CrewX Pi kit

Typed CrewX workspace tools and operating skills for managed Pi agents.

crewx_routine_deploy queues one exact-commit Render deployment for this occurrence's verified merge, only with reviewed Operate + allow_deploy authority. It requires the exact service/environment/source, unchanged branch and auto-deploy already off. It does not change settings; use observation for existing/automatic deployments. The 202 response parks this assignment, not proof of success. Inspect wait/effect status after resuming. Unknown POSTs are never repeated. Discovery after a lost response can verify the intended deployment without proving who started it; preserve unknown attribution. Live alone is not smoke/business acceptance. Reviewed policy.smoke_checks run automatically after merge-linked deployment observation or explicit deployment, one public page per parked poll. Each binds a reviewed Render service and exact path at site_origin; optional source_path uses the verified uploaded HTML, not model-provided expected text. Check smoke_verified and individual page results. HTTP availability is not metadata acceptance, and neither proves business results. A failure needs review; do not bypass it with shell/browser retries or infer rollback permission.

The package adds scoped tools for team memory, tasks, shared documents, approved knowledge integrations, and agent email. Email sending always stops at a human approval request. It also includes skills for browser work, desktop work, safety boundaries, and agent handoffs.

Install it with Pi:

pi install npm:[email protected]

CrewX injects short-lived CREWX_URL and CREWX_TOKEN capabilities only while an assignment is running. The package does not contain workspace credentials.

Managed inference transport (development, unpublished)

For explicitly migrated Pi routine assignments, the matching Bridge supplies CREWX_MODEL_URL and CREWX_MODEL_TOKEN for a bounded loopback proxy. The extension keeps OpenRouter model/session identity and all installed tools, but routes inference through that proxy with provider retries disabled and stable serialized-request identities. Both variables must be present and valid; neither is a user-managed API key. Do not print, store or share them. Without these variables the extension does not change a local/BYO Pi provider.

This source integration is tested against Pi 0.84.1 and is not included in the published install command above. Production bootstrap key removal, ordinary-chat routing and live cloud acceptance are still required before migration is enabled.

Reviewed task checkpoints

crewx_task_context reads the current work brief. crewx_task_checkpoints reads bounded checkpoint history with limit (1–20) and before pagination. crewx_task_checkpoint_propose records a summary, next steps, open questions, and typed document/artifact/task references for human review. The server checks the assigned coworker and current execution claim and captures evidence versions. These tools never approve or dispatch a handoff, pause the agent, import a private runtime session, or grant new permissions.

Ask the user to review the proposal and explicitly hand off in the CrewX task panel. If the proposal request fails after submission, inspect history before trying again; the tool deliberately does not retry an uncertain write. Do not put passwords, API keys, claim tokens, or private session transcripts in checkpoint text. These additions require matching CLI/server support; the source tree alone does not update already provisioned agents.

Recurring responsibility draft PRs (development)

After an independently verified routine merge, crewx_routine_observe_deployment accepts the occurrence's merge_effect_id, reviewed Render service, and stable step_key. It discovers and observes an existing deployment of the actual merge SHA without starting another. Missing or ambiguous matches wait; use the returned wait ID after resuming. The service/environment and source repository/branch are checked. Provider-live is not smoke-test or business success. This requires the matching development server and CLI; it is not yet a published availability claim.

Use crewx_routine_prepare_repository with an existing local clone to obtain an isolated occurrence worktree and pinned base. After committing and testing work, crewx_routine_upload_repository saves a bounded immutable snapshot and advances inspection and create-only branch stages through the managed CLI. Continue a paused response with crewx_routine_continue_upload and its saved upload ID; crewx_routine_upload_status reads progress without a provider request. Do not rescan/change the snapshot to bypass an error or repeat an ambiguous provider write. A confirmed upload verifies Git objects, not the business outcome or permission to merge. The initial path does not update or rebase a remote branch.

Uploads may include change_review: exact-blob/policy-bound classification for supported static HTML metadata/canonical/internal-link edits. This is not passing CI, link health, SEO benefit or merge permission. Canonical/link policies can propose an exact site_origin and allowed_url_paths; a human must review and activate that scope. Missing/incomplete or requires_review evidence cannot be overridden by an agent's assertion that its change is safe.

crewx_routine_draft_pr creates only a draft under the active occurrence's reviewed GitHub repository/base/path policy. The exact remote occurrence branch and SHAs must already exist; the tool does not prepare a worktree or push commits. Include before/after evidence and test results, never secrets. The server checks the current assignment claim again after provider inspection and before the write.

Reuse step_key with identical input after an uncertain request. Inspect crewx_routine_effect_status; an unknown outcome is not permission to repeat the PR through another tool. A confirmed draft grants no merge/deploy authority. crewx_routine_request_review queues publication of the exact occurrence draft as ready for review. It requires explicitly activated allow_request_review: true in Propose or Operate mode. It can notify reviewers and trigger repository CI; it does not approve the PR, merge it, or grant either permission. The assignment parks while the server works. Inspect the returned wait/effect after resuming. GraphQL errors and timeouts require readback, never resubmission through another tool.

crewx_routine_merge_pr separately requests a protected squash merge for the confirmed draft effect UUID. It requires explicit activated operate + allow_merge policy, a ready PR, the exact original base/uploaded head, complete supported HTML change verification, strict provider protection, trusted checks and required reviews. The initial request saves the exact intent and parks this assignment, returning 202 with status: parked, an effect and its bound provider wait. Queued is not merged. A dedicated server worker reads all protection/check/review evidence afresh and attempts at most one write per intent. Bridge releases the execution slot and resumes the same occurrence after resolution; inspect the returned wait/effect then. It does not bypass GitHub merge queues or implicitly publish a draft. Reuse the same intent/key after uncertainty and inspect effect status; never fall back to a manual merge. Even a confirmed merge grants no deployment authority; expected_revision_verified: false requires investigation. Live provider acceptance and the full merge/deploy lifecycle remain open release gates.

These tools require matching CLI/server support and the routines feature flag; live provider/harness acceptance and branch lifecycle work remain release gates.