pi-crew 0.6.1 → 0.6.3

package/src/extension/team-tool/lifecycle-actions.ts

@@ -17,7 +17,7 @@ import * as path from "node:path";
 
 export function handleWorktrees(params: TeamToolParamsValue, ctx: TeamContext): PiTeamsToolResult {
 	if (!params.runId) return result("Worktrees requires runId.", { action: "worktrees", status: "error" }, true);
-	const loaded = loadRunManifestById(ctx.cwd, params.runId);
+	const loaded = loadRunManifestById(ctx.cwd, params.runId); // NOTE: no withRunLock - best-effort only; concurrent writes may cause inconsistency
 	if (!loaded) return result(`Run '${params.runId}' not found.`, { action: "worktrees", status: "error" }, true);
 	const withWorktrees = loaded.tasks.filter((task) => task.worktree);
 	const lines = [`Worktrees for ${loaded.manifest.runId}:`, ...(withWorktrees.length ? withWorktrees.map((task) => `- ${task.id}: ${task.worktree!.path} branch=${task.worktree!.branch} reused=${task.worktree!.reused ? "true" : "false"}`) : ["- (none)"])];
@@ -46,7 +46,7 @@ export function handleImport(params: TeamToolParamsValue, ctx: TeamContext): PiT
 
 export async function handleExport(params: TeamToolParamsValue, ctx: TeamContext): Promise<PiTeamsToolResult> {
 	if (!params.runId) return result("Export requires runId.", { action: "export", status: "error" }, true);
-	const loaded = loadRunManifestById(ctx.cwd, params.runId);
+	const loaded = loadRunManifestById(ctx.cwd, params.runId); // NOTE: no withRunLock - best-effort only; concurrent writes may cause inconsistency
 	if (!loaded) return result(`Run '${params.runId}' not found.`, { action: "export", status: "error" }, true);
 
 	// SECURITY: Ownership check — only the owner session may export a run.
@@ -95,7 +95,7 @@ export async function handleForget(params: TeamToolParamsValue, ctx: TeamContext
 	if (intentError) return intentError;
 	if (!params.runId) return result("Forget requires runId.", { action: "forget", status: "error" }, true);
 	if (!params.confirm) return result("forget requires confirm: true.", { action: "forget", status: "error" }, true);
-	const loaded = loadRunManifestById(ctx.cwd, params.runId);
+	const loaded = loadRunManifestById(ctx.cwd, params.runId); // NOTE: no withRunLock - best-effort only; concurrent writes may cause inconsistency
 	if (!loaded) return result(`Run '${params.runId}' not found.`, { action: "forget", status: "error" }, true);
 
 	// Ownership check — prevent cross-session deletion unless force is set
@@ -125,7 +125,7 @@ export async function handleCleanup(params: TeamToolParamsValue, ctx: TeamContex
 	const intentError = enforceDestructiveIntent("cleanup", params, ctx.config);
 	if (intentError) return intentError;
 	if (!params.runId) return result("Cleanup requires runId.", { action: "cleanup", status: "error" }, true);
-	const loaded = loadRunManifestById(ctx.cwd, params.runId);
+	const loaded = loadRunManifestById(ctx.cwd, params.runId); // NOTE: no withRunLock - best-effort only; concurrent writes may cause inconsistency
 	if (!loaded) return result(`Run '${params.runId}' not found.`, { action: "cleanup", status: "error" }, true);
 
 	// Ownership check — prevent cross-session worktree cleanup unless force is set

package/src/extension/team-tool/respond.ts

@@ -20,11 +20,11 @@ export function handleRespond(params: TeamToolParamsValue, ctx: TeamContext): Pi
 
 	const runCwd = locateRunCwd(params.runId, ctx.cwd);
 	if (!runCwd) return result(`Run '${params.runId}' not found.`, { action: "respond", status: "error" }, true);
-	const loaded = loadRunManifestById(runCwd, params.runId);
+	const loaded = loadRunManifestById(runCwd, params.runId); // NOTE: no withRunLock - best-effort only; concurrent writes may cause inconsistency
 	if (!loaded) return result(`Run '${params.runId}' not found.`, { action: "respond", status: "error" }, true);
 
 	return withRunLockSync(loaded.manifest, () => {
-		const fresh = loadRunManifestById(loaded.manifest.cwd, params.runId!);
+		const fresh = loadRunManifestById(loaded.manifest.cwd, params.runId!); // NOTE: inside withRunLockSync - consistent read
 		if (!fresh) return result(`Run '${params.runId}' not found.`, { action: "respond", status: "error" }, true);
 		const foreignRun = typeof fresh.manifest.ownerSessionId === "string" && fresh.manifest.ownerSessionId !== ctx.sessionId;
 		if (foreignRun && !params.force) return result(`Run ${fresh.manifest.runId} belongs to another session. Use force: true to override.`, { action: "respond", status: "error", runId: fresh.manifest.runId }, true);

package/src/extension/team-tool/run.ts

@@ -2,6 +2,7 @@ import { allAgents, discoverAgents } from "../../agents/discover-agents.ts";
 import { allTeams, discoverTeams } from "../../teams/discover-teams.ts";
 import { allWorkflows, discoverWorkflows } from "../../workflows/discover-workflows.ts";
 import { loadConfig } from "../../config/config.ts";
+import { findGitRoot, assertCleanLeader } from "../../worktree/worktree-manager.ts";
 import type { TeamToolParamsValue } from "../../schema/team-tool-schema.ts";
 import { writeArtifact } from "../../state/artifact-store.ts";
 import { registerActiveRun, unregisterActiveRun } from "../../state/active-run-registry.ts";
@@ -85,9 +86,57 @@ export async function handleRun(params: TeamToolParamsValue, ctx: TeamContext):
 	const { ensureCrewDirectory } = await import("../../state/crew-init.ts");
 	await ensureCrewDirectory(workingDir);
 
-	const teams = allTeams(discoverTeams(ctx.cwd));
-	const workflows = allWorkflows(discoverWorkflows(ctx.cwd));
-	const agents = allAgents(discoverAgents(ctx.cwd));
+	// WORKTREE FIX: If worktree mode is needed but cwd is not a git repo,
+	// auto-correct to the nearest git repo root. This prevents "not a git repository"
+	// errors when ctx.cwd points to a parent directory that isn't a git repo.
+	let resolvedCtx = ctx;
+	if (workingDir) {
+		try {
+			const gitRoot = findGitRoot(workingDir);
+			if (gitRoot && gitRoot !== workingDir) {
+				resolvedCtx = { ...ctx, cwd: gitRoot };
+			}
+		} catch {
+			// cwd is not in a git repo — validate below if worktree mode is needed
+		}
+	}
+
+	// WORKTREE PRECONDITION CHECK: validate git repo exists and is clean
+	// BEFORE creating the run manifest, so we return a friendly error
+	// instead of crashing mid-execution in prepareTaskWorkspace.
+	if (params.workspaceMode === "worktree") {
+		let gitRoot: string | undefined;
+		try {
+			gitRoot = findGitRoot(resolvedCtx.cwd);
+		} catch {
+			// not a git repo
+		}
+		if (!gitRoot) {
+			return result(
+				`Worktree mode requires a git repository. '${resolvedCtx.cwd}' is not inside a git repo.\nUse workspaceMode: 'single' or run from a git repository.`,
+				{ action: "run", status: "error" },
+				true,
+			);
+		}
+		// Check if clean leader is required (can be disabled via config)
+		const preCheckConfig = loadConfig(resolvedCtx.cwd);
+		if (preCheckConfig.config.requireCleanWorktreeLeader !== false) {
+			try {
+				assertCleanLeader(gitRoot);
+			} catch (err) {
+				const msg = err instanceof Error ? err.message : String(err);
+				return result(
+					`${msg}\nCommit or stash changes before using worktree mode, or use workspaceMode: 'single'.`,
+					{ action: "run", status: "error" },
+					true,
+				);
+			}
+		}
+	}
+
+	const teams = allTeams(discoverTeams(resolvedCtx.cwd));
+	const workflows = allWorkflows(discoverWorkflows(resolvedCtx.cwd));
+	const agents = allAgents(discoverAgents(resolvedCtx.cwd));
 	const directAgent = params.agent ? agents.find((item) => item.name === params.agent) : undefined;
 	if (params.agent && !directAgent) return result(`Agent '${params.agent}' not found.`, { action: "run", status: "error" }, true);
 	const teamName = params.team ?? "default";
@@ -110,7 +159,7 @@ export async function handleRun(params: TeamToolParamsValue, ctx: TeamContext):
 		steps: [{ id: "01_agent", role: params.role ?? "agent", task: "{goal}", model: params.model }],
 	} : workflows.find((item) => item.name === workflowName);
 	if (!baseWorkflow) return result(`Workflow '${workflowName}' not found.`, { action: "run", status: "error" }, true);
-	const workflow = directAgent ? baseWorkflow : expandParallelResearchWorkflow(baseWorkflow, ctx.cwd);
+	const workflow = directAgent ? baseWorkflow : expandParallelResearchWorkflow(baseWorkflow, resolvedCtx.cwd);
 
 	// Check if this is a pipeline workflow - special handling for multi-stage execution
 	const isPipelineWorkflow = workflowName === "pipeline" && !directAgent;
@@ -152,7 +201,7 @@ export async function handleRun(params: TeamToolParamsValue, ctx: TeamContext):
 
 	const skillOverride = normalizeSkillOverride(params.skill);
 	const { manifest, tasks, paths } = createRunManifest({
-		cwd: ctx.cwd,
+		cwd: resolvedCtx.cwd,
 		team,
 		workflow,
 		goal,
@@ -169,7 +218,7 @@ export async function handleRun(params: TeamToolParamsValue, ctx: TeamContext):
 	atomicWriteJson(paths.manifestPath, updatedManifest);
 	registerActiveRun(updatedManifest);
 
-	const loadedConfig = loadConfig(ctx.cwd);
+	const loadedConfig = loadConfig(resolvedCtx.cwd);
 	const executedConfig = effectiveRunConfig(loadedConfig.config, params.config);
 	const runtime = await resolveCrewRuntime(executedConfig);
 	const runtimeResolution = runtimeResolutionState(runtime);
@@ -205,11 +254,11 @@ export async function handleRun(params: TeamToolParamsValue, ctx: TeamContext):
 		const asyncManifest = { ...effectiveManifest, async: { pid: spawned.pid, logPath: spawned.logPath, spawnedAt: new Date().toISOString() } };
 		atomicWriteJson(paths.manifestPath, asyncManifest);
 		void appendEventAsync(effectiveManifest.eventsPath, { type: "async.spawned", runId: effectiveManifest.runId, data: { pid: spawned.pid, logPath: spawned.logPath } });
-		scheduleBackgroundEarlyExitGuard(ctx.cwd, effectiveManifest.runId, spawned.pid, spawned.logPath);
+		scheduleBackgroundEarlyExitGuard(resolvedCtx.cwd, effectiveManifest.runId, spawned.pid, spawned.logPath);
 		// Wait for the async run to complete and return actual results.
 		try {
-			const completed = await waitForRun(updatedManifest.runId, ctx.cwd, { timeoutMs: 3600000 });
-			const metrics = collectRunMetrics(ctx.cwd, completed.manifest.runId);
+			const completed = await waitForRun(updatedManifest.runId, resolvedCtx.cwd, { timeoutMs: 3600000 });
+			const metrics = collectRunMetrics(resolvedCtx.cwd, completed.manifest.runId);
 			const lines: string[] = [
 				`pi-crew run ${completed.manifest.status}: ${completed.manifest.runId} (${team.name})`,
 				`Goal: ${goal.slice(0, 100)}`,
@@ -341,8 +390,8 @@ export async function handleRun(params: TeamToolParamsValue, ctx: TeamContext):
 
 		// Wait for the foreground run to complete and return actual results.
 		try {
-			const completed = await waitForRun(updatedManifest.runId, ctx.cwd, { timeoutMs: 3600000 });
-			const metrics = collectRunMetrics(ctx.cwd, completed.manifest.runId);
+			const completed = await waitForRun(updatedManifest.runId, resolvedCtx.cwd, { timeoutMs: 3600000 });
+			const metrics = collectRunMetrics(resolvedCtx.cwd, completed.manifest.runId);
 			const lines: string[] = [
 				`pi-crew run ${completed.manifest.status}: ${completed.manifest.runId} (${team.name})`,
 				`Goal: ${goal.slice(0, 100)}`,

package/src/extension/team-tool/status.ts

@@ -18,7 +18,7 @@ export function handleStatus(params: TeamToolParamsValue, ctx: TeamContext): PiT
 	if (!params.runId) return result("Status requires runId.", { action: "status", status: "error" }, true);
 	const runCwd = locateRunCwd(params.runId, ctx.cwd);
 	if (!runCwd) return result(`Run '${params.runId}' not found.`, { action: "status", status: "error" }, true);
-	const loaded = loadRunManifestById(runCwd, params.runId);
+	const loaded = loadRunManifestById(runCwd, params.runId); // NOTE: no withRunLock - best-effort only; concurrent writes may cause inconsistency
 	if (!loaded) return result(`Run '${params.runId}' not found.`, { action: "status", status: "error" }, true);
 	let { manifest, tasks } = loaded;
 	let asyncLivenessLine: string | undefined;

package/src/extension/team-tool.ts

@@ -18,7 +18,7 @@ import {
 import type { executeTeamRun as _executeTeamRunFn } from "../runtime/team-runner.ts";
 import type { TeamToolParamsValue } from "../schema/team-tool-schema.ts";
 import { writeArtifact } from "../state/artifact-store.ts";
-import { appendEvent } from "../state/event-log.ts";
+import { appendEvent, appendEventFireAndForget } from "../state/event-log.ts";
 import { withRunLock } from "../state/locks.ts";
 import { replayPendingMailboxMessages } from "../state/mailbox.ts";
 import {
@@ -33,6 +33,7 @@ import type {
 	TeamTaskState,
 } from "../state/types.ts";
 import { allTeams, discoverTeams } from "../teams/discover-teams.ts";
+import { assertSafePathId } from "../utils/safe-paths.ts";
 import {
 	allWorkflows,
 	discoverWorkflows,
@@ -99,10 +100,31 @@ async function handleRun(
 	return _cachedHandleRun(...args);
 }
 
+import { FileCheckpointStore } from "../runtime/checkpoint.ts";
 import { waitForRun } from "../runtime/run-tracker.ts";
 import { normalizeSkillOverride } from "../runtime/skill-instructions.ts";
+import {
+	computeRunCacheKey,
+	getCachedRun,
+	getCacheStats,
+} from "../state/run-cache.ts";
+import { listRunGraphs, loadRunGraph } from "../state/run-graph.ts";
 import { searchAgents, searchTeams } from "../utils/bm25-search.ts";
 import { projectCrewRoot } from "../utils/paths.ts";
+import { buildTeamOnboarding } from "./team-onboard.ts";
+import {
+	handleAnchorAccumulate,
+	handleAnchorClear,
+	handleAnchorSet,
+	handleAnchorStatus,
+} from "./team-tool/anchor.ts";
+import {
+	createAutoSummarizeService,
+	handleAutoSummarizeConfig,
+	handleAutoSummarizeOff,
+	handleAutoSummarizeOn,
+	handleAutoSummarizeStatus,
+} from "./team-tool/auto-summarize.ts";
 import {
 	type CacheControlDeps,
 	invalidateSnapshot,
@@ -110,6 +132,10 @@ import {
 import { handleCancel, handleRetry } from "./team-tool/cancel.ts";
 import { handleDoctor } from "./team-tool/doctor.ts";
 import { handleExplain } from "./team-tool/explain.ts";
+import {
+	handleListScheduled,
+	handleSchedule,
+} from "./team-tool/handle-schedule.ts";
 import { handleHealthMonitor } from "./team-tool/health-monitor.ts";
 import {
 	handleArtifacts,
@@ -125,30 +151,17 @@ import {
 	handlePrune,
 	handleWorktrees,
 } from "./team-tool/lifecycle-actions.ts";
-import {
-	getCachedRun,
-	computeRunCacheKey,
-	getCacheStats,
-} from "../state/run-cache.ts";
-import {
-	loadRunGraph,
-	listRunGraphs,
-} from "../state/run-graph.ts";
-import { FileCheckpointStore } from "../runtime/checkpoint.ts";
-import { buildTeamOnboarding } from "./team-onboard.ts";
+import { handleOrchestrate } from "./team-tool/orchestrate.ts";
 import { handleParallel } from "./team-tool/parallel-dispatch.ts";
-import { handleSchedule, handleListScheduled } from "./team-tool/handle-schedule.ts";
 import { handlePlan } from "./team-tool/plan.ts";
-import { handleOrchestrate } from "./team-tool/orchestrate.ts";
 import { handleRespond } from "./team-tool/respond.ts";
 import { handleStatus } from "./team-tool/status.ts";
-import { handleAnchorSet, handleAnchorClear, handleAnchorStatus, handleAnchorAccumulate } from "./team-tool/anchor.ts";
-import { handleAutoSummarizeOn, handleAutoSummarizeOff, handleAutoSummarizeStatus, handleAutoSummarizeConfig, createAutoSummarizeService } from "./team-tool/auto-summarize.ts";
 
 export { handleApi } from "./team-tool/api.ts";
 export { handleRetry } from "./team-tool/cancel.ts";
 export type { TeamContext } from "./team-tool/context.ts";
 export { handleDoctor } from "./team-tool/doctor.ts";
+export { handleSchedule } from "./team-tool/handle-schedule.ts";
 export {
 	handleArtifacts,
 	handleEvents,
@@ -163,12 +176,11 @@ export {
 	handlePrune,
 	handleWorktrees,
 } from "./team-tool/lifecycle-actions.ts";
-export { handleSchedule } from "./team-tool/handle-schedule.ts";
+export { handleOrchestrate } from "./team-tool/orchestrate.ts";
 export { handlePlan } from "./team-tool/plan.ts";
 export { handleStatus } from "./team-tool/status.ts";
 export type { TeamToolDetails } from "./team-tool-types.ts";
 export { handleRun };
-export { handleOrchestrate } from "./team-tool/orchestrate.ts";
 
 export function handleList(
 	params: TeamToolParamsValue,
@@ -451,7 +463,7 @@ export async function handleResume(
 			{ action: "resume", status: "error" },
 			true,
 		);
-	const loaded = loadRunManifestById(runCwd, params.runId);
+	const loaded = loadRunManifestById(runCwd, params.runId); // NOTE: no withRunLock - best-effort only; concurrent writes may cause inconsistency
 	if (!loaded)
 		return result(
 			`Run '${params.runId}' not found.`,
@@ -674,7 +686,7 @@ export function handleSteer(
 			{ action: "steer", status: "error" },
 			true,
 		);
-	const loaded = loadRunManifestById(runCwd, runId);
+	const loaded = loadRunManifestById(runCwd, runId); // NOTE: no withRunLock - best-effort only; concurrent writes may cause inconsistency
 	if (!loaded)
 		return result(
 			`Run '${runId}' not found`,
@@ -689,12 +701,23 @@ export function handleSteer(
 			true,
 		);
 	if (!task.pendingSteers) task.pendingSteers = [];
-		// HIGH-04: Cap pendingSteers array to prevent unbounded memory growth
-		const MAX_PENDING_STEERS = 100;
-		if (task.pendingSteers.length >= MAX_PENDING_STEERS) {
-			task.pendingSteers = task.pendingSteers.slice(-(MAX_PENDING_STEERS - 1));
-		}
-		task.pendingSteers.push(message);
+	// HIGH-04: Cap pendingSteers array to prevent unbounded memory growth
+	const MAX_PENDING_STEERS = 100;
+	if (task.pendingSteers.length >= MAX_PENDING_STEERS) {
+		// Log warning before dropping the oldest message
+		appendEventFireAndForget(loaded.manifest.eventsPath, {
+			type: "task.steer_dropped",
+			runId,
+			taskId,
+			data: {
+				droppedMessage: task.pendingSteers[0],
+				reason: "pendingSteers cap exceeded",
+				queueDepth: task.pendingSteers.length,
+			},
+		});
+		task.pendingSteers = task.pendingSteers.slice(-(MAX_PENDING_STEERS - 1));
+	}
+	task.pendingSteers.push(message);
 	saveRunTasks(loaded.manifest, loaded.tasks);
 	appendEvent(loaded.manifest.eventsPath, {
 		type: "task.steer_queued",
@@ -751,17 +774,57 @@ function handleInvalidate(
 /**
  * Locate the CWD where a run's state is stored.
  * Tries ctx.cwd first, then scans immediate child directories for .crew/state/runs/<runId>.
+ *
+ * Defensive bounds (prevent hang on large dirs like /tmp in CI):
+ * - Skips entries that are well-known system/ephemeral dirs (e.g. .npm, node_modules, .git)
+ * - Caps the scan at MAX_SCAN_ENTRIES to avoid pathological scans
+ * - Skips hidden entries (starting with `.`) unless they look like run directories
+ *   (e.g. .crew, .pi, .tmp-crew-runs)
  */
-export function locateRunCwd(runId: string, baseCwd: string): string | undefined {
+const MAX_SCAN_ENTRIES = 1000;
+const SKIP_SCAN_DIRS = new Set([
+	"node_modules",
+	".git",
+	".npm",
+	".cache",
+	".local",
+	"proc",
+	"sys",
+	"dev",
+	"Library",
+	"Applications",
+]);
+
+export function locateRunCwd(
+	runId: string,
+	baseCwd: string,
+): string | undefined {
 	// Fast path: run is in the current CWD
-	if (loadRunManifestById(baseCwd, runId)) return baseCwd;
+	if (loadRunManifestById(baseCwd, runId)) {
+		return baseCwd;
+	}
 
-	// Scan immediate child directories
+	// Scan immediate child directories, but with defensive bounds.
 	try {
-		for (const entry of fs.readdirSync(baseCwd, { withFileTypes: true })) {
+		const entries = fs.readdirSync(baseCwd, { withFileTypes: true });
+		const boundedEntries = entries.length > MAX_SCAN_ENTRIES
+			? entries.slice(0, MAX_SCAN_ENTRIES)
+			: entries;
+		for (const entry of boundedEntries) {
 			if (!entry.isDirectory()) continue;
+			if (SKIP_SCAN_DIRS.has(entry.name)) continue;
+			// Skip hidden entries except well-known run-storage prefixes
+			if (entry.name.startsWith(".")) {
+				if (
+					!entry.name.startsWith(".crew") &&
+					!entry.name.startsWith(".pi") &&
+					!entry.name.startsWith(".tmp-crew")
+				) continue;
+			}
 			const candidate = path.join(baseCwd, entry.name);
-			if (loadRunManifestById(candidate, runId)) return candidate;
+			if (loadRunManifestById(candidate, runId)) {
+				return candidate;
+			}
 		}
 	} catch {
 		/* ignore unreadable dirs */
@@ -1090,23 +1153,32 @@ export async function handleTeamTool(
 			return handleWait(params, ctx);
 		case "graph": {
 			if (params.runId) {
+				assertSafePathId("runId", params.runId);
 				const graph = loadRunGraph(ctx.cwd, params.runId);
 				return result(
-					graph ? JSON.stringify(graph, null, 2) : "No graph found for this run.",
+					graph
+						? JSON.stringify(graph, null, 2)
+						: "No graph found for this run.",
 					{ action: "graph", status: graph ? "ok" : "error" },
 					!graph,
 				);
 			}
 			const graphs = listRunGraphs(ctx.cwd);
 			return result(
-				graphs.length ? `Available graphs:\n${graphs.join("\n")}` : "No graphs available.",
+				graphs.length
+					? `Available graphs:\n${graphs.join("\n")}`
+					: "No graphs available.",
 				{ action: "graph", status: "ok" },
 			);
 		}
 		case "search": {
 			const query = params.goal ?? params.task ?? "";
 			if (!query) {
-				return result("Search requires goal or task query.", { action: "search", status: "error" }, true);
+				return result(
+					"Search requires goal or task query.",
+					{ action: "search", status: "error" },
+					true,
+				);
 			}
 			try {
 				const [agentResults, teamResults] = await Promise.all([
@@ -1117,19 +1189,30 @@ export async function handleTeamTool(
 				if (teamResults.length) {
 					lines.push("## Teams");
 					for (const r of teamResults) {
-						lines.push(`- [${r.team.name}] score=${r.score.toFixed(2)}: ${r.team.description ?? "(no description)"}`);
+						lines.push(
+							`- [${r.team.name}] score=${r.score.toFixed(2)}: ${r.team.description ?? "(no description)"}`,
+						);
 					}
 				}
 				if (agentResults.length) {
 					lines.push("## Agents");
 					for (const r of agentResults) {
-						lines.push(`- [${r.agent.name}] score=${r.score.toFixed(2)}: ${r.agent.description ?? "(no description)"}`);
+						lines.push(
+							`- [${r.agent.name}] score=${r.score.toFixed(2)}: ${r.agent.description ?? "(no description)"}`,
+						);
 					}
 				}
-				return result(lines.length ? lines.join("\n") : "No results found.", { action: "search", status: "ok" });
+				return result(
+					lines.length ? lines.join("\n") : "No results found.",
+					{ action: "search", status: "ok" },
+				);
 			} catch (err) {
 				const msg = err instanceof Error ? err.message : String(err);
-				return result(`Search failed: ${msg}`, { action: "search", status: "error" }, true);
+				return result(
+					`Search failed: ${msg}`,
+					{ action: "search", status: "error" },
+					true,
+				);
 			}
 		}
 		case "schedule":
@@ -1137,7 +1220,10 @@ export async function handleTeamTool(
 		case "scheduled":
 			return handleListScheduled(params, ctx);
 		case "anchor": {
-			const subAction = typeof params.config?.subAction === "string" ? params.config.subAction : "status";
+			const subAction =
+				typeof params.config?.subAction === "string"
+					? params.config.subAction
+					: "status";
 			switch (subAction) {
 				case "set":
 					return handleAnchorSet(params, ctx);
@@ -1151,7 +1237,12 @@ export async function handleTeamTool(
 		}
 		case "auto-summarize":
 		case "auto_boomerang": {
-			const subAction = typeof params.config?.subAction === "string" ? params.config.subAction : ((params.action as string) === "auto_boomerang" ? "toggle" : "status");
+			const subAction =
+				typeof params.config?.subAction === "string"
+					? params.config.subAction
+					: (params.action as string) === "auto_boomerang"
+						? "toggle"
+						: "status";
 			switch (subAction) {
 				case "on":
 					return handleAutoSummarizeOn(params, ctx);
@@ -1178,7 +1269,14 @@ export async function handleTeamTool(
 		}
 		case "explain": {
 			const explainResult = handleExplain(params, ctx.cwd);
-			return result(explainResult.text, { action: "explain", status: explainResult.isError ? "error" : "ok" }, explainResult.isError);
+			return result(
+				explainResult.text,
+				{
+					action: "explain",
+					status: explainResult.isError ? "error" : "ok",
+				},
+				explainResult.isError,
+			);
 		}
 		case "cache": {
 			if (params.goal) {
@@ -1192,10 +1290,24 @@ export async function handleTeamTool(
 				if (cached) {
 					return result(
 						`Cached run found (${new Date(cached.cachedAt).toISOString()}): runId=${cached.runId}, status=${cached.status}, ${cached.tasks.length} tasks`,
-						{ action: "cache", status: "ok", data: { cacheKey: key, cacheHit: true, runId: cached.runId, status: cached.status, taskCount: cached.tasks.length } },
+						{
+							action: "cache",
+							status: "ok",
+							data: {
+								cacheKey: key,
+								cacheHit: true,
+								runId: cached.runId,
+								status: cached.status,
+								taskCount: cached.tasks.length,
+							},
+						},
 					);
 				}
-				return result(`No cached result for key: ${key}`, { action: "cache", status: "ok", data: { cacheKey: key, cacheHit: false } });
+				return result(`No cached result for key: ${key}`, {
+					action: "cache",
+					status: "ok",
+					data: { cacheKey: key, cacheHit: false },
+				});
 			}
 			const stats = getCacheStats(ctx.cwd);
 			return result(
@@ -1205,13 +1317,28 @@ export async function handleTeamTool(
 		}
 		case "checkpoint": {
 			if (!params.runId || !params.taskId) {
-				return result("Checkpoint requires runId and taskId.", { action: "checkpoint", status: "error" }, true);
+				return result(
+					"Checkpoint requires runId and taskId.",
+					{ action: "checkpoint", status: "error" },
+					true,
+				);
 			}
-			const stateRoot = path.join(projectCrewRoot(ctx.cwd), "state", "runs", params.runId);
+			assertSafePathId("runId", params.runId);
+			assertSafePathId("taskId", params.taskId);
+			const stateRoot = path.join(
+				projectCrewRoot(ctx.cwd),
+				"state",
+				"runs",
+				params.runId,
+			);
 			const store = new FileCheckpointStore(stateRoot);
 			const checkpoint = store.load(params.runId, params.taskId);
 			if (!checkpoint) {
-				return result("No checkpoint found.", { action: "checkpoint", status: "error" }, true);
+				return result(
+					"No checkpoint found.",
+					{ action: "checkpoint", status: "error" },
+					true,
+				);
 			}
 			return result(
 				`Checkpoint: step=${checkpoint.step}, progress=${checkpoint.progress}, savedAt=${new Date(checkpoint.savedAt).toISOString()}`,