pi-crew 0.9.68 → 0.10.2

package/src/utils/safe-abort.ts

@@ -0,0 +1,45 @@
+/**
+ * safe-abort.ts — abort helpers that cannot crash the host process.
+ *
+ * When a child process was spawned with `options.signal` and the signal fires
+ * AFTER that child already exited (fast workers, cleanup-after-completion,
+ * session switches mid-run), Node's child_process abort listener throws
+ * `AbortError: The operation was aborted` SYNCHRONOUSLY from
+ * `AbortController.abort()` (node:child_process abortChildProcess).
+ *
+ * In pi extension event handlers that throw propagates straight into pi's
+ * `uncaughtException` handling and kills the whole terminal session — the
+ * crash seen here: session_before_switch → stopSessionBoundSubagents → abort
+ * → AbortError → "pi exiting due to uncaughtException".
+ *
+ * Abort-after-exit is a semantic no-op (the work is already gone), so every
+ * controller abort that can be linked to a spawned child MUST go through
+ * these helpers: swallow the throw, log it, carry on.
+ */
+
+import { logInternalError } from "./internal-error.ts";
+
+/** Minimal controller shape — anything with an `abort()` method. */
+export interface Abortable {
+	abort(): void;
+}
+
+/**
+ * Abort a controller, tolerating Node's abort-after-child-exit AbortError.
+ * Never throws. `scope` names the call site for the internal error log.
+ */
+export function safeAbort(controller: Abortable | undefined, scope: string): void {
+	if (!controller) return;
+	try {
+		controller.abort();
+	} catch (error) {
+		logInternalError(`safe-abort.${scope}`, error);
+	}
+}
+
+/** Abort every controller in an iterable; a throwing controller does not
+ *  prevent the remaining ones from being aborted. */
+export function safeAbortAll(controllers: Iterable<Abortable> | undefined, scope: string): void {
+	if (!controllers) return;
+	for (const controller of controllers) safeAbort(controller, scope);
+}

package/src/utils/task-name-generator.ts

@@ -295,7 +295,7 @@ function capitalize(s: string): string {
 	return s.charAt(0).toUpperCase() + s.slice(1);
 }
 
-let usedNames = new Set<string>();
+const usedNames = new Set<string>();
 
 /**
  * Generate a unique two-word identifier (e.g., "SwiftFalcon").
@@ -328,10 +328,3 @@ export function generateTaskName(): string {
 	usedNames.clear();
 	return generateTaskName();
 }
-
-/**
- * Reset name generator state (for testing).
- */
-export function resetTaskNames(): void {
-	usedNames = new Set<string>();
-}

package/src/workflows/discover-workflows.ts

@@ -2,6 +2,7 @@ import * as fs from "node:fs";
 import * as path from "node:path";
 import type { ResourceSource } from "../agents/agent-config.ts";
 import { parseCsv, parseFrontmatter } from "../utils/frontmatter.ts";
+import { logInternalError } from "../utils/internal-error.ts";
 import { packageRoot, projectCrewRoot, userPiRoot } from "../utils/paths.ts";
 import type { WorkflowConfig, WorkflowStep } from "./workflow-config.ts";
 
@@ -24,6 +25,8 @@ const STEP_CONFIG_KEYS = new Set([
 	"verify",
 	"task",
 	"seedPaths",
+	"specRefs",
+	"specStrict",
 	"preStepScript",
 	"preStepArgs",
 	"preStepTimeout",
@@ -68,6 +71,11 @@ function parseStepSection(id: string, body: string): WorkflowStep | undefined {
 		worktree: config.worktree === "true" ? true : config.worktree === "false" ? false : undefined,
 		verify: config.verify === "true" ? true : config.verify === "false" ? false : undefined,
 		seedPaths: parseCsv(config.seedPaths) || undefined,
+		specRefs: parseCsv(config.specRefs) || undefined,
+		// Tri-state (round-1 P1-2): ABSENT = undefined so the workflow-level flag
+		// survives the `step.specStrict ?? workflow.specStrict` dispatch merge; an
+		// explicit `false` stays false (per-step opt-out of a strict workflow).
+		specStrict: config.specStrict === undefined ? undefined : config.specStrict === "true" || config.specStrict === "1",
 		preStepScript: config.preStepScript || undefined,
 		preStepArgs: parseCsv(config.preStepArgs) || undefined,
 		preStepTimeout: parseOptionalInteger(config.preStepTimeout) ?? undefined,
@@ -155,8 +163,16 @@ function parseWorkflowFile(filePath: string, source: ResourceSource): WorkflowCo
 				// runtime, but stripping here prevents the script value from even reaching
 				// downstream consumers (coalesce-tasks, policy-engine, etc.).
 				if (source === "project" && step.preStepScript) {
-					console.warn(
-						`[discover-workflows] Stripping preStepScript from project workflow '${name}' step '${step.id}': '${step.preStepScript}' (F-02: project-sourced pre-step scripts are not allowed for RCE prevention)`,
+					// F-02 redaction: NEVER log the preStepScript body — project workflows
+					// are untrusted input and the script may contain secrets. Log name,
+					// step id, and script length only.
+					logInternalError(
+						"discover-workflows",
+						new Error(
+							`Stripping preStepScript from project workflow '${name}' step '${step.id}' — script body redacted (${step.preStepScript.length} chars) (F-02: project-sourced pre-step scripts are not allowed for RCE prevention)`,
+						),
+						undefined,
+						"warn",
 					);
 					step.preStepScript = undefined;
 					step.preStepArgs = undefined;
@@ -174,6 +190,8 @@ function parseWorkflowFile(filePath: string, source: ResourceSource): WorkflowCo
 			maxConcurrency: parseOptionalInteger(frontmatter.maxConcurrency),
 			topology: parseTopology(frontmatter.topology),
 			coalesceMicroTasks: parseOptionalBoolean(frontmatter.coalesceMicroTasks),
+			specStrict: parseOptionalBoolean(frontmatter.specStrict),
+			adaptive: parseOptionalBoolean(frontmatter.adaptive),
 			steps,
 		};
 	} catch {

package/src/workflows/validate-workflow.ts

@@ -9,7 +9,13 @@ export function validateWorkflowForTeam(workflow: WorkflowConfig, team: TeamConf
 	for (const step of workflow.steps) {
 		if (stepIds.has(step.id)) errors.push(`Duplicate workflow step id '${step.id}'.`);
 		stepIds.add(step.id);
-		if (!roles.has(step.role)) errors.push(`Step '${step.id}' references unknown team role '${step.role}'.`);
+		if (!roles.has(step.role)) {
+			// F19-9: the distill adapter needs roles the default team lacks
+			// (analyst/critic) — hint the correct invocation instead of a bare
+			// unknown-role error.
+			const distillHint = workflow.name === "distill" ? " (run with team='implementation' — needs analyst+critic roles)" : "";
+			errors.push(`Step '${step.id}' references unknown team role '${step.role}'.${distillHint}`);
+		}
 	}
 
 	for (const step of workflow.steps) {

package/src/workflows/workflow-config.ts

@@ -22,6 +22,12 @@ export interface WorkflowStep {
 	/** Per-step files to overlay into the worktree (in addition to global worktree.seedPaths).
 	 * Useful when only certain steps need access to local drafts or scripts. */
 	seedPaths?: string[];
+	/** T4/R6 (ADR-6): workspace SpecRecord ids this step is held to; frozen
+	 *  into the task packet at dispatch (specStrict per workflow frontmatter). */
+	specRefs?: string[];
+	/** T4/R6 (ADR-6 §7): per-step strict-mode opt-in. Normally inherited from
+	 *  the workflow-level frontmatter flag (merged at dispatch). */
+	specStrict?: boolean;
 	/** Path to a deterministic script to run before dispatching the LLM worker.
 	 * Script stdout is injected into the worker's prompt as context.
 	 * Pattern origin: Understand-Anything deterministic pre-step pattern. */
@@ -65,6 +71,17 @@ export interface WorkflowConfig {
 	 *  in v0.9.17 unless the workflow author opts in. See
 	 *  src/runtime/scheduling/coalesce-tasks.ts. */
 	coalesceMicroTasks?: boolean;
+	/** T4/R6 (ADR-6 §7): strict spec mode opt-in (frontmatter `specStrict: true`).
+	 *  Requires a verifier-role step (reject-start, §5) and fails the write-gate
+	 *  on coverage gaps or machine-check failures (§4). */
+	specStrict?: boolean;
+	/** Frontmatter `adaptive: true` — the workflow's `assess` step (planner role)
+	 *  emits an ADAPTIVE_PLAN_JSON block that the runtime parses and injects as
+	 *  concrete tasks, so the plan painted in the task list is derived from the
+	 *  goal, not from fixed phase templates. The `implementation` workflow is
+	 *  adaptive by name (backward compat); this flag extends the mechanism to
+	 *  any workflow. See src/runtime/goal-workflow/adaptive-plan.ts. */
+	adaptive?: boolean;
 }
 
 /** A dynamic workflow (runtime === "dynamic"). steps is empty — the script is the source of truth. */

package/src/workflows/workflow-serializer.ts

@@ -14,6 +14,8 @@ function serializeStep(step: WorkflowStep): string[] {
 	if (step.progress !== undefined) lines.push(`progress: ${step.progress ? "true" : "false"}`);
 	if (step.worktree !== undefined) lines.push(`worktree: ${step.worktree ? "true" : "false"}`);
 	if (step.verify !== undefined) lines.push(`verify: ${step.verify ? "true" : "false"}`);
+	if (step.specRefs?.length) lines.push(`specRefs: ${step.specRefs.join(", ")}`);
+	if (step.specStrict !== undefined && step.specStrict !== false) lines.push("specStrict: true");
 	lines.push("", step.task.trim(), "");
 	return lines;
 }
@@ -24,6 +26,7 @@ export function serializeWorkflow(workflow: WorkflowConfig): string {
 		`name: ${workflow.name}`,
 		`description: ${workflow.description}`,
 		...(workflow.maxConcurrency !== undefined ? [`maxConcurrency: ${workflow.maxConcurrency}`] : []),
+		...(workflow.specStrict !== undefined ? [`specStrict: ${workflow.specStrict ? "true" : "false"}`] : []),
 		"---",
 		"",
 		...workflow.steps.flatMap(serializeStep),

package/src/worktree/worktree-manager.ts

@@ -146,6 +146,12 @@ export function assertCleanLeader(repoRoot: string): void {
 
 // --- Async versions ---
 
+// R5-L1 (Round 5 LOW-1): the exported clear*() fns below stay unwired by
+// leader decision (rewiring run-start/lock-release paths is riskier than the
+// leak); the FIFO caps bound these caches instead.
+const MAX_GIT_ROOT_CACHE = 256;
+const MAX_CLEAN_LEADER_CACHE = 256;
+
 /** Cache for findGitRoot results keyed by cwd. Cleared per-run. */
 const _gitRootCache = new Map<string, string>();
 
@@ -159,6 +165,10 @@ export async function findGitRootAsync(cwd: string): Promise<string> {
 	if (cached) return cached;
 	const root = await gitAsync(cwd, ["rev-parse", "--show-toplevel"]);
 	_gitRootCache.set(cwd, root);
+	if (_gitRootCache.size > MAX_GIT_ROOT_CACHE) {
+		const oldest = _gitRootCache.keys().next().value;
+		if (oldest !== undefined) _gitRootCache.delete(oldest);
+	}
 	return root;
 }
 
@@ -179,6 +189,10 @@ export async function assertCleanLeaderAsync(repoRoot: string): Promise<void> {
 		throw new Error("Worktree mode requires a clean leader repository. Commit/stash changes or use workspaceMode: 'single'.");
 	}
 	_cleanLeaderCache.add(repoRoot);
+	if (_cleanLeaderCache.size > MAX_CLEAN_LEADER_CACHE) {
+		const oldest = _cleanLeaderCache.values().next().value;
+		if (oldest !== undefined) _cleanLeaderCache.delete(oldest);
+	}
 }
 
 function linkNodeModulesIfPresent(repoRoot: string, worktreePath: string): boolean {
@@ -469,6 +483,10 @@ async function branchExistsAsync(repoRoot: string, branch: string): Promise<{ lo
 // run no new stale worktrees appear, so one prune suffices).
 const _prunedRepos = new Set<string>();
 const _pruneInFlight = new Map<string, Promise<void>>();
+// R5-L2 (Round 5 LOW-2): FIFO cap — dedupe-only Set, never cleared in
+// production; eviction just means a re-prune for that repo later, which is
+// harmless (prune is idempotent and coalesced).
+const MAX_PRUNED_REPOS = 128;
 async function pruneStaleWorktreesAsync(repoRoot: string): Promise<void> {
 	if (_prunedRepos.has(repoRoot)) return;
 	const inFlight = _pruneInFlight.get(repoRoot);
@@ -483,6 +501,10 @@ async function pruneStaleWorktreesAsync(repoRoot: string): Promise<void> {
 			/* best-effort */
 		}
 		_prunedRepos.add(repoRoot);
+		if (_prunedRepos.size > MAX_PRUNED_REPOS) {
+			const oldest = _prunedRepos.values().next().value;
+			if (oldest !== undefined) _prunedRepos.delete(oldest);
+		}
 		_pruneInFlight.delete(repoRoot);
 	})();
 	_pruneInFlight.set(repoRoot, p);

package/workflows/default.workflow.md

@@ -1,31 +1,41 @@
 ---
 name: default
-description: Explore, plan, execute, and verify
-topology: sequential
+description: Plan the goal into concrete tasks, execute them in parallel phases, verify
+topology: complex-dag
+adaptive: true
 ---
 
-## explore
-role: explorer
-
-Explore the codebase for the goal: {goal}
-
-## plan
+## assess
 role: planner
-dependsOn: explore
-output: plan.md
-
-Create a concise implementation plan for: {goal}
-
-## execute
-role: executor
-dependsOn: plan
-
-Implement the plan for: {goal}
-
-## verify
-role: verifier
-dependsOn: execute
-verify: true
-
-Verify completion for: {goal}
-Run FAST checks ONCE (cache output to .crew/cache/): `npm run test:critical && npx tsc --noEmit` (completes in <60s). Do NOT run `npm run test:unit` or `npm test` — too slow (642 files, >4 min). Cross-reference cached output with the changes. Do NOT re-run tests. Give PASS or FAIL with specific test evidence.
+output: adaptive-plan.json
+
+Plan the concrete task list for: {goal}
+
+You are the orchestration planner. Inspect the repository enough to break the goal into specific, executable tasks; do not use a fixed template. Small tasks may need one executor plus one verifier; broader tasks may need parallel explorers, executors, and a verification phase.
+
+Return a concise rationale, then include exactly one JSON block between these markers:
+
+ADAPTIVE_PLAN_JSON_START
+{
+  "phases": [
+    {
+      "name": "short-phase-name",
+      "tasks": [
+        {
+          "role": "explorer|executor|verifier",
+          "title": "short task title",
+          "task": "specific autonomous task prompt for this subagent"
+        }
+      ]
+    }
+  ]
+}
+ADAPTIVE_PLAN_JSON_END
+
+Rules:
+- **MAXIMIZE PARALLELISM**: Put independent tasks in the SAME phase so they run concurrently. Never create sequential phases when tasks are independent.
+- Task titles name the concrete piece of work — they become the task list the user watches.
+- Choose the smallest effective number of tasks per phase; a simple goal may have 1-2 phases with 1-2 tasks.
+- End implementation plans with a verification phase (`verifier` role): run FAST targeted checks only (e.g. the affected test files), never the full suite.
+- Tasks within the same phase run in parallel; phases run sequentially.
+- Do not include more than 12 tasks per phase; split or summarize oversized plans instead.

package/workflows/strict-fast-fix.workflow.md

@@ -0,0 +1,26 @@
+---
+name: strict-fast-fix
+description: T4 follow-up — fast-fix variant with strict spec binding (ADR-6 §5). Use this to exercise provenance v2 / freeze-at-dispatch / strict-mode gate end-to-end. Imports the spec via `scripts/spec-import.mjs` first.
+topology: sequential
+---
+
+## explore
+role: explorer
+specRefs: b5-t4-strict-probe
+specStrict: true
+
+Find the likely source of the issue: {goal}. You are held to the SPEC-EVIDENCE contract for the referenced spec — emit a `=== SPEC-EVIDENCE ===` block with `cited: <id>:<id>` lines for each requirement the work touches, then `=== END ===`.
+
+## execute
+role: executor
+dependsOn: explore
+
+Make the smallest safe fix. Continue the SPEC-EVIDENCE contract from explore: cite every requirement the implementation satisfies.
+
+## verify
+role: verifier
+dependsOn: execute
+verify: true
+
+Verify the fix with available evidence, AND cross-reference the SPEC-EVIDENCE footer from explore+execute against the spec's requirements (machine-check the citations vs the spec id set).
+Run FAST checks ONCE (cache output to .crew/cache/): `npm run test:critical && npx tsc --noEmit` (completes in <60s). Do NOT run `npm run test:unit` or `npm test` — too slow (642 files, >4 min). Cross-reference cached output with the fix. Do NOT re-run tests. Give PASS or FAIL with specific test evidence + spec gate verdict.

package/src/agents/agent-search.ts

@@ -1,98 +0,0 @@
-import type { AgentConfig } from "./agent-config.ts";
-
-// ─── BM25 Agent Search ──────────────────────────────────────────────────────
-// Lightweight BM25 search over agent descriptors for task-to-agent matching.
-// Based on the same BM25 algorithm used in oh-my-pi's tool-index.ts.
-
-export interface AgentSearchDocument {
-	agent: AgentConfig;
-	termFrequencies: Map<string, number>;
-	length: number;
-}
-
-export interface AgentSearchIndex {
-	documents: AgentSearchDocument[];
-	averageLength: number;
-	documentFrequencies: Map<string, number>;
-}
-
-export interface AgentSearchResult {
-	agent: AgentConfig;
-	score: number;
-}
-
-const BM25_K1 = 1.2;
-const BM25_B = 0.75;
-const FIELD_WEIGHTS = {
-	name: 6,
-	description: 2,
-	role: 3,
-} as const;
-
-function tokenize(value: string): string[] {
-	return value
-		.replace(/([a-z0-9])([A-Z])/g, "$1 $2")
-		.replace(/[^a-zA-Z0-9]+/g, " ")
-		.toLowerCase()
-		.trim()
-		.split(/\s+/)
-		.filter((token) => token.length > 0);
-}
-
-function addWeightedTokens(termFrequencies: Map<string, number>, value: string | undefined, weight: number): void {
-	if (!value) return;
-	for (const token of tokenize(value)) {
-		termFrequencies.set(token, (termFrequencies.get(token) ?? 0) + weight);
-	}
-}
-
-function buildAgentSearchDocument(agent: AgentConfig): AgentSearchDocument {
-	const termFrequencies = new Map<string, number>();
-	addWeightedTokens(termFrequencies, agent.name, FIELD_WEIGHTS.name);
-	addWeightedTokens(termFrequencies, agent.description, FIELD_WEIGHTS.description);
-	// Role from agent name heuristic
-	const roleHint = agent.name?.replace(/[-_]/g, " ") ?? "";
-	addWeightedTokens(termFrequencies, roleHint, FIELD_WEIGHTS.role);
-	const length = Array.from(termFrequencies.values()).reduce((sum, value) => sum + value, 0);
-	return { agent, termFrequencies, length };
-}
-
-export function buildAgentSearchIndex(agents: Iterable<AgentConfig>): AgentSearchIndex {
-	const documents = Array.from(agents, buildAgentSearchDocument);
-	const averageLength = documents.reduce((sum, document) => sum + document.length, 0) / documents.length || 1;
-	const documentFrequencies = new Map<string, number>();
-	for (const document of documents) {
-		for (const token of new Set(document.termFrequencies.keys())) {
-			documentFrequencies.set(token, (documentFrequencies.get(token) ?? 0) + 1);
-		}
-	}
-	return { documents, averageLength, documentFrequencies };
-}
-
-export function searchAgents(index: AgentSearchIndex, query: string, limit: number): AgentSearchResult[] {
-	const queryTokens = tokenize(query);
-	if (queryTokens.length === 0) return [];
-	if (index.documents.length === 0) return [];
-
-	const queryTermCounts = new Map<string, number>();
-	for (const token of queryTokens) {
-		queryTermCounts.set(token, (queryTermCounts.get(token) ?? 0) + 1);
-	}
-
-	return index.documents
-		.map((document) => {
-			let score = 0;
-			for (const [token, queryTermCount] of queryTermCounts) {
-				const termFrequency = document.termFrequencies.get(token) ?? 0;
-				if (termFrequency === 0) continue;
-				const documentFrequency = index.documentFrequencies.get(token) ?? 0;
-				const idf = Math.log(1 + (index.documents.length - documentFrequency + 0.5) / (documentFrequency + 0.5));
-				const normalization = BM25_K1 * (1 - BM25_B + BM25_B * (document.length / index.averageLength));
-				score += queryTermCount * idf * ((termFrequency * (BM25_K1 + 1)) / (termFrequency + normalization));
-			}
-			return { agent: document.agent, score };
-		})
-		.filter((result) => result.score > 0)
-		.sort((left, right) => right.score - left.score || left.agent.name.localeCompare(right.agent.name))
-		.slice(0, limit);
-}