pi-crew 0.11.22 → 0.11.24

package/docs/dynamic-workflows.md

@@ -25,6 +25,9 @@ export default async function (ctx) {
   const synth = await ctx.agent({ role: "analyst", prompt: "Merge + dedupe findings", inputs: reports.map(r => r.artifactPath) });
 
   ctx.phase("Review");
+  // NOTE (R2-M-B5): the identical-call cache is RESUME-ONLY — every
+  // ctx.review / ctx.retry iteration really re-runs the task (fixed
+  // semantics; see the caveat under WorkflowCtx API below).
   for (let i = 0; i < 3; i++) {
     const review = await ctx.review(synth.taskId, "reviewer");
     if (review.outcome === "accept") break;
@@ -52,8 +55,8 @@ Slash command: `/workflows` lists all workflows (static + dynamic).
 | `ctx.agent({role, prompt, model?, skill?, maxTurns?, inputs?, schema?, worktree?})` | Spawn one agent, await `{ok, text, structured, artifactPath, usage}`. Concurrency enforced by `ctx.semaphore`. `schema?` (round-13) is a TypeBox schema — when set, output is validated and mismatch yields `ok:false`. `worktree?` (round-17) spawns the agent in an isolated git worktree (default false; falls back to normal cwd + warning in a non-git repo). |
 | `ctx.fanOut(items, limit, fn)` | Bounded parallel fan-out (wraps `mapConcurrent`). |
 | `ctx.pipeline(items, ...stages)` | **round-16.** Multi-stage pipeline: each item passes through all stages sequentially; different items run concurrently (bounded by `ctx.semaphore`). A failed stage yields `null` for that item (logged via `ctx.log`) and other items continue. Aborts propagate. Returns `(TResult\|null)[]`. |
-| `ctx.review(taskId, reviewerRole?)` | Run a reviewer; parse `{outcome, feedback}`. |
-| `ctx.retry(taskId, {feedback?})` | Re-run with feedback (wraps `executeWithRetry`). |
+| `ctx.review(taskId, reviewerRole?)` | Run a reviewer; parse `{outcome, feedback}`. Re-runs the task every call (see the identical-call cache caveat below). |
+| `ctx.retry(taskId, {feedback?})` | Re-run with feedback (wraps `executeWithRetry`). Always re-spawns (never cached). |
 | `ctx.mail(to, body, opts?)` | Mailbox message to another agent/leader. |
 | `ctx.gatherReplies(ids, deadlineMs)` | Block until N replies arrive or deadline. |
 | `ctx.renderTemplate(name, vars)` | Render a built-in plan template. |
@@ -68,6 +71,15 @@ Slash command: `/workflows` lists all workflows (static + dynamic).
 explicit `agent` name → `team.roles[].agent` → `discoverAgents` by name → synthesize
 minimal (`source:'dynamic'`).
 
+> **Identical-call cache caveat (R2-M-B5, fixed semantics).** The
+> completed-calls cache is consulted ONLY for calls hydrated from a resumed
+> checkpoint — identical call options within a LIVE run always re-spawn.
+> Historically the cache also hit within a run, which made
+> `while(true){review; if accept break; retry}` loops replay round-1 verdicts
+> forever (stale verdicts until the agent-call cap aborted the run). If you
+> need true idempotency within a run, structure the workflow to call each
+> distinct step once and rely on resume for crash recovery.
+
 ### Pipeline (round-16 P2-1)
 
 `ctx.pipeline(items, ...stages)` runs a **multi-stage transform** over a list of

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "pi-crew",
-	"version": "0.11.22",
+	"version": "0.11.24",
 	"description": "Pi extension for coordinated AI teams, workflows, worktrees, and async task orchestration",
 	"author": "baphuongna",
 	"license": "MIT",
@@ -134,9 +134,9 @@
 		]
 	},
 	"peerDependencies": {
-		"@earendil-works/pi-agent-core": "*",
-		"@earendil-works/pi-ai": "*",
-		"@earendil-works/pi-coding-agent": "*",
+		"@earendil-works/pi-agent-core": ">=1.0.4",
+		"@earendil-works/pi-ai": ">=1.0.4",
+		"@earendil-works/pi-coding-agent": ">=1.0.4",
 		"@earendil-works/pi-tui": ">=1.0.4 <2.0.0",
 		"@sinclair/typebox": "*"
 	},

package/src/agents/discover-agents.ts

@@ -1,6 +1,7 @@
 import * as fs from "node:fs";
 import * as path from "node:path";
 import { type LoadedPiTeamsConfig, loadConfig } from "../config/config.ts";
+import { LIMIT_CEILINGS } from "../config/config-validation.ts";
 import { getCrewEnv } from "../config/env-vars.ts";
 import { discoverProviderExtensionPaths } from "../runtime/model/provider-extensions.ts";
 import { parseCsv, parseFrontmatter } from "../utils/frontmatter.ts";
@@ -462,11 +463,16 @@ function parseAgentFile(filePath: string, source: ResourceSource): AgentConfig |
 			contextMode,
 			maxTurns: (() => {
 				const n = Number.parseInt(frontmatter.maxTurns, 10);
-				return Number.isFinite(n) && n > 0 ? n : undefined;
+				// R7-A3 (wave-2b): clamp to the config ceiling — a repo-sourced agent
+				// file with maxTurns: 1e9 became the effective run cap whenever
+				// runtime.maxTurns was unset (config paths already bound at 10k).
+				return Number.isFinite(n) && n > 0 ? Math.min(n, LIMIT_CEILINGS.runtimeMaxTurns) : undefined;
 			})(),
 			maxTokens: (() => {
 				const n = Number.parseInt(frontmatter.maxTokens, 10);
-				return Number.isFinite(n) && n > 0 ? n : undefined;
+				// R7-A3: same clamp class — budget-equivalent token counts use the
+				// handoff-budget ceiling (1M) as the family bound.
+				return Number.isFinite(n) && n > 0 ? Math.min(n, LIMIT_CEILINGS.runtimeHandoffBudgetTokens) : undefined;
 			})(),
 			effort:
 				frontmatter.effort === "low" || frontmatter.effort === "medium" || frontmatter.effort === "high"

package/src/config/config-validation.ts

@@ -63,7 +63,9 @@ function validateConfigWithWarnings(raw: unknown): string[] {
 	return [];
 }
 
-const LIMIT_CEILINGS = {
+// wave-2b (R7-A3): exported so agent frontmatter parsing (discover-agents)
+// clamps project-sourced values with the SAME ceilings the config paths use.
+export const LIMIT_CEILINGS = {
 	maxConcurrentWorkers: 1024,
 	maxTaskDepth: 100,
 	maxChildrenPerTask: 1000,

package/src/config/env-allowlist-registry.ts

@@ -69,6 +69,11 @@ export const ESSENTIAL_PROCESS_ENV_VARS: readonly string[] = [
 	"XDG_DATA_HOME",
 	"XDG_CACHE_HOME",
 	"XDG_RUNTIME_DIR",
+	// R1-M1 (wave-2b): Node's fs.realpathSync.native / os.tmpdir / sqlite WAL
+	// all consult TMPDIR; a host with a non-default TMPDIR spawned children that
+	// diverged from it (temp paths under /tmp vs $TMPDIR) — pass it through so
+	// parent and children agree on the temp root.
+	"TMPDIR",
 ];
 
 /** Node/npm toolchain vars (nvm prefixes, npm registry/config). */

package/src/config/env-vars.ts

@@ -78,7 +78,10 @@ export const CREW_ENV_VARS: Record<string, CrewEnvVarSpec> = {
 		name: "PI_CREW_DEPTH",
 		mirror: "PI_TEAMS_DEPTH",
 		mirrorPrecedence: "crew",
-		default: "0",
+		// wave-2b: default was the STRING "0" on an int parser — getCrewEnvParsed
+		// returned the raw string from the fallback, so typed readers (getCrewEnvInt)
+		// saw undefined instead of 0. Numeric default routes through the parser.
+		default: 0,
 		parser: "int",
 		doc: "current crew depth (pi-args.ts:72 reads CREW ?? TEAMS ?? '0')",
 	},
@@ -86,7 +89,7 @@ export const CREW_ENV_VARS: Record<string, CrewEnvVarSpec> = {
 		name: "PI_TEAMS_DEPTH",
 		mirror: "PI_CREW_DEPTH",
 		mirrorPrecedence: "crew",
-		default: "0",
+		default: 0, // wave-2b: numeric default on int parser (was string "0")
 		parser: "int",
 		doc: "crew depth mirror (fallback of PI_CREW_DEPTH)",
 	},
@@ -508,7 +511,7 @@ export const CREW_ENV_VARS: Record<string, CrewEnvVarSpec> = {
 	PI_CREW_VERIFY_GATE_TIMEOUT_MS: {
 		name: "PI_CREW_VERIFY_GATE_TIMEOUT_MS",
 		parser: "int",
-		default: "120000",
+		default: 120_000, // wave-2b: numeric default (was string "120000" — fallback bypassed the parser)
 		doc: "U13 per-check timeout in ms for the deterministic verify_gate pre-gate commands. Invalid/≤0 → 120000, mirroring runPhaseGates (runtime/verification/verify-gate.ts resolveVerifyGateTimeoutMs)",
 	},
 	PI_CREW_VERIFY_DETERMINISM: {
@@ -523,7 +526,7 @@ export const CREW_ENV_VARS: Record<string, CrewEnvVarSpec> = {
 	PI_CREW_RPC_TURN_TIMEOUT_MS: {
 		name: "PI_CREW_RPC_TURN_TIMEOUT_MS",
 		parser: "int",
-		default: "600000",
+		default: 600_000, // wave-2b: numeric default (was string "600000" — fallback bypassed the parser)
 		doc: "W7/DR1 belt-and-suspenders turn timeout for the EXPERIMENTAL RPC worker transport: max ms a prompt-accepted turn may run without agent_settled before the transport fails with the early-failure shape (DR5 guard still blocks the stdio fallback once a session event was seen). Env-only while RPC stays experimental. Invalid/≤0 → 600000 (rpc-worker.ts resolveRpcTurnTimeoutMs)",
 	},
 	PI_CREW_AUTO_EXIT: {
@@ -533,13 +536,13 @@ export const CREW_ENV_VARS: Record<string, CrewEnvVarSpec> = {
 	PI_CREW_AUTO_PRUNE_KEEP: {
 		name: "PI_CREW_AUTO_PRUNE_KEEP",
 		parser: "int",
-		default: "10",
+		default: 10, // wave-2b: numeric default (was string "10" — fallback bypassed the parser)
 		doc: "DP-01: number of most-recent finished runs the session-start auto-prune retains (was hard-coded 10). Invalid/negative → 10 with a warning (run-maintenance.ts:resolveAutoPruneKeep)",
 	},
 	PI_CREW_AUTO_PRUNE_AGE_FLOOR_HOURS: {
 		name: "PI_CREW_AUTO_PRUNE_AGE_FLOOR_HOURS",
 		parser: "int",
-		default: "24",
+		default: 24, // wave-2b: numeric default (was string "24" — fallback bypassed the parser)
 		doc: "DP-01: auto-prune never deletes a finished run younger than this many hours, even beyond top-keep — evidence/incident runs survive a session restart (0 disables; run-maintenance.ts:resolveAutoPruneAgeFloorMs)",
 	},
 	PI_CREW_SURFACE: {

package/src/config/role-tools.ts

@@ -17,13 +17,14 @@ export interface RoleToolConfig {
 }
 
 export const ROLE_TOOL_CONFIGS: Record<string, RoleToolConfig> = {
-	// Explorer - Read-only exploration; bash is included for git log/show
-	// (decisions stream needs commit-history mining) but edit/write stay
-	// excluded. State-mutation safety is enforced separately by
-	// READ_ONLY_ROLES in role-permission.ts.
+	// Explorer - Read-only exploration. Wave-3 (Chain A cheapest cut, deep review
+	// 2026-10-16/17): bash REMOVED from the enforced allowlist — the advertised
+	// read-only contract is now the enforceable one (READ_ONLY_ROLES state-mutation
+	// gating cannot stop host-level persistence via arbitrary commands, e.g.
+	// `git config --global` or writes to ~/.pi/agent). Frontmatter mirrors this.
 	explorer: {
-		tools: ["read", "grep", "find", "ls", "glob", "bash", "ask"],
-		excludeTools: ["edit", "write", "web"],
+		tools: ["read", "grep", "find", "ls", "glob", "ask"],
+		excludeTools: ["edit", "write", "bash", "web"],
 	},
 
 	// Analyst - Read and analyze, limited execution

package/src/extension/management.ts

@@ -15,6 +15,7 @@ import { projectCrewRoot, userPiRoot } from "../utils/paths.ts";
 import { allWorkflows, discoverWorkflows, invalidateWorkflowDiscoveryCache } from "../workflows/discover-workflows.ts";
 import type { WorkflowConfig, WorkflowStep } from "../workflows/workflow-config.ts";
 import { serializeWorkflow } from "../workflows/workflow-serializer.ts";
+import { assertRootOnlyAction } from "./team-tool/destructive-gate.ts";
 import { enforceDestructiveIntent } from "./team-tool/intent-policy.ts";
 import type { TeamToolDetails } from "./team-tool-types.ts";
 import { type PiTeamsToolResult, toolResult } from "./tool-result.ts";
@@ -415,6 +416,12 @@ export function handleUpdate(params: TeamToolParamsValue, ctx: ManagementContext
 	if (parsed.error) return result(parsed.error, "error", true);
 	const cfg = parsed.value!;
 	const current = resolved.resource!;
+	// Wave-3 root-gate (R5-M-B2): the update path resolves its write scope from
+	// the MATCHED resource (params.scope may be undefined and match either
+	// tier), so the facade gate cannot decide — gate HERE on the resolved
+	// source. Non-root sessions may only rewrite project-tier resources.
+	const updateGate = assertRootOnlyAction("update", undefined, current.source === "project" ? "project" : "user");
+	if (updateGate) return result(updateGate.message, "error", true);
 	const nextName = hasOwn(cfg, "name") ? sanitizeName(String(cfg.name ?? "")) : current.name;
 	if (!nextName) return result("config.name is invalid after sanitization.", "error", true);
 	const source = current.source === "project" ? "project" : "user";

package/src/extension/register.ts

@@ -75,6 +75,21 @@ export async function registerPiTeams(pi: ExtensionAPI): Promise<void> {
 		);
 	}
 
+	// Wave-3 (attack-chain A / R2-M-B1 hardening): hermeticWorkers is DEFAULT
+	// ON; runtime.hermeticWorkers=false is a deliberate trust downgrade (worker
+	// pi sessions load ambient extensions/skills — the parity state where a
+	// repo-planted worker can reach the `team` tool's user-tier persistence).
+	// Emit ONE prominent warning at extension init so the operator sees it.
+	try {
+		if (loadConfig(process.cwd()).config.runtime?.hermeticWorkers === false) {
+			console.warn(
+				"[pi-crew] ⚠ SECURITY: runtime.hermeticWorkers=false — workers will load ambient extensions/skills (non-default trust posture). Worker sessions can then persist user-tier config/agents (every future session). Re-enable hermetic spawns unless parity mode is specifically required.",
+			);
+		}
+	} catch {
+		/* config read failures surface through their own channel */
+	}
+
 	startRuntimeWarmup();
 	primePeerDep().catch(() => undefined);
 	deployBundledThemes();

package/src/extension/run-index.ts

@@ -27,9 +27,32 @@ function readManifest(filePath: string): TeamRunManifest | undefined {
  */
 const TEMP_DIR_ROOTS = [os.tmpdir(), "/var/tmp", "/tmp"];
 
+/** R7-P2 (wave-2b): canonicalize BOTH sides of the temp-root comparison.
+ * macOS returns /var/... from one API and /private/var/... from another
+ * (getcwd is physical); the raw startsWith then misses and phantom test runs
+ * leak into production dashboards. realpath'd roots + realpath'd compared
+ * paths (best-effort — a vanished path simply doesn't match, as before). */
+const TEMP_DIR_ROOTS_REAL = TEMP_DIR_ROOTS.map((root) => {
+	try {
+		return fs.realpathSync.native(root);
+	} catch {
+		return root;
+	}
+});
+
+function realPathOrNull(p: string): string | null {
+	try {
+		return fs.realpathSync.native(p);
+	} catch {
+		return null;
+	}
+}
+
 function isTempWorkspacePath(p: string | undefined): boolean {
 	if (!p) return false;
-	return TEMP_DIR_ROOTS.some((t) => p.startsWith(t + path.sep));
+	const real = realPathOrNull(p);
+	if (!real) return false; // unreadable/vanished — do not guess
+	return TEMP_DIR_ROOTS_REAL.some((t) => real === t || real.startsWith(t + path.sep));
 }
 
 function collectRuns(root: string, maxEntries?: number, signal?: AbortSignal): TeamRunManifest[] {

package/src/extension/team-tool/destructive-gate.ts

@@ -21,6 +21,8 @@
  *  5. Otherwise → blocked with a reason telling the user what to pass.
  */
 
+import { currentCrewDepth } from "../../runtime/model/pi-args.ts";
+
 export const DESTRUCTIVE_TEAM_ACTIONS = new Set([
 	"delete",
 	"forget",
@@ -56,3 +58,209 @@ export function shouldBlockDestructiveTeamAction(action: string | undefined, inp
 	if (forceBypassesReferenceChecks) return undefined;
 	return `Destructive action '${action}' requires confirm=true${action === "delete" ? " (or force=true to bypass reference checks)" : ""}.`;
 }
+
+// ---------------------------------------------------------------------------
+// Root-session gate (merged from root-gate.ts — Wave-3; lazy-import budget)
+// ---------------------------------------------------------------------------
+/**
+ * Root-session gate for user-tier persistent team actions (Wave-3).
+ *
+ * Deep-audit findings R2-M-B1, R3-SEC-1, R5-M-B1, R5-M-B2 (pi-crew-deep-review
+ * 2026-10-16): eight team-tool entry points could persist state OUTSIDE the
+ * current workspace — user-tier config (`~/.pi/agent/pi-crew.json`), user-tier
+ * agents/teams/workflows (`~/.pi/agent/{agents,teams,workflows}/`), the
+ * project scheduler, autonomous goal loops, and the Pi UI theme — from ANY
+ * caller with the `team` tool, including nested workers and repo-planted
+ * parity sessions. A worker that persists there survives the task and
+ * affects every future pi session (attack chains A/D/E).
+ *
+ * OWNER-DECIDED policy (Wave-3): gate on WORKER ORIGIN — actions initiated
+ * from a NON-ROOT session (PI_CREW_KIND=subagent or crew depth > 0) are
+ * rejected when they would write outside the project tier; project-scope
+ * writes stay worker-reachable (project-tier agent files already get SEC-1
+ * extension stripping).
+ *
+ * Gated matrix (non-root sessions only):
+ *   - `schedule`  — ALL mutations (add is the default subAction; reads use
+ *                   `scheduled`, a different action).
+ *   - `goal`      — `start` (any), plus ANY subAction carrying force:true.
+ *   - `config`    — mutations whose resolved scope is `user` (project allowed).
+ *   - `settings`  — `set`/`unset` at scope `user` (project allowed);
+ *                   `theme` always (it always writes the user tier).
+ *   - `autonomy`  — mutations (the autonomous patch always writes user tier).
+ *   - `create` /  — when resolved scope is `user` (create defaults to user;
+ *   - `update`     update is gated at the resolved resource's scope — see
+ *                   the post-`resolveMutable` call in management.ts).
+ *
+ * Reads (config/status/list, settings list/get, schedule `scheduled`) are
+ * never gated. `dryRun` previews that write nothing pass through, mirroring
+ * destructive-gate.ts's dryRun convention.
+ */
+
+/** Typed error so callers/tests can distinguish the gate from handler errors. */
+export class RootSessionRequiredError extends Error {
+	constructor(message: string) {
+		super(message);
+		this.name = "RootSessionRequiredError";
+	}
+}
+
+/**
+ * True when this process is the user's ROOT pi session (not a pi-crew worker:
+ * PI_CREW_KIND !== "subagent" AND currentCrewDepth === 0). Mirrors the broker
+ * credential gate in lifecycle-handlers.ts — the depth-gate pattern proven
+ * in-repo (broker tests).
+ */
+export function isRootSession(env: NodeJS.ProcessEnv = process.env): boolean {
+	if (env.PI_CREW_KIND === "subagent") return false;
+	try {
+		return currentCrewDepth(env) === 0;
+	} catch {
+		return false;
+	}
+}
+
+export type RootGateScope = "user" | "project";
+
+/**
+ * Core predicate: does this (action, subcommand, scope) combination require a
+ * root session? Pure — callers resolve the subcommand/scope from their params
+ * (see {@link rootGateBlockReason} for the raw-params resolver used by the
+ * team-tool facade).
+ *
+ * @returns a {@link RootSessionRequiredError} when the action must be blocked
+ * for non-root sessions, or `undefined` when allowed.
+ */
+export function assertRootOnlyAction(
+	action: string,
+	subcommand: string | undefined,
+	scope: RootGateScope | undefined,
+	env: NodeJS.ProcessEnv = process.env,
+): RootSessionRequiredError | undefined {
+	if (isRootSession(env)) return undefined;
+	const detail = (what: string): RootSessionRequiredError =>
+		new RootSessionRequiredError(
+			`root-session required: team action '${action}'${subcommand ? ` (${subcommand})` : ""} ${what}. ` +
+				"This session is a pi-crew worker (PI_CREW_KIND/subagent or depth>0); user-tier state persists beyond the task and is reserved for the user's root pi session. " +
+				(what.includes("project") ? "" : "Re-run with scope:'project' for project-local effects, or from the root session."),
+		);
+	switch (action) {
+		case "schedule":
+			// ALL mutations; reads go through the separate `scheduled` action.
+			return detail("creates/modifies persistent scheduled jobs");
+		case "goal":
+			if (subcommand === "start") return detail("starts a persistent autonomous goal loop");
+			if (subcommand === "force") return detail("bypasses goal-ownership via force:true (stop/resume/clear/pause)");
+			// other goal ops (status/pause/stop without force) stay open.
+			return undefined;
+		case "config":
+			if (scope === "user") return detail("writes user-scope config (all future sessions)");
+			return undefined;
+		case "settings":
+			// `theme` always writes the user tier; set/unset gated at user scope.
+			if (subcommand === "theme") return detail("switches the user-tier Pi UI theme");
+			if ((subcommand === "set" || subcommand === "unset") && scope === "user")
+				return detail("writes user-scope settings (all future sessions)");
+			return undefined;
+		case "autonomy":
+			// The autonomous patch ALWAYS writes the user tier.
+			return detail("writes the user-tier autonomy config (all future sessions)");
+		case "create":
+			if (scope === "user") return detail("plants a user-tier resource loaded by every future session");
+			return undefined;
+		case "update":
+			if (scope === "user") return detail("rewrites a user-tier resource loaded by every future session");
+			return undefined;
+		default:
+			return undefined;
+	}
+}
+
+export interface RootGateParamsLike {
+	action?: unknown;
+	/** Top-level scope override ("user" | "project" | "both"). */
+	scope?: unknown;
+	/** Top-level force (goal ops). */
+	force?: unknown;
+	/** Top-level subAction (schedule/goal). */
+	subAction?: unknown;
+	/** Advisory-only dryRun preview flag. */
+	dryRun?: unknown;
+	config?: unknown;
+}
+
+function configRecord(config: unknown): Record<string, unknown> {
+	return config && typeof config === "object" && !Array.isArray(config) ? (config as Record<string, unknown>) : {};
+}
+
+function resolveScopeParam(params: RootGateParamsLike): RootGateScope {
+	const fromConfig = configRecord(params.config).scope;
+	const raw = params.scope ?? fromConfig;
+	return raw === "project" ? "project" : "user";
+}
+
+/**
+ * Facade resolver: derive (subcommand, scope) from raw team-tool params for
+ * the gated actions and decide whether a NON-ROOT session must be blocked.
+ * `update` is special: its effective write scope is the matched resource's
+ * scope, unknown until `resolveMutable` — the facade blocks explicit
+ * `scope:"user"` and management.ts gates the resolved case.
+ *
+ * @returns block reason string, or `undefined` to allow.
+ */
+export function rootGateBlockReason(params: RootGateParamsLike, env: NodeJS.ProcessEnv = process.env): string | undefined {
+	const action = typeof params.action === "string" ? params.action : undefined;
+	if (!action) return undefined;
+	const cfg = configRecord(params.config);
+	const rawSub =
+		(typeof params.subAction === "string" ? params.subAction : undefined) ??
+		(typeof cfg.subAction === "string" ? cfg.subAction : undefined);
+	const subcommand = typeof rawSub === "string" ? rawSub.toLowerCase() : undefined;
+	const scope = resolveScopeParam(params);
+	const force = params.force === true || cfg.force === true;
+
+	// Reads / previews never gated (destructive-gate dryRun convention).
+	const isPreview = params.dryRun === true || cfg.dryRun === true;
+
+	// goal: gate `start` and any force:true op; status/pause/read-only stay open.
+	if (action === "goal") {
+		if (force) return assertRootOnlyAction("goal", "force", scope, env)?.message;
+		if (subcommand === "start" && !isPreview) return assertRootOnlyAction("goal", "start", scope, env)?.message;
+		return undefined;
+	}
+	// schedule: every subAction path mutates (add is the default); previews of
+	// create carry no dryRun contract in handle-schedule — gate all.
+	if (action === "schedule") {
+		return assertRootOnlyAction("schedule", subcommand, scope, env)?.message;
+	}
+	// config: gate only the WRITE path (non-empty patch or unset paths).
+	if (action === "config") {
+		const patchKeys = Object.keys(cfg).filter(
+			(k) => !["scope", "unset", "subAction", "dryRun", "confirm", "force"].includes(k) && cfg[k] !== undefined,
+		);
+		const unset = Array.isArray(cfg.unset) ? cfg.unset.length > 0 : cfg.unset !== undefined;
+		const isWrite = patchKeys.length > 0 || unset;
+		if (!isWrite) return undefined;
+	}
+	// autonomy: gate only the WRITE path (patch present).
+	if (action === "autonomy") {
+		const patchKeys = Object.keys(cfg).filter((k) => !["subAction", "dryRun", "confirm"].includes(k) && cfg[k] !== undefined);
+		if (patchKeys.length === 0) return undefined;
+	}
+	// settings: derive the subcommand from `config.args` ("set k v", "unset k",
+	// "theme <name>", …). Non-mutating subcommands (list/get/json/scope/themes
+	// browse) pass. The derived sub REPLACES the (undefined) subAction token.
+	let effectiveSub = subcommand;
+	if (action === "settings") {
+		const args = typeof cfg.args === "string" ? cfg.args.trim() : "";
+		const sub = args === "theme" || args.startsWith("theme ") ? "theme" : (args.split(/\s+/)[0] ?? "");
+		if (sub !== "set" && sub !== "unset" && sub !== "theme") return undefined;
+		effectiveSub = sub;
+	}
+	// goal force:true (top-level or config) is its own gated token.
+	if (action === "goal" && force) effectiveSub = "force";
+	// create/update/config/settings/autonomy below share scope gating.
+	if (isPreview && action === "create") return undefined;
+	const reason = assertRootOnlyAction(action, effectiveSub, scope, env);
+	return reason?.message;
+}

package/src/extension/team-tool/goal-wrap.ts

@@ -287,7 +287,17 @@ export async function startGoalWrappedRun(
 			},
 		});
 
-		const spawned = await spawnBackgroundTeamRun(goalLoopManifest);
+		// wave-2b (goal-wrap zombie): a spawn failure left goalState saved as
+		// "running" with NO pid — `goal status` reports a live loop forever.
+		// Mirror goal.ts:236-241 (the non-wrapped goal-loop's spawn-failure
+		// branch): revert the status (blocked — the GoalLoopStatus enum has no
+		// "failed"; blocked is the existing precedent for this exact condition)
+		// and emit the failure event.
+		const spawned = await spawnBackgroundTeamRun(goalLoopManifest).catch((spawnError: unknown) => {
+			const message = spawnError instanceof Error ? spawnError.message : String(spawnError);
+			store.setStatus(goalId, "blocked", paths.eventsPath);
+			throw spawnError;
+		});
 		const pid = spawned.pid ?? 0;
 		// FIX: persist async.pid on the OUTER goal-loop manifest (not just goal state).
 		// Without this, async-notifier.markDeadAsyncRunIfNeeded returns early on

package/src/extension/team-tool/goal.ts

@@ -14,6 +14,7 @@
  *       §0c C11 (control path: cooperative flag + handleCancel(currentRunId) via abortOwned).
  */
 
+import { LIMIT_CEILINGS } from "../../config/config-validation.ts";
 import { spawnBackgroundTeamRun } from "../../runtime/async-runner.ts";
 import { GoalStore } from "../../runtime/goal-workflow/goal-state-store.ts";
 import { captureRunModelContext } from "../../runtime/model/session-model.ts";
@@ -76,6 +77,17 @@ function formatGoalStatus(goal: GoalLoopState): string {
 		.join("\n");
 }
 
+/**
+ * R3-SEC-1 rider (Wave-3): clamp worker-supplied maxTurns to the SAME runtime
+ * ceiling the config paths use (LIMIT_CEILINGS.runtimeMaxTurns — no dedicated
+ * goal ceiling exists; budgetTotal is already guarded in handleStart).
+ * @internal — exported for the clamp pinning test.
+ */
+export function clampGoalMaxTurns(raw: unknown): number {
+	const parsed = typeof raw === "number" && Number.isFinite(raw) && raw > 0 ? raw : 20; // Claude/Codex parity default
+	return Math.min(Math.floor(parsed), LIMIT_CEILINGS.runtimeMaxTurns);
+}
+
 /** `goal start` — create state + spawn background process (P0: writes state; spawn wiring TBD per host). */
 async function handleStart(input: GoalSubActionInput): Promise<ReturnType<typeof result>> {
 	const { params, ctx, store } = input;
@@ -86,7 +98,7 @@ async function handleStart(input: GoalSubActionInput): Promise<ReturnType<typeof
 		const goalId = store.createGoalId();
 		const ownerSessionId = ctx.sessionId ?? "unknown";
 		const now = new Date().toISOString();
-		const maxTurns = typeof params.config?.maxTurns === "number" && params.config.maxTurns > 0 ? params.config.maxTurns : 20; // Claude/Codex parity default
+		const maxTurns = clampGoalMaxTurns(params.config?.maxTurns);
 		// P1d (RFC v0.5 §P1d): budget is REQUIRED. Either an explicit budgetTotal (>=1000, enforced
 		// by schema) OR an explicit budgetUnlimited:true opt-out (audit-logged). No silent unbounded
 		// default — without a cap the loop could spend unboundedly across many turns × workers.

package/src/extension/team-tool/respond.ts

@@ -327,12 +327,14 @@ export function handleRespond(params: TeamToolParamsValue, ctx: TeamContext): Pi
 		if (requeuedIds.length > 0) {
 			try {
 				const existingRuntimes = new Map(readCrewAgents(fresh.manifest).map((a) => [a.taskId, a.runtime]));
-				saveCrewAgents(
-					fresh.manifest,
-					updatedTasks
-						.filter((task) => requeuedIds.includes(task.id))
-						.map((task) => recordFromTask(fresh.manifest, task, existingRuntimes.get(task.id) ?? "child-process")),
-				);
+				// R4-A1 (fix): merge requeued records into the existing index — the
+				// subset-only save wiped sibling agent records (team-runner.ts:525 pattern).
+				const mergedById = new Map(readCrewAgents(fresh.manifest).map((record) => [record.id, record] as const));
+				for (const task of updatedTasks.filter((task) => requeuedIds.includes(task.id))) {
+					const record = recordFromTask(fresh.manifest, task, existingRuntimes.get(task.id) ?? "child-process");
+					mergedById.set(record.id, record);
+				}
+				saveCrewAgents(fresh.manifest, [...mergedById.values()]);
 			} catch (error) {
 				logInternalError("team-tool.handleRespond.crewAgents", error, `runId=${fresh.manifest.runId}`);
 			}

package/src/extension/team-tool/run.ts

@@ -137,7 +137,7 @@ function scheduleBackgroundEarlyExitGuard(cwd: string, runId: string, pid: numbe
 					runId: failed.runId,
 					message,
 					data: { pid, detail: liveness.detail },
-				});
+				}).catch((error) => logInternalError("team-tool.run.asyncFailedEvent", error, `runId=${failed.runId}`)); // R5-M-B3 (fix)
 			});
 		} catch (error) {
 			// One-shot unref'd timer — a lock-contention error must not escape and
@@ -589,7 +589,7 @@ export async function handleRun(params: TeamToolParamsValue, ctx: TeamContext):
 						envTeams: getCrewEnv("PI_TEAMS_EXECUTE_WORKERS"),
 					},
 				},
-			});
+			}).catch((error) => logInternalError("team-tool.run.blockedEvent", error, `runId=${blocked.runId}`)); // R5-M-B3 (fix)
 			unregisterActiveRun(blocked.runId);
 			return result(
 				[
@@ -622,7 +622,7 @@ export async function handleRun(params: TeamToolParamsValue, ctx: TeamContext):
 			type: "async.spawned",
 			runId: effectiveManifest.runId,
 			data: { pid: spawned.pid, logPath: spawned.logPath },
-		});
+		}).catch((error) => logInternalError("team-tool.run.asyncSpawnedEvent", error, `runId=${effectiveManifest.runId}`)); // R5-M-B3 (fix)
 		ctx.onRunStarted?.(effectiveManifest.runId);
 		scheduleBackgroundEarlyExitGuard(resolvedCtx.cwd, effectiveManifest.runId, spawned.pid, spawned.logPath);
 		// CORE-8: unified deadline for waitForRun timeout (background process is detached).
@@ -684,7 +684,7 @@ export async function handleRun(params: TeamToolParamsValue, ctx: TeamContext):
 					envTeams: getCrewEnv("PI_TEAMS_EXECUTE_WORKERS"),
 				},
 			},
-		});
+		}).catch((error) => logInternalError("team-tool.run.blockedEvent", error, `runId=${blocked.runId}`)); // R5-M-B3 (fix)
 		unregisterActiveRun(blocked.runId);
 		return result(
 			[

package/src/extension/team-tool.ts

@@ -57,6 +57,7 @@ import { waitForRun } from "../runtime/run-tracker.ts";
 import { normalizeSkillOverride } from "../runtime/skill-instructions.ts";
 import { formatActionSuggestion } from "./action-suggestions.ts";
 import { type CacheControlDeps, invalidateSnapshot } from "./team-tool/cache-control.ts";
+import { rootGateBlockReason } from "./team-tool/destructive-gate.ts";
 // API-5 facade dispatch: domain routers replace the former 54-case switch.
 import {
 	domainForAction,
@@ -1225,6 +1226,15 @@ export async function handleTeamTool(params: TeamToolParamsValue, ctx: TeamConte
 	// numbers before domain routers read them. See normalizeLooseNumericFields.
 	params = normalizeLooseNumericFields(params);
 	const action = params.action ?? "list";
+	// Wave-3 root-gate (R2-M-B1/R3-SEC-1/R5-M-B1/B2): user-tier persistent
+	// actions (schedule mutations, goal start/force, user-scope config/settings/
+	// create/update, autonomy, settings theme) are reserved for the user's
+	// ROOT session. Non-root callers (workers) can still write project scope.
+	// Single chokepoint: every domain router dispatch passes through here.
+	const rootGateReason = rootGateBlockReason(params);
+	if (rootGateReason) {
+		return result(rootGateReason, { action: String(action), status: "error" }, true);
+	}
 	const domain = domainForAction(action);
 	switch (domain) {
 		case "run":