pi-crew 0.9.68 → 0.10.2

package/src/ui/widget/widget-renderer.ts

@@ -4,18 +4,30 @@
  * Extracted from crew-widget.ts.
  */
 
+import type { CrewAgentRecord } from "../../runtime/crew-agent-runtime.ts";
 import { listLiveAgents } from "../../runtime/live-session/live-agent-manager.ts";
+import { isPlanApprovalStatePending } from "../../runtime/plan-approval.ts";
 import { isFinishedRunStatus } from "../../runtime/process-status.ts";
+import type { TeamRunManifest } from "../../state/types.ts";
 import { truncate } from "../../utils/visual.ts";
 import { Box, Text } from "../layout-primitives.ts";
 import { spinnerFrame } from "../spinner.ts";
 import { colorizeStatusGlyphs, iconForStatus } from "../status-colors.ts";
 import type { CrewTheme } from "../theme-adapter.ts";
-import { agentActivity, agentStats, notificationBadge } from "./widget-formatters.ts";
+import {
+	agentActivity,
+	agentStats,
+	budgetedRow,
+	dockElapsed,
+	dockStatusIcon,
+	dockStatusLabel,
+	dockUsageText,
+	notificationBadge,
+} from "./widget-formatters.ts";
 import { activeWidgetRuns, shortRunLabel } from "./widget-model.ts";
 import type { WidgetRun } from "./widget-types.ts";
 
-const MAX_AGENTS_DISPLAY = 3;
+export const MAX_AGENTS_DISPLAY = 3;
 const FINISHED_LINGER_MAX_AGE = 1;
 /** Default terminal width when caller doesn't pass one explicitly. Keep <= 116
  * (the same default used elsewhere in pi-crew tool renderers) so we never paint
@@ -42,8 +54,192 @@ export function widgetHeader(runs: WidgetRun[], runningGlyph: string, maxLines =
 	return `${runningGlyph} Crew agents${notificationBadge(notificationCount)} · ${parts.join(" · ")} · /team-dashboard`;
 }
 
+// ── Agent ordering (shared with the inline panel) ──────────────────────
+
+/**
+ * L-4: prioritize RUNNING > QUEUED > WAITING so the most relevant live workers
+ * are always shown first. Finished rows fill only the leftover budget and never
+ * steal a slot from an active agent.
+ */
+const ACTIVE_PRIORITY: Record<string, number> = { running: 0, queued: 1, waiting: 2 };
+
+function isActiveStatus(status: string): boolean {
+	return status === "running" || status === "queued" || status === "waiting";
+}
+
+/**
+ * The agent order the widget paints, split into its two sections.
+ *
+ * Exported because the inline panel navigates the same list: if the panel
+ * derived its own order, the cursor index would drift from the rendered rows.
+ * One function, one order.
+ */
+export function orderWidgetAgents(entry: WidgetRun, now = Date.now()): { active: CrewAgentRecord[]; finished: CrewAgentRecord[] } {
+	const runDone = isFinishedRunStatus(entry.run.status);
+	const active = entry.agents.filter((agent) => isActiveStatus(agent.status));
+	const finished = entry.agents.filter((agent) => {
+		if (isActiveStatus(agent.status)) return false;
+		if (!agent.completedAt) return false;
+		// Mid-run, finished agents are the run's HISTORY: they must stay in
+		// the dock until the RUN itself is done, not age out after a minute
+		// while later phases are still working. The linger windows below only
+		// apply once the run reached a terminal status (and the run-level
+		// visibility grace then decides how much longer the dock shows at all).
+		if (!runDone) return true;
+		const maxAgeMs = (ERROR_STATUSES.has(agent.status) ? ERROR_LINGER_MAX_AGE : FINISHED_LINGER_MAX_AGE) * 60_000;
+		const age = now - new Date(agent.completedAt).getTime();
+		return Number.isFinite(age) && age < maxAgeMs;
+	});
+	return {
+		active: [...active].sort((a, b) => (ACTIVE_PRIORITY[a.status] ?? 9) - (ACTIVE_PRIORITY[b.status] ?? 9)),
+		finished,
+	};
+}
+
 // ── Line builder ──────────────────────────────────────────────────────
 
+/**
+ * Row layout for the per-agent lines.
+ *
+ * - `detailed` — the historical two-line tree (name row + `⊶ activity` row).
+ * - `compact`  — one width-budgeted line per agent, so a wide terminal shows the
+ *   full description instead of the same clip a narrow one gets.
+ */
+export type WidgetRowStyle = "compact" | "detailed";
+
+export interface WidgetRenderOptions {
+	rowStyle?: WidgetRowStyle;
+	/** Task id under the inline panel cursor, if any. */
+	selectedTaskId?: string;
+	/** Task id whose transcript pane is open, if any. */
+	viewedTaskId?: string;
+	/**
+	 * True while the inline panel holds the cursor. Every agent is then listed
+	 * (no MAX_AGENTS_DISPLAY cap) so keyboard navigation can reach all of them;
+	 * the idle widget stays capped to keep the prompt area small.
+	 */
+	focused?: boolean;
+}
+
+/** Short display form of a model id: `zai/glm-5.3` → `glm-5.3`. */
+function shortModelLabel(agent: CrewAgentRecord, run: TeamRunManifest): string | undefined {
+	const model = agent.model ?? run.modelContext?.parentModel ?? run.modelContext?.override;
+	if (typeof model !== "string" || !model) return undefined;
+	return model.split("/").at(-1) ?? model;
+}
+
+/** One flat dock row (pi-subtask style) for an agent — active or finished. */
+function compactAgentRow(
+	run: TeamRunManifest,
+	agent: CrewAgentRecord,
+	finished: boolean,
+	runs: readonly WidgetRun[],
+	options: WidgetRenderOptions,
+	width: number,
+	liveHandle: ReturnType<typeof listLiveAgents>[number] | undefined,
+): string {
+	const marker = options.selectedTaskId === agent.taskId ? "❯" : " ";
+	const dockGlyph = options.viewedTaskId === agent.taskId ? "⏺" : dockStatusIcon(agent.status);
+	const name = liveHandle?.agent ?? agent.agent;
+	const label = liveHandle?.description ?? agent.role ?? "";
+	// Task-first: the agent exists to run its task, so the row names the task
+	// right after the agent. With multiple runs, prefix each row with its run
+	// label so the flat dock still says which run an agent belongs to.
+	const runTag = runs.length > 1 ? `${shortRunLabel(run)} · ` : "";
+	const taskTag = agent.taskId ? ` · ${agent.taskId}` : "";
+	const roleTag = label && label !== agent.taskId && label !== name ? ` · ${label}` : "";
+	const nameText = runTag + name + taskTag + roleTag;
+	// pi-subtask activity: the worker's latest line while running, otherwise
+	// the status word.
+	const liveLine = liveHandle?.activity?.responseText
+		?.split("\n")
+		.find((line) => line.trim())
+		?.trim();
+	const activity =
+		!finished && liveHandle?.status === "running" && liveLine
+			? liveLine.length > 60
+				? `${liveLine.slice(0, 60)}…`
+				: liveLine
+			: finished
+				? dockStatusLabel(agent.status)
+				: agentActivity(agent, liveHandle);
+	const usage = dockUsageText(agent, liveHandle, { viewed: options.viewedTaskId === agent.taskId });
+	const ageText = dockElapsed(agent.completedAt ?? agent.startedAt);
+	const model = shortModelLabel(agent, run);
+	// Stats tail: `· glm-5.3 · ↑1.2k ↓350 · 41s` — the model the worker is
+	// actually on first, then usage, then elapsed.
+	const suffix = `${model ? ` · ${model}` : ""}${usage ? ` · ${usage}` : ""}${ageText ? ` · ${ageText}` : ""}`;
+	return budgetedRow({ lead: `${marker} ${dockGlyph} `, name: nameText, activity, suffix }, width);
+}
+
+/**
+ * The compact dock: hint line, the `main` conversation row, then a
+ * MAX_AGENTS_DISPLAY-row SCROLL WINDOW over the flat agent list (exactly the
+ * order the inline panel navigates — `panelRowsFromRuns` parity). The window
+ * follows the panel selection bottom-pinned: moving the cursor past the
+ * window scrolls one row at a time and the ❯ marker is always painted; idle
+ * (no selection) shows the top of the list, which the shared ordering puts at
+ * the highest-priority live agents. Hidden rows surface as `… ↑N earlier` /
+ * `… +N more` indicators.
+ */
+function compactDockLines(
+	runs: WidgetRun[],
+	options: WidgetRenderOptions,
+	width: number,
+	maxLines: number,
+	notificationCount: number,
+	runningGlyph: string,
+): string[] {
+	const now = Date.now();
+	const flat: Array<{
+		run: TeamRunManifest;
+		agent: CrewAgentRecord;
+		finished: boolean;
+		liveHandle: ReturnType<typeof listLiveAgents>[number] | undefined;
+	}> = [];
+	for (const entry of runs) {
+		const { active, finished } = orderWidgetAgents(entry, now);
+		const liveForRun = listLiveAgents().filter((a) => a.runId === entry.run.runId);
+		for (const agent of active) {
+			flat.push({ run: entry.run, agent, finished: false, liveHandle: liveForRun.find((h) => h.taskId === agent.taskId) });
+		}
+		for (const agent of finished) {
+			flat.push({ run: entry.run, agent, finished: true, liveHandle: liveForRun.find((h) => h.taskId === agent.taskId) });
+		}
+	}
+
+	// No agents at all: fall back to the legacy header so the space under the
+	// editor is never just blank.
+	if (flat.length === 0) return [widgetHeader(runs, runningGlyph, maxLines, notificationCount)];
+
+	const lines: string[] = [];
+	let hint: string;
+	if (options.viewedTaskId) {
+		const viewedName = flat.find((row) => row.agent.taskId === options.viewedTaskId)?.agent.agent ?? "agent";
+		hint = `viewing @${viewedName} — typing goes to the agent · ↓ switch · esc back`;
+	} else if (options.focused) {
+		hint = "enter to view · x to stop/cancel · esc back";
+	} else {
+		hint = `agents (${flat.length}) — ↓ to select`;
+	}
+	lines.push(truncate(hint, width));
+	// Filled ● = you're on the main conversation; hollow ◯ = an agent view is
+	// open (same convention as pi-subtask's main row).
+	const mainMarker = options.focused && !options.selectedTaskId ? "❯" : " ";
+	const mainIcon = options.viewedTaskId ? "◯" : "●";
+	lines.push(truncate(`${mainMarker} ${mainIcon} main`, width));
+
+	const selectedIndex = options.selectedTaskId ? flat.findIndex((row) => row.agent.taskId === options.selectedTaskId) : -1;
+	const windowStart = selectedIndex >= 0 ? Math.max(0, selectedIndex - MAX_AGENTS_DISPLAY + 1) : 0;
+	const windowEnd = Math.min(flat.length, windowStart + MAX_AGENTS_DISPLAY);
+	if (windowStart > 0) lines.push(truncate(`  … ↑${windowStart} earlier (↑ to scroll)`, width));
+	for (const row of flat.slice(windowStart, windowEnd)) {
+		lines.push(compactAgentRow(row.run, row.agent, row.finished, runs, options, width, row.liveHandle));
+	}
+	if (windowEnd < flat.length) lines.push(truncate(`  … +${flat.length - windowEnd} more (↓ to scroll)`, width));
+	return lines;
+}
+
 export function buildWidgetLines(
 	cwd: string,
 	frame = 0,
@@ -51,7 +247,10 @@ export function buildWidgetLines(
 	providedRuns?: WidgetRun[],
 	notificationCount = 0,
 	width = DEFAULT_WIDGET_WIDTH,
+	options: WidgetRenderOptions = {},
 ): string[] {
+	const rowStyle: WidgetRowStyle = options.rowStyle ?? "detailed";
+	const focused = options.focused === true;
 	// Match the legacy `buildCrewWidgetLines` API: when no runs are supplied,
 	// auto-fetch via activeWidgetRuns(cwd). Otherwise widgets calling with
 	// only `(cwd, frame)` would render an empty line set (regression vs. the
@@ -60,20 +259,29 @@ export function buildWidgetLines(
 	if (!runs.length) return [];
 
 	const runningGlyph = spinnerFrame("widget-header");
+
+	// Compact = pi-subtask's dock: NO "Crew agents" header, NO tree — hint
+	// line, `main` row, then a 3-row scroll window over the flat agent list.
+	if (rowStyle === "compact") {
+		const lines = compactDockLines(runs, options, width, maxLines, notificationCount, runningGlyph);
+		return focused ? lines : lines.slice(0, maxLines);
+	}
+
 	const lines: string[] = [widgetHeader(runs, runningGlyph, maxLines, notificationCount)];
 
-	for (const { run, agents, snapshot } of runs) {
-		const activeAgents = agents.filter((a) => a.status === "running" || a.status === "queued" || a.status === "waiting");
+	for (const entry of runs) {
+		const { run, agents } = entry;
 		const now = Date.now();
-		const finishedAgents = agents.filter((item) => {
-			if (item.status === "running" || item.status === "queued" || item.status === "waiting") return false;
-			if (!item.completedAt) return false;
-			const maxAgeMs = (ERROR_STATUSES.has(item.status) ? ERROR_LINGER_MAX_AGE : FINISHED_LINGER_MAX_AGE) * 60_000;
-			const age = now - new Date(item.completedAt).getTime();
-			return Number.isFinite(age) && age < maxAgeMs;
-		});
+		const { active: activeAgents, finished: finishedAgents } = orderWidgetAgents(entry, now);
 		const completed = agents.filter((a) => a.status === "completed").length;
-		const runGlyph = iconForStatus(run.status, { runningGlyph });
+		// WP-3 (H4): while a run is parked awaiting plan approval, the spinner
+		// glyph is replaced by a `⚠ plan:<last-8 runId>` badge. Plain-unicode ⚠
+		// (the same glyph needs_attention already uses) stays legible in no-color
+		// mode and is colorized by the shared colorizeStatusGlyphs pass. In-place
+		// glyph swap only — no extra line, so the MAX_AGENTS_DISPLAY / maxLines
+		// budget and the truncate(width) rule are untouched.
+		const planPending = isPlanApprovalStatePending(run.planApproval);
+		const runGlyph = planPending ? `⚠ plan:${run.runId.slice(-8)}` : iconForStatus(run.status, { runningGlyph });
 		const isTerminal = isFinishedRunStatus(run.status);
 		// Run progress line. v1–v3 flickered on snapshot.tasks state, v4 was
 		// too minimal (`0/1 agents` only), v5 duplicated the worker activity
@@ -82,11 +290,6 @@ export function buildWidgetLines(
 		// activity line) and is GUARANTEED stable across ticks:
 		//   - agents count — from `agents` array, always populated, never empty.
 		//   - run elapsed   — from `run.createdAt`, always set on manifest.
-		// Both come from sources with no race window — `agents` is read from
-		// snapshot.agents OR agentsFor(run) (both always return same length
-		// for a healthy run), and `run.createdAt` is immutable. The format
-		// shape `"X/Y agents · Ns"` is therefore truly invariant: same number
-		// of `·`-separated fields, same field meanings, every render tick.
 		//
 		// Bug 022 (timer-fix + label): for TERMINAL runs (failed/cancelled/
 		// completed) the elapsed counter previously kept ticking up forever
@@ -104,56 +307,58 @@ export function buildWidgetLines(
 
 		const liveForRun = listLiveAgents().filter((a) => a.runId === run.runId);
 
-		// L-4: prioritize RUNNING > QUEUED > WAITING within the visible window so the
-		// most relevant live workers are always shown. Finished rows fill only the
-		// leftover budget and never steal slots from running agents.
-		const ACTIVE_PRIORITY: Record<string, number> = {
-			running: 0,
-			queued: 1,
-			waiting: 2,
-		};
-		const prioritizedActive = [...activeAgents].sort((a, b) => (ACTIVE_PRIORITY[a.status] ?? 9) - (ACTIVE_PRIORITY[b.status] ?? 9));
+		// Focused: list every agent so the keyboard cursor can reach it. Idle: keep
+		// the historical cap so the prompt area stays small.
+		const activeCap = focused ? activeAgents.length : MAX_AGENTS_DISPLAY;
 		// Finished rows only appear in slots not used by active agents (max 2). When
 		// there are >= MAX_AGENTS_DISPLAY live workers, finished rows are suppressed
 		// entirely so they cannot push a live agent's activity line off-screen.
-		const finishedSlots = Math.max(0, Math.min(2, MAX_AGENTS_DISPLAY - activeAgents.length));
+		const finishedSlots = focused ? finishedAgents.length : Math.max(0, Math.min(2, MAX_AGENTS_DISPLAY - activeAgents.length));
+
+		/** Cursor marker column, mirroring the inline panel's selection. */
+		const markerFor = (taskId: string): string => (options.selectedTaskId === taskId ? "❯" : " ");
 
-		const visibleAgents = prioritizedActive.slice(0, MAX_AGENTS_DISPLAY);
+		const visibleAgents = activeAgents.slice(0, activeCap);
 		for (const [index, agent] of visibleAgents.entries()) {
-			const last = index === visibleAgents.length - 1 && activeAgents.length <= MAX_AGENTS_DISPLAY && finishedSlots === 0;
+			const last = index === visibleAgents.length - 1 && activeAgents.length <= activeCap && finishedSlots === 0;
 			const branch = last ? "└─" : "├─";
-			const agentGlyph = iconForStatus(agent.status, { runningGlyph });
 			const liveHandle = liveForRun.find((h) => h.taskId === agent.taskId);
+			const legacyGlyph = options.viewedTaskId === agent.taskId ? "◉" : iconForStatus(agent.status, { runningGlyph });
 			const stats = agentStats(agent, liveHandle);
 			const name = liveHandle?.agent ?? agent.agent;
+			const activity = agentActivity(agent, liveHandle);
 			const desc = truncate(liveHandle?.description ?? agent.role ?? "", TASK_DESC_MAX);
-			const _activeMain = truncate(`│  ${branch} ${agentGlyph} ${name}${desc ? ` · ${desc}` : ` · ${agent.role}`}`, width);
+			const _activeMain = truncate(`│  ${branch} ${legacyGlyph} ${name}${desc ? ` · ${desc}` : ` · ${agent.role}`}`, width);
 			lines.push(_activeMain);
-			const _activity = truncate(`│     ⊶ ${agentActivity(agent, liveHandle)}${stats ? ` · ${stats}` : ""}`, width);
+			const _activity = truncate(`│     ⊶ ${activity}${stats ? ` · ${stats}` : ""}`, width);
 			lines.push(_activity);
 		}
 
-		if (activeAgents.length > MAX_AGENTS_DISPLAY) {
-			lines.push(truncate(`│  └─ … +${activeAgents.length - MAX_AGENTS_DISPLAY} more agents`, width));
+		if (activeAgents.length > activeCap) {
+			lines.push(truncate(`│  └─ … +${activeAgents.length - activeCap} more agents`, width));
 		}
 
 		for (const [index, agent] of finishedAgents.slice(0, finishedSlots).entries()) {
 			const liveHandle = liveForRun.find((h) => h.taskId === agent.taskId);
 			const name = liveHandle?.agent ?? agent.agent;
-			const icon =
+			const legacyIcon =
 				agent.status === "completed" ? "✓" : agent.status === "failed" ? "✗" : agent.status === "needs_attention" ? "⚠" : "▪";
 			const stats = agentStats(agent, liveHandle);
 			const desc = truncate(liveHandle?.description ?? agent.role ?? "", TASK_DESC_MAX);
 			const isLastFinished = index === Math.min(finishedAgents.length, finishedSlots) - 1;
 			const branch = isLastFinished ? "└─" : "├─";
-			const _finished = truncate(`│  ${branch} ${icon} ${name} · ${desc}${stats ? ` · ${stats}` : ""}`, width);
+			const _finished = truncate(`│  ${branch} ${legacyIcon} ${name} · ${desc}${stats ? ` · ${stats}` : ""}`, width);
 			lines.push(_finished);
 		}
 
-		if (lines.length >= maxLines) break;
+		// Focused (inline panel cursor active): the keyboard can reach every
+		// agent, so the renderer must list them ALL — clipping here would put
+		// the cursor marker (❯) on rows that are never painted. The idle
+		// widget keeps its historical cap to hold the prompt area small.
+		if (lines.length >= maxLines && !focused) break;
 	}
 
-	return lines.slice(0, maxLines);
+	return focused ? lines : lines.slice(0, maxLines);
 }
 
 // ── Colorization ──────────────────────────────────────────────────────

package/src/ui/widget/widget-types.ts

@@ -24,16 +24,27 @@ export interface CrewWidgetModel {
 	/** P3 (#9): workspace/session ID for filtering runs by ownerSessionId
 	 * on every render, not just the first frame. */
 	workspaceId?: string;
+	/** Per-agent row layout; defaults to the historical two-line tree. */
+	rowStyle?: import("./widget-renderer.ts").WidgetRowStyle;
 }
 
 export interface CrewWidgetState {
 	frame: number;
 	lastPlacement?: string;
 	lastVisibility?: "hidden" | "visible";
+	/** Whether the aboveEditor task-list widget (pi-crew-tasks) is mounted. */
+	lastTasksVisibility?: "hidden" | "visible";
 	lastKey?: string;
 	lastMaxLines?: number;
 	lastCwd?: string;
 	legacyCleared?: boolean;
 	model?: CrewWidgetModel;
 	notificationCount?: number;
+	/**
+	 * Non-serializable dock host used when `widgetPlacement` is `"bottom"`:
+	 * the dock renders through the crew-vibes footer instead of a pi widget
+	 * slot. Kept off `model` so serialization/persistence of the rest of the
+	 * state stays unaffected.
+	 */
+	footerDock?: { render(width: number): string[]; dispose(): void };
 }

package/src/utils/child-process-shield.ts

@@ -0,0 +1,106 @@
+/**
+ * child-process-shield.ts — stop abort-driven child-process errors from
+ * killing the host pi process.
+ *
+ * THE CRASH
+ * ---------
+ * Node spawns a child with `options.signal` and the signal fires while that
+ * child is still tracked (before its 'exit' event has dispatched), Node runs:
+ *
+ *   abortChildProcess(child, killSignal, reason)
+ *     try { if (child.kill(killSignal)) {
+ *       child.emit("error", new AbortError(...))   // node:child_process
+ *     } } catch (err) { child.emit("error", err); }
+ *
+ * `child.emit("error", ...)` THROWS synchronously when the ChildProcess has
+ * no 'error' listener (EventEmitter 'error'-event semantics). That throw is
+ * captured by the AbortSignal dispatch machinery and re-thrown on the next
+ * tick (`process.nextTick(() => { throw err; })`, node:internal/event_target)
+ * — OUTSIDE any try/catch, so it surfaces as `uncaughtException` and pi dies
+ * (`pi exiting due to uncaughtException: AbortError: The operation was
+ * aborted`). This is exactly the crash seen on /crew-view session switches
+ * mid-foreground-run: the run's signal propagates into the vendored pi SDK's
+ * session machinery, an internal controller abort reaches a signal-spawned
+ * child with no error listener, and the terminal dies.
+ *
+ * IMPORTANT: because the rethrow is asynchronous (next tick), wrapping the
+ * AbortController.abort() call in try/catch (see safe-abort.ts) CANNOT stop
+ * it. The only reliable fix is to make sure the spawned child ALWAYS has an
+ * 'error' listener before an abort can fire, so child.emit("error", ...)
+ * dispatches instead of throwing.
+ *
+ * THE SHIELD
+ * ----------
+ * 1. `ChildProcess.prototype.kill` — every abort path in node runs through
+ *    `child.kill()` FIRST (abortChildProcess calls it before emitting), so a
+ *    no-op 'error' listener attached inside kill() protects every signal-
+ *    spawned child IN THE PROCESS, regardless of when the spawning module
+ *    captured its `spawn` reference (the vendored SDK may bind `spawn` at a
+ *    point we cannot observe).
+ * 2. `child_process.spawn` wrapper — attaches the same no-op 'error' listener
+ *    at spawn time when `options.signal` is present, so the listener exists
+ *    before Node's pre-aborted-signal nextTick abort and before spawn-failure
+ *    errors (ENOENT) are emitted.
+ *
+ * The no-op listener never swallows anything a consumer cares about: 'error'
+ * events still reach every other listener (multiple listeners run), and code
+ * that previously died on an unhandled 'error' event keeps its semantics for
+ * genuinely broken spawns — it just no longer takes down the whole pi process
+ * for the abort-after-exit case, which is a semantic no-op by definition (the
+ * child was already gone).
+ */
+import type { ChildProcess } from "node:child_process";
+import { createRequire } from "node:module";
+
+const require = createRequire(import.meta.url);
+const childProcessModule = require("node:child_process") as {
+	spawn: (file: string, args?: readonly string[] | undefined, options?: object) => ChildProcess;
+	ChildProcess: { prototype: { kill: (signal?: number | string) => boolean } };
+};
+
+const SHIELD_MARKER = Symbol.for("pi-crew.childProcessAbortShieldInstalled");
+
+/** No-op 'error' listener: prevents the EventEmitter throw, never filters data. */
+function shieldErrorListener(): void {
+	/* deliberately empty — see module docstring */
+}
+
+/**
+ * Install the child-process abort shield. Idempotent: subsequent calls are
+ * no-ops. MUST be called at extension registration, before any team run can
+ * start (the vendored SDK is imported lazily later, so any spawn it binds
+ * afterwards already sees the shielded spawn).
+ */
+export function installChildProcessAbortShield(): void {
+	const proto = childProcessModule.ChildProcess.prototype as typeof childProcessModule.ChildProcess.prototype & {
+		[SHIELD_MARKER]?: boolean;
+	};
+	if (proto[SHIELD_MARKER]) return;
+
+	const originalKill = proto.kill;
+	proto.kill = function shieldedKill(this: ChildProcess, signal?: number | string): boolean {
+		// A signal-spawned child may be aborted synchronously by node's
+		// abortChildProcess right after this kill() returns; guarantee a
+		// listener is present so child.emit("error", AbortError) dispatches
+		// instead of throwing.
+		if (this.listenerCount("error") === 0) this.on("error", shieldErrorListener);
+		return originalKill.call(this, signal);
+	};
+
+	const moduleObject = childProcessModule as {
+		spawn: typeof childProcessModule.spawn;
+	};
+	const originalSpawn = moduleObject.spawn;
+	moduleObject.spawn = function shieldedSpawn(this: unknown, ...args: Parameters<typeof childProcessModule.spawn>) {
+		const child = originalSpawn.apply(this, args);
+		// Attach at spawn time: covers pre-aborted signals (node defers the
+		// abort to the next tick) and spawn-failure errors (ENOENT etc.)
+		// before any abort could fire.
+		if (child && (args[2] as { signal?: unknown } | undefined)?.signal !== undefined) {
+			child.on("error", shieldErrorListener);
+		}
+		return child;
+	};
+
+	proto[SHIELD_MARKER] = true;
+}

package/src/utils/file-coalescer.ts

@@ -63,10 +63,6 @@ function evictOldestCacheEntry(): void {
 	if (oldestKey !== undefined) readCache.delete(oldestKey);
 }
 
-export function clearReadCache(): void {
-	readCache.clear();
-}
-
 export function readJsonFileCoalesced<T>(filePath: string, ttlMs: number, read: () => T): T {
 	const now = Date.now();
 	const stat = (() => {

package/src/utils/fs-errno.ts

@@ -0,0 +1,66 @@
+/**
+ * Fatal-filesystem errno classification (bug-026 sub-issue B).
+ *
+ * During the 2026-08-15 disk-full window, workers died with generic
+ * "unresponsive"/ETIMEDOUT diagnostics — the ENOSPC errno only surfaced
+ * inside stderr-tail strings embedded in the E007 ChildTimeout message
+ * (`errors.ts` childTimeout appends "Stderr tail: ..."), never as a raw
+ * errno object in the parent process. The classifier therefore matches BOTH
+ * shapes:
+ *  - (a) `err.code` (NodeJS.ErrnoException) case-insensitively, and
+ *  - (b) the error's message text — or any plain string, e.g. a stderr tail.
+ *
+ * Deliberately NOT placed in state/atomic-write.ts: that module has
+ * process.on side effects at module load and imports worker-atomic-writer,
+ * and it already throws raw errno errors — classification belongs at catch
+ * sites. This module is dependency-free so state/types.ts (type-only) and
+ * the team-tool run/doctor surfaces can import it cheaply.
+ */
+
+export type FatalFsCause = "enospc" | "edquot" | "emfile" | "enfile";
+
+const FATAL_FS_CODES: ReadonlySet<string> = new Set(["enospc", "edquot", "emfile", "enfile"]);
+
+/** Message-text fallback: catches errno codes embedded in stderr tails /
+ *  synthesized error messages where no structured `.code` exists. */
+const FATAL_FS_TEXT = /\b(ENOSPC|EDQUOT|EMFILE|ENFILE)\b/;
+
+function classifyCode(code: unknown): FatalFsCause | undefined {
+	if (typeof code !== "string") return undefined;
+	const normalized = code.toLowerCase();
+	return FATAL_FS_CODES.has(normalized) ? (normalized as FatalFsCause) : undefined;
+}
+
+function classifyText(text: unknown): FatalFsCause | undefined {
+	if (typeof text !== "string") return undefined;
+	const match = FATAL_FS_TEXT.exec(text);
+	return match ? (match[1]?.toLowerCase() as FatalFsCause) : undefined;
+}
+
+/**
+ * Classify an unknown error (or a raw string, e.g. a child stderr tail) as a
+ * fatal filesystem cause. Returns undefined for non-fs errors. Pure and total:
+ * never throws on non-object inputs.
+ */
+export function classifyFatalFsError(err: unknown): FatalFsCause | undefined {
+	if (typeof err === "string") return classifyText(err);
+	if (err === null || err === undefined) return undefined;
+	const code = classifyCode((err as NodeJS.ErrnoException).code);
+	if (code) return code;
+	return classifyText((err as { message?: unknown }).message);
+}
+
+/**
+ * Combined classification for a finished attempt (bug-026 sub-issue B):
+ * the assembled attempt error first — a structured errno or a message that
+ * embeds one (E007 stderr tails) — then the child's stderr tail. Extracted
+ * as a pure seam so the child-executor hook is directly unit-testable.
+ */
+export function failureCauseForAttempt(error: string | undefined, stderr: string | undefined): FatalFsCause | undefined {
+	return classifyFatalFsError(error) ?? classifyFatalFsError(stderr);
+}
+
+/** Human label for a fatal fs cause. */
+export function fsFailureLabel(cause: FatalFsCause): string {
+	return cause === "enospc" || cause === "edquot" ? "disk full" : "too many open files";
+}

package/src/utils/fs-watch.ts

@@ -10,7 +10,7 @@ import * as fs from "node:fs";
  * caused a permanent interactive-session busy-loop. The bounded
  * {@link RunWatcherRegistry} (one non-recursive watcher per ACTIVE run) now
  * replaces them. Only the two primitives below survive — they are still used by
- * manifest-cache, result-watcher, and run-watcher-registry.
+ * manifest-cache and run-watcher-registry.
  */
 
 export function closeWatcher(watcher: FSWatcher | null | undefined): void {

package/src/utils/internal-error.ts

@@ -1,7 +1,9 @@
+import { getCrewEnv } from "../config/env-vars.ts";
+
 export function logInternalError(scope: string, error: unknown, details?: string, severity?: "error" | "warn" | "debug"): void {
 	// "error" and "warn" always emit; "debug" (default) is gated behind PI_TEAMS_DEBUG
 	if (!severity || severity === "debug") {
-		if (!process.env.PI_TEAMS_DEBUG) return;
+		if (!getCrewEnv("PI_TEAMS_DEBUG")) return;
 	}
 	const message =
 		error instanceof Error ? error.message : typeof error === "object" && error !== null ? JSON.stringify(error) : String(error);

package/src/utils/paths.ts

@@ -2,6 +2,7 @@ import * as fs from "node:fs";
 import * as os from "node:os";
 import * as path from "node:path";
 import { fileURLToPath } from "node:url";
+import { getCrewEnv } from "../config/env-vars.ts";
 
 // NEW-P1/NEW-P2 (perf): packageRoot() and userPiRoot() are invariant for a
 // process lifetime but each call did statSync/readFileSync/lstatSync (10-15+
@@ -55,7 +56,7 @@ export function userPiRoot(): string {
 	// "undefined/.pi/agent" relative to cwd and silently create a junk "undefined/"
 	// tree. Treat the literal "undefined" (and empty) as unset and fall back to
 	// os.homedir().
-	const rawHome = (process.env.PI_TEAMS_HOME ?? process.env.PI_CREW_HOME)?.trim();
+	const rawHome = getCrewEnv("PI_CREW_HOME")?.trim();
 	const home = rawHome && rawHome !== "undefined" ? rawHome : os.homedir();
 	// NEW-P2: memoize but KEY ON HOME. Tests (withIsolatedHome / isolateHome)
 	// change PI_TEAMS_HOME mid-process; an unkeyed cache would leak the first
@@ -203,8 +204,15 @@ export function findRepoRoot(cwd: string): string | undefined {
 function computeRepoRoot(start: string): string | undefined {
 	let current = start;
 	const root = path.parse(current).root;
-	const home = path.resolve(os.homedir());
-	const tempRoot = path.resolve(os.tmpdir());
+	// Canonicalize the boundaries to match the walk chain: findRepoRoot
+	// resolves the start dir via realpathSync, so every step of the walk is a
+	// canonical path. Comparing against the LEXICAL home/tmpdir lets symlinked
+	// temp dirs (macOS: /var -> /private/var, TMPDIR=/var/folders/.../T) never
+	// match, so the walk escapes the sandbox and can latch onto an unrelated
+	// ancestor marker (seen live: GH macOS runners have one) — state then
+	// resolves to a repo root far outside the temp tree (bug-029).
+	const home = canonicalizePath(path.resolve(os.homedir()));
+	const tempRoot = canonicalizePath(path.resolve(os.tmpdir()));
 	while (current !== root) {
 		// Stop walking before checking markers at home or temp root
 		if (current === home || current === tempRoot) return undefined;

package/src/utils/redaction.ts

@@ -34,7 +34,14 @@ export const PEM_PRIVATE_KEY_PATTERN = /-----BEGIN [A-Z ]+PRIVATE KEY-----[\s\S]
 // keyword-scan matches '_token' in 'prompt_tokens' (underscore + "token"),
 // falsely classifying usage counts as secrets. See performance/quality
 // assessment fix #5.
+//
+// `tokens` alone must stay too: pi-crew state records use
+// `progress.tokens` / `status.tokens` as the per-task usage total; the
+// camelCase fallback scan in isSecretKey() matches the bare keyword at
+// start+end of the name and would otherwise rewrite `15` to the literal
+// "***" on disk, which the widget then renders verbatim as `*** tok`.
 const TOKEN_COUNT_KEYS = new Set([
+	"tokens",
 	"prompt_tokens",
 	"completion_tokens",
 	"total_tokens",