pi-crew 0.9.68 → 0.10.2

package/src/runtime/task-quality.ts

@@ -1,199 +0,0 @@
-/**
- * Task quality scoring — simple additive heuristic for evaluating task
- * completion quality based on diagnostics, metrics, artifacts, and duration.
- *
- * Distilled from pi-autoresearch's quality scoring pattern.
- */
-import * as fs from "node:fs";
-import * as path from "node:path";
-import type { TeamTaskState } from "../state/types.ts";
-
-/** Letter grade for task quality. */
-export type QualityGrade = "A" | "B" | "C" | "D";
-
-/** Breakdown of individual quality criteria. */
-export interface QualityBreakdown {
-	/** Task has a non-empty diagnostics object. */
-	hasDiagnostics: boolean;
-	/** Task has a non-empty metrics object. */
-	hasMetrics: boolean;
-	/** Task produced files in the artifacts directory. */
-	producedArtifacts: boolean;
-	/** Task has a non-empty result/description. */
-	hasDescription: boolean;
-	/** Task duration is reasonable (> 0 and < 1 hour). */
-	durationReasonable: boolean;
-}
-
-/** Scored quality result for a task. */
-export interface TaskQualityScore {
-	/** Numeric score (0–5). */
-	score: number;
-	/** Individual criterion breakdown. */
-	breakdown: QualityBreakdown;
-	/** Letter grade based on score thresholds. */
-	grade: QualityGrade;
-}
-
-/** One hour in milliseconds. */
-const ONE_HOUR_MS = 3_600_000;
-
-/**
- * Determine the letter grade for a given numeric score.
- *
- * A: 4–5, B: 3, C: 2, D: 0–1
- */
-function scoreToGrade(score: number): QualityGrade {
-	if (score >= 4) return "A";
-	if (score === 3) return "B";
-	if (score === 2) return "C";
-	return "D";
-}
-
-/**
- * Check whether the artifacts directory contains files for the given task.
- *
- * Looks for a subdirectory named after the task ID, or files containing
- * the task ID prefix in the artifacts directory.
- */
-function hasTaskArtifacts(taskId: string, artifactsDir: string): boolean {
-	try {
-		if (!fs.existsSync(artifactsDir)) return false;
-
-		// Check for a task-specific subdirectory
-		const taskDir = path.join(artifactsDir, taskId);
-		if (fs.existsSync(taskDir)) {
-			const stat = fs.statSync(taskDir);
-			if (stat.isDirectory()) {
-				const entries = fs.readdirSync(taskDir);
-				return entries.length > 0;
-			}
-		}
-
-		// Check for files containing the task ID prefix
-		const entries = fs.readdirSync(artifactsDir);
-		const safePrefix = taskId.replace(/[^a-zA-Z0-9_-]/g, "");
-		return entries.some((entry) => entry.includes(safePrefix));
-	} catch {
-		return false;
-	}
-}
-
-/**
- * Check if a task result string is a non-empty description.
- *
- * A result is considered descriptive if any of these sources have non-empty content:
- * - task.resultArtifact exists with a path
- * - task.error is a non-empty string (workers often set this with result info)
- * - task.verification.satisfied is true
- * - task.diagnostics contains a 'result' string
- */
-function isResultDescriptive(task: TeamTaskState): boolean {
-	// Check resultArtifact — presence of a result artifact indicates output was produced
-	if (task.resultArtifact?.path) return true;
-
-	// Check error field — workers often put result info here
-	if (typeof task.error === "string" && task.error.trim().length > 0) return true;
-
-	// Check verification — satisfied verification indicates meaningful output
-	if (task.verification?.satisfied) return true;
-
-	// Check diagnostics for an explicit result string
-	if (
-		task.diagnostics &&
-		typeof task.diagnostics === "object" &&
-		typeof task.diagnostics.result === "string" &&
-		(task.diagnostics.result as string).trim().length > 0
-	)
-		return true;
-
-	return false;
-}
-
-/**
- * Check if the task duration is reasonable (started, finished, > 0, < 1 hour).
- */
-function isDurationReasonable(task: TeamTaskState): boolean {
-	if (!task.startedAt || !task.finishedAt) return false;
-
-	const started = new Date(task.startedAt).getTime();
-	const finished = new Date(task.finishedAt).getTime();
-
-	if (Number.isNaN(started) || Number.isNaN(finished)) return false;
-
-	const duration = finished - started;
-	return duration > 0 && duration < ONE_HOUR_MS;
-}
-
-/**
- * Compute the quality score for a completed task.
- *
- * Uses simple additive scoring across 5 criteria:
- * - hasDiagnostics: +1 if task.diagnostics exists and has keys
- * - hasMetrics: +1 if task.metrics exists and has keys
- * - producedArtifacts: +1 if artifactsDir has files for this task
- * - hasDescription: +1 if task has a non-empty result/description
- * - durationReasonable: +1 if task has both startedAt and finishedAt, duration > 0 and < 1 hour
- *
- * @param task - The task state to evaluate
- * @param artifactsDir - Optional path to the run artifacts directory
- * @returns TaskQualityScore with numeric score, breakdown, and letter grade
- */
-export function computeTaskQuality(task: TeamTaskState, artifactsDir?: string): TaskQualityScore {
-	const hasDiagnostics =
-		task.diagnostics !== undefined && typeof task.diagnostics === "object" && Object.keys(task.diagnostics).length > 0;
-
-	const hasMetrics = task.metrics !== undefined && typeof task.metrics === "object" && Object.keys(task.metrics).length > 0;
-
-	const producedArtifacts = artifactsDir !== undefined && hasTaskArtifacts(task.id, artifactsDir);
-
-	const hasDescription = isResultDescriptive(task);
-
-	const durationReasonable = isDurationReasonable(task);
-
-	const breakdown: QualityBreakdown = {
-		hasDiagnostics,
-		hasMetrics,
-		producedArtifacts,
-		hasDescription,
-		durationReasonable,
-	};
-
-	const score =
-		(hasDiagnostics ? 1 : 0) +
-		(hasMetrics ? 1 : 0) +
-		(producedArtifacts ? 1 : 0) +
-		(hasDescription ? 1 : 0) +
-		(durationReasonable ? 1 : 0);
-
-	return {
-		score,
-		breakdown,
-		grade: scoreToGrade(score),
-	};
-}
-
-/** Human-readable labels for each quality criterion. */
-const CRITERION_LABELS: Record<keyof QualityBreakdown, string> = {
-	hasDiagnostics: "diagnostics",
-	hasMetrics: "metrics",
-	producedArtifacts: "artifacts",
-	hasDescription: "description",
-	durationReasonable: "duration",
-};
-
-/**
- * Format a quality score as a human-readable one-line string.
- *
- * Format: "Quality: B (3/5: diagnostics, metrics, description)"
- *
- * @param score - The quality score to format
- * @returns Formatted string
- */
-export function formatQualityScore(score: TaskQualityScore): string {
-	const metCriteria = Object.entries(score.breakdown)
-		.filter(([, met]) => met)
-		.map(([key]) => CRITERION_LABELS[key as keyof QualityBreakdown]);
-
-	return `Quality: ${score.grade} (${score.score}/5${metCriteria.length > 0 ? `: ${metCriteria.join(", ")}` : ""})`;
-}

package/src/runtime/task-runner/run-projection.ts

@@ -1,128 +0,0 @@
-import type { MailboxMessage } from "../../state/coordination/mailbox.ts";
-import type { ArtifactDescriptor, TeamRunManifest, TeamTaskState } from "../../state/types.ts";
-import { sanitizeTaskText } from "../task-packet.ts";
-
-export interface RunProjectionSource {
-	kind: "events" | "mailbox" | "artifacts" | "ui_metadata" | "runtime_metadata";
-	bounded: boolean;
-	reference?: string;
-}
-
-export interface RunProjectionResult {
-	sources: RunProjectionSource[];
-	summary: string;
-	injectedAsContext: boolean;
-}
-
-/**
- * Transform run context before a worker starts.
- * Builds a bounded projection of durable history that will be available
- * to the worker as reference context, not as instructions.
- *
- * Rules:
- * - Durable history retains events, mailbox, artifacts, UI/runtime metadata.
- * - Worker prompt gets a bounded projection (truncated/summarized).
- * - UI/runtime events are not prompt text unless explicitly selected.
- */
-export function transformRunContextBeforeWorkerStart(input: {
-	manifest: TeamRunManifest;
-	tasks: TeamTaskState[];
-	pendingMailbox: MailboxMessage[];
-	artifacts: ArtifactDescriptor[];
-	maxEvents?: number;
-	maxMailboxMessages?: number;
-	maxArtifactRefs?: number;
-}): RunProjectionResult {
-	const maxEvents = input.maxEvents ?? 20;
-	const maxMailbox = input.maxMailboxMessages ?? 10;
-	const maxArtifacts = input.maxArtifactRefs ?? 15;
-
-	const sources: RunProjectionSource[] = [];
-	const lines: string[] = [];
-
-	// Project a bounded slice of task history
-	const completedTasks = input.tasks.filter((t) => t.status === "completed" || t.status === "failed");
-	if (completedTasks.length > 0) {
-		const tasks = completedTasks.slice(0, maxEvents);
-		sources.push({
-			kind: "events",
-			bounded: true,
-			reference: `tasks:${tasks.length}/${completedTasks.length}`,
-		});
-		lines.push(`Previous tasks (${tasks.length}/${completedTasks.length}):`);
-		for (const task of tasks) {
-			lines.push(`- ${task.id}: ${task.status}${task.error ? ` (${task.error})` : ""}`);
-		}
-	}
-
-	// Project pending mailbox that is relevant to this worker
-	if (input.pendingMailbox.length > 0) {
-		const messages = input.pendingMailbox.slice(0, maxMailbox);
-		sources.push({
-			kind: "mailbox",
-			bounded: true,
-			reference: `mailbox:${messages.length}/${input.pendingMailbox.length}`,
-		});
-		lines.push(`Pending messages (${messages.length}/${input.pendingMailbox.length}):`);
-		for (const msg of messages) {
-			const safeBody = sanitizeTaskText(msg.body.slice(0, 100));
-			// VULN-3: mailbox bodies are cross-worker controllable — give the model a
-			// structural signal that this is untrusted content (sanitizeTaskText catches
-			// directive injection; the demarcation frames natural-language injection).
-			lines.push(`- ${msg.kind ?? "message"}: <untrusted_data source="mailbox">${safeBody}</untrusted_data>`);
-		}
-	}
-
-	// Project artifact references (not content)
-	if (input.artifacts.length > 0) {
-		const artifacts = input.artifacts.slice(0, maxArtifacts);
-		sources.push({
-			kind: "artifacts",
-			bounded: true,
-			reference: `artifacts:${artifacts.length}/${input.artifacts.length}`,
-		});
-		lines.push(`Available artifacts (${artifacts.length}/${input.artifacts.length}):`);
-		for (const art of artifacts) {
-			lines.push(`- ${art.kind} (${art.producer})`);
-		}
-	}
-
-	// Metadata markers — not injected as prompt instructions
-	sources.push({
-		kind: "ui_metadata",
-		bounded: false,
-		reference: "excluded_from_prompt",
-	});
-	sources.push({
-		kind: "runtime_metadata",
-		bounded: false,
-		reference: "excluded_from_prompt",
-	});
-
-	return {
-		sources,
-		summary: lines.join("\n"),
-		injectedAsContext: true,
-	};
-}
-
-/**
- * Convert run history to a bounded worker prompt section.
- * Same logic as transformRunContextBeforeWorkerStart but returns
- * the prompt text directly for embedding in the worker prompt.
- */
-export function convertRunHistoryToWorkerPrompt(input: {
-	manifest: TeamRunManifest;
-	tasks: TeamTaskState[];
-	pendingMailbox: MailboxMessage[];
-	artifacts: ArtifactDescriptor[];
-}): string {
-	const projection = transformRunContextBeforeWorkerStart(input);
-	if (!projection.summary) return "";
-	return [
-		"## Run Context (bounded projection)",
-		projection.summary,
-		"",
-		`Projection sources: ${projection.sources.map((s) => s.kind).join(", ")}`,
-	].join("\n");
-}

package/src/runtime/verification/post-checks.ts

@@ -1,142 +0,0 @@
-/**
- * Post-task backpressure checks — runs a configurable shell script after
- * task completion to verify workspace health before proceeding.
- *
- * Distilled from pi-autoresearch's post-check / backpressure pattern.
- */
-import { execFileSync } from "node:child_process";
-import { WINDOWS_ESSENTIAL_ENV_VARS } from "../../utils/env-allowlist.ts";
-import { sanitizeEnvSecrets } from "../../utils/env-filter.ts";
-import { resolveShellForScript } from "../../utils/resolve-shell.ts";
-import { resolveRealContainedPath } from "../../utils/safe-paths.ts";
-
-/** Default timeout for post-check scripts (5 minutes). */
-const DEFAULT_TIMEOUT_MS = 300_000;
-
-/** Environment variable name for the post-check script path. */
-const POST_CHECK_SCRIPT_ENV = "PI_CREW_POST_CHECK_SCRIPT";
-
-/**
- * Configuration for a post-task check.
- */
-export interface PostCheckConfig {
-	/** Path to the shell script to execute. */
-	scriptPath: string;
-	/** Timeout in milliseconds. Defaults to 300000 (5 minutes). */
-	timeoutMs: number;
-}
-
-/**
- * Result of running a post-task check.
- */
-export interface PostCheckResult {
-	/** Whether the check passed (exit code 0). */
-	passed: boolean;
-	/** Combined stdout + stderr from the script. */
-	output: string;
-	/** Wall-clock duration of the check in milliseconds. */
-	durationMs: number;
-	/** Whether the check timed out. */
-	timedOut: boolean;
-}
-
-/**
- * Resolve the effective post-check script path.
- * Prefers config.scriptPath; falls back to the PI_CREW_POST_CHECK_SCRIPT env var.
- */
-function resolveScriptPath(config: PostCheckConfig): string | undefined {
-	if (config.scriptPath && config.scriptPath.length > 0) {
-		return config.scriptPath;
-	}
-	return process.env[POST_CHECK_SCRIPT_ENV];
-}
-
-/**
- * Run a post-task backpressure check script.
- *
- * Executes the configured bash script and returns a structured result.
- * If no script path is available (neither config nor env var), the check
- * passes by default with a note.
- *
- * **Security note:** The script path is validated to stay within `cwd`.
- * Scripts that escape the working directory are rejected.
- *
- * @param config - Post-check configuration (script path and timeout)
- * @param cwd - Working directory for script execution
- * @returns PostCheckResult with pass/fail status, output, and timing
- */
-export async function runPostCheck(config: PostCheckConfig, cwd: string): Promise<PostCheckResult> {
-	const scriptPath = resolveScriptPath(config);
-	const timeoutMs = config.timeoutMs > 0 ? config.timeoutMs : DEFAULT_TIMEOUT_MS;
-
-	if (!scriptPath) {
-		return {
-			passed: true,
-			output: "No post-check script configured; skipping.",
-			durationMs: 0,
-			timedOut: false,
-		};
-	}
-
-	// M-1 fix (code-review 2026-06-23): use the project's safe-path primitive instead
-	// of a hand-rolled path.resolve + startsWith check. The lexical check passed a
-	// symlinked cwd/scripts -> /usr/local/bin, but execFileSync followed the symlink
-	// and executed a script outside the working directory. resolveRealContainedPath
-	// walks ancestors with O_NOFOLLOW and re-validates after realpath, defeating
-	// symlink-traversal attacks. Throws if the resolved path escapes cwd.
-	resolveRealContainedPath(cwd, scriptPath);
-
-	const startTime = Date.now();
-
-	return new Promise<PostCheckResult>((resolve) => {
-		try {
-			const { command, args } = resolveShellForScript(scriptPath);
-			const output = execFileSync(command, args, {
-				cwd,
-				timeout: timeoutMs,
-				encoding: "utf-8",
-				maxBuffer: 10 * 1024 * 1024, // 10 MB
-				env: {
-					...sanitizeEnvSecrets(process.env, {
-						allowList: ["PATH", "HOME", "USER", ...WINDOWS_ESSENTIAL_ENV_VARS, "TMPDIR", "LANG", "LC_ALL", "PI_CREW_*"],
-					}),
-					PI_CREW_POST_CHECK: "1",
-				},
-			});
-
-			const durationMs = Date.now() - startTime;
-			resolve({
-				passed: true,
-				output: output.trim(),
-				durationMs,
-				timedOut: false,
-			});
-		} catch (error: unknown) {
-			const durationMs = Date.now() - startTime;
-
-			// Determine if this was a timeout
-			// execFileSync throws with code 'ETIMEDOUT' or sets killed:true on timeout
-			const isTimedOut =
-				Boolean((error as NodeJS.ErrnoException & { killed?: boolean }).killed) ||
-				(error as NodeJS.ErrnoException).code === "ETIMEDOUT";
-
-			let output = "";
-			if (error instanceof Error) {
-				const execError = error as NodeJS.ErrnoException & {
-					stdout?: string;
-					stderr?: string;
-				};
-				output = [execError.stdout ?? "", execError.stderr ?? "", execError.message ?? ""].join("\n").trim();
-			} else {
-				output = String(error);
-			}
-
-			resolve({
-				passed: false,
-				output,
-				durationMs,
-				timedOut: isTimedOut,
-			});
-		}
-	});
-}

package/src/state/coordination/schedule.ts

@@ -1,166 +0,0 @@
-/**
- * schedule.ts — Schedule detection and parsing utilities.
- *
- * Mirrors pi-subagents3's SubagentScheduler static methods:
- *   - detectSchedule(): sniff cron / interval / one-shot from string
- *   - validateCronExpression(): 6-field cron validation
- *   - parseRelativeTime(): "+10m" → ISO timestamp
- *   - parseInterval(): "5m" → milliseconds
- */
-import * as fs from "node:fs";
-import * as path from "node:path";
-import { logInternalError } from "../../utils/internal-error.ts";
-import { atomicWriteJson } from "../atomic-write.ts";
-
-import type { ScheduledTask, ScheduleStoreData } from "../types.ts";
-
-export type DetectedSchedule =
-	| { type: "cron"; normalized: string }
-	| { type: "interval"; intervalMs: number; normalized: string }
-	| { type: "once"; normalized: string };
-
-/** "+10s"/"+5m"/"+1h"/"+2d" → ISO timestamp or null if not a relative time. */
-export function parseRelativeTime(s: string): string | null {
-	const m = s.trim().match(/^\+(\d+)(s|m|h|d)$/);
-	if (!m) return null;
-	const ms = parseInt(m[1], 10) * { s: 1000, m: 60_000, h: 3_600_000, d: 86_400_000 }[m[2] as "s" | "m" | "h" | "d"];
-	return new Date(Date.now() + ms).toISOString();
-}
-
-/** "10s"/"5m"/"1h"/"2d" → milliseconds or null if not an interval. */
-export function parseInterval(s: string): number | null {
-	const m = s.trim().match(/^(\d+)(s|m|h|d)$/);
-	if (!m) return null;
-	return parseInt(m[1], 10) * { s: 1000, m: 60_000, h: 3_600_000, d: 86_400_000 }[m[2] as "s" | "m" | "h" | "d"];
-}
-
-/** 6-field cron validation ("second minute hour dom month dow"). */
-export function validateCronExpression(expr: string): {
-	valid: boolean;
-	error?: string;
-} {
-	const fields = expr.trim().split(/\s+/);
-	if (fields.length !== 6) {
-		return {
-			valid: false,
-			error: `Cron must have 6 fields (second minute hour dom month dow), got ${fields.length}. Example: "0 0 9 * * 1" for 9am every Monday.`,
-		};
-	}
-	// Basic format check: all fields must be non-empty
-	if (!fields.every((f) => f.length > 0)) {
-		return {
-			valid: false,
-			error: "Cron expression contains empty fields.",
-		};
-	}
-	// Accept any cron pattern — fail silently for malformed expressions
-	// (the croner library will reject at execution time)
-	return { valid: true };
-}
-
-/**
- * Sniff a schedule string and tag its type. Throws on invalid input.
- * Order matters: relative ("+10m") and interval ("5m") both match digit+unit;
- * relative requires the leading "+" to disambiguate.
- */
-export function detectSchedule(s: string): DetectedSchedule {
-	const trimmed = s.trim();
-	// "+10m" — relative one-shot
-	const rel = parseRelativeTime(trimmed);
-	if (rel !== null) return { type: "once", normalized: rel };
-	// "5m" — interval
-	const ivl = parseInterval(trimmed);
-	if (ivl !== null) return { type: "interval", intervalMs: ivl, normalized: trimmed };
-	// ISO timestamp — one-shot. Reject past timestamps.
-	if (/^\d{4}-\d{2}-\d{2}T/.test(trimmed)) {
-		const d = new Date(trimmed);
-		if (!Number.isNaN(d.getTime())) {
-			if (d.getTime() <= Date.now()) {
-				throw new Error(`Scheduled time ${d.toISOString()} is in the past.`);
-			}
-			return { type: "once", normalized: d.toISOString() };
-		}
-	}
-	// Cron — 6-field
-	const cronCheck = validateCronExpression(trimmed);
-	if (cronCheck.valid) return { type: "cron", normalized: trimmed };
-	throw new Error(
-		`Invalid schedule "${s}". Use 6-field cron (e.g. "0 0 9 * * 1" — 9am every Monday), interval ("5m"/"1h"), or one-shot ("+10m" / ISO).`,
-	);
-}
-
-/** ScheduleStore: PID-locked, session-scoped, atomic JSON persistence. */
-export class ScheduleStore {
-	private readonly path: string;
-	private data: ScheduleStoreData;
-
-	constructor(path: string) {
-		this.path = path;
-		this.data = { version: 1, jobs: [] };
-		try {
-			if (fs.existsSync(path)) {
-				const content = fs.readFileSync(path, "utf-8");
-				const parsed = JSON.parse(content);
-				if (parsed && typeof parsed === "object" && "version" in parsed && "jobs" in parsed) {
-					this.data = parsed as ScheduleStoreData;
-				}
-			}
-		} catch {
-			// Corrupt or missing file — start fresh
-		}
-	}
-
-	private save(): void {
-		try {
-			fs.mkdirSync(path.dirname(this.path), { recursive: true });
-			// Atomic (temp + rename + fsync) — matches the class docstring's "atomic JSON
-			// persistence" claim. A raw writeFileSync could truncate schedules.json on
-			// crash and the constructor silently resets to {jobs:[]} on parse failure.
-			// NOTE: this class is currently not instantiated in production (scheduling
-			// persists via settings-store updateCrewSettings); kept consistent for safety.
-			atomicWriteJson(this.path, this.data);
-		} catch (error) {
-			// FIX (Round 21, L1): Use logInternalError for consistency with
-			// the rest of the codebase. Previously console.warn may not be
-			// visible in all environments (e.g. JSON-RPC mode, redirected
-			// stderr). Also import the dependency properly at the top of
-			// the file (this method used the legacy require() pattern).
-			logInternalError("schedule.save", error, `path=${this.path}`);
-		}
-	}
-
-	list(): ScheduledTask[] {
-		return [...this.data.jobs];
-	}
-
-	hasName(name: string): boolean {
-		return this.data.jobs.some((j) => j.name === name);
-	}
-
-	get(id: string): ScheduledTask | undefined {
-		return this.data.jobs.find((j) => j.id === id);
-	}
-
-	add(job: ScheduledTask): void {
-		this.data.jobs.push(job);
-		this.save();
-	}
-
-	update(id: string, patch: Partial<ScheduledTask>): ScheduledTask | undefined {
-		const idx = this.data.jobs.findIndex((j) => j.id === id);
-		if (idx === -1) return undefined;
-		this.data.jobs[idx] = { ...this.data.jobs[idx], ...patch };
-		this.save();
-		return this.data.jobs[idx];
-	}
-
-	remove(id: string): boolean {
-		const before = this.data.jobs.length;
-		this.data.jobs = this.data.jobs.filter((j) => j.id !== id);
-		if (this.data.jobs.length !== before) {
-			this.save();
-			return true;
-		}
-		return false;
-	}
-}