pi-crew 0.11.49 → 0.11.51

package/src/extension/team-tool.ts

@@ -11,12 +11,18 @@ import type { executeTeamRun as _executeTeamRunFn } from "../runtime/team-runner
 import type { TeamToolParamsValue } from "../schema/team-tool-schema.ts";
 import { TEAM_TERMINAL_TASK_STATUSES } from "../state/contracts.ts";
 import { withRunLock } from "../state/coordination/locks.ts";
-import { replayPendingMailboxMessages } from "../state/coordination/mailbox.ts";
+import { replayPendingMailboxMessages, signSteeringEntry } from "../state/coordination/mailbox.ts";
 import { isTaskClaimExpired } from "../state/coordination/task-claims.ts";
 import { appendEventAsync, appendEventFireAndForget } from "../state/event-log/event-log.ts";
 import { ACTIVE_RUN_STALE_MS, activeRunEntries, registerActiveRun, unregisterActiveRun } from "../state/stores/active-run-registry.ts";
 import { writeArtifact } from "../state/stores/artifact-store.ts";
-import { loadRunManifestById, saveRunManifestAsync, saveRunTasks, updateRunStatus } from "../state/stores/state-store.ts";
+import {
+	loadRunManifestById,
+	resolveMaxTasksPerRunAdmissionCap,
+	saveRunManifestAsync,
+	saveRunTasks,
+	updateRunStatus,
+} from "../state/stores/state-store.ts";
 import type { ArtifactDescriptor, TeamRunManifest, TeamTaskState } from "../state/types.ts";
 import { allTeams, discoverTeams } from "../teams/discover-teams.ts";
 import type { TeamConfig } from "../teams/team-config.ts";
@@ -398,6 +404,16 @@ function resumeLivenessRefusal(manifest: TeamRunManifest, tasks: TeamTaskState[]
 	return undefined;
 }
 
+/** F1-mirror (adoptSpecialKindRunForResume in-lock liveness re-check): thrown
+ * by the special-kind (goal-loop / dynamic-workflow) resume adopt path when the
+ * freshly re-read LOCKED state shows the run LIVE — a concurrent session
+ * adopted + registered it between this session's pre-lock gate (handleResume)
+ * and this lock acquisition. Mirrors the static LOCK-2 refusal: force:true
+ * bypasses OWNERSHIP only, never LIVENESS (G12). The resume arms catch this
+ * BEFORE any adoption side effect and surface it as a typed error result — no
+ * manifest write, no ownership flip, no registry write, no engine re-dispatch. */
+class ResumeLivenessRefusedError extends Error {}
+
 /** G11 (SDD-3 W-C WI-2): adopt ownership + refresh heartbeat for a special-kind
  * (goal-loop / dynamic-workflow) resume, under the same per-run lock semantics
  * as the static path. Mirrors the static path's B1 adoption (battery 2026-08-18
@@ -412,6 +428,17 @@ async function adoptSpecialKindRunForResume(
 	return await withRunLock(manifest, async () => {
 		const fresh = loadRunManifestById(manifest.cwd, manifest.runId);
 		const base = fresh?.manifest ?? manifest;
+		// F1 mirror (LOCK-2 in-lock liveness re-check, static path): the pre-lock
+		// gate in handleResume raced concurrent adoption — between that load and
+		// this lock acquisition another session may have adopted and REGISTERED
+		// the run (registerActiveRun + ownerSessionId). Re-check liveness against
+		// the LOCKED state BEFORE any adoption mutation (async drop, status flip,
+		// owner adopt, registry write, engine re-dispatch); force:true bypasses
+		// OWNERSHIP only, never LIVENESS (G12).
+		const lockedLiveness = resumeLivenessRefusal(base, fresh?.tasks ?? []);
+		if (lockedLiveness) {
+			throw new ResumeLivenessRefusedError(lockedLiveness);
+		}
 		// W-C2 (SDD-4 WI-6): drop the dispatch-time detached-runner pointer. Resume
 		// arms re-execute IN THIS session's process (runGoalLoop /
 		// runDynamicWorkflow) — no runner is re-spawned — yet goal-wrapped runs carry
@@ -474,7 +501,20 @@ async function resumeDynamicWorkflowRun(
 		roles: [{ name: "worker", agent: params.agent ?? "executor" }],
 		workspaceMode: "single",
 	};
-	const adopted = await adoptSpecialKindRunForResume(manifest, "dynamic-workflow", ctx);
+	// In-lock liveness refusal surface (F1 mirror): adoptSpecialKindRunForResume
+	// re-checks liveness under the run lock and throws ResumeLivenessRefusedError
+	// BEFORE any adoption mutation — no manifest write, no ownership flip, no
+	// registry entry, no engine dispatch. Surface the exact refusal message the
+	// static LOCK-2 path returns.
+	let adopted: TeamRunManifest;
+	try {
+		adopted = await adoptSpecialKindRunForResume(manifest, "dynamic-workflow", ctx);
+	} catch (error) {
+		if (error instanceof ResumeLivenessRefusedError) {
+			return result(error.message, { action: "resume", status: "error", runId: manifest.runId }, true);
+		}
+		throw error;
+	}
 	registerActiveRun(adopted);
 	// CORE-8 mirror: unified deadline (params.timeoutMs > config.maxRunMinutes > 1h default).
 	const dwfDeadline = resolveRunDeadline(ctx, params);
@@ -547,7 +587,16 @@ async function resumeGoalLoopRun(params: TeamToolParamsValue, ctx: TeamContext,
 			true,
 		);
 	}
-	const adopted = await adoptSpecialKindRunForResume(manifest, "goal-loop", ctx);
+	// In-lock liveness refusal surface (F1 mirror) — same contract as the DWF arm.
+	let adopted: TeamRunManifest;
+	try {
+		adopted = await adoptSpecialKindRunForResume(manifest, "goal-loop", ctx);
+	} catch (error) {
+		if (error instanceof ResumeLivenessRefusedError) {
+			return result(error.message, { action: "resume", status: "error", runId: manifest.runId }, true);
+		}
+		throw error;
+	}
 	// LAZY: the runner import stays after the state check for fast failure.
 	const { runGoalLoop } = await import("../runtime/goal-workflow/goal-loop-runner.ts");
 	registerActiveRun(adopted);
@@ -714,6 +763,25 @@ export async function handleResume(params: TeamToolParamsValue, ctx: TeamContext
 				payload: result(lockedLiveness, { action: "resume", status: "error", runId: lockedManifest.runId }, true),
 			};
 		}
+		// resume-skips-maxtasks-admission fix: limits.maxTasksPerRun is an ADMISSION
+		// invariant, not a creation-only one. The disk-loaded tasks.json is untrusted
+		// persisted state (worker-writable in single-workspace project state —
+		// loadTasksWithRecovery returns it verbatim with no count bound), so a
+		// poisoned file inflated past the ceiling must be refused here exactly as
+		// createRunManifest refuses the same cardinality at creation — BEFORE any
+		// recovery/reset mutation, status flip, or dispatch. Same contract as the
+		// creation gate: name the config key, the cap, and the actual count.
+		const admissionCap = resolveMaxTasksPerRunAdmissionCap(ctx.cwd);
+		if (lockedTasks.length > admissionCap) {
+			return {
+				kind: "blocked" as const,
+				payload: result(
+					`Refusing to resume run ${lockedManifest.runId}: tasks.json holds ${lockedTasks.length} tasks, exceeding limits.maxTasksPerRun=${admissionCap}. Persisted task state is untrusted (worker-writable in single-workspace project state); reduce the task count or raise limits.maxTasksPerRun.`,
+					{ action: "resume", status: "error", runId: lockedManifest.runId },
+					true,
+				),
+			};
+		}
 		const loadedConfig = loadConfig(ctx.cwd);
 		const recovered = await recoverCheckpointedTasks(lockedManifest, lockedTasks);
 		const resumeManifest = recovered.manifest;
@@ -896,28 +964,55 @@ export async function handleResume(params: TeamToolParamsValue, ctx: TeamContext
 	// handleRun (which never wraps executeTeamRun in an outer lock).
 	if (decision.kind === "blocked") return decision.payload;
 
-	const executed = await executeTeamRun({
-		manifest: decision.runtimeManifest,
-		tasks: decision.resetTasks,
-		team,
-		workflow,
-		agents,
-		executeWorkers: decision.executeWorkers,
-		limits: decision.executedConfig.limits,
-		runtime: decision.runtime,
-		runtimeConfig: decision.executedConfig.runtime,
-		parentContext: buildParentContext(ctx),
-		parentModel: resolveParentModel(ctx.model),
-		modelRegistry: ctx.modelRegistry,
-		modelOverride: params.model,
-		skillOverride: decision.resumeSkillOverride,
-		signal: ctx.signal,
-		reliability: decision.executedConfig.reliability,
-		metricRegistry: ctx.metricRegistry,
-		workspaceId: ctx.sessionId ?? ctx.cwd,
-		// Finding 8: resume is the legitimate terminal-exit flow.
-		isResume: true,
-	});
+	// resume-disarms-run-budget-enforcement fix (handleResume re-arm): the static
+	// resume re-entry previously forwarded NEITHER the persisted budget fields
+	// NOR a unified deadline — enforceRunBudget gates solely on input.budgetTotal
+	// and resolveRunDeadline was armed only at the dispatch/DWF/goal-resume
+	// sites, so a paused-and-resumed run escaped both operator bounds entirely
+	// (disarmed). Mirror the inline dispatch path (run.ts CORE-8 deadline) and
+	// the detached re-entry (background-runner.ts manifest.budget* forwarding):
+	// arm the same unified deadline a fresh run gets (params.timeoutMs >
+	// config.limits.maxRunMinutes > 1h default — elapsed wall-clock counts
+	// against it) and re-forward the manifest budget persisted at the original
+	// dispatch. team-runner additionally re-arms missing budget fields from the
+	// manifest as defense-in-depth, so the two layers cannot cancel out.
+	const resumeDeadline = resolveRunDeadline(ctx, params, decision.executedConfig);
+	let executed: Awaited<ReturnType<typeof executeTeamRun>>;
+	try {
+		executed = await executeTeamRun({
+			manifest: decision.runtimeManifest,
+			tasks: decision.resetTasks,
+			team,
+			workflow,
+			agents,
+			executeWorkers: decision.executeWorkers,
+			limits: decision.executedConfig.limits,
+			runtime: decision.runtime,
+			runtimeConfig: decision.executedConfig.runtime,
+			parentContext: buildParentContext(ctx),
+			parentModel: resolveParentModel(ctx.model),
+			modelRegistry: ctx.modelRegistry,
+			modelOverride: params.model,
+			skillOverride: decision.resumeSkillOverride,
+			signal: resumeDeadline.signal,
+			reliability: decision.executedConfig.reliability,
+			metricRegistry: ctx.metricRegistry,
+			workspaceId: ctx.sessionId ?? ctx.cwd,
+			// Finding 8: resume is the legitimate terminal-exit flow.
+			isResume: true,
+			// resume-disarms fix: re-forward the operator's persisted spend cap —
+			// this call site previously dropped the budget fields on the floor.
+			...(decision.runtimeManifest.budgetTotal !== undefined ? { budgetTotal: decision.runtimeManifest.budgetTotal } : {}),
+			...(decision.runtimeManifest.budgetWarning !== undefined ? { budgetWarning: decision.runtimeManifest.budgetWarning } : {}),
+			...(decision.runtimeManifest.budgetAbort !== undefined ? { budgetAbort: decision.runtimeManifest.budgetAbort } : {}),
+			...(decision.runtimeManifest.budgetUnlimited !== undefined
+				? { budgetUnlimited: decision.runtimeManifest.budgetUnlimited }
+				: {}),
+		});
+	} finally {
+		// RC-02: clear the resumed-execution deadline timer (idempotent).
+		clearTimeout(resumeDeadline.timer);
+	}
 	// RELIABILITY FIX 2026-10-10 (bug #3, wave-2/wave-3 observations): the old
 	// message printed a bare "Status: completed" which read as "the whole run
 	// just finished" even when the resume had re-queued real work that kept
@@ -1020,7 +1115,13 @@ export function handleSteer(params: TeamToolParamsValue, ctx: TeamContext): PiTe
 		// guards against future changes to task-id generation (e.g. if it ever
 		// accepted user input).
 		const safeSteeringPath = resolveRealContainedPath(steeringDir, `${taskId}.jsonl`);
-		fs.appendFileSync(safeSteeringPath, JSON.stringify({ type: "steer", message, ts: new Date().toISOString() }) + "\n");
+		// w1a sender binding: the steering file is same-uid writable — the line
+		// carries this process's Ed25519 signature (worker pollSteering drops
+		// unauthenticated lines).
+		fs.appendFileSync(
+			safeSteeringPath,
+			JSON.stringify(signSteeringEntry({ type: "steer", message, ts: new Date().toISOString() })) + "\n",
+		);
 	} catch {
 		// Best-effort: file write failure doesn't block the steer from pending array
 	}

package/src/observability/exporters/otlp-exporter.ts

@@ -10,6 +10,23 @@ import type { MetricExporter } from "./adapter.ts";
 
 const gzipAsync = promisify(gzip);
 
+/**
+ * Log-safe endpoint form: origin only — never path, query, or userinfo.
+ * Mirrors the webhook-notify.ts `safeUrlForLog` control: the OTLP endpoint may
+ * carry embedded credentials (`http://user:pass@host/...` is accepted by the
+ * config schema pattern), and raw interpolation into log/throw text would leak
+ * those credentials to host stderr/session logs.
+ */
+function safeEndpointForLog(endpoint: string): string {
+	try {
+		return new URL(bracketIpv6InUrl(endpoint)).origin;
+	} catch {
+		// Unparseable URL: still strip any embedded userinfo before echoing the
+		// raw text into an error message.
+		return endpoint.replace(/^([a-zA-Z][a-zA-Z\d+\-.]*:)\/\/[^/?#]*@/, "$1//[redacted]@");
+	}
+}
+
 /**
  * SSRF protection: validate that an OTLP endpoint URL does not target
  * private/reserved networks or dangerous protocols.
@@ -26,7 +43,7 @@ export function validateEndpoint(endpoint: string): void {
 	try {
 		url = new URL(endpoint);
 	} catch {
-		throw new Error(`Invalid OTLP endpoint URL: ${endpoint}`);
+		throw new Error(`Invalid OTLP endpoint URL: ${safeEndpointForLog(endpoint)}`);
 	}
 
 	// Only allow http and https protocols
@@ -34,11 +51,20 @@ export function validateEndpoint(endpoint: string): void {
 		throw new Error(`OTLP endpoint must use http:// or https:// protocol, got: ${url.protocol}`);
 	}
 
+	// Credentials embedded in the URL would leak into logs — refuse them
+	// (pass them via the `headers` option instead), mirroring the webhook
+	// sink (webhook-notify.ts). Checked BEFORE every classification error so
+	// no later throw message can ever embed a credential-bearing endpoint:
+	// all messages below render the origin-only `safeEndpointForLog` form.
+	if (url.username || url.password) {
+		throw new Error(`OTLP endpoint must not embed credentials (userinfo) — pass them via headers instead: ${url.origin}`);
+	}
+
 	const hostname = url.hostname.toLowerCase();
 
 	// Reject known localhost names
 	if (hostname === "localhost" || hostname.endsWith(".localhost")) {
-		throw new Error(`OTLP endpoint must not target localhost: ${endpoint}`);
+		throw new Error(`OTLP endpoint must not target localhost: ${safeEndpointForLog(endpoint)}`);
 	}
 
 	// Reject IPv6 loopback and private
@@ -46,38 +72,38 @@ export function validateEndpoint(endpoint: string): void {
 		const bare = hostname.replace(/^\[|\]$/g, "");
 		const lower = bare.toLowerCase();
 		if (lower === "::1") {
-			throw new Error(`OTLP endpoint must not target loopback address: ${endpoint}`);
+			throw new Error(`OTLP endpoint must not target loopback address: ${safeEndpointForLog(endpoint)}`);
 		}
 		// Unique Local Addresses (fc00::/7) — fd and fc prefixes
 		if (lower.startsWith("fd") || lower.startsWith("fc")) {
-			throw new Error(`OTLP endpoint must not target private IPv6 address: ${endpoint}`);
+			throw new Error(`OTLP endpoint must not target private IPv6 address: ${safeEndpointForLog(endpoint)}`);
 		}
 		// Link-Local (fe80::/10) — fe8x, fe9x, feax, febx prefixes
 		if (lower.startsWith("fe8") || lower.startsWith("fe9") || lower.startsWith("fea") || lower.startsWith("feb")) {
-			throw new Error(`OTLP endpoint must not target IPv6 link-local address: ${endpoint}`);
+			throw new Error(`OTLP endpoint must not target IPv6 link-local address: ${safeEndpointForLog(endpoint)}`);
 		}
 		// Site-Local (fec0::/10) — deprecated but still routable on misconfigured networks
 		if (lower.startsWith("fec") || lower.startsWith("fed") || lower.startsWith("fee") || lower.startsWith("fef")) {
-			throw new Error(`OTLP endpoint must not target IPv6 site-local address: ${endpoint}`);
+			throw new Error(`OTLP endpoint must not target IPv6 site-local address: ${safeEndpointForLog(endpoint)}`);
 		}
 		// Multicast (ff00::/8) — prefix ff
 		if (lower.startsWith("ff")) {
-			throw new Error(`OTLP endpoint must not target IPv6 multicast address: ${endpoint}`);
+			throw new Error(`OTLP endpoint must not target IPv6 multicast address: ${safeEndpointForLog(endpoint)}`);
 		}
 		// Unspecified address ::
 		if (lower === "::") {
-			throw new Error(`OTLP endpoint must not target IPv6 unspecified address: ${endpoint}`);
+			throw new Error(`OTLP endpoint must not target IPv6 unspecified address: ${safeEndpointForLog(endpoint)}`);
 		}
 		// IPv4-mapped IPv6 (::ffff:x.x.x.x)
 		if (lower.startsWith("::ffff:")) {
-			throw new Error(`OTLP endpoint must not target IPv4-mapped IPv6 address: ${endpoint}`);
+			throw new Error(`OTLP endpoint must not target IPv4-mapped IPv6 address: ${safeEndpointForLog(endpoint)}`);
 		}
 		// G6: catch every literal form the prefix checks above miss —
 		// IPv4-compatible `::a.b.c.d` (e.g. ::127.0.0.1, ::169.254.169.254),
 		// expanded spellings (`0:0:0:0:0:0:0:1`), zone-ids — through the
 		// shared parser, applying the same predicates as the IPv4 branch.
 		if (isPrivateIpv6Literal(bare)) {
-			throw new Error(`OTLP endpoint must not target private/reserved IPv6 address: ${endpoint}`);
+			throw new Error(`OTLP endpoint must not target private/reserved IPv6 address: ${safeEndpointForLog(endpoint)}`);
 		}
 	}
 
@@ -88,27 +114,27 @@ export function validateEndpoint(endpoint: string): void {
 		const octets = [Number(ipv4Match[1]), Number(ipv4Match[2]), Number(ipv4Match[3]), Number(ipv4Match[4])];
 		// 127.x.x.x - loopback
 		if (octets[0] === 127) {
-			throw new Error(`OTLP endpoint must not target loopback address: ${endpoint}`);
+			throw new Error(`OTLP endpoint must not target loopback address: ${safeEndpointForLog(endpoint)}`);
 		}
 		// 10.x.x.x - private class A
 		if (octets[0] === 10) {
-			throw new Error(`OTLP endpoint must not target private network (10.0.0.0/8): ${endpoint}`);
+			throw new Error(`OTLP endpoint must not target private network (10.0.0.0/8): ${safeEndpointForLog(endpoint)}`);
 		}
 		// 172.16.x.x - 172.31.x.x - private class B
 		if (octets[0] === 172 && octets[1] >= 16 && octets[1] <= 31) {
-			throw new Error(`OTLP endpoint must not target private network (172.16.0.0/12): ${endpoint}`);
+			throw new Error(`OTLP endpoint must not target private network (172.16.0.0/12): ${safeEndpointForLog(endpoint)}`);
 		}
 		// 192.168.x.x - private class C
 		if (octets[0] === 192 && octets[1] === 168) {
-			throw new Error(`OTLP endpoint must not target private network (192.168.0.0/16): ${endpoint}`);
+			throw new Error(`OTLP endpoint must not target private network (192.168.0.0/16): ${safeEndpointForLog(endpoint)}`);
 		}
 		// 169.254.x.x - link-local / cloud metadata
 		if (octets[0] === 169 && octets[1] === 254) {
-			throw new Error(`OTLP endpoint must not target link-local/metadata endpoint (169.254.0.0/16): ${endpoint}`);
+			throw new Error(`OTLP endpoint must not target link-local/metadata endpoint (169.254.0.0/16): ${safeEndpointForLog(endpoint)}`);
 		}
 		// 0.x.x.x - this network
 		if (octets[0] === 0) {
-			throw new Error(`OTLP endpoint must not target this-network address (0.0.0.0/8): ${endpoint}`);
+			throw new Error(`OTLP endpoint must not target this-network address (0.0.0.0/8): ${safeEndpointForLog(endpoint)}`);
 		}
 	}
 }
@@ -230,7 +256,7 @@ export async function assertResolvedAddressSafe(endpoint: string): Promise<void>
 	// literal needs no DNS round-trip.
 	if (hostname.startsWith("[")) {
 		if (isPrivateIpv6Literal(hostname)) {
-			throw new Error(`OTLP endpoint targets private/reserved IPv6 literal: ${endpoint}`);
+			throw new Error(`OTLP endpoint targets private/reserved IPv6 literal: ${safeEndpointForLog(endpoint)}`);
 		}
 		return;
 	}
@@ -244,7 +270,9 @@ export async function assertResolvedAddressSafe(endpoint: string): Promise<void>
 	}
 	for (const { address } of addresses) {
 		if (isPrivateIpAddress(address)) {
-			throw new Error(`OTLP endpoint resolves to private/reserved address ${address} (DNS rebinding blocked): ${endpoint}`);
+			throw new Error(
+				`OTLP endpoint resolves to private/reserved address ${address} (DNS rebinding blocked): ${safeEndpointForLog(endpoint)}`,
+			);
 		}
 	}
 }
@@ -411,12 +439,34 @@ export class OTLPExporter implements MetricExporter {
 					},
 					body,
 					signal: controller.signal,
+					// SSRF (security review MEDIUM): redirect:"follow" (the undici
+					// default) would chase up to 20 hops WITHOUT re-running either
+					// guard — validateEndpoint and assertResolvedAddressSafe bind ONLY
+					// to the configured endpoint, so a 302 from the collector reaches
+					// loopback / RFC1918 / 169.254.169.254 cloud metadata, and a 307 on
+					// Node >=24 REPLAYS the gzipped body + custom headers there.
+					// Manual mode surfaces any 3xx as a failed push below, exactly like
+					// the sibling webhook sink (webhook-notify.ts redirect handling).
+					redirect: "manual",
 				});
+				// 3xx under redirect:"manual" = a redirect we REFUSE to follow (the
+				// guards validated the configured URL, never the hop target). The
+				// Location target is never contacted — permanent failure for this push.
+				if (response.status >= 300 && response.status < 400) {
+					logInternalError(
+						"otlp-export-http",
+						new Error(`refused redirect HTTP ${response.status} (SSRF guard — redirects are not followed)`),
+						`endpoint=${safeEndpointForLog(this.opts.endpoint)}`,
+					);
+					return;
+				}
 				if (!response.ok) {
 					logInternalError(
 						"otlp-export-http",
 						new Error(`HTTP ${response.status}: ${response.statusText}`),
-						`endpoint=${this.opts.endpoint}`,
+						// Origin only: never render path/query/userinfo into logs
+						// (credentials embedded in the endpoint must not reach stderr).
+						`endpoint=${safeEndpointForLog(this.opts.endpoint)}`,
 					);
 				}
 			} finally {

package/src/prompt/message-tool.ts

@@ -27,6 +27,7 @@
 import { createHash } from "node:crypto";
 import { type Static, Type } from "@sinclair/typebox";
 import { getCrewEnv } from "../config/env-vars.ts";
+import { resolvedChildBrokerCreds } from "../runtime/broker/crew-broker-child.ts";
 import { CrewBrokerClient } from "../runtime/broker/crew-broker-client.ts";
 
 export const PI_CREW_MSG_ENABLED_ENV = "PI_CREW_MSG_ENABLED";
@@ -166,18 +167,28 @@ export function createMessageTool(deps: MessageToolDeps = {}): MessageTool {
 					text: "[message] rate-limited (10 messages/minute) — this message was NOT sent; include the note in your final result instead.",
 				};
 			}
-			const runId = get("PI_CREW_BROKER_RUN_ID") ?? "";
-			const taskId = get("PI_CREW_TASK_ID") ?? get("PI_CREW_BROKER_TASK_ID") ?? "";
-			const socketPath = get("PI_CREW_BROKER_SOCKET") ?? "";
-			const token = get("PI_CREW_BROKER_TOKEN") ?? "";
+			const taskId0 = get("PI_CREW_TASK_ID") ?? get("PI_CREW_BROKER_TASK_ID") ?? "";
+			let runId = get("PI_CREW_BROKER_RUN_ID") ?? "";
+			let socketPath = get("PI_CREW_BROKER_SOCKET") ?? "";
+			let token = get("PI_CREW_BROKER_TOKEN") ?? "";
+			// LOW-1 guard closure (2026-10-30): bridge to the fd3-resolved creds when
+			// the env token is deliberately absent (default-on fd3 route).
+			if (!token) {
+				const creds = await resolvedChildBrokerCreds();
+				if (creds && creds.taskId === taskId0) {
+					token = creds.token;
+					runId = runId || creds.runId;
+					socketPath = socketPath || creds.socketPath;
+				}
+			}
 			const client = deps.makeBrokerClient
-				? deps.makeBrokerClient({ runId, taskId, socketPath, token })
+				? deps.makeBrokerClient({ runId, taskId: taskId0, socketPath, token })
 				: (() => {
 						// Production: the broker credentials are only present for
 						// broker-eligible workers (child-pi-spawn). Scaffold/mock
 						// workers fast-fail with a structured notice, never a hang.
-						if (!runId || !taskId || !socketPath || !token) return null;
-						return new CrewBrokerClient({ runId, taskId, socketPath, token });
+						if (!runId || !taskId0 || !socketPath || !token) return null;
+						return new CrewBrokerClient({ runId, taskId: taskId0, socketPath, token });
 					})();
 			if (!client) return brokerUnavailable();
 			// R6-6: stable requestId (idempotency across retries) + explicit
@@ -188,7 +199,7 @@ export function createMessageTool(deps: MessageToolDeps = {}): MessageTool {
 				body: params.body,
 				requestId: computeMessageRequestId({
 					runId,
-					taskId,
+					taskId: taskId0,
 					to: params.to,
 					kind: params.kind,
 					body: params.body,