pi-crew 0.11.24 → 0.11.26

package/src/extension/team-tool/api/read.ts

@@ -15,6 +15,7 @@ import { agentOutputPath, readCrewAgentEventsCursor, readCrewAgentStatus, readCr
 import { readForegroundControlStatus, writeForegroundInterruptRequest } from "../../../runtime/foreground-control.ts";
 import { probeLiveSessionRuntime } from "../../../runtime/live-session/live-session-runtime.ts";
 import { resolveCrewRuntime } from "../../../runtime/model/runtime-resolver.ts";
+import { fenceWorkerText } from "../../../runtime/sanitize/worker-text.ts";
 import { readEvents, readEventsCursor } from "../../../state/event-log/event-log.ts";
 import { globMatch } from "../../../utils/glob-match.ts";
 import { resolveRealContainedPath } from "../../../utils/safe-paths.ts";
@@ -201,7 +202,11 @@ export const handleGetAgentResult: ApiOperationHandler = (hctx) => {
 			true,
 		);
 	const task = loaded.tasks.find((item) => item.id === agent.taskId);
-	const text = safeReadContainedFile(loaded.manifest.artifactsRoot, task?.resultArtifact?.path) ?? JSON.stringify(agent, null, 2);
+	const artifactText = safeReadContainedFile(loaded.manifest.artifactsRoot, task?.resultArtifact?.path);
+	// R38-C1 (EP1 seed): result-artifact bytes are worker-authored — fence them
+	// before they enter the privileged session. The no-artifact fallback (agent
+	// record JSON) is runtime-owned and stays unfenced.
+	const text = artifactText !== undefined ? fenceWorkerText(artifactText, { source: "agent-result" }) : JSON.stringify(agent, null, 2);
 	return result(text, {
 		action: "api",
 		status: "ok",
@@ -294,7 +299,9 @@ export const handleReadAgentTranscript: ApiOperationHandler = (hctx) => {
 	const fallbackText = artifactText ? "" : (safeReadContainedFile(loaded.manifest.stateRoot, fallbackPath) ?? "");
 	const transcriptPath = artifactText ? artifactTranscriptPath : fallbackPath;
 	const text = artifactText || fallbackText;
-	return result(text || `(no transcript at ${transcriptPath})`, {
+	// R38-C1 (EP1 seed): transcript/output.log bytes are worker-authored — fence
+	// them; the no-transcript fallback is runtime-owned and stays unfenced.
+	return result(text ? fenceWorkerText(text, { source: "agent-transcript" }) : `(no transcript at ${transcriptPath})`, {
 		action: "api",
 		status: "ok",
 		runId: loaded.manifest.runId,
@@ -403,7 +410,9 @@ export const handleDiff: ApiOperationHandler = (hctx) => {
 		const content = safeReadContainedFile(loaded.manifest.artifactsRoot, artifact.path);
 		if (content) {
 			const display = content.length > 4000 ? content.slice(0, 4000) + "\n... (truncated)" : content;
-			parts.push(`\n--- ${artifact.path} ---\n${display}`);
+			// R38-C1 (EP1 seed): diff/patch bytes are worker-authored — fence them
+			// per artifact (per-op fencing; headers stay runtime-owned).
+			parts.push(`\n--- ${artifact.path} ---\n${fenceWorkerText(display, { source: "diff" })}`);
 		}
 	}
 	return result(parts.join("\n"), {

package/src/extension/team-tool/cancel.ts

@@ -1,4 +1,5 @@
 import { appendHookEvent, executeHook } from "../../hooks/registry.ts";
+import { abortRunDelegates } from "../../runtime/broker/delegate/delegate-abort.ts";
 import { killProcessPid } from "../../runtime/child-pi/child-pi.ts";
 import { recordFromTask, saveCrewAgents } from "../../runtime/crew-agent-records.ts";
 import { writeForegroundInterruptRequest } from "../../runtime/foreground-control.ts";
@@ -340,6 +341,16 @@ export async function handleCancel(params: TeamToolParamsValue, ctx: TeamContext
 		// still signals synchronously here — while we hold the lock — so the async
 		// background runner cannot overwrite the cancelled state we write below.
 		if (fresh.manifest.status === "running") {
+			// M4-R1(c) (fix-wave 6 residual, M3-A / R43-N3): the run is going
+			// terminal — abort its in-flight DELEGATE GRANDCHILDREN too. They live
+			// in the broker's abort registry (a separate, process-local lifetime),
+			// so without this they outlive the cancel by up to their own 24h
+			// deadline while still spending tokens and holding nested slots. Exact
+			// wiring budget-enforcement.ts terminaliseRunWithDrain already uses;
+			// abortRunDelegates is SYNC + never throws (0 when no broker aborter is
+			// installed — headless/worker-side cancels keep the pre-existing
+			// degrade, never a new failure path).
+			abortRunDelegates(fresh.manifest.runId, "run-cancelled");
 			void terminateLiveAgentsForRun(fresh.manifest.runId, "cancelled", appendEvent, fresh.manifest.eventsPath).catch((error) =>
 				logInternalError("team-tool.handleCancel.terminateLiveAgents", error, `runId=${fresh.manifest.runId}`),
 			);

package/src/extension/team-tool/config-patch.ts

@@ -1,17 +1,17 @@
 import { effectiveAutonomousConfig, type PiTeamsAutonomousConfig, type PiTeamsConfig, parseConfig } from "../../config/config.ts";
+import { stripDangerousKeysDeep } from "../../config/config-validation.ts";
+import { collectSensitiveConfigPaths } from "../../schema/sensitive-config-paths.ts";
 
-const DANGEROUS_KEYS = new Set(["__proto__", "constructor", "prototype"]);
-
-/** Recursively strip dangerous prototype-pollution keys from all levels of an object. */
+/**
+ * Recursively strip dangerous prototype-pollution keys from all levels of an
+ * object. M1-1: delegates to the shared proto-safe helpers (config-validation.ts,
+ * case-insensitive
+ * DANGEROUS_OBJECT_KEYS superset) so every config-patch parse boundary applies
+ * ONE canonical drop rule — config patch, autonomy patch, and
+ * effectiveRunConfig all flow through here or through parseConfig's asRecord.
+ */
 export function sanitizeObject<T>(obj: T): T {
-	if (obj === null || obj === undefined || typeof obj !== "object") return obj;
-	if (Array.isArray(obj)) return obj.map((item) => sanitizeObject(item)) as T;
-	const safe: Record<string, unknown> = {};
-	for (const key of Object.keys(obj as Record<string, unknown>)) {
-		if (DANGEROUS_KEYS.has(key)) continue;
-		safe[key] = sanitizeObject((obj as Record<string, unknown>)[key]);
-	}
-	return safe as T;
+	return stripDangerousKeysDeep(obj);
 }
 
 export function autonomousPatchFromConfig(config: unknown): PiTeamsAutonomousConfig {
@@ -24,8 +24,53 @@ export function configPatchFromConfig(config: unknown): PiTeamsConfig {
 	return parseConfig(config);
 }
 
+/**
+ * M1-8 (R45-S2): drop the schema's sensitive-marked config paths from the
+ * RUN-PARAM tier. `params.config` is worker/LLM-influenced tool input — the
+ * same fields a project file may not set (user-only kill-switches and
+ * execution-shaping knobs: executeWorkers, runtime.mode/isolationPolicy,
+ * worktree.setupHook/seedPaths, agents.overrides, otlp.*, policy.*,
+ * autonomous.*, goalWrap, …) must not be settable through run params either.
+ *
+ * Drops mutate the FRESH parseConfig output only — never the caller's input
+ * and never `base` (the loaded user/project config, already project-tier
+ * sanitized at load). Sensitive keys are dropped SILENTLY: the drop is the
+ * contract, and the persisted `manifest.runConfig` records the effective
+ * (post-drop) config for audit. Precedence note (P4 pin): with
+ * `executeWorkers` dropped from the patch, a user's `executeWorkers:false`
+ * survives untouched — the kill-switch cannot be flipped back on via run
+ * params (runtime-resolver reads the merged effective config).
+ *
+ * Conditional carve-out (mirrors the project tier's CONDITIONAL_PROJECT_DROPS
+ * doctrine: loosening values dropped, tightening values survive): a run param
+ * may still TIGHTEN `runtime.mode` to "scaffold" — the documented params
+ * dry-run channel ("Set runtime.mode=scaffold … only for dry runs", run tool
+ * banner) spawns no workers and is the SAFE direction. Loosening modes
+ * (auto/child-process/live-session — the R45-S2 escalation threat) are
+ * dropped like every other sensitive value.
+ */
+const RUNPARAM_CONDITIONAL_KEEP: Record<string, (value: unknown) => boolean> = {
+	"runtime.mode": (value) => value === "scaffold",
+};
+
+function dropSensitivePatchPaths(patch: Record<string, unknown>): void {
+	for (const dotted of collectSensitiveConfigPaths()) {
+		const parts = dotted.split(".");
+		let node: Record<string, unknown> | undefined = patch;
+		for (let i = 0; node !== undefined && i < parts.length - 1; i++) {
+			const next: unknown = node[parts[i]!];
+			node = next !== null && typeof next === "object" && !Array.isArray(next) ? (next as Record<string, unknown>) : undefined;
+		}
+		if (node === undefined) continue;
+		const leaf = parts[parts.length - 1]!;
+		if (RUNPARAM_CONDITIONAL_KEEP[dotted]?.(node[leaf])) continue;
+		delete node[leaf];
+	}
+}
+
 export function effectiveRunConfig(base: PiTeamsConfig, rawOverride: unknown): PiTeamsConfig {
 	const patch = sanitizeObject(parseConfig(rawOverride));
+	dropSensitivePatchPaths(patch as Record<string, unknown>);
 	return {
 		...base,
 		...patch,

package/src/extension/team-tool/destructive-gate.ts

@@ -21,6 +21,7 @@
  *  5. Otherwise → blocked with a reason telling the user what to pass.
  */
 
+import { getCrewEnv } from "../../config/env-vars.ts";
 import { currentCrewDepth } from "../../runtime/model/pi-args.ts";
 
 export const DESTRUCTIVE_TEAM_ACTIONS = new Set([
@@ -91,6 +92,19 @@ export function shouldBlockDestructiveTeamAction(action: string | undefined, inp
  *   - `create` /  — when resolved scope is `user` (create defaults to user;
  *   - `update`     update is gated at the resolved resource's scope — see
  *                   the post-`resolveMutable` call in management.ts).
+ *   - `workflow-` — ALWAYS (fix-wave 6, R11-S1): .dwf.ts scripts are
+ *     `create`/    arbitrary code auto-loaded by every future session —
+ *     `save`/      project tier included (`.crew/workflows/` is discovered
+ *     `delete`     per-repo) and delete reaches the user tier. This is a
+ *                  deliberate exception to "project stays worker-reachable".
+ *                  workflow-get/list (reads) stay open.
+ *   - `import` /  — at resolved scope `user` only (project/default open,
+ *   - `export`      mirroring handleImport's project default).
+ *
+ * Scope source (fix-wave 6, R11-F1): the canonical carrier is `config.scope`
+ * — the ONE key every scope-bearing handler reads. Top-level `params.scope`
+ * is ignored by the gate (as it already is by the handlers) so divergent
+ * carriers cannot smuggle a user-tier write past the gate.
  *
  * Reads (config/status/list, settings list/get, schedule `scheduled`) are
  * never gated. `dryRun` previews that write nothing pass through, mirroring
@@ -112,7 +126,7 @@ export class RootSessionRequiredError extends Error {
  * in-repo (broker tests).
  */
 export function isRootSession(env: NodeJS.ProcessEnv = process.env): boolean {
-	if (env.PI_CREW_KIND === "subagent") return false;
+	if (getCrewEnv("PI_CREW_KIND", env) === "subagent") return false;
 	try {
 		return currentCrewDepth(env) === 0;
 	} catch {
@@ -142,7 +156,9 @@ export function assertRootOnlyAction(
 		new RootSessionRequiredError(
 			`root-session required: team action '${action}'${subcommand ? ` (${subcommand})` : ""} ${what}. ` +
 				"This session is a pi-crew worker (PI_CREW_KIND/subagent or depth>0); user-tier state persists beyond the task and is reserved for the user's root pi session. " +
-				(what.includes("project") ? "" : "Re-run with scope:'project' for project-local effects, or from the root session."),
+				(what.includes("project")
+					? ""
+					: "Re-run with config: {scope: 'project'} for project-local effects, or from the root session."),
 		);
 	switch (action) {
 		case "schedule":
@@ -171,6 +187,24 @@ export function assertRootOnlyAction(
 		case "update":
 			if (scope === "user") return detail("rewrites a user-tier resource loaded by every future session");
 			return undefined;
+		case "workflow-create":
+		case "workflow-save":
+			// R11-S1 (fix-wave 6 M1-3): a .dwf.ts is arbitrary code auto-loaded by
+			// every future session in the discovery dirs — project tier included
+			// (`.crew/workflows/` of this repo). Unconditional for workers, like
+			// autonomy: no worker-reachable scope (confirm:true is caller-
+			// controlled and thus no barrier).
+			return detail("writes a dynamic-workflow .dwf.ts script auto-loaded by future sessions (arbitrary-code surface)");
+		case "workflow-delete":
+			// The target's tier is resolved from the named workflow at delete time
+			// (not from params) and includes the user tier — fail closed for workers.
+			return detail("deletes a persistent dynamic-workflow file (user tier included)");
+		case "import":
+			if (scope === "user") return detail("imports a run bundle into user-scope state (all future sessions)");
+			return undefined;
+		case "export":
+			if (scope === "user") return detail("writes a user-scope run export (all future sessions)");
+			return undefined;
 		default:
 			return undefined;
 	}
@@ -186,6 +220,9 @@ export interface RootGateParamsLike {
 	subAction?: unknown;
 	/** Advisory-only dryRun preview flag. */
 	dryRun?: unknown;
+	/** Destructive-gate confirm flag — caller-controlled, so the root-gate
+	 * deliberately does NOT treat it as a bypass (R11-S1 pin). */
+	confirm?: unknown;
 	config?: unknown;
 }
 
@@ -193,15 +230,29 @@ function configRecord(config: unknown): Record<string, unknown> {
 	return config && typeof config === "object" && !Array.isArray(config) ? (config as Record<string, unknown>) : {};
 }
 
-function resolveScopeParam(params: RootGateParamsLike): RootGateScope {
+/**
+ * R11-F1 (fix-wave 6, M1-2): the canonical scope carrier is `config.scope` —
+ * the same key every scope-bearing handler reads (create/settings/config in
+ * their dispatch paths, import and workflow-create in their handlers). The
+ * previous `params.scope ?? config.scope` read let a divergent
+ * `{scope: "project", config: {scope: "user"}}` payload pass the gate while
+ * the handler wrote the user tier. Handlers ignore top-level `scope`, so the
+ * gate must too. Per-action defaults mirror each handler's own default when
+ * the carrier is absent: import/export default `project` (handleImport),
+ * everything else defaults `user` (fail-closed, like create/settings/config).
+ */
+function resolveScopeParam(params: RootGateParamsLike, action?: string): RootGateScope {
 	const fromConfig = configRecord(params.config).scope;
-	const raw = params.scope ?? fromConfig;
-	return raw === "project" ? "project" : "user";
+	if (fromConfig === "project") return "project";
+	if (fromConfig === "user") return "user";
+	return action === "import" || action === "export" ? "project" : "user";
 }
 
 /**
  * Facade resolver: derive (subcommand, scope) from raw team-tool params for
  * the gated actions and decide whether a NON-ROOT session must be blocked.
+ * R11-F1: scope resolves from `config.scope` only (canonical carrier — see
+ * {@link resolveScopeParam}); top-level `scope` never influences the gate.
  * `update` is special: its effective write scope is the matched resource's
  * scope, unknown until `resolveMutable` — the facade blocks explicit
  * `scope:"user"` and management.ts gates the resolved case.
@@ -216,7 +267,7 @@ export function rootGateBlockReason(params: RootGateParamsLike, env: NodeJS.Proc
 		(typeof params.subAction === "string" ? params.subAction : undefined) ??
 		(typeof cfg.subAction === "string" ? cfg.subAction : undefined);
 	const subcommand = typeof rawSub === "string" ? rawSub.toLowerCase() : undefined;
-	const scope = resolveScopeParam(params);
+	const scope = resolveScopeParam(params, action);
 	const force = params.force === true || cfg.force === true;
 
 	// Reads / previews never gated (destructive-gate dryRun convention).
@@ -233,18 +284,27 @@ export function rootGateBlockReason(params: RootGateParamsLike, env: NodeJS.Proc
 	if (action === "schedule") {
 		return assertRootOnlyAction("schedule", subcommand, scope, env)?.message;
 	}
-	// config: gate only the WRITE path (non-empty patch or unset paths).
+	// config: gate only the WRITE path. Carrier keys (scope/unset/subAction/
+	// dryRun/confirm/force/args) are dropped by the config schema
+	// (configPatchFromConfig → parseConfig), so a payload of ONLY carrier keys
+	// can never change the file — a read. Unknown junk keys stay
+	// write-classified (fail-closed). `args` was missing from this list and
+	// miscounted `config {args:"show"}` reads as writes (RT24-F1, live-caught
+	// 2026-10-18). Note parseConfig injects defaults (runtime.*), so
+	// patch-emptiness cannot be used here — see updateConfig skip-if-unchanged.
 	if (action === "config") {
-		const patchKeys = Object.keys(cfg).filter(
-			(k) => !["scope", "unset", "subAction", "dryRun", "confirm", "force"].includes(k) && cfg[k] !== undefined,
-		);
+		const carrierKeys = new Set(["scope", "unset", "subAction", "dryRun", "confirm", "force", "args"]);
+		const patchKeys = Object.keys(cfg).filter((k) => !carrierKeys.has(k) && cfg[k] !== undefined);
 		const unset = Array.isArray(cfg.unset) ? cfg.unset.length > 0 : cfg.unset !== undefined;
 		const isWrite = patchKeys.length > 0 || unset;
 		if (!isWrite) return undefined;
 	}
-	// autonomy: gate only the WRITE path (patch present).
+	// autonomy: gate only the WRITE path (patch keys present). Same carrier
+	// reasoning as config — `args`/`subAction` are subcommand carriers, not
+	// autonomous-config fields.
 	if (action === "autonomy") {
-		const patchKeys = Object.keys(cfg).filter((k) => !["subAction", "dryRun", "confirm"].includes(k) && cfg[k] !== undefined);
+		const carrierKeys = new Set(["subAction", "dryRun", "confirm", "args"]);
+		const patchKeys = Object.keys(cfg).filter((k) => !carrierKeys.has(k) && cfg[k] !== undefined);
 		if (patchKeys.length === 0) return undefined;
 	}
 	// settings: derive the subcommand from `config.args` ("set k v", "unset k",

package/src/extension/team-tool/dispatch/manage.ts

@@ -86,7 +86,15 @@ export async function handleManageDomain(params: TeamToolParamsValue, ctx: TeamC
 					...(initialized.skippedFiles.length
 						? ["Skipped existing files:", ...initialized.skippedFiles.map((file) => `- ${file}`)]
 						: []),
-					`Config: ${initialized.configPath || "(none)"} (${initialized.configScope}${initialized.configCreated ? "; created" : initialized.configSkipped ? "; already existed" : "; unchanged"})`,
+					`Config: ${initialized.configPath || "(none)"} (${initialized.configScope}${
+						initialized.configBackupPath
+							? "; overwritten — previous content backed up to " + initialized.configBackupPath
+							: initialized.configCreated
+								? "; created"
+								: initialized.configSkipped
+									? "; already existed — left untouched (pass config.overwrite: true to replace)"
+									: "; unchanged"
+					})`,
 					`Ignore: ${initialized.gitignorePath} (${initialized.gitignoreUpdated ? "updated" : "already configured"})`,
 				].join("\n"),
 				{ action: "init", status: "ok" },

package/src/extension/team-tool/handle-schedule.ts

@@ -89,6 +89,26 @@ export function getScheduledJobs(
 	}
 }
 
+/**
+ * F12-M3: hard cap on scheduled jobs. `add` had no count limit — every job also
+ * creates a 1:1 scheduler timer and is persisted, so a project-scope caller could
+ * grow the store (and the in-memory timer map) without bound. 100 is well above
+ * any hand-authored schedule list and cheap to hold.
+ */
+export const MAX_SCHEDULED_JOBS = 100;
+
+/** @internal — count of persisted scheduled jobs for this cwd (R4-M-B4-adjacent: the
+ * cap bounds the on-disk store + the 1:1 scheduler timer map, so it counts BOTH
+ * tiers rather than the B2-gated registration view). */
+function scheduledJobCount(cwd: string): number {
+	try {
+		const tiers = loadCrewSettingsTiers(cwd, undefined);
+		return [...(tiers.user.scheduledJobs ?? []), ...(tiers.project.scheduledJobs ?? [])].filter(isScheduledJobLike).length;
+	} catch {
+		return 0;
+	}
+}
+
 /** Shape guard for the settings fallback — mirrors settings-store's private
  * `validateScheduledJob` (id + scheduleType + enabled) so invalid persisted
  * entries are skipped instead of reaching renderers. */
@@ -219,6 +239,17 @@ export function handleSchedule(params: TeamToolParamsValue, ctx: TeamContext): P
 		return result(msg, { action: "schedule", status: "error" }, true);
 	}
 
+	// F12-M3: enforce the cap BEFORE building/persisting the job so the caller gets
+	// a clear refusal instead of a silently-dropped write (every add also creates a
+	// 1:1 scheduler timer — an unbounded job list is an unbounded timer set).
+	if (scheduledJobCount(ctx.cwd) >= MAX_SCHEDULED_JOBS) {
+		return result(
+			`Scheduled job limit reached (${MAX_SCHEDULED_JOBS}). Remove finished schedules first: { action: 'schedule', subAction: 'list' } then subAction: 'remove', id: '<jobId>'.`,
+			{ action: "schedule", status: "error" },
+			true,
+		);
+	}
+
 	const { spec, schedule, scheduleType, intervalMs } = specResult;
 	const next = nextRunTime(spec);
 	if ("error" in next) return result(next.error, { action: "schedule", status: "error" }, true);
@@ -301,10 +332,13 @@ function scheduledJobsOf(settings: CrewSettings): import("../../runtime/scheduli
 
 function persistScheduledJob(cwd: string, job: import("../../runtime/scheduling/scheduler.ts").ScheduledJob): void {
 	try {
-		updateCrewSettings(cwd, (settings) => ({
-			...settings,
-			scheduledJobs: [...scheduledJobsOf(settings), job],
-		}));
+		updateCrewSettings(cwd, (settings) => {
+			const existing = scheduledJobsOf(settings);
+			// F12-M3: enforced here as well as at the tool boundary so no other writer
+			// can push past the cap into the persisted store.
+			if (existing.length >= MAX_SCHEDULED_JOBS) return settings;
+			return { ...settings, scheduledJobs: [...existing, job] };
+		});
 	} catch {
 		/* best-effort persistence */
 	}

package/src/extension/team-tool/handle-settings.ts

@@ -1,4 +1,5 @@
 import { loadConfig, updateConfig } from "../../config/config.ts";
+import { isDangerousPath } from "../../config/config-validation.ts";
 import { suggestConfigKey } from "../../config/suggestions.ts";
 import { collectSensitiveConfigPaths } from "../../schema/sensitive-config-paths.ts";
 import { discoverPiThemes, formatThemesListing, setPiTheme } from "../../ui/theme-discovery.ts";
@@ -60,7 +61,11 @@ const EFFECTIVE_DEFAULTS: Record<string, unknown> = {
 	"reliability.ambientStatusInjection": true,
 	"reliability.forcePreflight": false,
 	"reliability.scopeModels": false,
-	"telemetry.enabled": false,
+	// R45-F3: the real default is ON — observability installs the metric sink when
+	// `config.telemetry?.enabled !== false` (registration/observability.ts:109), so
+	// an unset key means enabled. This map only drives the "(default)" display;
+	// `false` here printed a wrong default for `team-settings get telemetry.enabled`.
+	"telemetry.enabled": true,
 	"notifications.enabled": false,
 };
 
@@ -69,6 +74,12 @@ const EFFECTIVE_DEFAULTS: Record<string, unknown> = {
 // ---------------------------------------------------------------------------
 
 function setNested(obj: Record<string, unknown>, path: string, value: unknown): void {
+	// R24-H1 (M1-1): walking a raw dotted key through `target["__proto__"]`
+	// resolves to Object.prototype via the [[Prototype]] getter — the write
+	// then lands on Object.prototype BEFORE configPatchFromConfig sanitizes.
+	// Refuse dangerous segments at the walker (shared proto-safe helpers in
+	// config-validation.ts).
+	if (isDangerousPath(path)) return;
 	const keys = path.split(".");
 	let target: Record<string, unknown> = obj;
 	for (let i = 0; i < keys.length - 1; i++) {
@@ -81,10 +92,17 @@ function setNested(obj: Record<string, unknown>, path: string, value: unknown):
 }
 
 function getNested(obj: Record<string, unknown>, path: string): unknown {
+	// R45-S1 read-side (wave-6 M4-R2): mirror the write path's guard. A raw
+	// dotted key resolves INHERITED members without an own-property check —
+	// `get __proto__.toString` / `get constructor` walk Object.prototype and the
+	// value is printed by formatValue (function source) and returned in the typed
+	// result. Refuse any hop the object does not OWN. (The write path already
+	// rejects dangerous segments via isDangerousPath in setNested.)
 	const keys = path.split(".");
 	let current: unknown = obj;
 	for (const key of keys) {
 		if (!current || typeof current !== "object") return undefined;
+		if (!Object.hasOwn(current, key)) return undefined;
 		current = (current as Record<string, unknown>)[key];
 	}
 	return current;
@@ -92,7 +110,12 @@ function getNested(obj: Record<string, unknown>, path: string): unknown {
 
 function formatValue(value: unknown, key?: string): string {
 	if (value === undefined || value === null) {
-		const def = key ? EFFECTIVE_DEFAULTS[key] : undefined;
+		// R45-S1 read-side (wave-6 M4-R2): `EFFECTIVE_DEFAULTS` is a plain object
+		// literal, so an unguarded `EFFECTIVE_DEFAULTS["constructor"]` resolves the
+		// INHERITED Object constructor and prints its source — the same
+		// inherited-member leak as the getNested walker (pinned by
+		// `get constructor`). Require an OWN entry.
+		const def = key && Object.hasOwn(EFFECTIVE_DEFAULTS, key) ? EFFECTIVE_DEFAULTS[key] : undefined;
 		if (def !== undefined) return `${String(def)} (default)`;
 		return "<not set>";
 	}
@@ -145,6 +168,43 @@ function flattenConfig(obj: unknown, prefix: string = ""): string[] {
 	return lines;
 }
 
+// ---------------------------------------------------------------------------
+// Sensitive-value redaction (US-030 / R45-S1)
+// ---------------------------------------------------------------------------
+
+/** Marker printed in place of a schema-marked sensitive value. */
+const SENSITIVE_REDACTION_MARKER = "***(redacted — sensitive)";
+
+/** Schema-marked sensitive dotted paths — computed once from the same source
+ * the `get` path historically used, so `get`/`list`/`json` can never drift. */
+const SENSITIVE_CONFIG_PATHS = collectSensitiveConfigPaths();
+
+function isSensitiveConfigPath(dotted: string): boolean {
+	return SENSITIVE_CONFIG_PATHS.some((p) => dotted === p || dotted.startsWith(`${p}.`));
+}
+
+/**
+ * R45-S1 (deep-review 2026-10-19): `list` and `json` dump the WHOLE effective
+ * config, so without redaction they bypass the `get` path's US-030 redaction
+ * and echo sensitive values (webhook.secret, otlp.headers, …) verbatim into
+ * the session transcript — any in-session agent can read tool output. Returns
+ * a deep clone with every sensitive-marked value replaced by the marker;
+ * undefined/null are kept as-is (they leak nothing and stay invisible in both
+ * output formats).
+ */
+function redactSensitiveConfig(value: unknown, prefix: string = ""): unknown {
+	if (!value || typeof value !== "object" || Array.isArray(value)) return value;
+	const out: Record<string, unknown> = {};
+	for (const [key, child] of Object.entries(value as Record<string, unknown>)) {
+		const dotted = prefix ? `${prefix}.${key}` : key;
+		out[key] =
+			isSensitiveConfigPath(dotted) && child !== undefined && child !== null
+				? SENSITIVE_REDACTION_MARKER
+				: redactSensitiveConfig(child, dotted);
+	}
+	return out;
+}
+
 // ---------------------------------------------------------------------------
 // Known config keys — mirrors config-schema.ts + config.ts.
 // ---------------------------------------------------------------------------
@@ -318,7 +378,8 @@ export function handleSettings(params: { config?: Record<string, unknown> }, ctx
 	// team-settings list — show ALL effective values (not just KNOWN_KEYS)
 	if (!args || args === "list") {
 		const lines = ["pi-crew effective settings:", `Config file: ${loaded.path}`, ""];
-		const flatLines = flattenConfig(effective);
+		// R45-S1: full dump must pass through the same redaction as `get`.
+		const flatLines = flattenConfig(redactSensitiveConfig(effective));
 		if (flatLines.length > 0) {
 			lines.push(...flatLines);
 		} else {
@@ -344,7 +405,8 @@ export function handleSettings(params: { config?: Record<string, unknown> }, ctx
 			`// Sources: ${loaded.paths?.join(", ") ?? loaded.path}`,
 			...(loaded.warnings?.map((w) => `// WARNING: ${w}`) ?? []),
 			"",
-			JSON.stringify(effective, null, 2),
+			// R45-S1: full dump must pass through the same redaction as `get`.
+			JSON.stringify(redactSensitiveConfig(effective), null, 2),
 		];
 		return result(lines.join("\n"), { ...OK } as never);
 	}
@@ -475,11 +537,11 @@ export function handleSettings(params: { config?: Record<string, unknown> }, ctx
 		// US-030 security review: a value whose dotted path is schema-marked
 		// sensitive (webhook.secret, otlp.headers, …) must not be echoed into
 		// the session transcript — any in-session agent can read tool output.
-		const sensitive = collectSensitiveConfigPaths().some((path) => key === path || key.startsWith(`${path}.`));
+		const sensitive = isSensitiveConfigPath(key);
 		const rendered = sensitive
 			? value === undefined || value === null
 				? "<not set>"
-				: "***(redacted — sensitive)"
+				: SENSITIVE_REDACTION_MARKER
 			: formatValue(value, key);
 		return result(`${key} = ${rendered}${note}`, {
 			...OK,
@@ -492,6 +554,10 @@ export function handleSettings(params: { config?: Record<string, unknown> }, ctx
 	if (args.startsWith("unset ")) {
 		const key = args.slice(6).trim();
 		if (!key) return result("Usage: team-settings unset <key>", { ...ERR }, true);
+		// R24-H2 (M1-1): refuse reserved Object.prototype key paths at the
+		// boundary — `unset __proto__.toString` would otherwise delete
+		// Object.prototype.toString via the [[Prototype]] getter walk.
+		if (isDangerousPath(key)) return result(`Refusing to unset '${key}': reserved Object.prototype key path`, { ...ERR }, true);
 		try {
 			const saved = updateConfig({}, { cwd: ctx.cwd, scope, unsetPaths: [key] });
 			return result(`Unset ${key}\nSaved to: ${saved.path}`, {
@@ -516,6 +582,10 @@ export function handleSettings(params: { config?: Record<string, unknown> }, ctx
 		const key = rest.slice(0, spaceIdx);
 		const rawValue = rest.slice(spaceIdx + 1).trim();
 		if (!key) return result("Usage: team-settings set <key> <value>", { ...ERR }, true);
+		// R24-H1 (M1-1): refuse reserved Object.prototype key paths at the
+		// boundary — `set __proto__.polluted 1` would otherwise pollute
+		// Object.prototype via the [[Prototype]] getter walk in setNested.
+		if (isDangerousPath(key)) return result(`Refusing to set '${key}': reserved Object.prototype key path`, { ...ERR }, true);
 
 		const value = parseValue(rawValue);
 		const patch: Record<string, unknown> = {};

package/src/extension/team-tool/health-monitor.ts

@@ -27,7 +27,7 @@ interface CorruptEntry {
 	reason: string;
 }
 
-interface StuckTask {
+export interface StuckTask {
 	runId: string;
 	taskId: string;
 	staleMs: number;
@@ -80,6 +80,18 @@ function readRunTasks(stateRoot: string): TeamTaskState[] {
  */
 export function detectStuckTasks(run: { runId: string; stateRoot: string }, now: number): StuckTask[] {
 	const tasks = readRunTasks(run.stateRoot);
+	return stuckTasksFromRecords(tasks, run.runId, now);
+}
+
+/**
+ * R48-N1 (2026-10-19): pure stuck-task detection over an ALREADY-loaded task
+ * array. Extracted from {@link detectStuckTasks} so the status surface — which
+ * already holds `tasks` in memory — can consult the SAME external heartbeat-age
+ * signal without a second disk read. This is the EXTERNAL (timestamp-based)
+ * signal the status `needsAttention` surface previously never had: it does not
+ * trust the worker's self-reported `activityState`.
+ */
+export function stuckTasksFromRecords(tasks: TeamTaskState[], runId: string, now: number): StuckTask[] {
 	const stuck: StuckTask[] = [];
 
 	for (const task of tasks) {
@@ -103,7 +115,7 @@ export function detectStuckTasks(run: { runId: string; stateRoot: string }, now:
 		const staleMs = now - latest;
 		if (staleMs > STUCK_TASK_THRESHOLD_MS) {
 			stuck.push({
-				runId: run.runId,
+				runId,
 				taskId: task.id,
 				staleMs,
 				detail: `stale ${Math.round(staleMs / 60_000)}m (last activity: ${new Date(latest).toISOString()})`,