pi-crew 0.11.50 → 0.11.52

package/src/runtime/foreground-control.ts

@@ -1,7 +1,8 @@
 import * as fs from "node:fs";
 import * as path from "node:path";
+import { getCrewEnv } from "../config/env-vars.ts";
 import { atomicWriteFile } from "../state/atomic-write.ts";
-import { appendEvent } from "../state/event-log/event-log.ts";
+import { appendEvent, appendEventBuffered } from "../state/event-log/event-log.ts";
 import type { TeamRunManifest, TeamTaskState } from "../state/types.ts";
 import { logInternalError } from "../utils/internal-error.ts";
 import { sleepSync } from "../utils/sleep.ts";
@@ -204,3 +205,96 @@ export function writeForegroundInterruptRequest(
 		releaseLock();
 	}
 }
+
+// ═══════════════════════════════════════════════════════════════════════════
+// FIX-1 (live catch, run team_20261030044630_3935473bc4886682): the
+// foreground-control interrupt CONSUMER. The guard used to live ONLY inside
+// background-runner's detached main(); runs executed INLINE in the owner
+// session process (executeBackgroundRun core — also the PI_CREW_TEST_ASYNC_INLINE
+// seam) never polled foreground-control.json, so cross-session cancels sat
+// acknowledged:false forever (two requests in that run) while the worker ran
+// ≥75s post-cancel with fresh heartbeats. Colocated with the PRODUCER
+// (writeForegroundInterruptRequest above) so the control-file contract has
+// one home.
+//
+// Polling/ack semantics carried over byte-identically from the previous
+// inline guard in background-runner.ts: existsSync+readFileSync+JSON.Parse
+// per tick, interval PI_CREW_INTERRUPT_GUARD_INTERVAL_MS (default 1000ms),
+// synchronous atomic ack write, once-per-request gate (defense-in-depth when
+// the ack write fails), appendEventBuffered("async.interrupt_detected"),
+// interval.unref().
+//
+// What an interrupt DOES is host-scoped via onInterrupt:
+//  - detached runner (background-runner.startInterruptGuard): process-wide
+//    sweep — terminateActiveChildPiProcesses + stopParentGuard + exitCode 130.
+//  - inline core (executeBackgroundRun with no host signal): abort ONLY this
+//    run's controller. NEVER sweep: the owner session process may host
+//    sibling runs whose child-pi processes would be murdered by a global
+//    terminateActiveChildPiProcesses() call.
+// ═══════════════════════════════════════════════════════════════════════════
+
+export interface RunInterruptGuardOptions {
+	manifest: { runId: string; stateRoot: string; eventsPath: string };
+	/**
+	 * Host-scoped interrupt action. Runs ONCE per unacknowledged request,
+	 * after the synchronous ack write. Keep it synchronous: this is a
+	 * setInterval polling callback — it cannot await.
+	 */
+	onInterrupt: () => void;
+	/** Message for the async.interrupt_detected event (hosts describe their own follow-up). */
+	eventMessage?: string;
+}
+
+export function startRunInterruptGuard(opts: RunInterruptGuardOptions): () => void {
+	const controlPath = path.join(opts.manifest.stateRoot, "foreground-control.json");
+	// PERF (2026-08-24, carried over verbatim): default 1000ms. Each tick does
+	// existsSync + readFileSync + JSON.parse for the whole run, and the guard
+	// is best-effort interrupt LATENCY, not a correctness deadline — a late
+	// trigger merely delays the SIGTERM (children are SIGKILLed after
+	// HARD_KILL_MS=3s regardless) and no state machine aborts on a deadline
+	// when the guard fires late. Nothing downstream requires a tighter cadence.
+	const interruptGuardInterval = Number(getCrewEnv("PI_CREW_INTERRUPT_GUARD_INTERVAL_MS")) || 1000;
+	// RT-4 FIX (carried over verbatim): local gate so the interrupt body runs
+	// only once per request. The ack write stops the re-fire; this gate is
+	// defense-in-depth if the ack write fails (e.g. transient fs error).
+	let interruptHandled = false;
+	const interval = setInterval(() => {
+		try {
+			if (!fs.existsSync(controlPath)) return;
+			const parsed = JSON.parse(fs.readFileSync(controlPath, "utf-8")) as {
+				requests?: Array<{ type: string; acknowledged?: boolean }>;
+			};
+			const last = parsed.requests?.at(-1);
+			if (last?.type === "interrupt" && last?.acknowledged !== true) {
+				if (interruptHandled) return;
+				interruptHandled = true;
+				// RT-4 FIX: write acknowledged:true back SYNCHRONOUSLY so the next
+				// tick does not re-fire. Sync because a polling callback cannot await.
+				try {
+					const reqs = parsed.requests ?? [];
+					if (reqs.length > 0) {
+						reqs[reqs.length - 1].acknowledged = true;
+						atomicWriteFile(controlPath, JSON.stringify(parsed, null, 2));
+					}
+				} catch {
+					/* best-effort ack — interruptHandled gate prevents re-fire */
+				}
+				appendEventBuffered(opts.manifest.eventsPath, {
+					type: "async.interrupt_detected",
+					runId: opts.manifest.runId,
+					message: opts.eventMessage ?? "Background runner detected foreground interrupt — killing child processes and exiting.",
+				}).catch((e) => logInternalError("interrupt-guard.buffered", e, "type=async.interrupt_detected"));
+				opts.onInterrupt();
+				// Cosmetic (verifier-flagged, live catch follow-up): an ALREADY-ACKED
+				// interrupt must not fall through to this branch — it used to warn
+				// "Ignoring unknown ... interrupt" every tick until guard stop.
+			} else if (last && !(last.type === "interrupt" && last.acknowledged === true)) {
+				console.warn(`[background-runner] Ignoring unknown foreground control request: ${last.type}`);
+			}
+		} catch {
+			/* ignore read/parse errors */
+		}
+	}, interruptGuardInterval);
+	interval.unref();
+	return () => clearInterval(interval);
+}

package/src/runtime/goal-workflow/dynamic-workflow-context.ts

@@ -26,7 +26,8 @@ import { randomBytes } from "node:crypto";
 import type { TSchema } from "@sinclair/typebox";
 import type { AgentConfig } from "../../agents/agent-config.ts";
 import { allAgents, discoverAgents } from "../../agents/discover-agents.ts";
-import { appendMailboxMessage, readMailbox } from "../../state/coordination/mailbox.ts";
+import { renderInboxMessage } from "../../prompt/prompt-runtime.ts";
+import { appendMailboxMessage, type MailboxMessage, readMailbox } from "../../state/coordination/mailbox.ts";
 import { appendEvent } from "../../state/event-log/event-log.ts";
 import { writeArtifact } from "../../state/stores/artifact-store.ts";
 import type { TeamRunManifest } from "../../state/types.ts";
@@ -383,6 +384,27 @@ export function makeWorkflowCtx(manifest: TeamRunManifest, opts: MakeWorkflowCtx
 	// `while(true){review; if accept break; retry}` loop replay round-1's
 	// verdict forever (stale-verdict hazard, docs/dynamic-workflows.md).
 	const hydratedCallIds = new Set<string>(Object.keys(opts.resumedState?.completedAgentCalls ?? {}));
+	// W1b binding (security fix gatherreplies-replyto-only-binding): messageId →
+	// expected addressee, recorded when ctx.mail() issues each mail. gatherReplies
+	// only accepts a reply row when its broker-authenticated sender (m.from)
+	// equals the expected addressee of the mail the reply claims (m.replyTo) — a
+	// forged replyTo from any other task cannot enter the reply stream.
+	const mailedAddressees = new Map<string, string>();
+	const unresolvedMailLookups = new Set<string>();
+	// Resolve the expected addressee for a mailed id, falling back to the run
+	// outbox ONCE per unknown id (resume path: mails sent by a previous process
+	// of the same workflow are not in the in-memory map; their outbox rows are
+	// host-written — workers cannot append to the outbox lane — so the recorded
+	// `to` is a trusted binding source. Inbox rows are never consulted).
+	const expectedReplyAddressee = (messageId: string): string | undefined => {
+		const known = mailedAddressees.get(messageId);
+		if (known !== undefined) return known;
+		if (unresolvedMailLookups.has(messageId)) return undefined;
+		unresolvedMailLookups.add(messageId);
+		const mailed = readMailbox(manifest, "outbox").find((m) => m.id === messageId && m.from === "dynamic-workflow" && m.to);
+		if (mailed?.to) mailedAddressees.set(messageId, mailed.to);
+		return mailedAddressees.get(messageId);
+	};
 	// round-14 P1-2: frozen budget surface. The closures read wfState.spent so the
 	// object stays live after Object.freeze(ctx). total is a snapshot primitive.
 	const budget = Object.freeze({
@@ -852,18 +874,37 @@ export function makeWorkflowCtx(manifest: TeamRunManifest, opts: MakeWorkflowCtx
 				replyTo: mailOpts?.replyTo,
 				replyDeadline: mailOpts?.replyDeadline,
 			});
+			// W1b binding: record the expected addressee so gatherReplies can verify
+			// that a reply row's authenticated sender (from) is the task this mail
+			// was addressed to (replyTo target ownership).
+			mailedAddressees.set(msg.id, to);
 			return msg.id;
 		},
 		async gatherReplies(messageIds: string[], deadlineMs: number): Promise<unknown[]> {
+			// W1b binding (security fix gatherreplies-replyto-only-binding): a reply
+			// row counts ONLY when (a) it targets the run-level parent lane
+			// (to === "parent" — the lane this gather polls), (b) its replyTo is one
+			// of the awaited ids, and (c) its broker-authenticated sender (from)
+			// equals the addressee recorded for that id at mail time. Duplicate rows
+			// from one sender no longer satisfy a multi-id gather (distinct
+			// (replyTo, from) pairs are counted toward messageIds.length), and every
+			// delivered body is fenced through renderInboxMessage (same seam as
+			// worker inbox delivery: control-char strip, closing-tag neutralization,
+			// 8192-char cap) before it enters workflow variables.
+			const collectBoundReplies = (): MailboxMessage[] =>
+				readMailbox(manifest, "inbox").filter((m) => {
+					if (!m.replyTo || !messageIds.includes(m.replyTo) || m.to !== "parent") return false;
+					return expectedReplyAddressee(m.replyTo) === m.from;
+				});
+			const distinctReplyPairs = (rows: MailboxMessage[]): number => new Set(rows.map((m) => `${m.replyTo}\u0000${m.from}`)).size;
+			const fenceReplyRow = (m: MailboxMessage): MailboxMessage => ({ ...m, body: renderInboxMessage(m) });
 			const deadline = Date.now() + deadlineMs;
-			while (Date.now() < deadline) {
-				const inbox = readMailbox(manifest, "inbox");
-				const got = inbox.filter((m) => m.replyTo && messageIds.includes(m.replyTo));
-				if (got.length >= messageIds.length) return got;
+			for (;;) {
+				const got = collectBoundReplies();
+				if (distinctReplyPairs(got) >= messageIds.length) return got.map(fenceReplyRow);
+				if (Date.now() >= deadline || ctxSignal.aborted) return got.map(fenceReplyRow);
 				await new Promise((r) => setTimeout(r, 500));
-				if (ctxSignal.aborted) return inbox.filter((m) => m.replyTo && messageIds.includes(m.replyTo));
 			}
-			return readMailbox(manifest, "inbox").filter((m) => m.replyTo && messageIds.includes(m.replyTo));
 		},
 		renderTemplate(name: string, vars: Record<string, string>): unknown {
 			return renderPlanTemplate(name, vars);

package/src/runtime/goal-workflow/dynamic-workflow-runner.ts

@@ -17,12 +17,14 @@
  * See docs/dynamic-workflows.md for the full threat model.
  */
 
+import { createHash } from "node:crypto";
 import { readFileSync } from "node:fs";
 import { createRequire } from "node:module";
 import { join } from "node:path";
 import { getCrewEnv } from "../../config/env-vars.ts";
 import { appendEventAsync } from "../../state/event-log/event-log.ts";
 import { writeArtifact } from "../../state/stores/artifact-store.ts";
+import { saveRunManifestAsync } from "../../state/stores/state-store.ts";
 import type { TeamRunManifest, TeamTaskState } from "../../state/types.ts";
 import { logInternalError } from "../../utils/internal-error.ts";
 import { packageRoot, projectCrewRoot, userPiRoot } from "../../utils/paths.ts";
@@ -177,26 +179,97 @@ export async function runDynamicWorkflow(input: RunDynamicWorkflowInput): Promis
 	const eventsPath = manifest.eventsPath;
 	const scriptPath = resolveScriptPath(workflow, manifest.cwd);
 
-	// F-01: Trust gate — project-sourced .dwf.ts scripts have FULL Node access (process,
+	// w3-dwf-trust: dispatch-time pin stamping (single point). The FIRST entry to the
+	// runner for a run IS the dispatch — stamp manifest.dynamicScriptPin with the exact
+	// resolved script path + sha256 of the CURRENT bytes and persist before any module
+	// load. Both resume arms funnel back through runDynamicWorkflow, so every later
+	// entry hits the pin-mismatch verification below: a plant that swaps the file
+	// between dispatch and resume is refused instead of executing swapped bytes.
+	// Absent pin (legacy manifests) gets stamped on first resume — backward compatible.
+	if (manifest.dynamicScriptPin === undefined) {
+		let sha256: string;
+		try {
+			sha256 = createHash("sha256").update(readFileSync(scriptPath)).digest("hex");
+		} catch (error) {
+			logInternalError("dynamic-workflow-runner: pin stamp hash failed", error);
+			throw new Error(
+				`Dynamic workflow script '${scriptPath}' could not be read for dispatch-time pinning — refusing to execute an unhashable script.`,
+			);
+		}
+		manifest.dynamicScriptPin = { scriptPath, sha256 };
+		try {
+			await saveRunManifestAsync(manifest);
+		} catch (error) {
+			// Pin not durable → verification cannot be trusted later. Fail closed.
+			logInternalError("dynamic-workflow-runner: pin stamp persist failed", error);
+			throw new Error(`Dynamic workflow dispatch failed to persist the script pin — refusing to execute without a durable pin.`);
+		}
+	}
+
+	// F-01: Trust gate — project/user-sourced .dwf.ts scripts have FULL Node access (process,
 	// require, fs, child_process). Cloning a hostile repo and running its workflow = arbitrary
-	// code execution. Default-deny project workflows unless the user explicitly opts in via
-	// PI_CREW_TRUST_PROJECT_DWF=1. Builtin and user workflows proceed without restriction.
+	// code execution; default-deny project workflows unless the user explicitly opts in via
+	// PI_CREW_TRUST_PROJECT_DWF=1.
+	// w3-dwf-trust (2026-10-29): the USER tier gets the SAME default-deny via
+	// PI_CREW_TRUST_USER_DWF=1. ~/.pi/agent/workflows is writable by every WRITE-role
+	// child worker (same OS uid, bash granted by role-tools), so directory location alone
+	// is not human provenance: a worker-planted user-tier .dwf.ts previously executed in
+	// this HOST process (parent env, in-memory broker state) and silently shadowed
+	// same-named builtin/project workflows via the allWorkflows merge order. Builtin
+	// (shipped, package-owned) workflows proceed without restriction.
 	// U2 (2026-10-10): awaited appendEventAsync — the 2026-09-10 M2a revert
 	// was required by BUFFERED (20ms-delayed) writes; awaiting the direct async
 	// append keeps the read-your-writes contract (resume flow, dwf-setresult
 	// tests, status display all read events only after runDynamicWorkflow
 	// resolves) while dropping the sleepSync event-loop block.
-	if (workflow.source === "project" && getCrewEnv("PI_CREW_TRUST_PROJECT_DWF") !== "1") {
+	const trustEnv: "PI_CREW_TRUST_PROJECT_DWF" | "PI_CREW_TRUST_USER_DWF" | undefined =
+		workflow.source === "project" ? "PI_CREW_TRUST_PROJECT_DWF" : workflow.source === "user" ? "PI_CREW_TRUST_USER_DWF" : undefined;
+	if (trustEnv !== undefined && getCrewEnv(trustEnv) !== "1") {
 		await appendEventAsync(eventsPath, {
 			type: "dwf.trust_denied",
 			runId: manifest.runId,
 			data: { workflow: workflow.name, source: workflow.source, script: scriptPath },
 		});
 		throw new Error(
-			`Project dynamic workflow requires explicit trust. Set PI_CREW_TRUST_PROJECT_DWF=1 to allow execution of project .dwf.ts scripts.`,
+			workflow.source === "user"
+				? `User dynamic workflow requires explicit trust. Set PI_CREW_TRUST_USER_DWF=1 to allow execution of user .dwf.ts scripts.`
+				: `Project dynamic workflow requires explicit trust. Set PI_CREW_TRUST_PROJECT_DWF=1 to allow execution of project .dwf.ts scripts.`,
 		);
 	}
 
+	// w3-dwf-trust: dispatch-time script pin. When the dispatcher stamped
+	// manifest.dynamicScriptPin, re-hash the script bytes before EVERY load — fresh
+	// dispatch AND both resume arms funnel through runDynamicWorkflow — so a plant
+	// that swaps the file between dispatch and resume cannot execute. Optional/absent
+	// on manifests dispatched before this field existed (and on dispatchers that do
+	// not stamp it yet) → no pin verification (backward compatible).
+	const pin = manifest.dynamicScriptPin;
+	if (pin !== undefined) {
+		let actualSha256: string | undefined;
+		try {
+			actualSha256 = createHash("sha256").update(readFileSync(scriptPath)).digest("hex");
+		} catch {
+			// Unreadable/missing script cannot match its pin — treat as mismatch.
+			actualSha256 = undefined;
+		}
+		if (pin.scriptPath !== scriptPath || actualSha256 === undefined || pin.sha256 !== actualSha256) {
+			await appendEventAsync(eventsPath, {
+				type: "dwf.trust_denied",
+				runId: manifest.runId,
+				data: {
+					workflow: workflow.name,
+					source: workflow.source,
+					script: scriptPath,
+					reason: "script-pin-mismatch",
+					...(actualSha256 !== undefined ? { expectedSha256: pin.sha256, actualSha256 } : {}),
+				},
+			});
+			throw new Error(
+				`Dynamic workflow script does not match the dispatch-time pin (path/sha256) — refusing to load a possibly swapped script. Re-dispatch the run to re-pin the current script bytes.`,
+			);
+		}
+	}
+
 	await appendEventAsync(eventsPath, {
 		type: "dwf.started",
 		runId: manifest.runId,
@@ -208,7 +281,10 @@ export async function runDynamicWorkflow(input: RunDynamicWorkflowInput): Promis
 	// <stateRoot>/dwf-checkpoint.json (no double-nesting). A missing checkpoint (fresh run)
 	// yields undefined — makeWorkflowCtx starts with empty defaults (backward compatible).
 	const dwfStore = new DwfStore(manifest.stateRoot);
-	const resumedState = dwfStore.load();
+	// w3-dwf-trust: bind the checkpoint to THIS run — a checkpoint whose runId
+	// differs (stale/planted/enumerated under .crew/state/runs/) is rejected and
+	// the run restarts fresh instead of replaying worker-writable state.
+	const resumedState = dwfStore.load(manifest.runId);
 	if (resumedState) {
 		// R14-C3 (wave 7): fingerprint check — a resume that changes the dispatch
 		// context (modelOverride/team) still replays the completed-call cache, but

package/src/runtime/heartbeat/heartbeat-watcher.ts

@@ -109,22 +109,43 @@ export class HeartbeatWatcher {
 				activeKeys.add(key);
 				this.lastSeen.set(key, now);
 
-				// Check heartbeat staleness with lastActivityAt fallback
-				let elapsed = heartbeatAgeMs(task.heartbeat, now);
+				// FIX-2 (live catch, run team_20261030044630_3935473bc4886682):
+				// attempt-clamp. handleRetry re-queues tasks WITHOUT resetting
+				// liveness fields, so a retry attempt inherited attempt-1's stale
+				// heartbeat/agentProgress timestamps and this watcher fired
+				// heartbeat_dead 3× for a worker that was ALIVE (fresh heartbeats,
+				// active tool calls). Evidence predating the CURRENT attempt's
+				// task.startedAt is meaningless and must be ignored; startedAt is
+				// reset per attempt at dispatch (child-executor attemptStartedAt),
+				// so it is the authoritative attempt boundary.
+				const startedAtMs = task.startedAt !== undefined ? Date.parse(task.startedAt) : Number.NaN;
+				const attemptStartMs = Number.isFinite(startedAtMs) ? startedAtMs : undefined;
+				const evidenceUsable = (iso: string | undefined): boolean => {
+					if (iso === undefined) return false;
+					const ms = Date.parse(iso);
+					return Number.isFinite(ms) && (attemptStartMs === undefined || ms >= attemptStartMs);
+				};
+				// Check heartbeat staleness with lastActivityAt fallback (evidence
+				// older than startedAt is inadmissible — see clamp above).
+				let elapsed = evidenceUsable(task.heartbeat?.lastSeenAt) ? heartbeatAgeMs(task.heartbeat, now) : Number.POSITIVE_INFINITY;
 				// PR #6 partial: use lastActivityAt as fallback when heartbeat is stale
 				// If heartbeat is stale but lastActivityAt is fresher, use activity age instead.
 				// This prevents false-positive dead detection for live-session tasks during long operations.
-				if (task.agentProgress?.lastActivityAt) {
-					const activityAt = new Date(task.agentProgress.lastActivityAt).getTime();
-					if (Number.isFinite(activityAt)) {
-						const activityAge = now - activityAt;
-						// Use activity age if it's fresher than heartbeat age
-						// (no upper bound - if agent has recent activity, trust it even if old)
-						if (activityAge < elapsed) {
-							elapsed = activityAge;
-						}
+				if (evidenceUsable(task.agentProgress?.lastActivityAt)) {
+					const activityAge = now - new Date(task.agentProgress!.lastActivityAt!).getTime();
+					// Use activity age if it's fresher than heartbeat age
+					// (no upper bound - if agent has recent activity, trust it even if old)
+					if (activityAge < elapsed) {
+						elapsed = activityAge;
 					}
 				}
+				// No usable liveness evidence at all → compute elapsed from the
+				// attempt's own start: a task younger than deadMs can never be dead
+				// (previously a missing heartbeat meant elapsed=∞ → instant "dead").
+				// Tasks without startedAt keep the legacy ∞ (unclassifiable).
+				if (!Number.isFinite(elapsed) && attemptStartMs !== undefined) {
+					elapsed = Math.max(0, now - attemptStartMs);
+				}
 				// PID liveness gate: if the worker process is still alive, downgrade
 				// "dead" to "stale". This prevents false positives when the LLM spends
 				// a long time generating a response (>5 min) without tool calls.

package/src/runtime/live-session/live-session-runtime.ts

@@ -8,7 +8,14 @@ import { redactSecrets } from "../../utils/redaction.ts";
 import { BoundedTail } from "../compaction/compact-stages/bounded-tail.ts";
 import { createIrcTool } from "../custom-tools/irc-tool.ts";
 import { createSubmitResultTool } from "../custom-tools/submit-result-tool.ts";
-import { g2EnforcementDegradationReason, mcpPermittedForRole, shouldFailClosedMcpEnforcement, stripMcpExtensions } from "../mcp-proxy.ts";
+import {
+	foreignMcpExtensionsAgainstAllowlist,
+	g2EnforcementDegradationReason,
+	McpForeignExtensionError,
+	mcpPermittedForRole,
+	shouldFailClosedMcpEnforcement,
+	stripMcpExtensions,
+} from "../mcp-proxy.ts";
 import { buildConfiguredModelRouting, modelRefToString, warnOutOfScopeSoft } from "../model/model-fallback.ts";
 import { isLiveSessionRuntimeAvailable } from "../model/runtime-resolver.ts";
 import { awaitRuntimeWarmup } from "../model/runtime-warmup.ts";
@@ -360,13 +367,42 @@ export function collectForeignExtensions(session: LiveSessionLike | undefined, a
 	const runner = session?.extensionRunner;
 	if (typeof runner?.getExtensionPaths !== "function") return [];
 	try {
-		const allowed = new Set(allowedPaths);
-		return runner.getExtensionPaths().filter((extensionPath: string) => !allowed.has(extensionPath));
+		// N1 (security-audit run-1): the allowlist check itself has exactly ONE
+		// implementation — mcp-proxy.ts `foreignMcpExtensionsAgainstAllowlist` —
+		// so the fast-path assert and the legacy-loader-route assert below share
+		// identical semantics (set membership against allowedLiveExtensionPaths).
+		return foreignMcpExtensionsAgainstAllowlist(runner.getExtensionPaths(), allowedPaths);
 	} catch {
 		return [];
 	}
 }
 
+/**
+ * N1 (security-audit run-1): the post-creation assert DECISION for the LEGACY
+ * `DefaultResourceLoader` route (the `!sharedServicesAvailable` branch) — the
+ * same backstop the shared-services fast path's own assert gives it, with
+ * identical allowlist semantics (`collectForeignExtensions` +
+ * `allowedLiveExtensionPaths`). The loader-level `stripMcpExtensions` control
+ * is a NAME-based denylist, so a differently-named MCP adapter survives it;
+ * for a NON-MCP-permitted role the allowlist is empty, hence ANY extension
+ * that still loaded is a violation.
+ *
+ * Armed ONLY for non-MCP-permitted roles on the legacy route: permitted roles
+ * keep their extensions there (no strip is armed for them), and the fast path
+ * owns its own assert (pass `sharedServices: true` to disarm this one). The
+ * no-loader degradation case never reaches an assert — it already failed
+ * closed earlier via `g2EnforcementDegradationReason` +
+ * `shouldFailClosedMcpEnforcement`. Returns the offending foreign extension
+ * paths; empty = pass.
+ */
+export function legacyLoaderMcpAllowlistViolation(
+	session: LiveSessionLike | undefined,
+	route: { sharedServices: boolean; mcpPermitted: boolean },
+): string[] {
+	if (route.sharedServices || route.mcpPermitted) return [];
+	return collectForeignExtensions(session, allowedLiveExtensionPaths(false));
+}
+
 function appendTranscript(filePath: string | undefined, event: unknown): void {
 	if (!filePath) return;
 	// Task 26 (2026-08-24): serialize + redact at queue time, then route
@@ -971,6 +1007,45 @@ export async function runLiveSessionTask(input: LiveSessionSpawnInput): Promise<
 				);
 			}
 		}
+		// N1 (security-audit run-1, w9-n1): allowlist-shaped post-creation assert
+		// for the LEGACY DefaultResourceLoader route — the same backstop the
+		// shared-services fast path gets above, with identical semantics (single
+		// mcp-proxy check via collectForeignExtensions). stripMcpExtensions is a
+		// NAME-based denylist, so a differently-named MCP adapter (e.g.
+		// 'mcp-bridge') survives it; any extension that still loaded for a
+		// NON-MCP-permitted role is foreign (its allowlist is empty) and must
+		// fail the task instead of silently loading and connecting its servers.
+		// NOT armed for permitted roles (the legacy route keeps their extensions)
+		// and unreachable for the no-loader degradation path (that already failed
+		// closed above via g2EnforcementDegradationReason).
+		const legacyForeignExtensions = legacyLoaderMcpAllowlistViolation(session, {
+			sharedServices: Boolean(sharedBundle),
+			mcpPermitted,
+		});
+		if (legacyForeignExtensions.length > 0) {
+			const failClosedCode = "mcp-allowlist-fail-closed";
+			const legacyAllowedPaths = allowedLiveExtensionPaths(false);
+			appendEventFireAndForget(input.manifest.eventsPath, {
+				type: "live-session.foreign_extension_blocked",
+				runId: input.manifest.runId,
+				taskId: input.task.id,
+				message: `G2 MCP policy ABORTED live-session spawn for role "${input.task.role ?? "unknown"}" (${failClosedCode}): child session (legacy loader route) loaded extension(s) ${legacyForeignExtensions.join(
+					", ",
+				)} not sanctioned for a non-MCP-permitted role — failing closed instead of silently running with them.`,
+				data: {
+					foreignExtensions: legacyForeignExtensions,
+					allowed: legacyAllowedPaths,
+					route: "legacy-loader",
+					code: failClosedCode,
+					role: input.task.role ?? null,
+				},
+			});
+			throw new McpForeignExtensionError({
+				foreignExtensions: legacyForeignExtensions,
+				allowedExtensions: legacyAllowedPaths,
+				role: input.task.role,
+			});
+		}
 		// U3: register the test-only provider override (faux E2E seam) before
 		// anything streams. No-op in production (modelProviderOverride stays
 		// undefined there).

package/src/runtime/mcp-proxy.ts

@@ -144,12 +144,21 @@ export function mcpPermittedForRole(role: string | undefined): boolean {
  *   "replaces the built-in MCP support"). Both must be dropped to actually
  *   deny MCP; a path-segment match keeps npm-installed and file-path forms.
  *
- * KNOWN LIMITATION (security-review follow-up): this is a NAME-based
- * denylist. A third-party MCP adapter that registers `/mcp` under a
- * different name is NOT stripped and would re-enable discovery for
- * non-permitted roles on the live-session path. An allowlist-shaped
- * extension filter is the root fix — tracked as a follow-up work item
- * (SDD-2 §13, G2 hardening backlog).
+ * KNOWN LIMITATION (name-denylist gap — CLOSED at the assert layer,
+ * security-audit run-1 N1): this remains a NAME-based denylist, so a
+ * third-party MCP adapter that registers `/mcp` under a different name
+ * (e.g. `mcp-bridge`) is NOT stripped here and would re-enable discovery
+ * for non-permitted roles. The root allowlist fix is now layered on top:
+ * after the child session is created on the legacy `DefaultResourceLoader`
+ * route, the live-session runtime runs the same-shaped post-creation assert
+ * the shared-services fast path runs (`foreignMcpExtensionsAgainstAllowlist`
+ * below, fed by `allowedLiveExtensionPaths`) and FAILS the task for a
+ * non-MCP-permitted role when ANY extension survived the strip — a
+ * differently-named adapter now hard-fails (`McpForeignExtensionError`)
+ * instead of silently loading and connecting its servers. Permitted roles
+ * are unaffected (the strip is not armed for them); the no-loader
+ * degradation path already fails closed via `g2EnforcementDegradationReason`
+ * + `shouldFailClosedMcpEnforcement`.
  */
 export function isMcpExtensionPath(extensionPath: string): boolean {
 	if (extensionPath === "builtin:mcp") return true;
@@ -216,3 +225,53 @@ export function stripMcpExtensions(base: LoadedExtensionsShape): LoadedExtension
 export function shouldFailClosedMcpEnforcement(mcpPermitted: boolean, degradationReason: string | undefined): boolean {
 	return degradationReason !== undefined && !mcpPermitted;
 }
+
+/**
+ * N1 (security-audit run-1): the allowlist-shaped control the KNOWN
+ * LIMITATION block above called the root fix — given the extension paths a
+ * child session ACTUALLY loaded and the sanctioned allowlist, return the
+ * foreign/offending entries.
+ *
+ * Semantics are MIRRORED EXACTLY from the shared-services fast path's
+ * post-creation assert in live-session-runtime.ts (`allowedLiveExtensionPaths`
+ * + `collectForeignExtensions`): an extension is foreign iff its path is not
+ * a member of the allowlist — no name heuristics, no substring matching. For
+ * a non-MCP-permitted role the allowlist is empty, so ANY loaded extension
+ * (including a differently-named MCP adapter that survives
+ * `stripMcpExtensions`) is foreign; for a permitted role the allowlist is
+ * exactly `builtin:mcp`. `collectForeignExtensions` delegates here so both
+ * live-session routes share ONE implementation of these semantics.
+ */
+export function foreignMcpExtensionsAgainstAllowlist(
+	loadedExtensionPaths: readonly string[],
+	allowedExtensionPaths: readonly string[],
+): string[] {
+	const allowed = new Set(allowedExtensionPaths);
+	return loadedExtensionPaths.filter((extensionPath) => !allowed.has(extensionPath));
+}
+
+/**
+ * N1 (security-audit run-1, fail-closed): thrown by the live-session
+ * runtime's post-creation assert on the LEGACY `DefaultResourceLoader` route
+ * when the child session loaded extension(s) not sanctioned for a
+ * non-MCP-permitted role (e.g. a differently-named MCP adapter that survived
+ * `stripMcpExtensions`). Mirrors `LiveSessionEmbeddedEnforcementError`'s
+ * pattern: plain fields assigned in the constructor body (strip-types
+ * rejects TS parameter properties), a stamped `name`, and a `[<code>]`-
+ * prefixed message consistent with the G2 fail-closed style.
+ */
+export class McpForeignExtensionError extends Error {
+	readonly foreignExtensions: string[];
+	readonly allowedExtensions: string[];
+
+	constructor(input: { foreignExtensions: readonly string[]; allowedExtensions: readonly string[]; role: string | undefined }) {
+		super(
+			`[mcp-allowlist-fail-closed] Live-session spawn refused for role "${input.role ?? "unknown"}": child session loaded extension(s) not sanctioned for a non-MCP-permitted role: ${input.foreignExtensions.join(
+				", ",
+			)} (allowed: ${input.allowedExtensions.length === 0 ? "none" : input.allowedExtensions.join(", ")}) — failing closed instead of silently running with them.`,
+		);
+		this.foreignExtensions = [...input.foreignExtensions];
+		this.allowedExtensions = [...input.allowedExtensions];
+		this.name = "McpForeignExtensionError";
+	}
+}

package/src/runtime/model/pi-args.ts

@@ -2,6 +2,7 @@ import * as fs from "node:fs";
 import * as os from "node:os";
 import * as path from "node:path";
 import type { AgentConfig } from "../../agents/agent-config.ts";
+import { resolveToolPolicy } from "../../agents/agent-config.ts";
 import { getCrewEnv, getCrewEnvBool } from "../../config/env-vars.ts";
 import { atomicWriteFile } from "../../state/atomic-write.ts";
 import { hasRunStateLayout, packageRoot, userPiRoot } from "../../utils/paths.ts";
@@ -383,19 +384,16 @@ export function buildPiWorkerArgs(input: BuildPiWorkerArgsInput): BuildPiWorkerA
 	if (input.agent.disableTools === true) {
 		args.push("--no-tools"); // capability-locked agents giữ hành vi (goal-judge)
 	} else {
-		// AgentConfig.tools is string[] (parseToolsField normalizes the
-		// frontmatter CSV), but inline/runtime-constructed agents may still
-		// carry the raw CSV string — normalize both.
-		const rawTools: unknown = input.agent.tools;
-		const declared =
-			typeof rawTools === "string"
-				? rawTools
-						.split(",")
-						.map((t) => t.trim())
-						.filter(Boolean)
-				: Array.isArray(rawTools)
-					? rawTools.map((t) => String(t).trim()).filter(Boolean)
-					: [];
+		// S-7 (w4b security fix): the tool surface is now emitted from the unified
+		// resolveToolPolicy — the SAME seam live-session's filterActiveTools
+		// consumes — instead of the raw frontmatter declaration. This brings the
+		// source-aware allowlist precedence, the additive role denylist, and the
+		// read_only execution-tool floor (bash/edit/write stripped + excluded for
+		// default-deny/custom read-only roles regardless of frontmatter) onto the
+		// child spawn path. Role comes from input.role (the teamRole / spawn role);
+		// resolveToolPolicy normalizes the raw CSV-string form internally.
+		const policy = resolveToolPolicy(input.agent, input.role ?? input.agent.name);
+		const declared = policy.tools ?? [];
 		if (declared.length > 0) {
 			// L2-3 (pi 1.1.0 `+name` modifier syntax) — OPT-IN via
 			// PI_CREW_TOOLS_MODIFIERS=1, default OFF. Decision rationale (Wave A,
@@ -421,7 +419,10 @@ export function buildPiWorkerArgs(input: BuildPiWorkerArgsInput): BuildPiWorkerA
 		// buildSubagentToolAllowlist của pi-interactive-subagents index.ts:809-811).
 		// B2 (fix round 1): `disallowedTools:` frontmatter is a
 		// declaration-driven denylist (opt-in like `tools:`) — NOT the
-		// role-based policy D5 removed.
+		// role-based policy D5 removed. S-7 (w4b): the set now starts from
+		// resolveToolPolicy's excludeTools — which ALREADY merges
+		// agent.disallowedTools + the additive role denylist + the read_only
+		// execution-tool floor — so every policy cut reaches the child argv.
 		// U2-lite (pi 1.0.4 `--tools` semantics drift): on 1.0.4, `--tools` no
 		// longer cuts MCP — ambient MCP servers stay connected on parity
 		// (NON-hermetic) spawns. Fold `mcp__*` into the exclude list to restore
@@ -437,7 +438,7 @@ export function buildPiWorkerArgs(input: BuildPiWorkerArgsInput): BuildPiWorkerA
 		// `--no-tools` already locks the whole tool surface, an extra cut would
 		// be dead weight. Surface TUI panes strip argv flags after build
 		// (child-pi.ts stripHeadlessOnlyFlags), so this cut never reaches them.
-		const disallowed = new Set((input.agent.disallowedTools ?? []).map((t) => t.trim()).filter(Boolean));
+		const disallowed = new Set((policy.excludeTools ?? []).map((t) => t.trim()).filter(Boolean));
 		const paritySpawn = !resolveHermeticWorkers(input.hermeticWorkers);
 		if (paritySpawn) disallowed.add("mcp__" + "*");
 		if (disallowed.size > 0) args.push("--exclude-tools", [...disallowed].join(","));