pi-crew 0.2.3 → 0.2.5

package/src/extension/run-bundle-schema.ts

@@ -1,89 +1,89 @@
-import { isTeamRunStatus, isTeamTaskStatus } from "../state/contracts.ts";
-import type { TeamRunManifest, TeamTaskState, ArtifactDescriptor } from "../state/types.ts";
-import type { TeamEvent } from "../state/event-log.ts";
-import type { ExportedRunBundle } from "./run-export.ts";
-
-export interface BundleValidationResult {
-	ok: boolean;
-	errors: string[];
-}
-
-function isRecord(value: unknown): value is Record<string, unknown> {
-	return Boolean(value) && typeof value === "object" && !Array.isArray(value);
-}
-
-function validateArtifact(value: unknown, index: number, errors: string[]): value is ArtifactDescriptor {
-	if (!isRecord(value)) {
-		errors.push(`manifest.artifacts[${index}] must be an object.`);
-		return false;
-	}
-	const before = errors.length;
-	if (typeof value.kind !== "string") errors.push(`manifest.artifacts[${index}].kind must be a string.`);
-	if (typeof value.path !== "string") errors.push(`manifest.artifacts[${index}].path must be a string.`);
-	if (typeof value.createdAt !== "string") errors.push(`manifest.artifacts[${index}].createdAt must be a string.`);
-	if (typeof value.producer !== "string") errors.push(`manifest.artifacts[${index}].producer must be a string.`);
-	if (value.retention !== "run" && value.retention !== "project" && value.retention !== "temporary") errors.push(`manifest.artifacts[${index}].retention is invalid.`);
-	return errors.length === before;
-}
-
-function validateManifest(value: unknown, errors: string[]): value is TeamRunManifest {
-	if (!isRecord(value)) {
-		errors.push("manifest must be an object.");
-		return false;
-	}
-	const before = errors.length;
-	if (value.schemaVersion !== 1) errors.push("manifest.schemaVersion must be 1.");
-	for (const field of ["runId", "team", "goal", "createdAt", "updatedAt", "cwd", "stateRoot", "artifactsRoot", "tasksPath", "eventsPath"] as const) {
-		if (typeof value[field] !== "string") errors.push(`manifest.${field} must be a string.`);
-	}
-	if (!isTeamRunStatus(value.status)) errors.push("manifest.status is invalid.");
-	if (value.workspaceMode !== "single" && value.workspaceMode !== "worktree") errors.push("manifest.workspaceMode must be single or worktree.");
-	if (!Array.isArray(value.artifacts)) errors.push("manifest.artifacts must be an array.");
-	else value.artifacts.forEach((artifact, index) => validateArtifact(artifact, index, errors));
-	return errors.length === before;
-}
-
-function validateTask(value: unknown, index: number, errors: string[]): value is TeamTaskState {
-	if (!isRecord(value)) {
-		errors.push(`tasks[${index}] must be an object.`);
-		return false;
-	}
-	const before = errors.length;
-	for (const field of ["id", "runId", "role", "agent", "title", "cwd"] as const) {
-		if (typeof value[field] !== "string") errors.push(`tasks[${index}].${field} must be a string.`);
-	}
-	if (!isTeamTaskStatus(value.status)) errors.push(`tasks[${index}].status is invalid.`);
-	if (!Array.isArray(value.dependsOn)) errors.push(`tasks[${index}].dependsOn must be an array.`);
-	return errors.length === before;
-}
-
-function validateEvent(value: unknown, index: number, errors: string[]): value is TeamEvent {
-	if (!isRecord(value)) {
-		errors.push(`events[${index}] must be an object.`);
-		return false;
-	}
-	const before = errors.length;
-	for (const field of ["time", "type", "runId"] as const) {
-		if (typeof value[field] !== "string") errors.push(`events[${index}].${field} must be a string.`);
-	}
-	return errors.length === before;
-}
-
-export function validateRunBundle(value: unknown): BundleValidationResult {
-	const errors: string[] = [];
-	if (!isRecord(value)) return { ok: false, errors: ["bundle must be an object."] };
-	if (value.schemaVersion !== 1) errors.push("schemaVersion must be 1.");
-	if (typeof value.exportedAt !== "string") errors.push("exportedAt must be a string.");
-	validateManifest(value.manifest, errors);
-	if (!Array.isArray(value.tasks)) errors.push("tasks must be an array.");
-	else value.tasks.forEach((task, index) => validateTask(task, index, errors));
-	if (!Array.isArray(value.events)) errors.push("events must be an array.");
-	else value.events.forEach((event, index) => validateEvent(event, index, errors));
-	if (!Array.isArray(value.artifactPaths) || !value.artifactPaths.every((item) => typeof item === "string")) errors.push("artifactPaths must be an array of strings.");
-	return { ok: errors.length === 0, errors };
-}
-
-export function assertRunBundle(value: unknown): asserts value is ExportedRunBundle {
-	const validation = validateRunBundle(value);
-	if (!validation.ok) throw new Error(`File is not a valid pi-crew exported run bundle:\n${validation.errors.map((error) => `- ${error}`).join("\n")}`);
-}
+import { isTeamRunStatus, isTeamTaskStatus } from "../state/contracts.ts";
+import type { TeamRunManifest, TeamTaskState, ArtifactDescriptor } from "../state/types.ts";
+import type { TeamEvent } from "../state/event-log.ts";
+import type { ExportedRunBundle } from "./run-export.ts";
+
+export interface BundleValidationResult {
+	ok: boolean;
+	errors: string[];
+}
+
+function isRecord(value: unknown): value is Record<string, unknown> {
+	return Boolean(value) && typeof value === "object" && !Array.isArray(value);
+}
+
+function validateArtifact(value: unknown, index: number, errors: string[]): value is ArtifactDescriptor {
+	if (!isRecord(value)) {
+		errors.push(`manifest.artifacts[${index}] must be an object.`);
+		return false;
+	}
+	const before = errors.length;
+	if (typeof value.kind !== "string") errors.push(`manifest.artifacts[${index}].kind must be a string.`);
+	if (typeof value.path !== "string") errors.push(`manifest.artifacts[${index}].path must be a string.`);
+	if (typeof value.createdAt !== "string") errors.push(`manifest.artifacts[${index}].createdAt must be a string.`);
+	if (typeof value.producer !== "string") errors.push(`manifest.artifacts[${index}].producer must be a string.`);
+	if (value.retention !== "run" && value.retention !== "project" && value.retention !== "temporary") errors.push(`manifest.artifacts[${index}].retention is invalid.`);
+	return errors.length === before;
+}
+
+function validateManifest(value: unknown, errors: string[]): value is TeamRunManifest {
+	if (!isRecord(value)) {
+		errors.push("manifest must be an object.");
+		return false;
+	}
+	const before = errors.length;
+	if (value.schemaVersion !== 1) errors.push("manifest.schemaVersion must be 1.");
+	for (const field of ["runId", "team", "goal", "createdAt", "updatedAt", "cwd", "stateRoot", "artifactsRoot", "tasksPath", "eventsPath"] as const) {
+		if (typeof value[field] !== "string") errors.push(`manifest.${field} must be a string.`);
+	}
+	if (!isTeamRunStatus(value.status)) errors.push("manifest.status is invalid.");
+	if (value.workspaceMode !== "single" && value.workspaceMode !== "worktree") errors.push("manifest.workspaceMode must be single or worktree.");
+	if (!Array.isArray(value.artifacts)) errors.push("manifest.artifacts must be an array.");
+	else value.artifacts.forEach((artifact, index) => validateArtifact(artifact, index, errors));
+	return errors.length === before;
+}
+
+function validateTask(value: unknown, index: number, errors: string[]): value is TeamTaskState {
+	if (!isRecord(value)) {
+		errors.push(`tasks[${index}] must be an object.`);
+		return false;
+	}
+	const before = errors.length;
+	for (const field of ["id", "runId", "role", "agent", "title", "cwd"] as const) {
+		if (typeof value[field] !== "string") errors.push(`tasks[${index}].${field} must be a string.`);
+	}
+	if (!isTeamTaskStatus(value.status)) errors.push(`tasks[${index}].status is invalid.`);
+	if (!Array.isArray(value.dependsOn)) errors.push(`tasks[${index}].dependsOn must be an array.`);
+	return errors.length === before;
+}
+
+function validateEvent(value: unknown, index: number, errors: string[]): value is TeamEvent {
+	if (!isRecord(value)) {
+		errors.push(`events[${index}] must be an object.`);
+		return false;
+	}
+	const before = errors.length;
+	for (const field of ["time", "type", "runId"] as const) {
+		if (typeof value[field] !== "string") errors.push(`events[${index}].${field} must be a string.`);
+	}
+	return errors.length === before;
+}
+
+export function validateRunBundle(value: unknown): BundleValidationResult {
+	const errors: string[] = [];
+	if (!isRecord(value)) return { ok: false, errors: ["bundle must be an object."] };
+	if (value.schemaVersion !== 1) errors.push("schemaVersion must be 1.");
+	if (typeof value.exportedAt !== "string") errors.push("exportedAt must be a string.");
+	validateManifest(value.manifest, errors);
+	if (!Array.isArray(value.tasks)) errors.push("tasks must be an array.");
+	else value.tasks.forEach((task, index) => validateTask(task, index, errors));
+	if (!Array.isArray(value.events)) errors.push("events must be an array.");
+	else value.events.forEach((event, index) => validateEvent(event, index, errors));
+	if (!Array.isArray(value.artifactPaths) || !value.artifactPaths.every((item) => typeof item === "string")) errors.push("artifactPaths must be an array of strings.");
+	return { ok: errors.length === 0, errors };
+}
+
+export function assertRunBundle(value: unknown): asserts value is ExportedRunBundle {
+	const validation = validateRunBundle(value);
+	if (!validation.ok) throw new Error(`File is not a valid pi-crew exported run bundle:\n${validation.errors.map((error) => `- ${error}`).join("\n")}`);
+}

package/src/extension/run-export.ts

@@ -1,73 +1,73 @@
-import * as fs from "node:fs";
-import * as path from "node:path";
-import * as os from "node:os";
-import type { TeamRunManifest, TeamTaskState } from "../state/types.ts";
-import { writeArtifact } from "../state/artifact-store.ts";
-import { readEvents, type TeamEvent } from "../state/event-log.ts";
-import { redactSecrets } from "../utils/redaction.ts";
-
-/** Replace absolute paths containing home directory with ~/ */
-function redactHomePaths<T>(obj: T): T {
-	const home = os.homedir();
-	if (!home) return redactSecrets(obj) as T;
-	const json = JSON.stringify(obj);
-	const safe = json.split(home).join("~");
-	return redactSecrets(JSON.parse(safe)) as T;
-}
-
-export interface ExportedRunBundle {
-	schemaVersion: 1;
-	exportedAt: string;
-	manifest: TeamRunManifest;
-	tasks: TeamTaskState[];
-	events: TeamEvent[];
-	artifactPaths: string[];
-}
-
-export function exportRunBundle(manifest: TeamRunManifest, tasks: TeamTaskState[]): { jsonPath: string; markdownPath: string } {
-	const events = readEvents(manifest.eventsPath);
-	const safeManifest = redactHomePaths(manifest);
-	const safeTasks = redactHomePaths(tasks);
-	const safeEvents = redactHomePaths(events);
-	const bundle: ExportedRunBundle = {
-		schemaVersion: 1,
-		exportedAt: new Date().toISOString(),
-		manifest: safeManifest as TeamRunManifest,
-		tasks: safeTasks as TeamTaskState[],
-		events: safeEvents as TeamEvent[],
-		artifactPaths: safeManifest.artifacts.map((artifact) => artifact.path),
-	};
-	const json = writeArtifact(manifest.artifactsRoot, {
-		kind: "metadata",
-		relativePath: "export/run-export.json",
-		producer: "run-export",
-		content: `${JSON.stringify(bundle, null, 2)}\n`,
-	});
-	const markdown = writeArtifact(manifest.artifactsRoot, {
-		kind: "summary",
-		relativePath: "export/run-export.md",
-		producer: "run-export",
-		content: [
-			`# pi-crew export ${safeManifest.runId}`,
-			"",
-			`Exported: ${bundle.exportedAt}`,
-			`Status: ${safeManifest.status}`,
-			`Team: ${safeManifest.team}`,
-			`Workflow: ${safeManifest.workflow ?? "(none)"}`,
-			`Goal: ${safeManifest.goal}`,
-			"",
-			"## Tasks",
-			...safeTasks.map((task) => `- ${task.id}: ${task.status} (${task.role} -> ${task.agent})${task.error ? ` - ${task.error}` : ""}`),
-			"",
-			"## Artifacts",
-			...(safeManifest.artifacts.length ? safeManifest.artifacts.map((artifact) => `- ${artifact.kind}: ${artifact.path}`) : ["- (none)"]),
-			"",
-			"## Recent Events",
-			...(safeEvents.slice(-20).map((event) => `- ${event.time} ${event.type}${event.taskId ? ` ${event.taskId}` : ""}${event.message ? `: ${event.message}` : ""}`)),
-			"",
-		].join("\n"),
-	});
-	// Ensure artifact dirs are materialized before returning paths on filesystems with delayed metadata.
-	fs.statSync(path.dirname(json.path));
-	return { jsonPath: json.path, markdownPath: markdown.path };
-}
+import * as fs from "node:fs";
+import * as path from "node:path";
+import * as os from "node:os";
+import type { TeamRunManifest, TeamTaskState } from "../state/types.ts";
+import { writeArtifact } from "../state/artifact-store.ts";
+import { readEvents, type TeamEvent } from "../state/event-log.ts";
+import { redactSecrets } from "../utils/redaction.ts";
+
+/** Replace absolute paths containing home directory with ~/ */
+function redactHomePaths<T>(obj: T): T {
+	const home = os.homedir();
+	if (!home) return redactSecrets(obj) as T;
+	const json = JSON.stringify(obj);
+	const safe = json.split(home).join("~");
+	return redactSecrets(JSON.parse(safe)) as T;
+}
+
+export interface ExportedRunBundle {
+	schemaVersion: 1;
+	exportedAt: string;
+	manifest: TeamRunManifest;
+	tasks: TeamTaskState[];
+	events: TeamEvent[];
+	artifactPaths: string[];
+}
+
+export function exportRunBundle(manifest: TeamRunManifest, tasks: TeamTaskState[]): { jsonPath: string; markdownPath: string } {
+	const events = readEvents(manifest.eventsPath);
+	const safeManifest = redactHomePaths(manifest);
+	const safeTasks = redactHomePaths(tasks);
+	const safeEvents = redactHomePaths(events);
+	const bundle: ExportedRunBundle = {
+		schemaVersion: 1,
+		exportedAt: new Date().toISOString(),
+		manifest: safeManifest as TeamRunManifest,
+		tasks: safeTasks as TeamTaskState[],
+		events: safeEvents as TeamEvent[],
+		artifactPaths: safeManifest.artifacts.map((artifact) => artifact.path),
+	};
+	const json = writeArtifact(manifest.artifactsRoot, {
+		kind: "metadata",
+		relativePath: "export/run-export.json",
+		producer: "run-export",
+		content: `${JSON.stringify(bundle, null, 2)}\n`,
+	});
+	const markdown = writeArtifact(manifest.artifactsRoot, {
+		kind: "summary",
+		relativePath: "export/run-export.md",
+		producer: "run-export",
+		content: [
+			`# pi-crew export ${safeManifest.runId}`,
+			"",
+			`Exported: ${bundle.exportedAt}`,
+			`Status: ${safeManifest.status}`,
+			`Team: ${safeManifest.team}`,
+			`Workflow: ${safeManifest.workflow ?? "(none)"}`,
+			`Goal: ${safeManifest.goal}`,
+			"",
+			"## Tasks",
+			...safeTasks.map((task) => `- ${task.id}: ${task.status} (${task.role} -> ${task.agent})${task.error ? ` - ${task.error}` : ""}`),
+			"",
+			"## Artifacts",
+			...(safeManifest.artifacts.length ? safeManifest.artifacts.map((artifact) => `- ${artifact.kind}: ${artifact.path}`) : ["- (none)"]),
+			"",
+			"## Recent Events",
+			...(safeEvents.slice(-20).map((event) => `- ${event.time} ${event.type}${event.taskId ? ` ${event.taskId}` : ""}${event.message ? `: ${event.message}` : ""}`)),
+			"",
+		].join("\n"),
+	});
+	// Ensure artifact dirs are materialized before returning paths on filesystems with delayed metadata.
+	fs.statSync(path.dirname(json.path));
+	return { jsonPath: json.path, markdownPath: markdown.path };
+}

package/src/extension/run-import.ts

@@ -1,84 +1,84 @@
-import * as fs from "node:fs";
-import * as path from "node:path";
-import { assertRunBundle } from "./run-bundle-schema.ts";
-import { projectCrewRoot, userCrewRoot } from "../utils/paths.ts";
-import { DEFAULT_PATHS } from "../config/defaults.ts";
-import { assertSafePathId, resolveContainedRelativePath, resolveRealContainedPath } from "../utils/safe-paths.ts";
-import { detectImportConflicts, type ConflictReport } from "../runtime/delta-conflict.ts";
-
-export interface ImportedRunBundleInfo {
-	runId: string;
-	importedAt: string;
-	bundlePath: string;
-	summaryPath: string;
-	conflictReport?: ConflictReport;
-}
-
-function importRoot(cwd: string, scope: "project" | "user"): string {
-	const base = scope === "project" ? projectCrewRoot(cwd) : userCrewRoot();
-	return path.join(base, DEFAULT_PATHS.state.importsSubdir);
-}
-
-export function importRunBundle(cwd: string, bundlePath: string, scope: "project" | "user" = "project"): ImportedRunBundleInfo {
-	const resolvedPath = path.isAbsolute(bundlePath) ? bundlePath : path.resolve(cwd, bundlePath);
-	// Path containment: only allow reading bundles from cwd or user home
-	const allowedBases = [cwd];
-	try { allowedBases.push(userCrewRoot()); } catch { /* ignore */ }
-	try { allowedBases.push(projectCrewRoot(cwd)); } catch { /* ignore */ }
-	const isContained = allowedBases.some((base) => resolvedPath.startsWith(base + path.sep) || resolvedPath === base);
-	if (!isContained) throw new Error(`Import path must be within project directory or crew root: ${resolvedPath}`);
-	const raw = JSON.parse(fs.readFileSync(resolvedPath, "utf-8")) as unknown;
-	assertRunBundle(raw);
-	const runId = assertSafePathId("runId", raw.manifest.runId);
-	const importedAt = new Date().toISOString();
-
-	// Non-blocking conflict detection: compare incoming bundle against any existing state.
-	let conflictReport: ConflictReport | undefined;
-	try {
-		const existingManifestPath = path.join(importRoot(cwd, scope), runId, "run-export.json");
-		if (fs.existsSync(existingManifestPath)) {
-			const existingRaw = JSON.parse(fs.readFileSync(existingManifestPath, "utf-8")) as { manifest?: Record<string, unknown>; tasks?: unknown[] };
-			conflictReport = detectImportConflicts(
-				{ manifest: raw.manifest as unknown as Record<string, unknown>, tasks: raw.tasks as unknown[] },
-				{ manifest: existingRaw.manifest, tasks: existingRaw.tasks },
-			);
-		}
-	} catch {
-		// Conflict detection is best-effort; do not block import on failure.
-	}
-
-	const importsRoot = importRoot(cwd, scope);
-	fs.mkdirSync(importsRoot, { recursive: true });
-	if (fs.lstatSync(importsRoot).isSymbolicLink()) throw new Error(`Invalid import root: ${importsRoot}`);
-	resolveRealContainedPath(path.dirname(importsRoot), path.basename(importsRoot));
-	const root = resolveContainedRelativePath(importsRoot, runId, "runId");
-	fs.mkdirSync(root, { recursive: true });
-	// TOCTOU note: mkdirSync would throw EEXIST if a symlink already existed.
-	// The lstatSync check catches a symlink swapped in between mkdirSync and the check
-	// (theoretically possible but requires local attacker with exact timing).
-	// resolveRealContainedPath provides an additional real-path containment barrier.
-	if (fs.lstatSync(root).isSymbolicLink()) throw new Error(`Invalid import directory: ${root}`);
-	resolveRealContainedPath(importsRoot, runId);
-	const targetJson = path.join(root, "run-export.json");
-	const targetSummary = path.join(root, "README.md");
-	for (const target of [targetJson, targetSummary]) {
-		if (fs.existsSync(target) && fs.lstatSync(target).isSymbolicLink()) throw new Error(`Invalid import target: ${target}`);
-	}
-	fs.writeFileSync(targetJson, `${JSON.stringify({ ...raw, importedAt, importedFrom: resolvedPath }, null, 2)}\n`, "utf-8");
-	fs.writeFileSync(targetSummary, [
-		`# Imported pi-crew run ${runId}`,
-		"",
-		`Imported: ${importedAt}`,
-		`Source: ${resolvedPath}`,
-		`Original export: ${raw.exportedAt}`,
-		`Status: ${raw.manifest.status}`,
-		`Team: ${raw.manifest.team}`,
-		`Workflow: ${raw.manifest.workflow ?? "(none)"}`,
-		`Goal: ${raw.manifest.goal}`,
-		"",
-		"## Tasks",
-		...raw.tasks.map((task) => `- ${task.id}: ${task.status} (${task.role} -> ${task.agent})${task.error ? ` - ${task.error}` : ""}`),
-		"",
-	].join("\n"), "utf-8");
-	return { runId, importedAt, bundlePath: targetJson, summaryPath: targetSummary, ...(conflictReport?.hasConflicts ? { conflictReport } : {}) };
-}
+import * as fs from "node:fs";
+import * as path from "node:path";
+import { assertRunBundle } from "./run-bundle-schema.ts";
+import { projectCrewRoot, userCrewRoot } from "../utils/paths.ts";
+import { DEFAULT_PATHS } from "../config/defaults.ts";
+import { assertSafePathId, resolveContainedRelativePath, resolveRealContainedPath } from "../utils/safe-paths.ts";
+import { detectImportConflicts, type ConflictReport } from "../runtime/delta-conflict.ts";
+
+export interface ImportedRunBundleInfo {
+	runId: string;
+	importedAt: string;
+	bundlePath: string;
+	summaryPath: string;
+	conflictReport?: ConflictReport;
+}
+
+function importRoot(cwd: string, scope: "project" | "user"): string {
+	const base = scope === "project" ? projectCrewRoot(cwd) : userCrewRoot();
+	return path.join(base, DEFAULT_PATHS.state.importsSubdir);
+}
+
+export function importRunBundle(cwd: string, bundlePath: string, scope: "project" | "user" = "project"): ImportedRunBundleInfo {
+	const resolvedPath = path.isAbsolute(bundlePath) ? bundlePath : path.resolve(cwd, bundlePath);
+	// Path containment: only allow reading bundles from cwd or user home
+	const allowedBases = [cwd];
+	try { allowedBases.push(userCrewRoot()); } catch { /* ignore */ }
+	try { allowedBases.push(projectCrewRoot(cwd)); } catch { /* ignore */ }
+	const isContained = allowedBases.some((base) => resolvedPath.startsWith(base + path.sep) || resolvedPath === base);
+	if (!isContained) throw new Error(`Import path must be within project directory or crew root: ${resolvedPath}`);
+	const raw = JSON.parse(fs.readFileSync(resolvedPath, "utf-8")) as unknown;
+	assertRunBundle(raw);
+	const runId = assertSafePathId("runId", raw.manifest.runId);
+	const importedAt = new Date().toISOString();
+
+	// Non-blocking conflict detection: compare incoming bundle against any existing state.
+	let conflictReport: ConflictReport | undefined;
+	try {
+		const existingManifestPath = path.join(importRoot(cwd, scope), runId, "run-export.json");
+		if (fs.existsSync(existingManifestPath)) {
+			const existingRaw = JSON.parse(fs.readFileSync(existingManifestPath, "utf-8")) as { manifest?: Record<string, unknown>; tasks?: unknown[] };
+			conflictReport = detectImportConflicts(
+				{ manifest: raw.manifest as unknown as Record<string, unknown>, tasks: raw.tasks as unknown[] },
+				{ manifest: existingRaw.manifest, tasks: existingRaw.tasks },
+			);
+		}
+	} catch {
+		// Conflict detection is best-effort; do not block import on failure.
+	}
+
+	const importsRoot = importRoot(cwd, scope);
+	fs.mkdirSync(importsRoot, { recursive: true });
+	if (fs.lstatSync(importsRoot).isSymbolicLink()) throw new Error(`Invalid import root: ${importsRoot}`);
+	resolveRealContainedPath(path.dirname(importsRoot), path.basename(importsRoot));
+	const root = resolveContainedRelativePath(importsRoot, runId, "runId");
+	fs.mkdirSync(root, { recursive: true });
+	// TOCTOU note: mkdirSync would throw EEXIST if a symlink already existed.
+	// The lstatSync check catches a symlink swapped in between mkdirSync and the check
+	// (theoretically possible but requires local attacker with exact timing).
+	// resolveRealContainedPath provides an additional real-path containment barrier.
+	if (fs.lstatSync(root).isSymbolicLink()) throw new Error(`Invalid import directory: ${root}`);
+	resolveRealContainedPath(importsRoot, runId);
+	const targetJson = path.join(root, "run-export.json");
+	const targetSummary = path.join(root, "README.md");
+	for (const target of [targetJson, targetSummary]) {
+		if (fs.existsSync(target) && fs.lstatSync(target).isSymbolicLink()) throw new Error(`Invalid import target: ${target}`);
+	}
+	fs.writeFileSync(targetJson, `${JSON.stringify({ ...raw, importedAt, importedFrom: resolvedPath }, null, 2)}\n`, "utf-8");
+	fs.writeFileSync(targetSummary, [
+		`# Imported pi-crew run ${runId}`,
+		"",
+		`Imported: ${importedAt}`,
+		`Source: ${resolvedPath}`,
+		`Original export: ${raw.exportedAt}`,
+		`Status: ${raw.manifest.status}`,
+		`Team: ${raw.manifest.team}`,
+		`Workflow: ${raw.manifest.workflow ?? "(none)"}`,
+		`Goal: ${raw.manifest.goal}`,
+		"",
+		"## Tasks",
+		...raw.tasks.map((task) => `- ${task.id}: ${task.status} (${task.role} -> ${task.agent})${task.error ? ` - ${task.error}` : ""}`),
+		"",
+	].join("\n"), "utf-8");
+	return { runId, importedAt, bundlePath: targetJson, summaryPath: targetSummary, ...(conflictReport?.hasConflicts ? { conflictReport } : {}) };
+}