pi-crew 0.9.68 → 0.10.2

package/src/extension/registration/foreground-run-controller.ts

@@ -20,6 +20,7 @@ import { setWorkingIndicator } from "../../ui/pi-ui-compat.ts";
 import { requestPowerbarUpdate } from "../../ui/powerbar-publisher.ts";
 import { updateCrewWidget } from "../../ui/widget/index.ts";
 import { logInternalError } from "../../utils/internal-error.ts";
+import { safeAbort } from "../../utils/safe-abort.ts";
 import type { RegistrationContext } from "./registration-types.ts";
 
 /**
@@ -36,7 +37,10 @@ export function installForegroundRunController(pi: ExtensionAPI, ctx: Registrati
 	ctx.abortForegroundRun = (runId) => {
 		const controller = ctx.foregroundTeamRunControllers.get(runId);
 		if (!controller) return false;
-		controller.abort();
+		// safe-abort: cancel can race a completed run whose spawned children
+		// already exited — Node's child_process signal listener would throw
+		// AbortError out of abort() and kill the host (uncaughtException).
+		safeAbort(controller, "fg-run.abort-by-run-id");
 		return true;
 	};
 }
@@ -142,7 +146,11 @@ function startForegroundRunImpl(
 						.catch((error) => logInternalError("register.foreground-watchdog", error, `runId=${runId}`));
 				}
 				const ownerCurrent = ctx.isContextCurrent(extensionCtx, ownerGeneration);
-				if (extensionCtx.hasUI) {
+				// The owner ctx can go stale while the run is in flight (e.g. the
+				// user opened an agent session view via /crew-view and the run
+				// finishes there): the `hasUI` getter THROWS on a stale ctx, so
+				// it must only be touched for the still-current owner.
+				if (ownerCurrent && extensionCtx.hasUI) {
 					try {
 						setWorkingIndicator(extensionCtx);
 						extensionCtx.ui.setWorkingMessage();

package/src/extension/registration/lifecycle-handlers.ts

@@ -19,13 +19,16 @@ import * as path from "node:path";
 import type { ExtensionAPI, ExtensionContext } from "@earendil-works/pi-coding-agent";
 import { loadConfig } from "../../config/config.ts";
 import { DEFAULT_UI } from "../../config/defaults.ts";
+import { getCrewEnv } from "../../config/env-vars.ts";
 import { pruneFinishedRuns, pruneUserLevelRuns } from "../../extension/run-maintenance.ts";
 import { type BrokerSpawnCredentials, setActiveBrokerIssuer } from "../../runtime/broker/broker-issuer.ts";
 import { CrewBroker } from "../../runtime/broker/crew-broker.ts";
 import { terminateActiveChildPiProcesses } from "../../runtime/child-pi/child-pi.ts";
+import { forgetDetachedRun, hasDetachedRuns, peekFinishedDetachedRunResults } from "../../runtime/detached-run-results.ts";
 import { listLiveAgents } from "../../runtime/live-session/live-agent-manager.ts";
 import type { createManifestCache } from "../../runtime/manifest-cache.ts";
-import { cleanupLegacyOrphanTempDirs, cleanupOrphanTempDirs, currentCrewDepth } from "../../runtime/model/pi-args.ts";
+import { configuredModelInfosFromPiConfig } from "../../runtime/model/model-fallback.ts";
+import { cleanupLegacyOrphanTempDirs, cleanupOrphanTempDirs, currentCrewDepth, resolveCrewMaxDepth } from "../../runtime/model/pi-args.ts";
 import { clearProviderQuotaCache, noteProviderResponse } from "../../runtime/model/provider-quota.ts";
 import { noteSessionModel, noteSessionThinking, resolveProviderForResponse } from "../../runtime/model/session-model.ts";
 import { cleanupOrphanWorkers } from "../../runtime/orphan-worker-registry.ts";
@@ -33,11 +36,13 @@ import { reconcileAllStaleRuns } from "../../runtime/recovery/crash-recovery.ts"
 import { CrewScheduler, type ScheduledJob } from "../../runtime/scheduling/scheduler.ts";
 import { tryRegisterSessionCleanup } from "../../runtime/session-resources.ts";
 import { createSessionSnapshot } from "../../runtime/session-snapshot.ts";
-import { applyCrewSettingsToConfig, loadCrewSettings } from "../../runtime/settings-store.ts";
+import { applyCrewSettingsTiersToConfig, loadCrewSettingsTiers } from "../../runtime/settings-store.ts";
 import { loadRunManifestById } from "../../state/stores/state-store.ts";
 import type { TeamRunManifest } from "../../state/types.ts";
 import { summarizeHeartbeats } from "../../ui/heartbeat-aggregator.ts";
-import { requestRender, setExtensionWidget } from "../../ui/pi-ui-compat.ts";
+import { installInlinePanel } from "../../ui/inline-panel/index.ts";
+import { clearSessionSwitchInFlight, markSessionSwitchInFlight } from "../../ui/inline-panel/view-session-store.ts";
+import { requestRender, setExtensionWidget, toPiWidgetPlacement } from "../../ui/pi-ui-compat.ts";
 import {
 	registerPiCrewPowerbarSegments,
 	requestPowerbarUpdate,
@@ -73,6 +78,36 @@ export function installSessionLifecycleHandlers(pi: ExtensionAPI, ctx: Registrat
 	installModelTrackingHandlers(pi);
 }
 
+/**
+ * Hand over the outcome of runs detached by an agent-view switch.
+ *
+ * Delivered as a DISPLAYED session entry (not a follow-up queue item): an idle
+ * session never flushes a follow-up, so the queued variant left the result
+ * invisible. Each result is dropped from the registry only after its send
+ * succeeded, and only while the owning session is current — a worker's view
+ * session must never receive the parent run's report.
+ */
+function deliverDetachedRunResults(pi: ExtensionAPI, extensionCtx: ExtensionContext): void {
+	if (!hasDetachedRuns()) return;
+	try {
+		// Agent views are in-document panes now, never sessions: the current
+		// session is always the main one, so detached results always deliver.
+		const inViewSession = false;
+		for (const { runId, text } of peekFinishedDetachedRunResults({ inViewSession })) {
+			pi.sendMessage({ customType: "pi-crew-run-result", content: text, display: true });
+			forgetDetachedRun(runId);
+			try {
+				extensionCtx.ui.notify(text.split("\n")[0] ?? `pi-crew run finished: ${runId}`, "info");
+			} catch {
+				/* toast is secondary to the session entry */
+			}
+		}
+	} catch (error) {
+		// Keep the entry: the next tick retries rather than losing the outcome.
+		logInternalError("register.detachedRunResults", error);
+	}
+}
+
 /**
  * model_select / thinking_level_select:
  *   Track what the MAIN session is *actually* running so subagents that
@@ -123,6 +158,12 @@ function installSessionShutdownHandler(pi: ExtensionAPI, ctx: RegistrationContex
  */
 function installSessionBeforeSwitchHandler(pi: ExtensionAPI, ctx: RegistrationContext): void {
 	pi.on("session_before_switch", () => {
+		// The switch tears the current turn down right after this handler
+		// (teardownCurrent → session.abort()). That turn-abort must NOT cancel
+		// a foreground team run that is still forming (see run-deadline.ts):
+		// foreground runs survive session switches (P0). Cleared on the next
+		// session_start.
+		markSessionSwitchInFlight();
 		ctx.sessionGeneration++;
 		const pendingCount = ctx.lifecycleState.deliveryCoordinator?.getPendingCount() ?? 0;
 		try {
@@ -165,6 +206,9 @@ function installSessionBeforeSwitchHandler(pi: ExtensionAPI, ctx: RegistrationCo
  */
 function installSessionStartHandler(pi: ExtensionAPI, ctx: RegistrationContext): void {
 	pi.on("session_start", (_event, extensionCtx) => {
+		// Any session start means a pending switch landed — the turn-abort
+		// suppression window for that switch is over.
+		clearSessionSwitchInFlight();
 		runArtifactCleanup(extensionCtx.cwd);
 
 		// Restore brief mode state from session entries (best-effort).
@@ -215,8 +259,18 @@ function installSessionStartHandler(pi: ExtensionAPI, ctx: RegistrationContext):
 		}, 0);
 
 		const loadedConfig = loadConfig(extensionCtx.cwd);
-		const crewSettings = loadCrewSettings(extensionCtx.cwd);
-		applyCrewSettingsToConfig(loadedConfig.config, crewSettings);
+		// Wave 2B (P1 security): crew settings load as TIERS — the project-tier
+		// <cwd>/.pi/crew-settings.json is untrusted (a cloned repo can ship it)
+		// and now goes through sanitizeProjectConfig + tighten-only guard
+		// tiering instead of being applied raw over the sanitized config (the
+		// pre-2B `loadCrewSettings` + `applyCrewSettingsToConfig` bypass).
+		// See src/runtime/settings-store.ts for the tier pipeline + the
+		// scheduledJobs/schedulingEnabled boundary decision.
+		const crewSettingsTiers = loadCrewSettingsTiers(extensionCtx.cwd);
+		const settingsWarnings = applyCrewSettingsTiersToConfig(loadedConfig.config, crewSettingsTiers);
+		if (settingsWarnings.length > 0) {
+			(loadedConfig.warnings ??= []).push(...settingsWarnings);
+		}
 
 		// Start scheduler with event-based executor
 		const sessionId =
@@ -229,14 +283,20 @@ function installSessionStartHandler(pi: ExtensionAPI, ctx: RegistrationContext):
 		// Wire scheduler into handle-schedule.ts so handlers can add/list jobs.
 		// EXT-9: module-scoped setter (was globalThis[Symbol.for(...)]).
 		registerCrewScheduler(ctx.crewScheduler);
-		// Load scheduled jobs from settings if present
-		if (Array.isArray(crewSettings.scheduledJobs)) {
-			for (const job of crewSettings.scheduledJobs) {
-				try {
-					ctx.crewScheduler.add(job as ScheduledJob);
-				} catch {
-					/* skip invalid */
-				}
+		// Load scheduled jobs from settings if present.
+		// BOUNDARY (Wave B2): project-tier scheduledJobs are OPT-IN GATED — the
+		// registration loop reads the gated `effectiveScheduledJobs` view (user
+		// jobs always; project jobs ONLY when the user-tier global file has BOTH
+		// schedulingEnabled:true AND allowProjectScheduledJobs:true).
+		// <cwd>/.pi/crew-settings.json remains the persistence store for the
+		// user's own `crew schedule add/update/remove` commands (handle-schedule.ts),
+		// so crew-schedule users must set both flags in ~/.pi/crew-settings.json.
+		// `schedulingEnabled` is user-tier-only (project values always dropped).
+		for (const job of crewSettingsTiers.effectiveScheduledJobs) {
+			try {
+				ctx.crewScheduler.add(job as ScheduledJob);
+			} catch {
+				/* skip invalid */
 			}
 		}
 		ctx.autoRecoveryLast.clear();
@@ -255,6 +315,13 @@ function installSessionStartHandler(pi: ExtensionAPI, ctx: RegistrationContext):
 		});
 		const cache = ctx.getManifestCache(extensionCtx.cwd);
 		updateCrewWidget(extensionCtx, ctx.widgetState, loadedConfig.config.ui, cache, ctx.getRunSnapshotCache(extensionCtx.cwd));
+		// Inline agent panel: keyboard-navigable rows under the prompt + per-agent
+		// transcript pane. Installed after the widget so the row projection sees
+		// the same caches the widget paint uses.
+		installInlinePanel(pi, extensionCtx, loadedConfig.config.ui);
+		// Returning from an agent view lands here: report any detached run that
+		// finished while the view was open, without waiting for a render tick.
+		deliverDetachedRunResults(pi, extensionCtx);
 		updatePiCrewPowerbar(
 			pi.events,
 			extensionCtx.cwd,
@@ -540,6 +607,44 @@ export function filterManifestsForHealthNotifications(
 	return manifests.filter((run) => !run.ownerSessionId || run.ownerSessionId === currentSessionId);
 }
 
+/**
+ * bug-026 sub-issue C: runEventBus event types that mark a run TERMINAL,
+ * across BOTH type namespaces seen on the bus — dotted `run.*` strings (kept
+ * for parity with classifyEventChannel's WORKER_LIFECYCLE_TYPES, see
+ * src/ui/run-event-bus.ts:31-44) and underscore `run_*` (the native
+ * RunEventType namespace actually emitted by team-runner, e.g.
+ * `run_completed`). Exported for unit testing.
+ */
+export const TERMINAL_RUN_EVENT_TYPES: ReadonlySet<string> = new Set([
+	"run.completed",
+	"run.failed",
+	"run.cancelled",
+	"run_completed",
+	"run_failed",
+	"run_cancelled",
+]);
+
+/** True when a runEventBus event type marks the run terminal (either namespace). */
+export function isTerminalRunEventType(type: string): boolean {
+	return TERMINAL_RUN_EVENT_TYPES.has(type);
+}
+
+/** Pure filter: drop `runId` from a preloaded-manifest frame (bug-026 sub-issue C eviction). */
+export function evictRunFromManifests(manifests: TeamRunManifest[], runId: string): TeamRunManifest[] {
+	return manifests.filter((m) => m.runId !== runId);
+}
+
+/**
+ * Apply a runEventBus payload to a preloaded-manifest frame: evict the run on
+ * terminal events, pass through unchanged otherwise. This is the exact logic
+ * wired into the setupRenderLoop `runEventBus.onAny` subscription (bug-026
+ * sub-issue C); exported so tests can exercise it end-to-end against the
+ * real bus without spinning up the full render loop.
+ */
+export function applyTerminalRunEventToManifests(manifests: TeamRunManifest[], event: { type: string; runId: string }): TeamRunManifest[] {
+	return isTerminalRunEventType(event.type) ? evictRunFromManifests(manifests, event.runId) : manifests;
+}
+
 function setupRenderLoop(
 	pi: ExtensionAPI,
 	ctx: RegistrationContext,
@@ -625,13 +730,14 @@ function setupRenderLoop(
 
 	const renderTick = (): void => {
 		if (!ctx.currentCtx) return;
+		deliverDetachedRunResults(pi, ctx.currentCtx);
 		const config = lastPreloadedConfig?.config.ui;
 		const activeCache = lastFrameManifestCache ?? ctx.getManifestCache(ctx.currentCtx.cwd);
 		const snapshotCache = lastFrameSnapshotCache ?? ctx.getRunSnapshotCache(ctx.currentCtx.cwd);
 		const manifests = lastPreloadedManifests;
 		if (!lastPreloadedConfig) backgroundPreload();
 		if (ctx.uiState.liveSidebarRunId || ctx.uiState.dashboardOpen) {
-			const placement = config?.widgetPlacement ?? DEFAULT_UI.widgetPlacement;
+			const placement = toPiWidgetPlacement(config?.widgetPlacement ?? DEFAULT_UI.widgetPlacement);
 			if (ctx.widgetState.lastVisibility !== "hidden" || ctx.widgetState.lastPlacement !== placement) {
 				setExtensionWidget(ctx.currentCtx, "pi-crew", undefined, { placement });
 				setExtensionWidget(ctx.currentCtx, "pi-crew-active", undefined, { placement });
@@ -803,6 +909,12 @@ function setupRenderLoop(
 	// re-renders within debounceMs of any agent lifecycle event.
 	const sched = ctx.renderScheduler;
 	const unsubscribeRunEvents = runEventBus.onAny((event) => {
+		// bug-026 sub-issue C: evict terminal runs from the preloaded manifest
+		// frame so a stale "running" entry cannot persist for the session
+		// lifetime. Additive to the renderTick GATE 1 / FIX #1 / GATE 2 snapshot
+		// purges (which invalidate the snapshot cache) — those gates do not
+		// touch lastPreloadedManifests itself.
+		lastPreloadedManifests = applyTerminalRunEventToManifests(lastPreloadedManifests, event);
 		sched.schedule({
 			runId: event.runId,
 			source: "runEventBus",
@@ -905,7 +1017,7 @@ export function installCrewBrokerLifecycleController(_pi: ExtensionAPI, _ctx: Re
 
 	function effectiveEnabled(): boolean {
 		// Env wins over config. PI_CREW_BROKER=1 forces on, =0 forces off.
-		const envOverride = process.env.PI_CREW_BROKER;
+		const envOverride = getCrewEnv("PI_CREW_BROKER");
 		if (envOverride === "0") return false;
 		// Config block: read fresh so a runtime config update takes effect.
 		try {
@@ -934,7 +1046,23 @@ export function installCrewBrokerLifecycleController(_pi: ExtensionAPI, _ctx: Re
 			starting = (async () => {
 				const cfg = (() => {
 					try {
-						return loadConfig().config.broker;
+						// B1 battery 2026-08-18 (third config-layer bug): loadConfig()
+						// WITHOUT cwd reads only the user config — the workspace
+						// .crew/config.json (where broker.waitMethodsEnabled:true would
+						// live) was never merged, so the flag stayed default-false even
+						// after the parser + merge fixes. Pass the SAME cwd the broker
+						// itself uses below.
+						return loadConfig(process.cwd()).config.broker;
+					} catch {
+						return undefined;
+					}
+				})();
+				// T3/R5 (ADR-5 §10): governed-nesting + limits config for the delegate
+				// surface — same cwd discipline as the broker block above.
+				const nestingCfg = (() => {
+					try {
+						const c = loadConfig(process.cwd()).config;
+						return { nesting: c.nesting, limits: c.limits };
 					} catch {
 						return undefined;
 					}
@@ -944,6 +1072,32 @@ export function installCrewBrokerLifecycleController(_pi: ExtensionAPI, _ctx: Re
 					socketPath: getBrokerSocketPath(sessionId),
 					maxFrameBytes: cfg?.maxFrameBytes ?? 262144,
 					outboundQueueCap: cfg?.outboundQueueCap ?? 256,
+					// WP-2 review round 1 (P1): thread the capability gate into the
+					// PRODUCTION broker — the constructor default (false) made
+					// config.broker.waitMethodsEnabled a dead knob and the ADR-0
+					// "then true" flip a silent no-op. Fail-closed when unset.
+					waitMethodsEnabled: cfg?.waitMethodsEnabled ?? false,
+					// T3/R5 (ADR-5 §10): governed-nesting capability gate — fail-closed
+					// default; production threads config.nesting (sensitive: user config
+					// only). Nested-slot sizing + admission-time model catalog (ADR-5 §7 —
+					// the production wiring MUST supply it) + workspace gate mirror.
+					nestingEnabled: nestingCfg?.nesting?.enabled ?? false,
+					...(nestingCfg?.nesting?.maxSlots !== undefined ? { nestingMaxSlots: nestingCfg.nesting.maxSlots } : {}),
+					...(nestingCfg?.nesting?.maxDepth !== undefined ? { nestingMaxDepth: nestingCfg.nesting.maxDepth } : {}),
+					// ADR-5 §12: enabling the sensitive USER-config-only flag IS the manual
+					// trust decision for the escalation surface.
+					nestingTrustedEscalation: nestingCfg?.nesting?.enabled === true,
+					...(nestingCfg?.limits?.maxConcurrentWorkers !== undefined
+						? { globalWorkerSemaphore: nestingCfg.limits.maxConcurrentWorkers }
+						: {}),
+					serializeOnPathOverlap: nestingCfg?.limits?.serializeOnPathOverlap ?? false,
+					modelCatalog: () => {
+						try {
+							return configuredModelInfosFromPiConfig(process.cwd()).map((info) => info.fullId);
+						} catch {
+							return undefined;
+						}
+					},
 					enabled: true,
 					cwd: process.cwd(),
 				});
@@ -960,10 +1114,17 @@ export function installCrewBrokerLifecycleController(_pi: ExtensionAPI, _ctx: Re
 		return starting!;
 	}
 
-	const issueForChild = async (runId: string, taskId?: string): Promise<BrokerSpawnCredentials | undefined> => {
+	const issueForChild = async (runId: string, taskId?: string, childDepth?: number): Promise<BrokerSpawnCredentials | undefined> => {
 		if (!runId || typeof runId !== "string") return undefined;
 		if (!isRootSession(process.env)) return undefined;
 		if (!effectiveEnabled()) return undefined;
+		// ADR-5 §4 (governed nesting): tokens are minted ONLY for children that
+		// may themselves delegate — childDepth < resolved maxDepth. At the default
+		// maxDepth=2 a delegate-spawned depth-2 grandchild gets NO credentials
+		// (env containment: no PI_CREW_BROKER_SOCKET/TOKEN at depth 2; identity
+		// routing via PI_CREW_BROKER_RUN_ID/TASK_ID is threaded unconditionally
+		// elsewhere). Undefined childDepth = legacy worker spawn (depth 1).
+		if (childDepth !== undefined && childDepth >= resolveCrewMaxDepth(undefined)) return undefined;
 		const sessionId = cachedSessionId;
 		if (!sessionId) return undefined;
 		try {

package/src/extension/registration/runtime-cleanup.ts

@@ -20,12 +20,12 @@
 import type { ExtensionAPI } from "@earendil-works/pi-coding-agent";
 import { loadConfig } from "../../config/config.ts";
 import { clearHooksScoped } from "../../hooks/registry.ts";
-import { terminateActiveChildPiProcesses } from "../../runtime/child-pi/child-pi.ts";
 import { stopAllWatchdogs } from "../../runtime/foreground-watchdog.ts";
 import { clearPiCrewPowerbar, disposePowerbarCoalescer } from "../../ui/powerbar-publisher.ts";
 import { stopCrewWidget } from "../../ui/widget/index.ts";
 import { logInternalError } from "../../utils/internal-error.ts";
 import { clearProjectRootCache } from "../../utils/paths.ts";
+import { safeAbortAll } from "../../utils/safe-abort.ts";
 import { extractSessionId } from "../../utils/session-utils.ts";
 import { stopAsyncRunNotifier } from "../async-notifier.ts";
 import { uninstallCrewGlobalRegistry } from "../team-tool.ts";
@@ -135,7 +135,9 @@ function buildCleanupRuntime(ctx: RegistrationContext): () => void {
 		ctx.stopSessionBoundSubagents();
 		// P0 fix: also abort foreground team runs on session shutdown (not on session switch).
 		// This is the only place where foreground team run controllers should be aborted.
-		for (const controller of ctx.foregroundTeamRunControllers.values()) controller.abort();
+		// safe-abort: shutdown races completed runs whose spawned children already
+		// exited — abort() would throw AbortError from Node's child_process listener.
+		safeAbortAll(ctx.foregroundTeamRunControllers.values(), "cleanup-runtime.foreground-team");
 		ctx.foregroundTeamRunControllers.clear();
 		// RC-01: stop the foreground-run watchdog timers on full shutdown — they were
 		// never cleared, so an active (non-terminal) foreground run left its watchdog
@@ -219,10 +221,26 @@ function buildStopSessionBoundSubagents(ctx: RegistrationContext): () => void {
 		// Only abort subagent controllers — NOT foreground team runs.
 		// Foreground team runs are bound to the session lifecycle; they will be aborted
 		// by cleanupRuntime during session_shutdown.
-		for (const controller of ctx.foregroundControllers.values()) controller.abort();
+		// safe-abort: these signals may be linked to spawned children (pipelines pass
+		// them into spawn options.signal); aborting after a child exited makes Node's
+		// child_process listener throw AbortError synchronously — inside a session
+		// event handler that would surface as uncaughtException and kill pi.
+		safeAbortAll(ctx.foregroundControllers.values(), "stop-session-bound.foreground");
 		ctx.foregroundControllers.clear();
-		ctx.subagentManager.abortAll("Session switching — foreground subagents cancelled.");
-		terminateActiveChildPiProcesses();
+		try {
+			ctx.subagentManager.abortAll("Session switching — foreground subagents cancelled.");
+		} catch (error) {
+			logInternalError("stop-session-bound.abortAll", error);
+		}
+		// Deliberately NOT terminateActiveChildPiProcesses() here: the active
+		// child registry holds EVERY child pi spawned in this process —
+		// including foreground team-run workers. Killing them on a session
+		// switch (resume/new/fork) is exactly the regression "jumping into any
+		// session stops the run" (exit 143). Session-bound subagents are
+		// cancelled above via their own controllers; foreground runs must
+		// survive switches (P0) and are aborted only by cleanupRuntime on real
+		// shutdown; the process-exit hook (tryRegisterSessionCleanup) drains
+		// the registry when pi actually exits.
 		ctx.disposeRenderSchedulerSubscriptions();
 		ctx.renderScheduler?.dispose();
 		ctx.renderScheduler = undefined;