pi-crew 0.9.66 → 0.9.68

package/src/state/event-log/event-log.ts

@@ -357,6 +357,12 @@ function persistSequence(eventsPath: string, seq: number): void {
 // makes assignment atomic (JS is single-threaded); persistSequence() keeps the
 // sidecar durable for crash recovery across restarts.
 const seqCounters = new Map<string, number>();
+// H6 (2026-08-10): FIFO cap — mirrors appendCounters (APPEND_COUNTER_MAX_ENTRIES = 256)
+// and agentEventSeqCache (cap at :434). Without this, a long-lived parent pi process
+// that observes many runs (dev sessions with hundreds of background runs over a week)
+// accumulates one entry per distinct eventsPath forever. Eviction is safe: the next
+// append re-seeds from the `.seq` sidecar via reserveSequenceUnderLock.
+const SEQ_COUNTERS_MAX_ENTRIES = 256;
 
 /** Atomically reserve the next sequence number for `eventsPath`.
  *
@@ -384,7 +390,18 @@ function reserveSequence(eventsPath: string): number {
  *  (e.g. baseMetadata.seq) so a later auto-assigned seq never collides with it. */
 function advanceSequenceCounter(eventsPath: string, seq: number): void {
 	const last = seqCounters.get(eventsPath);
-	if (last === undefined || seq > last) seqCounters.set(eventsPath, seq);
+	if (last === undefined || seq > last) {
+		seqCounters.set(eventsPath, seq);
+		enforceSeqCountersCap();
+	}
+}
+
+/** H6: FIFO eviction when the seqCounters map exceeds its bounded size. */
+function enforceSeqCountersCap(): void {
+	if (seqCounters.size > SEQ_COUNTERS_MAX_ENTRIES) {
+		const oldest = seqCounters.keys().next().value;
+		if (oldest !== undefined) seqCounters.delete(oldest);
+	}
 }
 
 /** C-01: Reserve sequence INSIDE the cross-process lock. Reads the authoritative
@@ -401,6 +418,7 @@ function reserveSequenceUnderLock(eventsPath: string): number {
 	const last = Math.max(stored, inProcess);
 	const next = last + 1;
 	seqCounters.set(eventsPath, next);
+	enforceSeqCountersCap();
 	return next;
 }
 
@@ -418,32 +436,6 @@ export function computeEventFingerprint(event: Pick<TeamEvent, "type" | "runId"
 		.slice(0, 16);
 }
 
-/**
- * Check for sequence gaps between the sidecar file and the events file.
- * This detects situations where the sidecar records a sequence number that has
- * no corresponding event in the file (e.g., due to a crash between
- * persistSequence and appendFile in older code, or other corruption).
- *
- * Returns an array of gap info: for each gap found, { missing: n } indicates
- * sequence n is recorded in sidecar but has no corresponding event.
- * An empty array means no gaps were found.
- */
-export function checkSequenceGaps(eventsPath: string): { missing: number }[] {
-	if (!fs.existsSync(eventsPath)) return [];
-	const gaps: { missing: number }[] = [];
-	const storedSeq = readStoredSequence(eventsPath);
-	if (storedSeq === undefined) return [];
-	const maxInFile = scanSequence(eventsPath);
-	// If sidecar is ahead of file, report the missing sequences
-	// (sidecar stores the NEXT sequence to use, so storedSeq is the last written)
-	if (storedSeq > maxInFile) {
-		for (let i = maxInFile + 1; i <= storedSeq; i++) {
-			gaps.push({ missing: i });
-		}
-	}
-	return gaps;
-}
-
 /**
  * @deprecated Prefer `appendEventAsync()` in async contexts. The sync lock uses
  * `sleepSync` which blocks the Node.js event loop, preventing AbortSignal handlers

package/src/state/gitignore-manager.ts

@@ -1,15 +1,27 @@
 /**
- * Manage .gitignore entries for the .crew directory.
+ * Manage .gitignore entries for the crew state directory.
+ *
+ * Supports BOTH layouts that `projectCrewRoot` (src/utils/paths.ts) can
+ * resolve to:
+ *   - `.crew/` (default, created when neither .crew/ nor .pi/ exists)
+ *   - `.pi/teams/` (legacy layout, reused when .pi/ already exists)
+ *
+ * Before this fix (2026-08-10, improvement-plan G12), only `.crew/`
+ * entries were written — so projects on the `.pi/teams/` layout silently
+ * committed their run state, artifacts, and logs to git. The layout is
+ * detected from the repo root (parent dir of the .gitignore path).
+ *
  * Only adds entries if not already present; preserves existing content.
  */
 import * as fs from "node:fs";
+import * as path from "node:path";
 import { atomicWriteFile } from "./atomic-write.ts";
 
 /**
- * Entries to add to .gitignore for .crew directory management.
+ * Entries to add to .gitignore for the `.crew/` layout.
  *
  * - `/.crew/` and `/.crew` ignore the core state directory.
- * - Exceptions allow optional commit of artifacts/ and graphs/ (including their .gitkeep).
+ * - Exceptions allow optional commit of artifacts/ and graphs/.
  */
 const CREW_GITIGNORE_ENTRIES = [
 	"/.crew/",
@@ -21,12 +33,54 @@ const CREW_GITIGNORE_ENTRIES = [
 ];
 
 /**
- * Update .gitignore with .crew entries. Creates the file if it doesn't exist.
- * Preserves all existing content.
+ * Entries to add to .gitignore for the `.pi/teams/` legacy layout.
+ *
+ * `.pi/` is shared with other pi-crew-unrelated pi tooling, so we ignore
+ * ONLY the specific pi-crew state subdirs rather than the whole `.pi/teams/`
+ * tree. `artifacts/` and `graphs/` stay committable (mirroring the `.crew/`
+ * exception policy).
+ */
+const PI_TEAMS_GITIGNORE_ENTRIES = [
+	"/.pi/teams/state/",
+	"/.pi/teams/cache/",
+	"/.pi/teams/worktrees/",
+	"/.pi/teams/imports/",
+	"/.pi/teams/audit/",
+	"!/.pi/teams/artifacts/",
+	"!/.pi/teams/graphs/",
+];
+
+/**
+ * Resolve which gitignore entry set applies. The repo root is the parent
+ * directory of the `.gitignore` path. If `.crew/` exists there, use the
+ * `.crew/` entries; else if `.pi/` exists, use the `.pi/teams/` entries;
+ * else fall through to the default `.crew/` set (forward-looking for fresh
+ * projects — the crew-init step will create `.crew/`).
+ */
+function resolveEntries(gitignorePath: string): string[] {
+	const repoRoot = path.dirname(gitignorePath);
+	try {
+		if (fs.existsSync(path.join(repoRoot, ".crew"))) return CREW_GITIGNORE_ENTRIES;
+		if (fs.existsSync(path.join(repoRoot, ".pi"))) return PI_TEAMS_GITIGNORE_ENTRIES;
+	} catch {
+		// Filesystem error — fall through to default. The crew-init step
+		// creates .crew/ anyway, so the default entries are correct.
+	}
+	return CREW_GITIGNORE_ENTRIES;
+}
+
+/**
+ * Update .gitignore with the appropriate crew entries. Creates the file if it
+ * doesn't exist. Preserves all existing content.
+ *
+ * Layout detection: if `.pi/` exists at the repo root and `.crew/` does not,
+ * the `.pi/teams/` entries are written instead (mirrors `projectCrewRoot`).
  */
 export async function updateGitignore(gitignorePath: string): Promise<void> {
+	const entries = resolveEntries(gitignorePath);
+
 	if (!fs.existsSync(gitignorePath)) {
-		atomicWriteFile(gitignorePath, CREW_GITIGNORE_ENTRIES.join("\n") + "\n");
+		atomicWriteFile(gitignorePath, entries.join("\n") + "\n");
 		return;
 	}
 
@@ -34,7 +88,7 @@ export async function updateGitignore(gitignorePath: string): Promise<void> {
 	const existingLines = new Set(current.split("\n").map((line) => line.trim()));
 
 	let appended = "";
-	for (const entry of CREW_GITIGNORE_ENTRIES) {
+	for (const entry of entries) {
 		if (!existingLines.has(entry)) {
 			appended += `\n${entry}`;
 		}

package/src/utils/glob-match.ts

@@ -0,0 +1,29 @@
+/**
+ * Glob matcher with ReDoS protection.
+ *
+ * Extracted from `src/extension/team-tool/api.ts` so the security-critical
+ * ReDoS guard (pattern length cap + path-safe wildcards) is testable in
+ * isolation without importing the heavy `team-tool/api` transitive graph
+ * (which pulls in `pi-coding-agent` peer deps unavailable in unit tests).
+ *
+ * Semantics (intentional, path-safe):
+ *   - `*` matches a run of non-separator chars (does NOT cross `/`)
+ *   - `?` matches a single non-separator char
+ *   - all other regex metacharacters are escaped (literal match)
+ *   - patterns longer than 200 chars are rejected outright (ReDoS backstop)
+ *
+ * @see test/unit/glob-match-redos.test.ts — the regression suite for the
+ * catastrophic-backtracking fix (MEDIUM #4).
+ */
+
+// Prevent ReDoS: reject excessively long patterns.
+const MAX_GLOB_PATTERN_LEN = 200;
+
+export function globMatch(value: string, pattern: string): boolean {
+	if (pattern.length > MAX_GLOB_PATTERN_LEN) return false;
+	const regex = pattern
+		.replace(/[.+^${}()|[\]\\]/g, "\\$&") // escape regex special chars
+		.replace(/\*/g, "[^/]*") // * matches non-slash characters only
+		.replace(/\?/g, "[^/]"); // ? matches single non-slash
+	return new RegExp(`^${regex}$`).test(value);
+}

package/types/dwf.d.ts

@@ -24,7 +24,7 @@
  * import type { WorkflowCtx } from "pi-crew/workflow";
  * ```
  *
- * These interfaces mirror the runtime types in `src/runtime/dynamic-workflow-context.ts`.
+ * These interfaces mirror the runtime types in `src/runtime/goal-workflow/dynamic-workflow-context.ts`.
  * They are authoring-only (no runtime values); the real implementations live in the runner.
  *
  * ## Resume & Checkpoint (round-18 P2-3)

package/src/runtime/scratchpad/snapshot-hmac.ts

@@ -1,161 +0,0 @@
-/**
- * Snapshot HMAC helper — opt-in integrity for scratchpad snapshots.
- *
- * Closes the E.2 gap declared in docs/improvement-plan-2026-08-09.md and
- * docs/runtime/scratchpad/README.md:120 ("v8.deserialize of restore content
- * is unauthenticated (no HMAC)"). The threat model — a same-uid attacker
- * plants a crafted V8 blob at the snapshot path to run deserialize gadgets
- * in the guest — does not cross the existing same-uid boundary, but HMAC
- * hardening is required before snapshots ever land in a shared/networked
- * store.
- *
- * Migration window (see docs/decisions/2026-08-10-scratchpad-snapshot-hmac.md):
- *
- *   Phase 1 (this module): HMAC sign-on-write + verify-on-read are OPT-IN
- *     via PI_CREW_SNAPSHOT_HMAC_KEY. When the key is unset, behaviour is
- *     unchanged (snapshots remain unsigned). When the key is set, writes
- *     attach a signature and reads verify it; an unsigned/failed snapshot
- *     is ACCEPTED with a warning so existing snapshots remain readable.
- *   Phase 2 (after one release): unsigned snapshots are REJECTED when the
- *     key is set (configurable via PI_CREW_SNAPSHOT_HMAC_STRICT=1).
- *   Phase 3 (after snapshots move to a shared store): the key becomes
- *     required and unsigned snapshots are always rejected.
- *
- * Wire-up into the actual write/read paths is intentionally deferred to a
- * follow-up that audits the snapshot envelope format (V8 base64 vs raw
- * bytes) and the writeArtifact redaction interaction. See ADR for the plan.
- */
-import { createHmac, timingSafeEqual } from "node:crypto";
-
-/**
- * Env var holding the HMAC secret. When unset, HMAC is disabled (Phase 0
- * behaviour — snapshots unsigned). When set, sign-on-write and
- * verify-on-read are enabled.
- */
-export const SNAPSHOT_HMAC_KEY_ENV = "PI_CREW_SNAPSHOT_HMAC_KEY";
-
-/**
- * Opt-in strict mode (Phase 2): when the key is set AND this is "1",
- * unsigned or signature-mismatched snapshots are REJECTED on read instead
- * of accepted with a warning.
- */
-export const SNAPSHOT_HMAC_STRICT_ENV = "PI_CREW_SNAPSHOT_HMAC_STRICT";
-
-/**
- * Header prefix for an inline signature. When snapshots are signed, the
- * signature is prepended to the blob as `PI_CREW_SIG=<hex>\n` so a single
- * read yields both the signature and the payload. (Sidecar files would
- * require writeArtifact coordination that the envelope format does not
- * currently support.)
- */
-export const SNAPSHOT_SIG_PREFIX = "PI_CREW_SIG=";
-
-export function getSnapshotHmacKey(env: NodeJS.ProcessEnv = process.env): Buffer | undefined {
-	const raw = env[SNAPSHOT_HMAC_KEY_ENV];
-	if (!raw) return undefined;
-	// Accept hex-encoded keys directly; otherwise encode the string as utf8.
-	// A key shorter than 32 bytes is rejected to prevent trivial brute-force.
-	const buf = /^[0-9a-fA-F]+$/.test(raw) && raw.length % 2 === 0 ? Buffer.from(raw, "hex") : Buffer.from(raw, "utf8");
-	if (buf.length < 32) {
-		throw new Error(
-			`${SNAPSHOT_HMAC_KEY_ENV} must be at least 32 bytes (got ${buf.length}); use a longer key or generate one with: node -e "console.log(require('crypto').randomBytes(32).toString('hex'))"`,
-		);
-	}
-	return buf;
-}
-
-export function isSnapshotHmacStrict(env: NodeJS.ProcessEnv = process.env): boolean {
-	return env[SNAPSHOT_HMAC_STRICT_ENV] === "1" || env[SNAPSHOT_HMAC_STRICT_ENV] === "true";
-}
-
-/**
- * Compute the HMAC-SHA256 signature of `content` under `key`. Returns a
- * lowercase hex string.
- */
-export function signSnapshot(content: Buffer | string, key: Buffer): string {
-	return createHmac("sha256", key).update(content).digest("hex");
-}
-
-/**
- * Constant-time signature comparison. Both signatures must be lowercase
- * hex of the same length; anything else returns false without throwing.
- */
-export function snapshotSignatureMatches(content: Buffer | string, signature: string, key: Buffer): boolean {
-	const expected = signSnapshot(content, key);
-	const a = Buffer.from(expected);
-	const b = Buffer.from(signature);
-	if (a.length !== b.length) return false;
-	return timingSafeEqual(a, b);
-}
-
-/**
- * Outcome of {@link verifySnapshotPayload}. Callers decide how to react
- * based on the strict-mode flag.
- */
-export type SnapshotVerifyOutcome =
-	| { kind: "unsigned"; strict: boolean }
-	| { kind: "verified" }
-	| { kind: "mismatch"; strict: boolean }
-	| { kind: "hmac-disabled" };
-
-/**
- * Verify a snapshot payload that may or may not carry an inline signature.
- *
- * @param payload The raw bytes read from disk (possibly including the
- *   `PI_CREW_SIG=<hex>\n` prefix).
- * @param key The HMAC key, or `undefined` when HMAC is disabled.
- * @param strict When true, unsigned/mismatched payloads are reported as
- *   rejectable. When false (the Phase 1 default), the caller is expected
- *   to accept the payload with a warning.
- */
-export function verifySnapshotPayload(payload: Buffer, key: Buffer | undefined, strict: boolean): SnapshotVerifyOutcome {
-	if (!key) return { kind: "hmac-disabled" };
-	const prefixStr = SNAPSHOT_SIG_PREFIX;
-	if (payload.length < prefixStr.length + 1 || payload.subarray(0, prefixStr.length).toString("utf8") !== prefixStr) {
-		return { kind: "unsigned", strict };
-	}
-	const newlineIdx = payload.indexOf(0x0a, prefixStr.length);
-	if (newlineIdx < 0) return { kind: "unsigned", strict };
-	const sigHex = payload.subarray(prefixStr.length, newlineIdx).toString("utf8");
-	const body = payload.subarray(newlineIdx + 1);
-	return snapshotSignatureMatches(body, sigHex, key) ? { kind: "verified" } : { kind: "mismatch", strict };
-}
-
-/**
- * Strip the inline signature prefix and return the bare payload. Returns
- * the original buffer when no prefix is present. Used by read paths that
- * have already called {@link verifySnapshotPayload} and decided to accept.
- */
-export function stripSnapshotSignature(payload: Buffer): Buffer {
-	if (payload.length < SNAPSHOT_SIG_PREFIX.length) return payload;
-	if (payload.subarray(0, SNAPSHOT_SIG_PREFIX.length).toString("utf8") !== SNAPSHOT_SIG_PREFIX) return payload;
-	const newlineIdx = payload.indexOf(0x0a, SNAPSHOT_SIG_PREFIX.length);
-	if (newlineIdx < 0) return payload;
-	return payload.subarray(newlineIdx + 1);
-}
-
-/**
- * Attach an inline signature to a payload. Returns a new buffer shaped as
- * `PI_CREW_SIG=<hex>\n<payload>`. Used by write paths that have HMAC
- * enabled.
- */
-export function attachSnapshotSignature(payload: Buffer, key: Buffer): Buffer {
-	const sig = signSnapshot(payload, key);
-	return Buffer.concat([Buffer.from(`${SNAPSHOT_SIG_PREFIX}${sig}\n`, "utf8"), payload]);
-}
-
-/**
- * Should the caller reject the snapshot based on the verify outcome?
- * Centralises the strict-vs-migration decision so callers stay simple.
- */
-export function shouldRejectSnapshot(outcome: SnapshotVerifyOutcome): boolean {
-	switch (outcome.kind) {
-		case "hmac-disabled":
-			return false;
-		case "verified":
-			return false;
-		case "unsigned":
-		case "mismatch":
-			return outcome.strict;
-	}
-}

package/src/types/new-api-types.ts

@@ -1,35 +0,0 @@
-/**
- * Type imports from pi v0.77.0
- */
-import type { AgentSessionEvent } from "@earendil-works/pi-coding-agent";
-
-export type { AgentSessionEvent } from "@earendil-works/pi-coding-agent";
-
-// Note: AgentEvent is not exported by pi-coding-agent v0.77.0
-// Using AgentEndEvent and AgentStartEvent instead
-
-// Type guards for pi-crew usage
-/** @internal */
-function isToolEvent(event: AgentSessionEvent): boolean {
-	return event.type === "tool_execution_start" || event.type === "tool_execution_update" || event.type === "tool_execution_end";
-}
-
-/** @internal */
-function isAgentLifecycleEvent(event: AgentSessionEvent): boolean {
-	return event.type === "agent_start" || event.type === "agent_end";
-}
-
-/** @internal */
-function isCompactionEvent(event: AgentSessionEvent): boolean {
-	return event.type === "compaction_start" || event.type === "compaction_end";
-}
-
-/** @internal */
-function isRetryEvent(event: AgentSessionEvent): boolean {
-	return event.type === "auto_retry_start" || event.type === "auto_retry_end";
-}
-
-/** @internal */
-function isQueueEvent(event: AgentSessionEvent): boolean {
-	return event.type === "queue_update";
-}