pi-crew 0.9.40 → 0.9.42

package/src/runtime/stale-reconciler.ts

@@ -2,7 +2,7 @@ import * as fs from "node:fs";
 import * as os from "node:os";
 import * as path from "node:path";
 import { errors } from "../errors.ts";
-import { atomicWriteJson } from "../state/atomic-write.ts";
+import { atomicWriteFile, atomicWriteJson } from "../state/atomic-write.ts";
 import { saveRunManifest } from "../state/state-store.ts";
 import type { TeamRunManifest, TeamTaskState } from "../state/types.ts";
 import { recordFromTask, upsertCrewAgent } from "./crew-agent-records.ts";
@@ -152,29 +152,32 @@ function checkPidLiveness(
 	}
 	// If process is alive per kill(0), we're done.
 	if (liveness.alive) return { alive: true, detail: liveness.detail };
-	// Process is dead per kill(0). Check heartbeat as corroborating evidence.
+	// Process is dead per kill(0). ESRCH is AUTHORITATIVE — the PID does not exist.
+	// A frozen/zombie process still has a PID (kill(0) returns 0, or EPERM if we lack
+	// permission to signal it), so reaching here with alive=false means the process
+	// is genuinely gone. PID recycling is already handled above via the startTime
+	// TOCTOU check, so the heartbeat file must NOT override the dead verdict.
+	//
+	// HISTORY: a <5min-old heartbeat.json previously OVERRRODE this verdict (returned
+	// alive:true "process dead but heartbeat Xs old"), delaying repair by ~5min.
+	// Combined with the 60s reconcile cadence this produced a ~300-360s detection lag
+	// for dead workers (observed 353s in production). The heartbeat is now used only
+	// to enrich the detail string, never to override the authoritative kill(0) verdict.
+	let heartbeatNote = "";
 	if (stateRoot) {
-		const heartbeatPath = path.join(stateRoot, "heartbeat.json");
 		try {
+			const heartbeatPath = path.join(stateRoot, "heartbeat.json");
 			if (fs.existsSync(heartbeatPath)) {
 				const hb = JSON.parse(fs.readFileSync(heartbeatPath, "utf-8")) as { pid?: number; at?: number };
 				if (hb?.pid === pid && hb?.at) {
-					const ageMs = Date.now() - hb.at;
-					// Heartbeat written < 5 min ago → process was alive recently.
-					// Don't repair yet; let the next reconciliation cycle catch it.
-					if (ageMs < 5 * 60_000) {
-						return {
-							alive: true,
-							detail: `process dead but heartbeat ${Math.round(ageMs / 1000)}s old`,
-						};
-					}
+					heartbeatNote = ` (heartbeat was ${Math.round((Date.now() - hb.at) / 1000)}s old)`;
 				}
 			}
 		} catch {
 			/* ignore — best-effort */
 		}
 	}
-	return { alive: liveness.alive, detail: liveness.detail };
+	return { alive: false, detail: `${liveness.detail}${heartbeatNote}` };
 }
 
 /**
@@ -267,11 +270,6 @@ function buildStaleReconcileError(task: TeamTaskState, reason: string): Error {
 	return errors.runStale(reason, heartbeatAgeSeconds);
 }
 
-/** @deprecated use buildStaleReconcileError (returns a structured CrewError). Kept for any external callers. */
-function formatStaleReconcileError(task: TeamTaskState, reason: string): string {
-	return buildStaleReconcileError(task, reason).message;
-}
-
 function repairStaleRun(manifest: TeamRunManifest, tasks: TeamTaskState[], reason: string): TeamTaskState[] {
 	const now = new Date().toISOString();
 	const repairedTasks = tasks.map((task) => {
@@ -592,9 +590,13 @@ export function reconcileOrphanedTempWorkspaces(
 					if (!fs.existsSync(workspaceDir)) {
 						fs.mkdirSync(workspaceDir, { recursive: true });
 					}
-					fs.writeFileSync(sentinelPath, JSON.stringify({ startedAt: now }), {
-						flag: "wx",
-					});
+					// Atomic exclusive-create: reserve the sentinel (fails with EEXIST if
+					// another cleanup is in progress), then fill it atomically. The brief
+					// empty-file window is safe — the sentinel "exists" (correctly
+					// signalling in-progress cleanup).
+					const sentinelFd = fs.openSync(sentinelPath, "wx");
+					fs.closeSync(sentinelFd);
+					atomicWriteFile(sentinelPath, JSON.stringify({ startedAt: now }));
 				} catch {
 					// Sentinel already exists (another cleanup in progress) — skip
 					canCleanup = false;
@@ -661,38 +663,6 @@ export function reconcileOrphanedTempWorkspaces(
 				} catch {
 					/* ignore if already gone */
 				}
-			} else if (canCleanup) {
-				// Sentinel already existed — another cleanup attempt is in progress.
-				// Perform a simplified TOCTOU check: if any manifest is running,
-				// do NOT remove the sentinel (let the first attempt finish its scan).
-				let hasRunningManifest = false;
-				if (fs.existsSync(stateRunsDir)) {
-					try {
-						for (const runDir of fs.readdirSync(stateRunsDir)) {
-							const manifestPath = path.join(stateRunsDir, runDir, "manifest.json");
-							if (!fs.existsSync(manifestPath)) continue;
-							try {
-								const m = JSON.parse(fs.readFileSync(manifestPath, "utf-8")) as TeamRunManifest;
-								if (m.status === "running") {
-									hasRunningManifest = true;
-									break;
-								}
-							} catch {
-								/* skip on parse error */
-							}
-						}
-					} catch {
-						/* skip if runs dir unreadable */
-					}
-				}
-				// Only clean up sentinel if no running manifests exist
-				if (!hasRunningManifest) {
-					try {
-						fs.unlinkSync(sentinelPath);
-					} catch {
-						/* ignore if already gone */
-					}
-				}
 			}
 		}
 	} catch {

package/src/runtime/subagent-manager.ts

@@ -439,13 +439,29 @@ export class SubagentManager {
 	private drainQueue(): void {
 		while (this.queue.length > 0 && this.runningBackground < this.maxConcurrent) {
 			const next = this.queue.shift();
-			if (!next || next.record.status !== "queued") continue;
+			if (next?.record.status !== "queued") continue;
 			this.start(next.record, next.options, next.runner, next.signal);
 		}
 	}
 
 	private async pollRunToTerminal(cwd: string, record: SubagentRecord): Promise<void> {
+		// Safety: max 30 minutes (1800 polls at 1s interval) to prevent infinite
+		// polling if manifest file is deleted or run state becomes unrecoverable.
+		const MAX_POLL_COUNT = 1800;
+		let pollCount = 0;
 		while (record.runId && (record.status === "running" || record.status === "blocked")) {
+			if (++pollCount > MAX_POLL_COUNT) {
+				logInternalError(
+					"subagent-manager.poll-timeout",
+					new Error(`pollRunToTerminal exceeded ${MAX_POLL_COUNT} polls for runId=${record.runId}`),
+					`id=${record.id}`,
+				);
+				record.status = "error";
+				record.error = `Poll timeout: run did not reach terminal state after ${MAX_POLL_COUNT} seconds`;
+				record.completedAt = Date.now();
+				savePersistedSubagentRecord(cwd, record);
+				return;
+			}
 			const loaded = loadRunManifestById(cwd, record.runId); // NOTE: no withRunLock - best-effort only; concurrent writes may cause inconsistency
 			if (!loaded) {
 				await new Promise((resolve) => setTimeout(resolve, this.pollIntervalMs));
@@ -488,7 +504,7 @@ export class SubagentManager {
 	private scheduleBlockedTerminalPoll(cwd: string, record: SubagentRecord): void {
 		const poll = (): void => {
 			const current = this.records.get(record.id);
-			if (!current || current.status !== "blocked" || !current.runId) return;
+			if (current?.status !== "blocked" || !current.runId) return;
 			const loaded = loadRunManifestById(cwd, current.runId); // NOTE: no withRunLock - best-effort only; concurrent writes may cause inconsistency
 			if (
 				!loaded ||
@@ -524,7 +540,7 @@ export class SubagentManager {
 		const threshold = DEFAULT_SUBAGENT.stuckBlockedNotifyMs;
 		const fire = (): void => {
 			const current = this.records.get(record.id);
-			if (!current || current.status !== "blocked" || !current.blockedAt || current.stuckNotified) return;
+			if (current?.status !== "blocked" || !current.blockedAt || current.stuckNotified) return;
 			current.stuckNotified = true;
 			this.onEvent?.("subagent.stuck-blocked", {
 				event: "subagent.stuck-blocked",

package/src/runtime/task-output-context.ts

@@ -2,6 +2,7 @@ import * as fs from "node:fs";
 import * as path from "node:path";
 import { DEFAULT_OUTPUT_CONTEXT } from "../config/defaults.ts";
 import { writeArtifact } from "../state/artifact-store.ts";
+import { atomicWriteFile } from "../state/atomic-write.ts";
 import type { ArtifactDescriptor, TeamRunManifest, TeamTaskState } from "../state/types.ts";
 import { resolveRealContainedPath } from "../utils/safe-paths.ts";
 import type { WorkflowStep } from "../workflows/workflow-config.ts";
@@ -155,7 +156,7 @@ export function teePathForArtifact(artifactsRoot: string, taskId: string, artifa
 function writeTeeFile(fullOutputPath: string, content: string): boolean {
 	try {
 		fs.mkdirSync(path.dirname(fullOutputPath), { recursive: true });
-		fs.writeFileSync(fullOutputPath, content, "utf-8");
+		atomicWriteFile(fullOutputPath, content);
 		return true;
 	} catch {
 		return false;

package/src/runtime/task-runner/prompt-builder.ts

@@ -14,7 +14,7 @@ import { renderSuggestedFilesSection, runRetrievalCycle } from "./retrieval-orch
  * filtering at the Pi level is a future optimisation (Phase 3.2+).
  */
 export function toolGuidanceBlock(agent?: AgentConfig): string {
-	if (!agent || agent.loadMode !== "lean" || !agent.defaultTools?.length) return "";
+	if (agent?.loadMode !== "lean" || !agent.defaultTools?.length) return "";
 	return [
 		"# Tool Guidance",
 		`This role uses a focused tool set. Preferred tools: ${agent.defaultTools.join(", ")}.`,

package/src/runtime/task-runner/run-projection.ts

@@ -1,5 +1,6 @@
 import type { MailboxMessage } from "../../state/mailbox.ts";
 import type { ArtifactDescriptor, TeamRunManifest, TeamTaskState } from "../../state/types.ts";
+import { sanitizeTaskText } from "../task-packet.ts";
 
 export interface RunProjectionSource {
 	kind: "events" | "mailbox" | "artifacts" | "ui_metadata" | "runtime_metadata";
@@ -64,7 +65,8 @@ export function transformRunContextBeforeWorkerStart(input: {
 		});
 		lines.push(`Pending messages (${messages.length}/${input.pendingMailbox.length}):`);
 		for (const msg of messages) {
-			lines.push(`- ${msg.kind ?? "message"}: ${msg.body.slice(0, 100)}`);
+			const safeBody = sanitizeTaskText(msg.body.slice(0, 100));
+			lines.push(`- ${msg.kind ?? "message"}: ${safeBody}`);
 		}
 	}
 

package/src/runtime/task-runner/state-helpers.ts

@@ -24,6 +24,14 @@ export function updateTask(tasks: TeamTaskState[], updated: TeamTaskState): Team
  * committed first; retry with the fresh state. This is O(retry) under contention but
  * converges in the normal single-writer case.
  *
+ * ST-7: pass `skipCoalesce: true` when persisting a TERMINAL task status
+ * (completed/failed/cancelled/needs_attention/skipped). Without this the
+ * underlying `saveRunTasksCoalesced` would buffer the write for 50ms; a
+ * SIGKILL in that window loses the terminal update and crash recovery
+ * would see "running" in tasks.json while events.jsonl already shows
+ * "completed". For non-terminal transitions (heartbeat, progress) the
+ * default buffered write is fine and matches prior behavior.
+ *
  * @param checkpointPhase - Optional checkpoint phase to include in the task state alongside the update.
  */
 export function persistSingleTaskUpdate(
@@ -31,6 +39,7 @@ export function persistSingleTaskUpdate(
 	fallbackTasks: TeamTaskState[],
 	updated: TeamTaskState,
 	checkpointPhase?: TaskCheckpointState["phase"],
+	skipCoalesce: boolean = false,
 ): TeamTaskState[] {
 	const MAX_CAS_ATTEMPTS = 100;
 	let baseMtime = 0;
@@ -126,7 +135,10 @@ export function persistSingleTaskUpdate(
 				// non-coalesced writers; the flushPendingAtomicWrites() guard at
 				// the top of the retry loop ensures reads see any other coalesced
 				// writer's flushed-before-this-call state.
-				saveRunTasksCoalesced(manifest, merged);
+				// ST-7: terminal transitions (skipCoalesce=true) bypass the 50ms
+				// coalesce window so a SIGKILL after the persist completes cannot
+				// leave tasks.json stale with a non-terminal status.
+				saveRunTasksCoalesced(manifest, merged, skipCoalesce);
 			} catch (err) {
 				logInternalError("persistSingleTaskUpdate", err, undefined, "error");
 				throw err;

package/src/runtime/task-runner.ts

@@ -15,11 +15,10 @@ import type {
 	OperationTerminalEvidence,
 	TeamRunManifest,
 	TeamTaskState,
-	UsageState,
 	VerificationEvidence,
 } from "../state/types.ts";
 import { logInternalError } from "../utils/internal-error.ts";
-import { resolveRealContainedPath } from "../utils/safe-paths.ts";
+import { resolveContainedPath, resolveRealContainedPath } from "../utils/safe-paths.ts";
 import type { WorkflowStep } from "../workflows/workflow-config.ts";
 import { captureWorktreeDiffAsync, captureWorktreeDiffStatAsync, prepareTaskWorkspaceAsync } from "../worktree/worktree-manager.ts";
 import { reserveControlChannel } from "./agent-control.ts";
@@ -35,7 +34,7 @@ import {
 	recordFromTask,
 	upsertCrewAgent,
 } from "./crew-agent-records.ts";
-import type { CrewAgentProgress, CrewRuntimeKind } from "./crew-agent-runtime.ts";
+import type { CrewRuntimeKind } from "./crew-agent-runtime.ts";
 import { crewHooks } from "./crew-hooks.ts";
 import { bridgeEventFromJsonEvent, registerStreamBridge } from "./event-stream-bridge.ts";
 import { createVerificationEvidence } from "./green-contract.ts";
@@ -87,7 +86,7 @@ registerYieldTool();
 async function appendSteeringAsync(steeringDir: string, taskId: string, steers: string[]): Promise<void> {
 	try {
 		await fs.promises.mkdir(steeringDir, { recursive: true });
-		const steeringPath = `${steeringDir}/${taskId}.jsonl`;
+		const steeringPath = resolveContainedPath(steeringDir, `${taskId}.jsonl`);
 		const lines = steers
 			.map(
 				(msg) =>
@@ -254,10 +253,18 @@ export async function runTeamTask(input: TaskRunnerInput): Promise<{ manifest: T
 		if (input.step.preStepScript) {
 			const scriptTimeout = input.step.preStepTimeout ?? 30_000;
 			const scriptArgs = input.step.preStepArgs ?? [];
+			appendEventFireAndForget(manifest.eventsPath, {
+				type: "hook.pre_step_started",
+				runId: manifest.runId,
+				taskId: task.id,
+				data: { script: input.step.preStepScript, argCount: scriptArgs.length, timeoutMs: scriptTimeout },
+			});
 			// SECURITY (M-1 fix, code-review 2026-06-23): use the project's safe-path
 			// primitive instead of a hand-rolled path.resolve + startsWith check.
 			// The lexical check passed a symlinked ancestor, letting execFileSync
 			// follow it and execute a script outside cwd. Throws on escape.
+			// Keep validation outside the optional-execution catch: preStepOptional
+			// must never bypass a path-containment failure.
 			resolveRealContainedPath(manifest.cwd, input.step.preStepScript);
 			try {
 				// LAZY: defer dynamic import of node:child_process to its call site.
@@ -268,9 +275,22 @@ export async function runTeamTask(input: TaskRunnerInput): Promise<{ manifest: T
 					cwd: manifest.cwd,
 					maxBuffer: 1024 * 1024, // 1MB cap
 				});
+				appendEventFireAndForget(manifest.eventsPath, {
+					type: "hook.pre_step_completed",
+					runId: manifest.runId,
+					taskId: task.id,
+					data: { script: input.step.preStepScript, outputBytes: Buffer.byteLength(preStepOutput, "utf8") },
+				});
 			} catch (err) {
 				const msg = err instanceof Error ? err.message : String(err);
 				const exitCode = (err as NodeJS.ErrnoException & { status?: number }).status;
+				appendEventFireAndForget(manifest.eventsPath, {
+					type: "hook.pre_step_failed",
+					runId: manifest.runId,
+					taskId: task.id,
+					message: `pre-step hook failed (exit ${exitCode ?? "?"})`,
+					data: { script: input.step.preStepScript, exitCode: exitCode ?? null, optional: input.step.preStepOptional === true },
+				});
 				// E1 (Round 15): structured CrewError with code E009 + help hint,
 				// instead of a raw Error. Surfaces the script path, exit code, and stderr.
 				// Round 21 (E4): if preStepOptional is set, a failing hook is NON-FATAL.
@@ -484,7 +504,7 @@ export async function runTeamTask(input: TaskRunnerInput): Promise<{ manifest: T
 					runId: manifest.runId,
 					agentId: task.id,
 					artifactsRoot: manifest.artifactsRoot,
-					steeringFile: `${manifest.artifactsRoot}/steering/${task.id}.jsonl`,
+					steeringFile: resolveContainedPath(`${manifest.artifactsRoot}/steering`, `${task.id}.jsonl`),
 					onSpawn: (pid) => {
 						try {
 							({ task, tasks } = checkpointTask(manifest, tasks, task, "child-spawned", pid));
@@ -1222,9 +1242,14 @@ export async function runTeamTask(input: TaskRunnerInput): Promise<{ manifest: T
 		// stale manifest and overwrite this task's freshly-written artifacts, silently
 		// losing them. persistSingleTaskUpdate is re-entrance-safe (runLockHeldByUs guard),
 		// so nesting it inside this lock is a no-op re-acquire, not a deadlock.
+		// ST-7: this is a terminal transition (task.status is completed/failed/needs_attention),
+		// pass skipCoalesce=true so the terminal update is durable — a SIGKILL in the
+		// 50ms coalesce window must NOT leave tasks.json showing the prior non-terminal
+		// status, otherwise crash recovery would see inconsistency between tasks.json
+		// (running) and events.jsonl (terminal).
 		tasks = await withRunLock(manifest, async () => {
 			await saveRunManifestAsync(manifest);
-			return persistSingleTaskUpdate(manifest, tasks, task);
+			return persistSingleTaskUpdate(manifest, tasks, task, undefined, true);
 		});
 		upsertCrewAgent(manifest, recordFromTask(manifest, task, runtimeKind));
 		// Execute task_result hook before emitting terminal event

package/src/runtime/team-runner.ts

@@ -9,6 +9,7 @@ import type { MetricRegistry } from "../observability/metric-registry.ts";
 import { PluginRegistry } from "../plugins/plugin-registry.ts";
 import { NextJsPlugin, VitePlugin, VitestPlugin } from "../plugins/plugins/index.ts";
 import { hashArtifactContent as hashContent, writeArtifact } from "../state/artifact-store.ts";
+import { atomicWriteFile } from "../state/atomic-write.ts";
 import { appendEvent, appendEventAsync, appendEventBuffered, appendEventFireAndForget, flushEventLogBuffer } from "../state/event-log.ts";
 import { HealthStore } from "../state/health-store.ts";
 import { withRunLock } from "../state/locks.ts";
@@ -84,7 +85,7 @@ function startTeamRunHeartbeat(stateRoot: string, runId: string): () => void {
 			// captured manifest.updatedAt once at startup, making the value
 			// permanently stale throughout the run.
 			const now = new Date().toISOString();
-			fs.writeFileSync(
+			atomicWriteFile(
 				heartbeatPath,
 				JSON.stringify({
 					pid: process.pid,
@@ -93,7 +94,7 @@ function startTeamRunHeartbeat(stateRoot: string, runId: string): () => void {
 					kind: "team-runner",
 					lastTaskUpdateAt: now,
 				}),
-				{ encoding: "utf-8", mode: 0o600 },
+				{ mode: 0o600 },
 			);
 		} catch {
 			// best-effort

package/src/runtime/verification-gates.ts

@@ -13,7 +13,7 @@ import { spawn } from "node:child_process";
 import * as fs from "node:fs";
 import * as path from "node:path";
 import { writeArtifact } from "../state/artifact-store.ts";
-import type { ArtifactDescriptor, GreenLevel, VerificationCommandResult, VerificationContract } from "../state/types.ts";
+import type { GreenLevel, VerificationCommandResult, VerificationContract } from "../state/types.ts";
 import { WINDOWS_ESSENTIAL_ENV_VARS } from "../utils/env-allowlist.ts";
 import { sanitizeEnvSecrets } from "../utils/env-filter.ts";
 import { redactSecretString } from "../utils/redaction.ts";
@@ -154,13 +154,61 @@ export const CARGO_RUST_GATES: Array<{
 // `npm test > ~/.ssh/authorized_keys`) and used char-class semantics instead of
 // a lookahead. Now `[<>](?![&\d])` blocks BOTH `<` and `>` file redirects while
 // still permitting fd-duplication forms (`2>&1`, `1>&2`, `>&2`, `<&3`) via the
-// negative lookahead (a `>`/`<` followed by `&` or a digit is allowed).
-const DANGEROUS_SHELL_PATTERNS = /(?:;|&&|\|\||\$\(|`|\$\{|\$\w|\b(eval|exec)\b|[<>](?![&\d])|[\r\n])/;
+// negative lookahead (a `>`/`<` followed by `&` or a digit is allowed). A bare
+// `&` is also blocked so an allowed gate cannot background itself and start a
+// second command.
+const DANGEROUS_SHELL_PATTERNS = /(?:;|&&|\|\||\$\(|`|\$\{|\$\w|\b(eval|exec)\b|[<>](?![&\d])|(?<![<>])&|[\r\n])/;
+
+/**
+ * Verification gates intentionally execute project-controlled code, but they
+ * must enter through a known build/test runner. Interpreter eval modes and
+ * arbitrary utilities are excluded: `node -e`, `python -c`, `curl`, etc. can
+ * otherwise execute attacker-provided code without any shell metacharacters.
+ *
+ * Prefixes are token-bound and each side of a pipeline is checked separately,
+ * preventing an allowed prefix such as `npm test | node -e ...` from bypassing
+ * the restriction. Keep this list focused on common verification commands.
+ */
+const ALLOWED_GATE_COMMAND_PATTERNS: readonly RegExp[] = [
+	/^npm\s+(?:test(?:\s|$)|run(?:-script)?\s+[A-Za-z0-9_.:-]+(?:\s|$))/,
+	/^pnpm\s+(?:test(?:\s|$)|run\s+[A-Za-z0-9_.:-]+(?:\s|$))/,
+	/^yarn\s+(?:test(?:\s|$)|run\s+[A-Za-z0-9_.:-]+(?:\s|$))/,
+	/^npx\s+(?:--no-install\s+)?(?:biome|eslint|tsc)(?:\s|$)/,
+	/^(?:biome|eslint|tsc)(?:\s|$)/,
+	/^node\s+(?:(?:--experimental-strip-types|--no-warnings)\s+)*--test(?:\s|$)/,
+	/^python(?:3(?:\.\d+)*)?\s+-m\s+(?:pytest|unittest)(?:\s|$)/,
+	/^pytest(?:\s|$)/,
+	/^cargo\s+(?:build|check|clippy|fmt|test)(?:\s|$)/,
+	/^go\s+(?:build|test|vet)(?:\s|$)/,
+	/^bun\s+test(?:\s|$)/,
+	/^deno\s+(?:check|lint|test)(?:\s|$)/,
+	/^dotnet\s+(?:build|test)(?:\s|$)/,
+	/^(?:gradle|\.\/gradlew)\s+(?:build|check|test)(?:\s|$)/,
+	/^(?:mvn|\.\/mvnw)\s+(?:package|test|verify)(?:\s|$)/,
+	/^make\s+(?:build|check|lint|test)(?:\s|$)/,
+	/^(?:echo|false|printenv|printf|true)(?:\s|$)/,
+	/^(?:grep|head|rg|tail)(?:\s|$)/,
+];
+
+const NODE_EVAL_MODE_PATTERN = /(?:^|\s)["']?(?:(?:-e|-p)(?!-)|--(?:eval|print)(?:=|\s|["']|$))/;
+
+function validateAllowedGateCommands(normalized: string, original: string): void {
+	const pipelineCommands = normalized.split("|").map((part) => part.trim());
+	for (const pipelineCommand of pipelineCommands) {
+		if (/^node(?:\s|$)/.test(pipelineCommand) && NODE_EVAL_MODE_PATTERN.test(pipelineCommand)) {
+			throw new Error(`Security: verification gate command rejected (Node eval/print mode is not allowed): ${original}`);
+		}
+		if (!pipelineCommand || !ALLOWED_GATE_COMMAND_PATTERNS.some((pattern) => pattern.test(pipelineCommand))) {
+			throw new Error(`Security: verification gate command rejected (command is not allowlisted): ${original}`);
+		}
+	}
+}
 
 /**
  * Validate a verification gate command is safe to execute.
- * Rejects commands with shell metacharacters that could enable injection.
- * Allows: pipes (|), redirection of stderr (2>&1), and basic npm/cargo/npx commands.
+ * Rejects commands with shell metacharacters that could enable injection and
+ * commands outside the verification-runner allowlist. Allows safe pipelines
+ * and stderr fd duplication (`2>&1`).
  */
 /** @internal — exported for injection-guard unit testing (Round 25). */
 export function __test__validateGateCommand(command: string): void {
@@ -187,6 +235,7 @@ function validateGateCommand(command: string): void {
 	if (DANGEROUS_SHELL_PATTERNS.test(normalized)) {
 		throw new Error(`Security: verification gate command rejected (dangerous shell pattern): ${command}`);
 	}
+	validateAllowedGateCommands(normalized, command);
 }
 
 async function executeCommand(

package/src/schema/config-schema.ts

@@ -37,6 +37,7 @@ export const PiTeamsLimitsConfigSchema = Type.Object(
 		maxRetriesPerTask: Type.Optional(Type.Integer({ minimum: 1 })),
 		maxTasksPerRun: Type.Optional(Type.Integer({ minimum: 1 })),
 		heartbeatStaleMs: Type.Optional(Type.Integer({ minimum: 1 })),
+		serializeOnPathOverlap: Type.Optional(Type.Boolean()),
 	},
 	{ additionalProperties: false },
 );
@@ -59,6 +60,17 @@ export const PiTeamsRuntimeConfigSchema = Type.Object(
 		effectivenessGuard: Type.Optional(
 			Type.Union([Type.Literal("off"), Type.Literal("warn"), Type.Literal("block"), Type.Literal("fail")]),
 		),
+		yield: Type.Optional(
+			Type.Object(
+				{
+					enabled: Type.Optional(Type.Boolean()),
+					maxReminders: Type.Optional(Type.Integer({ minimum: 0 })),
+					reminderPrompt: Type.Optional(Type.String({ maxLength: 1000 })),
+				},
+				{ additionalProperties: false },
+			),
+		),
+		excludeContextBash: Type.Optional(Type.Boolean()),
 		isolationPolicy: Type.Optional(
 			Type.Object(
 				{
@@ -182,7 +194,7 @@ export const PiTeamsObservabilityConfigSchema = Type.Object(
 	{
 		enabled: Type.Optional(Type.Boolean()),
 		pollIntervalMs: Type.Optional(Type.Integer({ minimum: 1000, maximum: 60000 })),
-		metricRetentionDays: Type.Optional(Type.Integer({ minimum: 1, maximum: 365 })),
+		metricRetentionDays: Type.Optional(Type.Integer({ minimum: 1, maximum: 90 })),
 	},
 	{ additionalProperties: false },
 );
@@ -205,6 +217,11 @@ export const PiTeamsReliabilityConfigSchema = Type.Object(
 		autoRecover: Type.Optional(Type.Boolean()),
 		deadletterThreshold: Type.Optional(Type.Integer({ minimum: 1 })),
 		cleanupOrphanedTempDirs: Type.Optional(Type.Boolean()),
+		autoRepairIntervalMs: Type.Optional(Type.Integer({ minimum: 0 })),
+		forcePreflight: Type.Optional(Type.Boolean()),
+		ambientStatusInjection: Type.Optional(Type.Boolean()),
+		perWriteValidation: Type.Optional(Type.Boolean()),
+		scopeModels: Type.Optional(Type.Boolean()),
 	},
 	{ additionalProperties: false },
 );
@@ -235,6 +252,7 @@ export const PiTeamsUiConfigSchema = Type.Object(
 		dashboardLiveRefreshMs: Type.Optional(Type.Integer({ minimum: 250, maximum: 60000 })),
 		autoOpenDashboard: Type.Optional(Type.Boolean()),
 		autoOpenDashboardForForegroundRuns: Type.Optional(Type.Boolean()),
+		autoCloseDashboardMs: Type.Optional(Type.Integer({ minimum: 0 })),
 		showModel: Type.Optional(Type.Boolean()),
 		showTokens: Type.Optional(Type.Boolean()),
 		showTools: Type.Optional(Type.Boolean()),

package/src/schema/team-tool-schema.ts

@@ -194,6 +194,8 @@ export const TeamToolParams = Type.Object({
 			description: "Path to a markdown plan document for orchestration.",
 		}),
 	),
+	subAction: Type.Optional(Type.String({ description: "Sub-action for schedule management (remove, disable, enable, update)." })),
+	jobId: Type.Optional(Type.String({ description: "Job ID for schedule management actions." })),
 	cron: Type.Optional(
 		Type.String({
 			description: "Cron expression for recurring scheduled runs (e.g., '0 9 * * MON').",

package/src/skills/discover-skills.ts

@@ -28,23 +28,34 @@ export interface SkillDescriptor {
 }
 
 /**
- * F6 (v0.7.9): discover skills from all five roots (matching pi-subagents'
- * skill-loader so users authoring skills under either convention find them).
- * Roots, in precedence order (first hit wins):
- *   1. <cwd>/.pi/skills          (project, Pi standard)
- *   2. <cwd>/.agents/skills      (project, Agent Skills spec — agentskills.io)
- *   3. <cwd>/skills              (project, legacy pi-crew convention)
- *   4. <getAgentDir>/skills      (user, Pi standard)
- *   5. <homedir>/.agents/skills  (user, Agent Skills spec)
- *   6. <homedir>/.pi/skills      (user, legacy Pi — pre-standard)
- *   7. PACKAGE_SKILLS_DIR        (bundled, trusted)
- * The `PACKAGE_SKILLS_DIR` (bundled) and the legacy `<cwd>/skills` root are
- * kept as separate `source` values to preserve the existing capability
- * inventory shape — callers that key on `source === "package"` / `source ===
- * "project"` keep working.
+ * F6 (v0.7.9): discover skills from all roots (matching pi-subagents' skill-loader
+ * so users authoring skills under either convention find them).
+ *
+ * IMPORTANT — inventory vs injection (SEC-003): this function returns EVERY
+ * skill found across roots (NO first-wins dedup) because it feeds the capability
+ * INVENTORY, which intentionally surfaces all skills (incl. project shadows) for
+ * transparency; `capability-inventory.ts` then marks project/user items that
+ * shadow a package/builtin one and re-sorts by id.
+ *
+ * The actual skill-content INJECTION path is separate: `skill-instructions.ts`
+ * `candidateSkillDirs` + `readSkillMarkdown` use first-wins with PACKAGE FIRST
+ * (SEC-003 fix, regression-tested in test/unit/skill-instructions.test.ts) so a
+ * project skill can NEVER override a trusted package skill's content in worker
+ * prompts. The package-first order below mirrors that injection path for
+ * consistency/defense-in-depth.
+ *
+ * Roots:
+ *   1. PACKAGE_SKILLS_DIR        (bundled, trusted)
+ *   2. <cwd>/.pi/skills          (project, Pi standard)
+ *   3. <cwd>/.agents/skills      (project, Agent Skills spec — agentskills.io)
+ *   4. <cwd>/skills              (project, legacy pi-crew convention)
+ *   5. <getAgentDir>/skills      (user, Pi standard)
+ *   6. <homedir>/.agents/skills  (user, Agent Skills spec)
+ *   7. <homedir>/.pi/skills      (user, legacy Pi — pre-standard)
  */
 function listSkillDirs(cwd: string): Array<{ root: string; source: SkillDescriptor["source"] }> {
 	return [
+		{ root: PACKAGE_SKILLS_DIR, source: "package" },
 		{ root: path.resolve(cwd, ".pi", "skills"), source: "project-pi" },
 		{
 			root: path.resolve(cwd, ".agents", "skills"),
@@ -57,7 +68,6 @@ function listSkillDirs(cwd: string): Array<{ root: string; source: SkillDescript
 			source: "user-agents",
 		},
 		{ root: path.join(os.homedir(), ".pi", "skills"), source: "user-pi" },
-		{ root: PACKAGE_SKILLS_DIR, source: "package" },
 	];
 }
 

package/src/state/active-run-registry.ts

@@ -2,7 +2,6 @@ import * as crypto from "node:crypto";
 import * as fs from "node:fs";
 import * as path from "node:path";
 import { DEFAULT_CACHE, DEFAULT_PATHS } from "../config/defaults.ts";
-import { logInternalError } from "../utils/internal-error.ts";
 import { userCrewRoot } from "../utils/paths.ts";
 import { isSafePathId } from "../utils/safe-paths.ts";
 import { sharedScanCache } from "../utils/scan-cache.ts";