pi-crew 0.11.24 → 0.11.26

package/src/extension/team-tool/lifecycle-actions.ts

@@ -2,6 +2,7 @@ import * as fs from "node:fs";
 import * as path from "node:path";
 import { removeGuidance } from "../../config/markers.ts";
 import { appendHookEvent, executeHook } from "../../hooks/registry.ts";
+import { abortRunDelegates } from "../../runtime/broker/delegate/delegate-abort.ts";
 import { killProcessPid } from "../../runtime/child-pi/child-pi.ts";
 import { terminateLiveAgentsForRun } from "../../runtime/live-session/live-agent-manager.ts";
 import type { TeamToolParamsValue } from "../../schema/team-tool-schema.ts";
@@ -315,6 +316,12 @@ export async function handleForget(params: TeamToolParamsValue, ctx: TeamContext
 	// Without this, forgetting a running run orphans those processes (separate
 	// process groups via setsid) which keep executing and consuming tokens after
 	// their state directory is gone. Mirrors handleCancel's cleanup.
+	// M4-R1(c) (fix-wave 6 residual, M3-A / R43-N3): the in-flight DELEGATE
+	// grandchildren too — they live in the broker's abort registry (own
+	// process-local lifetime) and would otherwise keep spending against a state
+	// directory this call is about to delete. Must run before the fs.rmSync
+	// calls below. Sync + never throws (0 when no broker aborter is installed).
+	abortRunDelegates(loaded.manifest.runId, "run-forgotten");
 	await terminateLiveAgentsForRun(loaded.manifest.runId, "cancelled", appendEvent, loaded.manifest.eventsPath);
 	const asyncPid = loaded.manifest.async?.pid;
 	if (asyncPid !== undefined && asyncPid > 0) {
@@ -529,23 +536,36 @@ function dryRunRemovedIds(guidancePath: string): string[] {
  *  - NEVER removes user-authored agent files (`~/.pi/agent/agents/*.md`)
  *    because pi-crew cannot tell which were user-created vs test-copied —
  *    only the timestamped `.bak-*` backups (clearly pi-crew test junk).
- *  - The state dir removal requires force=true by default is NOT required
- *    (it's pi-crew's own runtime cache, regenerable), but config.json removal
- *    IS gated on force=true (it may hold user-customized settings).
- *  - dryRun=true previews without writing.
+ *  - F13-B: the user state dir is NOT removed on `confirm` alone. It holds run
+ *    history/artifacts for the whole user tier, so removal is gated on an
+ *    explicit `force: true` — parity with the global config below and with
+ *    project-scope `.crew/` removal (`force` gate). Without force the state dir
+ *    is reported and preserved.
+ *  - dryRun=true previews without writing (and always states the force gate).
  */
 function handleUserCleanup(params: TeamToolParamsValue, ctx: TeamContext): PiTeamsToolResult {
 	const dryRun = params.dryRun === true;
 	const force = params.force === true;
 	const lines: string[] = ["User-scope cleanup for pi-crew:"];
 
-	// 1. pi-crew user state dir (~/.pi/agent/extensions/pi-crew/) — always safe
-	//    to remove (regenerable runtime cache: artifacts + state). This is the
-	//    bulk of the "user-level junk".
+	// 1. pi-crew user state dir (~/.pi/agent/extensions/pi-crew/) — run history +
+	//    artifacts for the user tier. F13-B: force-gated (was confirm-only, which
+	//    let a routine `cleanup scope=user` wipe the whole user state dir).
 	const crewStateDir = userCrewRoot();
 	lines.push(`pi-crew user state dir (${crewStateDir}):`);
 	let crewStateBytes = 0;
-	if (fs.existsSync(crewStateDir)) {
+	if (!fs.existsSync(crewStateDir)) {
+		lines.push("  - (not present — nothing to do)");
+	} else if (!force) {
+		try {
+			crewStateBytes = dirSize(crewStateDir);
+		} catch {
+			/* best-effort size */
+		}
+		lines.push(
+			`  - ${dryRun ? "would preserve" : "preserved"}: ${crewStateDir} (${formatBytes(crewStateBytes)}) — holds run history/artifacts; pass force: true to remove`,
+		);
+	} else {
 		try {
 			crewStateBytes = dirSize(crewStateDir);
 		} catch {
@@ -559,8 +579,6 @@ function handleUserCleanup(params: TeamToolParamsValue, ctx: TeamContext): PiTea
 			}
 		}
 		lines.push(`  - ${dryRun ? "would remove" : "removed"}: ${crewStateDir} (${formatBytes(crewStateBytes)})`);
-	} else {
-		lines.push("  - (not present — nothing to do)");
 	}
 
 	// 2. pi-crew global config (~/.pi/agent/pi-crew.json) — gated on force=true

package/src/extension/team-tool/respond.ts

@@ -1,4 +1,5 @@
 import { renderAskAnswer } from "../../prompt/prompt-runtime.ts";
+import { repointWaitState } from "../../runtime/broker/protocol/wait-resolve.ts";
 import { readCrewAgents, recordFromTask, saveCrewAgents } from "../../runtime/crew-agent-records.ts";
 import { isWaitingWorkerAlive } from "../../runtime/dispatch-batch.ts";
 import { checkProcessLiveness } from "../../runtime/process-status.ts";
@@ -243,12 +244,18 @@ export function handleRespond(params: TeamToolParamsValue, ctx: TeamContext): Pi
 		let manifest = fresh.manifest;
 		if (requeuedIds.length > 0) {
 			saveRunTasks(fresh.manifest, updatedTasks);
-			// WP-2 review round 1 (P3): clear manifest.waitState when its park was
-			// requeued — mirror the broker's clearWaitState guard (taskId match),
-			// else the stale pointer shields the run from staleness repair for
-			// the full 24h TTL and leaves a stale marker in the manifest/UI.
+			// WP-2 review round 1 (P3) + M4-R1(b) (fix-wave 6 residual): when the slot
+			// pointed at a REQUEUED park, scoped-forget it — but never by blind
+			// clearing. Another task may still be parked and this single slot is the
+			// only thing shielding it (isWaitAnswerPending reads just this field), so
+			// re-point it at the surviving park (latest deadline wins, mirroring
+			// wait.resolve's repointedWaitState); it is cleared only when this was
+			// the last live park. The clear remains the correct outcome there — the
+			// pre-fix guard left the stale pointer shielding the run for the full
+			// 24h TTL with a stale marker in the manifest/UI.
 			if (manifest.waitState && requeuedIds.includes(manifest.waitState.taskId)) {
-				manifest = { ...manifest, waitState: undefined, updatedAt: new Date().toISOString() };
+				const waitState = repointWaitState(updatedTasks, manifest.waitState, (candidateId) => requeuedIds.includes(candidateId));
+				manifest = { ...manifest, waitState, updatedAt: new Date().toISOString() };
 				saveRunManifest(manifest);
 			}
 			if (

package/src/extension/team-tool/run-deadline.ts

@@ -2,6 +2,7 @@ import type { PiTeamsConfig } from "../../config/config.ts";
 import { loadConfig } from "../../config/config.ts";
 import { isSessionSwitchInFlight } from "../../ui/inline-panel/view-session-store.ts";
 import { safeAbort } from "../../utils/safe-abort.ts";
+import { clampTimerDelayMs, MAX_TIMER_DELAY_MS } from "../../utils/timer-limits.ts";
 import type { TeamContext } from "./context.ts";
 
 /**
@@ -22,6 +23,28 @@ export interface RunDeadline {
 /** Fallback deadline when no config or param override is available: 1 hour. */
 export const DEFAULT_RUN_DEADLINE_MS = 3_600_000;
 
+/**
+ * R37-F1: re-export the timer ceiling so callers/tests of this module can pin
+ * the clamp without reaching into utils/timer-limits.ts.
+ */
+export { MAX_TIMER_DELAY_MS };
+
+/**
+ * R37-F1: the resolved deadline MUST stay inside the `setTimeout` range.
+ *
+ * `params.timeoutMs` is read off the raw tool params (`additionalProperties:
+ * true`, so it is not schema-validated) and `maxRunMinutes * 60_000` comes from
+ * config. Either can exceed 2^31-1, and Node's timer then fires after **1 ms**
+ * — the run aborted at birth (deep-review round 37, runtime-proven).
+ *
+ * Exported so the `waitForRun` mirror (run-tracker.ts) and tests share ONE
+ * boundary. Returns undefined for absent/invalid values so the config →
+ * default chain still applies.
+ */
+export function clampRunDeadlineMs(value: unknown): number | undefined {
+	return clampTimerDelayMs(value);
+}
+
 /** Options for resolveRunDeadline. */
 export interface RunDeadlineOptions {
 	/** "abort" (default): arm the deadline timer that ABORTS the controller —
@@ -69,10 +92,14 @@ export function resolveRunDeadline<T extends object>(
 	config?: PiTeamsConfig,
 	options?: RunDeadlineOptions,
 ): RunDeadline {
-	const timeoutMs = (params as { timeoutMs?: number }).timeoutMs;
+	// R37-F1: BOTH inputs are caller-controlled and neither is schema-validated
+	// (params: additionalProperties; config: may be passed in directly).
+	// Validate (finite, > 0) and clamp to the timer ceiling before arming.
+	const timeoutMs = clampRunDeadlineMs((params as { timeoutMs?: number }).timeoutMs);
 	const effectiveConfig = config ?? loadConfig(ctx.cwd).config;
 	const maxRunMinutes = effectiveConfig?.limits?.maxRunMinutes;
-	const deadlineMs = timeoutMs ?? (maxRunMinutes ? maxRunMinutes * 60_000 : DEFAULT_RUN_DEADLINE_MS);
+	const configDeadlineMs = clampRunDeadlineMs(typeof maxRunMinutes === "number" ? maxRunMinutes * 60_000 : undefined);
+	const deadlineMs = timeoutMs ?? configDeadlineMs ?? DEFAULT_RUN_DEADLINE_MS;
 
 	const controller = new AbortController();
 	// Propagate caller abort (ctx.signal) to the shared controller.

package/src/extension/team-tool/run.ts

@@ -27,6 +27,7 @@ async function executeTeamRun(...args: Parameters<typeof ExecuteTeamRunFn>): Pro
 import { spawnBackgroundTeamRun } from "../../runtime/async-runner.ts";
 import { resolveCrewRuntime, runtimeResolutionState } from "../../runtime/model/runtime-resolver.ts";
 import { captureRunModelContext, resolveParentModel } from "../../runtime/model/session-model.ts";
+import { resolveHostVerifyGateSpec } from "../../runtime/verification/verify-gate.ts";
 import { appendEventAsync, readEventsCursor } from "../../state/event-log/event-log.ts";
 import type { RunMetrics } from "../../state/stores/run-metrics.ts";
 import type { RuntimeResolutionState, TeamRunManifest, TeamTaskState } from "../../state/types.ts";
@@ -495,6 +496,14 @@ export async function handleRun(params: TeamToolParamsValue, ctx: TeamContext):
 		);
 	}
 	const executedConfig = effectiveRunConfig(loadedConfig.config, params.config);
+	// M1-7 (R47-1): pin the host-owned verify-gate ground truth AT DISPATCH —
+	// this host process read of the project manifests happens BEFORE any
+	// worker can run, so the snapshot is pristine. The run manifest carries it
+	// to the verifier pre-gate (task-runner), which re-hashes the task cwd
+	// against it and never re-derives checks from the worker-mutable
+	// task-cwd package.json. Undefined when the project has neither manifests
+	// nor a check preset — the gate then resolves no checks (fail-closed).
+	const hostVerifyGateSpec = await resolveHostVerifyGateSpec(resolvedCtx.cwd);
 	const runtime = await resolveCrewRuntime(executedConfig);
 	const runtimeResolution = runtimeResolutionState(runtime);
 	// DEBUG: log what we received (gated to avoid stdout pollution in production)
@@ -514,6 +523,8 @@ export async function handleRun(params: TeamToolParamsValue, ctx: TeamContext):
 		...updatedManifest,
 		runtimeResolution,
 		runConfig: executedConfig,
+		// M1-7 (R47-1): host-owned verify-gate spec (see hostVerifyGateSpec above).
+		...(hostVerifyGateSpec ? { verifyGateSpec: hostVerifyGateSpec } : {}),
 		// Background/async runs re-enter through background-runner in a detached
 		// process with no ExtensionContext. Snapshot the model routing inputs so
 		// they survive the hand-off instead of being rediscovered from models.json.

package/src/extension/team-tool/status.ts

@@ -3,15 +3,17 @@ import { applyAttentionState, formatActivityAge, resolveCrewControlConfig } from
 import { extractCommandTrace } from "../../runtime/command-trace.ts";
 import { readCrewAgents } from "../../runtime/crew-agent-records.ts";
 import { deadletterStatusLine } from "../../runtime/deadletter.ts";
-import { evaluateRunEffectiveness } from "../../runtime/effectiveness.ts";
+import { delegateCompletedTaskIdsFromEvents, evaluateRunEffectiveness } from "../../runtime/effectiveness.ts";
 import { computePhaseProgress } from "../../runtime/phase-progress.ts";
 import { checkProcessLiveness, isActiveRunStatus } from "../../runtime/process-status.ts";
+import { stripWorkerEscapes } from "../../runtime/sanitize/worker-text.ts";
 import { formatTaskGraphLines, waitingReason } from "../../runtime/task-display.ts";
 import { verifyTaskCompletion } from "../../runtime/verification/completion-guard.ts";
 import type { TeamToolParamsValue } from "../../schema/team-tool-schema.ts";
 import { withRunLockSync } from "../../state/coordination/locks.ts";
 import { readDeliveryState, readMailbox } from "../../state/coordination/mailbox.ts";
 import { appendEvent, readEventsCursor } from "../../state/event-log/event-log.ts";
+import { getTasksCorruptionReport } from "../../state/stores/manifest-io.ts";
 import { loadRunManifestById, saveRunTasks, updateRunStatus } from "../../state/stores/state-store.ts";
 import { aggregateUsage, formatCost, formatUsage } from "../../state/usage.ts";
 import { formatDuration } from "../../ui/format-helpers.ts";
@@ -19,6 +21,7 @@ import { goalAchievedStatusLabel } from "../../ui/goal-flag.ts";
 import { locateRunCwd } from "../team-tool.ts";
 import type { PiTeamsToolResult } from "../tool-result.ts";
 import { result, type TeamContext } from "./context.ts";
+import { stuckTasksFromRecords } from "./health-monitor.ts";
 import { paramRequired } from "./param-error.ts";
 import { RUN_NOT_FOUND_HINT } from "./run-not-found.ts";
 
@@ -108,6 +111,31 @@ export function transitionStaleAsyncUnderLock(
 	return transitioned;
 }
 
+/**
+ * R46-1 / EP1 (unfenced-worker-text rollout): worker-authored values reach the
+ * orchestrator-facing status text from several places — child stderr flows
+ * VERBATIM into `task.error` / `failureCause` / `agent.error`
+ * (child-executor.ts attemptErrorFor), tool names/activity states arrive from
+ * worker JSON events, and event/attention messages are appended by crew code
+ * that embeds worker text. Interpolated raw, any of them can forge a fresh
+ * column-0 status row (e.g. a fake `✓ verifier [completed]` line, fabricated
+ * task/agent rows or `Progress: 100%`) and smuggle terminal escapes
+ * (ANSI color, OSC-52 clipboard writes) into the LEADER's status view.
+ *
+ * Shape: these are inline `key=value` fields inside dense single-line rows, so
+ * a multi-line provenance fence would break the row grammar. Route each value
+ * through the SHARED strip cascade (`stripWorkerEscapes`, not reimplemented)
+ * and collapse newlines/CRs to a single space — the R46-1 "newline-collapse"
+ * fix (the finding prescribes "newline-collapse or structural quoting in both
+ * status builders"). The stripped value can no longer start a new line, so
+ * forged rows are structurally impossible and escapes never reach the session.
+ */
+function sanitizeStatusField(value: string): string {
+	return stripWorkerEscapes(value)
+		.replace(/[\n\r]+/g, " ")
+		.trim();
+}
+
 export function handleStatus(params: TeamToolParamsValue, ctx: TeamContext): PiTeamsToolResult {
 	if (!params.runId)
 		return result(
@@ -225,21 +253,43 @@ export function handleStatus(params: TeamToolParamsValue, ctx: TeamContext): PiT
 		tasks,
 		executeWorkers: manifest.runtimeResolution?.kind !== "scaffold",
 		runtimeConfig: cfg.runtime,
+		// EP2 parity rider (wave-6 M4-R2): finalize-run passes the delegate.completed
+		// id set so a grandchild delegate task (real output delivered via the broker
+		// mailbox, no usage/transcript of its own) is NOT misread as no-observed-work.
+		// status omitted it, so the SAME run rendered a phantom `noObservedWork` row
+		// here while finalize counted it as work. `allEvents` is the bounded
+		// cursor/tail read above (not the full readEvents call finalize uses) —
+		// best-effort parity: a delegate.completed event that has already scrolled
+		// out of the tail window is not recoverable here, matching the reader's
+		// bounded contract.
+		delegateCompleted: delegateCompletedTaskIdsFromEvents(allEvents),
 	});
 	const noObservedWorkTasks = effectiveness.noObservedWorkTaskIds
 		.map((id) => tasks.find((task) => task.id === id))
 		.filter((task): task is (typeof tasks)[number] => task !== undefined);
-	const attentionTasks = effectiveness.needsAttentionTaskIds
+	// R48-N1 (fix-wave 6, EP3): fold an EXTERNAL liveness signal into the attention
+	// surface. `effectiveness.needsAttentionTaskIds` is worker-SELF-REPORTED
+	// (activityState === "needs_attention"); a dead sync host reports nothing and
+	// the run renders "running / needsAttention=none / 0%" forever. Consult the
+	// timestamp-based stuck-task signal (heartbeat/activity age) for active runs so
+	// an unresponsive/frozen task is surfaced even with zero self-report.
+	const externallyStuckTasks = isActiveRunStatus(manifest.status) ? stuckTasksFromRecords(tasks, manifest.runId, Date.now()) : [];
+	const externallyStuckIds = new Set(externallyStuckTasks.map((stuck) => stuck.taskId));
+	const needsAttentionIds = [...new Set([...effectiveness.needsAttentionTaskIds, ...externallyStuckIds])];
+	const attentionTasks = needsAttentionIds
 		.map((id) => tasks.find((task) => task.id === id))
 		.filter((task): task is (typeof tasks)[number] => task !== undefined);
 	const activeAgents = crewAgents.filter((agent) => agent.status === "running");
 	const completedAgents = crewAgents.filter((agent) => agent.status !== "running");
 	const waitingTasks = tasks.filter((task) => task.status === "queued" || task.status === "waiting");
 	const agentLine = (agent: (typeof crewAgents)[number]): string =>
-		`- ${agent.id} [${agent.status}] ${agent.role} -> ${agent.agent} runtime=${agent.runtime}${agent.model ? ` model=${agent.model}` : ""}${agent.usage ? ` usage=${formatUsage(agent.usage)}` : ""}${agent.usage?.cost ? ` cost=${formatCost(agent.usage.cost)}` : ""}${agent.progress?.activityState ? ` activityState=${agent.progress.activityState}` : ""}${formatActivityAge(agent) ? ` activity=${formatActivityAge(agent)}` : ""}${agent.progress?.currentTool ? ` tool=${agent.progress.currentTool}` : ""}${agent.toolUses ? ` tools=${agent.toolUses}` : ""}${!agent.usage && agent.progress?.tokens ? ` tokens=${agent.progress.tokens}` : ""}${agent.progress?.turns ? ` turns=${agent.progress.turns}` : ""}${agent.jsonEvents !== undefined ? ` jsonEvents=${agent.jsonEvents}` : ""}${agent.outputPath ? ` output=${agent.outputPath}` : ""}${agent.transcriptPath ? ` transcript=${agent.transcriptPath}` : ""}${agent.statusPath ? ` status=${agent.statusPath}` : ""}${agent.error ? ` error=${agent.error}` : ""}`;
+		`- ${agent.id} [${agent.status}] ${agent.role} -> ${agent.agent} runtime=${agent.runtime}${agent.model ? ` model=${agent.model}` : ""}${agent.usage ? ` usage=${formatUsage(agent.usage)}` : ""}${agent.usage?.cost ? ` cost=${formatCost(agent.usage.cost)}` : ""}${agent.progress?.activityState ? ` activityState=${sanitizeStatusField(agent.progress.activityState)}` : ""}${formatActivityAge(agent) ? ` activity=${formatActivityAge(agent)}` : ""}${agent.progress?.currentTool ? ` tool=${sanitizeStatusField(agent.progress.currentTool)}` : ""}${agent.toolUses ? ` tools=${agent.toolUses}` : ""}${!agent.usage && agent.progress?.tokens ? ` tokens=${agent.progress.tokens}` : ""}${agent.progress?.turns ? ` turns=${agent.progress.turns}` : ""}${agent.jsonEvents !== undefined ? ` jsonEvents=${agent.jsonEvents}` : ""}${agent.outputPath ? ` output=${agent.outputPath}` : ""}${agent.transcriptPath ? ` transcript=${agent.transcriptPath}` : ""}${agent.statusPath ? ` status=${agent.statusPath}` : ""}${agent.error ? ` error=${sanitizeStatusField(agent.error)}` : ""}`;
 	// G19 (W-E Phase 1): surface the goal-achievement verdict on terminal runs —
 	// ⚠ false-green warning line; silent while running, when achieved, or when
 	// the run predates the assessment (goalAchieved undefined).
+	// R39-M2 (fix-wave 6, EP3): if the tasks load above recovered from a corrupt
+	// tasks.json, surface the drop instead of a clean "completed 100%".
+	const corruptionReport = getTasksCorruptionReport(manifest.runId);
 	const goalLine = goalAchievedStatusLabel(manifest);
 	const lines = [
 		`Run: ${manifest.runId}`,
@@ -268,10 +318,10 @@ export function handleStatus(params: TeamToolParamsValue, ctx: TeamContext): PiT
 		...(tasks.length
 			? tasks.map(
 					(task) =>
-						`- ${task.id} [${task.status}] ${task.role} -> ${task.agent}${task.taskPacket ? ` scope=${task.taskPacket.scope}` : ""}${task.verification ? ` green=${task.verification.observedGreenLevel}/${task.verification.requiredGreenLevel}` : ""}${task.modelAttempts?.length ? ` attempts=${task.modelAttempts.length}` : ""}${task.modelRouting ? ` modelRouting=${task.modelRouting.requested ? `${task.modelRouting.requested}->` : ""}${task.modelRouting.resolved}${task.modelRouting.usedAttempt ? ` attempt=${task.modelRouting.usedAttempt + 1}` : ""}` : ""}${task.agentProgress?.activityState ? ` activityState=${task.agentProgress.activityState}` : ""}${(() => {
+						`- ${task.id} [${task.status}] ${task.role} -> ${task.agent}${task.taskPacket ? ` scope=${task.taskPacket.scope}` : ""}${task.verification ? ` green=${task.verification.observedGreenLevel}/${task.verification.requiredGreenLevel}` : ""}${task.modelAttempts?.length ? ` attempts=${task.modelAttempts.length}` : ""}${task.modelRouting ? ` modelRouting=${task.modelRouting.requested ? `${task.modelRouting.requested}->` : ""}${task.modelRouting.resolved}${task.modelRouting.usedAttempt ? ` attempt=${task.modelRouting.usedAttempt + 1}` : ""}` : ""}${task.agentProgress?.activityState ? ` activityState=${sanitizeStatusField(task.agentProgress.activityState)}` : ""}${(() => {
 							const t = extractCommandTrace(task.agentProgress?.recentTools);
 							return t.summary ? ` ${t.summary}` : "";
-						})()}${attentionByTask.get(task.id)?.data?.reason ? ` attention=${String(attentionByTask.get(task.id)?.data?.reason)}` : ""}${task.jsonEvents !== undefined ? ` jsonEvents=${task.jsonEvents}` : ""}${task.usage ? ` usage=${JSON.stringify(task.usage)}` : ""}${task.resultArtifact ? ` result=${task.resultArtifact.path}` : ""}${task.transcriptArtifact ? ` transcript=${task.transcriptArtifact.path}` : ""}${task.worktree ? ` worktree=${task.worktree.path}` : ""}${task.error ? ` error=${task.error}` : ""}${task.failureCause ? ` failureCause=${task.failureCause}` : ""}`,
+						})()}${attentionByTask.get(task.id)?.data?.reason ? ` attention=${sanitizeStatusField(String(attentionByTask.get(task.id)?.data?.reason))}` : ""}${task.jsonEvents !== undefined ? ` jsonEvents=${task.jsonEvents}` : ""}${task.usage ? ` usage=${JSON.stringify(task.usage)}` : ""}${task.resultArtifact ? ` result=${task.resultArtifact.path}` : ""}${task.transcriptArtifact ? ` transcript=${task.transcriptArtifact.path}` : ""}${task.worktree ? ` worktree=${task.worktree.path}` : ""}${task.error ? ` error=${sanitizeStatusField(task.error)}` : ""}${task.failureCause ? ` failureCause=${sanitizeStatusField(task.failureCause)}` : ""}`,
 				)
 			: ["- (none)"]),
 		`Task counts: ${[...counts.entries()].map(([status, count]) => `${status}=${count}`).join(", ") || "none"}`,
@@ -281,7 +331,13 @@ export function handleStatus(params: TeamToolParamsValue, ctx: TeamContext): PiT
 		`- observable=${effectiveness.observable}/${Math.max(1, effectiveness.completed)} completed tasks`,
 		`- workerExecution=${effectiveness.workerExecution} guard=${effectiveness.guardMode} severity=${effectiveness.severity}`,
 		`- noObservedWork=${effectiveness.noObservedWorkTaskIds.length ? effectiveness.noObservedWorkTaskIds.join(",") : "none"}`,
-		`- needsAttention=${effectiveness.needsAttentionTaskIds.length ? effectiveness.needsAttentionTaskIds.join(",") : "none"}`,
+		`- needsAttention=${needsAttentionIds.length ? needsAttentionIds.join(",") : "none"}`,
+		`- unresponsive=${externallyStuckTasks.length ? externallyStuckTasks.map((stuck) => `${stuck.taskId}(${stuck.detail})`).join(",") : "none"}`,
+		...(corruptionReport
+			? [
+					`⚠ State recovery: tasks.json was corrupt; reconstructed ${corruptionReport.reconstructedCount} task(s) from events${corruptionReport.droppedIds.length ? `, ${corruptionReport.droppedIds.length} DROPPED (${corruptionReport.droppedIds.join(",")})` : ""} — run is DEGRADED.`,
+				]
+			: []),
 		"Completion verification",
 		...(tasks.filter((t) => t.status === "completed").length
 			? tasks
@@ -316,7 +372,7 @@ export function handleStatus(params: TeamToolParamsValue, ctx: TeamContext): PiT
 		...(events.length
 			? events.map(
 					(event) =>
-						`- ${event.time} ${event.type}${event.taskId ? ` ${event.taskId}` : ""}${event.message ? `: ${event.message}` : ""}`,
+						`- ${event.time} ${event.type}${event.taskId ? ` ${event.taskId}` : ""}${event.message ? `: ${sanitizeStatusField(event.message)}` : ""}`,
 				)
 			: ["- (none)"]),
 	];
@@ -382,7 +438,7 @@ export function buildCompactStatus(
 	if (failedOrAttention.length > 0) {
 		lines.push("Issues:");
 		for (const t of failedOrAttention) {
-			lines.push(`- ${t.id} [${t.status}] ${t.role}: ${t.error ?? "(no error detail)"}`);
+			lines.push(`- ${t.id} [${t.status}] ${t.role}: ${t.error ? sanitizeStatusField(t.error) : "(no error detail)"}`);
 		}
 	}
 	lines.push("Tip: pass details=true for full output (task graph, agents, effectiveness, events).");

package/src/extension/team-tool/workflow-manage.ts

@@ -89,7 +89,11 @@ export function handleWorkflowCreate(params: TeamToolParamsValue, ctx: TeamConte
 		return result(`workflow-create rejected: ${validationError}`, { action: "workflow-create", status: "error" }, true);
 	}
 	try {
-		const scope = (params.scope === "user" ? "user" : "project") as "user" | "project";
+		// R11-F1 (fix-wave 6, M1-2): scope reads the canonical carrier
+		// `config.scope` (same source as the root-gate and every other
+		// scope-bearing handler), defaulting to project like handleImport —
+		// top-level `params.scope` no longer diverges from the gate's read.
+		const scope = (params.config?.scope === "user" ? "user" : "project") as "user" | "project";
 		const filePath = resolveWorkflowWritePath(ctx.cwd, name, scope);
 		writeFileSync(filePath, script, "utf-8");
 		return result(

package/src/extension/team-tool.ts

@@ -1230,6 +1230,9 @@ export async function handleTeamTool(params: TeamToolParamsValue, ctx: TeamConte
 	// actions (schedule mutations, goal start/force, user-scope config/settings/
 	// create/update, autonomy, settings theme) are reserved for the user's
 	// ROOT session. Non-root callers (workers) can still write project scope.
+	// Wave-6 (R11-F1/R11-S1): scope resolves from config.scope only, and
+	// workflow-create/save/delete are ALWAYS worker-gated (.dwf.ts ACE),
+	// import/export at user scope.
 	// Single chokepoint: every domain router dispatch passes through here.
 	const rootGateReason = rootGateBlockReason(params);
 	if (rootGateReason) {

package/src/i18n.ts

@@ -1,4 +1,5 @@
 import type { ExtensionAPI } from "@earendil-works/pi-coding-agent";
+import { isDangerousKey, stripDangerousKeysDeep } from "./config/config-validation.ts";
 import { logInternalError } from "./utils/internal-error.ts";
 
 type Params = Record<string, string | number>;
@@ -166,22 +167,17 @@ export function t(key: Key, params?: Params): string {
  * @example
  * addTranslations("vi", { "agent.requiresPrompt": "Agent cần prompt." })
  */
-const DANGEROUS_KEYS = new Set(["__proto__", "constructor", "prototype"]);
-
-function stripDangerousKeys<T extends Record<string, unknown>>(obj: T): T {
-	const safe: Record<string, unknown> = {};
-	for (const key of Object.keys(obj)) {
-		if (!DANGEROUS_KEYS.has(key)) {
-			safe[key] = obj[key];
-		}
-	}
-	return safe as T;
-}
-
 export function addTranslations(locale: string, bundle: Partial<Record<Key, string>>): void {
 	if (!locale) return;
-	const safeBundle = stripDangerousKeys(bundle as Record<string, unknown>) as Partial<Record<Key, string>>;
-	const existing = translations[locale];
+	// R46-7 (M1-1): the locale axis reaches `translations[locale]` — a
+	// reserved name (`__proto__`) resolves through the [[Prototype]] getter to
+	// Object.prototype, so the Object.assign branch would pollute it and the
+	// assignment branch would silently reassign [[Prototype]]. Reject reserved
+	// locale names and use own-property lookup (shared proto-safe helpers in
+	// config-validation.ts).
+	if (isDangerousKey(locale)) return;
+	const safeBundle = stripDangerousKeysDeep(bundle as Record<string, unknown>) as Partial<Record<Key, string>>;
+	const existing = Object.hasOwn(translations, locale) ? translations[locale] : undefined;
 	if (existing) {
 		Object.assign(existing, safeBundle);
 	} else {
@@ -199,6 +195,14 @@ export function listLocales(): string[] {
 // --- Initialization ---
 
 export function initI18n(pi: ExtensionAPI): () => void {
+	// R49-F3 (pi-core census): the `pi-core/i18n/*` channels below are a PHANTOM
+	// protocol in pi 0.77 and 1.0.4 — the resolved api literal + dist contain ZERO
+	// emitters/consumers for `pi-core/i18n/registerBundle`, `.../localeChanged` and
+	// `.../requestApi`, so `pi.events.on(...)` never fires and the locale stays
+	// locked to the default (`currentLocale` stays undefined → English/built-in
+	// fallback via t()). Harmless today (no runtime callers rely on a non-default
+	// locale); kept as forward-compat shims. Re-check before wiring any locale
+	// switch to this path.
 	try {
 		pi.events?.emit?.("pi-core/i18n/registerBundle", {
 			namespace,

package/src/prompt/inbox-poll.ts

@@ -25,7 +25,8 @@
  *     `sinceTs` watermark — one message delivers once;
  *   - U5 (2026-10-10): dedup is ALSO durable across restarts — delivered
  *     rows are recorded in delivery.json (`messages[id]="acknowledged"` +
- *     `${direction}:${requestId}` index) and re-read on the next poll, so a
+ *     `${direction}:${recipientTaskId}:${requestId}` index — recipient-scoped,
+ *     M3-9/R33-1) and re-read on the next poll, so a
  *     worker that restarts mid-run (fresh process, EMPTY seen-set) never
  *     re-delivers. A resend carrying the same requestId is dropped by the
  *     same index; duplicate rows under one requestId deliver exactly once.
@@ -44,6 +45,7 @@ import {
 	readAllMailboxMessages,
 	readDeliveryState,
 	recordMailboxRequestIdDelivery,
+	requestIdDeliveryKey,
 } from "../state/coordination/mailbox.ts";
 import { appendEventFireAndForget } from "../state/event-log/event-log.ts";
 import type { TeamRunManifest } from "../state/types.ts";
@@ -201,7 +203,13 @@ export function pollWorkerInbox(pickup: WorkerInboxPickup, limit?: number): Mail
 		// was PREVENTED — audited via mailbox.pickup_deduped (once per key
 		// per process so the 500ms re-scan cannot spam the event log).
 		const requestId = messageIdempotencyKey(m);
-		const dedupKey = requestId !== undefined ? `${m.direction}:${requestId}` : undefined;
+		// M3-9 / R33-1: the index key is RECIPIENT-scoped
+		// (`direction:recipient:requestId`). A group fan-out mints ONE requestId
+		// and reuses it for every recipient, so the pre-fix run-scoped key let the
+		// first acking recipient suppress every sibling at its own pickup
+		// (probe: 1 delivered / 0 / 0). Same-row duplicate protection is
+		// unaffected — that is the per-message `messages[id]` record below.
+		const dedupKey = requestId !== undefined ? requestIdDeliveryKey(m.direction, taskId, requestId) : undefined;
 		if (dedupKey !== undefined) {
 			// (direction, requestId) index — catches resends carrying the same
 			// requestId AND duplicate rows under one requestId.
@@ -258,6 +266,10 @@ export function acknowledgeWorkerInboxDelivery(
 			picked.map((m) => ({
 				direction: m.direction,
 				messageId: m.id,
+				// M3-9 / R33-1: record WHICH recipient consumed the row — the index
+				// key is recipient-scoped, so group fan-out siblings keep their own
+				// exactly-once records.
+				taskId,
 				requestId: messageIdempotencyKey(m),
 			})),
 		);

package/src/prompt/message-tool.ts

@@ -118,7 +118,7 @@ export interface MessageTool {
  *  the injected env object, never a raw process.env.PI_CREW_* member, so the
  *  check:env-vars gate stays green). */
 export function shouldRegisterMessageTool(env: NodeJS.ProcessEnv = process.env): boolean {
-	return env[PI_CREW_MSG_ENABLED_ENV] === "1";
+	return getCrewEnv(PI_CREW_MSG_ENABLED_ENV, env) === "1";
 }
 
 export function createMessageTool(deps: MessageToolDeps = {}): MessageTool {

package/src/prompt/prompt-runtime.ts

@@ -385,7 +385,7 @@ export type AskToolDefinition = ToolDefinition<typeof AskParams, AskDetails>;
  *  reads the injected env object, never a raw process.env.PI_CREW_* member,
  *  so the check:env-vars gate stays green). */
 export function shouldRegisterAskTool(env: NodeJS.ProcessEnv = process.env): boolean {
-	return env[PI_CREW_ASK_ENABLED_ENV] === "1";
+	return getCrewEnv(PI_CREW_ASK_ENABLED_ENV, env) === "1";
 }
 
 // ── T3/R5 (ADR-5 2026-08-17-governed-nesting §1): worker-side `delegate` tool ──
@@ -551,11 +551,33 @@ export function createDelegateTool(deps: DelegateToolDeps = {}): DelegateToolDef
 			const socketPath = get(PI_CREW_BROKER_SOCKET_ASK_ENV);
 			const token = get(PI_CREW_BROKER_TOKEN_ASK_ENV);
 			const runId = get(PI_CREW_BROKER_RUN_ID_ASK_ENV);
+			// delegate-auth: name the ACTUALLY-missing vars and distinguish the two
+			// no-creds shapes instead of a catch-all that blames all four:
+			//   (a) identity present + socket/token absent — nested-host run: the
+			//       spawning host is itself a child session, and child sessions
+			//       never install a broker (issueForChild is root-session-only,
+			//       lifecycle-handlers), so NO broker exists for this runId at any
+			//       depth. (A root-spawned depth-2 worker DOES carry creds, so the
+			//       old "depth-2 worker" label was wrong for this case.)
+			//   (b) identity vars absent too — scaffold, mock, or partially-wired
+			//       spawn; list exactly which vars are missing.
+			const missingVars: string[] = [];
+			if (!taskId) missingVars.push("PI_CREW_TASK_ID/PI_CREW_BROKER_TASK_ID");
+			if (!stateRoot) missingVars.push(PI_CREW_STATE_ROOT_ENV);
+			if (!runId) missingVars.push(PI_CREW_BROKER_RUN_ID_ASK_ENV);
+			if (!socketPath) missingVars.push(PI_CREW_BROKER_SOCKET_ASK_ENV);
+			if (!token) missingVars.push(PI_CREW_BROKER_TOKEN_ASK_ENV);
+			// direct-truthiness guard keeps TS narrowing for the client construction
+			// below (the missingVars[] indirection alone defeats control-flow analysis).
 			if (!taskId || !stateRoot || !socketPath || !token || !runId) {
+				const reason =
+					!socketPath && !token && taskId && stateRoot && runId
+						? "PI_CREW_BROKER_SOCKET / PI_CREW_BROKER_TOKEN absent while task-id/run-id/state-root are set — nested-host run: this worker's host is itself a child session, which never installs a broker, so no broker exists for this run"
+						: `${missingVars.join(" / ")} absent — scaffold, mock, or partially-wired spawn`;
 				return notice(
 					"unavailable",
 					"no-broker",
-					"[delegate] unavailable: no broker connection (socket/token/run-id/state-root absent — scaffold, mock, or depth-2 worker) — do the work yourself; do not call delegate again.",
+					`[delegate] unavailable: no broker connection (${reason}) — do the work yourself; do not call delegate again.`,
 				);
 			}
 			const client = deps.makeBrokerClient
@@ -674,7 +696,7 @@ export function createDelegateTool(deps: DelegateToolDeps = {}): DelegateToolDef
  *  for EVERY role. Broker admission re-checks depth+slot from the task
  *  RECORD — the env is UX/hygiene, not the security boundary). */
 export function shouldRegisterDelegateTool(env: NodeJS.ProcessEnv = process.env): boolean {
-	return env[PI_CREW_DELEGATE_ENABLED_ENV] === "1";
+	return getCrewEnv(PI_CREW_DELEGATE_ENABLED_ENV, env) === "1";
 }
 
 /** Task 5 (§15.2): fence a sibling/group inbox message before it reaches the

package/src/prompt/scratchpad-lifecycle.ts

@@ -30,6 +30,7 @@
 import * as fs from "node:fs";
 import * as path from "node:path";
 import { type Static, Type } from "@sinclair/typebox";
+import { getCrewEnv } from "../config/env-vars.ts";
 import { defineTool, type ExtensionAPI, type ToolDefinition } from "../extension/pi-api.ts";
 import { EngineManager, type ExecuteResult } from "../runtime/scratchpad/engine.ts";
 import { appendEventBuffered, appendEventFireAndForget } from "../state/event-log/event-log.ts";
@@ -77,8 +78,8 @@ function emitScratchpadMetric(
 	data: Record<string, unknown>,
 	appendEvent: typeof appendEventFireAndForget = appendEventFireAndForget,
 ): void {
-	const eventsPath = env[PI_CREW_EVENTS_PATH_ENV];
-	const runId = env[PI_CREW_RUN_ID_ENV];
+	const eventsPath = getCrewEnv(PI_CREW_EVENTS_PATH_ENV, env);
+	const runId = getCrewEnv(PI_CREW_RUN_ID_ENV, env);
 	if (!eventsPath || !runId) return;
 	// Fire-and-forget semantics (H1): a throwing writer (sync or async) must
 	// never break the cell. The real appendEventFireAndForget already catches
@@ -87,7 +88,7 @@ function emitScratchpadMetric(
 		appendEventBuffered(eventsPath, {
 			type,
 			runId,
-			taskId: env[PI_CREW_TASK_ID_ENV],
+			taskId: getCrewEnv(PI_CREW_TASK_ID_ENV, env),
 			data,
 		}).catch((e) => logInternalError("scratchpad_lifecycle.buffered", e, `type=${type}`));
 	} catch {
@@ -224,10 +225,10 @@ export interface SnapshotEnvValidation {
  * write to a guessed location.
  */
 export function validateSnapshotEnv(env: NodeJS.ProcessEnv = process.env): SnapshotEnvValidation {
-	const taskId = env[PI_CREW_TASK_ID_ENV];
-	const artifactsRoot = env[PI_CREW_ARTIFACTS_ROOT_ENV];
-	const snapshotPath = env[PI_CREW_SCRATCHPAD_SNAPSHOT_ENV];
-	const attempt = env[PI_CREW_ATTEMPT_ENV] ?? "0";
+	const taskId = getCrewEnv(PI_CREW_TASK_ID_ENV, env);
+	const artifactsRoot = getCrewEnv(PI_CREW_ARTIFACTS_ROOT_ENV, env);
+	const snapshotPath = getCrewEnv(PI_CREW_SCRATCHPAD_SNAPSHOT_ENV, env);
+	const attempt = getCrewEnv(PI_CREW_ATTEMPT_ENV, env) ?? "0";
 
 	if (!taskId) return { valid: false, reason: `missing ${PI_CREW_TASK_ID_ENV}`, attempt };
 	if (!artifactsRoot) return { valid: false, reason: `missing ${PI_CREW_ARTIFACTS_ROOT_ENV}`, attempt };
@@ -277,8 +278,8 @@ export interface RestoreEnvValidation {
  * no restore, empty namespace, execute continues, message never leaks paths.
  */
 export function validateRestoreEnv(env: NodeJS.ProcessEnv = process.env, restorePath: string): RestoreEnvValidation {
-	const taskId = env[PI_CREW_TASK_ID_ENV];
-	const artifactsRoot = env[PI_CREW_ARTIFACTS_ROOT_ENV];
+	const taskId = getCrewEnv(PI_CREW_TASK_ID_ENV, env);
+	const artifactsRoot = getCrewEnv(PI_CREW_ARTIFACTS_ROOT_ENV, env);
 	if (!taskId) return { valid: false, reason: `missing ${PI_CREW_TASK_ID_ENV}` };
 	if (!artifactsRoot) return { valid: false, reason: `missing ${PI_CREW_ARTIFACTS_ROOT_ENV}` };
 	try {
@@ -299,7 +300,7 @@ export function validateRestoreEnv(env: NodeJS.ProcessEnv = process.env, restore
 		if (st.isSymbolicLink() || !st.isFile()) return { valid: false, reason: "restore-path-not-regular-file" };
 		if (st.size > SNAPSHOT_MAX_BYTES) return { valid: false, reason: "restore-path-over-cap" };
 		// (4) mtime pin (swap-detection hint — forgeable, never authn).
-		const pinned = env[PI_CREW_SCRATCHPAD_RESTORE_MTIME_ENV];
+		const pinned = getCrewEnv(PI_CREW_SCRATCHPAD_RESTORE_MTIME_ENV, env);
 		if (pinned) {
 			const pinnedMs = Number.parseFloat(pinned);
 			if (Number.isFinite(pinnedMs) && Math.abs(st.mtimeMs - pinnedMs) > RESTORE_MTIME_TOLERANCE_MS) {
@@ -483,7 +484,7 @@ export function createExecuteTool(engine: EngineManager, deps: Partial<Scratchpa
 		async execute(_toolCallId, params, signal, _onUpdate, _ctx) {
 			const env = deps.env ?? process.env;
 			// 1. Dormant check (lớp 2 — defense in depth behind the registration gate).
-			if (env[PI_CREW_SCRATCHPAD_ENV] !== "1") {
+			if (getCrewEnv(PI_CREW_SCRATCHPAD_ENV, env) !== "1") {
 				throw new Error("scratchpad is dormant");
 			}
 			// 2. F12: terminal shutdown state — a distinct system error, not "wedged".
@@ -650,7 +651,7 @@ export function registerScratchpadLifecycle(pi: ExtensionAPI, options: Scratchpa
 		// Reset first: each register is a fresh worker session (a session reload
 		// re-arms restore via the env — NIT-2a, module-scope is intentional).
 		const env = options.env ?? process.env;
-		const restorePath = env[PI_CREW_SCRATCHPAD_RESTORE_ENV];
+		const restorePath = getCrewEnv(PI_CREW_SCRATCHPAD_RESTORE_ENV, env);
 		if (restorePath) {
 			const m = restorePath.match(/\.attempt-(\d+)\.snapshot\.json$/);
 			restorePending = { path: restorePath, attempt: m ? Number.parseInt(m[1], 10) : 0 };
@@ -676,5 +677,5 @@ export function registerScratchpadLifecycle(pi: ExtensionAPI, options: Scratchpa
  * the single source of truth per F15.
  */
 export function shouldRegisterScratchpadTool(env: NodeJS.ProcessEnv = process.env): boolean {
-	return env[PI_CREW_SCRATCHPAD_ENV] === "1" && env[PI_CREW_KIND_ENV] === "subagent";
+	return getCrewEnv(PI_CREW_SCRATCHPAD_ENV, env) === "1" && getCrewEnv(PI_CREW_KIND_ENV, env) === "subagent";
 }