pi-crew 0.1.46 → 0.1.49

package/src/extension/team-tool/handle-settings.ts

@@ -1,188 +1,188 @@
-import type { TeamContext } from "../team-tool/context.ts";
-import { loadConfig, updateConfig } from "../../config/config.ts";
-import { configPatchFromConfig } from "../team-tool/config-patch.ts";
-import { result } from "../team-tool/context.ts";
-import type { PiTeamsToolResult } from "../tool-result.ts";
-
-// ---------------------------------------------------------------------------
-// Helpers
-// ---------------------------------------------------------------------------
-
-function setNested(obj: Record<string, unknown>, path: string, value: unknown): void {
-	const keys = path.split(".");
-	let target: Record<string, unknown> = obj;
-	for (let i = 0; i < keys.length - 1; i++) {
-		if (!target[keys[i]] || typeof target[keys[i]] !== "object") {
-			target[keys[i]] = {};
-		}
-		target = target[keys[i]] as Record<string, unknown>;
-	}
-	target[keys[keys.length - 1]] = value;
-}
-
-function getNested(obj: Record<string, unknown>, path: string): unknown {
-	const keys = path.split(".");
-	let current: unknown = obj;
-	for (const key of keys) {
-		if (!current || typeof current !== "object") return undefined;
-		current = (current as Record<string, unknown>)[key];
-	}
-	return current;
-}
-
-function formatValue(value: unknown): string {
-	if (value === undefined) return "<not set>";
-	if (typeof value === "object") return JSON.stringify(value);
-	return String(value);
-}
-
-function parseValue(raw: string): unknown {
-	// JSON handles strings (quoted), numbers, booleans, null, arrays, objects.
-	try { return JSON.parse(raw); } catch { /* keep as string */ }
-	return raw;
-}
-
-// ---------------------------------------------------------------------------
-// Known config keys — mirrors config-schema.ts + config.ts.
-// When adding new config fields, add the dotted path here so team-settings
-// can discover and display them.
-// ---------------------------------------------------------------------------
-
-const KNOWN_KEYS = new Set([
-	// top-level
-	"asyncByDefault",
-	"executeWorkers",
-	"notifierIntervalMs",
-	"requireCleanWorktreeLeader",
-	// runtime
-	"runtime.mode",
-	"runtime.preferLiveSession",
-	"runtime.allowChildProcessFallback",
-	"runtime.maxTurns",
-	"runtime.graceTurns",
-	"runtime.inheritContext",
-	"runtime.promptMode",
-	"runtime.groupJoin",
-	"runtime.groupJoinAckTimeoutMs",
-	"runtime.requirePlanApproval",
-	"runtime.completionMutationGuard",
-	// limits
-	"limits.maxConcurrentWorkers",
-	"limits.allowUnboundedConcurrency",
-	"limits.maxTaskDepth",
-	"limits.maxChildrenPerTask",
-	"limits.maxRunMinutes",
-	"limits.maxRetriesPerTask",
-	"limits.maxTasksPerRun",
-	"limits.heartbeatStaleMs",
-	// control
-	"control.enabled",
-	"control.needsAttentionAfterMs",
-	// autonomous
-	"autonomous.profile",
-	"autonomous.enabled",
-	"autonomous.injectPolicy",
-	"autonomous.preferAsyncForLongTasks",
-	"autonomous.allowWorktreeSuggestion",
-	// tools
-	"tools.enableClaudeStyleAliases",
-	"tools.enableSteer",
-	"tools.terminateOnForeground",
-	// agents
-	"agents.disableBuiltins",
-	// observability
-	"observability.prometheus.enabled",
-	"observability.otlp.enabled",
-	// worktree
-	"worktree.enabled",
-]);
-
-const KNOWN_SORTED = [...KNOWN_KEYS].sort();
-
-// ---------------------------------------------------------------------------
-// Detail objects – all require { action, status } from TeamToolDetails.
-// Extras (count, key, value, path) are passed as never to bypass the narrow
-// TeamToolDetails interface (consistent with the rest of the codebase).
-// ---------------------------------------------------------------------------
-
-const OK = { action: "settings", status: "ok" as const };
-const ERR = { action: "settings", status: "error" as const };
-
-// ---------------------------------------------------------------------------
-// Main handler
-// ---------------------------------------------------------------------------
-
-export function handleSettings(params: { config?: Record<string, unknown> }, ctx: TeamContext): PiTeamsToolResult {
-	const cfg = (params.config ?? {}) as Record<string, unknown>;
-	const args = typeof cfg.args === "string" ? cfg.args.trim() : "";
-	const scope = cfg.scope === "project" ? "project" : "user";
-	const loaded = loadConfig(ctx.cwd);
-	const effective = loaded.config as Record<string, unknown>;
-
-	// team-settings list
-	if (!args || args === "list") {
-		const lines = ["pi-crew settings:", `Path: ${loaded.path}`, ""];
-		for (const key of KNOWN_SORTED) {
-			const value = getNested(effective, key);
-			lines.push(`  ${key} = ${formatValue(value)}`);
-		}
-		lines.push("", "Usage: team-settings [list|get <key>|set <key> <value>|unset <key>|path|scope]");
-		return result(lines.join("\n"), { ...OK, count: KNOWN_KEYS.size } as never);
-	}
-
-	// team-settings path
-	if (args === "path") {
-		return result(`pi-crew config path: ${loaded.path}`, { ...OK, path: loaded.path } as never);
-	}
-
-	// team-settings scope
-	if (args === "scope") {
-		return result(`Current scope: ${scope}\nConfig at: ${loaded.path}`, { ...OK, scope } as never);
-	}
-
-	// team-settings get <key>
-	if (args.startsWith("get ")) {
-		const key = args.slice(4).trim();
-		if (!key) return result("Usage: team-settings get <key>", { ...ERR }, true);
-		const value = getNested(effective, key);
-		const note = KNOWN_KEYS.has(key) ? "" : " (unknown key — may not take effect)";
-		return result(`${key} = ${formatValue(value)}${note}`, { ...OK, key, value } as never);
-	}
-
-	// team-settings unset <key>
-	if (args.startsWith("unset ")) {
-		const key = args.slice(6).trim();
-		if (!key) return result("Usage: team-settings unset <key>", { ...ERR }, true);
-		try {
-			const saved = updateConfig({}, { cwd: ctx.cwd, scope, unsetPaths: [key] });
-			return result(`Unset ${key}\nPath: ${saved.path}`, { ...OK, key } as never);
-		} catch (error) {
-			return result(error instanceof Error ? error.message : String(error), { ...ERR }, true);
-		}
-	}
-
-	// team-settings set <key> <value>
-	if (args.startsWith("set ")) {
-		const rest = args.slice(4).trim();
-		const spaceIdx = rest.indexOf(" ");
-		if (spaceIdx === -1) return result("Usage: team-settings set <key> <value>", { ...ERR }, true);
-		const key = rest.slice(0, spaceIdx);
-		const rawValue = rest.slice(spaceIdx + 1).trim();
-		if (!key) return result("Usage: team-settings set <key> <value>", { ...ERR }, true);
-
-		const value = parseValue(rawValue);
-		const patch = {};
-		setNested(patch as Record<string, unknown>, key, value);
-
-		try {
-			const converted = configPatchFromConfig({ config: patch as Record<string, unknown> });
-			const saved = updateConfig(converted, { cwd: ctx.cwd, scope });
-			const warning = KNOWN_KEYS.has(key) ? "" : "\nWarning: unknown key — verify it exists in config schema.";
-			return result(`Set ${key} = ${formatValue(value)}\nPath: ${saved.path}${warning}`, { ...OK, key, value } as never);
-		} catch (error) {
-			return result(error instanceof Error ? error.message : String(error), { ...ERR }, true);
-		}
-	}
-
-	return result("Unknown subcommand. Usage: team-settings [list|get <key>|set <key> <value>|unset <key>|path|scope]", { ...ERR }, true);
-}
+import type { TeamContext } from "../team-tool/context.ts";
+import { loadConfig, updateConfig } from "../../config/config.ts";
+import { configPatchFromConfig } from "../team-tool/config-patch.ts";
+import { result } from "../team-tool/context.ts";
+import type { PiTeamsToolResult } from "../tool-result.ts";
+
+// ---------------------------------------------------------------------------
+// Helpers
+// ---------------------------------------------------------------------------
+
+function setNested(obj: Record<string, unknown>, path: string, value: unknown): void {
+	const keys = path.split(".");
+	let target: Record<string, unknown> = obj;
+	for (let i = 0; i < keys.length - 1; i++) {
+		if (!target[keys[i]] || typeof target[keys[i]] !== "object") {
+			target[keys[i]] = {};
+		}
+		target = target[keys[i]] as Record<string, unknown>;
+	}
+	target[keys[keys.length - 1]] = value;
+}
+
+function getNested(obj: Record<string, unknown>, path: string): unknown {
+	const keys = path.split(".");
+	let current: unknown = obj;
+	for (const key of keys) {
+		if (!current || typeof current !== "object") return undefined;
+		current = (current as Record<string, unknown>)[key];
+	}
+	return current;
+}
+
+function formatValue(value: unknown): string {
+	if (value === undefined) return "<not set>";
+	if (typeof value === "object") return JSON.stringify(value);
+	return String(value);
+}
+
+function parseValue(raw: string): unknown {
+	// JSON handles strings (quoted), numbers, booleans, null, arrays, objects.
+	try { return JSON.parse(raw); } catch { /* keep as string */ }
+	return raw;
+}
+
+// ---------------------------------------------------------------------------
+// Known config keys — mirrors config-schema.ts + config.ts.
+// When adding new config fields, add the dotted path here so team-settings
+// can discover and display them.
+// ---------------------------------------------------------------------------
+
+const KNOWN_KEYS = new Set([
+	// top-level
+	"asyncByDefault",
+	"executeWorkers",
+	"notifierIntervalMs",
+	"requireCleanWorktreeLeader",
+	// runtime
+	"runtime.mode",
+	"runtime.preferLiveSession",
+	"runtime.allowChildProcessFallback",
+	"runtime.maxTurns",
+	"runtime.graceTurns",
+	"runtime.inheritContext",
+	"runtime.promptMode",
+	"runtime.groupJoin",
+	"runtime.groupJoinAckTimeoutMs",
+	"runtime.requirePlanApproval",
+	"runtime.completionMutationGuard",
+	// limits
+	"limits.maxConcurrentWorkers",
+	"limits.allowUnboundedConcurrency",
+	"limits.maxTaskDepth",
+	"limits.maxChildrenPerTask",
+	"limits.maxRunMinutes",
+	"limits.maxRetriesPerTask",
+	"limits.maxTasksPerRun",
+	"limits.heartbeatStaleMs",
+	// control
+	"control.enabled",
+	"control.needsAttentionAfterMs",
+	// autonomous
+	"autonomous.profile",
+	"autonomous.enabled",
+	"autonomous.injectPolicy",
+	"autonomous.preferAsyncForLongTasks",
+	"autonomous.allowWorktreeSuggestion",
+	// tools
+	"tools.enableClaudeStyleAliases",
+	"tools.enableSteer",
+	"tools.terminateOnForeground",
+	// agents
+	"agents.disableBuiltins",
+	// observability
+	"observability.prometheus.enabled",
+	"observability.otlp.enabled",
+	// worktree
+	"worktree.enabled",
+]);
+
+const KNOWN_SORTED = [...KNOWN_KEYS].sort();
+
+// ---------------------------------------------------------------------------
+// Detail objects – all require { action, status } from TeamToolDetails.
+// Extras (count, key, value, path) are passed as never to bypass the narrow
+// TeamToolDetails interface (consistent with the rest of the codebase).
+// ---------------------------------------------------------------------------
+
+const OK = { action: "settings", status: "ok" as const };
+const ERR = { action: "settings", status: "error" as const };
+
+// ---------------------------------------------------------------------------
+// Main handler
+// ---------------------------------------------------------------------------
+
+export function handleSettings(params: { config?: Record<string, unknown> }, ctx: TeamContext): PiTeamsToolResult {
+	const cfg = (params.config ?? {}) as Record<string, unknown>;
+	const args = typeof cfg.args === "string" ? cfg.args.trim() : "";
+	const scope = cfg.scope === "project" ? "project" : "user";
+	const loaded = loadConfig(ctx.cwd);
+	const effective = loaded.config as Record<string, unknown>;
+
+	// team-settings list
+	if (!args || args === "list") {
+		const lines = ["pi-crew settings:", `Path: ${loaded.path}`, ""];
+		for (const key of KNOWN_SORTED) {
+			const value = getNested(effective, key);
+			lines.push(`  ${key} = ${formatValue(value)}`);
+		}
+		lines.push("", "Usage: team-settings [list|get <key>|set <key> <value>|unset <key>|path|scope]");
+		return result(lines.join("\n"), { ...OK, count: KNOWN_KEYS.size } as never);
+	}
+
+	// team-settings path
+	if (args === "path") {
+		return result(`pi-crew config path: ${loaded.path}`, { ...OK, path: loaded.path } as never);
+	}
+
+	// team-settings scope
+	if (args === "scope") {
+		return result(`Current scope: ${scope}\nConfig at: ${loaded.path}`, { ...OK, scope } as never);
+	}
+
+	// team-settings get <key>
+	if (args.startsWith("get ")) {
+		const key = args.slice(4).trim();
+		if (!key) return result("Usage: team-settings get <key>", { ...ERR }, true);
+		const value = getNested(effective, key);
+		const note = KNOWN_KEYS.has(key) ? "" : " (unknown key — may not take effect)";
+		return result(`${key} = ${formatValue(value)}${note}`, { ...OK, key, value } as never);
+	}
+
+	// team-settings unset <key>
+	if (args.startsWith("unset ")) {
+		const key = args.slice(6).trim();
+		if (!key) return result("Usage: team-settings unset <key>", { ...ERR }, true);
+		try {
+			const saved = updateConfig({}, { cwd: ctx.cwd, scope, unsetPaths: [key] });
+			return result(`Unset ${key}\nPath: ${saved.path}`, { ...OK, key } as never);
+		} catch (error) {
+			return result(error instanceof Error ? error.message : String(error), { ...ERR }, true);
+		}
+	}
+
+	// team-settings set <key> <value>
+	if (args.startsWith("set ")) {
+		const rest = args.slice(4).trim();
+		const spaceIdx = rest.indexOf(" ");
+		if (spaceIdx === -1) return result("Usage: team-settings set <key> <value>", { ...ERR }, true);
+		const key = rest.slice(0, spaceIdx);
+		const rawValue = rest.slice(spaceIdx + 1).trim();
+		if (!key) return result("Usage: team-settings set <key> <value>", { ...ERR }, true);
+
+		const value = parseValue(rawValue);
+		const patch = {};
+		setNested(patch as Record<string, unknown>, key, value);
+
+		try {
+			const converted = configPatchFromConfig({ config: patch as Record<string, unknown> });
+			const saved = updateConfig(converted, { cwd: ctx.cwd, scope });
+			const warning = KNOWN_KEYS.has(key) ? "" : "\nWarning: unknown key — verify it exists in config schema.";
+			return result(`Set ${key} = ${formatValue(value)}\nPath: ${saved.path}${warning}`, { ...OK, key, value } as never);
+		} catch (error) {
+			return result(error instanceof Error ? error.message : String(error), { ...ERR }, true);
+		}
+	}
+
+	return result("Unknown subcommand. Usage: team-settings [list|get <key>|set <key> <value>|unset <key>|path|scope]", { ...ERR }, true);
+}

package/src/extension/team-tool/inspect.ts

@@ -1,41 +1,41 @@
-import type { TeamToolParamsValue } from "../../schema/team-tool-schema.ts";
-import { readEvents } from "../../state/event-log.ts";
-import { loadRunManifestById } from "../../state/state-store.ts";
-import { aggregateUsage, formatUsage } from "../../state/usage.ts";
-import type { PiTeamsToolResult } from "../tool-result.ts";
-import { result, type TeamContext } from "./context.ts";
-
-export function handleEvents(params: TeamToolParamsValue, ctx: TeamContext): PiTeamsToolResult {
-	if (!params.runId) return result("Events requires runId.", { action: "events", status: "error" }, true);
-	const loaded = loadRunManifestById(ctx.cwd, params.runId);
-	if (!loaded) return result(`Run '${params.runId}' not found.`, { action: "events", status: "error" }, true);
-	const events = readEvents(loaded.manifest.eventsPath);
-	const lines = [`Events for ${loaded.manifest.runId}:`, ...(events.length ? events.map((event) => `${event.time} ${event.type}${event.taskId ? ` ${event.taskId}` : ""}${event.message ? `: ${event.message}` : ""}${event.data ? ` ${JSON.stringify(event.data)}` : ""}`) : ["(none)"])];
-	return result(lines.join("\n"), { action: "events", status: "ok", runId: loaded.manifest.runId, artifactsRoot: loaded.manifest.artifactsRoot });
-}
-
-export function handleArtifacts(params: TeamToolParamsValue, ctx: TeamContext): PiTeamsToolResult {
-	if (!params.runId) return result("Artifacts requires runId.", { action: "artifacts", status: "error" }, true);
-	const loaded = loadRunManifestById(ctx.cwd, params.runId);
-	if (!loaded) return result(`Run '${params.runId}' not found.`, { action: "artifacts", status: "error" }, true);
-	const lines = [`Artifacts for ${loaded.manifest.runId}:`, ...(loaded.manifest.artifacts.length ? loaded.manifest.artifacts.map((artifact) => `- ${artifact.kind}: ${artifact.path}${artifact.sizeBytes !== undefined ? ` (${artifact.sizeBytes} bytes)` : ""}${artifact.contentHash ? ` sha256=${artifact.contentHash.slice(0, 12)}` : ""}`) : ["- (none)"])];
-	return result(lines.join("\n"), { action: "artifacts", status: "ok", runId: loaded.manifest.runId, artifactsRoot: loaded.manifest.artifactsRoot });
-}
-
-export function handleSummary(params: TeamToolParamsValue, ctx: TeamContext): PiTeamsToolResult {
-	if (!params.runId) return result("Summary requires runId.", { action: "summary", status: "error" }, true);
-	const loaded = loadRunManifestById(ctx.cwd, params.runId);
-	if (!loaded) return result(`Run '${params.runId}' not found.`, { action: "summary", status: "error" }, true);
-	const usage = aggregateUsage(loaded.tasks);
-	const lines = [
-		`Summary for ${loaded.manifest.runId}`,
-		`Status: ${loaded.manifest.status}`,
-		`Team: ${loaded.manifest.team}`,
-		`Workflow: ${loaded.manifest.workflow ?? "(none)"}`,
-		`Goal: ${loaded.manifest.goal}`,
-		`Usage: ${formatUsage(usage)}`,
-		"Tasks:",
-		...loaded.tasks.map((task) => `- ${task.id}: ${task.status} (${task.role} -> ${task.agent})${task.error ? ` - ${task.error}` : ""}`),
-	];
-	return result(lines.join("\n"), { action: "summary", status: "ok", runId: loaded.manifest.runId, artifactsRoot: loaded.manifest.artifactsRoot });
-}
+import type { TeamToolParamsValue } from "../../schema/team-tool-schema.ts";
+import { readEvents } from "../../state/event-log.ts";
+import { loadRunManifestById } from "../../state/state-store.ts";
+import { aggregateUsage, formatUsage } from "../../state/usage.ts";
+import type { PiTeamsToolResult } from "../tool-result.ts";
+import { result, type TeamContext } from "./context.ts";
+
+export function handleEvents(params: TeamToolParamsValue, ctx: TeamContext): PiTeamsToolResult {
+	if (!params.runId) return result("Events requires runId.", { action: "events", status: "error" }, true);
+	const loaded = loadRunManifestById(ctx.cwd, params.runId);
+	if (!loaded) return result(`Run '${params.runId}' not found.`, { action: "events", status: "error" }, true);
+	const events = readEvents(loaded.manifest.eventsPath);
+	const lines = [`Events for ${loaded.manifest.runId}:`, ...(events.length ? events.map((event) => `${event.time} ${event.type}${event.taskId ? ` ${event.taskId}` : ""}${event.message ? `: ${event.message}` : ""}${event.data ? ` ${JSON.stringify(event.data)}` : ""}`) : ["(none)"])];
+	return result(lines.join("\n"), { action: "events", status: "ok", runId: loaded.manifest.runId, artifactsRoot: loaded.manifest.artifactsRoot });
+}
+
+export function handleArtifacts(params: TeamToolParamsValue, ctx: TeamContext): PiTeamsToolResult {
+	if (!params.runId) return result("Artifacts requires runId.", { action: "artifacts", status: "error" }, true);
+	const loaded = loadRunManifestById(ctx.cwd, params.runId);
+	if (!loaded) return result(`Run '${params.runId}' not found.`, { action: "artifacts", status: "error" }, true);
+	const lines = [`Artifacts for ${loaded.manifest.runId}:`, ...(loaded.manifest.artifacts.length ? loaded.manifest.artifacts.map((artifact) => `- ${artifact.kind}: ${artifact.path}${artifact.sizeBytes !== undefined ? ` (${artifact.sizeBytes} bytes)` : ""}${artifact.contentHash ? ` sha256=${artifact.contentHash.slice(0, 12)}` : ""}`) : ["- (none)"])];
+	return result(lines.join("\n"), { action: "artifacts", status: "ok", runId: loaded.manifest.runId, artifactsRoot: loaded.manifest.artifactsRoot });
+}
+
+export function handleSummary(params: TeamToolParamsValue, ctx: TeamContext): PiTeamsToolResult {
+	if (!params.runId) return result("Summary requires runId.", { action: "summary", status: "error" }, true);
+	const loaded = loadRunManifestById(ctx.cwd, params.runId);
+	if (!loaded) return result(`Run '${params.runId}' not found.`, { action: "summary", status: "error" }, true);
+	const usage = aggregateUsage(loaded.tasks);
+	const lines = [
+		`Summary for ${loaded.manifest.runId}`,
+		`Status: ${loaded.manifest.status}`,
+		`Team: ${loaded.manifest.team}`,
+		`Workflow: ${loaded.manifest.workflow ?? "(none)"}`,
+		`Goal: ${loaded.manifest.goal}`,
+		`Usage: ${formatUsage(usage)}`,
+		"Tasks:",
+		...loaded.tasks.map((task) => `- ${task.id}: ${task.status} (${task.role} -> ${task.agent})${task.error ? ` - ${task.error}` : ""}`),
+	];
+	return result(lines.join("\n"), { action: "summary", status: "ok", runId: loaded.manifest.runId, artifactsRoot: loaded.manifest.artifactsRoot });
+}

package/src/extension/team-tool/intent-policy.ts

@@ -0,0 +1,42 @@
+import type { PiTeamsConfig } from "../../config/config.ts";
+import type { TeamToolParamsValue } from "../../schema/team-tool-schema.ts";
+import type { PiTeamsToolResult } from "../tool-result.ts";
+import { configRecord, result } from "./context.ts";
+
+export type DestructiveIntentAction = "cancel" | "cleanup" | "delete" | "forget" | "prune";
+
+const DESTRUCTIVE_ACTION_LABELS: Record<DestructiveIntentAction, string> = {
+	cancel: "cancel",
+	cleanup: "forced cleanup",
+	delete: "delete",
+	forget: "forget",
+	prune: "prune",
+};
+
+export function intentFromConfig(config: unknown): string | undefined {
+	const cfg = configRecord(config);
+	const rawIntent = cfg.intent ?? cfg._intent;
+	if (typeof rawIntent !== "string") return undefined;
+	const intent = rawIntent.replace(/\s+/g, " ").trim();
+	return intent ? intent.slice(0, 500) : undefined;
+}
+
+export function shouldRequireIntent(config: PiTeamsConfig | undefined): boolean {
+	return config?.policy?.requireIntentForDestructiveActions === true;
+}
+
+export function enforceDestructiveIntent(
+	action: DestructiveIntentAction,
+	params: TeamToolParamsValue,
+	config: PiTeamsConfig | undefined,
+): PiTeamsToolResult | undefined {
+	if (!shouldRequireIntent(config)) return undefined;
+	if (action === "cleanup" && params.force !== true) return undefined;
+	if (intentFromConfig(params.config)) return undefined;
+	const label = DESTRUCTIVE_ACTION_LABELS[action];
+	return result(
+		`Destructive action '${label}' requires config.intent when policy.requireIntentForDestructiveActions is enabled.`,
+		{ action: action === "delete" ? "management" : action, status: "error" },
+		true,
+	);
+}

package/src/extension/team-tool/lifecycle-actions.ts

@@ -9,14 +9,8 @@ import { importRunBundle } from "../run-import.ts";
 import { pruneFinishedRuns } from "../run-maintenance.ts";
 import type { PiTeamsToolResult } from "../tool-result.ts";
 import { configRecord, result, type TeamContext } from "./context.ts";
-
-function intentFromParams(params: TeamToolParamsValue): string | undefined {
-	const cfg = configRecord(params.config);
-	const rawIntent = cfg.intent ?? cfg._intent;
-	if (typeof rawIntent !== "string") return undefined;
-	const intent = rawIntent.replace(/\s+/g, " ").trim();
-	return intent ? intent.slice(0, 500) : undefined;
-}
+import { enforceDestructiveIntent, intentFromConfig } from "./intent-policy.ts";
+import { executeHook, appendHookEvent } from "../../hooks/registry.ts";
 
 export function handleWorktrees(params: TeamToolParamsValue, ctx: TeamContext): PiTeamsToolResult {
 	if (!params.runId) return result("Worktrees requires runId.", { action: "worktrees", status: "error" }, true);
@@ -47,44 +41,79 @@ export function handleImport(params: TeamToolParamsValue, ctx: TeamContext): PiT
 	}
 }
 
-export function handleExport(params: TeamToolParamsValue, ctx: TeamContext): PiTeamsToolResult {
+export async function handleExport(params: TeamToolParamsValue, ctx: TeamContext): Promise<PiTeamsToolResult> {
 	if (!params.runId) return result("Export requires runId.", { action: "export", status: "error" }, true);
 	const loaded = loadRunManifestById(ctx.cwd, params.runId);
 	if (!loaded) return result(`Run '${params.runId}' not found.`, { action: "export", status: "error" }, true);
+
+	const hookReport = await executeHook("before_publish", { runId: loaded.manifest.runId, cwd: ctx.cwd });
+	appendHookEvent(loaded.manifest, hookReport);
+	if (hookReport.outcome === "block") {
+		return result(`Export blocked by hook: ${hookReport.reason ?? "before_publish hook blocked the operation."}`, { action: "export", status: "error", runId: loaded.manifest.runId }, true);
+	}
+
 	const exported = exportRunBundle(loaded.manifest, loaded.tasks);
 	appendEvent(loaded.manifest.eventsPath, { type: "run.exported", runId: loaded.manifest.runId, data: exported });
 	return result([`Exported run ${loaded.manifest.runId}.`, `JSON: ${exported.jsonPath}`, `Markdown: ${exported.markdownPath}`].join("\n"), { action: "export", status: "ok", runId: loaded.manifest.runId, artifactsRoot: loaded.manifest.artifactsRoot });
 }
 
-export function handlePrune(params: TeamToolParamsValue, ctx: TeamContext): PiTeamsToolResult {
-	const keep = params.keep ?? 20;
+export async function handlePrune(params: TeamToolParamsValue, ctx: TeamContext): Promise<PiTeamsToolResult> {
+	const intentError = enforceDestructiveIntent("prune", params, ctx.config);
+	if (intentError) return intentError;
 	if (!params.confirm) return result("prune requires confirm: true.", { action: "prune", status: "error" }, true);
+	const keep = params.keep ?? 20;
 	if (keep < 0 || !Number.isInteger(keep)) return result("keep must be an integer >= 0.", { action: "prune", status: "error" }, true);
-	const intent = intentFromParams(params);
-	const pruned = pruneFinishedRuns(ctx.cwd, keep, { intent });
+	const intent = intentFromConfig(params.config);
+	const pruned = pruneFinishedRuns(ctx.cwd, keep, { intent, signal: ctx.signal });
+	const firstRunId = pruned.kept[0] ?? pruned.removed[0];
+	if (firstRunId) {
+		const manifest = loadRunManifestById(ctx.cwd, firstRunId)?.manifest;
+		if (manifest) {
+			const hookReport = await executeHook("before_cleanup", { runId: manifest.runId, cwd: ctx.cwd });
+			appendHookEvent(manifest, hookReport);
+		}
+	}
 	return result([`Pruned finished pi-crew runs.`, `Kept: ${pruned.kept.length}`, `Removed: ${pruned.removed.length}`, ...(pruned.auditPath ? [`Audit: ${pruned.auditPath}`] : []), ...(pruned.removed.length ? ["Removed runs:", ...pruned.removed.map((runId) => `- ${runId}`)] : [])].join("\n"), { action: "prune", status: "ok", intent });
 }
 
-export function handleForget(params: TeamToolParamsValue, ctx: TeamContext): PiTeamsToolResult {
+export async function handleForget(params: TeamToolParamsValue, ctx: TeamContext): Promise<PiTeamsToolResult> {
+	const intentError = enforceDestructiveIntent("forget", params, ctx.config);
+	if (intentError) return intentError;
 	if (!params.runId) return result("Forget requires runId.", { action: "forget", status: "error" }, true);
 	if (!params.confirm) return result("forget requires confirm: true.", { action: "forget", status: "error" }, true);
 	const loaded = loadRunManifestById(ctx.cwd, params.runId);
 	if (!loaded) return result(`Run '${params.runId}' not found.`, { action: "forget", status: "error" }, true);
+
+	const hookReport = await executeHook("before_forget", { runId: loaded.manifest.runId, cwd: ctx.cwd });
+	appendHookEvent(loaded.manifest, hookReport);
+	if (hookReport.outcome === "block") {
+		return result(`Forget blocked by hook: ${hookReport.reason ?? "before_forget hook blocked the operation."}`, { action: "forget", status: "error", runId: loaded.manifest.runId }, true);
+	}
+
 	const cleanup = cleanupRunWorktrees(loaded.manifest, { force: params.force });
 	if (cleanup.preserved.length > 0 && !params.force) return result([`Run '${params.runId}' has preserved worktrees. Use force: true to forget anyway.`, ...cleanup.preserved.map((item) => `- ${item.path}: ${item.reason}`)].join("\n"), { action: "forget", status: "error", runId: loaded.manifest.runId, artifactsRoot: loaded.manifest.artifactsRoot }, true);
-	const intent = intentFromParams(params);
+	const intent = intentFromConfig(params.config);
 	appendEvent(loaded.manifest.eventsPath, { type: "run.forget_requested", runId: loaded.manifest.runId, message: "Run state and artifacts are being forgotten.", data: { force: params.force === true, removedWorktrees: cleanup.removed, preservedWorktrees: cleanup.preserved, intent } });
 	fs.rmSync(loaded.manifest.stateRoot, { recursive: true, force: true });
 	fs.rmSync(loaded.manifest.artifactsRoot, { recursive: true, force: true });
 	return result([`Forgot run ${loaded.manifest.runId}.`, `Removed state: ${loaded.manifest.stateRoot}`, `Removed artifacts: ${loaded.manifest.artifactsRoot}`, ...(cleanup.removed.length ? ["Removed worktrees:", ...cleanup.removed.map((item) => `- ${item}`)] : [])].join("\n"), { action: "forget", status: "ok", runId: loaded.manifest.runId, intent });
 }
 
-export function handleCleanup(params: TeamToolParamsValue, ctx: TeamContext): PiTeamsToolResult {
+export async function handleCleanup(params: TeamToolParamsValue, ctx: TeamContext): Promise<PiTeamsToolResult> {
+	const intentError = enforceDestructiveIntent("cleanup", params, ctx.config);
+	if (intentError) return intentError;
 	if (!params.runId) return result("Cleanup requires runId.", { action: "cleanup", status: "error" }, true);
 	const loaded = loadRunManifestById(ctx.cwd, params.runId);
 	if (!loaded) return result(`Run '${params.runId}' not found.`, { action: "cleanup", status: "error" }, true);
-	const cleanup = cleanupRunWorktrees(loaded.manifest, { force: params.force });
-	const intent = intentFromParams(params);
+
+	const hookReport = await executeHook("before_cleanup", { runId: loaded.manifest.runId, cwd: ctx.cwd });
+	appendHookEvent(loaded.manifest, hookReport);
+	if (hookReport.outcome === "block") {
+		return result(`Cleanup blocked by hook: ${hookReport.reason ?? "before_cleanup hook blocked the operation."}`, { action: "cleanup", status: "error", runId: loaded.manifest.runId }, true);
+	}
+
+	const cleanup = cleanupRunWorktrees(loaded.manifest, { force: params.force, signal: ctx.signal });
+	const intent = intentFromConfig(params.config);
 	appendEvent(loaded.manifest.eventsPath, { type: "worktree.cleanup", runId: loaded.manifest.runId, data: { removed: cleanup.removed, preserved: cleanup.preserved, artifacts: cleanup.artifactPaths, intent } });
 	const lines = [`Worktree cleanup for ${loaded.manifest.runId}:`, "Removed:", ...(cleanup.removed.length ? cleanup.removed.map((item) => `- ${item}`) : ["- (none)"]), "Preserved:", ...(cleanup.preserved.length ? cleanup.preserved.map((item) => `- ${item.path}: ${item.reason}`) : ["- (none)"]), "Artifacts:", ...(cleanup.artifactPaths.length ? cleanup.artifactPaths.map((item) => `- ${item}`) : ["- (none)"])];
 	return result(lines.join("\n"), { action: "cleanup", status: "ok", runId: loaded.manifest.runId, artifactsRoot: loaded.manifest.artifactsRoot, intent });