pi-crew 0.11.5 → 0.11.7

package/src/extension/team-tool.ts

@@ -12,11 +12,14 @@ import type { TeamToolParamsValue } from "../schema/team-tool-schema.ts";
 import { TEAM_TERMINAL_TASK_STATUSES } from "../state/contracts.ts";
 import { withRunLock } from "../state/coordination/locks.ts";
 import { replayPendingMailboxMessages } from "../state/coordination/mailbox.ts";
+import { isTaskClaimExpired } from "../state/coordination/task-claims.ts";
 import { appendEventAsync, appendEventFireAndForget } from "../state/event-log/event-log.ts";
+import { ACTIVE_RUN_STALE_MS, activeRunEntries, registerActiveRun, unregisterActiveRun } from "../state/stores/active-run-registry.ts";
 import { writeArtifact } from "../state/stores/artifact-store.ts";
 import { loadRunManifestById, saveRunManifestAsync, saveRunTasks, updateRunStatus } from "../state/stores/state-store.ts";
 import type { ArtifactDescriptor, TeamRunManifest, TeamTaskState } from "../state/types.ts";
 import { allTeams, discoverTeams } from "../teams/discover-teams.ts";
+import type { TeamConfig } from "../teams/team-config.ts";
 import { logInternalError } from "../utils/internal-error.ts";
 import { findRepoRoot, projectCrewRoot, userCrewRoot } from "../utils/paths.ts";
 import { resolveRealContainedPath } from "../utils/safe-paths.ts";
@@ -40,6 +43,7 @@ import { buildParentContext, formatScoped, result, type TeamContext } from "./te
 // Lazy-loaded: run.ts pulls in spawnBackgroundTeamRun, resolveCrewRuntime, etc.
 // Static import fails silently in some jiti contexts (child-process), leaving handleRun undefined.
 import type { handleRun as _handleRunFn } from "./team-tool/run.ts";
+import { resolveRunDeadline } from "./team-tool/run-deadline.ts";
 
 type HandleRunFn = typeof _handleRunFn;
 async function handleRun(...args: Parameters<HandleRunFn>): Promise<Awaited<ReturnType<HandleRunFn>>> {
@@ -315,12 +319,318 @@ async function recoverCheckpointedTasks(
 	return { manifest: nextManifest, tasks: nextTasks, recovered };
 }
 
+/** PID liveness probe — same semantics as filterAliveEntries: only ESRCH/ENOENT
+ * mean "process does not exist"; EPERM means alive in another security context. */
+function isPidAliveForResume(pid: number): boolean {
+	try {
+		process.kill(pid, 0);
+		return true;
+	} catch (error) {
+		const code = (error as NodeJS.ErrnoException).code;
+		return code !== "ESRCH" && code !== "ENOENT";
+	}
+}
+
+/** G12 (SDD-3 W-C WI-1): liveness evidence for a run being resumed. Returns a
+ * human-readable refusal message when the run is LIVE, undefined when it is
+ * safe to resume. force:true bypasses OWNERSHIP, never LIVENESS — callers must
+ * refuse regardless of force when this returns a message.
+ *
+ * Three independent signals (any one ⇒ live):
+ * 1. active-run-registry entry (activeRunEntries already applies the full
+ *    filter: terminal status, dead async PID, >30-min staleness);
+ * 2. a running task holding a PRESENT, UNEXPIRED worker claim (task-claims
+ *    lease). Review fix 2026-10-01 (MAJOR): the claim must EXIST — coalesced
+ *    dispatch (run-coalesced-task-group.ts) and the task-graph scheduler mark
+ *    tasks running WITHOUT claims, so counting claim-less running tasks as
+ *    live permanently refused resume of crashed coalesced runs (with a
+ *    misleading "until undefined" message). Runs dispatched by real engines
+ *    carry the registry (signal 1) / async-PID (signal 3) liveness instead;
+ * 3. the manifest's detached async PID is alive and the manifest is fresh
+ *    (covers goal-loop/DWF background runs whose registry entry was pruned).
+ * Terminal runs (completed/failed/cancelled) never count as live via signal 3
+ * — a lingering post-finalize PID must not block legitimate re-runs. */
+function resumeLivenessRefusal(manifest: TeamRunManifest, tasks: TeamTaskState[]): string | undefined {
+	const runId = manifest.runId;
+	const registryEntry = activeRunEntries().find((entry) => entry.runId === runId);
+	if (registryEntry) {
+		return [
+			`Run ${runId} is still live (active-run registry, last heartbeat ${registryEntry.updatedAt}) — resume refused to prevent double-dispatch.`,
+			`Current status: ${manifest.status}. Wait for it to finish, or cancel it first (team action=cancel runId=${runId}).`,
+			"force:true bypasses OWNERSHIP checks only — it can never bypass this liveness check.",
+		].join("\n");
+	}
+	const claimed = tasks.find(
+		// Review fix 2026-10-01 (MAJOR): require the claim to EXIST — see the
+		// signal-2 note above (claim-less running tasks come from coalesced
+		// dispatch / scheduler markings and must not read as permanently live).
+		(task) => task.status === "running" && task.claim !== undefined && !isTaskClaimExpired(task.claim),
+	);
+	if (claimed) {
+		return [
+			`Run ${runId} is still live (task '${claimed.id}' holds an unexpired worker claim until ${claimed.claim?.leasedUntil}) — resume refused to prevent double-dispatch.`,
+			`Current status: ${manifest.status}. Wait for the worker to finish, or cancel the run first (team action=cancel runId=${runId}).`,
+			"force:true bypasses OWNERSHIP checks only — it can never bypass this liveness check.",
+		].join("\n");
+	}
+	const pid = manifest.async?.pid;
+	if (
+		typeof pid === "number" &&
+		Number.isInteger(pid) &&
+		pid > 0 &&
+		manifest.status !== "completed" &&
+		manifest.status !== "failed" &&
+		manifest.status !== "cancelled"
+	) {
+		const updatedAt = Date.parse(manifest.updatedAt);
+		// NIT 1 fix: shared registry constant — the resume horizon can never drift
+		// from filterAliveEntries' staleness horizon.
+		const fresh = Number.isFinite(updatedAt) && Date.now() - updatedAt <= ACTIVE_RUN_STALE_MS;
+		if (fresh && isPidAliveForResume(pid)) {
+			return [
+				`Run ${runId} is still live (background process PID ${pid} is alive) — resume refused to prevent double-dispatch.`,
+				`Current status: ${manifest.status}. Wait for the background run to finish, or cancel it first (team action=cancel runId=${runId}).`,
+				"force:true bypasses OWNERSHIP checks only — it can never bypass this liveness check.",
+			].join("\n");
+		}
+	}
+	return undefined;
+}
+
+/** G11 (SDD-3 W-C WI-2): adopt ownership + refresh heartbeat for a special-kind
+ * (goal-loop / dynamic-workflow) resume, under the same per-run lock semantics
+ * as the static path. Mirrors the static path's B1 adoption (battery 2026-08-18
+ * case b): a force-resumed run must not keep its dead original ownerSessionId,
+ * or a third session's orphan-scan cancels the live resumed run. The adopted
+ * manifest PRESERVES the original runKind — the whole point of the branch. */
+async function adoptSpecialKindRunForResume(
+	manifest: TeamRunManifest,
+	runKind: "goal-loop" | "dynamic-workflow",
+	ctx: TeamContext,
+): Promise<TeamRunManifest> {
+	return await withRunLock(manifest, async () => {
+		const fresh = loadRunManifestById(manifest.cwd, manifest.runId);
+		const base = fresh?.manifest ?? manifest;
+		// W-C2 (SDD-4 WI-6): drop the dispatch-time detached-runner pointer. Resume
+		// arms re-execute IN THIS session's process (runGoalLoop /
+		// runDynamicWorkflow) — no runner is re-spawned — yet goal-wrapped runs carry
+		// `async: { pid }` from their original background spawn. A dead pid on an
+		// adopted "running" manifest is exactly the state that
+		// transitionStaleAsyncUnderLock (status.ts) flips to failed on the next
+		// status poll ("Async process stale: process does not exist"). The drop is
+		// audited on the run.resume_requested event (clearedAsyncPid).
+		const adoptedBase: TeamRunManifest = { ...base };
+		const staleAsyncPid = adoptedBase.async?.pid;
+		delete adoptedBase.async;
+		const adopted: TeamRunManifest = {
+			...adoptedBase,
+			// WI-2 (G11): keep the ORIGINAL runKind — an accidental fallback to
+			// "team-run" would route the NEXT resume through the static path.
+			runKind,
+			// Mark running at adoption: registerActiveRun refuses terminal
+			// entries, and the run IS executing from this dispatch until terminal.
+			// allowTerminalExit mirrors the static resume path (finding 8 write
+			// guard — resume is the one legitimate terminal-exit flow).
+			status: "running",
+			summary: `Resuming ${runKind} run.`,
+			updatedAt: new Date().toISOString(),
+			...(ctx.sessionId ? { ownerSessionId: ctx.sessionId } : {}),
+		};
+		await saveRunManifestAsync(adopted, { allowTerminalExit: true });
+		await appendEventAsync(adopted.eventsPath, {
+			type: "run.resume_requested",
+			runId: adopted.runId,
+			data: { runKind, action: "resume", ...(staleAsyncPid !== undefined ? { clearedAsyncPid: staleAsyncPid } : {}) },
+		});
+		return adopted;
+	});
+}
+
+/** G11 (SDD-3 W-C WI-2): resume arm for runKind="dynamic-workflow" — mirrors
+ * run.ts's DWF dispatch (:390-435): re-synthesize the dynamic team, adopt the
+ * run, then hand off to runDynamicWorkflow (which hydrates the dwf-checkpoint
+ * state, dwf-runner.ts round-18 P2-3). The static team lookup CANNOT resolve
+ * the synthetic `dwf-*` team, which is why this branch exists. */
+async function resumeDynamicWorkflowRun(
+	params: TeamToolParamsValue,
+	ctx: TeamContext,
+	manifest: TeamRunManifest,
+): Promise<PiTeamsToolResult> {
+	const dwfWorkflow = allWorkflows(discoverWorkflows(ctx.cwd)).find((candidate) => candidate.name === manifest.workflow);
+	if (dwfWorkflow?.runtime !== "dynamic" || !dwfWorkflow?.dynamicScript) {
+		return result(
+			`Workflow '${manifest.workflow ?? ""}' is not a dynamic workflow (runKind=dynamic-workflow); cannot resume run ${manifest.runId}. Fix or restore the workflow file, or re-dispatch with action=run.`,
+			{ action: "resume", status: "error", runId: manifest.runId },
+			true,
+		);
+	}
+	// Re-synthesize the dynamic team (§0c C9 mirror of run.ts) — role resolution only.
+	const dwfTeam: TeamConfig = {
+		name: manifest.team,
+		description: `Dynamic workflow run for ${dwfWorkflow.name}`,
+		source: "dynamic",
+		filePath: "<dynamic-workflow>",
+		roles: [{ name: "worker", agent: params.agent ?? "executor" }],
+		workspaceMode: "single",
+	};
+	const adopted = await adoptSpecialKindRunForResume(manifest, "dynamic-workflow", ctx);
+	registerActiveRun(adopted);
+	// CORE-8 mirror: unified deadline (params.timeoutMs > config.maxRunMinutes > 1h default).
+	const dwfDeadline = resolveRunDeadline(ctx, params);
+	try {
+		// LAZY: defer dynamic import of the DWF runner to its call site (mirrors run.ts:399).
+		const { runDynamicWorkflow } = await import("../runtime/goal-workflow/dynamic-workflow-runner.ts");
+		const dwfResult = await runDynamicWorkflow({
+			manifest: adopted,
+			workflow: dwfWorkflow as import("../workflows/workflow-config.ts").DynamicWorkflowConfig,
+			team: dwfTeam,
+			signal: dwfDeadline.signal,
+			modelOverride: params.model,
+			tokenBudget:
+				params.tokenBudget ?? (dwfWorkflow as import("../workflows/workflow-config.ts").DynamicWorkflowConfig).maxTokenBudget,
+		});
+		await saveRunManifestAsync(dwfResult.manifest);
+		return result(
+			[
+				`Resumed dynamic-workflow run ${dwfResult.manifest.runId}.`,
+				`Status: ${dwfResult.manifest.status}`,
+				dwfResult.manifest.summary ? `Result: ${dwfResult.manifest.summary}` : undefined,
+			]
+				.filter((line): line is string => line !== undefined)
+				.join("\n"),
+			{
+				action: "resume",
+				status: dwfResult.manifest.status === "failed" ? "error" : "ok",
+				runId: dwfResult.manifest.runId,
+				artifactsRoot: dwfResult.manifest.artifactsRoot,
+			},
+			dwfResult.manifest.status === "failed",
+		);
+	} catch (runnerError) {
+		// Round-11 runtime-fix mirror (run.ts): persist the failure instead of
+		// leaving the manifest at its pre-resume status forever.
+		const failureReason = runnerError instanceof Error ? runnerError.message : String(runnerError);
+		const failedManifest = {
+			...adopted,
+			status: "failed" as const,
+			summary: `Dynamic workflow '${dwfWorkflow.name}' resume failed: ${failureReason}`.slice(0, 2000),
+			updatedAt: new Date().toISOString(),
+		};
+		await saveRunManifestAsync(failedManifest);
+		return result(
+			`Dynamic workflow '${dwfWorkflow.name}' resume failed: ${failureReason}`,
+			{ action: "resume", status: "error", runId: failedManifest.runId, artifactsRoot: failedManifest.artifactsRoot },
+			true,
+		);
+	} finally {
+		unregisterActiveRun(adopted.runId);
+		clearTimeout(dwfDeadline.timer); // RC-02
+	}
+}
+
+/** G11 (SDD-3 W-C WI-2): resume arm for runKind="goal-loop" — mirrors the
+ * background-runner.ts goal-loop short-circuit (:492): hydrate GoalLoopState,
+ * continue the loop via runGoalLoop, map the goal outcome to a run status. */
+async function resumeGoalLoopRun(params: TeamToolParamsValue, ctx: TeamContext, manifest: TeamRunManifest): Promise<PiTeamsToolResult> {
+	// Check the goal state BEFORE adoption: a missing GoalLoopState is not
+	// resumable at all, so the run must be left untouched (no ownership flip,
+	// no status change) for a clearer retry story.
+	// LAZY: defer heavy goal-loop imports to the call site (mirrors background-runner.ts:498-506).
+	const { GoalStore } = await import("../runtime/goal-workflow/goal-state-store.ts");
+	const store = new GoalStore(manifest.cwd);
+	const goalState = store.load(manifest.runId);
+	if (!goalState) {
+		return result(
+			`runKind="goal-loop" but GoalLoopState '${manifest.runId}' not found (cwd=${manifest.cwd}); cannot resume. The goal state file may have been pruned — start a new goal run instead.`,
+			{ action: "resume", status: "error", runId: manifest.runId },
+			true,
+		);
+	}
+	const adopted = await adoptSpecialKindRunForResume(manifest, "goal-loop", ctx);
+	// LAZY: the runner import stays after the state check for fast failure.
+	const { runGoalLoop } = await import("../runtime/goal-workflow/goal-loop-runner.ts");
+	registerActiveRun(adopted);
+	// CORE-8 mirror (review MINOR 4): honor params.timeoutMs like the DWF arm —
+	// previously this arm resolved the deadline with {} and silently ignored the
+	// caller's timeout override.
+	const goalDeadline = resolveRunDeadline(ctx, params);
+	try {
+		const goalResult = await runGoalLoop({
+			goalState,
+			manifest: adopted,
+			signal: goalDeadline.signal,
+			deps: {
+				discoverAgents: (cwd: string) => allAgents(discoverAgents(cwd)),
+			},
+		});
+		// Fix P1-1 + round-6 #5 mirror (background-runner.ts:525-536): persist the
+		// terminal status reflecting the goal's actual outcome, not a blanket
+		// 'completed'.
+		const goalStatusToRunStatus: Record<string, TeamRunManifest["status"]> = {
+			achieved: "completed",
+			max_turns: "completed",
+			budget_exceeded: "completed",
+			blocked: "blocked",
+			cancelled: "cancelled",
+			paused: "blocked",
+			running: "running",
+		};
+		const runStatus = goalStatusToRunStatus[goalResult.goalState.state] ?? "completed";
+		const finalManifest: TeamRunManifest = {
+			...goalResult.manifest,
+			status: runStatus,
+			updatedAt: new Date().toISOString(),
+		};
+		await saveRunManifestAsync(finalManifest);
+		return result(
+			[
+				`Resumed goal-loop run ${finalManifest.runId}.`,
+				`Status: ${finalManifest.status} (goal state: ${goalResult.goalState.state})`,
+			].join("\n"),
+			{
+				action: "resume",
+				status: runStatus === "failed" ? "error" : "ok",
+				runId: finalManifest.runId,
+				artifactsRoot: finalManifest.artifactsRoot,
+			},
+			runStatus === "failed",
+		);
+	} catch (runnerError) {
+		// Round-11 runtime-fix mirror (DWF arm + review MINOR 1): persist the
+		// failure instead of leaving the adopted manifest stuck at
+		// status:"running" with a live registry entry until the stale horizon.
+		const failureReason = runnerError instanceof Error ? runnerError.message : String(runnerError);
+		const failedManifest = {
+			...adopted,
+			status: "failed" as const,
+			summary: `Goal-loop resume failed: ${failureReason}`.slice(0, 2000),
+			updatedAt: new Date().toISOString(),
+		};
+		await saveRunManifestAsync(failedManifest);
+		return result(
+			`Goal-loop run ${failedManifest.runId} resume failed: ${failureReason}`,
+			{ action: "resume", status: "error", runId: failedManifest.runId, artifactsRoot: failedManifest.artifactsRoot },
+			true,
+		);
+	} finally {
+		unregisterActiveRun(adopted.runId);
+		clearTimeout(goalDeadline.timer); // RC-02
+	}
+}
+
 export async function handleResume(params: TeamToolParamsValue, ctx: TeamContext): Promise<PiTeamsToolResult> {
 	if (!params.runId) return result("Resume requires runId.", { action: "resume", status: "error" }, true);
 	const runCwd = locateRunCwd(params.runId, ctx.cwd);
 	if (!runCwd) return result(`Run '${params.runId}' not found.${RUN_NOT_FOUND_HINT}`, { action: "resume", status: "error" }, true);
 	const loaded = loadRunManifestById(runCwd, params.runId); // NOTE: no withRunLock - best-effort only; concurrent writes may cause inconsistency
 	if (!loaded) return result(`Run '${params.runId}' not found.${RUN_NOT_FOUND_HINT}`, { action: "resume", status: "error" }, true);
+	// G12 (SDD-3 W-C WI-1): liveness-first gate — BEFORE the ownership check and
+	// BEFORE any reset/dispatch. executeTeamRun runs OUTSIDE the resume lock
+	// (LOCK-2 below), so a resume accepted against a live run double-dispatches
+	// workers (duplicate tokens + duplicate side effects). force:true bypasses
+	// OWNERSHIP only — never LIVENESS — so the refusal applies even when forced.
+	const liveness = resumeLivenessRefusal(loaded.manifest, loaded.tasks);
+	if (liveness) return result(liveness, { action: "resume", status: "error", runId: loaded.manifest.runId }, true);
 	// R1: foreign-ownership check — mirrors handleRetry/handleCancel. Without it,
 	// another session can resume (and re-execute) a run it doesn't own, racing
 	// the owning session.
@@ -332,8 +642,40 @@ export async function handleResume(params: TeamToolParamsValue, ctx: TeamContext
 			true,
 		);
 	}
+	// G4 (SDD-3 W-C WI-1): force-on-foreign is an authorization override — liveness
+	// was already REFUSED above, so force only bypassed OWNERSHIP here. Record it
+	// as a security event (registered in TEAM_EVENT_TYPES) so cross-session forced
+	// resumes are auditable; never silent.
+	if (foreignRun && params.force) {
+		await appendEventAsync(loaded.manifest.eventsPath, {
+			type: "run.resume_forced_foreign",
+			runId: loaded.manifest.runId,
+			message: `Foreign run ${loaded.manifest.runId} force-resumed by session ${ctx.sessionId} (owner ${loaded.manifest.ownerSessionId}).`,
+			data: {
+				action: "resume",
+				forced: true,
+				ownerSessionId: loaded.manifest.ownerSessionId,
+				forcingSessionId: ctx.sessionId,
+				runStatus: loaded.manifest.status,
+			},
+		});
+	}
 	if (!loaded.manifest.workflow)
 		return result(`Run '${params.runId}' has no workflow to resume.`, { action: "resume", status: "error" }, true);
+	// G11 (SDD-3 W-C WI-2): goal-loop and dynamic-workflow runs use SYNTHETIC
+	// team names (goal-*/dwf-*) that never appear in discoverTeams — the static
+	// team lookup below fails with "Team not found" and the run is unresumable
+	// even though both engines have resume support (DWF checkpoint hydration,
+	// goal-loop state). Branch on the ORIGINAL runKind (mirrors run.ts:390-435
+	// dispatch and background-runner.ts:492 short-circuit); the resumed run
+	// PRESERVES its runKind (see adoptSpecialKindRunForResume).
+	const resumeRunKind = loaded.manifest.runKind ?? "team-run";
+	if (resumeRunKind === "dynamic-workflow") {
+		return await resumeDynamicWorkflowRun(params, ctx, loaded.manifest);
+	}
+	if (resumeRunKind === "goal-loop") {
+		return await resumeGoalLoopRun(params, ctx, loaded.manifest);
+	}
 	const agents = allAgents(discoverAgents(ctx.cwd));
 	const direct = directTeamAndWorkflowFromRun(loaded.manifest, loaded.tasks, agents);
 	const team = direct?.team ?? allTeams(discoverTeams(ctx.cwd)).find((candidate) => candidate.name === loaded.manifest.team);
@@ -359,9 +701,36 @@ export async function handleResume(params: TeamToolParamsValue, ctx: TeamContext
 		const fresh = loadRunManifestById(runCwd, loaded.manifest.runId);
 		const lockedManifest = fresh?.manifest ?? loaded.manifest;
 		const lockedTasks = fresh?.tasks ?? loaded.tasks;
+		// F1 (2026-10-01 security review): the PRE-lock liveness gate raced
+		// concurrent dispatch — between the pre-lock load and this lock acquisition
+		// another session may have adopted and REGISTERED the run. Re-check
+		// liveness against the LOCKED state before any recovery/reset mutation;
+		// force:true still never bypasses liveness (G12 principle).
+		const lockedLiveness = resumeLivenessRefusal(lockedManifest, lockedTasks);
+		if (lockedLiveness) {
+			return {
+				kind: "blocked" as const,
+				payload: result(lockedLiveness, { action: "resume", status: "error", runId: lockedManifest.runId }, true),
+			};
+		}
 		const loadedConfig = loadConfig(ctx.cwd);
 		const recovered = await recoverCheckpointedTasks(lockedManifest, lockedTasks);
 		const resumeManifest = recovered.manifest;
+		// W-C2 (SDD-4 WI-6): drop the stale detached-runner pointer — resume never
+		// re-spawns a background runner (executeTeamRun below runs in THIS
+		// session's process), yet the adopted manifest kept the dispatch-time
+		// `async: { pid }` block pointing at the (now dead) original runner. During
+		// the re-execution window (status=running) any status poll read that dead
+		// pid and transitionStaleAsyncUnderLock flipped the LIVE resumed run to
+		// failed ("Async process stale: process does not exist", cancelling running
+		// tasks) — real-test battery 2026-10-02 finding 1: resume of a completed
+		// async run died 14s in while the sync contrast passed. Invariant restored:
+		// manifest.async is present ONLY while a detached runner owns execution; a
+		// resumed run's liveness is carried by registerActiveRun + ownerSessionId.
+		// The drop is audited on the run.resume_requested event (clearedAsyncPid).
+		const resumeBase: TeamRunManifest = { ...resumeManifest };
+		const staleAsyncPid = resumeBase.async?.pid;
+		delete resumeBase.async;
 		const executedConfig = {
 			...effectiveRunConfig(loadedConfig.config, params.config),
 		};
@@ -382,7 +751,7 @@ export async function handleResume(params: TeamToolParamsValue, ctx: TeamContext
 		const runtime = await resolveCrewRuntime(executedConfig);
 		const runtimeResolution = runtimeResolutionState(runtime);
 		const runtimeManifest = {
-			...resumeManifest,
+			...resumeBase,
 			runtimeResolution,
 			updatedAt: new Date().toISOString(),
 			// B1 battery 2026-08-18 (case b root-cause fix): resume ADOPTS the run —
@@ -458,6 +827,9 @@ export async function handleResume(params: TeamToolParamsValue, ctx: TeamContext
 			data: {
 				replayedMailboxMessages: replay.messages.length,
 				recoveredCheckpointTasks: recovered.recovered,
+				// W-C2 (SDD-4 WI-6): audit trail for the stale detached-runner pointer
+				// dropped at adoption (see resumeBase above).
+				...(staleAsyncPid !== undefined ? { clearedAsyncPid: staleAsyncPid } : {}),
 			},
 		});
 		if (recovered.recovered.length)
@@ -479,10 +851,28 @@ export async function handleResume(params: TeamToolParamsValue, ctx: TeamContext
 			});
 		const executeWorkers = runtime.kind !== "scaffold";
 		const resumeSkillOverride = normalizeSkillOverride(params.skill) ?? runtimeManifest.skillOverride;
-
+		// F1 (2026-10-01 security review): adopt running + REGISTER in the
+		// cross-process active-run registry INSIDE the lock, mirroring run.ts
+		// dispatch (:388) and adoptSpecialKindRunForResume. The static path
+		// previously never registered, so during foreground executeTeamRun (which
+		// runs OUTSIDE the lock) a concurrent resume saw NO cross-process liveness
+		// signal until the first task claim appeared — the double-dispatch window
+		// (even with force:true). Terminal finalize unregisters (updateRunStatus →
+		// unregisterActiveRun); a resume that crashes mid-execution ages out via
+		// the registry's staleness horizon. registerActiveRun throwing here (a
+		// raced external cancel flipped the disk manifest terminal) is intentional
+		// fail-safe: the other writer won the race, so we must not dispatch.
+		const executingManifest = updateRunStatus(
+			runtimeManifest,
+			"running",
+			`Resuming run (adopted by session ${ctx.sessionId ?? "unknown"}).`,
+			// Finding 8 write guard: resume is the legitimate terminal-exit flow.
+			{ allowTerminalExit: true },
+		);
+		registerActiveRun(executingManifest);
 		return {
 			kind: "execute" as const,
-			runtimeManifest,
+			runtimeManifest: executingManifest,
 			resetTasks,
 			executeWorkers,
 			resumeSkillOverride,

package/src/extension/webhook-notify.ts

@@ -36,6 +36,7 @@ import type { CrewWebhookConfig } from "../config/types.ts";
 import { loadRunManifestById } from "../state/stores/state-store.ts";
 import type { TeamTaskState } from "../state/types.ts";
 import { logInternalError } from "../utils/internal-error.ts";
+import { embeddedIpv4FromGroups, parseIpv6Literal } from "../utils/ip-literal.ts";
 import { isInQuietHours } from "./notification-router.ts";
 
 /** Documented payload (spec §Design). Field order matches the spec example. */
@@ -139,7 +140,28 @@ function isLocalAddress(hostname: string): boolean {
 	const firstHextet = bare.split(":").find((segment) => segment.length > 0);
 	if (firstHextet && /^[0-9a-f]{1,4}$/.test(firstHextet)) {
 		const value = Number.parseInt(firstHextet, 16);
-		return value >= 0xfe80 && value <= 0xfebf;
+		if (value >= 0xfe80 && value <= 0xfebf) return true;
+	}
+	// G6: classify any remaining IPv6 literal through the shared parser —
+	// the textual checks above match only a subset of spellings, so
+	// `::127.0.0.1` (IPv4-compatible loopback), `0:0:0:0:0:0:0:1` (expanded
+	// ::1) and full-form mapped addresses slipped through. Same predicate
+	// scope as above: loopback/unspecified/link-local + the local part of an
+	// embedded IPv4 (RFC1918 deliberately stays allowed — internal
+	// webhooks are a use case).
+	const groups = parseIpv6Literal(bare);
+	if (groups) {
+		if (groups.every((group) => group === 0)) return true;
+		if (groups.slice(0, 7).every((group) => group === 0) && groups[7] === 1) return true;
+		if ((groups[0] & 0xffc0) === 0xfe80) return true;
+		const embedded = embeddedIpv4FromGroups(groups);
+		if (embedded) {
+			const v4 = ipv4Octets(embedded);
+			if (v4) {
+				const [a, b] = v4;
+				return a === 127 || a === 0 || (a === 169 && b === 254);
+			}
+		}
 	}
 	return false;
 }

package/src/observability/exporters/otlp-exporter.ts

@@ -2,6 +2,7 @@ import { lookup } from "node:dns/promises";
 import { promisify } from "node:util";
 import { gzip } from "node:zlib";
 import { logInternalError } from "../../utils/internal-error.ts";
+import { bracketIpv6InUrl, embeddedIpv4FromGroups, parseIpv6Literal, unbracketHost } from "../../utils/ip-literal.ts";
 import { redactSecrets } from "../../utils/redaction.ts";
 import type { MetricRegistry } from "../metric-registry.ts";
 import type { MetricSnapshot } from "../metrics-primitives.ts";
@@ -17,6 +18,10 @@ const gzipAsync = promisify(gzip);
  * Only http:// and https:// to public hostnames are allowed.
  */
 export function validateEndpoint(endpoint: string): void {
+	// G6: a bare IPv6 literal in the authority (`http://::1:4318`) makes
+	// `new URL` throw — bracket it first so the classifier sees the literal
+	// instead of a generic invalid-URL error (RFC 3986 §3.2.2 host ABNF).
+	endpoint = bracketIpv6InUrl(endpoint);
 	let url: URL;
 	try {
 		url = new URL(endpoint);
@@ -67,6 +72,13 @@ export function validateEndpoint(endpoint: string): void {
 		if (lower.startsWith("::ffff:")) {
 			throw new Error(`OTLP endpoint must not target IPv4-mapped IPv6 address: ${endpoint}`);
 		}
+		// G6: catch every literal form the prefix checks above miss —
+		// IPv4-compatible `::a.b.c.d` (e.g. ::127.0.0.1, ::169.254.169.254),
+		// expanded spellings (`0:0:0:0:0:0:0:1`), zone-ids — through the
+		// shared parser, applying the same predicates as the IPv4 branch.
+		if (isPrivateIpv6Literal(bare)) {
+			throw new Error(`OTLP endpoint must not target private/reserved IPv6 address: ${endpoint}`);
+		}
 	}
 
 	// Reject IPv4 private/reserved ranges
@@ -101,6 +113,63 @@ export function validateEndpoint(endpoint: string): void {
 	}
 }
 
+/**
+ * IPv4 predicate shared by the IPv6 literal classifier below: loopback,
+ * private (RFC1918), link-local/metadata, this-network. Mirrors the ranges
+ * checked textually in `validateEndpoint`.
+ */
+function isPrivateIpv4(address: string): boolean {
+	const match = /^(\d{1,3})\.(\d{1,3})\.(\d{1,3})\.(\d{1,3})$/.exec(address);
+	if (!match) return false;
+	const o0 = Number(match[1]);
+	const o1 = Number(match[2]);
+	if (o0 === 127 || o0 === 0) return true;
+	if (o0 === 10) return true;
+	if (o0 === 172 && o1 >= 16 && o1 <= 31) return true;
+	if (o0 === 192 && o1 === 168) return true;
+	if (o0 === 169 && o1 === 254) return true;
+	return false;
+}
+
+/**
+ * G6: classify a parsed IPv6 literal (8 groups) as private/reserved using
+ * the same predicates as the IPv4 branch. Catches the forms the textual
+ * prefix checks miss: IPv4-compatible `::a.b.c.d`, IPv4-mapped
+ * `::ffff:a.b.c.d` (refused wholesale, as before), expanded spellings of
+ * `::1` / ULA / link-local / site-local / multicast, and zone-ids.
+ */
+function isPrivateIpv6Groups(groups: number[]): boolean {
+	// Unspecified `::`.
+	if (groups.every((group) => group === 0)) return true;
+	// Loopback `::1`.
+	if (groups.slice(0, 7).every((group) => group === 0) && groups[7] === 1) return true;
+	// IPv4-mapped `::ffff:a.b.c.d` — refused wholesale (existing rule).
+	if (groups[5] === 0xffff && groups.slice(0, 5).every((group) => group === 0)) return true;
+	// IPv4-compatible `::a.b.c.d` — map to IPv4, apply the IPv4 predicates.
+	const embedded = embeddedIpv4FromGroups(groups);
+	if (embedded && isPrivateIpv4(embedded)) return true;
+	// Unique local fc00::/7.
+	if ((groups[0] & 0xfe00) === 0xfc00) return true;
+	// Link-local fe80::/10.
+	if ((groups[0] & 0xffc0) === 0xfe80) return true;
+	// Site-local fec0::/10 (deprecated).
+	if ((groups[0] & 0xffc0) === 0xfec0) return true;
+	// Multicast ff00::/8.
+	if ((groups[0] & 0xff00) === 0xff00) return true;
+	return false;
+}
+
+/**
+ * G6: classify ANY IPv6 literal spelling (bracketed or bare) as
+ * private/reserved. Non-literals (hostnames, plain IPv4) return false —
+ * those are handled by `validateEndpoint`'s IPv4 branch and the DNS
+ * rebinding guard.
+ */
+function isPrivateIpv6Literal(host: string): boolean {
+	const groups = parseIpv6Literal(unbracketHost(host));
+	return groups !== undefined && isPrivateIpv6Groups(groups);
+}
+
 /**
  * CFG-6: classify a single IP address (IPv4 or IPv6) as private / reserved /
  * loopback / link-local. Used by the runtime DNS-rebinding guard below to
@@ -122,14 +191,11 @@ export function isPrivateIpAddress(address: string): boolean {
 		if (o0 === 169 && o1 === 254) return true;
 		return false;
 	}
-	// IPv6 (without surrounding brackets, as `dns.lookup` returns them)
-	if (lower === "::1" || lower === "::") return true;
-	if (lower.startsWith("fd") || lower.startsWith("fc")) return true;
-	if (lower.startsWith("fe8") || lower.startsWith("fe9") || lower.startsWith("fea") || lower.startsWith("feb")) return true;
-	if (lower.startsWith("fec") || lower.startsWith("fed") || lower.startsWith("fee") || lower.startsWith("fef")) return true;
-	if (lower.startsWith("ff")) return true;
-	if (lower.startsWith("::ffff:")) return true;
-	return false;
+	// IPv6 (without surrounding brackets, as `dns.lookup` returns them):
+	// classify through the shared literal parser (G6) so compressed,
+	// expanded, embedded-IPv4 and zone-id forms all reduce to the same
+	// predicates — the old prefix chain missed `::127.0.0.1`.
+	return isPrivateIpv6Literal(lower);
 }
 
 /**
@@ -142,6 +208,9 @@ export function isPrivateIpAddress(address: string): boolean {
  * allowed to fall through so the underlying `fetch` surfaces the error.
  */
 export async function assertResolvedAddressSafe(endpoint: string): Promise<void> {
+	// G6: bare IPv6 literal authorities are bracketed before parsing so the
+	// literal classifier below sees them (idempotent for normal URLs).
+	endpoint = bracketIpv6InUrl(endpoint);
 	let url: URL;
 	try {
 		url = new URL(endpoint);
@@ -155,7 +224,16 @@ export async function assertResolvedAddressSafe(endpoint: string): Promise<void>
 	// round-trip so we don't double-report errors the sync check already
 	// produces.
 	if (hostname === "localhost" || hostname.endsWith(".localhost")) return;
-	if (hostname.startsWith("[")) return;
+	// G6: bracketed IPv6 literals used to bypass this layer entirely; now
+	// they are classified with the same predicates as `validateEndpoint`
+	// (defense in depth — layer 2 must not trust layer 1 having run). A
+	// literal needs no DNS round-trip.
+	if (hostname.startsWith("[")) {
+		if (isPrivateIpv6Literal(hostname)) {
+			throw new Error(`OTLP endpoint targets private/reserved IPv6 literal: ${endpoint}`);
+		}
+		return;
+	}
 	if (/^\d{1,3}(\.\d{1,3}){3}$/.test(hostname)) return;
 	let addresses: { address: string }[];
 	try {
@@ -261,8 +339,12 @@ export class OTLPExporter implements MetricExporter {
 	private readonly registry: MetricRegistry;
 
 	constructor(opts: OTLPExporterOptions, registry: MetricRegistry) {
-		validateEndpoint(opts.endpoint);
-		this.opts = opts;
+		// G6: normalize a bare IPv6 literal authority (`http://::1:4318`) to
+		// bracketed form ONCE — `new URL` throws on the raw form, and both
+		// SSRF layers plus the actual `fetch` must see the same parseable URL.
+		const endpoint = bracketIpv6InUrl(opts.endpoint);
+		validateEndpoint(endpoint);
+		this.opts = { ...opts, endpoint };
 		this.registry = registry;
 	}