pi-crew 0.9.66 → 0.9.68

package/CHANGELOG.md

@@ -2,6 +2,115 @@
 
 > **Note:** `atomic-write-v2.ts` / `AtomicWriter` mentioned in historical entries below was consolidated into `atomic-write.ts` as of v0.9.42. This changelog is preserved as historical record — the migration was completed (the v2 class was never adopted; v1 won on simplicity + symlink-safety + link+unlink atomicity). See `docs/migration/atomic-write-v2-migration.md` for the decision rationale.
 
+## [0.9.68] — RLM fixes after deep-review verification (2026-08-12)
+
+Fixes from `docs/rlm-deep-review-2026-08-12.md` (verified) +
+`docs/rlm-fixes-implementation-plan.md`. Each code part loop-reviewed (3
+parallel reviewers: security/correctness/tests, read-only) before merge here.
+
+### Fixes
+- **P1 — global shadow poisoning** (`src/runtime/scratchpad/guest.ts`):
+  `PROTECTED_GLOBALS` + `resetProtectedGlobals()` register live Node globals
+  into the namespace/`INTERNAL_BINDINGS`. Closes both poisoning paths: restore
+  (re-install overwrites revived shadow) and in-session (reset at cell start —
+  shadow stays local to the cell that created it). Silent corruption (e.g.
+  `const process='x'` making `process.env` undefined) is gone. 8 regression
+  tests in `test/unit/runtime/scratchpad/guest-global-shadow.test.ts`.
+- **P2 — scratchpad adoption lever** (`src/agents/agent-config.ts`): new
+  `PI_CREW_SCRATCHPAD_DEMOTE_BASH=1` flag. When on + a role has scratchpad
+  enabled, `resolveToolPolicy` removes `bash` (allowlist filter + denylist add)
+  so the model reaches for the `sh()` binding instead — the documented root
+  cause of 0 adoption. Default off (zero behavior change); scoped to
+  scratchpad-armed roles (executor/verifier/test-engineer) via
+  `isScratchpadEnabledForRole` (S-6 read-only gate + F6 kill-switch honored).
+  10 tests in `test/unit/scratchpad-demote-bash.test.ts`.
+- **P4 — host_request protocol doc** (`src/runtime/scratchpad/protocol.ts`):
+  the `host_request` type is now documented as reserved for the future host
+  bridge (§5.2F), not yet wired (no handler).
+- **P5 — version drift** (`package.json`): 4 pi devDeps `^0.83.0` → `^0.84.0`
+  (installed runtime is 0.84.1).
+- **P6 — scratchpad stack-trace sourcemap** (`src/runtime/scratchpad/transform.ts`
+  + `guest.ts`): `transformCell` now returns a `lineMap` (body line → source
+  line) built from esbuild `sourcemap:'inline'` + a hand-rolled VLQ decoder
+  (no dependency) + import pre-rewrite tracking + splice line counting. Guest
+  `remapStackLines` remaps the V8 `<anonymous>:N` frame back to the cell's
+  original source line. Only real `    at ` frames are remapped (a crafted
+  error message containing `<anonymous>:N:C)` is left byte-identical). Known
+  cosmetic limitation: multi-line type annotations map to the esbuild collapse
+  point. 10 tests in `test/unit/runtime/scratchpad/scratchpad-sourcemap.test.ts`.
+
+### Removed
+- **P3 — dead HMAC crypto deleted.** `src/runtime/scratchpad/snapshot-hmac.ts`
+  (167 lines, 11 tests) + its test file removed. The threat it mitigated
+  (v8.deserialize tamper) is double-conditional (0 scratchpad adoption +
+  same-uid store both hold today); wiring (ROADMAP R1-4) was premature and
+  blocked on 3 unresolved design questions. ADR Superseded; design retained
+  for clean re-add if conditions ever hold. ROADMAP R1-4 / R2-2 marked removed.
+
+### Deferred (needs design)
+- *None remaining.* (P6 was the last deferred item; it shipped — see Fixes.)
+
+## [0.9.67] — RLM/scratchpad adoption batch (I1–I7) (2026-08-11)
+
+First shippable slice of `improvement-plan-2026-08-11.md` — the scratchpad was
+armed-but-unused (0 cells in 14 runs); this batch fixes the doctrine, adds an
+adoption/value metric, and ports the pattern-12 shell guard. Each item was
+loop-reviewed (iterative-audit) before commit; `test:critical` 101/0, 129
+scratchpad tests, `tsc`/biome clean.
+
+### Fixes
+- **Doctrine truthfulness (I1–I2)** (`src/prompt/scratchpad-lifecycle.ts`):
+  removed the "await expressions" bullet that advertised a tools bridge that
+does not exist (pattern-22 "silence is cheaper"); replaced the foreign
+`<rlm_engine_reset>` marker with the real `[scratchpad]` restore-notice prefix,
+keeping the I6-pairing "especially inside shell commands" clause. New pins in
+`test/unit/scratchpad-lifecycle.test.ts` (no absent-binding ads, no foreign
+marker, real prefix taught).
+- **English model-facing surface (I3)**: `description` + `promptSnippet`
+translated from Vietnamese to English (model-facing channel only; human docs
+stay Vietnamese). Pin asserts no non-ASCII prose.
+- **Worked example + when-to-prefer rule (I4)**: 7th doctrine bullet shows a
+two-cell `await import('node:fs')` example with `const failures` persisting
+across cells, a prefer-scratchpad-over-bash rule, the "bash is cheaper for
+one-shot" negative rule, and a "keep namespace values small" caveat. Perf
+metric re-recorded: doctrine=299, delta=310 est-tokens (under the ~350
+budget).
+- **Adoption/value metric (I5)**: fire-and-forget `scratchpad.cell` (per cell:
+status/durationMs/codeLength/resultBytes) and `scratchpad.restored`
+(attempt/restoredCount/failedCount/status, incl. restore-throw) events, threaded
+via new `PI_CREW_EVENTS_PATH` env + runId (now set unconditionally, uncoupled
+from the broker gate). Both literals registered in `TEAM_EVENT_TYPES`; a
+non-zero `## Scratchpad` section is reported in `summary.md` (silent when
+unused). DI-seam failing-writer test added.
+- **Pattern-12 shell guard (I6)** (`src/runtime/scratchpad/guest.ts`): guest-local
+`sh(cmd, args[])` refuses null/empty args before spawn (the `rm -rf undefined`
+class bug), runs `execFile(shell:false, args array)`, returns
+`{ exitCode, stdout, stderr }` (non-zero does not throw). Registered in
+`INTERNAL_BINDINGS` + namespace (identity skip excludes it from snapshots);
+re-installed after restore. Advisory guard only — cells run at full worker
+trust (no VM sandbox). 5 new guest tests.
+- **NOT WIRED banners (I7)**: `snapshot-hmac.ts` marked unmissably NOT WIRED
+(module + test header + README threat-model cross-ref) pending the J1
+wire-or-delete decision.
+
+### Verified
+- `npm run test:critical`: 101/0; 19 scratchpad test files 129/129; `test:spike`
+12 pass/1 pre-existing skip.
+- `npx tsc --noEmit`, biome lint + format clean; `check:event-types` 67
+registered (2 new), drift unchanged at 72; `check:lazy-imports`
+(LAZY marker on the doctrine example string), bundle-staleness/size OK.
+- Bundle rebuilt (2.81 MB < 3.5 MB budget).
+- Observation window for the §5 decision gate starts after this release
+(scratchpad.cell counts now visible in run state + summary.md).
+
+### CI regression fixes (same release)
+- **Untracked api/ modules committed** (`src/extension/team-tool/api/*`, `run-intent.ts`, `src/utils/glob-match.ts`, `src/runtime/child-pi/mock-fixtures.ts`): the 08-10 batch staged only tracked files; CI typecheck failed `Cannot find module './api/*.ts'`. Fixed by committing the 10 missing source files.
+- **Sync appendEvent restored in extracted api/ handlers** (`team-tool/api/{agent-control,mailbox,heartbeat,plan-approval}.ts` + `team-tool/status.ts`): the H3 extract silently changed 11 sync `appendEvent` → fire-and-forget `appendEventAsync`, breaking byte-identical behavior and racing integration tests (status/ack/nudge events missed when read immediately after the call). Reverted to sync `appendEvent`; integration 188/0 (was 3 fails), unit 7121/0.
+- **removeCrewAgent test fixed** for H2 coalesced non-terminal status writes (use a terminal record).
+
+### Verified (CI)
+- GitHub Actions: ubuntu + windows + macOS all green (run `31556762231`).
+
 ## [0.9.66] — real-test findings: cross-project run lookup, output validation, config no-op-write, retry clarity, cron grammar (2026-08-10)
 
 Six fixes distilled from the `real-test-pi-crew` 9-tier battery (run 2026-08-10). All verified live end-to-end; `npm run test:critical` 101/101, `npx tsc --noEmit` exit 0, biome lint+format clean.

package/README.md

@@ -271,7 +271,7 @@ The guidance is available in three places agents see:
 
 ### How to silence the advisory
 
-The advisory is **informational only** — there is no `force:true` flag needed (the run proceeds regardless). If you want to silence the `console.warn` output for cleaner logs, set `PI_CREW_QUIET_PREFLIGHT=1` in your environment.
+The advisory is **informational only** — there is no `force:true` flag needed (the run proceeds regardless).
 
 ### Implementation
 
@@ -827,7 +827,7 @@ This is pi-crew's cliff-resilient mode: the workflow definitions, phase structur
 { "action": "auto-summarize" }
 ```
 
-📖 Full actions reference (40+ actions): [docs/actions-reference.md](docs/actions-reference.md)
+📖 Full actions reference (54 schema actions across 5 domain dispatchers: run/status/control/manage/automate): [docs/actions-reference.md](docs/actions-reference.md)
 
 ---
 
@@ -911,7 +911,6 @@ Your system prompt here.
 |----------|---------|
 | `PI_CREW_BROKER=0` | **Disable the inter-pi broker entirely** (always wins over config). Use to opt out of cross-session messaging. |
 | `PI_CREW_BROKER=1` | Explicitly enable the broker (redundant under the v0.9.47 default-on; useful for overriding a config `broker.enabled: false`). |
-| `PI_CREW_BROKER_DIAG_UI=1` | Make the run-dashboard `handleInput` emit a `[PI-CREW-DIAG]` line to stderr per keystroke — for TUI keybinding probes. |
 | `PI_CREW_USE_BUNDLE=1` | Force-load via bundled `dist/index.mjs` (~19% faster cold-start than strip-types). Default: bundle (since v0.9.17). Set `PI_CREW_USE_BUNDLE=0` to force strip-types fallback. Requires `npm run build:bundle` to have produced `dist/`. |
 | `PI_CREW_EXECUTE_WORKERS=0` | Disable child workers (scaffold mode) |
 | `PI_TEAMS_EXECUTE_WORKERS=0` | Legacy disable flag |

package/agents/executor.md

@@ -5,7 +5,7 @@ model: false
 systemPromptMode: replace
 inheritProjectContext: true
 inheritSkills: false
-tools: read, grep, find, ls, bash, edit, write
+tools: read, grep, find, ls, bash, edit, write, scratchpad
 ---
 
 You are an implementation specialist. Follow the provided plan, make targeted changes, keep edits minimal, and report changed files plus validation status. Do not broaden scope without explaining why.

package/agents/test-engineer.md

@@ -5,7 +5,7 @@ model: false
 systemPromptMode: replace
 inheritProjectContext: true
 inheritSkills: false
-tools: read, edit, write, bash, ls
+tools: read, edit, write, bash, ls, scratchpad
 ---
 
 You are a test engineer. Identify the right test level, add or adjust tests when asked, detect flaky assumptions, and report exact validation commands and results.

package/agents/verifier.md

@@ -5,7 +5,7 @@ model: false
 systemPromptMode: replace
 inheritProjectContext: true
 inheritSkills: false
-tools: read, grep, find, ls, bash
+tools: read, grep, find, ls, bash, scratchpad
 maxTurns: 15
 ---