pi-crew 0.6.0 → 0.6.3

package/src/extension/team-tool/api.ts

@@ -25,9 +25,14 @@ import type { PiTeamsToolResult } from "../tool-result.ts";
 import { locateRunCwd } from "../team-tool.ts";
 import { configRecord, result, type TeamContext } from "./context.ts";
 
-function globMatch(value: string, pattern: string): boolean {
-	const escaped = pattern.replace(/[.+^${}()|[\]\\]/g, "\\$&").replace(/\?/g, "\\?").replace(/\*/g, ".*");
-	return new RegExp(`^${escaped}$`).test(value);
+export function globMatch(value: string, pattern: string): boolean {
+	// Prevent ReDoS: reject excessively long patterns
+	if (pattern.length > 200) return false;
+	const regex = pattern
+		.replace(/[.+^${}()|[\]\\]/g, "\\$&")  // escape regex special chars
+		.replace(/\*/g, "[^/]*")  // * matches non-slash characters only
+		.replace(/\?/g, "[^/]");  // ? matches single non-slash
+	return new RegExp(`^${regex}$`).test(value);
 }
 
 function safeReadContainedFile(baseDir: string, filePath: string | undefined): string | undefined {
@@ -87,7 +92,7 @@ export async function handleApi(params: TeamToolParamsValue, ctx: TeamContext):
 	if (!params.runId) return result("API requires runId.", { action: "api", status: "error" }, true);
 	const runCwd = locateRunCwd(params.runId, ctx.cwd);
 	if (!runCwd) return result(`Run '${params.runId}' not found.`, { action: "api", status: "error" }, true);
-	const loaded = loadRunManifestById(runCwd, params.runId);
+	const loaded = loadRunManifestById(runCwd, params.runId); // NOTE: no withRunLock - best-effort only; concurrent writes may cause inconsistency
 	if (!loaded) return result(`Run '${params.runId}' not found.`, { action: "api", status: "error" }, true);
 	if (operation === "read-manifest") {
 		return result(JSON.stringify(loaded.manifest, null, 2), { action: "api", status: "ok", runId: loaded.manifest.runId, artifactsRoot: loaded.manifest.artifactsRoot });
@@ -97,7 +102,7 @@ export async function handleApi(params: TeamToolParamsValue, ctx: TeamContext):
 		if (!permission.allowed) return result(permission.reason ?? "Plan approval is not allowed in this context.", { action: "api", status: "error", runId: loaded.manifest.runId }, true);
 		try {
 			return withRunLockSync(loaded.manifest, () => {
-				const current = loadRunManifestById(ctx.cwd, loaded.manifest.runId) ?? loaded;
+				const current = loadRunManifestById(ctx.cwd, loaded.manifest.runId) ?? loaded; // NOTE: inside withRunLockSync - consistent read
 				const approval = current.manifest.planApproval;
 				if (!approval?.required || approval.status !== "pending") return result("Run has no pending plan approval request.", { action: "api", status: "error", runId: loaded.manifest.runId }, true);
 				const now = new Date().toISOString();
@@ -116,7 +121,7 @@ export async function handleApi(params: TeamToolParamsValue, ctx: TeamContext):
 		if (!permission.allowed) return result(permission.reason ?? "Plan approval cancellation is not allowed in this context.", { action: "api", status: "error", runId: loaded.manifest.runId }, true);
 		try {
 			return withRunLockSync(loaded.manifest, () => {
-				const current = loadRunManifestById(ctx.cwd, loaded.manifest.runId) ?? loaded;
+				const current = loadRunManifestById(ctx.cwd, loaded.manifest.runId) ?? loaded; // NOTE: inside withRunLockSync - consistent read
 				const approval = current.manifest.planApproval;
 				if (!approval?.required || approval.status !== "pending") return result("Run has no pending plan approval request.", { action: "api", status: "error", runId: loaded.manifest.runId }, true);
 				const now = new Date().toISOString();
@@ -364,7 +369,7 @@ export async function handleApi(params: TeamToolParamsValue, ctx: TeamContext):
 				const updatedTask = claimTask(task, owner);
 				const tasks = loaded.tasks.map((item) => item.id === task.id ? updatedTask : item);
 				saveRunTasks(loaded.manifest, tasks);
-				appendEvent(loaded.manifest.eventsPath, { type: "task.claimed", runId: loaded.manifest.runId, taskId: task.id, data: { owner, token: updatedTask.claim?.token, leasedUntil: updatedTask.claim?.leasedUntil } });
+				appendEvent(loaded.manifest.eventsPath, { type: "task.claimed", runId: loaded.manifest.runId, taskId: task.id, data: { owner, token: "[REDACTED]", leasedUntil: updatedTask.claim?.leasedUntil } });
 				return result(JSON.stringify(updatedTask.claim, null, 2), { action: "api", status: "ok", runId: loaded.manifest.runId, artifactsRoot: loaded.manifest.artifactsRoot });
 			});
 		} catch (error) {

package/src/extension/team-tool/cancel.ts

@@ -41,7 +41,7 @@ export function abortOwned(
 ): AbortOwnedResult {
 	const runCwd = locateRunCwd(runId, ctx.cwd);
 	if (!runCwd) return { abortedIds: [], missingIds: taskIds ?? [], foreignIds: [] };
-	const loaded = loadRunManifestById(runCwd, runId);
+	const loaded = loadRunManifestById(runCwd, runId); // NOTE: no withRunLock - best-effort only; concurrent writes may cause inconsistency
 	if (!loaded) return { abortedIds: [], missingIds: taskIds ?? [], foreignIds: [] };
 
 	const result: AbortOwnedResult = { abortedIds: [], missingIds: [], foreignIds: [] };
@@ -81,7 +81,7 @@ export async function handleRetry(params: TeamToolParamsValue, ctx: TeamContext,
 	if (!params.runId) return result("Retry requires runId.", { action: "retry", status: "error" }, true);
 	const runCwd = locateRunCwd(params.runId, ctx.cwd);
 	if (!runCwd) return result(`Run '${params.runId}' not found.`, { action: "retry", status: "error" }, true);
-	const loaded = loadRunManifestById(runCwd, params.runId);
+	const loaded = loadRunManifestById(runCwd, params.runId); // NOTE: no withRunLock - best-effort only; concurrent writes may cause inconsistency
 	if (!loaded) return result(`Run '${params.runId}' not found.`, { action: "retry", status: "error" }, true);
 
 	// Pre-lock ownership check: reject foreign-owned runs unless force is set
@@ -146,7 +146,7 @@ export async function handleCancel(params: TeamToolParamsValue, ctx: TeamContext
 	if (!params.runId) return result("Cancel requires runId.", { action: "cancel", status: "error" }, true);
 	const runCwd = locateRunCwd(params.runId, ctx.cwd);
 	if (!runCwd) return result(`Run '${params.runId}' not found.`, { action: "cancel", status: "error" }, true);
-	const loaded = loadRunManifestById(runCwd, params.runId);
+	const loaded = loadRunManifestById(runCwd, params.runId); // NOTE: no withRunLock - best-effort only; concurrent writes may cause inconsistency
 	if (!loaded) return result(`Run '${params.runId}' not found.`, { action: "cancel", status: "error" }, true);
 
 	// Pre-lock ownership check: reject foreign-owned runs unless force is set

package/src/extension/team-tool/config-patch.ts

@@ -1,5 +1,19 @@
 import { effectiveAutonomousConfig, parseConfig, type PiTeamsAutonomousConfig, type PiTeamsConfig } from "../../config/config.ts";
 
+const DANGEROUS_KEYS = new Set(["__proto__", "constructor", "prototype"]);
+
+/** Recursively strip dangerous prototype-pollution keys from all levels of an object. */
+export function sanitizeObject<T>(obj: T): T {
+	if (obj === null || obj === undefined || typeof obj !== "object") return obj;
+	if (Array.isArray(obj)) return obj.map((item) => sanitizeObject(item)) as T;
+	const safe: Record<string, unknown> = {};
+	for (const key of Object.keys(obj as Record<string, unknown>)) {
+		if (DANGEROUS_KEYS.has(key)) continue;
+		safe[key] = sanitizeObject((obj as Record<string, unknown>)[key]);
+	}
+	return safe as T;
+}
+
 export function autonomousPatchFromConfig(config: unknown): PiTeamsAutonomousConfig {
 	const rootPatch = parseConfig(config).autonomous;
 	if (rootPatch) return rootPatch;
@@ -11,7 +25,7 @@ export function configPatchFromConfig(config: unknown): PiTeamsConfig {
 }
 
 export function effectiveRunConfig(base: PiTeamsConfig, rawOverride: unknown): PiTeamsConfig {
-	const patch = parseConfig(rawOverride);
+	const patch = sanitizeObject(parseConfig(rawOverride));
 	return {
 		...base,
 		...patch,

package/src/extension/team-tool/explain.ts

@@ -209,7 +209,7 @@ export function handleExplain(params: {
     return result("explain requires runId", { action: "explain", status: "error" }, true);
   }
 
-  const loaded = loadRunManifestById(cwd, params.runId);
+  const loaded = loadRunManifestById(cwd, params.runId); // NOTE: no withRunLock - best-effort only; concurrent writes may cause inconsistency
   if (!loaded) {
     return result(`Run '${params.runId}' not found.`, { action: "explain", status: "error" }, true);
   }

package/src/extension/team-tool/handle-schedule.ts

@@ -163,6 +163,43 @@ function persistScheduledJob(cwd: string, job: import("../../runtime/scheduler.t
 	}
 }
 
+/** Update an existing scheduled job in persistent settings. */
+export function persistScheduledJobUpdate(cwd: string, job: import("../../runtime/scheduler.ts").ScheduledJob): void {
+	try {
+		const settings = loadCrewSettings(cwd);
+		const existingJobs: import("../../runtime/scheduler.ts").ScheduledJob[] = Array.isArray(
+			(settings as Record<string, unknown>).scheduledJobs,
+		)
+			? ((settings as Record<string, unknown>).scheduledJobs as import("../../runtime/scheduler.ts").ScheduledJob[])
+			: [];
+		const updated = existingJobs.map((j) => j.id === job.id ? job : j);
+		saveCrewSettings(
+			{ ...settings, scheduledJobs: updated } as Parameters<typeof saveCrewSettings>[0],
+			cwd,
+		);
+	} catch {
+		/* best-effort persistence */
+	}
+}
+
+/** Remove a scheduled job from persistent settings. */
+function persistScheduledJobRemove(cwd: string, jobId: string): void {
+	try {
+		const settings = loadCrewSettings(cwd);
+		const existingJobs: import("../../runtime/scheduler.ts").ScheduledJob[] = Array.isArray(
+			(settings as Record<string, unknown>).scheduledJobs,
+		)
+			? ((settings as Record<string, unknown>).scheduledJobs as import("../../runtime/scheduler.ts").ScheduledJob[])
+			: [];
+		saveCrewSettings(
+			{ ...settings, scheduledJobs: existingJobs.filter((j) => j.id !== jobId) } as Parameters<typeof saveCrewSettings>[0],
+			cwd,
+		);
+	} catch {
+		/* best-effort persistence */
+	}
+}
+
 export function handleListScheduled(_params: TeamToolParamsValue, ctx: TeamContext): PiTeamsToolResult {
 	const scheduler = getCrewScheduler();
 	if (!scheduler) return result("Scheduler not running.", { action: "scheduled", status: "error" }, true);
@@ -177,6 +214,9 @@ export function handleListScheduled(_params: TeamToolParamsValue, ctx: TeamConte
 			`    Next run: ${job.nextRun ?? "(unscheduled)"}`,
 			`    Runs: ${job.runCount}, Last: ${job.lastRun ?? "(never)"} [${job.lastStatus ?? "?"}]`,
 		);
+		if (job.spawnedRunIds && job.spawnedRunIds.length > 0) {
+			lines.push(`    Spawned runs: ${job.spawnedRunIds.join(", ")}`);
+		}
 	}
 	return result(lines.join("\n"), { action: "scheduled", status: "ok" });
 }

package/src/extension/team-tool/inspect.ts

@@ -10,7 +10,7 @@ export function handleEvents(params: TeamToolParamsValue, ctx: TeamContext): PiT
 	if (!params.runId) return result("Events requires runId.", { action: "events", status: "error" }, true);
 	const runCwd = locateRunCwd(params.runId, ctx.cwd);
 	if (!runCwd) return result(`Run '${params.runId}' not found.`, { action: "events", status: "error" }, true);
-	const loaded = loadRunManifestById(runCwd, params.runId);
+	const loaded = loadRunManifestById(runCwd, params.runId); // NOTE: no withRunLock - best-effort only; concurrent writes may cause inconsistency
 	if (!loaded) return result(`Run '${params.runId}' not found.`, { action: "events", status: "error" }, true);
 	const events = readEvents(loaded.manifest.eventsPath);
 	const lines = [`Events for ${loaded.manifest.runId}:`, ...(events.length ? events.map((event) => `${event.time} ${event.type}${event.taskId ? ` ${event.taskId}` : ""}${event.message ? `: ${event.message}` : ""}${event.data ? ` ${JSON.stringify(event.data)}` : ""}`) : ["(none)"])];
@@ -21,7 +21,7 @@ export function handleArtifacts(params: TeamToolParamsValue, ctx: TeamContext):
 	if (!params.runId) return result("Artifacts requires runId.", { action: "artifacts", status: "error" }, true);
 	const runCwd = locateRunCwd(params.runId, ctx.cwd);
 	if (!runCwd) return result(`Run '${params.runId}' not found.`, { action: "artifacts", status: "error" }, true);
-	const loaded = loadRunManifestById(runCwd, params.runId);
+	const loaded = loadRunManifestById(runCwd, params.runId); // NOTE: no withRunLock - best-effort only; concurrent writes may cause inconsistency
 	if (!loaded) return result(`Run '${params.runId}' not found.`, { action: "artifacts", status: "error" }, true);
 	const lines = [`Artifacts for ${loaded.manifest.runId}:`, ...(loaded.manifest.artifacts.length ? loaded.manifest.artifacts.map((artifact) => `- ${artifact.kind}: ${artifact.path}${artifact.sizeBytes !== undefined ? ` (${artifact.sizeBytes} bytes)` : ""}${artifact.contentHash ? ` sha256=${artifact.contentHash.slice(0, 12)}` : ""}`) : ["- (none)"])];
 	return result(lines.join("\n"), { action: "artifacts", status: "ok", runId: loaded.manifest.runId, artifactsRoot: loaded.manifest.artifactsRoot });
@@ -31,7 +31,7 @@ export function handleSummary(params: TeamToolParamsValue, ctx: TeamContext): Pi
 	if (!params.runId) return result("Summary requires runId.", { action: "summary", status: "error" }, true);
 	const runCwd = locateRunCwd(params.runId, ctx.cwd);
 	if (!runCwd) return result(`Run '${params.runId}' not found.`, { action: "summary", status: "error" }, true);
-	const loaded = loadRunManifestById(runCwd, params.runId);
+	const loaded = loadRunManifestById(runCwd, params.runId); // NOTE: no withRunLock - best-effort only; concurrent writes may cause inconsistency
 	if (!loaded) return result(`Run '${params.runId}' not found.`, { action: "summary", status: "error" }, true);
 	const usage = aggregateUsage(loaded.tasks);
 	const lines = [

package/src/extension/team-tool/lifecycle-actions.ts

@@ -17,7 +17,7 @@ import * as path from "node:path";
 
 export function handleWorktrees(params: TeamToolParamsValue, ctx: TeamContext): PiTeamsToolResult {
 	if (!params.runId) return result("Worktrees requires runId.", { action: "worktrees", status: "error" }, true);
-	const loaded = loadRunManifestById(ctx.cwd, params.runId);
+	const loaded = loadRunManifestById(ctx.cwd, params.runId); // NOTE: no withRunLock - best-effort only; concurrent writes may cause inconsistency
 	if (!loaded) return result(`Run '${params.runId}' not found.`, { action: "worktrees", status: "error" }, true);
 	const withWorktrees = loaded.tasks.filter((task) => task.worktree);
 	const lines = [`Worktrees for ${loaded.manifest.runId}:`, ...(withWorktrees.length ? withWorktrees.map((task) => `- ${task.id}: ${task.worktree!.path} branch=${task.worktree!.branch} reused=${task.worktree!.reused ? "true" : "false"}`) : ["- (none)"])];
@@ -46,7 +46,7 @@ export function handleImport(params: TeamToolParamsValue, ctx: TeamContext): PiT
 
 export async function handleExport(params: TeamToolParamsValue, ctx: TeamContext): Promise<PiTeamsToolResult> {
 	if (!params.runId) return result("Export requires runId.", { action: "export", status: "error" }, true);
-	const loaded = loadRunManifestById(ctx.cwd, params.runId);
+	const loaded = loadRunManifestById(ctx.cwd, params.runId); // NOTE: no withRunLock - best-effort only; concurrent writes may cause inconsistency
 	if (!loaded) return result(`Run '${params.runId}' not found.`, { action: "export", status: "error" }, true);
 
 	// SECURITY: Ownership check — only the owner session may export a run.
@@ -95,7 +95,7 @@ export async function handleForget(params: TeamToolParamsValue, ctx: TeamContext
 	if (intentError) return intentError;
 	if (!params.runId) return result("Forget requires runId.", { action: "forget", status: "error" }, true);
 	if (!params.confirm) return result("forget requires confirm: true.", { action: "forget", status: "error" }, true);
-	const loaded = loadRunManifestById(ctx.cwd, params.runId);
+	const loaded = loadRunManifestById(ctx.cwd, params.runId); // NOTE: no withRunLock - best-effort only; concurrent writes may cause inconsistency
 	if (!loaded) return result(`Run '${params.runId}' not found.`, { action: "forget", status: "error" }, true);
 
 	// Ownership check — prevent cross-session deletion unless force is set
@@ -125,7 +125,7 @@ export async function handleCleanup(params: TeamToolParamsValue, ctx: TeamContex
 	const intentError = enforceDestructiveIntent("cleanup", params, ctx.config);
 	if (intentError) return intentError;
 	if (!params.runId) return result("Cleanup requires runId.", { action: "cleanup", status: "error" }, true);
-	const loaded = loadRunManifestById(ctx.cwd, params.runId);
+	const loaded = loadRunManifestById(ctx.cwd, params.runId); // NOTE: no withRunLock - best-effort only; concurrent writes may cause inconsistency
 	if (!loaded) return result(`Run '${params.runId}' not found.`, { action: "cleanup", status: "error" }, true);
 
 	// Ownership check — prevent cross-session worktree cleanup unless force is set

package/src/extension/team-tool/respond.ts

@@ -20,11 +20,11 @@ export function handleRespond(params: TeamToolParamsValue, ctx: TeamContext): Pi
 
 	const runCwd = locateRunCwd(params.runId, ctx.cwd);
 	if (!runCwd) return result(`Run '${params.runId}' not found.`, { action: "respond", status: "error" }, true);
-	const loaded = loadRunManifestById(runCwd, params.runId);
+	const loaded = loadRunManifestById(runCwd, params.runId); // NOTE: no withRunLock - best-effort only; concurrent writes may cause inconsistency
 	if (!loaded) return result(`Run '${params.runId}' not found.`, { action: "respond", status: "error" }, true);
 
 	return withRunLockSync(loaded.manifest, () => {
-		const fresh = loadRunManifestById(loaded.manifest.cwd, params.runId!);
+		const fresh = loadRunManifestById(loaded.manifest.cwd, params.runId!); // NOTE: inside withRunLockSync - consistent read
 		if (!fresh) return result(`Run '${params.runId}' not found.`, { action: "respond", status: "error" }, true);
 		const foreignRun = typeof fresh.manifest.ownerSessionId === "string" && fresh.manifest.ownerSessionId !== ctx.sessionId;
 		if (foreignRun && !params.force) return result(`Run ${fresh.manifest.runId} belongs to another session. Use force: true to override.`, { action: "respond", status: "error", runId: fresh.manifest.runId }, true);

package/src/extension/team-tool/run.ts

@@ -2,6 +2,7 @@ import { allAgents, discoverAgents } from "../../agents/discover-agents.ts";
 import { allTeams, discoverTeams } from "../../teams/discover-teams.ts";
 import { allWorkflows, discoverWorkflows } from "../../workflows/discover-workflows.ts";
 import { loadConfig } from "../../config/config.ts";
+import { findGitRoot, assertCleanLeader } from "../../worktree/worktree-manager.ts";
 import type { TeamToolParamsValue } from "../../schema/team-tool-schema.ts";
 import { writeArtifact } from "../../state/artifact-store.ts";
 import { registerActiveRun, unregisterActiveRun } from "../../state/active-run-registry.ts";
@@ -85,9 +86,57 @@ export async function handleRun(params: TeamToolParamsValue, ctx: TeamContext):
 	const { ensureCrewDirectory } = await import("../../state/crew-init.ts");
 	await ensureCrewDirectory(workingDir);
 
-	const teams = allTeams(discoverTeams(ctx.cwd));
-	const workflows = allWorkflows(discoverWorkflows(ctx.cwd));
-	const agents = allAgents(discoverAgents(ctx.cwd));
+	// WORKTREE FIX: If worktree mode is needed but cwd is not a git repo,
+	// auto-correct to the nearest git repo root. This prevents "not a git repository"
+	// errors when ctx.cwd points to a parent directory that isn't a git repo.
+	let resolvedCtx = ctx;
+	if (workingDir) {
+		try {
+			const gitRoot = findGitRoot(workingDir);
+			if (gitRoot && gitRoot !== workingDir) {
+				resolvedCtx = { ...ctx, cwd: gitRoot };
+			}
+		} catch {
+			// cwd is not in a git repo — validate below if worktree mode is needed
+		}
+	}
+
+	// WORKTREE PRECONDITION CHECK: validate git repo exists and is clean
+	// BEFORE creating the run manifest, so we return a friendly error
+	// instead of crashing mid-execution in prepareTaskWorkspace.
+	if (params.workspaceMode === "worktree") {
+		let gitRoot: string | undefined;
+		try {
+			gitRoot = findGitRoot(resolvedCtx.cwd);
+		} catch {
+			// not a git repo
+		}
+		if (!gitRoot) {
+			return result(
+				`Worktree mode requires a git repository. '${resolvedCtx.cwd}' is not inside a git repo.\nUse workspaceMode: 'single' or run from a git repository.`,
+				{ action: "run", status: "error" },
+				true,
+			);
+		}
+		// Check if clean leader is required (can be disabled via config)
+		const preCheckConfig = loadConfig(resolvedCtx.cwd);
+		if (preCheckConfig.config.requireCleanWorktreeLeader !== false) {
+			try {
+				assertCleanLeader(gitRoot);
+			} catch (err) {
+				const msg = err instanceof Error ? err.message : String(err);
+				return result(
+					`${msg}\nCommit or stash changes before using worktree mode, or use workspaceMode: 'single'.`,
+					{ action: "run", status: "error" },
+					true,
+				);
+			}
+		}
+	}
+
+	const teams = allTeams(discoverTeams(resolvedCtx.cwd));
+	const workflows = allWorkflows(discoverWorkflows(resolvedCtx.cwd));
+	const agents = allAgents(discoverAgents(resolvedCtx.cwd));
 	const directAgent = params.agent ? agents.find((item) => item.name === params.agent) : undefined;
 	if (params.agent && !directAgent) return result(`Agent '${params.agent}' not found.`, { action: "run", status: "error" }, true);
 	const teamName = params.team ?? "default";
@@ -110,7 +159,7 @@ export async function handleRun(params: TeamToolParamsValue, ctx: TeamContext):
 		steps: [{ id: "01_agent", role: params.role ?? "agent", task: "{goal}", model: params.model }],
 	} : workflows.find((item) => item.name === workflowName);
 	if (!baseWorkflow) return result(`Workflow '${workflowName}' not found.`, { action: "run", status: "error" }, true);
-	const workflow = directAgent ? baseWorkflow : expandParallelResearchWorkflow(baseWorkflow, ctx.cwd);
+	const workflow = directAgent ? baseWorkflow : expandParallelResearchWorkflow(baseWorkflow, resolvedCtx.cwd);
 
 	// Check if this is a pipeline workflow - special handling for multi-stage execution
 	const isPipelineWorkflow = workflowName === "pipeline" && !directAgent;
@@ -152,7 +201,7 @@ export async function handleRun(params: TeamToolParamsValue, ctx: TeamContext):
 
 	const skillOverride = normalizeSkillOverride(params.skill);
 	const { manifest, tasks, paths } = createRunManifest({
-		cwd: ctx.cwd,
+		cwd: resolvedCtx.cwd,
 		team,
 		workflow,
 		goal,
@@ -169,7 +218,7 @@ export async function handleRun(params: TeamToolParamsValue, ctx: TeamContext):
 	atomicWriteJson(paths.manifestPath, updatedManifest);
 	registerActiveRun(updatedManifest);
 
-	const loadedConfig = loadConfig(ctx.cwd);
+	const loadedConfig = loadConfig(resolvedCtx.cwd);
 	const executedConfig = effectiveRunConfig(loadedConfig.config, params.config);
 	const runtime = await resolveCrewRuntime(executedConfig);
 	const runtimeResolution = runtimeResolutionState(runtime);
@@ -205,11 +254,11 @@ export async function handleRun(params: TeamToolParamsValue, ctx: TeamContext):
 		const asyncManifest = { ...effectiveManifest, async: { pid: spawned.pid, logPath: spawned.logPath, spawnedAt: new Date().toISOString() } };
 		atomicWriteJson(paths.manifestPath, asyncManifest);
 		void appendEventAsync(effectiveManifest.eventsPath, { type: "async.spawned", runId: effectiveManifest.runId, data: { pid: spawned.pid, logPath: spawned.logPath } });
-		scheduleBackgroundEarlyExitGuard(ctx.cwd, effectiveManifest.runId, spawned.pid, spawned.logPath);
+		scheduleBackgroundEarlyExitGuard(resolvedCtx.cwd, effectiveManifest.runId, spawned.pid, spawned.logPath);
 		// Wait for the async run to complete and return actual results.
 		try {
-			const completed = await waitForRun(updatedManifest.runId, ctx.cwd, { timeoutMs: 3600000 });
-			const metrics = collectRunMetrics(ctx.cwd, completed.manifest.runId);
+			const completed = await waitForRun(updatedManifest.runId, resolvedCtx.cwd, { timeoutMs: 3600000 });
+			const metrics = collectRunMetrics(resolvedCtx.cwd, completed.manifest.runId);
 			const lines: string[] = [
 				`pi-crew run ${completed.manifest.status}: ${completed.manifest.runId} (${team.name})`,
 				`Goal: ${goal.slice(0, 100)}`,
@@ -341,8 +390,8 @@ export async function handleRun(params: TeamToolParamsValue, ctx: TeamContext):
 
 		// Wait for the foreground run to complete and return actual results.
 		try {
-			const completed = await waitForRun(updatedManifest.runId, ctx.cwd, { timeoutMs: 3600000 });
-			const metrics = collectRunMetrics(ctx.cwd, completed.manifest.runId);
+			const completed = await waitForRun(updatedManifest.runId, resolvedCtx.cwd, { timeoutMs: 3600000 });
+			const metrics = collectRunMetrics(resolvedCtx.cwd, completed.manifest.runId);
 			const lines: string[] = [
 				`pi-crew run ${completed.manifest.status}: ${completed.manifest.runId} (${team.name})`,
 				`Goal: ${goal.slice(0, 100)}`,

package/src/extension/team-tool/status.ts

@@ -18,7 +18,7 @@ export function handleStatus(params: TeamToolParamsValue, ctx: TeamContext): PiT
 	if (!params.runId) return result("Status requires runId.", { action: "status", status: "error" }, true);
 	const runCwd = locateRunCwd(params.runId, ctx.cwd);
 	if (!runCwd) return result(`Run '${params.runId}' not found.`, { action: "status", status: "error" }, true);
-	const loaded = loadRunManifestById(runCwd, params.runId);
+	const loaded = loadRunManifestById(runCwd, params.runId); // NOTE: no withRunLock - best-effort only; concurrent writes may cause inconsistency
 	if (!loaded) return result(`Run '${params.runId}' not found.`, { action: "status", status: "error" }, true);
 	let { manifest, tasks } = loaded;
 	let asyncLivenessLine: string | undefined;