pi-crew 0.6.0 → 0.6.3

package/src/state/locks.ts

@@ -1,9 +1,10 @@
 import * as fs from "node:fs";
 import * as path from "node:path";
-import { randomUUID } from "node:crypto";
+import { randomUUID, timingSafeEqual } from "node:crypto";
 import type { TeamRunManifest } from "./types.ts";
 import { DEFAULT_LOCKS } from "../config/defaults.ts";
 import { sleepSync } from "../utils/sleep.ts";
+import { isSymlinkSafePath } from "./atomic-write.ts";
 
 export interface RunLockOptions {
 	staleMs?: number;
@@ -52,8 +53,13 @@ function isLockHolderAlive(filePath: string): boolean {
 			return true; // Signal 0 succeeded — process is alive
 		} catch (error) {
 			const code = (error as NodeJS.ErrnoException).code;
-			// EPERM: process exists but we don't have permission to signal it
-			return code === "EPERM";
+			// EPERM: process exists but we don't have permission to signal it.
+			// Since we cannot verify liveness, treat the holder as potentially
+			// stale so the lock can be stolen rather than blocking indefinitely.
+			// This is an acceptable trade-off: EPERM requires elevated privileges,
+			// and blocking indefinitely would be worse. The risk is low.
+			// Other errors (ESRCH — process doesn't exist) also mean holder is dead.
+			return false;
 		}
 	} catch {
 		return true; // Can't read — assume alive to be safe
@@ -72,7 +78,24 @@ function isLockHolderAlive(filePath: string): boolean {
 export type LockKind = "run" | "file";
 
 function writeLockFile(filePath: string, token: string, kind: LockKind = "file"): void {
-	const fd = fs.openSync(filePath, fs.constants.O_WRONLY | fs.constants.O_CREAT | fs.constants.O_EXCL, 0o644);
+	// Reject a pre-existing symlink at the lock path before O_CREAT|O_EXCL.
+	// O_EXCL fails with EEXIST if the path exists (including as a symlink),
+	// but the failure mode is confusing — an explicit lstatSync gives a
+	// clean, distinguishable error instead.
+	try {
+		const stat = fs.lstatSync(filePath);
+		if (stat.isSymbolicLink()) {
+			throw new Error(`Refusing to create lock file over symlink: ${filePath}`);
+		}
+	} catch (error) {
+		const code = (error as NodeJS.ErrnoException).code;
+		// ENOENT means the path doesn't exist yet — that's fine, proceed.
+		// Anything else (EACCES, EPERM, etc.) should surface immediately.
+		if (code !== "ENOENT") throw error;
+	}
+	// Ensure parent directory exists (may have been cleaned up by a concurrent process)
+	fs.mkdirSync(path.dirname(filePath), { recursive: true });
+	const fd = fs.openSync(filePath, fs.constants.O_WRONLY | fs.constants.O_CREAT | fs.constants.O_EXCL, 0o600);
 	try {
 		fs.writeSync(fd, JSON.stringify({ kind, pid: process.pid, createdAt: new Date().toISOString(), token }));
 	} finally {
@@ -86,6 +109,9 @@ function writeLockFile(filePath: string, token: string, kind: LockKind = "file")
  */
 function readLockToken(filePath: string): string | undefined {
 	try {
+		// Refuse to read a symlink — prevents reading a target an attacker placed
+		const stat = fs.lstatSync(filePath);
+		if (stat.isSymbolicLink()) return undefined;
 		const raw = fs.readFileSync(filePath, "utf-8");
 		const parsed = JSON.parse(raw) as { token?: unknown };
 		return typeof parsed.token === "string" ? parsed.token : undefined;
@@ -103,14 +129,37 @@ function readLockToken(filePath: string): string | undefined {
  *
  * With token matching, A's release is a no-op for B's lock.
  */
+function timingSafeTokenMatch(a: string, b: string): boolean {
+	const bufA = Buffer.from(String(a));
+	const bufB = Buffer.from(String(b));
+	const len = Math.max(bufA.length, bufB.length);
+	const safeA = Buffer.alloc(len);
+	const safeB = Buffer.alloc(len);
+	bufA.copy(safeA);
+	bufB.copy(safeB);
+	return timingSafeEqual(safeA, safeB);
+}
+
 function releaseLock(filePath: string, token: string): void {
+	// FIX: Do not delete a symlink — it may have been planted by an attacker
+	// after our lock was released. A legitimate lock file should never be a
+	// symlink since writeLockFile uses O_CREAT|O_EXCL which fails on symlinks.
+	let isSymlink = false;
+	try {
+		isSymlink = fs.lstatSync(filePath).isSymbolicLink();
+	} catch { /* file doesn't exist — that's fine, we'll handle ENOENT below */ }
+	if (isSymlink) return;
+
 	const stored = readLockToken(filePath);
-	if (stored === undefined || stored === token) {
+	if (stored === undefined || timingSafeTokenMatch(stored, token)) {
 		try {
 			fs.rmSync(filePath, { force: true });
-		} catch {
-			// Best-effort cleanup. Either someone else with the same token got
-			// there first, or the lock is already gone — both are fine.
+		} catch (error) {
+			// FIX: Only ignore ENOENT (lock already gone). Other errors (EACCES,
+			// EPERM, EBUSY) indicate a real problem and should be surfaced.
+			const code = (error as NodeJS.ErrnoException).code;
+			if (code !== "ENOENT") throw error;
+			// Lock already gone — that's fine, we wanted to release it anyway.
 		}
 	}
 	// If the stored token does not match, our lock has been stolen
@@ -131,17 +180,12 @@ function acquireLockWithRetry(filePath: string, staleMs: number, kind: LockKind
 			if (Date.now() > deadline) {
 				throw new Error(`Run '${path.basename(filePath)}' is locked by another operation.`);
 			}
-			// FIX: Use both staleness AND PID liveness to decide if we can steal
-			// a lock. Previously only staleness was checked, so a process whose
-			// PID was recently reused by another process could have its lock
-			// stolen even while still active. Now: fresh+alive = fail, else = clear.
 			const isStale = isLockStale(filePath, staleMs);
 			const isHolderAlive = isLockHolderAlive(filePath);
 			if (!isStale && isHolderAlive) {
-				// Lock is fresh AND holder is alive — fail fast
 				throw new Error(`Run '${path.basename(filePath)}' is locked by another operation.`);
 			}
-			// Lock is stale OR holder is dead — safe to clear
+			// Stale or dead holder — forcibly remove the lock.
 			try {
 				fs.rmSync(filePath, { force: true });
 			} catch { /* race — let loop retry */ }
@@ -169,16 +213,12 @@ async function acquireLockWithRetryAsync(filePath: string, staleMs: number, kind
 			if (Date.now() > deadline) {
 				throw new Error(`Run '${path.basename(filePath)}' is locked by another operation.`);
 			}
-			// FIX (Round 14, locks-async): Mirror the sync path's staleness AND
-			// PID liveness check. Previously the async path only checked
-			// staleness, so a recently-reused PID could have its lock stolen
-			// even while still running. Now: fresh + alive holder = fail.
 			const isStale = isLockStale(filePath, staleMs);
 			const isHolderAlive = isLockHolderAlive(filePath);
 			if (!isStale && isHolderAlive) {
 				throw new Error(`Run '${path.basename(filePath)}' is locked by another operation.`);
 			}
-			// Lock is stale OR holder is dead — safe to clear
+			// Stale or dead holder — forcibly remove the lock.
 			try {
 				fs.rmSync(filePath, { force: true });
 			} catch { /* race — let loop retry */ }
@@ -200,8 +240,38 @@ export function withFileLockSync<T>(filePath: string, fn: () => T, options: RunL
 	// append, or even the lock acquisition itself) would race with the lock.
 	const lockFile = `${filePath}.lock`;
 	const staleMs = options.staleMs ?? DEFAULT_STALE_MS;
+	// FIX: Validate the parent directory is not a symlink BEFORE calling mkdirSync.
+	// Between mkdir and lock acquisition, an attacker could plant a symlink.
+	if (!isSymlinkSafePath(path.dirname(lockFile))) throw new Error("Refusing: parent of lock directory is a symlink");
 	fs.mkdirSync(path.dirname(lockFile), { recursive: true });
-	const token = acquireLockWithRetry(lockFile, staleMs, "file");
+	// FIX: Validate that the target file still exists. If it was deleted and
+	// recreated since the last lock cycle, the old .lock file may be orphaned
+	// and should not block the new cycle. Clean it up if the target is missing.
+	try {
+		fs.statSync(filePath);
+	} catch {
+		// Target file doesn't exist — clean up any stale .lock file and proceed.
+		// The lock will be acquired fresh for the new file (if fn creates it).
+		try { fs.rmSync(lockFile, { force: true }); } catch { /* ignore */ }
+	}
+	// FIX (TOCTOU): Re-validate symlink safety before each lock acquisition
+	// attempt. Between our initial check and the acquisition (and between
+	// acquireLockWithRetry's internal retries), an attacker could plant a
+	// symlink. We must re-check on each iteration to catch TOCTOU races.
+	let token = "";
+	let attempt = 0;
+	const deadline = Date.now() + staleMs * 2;
+	while (Date.now() <= deadline) {
+		if (!isSymlinkSafePath(path.dirname(lockFile))) throw new Error("Refusing: parent of lock directory is a symlink");
+		try {
+			token = acquireLockWithRetry(lockFile, staleMs, "file");
+			break;
+		} catch {
+			sleepSync(Math.min(250, 25 * 2 ** attempt));
+			attempt++;
+		}
+	}
+	if (token === "") throw new Error(`Run '${path.basename(lockFile)}' is locked by another operation.`);
 	try {
 		return fn();
 	} finally {
@@ -213,23 +283,42 @@ export function withFileLockSync<T>(filePath: string, fn: () => T, options: RunL
 export function withRunLockSync<T>(manifest: TeamRunManifest, fn: () => T, options: RunLockOptions = {}): T {
 	const filePath = lockPath(manifest);
 	const staleMs = options.staleMs ?? DEFAULT_STALE_MS;
+	const existingToken = runLockHeldByUs.get(filePath);
+	if (existingToken) {
+		// Re-entrant: already hold this lock, just run the callback.
+		return fn();
+	}
 	fs.mkdirSync(path.dirname(filePath), { recursive: true });
 	const token = acquireLockWithRetry(filePath, staleMs, "run");
+	runLockHeldByUs.set(filePath, token);
 	try {
 		return fn();
 	} finally {
+		runLockHeldByUs.delete(filePath);
 		releaseLock(filePath, token);
 	}
 }
 
+// Track re-entrant lock acquisitions per lock file path. When a lock is
+// already held by this call stack (handleResume -> executeTeamRun ->
+// executeTeamRunCore), we skip re-acquisition to avoid deadlock.
+const runLockHeldByUs = new Map<string, string>(); // filePath -> token
+
 export async function withRunLock<T>(manifest: TeamRunManifest, fn: () => Promise<T>, options: RunLockOptions = {}): Promise<T> {
 	const filePath = lockPath(manifest);
 	const staleMs = options.staleMs ?? DEFAULT_STALE_MS;
+	const existingToken = runLockHeldByUs.get(filePath);
+	if (existingToken) {
+		// Re-entrant: already hold this lock, just run the callback.
+		return await fn();
+	}
 	fs.mkdirSync(path.dirname(filePath), { recursive: true });
 	const token = await acquireLockWithRetryAsync(filePath, staleMs, "run");
+	runLockHeldByUs.set(filePath, token);
 	try {
 		return await fn();
 	} finally {
+		runLockHeldByUs.delete(filePath);
 		releaseLock(filePath, token);
 	}
 }

package/src/state/mailbox.ts

@@ -69,7 +69,24 @@ function mailboxDir(manifest: TeamRunManifest): string {
 
 function safeMailboxDir(manifest: TeamRunManifest, create = false): string {
 	const dir = mailboxDir(manifest);
-	if (create) fs.mkdirSync(dir, { recursive: true });
+	if (create) {
+		try {
+			fs.mkdirSync(dir, { recursive: true });
+		} catch (error) {
+			// Windows EPERM: can occur when dir uses long-name form (runneradmin)
+			// but filesystem parent only exists in short-name form (RUNNER~1).
+			// Retry with realpathSync-resolved form.
+			if (process.platform === "win32" && (error as NodeJS.ErrnoException).code === "EPERM") {
+				try {
+					const realDir = fs.realpathSync(path.dirname(dir));
+					const correctedDir = path.join(realDir, path.basename(dir));
+					fs.mkdirSync(correctedDir, { recursive: true });
+				} catch { throw error; }
+			} else {
+				throw error;
+			}
+		}
+	}
 	// SECURITY: When create=true, dir now exists and must be validated via
 	// resolveRealContainedPath. When create=false, missing dir must throw —
 	// never return an unvalidated bare path (bypasses containment checks).
@@ -78,7 +95,12 @@ function safeMailboxDir(manifest: TeamRunManifest, create = false): string {
 		return path.join(dir); // will throw in callers via resolveRealContainedPath on read
 	}
 	if (fs.lstatSync(dir).isSymbolicLink()) throw new Error(`Invalid mailbox directory: ${dir}`);
-	return resolveRealContainedPath(manifest.stateRoot, "mailbox");
+	// Return dir as-is. The containment guarantee is provided by
+	// manifest.stateRoot which was validated by createRunPaths. Re-resolving
+	// through resolveRealContainedPath can change the path form on Windows
+	// (short-name vs long-name), causing subsequent operations to see a
+	// different filesystem entry.
+	return dir;
 }
 
 function safeTaskId(taskId: string): string {
@@ -91,7 +113,8 @@ function safeMailboxTasksRoot(manifest: TeamRunManifest, create = false): string
 	if (create) fs.mkdirSync(root, { recursive: true });
 	if (!fs.existsSync(root)) return root;
 	if (fs.lstatSync(root).isSymbolicLink()) throw new Error(`Invalid mailbox tasks directory: ${root}`);
-	return resolveRealContainedPath(safeMailboxDir(manifest), "tasks");
+	// Return root as-is (see safeMailboxDir comment about path form consistency)
+	return root;
 }
 
 function taskMailboxDir(manifest: TeamRunManifest, taskId: string, create = false): string {
@@ -101,7 +124,9 @@ function taskMailboxDir(manifest: TeamRunManifest, taskId: string, create = fals
 	const relative = path.relative(tasksRoot, resolved);
 	if (relative.startsWith("..") || path.isAbsolute(relative)) throw new Error(`Invalid mailbox task id: ${taskId}`);
 	if (create) fs.mkdirSync(resolved, { recursive: true });
-	return resolveRealContainedPath(tasksRoot, normalizedTaskId);
+	if (fs.existsSync(resolved) && fs.lstatSync(resolved).isSymbolicLink()) throw new Error(`Invalid mailbox task directory: ${resolved}`);
+	// Return resolved as-is (see safeMailboxDir comment about path form consistency)
+	return resolved;
 }
 
 function mailboxPath(manifest: TeamRunManifest, direction: MailboxDirection, taskId?: string, create = false): string {
@@ -115,7 +140,12 @@ function deliveryPath(manifest: TeamRunManifest, create = false): string {
 function safeMailboxFile(filePath: string, parentDir: string): string {
 	if (!fs.existsSync(filePath)) return filePath;
 	if (fs.lstatSync(filePath).isSymbolicLink()) throw new Error(`Invalid mailbox file: ${filePath}`);
-	return resolveRealContainedPath(parentDir, path.basename(filePath));
+	// Return filePath as-is instead of calling resolveRealContainedPath().
+	// The containment guarantee is already provided by safeMailboxDir/taskMailboxDir
+	// when the parent directory is created. Re-resolving can change the path
+	// form (e.g. short-name vs long-name on Windows), causing subsequent
+	// existsSync/appendFileSync to see a different file.
+	return filePath;
 }
 
 function mailboxFile(manifest: TeamRunManifest, direction: MailboxDirection, taskId?: string, create = false): string {
@@ -145,10 +175,18 @@ function ensureRunMailbox(manifest: TeamRunManifest): void {
 	safeMailboxDir(manifest, true);
 	for (const direction of ["inbox", "outbox"] as const) {
 		const filePath = mailboxFile(manifest, direction, undefined, true);
-		if (!fs.existsSync(filePath)) fs.writeFileSync(filePath, "", "utf-8");
+		if (!fs.existsSync(filePath)) {
+			// Ensure parent dir exists (may have been lost due to race or
+			// Windows path normalization mismatch)
+			fs.mkdirSync(path.dirname(filePath), { recursive: true });
+			fs.writeFileSync(filePath, "", "utf-8");
+		}
 	}
 	const delivery = deliveryFile(manifest, true);
-	if (!fs.existsSync(delivery)) fs.writeFileSync(delivery, `${JSON.stringify({ messages: {}, updatedAt: new Date().toISOString() }, null, 2)}\n`, "utf-8");
+	if (!fs.existsSync(delivery)) {
+		fs.mkdirSync(path.dirname(delivery), { recursive: true });
+		fs.writeFileSync(delivery, `${JSON.stringify({ messages: {}, updatedAt: new Date().toISOString() }, null, 2)}\n`, "utf-8");
+	}
 }
 
 function ensureTaskMailbox(manifest: TeamRunManifest, taskId: string): void {

package/src/state/observation-store.ts

@@ -9,6 +9,8 @@
  */
 
 import { mkdirSync, readFileSync, writeFileSync, existsSync, appendFileSync } from "node:fs";
+import * as fs from "node:fs";
+import * as path from "node:path";
 import { logInternalError } from "../utils/internal-error.ts";
 
 // ── Types ────────────────────────────────────────────────────────────────
@@ -151,7 +153,8 @@ export class ObservationStore {
 	 */
 	save(): void {
 		try {
-			mkdirSync(this.storePath.substring(0, this.storePath.lastIndexOf("/")), { recursive: true });
+			// Use path.dirname for cross-platform support (handles both \ and /)
+			mkdirSync(path.dirname(this.storePath), { recursive: true });
 			writeFileSync(this.storePath, JSON.stringify({
 				observations: this.observations,
 				compressed: this.compressed,

package/src/state/run-graph.ts

@@ -1,37 +1,39 @@
 import * as fs from "node:fs";
 import * as path from "node:path";
+import { projectCrewRoot } from "../utils/paths.ts";
+import { assertSafePathId } from "../utils/safe-paths.ts";
 import type { TeamRunManifest, TeamTaskState } from "./types.ts";
 
 export interface RunGraphNode {
-  id: string;
-  type: "run" | "task" | "agent" | "artifact" | "file";
-  name: string;
-  metadata?: Record<string, unknown>;
+	id: string;
+	type: "run" | "task" | "agent" | "artifact" | "file";
+	name: string;
+	metadata?: Record<string, unknown>;
 }
 
 export interface RunGraphEdge {
-  source: string;
-  target: string;
-  type: "dependsOn" | "produces" | "runs" | "contains";
-  weight?: number;
+	source: string;
+	target: string;
+	type: "dependsOn" | "produces" | "runs" | "contains";
+	weight?: number;
 }
 
 export interface RunGraphLayer {
-  name: string;
-  nodeIds: string[];
+	name: string;
+	nodeIds: string[];
 }
 
 export interface RunGraph {
-  version: "1.0.0";
-  runId: string;
-  team: string;
-  workflow: string;
-  createdAt: string;
-  completedAt?: string;
-  status: string;
-  nodes: RunGraphNode[];
-  edges: RunGraphEdge[];
-  layers: RunGraphLayer[];
+	version: "1.0.0";
+	runId: string;
+	team: string;
+	workflow: string;
+	createdAt: string;
+	completedAt?: string;
+	status: string;
+	nodes: RunGraphNode[];
+	edges: RunGraphEdge[];
+	layers: RunGraphLayer[];
 }
 
 /**
@@ -39,142 +41,151 @@ export interface RunGraph {
  * Consolidates state into a single graph JSON for dashboard/API use.
  */
 export function buildRunGraph(
-  manifest: TeamRunManifest,
-  tasks: TeamTaskState[],
+	manifest: TeamRunManifest,
+	tasks: TeamTaskState[],
 ): RunGraph {
-  const nodes: RunGraphNode[] = [];
-  const edges: RunGraphEdge[] = [];
-  const nodeIds = new Set<string>();
-
-  // Add run node
-  const runId = manifest.runId;
-  nodes.push({
-    id: `run:${runId}`,
-    type: "run",
-    name: manifest.goal ?? runId,
-    metadata: {
-      team: manifest.team,
-      workflow: manifest.workflow,
-      status: manifest.status,
-      createdAt: manifest.createdAt,
-    },
-  });
-  nodeIds.add(`run:${runId}`);
-
-  // Add task nodes
-  for (const task of tasks) {
-    const taskId = `task:${task.id}`;
-    if (nodeIds.has(taskId)) continue;
-    nodeIds.add(taskId);
-
-    nodes.push({
-      id: taskId,
-      type: "task",
-      name: task.role,
-      metadata: {
-        status: task.status,
-        startedAt: task.startedAt,
-        finishedAt: task.finishedAt,
-      },
-    });
-
-    // Edge from run to task
-    edges.push({
-      source: `run:${runId}`,
-      target: taskId,
-      type: "contains",
-    });
-
-    // Edges from dependencies
-    for (const dep of task.dependsOn ?? []) {
-      edges.push({
-        source: `task:${dep}`,
-        target: taskId,
-        type: "dependsOn",
-        weight: 1.0,
-      });
-    }
-
-  }
-
-  // Group by layer (based on phase or role)
-  const layerMap = new Map<string, string[]>();
-  for (const task of tasks) {
-    const layerName = task.adaptive?.phase ?? task.role;
-    if (!layerMap.has(layerName)) layerMap.set(layerName, []);
-    layerMap.get(layerName)!.push(`task:${task.id}`);
-  }
-
-  const layers: RunGraphLayer[] = [...layerMap.entries()].map(([name, nodeIdList]) => ({
-    name,
-    nodeIds: nodeIdList,
-  }));
-
-  return {
-    version: "1.0.0",
-    runId,
-    team: manifest.team ?? "unknown",
-    workflow: manifest.workflow ?? "unknown",
-    createdAt: manifest.createdAt,
-    completedAt: manifest.updatedAt,
-    status: manifest.status,
-    nodes,
-    edges,
-    layers,
-  };
+	const nodes: RunGraphNode[] = [];
+	const edges: RunGraphEdge[] = [];
+	const nodeIds = new Set<string>();
+
+	// Add run node
+	const runId = manifest.runId;
+	nodes.push({
+		id: `run:${runId}`,
+		type: "run",
+		name: manifest.goal ?? runId,
+		metadata: {
+			team: manifest.team,
+			workflow: manifest.workflow,
+			status: manifest.status,
+			createdAt: manifest.createdAt,
+		},
+	});
+	nodeIds.add(`run:${runId}`);
+
+	// Add task nodes
+	for (const task of tasks) {
+		const taskId = `task:${task.id}`;
+		if (nodeIds.has(taskId)) continue;
+		nodeIds.add(taskId);
+
+		nodes.push({
+			id: taskId,
+			type: "task",
+			name: task.role,
+			metadata: {
+				status: task.status,
+				startedAt: task.startedAt,
+				finishedAt: task.finishedAt,
+			},
+		});
+
+		// Edge from run to task
+		edges.push({
+			source: `run:${runId}`,
+			target: taskId,
+			type: "contains",
+		});
+
+		// Edges from dependencies
+		for (const dep of task.dependsOn ?? []) {
+			edges.push({
+				source: `task:${dep}`,
+				target: taskId,
+				type: "dependsOn",
+				weight: 1.0,
+			});
+		}
+	}
+
+	// Group by layer (based on phase or role)
+	const layerMap = new Map<string, string[]>();
+	for (const task of tasks) {
+		const layerName = task.adaptive?.phase ?? task.role;
+		if (!layerMap.has(layerName)) layerMap.set(layerName, []);
+		layerMap.get(layerName)!.push(`task:${task.id}`);
+	}
+
+	const layers: RunGraphLayer[] = [...layerMap.entries()].map(
+		([name, nodeIdList]) => ({
+			name,
+			nodeIds: nodeIdList,
+		}),
+	);
+
+	return {
+		version: "1.0.0",
+		runId,
+		team: manifest.team ?? "unknown",
+		workflow: manifest.workflow ?? "unknown",
+		createdAt: manifest.createdAt,
+		completedAt: manifest.updatedAt,
+		status: manifest.status,
+		nodes,
+		edges,
+		layers,
+	};
 }
 
 /**
- * Save run graph to disk in .crew/graphs/
+ * Save run graph to disk.
+ * Uses projectCrewRoot() to honour the .pi/teams/ fallback for .pi-based
+ * projects (issue #29 follow-up). Graph files now live alongside the
+ * manifest at `<crewRoot>/graphs/<runId>.json`.
  */
 export function saveRunGraph(graph: RunGraph, cwd: string): string {
-  const crewRoot = path.join(cwd, ".crew");
-  const graphsDir = path.join(crewRoot, "graphs");
+	assertSafePathId("runId", graph.runId);
+	const crewRoot = projectCrewRoot(cwd);
+	const graphsDir = path.join(crewRoot, "graphs");
 
-  if (!fs.existsSync(graphsDir)) {
-    fs.mkdirSync(graphsDir, { recursive: true });
-  }
+	if (!fs.existsSync(graphsDir)) {
+		fs.mkdirSync(graphsDir, { recursive: true });
+	}
 
-  const graphPath = path.join(graphsDir, `${graph.runId}.json`);
-  fs.writeFileSync(graphPath, JSON.stringify(graph, null, 2), "utf-8");
+	const graphPath = path.join(graphsDir, `${graph.runId}.json`);
+	fs.writeFileSync(graphPath, JSON.stringify(graph, null, 2), "utf-8");
 
-  return graphPath;
+	return graphPath;
 }
 
 /**
  * Load run graph from disk.
  */
 export function loadRunGraph(cwd: string, runId: string): RunGraph | null {
-  const graphPath = path.join(cwd, ".crew", "graphs", `${runId}.json`);
-  if (!fs.existsSync(graphPath)) return null;
-
-  try {
-    return JSON.parse(fs.readFileSync(graphPath, "utf-8")) as RunGraph;
-  } catch {
-    return null;
-  }
+	assertSafePathId("runId", runId);
+	const crewRoot = projectCrewRoot(cwd);
+	const graphPath = path.join(crewRoot, "graphs", `${runId}.json`);
+	if (!fs.existsSync(graphPath)) return null;
+
+	try {
+		return JSON.parse(fs.readFileSync(graphPath, "utf-8")) as RunGraph;
+	} catch {
+		return null;
+	}
 }
 
 /**
  * List all archived run graphs.
  */
 export function listRunGraphs(cwd: string): string[] {
-  const graphsDir = path.join(cwd, ".crew", "graphs");
-  if (!fs.existsSync(graphsDir)) return [];
-
-  return fs.readdirSync(graphsDir)
-    .filter((f) => f.endsWith(".json"))
-    .map((f) => f.replace(/\.json$/, ""));
+	const crewRoot = projectCrewRoot(cwd);
+	const graphsDir = path.join(crewRoot, "graphs");
+	if (!fs.existsSync(graphsDir)) return [];
+
+	return fs
+		.readdirSync(graphsDir)
+		.filter((f) => f.endsWith(".json"))
+		.map((f) => f.replace(/\.json$/, ""));
 }
 
 /**
  * Build and save run graph from manifest + tasks.
  */
 export function buildAndSaveRunGraph(
-  manifest: TeamRunManifest,
-  tasks: TeamTaskState[],
-  cwd: string,
+	manifest: TeamRunManifest,
+	tasks: TeamTaskState[],
+	cwd: string,
 ): string {
-  const graph = buildRunGraph(manifest, tasks);
-  return saveRunGraph(graph, cwd);
+	const graph = buildRunGraph(manifest, tasks);
+	return saveRunGraph(graph, cwd);
 }