pi-crew 0.11.49 → 0.11.51

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "pi-crew",
-	"version": "0.11.49",
+	"version": "0.11.51",
 	"description": "Pi extension for coordinated AI teams, workflows, worktrees, and async task orchestration",
 	"author": "baphuongna",
 	"license": "MIT",

package/skills/real-test-pi-crew/SKILL.md

@@ -202,6 +202,8 @@ End-to-end verification discipline for pi-crew changes. Distilled from the broke
 
 > **2026-10-28-b update (ROOT-CAUSE CLOSED + fd3 transport + review-wave fixes, commits `38d5ed58`..`5190e66b`, cold-verified review + 3-agent verification)**: (1) **ROOT-CAUSE incident 0.11.46/47 (đóng)** — pi's `readPipedStdin` (pi@1.0.4 `dist/main.js:52-65`) đọc TOÀN BỘ piped stdin làm PROMPT CONTENT trong mọi mode trừ `--mode=rpc` ⇒ handshake fd0 race 3 cách: token JSON thành literal prompt text (SECRET LEAK — chứng minh trên transcript thật), stream-ended creds-less câm lặng, reader `pause()` trước EOF drain → pi boot await deadlock → **TỰ exit 0** (KHÔNG phải parent SIGTERM — strace cũ misread) + takeOverStdout buffer ⇒ ~0 bytes. **Fix: handshake dời sang fd3** (stdio entry 4 `['ignore','pipe','pipe','pipe']`, `readFirstLineFromFd(BROKER_HANDSHAKE_FD=3)`; fd0 về `"ignore"` — shape pre-0.11.46); detached runner GIỮ fd0 (node process, không race). Gate `PI_CREW_BROKER_STDIN` vẫn OPT-IN. Evidence: pre-fix pi@1.0.4 gate-ON 5/5 chết (~1s, 0B) → post-fix 2/2 sống (106-110KB, ~3.2s, 0 leak); integration live-worker giờ assert CẢ gate-ON liveness (bỏ comment "DO NOT assert liveness") + leak-check `v":2` không xuất hiện trong output. **Contract nền: fd0 KHÔNG BAO GIỜ là kênh sideband của extension khi spawn pi binary — dùng stdio entry 4+ (fd3).** (2) **T7 judge mechanics ĐỔI** — dispatch goal giờ mang nonce `[t7-nonce:<uuid>]`, judge CHỈ dirs có nonce trong events.jsonl (hết race newest-mtime với run đồng thời); non-terminal run = FAIL (check TRƯỚC killed-branch); stdout/stderr của dispatch được capture (cap 64KB) vào failure reason + audit. (3) **T7 triggers mở rộng** — thêm `src/(state|utils|agents|teams|workflows|hooks|observability)/` + `scripts/` (gate changes live-test the gate). (4) diff-base tag filter `^v\d+\.\d+\.\d+$` + porcelain rename both-sides; `PI_CREW_BATTERY_SKIP` giờ sống qua prepublishOnly path. (5) maxTasksPerRun admission cap tại createRunManifest (pre-dispatch); seam fix gate đọc `options.env ?? process.env` (test inject được — hết mutate process.env); `buildBrokerStdinLine` warn >60KiB (reader abort ~131KiB thực tế Linux — pipe chunks). (6) **CI 'Checks' step có gates NGOÀI battery list** (`check:env-vars`, `check:decision-drift`) — thêm vào leader local gate list sau mọi src edit.
 
+> **2026-10-28-c update (LOW-1 DEFAULT-ON flip — commit riêng ngay sau `deb09c5e`/v0.11.49)**: `PI_CREW_BROKER_STDIN` gate lật **DEFAULT-ON** — cả 2 gate (`resolveBrokerStdinHandshakeEnabled` child-pi-spawn.ts + `resolveBrokerStdinFallbackEnabled` crew-broker-child.ts) đổi `=== "1"` → `!== "0"` (chỉ đúng `0` opt-out; unset/`1`/bất kỳ giá trị khác = ON — kể cả garbage như `true`). Fix-1 spawner vẫn ghi `"1"` vào built.env khi gate ON (pin route + tương thích worker pre-flip); parent opt-out ⇒ token ở env child (worker reader tự disarm). T7 live-worker test có thêm pin DEFAULT (gate unset + fd3 payload → alive + no-leak). **Meta-rule của update 2026-10-28 (1) vẫn nguyên: flip này là ĐÚNG lớp incident 0.11.46/47 — battery T7 REAL-TEST BẮT BUỘC trước publish, không chỉ CI.** Skew case mới: gate unset + KHÔNG fd3 pipe (old-parent shape) → `readFirstLineFromFd(3)` missing-fd contract = undefined (bounded, không treo) — pin bởi test đầu của `broker-stdin-reader-liveworker.test.ts`.
+
 ## Core principle: disk ≠ live Pi
 
 Two locations hold pi-crew state:

package/src/agents/agent-config.ts

@@ -1,6 +1,7 @@
 import { getCrewEnv } from "../config/env-vars.ts";
 import type { RoleToolConfig } from "../config/role-tools.ts";
 import { getToolConfig, isScratchpadEnabledForRole } from "../config/role-tools.ts";
+import { permissionForRole } from "../runtime/role-permission.ts";
 
 /**
  * F1 (v0.7.9): canonical built-in tool name list. Used by `parseToolsField`
@@ -146,6 +147,13 @@ export function getAgentSessionOptions(role: string): {
  *
  * Returns `{ tools, excludeTools }` where each is `undefined` when no
  * restriction of that kind applies (so callers no-op cleanly).
+ *
+ * S-7 (w4b): INDEPENDENT of both rules above, a role classified read_only by
+ * `permissionForRole` (including the default-deny for unknown names) never
+ * resolves bash/edit/write — they are stripped from the allowlist and merged
+ * into the excludeTools denylist regardless of source or frontmatter. The
+ * resolved policy is therefore safe to emit verbatim on BOTH spawn paths
+ * (child-pi `pi-args.ts` and live-session `filterActiveTools`).
  */
 export interface ResolvedToolPolicy {
 	/** Allowlist; undefined = no allowlist restriction (all built-ins allowed). */
@@ -160,9 +168,15 @@ function uniqueToolMerge(...lists: Array<string[] | undefined>): string[] | unde
 }
 
 export function resolveToolPolicy(agent: AgentConfig, role?: string): ResolvedToolPolicy {
+	// Normalize raw frontmatter shapes BEFORE any array operation: inline /
+	// runtime-constructed agents may carry the raw CSV string (the type says
+	// string[], but callers historically pass the raw form — pi-args.ts docs).
+	// Without this, the array filters below crash on a string, and consumers
+	// building a Set from the "list" would spread a string into single chars.
+	const declaredTools = normalizeToolList(agent.tools);
 	const roleConfig = role ? getToolConfig(role) : {};
 	// allowlist: source-aware precedence (see doc above).
-	const explicitTools = agent.source === "builtin" ? (roleConfig.tools ?? agent.tools) : (agent.tools ?? roleConfig.tools);
+	const explicitTools = agent.source === "builtin" ? (roleConfig.tools ?? declaredTools) : (declaredTools ?? roleConfig.tools);
 	let tools =
 		agent.loadMode === "lean" && agent.defaultTools?.length ? uniqueToolMerge(explicitTools, agent.defaultTools) : explicitTools;
 	// denylist: additive merge of role excludeTools + agent disallowedTools.
@@ -179,9 +193,52 @@ export function resolveToolPolicy(agent: AgentConfig, role?: string): ResolvedTo
 		tools = tools ? tools.filter((t) => t !== "bash") : tools;
 		excludeTools = uniqueToolMerge(excludeTools, ["bash"]);
 	}
+	// S-7 (w4b security fix — mirrors S-6 onto the tools path): a role
+	// classified read_only by permissionForRole must never receive
+	// execution-capable tools from ANY frontmatter declaration, wildcard
+	// expansion, or default fallback, regardless of agent.source — user intent
+	// does not outrank the tier. Project/project-pi frontmatter previously
+	// REPLACED the role allowlist wholesale (and custom role names had no
+	// role allowlist at all — getToolConfig {}), so a repo-authored
+	// `tools: bash` armed host-level command execution on a worker whose
+	// permission tier is read_only (default-deny). The denylist side is
+	// additive: it can never be weakened by frontmatter omission.
+	// F10: normalize underscore→hyphen before the tier lookup (same convention
+	// as isScratchpadEnabledForRole) — a raw `test_engineer` role must classify
+	// as its hyphenated WRITE counterpart, not default-deny to read_only.
+	if (role && permissionForRole(normalizeRoleKey(role)) === "read_only") {
+		tools = tools ? tools.filter((t) => !EXECUTION_TOOLS.has(t)) : tools;
+		excludeTools = uniqueToolMerge(excludeTools, [...EXECUTION_TOOLS]);
+	}
 	return { tools, excludeTools };
 }
 
+/**
+ * S-7: execution-capable builtin tools. A read_only-tier role never holds
+ * these, no matter what any frontmatter or role-config allowlist declares.
+ * (`scratchpad`/`sh` execution is already gated by S-6 in
+ * isScratchpadEnabledForRole — the two guards together close both execution
+ * paths for read-only roles.)
+ */
+const EXECUTION_TOOLS: ReadonlySet<string> = new Set(["bash", "edit", "write"]);
+
+/** F10: hyphen/underscore role-key normalization (mirrors getToolConfig). */
+function normalizeRoleKey(role: string): string {
+	return role.includes("_") ? role.replaceAll("_", "-") : role;
+}
+
+/**
+ * Normalize a declared tool list into a clean string[]. Accepts the raw CSV
+ * string form (parseToolsField semantics: `*`/`all` expand to the builtin
+ * list, `none` → []) and plain arrays (trim + drop empties, NO wildcard
+ * re-expansion — an already-parsed array passes through verbatim).
+ */
+function normalizeToolList(raw: unknown): string[] | undefined {
+	if (raw === undefined || raw === null) return undefined;
+	if (Array.isArray(raw)) return raw.map((t) => String(t).trim()).filter(Boolean);
+	return parseToolsField(raw);
+}
+
 /**
  * P2: should `bash` be demoted (removed) for a scratchpad-armed role?
  *

package/src/config/config-validation.ts

@@ -828,6 +828,24 @@ function parseOtlpConfig(value: unknown): CrewOtlpConfig | undefined {
 		headers: Object.keys(headers).length > 0 ? headers : undefined,
 		intervalMs: parseWithSchema(Type.Integer({ minimum: 5000 }), obj.intervalMs),
 	};
+	// W9-R1 (w7b deferred): refuse credential-bearing endpoints at CONFIG
+	// VALIDATION time, mirroring the runtime refusal in otlp-exporter.ts
+	// validateEndpoint. The error text renders the ORIGIN only — the
+	// credential-bearing URL is never echoed (unparseable URLs refuse without
+	// echoing any part of the endpoint).
+	if (otlp.endpoint !== undefined && /^https?:\/\/[^/?#]*@/.test(otlp.endpoint)) {
+		let origin = "";
+		try {
+			origin = new URL(otlp.endpoint).origin;
+		} catch {
+			origin = "";
+		}
+		throw new Error(
+			origin
+				? `OTLP endpoint must not embed credentials (userinfo) — pass them via headers instead: ${origin}`
+				: "OTLP endpoint must not embed credentials (userinfo) — pass them via headers instead",
+		);
+	}
 	return Object.values(otlp).some((entry) => entry !== undefined) ? otlp : undefined;
 }
 

package/src/config/env-allowlist-registry.ts

@@ -191,6 +191,10 @@ const CREW_ENV_FORWARDING_DECL: Record<string, CrewEnvForwardDecision> = {
 	PI_CREW_DELEGATE_ENABLED: { kind: "child-write", reason: "child-pi-spawn dormant delegate gate" },
 	PI_CREW_STATE_ROOT: { kind: "child-write", reason: "child-pi-spawn mailbox root" },
 	PI_CREW_BROKER_RUN_ID: { kind: "child-write", reason: "child-pi-spawn broker handshake" },
+	PI_CREW_MAILBOX_VERIFY_KEY: {
+		kind: "child-write",
+		reason: "SEC-2026-11 w1a: PUBLIC base64 SPKI Ed25519 verify key handed to children via built.env (child-pi-spawn) for coordination-row verify-only; public material — possession cannot forge rows (private key is heap-only in the root session)",
+	},
 	PI_CREW_AGENT_EVENTS_PATH: { kind: "child-write", reason: "prepareSurfaceSpawn recorder log" },
 	PI_CREW_BROKER_SOCKET: { kind: "child-write", reason: "child-pi-spawn broker handshake (never ambient — per-run socket)" },
 	PI_CREW_BROKER_TOKEN: {
@@ -200,7 +204,7 @@ const CREW_ENV_FORWARDING_DECL: Record<string, CrewEnvForwardDecision> = {
 	PI_CREW_BROKER_TASK_ID: { kind: "child-write", reason: "child-pi-spawn broker handshake" },
 	PI_CREW_BROKER_STDIN: {
 		kind: "child-write",
-		reason: "LOW-1 broker-credential transport gate — read by the HOST spawner (child-pi-spawn .resolveBrokerStdinHandshakeEnabled) to pick env vs stdin route, then RE-WRITTEN by that spawner into every brokered child's built.env ('1') so the worker-side mirror gate (crew-broker-child .resolveBrokerStdinFallbackEnabled, which reads its OWN process.env) actually sees it — ambient forwarding never reaches the child, so child-write is the only channel that wires the route through (FIX-1 2026-10-28). Never ambient-allowlisted: route selection is per-spawn",
+		reason: "LOW-1 broker-credential transport gate (DEFAULT-ON since 2026-10-28 — only exact '0' opts out) — read by the HOST spawner (child-pi-spawn .resolveBrokerStdinHandshakeEnabled) to pick env vs stdin route, then RE-WRITTEN by that spawner into every gate-ON brokered child's built.env ('1') so the worker-side mirror gate (crew-broker-child .resolveBrokerStdinFallbackEnabled, which reads its OWN process.env) is armed deterministically and pre-flip workers (mirror === '1') stay compatible — ambient forwarding never reaches the child, so child-write is the only channel that wires the route through (FIX-1 2026-10-28). Never ambient-allowlisted: route selection is per-spawn",
 	},
 	PI_CREW_INFERENCE_BROKER: {
 		kind: "gap",

package/src/config/env-vars.ts

@@ -636,6 +636,10 @@ export const CREW_ENV_VARS: Record<string, CrewEnvVarSpec> = {
 		parser: "number",
 		doc: "swap-detection mtime pin for restore snapshots (scratchpad-lifecycle.ts:302)",
 	},
+	PI_CREW_MAILBOX_VERIFY_KEY: {
+		name: "PI_CREW_MAILBOX_VERIFY_KEY",
+		doc: "SEC-2026-11 w1a coordination sender-binding: base64 SPKI Ed25519 public verify key handed to child workers at spawn (child-pi-spawn.ts) so they can VERIFY parent-signed mailbox/steering rows; the PRIVATE signing key never leaves the root session heap (mailbox.ts signingKeypair). Children verify-only — possession of the public key cannot forge rows",
+	},
 	PI_CREW_MAX_AUTO_FALLBACKS: {
 		name: "PI_CREW_MAX_AUTO_FALLBACKS",
 		parser: "int",
@@ -668,7 +672,7 @@ export const CREW_ENV_VARS: Record<string, CrewEnvVarSpec> = {
 	},
 	PI_CREW_BROKER_STDIN: {
 		name: "PI_CREW_BROKER_STDIN",
-		doc: "LOW-1 closure (2026-10-27) broker-credential transport gate, OPT-IN since v0.11.48 (2026-10-28): '1' sends the per-task compound PI_CREW_BROKER_TOKEN to the headless JSON worker over a DEDICATED fd3 spawn pipe (one buildBrokerStdinLine v2 payload on stdio entry 4; heap → fd3 → heap — child-pi-spawn.ts writer, crew-broker-child.ts startChildBrokerClientAsync reader; fd0 stays 'ignore') so the token never appears in the child env; unset/any-other-value (default) keeps the LEGACY ENV ROUTE (token in built.env) on BOTH sides — the original fd0 variant was caught by the live battery (real-test-pi-crew T7) killing real headless workers with a silent exit 0 (root cause: pi@1.0.4 readPipedStdin consumes all piped fd0 as prompt content); the fd3 transport removes that race. RPC-mode workers and surface TUI panes are unaffected (they keep the env route; the worker-side fd3 read skips --mode rpc argv by design)",
+		doc: "LOW-1 closure (2026-10-27) broker-credential transport gate, DEFAULT-ON since 2026-10-28 (was OPT-IN v0.11.48–0.11.49): unset (default)/'1'/any value other than exactly '0' sends the per-task compound PI_CREW_BROKER_TOKEN to the headless JSON worker over a DEDICATED fd3 spawn pipe (one buildBrokerStdinLine v2 payload on stdio entry 4; heap → fd3 → heap — child-pi-spawn.ts writer, crew-broker-child.ts startChildBrokerClientAsync reader; fd0 stays 'ignore') so the token never appears in the child env; exactly '0' opts OUT (rollback to the LEGACY ENV ROUTE — token in built.env — on BOTH sides) — the original fd0 variant was caught by the live battery (real-test-pi-crew T7) killing real headless workers with a silent exit 0 (root cause: pi@1.0.4 readPipedStdin consumes all piped fd0 as prompt content); the fd3 transport removes that race. RPC-mode workers and surface TUI panes are unaffected (they keep the env route; the worker-side fd3 read skips --mode rpc argv by design)",
 	},
 	PI_CREW_GUEST: {
 		name: "PI_CREW_GUEST",

package/src/config/sanitize-project-config.ts

@@ -1,4 +1,5 @@
 import { collectSensitiveConfigPaths } from "../schema/sensitive-config-paths.ts";
+import { getCrewEnv } from "./env-vars.ts";
 import type { ConfigValidationResult, PiTeamsConfig } from "./types.ts";
 
 /**
@@ -43,6 +44,14 @@ export function projectOverrideWarning(projectPath: string, dottedPath: string):
  * `limits.maxConcurrentWorkers` deliberately has NO entry: the schema already
  * bounds it (Type.Integer minimum 1, reader-side sanity ceilings) and a project
  * can only lower it — i.e. tighten — so no drop is needed (ADR Wave 1A).
+ *
+ * `runtime.embeddedWorkers` deliberately has NO entry either (w4b): the whole
+ * block is sensitive-marked in the schema (user-only), so the unconditional
+ * walk above already drops it from the project tier — there is no residual
+ * project-tier surface to guard-tier. Do not re-add conditional entries for
+ * it; if the block ever loses its sensitive mark, routing to the in-process
+ * embedded tier becomes project-settable again, which is the bug class this
+ * table exists to prevent.
  */
 export const CONDITIONAL_PROJECT_DROPS: Record<string, (value: unknown) => boolean> = {
 	// Legacy exception (ADR Decision 3, folded in here): only `=== false`
@@ -170,3 +179,49 @@ export function sanitizeProjectConfig(projectPath: string, userConfig: PiTeamsCo
 
 /** @internal — direct-test seam for Phase 2.2 extraction target (refactor-plan step 1.9c). */
 export const __test__sanitizeProjectConfig = sanitizeProjectConfig;
+
+// ─── w4b defense-in-depth: the embedded tier must not void the sandbox opt-in ───
+// A project/user config can route a role onto the U11 EMBEDDED tier
+// (runtime.embeddedWorkers), where the worker's Pi session runs IN-PROCESS in
+// the host pi process. Both deterministic host protections live ONLY on the
+// child spawn path: the PI_CREW_SANDBOX=bwrap OS boundary (child-pi.ts
+// resolveSandboxConfig → sandbox.ts) and the env allowlist secret scrub
+// (child-pi-spawn.ts sanitizeEnvSecrets). An embedded-routed task never
+// reaches either — so while the sandbox posture is ON, routing to the
+// in-process tier silently voids the user's explicit opt-in. The schema now
+// removes the PROJECT tier's authority to enable embeddedWorkers; this gate is
+// the second layer: even a USER-tier enable must refuse to route while the
+// sandbox is on (fail closed, like resolveSandboxConfig itself).
+
+/**
+ * FAIL-CLOSED: must the embedded tier refuse routing because a sandbox
+ * posture is configured?
+ *
+ * Mirrors resolveSandboxConfig's value handling (sandbox.ts): `""` and `"0"
+ * mean OFF; ANY other non-empty value means sandbox intent — `"bwrap"` is the
+ * active boundary, and unrecognized values throw on the child path entirely
+ * (refusing embedded routing for them too is the same fail-closed posture:
+ * the user asked for containment and must never get the unprotected in-process
+ * tier instead).
+ *
+ * CONSUMER (required follow-up wiring, outside this wave's file ownership):
+ * `planEmbeddedTier` (src/runtime/task-runner/hybrid-tier.ts) must call this
+ * FIRST and, when true, emit a visible `tier.decision` warning event (reason
+ * "sandbox-opt-in", route subprocess) and return undefined — the task stays
+ * on the subprocess tier, which resolveSandboxConfig actually wraps. Until
+ * wired, the gate is exported + unit-tested but not yet consulted by the
+ * routing seam.
+ */
+export function embeddedTierRefusedBySandbox(env: NodeJS.ProcessEnv = process.env): boolean {
+	const raw = (getCrewEnv("PI_CREW_SANDBOX", env) ?? "").trim();
+	return raw !== "" && raw !== "0";
+}
+
+/**
+ * Human-visible refusal message for the gate above (single wording shared by
+ * the event emission and tests, so the warning cannot drift from the gate).
+ */
+export function embeddedTierSandboxRefusalReason(env: NodeJS.ProcessEnv = process.env): string {
+	const raw = (getCrewEnv("PI_CREW_SANDBOX", env) ?? "").trim();
+	return `Embedded tier refused: PI_CREW_SANDBOX='${raw}' is set — the in-process embedded tier has no bwrap OS boundary and no child-env secret scrub, so routing would void the sandbox opt-in; the task stays on the subprocess tier (which the sandbox wraps)`;
+}

package/src/extension/management.ts

@@ -555,6 +555,15 @@ export function handleDelete(params: TeamToolParamsValue, ctx: ManagementContext
 	if (!params.confirm) return result("delete requires confirm: true.", "error", true);
 	const resolved = resolveMutable(ctx, params);
 	if (resolved.error) return resolved.error;
+	// Wave-3 root-gate parity with handleUpdate (w5a,
+	// rootGateActionMatrixOmitsDeleteCleanupInit): delete resolves its write
+	// tier from the MATCHED resource (params.scope may be undefined and match
+	// either tier via the user+project pool), so the facade gate cannot decide
+	// — gate HERE on the resolved source. Non-root sessions may only delete
+	// project-tier resources; dryRun previews stay behind this gate (fail-
+	// closed, matching handleUpdate's gate-before-dryRun order).
+	const deleteGate = assertRootOnlyAction("delete", undefined, resolved.resource!.source === "project" ? "project" : "user");
+	if (deleteGate) return result(deleteGate.message, "error", true);
 	const refs = findReferences(ctx, params.resource!, resolved.resource!.name);
 	if (refs.length > 0 && !params.force) {
 		return result(

package/src/extension/registration/lifecycle-handlers.ts

@@ -43,6 +43,7 @@ import { createSessionSnapshot } from "../../runtime/session-snapshot.ts";
 import { applyCrewSettingsTiersToConfig, loadCrewSettingsTiers, scheduledJobsHiddenCountOf } from "../../runtime/settings-store.ts";
 import type { ReconcileResult } from "../../runtime/stale-reconciler.ts";
 import { flushReapEscalationsSync } from "../../runtime/stale-reconciler.ts";
+import { getMailboxVerifyKeyPublic } from "../../state/coordination/mailbox.ts";
 import { loadRunManifestById, saveRunManifest } from "../../state/stores/state-store.ts";
 import type { TeamRunManifest } from "../../state/types.ts";
 import { installInlinePanel } from "../../ui/inline-panel/index.ts";
@@ -758,6 +759,22 @@ export function installCrewBrokerLifecycleController(_pi: ExtensionAPI, _ctx: Re
 	let starting: Promise<CrewBroker> | null = null;
 	let cachedSessionId: string | undefined;
 
+	// w1a (coordination-durable-files-no-sender-binding): eagerly create this
+	// process's coordination-row signing keypair (heap-only Ed25519) at install
+	// time in ROOT sessions, so the parent is a fail-closed verifier from the
+	// first mailbox/steering read — before any row it ever signed exists — and
+	// children can be handed the public verify key at spawn time
+	// (child-pi-spawn → PI_CREW_MAILBOX_VERIFY_KEY). Children install handlers
+	// too but never act as coordination writers; creating a keypair there is
+	// harmless heap state, but skip it to keep child heaps clean.
+	if (isRootSession(process.env)) {
+		try {
+			getMailboxVerifyKeyPublic();
+		} catch {
+			/* heap-only keygen must never break extension install */
+		}
+	}
+
 	function effectiveEnabled(): boolean {
 		// Env wins over config. PI_CREW_BROKER=1 forces on, =0 forces off.
 		const envOverride = getCrewEnv("PI_CREW_BROKER");
@@ -860,6 +877,17 @@ export function installCrewBrokerLifecycleController(_pi: ExtensionAPI, _ctx: Re
 
 	const issueForChild = async (runId: string, taskId?: string, childDepth?: number): Promise<BrokerSpawnCredentials | undefined> => {
 		if (!runId || typeof runId !== "string") return undefined;
+		// w1a (broker-bare-run-token-forged-task-identity): FAIL CLOSED on a missing
+		// task identity — a spawn without a taskId must NOT receive the legacy bare
+		// per-run token. The registry's runId fallback let an LLM worker holding
+		// that env-delivered bearer claim ANY queued sibling's identity
+		// (cross-task inbox theft + parked-ask hijack, observed end-to-end). This
+		// mirrors the detached runner's issuer (background-runner.ts:802 —
+		// `if (!taskId) return undefined`). Legit agentId-less scaffold/DWF flows
+		// keep working via the explicit credential-less route: the spawn simply
+		// carries no broker creds and the worker runs file-paths-only (the
+		// pre-broker behavior).
+		if (!taskId || typeof taskId !== "string") return undefined;
 		if (!isRootSession(process.env)) return undefined;
 		if (!effectiveEnabled()) return undefined;
 		// ADR-5 §4 (governed nesting): tokens are minted ONLY for children that

package/src/extension/registration/subagent-tools.ts

@@ -30,6 +30,7 @@ import {
 	savePersistedSubagentRecord,
 } from "../../runtime/subagent-manager.ts";
 import { TEAM_TERMINAL_TASK_STATUSES } from "../../state/contracts.ts";
+import { signSteeringEntry } from "../../state/coordination/mailbox.ts";
 import { resolveEntryBySubagentId, upsertOwnershipEntry } from "../../state/stores/ownership-map.ts";
 import { loadRunManifestById } from "../../state/stores/state-store.ts";
 import type { TeamRunManifest, TeamTaskState } from "../../state/types.ts";
@@ -558,7 +559,10 @@ export function registerSubagentTools(
 				} catch (error) {
 					if ((error as NodeJS.ErrnoException).code !== "ENOENT") throw error;
 				}
-				const line = JSON.stringify({ type: "steer", message: p.message, ts: new Date().toISOString() }) + "\n";
+				// w1a sender binding: the steering file is same-uid writable — the
+				// line carries this process's Ed25519 signature (worker pollSteering
+				// drops unauthenticated lines).
+				const line = JSON.stringify(signSteeringEntry({ type: "steer", message: p.message, ts: new Date().toISOString() })) + "\n";
 				if (existingBytes + Buffer.byteLength(line) > MAX_STEERING_BYTES) {
 					return subagentToolResult(
 						`Steering file for task '${taskId}' has reached its size cap (${(MAX_STEERING_BYTES / 1024).toFixed(0)}KiB); steer refused.`,

package/src/extension/run-import.ts

@@ -23,6 +23,33 @@ export interface ImportedRunBundleInfo {
 // reading + JSON.parse). Stat BEFORE reading so we never buffer a huge file.
 export const MAX_IMPORT_BUNDLE_BYTES = 50 * 1024 * 1024;
 
+/**
+ * W7B (imported-manifest-goal-raw-render): output-encoding seam for untrusted
+ * strings imported from run bundles (manifest.goal/team/workflow/status,
+ * exportedAt, task.error/id/role/agent) before they are rendered into the
+ * parent-LLM team-tool listing (lifecycle-actions.ts handleImports) or the
+ * durable import README. Bundle files are repo-authored / plant-able content —
+ * assertRunBundle validates types only, not content — so every rendered field
+ * is forced into inert single-line data:
+ *  1. strip well-formed ANSI CSI escape sequences (colors / cursor moves),
+ *  2. collapse remaining C0/C1 controls + DEL to spaces (kills forged
+ *     multi-line listing entries and injected directive lines),
+ *  3. strip angle brackets (kills fake <dependency-context> fences and
+ *     <script> tags),
+ *  4. collapse whitespace runs and hard-cap the length.
+ * Mirrors the sanitizeFencedBody seam applied to worker output entering parent
+ * context (task-output-context.ts).
+ */
+export function sanitizeImportedText(value: string | undefined, max = 200): string {
+	const stripped = String(value ?? "")
+		.replace(/\u001b\[[0-9;?]*[0-9A-Za-z]/g, "")
+		.replace(/[\u0000-\u001f\u007f-\u009f]/g, " ")
+		.replace(/[<>]/g, "")
+		.replace(/\s+/g, " ")
+		.trim();
+	return stripped.length > max ? stripped.slice(0, max) : stripped;
+}
+
 function importRoot(cwd: string, scope: "project" | "user"): string {
 	const base = scope === "project" ? projectCrewRoot(cwd) : userCrewRoot();
 	// SECURITY NOTE: `DEFAULT_PATHS.state.importsSubdir` is a constant (not user-controlled).
@@ -157,20 +184,27 @@ export function importRunBundle(cwd: string, bundlePath: string, scope: "project
 	atomicWriteFile(targetJson, `${JSON.stringify({ ...raw, importedAt, importedFrom: resolvedPath }, null, 2)}\n`);
 	atomicWriteFile(
 		targetSummary,
+		// W7B: every bundle-authored string below is untrusted (repo/plant
+		// content) — render through the sanitizeImportedText seam so control
+		// chars, ANSI escapes and angle-bracket fence tokens can never break out
+		// of this README into forged headings/directives.
 		[
 			`# Imported pi-crew run ${runId}`,
 			"",
 			`Imported: ${importedAt}`,
 			`Source: ${resolvedPath}`,
-			`Original export: ${raw.exportedAt}`,
-			`Status: ${raw.manifest.status}`,
-			`Team: ${raw.manifest.team}`,
-			`Workflow: ${raw.manifest.workflow ?? "(none)"}`,
-			`Goal: ${raw.manifest.goal}`,
+			`Original export: ${sanitizeImportedText(raw.exportedAt, 64)}`,
+			`Status: ${sanitizeImportedText(raw.manifest.status, 64)}`,
+			`Team: ${sanitizeImportedText(raw.manifest.team, 64)}`,
+			`Workflow: ${raw.manifest.workflow === undefined ? "(none)" : sanitizeImportedText(raw.manifest.workflow, 64)}`,
+			`Goal: ${sanitizeImportedText(raw.manifest.goal)}`,
 			"",
 			"## Tasks",
 			...raw.tasks.map(
-				(task) => `- ${task.id}: ${task.status} (${task.role} -> ${task.agent})${task.error ? ` - ${task.error}` : ""}`,
+				(task) =>
+					`- ${sanitizeImportedText(task.id, 120)}: ${task.status} (${sanitizeImportedText(task.role, 64)} -> ${sanitizeImportedText(task.agent, 64)})${
+						typeof task.error === "string" ? ` - ${sanitizeImportedText(task.error)}` : ""
+					}`,
 			),
 			"",
 		].join("\n"),

package/src/extension/team-tool/api/agent-control.ts

@@ -5,6 +5,7 @@
  * byte-identical to the inline `if` blocks they replace.
  */
 
+import { getCrewEnv } from "../../../config/env-vars.ts";
 import { readCrewAgents } from "../../../runtime/crew-agent-records.ts";
 import { appendLiveAgentControlRequest } from "../../../runtime/live-session/live-agent-control.ts";
 import {
@@ -16,6 +17,7 @@ import {
 	stopLiveAgent,
 } from "../../../runtime/live-session/live-agent-manager.ts";
 import { liveControlRealtimeMessage, publishLiveControlRealtime } from "../../../runtime/live-session/live-control-realtime.ts";
+import { currentCrewRole, permissionForRole } from "../../../runtime/role-permission.ts";
 import {
 	appendFollowUpMessage,
 	appendFollowUpMessageAsync,
@@ -26,6 +28,40 @@ import { appendEvent, appendEventBuffered } from "../../../state/event-log/event
 import { logInternalError } from "../../../utils/internal-error.ts";
 import type { ApiOperationHandler } from "./handler-context.ts";
 
+// ── W1b deferred residual (w9-r1): role gate on the live-agent control cluster ──
+// Every operation dispatched to handleLiveAgentControl (steer-agent,
+// follow-up-agent, stop-agent, resume-agent, interrupt-agent) mutates run
+// state — mailbox writes, live-control request files, session stop/resume —
+// so the whole shared handler is gated with the canMutateTaskClaims pattern
+// (task-claims.ts): read_only-tier roles (explorer/analyst/reviewer/critic/
+// planner/security-reviewer + default-deny unknowns) are denied; write-tier
+// workers and role-less root-session callers stay allowed. handleListLiveAgents
+// is a pure read and stays open. NOTE: the separately named `foreground-interrupt`
+// operation lives in read.ts (outside this file's ownership) — see the w9-r1
+// fix record for the ownership-handoff note.
+
+/** Role-tier gate for live-agent control mutations (canApprovePlan pattern). */
+function canControlLiveAgents(): { allowed: boolean; reason?: string } {
+	const role = currentCrewRole();
+	if (!role) return { allowed: true };
+	if (permissionForRole(role) === "read_only")
+		return {
+			allowed: false,
+			reason: `Role '${role}' is read-only and cannot steer, stop, resume, or interrupt agents.`,
+		};
+	return { allowed: true };
+}
+
+/** Caller identity fields for the audit trail (w1b callerAuditFields pattern). */
+function callerAuditFields(): { callerRole?: string; callerTaskId?: string } {
+	const callerRole = currentCrewRole();
+	const callerTaskId = getCrewEnv("PI_CREW_TASK_ID")?.trim() || undefined;
+	return {
+		...(callerRole ? { callerRole } : {}),
+		...(callerTaskId ? { callerTaskId } : {}),
+	};
+}
+
 export const handleNudgeAgent: ApiOperationHandler = (hctx) => {
 	const { cfg, loaded, result, paramRequired, ctx } = hctx;
 	const agentId = typeof cfg.agentId === "string" ? cfg.agentId : undefined;
@@ -109,6 +145,17 @@ export const handleListLiveAgents: ApiOperationHandler = (hctx) => {
  */
 export const handleLiveAgentControl: ApiOperationHandler = async (hctx) => {
 	const { cfg, loaded, result, paramRequired, ctx } = hctx;
+	const gate = canControlLiveAgents();
+	if (!gate.allowed)
+		return result(
+			gate.reason ?? "agent control is not allowed in this context.",
+			{
+				action: "api",
+				status: "error",
+				runId: loaded.manifest.runId,
+			},
+			true,
+		);
 	const operation = typeof cfg.operation === "string" ? cfg.operation : "";
 	const agentId = typeof cfg.agentId === "string" ? cfg.agentId : undefined;
 	if (!agentId)
@@ -330,6 +377,8 @@ export const handleLiveAgentControl: ApiOperationHandler = async (hctx) => {
 					request,
 					mailboxMessageId: mailboxMessage?.id,
 					realtime: true,
+					// W1b residual: record the verified caller identity on the audit trail.
+					...callerAuditFields(),
 				},
 			}).catch((e) => logInternalError("api.agent-control.buffered", e, "type=agent.control.queued"));
 			return result(JSON.stringify({ queued: true, request, mailboxMessage }, null, 2), {

package/src/extension/team-tool/api/heartbeat.ts

@@ -5,7 +5,9 @@
  * byte-identical to the inline `if` blocks they replace.
  */
 
+import { getCrewEnv } from "../../../config/env-vars.ts";
 import { touchWorkerHeartbeat } from "../../../runtime/heartbeat/worker-heartbeat.ts";
+import { currentCrewRole, permissionForRole } from "../../../runtime/role-permission.ts";
 import { isTerminalTaskStatus } from "../../../state/contracts.ts";
 import { withRunLockSync } from "../../../state/coordination/locks.ts";
 import { appendEventBuffered } from "../../../state/event-log/event-log.ts";
@@ -14,8 +16,49 @@ import { logInternalError } from "../../../utils/internal-error.ts";
 import { RUN_NOT_FOUND_HINT } from "../run-not-found.ts";
 import type { ApiOperationHandler } from "./handler-context.ts";
 
+// ── W1b deferred residual (w9-r1): role gate on write-heartbeat ──
+// write-heartbeat mutates run state (task.heartbeat on disk + worker.heartbeat
+// event) and drives liveness/watchdog decisions, so it follows the
+// canMutateTaskClaims pattern (task-claims.ts): read_only-tier roles
+// (explorer/analyst/reviewer/critic/planner/security-reviewer + default-deny
+// unknowns) are denied; write-tier workers and role-less root-session callers
+// stay allowed.
+
+/** Role-tier gate for heartbeat-mutating operations (canApprovePlan pattern). */
+function canWriteHeartbeat(): { allowed: boolean; reason?: string } {
+	const role = currentCrewRole();
+	if (!role) return { allowed: true };
+	if (permissionForRole(role) === "read_only")
+		return {
+			allowed: false,
+			reason: `Role '${role}' is read-only and cannot write worker heartbeats.`,
+		};
+	return { allowed: true };
+}
+
+/** Caller identity fields for the audit trail (w1b callerAuditFields pattern). */
+function callerAuditFields(): { callerRole?: string; callerTaskId?: string } {
+	const callerRole = currentCrewRole();
+	const callerTaskId = getCrewEnv("PI_CREW_TASK_ID")?.trim() || undefined;
+	return {
+		...(callerRole ? { callerRole } : {}),
+		...(callerTaskId ? { callerTaskId } : {}),
+	};
+}
+
 export const handleWriteHeartbeat: ApiOperationHandler = (hctx) => {
 	const { cfg, loaded, result, paramRequired } = hctx;
+	const gate = canWriteHeartbeat();
+	if (!gate.allowed)
+		return result(
+			gate.reason ?? "write-heartbeat is not allowed in this context.",
+			{
+				action: "api",
+				status: "error",
+				runId: loaded.manifest.runId,
+			},
+			true,
+		);
 	const taskId = typeof cfg.taskId === "string" ? cfg.taskId : undefined;
 	const task = loaded.tasks.find((item) => item.id === taskId || item.stepId === taskId);
 	if (!task)
@@ -84,7 +127,11 @@ export const handleWriteHeartbeat: ApiOperationHandler = (hctx) => {
 				type: "worker.heartbeat",
 				runId: fresh.manifest.runId,
 				taskId: freshTask.id,
-				data: { ...heartbeat },
+				data: {
+					...heartbeat,
+					// W1b residual: record the verified caller identity on the audit trail.
+					...callerAuditFields(),
+				},
 			}).catch((e) => logInternalError("api.heartbeat.buffered", e, "type=worker.heartbeat"));
 			return result(JSON.stringify(heartbeat, null, 2), {
 				action: "api",