pi-crew 0.9.65 → 0.9.67

package/src/runtime/scheduling/scheduler.ts

@@ -229,24 +229,72 @@ function parseIntervalMs(s: string): number | undefined {
 	return ms;
 }
 
-function nextCronDate(spec: string, from: Date): Date | { error: string } | null {
-	const parts = spec.split(/\s+/);
-	if (parts.length < 5) return { error: "Invalid cron expression" };
-	const [minStr, hourStr, domStr, monthStr, dowStr] = parts;
+/** Named-token maps for cron DOW (SUN=0..SAT=6) and month (JAN=1..DEC=12). */
+const CRON_DOW_NAMES: Record<string, number> = { SUN: 0, MON: 1, TUE: 2, WED: 3, THU: 4, FRI: 5, SAT: 6 };
+const CRON_MONTH_NAMES: Record<string, number> = {
+	JAN: 1,
+	FEB: 2,
+	MAR: 3,
+	APR: 4,
+	MAY: 5,
+	JUN: 6,
+	JUL: 7,
+	AUG: 8,
+	SEP: 9,
+	OCT: 10,
+	NOV: 11,
+	DEC: 12,
+};
 
-	function matchField(value: number, str: string, min: number, max: number): boolean {
-		if (str === "*") return true;
-		const n = parseInt(str, 10);
-		if (!Number.isNaN(n) && n >= min && n <= max && n === value) return true;
-		if (/^\d+-\d+$/.test(str)) {
-			const [a, b] = str.split("-").map(Number);
-			return value >= a && value <= b;
+/**
+ * Match a single cron field value against a cron field expression.
+ * Supports the standard cron grammar: wildcard, single N, range a-b, list a,b,c,
+ * step syntax (wildcard-step, range-step, from-step), and named tokens
+ * (MON, JAN) when a `names` map is passed. Fixes the prior matcher that
+ * rejected step values and named DOW (parseInt returned NaN).
+ */
+function cronFieldMatches(value: number, field: string, min: number, max: number, names?: Record<string, number>): boolean {
+	let normalized = field.trim().toUpperCase();
+	if (names) {
+		for (const name of Object.keys(names).sort((a, b) => b.length - a.length)) {
+			normalized = normalized.split(name).join(String(names[name]));
+		}
+	}
+	// Cron permits 7 for Sunday in the DOW field — normalize to 0.
+	if (min === 0 && max === 6) normalized = normalized.replace(/\b7\b/g, "0");
+	const matched = new Set<number>();
+	for (const rawPart of normalized.split(",")) {
+		const part = rawPart.trim();
+		if (part === "") return false;
+		const stepMatch = part.match(/^(.*)\/(\d+)$/);
+		const step = stepMatch ? Number.parseInt(stepMatch[2], 10) : 1;
+		if (!Number.isFinite(step) || step < 1) return false;
+		const rangeStr = stepMatch ? stepMatch[1] : part;
+		let lo: number;
+		let hi: number;
+		if (rangeStr === "*") {
+			lo = min;
+			hi = max;
+		} else if (/^\d+$/.test(rangeStr)) {
+			lo = Number.parseInt(rangeStr, 10);
+			hi = stepMatch ? max : lo; // bare `N` = single value; `N/S` = N..max step S
+		} else {
+			const rm = rangeStr.match(/^(\d+)-(\d+)$/);
+			if (!rm) return false;
+			lo = Number.parseInt(rm[1], 10);
+			hi = Number.parseInt(rm[2], 10);
 		}
-		if (str.includes(",")) {
-			return str.split(",").some((part) => matchField(value, part.trim(), min, max));
+		for (let v = lo; v <= hi; v += step) {
+			if (v >= min && v <= max) matched.add(v);
 		}
-		return false;
 	}
+	return matched.has(value);
+}
+
+function nextCronDate(spec: string, from: Date): Date | { error: string } | null {
+	const parts = spec.split(/\s+/);
+	if (parts.length < 5) return { error: "Invalid cron expression" };
+	const [minStr, hourStr, domStr, monthStr, dowStr] = parts;
 
 	let cursor = new Date(from.getTime());
 	cursor.setSeconds(0, 0);
@@ -261,11 +309,11 @@ function nextCronDate(spec: string, from: Date): Date | { error: string } | null
 		const dow = cursor.getUTCDay();
 
 		if (
-			matchField(min, minStr, 0, 59) &&
-			matchField(hour, hourStr, 0, 23) &&
-			matchField(dom, domStr, 1, 31) &&
-			matchField(month, monthStr, 1, 12) &&
-			matchField(dow, dowStr, 0, 6)
+			cronFieldMatches(min, minStr, 0, 59) &&
+			cronFieldMatches(hour, hourStr, 0, 23) &&
+			cronFieldMatches(dom, domStr, 1, 31) &&
+			cronFieldMatches(month, monthStr, 1, 12, CRON_MONTH_NAMES) &&
+			cronFieldMatches(dow, dowStr, 0, 6, CRON_DOW_NAMES)
 		) {
 			return cursor;
 		}

package/src/runtime/scratchpad/README.md

@@ -123,6 +123,12 @@ attempt N+1 worker (scratchpad-lifecycle.ts)
   the guest already runs at full worker trust (it holds provider keys + broker
   token), so this does not cross the existing boundary. An HMAC over the payload
   is a Phase 2.5/3 hardening if artifacts ever land in a shared location.
+
+> ⚠️ **NOT WIRED (2026-08-11):** `src/runtime/scratchpad/snapshot-hmac.ts` is an
+> unconnected helper — zero production call sites, 11 green unit tests in
+> isolation. Wire-or-delete decision in `docs/improvement-plan-2026-08-11.md`
+> §4 J1. Until then the note above (v8.deserialize unauthenticated) is exactly
+> how the code behaves.
 - **Secret-at-rest under a benign key name** persists as base64 for the run's
   retention (structural redaction is key-name based, best-effort). A sanitized-
   namespace policy is a Phase 2.5 concern.

package/src/runtime/scratchpad/guest.ts

@@ -26,6 +26,7 @@
  */
 
 import { AsyncLocalStorage } from "node:async_hooks";
+import { execFile } from "node:child_process";
 import { writeSync } from "node:fs";
 import { createInterface } from "node:readline";
 import { format, inspect } from "node:util";
@@ -179,14 +180,61 @@ console.error = consoleErr;
 console.trace = consoleErr;
 
 // ── bootstrap bindings ───────────────────────────────────────────────────────
-// pi-rlm mounts rlm/tools/Bun handles here. The spike has no host bridge, so
-// nothing is installed — but the hook is kept (and re-run after restore) for
-// fidelity with the port plan: a later phase wires real bindings here.
+// pi-rlm mounts rlm/tools/Bun handles here. Pattern 12 (shell guard): the
+// guest-local `sh` helper narrows raw child_process — it refuses null/undefined
+// arguments (the `rm -rf undefined` class bug) and returns a value, not a
+// string, so cell 2 can reuse cell 1's result. Advisory guard only — cells run
+// at full worker trust (no VM sandbox), so `sh` is a nudge, not a boundary.
 
 const INTERNAL_BINDINGS = new Map<string, unknown>();
 
+/** Pattern-12 nullish guard: refuse undefined/null BEFORE spawning. */
+function assertShellArgNotNullish(name: string, value: unknown): void {
+	if (value === undefined || value === null) {
+		throw new Error(
+			`sh: argument '${name}' is null/undefined — a missing variable would stringify to the literal 'undefined' in the command. Re-verify variables after a restore before using them in shell commands.`,
+		);
+	}
+}
+
+/**
+ * sh(cmd, args[]) — pattern-12 shell interpolation guard.
+ * Runs via execFile (shell:false, args as an array — no shell interpolation
+ * of the command string), refuses nullish args, and returns a value:
+ * `{ exitCode, stdout, stderr }` (pi-rlm "shell as value"). Non-zero exit does
+ * NOT throw — it is returned in `exitCode`.
+ */
+function makeSh(): (cmd: string, args?: unknown[]) => Promise<{ exitCode: number; stdout: string; stderr: string }> {
+	const execFileAsync = (cmd: string, args: string[]) =>
+		new Promise<{ exitCode: number; stdout: string; stderr: string }>((resolve, reject) => {
+			execFile(cmd, args, { shell: false, encoding: "utf8" }, (error, stdout, stderr) => {
+				if (error) {
+					// error.code is the exit code for a non-zero exit; otherwise a real
+					// spawn failure (ENOENT etc.) — surface it as exitCode 127-like.
+					const exitCode = typeof error.code === "number" ? error.code : 127;
+					resolve({ exitCode, stdout: String(stdout), stderr: String(stderr || error.message) });
+					return;
+				}
+				resolve({ exitCode: 0, stdout: String(stdout), stderr: String(stderr) });
+			});
+		});
+	return async (cmd: string, args?: unknown[]) => {
+		assertShellArgNotNullish("cmd", cmd);
+		const stringArgs = (args ?? []).map((a, i) => {
+			assertShellArgNotNullish(`arg[${i}]`, a);
+			return String(a);
+		});
+		return execFileAsync(cmd, stringArgs);
+	};
+}
+
 function installBootstrapBindings(): void {
-	// Spike: no host bridge, no Bun — nothing to mount.
+	const sh = makeSh();
+	// Register the SAME function reference in INTERNAL_BINDINGS and the
+	// namespace so snapshotNamespace()'s identity skip (===) excludes it from
+	// serialization, and so cells can call `sh(...)` directly.
+	INTERNAL_BINDINGS.set("sh", sh);
+	namespace.sh = sh;
 }
 
 installBootstrapBindings();
@@ -294,7 +342,8 @@ function restoreNamespace(vars: Record<string, string>): {
 		}
 	}
 	// Bootstrap runs after restore: live handles would overwrite anything
-	// revived. The spike installs nothing, but the hook is kept for fidelity.
+	// revived. `sh` is re-installed so a revived stale value cannot shadow the
+	// live handle (I6).
 	installBootstrapBindings();
 	return { restored, failed };
 }

package/src/runtime/scratchpad/snapshot-hmac.ts

@@ -1,8 +1,14 @@
 /**
  * Snapshot HMAC helper — opt-in integrity for scratchpad snapshots.
  *
+ * ⚠️ NOT WIRED — see ADR 2026-08-10, Phase 2. This module is NOT connected to
+ * the snapshot write/read path (`guest.ts` restore uses plain `v8.deserialize`,
+ * `snapshotNamespace` writes unsigned payloads). Zero production call sites.
+ * The 11 unit tests here are green but exercise the helper in isolation.
+ * Wire-or-delete decision: docs/improvement-plan-2026-08-11.md §4 J1.
+ *
  * Closes the E.2 gap declared in docs/improvement-plan-2026-08-09.md and
- * docs/runtime/scratchpad/README.md:120 ("v8.deserialize of restore content
+ * src/runtime/scratchpad/README.md:120 ("v8.deserialize of restore content
  * is unauthenticated (no HMAC)"). The threat model — a same-uid attacker
  * plants a crafted V8 blob at the snapshot path to run deserialize gadgets
  * in the guest — does not cross the existing same-uid boundary, but HMAC

package/src/runtime/supervisor-contact.ts

@@ -61,19 +61,3 @@ export function supervisorContactFromEvent(event: unknown): Omit<SupervisorConta
 				: undefined,
 	};
 }
-
-/**
- * @deprecated The compact pipeline now passes `supervisor_contact` events through
- * to `onJsonEvent` with their full payload (P2-25 fix). Prefer
- * `supervisorContactFromEvent` on the parsed event. Kept for backward compat.
- */
-export function parseSupervisorContactFromLine(line: string): Omit<SupervisorContactPayload, "timestamp" | "runId"> | undefined {
-	if (!line.trim()) return undefined;
-	let parsed: unknown;
-	try {
-		parsed = JSON.parse(line);
-	} catch {
-		return undefined;
-	}
-	return supervisorContactFromEvent(parsed);
-}

package/src/runtime/task-runner/child-executor.ts

@@ -544,6 +544,7 @@ export async function runChildProcessTask(ctx: TaskExecutionContext): Promise<Ta
 				runId: manifest.runId,
 				agentId: task.id,
 				artifactsRoot: manifest.artifactsRoot,
+				eventsPath: manifest.eventsPath, // I5: scratchpad metric events from the worker
 				attempt: i,
 				steeringFile: resolveRealContainedPath(`${manifest.artifactsRoot}/steering`, `${task.id}.jsonl`),
 				onSpawn: (pid) => {

package/src/runtime/task-runner/state-helpers.ts

@@ -41,7 +41,15 @@ export function persistSingleTaskUpdate(
 	checkpointPhase?: TaskCheckpointState["phase"],
 	skipCoalesce: boolean = false,
 ): TeamTaskState[] {
-	const MAX_CAS_ATTEMPTS = 100;
+	// H5 (2026-08-10): lowered from 100 → 10. Each retry does
+	// flushPendingAtomicWrites (global) + loadRunManifestById (stat + parse)
+	// + statSync, ~5ms each. The first attempt uses fallbackTasks directly
+	// (no disk read); retries only fire under real contention from best-effort
+	// writers that don't hold the run lock (async-notifier, crash-recovery).
+	// If 10 retries cannot converge, the system is in a pathological state
+	// where 100 would not help either — the explicit error below surfaces it
+	// instead of blocking the event loop for 500ms.
+	const MAX_CAS_ATTEMPTS = 10;
 	let baseMtime = 0;
 	try {
 		baseMtime = fs.statSync(manifest.tasksPath).mtimeMs;

package/src/runtime/team-runner.ts

@@ -17,6 +17,7 @@ import {
 	appendEventBuffered,
 	appendEventFireAndForget,
 	flushEventLogBuffer,
+	readEvents,
 } from "../state/event-log/event-log.ts";
 import { hashArtifactContent as hashContent, writeArtifact } from "../state/stores/artifact-store.ts";
 import { HealthStore } from "../state/stores/health-store.ts";
@@ -415,6 +416,27 @@ function runEffectivenessLines(
 	);
 }
 
+// I5 (plan): surface scratchpad adoption in the run summary — but ONLY when
+// non-zero, so the 3 armed roles that never call it add no noise. Counts the
+// metric events the workers appended to the run events log (fire-and-forget
+// scratchpad.cell / scratchpad.restored). Silent when the feature is unused or
+// the events path is missing (no throw).
+function scratchpadSummaryLines(manifest: TeamRunManifest): string[] {
+	if (!manifest.eventsPath) return [];
+	const events = readEvents(manifest.eventsPath);
+	const cells = events.filter((e) => e.type === "scratchpad.cell");
+	const restores = events.filter((e) => e.type === "scratchpad.restored");
+	if (cells.length === 0 && restores.length === 0) return [];
+	return [
+		`## Scratchpad (RLM adoption) — I5 metric`,
+		`- cells executed: ${cells.length}`,
+		`- snapshot restores: ${restores.length}`,
+		...(cells.length > 0
+			? [`- total cell time: ${Math.round(cells.reduce((s, e) => s + ((e.data?.durationMs as number) ?? 0), 0))} ms`]
+			: []),
+	];
+}
+
 // P6 (perf): Cache the last-rendered progress content so we can skip the
 // artifact write + redaction + atomic write + size/hash read when nothing
 // material changed (rare between batches, but happens between idle heartbeats).
@@ -964,8 +986,22 @@ export async function executeTeamRun(input: ExecuteTeamRunInput): Promise<{ mani
 			);
 			manifest = updateRunStatus(manifest, "failed", `Unhandled error in team runner: ${message}`);
 			await saveRunManifestAsync(manifest);
-		} catch {
-			// Best-effort — state write may also fail
+		} catch (error) {
+			// H8 (2026-08-10): surface the silent failure. This is the
+			// unhandled-error recovery branch — if the state save ALSO fails
+			// (disk full, run-dir gone, permissions), the manifest stays in
+			// its pre-failure state (possibly still "running") and crash
+			// recovery will treat it as stale. Previously the failure was
+			// swallowed with no signal; now it lands in the internal-error
+			// channel so operators can see when recovery itself failed.
+			// We do NOT re-throw — the run must still be reported as failed
+			// to the caller (rejectRunPromise below) regardless of state-save
+			// outcome.
+			logInternalError(
+				"team-runner.recovery-save-failed",
+				error instanceof Error ? error : new Error(String(error)),
+				`runId=${manifest.runId} — state may be inconsistent; crash-recovery will reconcile on next launch`,
+			);
 		}
 		const result = { manifest, tasks };
 		rejectRunPromise(manifest.runId, error instanceof Error ? error : new Error(message));
@@ -2260,6 +2296,7 @@ async function finalizeRun(ctx: SchedulerContext): Promise<{ manifest: TeamRunMa
 			"## Policy decisions",
 			...(manifest.policyDecisions?.length ? summarizePolicyDecisions(manifest.policyDecisions) : ["- (none)"]),
 			"",
+			...scratchpadSummaryLines(manifest),
 		].join("\n"),
 	});
 	// Build the complete manifest BEFORE acquiring the lock so the artifacts array

package/src/state/contracts.ts

@@ -114,6 +114,9 @@ export const TEAM_EVENT_TYPES = [
 	"dwf.failed",
 	"dwf.trust_denied", // F-01: project .dwf.ts denied without PI_CREW_TRUST_PROJECT_DWF
 	"dwf.log",
+	// RLM/scratchpad adoption metrics (plan I5)
+	"scratchpad.cell",
+	"scratchpad.restored",
 ] as const;
 export type TeamEventType = (typeof TEAM_EVENT_TYPES)[number];
 

package/src/state/event-log/event-log.ts

@@ -357,6 +357,12 @@ function persistSequence(eventsPath: string, seq: number): void {
 // makes assignment atomic (JS is single-threaded); persistSequence() keeps the
 // sidecar durable for crash recovery across restarts.
 const seqCounters = new Map<string, number>();
+// H6 (2026-08-10): FIFO cap — mirrors appendCounters (APPEND_COUNTER_MAX_ENTRIES = 256)
+// and agentEventSeqCache (cap at :434). Without this, a long-lived parent pi process
+// that observes many runs (dev sessions with hundreds of background runs over a week)
+// accumulates one entry per distinct eventsPath forever. Eviction is safe: the next
+// append re-seeds from the `.seq` sidecar via reserveSequenceUnderLock.
+const SEQ_COUNTERS_MAX_ENTRIES = 256;
 
 /** Atomically reserve the next sequence number for `eventsPath`.
  *
@@ -384,7 +390,18 @@ function reserveSequence(eventsPath: string): number {
  *  (e.g. baseMetadata.seq) so a later auto-assigned seq never collides with it. */
 function advanceSequenceCounter(eventsPath: string, seq: number): void {
 	const last = seqCounters.get(eventsPath);
-	if (last === undefined || seq > last) seqCounters.set(eventsPath, seq);
+	if (last === undefined || seq > last) {
+		seqCounters.set(eventsPath, seq);
+		enforceSeqCountersCap();
+	}
+}
+
+/** H6: FIFO eviction when the seqCounters map exceeds its bounded size. */
+function enforceSeqCountersCap(): void {
+	if (seqCounters.size > SEQ_COUNTERS_MAX_ENTRIES) {
+		const oldest = seqCounters.keys().next().value;
+		if (oldest !== undefined) seqCounters.delete(oldest);
+	}
 }
 
 /** C-01: Reserve sequence INSIDE the cross-process lock. Reads the authoritative
@@ -401,6 +418,7 @@ function reserveSequenceUnderLock(eventsPath: string): number {
 	const last = Math.max(stored, inProcess);
 	const next = last + 1;
 	seqCounters.set(eventsPath, next);
+	enforceSeqCountersCap();
 	return next;
 }
 
@@ -418,32 +436,6 @@ export function computeEventFingerprint(event: Pick<TeamEvent, "type" | "runId"
 		.slice(0, 16);
 }
 
-/**
- * Check for sequence gaps between the sidecar file and the events file.
- * This detects situations where the sidecar records a sequence number that has
- * no corresponding event in the file (e.g., due to a crash between
- * persistSequence and appendFile in older code, or other corruption).
- *
- * Returns an array of gap info: for each gap found, { missing: n } indicates
- * sequence n is recorded in sidecar but has no corresponding event.
- * An empty array means no gaps were found.
- */
-export function checkSequenceGaps(eventsPath: string): { missing: number }[] {
-	if (!fs.existsSync(eventsPath)) return [];
-	const gaps: { missing: number }[] = [];
-	const storedSeq = readStoredSequence(eventsPath);
-	if (storedSeq === undefined) return [];
-	const maxInFile = scanSequence(eventsPath);
-	// If sidecar is ahead of file, report the missing sequences
-	// (sidecar stores the NEXT sequence to use, so storedSeq is the last written)
-	if (storedSeq > maxInFile) {
-		for (let i = maxInFile + 1; i <= storedSeq; i++) {
-			gaps.push({ missing: i });
-		}
-	}
-	return gaps;
-}
-
 /**
  * @deprecated Prefer `appendEventAsync()` in async contexts. The sync lock uses
  * `sleepSync` which blocks the Node.js event loop, preventing AbortSignal handlers

package/src/state/gitignore-manager.ts

@@ -1,15 +1,27 @@
 /**
- * Manage .gitignore entries for the .crew directory.
+ * Manage .gitignore entries for the crew state directory.
+ *
+ * Supports BOTH layouts that `projectCrewRoot` (src/utils/paths.ts) can
+ * resolve to:
+ *   - `.crew/` (default, created when neither .crew/ nor .pi/ exists)
+ *   - `.pi/teams/` (legacy layout, reused when .pi/ already exists)
+ *
+ * Before this fix (2026-08-10, improvement-plan G12), only `.crew/`
+ * entries were written — so projects on the `.pi/teams/` layout silently
+ * committed their run state, artifacts, and logs to git. The layout is
+ * detected from the repo root (parent dir of the .gitignore path).
+ *
  * Only adds entries if not already present; preserves existing content.
  */
 import * as fs from "node:fs";
+import * as path from "node:path";
 import { atomicWriteFile } from "./atomic-write.ts";
 
 /**
- * Entries to add to .gitignore for .crew directory management.
+ * Entries to add to .gitignore for the `.crew/` layout.
  *
  * - `/.crew/` and `/.crew` ignore the core state directory.
- * - Exceptions allow optional commit of artifacts/ and graphs/ (including their .gitkeep).
+ * - Exceptions allow optional commit of artifacts/ and graphs/.
  */
 const CREW_GITIGNORE_ENTRIES = [
 	"/.crew/",
@@ -21,12 +33,54 @@ const CREW_GITIGNORE_ENTRIES = [
 ];
 
 /**
- * Update .gitignore with .crew entries. Creates the file if it doesn't exist.
- * Preserves all existing content.
+ * Entries to add to .gitignore for the `.pi/teams/` legacy layout.
+ *
+ * `.pi/` is shared with other pi-crew-unrelated pi tooling, so we ignore
+ * ONLY the specific pi-crew state subdirs rather than the whole `.pi/teams/`
+ * tree. `artifacts/` and `graphs/` stay committable (mirroring the `.crew/`
+ * exception policy).
+ */
+const PI_TEAMS_GITIGNORE_ENTRIES = [
+	"/.pi/teams/state/",
+	"/.pi/teams/cache/",
+	"/.pi/teams/worktrees/",
+	"/.pi/teams/imports/",
+	"/.pi/teams/audit/",
+	"!/.pi/teams/artifacts/",
+	"!/.pi/teams/graphs/",
+];
+
+/**
+ * Resolve which gitignore entry set applies. The repo root is the parent
+ * directory of the `.gitignore` path. If `.crew/` exists there, use the
+ * `.crew/` entries; else if `.pi/` exists, use the `.pi/teams/` entries;
+ * else fall through to the default `.crew/` set (forward-looking for fresh
+ * projects — the crew-init step will create `.crew/`).
+ */
+function resolveEntries(gitignorePath: string): string[] {
+	const repoRoot = path.dirname(gitignorePath);
+	try {
+		if (fs.existsSync(path.join(repoRoot, ".crew"))) return CREW_GITIGNORE_ENTRIES;
+		if (fs.existsSync(path.join(repoRoot, ".pi"))) return PI_TEAMS_GITIGNORE_ENTRIES;
+	} catch {
+		// Filesystem error — fall through to default. The crew-init step
+		// creates .crew/ anyway, so the default entries are correct.
+	}
+	return CREW_GITIGNORE_ENTRIES;
+}
+
+/**
+ * Update .gitignore with the appropriate crew entries. Creates the file if it
+ * doesn't exist. Preserves all existing content.
+ *
+ * Layout detection: if `.pi/` exists at the repo root and `.crew/` does not,
+ * the `.pi/teams/` entries are written instead (mirrors `projectCrewRoot`).
  */
 export async function updateGitignore(gitignorePath: string): Promise<void> {
+	const entries = resolveEntries(gitignorePath);
+
 	if (!fs.existsSync(gitignorePath)) {
-		atomicWriteFile(gitignorePath, CREW_GITIGNORE_ENTRIES.join("\n") + "\n");
+		atomicWriteFile(gitignorePath, entries.join("\n") + "\n");
 		return;
 	}
 
@@ -34,7 +88,7 @@ export async function updateGitignore(gitignorePath: string): Promise<void> {
 	const existingLines = new Set(current.split("\n").map((line) => line.trim()));
 
 	let appended = "";
-	for (const entry of CREW_GITIGNORE_ENTRIES) {
+	for (const entry of entries) {
 		if (!existingLines.has(entry)) {
 			appended += `\n${entry}`;
 		}

package/src/utils/glob-match.ts

@@ -0,0 +1,29 @@
+/**
+ * Glob matcher with ReDoS protection.
+ *
+ * Extracted from `src/extension/team-tool/api.ts` so the security-critical
+ * ReDoS guard (pattern length cap + path-safe wildcards) is testable in
+ * isolation without importing the heavy `team-tool/api` transitive graph
+ * (which pulls in `pi-coding-agent` peer deps unavailable in unit tests).
+ *
+ * Semantics (intentional, path-safe):
+ *   - `*` matches a run of non-separator chars (does NOT cross `/`)
+ *   - `?` matches a single non-separator char
+ *   - all other regex metacharacters are escaped (literal match)
+ *   - patterns longer than 200 chars are rejected outright (ReDoS backstop)
+ *
+ * @see test/unit/glob-match-redos.test.ts — the regression suite for the
+ * catastrophic-backtracking fix (MEDIUM #4).
+ */
+
+// Prevent ReDoS: reject excessively long patterns.
+const MAX_GLOB_PATTERN_LEN = 200;
+
+export function globMatch(value: string, pattern: string): boolean {
+	if (pattern.length > MAX_GLOB_PATTERN_LEN) return false;
+	const regex = pattern
+		.replace(/[.+^${}()|[\]\\]/g, "\\$&") // escape regex special chars
+		.replace(/\*/g, "[^/]*") // * matches non-slash characters only
+		.replace(/\?/g, "[^/]"); // ? matches single non-slash
+	return new RegExp(`^${regex}$`).test(value);
+}

package/types/dwf.d.ts

@@ -24,7 +24,7 @@
  * import type { WorkflowCtx } from "pi-crew/workflow";
  * ```
  *
- * These interfaces mirror the runtime types in `src/runtime/dynamic-workflow-context.ts`.
+ * These interfaces mirror the runtime types in `src/runtime/goal-workflow/dynamic-workflow-context.ts`.
  * They are authoring-only (no runtime values); the real implementations live in the runner.
  *
  * ## Resume & Checkpoint (round-18 P2-3)

package/src/types/new-api-types.ts

@@ -1,35 +0,0 @@
-/**
- * Type imports from pi v0.77.0
- */
-import type { AgentSessionEvent } from "@earendil-works/pi-coding-agent";
-
-export type { AgentSessionEvent } from "@earendil-works/pi-coding-agent";
-
-// Note: AgentEvent is not exported by pi-coding-agent v0.77.0
-// Using AgentEndEvent and AgentStartEvent instead
-
-// Type guards for pi-crew usage
-/** @internal */
-function isToolEvent(event: AgentSessionEvent): boolean {
-	return event.type === "tool_execution_start" || event.type === "tool_execution_update" || event.type === "tool_execution_end";
-}
-
-/** @internal */
-function isAgentLifecycleEvent(event: AgentSessionEvent): boolean {
-	return event.type === "agent_start" || event.type === "agent_end";
-}
-
-/** @internal */
-function isCompactionEvent(event: AgentSessionEvent): boolean {
-	return event.type === "compaction_start" || event.type === "compaction_end";
-}
-
-/** @internal */
-function isRetryEvent(event: AgentSessionEvent): boolean {
-	return event.type === "auto_retry_start" || event.type === "auto_retry_end";
-}
-
-/** @internal */
-function isQueueEvent(event: AgentSessionEvent): boolean {
-	return event.type === "queue_update";
-}