pi-crew 0.6.1 → 0.6.3

package/src/extension/register.ts

@@ -5,7 +5,7 @@ import type {
 	ExtensionAPI,
 	ExtensionContext,
 } from "@earendil-works/pi-coding-agent";
-import { loadConfig } from "../config/config.ts";
+import { asRecord, loadConfig } from "../config/config.ts";
 import { applyCrewSettingsToConfig, loadCrewSettings } from "../runtime/settings-store.ts";
 // 2.7: Lazy-load LiveRunSidebar — only constructed when the user actually opens
 // a live run sidebar overlay. The class pulls in transcript-viewer and other
@@ -19,7 +19,7 @@ import {
 import { registerAutonomousPolicy } from "./autonomous-policy.ts";
 import { registerCleanupHandler } from "./crew-cleanup.ts";
 import type { ScheduledJob } from "../runtime/scheduler.ts";
-import { clearHooks } from "../hooks/registry.ts";
+import { clearHooksScoped } from "../hooks/registry.ts";
 import { uninstallCrewGlobalRegistry } from "./team-tool.ts";
 import { notifyActiveRuns } from "./session-summary.ts";
 
@@ -87,6 +87,7 @@ import {
 	projectCrewRoot,
 	userCrewRoot,
 } from "../utils/paths.ts";
+import { resolveContainedPath } from "../utils/safe-paths.ts";
 import { resetTimings, time } from "../utils/timings.ts";
 import {
 	type PiCrewRpcHandle,
@@ -108,6 +109,7 @@ import {
 import { registerSubagentTools } from "./registration/subagent-tools.ts";
 import { registerTeamTool } from "./registration/team-tool.ts";
 import { handleTeamTool } from "./team-tool.ts";
+import { persistScheduledJobUpdate } from "./team-tool/handle-schedule.ts";
 
 let _cachedOTLPExporter: typeof OTLPExporterType | undefined;
 async function importOTLPExporter(): Promise<typeof OTLPExporterType> {
@@ -132,6 +134,8 @@ import {
 } from "../runtime/crash-recovery.ts";
 import { appendDeadletter } from "../runtime/deadletter.ts";
 import { HeartbeatWatcher } from "../runtime/heartbeat-watcher.ts";
+import { cleanupOrphanTempDirs, cleanupLegacyOrphanTempDirs } from "../runtime/pi-args.ts";
+import { cleanupOrphanWorkers } from "../runtime/orphan-worker-registry.ts";
 import { reconcileOrphanedTempWorkspaces } from "../runtime/stale-reconciler.ts";
 
 let _cachedCrashRecovery:
@@ -183,10 +187,14 @@ export function registerPiTeams(pi: ExtensionAPI): void {
 	const disposeI18n = initI18n(pi);
 	resetTimings();
 	time("register:start");
-	const globalStore = globalThis as Record<string, unknown>;
-	const runtimeCleanupStoreKey = "__piCrewRuntimeCleanup";
+	const globalStore = globalThis as Record<string | symbol, unknown>;
+	const runtimeCleanupStoreKey = Symbol("__piCrewRuntimeCleanup");
 	const previousRuntimeCleanup = globalStore[runtimeCleanupStoreKey];
 	time("register:init");
+	// Best-effort cleanup of the previous runtime instance. Errors are logged but
+	// do not halt new registration — a failing cleanup from a prior instance is
+	// preferable to leaving pi-crew unregistered, and any stale state from the
+	// previous instance will be reconciled when the new instance initializes.
 	if (typeof previousRuntimeCleanup === "function") {
 		try {
 			previousRuntimeCleanup();
@@ -443,6 +451,34 @@ export function registerPiTeams(pi: ExtensionAPI): void {
 						cleanupOrphanedTempDirs:
 							config.reliability?.cleanupOrphanedTempDirs,
 					});
+					// Layer 4: also clean orphan temp dirs under
+					// ~/.pi/agent/pi-crew/tmp/ that the SIGKILL'd parent
+					// processes left behind. Catches anything Layers 1-3 missed.
+					const orphanResult = cleanupOrphanTempDirs();
+					if (orphanResult.cleaned > 0) {
+						notifyOperator({
+							id: `layer4_temp_cleanup_${Date.now()}`,
+							severity: "info",
+							source: "temp-cleanup",
+							title: `Layer 4: cleaned ${orphanResult.cleaned} orphan temp dir(s)`,
+							body: `~/.pi/agent/pi-crew/tmp/ orphans older than 24h removed (scanned ${orphanResult.scanned}, failed ${orphanResult.failed}).`,
+						});
+					}
+					// Layer 5: clean legacy /tmp/pi-crew-* prompt/task orphans
+					// from before commit 8ba270d moved temp dirs out of /tmp.
+					// The existing reconcileOrphanedTempWorkspaces only cleans
+					// dirs containing .crew/state/runs/ (run-state dirs), so
+					// prompt/task orphans are never touched by Layer 3.
+					const legacyResult = cleanupLegacyOrphanTempDirs();
+					if (legacyResult.cleaned > 0) {
+						notifyOperator({
+							id: `layer5_legacy_temp_cleanup_${Date.now()}`,
+							severity: "info",
+							source: "temp-cleanup",
+							title: `Layer 5: cleaned ${legacyResult.cleaned} legacy /tmp/pi-crew-* orphan(s)`,
+							body: `Pre-fix /tmp/pi-crew-* prompt/task orphans (no .crew/state/runs/, >24h) removed (scanned ${legacyResult.scanned}, failed ${legacyResult.failed}).`,
+						});
+					}
 				} catch (error) {
 					logInternalError("register.tempAutoRepair", error);
 				}
@@ -478,13 +514,15 @@ export function registerPiTeams(pi: ExtensionAPI): void {
 				);
 		}
 	};
-	const autoRecoveryLast = new Map<string, number>();
+	const autoRecoveryLast = new Map<string, { insertedAt: number; lastAccessAt: number }>();
 	// FIX (Round 22, defensive cap): Bound the cooldown-gate Map. Each run
 	// contributes up to 4 keys (one per maybeNotifyHealth kind). Without a cap,
 	// a long-running pi session that runs thousands of teams accumulates
-	// thousands of entries. Eviction: oldest insertion first — matches the
-	// 5-minute cooldown gate semantics, since once the gate has expired the
-	// entry is irrelevant.
+	// thousands of entries. Eviction: oldest lastAccessAt first — uses LRU-like
+	// semantics so entries that are still being actively accessed (re-accessed
+	// before eviction) survive longer. This is fairer than insertion-order
+	// eviction under high churn where many entries expire naturally before
+	// being re-accessed.
 	const AUTO_RECOVERY_LAST_MAX_ENTRIES = 1000;
 	const configureDeliveryCoordinator = (): void => {
 		deliveryCoordinator?.dispose();
@@ -812,8 +850,8 @@ export function registerPiTeams(pi: ExtensionAPI): void {
 				.then(({ startForegroundWatchdog }) => {
 					startForegroundWatchdog({ pi, cwd: ctx.cwd, runId });
 				})
-				.catch(() => {
-					/* non-critical */
+				.catch((error) => {
+					logInternalError("register.foreground-watchdog-import", error);
 				});
 		}
 		setImmediate(() => {
@@ -823,7 +861,7 @@ export function registerPiTeams(pi: ExtensionAPI): void {
 						error instanceof Error ? error.message : String(error);
 					if (runId) {
 						try {
-							const loaded = loadRunManifestById(ctx.cwd, runId);
+							const loaded = loadRunManifestById(ctx.cwd, runId); // NOTE: no withRunLock - best-effort only; concurrent writes may cause inconsistency. Post-run status updates tolerate slight staleness.
 							if (
 								loaded &&
 								loaded.manifest.status !== "completed" &&
@@ -877,7 +915,7 @@ export function registerPiTeams(pi: ExtensionAPI): void {
 						}
 					}
 					if (ownerCurrent && runId) {
-						const loaded = loadRunManifestById(ctx.cwd, runId);
+						const loaded = loadRunManifestById(ctx.cwd, runId); // NOTE: no withRunLock - best-effort only; concurrent writes may cause inconsistency. Post-run status updates tolerate slight staleness.
 						const status = loaded?.manifest.status ?? "finished";
 						const level =
 							status === "failed" || status === "blocked"
@@ -971,9 +1009,25 @@ export function registerPiTeams(pi: ExtensionAPI): void {
 			const registry = (globalThis as Record<symbol | string, unknown>)[
 				CREW_REGISTRY_KEY
 			] as Record<string, unknown>;
-			registry.getRecord = (runId: string) =>
+			// Phase 3b (defensive): Validate registry structure before patching methods.
+			// If a previous occupant left a non-conforming object, replace it entirely.
+			// This prevents runtime failures if getRecord/listRuns/etc. are called on a
+			// malformed predecessor value.
+			if (
+				registry === null ||
+				typeof registry !== "object" ||
+				Array.isArray(registry)
+			) {
+				(globalThis as Record<symbol | string, unknown>)[
+					CREW_REGISTRY_KEY
+				] = {};
+			}
+			const validatedRegistry = (globalThis as Record<symbol | string, unknown>)[
+				CREW_REGISTRY_KEY
+			] as Record<string, unknown>;
+			validatedRegistry.getRecord = (runId: string) =>
 				manifestCacheForRegistry.get(runId);
-			registry.listRuns = () =>
+			validatedRegistry.listRuns = () =>
 				manifestCacheForRegistry
 					.list(100)
 					.map(
@@ -987,7 +1041,7 @@ export function registerPiTeams(pi: ExtensionAPI): void {
 							goal: m.goal,
 						}),
 					);
-			registry.appendEvent = (
+			validatedRegistry.appendEvent = (
 				runId: string,
 				event: Record<string, unknown>,
 			) => {
@@ -1003,7 +1057,7 @@ export function registerPiTeams(pi: ExtensionAPI): void {
 							),
 					);
 			};
-			registry.waitForAll = async (runId: string) => {
+			validatedRegistry.waitForAll = async (runId: string) => {
 				// LAZY: state-store only needed for post-completion polling (waitForAll) and sync hasRunning check; avoid at startup.
 				const { loadRunManifestById } = await import(
 					"../state/state-store.ts"
@@ -1022,7 +1076,7 @@ export function registerPiTeams(pi: ExtensionAPI): void {
 				while (!check())
 					await new Promise((resolve) => setTimeout(resolve, 500));
 			};
-			registry.hasRunning = async (runId: string) => {
+			validatedRegistry.hasRunning = async (runId: string) => {
 				const manifest = manifestCacheForRegistry.get(runId);
 				if (!manifest) return false;
 				// LAZY: state-store only needed in hasRunning; avoid at startup.
@@ -1112,7 +1166,7 @@ export function registerPiTeams(pi: ExtensionAPI): void {
 		otlpExporter = undefined;
 		metricRegistry = undefined;
 		deliveryCoordinator?.dispose();
-		clearHooks();
+		clearHooksScoped();
 		uninstallCrewGlobalRegistry();
 		overflowTracker?.dispose();
 		deliveryCoordinator = undefined;
@@ -1150,10 +1204,11 @@ export function registerPiTeams(pi: ExtensionAPI): void {
 		notifyActiveRuns(ctx);
 
 		// Auto-cancel orphaned runs from dead sessions
-		// Extract sessionId from context — validate runtime type instead of unsafe cast.
+		// Extract sessionId from context — use Object.getOwnPropertyDescriptor
+		// to safely access property without triggering Proxy traps, then validate.
 		const rawSessionId =
-			typeof ctx === "object" && ctx !== null && "sessionId" in ctx
-				? (ctx as Record<string, unknown>).sessionId
+			typeof ctx === "object" && ctx !== null
+				? Object.getOwnPropertyDescriptor(ctx, "sessionId")?.value
 				: undefined;
 		const currentSessionId =
 			typeof rawSessionId === "string" && rawSessionId.length > 0
@@ -1219,6 +1274,54 @@ export function registerPiTeams(pi: ExtensionAPI): void {
 					}
 				}
 
+				// Startup cleanup (Fix A): run orphan-temp-dir cleanup
+				// immediately on session_start so we don't wait 5 minutes
+				// for the first timer tick. Especially important after
+				// a SIGKILL'd previous session that left thousands of
+				// orphan temp dirs behind.
+				try {
+					const orphanTmp = cleanupOrphanTempDirs();
+					const legacyTmp = cleanupLegacyOrphanTempDirs();
+					if (orphanTmp.cleaned > 0 || legacyTmp.cleaned > 0) {
+						notifyOperator({
+							id: `startup_temp_cleanup_${Date.now()}`,
+							severity: "info",
+							source: "temp-cleanup",
+							title: `Startup cleanup: removed ${orphanTmp.cleaned + legacyTmp.cleaned} orphan temp dir(s)`,
+							body: `${orphanTmp.cleaned} from ~/.pi/agent/pi-crew/tmp/ + ${legacyTmp.cleaned} legacy /tmp/pi-crew-*`,
+						});
+					}
+				} catch (error) {
+					logInternalError(
+						"register.sessionStart.startupTempCleanup",
+						error,
+					);
+				}
+
+				// Orphan worker cleanup (Fix B): kill stale background-runner
+				// processes from previous (SIGKILL'd) sessions. Workers
+				// detached via setsid+unref outlive the spawning pi
+				// session, and the per-worker parent-guard is intentionally
+				// disabled for background-runner (BUG #17 design). So
+				// orphans can only be cleaned from the next session_start.
+				try {
+					const orphanWorkers = cleanupOrphanWorkers(currentSessionId);
+					if (orphanWorkers.killed > 0) {
+						notifyOperator({
+							id: `orphan_workers_cleanup`,
+							severity: "info",
+							source: "worker-cleanup",
+							title: `Cleaned up ${orphanWorkers.killed} orphan worker(s)`,
+							body: `Background workers from previous (SIGKILL'd) sessions were terminated (pruned ${orphanWorkers.pruned} dead, kept ${orphanWorkers.kept}).`,
+						});
+					}
+				} catch (error) {
+					logInternalError(
+						"register.sessionStart.orphanWorkers",
+						error,
+					);
+				}
+
 				// Global purge of stale active-run-index entries
 				try {
 					const { purged } = purgeStaleActiveRunIndexFn();
@@ -1324,19 +1427,60 @@ export function registerPiTeams(pi: ExtensionAPI): void {
 					runParams = { action: "run", team: "default", goal: job.prompt };
 				}
 				if (runParams.action !== "run") return `scheduled-${job.id}-${Date.now()}`;
+				const agentId = `scheduled-${job.id}-${Date.now()}`;
 				setImmediate(async () => {
 					try {
-						await handleTeamTool(
+						const runResult = await handleTeamTool(
 							{ action: "run", team: runParams.team, goal: runParams.goal, async: true },
 							{ cwd: ctx.cwd, sessionId },
 						);
+						// Track the runId so remove() can cancel spawned runs
+						const runId = runResult?.details?.runId;
+						if (runId && typeof runId === "string") {
+							crewScheduler?.recordSpawnedRun(job.id, runId);
+							// Update run manifest with scheduler provenance for traceability
+							try {
+								const cwd = ctx.cwd ?? process.cwd();
+								const loaded = loadRunManifestById(cwd, runId);
+								if (loaded) {
+									const { atomicWriteJson } = await import("../state/atomic-write.ts");
+									atomicWriteJson(loaded.manifest.stateRoot + "/manifest.json", {
+										...loaded.manifest,
+										schedulerJobId: job.id,
+										schedulerName: job.name,
+									});
+								}
+							} catch { /* best-effort provenance tracking */ }
+						}
+						// Persist updated job with spawnedRunIds to settings
+						try {
+							const updatedJob = crewScheduler?.list().find((j) => j.id === job.id);
+							if (updatedJob) persistScheduledJobUpdate(ctx.cwd, updatedJob);
+						} catch { /* best-effort */ }
+						// Update run count
+						crewScheduler?.update(job.id, {
+							runCount: job.runCount + 1,
+							lastRun: new Date().toISOString(),
+							lastStatus: "success",
+						});
 					} catch (err) {
 						logInternalError("scheduler.execute", err);
+						crewScheduler?.update(job.id, { lastStatus: "error" });
 					}
 				});
-				return `scheduled-${job.id}-${Date.now()}`;
+				return agentId;
 			},
 			finalizer: () => {},
+			runCancelFn: (runId: string) => {
+				try {
+					handleTeamTool(
+						{ action: "cancel", runId, confirm: true },
+						{ cwd: ctx.cwd, sessionId },
+					).catch((err) => logInternalError("scheduler.runCancelFn", err, `runId=${runId}`));
+				} catch (err) {
+					logInternalError("scheduler.runCancelFn.sync", err, `runId=${runId}`);
+				}
+			},
 		});
 		// Wire scheduler into handle-schedule.ts so handlers can add/list jobs.
 		// Uses a global symbol so the module doesn't need a direct circular import.
@@ -1534,18 +1678,26 @@ export function registerPiTeams(pi: ExtensionAPI): void {
 						const previous = autoRecoveryLast.get(key);
 						if (
 							previous !== undefined &&
-							now - previous < 5 * 60_000
+							now - previous.lastAccessAt < 5 * 60_000
 						)
 							return;
-						// Defensive cap: evict oldest entries before inserting
-						// when size exceeds the limit. Map's natural insertion
-						// order means the first key is the oldest.
+						// Defensive cap: evict entry with oldest lastAccessAt before
+						// inserting/updating when size exceeds the limit. Uses LRU
+						// semantics so entries that are still being actively
+						// accessed survive longer than insertion-order eviction.
 						while (autoRecoveryLast.size >= AUTO_RECOVERY_LAST_MAX_ENTRIES) {
-							const oldest = autoRecoveryLast.keys().next().value;
-							if (oldest === undefined) break;
-							autoRecoveryLast.delete(oldest);
+							let oldestKey: string | undefined;
+							let oldestAccess = Infinity;
+							for (const [k, v] of autoRecoveryLast) {
+								if (v.lastAccessAt < oldestAccess) {
+									oldestAccess = v.lastAccessAt;
+									oldestKey = k;
+								}
+							}
+							if (oldestKey === undefined) break;
+							autoRecoveryLast.delete(oldestKey);
 						}
-						autoRecoveryLast.set(key, now);
+						autoRecoveryLast.set(key, { insertedAt: now, lastAccessAt: now });
 						notifyOperator({
 							id: key,
 							severity: "warning",
@@ -1752,8 +1904,15 @@ export function registerPiTeams(pi: ExtensionAPI): void {
 			);
 			const paths: string[] = [];
 			if (fs.existsSync(extSkillDir)) paths.push(extSkillDir);
-			if (skillDir !== extSkillDir && fs.existsSync(skillDir))
-				paths.push(skillDir);
+			if (skillDir !== extSkillDir && fs.existsSync(skillDir)) {
+				// Validate skillDir is within sessionCwd to prevent path traversal
+				try {
+					resolveContainedPath(sessionCwd, "skills");
+					paths.push(skillDir);
+				} catch {
+					// skillDir outside sessionCwd boundary — skip
+				}
+			}
 			return paths.length > 0 ? { skillPaths: paths } : {};
 		});
 	} catch {
@@ -1777,7 +1936,8 @@ export function registerPiTeams(pi: ExtensionAPI): void {
 		if (event.toolName !== "team") return;
 		const rawInput = event.input;
 		if (!rawInput || typeof rawInput !== "object") return;
-		const input = rawInput as { action?: unknown; confirm?: unknown; force?: unknown };
+		const input = asRecord(rawInput);
+		if (!input) return;
 		const action = typeof input.action === "string" ? input.action : undefined;
 		const destructiveActions = new Set(["delete", "forget", "prune", "cleanup"]);
 		if (!action || !destructiveActions.has(action)) return;

package/src/extension/registration/commands.ts

@@ -154,7 +154,7 @@ function teamCommandContext(ctx: ExtensionCommandContext): ExtensionCommandConte
 }
 
 async function handleHealthDashboardAction(ctx: ExtensionCommandContext, selection: RunDashboardSelection): Promise<void> {
-	const loaded = loadRunManifestById(ctx.cwd, selection.runId);
+	const loaded = loadRunManifestById(ctx.cwd, selection.runId); // NOTE: no withRunLock - best-effort only; concurrent writes may cause inconsistency
 	if (!loaded) {
 		depsNotify(ctx, `Run '${selection.runId}' not found.`, "error");
 		return;
@@ -379,7 +379,7 @@ export function registerTeamCommands(pi: ExtensionAPI, deps: RegisterTeamCommand
 	pi.registerCommand("team-result", { description: "Open a pi-crew agent result viewer: <runId> [taskId]", handler: async (args: string, ctx: ExtensionCommandContext) => {
 		const [runId, rawTaskId] = args.trim().split(/\s+/).filter(Boolean);
 		const selected = await selectAgentTask(ctx, runId, rawTaskId);
-		const loaded = selected ? loadRunManifestById(ctx.cwd, selected.runId) : undefined;
+		const loaded = selected ? loadRunManifestById(ctx.cwd, selected.runId) : undefined; // NOTE: no withRunLock - best-effort only; concurrent writes may cause inconsistency
 		if (ctx.hasUI && loaded) {
 			const agent = readCrewAgents(loaded.manifest).find((item) => item.taskId === selected?.taskId || item.id === selected?.taskId) ?? readCrewAgents(loaded.manifest)[0];
 			const resultText = agent?.resultArtifactPath ? commandText(await handleTeamTool({ action: "api", runId: selected?.runId ?? "", config: { operation: "read-agent-output", agentId: agent.taskId, maxBytes: 64_000 } }, teamCommandContext(ctx))) : "(no result)";

package/src/extension/registration/subagent-helpers.ts

@@ -34,7 +34,7 @@ export function sendAgentWakeUp(pi: ExtensionAPI, content: string): boolean {
 
 export function refreshPersistedSubagentRecord(ctx: ExtensionContext | ExtensionCommandContext, record: SubagentRecord): SubagentRecord {
 	if (!record.runId) return record;
-	const loaded = loadRunManifestById(ctx.cwd, record.runId);
+	const loaded = loadRunManifestById(ctx.cwd, record.runId); // NOTE: no withRunLock - best-effort only; concurrent writes may cause inconsistency
 	if (!loaded) return record;
 	if (loaded.manifest.status === "completed" || loaded.manifest.status === "failed" || loaded.manifest.status === "cancelled" || loaded.manifest.status === "blocked") {
 		const refreshed = {
@@ -65,7 +65,7 @@ export function formatSubagentRecord(record: SubagentRecord): string {
 
 export function readSubagentRunResult(ctx: ExtensionContext | ExtensionCommandContext, record: SubagentRecord): string | undefined {
 	if (!record.runId) return record.result;
-	const loaded = loadRunManifestById(ctx.cwd, record.runId);
+	const loaded = loadRunManifestById(ctx.cwd, record.runId); // NOTE: no withRunLock - best-effort only; concurrent writes may cause inconsistency
 	const task = loaded?.tasks.find((item) => item.resultArtifact) ?? loaded?.tasks[0];
 	const artifactPath = task?.resultArtifact?.path;
 	if (!artifactPath || !loaded) return undefined;

package/src/extension/registration/subagent-tools.ts

@@ -204,7 +204,7 @@ function startAgentToolProgress(cwd: string, agentRecordId: string, onUpdate: On
 			let tasks;
 			let agents;
 			if (record.runId) {
-				const loaded = loadRunManifestById(cwd, record.runId);
+				const loaded = loadRunManifestById(cwd, record.runId); // NOTE: no withRunLock - best-effort only; concurrent writes may cause inconsistency
 				if (loaded) {
 					manifest = loaded.manifest;
 					tasks = loaded.tasks;

package/src/extension/registration/team-tool.ts

@@ -136,7 +136,7 @@ function startTeamToolProgressBinder(onUpdate: OnUpdate | undefined): TeamToolPr
 				onUpdate({ content: [{ type: "text", text: `team status=starting elapsed=${elapsed}s` }] });
 				return;
 			}
-			const loaded = loadRunManifestById(cwd, runId);
+			const loaded = loadRunManifestById(cwd, runId); // NOTE: no withRunLock - best-effort only; concurrent writes may cause inconsistency
 			if (!loaded) {
 				const elapsed = Math.max(0, Math.round((Date.now() - startedAt) / 1000));
 				onUpdate({ content: [{ type: "text", text: `team run=${runId} elapsed=${elapsed}s (manifest pending)` }] });

package/src/extension/registration/viewers.ts

@@ -23,7 +23,7 @@ async function getViewer(): Promise<typeof DurableTranscriptViewerType> {
 export async function selectAgentTask(ctx: ExtensionCommandContext, runId: string | undefined, taskId?: string): Promise<{ runId: string; taskId?: string } | undefined> {
 	if (!runId) return undefined;
 	if (taskId) return { runId, taskId };
-	const loaded = loadRunManifestById(ctx.cwd, runId);
+	const loaded = loadRunManifestById(ctx.cwd, runId); // NOTE: no withRunLock - best-effort only; concurrent writes may cause inconsistency
 	if (!loaded) return { runId };
 	const agents = readCrewAgents(loaded.manifest);
 	if (ctx.hasUI && agents.length > 1) {
@@ -39,7 +39,7 @@ export async function openTranscriptViewer(ctx: ExtensionCommandContext, initial
 	const runId = selected.runId;
 	const taskId = selected.taskId;
 	if (!runId || !ctx.hasUI) return false;
-	const loaded = loadRunManifestById(ctx.cwd, runId);
+	const loaded = loadRunManifestById(ctx.cwd, runId); // NOTE: no withRunLock - best-effort only; concurrent writes may cause inconsistency
 	if (!loaded) return false;
 	const uiConfig = loadConfig(ctx.cwd).config.ui;
 	const DurableTranscriptViewer = await getViewer();

package/src/extension/team-tool/api.ts

@@ -92,7 +92,7 @@ export async function handleApi(params: TeamToolParamsValue, ctx: TeamContext):
 	if (!params.runId) return result("API requires runId.", { action: "api", status: "error" }, true);
 	const runCwd = locateRunCwd(params.runId, ctx.cwd);
 	if (!runCwd) return result(`Run '${params.runId}' not found.`, { action: "api", status: "error" }, true);
-	const loaded = loadRunManifestById(runCwd, params.runId);
+	const loaded = loadRunManifestById(runCwd, params.runId); // NOTE: no withRunLock - best-effort only; concurrent writes may cause inconsistency
 	if (!loaded) return result(`Run '${params.runId}' not found.`, { action: "api", status: "error" }, true);
 	if (operation === "read-manifest") {
 		return result(JSON.stringify(loaded.manifest, null, 2), { action: "api", status: "ok", runId: loaded.manifest.runId, artifactsRoot: loaded.manifest.artifactsRoot });
@@ -102,7 +102,7 @@ export async function handleApi(params: TeamToolParamsValue, ctx: TeamContext):
 		if (!permission.allowed) return result(permission.reason ?? "Plan approval is not allowed in this context.", { action: "api", status: "error", runId: loaded.manifest.runId }, true);
 		try {
 			return withRunLockSync(loaded.manifest, () => {
-				const current = loadRunManifestById(ctx.cwd, loaded.manifest.runId) ?? loaded;
+				const current = loadRunManifestById(ctx.cwd, loaded.manifest.runId) ?? loaded; // NOTE: inside withRunLockSync - consistent read
 				const approval = current.manifest.planApproval;
 				if (!approval?.required || approval.status !== "pending") return result("Run has no pending plan approval request.", { action: "api", status: "error", runId: loaded.manifest.runId }, true);
 				const now = new Date().toISOString();
@@ -121,7 +121,7 @@ export async function handleApi(params: TeamToolParamsValue, ctx: TeamContext):
 		if (!permission.allowed) return result(permission.reason ?? "Plan approval cancellation is not allowed in this context.", { action: "api", status: "error", runId: loaded.manifest.runId }, true);
 		try {
 			return withRunLockSync(loaded.manifest, () => {
-				const current = loadRunManifestById(ctx.cwd, loaded.manifest.runId) ?? loaded;
+				const current = loadRunManifestById(ctx.cwd, loaded.manifest.runId) ?? loaded; // NOTE: inside withRunLockSync - consistent read
 				const approval = current.manifest.planApproval;
 				if (!approval?.required || approval.status !== "pending") return result("Run has no pending plan approval request.", { action: "api", status: "error", runId: loaded.manifest.runId }, true);
 				const now = new Date().toISOString();

package/src/extension/team-tool/cancel.ts

@@ -41,7 +41,7 @@ export function abortOwned(
 ): AbortOwnedResult {
 	const runCwd = locateRunCwd(runId, ctx.cwd);
 	if (!runCwd) return { abortedIds: [], missingIds: taskIds ?? [], foreignIds: [] };
-	const loaded = loadRunManifestById(runCwd, runId);
+	const loaded = loadRunManifestById(runCwd, runId); // NOTE: no withRunLock - best-effort only; concurrent writes may cause inconsistency
 	if (!loaded) return { abortedIds: [], missingIds: taskIds ?? [], foreignIds: [] };
 
 	const result: AbortOwnedResult = { abortedIds: [], missingIds: [], foreignIds: [] };
@@ -81,7 +81,7 @@ export async function handleRetry(params: TeamToolParamsValue, ctx: TeamContext,
 	if (!params.runId) return result("Retry requires runId.", { action: "retry", status: "error" }, true);
 	const runCwd = locateRunCwd(params.runId, ctx.cwd);
 	if (!runCwd) return result(`Run '${params.runId}' not found.`, { action: "retry", status: "error" }, true);
-	const loaded = loadRunManifestById(runCwd, params.runId);
+	const loaded = loadRunManifestById(runCwd, params.runId); // NOTE: no withRunLock - best-effort only; concurrent writes may cause inconsistency
 	if (!loaded) return result(`Run '${params.runId}' not found.`, { action: "retry", status: "error" }, true);
 
 	// Pre-lock ownership check: reject foreign-owned runs unless force is set
@@ -146,7 +146,7 @@ export async function handleCancel(params: TeamToolParamsValue, ctx: TeamContext
 	if (!params.runId) return result("Cancel requires runId.", { action: "cancel", status: "error" }, true);
 	const runCwd = locateRunCwd(params.runId, ctx.cwd);
 	if (!runCwd) return result(`Run '${params.runId}' not found.`, { action: "cancel", status: "error" }, true);
-	const loaded = loadRunManifestById(runCwd, params.runId);
+	const loaded = loadRunManifestById(runCwd, params.runId); // NOTE: no withRunLock - best-effort only; concurrent writes may cause inconsistency
 	if (!loaded) return result(`Run '${params.runId}' not found.`, { action: "cancel", status: "error" }, true);
 
 	// Pre-lock ownership check: reject foreign-owned runs unless force is set

package/src/extension/team-tool/explain.ts

@@ -209,7 +209,7 @@ export function handleExplain(params: {
     return result("explain requires runId", { action: "explain", status: "error" }, true);
   }
 
-  const loaded = loadRunManifestById(cwd, params.runId);
+  const loaded = loadRunManifestById(cwd, params.runId); // NOTE: no withRunLock - best-effort only; concurrent writes may cause inconsistency
   if (!loaded) {
     return result(`Run '${params.runId}' not found.`, { action: "explain", status: "error" }, true);
   }

package/src/extension/team-tool/handle-schedule.ts

@@ -163,6 +163,43 @@ function persistScheduledJob(cwd: string, job: import("../../runtime/scheduler.t
 	}
 }
 
+/** Update an existing scheduled job in persistent settings. */
+export function persistScheduledJobUpdate(cwd: string, job: import("../../runtime/scheduler.ts").ScheduledJob): void {
+	try {
+		const settings = loadCrewSettings(cwd);
+		const existingJobs: import("../../runtime/scheduler.ts").ScheduledJob[] = Array.isArray(
+			(settings as Record<string, unknown>).scheduledJobs,
+		)
+			? ((settings as Record<string, unknown>).scheduledJobs as import("../../runtime/scheduler.ts").ScheduledJob[])
+			: [];
+		const updated = existingJobs.map((j) => j.id === job.id ? job : j);
+		saveCrewSettings(
+			{ ...settings, scheduledJobs: updated } as Parameters<typeof saveCrewSettings>[0],
+			cwd,
+		);
+	} catch {
+		/* best-effort persistence */
+	}
+}
+
+/** Remove a scheduled job from persistent settings. */
+function persistScheduledJobRemove(cwd: string, jobId: string): void {
+	try {
+		const settings = loadCrewSettings(cwd);
+		const existingJobs: import("../../runtime/scheduler.ts").ScheduledJob[] = Array.isArray(
+			(settings as Record<string, unknown>).scheduledJobs,
+		)
+			? ((settings as Record<string, unknown>).scheduledJobs as import("../../runtime/scheduler.ts").ScheduledJob[])
+			: [];
+		saveCrewSettings(
+			{ ...settings, scheduledJobs: existingJobs.filter((j) => j.id !== jobId) } as Parameters<typeof saveCrewSettings>[0],
+			cwd,
+		);
+	} catch {
+		/* best-effort persistence */
+	}
+}
+
 export function handleListScheduled(_params: TeamToolParamsValue, ctx: TeamContext): PiTeamsToolResult {
 	const scheduler = getCrewScheduler();
 	if (!scheduler) return result("Scheduler not running.", { action: "scheduled", status: "error" }, true);
@@ -177,6 +214,9 @@ export function handleListScheduled(_params: TeamToolParamsValue, ctx: TeamConte
 			`    Next run: ${job.nextRun ?? "(unscheduled)"}`,
 			`    Runs: ${job.runCount}, Last: ${job.lastRun ?? "(never)"} [${job.lastStatus ?? "?"}]`,
 		);
+		if (job.spawnedRunIds && job.spawnedRunIds.length > 0) {
+			lines.push(`    Spawned runs: ${job.spawnedRunIds.join(", ")}`);
+		}
 	}
 	return result(lines.join("\n"), { action: "scheduled", status: "ok" });
 }

package/src/extension/team-tool/inspect.ts

@@ -10,7 +10,7 @@ export function handleEvents(params: TeamToolParamsValue, ctx: TeamContext): PiT
 	if (!params.runId) return result("Events requires runId.", { action: "events", status: "error" }, true);
 	const runCwd = locateRunCwd(params.runId, ctx.cwd);
 	if (!runCwd) return result(`Run '${params.runId}' not found.`, { action: "events", status: "error" }, true);
-	const loaded = loadRunManifestById(runCwd, params.runId);
+	const loaded = loadRunManifestById(runCwd, params.runId); // NOTE: no withRunLock - best-effort only; concurrent writes may cause inconsistency
 	if (!loaded) return result(`Run '${params.runId}' not found.`, { action: "events", status: "error" }, true);
 	const events = readEvents(loaded.manifest.eventsPath);
 	const lines = [`Events for ${loaded.manifest.runId}:`, ...(events.length ? events.map((event) => `${event.time} ${event.type}${event.taskId ? ` ${event.taskId}` : ""}${event.message ? `: ${event.message}` : ""}${event.data ? ` ${JSON.stringify(event.data)}` : ""}`) : ["(none)"])];
@@ -21,7 +21,7 @@ export function handleArtifacts(params: TeamToolParamsValue, ctx: TeamContext):
 	if (!params.runId) return result("Artifacts requires runId.", { action: "artifacts", status: "error" }, true);
 	const runCwd = locateRunCwd(params.runId, ctx.cwd);
 	if (!runCwd) return result(`Run '${params.runId}' not found.`, { action: "artifacts", status: "error" }, true);
-	const loaded = loadRunManifestById(runCwd, params.runId);
+	const loaded = loadRunManifestById(runCwd, params.runId); // NOTE: no withRunLock - best-effort only; concurrent writes may cause inconsistency
 	if (!loaded) return result(`Run '${params.runId}' not found.`, { action: "artifacts", status: "error" }, true);
 	const lines = [`Artifacts for ${loaded.manifest.runId}:`, ...(loaded.manifest.artifacts.length ? loaded.manifest.artifacts.map((artifact) => `- ${artifact.kind}: ${artifact.path}${artifact.sizeBytes !== undefined ? ` (${artifact.sizeBytes} bytes)` : ""}${artifact.contentHash ? ` sha256=${artifact.contentHash.slice(0, 12)}` : ""}`) : ["- (none)"])];
 	return result(lines.join("\n"), { action: "artifacts", status: "ok", runId: loaded.manifest.runId, artifactsRoot: loaded.manifest.artifactsRoot });
@@ -31,7 +31,7 @@ export function handleSummary(params: TeamToolParamsValue, ctx: TeamContext): Pi
 	if (!params.runId) return result("Summary requires runId.", { action: "summary", status: "error" }, true);
 	const runCwd = locateRunCwd(params.runId, ctx.cwd);
 	if (!runCwd) return result(`Run '${params.runId}' not found.`, { action: "summary", status: "error" }, true);
-	const loaded = loadRunManifestById(runCwd, params.runId);
+	const loaded = loadRunManifestById(runCwd, params.runId); // NOTE: no withRunLock - best-effort only; concurrent writes may cause inconsistency
 	if (!loaded) return result(`Run '${params.runId}' not found.`, { action: "summary", status: "error" }, true);
 	const usage = aggregateUsage(loaded.tasks);
 	const lines = [