pi-crew 0.6.0 → 0.6.3

package/src/extension/register.ts

@@ -5,7 +5,7 @@ import type {
 	ExtensionAPI,
 	ExtensionContext,
 } from "@earendil-works/pi-coding-agent";
-import { loadConfig } from "../config/config.ts";
+import { asRecord, loadConfig } from "../config/config.ts";
 import { applyCrewSettingsToConfig, loadCrewSettings } from "../runtime/settings-store.ts";
 // 2.7: Lazy-load LiveRunSidebar — only constructed when the user actually opens
 // a live run sidebar overlay. The class pulls in transcript-viewer and other
@@ -19,7 +19,7 @@ import {
 import { registerAutonomousPolicy } from "./autonomous-policy.ts";
 import { registerCleanupHandler } from "./crew-cleanup.ts";
 import type { ScheduledJob } from "../runtime/scheduler.ts";
-import { clearHooks } from "../hooks/registry.ts";
+import { clearHooksScoped } from "../hooks/registry.ts";
 import { uninstallCrewGlobalRegistry } from "./team-tool.ts";
 import { notifyActiveRuns } from "./session-summary.ts";
 
@@ -87,6 +87,7 @@ import {
 	projectCrewRoot,
 	userCrewRoot,
 } from "../utils/paths.ts";
+import { resolveContainedPath } from "../utils/safe-paths.ts";
 import { resetTimings, time } from "../utils/timings.ts";
 import {
 	type PiCrewRpcHandle,
@@ -108,6 +109,7 @@ import {
 import { registerSubagentTools } from "./registration/subagent-tools.ts";
 import { registerTeamTool } from "./registration/team-tool.ts";
 import { handleTeamTool } from "./team-tool.ts";
+import { persistScheduledJobUpdate } from "./team-tool/handle-schedule.ts";
 
 let _cachedOTLPExporter: typeof OTLPExporterType | undefined;
 async function importOTLPExporter(): Promise<typeof OTLPExporterType> {
@@ -132,6 +134,8 @@ import {
 } from "../runtime/crash-recovery.ts";
 import { appendDeadletter } from "../runtime/deadletter.ts";
 import { HeartbeatWatcher } from "../runtime/heartbeat-watcher.ts";
+import { cleanupOrphanTempDirs, cleanupLegacyOrphanTempDirs } from "../runtime/pi-args.ts";
+import { cleanupOrphanWorkers } from "../runtime/orphan-worker-registry.ts";
 import { reconcileOrphanedTempWorkspaces } from "../runtime/stale-reconciler.ts";
 
 let _cachedCrashRecovery:
@@ -183,10 +187,14 @@ export function registerPiTeams(pi: ExtensionAPI): void {
 	const disposeI18n = initI18n(pi);
 	resetTimings();
 	time("register:start");
-	const globalStore = globalThis as Record<string, unknown>;
-	const runtimeCleanupStoreKey = "__piCrewRuntimeCleanup";
+	const globalStore = globalThis as Record<string | symbol, unknown>;
+	const runtimeCleanupStoreKey = Symbol("__piCrewRuntimeCleanup");
 	const previousRuntimeCleanup = globalStore[runtimeCleanupStoreKey];
 	time("register:init");
+	// Best-effort cleanup of the previous runtime instance. Errors are logged but
+	// do not halt new registration — a failing cleanup from a prior instance is
+	// preferable to leaving pi-crew unregistered, and any stale state from the
+	// previous instance will be reconciled when the new instance initializes.
 	if (typeof previousRuntimeCleanup === "function") {
 		try {
 			previousRuntimeCleanup();
@@ -443,6 +451,34 @@ export function registerPiTeams(pi: ExtensionAPI): void {
 						cleanupOrphanedTempDirs:
 							config.reliability?.cleanupOrphanedTempDirs,
 					});
+					// Layer 4: also clean orphan temp dirs under
+					// ~/.pi/agent/pi-crew/tmp/ that the SIGKILL'd parent
+					// processes left behind. Catches anything Layers 1-3 missed.
+					const orphanResult = cleanupOrphanTempDirs();
+					if (orphanResult.cleaned > 0) {
+						notifyOperator({
+							id: `layer4_temp_cleanup_${Date.now()}`,
+							severity: "info",
+							source: "temp-cleanup",
+							title: `Layer 4: cleaned ${orphanResult.cleaned} orphan temp dir(s)`,
+							body: `~/.pi/agent/pi-crew/tmp/ orphans older than 24h removed (scanned ${orphanResult.scanned}, failed ${orphanResult.failed}).`,
+						});
+					}
+					// Layer 5: clean legacy /tmp/pi-crew-* prompt/task orphans
+					// from before commit 8ba270d moved temp dirs out of /tmp.
+					// The existing reconcileOrphanedTempWorkspaces only cleans
+					// dirs containing .crew/state/runs/ (run-state dirs), so
+					// prompt/task orphans are never touched by Layer 3.
+					const legacyResult = cleanupLegacyOrphanTempDirs();
+					if (legacyResult.cleaned > 0) {
+						notifyOperator({
+							id: `layer5_legacy_temp_cleanup_${Date.now()}`,
+							severity: "info",
+							source: "temp-cleanup",
+							title: `Layer 5: cleaned ${legacyResult.cleaned} legacy /tmp/pi-crew-* orphan(s)`,
+							body: `Pre-fix /tmp/pi-crew-* prompt/task orphans (no .crew/state/runs/, >24h) removed (scanned ${legacyResult.scanned}, failed ${legacyResult.failed}).`,
+						});
+					}
 				} catch (error) {
 					logInternalError("register.tempAutoRepair", error);
 				}
@@ -478,13 +514,15 @@ export function registerPiTeams(pi: ExtensionAPI): void {
 				);
 		}
 	};
-	const autoRecoveryLast = new Map<string, number>();
+	const autoRecoveryLast = new Map<string, { insertedAt: number; lastAccessAt: number }>();
 	// FIX (Round 22, defensive cap): Bound the cooldown-gate Map. Each run
 	// contributes up to 4 keys (one per maybeNotifyHealth kind). Without a cap,
 	// a long-running pi session that runs thousands of teams accumulates
-	// thousands of entries. Eviction: oldest insertion first — matches the
-	// 5-minute cooldown gate semantics, since once the gate has expired the
-	// entry is irrelevant.
+	// thousands of entries. Eviction: oldest lastAccessAt first — uses LRU-like
+	// semantics so entries that are still being actively accessed (re-accessed
+	// before eviction) survive longer. This is fairer than insertion-order
+	// eviction under high churn where many entries expire naturally before
+	// being re-accessed.
 	const AUTO_RECOVERY_LAST_MAX_ENTRIES = 1000;
 	const configureDeliveryCoordinator = (): void => {
 		deliveryCoordinator?.dispose();
@@ -812,8 +850,8 @@ export function registerPiTeams(pi: ExtensionAPI): void {
 				.then(({ startForegroundWatchdog }) => {
 					startForegroundWatchdog({ pi, cwd: ctx.cwd, runId });
 				})
-				.catch(() => {
-					/* non-critical */
+				.catch((error) => {
+					logInternalError("register.foreground-watchdog-import", error);
 				});
 		}
 		setImmediate(() => {
@@ -823,7 +861,7 @@ export function registerPiTeams(pi: ExtensionAPI): void {
 						error instanceof Error ? error.message : String(error);
 					if (runId) {
 						try {
-							const loaded = loadRunManifestById(ctx.cwd, runId);
+							const loaded = loadRunManifestById(ctx.cwd, runId); // NOTE: no withRunLock - best-effort only; concurrent writes may cause inconsistency. Post-run status updates tolerate slight staleness.
 							if (
 								loaded &&
 								loaded.manifest.status !== "completed" &&
@@ -877,7 +915,7 @@ export function registerPiTeams(pi: ExtensionAPI): void {
 						}
 					}
 					if (ownerCurrent && runId) {
-						const loaded = loadRunManifestById(ctx.cwd, runId);
+						const loaded = loadRunManifestById(ctx.cwd, runId); // NOTE: no withRunLock - best-effort only; concurrent writes may cause inconsistency. Post-run status updates tolerate slight staleness.
 						const status = loaded?.manifest.status ?? "finished";
 						const level =
 							status === "failed" || status === "blocked"
@@ -971,9 +1009,25 @@ export function registerPiTeams(pi: ExtensionAPI): void {
 			const registry = (globalThis as Record<symbol | string, unknown>)[
 				CREW_REGISTRY_KEY
 			] as Record<string, unknown>;
-			registry.getRecord = (runId: string) =>
+			// Phase 3b (defensive): Validate registry structure before patching methods.
+			// If a previous occupant left a non-conforming object, replace it entirely.
+			// This prevents runtime failures if getRecord/listRuns/etc. are called on a
+			// malformed predecessor value.
+			if (
+				registry === null ||
+				typeof registry !== "object" ||
+				Array.isArray(registry)
+			) {
+				(globalThis as Record<symbol | string, unknown>)[
+					CREW_REGISTRY_KEY
+				] = {};
+			}
+			const validatedRegistry = (globalThis as Record<symbol | string, unknown>)[
+				CREW_REGISTRY_KEY
+			] as Record<string, unknown>;
+			validatedRegistry.getRecord = (runId: string) =>
 				manifestCacheForRegistry.get(runId);
-			registry.listRuns = () =>
+			validatedRegistry.listRuns = () =>
 				manifestCacheForRegistry
 					.list(100)
 					.map(
@@ -987,7 +1041,7 @@ export function registerPiTeams(pi: ExtensionAPI): void {
 							goal: m.goal,
 						}),
 					);
-			registry.appendEvent = (
+			validatedRegistry.appendEvent = (
 				runId: string,
 				event: Record<string, unknown>,
 			) => {
@@ -1003,7 +1057,7 @@ export function registerPiTeams(pi: ExtensionAPI): void {
 							),
 					);
 			};
-			registry.waitForAll = async (runId: string) => {
+			validatedRegistry.waitForAll = async (runId: string) => {
 				// LAZY: state-store only needed for post-completion polling (waitForAll) and sync hasRunning check; avoid at startup.
 				const { loadRunManifestById } = await import(
 					"../state/state-store.ts"
@@ -1022,7 +1076,7 @@ export function registerPiTeams(pi: ExtensionAPI): void {
 				while (!check())
 					await new Promise((resolve) => setTimeout(resolve, 500));
 			};
-			registry.hasRunning = async (runId: string) => {
+			validatedRegistry.hasRunning = async (runId: string) => {
 				const manifest = manifestCacheForRegistry.get(runId);
 				if (!manifest) return false;
 				// LAZY: state-store only needed in hasRunning; avoid at startup.
@@ -1112,7 +1166,7 @@ export function registerPiTeams(pi: ExtensionAPI): void {
 		otlpExporter = undefined;
 		metricRegistry = undefined;
 		deliveryCoordinator?.dispose();
-		clearHooks();
+		clearHooksScoped();
 		uninstallCrewGlobalRegistry();
 		overflowTracker?.dispose();
 		deliveryCoordinator = undefined;
@@ -1150,10 +1204,11 @@ export function registerPiTeams(pi: ExtensionAPI): void {
 		notifyActiveRuns(ctx);
 
 		// Auto-cancel orphaned runs from dead sessions
-		// Extract sessionId from context — validate runtime type instead of unsafe cast.
+		// Extract sessionId from context — use Object.getOwnPropertyDescriptor
+		// to safely access property without triggering Proxy traps, then validate.
 		const rawSessionId =
-			typeof ctx === "object" && ctx !== null && "sessionId" in ctx
-				? (ctx as Record<string, unknown>).sessionId
+			typeof ctx === "object" && ctx !== null
+				? Object.getOwnPropertyDescriptor(ctx, "sessionId")?.value
 				: undefined;
 		const currentSessionId =
 			typeof rawSessionId === "string" && rawSessionId.length > 0
@@ -1219,6 +1274,54 @@ export function registerPiTeams(pi: ExtensionAPI): void {
 					}
 				}
 
+				// Startup cleanup (Fix A): run orphan-temp-dir cleanup
+				// immediately on session_start so we don't wait 5 minutes
+				// for the first timer tick. Especially important after
+				// a SIGKILL'd previous session that left thousands of
+				// orphan temp dirs behind.
+				try {
+					const orphanTmp = cleanupOrphanTempDirs();
+					const legacyTmp = cleanupLegacyOrphanTempDirs();
+					if (orphanTmp.cleaned > 0 || legacyTmp.cleaned > 0) {
+						notifyOperator({
+							id: `startup_temp_cleanup_${Date.now()}`,
+							severity: "info",
+							source: "temp-cleanup",
+							title: `Startup cleanup: removed ${orphanTmp.cleaned + legacyTmp.cleaned} orphan temp dir(s)`,
+							body: `${orphanTmp.cleaned} from ~/.pi/agent/pi-crew/tmp/ + ${legacyTmp.cleaned} legacy /tmp/pi-crew-*`,
+						});
+					}
+				} catch (error) {
+					logInternalError(
+						"register.sessionStart.startupTempCleanup",
+						error,
+					);
+				}
+
+				// Orphan worker cleanup (Fix B): kill stale background-runner
+				// processes from previous (SIGKILL'd) sessions. Workers
+				// detached via setsid+unref outlive the spawning pi
+				// session, and the per-worker parent-guard is intentionally
+				// disabled for background-runner (BUG #17 design). So
+				// orphans can only be cleaned from the next session_start.
+				try {
+					const orphanWorkers = cleanupOrphanWorkers(currentSessionId);
+					if (orphanWorkers.killed > 0) {
+						notifyOperator({
+							id: `orphan_workers_cleanup`,
+							severity: "info",
+							source: "worker-cleanup",
+							title: `Cleaned up ${orphanWorkers.killed} orphan worker(s)`,
+							body: `Background workers from previous (SIGKILL'd) sessions were terminated (pruned ${orphanWorkers.pruned} dead, kept ${orphanWorkers.kept}).`,
+						});
+					}
+				} catch (error) {
+					logInternalError(
+						"register.sessionStart.orphanWorkers",
+						error,
+					);
+				}
+
 				// Global purge of stale active-run-index entries
 				try {
 					const { purged } = purgeStaleActiveRunIndexFn();
@@ -1324,19 +1427,60 @@ export function registerPiTeams(pi: ExtensionAPI): void {
 					runParams = { action: "run", team: "default", goal: job.prompt };
 				}
 				if (runParams.action !== "run") return `scheduled-${job.id}-${Date.now()}`;
+				const agentId = `scheduled-${job.id}-${Date.now()}`;
 				setImmediate(async () => {
 					try {
-						await handleTeamTool(
+						const runResult = await handleTeamTool(
 							{ action: "run", team: runParams.team, goal: runParams.goal, async: true },
 							{ cwd: ctx.cwd, sessionId },
 						);
+						// Track the runId so remove() can cancel spawned runs
+						const runId = runResult?.details?.runId;
+						if (runId && typeof runId === "string") {
+							crewScheduler?.recordSpawnedRun(job.id, runId);
+							// Update run manifest with scheduler provenance for traceability
+							try {
+								const cwd = ctx.cwd ?? process.cwd();
+								const loaded = loadRunManifestById(cwd, runId);
+								if (loaded) {
+									const { atomicWriteJson } = await import("../state/atomic-write.ts");
+									atomicWriteJson(loaded.manifest.stateRoot + "/manifest.json", {
+										...loaded.manifest,
+										schedulerJobId: job.id,
+										schedulerName: job.name,
+									});
+								}
+							} catch { /* best-effort provenance tracking */ }
+						}
+						// Persist updated job with spawnedRunIds to settings
+						try {
+							const updatedJob = crewScheduler?.list().find((j) => j.id === job.id);
+							if (updatedJob) persistScheduledJobUpdate(ctx.cwd, updatedJob);
+						} catch { /* best-effort */ }
+						// Update run count
+						crewScheduler?.update(job.id, {
+							runCount: job.runCount + 1,
+							lastRun: new Date().toISOString(),
+							lastStatus: "success",
+						});
 					} catch (err) {
 						logInternalError("scheduler.execute", err);
+						crewScheduler?.update(job.id, { lastStatus: "error" });
 					}
 				});
-				return `scheduled-${job.id}-${Date.now()}`;
+				return agentId;
 			},
 			finalizer: () => {},
+			runCancelFn: (runId: string) => {
+				try {
+					handleTeamTool(
+						{ action: "cancel", runId, confirm: true },
+						{ cwd: ctx.cwd, sessionId },
+					).catch((err) => logInternalError("scheduler.runCancelFn", err, `runId=${runId}`));
+				} catch (err) {
+					logInternalError("scheduler.runCancelFn.sync", err, `runId=${runId}`);
+				}
+			},
 		});
 		// Wire scheduler into handle-schedule.ts so handlers can add/list jobs.
 		// Uses a global symbol so the module doesn't need a direct circular import.
@@ -1534,18 +1678,26 @@ export function registerPiTeams(pi: ExtensionAPI): void {
 						const previous = autoRecoveryLast.get(key);
 						if (
 							previous !== undefined &&
-							now - previous < 5 * 60_000
+							now - previous.lastAccessAt < 5 * 60_000
 						)
 							return;
-						// Defensive cap: evict oldest entries before inserting
-						// when size exceeds the limit. Map's natural insertion
-						// order means the first key is the oldest.
+						// Defensive cap: evict entry with oldest lastAccessAt before
+						// inserting/updating when size exceeds the limit. Uses LRU
+						// semantics so entries that are still being actively
+						// accessed survive longer than insertion-order eviction.
 						while (autoRecoveryLast.size >= AUTO_RECOVERY_LAST_MAX_ENTRIES) {
-							const oldest = autoRecoveryLast.keys().next().value;
-							if (oldest === undefined) break;
-							autoRecoveryLast.delete(oldest);
+							let oldestKey: string | undefined;
+							let oldestAccess = Infinity;
+							for (const [k, v] of autoRecoveryLast) {
+								if (v.lastAccessAt < oldestAccess) {
+									oldestAccess = v.lastAccessAt;
+									oldestKey = k;
+								}
+							}
+							if (oldestKey === undefined) break;
+							autoRecoveryLast.delete(oldestKey);
 						}
-						autoRecoveryLast.set(key, now);
+						autoRecoveryLast.set(key, { insertedAt: now, lastAccessAt: now });
 						notifyOperator({
 							id: key,
 							severity: "warning",
@@ -1752,8 +1904,15 @@ export function registerPiTeams(pi: ExtensionAPI): void {
 			);
 			const paths: string[] = [];
 			if (fs.existsSync(extSkillDir)) paths.push(extSkillDir);
-			if (skillDir !== extSkillDir && fs.existsSync(skillDir))
-				paths.push(skillDir);
+			if (skillDir !== extSkillDir && fs.existsSync(skillDir)) {
+				// Validate skillDir is within sessionCwd to prevent path traversal
+				try {
+					resolveContainedPath(sessionCwd, "skills");
+					paths.push(skillDir);
+				} catch {
+					// skillDir outside sessionCwd boundary — skip
+				}
+			}
 			return paths.length > 0 ? { skillPaths: paths } : {};
 		});
 	} catch {
@@ -1777,7 +1936,8 @@ export function registerPiTeams(pi: ExtensionAPI): void {
 		if (event.toolName !== "team") return;
 		const rawInput = event.input;
 		if (!rawInput || typeof rawInput !== "object") return;
-		const input = rawInput as { action?: unknown; confirm?: unknown; force?: unknown };
+		const input = asRecord(rawInput);
+		if (!input) return;
 		const action = typeof input.action === "string" ? input.action : undefined;
 		const destructiveActions = new Set(["delete", "forget", "prune", "cleanup"]);
 		if (!action || !destructiveActions.has(action)) return;

package/src/extension/registration/commands.ts

@@ -154,7 +154,7 @@ function teamCommandContext(ctx: ExtensionCommandContext): ExtensionCommandConte
 }
 
 async function handleHealthDashboardAction(ctx: ExtensionCommandContext, selection: RunDashboardSelection): Promise<void> {
-	const loaded = loadRunManifestById(ctx.cwd, selection.runId);
+	const loaded = loadRunManifestById(ctx.cwd, selection.runId); // NOTE: no withRunLock - best-effort only; concurrent writes may cause inconsistency
 	if (!loaded) {
 		depsNotify(ctx, `Run '${selection.runId}' not found.`, "error");
 		return;
@@ -379,7 +379,7 @@ export function registerTeamCommands(pi: ExtensionAPI, deps: RegisterTeamCommand
 	pi.registerCommand("team-result", { description: "Open a pi-crew agent result viewer: <runId> [taskId]", handler: async (args: string, ctx: ExtensionCommandContext) => {
 		const [runId, rawTaskId] = args.trim().split(/\s+/).filter(Boolean);
 		const selected = await selectAgentTask(ctx, runId, rawTaskId);
-		const loaded = selected ? loadRunManifestById(ctx.cwd, selected.runId) : undefined;
+		const loaded = selected ? loadRunManifestById(ctx.cwd, selected.runId) : undefined; // NOTE: no withRunLock - best-effort only; concurrent writes may cause inconsistency
 		if (ctx.hasUI && loaded) {
 			const agent = readCrewAgents(loaded.manifest).find((item) => item.taskId === selected?.taskId || item.id === selected?.taskId) ?? readCrewAgents(loaded.manifest)[0];
 			const resultText = agent?.resultArtifactPath ? commandText(await handleTeamTool({ action: "api", runId: selected?.runId ?? "", config: { operation: "read-agent-output", agentId: agent.taskId, maxBytes: 64_000 } }, teamCommandContext(ctx))) : "(no result)";
@@ -428,7 +428,8 @@ export function registerTeamCommands(pi: ExtensionAPI, deps: RegisterTeamCommand
 			if (selection.action === "agent-transcript" && await openTranscriptViewer(ctx, selection.runId)) continue;
 			if (selection.action === "agent-live" && await openLiveConversation(ctx, selection.runId)) continue;
 			if (selection.action === "agent-live") { await notifyCommandResult(ctx, commandText({ content: [{ type: "text", text: "No live agent found for this run." }] })); continue; }
-			const result = selection.action === "api" ? await handleTeamTool({ action: "api", runId: selection.runId, config: { operation: "read-manifest" } }, teamCommandContext(ctx)) : selection.action === "agents" ? await handleTeamTool({ action: "api", runId: selection.runId, config: { operation: "agent-dashboard" } }, teamCommandContext(ctx)) : selection.action === "mailbox" ? await handleTeamTool({ action: "api", runId: selection.runId, config: { operation: "read-mailbox" } }, teamCommandContext(ctx)) : selection.action === "agent-events" ? await handleTeamTool({ action: "api", runId: selection.runId, config: { operation: "read-agent-events", limit: 50 } }, teamCommandContext(ctx)) : selection.action === "agent-output" ? await handleTeamTool({ action: "api", runId: selection.runId, config: { operation: "read-agent-output", maxBytes: 32_000 } }, teamCommandContext(ctx)) : selection.action === "agent-transcript" ? await handleTeamTool({ action: "api", runId: selection.runId, config: { operation: "read-agent-transcript" } }, teamCommandContext(ctx)) : await handleTeamTool({ action: selection.action as any, runId: selection.runId }, teamCommandContext(ctx));
+			const result = selection.action === "api" ? await handleTeamTool({ action: "api", runId: selection.runId, config: { operation: "read-manifest" } }, teamCommandContext(ctx)) : selection.action === "agents" ? await handleTeamTool({ action: "api", runId: selection.runId, config: { operation: "agent-dashboard" } }, teamCommandContext(ctx)) : selection.action === "mailbox" ? await handleTeamTool({ action: "api", runId: selection.runId, config: { operation: "read-mailbox" } }, teamCommandContext(ctx)) : selection.action === "agent-events" ? await handleTeamTool({ action: "api", runId: selection.runId, config: { operation: "read-agent-events", limit: 50 } }, teamCommandContext(ctx)) : selection.action === "agent-output" ? await handleTeamTool({ action: "api", runId: selection.runId, config: { operation: "read-agent-output", maxBytes: 32_000 } }, teamCommandContext(ctx)) : selection.action === "agent-transcript" ? await handleTeamTool({ action: "api", runId: selection.runId, config: { operation: "read-agent-transcript" } }, teamCommandContext(ctx)) : // eslint-disable-next-line @typescript-eslint/no-explicit-any
+				await handleTeamTool({ action: selection.action as any, runId: selection.runId }, teamCommandContext(ctx));
 			await notifyCommandResult(ctx, commandText(result));
 			return;
 		}

package/src/extension/registration/subagent-helpers.ts

@@ -34,7 +34,7 @@ export function sendAgentWakeUp(pi: ExtensionAPI, content: string): boolean {
 
 export function refreshPersistedSubagentRecord(ctx: ExtensionContext | ExtensionCommandContext, record: SubagentRecord): SubagentRecord {
 	if (!record.runId) return record;
-	const loaded = loadRunManifestById(ctx.cwd, record.runId);
+	const loaded = loadRunManifestById(ctx.cwd, record.runId); // NOTE: no withRunLock - best-effort only; concurrent writes may cause inconsistency
 	if (!loaded) return record;
 	if (loaded.manifest.status === "completed" || loaded.manifest.status === "failed" || loaded.manifest.status === "cancelled" || loaded.manifest.status === "blocked") {
 		const refreshed = {
@@ -65,7 +65,7 @@ export function formatSubagentRecord(record: SubagentRecord): string {
 
 export function readSubagentRunResult(ctx: ExtensionContext | ExtensionCommandContext, record: SubagentRecord): string | undefined {
 	if (!record.runId) return record.result;
-	const loaded = loadRunManifestById(ctx.cwd, record.runId);
+	const loaded = loadRunManifestById(ctx.cwd, record.runId); // NOTE: no withRunLock - best-effort only; concurrent writes may cause inconsistency
 	const task = loaded?.tasks.find((item) => item.resultArtifact) ?? loaded?.tasks[0];
 	const artifactPath = task?.resultArtifact?.path;
 	if (!artifactPath || !loaded) return undefined;

package/src/extension/registration/subagent-tools.ts

@@ -96,9 +96,11 @@ export function registerSubagentTools(pi: ExtensionAPI, subagentManager: Subagen
 			}
 			return foregroundResult;
 		},
+		// eslint-disable-next-line @typescript-eslint/no-explicit-any
 		renderCall(args: any, theme: any, context: any): any {
 			return renderAgentToolCall(args, theme, context);
 		},
+		// eslint-disable-next-line @typescript-eslint/no-explicit-any
 		renderResult(result: any, options: any, theme: any, context: any): any {
 			return renderAgentToolResult(result, options, theme, context);
 		},
@@ -202,7 +204,7 @@ function startAgentToolProgress(cwd: string, agentRecordId: string, onUpdate: On
 			let tasks;
 			let agents;
 			if (record.runId) {
-				const loaded = loadRunManifestById(cwd, record.runId);
+				const loaded = loadRunManifestById(cwd, record.runId); // NOTE: no withRunLock - best-effort only; concurrent writes may cause inconsistency
 				if (loaded) {
 					manifest = loaded.manifest;
 					tasks = loaded.tasks;

package/src/extension/registration/team-tool.ts

@@ -105,9 +105,11 @@ export function registerTeamTool(pi: ExtensionAPI, deps: RegisterTeamToolDeps):
 				stopProgress.stop();
 			}
 		},
+		// eslint-disable-next-line @typescript-eslint/no-explicit-any
 		renderCall(args: any, theme: any, context: any): any {
 			return renderTeamToolCall(args, theme, context);
 		},
+		// eslint-disable-next-line @typescript-eslint/no-explicit-any
 		renderResult(result: any, options: any, theme: any, context: any): any {
 			return renderTeamToolResult(result, options, theme, context);
 		},
@@ -134,7 +136,7 @@ function startTeamToolProgressBinder(onUpdate: OnUpdate | undefined): TeamToolPr
 				onUpdate({ content: [{ type: "text", text: `team status=starting elapsed=${elapsed}s` }] });
 				return;
 			}
-			const loaded = loadRunManifestById(cwd, runId);
+			const loaded = loadRunManifestById(cwd, runId); // NOTE: no withRunLock - best-effort only; concurrent writes may cause inconsistency
 			if (!loaded) {
 				const elapsed = Math.max(0, Math.round((Date.now() - startedAt) / 1000));
 				onUpdate({ content: [{ type: "text", text: `team run=${runId} elapsed=${elapsed}s (manifest pending)` }] });

package/src/extension/registration/viewers.ts

@@ -23,7 +23,7 @@ async function getViewer(): Promise<typeof DurableTranscriptViewerType> {
 export async function selectAgentTask(ctx: ExtensionCommandContext, runId: string | undefined, taskId?: string): Promise<{ runId: string; taskId?: string } | undefined> {
 	if (!runId) return undefined;
 	if (taskId) return { runId, taskId };
-	const loaded = loadRunManifestById(ctx.cwd, runId);
+	const loaded = loadRunManifestById(ctx.cwd, runId); // NOTE: no withRunLock - best-effort only; concurrent writes may cause inconsistency
 	if (!loaded) return { runId };
 	const agents = readCrewAgents(loaded.manifest);
 	if (ctx.hasUI && agents.length > 1) {
@@ -39,7 +39,7 @@ export async function openTranscriptViewer(ctx: ExtensionCommandContext, initial
 	const runId = selected.runId;
 	const taskId = selected.taskId;
 	if (!runId || !ctx.hasUI) return false;
-	const loaded = loadRunManifestById(ctx.cwd, runId);
+	const loaded = loadRunManifestById(ctx.cwd, runId); // NOTE: no withRunLock - best-effort only; concurrent writes may cause inconsistency
 	if (!loaded) return false;
 	const uiConfig = loadConfig(ctx.cwd).config.ui;
 	const DurableTranscriptViewer = await getViewer();
@@ -58,6 +58,7 @@ export async function openLiveConversation(ctx: ExtensionCommandContext, initial
 	const handle = liveAgents.find((h) => h.runId === selected.runId && (selected.taskId ? h.taskId === selected.taskId : true));
 	if (!handle) return false;
 	const theme = asCrewTheme({});
+	// eslint-disable-next-line @typescript-eslint/no-explicit-any
 	await ctx.ui.custom<undefined>((tui: any, _theme: any, _keybindings: any, done: (result: undefined) => void) => {
 		const columns = tui?.terminal?.columns ?? 80;
 		const rows = tui?.terminal?.rows ?? 24;

package/src/extension/run-export.ts

@@ -1,17 +1,29 @@
 import * as fs from "node:fs";
 import * as path from "node:path";
 import * as os from "node:os";
+import * as crypto from "node:crypto";
 import type { TeamRunManifest, TeamTaskState } from "../state/types.ts";
 import { writeArtifact } from "../state/artifact-store.ts";
 import { readEvents, type TeamEvent } from "../state/event-log.ts";
 import { redactSecrets } from "../utils/redaction.ts";
 
 /** Replace absolute paths containing home directory with ~/ */
+/** Escape special regex characters in a string */
+function escapeRegex(str: string): string {
+	return str.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+}
+
+/** Only redact home directory at path boundaries to avoid corrupting substrings */
+function redactHomePathInString(str: string, home: string): string {
+	return str.replace(new RegExp(`(^|(?<=[:=/]))${escapeRegex(home)}`, "g"), "$1~");
+}
+
+/** Replace absolute paths containing home directory with ~/ at path boundaries only */
 function redactHomePaths<T>(obj: T): T {
 	const home = os.homedir();
 	if (!home) return redactSecrets(obj) as T;
 	const json = JSON.stringify(obj);
-	const safe = json.split(home).join("~");
+	const safe = redactHomePathInString(json, home);
 	return redactSecrets(JSON.parse(safe)) as T;
 }
 
@@ -37,6 +49,9 @@ export function exportRunBundle(manifest: TeamRunManifest, tasks: TeamTaskState[
 		events: safeEvents as TeamEvent[],
 		artifactPaths: safeManifest.artifacts.map((artifact) => artifact.path),
 	};
+	// Compute SHA-256 integrity hash of the bundle and store in manifest
+	const sha256 = crypto.createHash("sha256").update(JSON.stringify(bundle)).digest("hex");
+	(bundle.manifest as unknown as Record<string, unknown>).sha256 = sha256;
 	const json = writeArtifact(manifest.artifactsRoot, {
 		kind: "metadata",
 		relativePath: "export/run-export.json",

package/src/extension/run-import.ts

@@ -1,5 +1,6 @@
 import * as fs from "node:fs";
 import * as path from "node:path";
+import * as crypto from "node:crypto";
 import { assertRunBundle } from "./run-bundle-schema.ts";
 import { projectCrewRoot, userCrewRoot } from "../utils/paths.ts";
 import { DEFAULT_PATHS } from "../config/defaults.ts";
@@ -42,6 +43,21 @@ export function importRunBundle(cwd: string, bundlePath: string, scope: "project
 	if (!isContained) throw new Error(`Import path must be within project directory or crew root: ${resolvedPath}`);
 	const raw = JSON.parse(fs.readFileSync(resolvedPath, "utf-8")) as unknown;
 	assertRunBundle(raw);
+
+	// Integrity check: verify SHA-256 hash if present in manifest
+	const bundleJson = fs.readFileSync(resolvedPath, "utf-8");
+	const parsedForHash = JSON.parse(bundleJson) as { manifest?: { sha256?: string } };
+	if (parsedForHash.manifest?.sha256) {
+		const expectedHash = parsedForHash.manifest.sha256;
+		// Recompute hash by stringifying the bundle without the sha256 field
+		const { sha256: _sha256, ...manifestWithoutHash } = parsedForHash.manifest as Record<string, unknown> & { sha256?: string };
+		const bundleForHash = { ...parsedForHash, manifest: manifestWithoutHash };
+		const recomputedHash = crypto.createHash("sha256").update(JSON.stringify(bundleForHash)).digest("hex");
+		if (recomputedHash !== expectedHash) {
+			throw new Error(`Integrity check failed: SHA-256 mismatch. Expected ${expectedHash}, got ${recomputedHash}`);
+		}
+	}
+
 	const runId = assertSafePathId("runId", raw.manifest.runId);
 	const importedAt = new Date().toISOString();
 

package/src/extension/team-tool/anchor.ts

@@ -40,9 +40,13 @@ export function handleAnchorSet(
 	const cfg = params.config ?? {};
 
 	// Parse context from config
+	const POLLUTED_KEYS = new Set(["__proto__", "constructor", "prototype"]);
 	const context: Record<string, unknown> = {};
 	if (cfg.context && typeof cfg.context === "object") {
-		Object.assign(context, cfg.context as Record<string, unknown>);
+		const raw = cfg.context as Record<string, unknown>;
+		for (const [k, v] of Object.entries(raw)) {
+			if (!POLLUTED_KEYS.has(k)) context[k] = v;
+		}
 	}
 	if (cfg.key) {
 		// Single key shorthand