pi-crew 0.9.58 → 0.9.60

package/CHANGELOG.md

@@ -3,6 +3,64 @@
 > **Note:** `atomic-write-v2.ts` / `AtomicWriter` mentioned in historical entries below was consolidated into `atomic-write.ts` as of v0.9.42. This changelog is preserved as historical record — the migration was completed (the v2 class was never adopted; v1 won on simplicity + symlink-safety + link+unlink atomicity). See `docs/migration/atomic-write-v2-migration.md` for the decision rationale.
 
 
+## [0.9.60] — subagent model routing: live-session model tracking, fallback policy, quota-aware ordering + iterative-audit hardening (2026-08-05)
+
+### Bug fixes
+
+- **Subagent model "jumped" to whatever a previous session had saved.** `ctx.model` is the session's *saved* model, not the live one. A session that restored stale state could report `anthropic/claude-sonnet-4-5` while actually running `minimax/MiniMax-M3`. Subagents inheriting the parent model (`model: false`, which every builtin agent uses) therefore landed on the wrong model. Fix: track the live model via pi's `model_select` event (`src/runtime/model/session-model.ts`) and use it as the parent model for all spawn paths.
+- **Live-session path silently discarded `ctx.model`.** `resolveParentModelFromRegistry` only accepted strings; `ctx.model` is a pi `Model` object. Every live-session subagent that inherited the parent model fell through to `getAvailable()[0]` instead. Fix: accept both objects and strings via `modelRefToString`.
+- **Background/async runs lost the caller's model context.** A detached background run has no `ExtensionContext`, so it lost the `model=` override, the inherited session model, and the auth-filtered model catalogue — silently routing to whatever `models.json` listed first. Fix: persist `modelContext` (override / parent model / available models) on the manifest at dispatch time and re-hydrate it in `background-runner`.
+- **Dead re-resolve branch in child-executor.** When the precomputed fallback chain was exhausted, the one-shot re-resolve found an alternative model but never appended it to `attemptModels` — the loop logged "retrying with X" but never actually retried. Fix: append the discovered model, exclude all previously-tried models, bump the spawn budget, and guard against re-entry.
+
+### Features
+
+- **Model fallback policy** (`runtime.modelFallback` in config, or env vars). Controls the auto tail (models appended from the registry/pi-config that nobody explicitly declared):
+  - `maxAutoFallbacks` — cap the auto tail (each extra candidate multiplies the worst-case spawn budget by `maxAttempts + 1`)
+  - `order: "parentFirst" | "asIs"` — keep the tail on the same provider as the running model before crossing providers
+  - `requireCredentials` — drop pi-config models whose provider has no discoverable credential
+  - `quotaAwareOrdering` — deprioritize providers near their rate-limit/quota (default: true, reads `after_provider_response` headers)
+  - `defaultSubagentModel` — default model for subagents when neither the caller nor the agent specifies one (sits between agent model and parent inheritance)
+  - Env overrides: `PI_CREW_MAX_AUTO_FALLBACKS`, `PI_CREW_MODEL_FALLBACK_ORDER`, `PI_CREW_MODEL_REQUIRE_CREDENTIALS`, `PI_CREW_MODEL`
+- **TeamRole `fallbackModels` + `thinking`**. Role lines now accept `fallbackModels=a,b` (comma-separated) and `thinking=high|medium|low|off`. Previously `fallbackModels=a,b` was silently swallowed into the role description.
+- **Quota-aware ordering** (`src/runtime/model/provider-quota.ts`). Tracks `x-ratelimit-remaining-*` and `retry-after` headers from `after_provider_response` events. Providers that are 429'd or near-zero remaining are pushed to the back of the auto tail. Process-local, 5-minute TTL, never blocks spawn.
+- **`task.model_dropped` warning event**. When the caller's requested model is not resolvable against the available catalogue, the chain silently runs something else. Now surfaced as an event + persisted to `task.modelRouting.droppedRequested` so users can see what happened.
+- **Doctor: "Model Routing" section**. Shows the live session model (from `model_select`), the active fallback policy, a sample chain for a generic agent, and the auto tail size.
+
+### Bug fixes
+
+- **Iterative-audit hardening (3 rounds, source-verified; 1 false positive rejected).** Round 1: provider-quota `headerResetMs` parsed `x-ratelimit-reset-requests` as epoch-seconds, but OpenAI sends Go-duration strings (`"6m0s"` → `parseInt`=6 → reset in 1970) so the low-remaining deprioritization heuristic never fired — now parses Go-duration / Anthropic RFC3339 / `retry-after` seconds. Scope-gate source attribution now tracks real precedence (override/step/teamRole → hard error; frontmatter/defaultSubagent/parent → soft warn). `quotaCache` cleared on `session_before_switch` (cross-session leak) + evicted past `2×QUOTA_TTL`. `PI_CREW_MAX_AUTO_FALLBACKS` NaN/negative now guarded with a warn (was silently unbounded / clamped to 0). Round 2 (re-audit caught regressions IN round 1): scope warnings were **silent** — the `logInternalError` calls forgot the `"warn"` severity, so they were debug-gated and the entire Sec-M1 fix was ineffective; now centralised in `warnOutOfScopeSoft()` (all 3 call sites) with a non-vacuous test. `parseResetValue` pure-seconds check moved before RFC3339 (`Date.parse("0")` returns Y2K, not NaN). Removed 2 vacuous re-resolve tests. `isFrontmatterOverride` source corrected to `"frontmatter"` so the soft warning surfaces. Round 3: verified Round-2 fixes; no new bugs (diminishing returns → stop).
+- **CI flake fixed — `[RT-NEW-2] budget abort drains in-flight tasks` (failed 3×: v0.9.59, `cfd68d06`, `12386af2`).** `terminaliseRunWithDrain` built `inflightTaskIds` as a SNAPSHOT of `ctx.pendingUnits`; a task whose dispatch unit settled + left `pendingUnits` before the abort — but whose task status wasn't terminal yet — was absent from the snapshot, fell through to `markBlocked`, and got clobbered to `"skipped"`. Now `SchedulerContext.dispatchedTaskIds` (monotonic Set populated at dispatch, never removed) drives the cancel-not-skip guard; `markBlocked` only catches genuinely never-dispatched queued tasks (semantics preserved). Verified 20/20 runs of the previously-flaky test + test:critical 101/101.
+
+### Docs / tooling
+- `skills/real-test-pi-crew/REPORT-TEMPLATE.md` + SKILL.md: per-run dated report artifact (evidence per tier) required for every real-test — fixes "all 9 tiers pass" overclaim where past runs were unverifiable memory. First report: `docs/real-test/reports/real-test-2026-08-05-model-routing.md`.
+- `docs/bugs/chain-workflow-forward-quirk.md` + GitHub issue #44: chain run via team tool fails ~58ms silent when `workflow:"chain"` is forwarded to steps (chain-dispatch passes it into each step's `handleRun`, which runs the "chain" workflow via `executeTeamRun`). Workaround: omit `workflow` (chain then runs 2/2 success).
+
+### Technical details
+
+- `ConfiguredModelRouting` gains `droppedRequested` and `autoFallbackCount` fields.
+- `ModelRoutingState` (persisted to task state) gains `droppedRequested` and `autoFallbackCount`.
+- `TeamRunManifest` gains `modelContext?: RunModelContext` for background/async model routing restoration.
+- `buildConfiguredModelRouting` input gains `defaultSubagentModel`, `teamRoleFallbackModels`, and `policy` fields.
+- New modules: `src/runtime/model/session-model.ts`, `src/runtime/model/provider-quota.ts`.
+- 42 new unit tests covering session-model tracker, provider-quota tracker, policy resolution, defaultSubagentModel precedence, teamRoleFallbackModels chain position, and droppedRequested detection.
+
+## [0.9.59] — cross-session isolation: stop leak of runs/subagents between concurrent pi sessions + stop false-reap of live sessions (2026-08-05)
+
+### Bug fixes
+
+- **Chạy 2 pi session trên cùng repo → thông tin run/subagent của session A rò rỉ sang B, và crash-recovery của B giết foreground work đang chạy của A.** Hai lỗi gốc: (1) `extractSessionId()` đọc `ctx.sessionId` (own property) — không tồn tại trên pi 0.83.0 `ExtensionContext` → trả `undefined` → mọi session filter vô hiệu thầm lặng; (2) crash-recovery + shared-state listings không có session component, nên session đang sống-but-bận không phân biệt được với session đã crash.
+  - **`extractSessionId` (`src/utils/session-utils.ts`)**: giờ dùng `ctx.sessionManager.getSessionId()` (WeakMap cache keyed bởi `sessionManager` ref ổn định — `ctx` được tạo mới mỗi event nên không thể làm cache key), giữ descriptor lookup làm fallback cho test mock/pi cũ.
+  - **Crash-recovery (`src/runtime/recovery/crash-recovery.ts`)**: `reconcileAllStaleRuns` / `purgeStaleActiveRunIndex` / `detectInterruptedRuns` nhận `currentSessionId?` và **skip run của chính session đang sống** (`===`, theo pattern `cancelOrphanedRuns`). Session chết vẫn được dọn; back-compat giữ nguyên khi `currentSessionId` undefined. Thread qua tất cả caller incl. path tần suất cao `observability` (`before_agent_start` + interval 5-min) và `lazy-configurers`.
+  - **Subagents (`src/runtime/subagent-manager.ts`, `subagent-tools.ts`, `subagent-manager-setup.ts`)**: `SubagentRecord` thêm `ownerSessionId`; `get_subagent_result` từ chối record của session khác (record cũ vẫn serve); `resultConsumed` không còn bị clobber chéo session; agent id thêm entropy tránh collision cross-process; `isOwnerSessionCurrent` check `ownerSessionId` cross-process (giữ generation cho in-process switch).
+  - **UI (`src/ui/run-dashboard.ts`, `widget/*`, `powerbar-publisher.ts`)**: dashboard `refreshRuns`, widget render, powerbar re-apply filter `workspaceId` mỗi frame. Powerbar self-derive `workspaceId` qua `extractSessionId(ctx)` nên mọi caller hiện tại đều được.
+  - **Notifier/session-summary (`src/extension/async-notifier.ts`, `session-summary.ts`)**: filter `listRuns` theo `ownerSessionId` trước notify — session B không còn toast về run của A.
+  - **Health filter (#3)**: `ctx.currentCtx?.sessionManager?.getSessionId()` + bỏ dead clause `ownerSessionGeneration` (field không tồn tại trên `TeamRunManifest`) — trước đó silently drop tất cả owned runs.
+  - Verified end-to-end theo skill `real-test-pi-crew`: `test:critical` 101/101, 3-path kill-switch green, typecheck + bundle + md5 sync OK, live TUI (tmux + pty) render không crash, smoke verifier 52s (<300s, no hang), full feature battery (team tool 9a–9f + subagent tools) clean — zero `Unknown type`/`Validation failed`. 6837 unit + 214 integration tests pass.
+- Lưu ý: `#12` (DeliveryCoordinator) infrastructure staged nhưng inert — `deliver*` không có production caller, nên queue không bao giờ được feed. Documented trong `docs/cross-session-leak-fix-plan.md`.
+
+### Docs
+- `docs/cross-session-leak-audit.md` (audit re-verify: 2/2 root cause CONFIRMED, 12/13 vector CONFIRMED, #3 REFUTED) + `docs/cross-session-leak-fix-plan.md` (phased plan, reviewed).
+
 ## [0.9.58] — fix load crash on stale hoisted typebox: defensive guard + bundle vendoring (survives `pi update`) + round-1/round-2 fixes (2026-08-04)
 
 ### Bug fixes