pi-crew 0.9.57 → 0.9.59

package/src/state/coordination/locks.ts

@@ -239,12 +239,20 @@ function timingSafeTokenMatch(a: string, b: string): boolean {
 }
 
 /**
- * Release the lock we (this process) just acquired. Unlike releaseLock, this
- * unconditionally removes the file because we know we created it in the same
- * withRunLock* call — token matching is only needed for multi-process scenarios
- * (where a different holder's token must not be deleted). Within the same process
- * the new acquire uses a fresh randomUUID token, so token matching would falsely
- * fail and leak the file across releases.
+ * Release the lock we (this process) just acquired. Unlike releaseLock, this is
+ * used in the `finally` blocks of withRunLock and withRunLockSync so the file was
+ * created earlier in the SAME call. Within the same process the new acquire uses
+ * a fresh randomUUID token, so token matching would falsely fail and leak the
+ * file across releases.
+ *
+ * LOCK-1 (Round 2): PID-guarded release. Previously this deleted
+ * UNCONDITIONALLY — if our critical section exceeded staleMs, another process
+ * could steal our lock (overwrite the file with its own pid); our finally would
+ * then DELETE THE STEALER's lock, breaking mutual exclusion. We now verify the
+ * lock file still records OUR pid before removing; if it records a different pid
+ * the lock was stolen and the current holder owns it. Same-process re-acquire is
+ * preserved (pid matches → delete). Mirrors the proven pattern in event-log.ts
+ * (Round 26, BUG 5).
  *
  * Symlink guard is preserved: if a symlink appeared since our writeLockFile, we
  * don't rm it (defense against attacker-planted symlinks).
@@ -257,7 +265,12 @@ export function releaseOwnLock(filePath: string, _token: string): void {
 		/* ENOENT is fine */
 	}
 	try {
-		fs.rmSync(filePath, { force: true });
+		const raw = fs.readFileSync(filePath, "utf-8");
+		const holderPid = (JSON.parse(raw) as { pid?: unknown })?.pid;
+		if (holderPid === process.pid) {
+			fs.rmSync(filePath, { force: true });
+		}
+		// holderPid !== process.pid → lock stolen by another process; do NOT touch.
 	} catch (error) {
 		const code = (error as NodeJS.ErrnoException).code;
 		if (code !== "ENOENT") {

package/src/state/coordination/mailbox.ts

@@ -238,7 +238,9 @@ function ensureTaskMailbox(manifest: TeamRunManifest, taskId: string): void {
 	taskMailboxDir(manifest, taskId, true);
 	for (const direction of ["inbox", "outbox"] as const) {
 		const filePath = mailboxFile(manifest, direction, taskId, true);
-		if (!fs.existsSync(filePath)) fs.writeFileSync(filePath, "", "utf-8");
+		// STATE-10: use atomicWriteFile for consistency with ensureRunMailbox —
+		// the old fs.writeFileSync was non-atomic (TOCTOU on concurrent reads).
+		if (!fs.existsSync(filePath)) atomicWriteFile(filePath, "");
 	}
 }
 
@@ -472,7 +474,23 @@ export function readDeliveryState(manifest: TeamRunManifest): MailboxDeliverySta
 		};
 		setDeliveryCacheEntry(filePath, { mtimeMs: stat.mtimeMs, state });
 		return state;
-	} catch {
+	} catch (error) {
+		// NEW-R4: a corrupt delivery.json was previously swallowed silently, returning
+		// empty → messages appear undelivered → re-delivery on every replay. Quarantine
+		// the corrupt file (preserve for diagnosis) + log prominently so the re-delivery
+		// risk is visible. Mirror the state-store quarantineCorruptFile pattern.
+		const quarantinePath = `${filePath}.corrupt-${Date.now()}`;
+		try {
+			fs.renameSync(filePath, quarantinePath);
+		} catch (renameError) {
+			logInternalError("mailbox.readDeliveryState.quarantine", renameError, `filePath=${filePath}`);
+		}
+		// NEW-R4: prominent (ungated) error so corrupt-delivery re-delivery risk is
+		// visible even without PI_TEAMS_DEBUG — messages may be re-delivered.
+		console.error(
+			`[pi-crew:mailbox.readDeliveryState] corrupt delivery.json quarantined to ${quarantinePath} — delivery state reset to empty; messages may be re-delivered. Error: ${error instanceof Error ? error.message : String(error)}`,
+		);
+		deliveryCache.delete(filePath);
 		return { messages: {}, updatedAt: new Date().toISOString() };
 	}
 }

package/src/state/gitignore-manager.ts

@@ -41,6 +41,10 @@ export async function updateGitignore(gitignorePath: string): Promise<void> {
 	}
 
 	if (appended) {
-		fs.writeFileSync(gitignorePath, current + appended, "utf-8");
+		// NEW-R5: atomic read-modify-write of the user-visible .gitignore — the old
+		// writeFileSync left a truncate-then-write window (crash ⇒ empty/partial file)
+		// and a TOCTOU race with concurrent readers. atomicWriteFile (temp+rename)
+		// makes the final write atomic while preserving the read-append logic above.
+		atomicWriteFile(gitignorePath, current + appended);
 	}
 }

package/src/state/stores/artifact-store.ts

@@ -216,11 +216,11 @@ export function writeArtifact(artifactsRoot: string, options: ArtifactWriteOptio
 	}
 	content = redactSecretString(content);
 	atomicWriteFile(filePath, content);
-	// Compute hash on written bytes for integrity verification.
-	// Read back the actual file content to handle atomicWrite fallback path
-	// where the written content might differ from the input (e.g., concurrent writes).
-	const writtenContent = fs.readFileSync(filePath, "utf-8");
-	const contentHash = hashContent(writtenContent);
+	// STATE-9: compute the hash on the in-memory content (post-redaction) instead of
+	// reading the file back. atomicWriteFile writes the exact content atomically, so
+	// the read-back was only ever "defense" for a concurrent-write case that cannot
+	// occur — the file is replaced via atomic rename, never partially written.
+	const contentHash = hashContent(content);
 	const stats = fs.statSync(filePath);
 	return {
 		kind: options.kind,

package/src/state/stores/run-cache.ts

@@ -117,7 +117,15 @@ export function saveRunToCache(
 	// name collision the old manual temp+rename had).
 	const indexPath = path.join(dir, "index.json");
 	withFileLockSync(indexPath, () => {
-		const index: CacheIndex = fs.existsSync(indexPath) ? JSON.parse(fs.readFileSync(indexPath, "utf-8")) : {};
+		// NEW-P4: TOCTOU fix — readFileSync + ENOENT catch instead of existsSync+read
+		// (1 syscall, no race). Only ENOENT falls back to {}; a corrupt-but-present
+		// index still throws, matching the old existsSync → JSON.parse behavior.
+		let index: CacheIndex = {};
+		try {
+			index = JSON.parse(fs.readFileSync(indexPath, "utf-8")) as CacheIndex;
+		} catch (error) {
+			if ((error as NodeJS.ErrnoException).code !== "ENOENT") throw error;
+		}
 		index[cacheKey] = entryPath;
 		atomicWriteJson(indexPath, index);
 	});

package/src/state/stores/state-store.ts

@@ -468,7 +468,7 @@ export function saveRunTasks(manifest: TeamRunManifest, tasks: TeamTaskState[]):
 		return;
 	}
 
-	atomicWriteJson(manifest.tasksPath, tasks);
+	atomicWriteJson(manifest.tasksPath, tasks, { compact: true });
 	// FIX: Re-populate cache with actual mtime/size for manifest and tasks.
 	// Note: We re-read manifest from disk to get its current mtime/size
 	// since we only wrote tasks here.
@@ -542,7 +542,7 @@ export function saveRunTasksCoalesced(manifest: TeamRunManifest, tasks: TeamTask
 	} catch {
 		return;
 	}
-	atomicWriteJsonCoalesced(manifest.tasksPath, tasks, undefined, undefined, skipCoalesce);
+	atomicWriteJsonCoalesced(manifest.tasksPath, tasks, undefined, { compact: true }, skipCoalesce);
 }
 
 export async function saveRunTasksAsync(manifest: TeamRunManifest, tasks: TeamTaskState[]): Promise<void> {
@@ -555,7 +555,7 @@ export async function saveRunTasksAsync(manifest: TeamRunManifest, tasks: TeamTa
 	} catch {
 		return;
 	}
-	await atomicWriteJsonAsync(manifest.tasksPath, tasks);
+	await atomicWriteJsonAsync(manifest.tasksPath, tasks, { compact: true });
 }
 
 /**
@@ -589,7 +589,7 @@ async function saveManifestAndTasksAtomic(manifest: TeamRunManifest, tasks: Team
 			invalidateRunCache(manifest.stateRoot);
 			await atomicWriteJsonAsync(path.join(manifest.stateRoot, "manifest.json"), manifest);
 			manifestWritten = true;
-			await atomicWriteJsonAsync(manifest.tasksPath, tasks);
+			await atomicWriteJsonAsync(manifest.tasksPath, tasks, { compact: true });
 			tasksWritten = true;
 		});
 	} catch (err) {
@@ -615,7 +615,7 @@ function saveManifestAndTasksAtomicSync(manifest: TeamRunManifest, tasks: TeamTa
 			invalidateRunCache(manifest.stateRoot);
 			atomicWriteJson(path.join(manifest.stateRoot, "manifest.json"), manifest);
 			manifestWritten = true;
-			atomicWriteJson(manifest.tasksPath, tasks);
+			atomicWriteJson(manifest.tasksPath, tasks, { compact: true });
 			tasksWritten = true;
 		});
 	} catch (err) {
@@ -891,7 +891,7 @@ function migrateTasksFile(parsed: unknown, runId: string): TeamTaskState[] {
 	}
 	return extractTaskArray(parsed);
 }
-function loadTasksWithRecovery(tasksPath: string, eventsPath: string, runId: string): TeamTaskState[] {
+export function loadTasksWithRecovery(tasksPath: string, eventsPath: string, runId: string): TeamTaskState[] {
 	let content: string;
 	try {
 		content = fs.readFileSync(tasksPath, "utf-8");
@@ -907,19 +907,49 @@ function loadTasksWithRecovery(tasksPath: string, eventsPath: string, runId: str
 		// SyntaxError — corrupt file.
 		quarantineCorruptFile(tasksPath);
 		const reconstructed = reconstructTasksFromEventLog(eventsPath, runId);
-		if (reconstructed.length > 0) atomicWriteJson(tasksPath, reconstructed);
+		if (reconstructed.length > 0) atomicWriteJson(tasksPath, reconstructed, { compact: true });
 		return reconstructed;
 	}
 	if (!isRecognizableTasksPayload(parsed)) {
 		// Neither v0 bare array nor v1+ envelope (e.g. `{}`) — corrupt.
 		quarantineCorruptFile(tasksPath);
 		const reconstructed = reconstructTasksFromEventLog(eventsPath, runId);
-		if (reconstructed.length > 0) atomicWriteJson(tasksPath, reconstructed);
+		if (reconstructed.length > 0) atomicWriteJson(tasksPath, reconstructed, { compact: true });
 		return reconstructed;
 	}
 	return migrateTasksFile(parsed, runId);
 }
 
+/**
+ * STATE-3: Load manifest.json with corruption quarantine (sync). Distinguishes:
+ * - ENOENT / read error → undefined (legitimate missing run — NOT quarantined).
+ * - SyntaxError (unparseable) → CORRUPT → quarantine `.corrupt-<ts>` + log + undefined.
+ *   Manifest CANNOT be reconstructed from events.jsonl (run.created only carries
+ *   {team, workflow}), so quarantine + visible log is the recovery — do NOT attempt
+ *   reconstruction (unlike loadTasksWithRecovery). This prevents a corrupt manifest
+ *   from silently making a run invisible (STATE-3).
+ */
+export function loadManifestWithRecovery(manifestPath: string, runId: string): TeamRunManifest | undefined {
+	let content: string;
+	try {
+		content = fs.readFileSync(manifestPath, "utf-8");
+	} catch {
+		// ENOENT / ENOTDIR / other read error → legitimate missing run.
+		return undefined;
+	}
+	try {
+		return JSON.parse(content) as TeamRunManifest;
+	} catch {
+		// SyntaxError → corrupt manifest. Quarantine (preserve for diagnosis) + log,
+		// then treat as missing. Do NOT reconstruct (infeasible from events).
+		quarantineCorruptFile(manifestPath);
+		console.error(
+			`[state-store] STATE-3: manifest.json for run ${runId} is corrupt (unparseable) — quarantined to ${manifestPath}.corrupt-*. Run is now treated as missing. Preserve the .corrupt-* file for diagnosis.`,
+		);
+		return undefined;
+	}
+}
+
 /**
  * ST-4: async twin of {@link loadTasksWithRecovery}.
  */
@@ -936,13 +966,13 @@ async function loadTasksWithRecoveryAsync(tasksPath: string, eventsPath: string,
 	} catch {
 		quarantineCorruptFile(tasksPath);
 		const reconstructed = reconstructTasksFromEventLog(eventsPath, runId);
-		if (reconstructed.length > 0) await atomicWriteJsonAsync(tasksPath, reconstructed);
+		if (reconstructed.length > 0) await atomicWriteJsonAsync(tasksPath, reconstructed, { compact: true });
 		return reconstructed;
 	}
 	if (!isRecognizableTasksPayload(parsed)) {
 		quarantineCorruptFile(tasksPath);
 		const reconstructed = reconstructTasksFromEventLog(eventsPath, runId);
-		if (reconstructed.length > 0) await atomicWriteJsonAsync(tasksPath, reconstructed);
+		if (reconstructed.length > 0) await atomicWriteJsonAsync(tasksPath, reconstructed, { compact: true });
 		return reconstructed;
 	}
 	return migrateTasksFile(parsed, runId);
@@ -1068,6 +1098,18 @@ export function loadRunManifestById(cwd: string, runId: string): { manifest: Tea
 			`[state-store] Manifest schemaVersion mismatch: expected ${CURRENT_SCHEMA_VERSION}, got ${manifest.schemaVersion}. Run ${runId} may be incompatible.`,
 		);
 	}
+	// STATE-3: readJsonFile returns undefined for BOTH missing (ENOENT) and corrupt
+	// (SyntaxError). A corrupt manifest currently makes the run silently invisible.
+	// If the file EXISTS but readJsonFile returned undefined, it is corrupt → quarantine
+	// it (preserve for diagnosis) + log + bail. Manifest reconstruction from events is
+	// infeasible (run.created lacks manifest fields), so quarantine+log is the recovery.
+	if (!manifest && fs.existsSync(manifestPath)) {
+		quarantineCorruptFile(manifestPath);
+		console.error(
+			`[state-store] STATE-3: manifest.json for run ${runId} exists but is unparseable — quarantined. Run treated as missing; preserve the .corrupt-* file for diagnosis.`,
+		);
+		return undefined;
+	}
 	if (!manifest || !validateRunManifestPaths(cwd, runId, manifest, stateRoot, tasksPath)) return undefined;
 	setManifestCache(stateRoot, {
 		manifest,
@@ -1193,6 +1235,18 @@ export async function loadRunManifestByIdAsync(
 			`[state-store] Manifest schemaVersion mismatch: expected ${CURRENT_SCHEMA_VERSION}, got ${manifest.schemaVersion}. Run ${runId} may be incompatible.`,
 		);
 	}
+	// STATE-3 (async twin): readJsonFileAsync returns undefined for BOTH missing (ENOENT)
+	// and corrupt (SyntaxError). Mirror the sync loadRunManifestById STATE-3 fix — if the
+	// file EXISTS but the read returned undefined, it is corrupt → quarantine (preserve for
+	// diagnosis) + log + bail. Manifest reconstruction from events is infeasible (run.created
+	// lacks manifest fields), so quarantine+log is the recovery.
+	if (!manifest && fs.existsSync(manifestPath)) {
+		quarantineCorruptFile(manifestPath);
+		console.error(
+			`[state-store] STATE-3 async: manifest.json for run ${runId} exists but is unparseable — quarantined. Run treated as missing; preserve the .corrupt-* file for diagnosis.`,
+		);
+		return undefined;
+	}
 	if (!manifest || !validateRunManifestPaths(cwd, runId, manifest, stateRoot, tasksPath)) return undefined;
 	setManifestCache(stateRoot, {
 		manifest,

package/src/ui/deploy-bundled-themes.ts

@@ -40,6 +40,17 @@ export function deployBundledThemes(): number {
 
 		if (!fs.existsSync(srcDir)) return 0;
 
+		// PERF-7: mtime fast-path. If the destination dir is at least as new as the
+		// source dir, the deployed themes are already current — skip the per-file
+		// read+compare loop entirely (~22 sync fs ops -> 2 statSync on the steady
+		// path). Falls through to the per-file deploy if either stat is missing or
+		// the source is newer (e.g. a new pi-crew version shipped updated themes).
+		try {
+			if (fs.statSync(srcDir).mtimeMs <= fs.statSync(dstDir).mtimeMs) return 0;
+		} catch {
+			/* dst missing or stat failed -> fall through to per-file deploy */
+		}
+
 		const files = (fs.readdirSync(srcDir) as string[]).filter((f) => f.endsWith(".json"));
 		if (files.length === 0) return 0;
 

package/src/ui/powerbar-publisher.ts

@@ -2,13 +2,14 @@ import * as fs from "node:fs";
 import type { CrewUiConfig } from "../config/config.ts";
 import { listRecentRuns } from "../extension/run-index.ts";
 import { readCrewAgents } from "../runtime/crew-agent-records.ts";
-import { listLiveAgents } from "../runtime/live-session/live-agent-manager.ts";
+import { listLiveAgents, listLiveAgentsByWorkspace } from "../runtime/live-session/live-agent-manager.ts";
 import type { ManifestCache } from "../runtime/manifest-cache.ts";
 import { isDisplayActiveRun } from "../runtime/process-status.ts";
 import type { TeamRunManifest, TeamTaskState } from "../state/types.ts";
 import { aggregateUsage } from "../state/usage.ts";
 import { readJsonFileCoalesced } from "../utils/file-coalescer.ts";
 import { logInternalError } from "../utils/internal-error.ts";
+import { extractSessionId } from "../utils/session-utils.ts";
 import { allWorkflows, discoverWorkflows } from "../workflows/discover-workflows.ts";
 import { RenderCoalescer } from "./render-coalescer.ts";
 import type { RunSnapshotCache, RunUiSnapshot } from "./snapshot-types.ts";
@@ -97,8 +98,9 @@ export function updatePiCrewPowerbar(
 	ctx?: StatusContext,
 	notificationCount = 0,
 	preloadedManifests?: TeamRunManifest[],
+	workspaceId?: string,
 ): void {
-	powerbarPublisher.update(events, cwd, config, manifestCache, snapshotCache, ctx, notificationCount, preloadedManifests);
+	powerbarPublisher.update(events, cwd, config, manifestCache, snapshotCache, ctx, notificationCount, preloadedManifests, workspaceId);
 }
 
 // --- Dedup state + coalescer live on a class instance so they survive hot-reload
@@ -191,6 +193,7 @@ interface PowerbarUpdateArgs {
 	ctx?: StatusContext;
 	notificationCount: number;
 	preloadedManifests?: TeamRunManifest[];
+	workspaceId?: string;
 }
 
 /**
@@ -211,7 +214,17 @@ class PowerbarPublisher {
 			const a = this.#latestArgs;
 			this.#latestArgs = null;
 			if (!a) return;
-			this.update(a.events, a.cwd, a.config, a.manifestCache, a.snapshotCache, a.ctx, a.notificationCount, a.preloadedManifests);
+			this.update(
+				a.events,
+				a.cwd,
+				a.config,
+				a.manifestCache,
+				a.snapshotCache,
+				a.ctx,
+				a.notificationCount,
+				a.preloadedManifests,
+				a.workspaceId,
+			);
 		}, 200);
 	}
 
@@ -224,10 +237,18 @@ class PowerbarPublisher {
 		ctx?: StatusContext,
 		notificationCount = 0,
 		preloadedManifests?: TeamRunManifest[],
+		workspaceId?: string,
 	): void {
 		if (config?.powerbar === false) return;
 		const useStatusFallback = !hasPowerbarConsumer(events);
-		const runs = preloadedManifests ?? (manifestCache ? manifestCache.list(20) : listRecentRuns(cwd, 20));
+		// P3 (#10): prefer an explicit workspaceId arg; otherwise self-derive
+		// from the ctx every caller already passes (ExtensionContext exposes
+		// sessionManager). Back-compat: when neither is present, no filtering.
+		const effectiveWorkspaceId = workspaceId ?? extractSessionId(ctx);
+		const allRuns = preloadedManifests ?? (manifestCache ? manifestCache.list(20) : listRecentRuns(cwd, 20));
+		const runs = effectiveWorkspaceId
+			? allRuns.filter((run) => !run.ownerSessionId || run.ownerSessionId === effectiveWorkspaceId)
+			: allRuns;
 		const active = runs
 			.map((run) => {
 				let snapshot: RunUiSnapshot | undefined;
@@ -300,7 +321,8 @@ class PowerbarPublisher {
 						?.model?.split("/")
 						.at(-1);
 		const tokenText = config?.showTokens === false || !tokenTotal ? undefined : compactTokens(tokenTotal);
-		const liveRunning = listLiveAgents().filter((a) => a.status === "running").length;
+		const liveAgents = effectiveWorkspaceId ? listLiveAgentsByWorkspace(effectiveWorkspaceId) : listLiveAgents();
+		const liveRunning = liveAgents.filter((a) => a.status === "running").length;
 		// Always show consistent status: running count + queued count from live tasks only
 		// Avoid snapshot cache for counts to prevent UI jumping
 		const runningCount = agents.filter((a) => a.status === "running").length;
@@ -388,6 +410,7 @@ class PowerbarPublisher {
 		ctx?: StatusContext,
 		notificationCount = 0,
 		preloadedManifests?: TeamRunManifest[],
+		workspaceId?: string,
 	): void {
 		if (config?.powerbar === false) return;
 		this.#latestArgs = {
@@ -399,6 +422,7 @@ class PowerbarPublisher {
 			ctx,
 			notificationCount,
 			preloadedManifests,
+			workspaceId,
 		};
 		this.#coalescer.request();
 	}
@@ -440,8 +464,9 @@ export function requestPowerbarUpdate(
 	ctx?: StatusContext,
 	notificationCount = 0,
 	preloadedManifests?: TeamRunManifest[],
+	workspaceId?: string,
 ): void {
-	powerbarPublisher.request(events, cwd, config, manifestCache, snapshotCache, ctx, notificationCount, preloadedManifests);
+	powerbarPublisher.request(events, cwd, config, manifestCache, snapshotCache, ctx, notificationCount, preloadedManifests, workspaceId);
 }
 
 /** Dispose the powerbar coalescer. Call during extension cleanup. */

package/src/ui/run-dashboard.ts

@@ -518,7 +518,13 @@ export class RunDashboard implements DashboardComponent {
 		if (!this.options.runProvider) return;
 		const selectedRunId = this.selectedRunId();
 		const next = this.options.runProvider();
-		this.runs = Array.isArray(next) ? next : this.runs;
+		// P3 (#8): re-apply the workspaceId filter on EVERY refresh, not just
+		// the constructor. Without this, runs from other sessions leak back in
+		// on frame 2+ once the runProvider returns the unfiltered manifest list.
+		const unfiltered = Array.isArray(next) ? next : this.runs;
+		this.runs = this.options.workspaceId
+			? unfiltered.filter((run) => !run.ownerSessionId || run.ownerSessionId === this.options.workspaceId)
+			: unfiltered;
 		if (selectedRunId) {
 			const nextIndex = groupedRuns(this.runs, this.options.snapshotCache)
 				.filter((row) => row.run)

package/src/ui/syntax-highlight.ts

@@ -5,10 +5,25 @@
  * Falls back to plain text (theme.fg on every line) if the language is
  * unsupported or highlighting fails.
  */
-import { highlight, supportsLanguage } from "cli-highlight";
+import { createRequire } from "node:module";
 import type { CrewTheme } from "./theme-adapter.ts";
 import { asCrewTheme } from "./theme-adapter.ts";
 
+// PERF-1: cli-highlight loads highlight.js (~190 grammars) at require() time,
+// adding 50-150ms to every cold start if imported eagerly at bundle load.
+// highlight() is only called from SYNC render paths (highlightCode /
+// highlightJson), so it MUST stay sync — lazy-load via a synchronous
+// createRequire shim on first use instead (same mechanism as
+// skills/validate.ts's yaml / utils/git.ts's hosted-git-info). In the esbuild
+// bundle cli-highlight stays external and resolves through this same shim.
+const require = createRequire(import.meta.url);
+type CliHighlight = typeof import("cli-highlight");
+let cached: CliHighlight | undefined;
+function cliHighlight(): CliHighlight {
+	if (!cached) cached = require("cli-highlight") as CliHighlight;
+	return cached;
+}
+
 // ── cli-highlight theme bridge ──────────────────────────────────────────
 
 function buildCliTheme(theme: CrewTheme): Record<string, (text: string) => string> {
@@ -39,11 +54,13 @@ function hlCliSync(code: string, language: string | undefined, theme: CrewTheme)
 			.join("\n");
 	}
 	try {
-		return highlight(code, {
-			language,
-			ignoreIllegals: true,
-			theme: buildCliTheme(theme),
-		}).trimEnd();
+		return cliHighlight()
+			.highlight(code, {
+				language,
+				ignoreIllegals: true,
+				theme: buildCliTheme(theme),
+			})
+			.trimEnd();
 	} catch {
 		return code
 			.split("\n")
@@ -105,18 +122,20 @@ function detectLanguageFromPath(filePath: string): string | undefined {
 
 export function highlightCode(code: string, language: string | undefined, themeLike: unknown = undefined): string {
 	const theme = asCrewTheme(themeLike);
-	const validLanguage = language && supportsLanguage(language) ? language : undefined;
+	const validLanguage = language && cliHighlight().supportsLanguage(language) ? language : undefined;
 	return hlCliSync(code, validLanguage, theme);
 }
 
 export function highlightJson(payload: string, themeLike: unknown = undefined): string {
 	const theme = asCrewTheme(themeLike);
 	try {
-		return highlight(payload, {
-			language: "json",
-			ignoreIllegals: true,
-			theme: buildCliTheme(theme),
-		}).trimEnd();
+		return cliHighlight()
+			.highlight(payload, {
+				language: "json",
+				ignoreIllegals: true,
+				theme: buildCliTheme(theme),
+			})
+			.trimEnd();
 	} catch {
 		try {
 			const parsed = JSON.parse(payload);

package/src/ui/widget/index.ts

@@ -270,7 +270,13 @@ class CrewWidgetComponent implements WidgetComponent {
 	}
 
 	render(width: number): string[] {
-		const runs = activeWidgetRuns(this.model.cwd, this.model.manifestCache, this.model.snapshotCache, this.model.preloadManifests);
+		const runs = activeWidgetRuns(
+			this.model.cwd,
+			this.model.manifestCache,
+			this.model.snapshotCache,
+			this.model.preloadManifests,
+			this.model.workspaceId,
+		);
 		// C4: invalidate-on-write signature cache. buildSignature() is
 		// O(runs×agents) string work called on every ~160ms host-driven render
 		// tick. Within one state snapshot (no event arrived → cache not cleared
@@ -391,6 +397,7 @@ export function updateCrewWidget(
 			manifestCache,
 			snapshotCache,
 			preloadManifests: preloadedManifests,
+			workspaceId,
 		};
 	else {
 		state.model.cwd = ctx.cwd;
@@ -400,6 +407,7 @@ export function updateCrewWidget(
 		state.model.manifestCache = manifestCache;
 		state.model.snapshotCache = snapshotCache;
 		state.model.preloadManifests = preloadedManifests;
+		state.model.workspaceId = workspaceId;
 	}
 
 	if (needsWidgetInstall) {

package/src/ui/widget/widget-model.ts

@@ -42,7 +42,7 @@ export function activeWidgetRuns(
 	if (now - lastStaleReconcileAt > STALE_RECONCILE_INTERVAL_MS && manifestCache) {
 		lastStaleReconcileAt = now;
 		try {
-			reconcileAllStaleRuns(cwd, manifestCache);
+			reconcileAllStaleRuns(cwd, manifestCache, Date.now(), workspaceId);
 		} catch {
 			/* non-critical */
 		}

package/src/ui/widget/widget-types.ts

@@ -21,6 +21,9 @@ export interface CrewWidgetModel {
 	manifestCache?: ManifestCache;
 	snapshotCache?: RunSnapshotCache;
 	preloadManifests?: TeamRunManifest[];
+	/** P3 (#9): workspace/session ID for filtering runs by ownerSessionId
+	 * on every render, not just the first frame. */
+	workspaceId?: string;
 }
 
 export interface CrewWidgetState {

package/src/utils/env-filter.ts

@@ -131,20 +131,34 @@ export function sanitizeEnvSecrets(env: NodeJS.ProcessEnv, options?: SanitizeEnv
 				throw new Error(`Allowlist entry "${pattern}" looks like a secret key. Use a more specific pattern.`);
 			}
 		}
-		const matchers = options.allowList.map((p) => {
+		// Separate exact entries (explicitly trusted) from glob patterns.
+		// Exact entries (e.g. provider API keys) are deliberately listed by the
+		// caller and validated above; they must pass through unchanged.
+		const exact = new Set<string>();
+		const globPrefixes: string[] = [];
+		for (const p of options.allowList) {
 			if (p.endsWith("*")) {
-				// Glob pattern: matches keys that start with the prefix AND have
-				// at least one additional character (distinguishes "PI_CREW_*" from "PI_CREW_").
-				// For example, "PI_CREW_*" matches "PI_CREW_DEPTH" but not "PI_CREW_".
-				// This ensures trailing glob patterns require extra chars, not exact-prefix-only matches.
-				const prefix = p.slice(0, -1);
-				return (k: string) => k.startsWith(prefix) && k.length > prefix.length;
+				// Trailing glob: match keys that start with the prefix AND have at
+				// least one additional character (distinguishes "PI_CREW_*" from "PI_CREW_").
+				globPrefixes.push(p.slice(0, -1));
+			} else {
+				exact.add(p);
 			}
-			// Exact match is case-sensitive; Unix env vars are uppercase by convention.
-			return (k: string) => k === p;
-		});
+		}
 		for (const [key, value] of Object.entries(env)) {
-			if (value !== undefined && matchers.some((fn) => fn(key))) filtered[key] = value;
+			if (value === undefined) continue;
+			// Exact allow-list entries are explicitly trusted (e.g. ANTHROPIC_API_KEY
+			// scoped to a model). No secondary secret check — the caller vouches for them.
+			if (exact.has(key)) {
+				filtered[key] = value;
+				continue;
+			}
+			// Glob-matched keys (e.g. PI_CREW_*): NEW-S1 secondary guard — a broad glob
+			// must not forward secret-named keys (PI_CREW_OPENAI_API_KEY,
+			// PI_CREW_SECRET_TOKEN, ...) to spawned hook scripts with process access.
+			if (globPrefixes.some((prefix) => key.startsWith(prefix) && key.length > prefix.length) && !isSecretKey(key)) {
+				filtered[key] = value;
+			}
 		}
 		return filtered;
 	}