pi-crew 0.11.49 → 0.11.51

package/src/extension/team-tool/api/mailbox.ts

@@ -5,6 +5,8 @@
  * byte-identical to the inline `if` blocks they replace.
  */
 
+import { getCrewEnv } from "../../../config/env-vars.ts";
+import { currentCrewRole, permissionForRole } from "../../../runtime/role-permission.ts";
 import { withRunLockSync } from "../../../state/coordination/locks.ts";
 import {
 	acknowledgeMailboxMessage,
@@ -20,6 +22,35 @@ import { appendEvent, appendEventBuffered } from "../../../state/event-log/event
 import { logInternalError } from "../../../utils/internal-error.ts";
 import type { ApiOperationHandler } from "./handler-context.ts";
 
+// ── W1b deferred residual (w9-r1): role gates on mutating mailbox operations ──
+// send-message (mailbox append + event), ack-message (delivery-state write +
+// events), and validate-mailbox WITH repair=true (rewrites mailbox/delivery
+// files) all mutate run state, so they follow the canMutateTaskClaims pattern
+// (task-claims.ts): read_only-tier roles (explorer/analyst/reviewer/critic/
+// planner/security-reviewer + default-deny unknowns) are denied; write-tier
+// workers and role-less root-session callers stay allowed. Plain validate-mailbox
+// (repair unset/false) is a pure diagnostic READ and stays open, as do
+// read-mailbox and read-delivery.
+
+/** Role-tier gate for mailbox-mutating operations (canApprovePlan pattern). */
+function canMutateMailbox(op: "repair" | "send" | "ack"): { allowed: boolean; reason?: string } {
+	const role = currentCrewRole();
+	if (!role) return { allowed: true };
+	if (permissionForRole(role) !== "read_only") return { allowed: true };
+	const action = op === "repair" ? "repair the mailbox" : op === "send" ? "send mailbox messages" : "acknowledge mailbox messages";
+	return { allowed: false, reason: `Role '${role}' is read-only and cannot ${action}.` };
+}
+
+/** Caller identity fields for the audit trail (w1b callerAuditFields pattern). */
+function callerAuditFields(): { callerRole?: string; callerTaskId?: string } {
+	const callerRole = currentCrewRole();
+	const callerTaskId = getCrewEnv("PI_CREW_TASK_ID")?.trim() || undefined;
+	return {
+		...(callerRole ? { callerRole } : {}),
+		...(callerTaskId ? { callerTaskId } : {}),
+	};
+}
+
 export const handleReadMailbox: ApiOperationHandler = (hctx) => {
 	const { cfg, loaded, result } = hctx;
 	const direction = cfg.direction === "inbox" || cfg.direction === "outbox" ? (cfg.direction as MailboxDirection) : undefined;
@@ -61,6 +92,21 @@ export const handleReadMailbox: ApiOperationHandler = (hctx) => {
 
 export const handleValidateMailbox: ApiOperationHandler = (hctx) => {
 	const { cfg, loaded, result } = hctx;
+	// W1b residual: ONLY the repair pass mutates (rewrites mailbox/delivery
+	// state); the plain validation report is a diagnostic read and stays open.
+	if (cfg.repair === true) {
+		const gate = canMutateMailbox("repair");
+		if (!gate.allowed)
+			return result(
+				gate.reason ?? "mailbox repair is not allowed in this context.",
+				{
+					action: "api",
+					status: "error",
+					runId: loaded.manifest.runId,
+				},
+				true,
+			);
+	}
 	const report = validateMailbox(loaded.manifest, {
 		repair: cfg.repair === true,
 	});
@@ -88,6 +134,17 @@ export const handleReadDelivery: ApiOperationHandler = (hctx) => {
 
 export const handleSendMessage: ApiOperationHandler = (hctx) => {
 	const { cfg, loaded, result, paramRequired, ctx } = hctx;
+	const gate = canMutateMailbox("send");
+	if (!gate.allowed)
+		return result(
+			gate.reason ?? "send-message is not allowed in this context.",
+			{
+				action: "api",
+				status: "error",
+				runId: loaded.manifest.runId,
+			},
+			true,
+		);
 	const direction = cfg.direction === "outbox" ? "outbox" : "inbox";
 	const from = typeof cfg.from === "string" && cfg.from.trim() ? cfg.from.trim() : "api";
 	const to = typeof cfg.to === "string" && cfg.to.trim() ? cfg.to.trim() : "leader";
@@ -133,7 +190,14 @@ export const handleSendMessage: ApiOperationHandler = (hctx) => {
 			appendEventBuffered(loaded.manifest.eventsPath, {
 				type: "mailbox.message",
 				runId: loaded.manifest.runId,
-				data: { id: message.id, direction, from, to },
+				data: {
+					id: message.id,
+					direction,
+					from,
+					to,
+					// W1b residual: record the verified caller identity on the audit trail.
+					...callerAuditFields(),
+				},
 			}).catch((e) => logInternalError("api.mailbox.buffered", e, "type=mailbox.message"));
 			ctx.events?.emit?.("crew.mailbox.message", {
 				runId: loaded.manifest.runId,
@@ -167,6 +231,17 @@ export const handleSendMessage: ApiOperationHandler = (hctx) => {
 
 export const handleAckMessage: ApiOperationHandler = (hctx) => {
 	const { cfg, loaded, result, paramRequired, ctx } = hctx;
+	const gate = canMutateMailbox("ack");
+	if (!gate.allowed)
+		return result(
+			gate.reason ?? "ack-message is not allowed in this context.",
+			{
+				action: "api",
+				status: "error",
+				runId: loaded.manifest.runId,
+			},
+			true,
+		);
 	const messageId = typeof cfg.messageId === "string" ? cfg.messageId : undefined;
 	if (!messageId)
 		return result(
@@ -194,7 +269,11 @@ export const handleAckMessage: ApiOperationHandler = (hctx) => {
 				appendEvent(loaded.manifest.eventsPath, {
 					type: "mailbox.acknowledged",
 					runId: loaded.manifest.runId,
-					data: { messageId },
+					data: {
+						messageId,
+						// W1b residual: record the verified caller identity on the audit trail.
+						...callerAuditFields(),
+					},
 				});
 			} catch (e) {
 				logInternalError("api.mailbox.append", e, "type=mailbox.acknowledged");

package/src/extension/team-tool/api/read.ts

@@ -15,6 +15,7 @@ import { agentOutputPath, readCrewAgentEventsCursor, readCrewAgentStatus, readCr
 import { readForegroundControlStatus, writeForegroundInterruptRequest } from "../../../runtime/foreground-control.ts";
 import { probeLiveSessionRuntime } from "../../../runtime/live-session/live-session-runtime.ts";
 import { resolveCrewRuntime } from "../../../runtime/model/runtime-resolver.ts";
+import { currentCrewRole, permissionForRole } from "../../../runtime/role-permission.ts";
 import { fenceWorkerText } from "../../../runtime/sanitize/worker-text.ts";
 import { readEvents, readEventsCursor } from "../../../state/event-log/event-log.ts";
 import { globMatch } from "../../../utils/glob-match.ts";
@@ -357,8 +358,29 @@ export const handleForegroundStatus: ApiOperationHandler = (hctx) => {
 	});
 };
 
+/** w9-r1 follow-up: role-tier gate for the mutating foreground-interrupt op
+ * (canMutateMailbox pattern — the op WRITES an interrupt-request file, it is
+ * not a read despite living in the read group). */
+function canWriteForegroundInterrupt(): { allowed: boolean; reason?: string } {
+	const role = currentCrewRole();
+	if (!role) return { allowed: true };
+	if (permissionForRole(role) !== "read_only") return { allowed: true };
+	return { allowed: false, reason: `Role '${role}' is read-only and cannot request a foreground interrupt.` };
+}
+
 export const handleForegroundInterrupt: ApiOperationHandler = (hctx) => {
 	const { cfg, loaded, result } = hctx;
+	const gate = canWriteForegroundInterrupt();
+	if (!gate.allowed)
+		return result(
+			gate.reason ?? "foreground interrupt is not allowed in this context.",
+			{
+				action: "api",
+				status: "error",
+				runId: loaded.manifest.runId,
+			},
+			true,
+		);
 	const reason = typeof cfg.reason === "string" && cfg.reason.trim() ? cfg.reason.trim() : undefined;
 	return result(JSON.stringify(writeForegroundInterruptRequest(loaded.manifest, reason), null, 2), {
 		action: "api",

package/src/extension/team-tool/api/task-claims.ts

@@ -13,6 +13,8 @@
  * `test/unit/extension/core/api-claim.test.ts` suite guards against drift.
  */
 
+import { getCrewEnv } from "../../../config/env-vars.ts";
+import { currentCrewRole, permissionForRole } from "../../../runtime/role-permission.ts";
 import { canTransitionTaskStatus, isTeamTaskStatus } from "../../../state/contracts.ts";
 import { withRunLockSync } from "../../../state/coordination/locks.ts";
 import { claimTask, releaseTaskClaim, transitionClaimedTaskStatus } from "../../../state/coordination/task-claims.ts";
@@ -23,6 +25,80 @@ import { logInternalError } from "../../../utils/internal-error.ts";
 import { RUN_NOT_FOUND_HINT } from "../run-not-found.ts";
 import type { ApiHandlerContext, ApiOperationHandler } from "./handler-context.ts";
 
+// ── W1b caller binding (security fix team-tool/api.claim-task.missing-caller-role-ownership-binding) ──
+// claim-task mints the capability token that release-task-claim and
+// transition-task-status later trust, so whoever can claim can poison a run's
+// task lifecycle (queued→failed flips drive selectDispatchBatch/finalization).
+// Two bindings close that, following the canApprovePlan pattern
+// (plan-approval.ts):
+//   1. ROLE GATE — read_only-tier callers (explorer/analyst/reviewer/critic/
+//      planner/security-reviewer + default-deny unknowns) are denied on all
+//      three claim-mutating operations. Root-session callers (no PI_CREW_ROLE)
+//      stay allowed — they are the tool's intended principals.
+//   2. IDENTITY BINDING (claim only) — a caller WITH a worker task identity
+//      (PI_CREW_TASK_ID, set for spawned workers) may only claim its OWN task,
+//      and the claim owner is forced to that verified identity instead of the
+//      self-declared cfg.owner. Release/transition stay token-gated: since the
+//      token can only be minted for the caller's own identity, a foreign
+//      (owner, token) pair cannot be constructed.
+
+/** Role-tier gate for claim-mutating operations (canApprovePlan pattern). */
+function canMutateTaskClaims(): { allowed: boolean; reason?: string } {
+	const role = currentCrewRole();
+	if (!role) return { allowed: true };
+	if (permissionForRole(role) === "read_only")
+		return {
+			allowed: false,
+			reason: `Role '${role}' is read-only and cannot claim, release, or transition tasks.`,
+		};
+	return { allowed: true };
+}
+
+/** The caller's own registered task identity (set for spawned workers; unset
+ *  for the root session). Read via the env registry — never raw process.env. */
+function callerTaskIdentity(): string | undefined {
+	return getCrewEnv("PI_CREW_TASK_ID")?.trim() || undefined;
+}
+
+/** Caller identity fields for the audit trail of claim-mutating events. */
+function callerAuditFields(): { callerRole?: string; callerTaskId?: string } {
+	const callerRole = currentCrewRole();
+	const callerTaskId = callerTaskIdentity();
+	return {
+		...(callerRole ? { callerRole } : {}),
+		...(callerTaskId ? { callerTaskId } : {}),
+	};
+}
+
+type ClaimOwnerBinding = { allowed: true; owner: string } | { allowed: false; reason: string };
+
+/**
+ * Bind claim-task to the caller's own identity. A caller with a worker task
+ * identity may only claim the task registered under that identity (validated
+ * against the run's task registry by the caller's existing find/fresh-re-read
+ * path — a foreign id fails the required-task lookup) and an EXPLICITLY
+ * declared cfg.owner must match it; the effective owner becomes the verified
+ * caller identity (a defaulted owner is silently replaced by it, never
+ * treated as a declaration). Root-session callers (no worker identity) keep
+ * the previous owner semantics unchanged.
+ */
+function bindClaimToCaller(taskId: string | undefined, declaredOwner: string | undefined): ClaimOwnerBinding {
+	const callerTaskId = callerTaskIdentity();
+	if (!callerTaskId) return { allowed: true, owner: declaredOwner ?? "api" };
+	if (!taskId) return { allowed: true, owner: declaredOwner ?? "api" }; // missing-param path reports below
+	if (taskId !== callerTaskId)
+		return {
+			allowed: false,
+			reason: `claim-task rejected: caller task '${callerTaskId}' may only claim its own task — refusing cross-task claim on '${taskId}'.`,
+		};
+	if (declaredOwner !== undefined && declaredOwner !== callerTaskId)
+		return {
+			allowed: false,
+			reason: `claim-task rejected: declared owner '${declaredOwner}' does not match the caller's own task identity '${callerTaskId}'.`,
+		};
+	return { allowed: true, owner: callerTaskId };
+}
+
 /** Find a task by id OR stepId — the convention used by every claim op. */
 function findTaskByIdOrStepId(tasks: TeamTaskState[], taskId: string | undefined) {
 	if (!taskId) return undefined;
@@ -56,8 +132,30 @@ function freshRunOrMissing(
 /** handleApi operation: `claim-task`. */
 export const handleClaimTask: ApiOperationHandler = (ctx) => {
 	const { cfg, loaded, result, paramRequired } = ctx;
+	const gate = canMutateTaskClaims();
+	if (!gate.allowed)
+		return result(
+			gate.reason ?? "claim-task is not allowed in this context.",
+			{
+				action: "api",
+				status: "error",
+				runId: loaded.manifest.runId,
+			},
+			true,
+		);
 	const taskId = typeof cfg.taskId === "string" ? cfg.taskId : undefined;
-	const owner = typeof cfg.owner === "string" ? cfg.owner : "api";
+	const binding = bindClaimToCaller(taskId, typeof cfg.owner === "string" ? cfg.owner : undefined);
+	if (!binding.allowed)
+		return result(
+			binding.reason,
+			{
+				action: "api",
+				status: "error",
+				runId: loaded.manifest.runId,
+			},
+			true,
+		);
+	const owner = binding.owner;
 	const task = findTaskByIdOrStepId(loaded.tasks, taskId);
 	if (!task)
 		return result(
@@ -101,6 +199,8 @@ export const handleClaimTask: ApiOperationHandler = (ctx) => {
 					owner,
 					token: "[REDACTED]",
 					leasedUntil: updatedTask.claim?.leasedUntil,
+					// W1b: record the verified caller identity on the audit trail.
+					...callerAuditFields(),
 				},
 			}).catch((e) => logInternalError("api.task-claims.buffered", e, "type=task.claimed"));
 			return result(JSON.stringify(updatedTask.claim, null, 2), {
@@ -127,6 +227,17 @@ export const handleClaimTask: ApiOperationHandler = (ctx) => {
 /** handleApi operation: `release-task-claim`. */
 export const handleReleaseTaskClaim: ApiOperationHandler = (ctx) => {
 	const { cfg, loaded, result, paramRequired } = ctx;
+	const gate = canMutateTaskClaims();
+	if (!gate.allowed)
+		return result(
+			gate.reason ?? "release-task-claim is not allowed in this context.",
+			{
+				action: "api",
+				status: "error",
+				runId: loaded.manifest.runId,
+			},
+			true,
+		);
 	const taskId = typeof cfg.taskId === "string" ? cfg.taskId : undefined;
 	const owner = typeof cfg.owner === "string" ? cfg.owner : undefined;
 	const token = typeof cfg.token === "string" ? cfg.token : undefined;
@@ -167,7 +278,11 @@ export const handleReleaseTaskClaim: ApiOperationHandler = (ctx) => {
 				type: "task.claim_released",
 				runId: fresh.manifest.runId,
 				taskId: freshTask.id,
-				data: { owner },
+				data: {
+					owner,
+					// W1b: record the verified caller identity on the audit trail.
+					...callerAuditFields(),
+				},
 			}).catch((e) => logInternalError("api.task-claims.buffered", e, "type=task.claim_released"));
 			return result(JSON.stringify(updatedTask, null, 2), {
 				action: "api",
@@ -193,6 +308,17 @@ export const handleReleaseTaskClaim: ApiOperationHandler = (ctx) => {
 /** handleApi operation: `transition-task-status`. */
 export const handleTransitionTaskStatus: ApiOperationHandler = (ctx) => {
 	const { cfg, loaded, result, paramRequired } = ctx;
+	const gate = canMutateTaskClaims();
+	if (!gate.allowed)
+		return result(
+			gate.reason ?? "transition-task-status is not allowed in this context.",
+			{
+				action: "api",
+				status: "error",
+				runId: loaded.manifest.runId,
+			},
+			true,
+		);
 	const taskId = typeof cfg.taskId === "string" ? cfg.taskId : undefined;
 	const owner = typeof cfg.owner === "string" ? cfg.owner : undefined;
 	const token = typeof cfg.token === "string" ? cfg.token : undefined;
@@ -246,7 +372,12 @@ export const handleTransitionTaskStatus: ApiOperationHandler = (ctx) => {
 				type: "task.status_transitioned",
 				runId: fresh.manifest.runId,
 				taskId: freshTask.id,
-				data: { owner, status: to },
+				data: {
+					owner,
+					status: to,
+					// W1b: record the verified caller identity on the audit trail.
+					...callerAuditFields(),
+				},
 			}).catch((e) => logInternalError("api.task-claims.buffered", e, "type=task.status_transitioned"));
 			return result(JSON.stringify(updatedTask, null, 2), {
 				action: "api",

package/src/extension/team-tool/destructive-gate.ts

@@ -92,6 +92,17 @@ export function shouldBlockDestructiveTeamAction(action: string | undefined, inp
  *   - `create` /  — when resolved scope is `user` (create defaults to user;
  *   - `update`     update is gated at the resolved resource's scope — see
  *                   the post-`resolveMutable` call in management.ts).
+ *   - `delete`    — user tier only at the facade (config.scope); handleDelete
+ *                   re-gates on the RESOLVED resource tier (management.ts)
+ *                   because `resolveMutable` pools user+project when no scope
+ *                   is given (w5a: the delete sibling of the update gate).
+ *   - `cleanup`   — top-level `scope: "user"` only (handleCleanup routes on
+ *                   that carrier); runId/project cleanup stay project-tier.
+ *   - `init`      — unless the resolved config scope is project/none
+ *                   (config.configScope/config.scope carriers, mirroring
+ *                   dispatch/manage.ts); the default is `global`, which
+ *                   writes `~/.pi/agent/pi-crew.json` (overwrite:true
+ *                   replaces a customized config).
  *   - `workflow-` — ALWAYS (fix-wave 6, R11-S1): .dwf.ts scripts are
  *     `create`/    arbitrary code auto-loaded by every future session —
  *     `save`/      project tier included (`.crew/workflows/` is discovered
@@ -107,8 +118,13 @@ export function shouldBlockDestructiveTeamAction(action: string | undefined, inp
  * carriers cannot smuggle a user-tier write past the gate.
  *
  * Reads (config/status/list, settings list/get, schedule `scheduled`) are
- * never gated. `dryRun` previews that write nothing pass through, mirroring
- * destructive-gate.ts's dryRun convention.
+ * never gated. `dryRun` carriers do NOT exempt mutating actions from this
+ * gate (w5a, rootGateDryRunPreviewExemptsMutatingHandlers): handleStart
+ * (goal.ts) has no dryRun branch at all and handleCreate (management.ts)
+ * honors only top-level `params.dryRun`, so a config-carrier "preview" of
+ * `goal start` / `create` would mutate for real. Previews therefore traverse
+ * the SAME matrix as execution — the schedule precedent ("previews of actions
+ * without a dryRun contract are gated").
  */
 
 /** Typed error so callers/tests can distinguish the gate from handler errors. */
@@ -187,6 +203,32 @@ export function assertRootOnlyAction(
 		case "update":
 			if (scope === "user") return detail("rewrites a user-tier resource loaded by every future session");
 			return undefined;
+		case "delete":
+			// w5a (rootGateActionMatrixOmitsDeleteCleanupInit): delete shares
+			// update's resource resolution (resolveMutable pools user+project when
+			// no scope is given) but previously fell through the switch default —
+			// a worker could unlink user-tier agents/teams/workflows. Gate the
+			// config-carrier user scope HERE (pre-filter, like update) and the
+			// RESOLVED resource tier in handleDelete (management.ts), where the
+			// matched file's tier is finally known.
+			if (scope === "user") return detail("deletes a user-tier resource loaded by every future session");
+			return undefined;
+		case "cleanup":
+			// Only the scope=user branch (handleUserCleanup) destroys user-tier
+			// state: the whole userCrewRoot() run-history/artifacts tree plus the
+			// global config with force:true. runId cleanup and project cleanup stay
+			// project-tier and worker-reachable (Wave-3 policy).
+			if (scope === "user") return detail("removes the user-tier pi-crew state directory and global config");
+			return undefined;
+		case "init":
+			// configScope defaults to 'global' (dispatch/manage.ts) -> writes
+			// ~/.pi/agent/pi-crew.json; overwrite:true replaces a customized config.
+			// The facade resolves init's config scope from its own carriers
+			// (config.configScope OR config.scope, mirroring the dispatch union) —
+			// global (the default) is user-tier and gated; project/none stay
+			// worker-reachable.
+			if (scope !== "project") return detail("writes/replaces the global pi-crew config (all future sessions)");
+			return undefined;
 		case "workflow-create":
 		case "workflow-save":
 			// R11-S1 (fix-wave 6 M1-3): a .dwf.ts is arbitrary code auto-loaded by
@@ -248,6 +290,24 @@ function resolveScopeParam(params: RootGateParamsLike, action?: string): RootGat
 	return action === "import" || action === "export" ? "project" : "user";
 }
 
+/**
+ * w5a (rootGateActionMatrixOmitsDeleteCleanupInit): `init` resolves its config
+ * scope from config.configScope OR config.scope with UNION semantics
+ * (dispatch/manage.ts: either carrier "project" → project; either carrier
+ * "none" → none; anything else, including an absent carrier, → "global").
+ * Only the "global" outcome writes the user tier (~/.pi/agent/pi-crew.json),
+ * so project AND none map to the worker-reachable bucket here. Note
+ * `configScope` must NOT participate in the shared {@link resolveScopeParam}:
+ * create/settings/config ignore it and default to user, so a configScope:
+ * 'project' fallback there would OPEN the gate on a user-tier write.
+ */
+function resolveInitConfigScope(params: RootGateParamsLike): RootGateScope {
+	const cfg = configRecord(params.config);
+	const projectScope = cfg.configScope === "project" || cfg.scope === "project";
+	const noneScope = cfg.configScope === "none" || cfg.scope === "none";
+	return projectScope || noneScope ? "project" : "user";
+}
+
 /**
  * Facade resolver: derive (subcommand, scope) from raw team-tool params for
  * the gated actions and decide whether a NON-ROOT session must be blocked.
@@ -255,7 +315,11 @@ function resolveScopeParam(params: RootGateParamsLike, action?: string): RootGat
  * {@link resolveScopeParam}); top-level `scope` never influences the gate.
  * `update` is special: its effective write scope is the matched resource's
  * scope, unknown until `resolveMutable` — the facade blocks explicit
- * `scope:"user"` and management.ts gates the resolved case.
+ * `scope:"user"` and management.ts gates the resolved case. `delete` mirrors
+ * that split (facade pre-filter + handleDelete resolved-tier gate).
+ * `cleanup` routes on TOP-LEVEL `params.scope` (lifecycle-actions.ts), and
+ * `init` on config.configScope/config.scope (dispatch/manage.ts) — both
+ * carriers are read here so the gate matches each handler exactly.
  *
  * @returns block reason string, or `undefined` to allow.
  */
@@ -267,16 +331,34 @@ export function rootGateBlockReason(params: RootGateParamsLike, env: NodeJS.Proc
 		(typeof params.subAction === "string" ? params.subAction : undefined) ??
 		(typeof cfg.subAction === "string" ? cfg.subAction : undefined);
 	const subcommand = typeof rawSub === "string" ? rawSub.toLowerCase() : undefined;
-	const scope = resolveScopeParam(params, action);
+	// w5a: cleanup reads the TOP-LEVEL scope carrier (handleCleanup routes on
+	// params.scope; config.scope is a carrier key it ignores) and init reads
+	// config.configScope/config.scope (dispatch/manage.ts). Everything else
+	// keeps the R11-F1 canonical config.scope resolver.
+	const scope =
+		action === "cleanup"
+			? params.scope === "user"
+				? "user"
+				: "project"
+			: action === "init"
+				? resolveInitConfigScope(params)
+				: resolveScopeParam(params, action);
 	const force = params.force === true || cfg.force === true;
 
-	// Reads / previews never gated (destructive-gate dryRun convention).
-	const isPreview = params.dryRun === true || cfg.dryRun === true;
+	// w5a (rootGateDryRunPreviewExemptsMutatingHandlers): dryRun carriers do
+	// NOT exempt mutating actions here. handleStart (goal.ts) has NO dryRun
+	// branch — it persists state and spawns the detached runner regardless —
+	// and handleCreate (management.ts) honors only top-level params.dryRun, so
+	// a config-carrier "preview" wrote the user tier for real. Previews of
+	// mutating actions traverse the SAME matrix as execution (schedule
+	// precedent); unrecognized carrier shapes therefore fail closed.
 
 	// goal: gate `start` and any force:true op; status/pause/read-only stay open.
 	if (action === "goal") {
 		if (force) return assertRootOnlyAction("goal", "force", scope, env)?.message;
-		if (subcommand === "start" && !isPreview) return assertRootOnlyAction("goal", "start", scope, env)?.message;
+		// Gate `start` unconditionally (schedule precedent: previews of actions
+		// without a dryRun contract are gated).
+		if (subcommand === "start") return assertRootOnlyAction("goal", "start", scope, env)?.message;
 		return undefined;
 	}
 	// schedule: every subAction path mutates (add is the default); previews of
@@ -320,7 +402,9 @@ export function rootGateBlockReason(params: RootGateParamsLike, env: NodeJS.Proc
 	// goal force:true (top-level or config) is its own gated token.
 	if (action === "goal" && force) effectiveSub = "force";
 	// create/update/config/settings/autonomy below share scope gating.
-	if (isPreview && action === "create") return undefined;
+	// create: NO preview exemption — handleCreate honors only top-level
+	// params.dryRun (management.ts), so a config-carrier "preview" writes the
+	// user tier for real (w5a).
 	const reason = assertRootOnlyAction(action, effectiveSub, scope, env);
 	return reason?.message;
 }

package/src/extension/team-tool/inspect.ts

@@ -4,6 +4,7 @@ import type { TeamToolParamsValue } from "../../schema/team-tool-schema.ts";
 import { readEventsCursor } from "../../state/event-log/event-log.ts";
 import { loadRunManifestById } from "../../state/stores/state-store.ts";
 import { aggregateUsage, formatCostReport, formatUsage } from "../../state/usage.ts";
+import { sanitizeUntrustedLine } from "../../utils/visual.ts";
 import { locateRunCwd } from "../team-tool.ts";
 import type { PiTeamsToolResult } from "../tool-result.ts";
 import { result, type TeamContext } from "./context.ts";
@@ -36,7 +37,9 @@ export function handleEvents(params: TeamToolParamsValue, ctx: TeamContext): PiT
 		...(events.length
 			? events.map(
 					(event) =>
-						`${event.time} ${event.type}${event.taskId ? ` ${event.taskId}` : ""}${event.message ? `: ${event.message}` : ""}${event.data ? ` ${JSON.stringify(event.data)}` : ""}`,
+						// w7a-render: event.message can embed child-stderr excerpts on worker
+						// failure — sanitize before it becomes tool-result content rendered by the team card.
+						`${event.time} ${event.type}${event.taskId ? ` ${event.taskId}` : ""}${event.message ? `: ${sanitizeUntrustedLine(event.message)}` : ""}${event.data ? ` ${JSON.stringify(event.data)}` : ""}`,
 				)
 			: ["(none)"]),
 	];
@@ -102,7 +105,10 @@ export function handleSummary(params: TeamToolParamsValue, ctx: TeamContext): Pi
 		"",
 		"Tasks:",
 		...loaded.tasks.map(
-			(task) => `- ${task.id}: ${task.status} (${task.role} -> ${task.agent})${task.error ? ` - ${task.error}` : ""}`,
+			// w7a-render: task.error can embed child-stderr excerpts on worker failure —
+			// sanitize before it becomes tool-result content rendered by the team card.
+			(task) =>
+				`- ${task.id}: ${task.status} (${task.role} -> ${task.agent})${task.error ? ` - ${sanitizeUntrustedLine(task.error)}` : ""}`,
 		),
 	];
 	return result(lines.join("\n"), {

package/src/extension/team-tool/lifecycle-actions.ts

@@ -16,7 +16,7 @@ import { cleanupRunWorktrees } from "../../worktree/cleanup.ts";
 import { listImportedRuns } from "../import-index.ts";
 import { runCompareBundle } from "../run-compare.ts";
 import { exportRunBundle } from "../run-export.ts";
-import { importRunBundle } from "../run-import.ts";
+import { importRunBundle, sanitizeImportedText } from "../run-import.ts";
 import { pruneFinishedRuns } from "../run-maintenance.ts";
 import { locateRunCwd } from "../team-tool.ts";
 import type { PiTeamsToolResult } from "../tool-result.ts";
@@ -56,12 +56,19 @@ export function handleWorktrees(params: TeamToolParamsValue, ctx: TeamContext):
 
 export function handleImports(_params: TeamToolParamsValue, ctx: TeamContext): PiTeamsToolResult {
 	const imports = listImportedRuns(ctx.cwd);
+	// W7B (imported-manifest-goal-raw-render): bundle-authored fields (status,
+	// team, workflow, goal) are untrusted repo/plant content re-read from disk
+	// on every listing (readEntry validates types only) — render through the
+	// sanitizeImportedText seam so forged multi-line entries, injected
+	// directives, ANSI escapes and fake fences cannot enter the parent-LLM
+	// tool-result context. runId is charset-guarded (isSafePathId); the Bundle
+	// / Summary paths are root-joined from that guarded id.
 	const lines = [
 		"Imported pi-crew runs:",
 		...(imports.length
 			? imports.map(
 					(entry) =>
-						`- ${entry.runId} (${entry.scope})${entry.status ? ` [${entry.status}]` : ""} ${entry.team ?? "unknown"}/${entry.workflow ?? "none"}: ${entry.goal ?? ""}\n  Bundle: ${entry.bundlePath}\n  Summary: ${entry.summaryPath}`,
+						`- ${entry.runId} (${entry.scope})${entry.status ? ` [${sanitizeImportedText(entry.status, 24)}]` : ""} ${sanitizeImportedText(entry.team ?? "unknown", 64)}/${sanitizeImportedText(entry.workflow ?? "none", 64)}: ${sanitizeImportedText(entry.goal)}\n  Bundle: ${entry.bundlePath}\n  Summary: ${entry.summaryPath}`,
 				)
 			: ["- (none)"]),
 	];