pi-crew 0.6.0 → 0.6.3

package/src/extension/team-tool.ts

@@ -18,7 +18,7 @@ import {
 import type { executeTeamRun as _executeTeamRunFn } from "../runtime/team-runner.ts";
 import type { TeamToolParamsValue } from "../schema/team-tool-schema.ts";
 import { writeArtifact } from "../state/artifact-store.ts";
-import { appendEvent } from "../state/event-log.ts";
+import { appendEvent, appendEventFireAndForget } from "../state/event-log.ts";
 import { withRunLock } from "../state/locks.ts";
 import { replayPendingMailboxMessages } from "../state/mailbox.ts";
 import {
@@ -33,6 +33,7 @@ import type {
 	TeamTaskState,
 } from "../state/types.ts";
 import { allTeams, discoverTeams } from "../teams/discover-teams.ts";
+import { assertSafePathId } from "../utils/safe-paths.ts";
 import {
 	allWorkflows,
 	discoverWorkflows,
@@ -99,10 +100,31 @@ async function handleRun(
 	return _cachedHandleRun(...args);
 }
 
+import { FileCheckpointStore } from "../runtime/checkpoint.ts";
 import { waitForRun } from "../runtime/run-tracker.ts";
 import { normalizeSkillOverride } from "../runtime/skill-instructions.ts";
+import {
+	computeRunCacheKey,
+	getCachedRun,
+	getCacheStats,
+} from "../state/run-cache.ts";
+import { listRunGraphs, loadRunGraph } from "../state/run-graph.ts";
 import { searchAgents, searchTeams } from "../utils/bm25-search.ts";
 import { projectCrewRoot } from "../utils/paths.ts";
+import { buildTeamOnboarding } from "./team-onboard.ts";
+import {
+	handleAnchorAccumulate,
+	handleAnchorClear,
+	handleAnchorSet,
+	handleAnchorStatus,
+} from "./team-tool/anchor.ts";
+import {
+	createAutoSummarizeService,
+	handleAutoSummarizeConfig,
+	handleAutoSummarizeOff,
+	handleAutoSummarizeOn,
+	handleAutoSummarizeStatus,
+} from "./team-tool/auto-summarize.ts";
 import {
 	type CacheControlDeps,
 	invalidateSnapshot,
@@ -110,6 +132,10 @@ import {
 import { handleCancel, handleRetry } from "./team-tool/cancel.ts";
 import { handleDoctor } from "./team-tool/doctor.ts";
 import { handleExplain } from "./team-tool/explain.ts";
+import {
+	handleListScheduled,
+	handleSchedule,
+} from "./team-tool/handle-schedule.ts";
 import { handleHealthMonitor } from "./team-tool/health-monitor.ts";
 import {
 	handleArtifacts,
@@ -125,30 +151,17 @@ import {
 	handlePrune,
 	handleWorktrees,
 } from "./team-tool/lifecycle-actions.ts";
-import {
-	getCachedRun,
-	computeRunCacheKey,
-	getCacheStats,
-} from "../state/run-cache.ts";
-import {
-	loadRunGraph,
-	listRunGraphs,
-} from "../state/run-graph.ts";
-import { FileCheckpointStore } from "../runtime/checkpoint.ts";
-import { buildTeamOnboarding } from "./team-onboard.ts";
+import { handleOrchestrate } from "./team-tool/orchestrate.ts";
 import { handleParallel } from "./team-tool/parallel-dispatch.ts";
-import { handleSchedule, handleListScheduled } from "./team-tool/handle-schedule.ts";
 import { handlePlan } from "./team-tool/plan.ts";
-import { handleOrchestrate } from "./team-tool/orchestrate.ts";
 import { handleRespond } from "./team-tool/respond.ts";
 import { handleStatus } from "./team-tool/status.ts";
-import { handleAnchorSet, handleAnchorClear, handleAnchorStatus, handleAnchorAccumulate } from "./team-tool/anchor.ts";
-import { handleAutoSummarizeOn, handleAutoSummarizeOff, handleAutoSummarizeStatus, handleAutoSummarizeConfig, createAutoSummarizeService } from "./team-tool/auto-summarize.ts";
 
 export { handleApi } from "./team-tool/api.ts";
 export { handleRetry } from "./team-tool/cancel.ts";
 export type { TeamContext } from "./team-tool/context.ts";
 export { handleDoctor } from "./team-tool/doctor.ts";
+export { handleSchedule } from "./team-tool/handle-schedule.ts";
 export {
 	handleArtifacts,
 	handleEvents,
@@ -163,12 +176,11 @@ export {
 	handlePrune,
 	handleWorktrees,
 } from "./team-tool/lifecycle-actions.ts";
-export { handleSchedule } from "./team-tool/handle-schedule.ts";
+export { handleOrchestrate } from "./team-tool/orchestrate.ts";
 export { handlePlan } from "./team-tool/plan.ts";
 export { handleStatus } from "./team-tool/status.ts";
 export type { TeamToolDetails } from "./team-tool-types.ts";
 export { handleRun };
-export { handleOrchestrate } from "./team-tool/orchestrate.ts";
 
 export function handleList(
 	params: TeamToolParamsValue,
@@ -451,7 +463,7 @@ export async function handleResume(
 			{ action: "resume", status: "error" },
 			true,
 		);
-	const loaded = loadRunManifestById(runCwd, params.runId);
+	const loaded = loadRunManifestById(runCwd, params.runId); // NOTE: no withRunLock - best-effort only; concurrent writes may cause inconsistency
 	if (!loaded)
 		return result(
 			`Run '${params.runId}' not found.`,
@@ -674,7 +686,7 @@ export function handleSteer(
 			{ action: "steer", status: "error" },
 			true,
 		);
-	const loaded = loadRunManifestById(runCwd, runId);
+	const loaded = loadRunManifestById(runCwd, runId); // NOTE: no withRunLock - best-effort only; concurrent writes may cause inconsistency
 	if (!loaded)
 		return result(
 			`Run '${runId}' not found`,
@@ -689,12 +701,23 @@ export function handleSteer(
 			true,
 		);
 	if (!task.pendingSteers) task.pendingSteers = [];
-		// HIGH-04: Cap pendingSteers array to prevent unbounded memory growth
-		const MAX_PENDING_STEERS = 100;
-		if (task.pendingSteers.length >= MAX_PENDING_STEERS) {
-			task.pendingSteers = task.pendingSteers.slice(-(MAX_PENDING_STEERS - 1));
-		}
-		task.pendingSteers.push(message);
+	// HIGH-04: Cap pendingSteers array to prevent unbounded memory growth
+	const MAX_PENDING_STEERS = 100;
+	if (task.pendingSteers.length >= MAX_PENDING_STEERS) {
+		// Log warning before dropping the oldest message
+		appendEventFireAndForget(loaded.manifest.eventsPath, {
+			type: "task.steer_dropped",
+			runId,
+			taskId,
+			data: {
+				droppedMessage: task.pendingSteers[0],
+				reason: "pendingSteers cap exceeded",
+				queueDepth: task.pendingSteers.length,
+			},
+		});
+		task.pendingSteers = task.pendingSteers.slice(-(MAX_PENDING_STEERS - 1));
+	}
+	task.pendingSteers.push(message);
 	saveRunTasks(loaded.manifest, loaded.tasks);
 	appendEvent(loaded.manifest.eventsPath, {
 		type: "task.steer_queued",
@@ -751,17 +774,57 @@ function handleInvalidate(
 /**
  * Locate the CWD where a run's state is stored.
  * Tries ctx.cwd first, then scans immediate child directories for .crew/state/runs/<runId>.
+ *
+ * Defensive bounds (prevent hang on large dirs like /tmp in CI):
+ * - Skips entries that are well-known system/ephemeral dirs (e.g. .npm, node_modules, .git)
+ * - Caps the scan at MAX_SCAN_ENTRIES to avoid pathological scans
+ * - Skips hidden entries (starting with `.`) unless they look like run directories
+ *   (e.g. .crew, .pi, .tmp-crew-runs)
  */
-export function locateRunCwd(runId: string, baseCwd: string): string | undefined {
+const MAX_SCAN_ENTRIES = 1000;
+const SKIP_SCAN_DIRS = new Set([
+	"node_modules",
+	".git",
+	".npm",
+	".cache",
+	".local",
+	"proc",
+	"sys",
+	"dev",
+	"Library",
+	"Applications",
+]);
+
+export function locateRunCwd(
+	runId: string,
+	baseCwd: string,
+): string | undefined {
 	// Fast path: run is in the current CWD
-	if (loadRunManifestById(baseCwd, runId)) return baseCwd;
+	if (loadRunManifestById(baseCwd, runId)) {
+		return baseCwd;
+	}
 
-	// Scan immediate child directories
+	// Scan immediate child directories, but with defensive bounds.
 	try {
-		for (const entry of fs.readdirSync(baseCwd, { withFileTypes: true })) {
+		const entries = fs.readdirSync(baseCwd, { withFileTypes: true });
+		const boundedEntries = entries.length > MAX_SCAN_ENTRIES
+			? entries.slice(0, MAX_SCAN_ENTRIES)
+			: entries;
+		for (const entry of boundedEntries) {
 			if (!entry.isDirectory()) continue;
+			if (SKIP_SCAN_DIRS.has(entry.name)) continue;
+			// Skip hidden entries except well-known run-storage prefixes
+			if (entry.name.startsWith(".")) {
+				if (
+					!entry.name.startsWith(".crew") &&
+					!entry.name.startsWith(".pi") &&
+					!entry.name.startsWith(".tmp-crew")
+				) continue;
+			}
 			const candidate = path.join(baseCwd, entry.name);
-			if (loadRunManifestById(candidate, runId)) return candidate;
+			if (loadRunManifestById(candidate, runId)) {
+				return candidate;
+			}
 		}
 	} catch {
 		/* ignore unreadable dirs */
@@ -1090,23 +1153,32 @@ export async function handleTeamTool(
 			return handleWait(params, ctx);
 		case "graph": {
 			if (params.runId) {
+				assertSafePathId("runId", params.runId);
 				const graph = loadRunGraph(ctx.cwd, params.runId);
 				return result(
-					graph ? JSON.stringify(graph, null, 2) : "No graph found for this run.",
+					graph
+						? JSON.stringify(graph, null, 2)
+						: "No graph found for this run.",
 					{ action: "graph", status: graph ? "ok" : "error" },
 					!graph,
 				);
 			}
 			const graphs = listRunGraphs(ctx.cwd);
 			return result(
-				graphs.length ? `Available graphs:\n${graphs.join("\n")}` : "No graphs available.",
+				graphs.length
+					? `Available graphs:\n${graphs.join("\n")}`
+					: "No graphs available.",
 				{ action: "graph", status: "ok" },
 			);
 		}
 		case "search": {
 			const query = params.goal ?? params.task ?? "";
 			if (!query) {
-				return result("Search requires goal or task query.", { action: "search", status: "error" }, true);
+				return result(
+					"Search requires goal or task query.",
+					{ action: "search", status: "error" },
+					true,
+				);
 			}
 			try {
 				const [agentResults, teamResults] = await Promise.all([
@@ -1117,19 +1189,30 @@ export async function handleTeamTool(
 				if (teamResults.length) {
 					lines.push("## Teams");
 					for (const r of teamResults) {
-						lines.push(`- [${r.team.name}] score=${r.score.toFixed(2)}: ${r.team.description ?? "(no description)"}`);
+						lines.push(
+							`- [${r.team.name}] score=${r.score.toFixed(2)}: ${r.team.description ?? "(no description)"}`,
+						);
 					}
 				}
 				if (agentResults.length) {
 					lines.push("## Agents");
 					for (const r of agentResults) {
-						lines.push(`- [${r.agent.name}] score=${r.score.toFixed(2)}: ${r.agent.description ?? "(no description)"}`);
+						lines.push(
+							`- [${r.agent.name}] score=${r.score.toFixed(2)}: ${r.agent.description ?? "(no description)"}`,
+						);
 					}
 				}
-				return result(lines.length ? lines.join("\n") : "No results found.", { action: "search", status: "ok" });
+				return result(
+					lines.length ? lines.join("\n") : "No results found.",
+					{ action: "search", status: "ok" },
+				);
 			} catch (err) {
 				const msg = err instanceof Error ? err.message : String(err);
-				return result(`Search failed: ${msg}`, { action: "search", status: "error" }, true);
+				return result(
+					`Search failed: ${msg}`,
+					{ action: "search", status: "error" },
+					true,
+				);
 			}
 		}
 		case "schedule":
@@ -1137,7 +1220,10 @@ export async function handleTeamTool(
 		case "scheduled":
 			return handleListScheduled(params, ctx);
 		case "anchor": {
-			const subAction = typeof params.config?.subAction === "string" ? params.config.subAction : "status";
+			const subAction =
+				typeof params.config?.subAction === "string"
+					? params.config.subAction
+					: "status";
 			switch (subAction) {
 				case "set":
 					return handleAnchorSet(params, ctx);
@@ -1151,7 +1237,12 @@ export async function handleTeamTool(
 		}
 		case "auto-summarize":
 		case "auto_boomerang": {
-			const subAction = typeof params.config?.subAction === "string" ? params.config.subAction : ((params.action as string) === "auto_boomerang" ? "toggle" : "status");
+			const subAction =
+				typeof params.config?.subAction === "string"
+					? params.config.subAction
+					: (params.action as string) === "auto_boomerang"
+						? "toggle"
+						: "status";
 			switch (subAction) {
 				case "on":
 					return handleAutoSummarizeOn(params, ctx);
@@ -1178,7 +1269,14 @@ export async function handleTeamTool(
 		}
 		case "explain": {
 			const explainResult = handleExplain(params, ctx.cwd);
-			return result(explainResult.text, { action: "explain", status: explainResult.isError ? "error" : "ok" }, explainResult.isError);
+			return result(
+				explainResult.text,
+				{
+					action: "explain",
+					status: explainResult.isError ? "error" : "ok",
+				},
+				explainResult.isError,
+			);
 		}
 		case "cache": {
 			if (params.goal) {
@@ -1192,10 +1290,24 @@ export async function handleTeamTool(
 				if (cached) {
 					return result(
 						`Cached run found (${new Date(cached.cachedAt).toISOString()}): runId=${cached.runId}, status=${cached.status}, ${cached.tasks.length} tasks`,
-						{ action: "cache", status: "ok", data: { cacheKey: key, cacheHit: true, runId: cached.runId, status: cached.status, taskCount: cached.tasks.length } },
+						{
+							action: "cache",
+							status: "ok",
+							data: {
+								cacheKey: key,
+								cacheHit: true,
+								runId: cached.runId,
+								status: cached.status,
+								taskCount: cached.tasks.length,
+							},
+						},
 					);
 				}
-				return result(`No cached result for key: ${key}`, { action: "cache", status: "ok", data: { cacheKey: key, cacheHit: false } });
+				return result(`No cached result for key: ${key}`, {
+					action: "cache",
+					status: "ok",
+					data: { cacheKey: key, cacheHit: false },
+				});
 			}
 			const stats = getCacheStats(ctx.cwd);
 			return result(
@@ -1205,13 +1317,28 @@ export async function handleTeamTool(
 		}
 		case "checkpoint": {
 			if (!params.runId || !params.taskId) {
-				return result("Checkpoint requires runId and taskId.", { action: "checkpoint", status: "error" }, true);
+				return result(
+					"Checkpoint requires runId and taskId.",
+					{ action: "checkpoint", status: "error" },
+					true,
+				);
 			}
-			const stateRoot = path.join(projectCrewRoot(ctx.cwd), "state", "runs", params.runId);
+			assertSafePathId("runId", params.runId);
+			assertSafePathId("taskId", params.taskId);
+			const stateRoot = path.join(
+				projectCrewRoot(ctx.cwd),
+				"state",
+				"runs",
+				params.runId,
+			);
 			const store = new FileCheckpointStore(stateRoot);
 			const checkpoint = store.load(params.runId, params.taskId);
 			if (!checkpoint) {
-				return result("No checkpoint found.", { action: "checkpoint", status: "error" }, true);
+				return result(
+					"No checkpoint found.",
+					{ action: "checkpoint", status: "error" },
+					true,
+				);
 			}
 			return result(
 				`Checkpoint: step=${checkpoint.step}, progress=${checkpoint.progress}, savedAt=${new Date(checkpoint.savedAt).toISOString()}`,
@@ -1258,7 +1385,8 @@ export function registerCrewGlobalRegistry(registry: CrewRegistry): void {
 		registry;
 }
 
-export function getCrewGlobalRegistry(): CrewRegistry | undefined {
+/** @internal */
+function getCrewGlobalRegistry(): CrewRegistry | undefined {
 	return (globalThis as Record<symbol | string, unknown>)[
 		CREW_REGISTRY_KEY
 	] as CrewRegistry | undefined;

package/src/hooks/registry.ts

@@ -5,19 +5,42 @@ import { runEventBus } from "../ui/run-event-bus.ts";
 
 const registry = new Map<HookName, HookDefinition[]>();
 
+// Track hook IDs registered by pi-crew for scope-aware cleanup
+const _piCrewHookIds = new Set<number>();
+let _nextHookId = 1;
+
 // SECURITY: Hooks are currently global (registered once, applied to all workspaces).
 // For multi-workspace environments, consider filtering hooks by workspace scope:
 //   const workspaceHooks = getHooks(name).filter(h => !h.workspaceId || h.workspaceId === ctx.workspaceId);
 // This prevents globally-registered hooks from operating on runs they weren't designed for.
 
-export function registerHook(definition: HookDefinition): void {
+export function registerHook(definition: HookDefinition): number {
+	const hookId = _nextHookId++;
+	_piCrewHookIds.add(hookId);
 	const hooks = registry.get(definition.name) ?? [];
-	hooks.push(definition);
+	hooks.push({ ...definition, _hookId: hookId });
 	registry.set(definition.name, hooks);
+	return hookId;
 }
 
 export function clearHooks(): void {
 	registry.clear();
+	_piCrewHookIds.clear();
+	_nextHookId = 1;
+}
+
+// Scope-aware hook clearing: only removes hooks registered by pi-crew
+export function clearHooksScoped(): void {
+	for (const [name, hooks] of registry) {
+		const remaining = hooks.filter((h) => !("_hookId" in h && _piCrewHookIds.has((h as { _hookId?: number })._hookId ?? -1)));
+		if (remaining.length === 0) {
+			registry.delete(name);
+		} else {
+			registry.set(name, remaining);
+		}
+	}
+	_piCrewHookIds.clear();
+	_nextHookId = 1;
 }
 
 export function getHooks(name: HookName): HookDefinition[] {
@@ -27,29 +50,78 @@ export function getHooks(name: HookName): HookDefinition[] {
 export async function executeHook(name: HookName, ctx: HookContext): Promise<HookExecutionReport> {
 	const hooks = getHooks(name);
 	if (hooks.length === 0) return { hookName: name, outcome: "allow", durationMs: 0 };
-	// SECURITY: If ctx contains a workspaceId, filter hooks to only those scoped to
-	// this workspace. This prevents globally-registered hooks from operating on runs
-	// they weren't designed for.
-	// SECURITY: Hooks without workspaceId match ALL workspaces. This is intentional
-	// for globally-applicable hooks (e.g., logging, metrics). For multi-tenant
-	// environments, all hooks should set workspaceId to prevent cross-workspace access.
-	const scopedHooks = hooks.filter((h) => !h.workspaceId || h.workspaceId === ctx.workspaceId);
+	// SECURITY: Filter hooks by workspace scope.
+	//   - Global hooks (no workspaceId) match all contexts UNLESS ctx explicitly
+	//     opts out via `includeGlobalHooks: false`. This is the documented
+	//     behavior: "Hooks without workspaceId match ALL workspaces".
+	//   - Scoped hooks (workspaceId set) require an exact match with ctx.workspaceId.
+	//   - If ctx has no workspaceId, scoped hooks are excluded (they can't match).
+	//   - `includeGlobalHooks: true` on ctx forces inclusion of global hooks even
+	//     when ctx has a workspaceId.
+	const scopedHooks = hooks.filter((h) => {
+		// Scoped hook: must match ctx.workspaceId exactly
+		if (h.workspaceId !== undefined) {
+			return h.workspaceId === ctx.workspaceId;
+		}
+		// Global hook (no workspaceId): include unless ctx explicitly excludes
+		return ctx.includeGlobalHooks !== false;
+	});
 	if (scopedHooks.length === 0) return { hookName: name, outcome: "allow", durationMs: 0 };
+	const POLLUTED_KEYS = new Set(["__proto__", "constructor", "prototype", "hasOwnProperty", "toString", "valueOf", "isPrototypeOf", "propertyIsEnumerable", "__defineGetter__", "__defineSetter__", "__lookupGetter__", "__lookupSetter__"].map((k) => k.toLowerCase().normalize("NFKC")));
+	function sanitizeMergeData(data: Record<string, unknown>): Record<string, unknown> {
+		const clean: Record<string, unknown> = {};
+		for (const [k, v] of Object.entries(data)) {
+			if (!POLLUTED_KEYS.has(k.toLowerCase())) {
+				if (v !== null && typeof v === "object") {
+					if (Array.isArray(v)) {
+						// Sanitize array elements that are objects
+						clean[k] = v.map((item) => (item !== null && typeof item === "object" && !Array.isArray(item) ? sanitizeMergeData(item as Record<string, unknown>) : item));
+					} else {
+						clean[k] = sanitizeMergeData(v as Record<string, unknown>);
+					}
+				} else {
+					clean[k] = v;
+				}
+			}
+		}
+		return clean;
+	}
+	// Sanitize ctx by stripping dangerous property names before passing to handlers.
+	// Hook authors must NOT set these keys directly on ctx: [...POLLUTED_KEYS]
+	// This sanitization runs at the start of executeHook to prevent prototype pollution attacks.
+	function sanitizeContext(ctx: HookContext): HookContext {
+		for (const key of Object.keys(ctx)) {
+			if (POLLUTED_KEYS.has(key.toLowerCase())) {
+				delete ctx[key];
+			}
+		}
+		return ctx;
+	}
+	function sanitizeErrorMessage(message: string): string {
+		// Remove file paths, environment variable references, and other potentially sensitive data
+		return message
+			.replace(/\/[^:\s]+/g, "[path]")
+			.replace(/\b[A-Z_0-9]+\s*=/g, "[env]")
+			.replace(/\b\d+\.\d+\.\d+\.\d+\b/g, "[ip]");
+	}
 	const start = Date.now();
 	const diagnostics: string[] = [];
 	let capturedModifications: Record<string, unknown> | undefined;
 	for (const hook of scopedHooks) {
 			try {
-				const result: HookResult = await hook.handler(ctx);
+				const result: HookResult = await hook.handler(sanitizeContext(ctx));
+				// SECURITY: Sanitize any direct mutations the handler may have made to ctx.
+				// This prevents hooks from injecting dangerous properties via direct ctx assignment.
+				sanitizeContext(ctx);
 				if (hook.mode === "blocking" && result.outcome === "block") {
 					return { hookName: name, outcome: "block", durationMs: Date.now() - start, reason: result.reason };
 				}
 			if (result.outcome === "modify" && result.data) {
-				Object.assign(ctx, result.data);
+				Object.assign(ctx, sanitizeMergeData(result.data));
 				capturedModifications = { ...result.data };
 			}
 		} catch (error) {
-			const message = error instanceof Error ? error.message : String(error);
+			const message = sanitizeErrorMessage(error instanceof Error ? error.message : String(error));
 			if (hook.mode === "blocking") {
 				return { hookName: name, outcome: "block", durationMs: Date.now() - start, reason: `Hook error: ${message}` };
 			}

package/src/hooks/types.ts

@@ -20,9 +20,9 @@ export type HookName =
  * - 1 = warn (non-blocking error, continue)
  * - 2 = block (blocking error, stop)
  */
-export const HOOK_EXIT_SUCCESS = 0 as const;
-export const HOOK_EXIT_WARN = 1 as const;
-export const HOOK_EXIT_BLOCK = 2 as const;
+/** @internal */ const HOOK_EXIT_SUCCESS = 0 as const;
+/** @internal */ const HOOK_EXIT_WARN = 1 as const;
+/** @internal */ const HOOK_EXIT_BLOCK = 2 as const;
 
 export type HookMode = "blocking" | "non_blocking";
 export type HookOutcome = "allow" | "block" | "modify" | "diagnostic";
@@ -31,6 +31,13 @@ export interface HookContext {
 	runId: string;
 	taskId?: string;
 	cwd: string;
+	// NOTE: Hooks receive a shared mutable context object. A hook may directly set
+	// properties on ctx, but MUST NOT set dangerous names like "__proto__",
+	// "constructor", "prototype", etc. (see registry.ts POLLUTED_KEYS).
+	// Hook authors are trusted but must avoid prototype pollution attacks.
+	// The sanitizeMergeData function prevents dangerous properties from propagating
+	// via result.data merge, and a runtime guard sanitizes ctx before passing to
+	// handlers AND after handler execution to catch direct mutations.
 	[key: string]: unknown;
 }
 
@@ -47,6 +54,8 @@ export interface HookDefinition {
 	// SECURITY: Optional workspace scoping. When set, the hook only executes for
 	// runs in the specified workspace. When absent, the hook applies to all runs.
 	workspaceId?: string;
+	/** @internal Internal hook ID for scope-aware cleanup. */
+	_hookId?: number;
 }
 
 export interface HookExecutionReport {

package/src/i18n.ts

@@ -129,13 +129,26 @@ export function t(key: Key, params?: Params): string {
  * @example
  * addTranslations("vi", { "agent.requiresPrompt": "Agent cần prompt." })
  */
+const DANGEROUS_KEYS = new Set(["__proto__", "constructor", "prototype"]);
+
+function stripDangerousKeys<T extends Record<string, unknown>>(obj: T): T {
+	const safe: Record<string, unknown> = {};
+	for (const key of Object.keys(obj)) {
+		if (!DANGEROUS_KEYS.has(key)) {
+			safe[key] = obj[key];
+		}
+	}
+	return safe as T;
+}
+
 export function addTranslations(locale: string, bundle: Partial<Record<Key, string>>): void {
 	if (!locale) return;
+	const safeBundle = stripDangerousKeys(bundle as Record<string, unknown>) as Partial<Record<Key, string>>;
 	const existing = translations[locale];
 	if (existing) {
-		Object.assign(existing, bundle);
+		Object.assign(existing, safeBundle);
 	} else {
-		translations[locale] = { ...bundle };
+		translations[locale] = { ...safeBundle };
 	}
 }
 

package/src/observability/exporters/otlp-exporter.ts

@@ -8,6 +8,78 @@ import type { MetricExporter } from "./adapter.ts";
 
 const gzipAsync = promisify(gzip);
 
+/**
+ * SSRF protection: validate that an OTLP endpoint URL does not target
+ * private/reserved networks or dangerous protocols.
+ * Rejects: localhost, loopback, private IPs, link-local, cloud metadata,
+ * IPv6 private, file:// and javascript:// protocols.
+ * Only http:// and https:// to public hostnames are allowed.
+ */
+export function validateEndpoint(endpoint: string): void {
+	let url: URL;
+	try {
+		url = new URL(endpoint);
+	} catch {
+		throw new Error(`Invalid OTLP endpoint URL: ${endpoint}`);
+	}
+
+	// Only allow http and https protocols
+	if (url.protocol !== "http:" && url.protocol !== "https:") {
+		throw new Error(
+			`OTLP endpoint must use http:// or https:// protocol, got: ${url.protocol}`,
+		);
+	}
+
+	const hostname = url.hostname.toLowerCase();
+
+	// Reject known localhost names
+	if (hostname === "localhost" || hostname.endsWith(".localhost")) {
+		throw new Error(`OTLP endpoint must not target localhost: ${endpoint}`);
+	}
+
+	// Reject IPv6 loopback and private
+	if (hostname.startsWith("[")) {
+		const bare = hostname.replace(/^\[|\]$/g, "");
+		if (bare === "::1") {
+			throw new Error(`OTLP endpoint must not target loopback address: ${endpoint}`);
+		}
+		if (bare.toLowerCase().startsWith("fd") || bare.toLowerCase().startsWith("fc")) {
+			throw new Error(`OTLP endpoint must not target private IPv6 address: ${endpoint}`);
+		}
+	}
+
+	// Reject IPv4 private/reserved ranges
+	// Match plain IPv4 addresses (not hostnames that look like IPs)
+	const ipv4Match = hostname.match(/^(\d{1,3})\.(\d{1,3})\.(\d{1,3})\.(\d{1,3})$/);
+	if (ipv4Match) {
+		const octets = [Number(ipv4Match[1]), Number(ipv4Match[2]), Number(ipv4Match[3]), Number(ipv4Match[4])];
+		// 127.x.x.x - loopback
+		if (octets[0] === 127) {
+			throw new Error(`OTLP endpoint must not target loopback address: ${endpoint}`);
+		}
+		// 10.x.x.x - private class A
+		if (octets[0] === 10) {
+			throw new Error(`OTLP endpoint must not target private network (10.0.0.0/8): ${endpoint}`);
+		}
+		// 172.16.x.x - 172.31.x.x - private class B
+		if (octets[0] === 172 && octets[1] >= 16 && octets[1] <= 31) {
+			throw new Error(`OTLP endpoint must not target private network (172.16.0.0/12): ${endpoint}`);
+		}
+		// 192.168.x.x - private class C
+		if (octets[0] === 192 && octets[1] === 168) {
+			throw new Error(`OTLP endpoint must not target private network (192.168.0.0/16): ${endpoint}`);
+		}
+		// 169.254.x.x - link-local / cloud metadata
+		if (octets[0] === 169 && octets[1] === 254) {
+			throw new Error(`OTLP endpoint must not target link-local/metadata endpoint (169.254.0.0/16): ${endpoint}`);
+		}
+		// 0.x.x.x - this network
+		if (octets[0] === 0) {
+			throw new Error(`OTLP endpoint must not target this-network address (0.0.0.0/8): ${endpoint}`);
+		}
+	}
+}
+
 // FIX (Round 15): Cap the number of snapshots per push to prevent OOM when
 // the metric registry has grown large. The OTLP HTTP spec allows many metrics
 // in one payload, but a single push > 10_000 metrics would balloon the
@@ -71,6 +143,7 @@ export class OTLPExporter implements MetricExporter {
 	private readonly registry: MetricRegistry;
 
 	constructor(opts: OTLPExporterOptions, registry: MetricRegistry) {
+		validateEndpoint(opts.endpoint);
 		this.opts = opts;
 		this.registry = registry;
 	}