pi-crew 0.11.1 → 0.11.2

package/src/extension/team-tool.ts

@@ -3,6 +3,7 @@ import * as path from "node:path";
 import type { AgentConfig } from "../agents/agent-config.ts";
 import { allAgents, discoverAgents, listDynamicAgents, registerDynamicAgent, unregisterDynamicAgent } from "../agents/discover-agents.ts";
 import { loadConfig } from "../config/config.ts";
+import { DEFAULT_PATHS } from "../config/defaults.ts";
 import { getCrewEnv } from "../config/env-vars.ts";
 // Heavy runtime — lazy-loaded to avoid 1.4s import cost at extension registration.
 // executeTeamRun is only called when a team run actually executes.
@@ -17,6 +18,7 @@ import { loadRunManifestById, saveRunManifestAsync, saveRunTasks, updateRunStatu
 import type { ArtifactDescriptor, TeamRunManifest, TeamTaskState } from "../state/types.ts";
 import { allTeams, discoverTeams } from "../teams/discover-teams.ts";
 import { logInternalError } from "../utils/internal-error.ts";
+import { findRepoRoot, projectCrewRoot, userCrewRoot } from "../utils/paths.ts";
 import { resolveRealContainedPath } from "../utils/safe-paths.ts";
 import { allWorkflows, discoverWorkflows } from "../workflows/discover-workflows.ts";
 import { listRecentRuns } from "./run-index.ts";
@@ -191,9 +193,9 @@ function artifactKey(artifact: ArtifactDescriptor): string {
  *  passes) but handlers expect real numbers (TeamToolParamsValue types them as
  *  number). This converts the string form back to a number — and treats "" as
  *  unset (deleted) — before any domain router reads the param. */
-const LOOSE_NUMERIC_PARAM_KEYS = ["interval", "budgetWarning", "budgetAbort", "tokenBudget", "replyDeadline"] as const;
+const LOOSE_NUMERIC_PARAM_KEYS = ["interval", "budgetWarning", "budgetAbort", "tokenBudget", "replyDeadline", "budgetTotal"] as const;
 
-function normalizeLooseNumericFields(params: TeamToolParamsValue): TeamToolParamsValue {
+export function normalizeLooseNumericFields(params: TeamToolParamsValue): TeamToolParamsValue {
 	let mutated = false;
 	const out: Record<string, unknown> = { ...params };
 	for (const key of LOOSE_NUMERIC_PARAM_KEYS) {
@@ -400,7 +402,10 @@ export async function handleResume(params: TeamToolParamsValue, ctx: TeamContext
 			data: { runtimeResolution, action: "resume" },
 		});
 		if (runtime.safety === "blocked") {
-			const runningManifest = updateRunStatus(runtimeManifest, "running", "Checking worker runtime availability before resume.");
+			const runningManifest = updateRunStatus(runtimeManifest, "running", "Checking worker runtime availability before resume.", {
+				// Resume is the ONE legitimate terminal-exit flow (finding 8 write guard).
+				allowTerminalExit: true,
+			});
 			const blocked = updateRunStatus(
 				runningManifest,
 				"blocked",
@@ -511,6 +516,8 @@ export async function handleResume(params: TeamToolParamsValue, ctx: TeamContext
 		reliability: decision.executedConfig.reliability,
 		metricRegistry: ctx.metricRegistry,
 		workspaceId: ctx.sessionId ?? ctx.cwd,
+		// Finding 8: resume is the legitimate terminal-exit flow.
+		isResume: true,
 	});
 	return result(
 		[
@@ -652,9 +659,48 @@ export function locateRunCwd(runId: string, baseCwd: string): string | undefined
  * - Skips hidden entries (starting with `.`) unless they look like run directories
  *   (e.g. .crew, .pi, .tmp-crew-runs)
  */
+/**
+ * F-L1 companion (2026-09-23 correction): a hit counts when the resolved
+ * stateRoot sits under EITHER root that `list` unions (run-index
+ * `scopedRunRoots` = userCrewRoot + projectCrewRoot), because this function
+ * answers "which cwd can read this run's state" — not "was it created here".
+ *
+ * History: the first F-L1 fix (5d3a3d0f) restricted hits to the candidate
+ * cwd's PRIMARY root. That kept `locateRunCwd` from claiming a run created in
+ * a sibling, but it also made every by-ID handler (status/events/summary/
+ * artifacts/worktrees/api/plans/respond/cancel) reject runs that `list` shows
+ * from the user root: `list` unions both roots, `loadRunManifestById` resolves
+ * both roots, yet `locateRunCwd` returned undefined → "Run not found" for
+ * runs the dashboard had just listed. Measured live: 10/10 user-root runs
+ * listed by `action='list'` failed `action='status'`.
+ *
+ * Sibling isolation is preserved WITHOUT the primary-only restriction: a run
+ * living under a sibling's PROJECT root (…/sibling/.crew/state/runs/<id>) is
+ * not under the candidate cwd's project root nor the user root, so it still
+ * does not match (pinned by locate-run-cwd.test.ts "sibling directory").
+ */
+function runUnderListedRoot(cwd: string, runId: string): boolean {
+	const loaded = loadRunManifestById(cwd, runId);
+	if (!loaded) return false;
+	const roots = findRepoRoot(cwd) ? [projectCrewRoot(cwd), userCrewRoot()] : [userCrewRoot()];
+	return roots.some((root) => loaded.manifest.stateRoot === path.join(root, DEFAULT_PATHS.state.runsSubdir, runId));
+}
+
+/**
+ * Scan-path variant: a CHILD directory may claim the run only when the run's
+ * state actually lives under that child's OWN crew root (the nested-child
+ * case this scan exists for). Without this, a shared user-root run would be
+ * "claimed" by whichever child happened to be scanned first.
+ */
+function runUnderOwnRoot(cwd: string, runId: string): boolean {
+	const loaded = loadRunManifestById(cwd, runId);
+	if (!loaded) return false;
+	return loaded.manifest.stateRoot === path.join(projectCrewRoot(cwd), DEFAULT_PATHS.state.runsSubdir, runId);
+}
+
 export function locateRunCwdUncached(runId: string, baseCwd: string): string | undefined {
-	// Fast path: run is in the current CWD
-	if (loadRunManifestById(baseCwd, runId)) {
+	// Fast path: run resolves under one of the roots `list` shows (see helper note).
+	if (runUnderListedRoot(baseCwd, runId)) {
 		return baseCwd;
 	}
 
@@ -670,7 +716,7 @@ export function locateRunCwdUncached(runId: string, baseCwd: string): string | u
 				if (!entry.name.startsWith(".crew") && !entry.name.startsWith(".pi") && !entry.name.startsWith(".tmp-crew")) continue;
 			}
 			const candidate = path.join(baseCwd, entry.name);
-			if (loadRunManifestById(candidate, runId)) {
+			if (runUnderOwnRoot(candidate, runId)) {
 				return candidate;
 			}
 		}

package/src/extension/webhook-notify.ts

@@ -0,0 +1,382 @@
+/**
+ * US-030 (docs/specs/US-030.md) — outbound webhook notifications on run
+ * terminal transitions (completed/failed/cancelled).
+ *
+ * Pattern: bounded sibling of notification-router.ts / schedule-toast-bridge.ts
+ * — an opt-in, fire-and-forget sink. The terminal TRANSITION itself is
+ * observed by the async-run notifier (src/extension/async-notifier.ts, the
+ * existing poller that also toasts run completion for background runs);
+ * this module only formats + delivers. No new polling loop was introduced.
+ *
+ * Safety model (spec "SECURITY-SENSITIVE"):
+ *  - Disabled by default: no `notifications.webhook.url` (or `enabled:false`)
+ *    → the factory returns a shared no-op singleton — ZERO network calls and
+ *    zero allocation on the hot path (notifyTerminalRun is an empty fn).
+ *  - SSRF guard: URL must be http(s) and must not target localhost /
+ *    127.0.0.0/8 / 0.0.0.0 / [::1] / :: / fe80::/10 / 169.254.0.0/16 unless
+ *    `allowLocalhost: true` is set explicitly (checked once at creation —
+ *    fail closed). Hostname-LITERAL checks only (no DNS resolution): a DNS
+ *    name that resolves to loopback is not detected — documented limitation.
+ *  - PII-safe payload: event/runId/status/team/goal FIRST LINE/durationMs/
+ *    cost/tokens/at only. NO transcripts, events, task bodies, or summaries.
+ *  - The config block is `sensitive: true` in the schema, so project-level
+ *    config drops it (user config only) — an untrusted repo cannot point
+ *    pi-crew at an attacker URL.
+ *  - Delivery never throws into the caller (async-notifier poller / run
+ *    lifecycle path): every entry point is wrapped; failures land in
+ *    logInternalError (always-on "warn") + a `crew.webhook.failed` pi event
+ *    surfaced via deps.onFailure (wired in registration/lifecycle.ts).
+ *
+ * Delivery: ONE POST (content-type application/json) with a 5 s per-attempt
+ * timeout and EXACTLY ONE retry on 5xx/network error, then give up. Uses the
+ * Node 22 global fetch — no new dependency.
+ */
+import { createHmac } from "node:crypto";
+import type { CrewWebhookConfig } from "../config/types.ts";
+import { loadRunManifestById } from "../state/stores/state-store.ts";
+import type { TeamTaskState } from "../state/types.ts";
+import { logInternalError } from "../utils/internal-error.ts";
+import { isInQuietHours } from "./notification-router.ts";
+
+/** Documented payload (spec §Design). Field order matches the spec example. */
+export interface WebhookPayload {
+	event: "run.terminal";
+	runId: string;
+	status: string;
+	team: string;
+	goal: string;
+	durationMs: number;
+	cost: number;
+	tokens: number;
+	at: string;
+}
+
+/** Manifest projection the notifier needs — TeamRunManifest satisfies this structurally. */
+export interface WebhookTerminalRun {
+	runId: string;
+	status: string;
+	team: string;
+	goal?: string;
+	createdAt?: string;
+	/** Working dir of the project that owns the run (task loader input). */
+	cwd: string;
+}
+
+export interface WebhookDeliveryFailure {
+	runId: string;
+	/** Target URL — carries no secret material (the secret only ever lives in the signature header). */
+	url: string;
+	attempts: number;
+	error: string;
+}
+
+export interface WebhookNotifier {
+	/** Fire-and-forget terminal notification. NEVER throws. */
+	notifyTerminalRun(run: WebhookTerminalRun): void;
+	/** Determinism seam: resolves once no delivery is in flight. */
+	settled(): Promise<void>;
+	/** Stop accepting new deliveries (in-flight ones still settle). */
+	dispose(): void;
+}
+
+export interface WebhookNotifierDeps {
+	/** Fetch implementation (injectable for tests); default = Node 22 global fetch. */
+	fetch?: (url: string, init: RequestInit) => Promise<Response>;
+	/** Clock for the quiet-hours gate and the payload `at` field; default `() => new Date()`. */
+	now?: () => Date;
+	/** Task loader for cost/token sums; default reads the run's tasks from disk (best-effort). */
+	loadTasks?: (run: WebhookTerminalRun) => TeamTaskState[] | undefined;
+	/** Extra failure surface (the wiring emits `crew.webhook.failed` here). logInternalError always fires. */
+	onFailure?: (failure: WebhookDeliveryFailure) => void;
+	/** Per-attempt timeout. Default 5000 ms (spec "e.g. 5 s"). */
+	timeoutMs?: number;
+}
+
+export interface WebhookNotifyOptions {
+	/** `notifications.webhook` config block (url/enabled/secret/allowLocalhost). */
+	webhook?: CrewWebhookConfig;
+	/** `notifications.quietHours` — the SAME gate as the TUI router (reuses isInQuietHours — do not duplicate the logic). */
+	quietHours?: string;
+}
+
+const DEFAULT_TIMEOUT_MS = 5_000;
+/** One attempt + exactly one retry (spec: "ONE retry on 5xx/network error"). */
+const MAX_ATTEMPTS = 2;
+
+// ── SSRF guard ─────────────────────────────────────────────────────────────
+
+function ipv4Octets(host: string): number[] | undefined {
+	if (!/^\d{1,3}(\.\d{1,3}){3}$/.test(host)) return undefined;
+	const parts = host.split(".").map(Number);
+	if (!parts.every((part) => Number.isInteger(part) && part >= 0 && part <= 255)) return undefined;
+	return parts;
+}
+
+/**
+ * True for localhost NAMES and loopback/unspecified/link-local address
+ * literals. RFC1918 (10/8, 172.16/12, 192.168/16) is deliberately NOT
+ * blocked — internal webhooks are a primary use case (spec blocks only
+ * localhost / 127.0.0.1 / [::1] / 169.254.0.0/16).
+ */
+function isLocalAddress(hostname: string): boolean {
+	const host = hostname.toLowerCase();
+	// URL.hostname keeps brackets on IPv6 literals — strip for matching. A
+	// trailing dot ("localhost.", FQDN form) also resolves to loopback via
+	// getaddrinfo — strip it too (security review finding).
+	let bare = host.startsWith("[") && host.endsWith("]") ? host.slice(1, -1) : host;
+	if (bare.endsWith(".")) bare = bare.slice(0, -1);
+	if (bare === "localhost" || bare.endsWith(".localhost")) return true;
+	// IPv4 literal, incl. IPv4-mapped IPv6 (::ffff:a.b.c.d).
+	const mapped = /^::ffff:(\d{1,3}(?:\.\d{1,3}){3})$/.exec(bare);
+	const v4 = ipv4Octets(mapped ? mapped[1] : bare);
+	if (v4) {
+		const [a, b] = v4;
+		// 127/8 loopback, 0/8 unspecified, 169.254/16 link-local.
+		return a === 127 || a === 0 || (a === 169 && b === 254);
+	}
+	if (bare === "::1" || bare === "::") return true;
+	// IPv6 link-local fe80::/10: first non-empty hextet in 0xfe80..0xfebf.
+	const firstHextet = bare.split(":").find((segment) => segment.length > 0);
+	if (firstHextet && /^[0-9a-f]{1,4}$/.test(firstHextet)) {
+		const value = Number.parseInt(firstHextet, 16);
+		return value >= 0xfe80 && value <= 0xfebf;
+	}
+	return false;
+}
+
+/** SSRF guard (pure, exported for tests): http(s) only + local-address refusal unless opted in. */
+export function isWebhookUrlAllowed(rawUrl: string, allowLocalhost = false): boolean {
+	let parsed: URL;
+	try {
+		parsed = new URL(rawUrl);
+	} catch {
+		return false;
+	}
+	if (parsed.protocol !== "http:" && parsed.protocol !== "https:") return false;
+	// Credentials embedded in the URL would leak into logs — refuse them
+	// (use the `secret` HMAC field, never userinfo).
+	if (parsed.username || parsed.password) return false;
+	if (allowLocalhost) return true;
+	return !isLocalAddress(parsed.hostname);
+}
+
+/** Log-safe URL form: origin only — never path, query, or userinfo. */
+function safeUrlForLog(url: string): string {
+	try {
+		return new URL(url).origin;
+	} catch {
+		return "(unparseable-url)";
+	}
+}
+
+// ── payload ────────────────────────────────────────────────────────────────
+
+function sumUsage(tasks: TeamTaskState[] | undefined): { cost: number; tokens: number } {
+	let cost = 0;
+	let tokens = 0;
+	for (const task of tasks ?? []) {
+		const usage = task.usage;
+		if (!usage) continue;
+		cost += usage.cost ?? 0;
+		tokens += (usage.input ?? 0) + (usage.output ?? 0);
+	}
+	// Round the FP cost sum at micro-USD precision — keeps the JSON stable and test-friendly.
+	return { cost: Math.round(cost * 1e6) / 1e6, tokens };
+}
+
+/** Pure payload builder (exported for tests). PII-safe by construction: only
+ *  the documented fields; goal is reduced to its FIRST line. */
+export function buildWebhookPayload(run: WebhookTerminalRun, tasks: TeamTaskState[] | undefined, now: Date): WebhookPayload {
+	const createdAtMs = run.createdAt ? new Date(run.createdAt).getTime() : Number.NaN;
+	const { cost, tokens } = sumUsage(tasks);
+	return {
+		event: "run.terminal",
+		runId: run.runId,
+		status: run.status,
+		team: run.team,
+		// First line, capped at 256 chars: goals of nested runs are
+		// agent-composable — an uncapped line is a data-stuffing channel to
+		// the configured endpoint (security review finding).
+		goal: ((run.goal ?? "").split(/\r?\n/)[0] ?? "").slice(0, 256),
+		durationMs: Number.isFinite(createdAtMs) ? Math.max(0, now.getTime() - createdAtMs) : 0,
+		cost,
+		tokens,
+		at: now.toISOString(),
+	};
+}
+
+// ── notifier ───────────────────────────────────────────────────────────────
+
+const DISABLED_NOTIFIER: WebhookNotifier = Object.freeze({
+	notifyTerminalRun: () => undefined,
+	settled: () => Promise.resolve(),
+	dispose: () => undefined,
+});
+
+function defaultLoadTasks(run: WebhookTerminalRun): TeamTaskState[] | undefined {
+	try {
+		return loadRunManifestById(run.cwd, run.runId)?.tasks;
+	} catch {
+		return undefined;
+	}
+}
+
+/** Active-config check (pure, exported for tests): url present + not disabled. */
+export function isWebhookActive(config: { webhook?: CrewWebhookConfig }): boolean {
+	return Boolean(config.webhook?.url) && config.webhook?.enabled !== false;
+}
+
+export function createWebhookNotifier(options: WebhookNotifyOptions, deps: WebhookNotifierDeps = {}): WebhookNotifier {
+	const webhook = options.webhook;
+	const url = webhook?.url ?? "";
+	if (!isWebhookActive(options)) return DISABLED_NOTIFIER;
+	if (!isWebhookUrlAllowed(url, webhook?.allowLocalhost === true)) {
+		// Fail closed at creation: the notifier stays a no-op — a disallowed
+		// target must never receive a request, not even once.
+		logInternalError(
+			"webhook-notify.config",
+			new Error(
+				`refusing webhook URL '${safeUrlForLog(url)}' (SSRF guard); set notifications.webhook.allowLocalhost=true to target loopback/link-local explicitly`,
+			),
+			undefined,
+			"warn",
+		);
+		return DISABLED_NOTIFIER;
+	}
+	const secret = webhook?.secret;
+	const quietHours = options.quietHours;
+	const now = deps.now ?? (() => new Date());
+	const fetchImpl = deps.fetch ?? ((input: string, init: RequestInit) => fetch(input, init));
+	const loadTasks = deps.loadTasks ?? defaultLoadTasks;
+	const timeoutMs = deps.timeoutMs ?? DEFAULT_TIMEOUT_MS;
+	const onFailure = deps.onFailure;
+	let disposed = false;
+	const inflight = new Set<Promise<void>>();
+
+	async function deliverOnce(body: string): Promise<Response> {
+		const headers: Record<string, string> = { "content-type": "application/json" };
+		if (secret) {
+			// Signature over the EXACT serialized body the receiver sees, so the
+			// receiver can verify with hmac_sha256(secret, raw_body).
+			headers["x-pi-crew-signature"] = `sha256=${createHmac("sha256", secret).update(body).digest("hex")}`;
+		}
+		const controller = new AbortController();
+		const timer = setTimeout(() => controller.abort(), timeoutMs);
+		try {
+			// SSRF (security review HIGH): redirect:"follow" (the default) lets
+			// undici chase up to 20 hops WITHOUT re-running the guard — a
+			// 302 at the allowed host reaches 169.254.169.254 / loopback /
+			// internal RFC1918, and a 307 REPLAYS the signed body there. Manual
+			// mode surfaces any 3xx as a response we treat as failure below.
+			return await fetchImpl(url, {
+				method: "POST",
+				headers,
+				body,
+				signal: controller.signal,
+				redirect: "manual",
+			});
+		} finally {
+			clearTimeout(timer);
+		}
+	}
+
+	async function deliver(body: string, runId: string): Promise<void> {
+		let lastError: unknown = new Error("webhook delivery failed");
+		let attempts = 0;
+		while (attempts < MAX_ATTEMPTS) {
+			attempts++;
+			try {
+				const response = await deliverOnce(body);
+				// Always release the body — undici pins the socket until the body
+				// is drained/cancelled (default bodyTimeout ~300s), which a
+				// slow-trickle endpoint would exploit across fire-and-forget calls.
+				// biome-ignore lint/suspicious/noEmptyBlockStatements: intentional fire-and-forget — the cancel() rejection has nothing left to act on.
+				void response.body?.cancel?.().catch(() => {});
+				if (response.ok) return;
+				// 3xx under redirect:"manual" = a redirect we REFUSE to follow
+				// (the guard validated the configured URL, not the hop target).
+				// Permanent failure — no retry.
+				if (response.status >= 300 && response.status < 400) {
+					lastError = new Error(`refused redirect HTTP ${response.status} (SSRF guard — redirects are not followed)`);
+					break;
+				}
+				lastError = new Error(`HTTP ${response.status}`);
+				// Retry ONLY on 5xx (and only once). 4xx is permanent — fail fast.
+				if (response.status >= 500 && attempts < MAX_ATTEMPTS) continue;
+				break;
+			} catch (error) {
+				// Network error / abort-timeout → exactly one retry.
+				lastError = error;
+			}
+		}
+		const failure: WebhookDeliveryFailure = {
+			runId,
+			// Origin only: the raw URL (path/query/userinfo) must never reach
+			// logs or the pi event stream (security review finding).
+			url: safeUrlForLog(url),
+			attempts,
+			error: lastError instanceof Error ? lastError.message : String(lastError),
+		};
+		logInternalError(
+			"webhook-notify.delivery",
+			lastError instanceof Error ? lastError : new Error(String(lastError)),
+			`runId=${runId} url=${failure.url} attempts=${failure.attempts}`,
+			"warn",
+		);
+		try {
+			onFailure?.(failure);
+		} catch (callbackError) {
+			logInternalError("webhook-notify.onFailure", callbackError, runId);
+		}
+	}
+
+	return {
+		notifyTerminalRun(run) {
+			// NEVER throws into the caller (async-notifier poller → run lifecycle).
+			try {
+				if (disposed) return;
+				// Quiet-hours gate reuses the router's isInQuietHours — the SAME
+				// suppression window as the TUI notification path. A pattern-valid
+				// but clock-invalid value ("99:99-00:00" passes the schema regex)
+				// throws in parseHHMMRange; suppression is a nicety, not a gate —
+				// deliver anyway and log once (security review finding: the throw
+				// previously silenced every delivery with only a console line).
+				if (quietHours) {
+					try {
+						if (isInQuietHours(quietHours, now())) return;
+					} catch (quietError) {
+						logInternalError(
+							"webhook-notify.quiet-hours",
+							quietError instanceof Error ? quietError : new Error(String(quietError)),
+							`invalid quietHours='${quietHours}' — delivering anyway`,
+							"warn",
+						);
+					}
+				}
+				const tasks = loadTasks(run);
+				const payload = buildWebhookPayload(run, tasks, now());
+				const body = JSON.stringify(payload);
+				const tracked = deliver(body, run.runId).then(
+					() => undefined,
+					(error) => {
+						// deliver() is designed to never reject; belt-only.
+						logInternalError("webhook-notify.unexpected", error, run.runId, "warn");
+					},
+				);
+				inflight.add(tracked);
+				void tracked.then(() => {
+					inflight.delete(tracked);
+				});
+			} catch (error) {
+				logInternalError("webhook-notify.terminal", error, run.runId);
+			}
+		},
+		async settled() {
+			// Loop: new deliveries may start while awaiting (only relevant in tests).
+			while (inflight.size > 0) await Promise.all([...inflight]);
+		},
+		dispose() {
+			disposed = true;
+		},
+	};
+}

package/src/observability/metric-sink.ts

@@ -56,13 +56,23 @@ export function createMetricFileSink(opts: MetricFileSinkOptions): MetricSink {
 	};
 	const writeSnapshot = (snapshots: MetricSnapshot[]): Promise<void> => {
 		try {
-			const now = new Date();
-			const date = now.toISOString().slice(0, 10);
+			// RR-020 Fix 2 (cold-verify correction): gate on the crew root ALREADY
+			// EXISTING, mirroring notification-sink. The first version of this fix
+			// skipped only EMPTY snapshots — dead code in production, because
+			// wireEventToMetrics (observability.ts registration) registers ~15
+			// metrics at init, so registry.snapshot() is never []; the 60s interval
+			// therefore kept materialising <crewRoot>/state/metrics/ for projects
+			// that never ran a team. Existence gate ⇒ no-op until a real run
+			// creates the crew root; once it exists, writes (empty ticks included)
+			// are byte-identical to HEAD.
+			if (!fs.existsSync(opts.crewRoot)) return Promise.resolve();
 			const redacted = redactSecrets(snapshots);
 			if (!Array.isArray(redacted)) {
 				logInternalError("metric-sink.type", new Error("redactSecrets did not return an array"), `got=${typeof redacted}`);
 				return Promise.resolve();
 			}
+			const now = new Date();
+			const date = now.toISOString().slice(0, 10);
 			const target = ensureFd(date);
 			const line = `${JSON.stringify({ exportedAt: now.toISOString(), snapshots: redacted as MetricSnapshot[] })}\n`;
 			// Async write to avoid blocking the main thread on the 60s tick.

package/src/prompt/prompt-runtime.ts

@@ -82,7 +82,11 @@ const SEEN_STEER_ID_CAP = 1024;
  * Factory-shaped so multiple prompt-runtime instances (tests, parallel
  * workers) get independent sets.
  */
-export function createSeenSteerIdSet(): { markOrSkip: (id?: string) => boolean; size: () => number } {
+export function createSeenSteerIdSet(): {
+	markOrSkip: (id?: string) => boolean;
+	unmark: (id?: string) => void;
+	size: () => number;
+} {
 	const seen: string[] = [];
 	const set = new Set<string>();
 	return {
@@ -98,6 +102,15 @@ export function createSeenSteerIdSet(): { markOrSkip: (id?: string) => boolean;
 			}
 			return true;
 		},
+		unmark(id?: string): void {
+			// F-L2: a steer whose DELIVERY failed must release its dedup mark so
+			// the retry (after the poll's offset rewind) is not skipped as a
+			// duplicate — that would silently drop the steer instead.
+			if (id === undefined) return;
+			if (!set.delete(id)) return;
+			const idx = seen.indexOf(id);
+			if (idx !== -1) seen.splice(idx, 1);
+		},
 		size: () => set.size,
 	};
 }
@@ -861,42 +874,80 @@ export default function registerPiTeamsPromptRuntime(pi: ExtensionAPI): void {
 					try {
 						const buf = Buffer.alloc(stat.size - lastOffset);
 						fs.readSync(fd, buf, 0, buf.length, lastOffset);
-						lastOffset = stat.size;
-						const lines = buf.toString("utf8").split("\n").filter(Boolean);
-						for (const line of lines) {
+						const offsetBefore = lastOffset;
+						let cursor = 0;
+						// F-L2 (live battery 2026-09-21, run team_20260921035840): a steer
+						// written while the extension is still LOADING makes pi.sendMessage
+						// throw ("Extension runtime not initialized" — pi's loader gates
+						// action methods until bindExtensions). The old code advanced
+						// lastOffset to stat.size BEFORE the line loop and its per-line
+						// catch swallowed that throw as "malformed line" — the entry was
+						// then silently lost forever (the offset was already past it).
+						// Walk the buffer by byte offset and advance only past lines with
+						// a terminal verdict (delivered / non-steer / rejected / malformed);
+						// a DELIVERY failure rewinds to the failing line's start so the
+						// next tick re-reads it (with its dedup id unmarked).
+						while (cursor < buf.length) {
+							const nl = buf.indexOf(10, cursor);
+							const end = nl === -1 ? buf.length : nl;
+							const line = buf.subarray(cursor, end).toString("utf8");
+							if (line.length === 0) {
+								cursor = end + 1;
+								continue;
+							}
 							try {
 								const entry = JSON.parse(line) as SteerEntry;
-								if (entry.type !== "steer") continue;
-								// FIX-S1: cross-channel dedup. The broker writes the
-								// same steer to both the mailbox (live fanout via the
-								// onSteer callback below) and this JSONL file. A
-								// connected worker receives it via the broker first
-								// and via this poll second; the seen-id set ensures
-								// only the first arrival reaches pi.sendMessage.
-								const entryId =
-									typeof (entry as { id?: unknown }).id === "string" ? (entry as { id: string }).id : undefined;
-								if (!seenSteers.markOrSkip(entryId)) continue;
-								// FIX-02: sanitize each steer entry before forwarding
-								// to pi.sendMessage. Reject oversized payloads,
-								// excessive newlines, and control characters.
-								const sanitized = sanitizeSteerMessage(entry);
-								if (!sanitized.valid || sanitized.message === undefined) {
-									logInternalError(
-										"prompt-runtime.steer-rejected",
-										new Error(sanitized.reason ?? "steer-sanitization-failed"),
-										`line-preview=${line.slice(0, 64)}`,
-										"warn",
-									);
-									continue;
+								if (entry.type === "steer") {
+									// FIX-S1: cross-channel dedup. The broker writes the
+									// same steer to both the mailbox (live fanout via the
+									// onSteer callback below) and this JSONL file. A
+									// connected worker receives it via the broker first
+									// and via this poll second; the seen-id set ensures
+									// only the first arrival reaches pi.sendMessage.
+									const entryId =
+										typeof (entry as { id?: unknown }).id === "string" ? (entry as { id: string }).id : undefined;
+									if (seenSteers.markOrSkip(entryId)) {
+										// FIX-02: sanitize each steer entry before forwarding
+										// to pi.sendMessage. Reject oversized payloads,
+										// excessive newlines, and control characters.
+										const sanitized = sanitizeSteerMessage(entry);
+										if (sanitized.valid && sanitized.message !== undefined) {
+											try {
+												pi.sendMessage(
+													{ customType: "crew-steer", content: sanitized.message, display: false },
+													{ deliverAs: "steer" },
+												);
+											} catch (sendErr) {
+												// Delivery failed (e.g. pre-bind notInitialized).
+												// Release the dedup mark so the retry after the
+												// offset rewind is not skipped as a duplicate, then
+												// rewind: cursor stays at this line's start so the
+												// next tick re-reads the entry.
+												seenSteers.unmark(entryId);
+												logInternalError(
+													"prompt-runtime.steer-delivery-failed",
+													sendErr instanceof Error ? sendErr : new Error(String(sendErr)),
+													`line-preview=${line.slice(0, 64)}`,
+													"warn",
+												);
+												break;
+											}
+										} else {
+											logInternalError(
+												"prompt-runtime.steer-rejected",
+												new Error(sanitized.reason ?? "steer-sanitization-failed"),
+												`line-preview=${line.slice(0, 64)}`,
+												"warn",
+											);
+										}
+									}
 								}
-								pi.sendMessage(
-									{ customType: "crew-steer", content: sanitized.message, display: false },
-									{ deliverAs: "steer" },
-								);
 							} catch {
-								// Malformed line — skip
+								// Malformed line — skip (terminal verdict — advance past)
 							}
+							cursor = end + 1;
 						}
+						lastOffset = offsetBefore + Math.min(cursor, buf.length);
 					} finally {
 						try {
 							fs.closeSync(fd);

package/src/prompt/worker-events-channel.ts

@@ -107,6 +107,18 @@ export function createWorkerEventsChannel(options: WorkerEventsChannelOptions =
 	const write = (item: { type: string; data: Record<string, unknown>; droppedSinceLast: number }): boolean => {
 		try {
 			appendEvent(eventsPath as string, {
+				// TeamEvent contract: `time` (ISO string) is REQUIRED — the import
+				// bundle validator (run-bundle-schema.ts validateEvent) rejects the
+				// whole bundle when any event lacks it, and event readers sort by it.
+				// The channel's default appender is a raw O_APPEND writer (NOT
+				// event-log.ts appendEvent, which stamps time itself), so the stamp
+				// must happen HERE — once, at the single choke point both emit()
+				// and emitTerminal() pass through. Found live 2026-09-21: every
+				// worker.started/completed of a tmux-surface run was written
+				// time-less, and exporting that run produced an un-importable bundle
+				// ("events[i].time must be a string"). Uses the injected clock so
+				// tests stay deterministic.
+				time: new Date(now()).toISOString(),
 				type: item.type,
 				runId,
 				taskId,