pi-crew 0.11.22 → 0.11.24

package/src/runtime/live-session/live-agent-manager.ts

@@ -549,6 +549,21 @@ export function clearLiveAgentsForTest(): void {
 	invalidateSortedLiveAgents();
 }
 
+/**
+ * R2-M-B3 (Wave-3): fence UNTRUSTED peer message content before it enters a
+ * recipient session. Peer DMs/broadcasts cross trust tiers (e.g. an
+ * explorer-mapped worker injecting into a writer session) and were previously
+ * delivered with only a `[DM from X]` prefix — raw, unfenced. Wrap in an
+ * `<untrusted-peer-message>` fence and strip any literal closing-tag
+ * occurrences from BOTH the content and the sender id so worker-authored
+ * text cannot escape the fence and pose as session-authored instructions.
+ */
+function fencePeerMessage(from: string, content: string): string {
+	const safeFrom = String(from).split("</untrusted-peer-message").join("");
+	const safeContent = String(content).split("</untrusted-peer-message").join("");
+	return `<untrusted-peer-message from="${safeFrom}">\n${safeContent}\n</untrusted-peer-message>`;
+}
+
 /** Phase 7/G4: Send an IRC message to a specific live agent (DM).
  * Uses non-blocking delivery via sendCustomMessage when available.
  * Falls back to session.prompt (blocking) when not.
@@ -569,7 +584,7 @@ export function sendIrcMessage(targetAgentId: string, message: IrcMessage): void
 			(session.sendCustomMessage as (msg: unknown, opts?: unknown) => void)(
 				{
 					customType: "irc",
-					content: `[DM from ${message.from}] ${message.content}`,
+					content: `[DM from ${message.from}] ${fencePeerMessage(message.from, message.content)}`,
 					display: "collapsed",
 				},
 				{ deliverAs: "followUp", triggerTurn: false },
@@ -581,7 +596,7 @@ export function sendIrcMessage(targetAgentId: string, message: IrcMessage): void
 	}
 	// Fallback: inject as prompt (blocking)
 	if (typeof handle.session.prompt === "function") {
-		const ircPrompt = `[Message from ${message.from}] ${message.content}`;
+		const ircPrompt = `[Message from ${message.from}] ${fencePeerMessage(message.from, message.content)}`;
 		void handle.session
 			.prompt(ircPrompt, { source: "api", expandPromptTemplates: false, streamingBehavior: "followUp" })
 			.catch((error) => logInternalError("live-agent-manager.irc-deliver", error, `agentId=${handle.agentId}`));
@@ -610,7 +625,7 @@ export function broadcastIrcMessage(fromAgentId: string, message: IrcMessage): s
 				(session.sendCustomMessage as (msg: unknown, opts?: unknown) => void)(
 					{
 						customType: "irc",
-						content: `[Broadcast from ${message.from}] ${message.content}`,
+						content: `[Broadcast from ${message.from}] ${fencePeerMessage(message.from, message.content)}`,
 						display: "collapsed",
 					},
 					{ deliverAs: "followUp", triggerTurn: false },
@@ -623,7 +638,7 @@ export function broadcastIrcMessage(fromAgentId: string, message: IrcMessage): s
 		}
 		// Fallback: inject as prompt
 		if (typeof handle.session.prompt === "function") {
-			const ircPrompt = `[Broadcast from ${message.from}] ${message.content}`;
+			const ircPrompt = `[Broadcast from ${message.from}] ${fencePeerMessage(message.from, message.content)}`;
 			void handle.session
 				.prompt(ircPrompt, {
 					source: "api",
@@ -706,7 +721,7 @@ export async function respondAsBackground(
 
 	// --- Non-blocking delivery -------------------------------------------
 	const session = handle.session as Record<string, unknown>;
-	const deliveredTag = `[DM from ${fromId}] ${message}`;
+	const deliveredTag = `[DM from ${fromId}] ${fencePeerMessage(fromId, message)}`;
 	let delivered = false;
 	if (typeof session.sendCustomMessage === "function") {
 		try {

package/src/runtime/live-session/live-session-runtime.ts

@@ -13,7 +13,7 @@ import type { WorkflowStep } from "../../workflows/workflow-config.ts";
 import { BoundedTail } from "../compaction/compact-stages/bounded-tail.ts";
 import { createIrcTool } from "../custom-tools/irc-tool.ts";
 import { createSubmitResultTool } from "../custom-tools/submit-result-tool.ts";
-import { g2EnforcementDegradationReason, mcpPermittedForRole, stripMcpExtensions } from "../mcp-proxy.ts";
+import { g2EnforcementDegradationReason, mcpPermittedForRole, shouldFailClosedMcpEnforcement, stripMcpExtensions } from "../mcp-proxy.ts";
 import {
 	availableModelInfosFromRegistry,
 	buildConfiguredModelRouting,
@@ -87,7 +87,16 @@ import {
 import { hasLiveControlRealtimeListeners, subscribeLiveControlRealtime } from "./live-control-realtime.ts";
 import { buildExtensionBridge } from "./live-extension-bridge.ts";
 import { collectLiveSessionHealth, formatLiveSessionDiagnostics } from "./live-session-health.ts";
-import { type SessionStatsLike, trackUsageFromMessageEndEvent, usageFromSessionStats } from "./usage-bridge.ts";
+import {
+	asRecord,
+	eventText,
+	extractToolName,
+	faultPathUsage,
+	finalAssistantText,
+	type SessionStatsLike,
+	trackUsageFromMessageEndEvent,
+	usageFromSessionStats,
+} from "./usage-bridge.ts";
 
 /**
  * Module-scoped latch for the optional peer dependency import. When N
@@ -435,14 +444,6 @@ function appendTranscript(filePath: string | undefined, event: unknown): void {
 	appendBatchedJsonlLine(filePath, `${JSON.stringify(redactSecrets(event))}\n`);
 }
 
-function asRecord(value: unknown): Record<string, unknown> | undefined {
-	return value && typeof value === "object" && !Array.isArray(value) ? (value as Record<string, unknown>) : undefined;
-}
-
-function isString(value: unknown): value is string {
-	return typeof value === "string";
-}
-
 /**
  * U3 test seam: register a caller-supplied pi-ai `Provider` on the created
  * session's ModelRuntime right after creation. Passive by design — no faux
@@ -463,50 +464,6 @@ function applyModelProviderOverride(session: LiveSessionLike | undefined, provid
 	}
 }
 
-/**
- * Type-safe extractor for tool name from streaming events.
- * Handles various event structures: { tool: { name } }, { toolName }, { name }.
- */
-function extractToolName(obj: Record<string, unknown> | undefined): string | undefined {
-	if (!obj) return undefined;
-	const tool = asRecord(obj.tool);
-	if (isString(tool?.name)) return tool.name;
-	if (isString(obj.toolName)) return obj.toolName;
-	if (isString(obj.name)) return obj.name;
-	return undefined;
-}
-
-function textFromContent(content: unknown): string[] {
-	if (typeof content === "string") return [content];
-	if (!Array.isArray(content)) return [];
-	return content.flatMap((part) => {
-		const obj = asRecord(part);
-		if (!obj) return [];
-		if (obj.type === "text" && typeof obj.text === "string") return [obj.text];
-		if (typeof obj.content === "string") return [obj.content];
-		return [];
-	});
-}
-
-function eventText(event: unknown): string[] {
-	const obj = asRecord(event);
-	if (!obj) return [];
-	const text: string[] = [];
-	if (typeof obj.text === "string") text.push(obj.text);
-	text.push(...textFromContent(obj.content));
-	const message = asRecord(obj.message);
-	if (message) text.push(...textFromContent(message.content));
-	return text.filter((entry) => entry.trim());
-}
-
-function finalAssistantText(event: unknown): string[] {
-	const obj = asRecord(event);
-	if (obj?.type !== "message_end") return [];
-	const message = asRecord(obj.message);
-	if (message?.role !== "assistant") return [];
-	return textFromContent(message.content);
-}
-
 /**
  * F7: resolve the enabledModels allowlist for the current project, but only
  * if the `reliability.scopeModels` toggle is ON. Returns an empty
@@ -892,25 +849,6 @@ class BoundedSeenControlRequestIdSet extends Set<string> {
 /** @internal — test seam for the C1 cap (see live-agent-control-dedupe tests). */
 export const __test__BoundedSeenControlRequestIdSet = BoundedSeenControlRequestIdSet;
 
-/**
- * R6-9 (DR-03 round-6): best-effort usage extraction for the fault/watchdog
- * escape returns. The success return reports usageFromSessionStats(session),
- * but the fault/watchdog catch paths previously carried NO usage — whenever
- * embeddedWorkers routed work to the embedded tier and the task faulted, the
- * burned turns vanished from the budget (under-count). The session may be
- * disposed or partially unusable after the fault, so stats collection is
- * guarded — it can never turn a fault into a crash. Returns undefined when no
- * usable stats surface exists.
- */
-function faultPathUsage(session: LiveSessionLike | undefined): UsageState | undefined {
-	try {
-		return usageFromSessionStats(session);
-	} catch (error) {
-		logInternalError("live-session.fault-usage-stats", error, "session stats unavailable on fault path");
-		return undefined;
-	}
-}
-
 export async function runLiveSessionTask(input: LiveSessionSpawnInput): Promise<LiveSessionRunResult> {
 	// Cold-start race fix: ensure the hot module graph is warm before touching
 	// any module. Under tsx, concurrent first-imports race module-record
@@ -944,7 +882,13 @@ export async function runLiveSessionTask(input: LiveSessionSpawnInput): Promise<
 	// G1: Capture yield result from custom tool callback
 	let customToolYieldResult: YieldResult | undefined;
 	let customToolYieldResolved = false;
-	if (getCrewEnv("PI_CREW_MOCK_LIVE_SESSION") === "success") {
+	// wave-2b (mock double-gate): the mock session fabricates a success event
+	// for the whole run — single-gated, inherited env would silently neuter a
+	// worker. Double-gate with PI_CREW_ALLOW_MOCK (mirror mock-fixtures.ts).
+	if (
+		getCrewEnv("PI_CREW_MOCK_LIVE_SESSION") === "success" &&
+		(getCrewEnv("PI_CREW_ALLOW_MOCK") === "1" || getCrewEnv("PI_CREW_ALLOW_MOCK") === "true")
+	) {
 		const agentId = `${input.manifest.runId}:${input.task.id}`;
 		const inherited =
 			input.runtimeConfig?.inheritContext === true && input.parentContext ? ` with inherited context: ${input.parentContext}` : "";
@@ -1207,16 +1151,36 @@ export async function runLiveSessionTask(input: LiveSessionSpawnInput): Promise<
 					resourceLoaderAvailable: Boolean(mod.DefaultResourceLoader && agentDir),
 				});
 		if (g2DegradationReason) {
+			// R1-M2 part 2 (Wave-3): FAIL CLOSED. Previously the degradation only
+			// warned and proceeded — a version-drifted SDK silently re-exposed the
+			// parent's MCP servers to a NON-PERMITTED (read-only) role. MCP-permitted
+			// roles keep the warn+proceed behavior (their access is intended); every
+			// other role ABORTS the spawn with a typed error so the drift is loud.
+			const failClosedCode = "mcp-enforcement-fail-closed";
 			appendEventFireAndForget(input.manifest.eventsPath, {
-				type: "task.mcp_enforcement_degraded",
+				type: mcpPermitted ? "task.mcp_enforcement_degraded" : "task.mcp_enforcement_fail_closed",
 				runId: input.manifest.runId,
 				taskId: input.task.id,
-				message: `G2 MCP policy NOT enforced for role "${input.task.role ?? "unknown"}": pi SDK resource loader unavailable (${g2DegradationReason}) — this worker may inherit the parent's MCP servers.`,
+				message: mcpPermitted
+					? `G2 MCP policy NOT enforced for role "${input.task.role ?? "unknown"}": pi SDK resource loader unavailable (${g2DegradationReason}) — this worker may inherit the parent's MCP servers.`
+					: `G2 MCP policy ABORTED live-session spawn for role "${input.task.role ?? "unknown"}" (${failClosedCode}): enforcement (MCP extension stripping) could not be armed (${g2DegradationReason}) — refusing fail-open inheritance of the parent's MCP servers.`,
 				data: {
 					role: input.task.role ?? null,
 					reason: g2DegradationReason,
+					code: failClosedCode,
 				},
 			});
+			if (g2DegradationReason && shouldFailClosedMcpEnforcement(mcpPermitted, g2DegradationReason)) {
+				const message = `[${failClosedCode}] Live-session spawn refused for role "${input.task.role ?? "unknown"}": MCP enforcement degraded (${g2DegradationReason}) and the role is not MCP-permitted — fail-closed instead of inheriting the parent's MCP servers.`;
+				return {
+					available: true,
+					exitCode: 1,
+					stdout: "",
+					stderr: message,
+					jsonEvents: 0,
+					error: message,
+				};
+			}
 		}
 		const effectiveParentModel = resolveParentModelFromRegistry(input.modelRegistry, input.parentModel);
 		const modelRouting = buildConfiguredModelRouting({
@@ -1471,12 +1435,16 @@ export async function runLiveSessionTask(input: LiveSessionSpawnInput): Promise<
 		};
 		unsubscribeControlRealtime = subscribeLiveControlRealtime((request) => {
 			if (!isCurrent() || request.runId !== input.manifest.runId || request.taskId !== input.task.id || !session) return;
+			// R3A-M1: the applier itself now records failures on the request, but a
+			// rejection must never reach unhandledRejection — catch + log here too.
 			void applyLiveAgentControlRequest({
 				request,
 				taskId: input.task.id,
 				agentId,
 				session,
 				seenRequestIds: seenControlRequestIds,
+			}).catch((error) => {
+				logInternalError("live-session.control-realtime-apply", error, `agentId=${agentId}`);
 			});
 		});
 		await pollControl();
@@ -1488,7 +1456,11 @@ export async function runLiveSessionTask(input: LiveSessionSpawnInput): Promise<
 		// path → keep the faster 500ms cadence.
 		controlTimer = setInterval(
 			() => {
-				if (isCurrent()) void pollControl();
+				// R3A-M1: fire-and-forget poll must never reject unhandled.
+				if (isCurrent())
+					void pollControl().catch((error) => {
+						logInternalError("live-session.control-poll", error, `agentId=${agentId}`);
+					});
 			},
 			hasLiveControlRealtimeListeners() ? 1000 : 500,
 		);
@@ -1525,14 +1497,21 @@ export async function runLiveSessionTask(input: LiveSessionSpawnInput): Promise<
 						trackLiveAgentTurnEnd(agentId);
 						if (maxTurns !== undefined && !softLimitReached && turnCount >= maxTurns) {
 							softLimitReached = true;
-							void session?.steer?.("You have reached your turn limit. Wrap up immediately — provide your final answer now.");
+							// R3A-M1: rejection here would crash the host session.
+							void session
+								?.steer?.("You have reached your turn limit. Wrap up immediately — provide your final answer now.")
+								.catch((error) => {
+									logInternalError("live-session.turn-limit-steer", error, `agentId=${agentId}`);
+								});
 						} else if (maxTurns !== undefined && softLimitReached && turnCount >= maxTurns + graceTurns) {
 							// U11 mitigation (c): abort + bounded watchdog — if the prompt does
 							// not settle within the grace, dispose the session (drop-reference,
 							// U4 escape discipline) and fail via the escape signal.
 							if (embedded && !embeddedWatchdogFired) {
 								embeddedWatchdogFired = true;
-								void session?.abort?.();
+								void Promise.resolve(session?.abort?.()).catch((error: unknown) => {
+									logInternalError("live-session.watchdog-abort", error, `agentId=${agentId}`);
+								});
 								embeddedWatchdogTimer = armTurnWatchdog({
 									agentId,
 									maxTurns,
@@ -1542,7 +1521,9 @@ export async function runLiveSessionTask(input: LiveSessionSpawnInput): Promise<
 									escalate: (error: Error) => faultSignalReject?.(error),
 								});
 							} else {
-								void session?.abort?.();
+								void Promise.resolve(session?.abort?.()).catch((error: unknown) => {
+									logInternalError("live-session.watchdog-abort", error, `agentId=${agentId}`);
+								});
 							}
 						}
 					}
@@ -1581,7 +1562,11 @@ export async function runLiveSessionTask(input: LiveSessionSpawnInput): Promise<
 		}
 		// Round 27 (BUG 4): named abort handler (removed in finally below).
 		onSignalAbort = (): void => {
-			void session?.abort?.();
+			// R3A-M1: abort rejection inside a signal handler must not become an
+			// unhandledRejection — catch + log.
+			void Promise.resolve(session?.abort?.()).catch((error: unknown) => {
+				logInternalError("live-session.signal-abort", error, `agentId=${agentId}`);
+			});
 		};
 		if (input.signal) {
 			if (input.signal.aborted) await session.abort?.();

package/src/runtime/live-session/usage-bridge.ts

@@ -1,4 +1,5 @@
 import type { UsageState } from "../../state/types.ts";
+import { logInternalError } from "../../utils/internal-error.ts";
 import { usageFromValue } from "../session-usage.ts";
 import { trackTaskUsage } from "../usage-tracker.ts";
 
@@ -9,11 +10,11 @@ import { trackTaskUsage } from "../usage-tracker.ts";
  * ledger — the runtime module keeps only the call sites.
  */
 
-function asRecord(value: unknown): Record<string, unknown> | undefined {
+export function asRecord(value: unknown): Record<string, unknown> | undefined {
 	return value && typeof value === "object" && !Array.isArray(value) ? (value as Record<string, unknown>) : undefined;
 }
 
-function isString(value: unknown): value is string {
+export function isString(value: unknown): value is string {
 	return typeof value === "string";
 }
 
@@ -91,3 +92,66 @@ export function trackUsageFromMessageEndEvent(taskId: string, event: unknown): v
 		cost: usage.cost,
 	});
 }
+
+/**
+ * R6-9 (DR-03 round-6): best-effort usage extraction for the fault/watchdog
+ * escape returns. The success return reports usageFromSessionStats(session as SessionWithStats | undefined),
+ * but the fault/watchdog catch paths previously carried NO usage — whenever
+ * embeddedWorkers routed work to the embedded tier and the task faulted, the
+ * burned turns vanished from the budget (under-count). The session may be
+ * disposed or partially unusable after the fault, so stats collection is
+ * guarded — it can never turn a fault into a crash. Returns undefined when no
+ * usable stats surface exists.
+ */
+export function faultPathUsage(session: SessionWithStats | undefined): UsageState | undefined {
+	try {
+		return usageFromSessionStats(session as SessionWithStats | undefined);
+	} catch (error) {
+		logInternalError("live-session.fault-usage-stats", error, "session stats unavailable on fault path");
+		return undefined;
+	}
+}
+
+/**
+ * Type-safe extractor for tool name from streaming events.
+ * Handles various event structures: { tool: { name } }, { toolName }, { name }.
+ */
+export function extractToolName(obj: Record<string, unknown> | undefined): string | undefined {
+	if (!obj) return undefined;
+	const tool = asRecord(obj.tool);
+	if (isString(tool?.name)) return tool.name;
+	if (isString(obj.toolName)) return obj.toolName;
+	if (isString(obj.name)) return obj.name;
+	return undefined;
+}
+
+export function textFromContent(content: unknown): string[] {
+	if (typeof content === "string") return [content];
+	if (!Array.isArray(content)) return [];
+	return content.flatMap((part) => {
+		const obj = asRecord(part);
+		if (!obj) return [];
+		if (obj.type === "text" && typeof obj.text === "string") return [obj.text];
+		if (typeof obj.content === "string") return [obj.content];
+		return [];
+	});
+}
+
+export function eventText(event: unknown): string[] {
+	const obj = asRecord(event);
+	if (!obj) return [];
+	const text: string[] = [];
+	if (typeof obj.text === "string") text.push(obj.text);
+	text.push(...textFromContent(obj.content));
+	const message = asRecord(obj.message);
+	if (message) text.push(...textFromContent(message.content));
+	return text.filter((entry) => entry.trim());
+}
+
+export function finalAssistantText(event: unknown): string[] {
+	const obj = asRecord(event);
+	if (obj?.type !== "message_end") return [];
+	const message = asRecord(obj.message);
+	if (message?.role !== "assistant") return [];
+	return textFromContent(message.content);
+}

package/src/runtime/mcp-proxy.ts

@@ -206,3 +206,13 @@ export function stripMcpExtensions(base: LoadedExtensionsShape): LoadedExtension
 		],
 	};
 }
+
+/**
+ * R1-M2 part 2 (Wave-3): pure fail-closed decision — when G2 MCP enforcement
+ * could not be armed (SDK loader missing / degraded), a NON-PERMITTED role
+ * must ABORT the live-session spawn instead of warn+proceed (fail-open);
+ * permitted roles keep the warn+proceed behavior (their access is intended).
+ */
+export function shouldFailClosedMcpEnforcement(mcpPermitted: boolean, degradationReason: string | undefined): boolean {
+	return degradationReason !== undefined && !mcpPermitted;
+}

package/src/runtime/model/model-fallback.ts

@@ -444,13 +444,81 @@ const NON_RETRYABLE_MODEL_FAILURE_PATTERNS = [
 	/credit/i,
 ];
 
+// R2-M-B2 (Wave-3): provider SAFETY/REFUSAL stop reasons must NOT be retried
+// down the fallback chain ("safety-refusal laundering" — re-dispatching the
+// same refused prompt to other models). The STRUCTURED stop reason is the
+// authoritative signal; the legacy `/safety/i` substring in
+// RETRYABLE_MODEL_FAILURE_PATTERNS stays as a FALLBACK only for errors that
+// carry no structured marker (legacy serialization).
+export const SAFETY_REFUSAL_STOP_REASONS: ReadonlySet<string> = new Set([
+	"refusal",
+	"refused",
+	"safety",
+	"safety_block",
+	"safety_block_consumed",
+	"content_policy",
+	"content_policy_violation",
+	"content_filter",
+]);
+
+/** Normalize + match a stop reason (or stopReason/stop_reason value) against the refusal/safety set. */
+export function isSafetyRefusalStopReason(reason: unknown): boolean {
+	if (typeof reason !== "string") return false;
+	return SAFETY_REFUSAL_STOP_REASONS.has(reason.trim().toLowerCase());
+}
+
+const SERIALIZED_STOP_REASON_MARKER = /(?:stop_reason|stopReason|stop reason)["':=\s]+["']?([a-z_\- ]+)/i;
+
+/**
+ * Structured safety-refusal detection on an ERROR OBJECT (preferred) or a
+ * serialized error string: true when the error carries a stop_reason in the
+ * refusal/safety family. Object shape: `{ stopReason }`, `{ stop_reason }`,
+ * nested under `.error`/`.cause`, or the same marker serialized into a string
+ * (JSON.stringify'd errors, stderr tails).
+ */
+export function hasStructuredSafetyRefusal(errorLike: unknown): boolean {
+	if (!errorLike) return false;
+	if (typeof errorLike === "string") {
+		const match = SERIALIZED_STOP_REASON_MARKER.exec(errorLike);
+		return match ? isSafetyRefusalStopReason(match[1]) : false;
+	}
+	if (typeof errorLike !== "object") return false;
+	const obj = errorLike as Record<string, unknown>;
+	if (isSafetyRefusalStopReason(obj.stopReason)) return true;
+	if (isSafetyRefusalStopReason(obj.stop_reason)) return true;
+	if (obj.error !== undefined && obj.error !== obj && hasStructuredSafetyRefusal(obj.error)) return true;
+	if (obj.cause !== undefined && obj.cause !== obj && hasStructuredSafetyRefusal(obj.cause)) return true;
+	// Error instances: message may carry the serialized marker.
+	if (typeof obj.message === "string") {
+		const match = SERIALIZED_STOP_REASON_MARKER.exec(obj.message);
+		if (match && isSafetyRefusalStopReason(match[1])) return true;
+	}
+	return false;
+}
+
 export function isRetryableModelFailure(error: string | undefined): boolean {
 	if (!error) return false;
+	// R2-M-B2 (Wave-3): structured safety/refusal stop reasons are checked
+	// FIRST — non-retryable even when the message text otherwise matches
+	// retryable-looking patterns ("overloaded", "transient", …). The plain
+	// `/safety/i` substring below remains as the LEGACY fallback for errors
+	// without a structured marker.
+	if (hasStructuredSafetyRefusal(error)) return false;
 	// Auth / billing / invalid-key failures will never succeed on retry.
 	if (NON_RETRYABLE_MODEL_FAILURE_PATTERNS.some((pattern) => pattern.test(error))) return false;
 	return RETRYABLE_MODEL_FAILURE_PATTERNS.some((pattern) => pattern.test(error));
 }
 
+/**
+ * R2-M-B2 companion for call sites that still hold the structured CAUSE
+ * object: consult it FIRST (authoritative), then fall back to the string
+ * classification of `message`.
+ */
+export function isRetryableModelFailureFrom(cause: unknown, message?: string): boolean {
+	if (hasStructuredSafetyRefusal(cause)) return false;
+	return isRetryableModelFailure(message ?? (cause instanceof Error ? cause.message : undefined));
+}
+
 export function formatModelAttemptNote(attempt: ModelAttemptSummary, nextModel?: string): string {
 	const failure = attempt.error?.trim() || `exit ${attempt.exitCode ?? 1}`;
 	return nextModel

package/src/runtime/model/runtime-policy.ts

@@ -40,6 +40,21 @@ export function resolveEmbeddedFaultThreshold(policy: CrewRuntimeConfig["embedde
  *   (the same depth>0 rule is applied to the embedded upgrade itself).
  * - Otherwise, use `isolationPolicy.defaultRuntime` when configured, then fall back to globalKind.
  */
+/**
+ * wave-2b (mock double-gate): PI_CREW_MOCK_LIVE_SESSION is a test seam that
+ * flips production runtime selection (policy + resolver) and fabricates a
+ * mock session — single-gated, an env var inherited from a hostile parent
+ * would silently downgrade a worker to a mock. Mirror the existing
+ * double-gated seams (PI_CREW_TEST_ASYNC_INLINE + PI_CREW_ALLOW_MOCK in
+ * async-runner.ts; PI_TEAMS_MOCK_CHILD_PI + PI_CREW_ALLOW_MOCK in
+ * mock-fixtures.ts): the mock only engages when PI_CREW_ALLOW_MOCK is ALSO
+ * set, and PI_CREW_ALLOW_MOCK is filtered from child envs.
+ */
+export function mockLiveSessionEnabled(env: NodeJS.ProcessEnv = process.env): boolean {
+	if (env.PI_CREW_MOCK_LIVE_SESSION !== "success") return false;
+	return env.PI_CREW_ALLOW_MOCK === "1" || env.PI_CREW_ALLOW_MOCK === "true";
+}
+
 export function resolveTaskRuntimeKind(
 	globalKind: CrewRuntimeKind,
 	role: string,
@@ -51,22 +66,21 @@ export function resolveTaskRuntimeKind(
 	// Safety: when already inside a pi-crew worker (depth > 0), never nest live-session.
 	// Live-session creates in-process Pi agent sessions, which would recursively
 	// try to use pi-crew, leading to "Cannot read properties of undefined" errors.
-	// Exception: when PI_CREW_MOCK_LIVE_SESSION is set, we're in a test harness
-	// that mocks the live-session path — forcing child-process would spawn a real
-	// pi process and hang the test.
-	if (globalKind === "live-session" && currentCrewDepth(env) > 0 && env.PI_CREW_MOCK_LIVE_SESSION !== "success") return "child-process";
+	// Exception: the double-gated mock seam (mockLiveSessionEnabled) — forcing
+	// child-process would spawn a real pi process and hang the test harness.
+	if (globalKind === "live-session" && currentCrewDepth(env) > 0 && !mockLiveSessionEnabled(env)) return "child-process";
 	const isolatedRoles = isolationPolicy?.isolatedRoles ?? [];
 	if (isolatedRoles.includes(role)) return "child-process";
 	// U11 embedded-tier upgrade (DEFAULT-OFF). Guards mirror the depth guard
 	// above: an in-process embedded session has the SAME nesting hazard, so
 	// depth>0 keeps the task on child-process regardless of which kind the
 	// caller resolved — the guard is EXTENDED to the embedded path, never
-	// weakened (PI_CREW_MOCK_LIVE_SESSION keeps its test-harness exception).
+	// weakened (the double-gated mock seam keeps its test-harness exception).
 	if (
 		embedded?.policy?.enabled === true &&
 		(embedded.policy.roles ?? []).includes(role) &&
 		(embedded.faultCount ?? 0) < resolveEmbeddedFaultThreshold(embedded.policy) &&
-		(currentCrewDepth(env) <= 0 || env.PI_CREW_MOCK_LIVE_SESSION === "success")
+		(currentCrewDepth(env) <= 0 || mockLiveSessionEnabled(env))
 	) {
 		return "live-session";
 	}

package/src/runtime/model/runtime-resolver.ts

@@ -1,6 +1,7 @@
 import type { PiTeamsConfig } from "../../config/config.ts";
 import type { RuntimeResolutionState } from "../../state/types.ts";
 import type { CrewRuntimeKind } from "../crew-agent-runtime.ts";
+import { mockLiveSessionEnabled } from "./runtime-policy.ts";
 
 export type CrewRuntimeMode = "auto" | "scaffold" | "child-process" | "live-session";
 
@@ -35,7 +36,8 @@ export async function isLiveSessionRuntimeAvailable(
 	timeoutMs = 1500,
 	env: NodeJS.ProcessEnv = process.env,
 ): Promise<{ available: boolean; reason?: string }> {
-	if (env.PI_CREW_MOCK_LIVE_SESSION === "success") {
+	// wave-2b: double-gated mock seam — see mockLiveSessionEnabled.
+	if (mockLiveSessionEnabled(env)) {
 		return {
 			available: true,
 			reason: "Mock live-session runtime is enabled.",
@@ -112,8 +114,8 @@ export async function resolveCrewRuntime(config: PiTeamsConfig, env: NodeJS.Proc
 	}
 	// auto mode: use child-process unless preferLiveSession is explicitly enabled
 	if (requestedMode === "auto") {
-		// Check for mock env var first (for testing)
-		if (env.PI_CREW_MOCK_LIVE_SESSION === "success") {
+		// Check for the double-gated mock seam first (for testing)
+		if (mockLiveSessionEnabled(env)) {
 			const live = await isLiveSessionRuntimeAvailable(1500, env);
 			if (live.available) return liveCaps(requestedMode);
 		}