pi-crew 0.11.0 → 0.11.2

package/src/extension/team-tool/routing-hint.ts

@@ -0,0 +1,63 @@
+/**
+ * DP-04 (2026-09-22): small-goal routing hint.
+ *
+ * Measured: a trivial goal through the default team burns 7.6–9k tokens just on
+ * the 3 context-setup steps (assess → execute → verify). The engine ALREADY
+ * supports `singleAgent: true` (handlePlan → composeSingleAgentPrompt); nothing
+ * suggested it for small goals.
+ *
+ * This module decides the hint. It is deliberately PURE and explainable — no
+ * ML, no hidden state — so the routing decision can be asserted in tests and
+ * audited from the plan output. Default mode is "suggest" (visible nudge, the
+ * caller/agent still decides), NOT a silent switch: this project has been
+ * burned by silent routing changes before (the auto-boomerang aliasing trap),
+ * so the decision must be visible.
+ */
+
+export type SmallGoalRoutingMode = "off" | "suggest" | "auto";
+
+/** Goals at or below this many whitespace tokens are considered "small". */
+export const SMALL_GOAL_TOKEN_THRESHOLD = 40;
+
+export interface RoutingHintInput {
+	goal: string;
+	/** True when the caller supplied an explicit team and/or workflow override. */
+	explicitOverride: boolean;
+	/** Configured mode; defaults to "suggest". */
+	mode?: SmallGoalRoutingMode;
+}
+
+export interface RoutingHint {
+	/** Whether a cheaper single-agent composition is advised. */
+	suggested: boolean;
+	/** Machine-readable reason (empty when not suggested). */
+	reason?: string;
+	/** Human-readable, shown in the plan output. */
+	message?: string;
+	/** Rough token saving estimate for the plan text (informational). */
+	estimatedSavings?: string;
+}
+
+/** Cheap, deterministic token count (whitespace split) — no tokenizer dep. */
+export function goalTokenCount(goal: string): number {
+	const trimmed = goal.trim();
+	if (trimmed.length === 0) return 0;
+	return trimmed.split(/\s+/).length;
+}
+
+export function resolveRoutingHint(input: RoutingHintInput): RoutingHint {
+	const mode = input.mode ?? "suggest";
+	if (mode === "off") return { suggested: false };
+	// Never second-guess an explicit team/workflow choice.
+	if (input.explicitOverride) return { suggested: false };
+	const tokens = goalTokenCount(input.goal);
+	if (tokens === 0 || tokens > SMALL_GOAL_TOKEN_THRESHOLD) return { suggested: false };
+	return {
+		suggested: true,
+		reason: `goal is small (${tokens} tokens ≤ ${SMALL_GOAL_TOKEN_THRESHOLD})`,
+		message:
+			`Hint: this goal is small (${tokens} tokens). The default team runs 3 context-setup phases ` +
+			`(~8k tokens overhead) before real work — consider \`singleAgent: true\` (or a 2-step chain) to skip them.`,
+		estimatedSavings: "~5-6k tokens",
+	};
+}

package/src/extension/team-tool/status.ts

@@ -2,6 +2,7 @@ import { loadConfig } from "../../config/config.ts";
 import { applyAttentionState, formatActivityAge, resolveCrewControlConfig } from "../../runtime/agent-control.ts";
 import { extractCommandTrace } from "../../runtime/command-trace.ts";
 import { readCrewAgents } from "../../runtime/crew-agent-records.ts";
+import { deadletterStatusLine } from "../../runtime/deadletter.ts";
 import { evaluateRunEffectiveness } from "../../runtime/effectiveness.ts";
 import { computePhaseProgress } from "../../runtime/phase-progress.ts";
 import { checkProcessLiveness, isActiveRunStatus } from "../../runtime/process-status.ts";
@@ -150,6 +151,7 @@ export function handleStatus(params: TeamToolParamsValue, ctx: TeamContext): PiT
 	}
 	const counts = new Map<string, number>();
 	for (const task of tasks) counts.set(task.status, (counts.get(task.status) ?? 0) + 1);
+	const deadletterLine = deadletterStatusLine(manifest);
 	const phaseProgress = computePhaseProgress(tasks);
 	// PERF (2026-08-24): intentionally NOT passing `limit` here — readEventsCursor's
 	// limit is a HEAD cap (oldest-first slice for streaming pagination), not a tail
@@ -267,6 +269,8 @@ export function handleStatus(params: TeamToolParamsValue, ctx: TeamContext): PiT
 				)
 			: ["- (none)"]),
 		`Task counts: ${[...counts.entries()].map(([status, count]) => `${status}=${count}`).join(", ") || "none"}`,
+		// US-003 AC-3: surface exhausted-retry failures — only when entries exist.
+		...(deadletterLine ? [deadletterLine] : []),
 		"Effectiveness:",
 		`- observable=${effectiveness.observable}/${Math.max(1, effectiveness.completed)} completed tasks`,
 		`- workerExecution=${effectiveness.workerExecution} guard=${effectiveness.guardMode} severity=${effectiveness.severity}`,

package/src/extension/team-tool.ts

@@ -3,6 +3,7 @@ import * as path from "node:path";
 import type { AgentConfig } from "../agents/agent-config.ts";
 import { allAgents, discoverAgents, listDynamicAgents, registerDynamicAgent, unregisterDynamicAgent } from "../agents/discover-agents.ts";
 import { loadConfig } from "../config/config.ts";
+import { DEFAULT_PATHS } from "../config/defaults.ts";
 import { getCrewEnv } from "../config/env-vars.ts";
 // Heavy runtime — lazy-loaded to avoid 1.4s import cost at extension registration.
 // executeTeamRun is only called when a team run actually executes.
@@ -17,6 +18,7 @@ import { loadRunManifestById, saveRunManifestAsync, saveRunTasks, updateRunStatu
 import type { ArtifactDescriptor, TeamRunManifest, TeamTaskState } from "../state/types.ts";
 import { allTeams, discoverTeams } from "../teams/discover-teams.ts";
 import { logInternalError } from "../utils/internal-error.ts";
+import { findRepoRoot, projectCrewRoot, userCrewRoot } from "../utils/paths.ts";
 import { resolveRealContainedPath } from "../utils/safe-paths.ts";
 import { allWorkflows, discoverWorkflows } from "../workflows/discover-workflows.ts";
 import { listRecentRuns } from "./run-index.ts";
@@ -191,9 +193,9 @@ function artifactKey(artifact: ArtifactDescriptor): string {
  *  passes) but handlers expect real numbers (TeamToolParamsValue types them as
  *  number). This converts the string form back to a number — and treats "" as
  *  unset (deleted) — before any domain router reads the param. */
-const LOOSE_NUMERIC_PARAM_KEYS = ["interval", "budgetWarning", "budgetAbort", "tokenBudget", "replyDeadline"] as const;
+const LOOSE_NUMERIC_PARAM_KEYS = ["interval", "budgetWarning", "budgetAbort", "tokenBudget", "replyDeadline", "budgetTotal"] as const;
 
-function normalizeLooseNumericFields(params: TeamToolParamsValue): TeamToolParamsValue {
+export function normalizeLooseNumericFields(params: TeamToolParamsValue): TeamToolParamsValue {
 	let mutated = false;
 	const out: Record<string, unknown> = { ...params };
 	for (const key of LOOSE_NUMERIC_PARAM_KEYS) {
@@ -400,7 +402,10 @@ export async function handleResume(params: TeamToolParamsValue, ctx: TeamContext
 			data: { runtimeResolution, action: "resume" },
 		});
 		if (runtime.safety === "blocked") {
-			const runningManifest = updateRunStatus(runtimeManifest, "running", "Checking worker runtime availability before resume.");
+			const runningManifest = updateRunStatus(runtimeManifest, "running", "Checking worker runtime availability before resume.", {
+				// Resume is the ONE legitimate terminal-exit flow (finding 8 write guard).
+				allowTerminalExit: true,
+			});
 			const blocked = updateRunStatus(
 				runningManifest,
 				"blocked",
@@ -511,6 +516,8 @@ export async function handleResume(params: TeamToolParamsValue, ctx: TeamContext
 		reliability: decision.executedConfig.reliability,
 		metricRegistry: ctx.metricRegistry,
 		workspaceId: ctx.sessionId ?? ctx.cwd,
+		// Finding 8: resume is the legitimate terminal-exit flow.
+		isResume: true,
 	});
 	return result(
 		[
@@ -652,9 +659,48 @@ export function locateRunCwd(runId: string, baseCwd: string): string | undefined
  * - Skips hidden entries (starting with `.`) unless they look like run directories
  *   (e.g. .crew, .pi, .tmp-crew-runs)
  */
+/**
+ * F-L1 companion (2026-09-23 correction): a hit counts when the resolved
+ * stateRoot sits under EITHER root that `list` unions (run-index
+ * `scopedRunRoots` = userCrewRoot + projectCrewRoot), because this function
+ * answers "which cwd can read this run's state" — not "was it created here".
+ *
+ * History: the first F-L1 fix (5d3a3d0f) restricted hits to the candidate
+ * cwd's PRIMARY root. That kept `locateRunCwd` from claiming a run created in
+ * a sibling, but it also made every by-ID handler (status/events/summary/
+ * artifacts/worktrees/api/plans/respond/cancel) reject runs that `list` shows
+ * from the user root: `list` unions both roots, `loadRunManifestById` resolves
+ * both roots, yet `locateRunCwd` returned undefined → "Run not found" for
+ * runs the dashboard had just listed. Measured live: 10/10 user-root runs
+ * listed by `action='list'` failed `action='status'`.
+ *
+ * Sibling isolation is preserved WITHOUT the primary-only restriction: a run
+ * living under a sibling's PROJECT root (…/sibling/.crew/state/runs/<id>) is
+ * not under the candidate cwd's project root nor the user root, so it still
+ * does not match (pinned by locate-run-cwd.test.ts "sibling directory").
+ */
+function runUnderListedRoot(cwd: string, runId: string): boolean {
+	const loaded = loadRunManifestById(cwd, runId);
+	if (!loaded) return false;
+	const roots = findRepoRoot(cwd) ? [projectCrewRoot(cwd), userCrewRoot()] : [userCrewRoot()];
+	return roots.some((root) => loaded.manifest.stateRoot === path.join(root, DEFAULT_PATHS.state.runsSubdir, runId));
+}
+
+/**
+ * Scan-path variant: a CHILD directory may claim the run only when the run's
+ * state actually lives under that child's OWN crew root (the nested-child
+ * case this scan exists for). Without this, a shared user-root run would be
+ * "claimed" by whichever child happened to be scanned first.
+ */
+function runUnderOwnRoot(cwd: string, runId: string): boolean {
+	const loaded = loadRunManifestById(cwd, runId);
+	if (!loaded) return false;
+	return loaded.manifest.stateRoot === path.join(projectCrewRoot(cwd), DEFAULT_PATHS.state.runsSubdir, runId);
+}
+
 export function locateRunCwdUncached(runId: string, baseCwd: string): string | undefined {
-	// Fast path: run is in the current CWD
-	if (loadRunManifestById(baseCwd, runId)) {
+	// Fast path: run resolves under one of the roots `list` shows (see helper note).
+	if (runUnderListedRoot(baseCwd, runId)) {
 		return baseCwd;
 	}
 
@@ -670,7 +716,7 @@ export function locateRunCwdUncached(runId: string, baseCwd: string): string | u
 				if (!entry.name.startsWith(".crew") && !entry.name.startsWith(".pi") && !entry.name.startsWith(".tmp-crew")) continue;
 			}
 			const candidate = path.join(baseCwd, entry.name);
-			if (loadRunManifestById(candidate, runId)) {
+			if (runUnderOwnRoot(candidate, runId)) {
 				return candidate;
 			}
 		}

package/src/extension/webhook-notify.ts

@@ -0,0 +1,382 @@
+/**
+ * US-030 (docs/specs/US-030.md) — outbound webhook notifications on run
+ * terminal transitions (completed/failed/cancelled).
+ *
+ * Pattern: bounded sibling of notification-router.ts / schedule-toast-bridge.ts
+ * — an opt-in, fire-and-forget sink. The terminal TRANSITION itself is
+ * observed by the async-run notifier (src/extension/async-notifier.ts, the
+ * existing poller that also toasts run completion for background runs);
+ * this module only formats + delivers. No new polling loop was introduced.
+ *
+ * Safety model (spec "SECURITY-SENSITIVE"):
+ *  - Disabled by default: no `notifications.webhook.url` (or `enabled:false`)
+ *    → the factory returns a shared no-op singleton — ZERO network calls and
+ *    zero allocation on the hot path (notifyTerminalRun is an empty fn).
+ *  - SSRF guard: URL must be http(s) and must not target localhost /
+ *    127.0.0.0/8 / 0.0.0.0 / [::1] / :: / fe80::/10 / 169.254.0.0/16 unless
+ *    `allowLocalhost: true` is set explicitly (checked once at creation —
+ *    fail closed). Hostname-LITERAL checks only (no DNS resolution): a DNS
+ *    name that resolves to loopback is not detected — documented limitation.
+ *  - PII-safe payload: event/runId/status/team/goal FIRST LINE/durationMs/
+ *    cost/tokens/at only. NO transcripts, events, task bodies, or summaries.
+ *  - The config block is `sensitive: true` in the schema, so project-level
+ *    config drops it (user config only) — an untrusted repo cannot point
+ *    pi-crew at an attacker URL.
+ *  - Delivery never throws into the caller (async-notifier poller / run
+ *    lifecycle path): every entry point is wrapped; failures land in
+ *    logInternalError (always-on "warn") + a `crew.webhook.failed` pi event
+ *    surfaced via deps.onFailure (wired in registration/lifecycle.ts).
+ *
+ * Delivery: ONE POST (content-type application/json) with a 5 s per-attempt
+ * timeout and EXACTLY ONE retry on 5xx/network error, then give up. Uses the
+ * Node 22 global fetch — no new dependency.
+ */
+import { createHmac } from "node:crypto";
+import type { CrewWebhookConfig } from "../config/types.ts";
+import { loadRunManifestById } from "../state/stores/state-store.ts";
+import type { TeamTaskState } from "../state/types.ts";
+import { logInternalError } from "../utils/internal-error.ts";
+import { isInQuietHours } from "./notification-router.ts";
+
+/** Documented payload (spec §Design). Field order matches the spec example. */
+export interface WebhookPayload {
+	event: "run.terminal";
+	runId: string;
+	status: string;
+	team: string;
+	goal: string;
+	durationMs: number;
+	cost: number;
+	tokens: number;
+	at: string;
+}
+
+/** Manifest projection the notifier needs — TeamRunManifest satisfies this structurally. */
+export interface WebhookTerminalRun {
+	runId: string;
+	status: string;
+	team: string;
+	goal?: string;
+	createdAt?: string;
+	/** Working dir of the project that owns the run (task loader input). */
+	cwd: string;
+}
+
+export interface WebhookDeliveryFailure {
+	runId: string;
+	/** Target URL — carries no secret material (the secret only ever lives in the signature header). */
+	url: string;
+	attempts: number;
+	error: string;
+}
+
+export interface WebhookNotifier {
+	/** Fire-and-forget terminal notification. NEVER throws. */
+	notifyTerminalRun(run: WebhookTerminalRun): void;
+	/** Determinism seam: resolves once no delivery is in flight. */
+	settled(): Promise<void>;
+	/** Stop accepting new deliveries (in-flight ones still settle). */
+	dispose(): void;
+}
+
+export interface WebhookNotifierDeps {
+	/** Fetch implementation (injectable for tests); default = Node 22 global fetch. */
+	fetch?: (url: string, init: RequestInit) => Promise<Response>;
+	/** Clock for the quiet-hours gate and the payload `at` field; default `() => new Date()`. */
+	now?: () => Date;
+	/** Task loader for cost/token sums; default reads the run's tasks from disk (best-effort). */
+	loadTasks?: (run: WebhookTerminalRun) => TeamTaskState[] | undefined;
+	/** Extra failure surface (the wiring emits `crew.webhook.failed` here). logInternalError always fires. */
+	onFailure?: (failure: WebhookDeliveryFailure) => void;
+	/** Per-attempt timeout. Default 5000 ms (spec "e.g. 5 s"). */
+	timeoutMs?: number;
+}
+
+export interface WebhookNotifyOptions {
+	/** `notifications.webhook` config block (url/enabled/secret/allowLocalhost). */
+	webhook?: CrewWebhookConfig;
+	/** `notifications.quietHours` — the SAME gate as the TUI router (reuses isInQuietHours — do not duplicate the logic). */
+	quietHours?: string;
+}
+
+const DEFAULT_TIMEOUT_MS = 5_000;
+/** One attempt + exactly one retry (spec: "ONE retry on 5xx/network error"). */
+const MAX_ATTEMPTS = 2;
+
+// ── SSRF guard ─────────────────────────────────────────────────────────────
+
+function ipv4Octets(host: string): number[] | undefined {
+	if (!/^\d{1,3}(\.\d{1,3}){3}$/.test(host)) return undefined;
+	const parts = host.split(".").map(Number);
+	if (!parts.every((part) => Number.isInteger(part) && part >= 0 && part <= 255)) return undefined;
+	return parts;
+}
+
+/**
+ * True for localhost NAMES and loopback/unspecified/link-local address
+ * literals. RFC1918 (10/8, 172.16/12, 192.168/16) is deliberately NOT
+ * blocked — internal webhooks are a primary use case (spec blocks only
+ * localhost / 127.0.0.1 / [::1] / 169.254.0.0/16).
+ */
+function isLocalAddress(hostname: string): boolean {
+	const host = hostname.toLowerCase();
+	// URL.hostname keeps brackets on IPv6 literals — strip for matching. A
+	// trailing dot ("localhost.", FQDN form) also resolves to loopback via
+	// getaddrinfo — strip it too (security review finding).
+	let bare = host.startsWith("[") && host.endsWith("]") ? host.slice(1, -1) : host;
+	if (bare.endsWith(".")) bare = bare.slice(0, -1);
+	if (bare === "localhost" || bare.endsWith(".localhost")) return true;
+	// IPv4 literal, incl. IPv4-mapped IPv6 (::ffff:a.b.c.d).
+	const mapped = /^::ffff:(\d{1,3}(?:\.\d{1,3}){3})$/.exec(bare);
+	const v4 = ipv4Octets(mapped ? mapped[1] : bare);
+	if (v4) {
+		const [a, b] = v4;
+		// 127/8 loopback, 0/8 unspecified, 169.254/16 link-local.
+		return a === 127 || a === 0 || (a === 169 && b === 254);
+	}
+	if (bare === "::1" || bare === "::") return true;
+	// IPv6 link-local fe80::/10: first non-empty hextet in 0xfe80..0xfebf.
+	const firstHextet = bare.split(":").find((segment) => segment.length > 0);
+	if (firstHextet && /^[0-9a-f]{1,4}$/.test(firstHextet)) {
+		const value = Number.parseInt(firstHextet, 16);
+		return value >= 0xfe80 && value <= 0xfebf;
+	}
+	return false;
+}
+
+/** SSRF guard (pure, exported for tests): http(s) only + local-address refusal unless opted in. */
+export function isWebhookUrlAllowed(rawUrl: string, allowLocalhost = false): boolean {
+	let parsed: URL;
+	try {
+		parsed = new URL(rawUrl);
+	} catch {
+		return false;
+	}
+	if (parsed.protocol !== "http:" && parsed.protocol !== "https:") return false;
+	// Credentials embedded in the URL would leak into logs — refuse them
+	// (use the `secret` HMAC field, never userinfo).
+	if (parsed.username || parsed.password) return false;
+	if (allowLocalhost) return true;
+	return !isLocalAddress(parsed.hostname);
+}
+
+/** Log-safe URL form: origin only — never path, query, or userinfo. */
+function safeUrlForLog(url: string): string {
+	try {
+		return new URL(url).origin;
+	} catch {
+		return "(unparseable-url)";
+	}
+}
+
+// ── payload ────────────────────────────────────────────────────────────────
+
+function sumUsage(tasks: TeamTaskState[] | undefined): { cost: number; tokens: number } {
+	let cost = 0;
+	let tokens = 0;
+	for (const task of tasks ?? []) {
+		const usage = task.usage;
+		if (!usage) continue;
+		cost += usage.cost ?? 0;
+		tokens += (usage.input ?? 0) + (usage.output ?? 0);
+	}
+	// Round the FP cost sum at micro-USD precision — keeps the JSON stable and test-friendly.
+	return { cost: Math.round(cost * 1e6) / 1e6, tokens };
+}
+
+/** Pure payload builder (exported for tests). PII-safe by construction: only
+ *  the documented fields; goal is reduced to its FIRST line. */
+export function buildWebhookPayload(run: WebhookTerminalRun, tasks: TeamTaskState[] | undefined, now: Date): WebhookPayload {
+	const createdAtMs = run.createdAt ? new Date(run.createdAt).getTime() : Number.NaN;
+	const { cost, tokens } = sumUsage(tasks);
+	return {
+		event: "run.terminal",
+		runId: run.runId,
+		status: run.status,
+		team: run.team,
+		// First line, capped at 256 chars: goals of nested runs are
+		// agent-composable — an uncapped line is a data-stuffing channel to
+		// the configured endpoint (security review finding).
+		goal: ((run.goal ?? "").split(/\r?\n/)[0] ?? "").slice(0, 256),
+		durationMs: Number.isFinite(createdAtMs) ? Math.max(0, now.getTime() - createdAtMs) : 0,
+		cost,
+		tokens,
+		at: now.toISOString(),
+	};
+}
+
+// ── notifier ───────────────────────────────────────────────────────────────
+
+const DISABLED_NOTIFIER: WebhookNotifier = Object.freeze({
+	notifyTerminalRun: () => undefined,
+	settled: () => Promise.resolve(),
+	dispose: () => undefined,
+});
+
+function defaultLoadTasks(run: WebhookTerminalRun): TeamTaskState[] | undefined {
+	try {
+		return loadRunManifestById(run.cwd, run.runId)?.tasks;
+	} catch {
+		return undefined;
+	}
+}
+
+/** Active-config check (pure, exported for tests): url present + not disabled. */
+export function isWebhookActive(config: { webhook?: CrewWebhookConfig }): boolean {
+	return Boolean(config.webhook?.url) && config.webhook?.enabled !== false;
+}
+
+export function createWebhookNotifier(options: WebhookNotifyOptions, deps: WebhookNotifierDeps = {}): WebhookNotifier {
+	const webhook = options.webhook;
+	const url = webhook?.url ?? "";
+	if (!isWebhookActive(options)) return DISABLED_NOTIFIER;
+	if (!isWebhookUrlAllowed(url, webhook?.allowLocalhost === true)) {
+		// Fail closed at creation: the notifier stays a no-op — a disallowed
+		// target must never receive a request, not even once.
+		logInternalError(
+			"webhook-notify.config",
+			new Error(
+				`refusing webhook URL '${safeUrlForLog(url)}' (SSRF guard); set notifications.webhook.allowLocalhost=true to target loopback/link-local explicitly`,
+			),
+			undefined,
+			"warn",
+		);
+		return DISABLED_NOTIFIER;
+	}
+	const secret = webhook?.secret;
+	const quietHours = options.quietHours;
+	const now = deps.now ?? (() => new Date());
+	const fetchImpl = deps.fetch ?? ((input: string, init: RequestInit) => fetch(input, init));
+	const loadTasks = deps.loadTasks ?? defaultLoadTasks;
+	const timeoutMs = deps.timeoutMs ?? DEFAULT_TIMEOUT_MS;
+	const onFailure = deps.onFailure;
+	let disposed = false;
+	const inflight = new Set<Promise<void>>();
+
+	async function deliverOnce(body: string): Promise<Response> {
+		const headers: Record<string, string> = { "content-type": "application/json" };
+		if (secret) {
+			// Signature over the EXACT serialized body the receiver sees, so the
+			// receiver can verify with hmac_sha256(secret, raw_body).
+			headers["x-pi-crew-signature"] = `sha256=${createHmac("sha256", secret).update(body).digest("hex")}`;
+		}
+		const controller = new AbortController();
+		const timer = setTimeout(() => controller.abort(), timeoutMs);
+		try {
+			// SSRF (security review HIGH): redirect:"follow" (the default) lets
+			// undici chase up to 20 hops WITHOUT re-running the guard — a
+			// 302 at the allowed host reaches 169.254.169.254 / loopback /
+			// internal RFC1918, and a 307 REPLAYS the signed body there. Manual
+			// mode surfaces any 3xx as a response we treat as failure below.
+			return await fetchImpl(url, {
+				method: "POST",
+				headers,
+				body,
+				signal: controller.signal,
+				redirect: "manual",
+			});
+		} finally {
+			clearTimeout(timer);
+		}
+	}
+
+	async function deliver(body: string, runId: string): Promise<void> {
+		let lastError: unknown = new Error("webhook delivery failed");
+		let attempts = 0;
+		while (attempts < MAX_ATTEMPTS) {
+			attempts++;
+			try {
+				const response = await deliverOnce(body);
+				// Always release the body — undici pins the socket until the body
+				// is drained/cancelled (default bodyTimeout ~300s), which a
+				// slow-trickle endpoint would exploit across fire-and-forget calls.
+				// biome-ignore lint/suspicious/noEmptyBlockStatements: intentional fire-and-forget — the cancel() rejection has nothing left to act on.
+				void response.body?.cancel?.().catch(() => {});
+				if (response.ok) return;
+				// 3xx under redirect:"manual" = a redirect we REFUSE to follow
+				// (the guard validated the configured URL, not the hop target).
+				// Permanent failure — no retry.
+				if (response.status >= 300 && response.status < 400) {
+					lastError = new Error(`refused redirect HTTP ${response.status} (SSRF guard — redirects are not followed)`);
+					break;
+				}
+				lastError = new Error(`HTTP ${response.status}`);
+				// Retry ONLY on 5xx (and only once). 4xx is permanent — fail fast.
+				if (response.status >= 500 && attempts < MAX_ATTEMPTS) continue;
+				break;
+			} catch (error) {
+				// Network error / abort-timeout → exactly one retry.
+				lastError = error;
+			}
+		}
+		const failure: WebhookDeliveryFailure = {
+			runId,
+			// Origin only: the raw URL (path/query/userinfo) must never reach
+			// logs or the pi event stream (security review finding).
+			url: safeUrlForLog(url),
+			attempts,
+			error: lastError instanceof Error ? lastError.message : String(lastError),
+		};
+		logInternalError(
+			"webhook-notify.delivery",
+			lastError instanceof Error ? lastError : new Error(String(lastError)),
+			`runId=${runId} url=${failure.url} attempts=${failure.attempts}`,
+			"warn",
+		);
+		try {
+			onFailure?.(failure);
+		} catch (callbackError) {
+			logInternalError("webhook-notify.onFailure", callbackError, runId);
+		}
+	}
+
+	return {
+		notifyTerminalRun(run) {
+			// NEVER throws into the caller (async-notifier poller → run lifecycle).
+			try {
+				if (disposed) return;
+				// Quiet-hours gate reuses the router's isInQuietHours — the SAME
+				// suppression window as the TUI notification path. A pattern-valid
+				// but clock-invalid value ("99:99-00:00" passes the schema regex)
+				// throws in parseHHMMRange; suppression is a nicety, not a gate —
+				// deliver anyway and log once (security review finding: the throw
+				// previously silenced every delivery with only a console line).
+				if (quietHours) {
+					try {
+						if (isInQuietHours(quietHours, now())) return;
+					} catch (quietError) {
+						logInternalError(
+							"webhook-notify.quiet-hours",
+							quietError instanceof Error ? quietError : new Error(String(quietError)),
+							`invalid quietHours='${quietHours}' — delivering anyway`,
+							"warn",
+						);
+					}
+				}
+				const tasks = loadTasks(run);
+				const payload = buildWebhookPayload(run, tasks, now());
+				const body = JSON.stringify(payload);
+				const tracked = deliver(body, run.runId).then(
+					() => undefined,
+					(error) => {
+						// deliver() is designed to never reject; belt-only.
+						logInternalError("webhook-notify.unexpected", error, run.runId, "warn");
+					},
+				);
+				inflight.add(tracked);
+				void tracked.then(() => {
+					inflight.delete(tracked);
+				});
+			} catch (error) {
+				logInternalError("webhook-notify.terminal", error, run.runId);
+			}
+		},
+		async settled() {
+			// Loop: new deliveries may start while awaiting (only relevant in tests).
+			while (inflight.size > 0) await Promise.all([...inflight]);
+		},
+		dispose() {
+			disposed = true;
+		},
+	};
+}

package/src/observability/metric-sink.ts

@@ -56,13 +56,23 @@ export function createMetricFileSink(opts: MetricFileSinkOptions): MetricSink {
 	};
 	const writeSnapshot = (snapshots: MetricSnapshot[]): Promise<void> => {
 		try {
-			const now = new Date();
-			const date = now.toISOString().slice(0, 10);
+			// RR-020 Fix 2 (cold-verify correction): gate on the crew root ALREADY
+			// EXISTING, mirroring notification-sink. The first version of this fix
+			// skipped only EMPTY snapshots — dead code in production, because
+			// wireEventToMetrics (observability.ts registration) registers ~15
+			// metrics at init, so registry.snapshot() is never []; the 60s interval
+			// therefore kept materialising <crewRoot>/state/metrics/ for projects
+			// that never ran a team. Existence gate ⇒ no-op until a real run
+			// creates the crew root; once it exists, writes (empty ticks included)
+			// are byte-identical to HEAD.
+			if (!fs.existsSync(opts.crewRoot)) return Promise.resolve();
 			const redacted = redactSecrets(snapshots);
 			if (!Array.isArray(redacted)) {
 				logInternalError("metric-sink.type", new Error("redactSecrets did not return an array"), `got=${typeof redacted}`);
 				return Promise.resolve();
 			}
+			const now = new Date();
+			const date = now.toISOString().slice(0, 10);
 			const target = ensureFd(date);
 			const line = `${JSON.stringify({ exportedAt: now.toISOString(), snapshots: redacted as MetricSnapshot[] })}\n`;
 			// Async write to avoid blocking the main thread on the 60s tick.