pi-crew 0.11.49 → 0.11.51

package/src/state/stores/manifest-io.ts

@@ -184,6 +184,176 @@ function reconstructTasksFromEventLog(eventsPath: string, runId: string): TeamTa
 	}
 }
 
+/**
+ * N3 (security-audit run-1, 2026-10-29 — w9 loader-level hardening):
+ * tasks.json and manifest.json live under the shared-cwd state root, i.e. they
+ * are same-uid writable by WRITE-role workers (verify-gate.ts treats shared-cwd
+ * files as worker-mutable attacker input for exactly this reason). Before this
+ * fix the load seam cast whatever JSON.parse produced straight to
+ * TeamTaskState[]/TeamRunManifest, so poisoned fields flowed into resume /
+ * crash-recovery dispatch as execution authority (forged role →
+ * permissionForRole at pre-execution.ts:248; forged runKind selects the resume
+ * engine at team-tool.ts:673). The validators below are the bounded,
+ * backward-compatible answer: fail-closed on structurally poisoned entries
+ * (drop, never crash the load), permissive on well-formed legacy state.
+ * Provenance/integrity (HMAC) and role re-authorization vs team composition
+ * are explicitly deferred (need secret-management + dispatch-side context).
+ */
+
+/** N3: loader DoG guard — a tasks array beyond this cap is truncated with an
+ * anomaly log. The maxTasksPerRun admission gate (state-store) caps dispatch
+ * cardinality; this bound merely stops an inflated file from dominating load
+ * time / memory before admission ever runs. 10_000 mirrors the default
+ * limits.maxTasksPerRun ceiling. */
+export const MAX_LOADED_TASKS = 10_000;
+
+const MAX_ANOMALY_EXAMPLES = 5;
+
+/** N3: per-entry shape check — a plausible TeamTaskState is a non-null,
+ * non-array object whose id/runId/role/agent/title/status are strings, whose
+ * dependsOn is absent or an array of strings, and whose cwd is absent or a
+ * string. Deliberately shape-only: values (role names, cwd targets, status
+ * enums) are NOT re-authorized here — the loader has no dispatch-side context
+ * for what the approved composition was. */
+function plausibleTaskShape(entry: unknown): entry is TeamTaskState {
+	if (entry === null || typeof entry !== "object" || Array.isArray(entry)) return false;
+	const task = entry as Record<string, unknown>;
+	if (typeof task.id !== "string") return false;
+	if (typeof task.runId !== "string") return false;
+	if (typeof task.role !== "string") return false;
+	if (typeof task.agent !== "string") return false;
+	if (typeof task.title !== "string") return false;
+	if (typeof task.status !== "string") return false;
+	if (task.dependsOn !== undefined) {
+		if (!Array.isArray(task.dependsOn) || task.dependsOn.some((dep) => typeof dep !== "string")) return false;
+	}
+	if (task.cwd !== undefined && typeof task.cwd !== "string") return false;
+	return true;
+}
+
+/**
+ * N3: validate a tasks array loaded from disk before it re-enters dispatch.
+ *
+ * - Entries failing the plausible-shape check are DROPPED with an anomaly log
+ *   (fail-closed on poison) instead of crashing the load or leaking through.
+ * - Entries whose runId does not match the loading run's runId are DROPPED —
+ *   mirrors the w3 DwfStore.load(expectedRunId) binding in
+ *   dwf-state-store.ts: a foreign/stale/planted entry never hydrates as this
+ *   run's execution authority.
+ * - Arrays longer than {@link MAX_LOADED_TASKS} are truncated (DoG guard).
+ *
+ * Clean input is returned UNCHANGED (same array reference, same entry objects)
+ * so legitimate legacy v0/v1 state loads byte-identical.
+ */
+/** @internal — exported for tests pinning the N3 loader contract. */
+export function sanitizeLoadedTasks(tasks: TeamTaskState[], runId: string): TeamTaskState[] {
+	const truncated = tasks.length > MAX_LOADED_TASKS;
+	const limit = truncated ? MAX_LOADED_TASKS : tasks.length;
+	const kept: TeamTaskState[] = [];
+	const shapeInvalid: string[] = [];
+	const foreignRunId: string[] = [];
+	for (let i = 0; i < limit; i++) {
+		const entry: unknown = tasks[i];
+		if (!plausibleTaskShape(entry)) {
+			const id = entry !== null && typeof entry === "object" && !Array.isArray(entry) ? (entry as { id?: unknown }).id : undefined;
+			shapeInvalid.push(typeof id === "string" ? id : `#${i}`);
+			continue;
+		}
+		// RunId binding (entry.runId is a string — the shape check above already
+		// failed entries without one, so legacy entries missing runId cannot
+		// masquerade as this run's tasks either).
+		if (entry.runId !== runId) {
+			foreignRunId.push(entry.id);
+			continue;
+		}
+		kept.push(entry);
+	}
+	if (truncated) {
+		logInternalError(
+			"state-store",
+			new Error(
+				`N3: tasks.json for run ${runId} holds ${tasks.length} entries — beyond the ${MAX_LOADED_TASKS} loader cap. Truncated to the first ${MAX_LOADED_TASKS} (dispatch admission caps are enforced separately).`,
+			),
+			undefined,
+			"error",
+		);
+	}
+	if (shapeInvalid.length > 0) {
+		logInternalError(
+			"state-store",
+			new Error(
+				`N3: ${shapeInvalid.length} task entr${shapeInvalid.length === 1 ? "y" : "ies"} in tasks.json for run ${runId} failed shape validation and ${shapeInvalid.length === 1 ? "was" : "were"} DROPPED (worker-writable state is untrusted input; example id(s): ${shapeInvalid.slice(0, MAX_ANOMALY_EXAMPLES).join(",")}).`,
+			),
+			undefined,
+			"error",
+		);
+	}
+	if (foreignRunId.length > 0) {
+		logInternalError(
+			"state-store",
+			new Error(
+				`N3: ${foreignRunId.length} task entr${foreignRunId.length === 1 ? "y" : "ies"} in tasks.json for run ${runId} carry a foreign runId and ${foreignRunId.length === 1 ? "was" : "were"} DROPPED (runId binding, mirrors DwfStore.load; example id(s): ${foreignRunId.slice(0, MAX_ANOMALY_EXAMPLES).join(",")}).`,
+			),
+			undefined,
+			"error",
+		);
+	}
+	return truncated || shapeInvalid.length > 0 || foreignRunId.length > 0 ? kept : tasks;
+}
+
+/** N3: the run kinds a persisted manifest may legally select. Unknown values
+ * normalize to "team-run" (see sanitizeLoadedManifest) — matching the
+ * `manifest.runKind ?? "team-run"` consumer at team-tool.ts:673, so a poisoned
+ * runKind can only ever select the DEFAULT resume engine. */
+const KNOWN_RUN_KINDS = new Set<string>(["team-run", "goal-loop", "dynamic-workflow"]);
+
+/**
+ * N3: validate a manifest loaded from disk before it re-enters dispatch.
+ *
+ * - A payload that is not a JSON object at all (null/number/string/array) is
+ *   NOT a manifest → undefined (fail-closed; previously the raw cast was
+ *   returned and downstream field access was undefined behavior).
+ * - runKind is checked against {@link KNOWN_RUN_KINDS}: unknown values are
+ *   normalized to "team-run" with a warn anomaly — deliberately NOT a throw,
+ *   so poison degrades to the default engine instead of hiding the run.
+ *   Absent runKind (legacy manifests) passes through unchanged: the consumer
+ *   already defaults it.
+ * - Identity fields (runId/stateRoot/tasksPath/eventsPath/artifactsRoot) are
+ *   intentionally NOT re-checked here — validateRunManifestPaths
+ *   (state-store.ts) already owns that contract.
+ *
+ * Clean input is returned UNCHANGED (same object reference); normalization
+ * returns a shallow copy so parsed/cached objects are never mutated in place.
+ */
+/** @internal — exported for tests pinning the N3 loader contract. */
+export function sanitizeLoadedManifest(manifest: TeamRunManifest | undefined, runId: string): TeamRunManifest | undefined {
+	if (manifest === undefined) return undefined;
+	const raw: unknown = manifest;
+	if (raw === null || typeof raw !== "object" || Array.isArray(raw)) {
+		logInternalError(
+			"state-store",
+			new Error(
+				`N3: manifest.json for run ${runId} parsed to a non-object — not a manifest, failing closed (run treated as corrupt/missing).`,
+			),
+			undefined,
+			"error",
+		);
+		return undefined;
+	}
+	const kind: unknown = (raw as { runKind?: unknown }).runKind;
+	if (kind === undefined) return manifest;
+	if (typeof kind === "string" && KNOWN_RUN_KINDS.has(kind)) return manifest;
+	logInternalError(
+		"state-store",
+		new Error(
+			`N3: manifest runKind ${JSON.stringify(kind)} for run ${runId} is not a known run kind (team-run|goal-loop|dynamic-workflow) — normalizing to 'team-run' so only the default resume engine can be selected.`,
+		),
+		undefined,
+		"warn",
+	);
+	return { ...manifest, runKind: "team-run" };
+}
+
 /**
  * ST-4: Load tasks.json with corruption recovery (sync path).
  *
@@ -253,6 +423,11 @@ function migrateTasksFile(parsed: unknown, runId: string): TeamTaskState[] {
 		const envelope = parsed as { schemaVersion?: unknown; tasks?: unknown };
 		const detected = typeof envelope.schemaVersion === "number" ? envelope.schemaVersion : 0;
 		if (detected !== CURRENT_TASKS_SCHEMA_VERSION) {
+			// N3 note: schemaVersion mismatch stays WARN-ONLY deliberately —
+			// forward compatibility is a design requirement (a newer-but-
+			// well-formed tasks.json must still load). Field-level poison is
+			// handled by sanitizeLoadedTasks (shape + runId binding + count cap)
+			// downstream, NOT by version rejection.
 			logInternalError(
 				"state-store",
 				new Error(
@@ -279,17 +454,20 @@ export function loadTasksWithRecovery(tasksPath: string, eventsPath: string, run
 		parsed = JSON.parse(content);
 	} catch {
 		// SyntaxError — corrupt file.
-		const reconstructed = recoverCorruptTasks(tasksPath, eventsPath, runId, content);
+		const reconstructed = sanitizeLoadedTasks(recoverCorruptTasks(tasksPath, eventsPath, runId, content), runId);
 		if (reconstructed.length > 0) atomicWriteJson(tasksPath, reconstructed, { compact: true });
 		return reconstructed;
 	}
 	if (!isRecognizableTasksPayload(parsed)) {
 		// Neither v0 bare array nor v1+ envelope (e.g. `{}`) — corrupt.
-		const reconstructed = recoverCorruptTasks(tasksPath, eventsPath, runId, content);
+		const reconstructed = sanitizeLoadedTasks(recoverCorruptTasks(tasksPath, eventsPath, runId, content), runId);
 		if (reconstructed.length > 0) atomicWriteJson(tasksPath, reconstructed, { compact: true });
 		return reconstructed;
 	}
-	return migrateTasksFile(parsed, runId);
+	// N3: fail-closed validation of the migrated array before it re-enters
+	// dispatch (shape-check + runId binding + count cap) — see
+	// sanitizeLoadedTasks above.
+	return sanitizeLoadedTasks(migrateTasksFile(parsed, runId), runId);
 }
 
 /**
@@ -309,8 +487,9 @@ export function loadManifestWithRecovery(manifestPath: string, runId: string): T
 		// ENOENT / ENOTDIR / other read error → legitimate missing run.
 		return undefined;
 	}
+	let parsed: unknown;
 	try {
-		return JSON.parse(content) as TeamRunManifest;
+		parsed = JSON.parse(content);
 	} catch {
 		// SyntaxError → corrupt manifest. Quarantine (preserve for diagnosis) + log,
 		// then treat as missing. Do NOT reconstruct (infeasible from events).
@@ -325,6 +504,25 @@ export function loadManifestWithRecovery(manifestPath: string, runId: string): T
 		);
 		return undefined;
 	}
+	// N3: a payload that parses but is not a JSON object (null/number/string/
+	// array) is not a manifest — fail closed the same way as unparseable
+	// (quarantine for diagnosis, run treated as missing).
+	if (parsed === null || typeof parsed !== "object" || Array.isArray(parsed)) {
+		quarantineCorruptFile(manifestPath);
+		logInternalError(
+			"state-store",
+			new Error(
+				`STATE-3/N3: manifest.json for run ${runId} is not a JSON object — quarantined to ${manifestPath}.corrupt-*. Run is now treated as missing. Preserve the .corrupt-* file for diagnosis.`,
+			),
+			undefined,
+			"error",
+		);
+		return undefined;
+	}
+	// N3: runKind allowlist — unknown values normalize to "team-run" with a
+	// warn anomaly (never a throw), matching the `?? "team-run"` consumer at
+	// team-tool.ts:673.
+	return sanitizeLoadedManifest(parsed as TeamRunManifest, runId);
 }
 
 /**
@@ -342,14 +540,15 @@ export async function loadTasksWithRecoveryAsync(tasksPath: string, eventsPath:
 	try {
 		parsed = JSON.parse(content);
 	} catch {
-		const reconstructed = recoverCorruptTasks(tasksPath, eventsPath, runId, content);
+		const reconstructed = sanitizeLoadedTasks(recoverCorruptTasks(tasksPath, eventsPath, runId, content), runId);
 		if (reconstructed.length > 0) await atomicWriteJsonAsync(tasksPath, reconstructed, { compact: true });
 		return reconstructed;
 	}
 	if (!isRecognizableTasksPayload(parsed)) {
-		const reconstructed = recoverCorruptTasks(tasksPath, eventsPath, runId, content);
+		const reconstructed = sanitizeLoadedTasks(recoverCorruptTasks(tasksPath, eventsPath, runId, content), runId);
 		if (reconstructed.length > 0) await atomicWriteJsonAsync(tasksPath, reconstructed, { compact: true });
 		return reconstructed;
 	}
-	return migrateTasksFile(parsed, runId);
+	// N3: same fail-closed validation as the sync twin.
+	return sanitizeLoadedTasks(migrateTasksFile(parsed, runId), runId);
 }

package/src/state/stores/state-store.ts

@@ -26,7 +26,13 @@ import { appendEvent } from "../event-log/event-log.ts";
 import type { RunModelContext, TeamRunManifest, TeamTaskState } from "../types.ts";
 import { CURRENT_SCHEMA_VERSION } from "../types.ts";
 import { unregisterActiveRun } from "./active-run-registry.ts";
-import { extractTaskArray, loadManifestWithRecovery, loadTasksWithRecovery, loadTasksWithRecoveryAsync } from "./manifest-io.ts";
+import {
+	extractTaskArray,
+	loadManifestWithRecovery,
+	loadTasksWithRecovery,
+	loadTasksWithRecoveryAsync,
+	sanitizeLoadedManifest,
+} from "./manifest-io.ts";
 import { closeSqliteRunStateStore, getSqliteRunStateStore, isSqliteStateBackend, sqliteDbPath } from "./sqlite-run-state.ts";
 
 export { loadManifestWithRecovery, loadTasksWithRecovery } from "./manifest-io.ts";
@@ -436,15 +442,20 @@ export function createTasksFromWorkflow(
 }
 
 /**
- * Admission cap for {@link createRunManifest}: the effective
+ * Admission cap for dispatchable task sets: the effective
  * `limits.maxTasksPerRun` from loaded config, falling back to the hard
  * ceiling LIMIT_CEILINGS.maxTasksPerRun — no parsed config value can exceed
  * the ceiling (config-validation clamps it), so a manifest beyond the ceiling
  * is invalid regardless of config. Config-load failure degrades to the
  * ceiling only (an admission check must never itself block run creation on a
  * config read problem; loadConfig surfaces its own warnings separately).
+ *
+ * Exported (resume-skips-maxtasks-admission fix) so non-creation paths that
+ * reconstruct a dispatchable task set from PERSISTED state — team resume,
+ * retry-then-resume, special-kind adoption — can re-run the SAME invariant
+ * createRunManifest enforces, before re-queueing or dispatching.
  */
-function resolveMaxTasksPerRunAdmissionCap(cwd: string): number {
+export function resolveMaxTasksPerRunAdmissionCap(cwd: string): number {
 	try {
 		const configured = loadConfig(cwd).config.limits?.maxTasksPerRun;
 		return typeof configured === "number" && Number.isFinite(configured) ? configured : LIMIT_CEILINGS.maxTasksPerRun;
@@ -1204,18 +1215,22 @@ export function loadRunManifestById(cwd: string, runId: string): { manifest: Tea
 	if (isSqliteStateBackend() && fs.existsSync(sqliteDbPath(stateRoot))) {
 		const loaded = getSqliteRunStateStore(stateRoot).loadManifestAndTasks();
 		if (loaded) {
-			if (loaded.manifest.schemaVersion !== CURRENT_SCHEMA_VERSION) {
+			// N3: same manifest sanitization as the JSON path below (uniform
+			// loader invariant — runKind leaving a loader is always allowlisted).
+			const sanitizedManifest = sanitizeLoadedManifest(loaded.manifest, runId);
+			if (!sanitizedManifest) return undefined;
+			if (sanitizedManifest.schemaVersion !== CURRENT_SCHEMA_VERSION) {
 				logInternalError(
 					"state-store",
 					new Error(
-						`Manifest schemaVersion mismatch: expected ${CURRENT_SCHEMA_VERSION}, got ${loaded.manifest.schemaVersion}. Run ${runId} may be incompatible.`,
+						`Manifest schemaVersion mismatch: expected ${CURRENT_SCHEMA_VERSION}, got ${sanitizedManifest.schemaVersion}. Run ${runId} may be incompatible.`,
 					),
 					undefined,
 					"warn",
 				);
 			}
-			if (!validateRunManifestPaths(cwd, runId, loaded.manifest, stateRoot, tasksPath)) return undefined;
-			return { manifest: loaded.manifest, tasks: loaded.tasks };
+			if (!validateRunManifestPaths(cwd, runId, sanitizedManifest, stateRoot, tasksPath)) return undefined;
+			return { manifest: sanitizedManifest, tasks: loaded.tasks };
 		}
 		// No manifest row yet: either a json-created legacy run (mirror exists,
 		// JSON path below serves it) or a pre-birth crash (nothing anywhere —
@@ -1344,8 +1359,13 @@ export function loadRunManifestById(cwd: string, runId: string): { manifest: Tea
 	// — the final stable state is what gets used. Because the retry loop
 	// handles the crash case, we do NOT fail based on this comparison alone.
 	// It does not indicate corruption on its own.
-	// S-01: warn (do not throw) on schemaVersion mismatch — future version
-	// bumps will add migration logic here.
+	// N3: sanitize the disk-loaded manifest (non-object payload → fail closed;
+	// runKind allowlist → unknown normalizes to "team-run" with a warn).
+	manifest = sanitizeLoadedManifest(manifest, runId);
+	// S-01 + N3 note: warn (do not throw) on schemaVersion mismatch — future
+	// version bumps will add migration logic here. WARN-ONLY is deliberate
+	// forward compat (a newer-but-well-formed manifest must still load;
+	// field-level poison is handled by the N3 sanitizers, not version rejection).
 	if (manifest && manifest.schemaVersion !== CURRENT_SCHEMA_VERSION) {
 		logInternalError(
 			"state-store",
@@ -1401,18 +1421,22 @@ export async function loadRunManifestByIdAsync(
 	if (isSqliteStateBackend() && fs.existsSync(sqliteDbPath(stateRoot))) {
 		const loaded = getSqliteRunStateStore(stateRoot).loadManifestAndTasks();
 		if (loaded) {
-			if (loaded.manifest.schemaVersion !== CURRENT_SCHEMA_VERSION) {
+			// N3: same manifest sanitization as the JSON path below (uniform
+			// loader invariant — runKind leaving a loader is always allowlisted).
+			const sanitizedManifest = sanitizeLoadedManifest(loaded.manifest, runId);
+			if (!sanitizedManifest) return undefined;
+			if (sanitizedManifest.schemaVersion !== CURRENT_SCHEMA_VERSION) {
 				logInternalError(
 					"state-store",
 					new Error(
-						`Manifest schemaVersion mismatch: expected ${CURRENT_SCHEMA_VERSION}, got ${loaded.manifest.schemaVersion}. Run ${runId} may be incompatible.`,
+						`Manifest schemaVersion mismatch: expected ${CURRENT_SCHEMA_VERSION}, got ${sanitizedManifest.schemaVersion}. Run ${runId} may be incompatible.`,
 					),
 					undefined,
 					"warn",
 				);
 			}
-			if (!validateRunManifestPaths(cwd, runId, loaded.manifest, stateRoot, tasksPath)) return undefined;
-			return { manifest: loaded.manifest, tasks: loaded.tasks };
+			if (!validateRunManifestPaths(cwd, runId, sanitizedManifest, stateRoot, tasksPath)) return undefined;
+			return { manifest: sanitizedManifest, tasks: loaded.tasks };
 		}
 		// No manifest row yet — fall through to the JSON path (legacy run or
 		// pre-birth crash; see the sync twin above).
@@ -1533,8 +1557,13 @@ export async function loadRunManifestByIdAsync(
 	// handles the crash case, we do NOT fail based on this comparison alone.
 	// It does not indicate corruption on its own.
 
-	// S-01: warn (do not throw) on schemaVersion mismatch — future version
-	// bumps will add migration logic here.
+	// N3: sanitize the disk-loaded manifest (non-object payload → fail closed;
+	// runKind allowlist → unknown normalizes to "team-run" with a warn).
+	manifest = sanitizeLoadedManifest(manifest, runId);
+	// S-01 + N3 note: warn (do not throw) on schemaVersion mismatch — future
+	// version bumps will add migration logic here. WARN-ONLY is deliberate
+	// forward compat (a newer-but-well-formed manifest must still load;
+	// field-level poison is handled by the N3 sanitizers, not version rejection).
 	if (manifest && manifest.schemaVersion !== CURRENT_SCHEMA_VERSION) {
 		logInternalError(
 			"state-store",

package/src/state/types.ts

@@ -426,6 +426,15 @@ export interface TeamRunManifest {
 	};
 	/** Background dispatch discriminator. Default "team-run" runs executeTeamRun; "goal-loop" / "dynamic-workflow" dispatch to their respective runners. Absent = "team-run" for backward compatibility. */
 	runKind?: "team-run" | "goal-loop" | "dynamic-workflow";
+	/** w3-dwf-trust (2026-10-29): dispatch-time code pin for runKind="dynamic-workflow"
+	 *  runs. The dispatcher stamps the RESOLVED .dwf.ts script path plus the sha256 of
+	 *  its bytes AT DISPATCH; runDynamicWorkflow re-hashes the file before every load
+	 *  (fresh dispatch and both resume arms funnel through it) and refuses to execute
+	 *  on path/hash mismatch — closing the plant-between-dispatch-and-resume swap for a
+	 *  script in a worker-writable discovery dir. Purely additive/optional: absent on
+	 *  every manifest written before this field existed (and on dispatchers that do not
+	 *  stamp it yet) → no pin verification. */
+	dynamicScriptPin?: { scriptPath: string; sha256: string };
 	/** round-14 P1-5: typed workflow arguments accessible in .dwf.ts scripts via ctx.args<T>(). Any JSON value; default {} when unset. */
 	args?: unknown;
 	/** Per-run token budget snapshot. budgetTotal is the cap; budgetWarning/budgetAbort are fractions in [0,1] at which the team-runner emits run.budget_warning / run.budget_abort. budgetUnlimited=true opts out of enforcement. Optional for backward compat. */

package/src/ui/inline-panel/agent-transcript.ts

@@ -27,6 +27,7 @@ import * as path from "node:path";
 
 import { readCrewAgentEventsCursor } from "../../runtime/crew-agent-records.ts";
 import type { TeamRunManifest } from "../../state/types.ts";
+import { stripTerminalSequences } from "../../utils/safe-terminal-text.ts";
 
 const MAX_TRANSCRIPT_ITEMS = 500;
 
@@ -127,21 +128,148 @@ function asRecord(value: unknown): Record<string, unknown> | undefined {
  * (role:"toolResult" message_end).
  */
 function normalizeResultContent(raw: unknown): Array<{ type: string; text?: string }> {
-	if (typeof raw === "string") return [{ type: "text", text: raw }];
+	// w7a-render: every string on this path is worker-written and handed to pi
+	// host components (ToolExecutionComponent) — strip terminal escape
+	// sequences (OSC 52/OSC 8/CSI/APC + residual introducers) at the boundary.
+	if (typeof raw === "string") return [{ type: "text", text: stripTerminalSequences(raw) }];
 	if (!Array.isArray(raw)) return [];
 	return raw.flatMap((part) => {
-		if (typeof part === "string") return [{ type: "text", text: part }];
+		if (typeof part === "string") return [{ type: "text", text: stripTerminalSequences(part) }];
 		const record = asRecord(part);
 		if (!record) return [];
 		return [
 			{
 				type: typeof record.type === "string" ? record.type : "text",
-				text: typeof record.text === "string" ? record.text : undefined,
+				text: typeof record.text === "string" ? stripTerminalSequences(record.text) : undefined,
 			},
 		];
 	});
 }
 
+/**
+ * w7a-render: sanitize the printable string fields of a retained assistant
+ * message (text + thinking content parts) before the full message object is
+ * handed to pi's AssistantMessageComponent, which renders them verbatim.
+ * Returns the SAME object when nothing needed stripping (component-cache
+ * fingerprint stays stable). Identity fields (usage/role/stopReason) and
+ * non-string payloads pass through untouched.
+ */
+function sanitizeMessageForRender(message: Record<string, unknown>): Record<string, unknown> {
+	const content = message.content;
+	if (!Array.isArray(content)) return message;
+	let touched = false;
+	const parts = content.map((part) => {
+		const record = asRecord(part);
+		if (!record) return part;
+		if (record.type === "text" && typeof record.text === "string") {
+			const clean = stripTerminalSequences(record.text);
+			if (clean !== record.text) {
+				touched = true;
+				return { ...record, text: clean };
+			}
+			return part;
+		}
+		if (record.type === "thinking") {
+			let partTouched = false;
+			const clean: Record<string, unknown> = { ...record };
+			if (typeof record.thinking === "string") {
+				clean.thinking = stripTerminalSequences(record.thinking);
+				partTouched = clean.thinking !== record.thinking;
+			}
+			if (typeof record.text === "string") {
+				clean.text = stripTerminalSequences(record.text);
+				partTouched ||= clean.text !== record.text;
+			}
+			if (partTouched) {
+				touched = true;
+				return clean;
+			}
+			return part;
+		}
+		return part;
+	});
+	return touched ? { ...message, content: parts } : message;
+}
+
+/**
+ * W9-R1 (w7a-render deferred residual): `tool_execution_start` event.args are
+ * worker-controlled and reach pi's ToolExecutionComponent verbatim — it
+ * interpolates top-level keys and string values RAW (formatToolCallWithArgs)
+ * and hands the whole record to per-tool call renderers. Strip terminal
+ * sequences from every string leaf (and every object key), recursing into
+ * nested objects/arrays down to ARGS_SANITIZE_MAX_DEPTH. Non-string leaves
+ * (numbers/booleans/null) are inert — they only ever render through
+ * JSON.stringify, whose output escapes control characters — and values below
+ * the depth cap likewise only surface JSON-escaped, so both are passed
+ * through untouched (nothing is sanitized that is not rendered raw).
+ * Returns the SAME object when nothing needed stripping (component-cache
+ * fingerprint stays stable, matching sanitizeMessageForRender).
+ */
+const ARGS_SANITIZE_MAX_DEPTH = 6;
+
+function sanitizeArgsForRender(
+	args: Record<string, unknown>,
+	depth = ARGS_SANITIZE_MAX_DEPTH,
+): { value: Record<string, unknown>; touched: boolean } {
+	// Null prototype: event args are unvalidated worker JSON — a "__proto__"
+	// key must never reach a prototype setter on the rebuilt record (same
+	// reasoning as config-validation's asRecord copy).
+	const clean: Record<string, unknown> = Object.create(null);
+	let touched = false;
+	for (const [rawKey, rawValue] of Object.entries(args)) {
+		const key = stripTerminalSequences(rawKey);
+		if (key !== rawKey) touched = true;
+		if (typeof rawValue === "string") {
+			const value = stripTerminalSequences(rawValue);
+			if (value !== rawValue) touched = true;
+			clean[key] = value;
+			continue;
+		}
+		const record = asRecord(rawValue);
+		if (depth > 0 && record) {
+			const nested = sanitizeArgsForRender(record, depth - 1);
+			if (nested.touched) touched = true;
+			clean[key] = nested.value;
+			continue;
+		}
+		if (depth > 0 && Array.isArray(rawValue)) {
+			const nested = sanitizeArgsArrayForRender(rawValue, depth - 1);
+			if (nested.touched) touched = true;
+			clean[key] = nested.value;
+			continue;
+		}
+		clean[key] = rawValue;
+	}
+	return touched ? { value: clean, touched: true } : { value: args, touched: false };
+}
+
+function sanitizeArgsArrayForRender(items: unknown[], depth: number): { value: unknown[]; touched: boolean } {
+	let touched = false;
+	const clean = items.map((entry) => {
+		if (typeof entry === "string") {
+			const value = stripTerminalSequences(entry);
+			if (value !== entry) {
+				touched = true;
+				return value;
+			}
+			return entry;
+		}
+		const record = asRecord(entry);
+		if (depth > 0 && record) {
+			const nested = sanitizeArgsForRender(record, depth - 1);
+			if (nested.touched) touched = true;
+			return nested.value;
+		}
+		if (depth > 0 && Array.isArray(entry)) {
+			const nested = sanitizeArgsArrayForRender(entry, depth - 1);
+			if (nested.touched) touched = true;
+			return nested.value;
+		}
+		return entry;
+	});
+	return touched ? { value: clean, touched: true } : { value: items, touched: false };
+}
+
 function textFromContent(content: unknown): string {
 	if (!Array.isArray(content)) return "";
 	return content
@@ -178,8 +306,12 @@ function parseEventRecord(record: Record<string, unknown>, pending: Map<string,
 	const items: CrewTranscriptItem[] = [];
 
 	if (type === "tool_execution_start") {
-		const name = typeof event.toolName === "string" ? event.toolName : "tool";
-		const args = (event.args as Record<string, unknown>) ?? {};
+		// w7a-render: toolName is interpolated into ToolExecutionComponent's title
+		const name = stripTerminalSequences(typeof event.toolName === "string" ? event.toolName : "tool");
+		// w9-r1 (w7a deferred): args reach ToolExecutionComponent verbatim —
+		// keys and string values are interpolated raw, nested structures go to
+		// call renderers. Strip terminal sequences at the parser boundary.
+		const args = sanitizeArgsForRender((event.args as Record<string, unknown>) ?? {}).value;
 		const id = `${name}#${seq}`;
 		const item: PendingTool = { type: "tool", name, toolCallId: id, args, seq };
 		pending.set(id, item);
@@ -223,7 +355,7 @@ function parseEventRecord(record: Record<string, unknown>, pending: Map<string,
 
 		if (message.role === "assistant") {
 			const content = Array.isArray(message.content) ? message.content : [];
-			const text = textFromContent(content);
+			const text = stripTerminalSequences(textFromContent(content));
 			if (text) {
 				// Compaction can carry usage at the RECORD level (usage-only
 				// tail) instead of inside the message — merge it in so the
@@ -234,7 +366,13 @@ function parseEventRecord(record: Record<string, unknown>, pending: Map<string,
 				if (recordUsage) {
 					merged = { ...message, usage: messageUsage ? { ...messageUsage, ...recordUsage } : recordUsage };
 				}
-				items.push({ type: "assistant", text, seq, message: merged, usage: normalizeUsage(merged.usage) });
+				items.push({
+					type: "assistant",
+					text,
+					seq,
+					message: sanitizeMessageForRender(merged),
+					usage: normalizeUsage(merged.usage),
+				});
 			}
 			// toolResult parts carry name + content; fold them into pending starts
 			// (normalized to the same updateResult envelope as the pi ≥0.84
@@ -242,7 +380,9 @@ function parseEventRecord(record: Record<string, unknown>, pending: Map<string,
 			for (const part of content) {
 				const item = asRecord(part);
 				if (item?.type !== "toolResult") continue;
-				const name = typeof item.name === "string" ? item.name : "tool";
+				// Sanitize the fold key EXACTLY like tool_execution_start names so a
+				// payload-carrying toolName still pairs with its result.
+				const name = stripTerminalSequences(typeof item.name === "string" ? item.name : "tool");
 				const isError = item.isError === true;
 				matchPending(
 					pending,
@@ -258,7 +398,7 @@ function parseEventRecord(record: Record<string, unknown>, pending: Map<string,
 		}
 
 		if (message.role === "user") {
-			const text = textFromContent(message.content);
+			const text = stripTerminalSequences(textFromContent(message.content));
 			if (text) items.push({ type: "user", text, seq });
 			return items;
 		}
@@ -266,7 +406,7 @@ function parseEventRecord(record: Record<string, unknown>, pending: Map<string,
 
 	// System / other events become a dim system line.
 	if (type && type !== "message_update") {
-		const text = typeof event.text === "string" ? event.text : "";
+		const text = stripTerminalSequences(typeof event.text === "string" ? event.text : "");
 		if (text) items.push({ type: "system", text, seq });
 	}
 
@@ -314,7 +454,7 @@ export function readAgentTranscript(manifest: TeamRunManifest, taskId: string):
 		const prompt = readWorkerPrompt(manifest, taskId);
 		if (prompt !== undefined) {
 			promptSeeded.add(key);
-			buffer.unshift({ type: "user", text: prompt, seq: 0 });
+			buffer.unshift({ type: "user", text: stripTerminalSequences(prompt), seq: 0 });
 		}
 	}
 	if (buffer.length > MAX_TRANSCRIPT_ITEMS) {

package/src/ui/settings-overlay.ts

@@ -6,7 +6,7 @@
 
 import * as piTui from "@earendil-works/pi-tui";
 import { PiTeamsRuntimeConfigSchema, PiTeamsUiConfigSchema } from "../schema/config-schema.ts";
-import { truncateToWidth, visibleWidth } from "../utils/visual.ts";
+import { sanitizeUntrustedLine, truncateToWidth, visibleWidth } from "../utils/visual.ts";
 import { keyOf, matchesKey } from "./key-utils.ts";
 import { CURSOR, canopyLine, formatHint, overflowHint, RAIL, railLine } from "./rail.ts";
 
@@ -308,9 +308,14 @@ const SETTINGS: SettingDef[] = [
 		label: "Pi UI Theme",
 		type: "action",
 		action: "piTheme",
-		values: discoverPiThemes().map((t) => t.name),
+		// w7a-render: theme names (and the active-theme value read from
+		// ~/.pi/agent/settings.json) derive from worker-writable files — sanitize
+		// before they reach SelectSubmenu.render, which interpolates items verbatim.
+		values: discoverPiThemes().map((t) => sanitizeUntrustedLine(t.name)),
 		tab: "themes",
-		description: "Overall terminal theme. Switches live (no restart). Currently: " + (getActivePiTheme() ?? "dark (default)"),
+		description:
+			"Overall terminal theme. Switches live (no restart). Currently: " +
+			sanitizeUntrustedLine(getActivePiTheme() ?? "dark (default)"),
 	},
 	// Autonomous
 	{