pi-crew 0.9.62 → 0.9.65

package/src/runtime/child-pi/child-pi-spawn.ts

@@ -19,11 +19,14 @@
 import type { SpawnOptions } from "node:child_process";
 import * as fs from "node:fs";
 import * as path from "node:path";
+import { isScratchpadEnabledForRole } from "../../config/role-tools.ts";
 import { WINDOWS_ESSENTIAL_ENV_VARS } from "../../utils/env-allowlist.ts";
 import { buildScopedAllowList, sanitizeEnvSecrets } from "../../utils/env-filter.ts";
 import { logInternalError } from "../../utils/internal-error.ts";
-import { buildPiWorkerArgs } from "../model/pi-args.ts";
+import { resolveRealContainedPath } from "../../utils/safe-paths.ts";
+import { buildPiWorkerArgs, createSafeTempDir, getPiTempBase } from "../model/pi-args.ts";
 import { getPiSpawnCommand } from "../pi-spawn.ts";
+import { findLatestScratchpadSnapshot } from "../scratchpad/snapshot-lookup.ts";
 import type { ChildPiRunInput, ChildPiRunResult } from "./child-pi.ts";
 
 // ── Env allowlist (base set always passed to children) ──────────────────
@@ -271,6 +274,44 @@ export function prepareSpawnContext(
 		if (input.runId) built.env.PI_CREW_BROKER_RUN_ID = input.runId;
 		if (input.agentId) built.env.PI_CREW_BROKER_TASK_ID = input.agentId;
 	}
+	// Phase 1 scratchpad: opt in the persistent Bun-free JS evaluator (execute
+	// tool) for this worker. Gated by role/agent (S-6 read-only roles never;
+	// F6 agent.scratchpad===false kills). All keys are PI_CREW_* control vars →
+	// pass assertOnlyControlEnvKeys. Only set when there is a task id to bind
+	// the snapshot to (always present on the child-executor path).
+	if (input.agentId && isScratchpadEnabledForRole(input.role ?? input.agent.name, input.agent)) {
+		built.env.PI_CREW_SCRATCHPAD = "1"; // dormant gate (worker conditional registerTool)
+		built.env.PI_CREW_TASK_ID = input.agentId; // snapshot relativePath provenance
+		built.env.PI_CREW_ATTEMPT = String(input.attempt ?? 0); // C3 per-attempt suffix
+		if (input.artifactsRoot) {
+			// N2-1: worker reads this DIRECTLY as writeArtifact's artifactsRoot — do
+			// NOT derive from the snapshot path (snapshot is in tempDir, not under
+			// artifactsRoot after F4/S-1).
+			built.env.PI_CREW_ARTIFACTS_ROOT = input.artifactsRoot;
+		}
+		// F4/S-1: the RAW (unredacted) snapshot must NEVER land in artifactsRoot —
+		// point it at a temp dir; the worker reads it then writeArtifact()
+		// (redact+atomic) is the ONLY writer into artifactsRoot.
+		// R3-1: built.tempDir is only created by buildPiWorkerArgs when the agent
+		// has a systemPrompt OR the task exceeds TASK_ARG_LIMIT — guard against
+		// undefined (resolveRealContainedPath(undefined) would TypeError and crash
+		// spawn). createSafeTempDir auto-tracks the dir for cleanupAllTrackedTempDirs.
+		const scratchTempDir = built.tempDir ?? createSafeTempDir(getPiTempBase(), "pi-crew-scratchpad-");
+		built.env.PI_CREW_SCRATCHPAD_SNAPSHOT = resolveRealContainedPath(scratchTempDir, `${input.agentId}.snapshot.json`);
+		// Phase 2 crash-resume (D1/D1b/D2): locate the latest snapshot artifact of a
+		// PREVIOUS attempt (retry round / crash-recovery re-queue / manual re-run)
+		// and hand its path to the worker via PI_CREW_SCRATCHPAD_RESTORE. The worker
+		// re-validates at READ time (D10) — this env is a hint, not a trust anchor.
+		// Latest-mtime wins (model-fallback i resets each retry round); RESTORE_MTIME
+		// lets the worker detect a swap between spawn and first execute (MINOR-S1).
+		const restoreHit = input.artifactsRoot ? findLatestScratchpadSnapshot(input.artifactsRoot, input.agentId) : null;
+		if (restoreHit) {
+			built.env.PI_CREW_SCRATCHPAD_RESTORE = restoreHit.path;
+			// NIT-CA-1: mtime pin is a SWAP-DETECTION HINT (defense-in-depth), never
+			// an integrity/authn control — any same-uid actor can utimesSync it.
+			built.env.PI_CREW_SCRATCHPAD_RESTORE_MTIME = String(restoreHit.mtimeMs);
+		}
+	}
 	// B5: if the parent already aborted before we spawn, do not start the child
 	// at all. Spawning a doomed process wastes resources, and the abort listener
 	// registered below will not re-fire for an already-aborted signal (so the

package/src/runtime/child-pi/child-pi.ts

@@ -147,6 +147,11 @@ export interface ChildPiRunInput {
 	thinkingOverride?: string;
 	/** Root directory for artifacts (used to validate transcriptPath). */
 	artifactsRoot?: string;
+	/** Phase 1 scratchpad: model-fallback attempt index (0-based) for per-attempt
+	 * snapshot relativePath `scratchpad/<taskId>.attempt-<attempt>.snapshot.json`
+	 * (C3). Optional — worker defaults to attempt 0 when unset (e.g. custom
+	 * agent spawn outside child-executor). */
+	attempt?: number;
 	/**
 	 * Optional broker spawn context (Phase 0 inter-pi broker). When present,
 	 * `prepareSpawnContext` injects `PI_CREW_BROKER_SOCKET` and

package/src/runtime/effectiveness.ts

@@ -26,6 +26,24 @@ export function taskHasObservableWorkerActivity(task: TeamTaskState): boolean {
 	);
 }
 
+/**
+ * True when the task completed but its result artifact is an EMPTY file
+ * (0 bytes). Closes the F4 monitoring gap (real-test-2026-08-10 finding):
+ * a child worker absorbed by a rate-limit (429) or a model-not-found
+ * failure still emits transcript/usage events, so
+ * {@link taskHasObservableWorkerActivity} reports "activity" — but the
+ * actual result content is empty. A completed task with an empty result
+ * has done no real work and must not count toward run effectiveness.
+ *
+ * Deliberately only flags `sizeBytes === 0` (a written-but-empty file).
+ * A missing resultArtifact stays non-flagging (some tasks legitimately
+ * produce no result file), and an undefined sizeBytes stays non-flagging
+ * (legacy tasks — do not false-positive on absent metadata).
+ */
+export function taskHasEmptyResult(task: TeamTaskState): boolean {
+	return Boolean(task.resultArtifact && task.resultArtifact.sizeBytes === 0);
+}
+
 export function resolveEffectivenessGuardMode(
 	runtimeConfig: CrewRuntimeConfig | undefined,
 	manifest?: TeamRunManifest,
@@ -43,7 +61,11 @@ export function evaluateRunEffectiveness(input: {
 	runtimeConfig?: CrewRuntimeConfig;
 }): RunEffectivenessSummary {
 	const completedTasks = input.tasks.filter((task) => task.status === "completed");
-	const noObservedWorkTasks = completedTasks.filter((task) => !taskHasObservableWorkerActivity(task));
+	// F4: a completed task with an EMPTY result artifact (0 bytes) is
+	// treated exactly like no-observed-work — the worker may have spun up
+	// and streamed transcript events, but it produced no real output
+	// (e.g. a 429 rate-limit absorbed by the fallback chain).
+	const noObservedWorkTasks = completedTasks.filter((task) => !taskHasObservableWorkerActivity(task) || taskHasEmptyResult(task));
 	const needsAttentionTasks = input.tasks.filter((task) => task.agentProgress?.activityState === "needs_attention");
 	const workerExecution: WorkerExecutionState = input.executeWorkers ? "enabled" : "disabled/scaffold";
 	const guardMode = resolveEffectivenessGuardMode(input.runtimeConfig, input.manifest);

package/src/runtime/merge-gate.ts

@@ -0,0 +1,202 @@
+/**
+ * Monotonic merge gate for parallel task updates.
+ *
+ * Extracted from team-runner.ts (2026-08-10, improvement-plan Tier 2
+ * "team-runner split" — self-contained portion). The merge gate protects
+ * terminal task states from being regressed by stale parallel worker
+ * snapshots: every terminal->non-terminal transition is rejected, plus a
+ * small set of bespoke policies (P2 completed integrity, P3
+ * waiting->running stale-snapshot regression) that are stricter than the
+ * lifecycle table on the parallel-merge path.
+ *
+ * Exhaustively tested in test/unit/team-runner-should-merge-table.test.ts.
+ */
+import { TEAM_TASK_STATUSES, TEAM_TERMINAL_TASK_STATUSES, type TeamTaskStatus } from "../state/contracts.ts";
+import type { TeamTaskState } from "../state/types.ts";
+import { refreshTaskGraphQueues } from "./scheduling/task-graph-scheduler.ts";
+
+export function isNonTerminalTaskStatus(status: TeamTaskState["status"]): boolean {
+	return status === "queued" || status === "running" || status === "waiting";
+}
+
+export function safeFinishedAt(task: TeamTaskState): number {
+	if (!task.finishedAt) return -Infinity;
+	const ms = new Date(task.finishedAt).getTime();
+	return Number.isNaN(ms) ? Infinity : ms;
+}
+
+/**
+ * Returns true when the current task has a malformed finishedAt (NaN/Infinity)
+ * and the updated task has a valid finite finishedAt. Malformed finishedAt
+ * should be replaced rather than persisting corruption.
+ */
+export function isMalformedFinishedAtReplacement(currentTime: number, updatedTime: number): boolean {
+	return !Number.isFinite(currentTime) && Number.isFinite(updatedTime);
+}
+
+/**
+ * RT-16: status-level gate for shouldMergeTaskUpdate. Returns the stable
+ * "from->to" key used by REJECTED_STATUS_MERGE_TRANSITIONS.
+ */
+export function statusMergeKey(from: TeamTaskStatus, to: TeamTaskStatus): string {
+	return `${from}->${to}`;
+}
+
+/**
+ * RT-16 — derived merge-gate transition table.
+ *
+ * The set of old->new status pairs that shouldMergeTaskUpdate must REJECT based
+ * solely on the status transition (before any field-level comparison). It
+ * replaces the former 13 hand-written status guards that hand-duplicated the
+ * lifecycle table. Built once from the single source-of-truth table
+ * (TEAM_TASK_STATUSES + TEAM_TERMINAL_TASK_STATUSES — the terminal half of
+ * TEAM_TASK_STATUS_TRANSITIONS) plus two merge-specific policies that are
+ * STRICTER than the lifecycle table on the parallel-merge path:
+ *
+ *  P1 Terminal preservation — every terminal->non-terminal pair is rejected.
+ *    The lifecycle table permits retries (e.g. completed->queued), but a stale
+ *    worker snapshot must never resurrect a settled task.
+ *  P2 Completed integrity — five terminal->terminal flips that touch the
+ *    "completed" success terminal are rejected: completed->failed,
+ *    completed->needs_attention, failed->completed, cancelled->completed,
+ *    needs_attention->completed. (completed may still move to
+ *    cancelled/skipped; that is intentionally allowed, so these are NOT simply
+ *    "every illegal terminal->terminal flip".)
+ *  P3 waiting->running regression — the single stale-snapshot case.
+ *
+ * The decision for every old->new pair is byte-for-byte identical to the former
+ * 7 status guards (verified exhaustively in
+ * test/unit/team-runner-should-merge-table.test.ts).
+ */
+export const REJECTED_STATUS_MERGE_TRANSITIONS: ReadonlySet<string> = (() => {
+	const rejected = new Set<string>();
+	// P1 — terminal preservation: reject every terminal->non-terminal pair.
+	for (const from of TEAM_TASK_STATUSES) {
+		if (!TEAM_TERMINAL_TASK_STATUSES.has(from)) continue;
+		for (const to of TEAM_TASK_STATUSES) {
+			if (!TEAM_TERMINAL_TASK_STATUSES.has(to)) rejected.add(statusMergeKey(from, to));
+		}
+	}
+	// P3 — waiting->running stale-snapshot regression.
+	rejected.add(statusMergeKey("waiting", "running"));
+	// P2 — completed integrity flips (bespoke terminal->terminal policy).
+	const completedIntegrityFlips: ReadonlyArray<[TeamTaskStatus, TeamTaskStatus]> = [
+		["completed", "failed"],
+		["completed", "needs_attention"],
+		["failed", "completed"],
+		["cancelled", "completed"],
+		["needs_attention", "completed"],
+	];
+	for (const [from, to] of completedIntegrityFlips) rejected.add(statusMergeKey(from, to));
+	return rejected;
+})();
+
+export function shouldMergeTaskUpdate(current: TeamTaskState, updated: TeamTaskState): boolean {
+	// RT-16: status-level gate — reject stale/dangerous transitions via the
+	// derived transition table (REJECTED_STATUS_MERGE_TRANSITIONS) instead of
+	// hand-written guards. Parallel workers receive the same input snapshot; a
+	// later result may still carry stale copies. The table encodes three
+	// merge-specific policies stricter than the lifecycle table: terminal
+	// preservation (no terminal->non-terminal resurrection), completed integrity
+	// (no flipping the "completed" success terminal to/from failed or
+	// needs_attention), and the waiting->running stale-snapshot regression.
+	if (REJECTED_STATUS_MERGE_TRANSITIONS.has(statusMergeKey(current.status, updated.status))) return false;
+	// Guard: when current is "running" but has resultArtifact (another worker already
+	// completed it), a stale updated with status="running" and no resultArtifact
+	// must not overwrite the actual completed state.
+	if (current.status === updated.status && updated.status === "running" && current.resultArtifact && !updated.resultArtifact)
+		return false;
+	// Guard: when current is "completed" and has resultArtifact but updated is also
+	// "completed" without resultArtifact, block the stale update from overwriting
+	// a task that successfully produced output.
+	if (current.status === updated.status && current.status === "completed" && current.resultArtifact && !updated.resultArtifact)
+		return false;
+	// Prevent a stale completed task from overwriting a fresher one.
+	// Restructure to handle undefined current.finishedAt as a special case:
+	// - undefined current + valid updated: allow the update
+	// - valid current + undefined updated: block the update (don't lose completion time)
+	// - both undefined: finishedAt guard does not apply, fall through to heartbeat check
+	// - both valid: compare timestamps as before
+	if (current.finishedAt !== undefined && updated.finishedAt !== undefined) {
+		const currentTime = safeFinishedAt(current);
+		const updatedTime = safeFinishedAt(updated);
+		// Malformed finishedAt (NaN) is treated as Infinity — invalid state should be
+		// replaced rather than persisting corruption. Log warning for visibility.
+		if (!Number.isFinite(currentTime)) {
+			console.warn(`[merge-gate] Task ${current.id} has malformed finishedAt: ${current.finishedAt}`);
+		}
+		if (isMalformedFinishedAtReplacement(currentTime, updatedTime)) {
+			return true;
+		}
+		if (updatedTime < currentTime) return false;
+	}
+	// Block if updated is trying to establish a terminal status without a finishedAt
+	// timestamp. Heartbeat-only updates (status='running', no finishedAt) are
+	// allowed if heartbeat has changed (checked separately in hasMeaningfulUpdate).
+	if (!updated.finishedAt && !isNonTerminalTaskStatus(updated.status)) return false;
+	// Explicitly enumerate all fields that constitute a meaningful update so that
+	// adding a new important field requires updating this list (rather than silently
+	// losing data if a field is forgotten in the boolean OR chain below).
+	const hasMeaningfulUpdate =
+		updated.status !== current.status ||
+		updated.finishedAt !== current.finishedAt ||
+		updated.startedAt !== current.startedAt ||
+		Boolean(updated.resultArtifact) !== Boolean(current.resultArtifact) ||
+		(Boolean(updated.resultArtifact) && updated.resultArtifact !== current.resultArtifact) ||
+		Boolean(updated.error) ||
+		Boolean(updated.modelAttempts?.length) ||
+		Boolean(updated.usage) ||
+		Boolean(updated.attempts?.length) ||
+		updated.heartbeat?.lastSeenAt !== current.heartbeat?.lastSeenAt ||
+		updated.jsonEvents !== current.jsonEvents ||
+		updated.agentProgress?.lastActivityAt !== current.agentProgress?.lastActivityAt;
+	return hasMeaningfulUpdate;
+}
+/** Exposed for the exhaustive status-merge table test (RT-16). */
+export const __test__shouldMergeTaskUpdate = shouldMergeTaskUpdate;
+
+// H4 fix: rename to descriptive name. Kept __test__ as alias for backward
+// compat test imports.
+// FIX (perf P10): replace O(N×M) .find() + .map() inside nested loops with a
+// single-pass Map-based merge. Build an index of `merged` once, then for each
+// incoming updated task do O(1) lookup; the final pass reassembles `merged`
+// preserving original order. For a 20-task run × 5-batch merger with
+// ~10 updates per result, this reduces from O(50×20) = 1000 ops to O(120).
+// Behavior is unchanged: skipped updates (shouldMergeTaskUpdate=false) still
+// leave the existing task in place.
+export function mergeTaskUpdatesPreservingTerminal(base: TeamTaskState[], results: Array<{ tasks: TeamTaskState[] }>): TeamTaskState[] {
+	// Index current merged state by id for O(1) lookup during the merge pass.
+	const indexById = new Map<string, TeamTaskState>();
+	for (const task of base) indexById.set(task.id, task);
+
+	let skipped = 0;
+	for (const result of results) {
+		for (const updated of result.tasks) {
+			const current = indexById.get(updated.id);
+			if (!current) continue;
+			if (!shouldMergeTaskUpdate(current, updated)) {
+				// Log skipped merges for visibility into rejected parallel updates.
+				// In distributed systems with parallel workers, rejected merges may
+				// indicate bugs (wrong status, timestamp corruption) if they accumulate.
+				console.debug("[merge-gate] Skipping stale merge for task", updated.id, {
+					currentStatus: current.status,
+					updatedStatus: updated.status,
+					currentFinishedAt: current.finishedAt,
+					updatedFinishedAt: updated.finishedAt,
+				});
+				skipped += 1;
+				continue;
+			}
+			indexById.set(updated.id, updated);
+		}
+	}
+	// Reassemble in original `base` order so downstream snapshots stay stable.
+	const merged = base.map((task) => indexById.get(task.id) ?? task);
+	// `skipped` is intentional visibility — currently no caller reads it but
+	// we'd rather leave the count available for future instrumentation than
+	// remove the cumulative silent-rejection signal it provides.
+	void skipped;
+	return refreshTaskGraphQueues(merged);
+}
+/** @deprecated Use mergeTaskUpdatesPreservingTerminal. Kept for backward test import compat. */
+export const __test__mergeTaskUpdates = mergeTaskUpdatesPreservingTerminal;

package/src/runtime/model/model-fallback.ts

@@ -365,6 +365,17 @@ const RETRYABLE_MODEL_FAILURE_PATTERNS = [
 	/safety/i,
 	/is[_ ]?overloaded/i,
 	/\b408\b/,
+	//
+	// EPIPE / broken-pipe. In the child-pi worker path this typically means
+	// the child `pi` process exited (crash or early exit) while the parent
+	// was still writing to its stdin — spawning a fresh child on the next
+	// model in the fallback chain usually recovers. In the network path it
+	// is a transient pipe close. Both are retryable on a different model.
+	// See docs/failure-mode-inventory.md EPIPE gap; NON_RETRYABLE patterns
+	// (auth/billing) are checked first, so an auth error mentioning EPIPE
+	// stays non-retryable.
+	/epipe/i,
+	/broken pipe/i,
 ];
 
 // These patterns indicate auth/key/billing issues that will never succeed on retry.

package/src/runtime/model/pi-args.ts

@@ -31,7 +31,7 @@ const createdTempDirs = new Set<string>();
  * /tmp directory. Uses `userPiRoot()` so the path stays consistent with
  * the rest of pi-crew (respects PI_TEAMS_HOME / PI_CODING_AGENT_DIR).
  */
-function getPiTempBase(): string {
+export function getPiTempBase(): string {
 	return path.join(userPiRoot(), "tmp");
 }
 

package/src/runtime/model/provider-extensions.ts

@@ -22,7 +22,7 @@
  */
 import * as fs from "node:fs";
 import * as path from "node:path";
-import { userPiRoot } from "../../utils/paths.ts";
+import { packageRoot, userPiRoot } from "../../utils/paths.ts";
 
 export interface DiscoveredProviderExtension {
 	/** Package specifier as written in settings.json packages (e.g. "npm:pi-commandcode-provider"). */
@@ -95,12 +95,17 @@ function resolvePackageEntry(pkgDir: string): string | undefined {
 
 /**
  * Discover provider extension entry points from Pi's installed package registry.
- * Reads `~/.pi/agent/settings.json` → `packages` (npm: specs only — local
- * relative paths are the pi-crew extension itself and other local work, which
- * children already handle) and resolves each against `~/.pi/agent/npm/node_modules/`.
+ * Reads `~/.pi/agent/settings.json` → `packages` and resolves each spec:
+ *   - `npm:<name>`      → `~/.pi/agent/npm/node_modules/<name>/`
+ *   - local path spec   → resolved relative to the settings.json dir (the way
+ *     `pi install <local-path>` records them), e.g. "../../src/foo"
+ *   - git:/file: specs   → skipped (not resolvable on disk)
  *
- * Non-npm specs (local paths, git URLs) are skipped: they are not part of the
- * npm registry dir and resolving them is outside this module's scope.
+ * Both npm: and local-path specs are SANCTIONED channels — the user wrote them
+ * into settings.json (directly or via `pi install`), so they are trusted at the
+ * same level. This is distinct from project-sourced AGENT extensions
+ * (`.crew/agents/*.md` `extensions:` frontmatter), which are repo-adjacent
+ * untrusted data and stay gated by SEC-1 in discover-agents.ts.
  */
 export function discoverProviderExtensions(settingsPath?: string): DiscoveredProviderExtension[] {
 	const root = userPiRoot();
@@ -125,13 +130,27 @@ export function discoverProviderExtensions(settingsPath?: string): DiscoveredPro
 	const npmBase = path.join(baseDir, "npm", "node_modules");
 	for (const spec of settings.packages ?? []) {
 		if (typeof spec !== "string") continue;
-		// Only npm: specs resolve into the npm registry dir. Skip local path
-		// packages (e.g. "../../source/my_pi/pi-crew") and git specs.
-		if (!spec.startsWith("npm:")) continue;
-		const pkgName = spec.slice(4);
-		// Scoped packages: "@scope/name" → "@scope/name"; plain: "name".
-		const pkgDir = path.join(npmBase, pkgName);
+		let pkgDir: string;
+		if (spec.startsWith("npm:")) {
+			// Scoped packages: "@scope/name" → "@scope/name"; plain: "name".
+			pkgDir = path.join(npmBase, spec.slice(4));
+		} else if (spec.startsWith("./") || spec.startsWith("../") || path.isAbsolute(spec)) {
+			// Local path spec — resolve relative to the settings.json dir, matching
+			// how `pi install <local-path>` records it. Same trust level as npm:
+			// (user wrote it into settings.json). Not to be confused with project
+			// AGENT extensions (.crew/agents/* frontmatter) — those stay SEC-1 gated.
+			pkgDir = path.resolve(baseDir, spec);
+		} else {
+			// git:/file:/http: specs etc. — not resolvable on disk, skip.
+			continue;
+		}
 		if (!fs.existsSync(pkgDir)) continue;
+		// Skip self: pi-crew's own package is a settings package (the orchestrator
+		// extension the parent loads), but a child WORKER must not re-load it — it
+		// would register the team tool / observability / MCP wiring intended for
+		// the orchestrator process, not a worker. Provider + adapter extensions
+		// (pi-other-provider, pi-mcp-adapter, pi-rlm, ...) stay.
+		if (path.resolve(pkgDir) === path.resolve(packageRoot())) continue;
 		const entryPath = resolvePackageEntry(pkgDir);
 		if (entryPath) out.push({ spec, entryPath });
 	}

package/src/runtime/output/progress-tracker.ts

@@ -1,5 +1,4 @@
 import type { AgentSessionEvent } from "@earendil-works/pi-coding-agent";
-import { crewEventBus } from "../../observability/event-bus.ts";
 
 export interface AgentProgress {
 	toolCalls: number;
@@ -25,7 +24,7 @@ export class ProgressTracker {
 			subscribe: (listener: (event: AgentSessionEvent) => void) => () => void;
 		},
 		agentId: string,
-		runId: string,
+		_runId: string,
 	): AgentProgress {
 		if (this.sessions.has(agentId)) {
 			return this.sessions.get(agentId)!.progress;
@@ -42,26 +41,19 @@ export class ProgressTracker {
 		};
 
 		const unsubscribe = session.subscribe((event: AgentSessionEvent) => {
-			this.handleEvent(event, progress, agentId, runId);
+			this.handleEvent(event, progress);
 		});
 
 		this.sessions.set(agentId, { unsubscribe, progress });
 		return progress;
 	}
 
-	private handleEvent(event: AgentSessionEvent, progress: AgentProgress, agentId: string, runId: string): void {
+	private handleEvent(event: AgentSessionEvent, progress: AgentProgress): void {
 		switch (event.type) {
 			case "tool_execution_start":
 				progress.toolCalls++;
 				progress.currentTool = event.toolName;
 				progress.toolStartTime = Date.now();
-				crewEventBus.emit({
-					type: "agent:progress",
-					runId,
-					agentId,
-					payload: { ...progress },
-					timestamp: Date.now(),
-				});
 				break;
 
 			case "tool_execution_end":
@@ -69,21 +61,7 @@ export class ProgressTracker {
 				progress.toolStartTime = null;
 				if (event.isError) {
 					progress.errors.push(String(event.result ?? "Unknown error"));
-					crewEventBus.emit({
-						type: "agent:error",
-						runId,
-						agentId,
-						payload: String(event.result ?? "Unknown error"),
-						timestamp: Date.now(),
-					});
 				}
-				crewEventBus.emit({
-					type: "agent:progress",
-					runId,
-					agentId,
-					payload: { ...progress },
-					timestamp: Date.now(),
-				});
 				break;
 
 			case "turn_start":
@@ -92,13 +70,6 @@ export class ProgressTracker {
 
 			case "agent_end":
 				progress.status = "completed";
-				crewEventBus.emit({
-					type: "agent:complete",
-					runId,
-					agentId,
-					payload: { ...progress },
-					timestamp: Date.now(),
-				});
 				break;
 
 			case "agent_start":
@@ -120,5 +91,4 @@ export class ProgressTracker {
 	}
 }
 
-// Export singleton instance
 export const globalProgressTracker = new ProgressTracker();

package/src/runtime/recovery/crash-recovery.ts

@@ -98,7 +98,7 @@ export function readManifestWithTransientRetry(manifestPath: string, maxRetries
 	throw new Error(`unreachable: readManifestWithTransientRetry exhausted for ${manifestPath}`);
 }
 
-function shouldRecoverTask(task: TeamTaskState, deadMs: number): boolean {
+export function shouldRecoverTask(task: TeamTaskState, deadMs: number): boolean {
 	if (task.status !== "running") return false;
 	if (!task.heartbeat) return true;
 	return task.heartbeat.alive === false || isWorkerHeartbeatStale(task.heartbeat, deadMs);