus = hasFailedOrCancelled ? "failed" : "completed";
@@ -1913,23 +1928,30 @@ async function enforceRunBudget(ctx: SchedulerContext): Promise<SchedulerDecisio
 
 		// Fair-share warning: flag tasks that consumed >50% of remaining budget
 		// without killing them mid-execution.
+		const fairShareAppends: Promise<void>[] = [];
 		for (const violatorId of budgetCheck.fairShareViolators) {
 			const violator = tasks.find((t) => t.id === violatorId);
 			if (!violator) continue;
 			const taskTotal = (violator.usage?.input ?? 0) + (violator.usage?.output ?? 0) + (violator.usage?.cacheWrite ?? 0);
 			const message = `Task '${violatorId}' consumed ${formatTokens(taskTotal)} (${Math.round((taskTotal / input.budgetTotal) * 100)}% of total budget) — exceeds fair share`;
 			console.warn(`[team-runner.fair-share] ${message}`);
-			await appendEventAsync(manifest.eventsPath, {
-				type: "task.budget_fair_share",
-				runId: manifest.runId,
-				taskId: violatorId,
-				message,
-				data: {
-					budgetTotal: input.budgetTotal,
-					taskUsage: taskTotal,
-				},
-			});
+			fairShareAppends.push(
+				appendEventAsync(manifest.eventsPath, {
+					type: "task.budget_fair_share",
+					runId: manifest.runId,
+					taskId: violatorId,
+					message,
+					data: {
+						budgetTotal: input.budgetTotal,
+						taskUsage: taskTotal,
+					},
+				}).then(
+					() => {},
+					(error) => logInternalError("team-runner.fair-share-event", error, `taskId=${violatorId}`),
+				),
+			);
 		}
+		await Promise.all(fairShareAppends);
 	}
 	return null;
 }
@@ -2355,7 +2377,10 @@ async function executeTeamRunCore(
 				return { manifest, tasks };
 			}
 			await saveRunTasksAsync(manifest, tasks);
-			saveCrewAgents(manifest, recordsForMaterializedTasks(manifest, tasks, runtimeKind));
+			// P0-3: per-batch progress write — coalesced (best-effort, no lock) so the
+			// sync spin-lock (Atomics.wait) doesn't block the event loop every batch.
+			// The terminal saveCrewAgents at closeout remains durable + flushes this.
+			saveCrewAgentsCoalesced(manifest, recordsForMaterializedTasks(manifest, tasks, runtimeKind));
 			const completedBatch = tasks.filter((t) => settledTaskIds.includes(t.id));
 			const batchArtifact = writeArtifact(manifest.artifactsRoot, {
 				kind: "summary",

package/src/schema/team-tool-schema.ts

@@ -1,4 +1,4 @@
-import { Type } from "@sinclair/typebox";
+import { type TSchema, Type } from "@sinclair/typebox";
 
 // ───────────────────────────────────────────────────────────────────────────
 // API-5 facade split: the 54-action mega-tool schema is split into 5 domain
@@ -346,17 +346,25 @@ export const ManageDomainParams = Type.Object({ action: manageActions, ...shared
 export const AutomateDomainParams = Type.Object({ action: automateActions, ...sharedFields }, { additionalProperties: true });
 
 /**
- * Backward-compatible re-export: Union of all 5 domain schemas.
- * Replaces the former flat 54-action Object — validation surface is identical
- * (all fields optional in every variant, additionalProperties: true).
+ * LLM-facing team-tool schema. FLAT single Object (all actions + all shared
+ * fields optional) — NOT the former 5-variant Type.Union. The union emitted a
+ * giant `anyOf` (each variant repeated all ~30 shared fields) that LLM
+ * tool-callers could not reliably satisfy → empty/malformed calls → params
+ * dropped → the tool defaulted to `list`. The handler validates per-action
+ * fields at runtime (defense-in-depth, team-tool.ts execute()), so the schema
+ * only needs to enumerate valid actions + field types. Domain objects above
+ * (RunDomainParams etc.) are kept for the facade dispatch + backward compat.
  */
-export const TeamToolParams = Type.Union([
-	RunDomainParams,
-	StatusDomainParams,
-	ControlDomainParams,
-	ManageDomainParams,
-	AutomateDomainParams,
-]);
+export const allActionLiterals = ([runActions, statusActions, controlActions, manageActions, automateActions] as TSchema[]).flatMap(
+	(set) => set.anyOf ?? [],
+);
+export const TeamToolParams = Type.Object(
+	{
+		action: Type.Optional(Type.Union(allActionLiterals, { description: ACTION_DESCRIPTION })),
+		...sharedFields,
+	},
+	{ additionalProperties: true },
+);
 
 /** Domain discriminator for the facade dispatch. */
 export type TeamDomain = "run" | "status" | "control" | "manage" | "automate";

package/src/state/event-log-rotation.ts

@@ -1,4 +1,5 @@
 import * as fs from "node:fs";
+import * as path from "node:path";
 import { logInternalError } from "../utils/internal-error.ts";
 import { atomicWriteFile } from "./atomic-write.ts";
 import { readEvents, type TeamEvent, withEventLogLockSync } from "./event-log.ts";
@@ -250,6 +251,30 @@ export function rotateEventLog(eventsPath: string): boolean {
 	return withEventLogLockSync(eventsPath, () => rotateEventLogUnlocked(eventsPath));
 }
 
+/** H2 retention: delete `<eventsPath>.*.archive.jsonl` files older than the window so
+ * they don't accumulate forever (mirrors notification/metric-sink rotateOldFiles). */
+const ARCHIVE_RETENTION_DAYS = 7;
+function sweepOldArchives(eventsPath: string, now = Date.now()): void {
+	const dir = path.dirname(eventsPath);
+	const base = path.basename(eventsPath);
+	let entries: string[];
+	try {
+		entries = fs.readdirSync(dir);
+	} catch {
+		return;
+	}
+	const cutoff = now - ARCHIVE_RETENTION_DAYS * 24 * 60 * 60 * 1000;
+	for (const name of entries) {
+		if (!name.startsWith(`${base}.`) || !name.endsWith(".archive.jsonl")) continue;
+		const archivePath = path.join(dir, name);
+		try {
+			if (fs.statSync(archivePath).mtimeMs < cutoff) fs.unlinkSync(archivePath);
+		} catch (error) {
+			logInternalError("event-log.archive-sweep", error, `archivePath=${archivePath}`, "debug");
+		}
+	}
+}
+
 /** Round 24 (BUG 1): the lock-free core of rotation. Assumes the caller
  * already holds the event-log lock (or accepts the unlocked race). */
 export function rotateEventLogUnlocked(eventsPath: string): boolean {
@@ -278,6 +303,9 @@ export function rotateEventLogUnlocked(eventsPath: string): boolean {
 		// detect the truncation and reset (re-read from offset 0 of the new
 		// file), instead of reading past EOF and missing post-rotation events.
 		bumpGenerationUnlocked(eventsPath);
+		// H2: retention — sweep archive files older than the window so they don't
+		// accumulate forever (mirrors notification/metric-sink rotateOldFiles).
+		sweepOldArchives(eventsPath);
 		return true;
 	} catch (error) {
 		logInternalError("event-log.rotate", error, `eventsPath=${eventsPath}`);

package/src/state/event-log.ts

@@ -69,7 +69,25 @@ const MAX_EVENTS_BYTES = 50 * 1024 * 1024;
 
 const sequenceCache = new Map<string, { size: number; mtimeMs: number; seq: number; lastAccessMs: number }>();
 const MAX_SEQUENCE_CACHE_ENTRIES = 256;
-let appendCounter = 0;
+// P0-2: per-eventsPath append counter. Previously a single module-global shared
+// across all runs AND never incremented on the async path, so the async rotation
+// gate (`0 % 100 === 0`) was always true → needsRotation ran on EVERY async append
+// (a full read+parse+rewrite once the log crossed 4 MB). FIFO-bounded to avoid
+// unbounded growth with run count.
+const appendCounters = new Map<string, number>();
+const APPEND_COUNTER_MAX_ENTRIES = 256;
+export function tickAppendCounter(eventsPath: string, inc = 1): boolean {
+	const prev = appendCounters.get(eventsPath) ?? 0;
+	const next = prev + inc;
+	appendCounters.set(eventsPath, next);
+	if (appendCounters.size > APPEND_COUNTER_MAX_ENTRIES) {
+		const oldest = appendCounters.keys().next().value;
+		if (oldest !== undefined) appendCounters.delete(oldest);
+	}
+	// True when a 100-boundary is crossed (matches the old `next % 100 === 0`
+	// semantics for inc=1, and generalizes to batch increments).
+	return Math.floor(next / 100) > Math.floor(prev / 100);
+}
 let overflowCounter = 0;
 
 /** Simple cross-process lock for an eventsPath to prevent JSONL interleave on concurrent append.
@@ -318,7 +336,9 @@ function nextSequence(eventsPath: string): number {
 
 function persistSequence(eventsPath: string, seq: number): void {
 	try {
-		atomicWriteFile(sequencePath(eventsPath), String(seq));
+		// P0-4: the .seq sidecar is disposable (event-reconstructor tolerates an
+		// inconsistent tail); best-effort avoids 2 fsyncs per event append.
+		atomicWriteFile(sequencePath(eventsPath), String(seq), { durability: "best-effort" });
 	} catch (error) {
 		logInternalError("event-log.persist-sequence-file", error, `eventsPath=${eventsPath}`);
 	}
@@ -501,7 +521,8 @@ async function withEventLogLockAsync<T>(
 			try {
 				await fs.promises.mkdir(lockDir);
 				try {
-					atomicWriteFile(pidFile, String(process.pid));
+					// P0-4: the lock pid file is disposable stale-lock state; best-effort.
+					atomicWriteFile(pidFile, String(process.pid), { durability: "best-effort" });
 				} catch {
 					/* best-effort */
 				}
@@ -724,12 +745,15 @@ export async function appendEventAsync(eventsPath: string, event: AppendTeamEven
 			// Phase 1.5: when worker atomic writer is enabled, append via worker.
 			if (isWorkerAtomicWriterEnabled()) {
 				await appendFileViaWorker(eventsPath, line);
-				// Worker path: fsync via a separate open (worker manages its own fd).
-				const fd = await fs.promises.open(eventsPath, "r+");
-				try {
-					await fd.sync();
-				} finally {
-					await fd.close();
+				// P0-4 (F3a mirror): fsync terminal events only; non-terminal events are
+				// informational and the event-reconstructor tolerates an inconsistent tail.
+				if (isTerminal) {
+					const fd = await fs.promises.open(eventsPath, "r+");
+					try {
+						await fd.sync();
+					} finally {
+						await fd.close();
+					}
 				}
 			} else {
 				// FIND-10: single-fd append+fsync. Opens in append mode, writes,
@@ -740,7 +764,8 @@ export async function appendEventAsync(eventsPath: string, event: AppendTeamEven
 				const fd = await fs.promises.open(eventsPath, "a");
 				try {
 					await fd.appendFile(line, "utf-8");
-					await fd.sync();
+					// P0-4 (F3a mirror): skip the data fsync for non-terminal events.
+					if (isTerminal) await fd.sync();
 					// FIND-10 R1 fix: the cache-optimization fd.stat() must NOT sit in the
 					// seq-durability critical path. If it threw (rare — fd invalidated),
 					// it would skip persistSequence below and reopen the seq-reuse
@@ -764,7 +789,7 @@ export async function appendEventAsync(eventsPath: string, event: AppendTeamEven
 		// FIND-10: track whether compaction happened after the append so the
 		// cache-update stat can safely reuse postAppendStat (file unchanged).
 		let compactedAfterAppend = false;
-		if (appendCounter % 100 === 0 && needsRotation(eventsPath)) {
+		if (tickAppendCounter(eventsPath) && needsRotation(eventsPath)) {
 			compactedAfterAppend = true;
 			try {
 				const prepared = prepareCompaction(eventsPath);
@@ -865,6 +890,8 @@ export async function appendEventAsync(eventsPath: string, event: AppendTeamEven
  */
 async function appendEventBatchInsideLock(eventsPath: string, queue: BufferedAppend[]): Promise<void> {
 	if (queue.length === 0) return;
+	// P0-2: keep the per-path counter honest for cross-path rotation sampling.
+	tickAppendCounter(eventsPath, queue.length);
 	fs.mkdirSync(path.dirname(eventsPath), { recursive: true });
 
 	// Pre-flight size check (mirrors appendEventInsideLock). We do it once for
@@ -1100,8 +1127,7 @@ function appendEventInsideLock(eventsPath: string, event: AppendTeamEvent): Team
 			logInternalError("event-log.persist-sequence", error, `eventsPath=${eventsPath}`);
 		}
 	}
-	appendCounter++;
-	if (appendCounter % 100 === 0 && needsRotation(eventsPath)) {
+	if (tickAppendCounter(eventsPath) && needsRotation(eventsPath)) {
 		// Round 24 (BUG 1): we are INSIDE withEventLogLockSync here (called via
 		// appendEventInsideLock). The mkdir lock is NOT re-entrant, so calling the
 		// locked compactEventLog would deadlock → 5s timeout → compaction never

package/src/state/state-store.ts

@@ -151,19 +151,33 @@ function scopeBaseRoot(cwd: string): string {
 	return useProjectState(cwd) ? projectCrewRoot(cwd) : userCrewRoot();
 }
 
+// P1-12: the containment verdict (resolveRealContainedPath ancestor walk, ~8-12
+// syscalls) cannot change for a run dir that isn't replaced — memoize positive
+// results per (cwd, runId) with a short TTL. Negatives are NOT cached (so a
+// newly-created run is found promptly). Downstream manifest stat still catches
+// deletions, so a stale positive is harmless.
+const runStateRootCache = new Map<string, { root: string; expiresAt: number }>();
+const RUN_STATE_ROOT_TTL_MS = 10_000;
+const RUN_STATE_ROOT_CACHE_MAX = 256;
+
 function resolveRunStateRoot(cwd: string, runId: string): string | undefined {
 	assertSafePathId("runId", runId);
+	const key = `${cwd}\0${runId}`;
+	const now = Date.now();
+	const cached = runStateRootCache.get(key);
+	if (cached && cached.expiresAt > now) return cached.root;
 	const runsRoot = path.join(scopeBaseRoot(cwd), DEFAULT_PATHS.state.runsSubdir);
 	const scopedPath = resolveContainedRelativePath(runsRoot, runId, "runId");
 	try {
-		// Single atomic validation: resolves through symlinks via realpath,
-		// verifies containment within runsRoot, and throws ENOENT if missing.
-		// Eliminates the TOCTOU window from the previous existsSync + lstatSync
-		// + resolveRealContainedPath sequence.
 		resolveRealContainedPath(runsRoot, runId);
 	} catch {
 		return undefined;
 	}
+	if (runStateRootCache.size >= RUN_STATE_ROOT_CACHE_MAX) {
+		const oldest = runStateRootCache.keys().next().value;
+		if (oldest !== undefined) runStateRootCache.delete(oldest);
+	}
+	runStateRootCache.set(key, { root: scopedPath, expiresAt: now + RUN_STATE_ROOT_TTL_MS });
 	return scopedPath;
 }
 

package/src/utils/redaction.ts

@@ -222,7 +222,46 @@ function isRecord(value: unknown): value is Record<string, unknown> {
 	return true;
 }
 
+// P1-6: cheap pre-filter. The common clean case (plain output, JSON event
+// lines without secret-like key names) bails after one sweep instead of running
+// all ~14 redaction passes. The marker set is the NECESSARY substring for every
+// redactable pattern below — a string containing none of them cannot hold a
+// redactable secret, so skipping is safe. Any marker present → full redaction.
+// NOTE: keep this set in sync with the patterns in redactSecretString; the
+// redaction-corpus test asserts every known secret type trips the pre-filter.
+const SECRET_MARKERS_CASE_SENSITIVE = [
+	"-----BEGIN",
+	"eyJ",
+	"AKIA",
+	"AIza",
+	"sk_live_",
+	"xox",
+	// GitHub PAT prefixes (gh[pousr]_) — exact, not the over-broad "gh" which
+	// matched "though"/"highlight"/"might" and defeated the pre-filter skip.
+	"ghp_",
+	"gho_",
+	"ghu_",
+	"ghs_",
+	"ghr_",
+];
+const SECRET_MARKERS_LOWER = ["bearer", "authorization", "token", "api", "key", "password", "passwd", "secret", "credential", "private"];
+
+function mayContainSecret(value: string): boolean {
+	for (const m of SECRET_MARKERS_CASE_SENSITIVE) {
+		if (value.includes(m)) return true;
+	}
+	// Case-insensitive markers (Bearer/auth headers + inline-secret key names).
+	// toLowerCase is a full pass, so only pay it after the case-sensitive misses.
+	const lower = value.toLowerCase();
+	for (const m of SECRET_MARKERS_LOWER) {
+		if (lower.includes(m)) return true;
+	}
+	return false;
+}
+
 export function redactSecretString(value: string): string {
+	// P1-6: skip the ~14 redaction passes when no secret marker is present.
+	if (!mayContainSecret(value)) return value;
 	let result = value;
 
 	// Replace PEM private keys. Skip the regex entirely on very large inputs —

package/src/worktree/worktree-manager.ts

@@ -463,15 +463,30 @@ async function branchExistsAsync(repoRoot: string, branch: string): Promise<{ lo
 	}
 }
 
+// P1-11: `git worktree prune` is a repo-level write that cleans ALL stale
+// worktrees — running it per task is pure waste. Coalesce concurrent calls
+// (N tasks in a batch → 1 prune) and memoize per repo per process (within a
+// run no new stale worktrees appear, so one prune suffices).
+const _prunedRepos = new Set<string>();
+const _pruneInFlight = new Map<string, Promise<void>>();
 async function pruneStaleWorktreesAsync(repoRoot: string): Promise<void> {
-	try {
-		await execFileAsync("git", ["worktree", "prune"], {
-			cwd: repoRoot,
-			windowsHide: true,
-		});
-	} catch {
-		/* best-effort */
-	}
+	if (_prunedRepos.has(repoRoot)) return;
+	const inFlight = _pruneInFlight.get(repoRoot);
+	if (inFlight) return inFlight;
+	const p = (async () => {
+		try {
+			await execFileAsync("git", ["worktree", "prune"], {
+				cwd: repoRoot,
+				windowsHide: true,
+			});
+		} catch {
+			/* best-effort */
+		}
+		_prunedRepos.add(repoRoot);
+		_pruneInFlight.delete(repoRoot);
+	})();
+	_pruneInFlight.set(repoRoot, p);
+	return p;
 }
 
 /**