pi-crew 0.9.41 → 0.9.44

package/src/runtime/run-coalesced-task-group.ts

@@ -1,16 +1,3 @@
-/**
- * run-coalesced-task-group.ts — M6 real-dispatch MVP worker spawn.
- *
- * Spawns ONE child Pi process for an entire coalesced group of N tasks
- * (sharing role + cwd per `planCoalescedGroups`). The combined prompt
- * instructs the worker to wrap each task's result in `<<<TASK_RESULT:id>>>`
- * ... `<<<END_TASK_RESULT>>>` delimiters. Output is split back into N
- * per-task results via `splitCoalescedOutput`, each written to its own
- * result artifact + state update.
- */
-
-import { writeFile } from "node:fs/promises";
-import path from "node:path";
 import type { AgentConfig } from "../agents/agent-config.ts";
 import { writeArtifact } from "../state/artifact-store.ts";
 import { appendEventAsync } from "../state/event-log.ts";
@@ -18,8 +5,10 @@ import { saveRunTasksAsync, updateRunStatus } from "../state/state-store.ts";
 import type { TeamRunManifest, TeamTaskState } from "../state/types.ts";
 import type { WorkflowStep } from "../workflows/workflow-config.ts";
 import { runChildPi } from "./child-pi.ts";
+import { DEFAULT_RETRY_POLICY, executeWithRetry } from "./retry-executor.ts";
 import { permissionForRole } from "./role-permission.ts";
 import type { CrewRuntimeMode } from "./runtime-resolver.ts";
+import { sanitizeTaskText } from "./task-packet.ts";
 import { splitCoalescedOutput } from "./task-runner/output-splitter.ts";
 import { mergeArtifacts } from "./team-runner-artifacts.ts";
 import { createWorkerHeartbeat, touchWorkerHeartbeat } from "./worker-heartbeat.ts";
@@ -114,15 +103,21 @@ export async function runCoalescedTaskGroup(input: CoalescedTaskGroupInput): Pro
 			}
 		}, 15_000);
 		try {
-			const result = await runChildPi({
-				cwd: firstTask.cwd,
-				task: combinedPrompt,
-				agent,
-				signal,
-				excludeContextBash: true,
-				maxTurns: 5,
-				onJsonEvent: (e) => input.onJsonEvent?.(firstTask.id, manifest.runId, e),
-			});
+			const result = await executeWithRetry(
+				async () => {
+					return await runChildPi({
+						cwd: firstTask.cwd,
+						task: combinedPrompt,
+						agent,
+						signal,
+						excludeContextBash: true,
+						maxTurns: 5,
+						onJsonEvent: (e) => input.onJsonEvent?.(firstTask.id, manifest.runId, e),
+					});
+				},
+				DEFAULT_RETRY_POLICY,
+				{ signal },
+			);
 			rawOutput = result.rawFinalText ?? result.stdout ?? "";
 			success = result.exitStatus?.exitCode === 0;
 		} catch (err) {
@@ -206,7 +201,7 @@ async function buildCoalescedPrompt(
 				`### Task ${idx + 1} of ${groupTasks.length} (id: ${task.id})`,
 				`Step: ${step.id}`,
 				`Role: ${step.role}`,
-				`Task: ${step.task.replaceAll("{goal}", manifest.goal)}`,
+				`Task: ${sanitizeTaskText(step.task.replaceAll("{goal}", manifest.goal))}`,
 			].join("\n");
 		})
 		.join("\n\n---\n\n");

package/src/runtime/scheduler.ts

@@ -111,6 +111,7 @@ export class CrewScheduler {
 		if (this.timers.has(job.id)) return;
 		if (job.scheduleType === "interval" && job.intervalMs) {
 			const t = setInterval(() => this.fire(job.id), job.intervalMs);
+			t.unref();
 			this.timers.set(job.id, t);
 		} else if (job.scheduleType === "once") {
 			const target = new Date(job.schedule).getTime();
@@ -120,6 +121,7 @@ export class CrewScheduler {
 					this.fire(job.id);
 					this.update(job.id, { enabled: false });
 				}, delay);
+				t.unref();
 				this.timers.set(job.id, t);
 			} else {
 				this.update(job.id, { enabled: false, lastStatus: "error" });

package/src/runtime/session-resources.ts

@@ -9,7 +9,7 @@ import { logInternalError } from "../utils/internal-error.ts";
  */
 export function tryRegisterSessionCleanup(pi: ExtensionAPI, cleanup: () => void): (() => void) | undefined {
 	const api = pi as unknown as Record<string, unknown>;
-	const registerFn = api["registerSessionResourceCleanup"];
+	const registerFn = api.registerSessionResourceCleanup;
 	if (typeof registerFn === "function") {
 		try {
 			const unregister = (registerFn as (fn: () => void) => (() => void) | void)(cleanup);

package/src/runtime/settings-store.ts

@@ -1,6 +1,8 @@
 import * as fs from "node:fs";
 import { homedir } from "node:os";
 import * as path from "node:path";
+import { atomicWriteJson } from "../state/atomic-write.ts";
+import { withFileLockSync } from "../state/locks.ts";
 import { logInternalError } from "../utils/internal-error.ts";
 import type { JoinMode } from "./group-join.ts";
 
@@ -98,13 +100,41 @@ export function saveCrewSettings(s: CrewSettings, cwd: string = process.cwd()):
 	const p = projectPath(cwd);
 	try {
 		fs.mkdirSync(path.dirname(p), { recursive: true });
-		fs.writeFileSync(p, JSON.stringify(s, null, 2), "utf-8");
+		// Atomic (temp + rename + fsync) instead of raw writeFileSync: a crash/SIGKILL
+		// mid-write would otherwise truncate <cwd>/.pi/crew-settings.json, and the
+		// reader silently resets to {} on parse failure — losing ALL crew settings +
+		// scheduledJobs.
+		atomicWriteJson(p, s);
 		return true;
 	} catch {
 		return false;
 	}
 }
 
+/**
+ * Atomically read-modify-write crew settings under a file lock.
+ *
+ * Fixes two issues vs a plain loadCrewSettings → saveCrewSettings sequence:
+ *  1. Cross-session lost-update race: <cwd>/.pi/crew-settings.json is project-scoped,
+ *     so two Pi sessions on the same project concurrently scheduling jobs would each
+ *     load-modify-save and the second save clobbers the first (lost job). The lock
+ *     serializes the whole transaction.
+ *  2. Crash truncation: the write uses atomicWriteJson (temp + rename + fsync).
+ *
+ * `mutator` receives the freshly-loaded (merged) settings and returns the new value
+ * to persist. Returns the persisted settings.
+ */
+export function updateCrewSettings(cwd: string, mutator: (settings: CrewSettings) => CrewSettings): CrewSettings {
+	const p = projectPath(cwd);
+	fs.mkdirSync(path.dirname(p), { recursive: true });
+	return withFileLockSync(p, () => {
+		const fresh = loadCrewSettings(cwd); // re-read inside the lock (TOCTOU-safe vs other updaters)
+		const next = mutator(fresh);
+		atomicWriteJson(p, next);
+		return next;
+	});
+}
+
 export function applyCrewSettingsToConfig(
 	config: {
 		limits?: { maxConcurrentWorkers?: number };

package/src/runtime/skill-effectiveness.ts

@@ -10,8 +10,8 @@
  * @module skill-effectiveness
  */
 
-import { existsSync, mkdirSync, readFileSync, writeFileSync } from "fs";
-import { dirname, join } from "path";
+import { existsSync, mkdirSync, readFileSync, writeFileSync } from "node:fs";
+import { dirname, join } from "node:path";
 import { projectCrewRoot } from "../utils/paths.ts";
 import { crewHooks } from "./crew-hooks.ts";
 

package/src/runtime/stale-reconciler.ts

@@ -2,7 +2,7 @@ import * as fs from "node:fs";
 import * as os from "node:os";
 import * as path from "node:path";
 import { errors } from "../errors.ts";
-import { atomicWriteJson } from "../state/atomic-write.ts";
+import { atomicWriteFile, atomicWriteJson } from "../state/atomic-write.ts";
 import { saveRunManifest } from "../state/state-store.ts";
 import type { TeamRunManifest, TeamTaskState } from "../state/types.ts";
 import { recordFromTask, upsertCrewAgent } from "./crew-agent-records.ts";
@@ -152,29 +152,32 @@ function checkPidLiveness(
 	}
 	// If process is alive per kill(0), we're done.
 	if (liveness.alive) return { alive: true, detail: liveness.detail };
-	// Process is dead per kill(0). Check heartbeat as corroborating evidence.
+	// Process is dead per kill(0). ESRCH is AUTHORITATIVE — the PID does not exist.
+	// A frozen/zombie process still has a PID (kill(0) returns 0, or EPERM if we lack
+	// permission to signal it), so reaching here with alive=false means the process
+	// is genuinely gone. PID recycling is already handled above via the startTime
+	// TOCTOU check, so the heartbeat file must NOT override the dead verdict.
+	//
+	// HISTORY: a <5min-old heartbeat.json previously OVERRRODE this verdict (returned
+	// alive:true "process dead but heartbeat Xs old"), delaying repair by ~5min.
+	// Combined with the 60s reconcile cadence this produced a ~300-360s detection lag
+	// for dead workers (observed 353s in production). The heartbeat is now used only
+	// to enrich the detail string, never to override the authoritative kill(0) verdict.
+	let heartbeatNote = "";
 	if (stateRoot) {
-		const heartbeatPath = path.join(stateRoot, "heartbeat.json");
 		try {
+			const heartbeatPath = path.join(stateRoot, "heartbeat.json");
 			if (fs.existsSync(heartbeatPath)) {
 				const hb = JSON.parse(fs.readFileSync(heartbeatPath, "utf-8")) as { pid?: number; at?: number };
 				if (hb?.pid === pid && hb?.at) {
-					const ageMs = Date.now() - hb.at;
-					// Heartbeat written < 5 min ago → process was alive recently.
-					// Don't repair yet; let the next reconciliation cycle catch it.
-					if (ageMs < 5 * 60_000) {
-						return {
-							alive: true,
-							detail: `process dead but heartbeat ${Math.round(ageMs / 1000)}s old`,
-						};
-					}
+					heartbeatNote = ` (heartbeat was ${Math.round((Date.now() - hb.at) / 1000)}s old)`;
 				}
 			}
 		} catch {
 			/* ignore — best-effort */
 		}
 	}
-	return { alive: liveness.alive, detail: liveness.detail };
+	return { alive: false, detail: `${liveness.detail}${heartbeatNote}` };
 }
 
 /**
@@ -267,11 +270,6 @@ function buildStaleReconcileError(task: TeamTaskState, reason: string): Error {
 	return errors.runStale(reason, heartbeatAgeSeconds);
 }
 
-/** @deprecated use buildStaleReconcileError (returns a structured CrewError). Kept for any external callers. */
-function formatStaleReconcileError(task: TeamTaskState, reason: string): string {
-	return buildStaleReconcileError(task, reason).message;
-}
-
 function repairStaleRun(manifest: TeamRunManifest, tasks: TeamTaskState[], reason: string): TeamTaskState[] {
 	const now = new Date().toISOString();
 	const repairedTasks = tasks.map((task) => {
@@ -592,9 +590,13 @@ export function reconcileOrphanedTempWorkspaces(
 					if (!fs.existsSync(workspaceDir)) {
 						fs.mkdirSync(workspaceDir, { recursive: true });
 					}
-					fs.writeFileSync(sentinelPath, JSON.stringify({ startedAt: now }), {
-						flag: "wx",
-					});
+					// Atomic exclusive-create: reserve the sentinel (fails with EEXIST if
+					// another cleanup is in progress), then fill it atomically. The brief
+					// empty-file window is safe — the sentinel "exists" (correctly
+					// signalling in-progress cleanup).
+					const sentinelFd = fs.openSync(sentinelPath, "wx");
+					fs.closeSync(sentinelFd);
+					atomicWriteFile(sentinelPath, JSON.stringify({ startedAt: now }));
 				} catch {
 					// Sentinel already exists (another cleanup in progress) — skip
 					canCleanup = false;
@@ -661,38 +663,6 @@ export function reconcileOrphanedTempWorkspaces(
 				} catch {
 					/* ignore if already gone */
 				}
-			} else if (canCleanup) {
-				// Sentinel already existed — another cleanup attempt is in progress.
-				// Perform a simplified TOCTOU check: if any manifest is running,
-				// do NOT remove the sentinel (let the first attempt finish its scan).
-				let hasRunningManifest = false;
-				if (fs.existsSync(stateRunsDir)) {
-					try {
-						for (const runDir of fs.readdirSync(stateRunsDir)) {
-							const manifestPath = path.join(stateRunsDir, runDir, "manifest.json");
-							if (!fs.existsSync(manifestPath)) continue;
-							try {
-								const m = JSON.parse(fs.readFileSync(manifestPath, "utf-8")) as TeamRunManifest;
-								if (m.status === "running") {
-									hasRunningManifest = true;
-									break;
-								}
-							} catch {
-								/* skip on parse error */
-							}
-						}
-					} catch {
-						/* skip if runs dir unreadable */
-					}
-				}
-				// Only clean up sentinel if no running manifests exist
-				if (!hasRunningManifest) {
-					try {
-						fs.unlinkSync(sentinelPath);
-					} catch {
-						/* ignore if already gone */
-					}
-				}
 			}
 		}
 	} catch {

package/src/runtime/subagent-manager.ts

@@ -439,13 +439,29 @@ export class SubagentManager {
 	private drainQueue(): void {
 		while (this.queue.length > 0 && this.runningBackground < this.maxConcurrent) {
 			const next = this.queue.shift();
-			if (!next || next.record.status !== "queued") continue;
+			if (next?.record.status !== "queued") continue;
 			this.start(next.record, next.options, next.runner, next.signal);
 		}
 	}
 
 	private async pollRunToTerminal(cwd: string, record: SubagentRecord): Promise<void> {
+		// Safety: max 30 minutes (1800 polls at 1s interval) to prevent infinite
+		// polling if manifest file is deleted or run state becomes unrecoverable.
+		const MAX_POLL_COUNT = 1800;
+		let pollCount = 0;
 		while (record.runId && (record.status === "running" || record.status === "blocked")) {
+			if (++pollCount > MAX_POLL_COUNT) {
+				logInternalError(
+					"subagent-manager.poll-timeout",
+					new Error(`pollRunToTerminal exceeded ${MAX_POLL_COUNT} polls for runId=${record.runId}`),
+					`id=${record.id}`,
+				);
+				record.status = "error";
+				record.error = `Poll timeout: run did not reach terminal state after ${MAX_POLL_COUNT} seconds`;
+				record.completedAt = Date.now();
+				savePersistedSubagentRecord(cwd, record);
+				return;
+			}
 			const loaded = loadRunManifestById(cwd, record.runId); // NOTE: no withRunLock - best-effort only; concurrent writes may cause inconsistency
 			if (!loaded) {
 				await new Promise((resolve) => setTimeout(resolve, this.pollIntervalMs));
@@ -488,7 +504,7 @@ export class SubagentManager {
 	private scheduleBlockedTerminalPoll(cwd: string, record: SubagentRecord): void {
 		const poll = (): void => {
 			const current = this.records.get(record.id);
-			if (!current || current.status !== "blocked" || !current.runId) return;
+			if (current?.status !== "blocked" || !current.runId) return;
 			const loaded = loadRunManifestById(cwd, current.runId); // NOTE: no withRunLock - best-effort only; concurrent writes may cause inconsistency
 			if (
 				!loaded ||
@@ -524,7 +540,7 @@ export class SubagentManager {
 		const threshold = DEFAULT_SUBAGENT.stuckBlockedNotifyMs;
 		const fire = (): void => {
 			const current = this.records.get(record.id);
-			if (!current || current.status !== "blocked" || !current.blockedAt || current.stuckNotified) return;
+			if (current?.status !== "blocked" || !current.blockedAt || current.stuckNotified) return;
 			current.stuckNotified = true;
 			this.onEvent?.("subagent.stuck-blocked", {
 				event: "subagent.stuck-blocked",

package/src/runtime/task-output-context.ts

@@ -2,6 +2,7 @@ import * as fs from "node:fs";
 import * as path from "node:path";
 import { DEFAULT_OUTPUT_CONTEXT } from "../config/defaults.ts";
 import { writeArtifact } from "../state/artifact-store.ts";
+import { atomicWriteFile } from "../state/atomic-write.ts";
 import type { ArtifactDescriptor, TeamRunManifest, TeamTaskState } from "../state/types.ts";
 import { resolveRealContainedPath } from "../utils/safe-paths.ts";
 import type { WorkflowStep } from "../workflows/workflow-config.ts";
@@ -155,7 +156,7 @@ export function teePathForArtifact(artifactsRoot: string, taskId: string, artifa
 function writeTeeFile(fullOutputPath: string, content: string): boolean {
 	try {
 		fs.mkdirSync(path.dirname(fullOutputPath), { recursive: true });
-		fs.writeFileSync(fullOutputPath, content, "utf-8");
+		atomicWriteFile(fullOutputPath, content);
 		return true;
 	} catch {
 		return false;

package/src/runtime/task-runner/prompt-builder.ts

@@ -4,7 +4,7 @@ import type { TaskOutputSchema, TeamRunManifest, TeamTaskState } from "../../sta
 import type { WorkflowStep } from "../../workflows/workflow-config.ts";
 import { buildMemoryBlock } from "../agent-memory.ts";
 import { permissionForRole } from "../role-permission.ts";
-import { HANDOFF_TEMPLATE, renderTaskPacket } from "../task-packet.ts";
+import { HANDOFF_TEMPLATE, renderTaskPacket, sanitizeTaskText } from "../task-packet.ts";
 import { buildWorkspaceTree } from "../workspace-tree.ts";
 import { renderSuggestedFilesSection, runRetrievalCycle } from "./retrieval-orchestrator.ts";
 
@@ -14,7 +14,7 @@ import { renderSuggestedFilesSection, runRetrievalCycle } from "./retrieval-orch
  * filtering at the Pi level is a future optimisation (Phase 3.2+).
  */
 export function toolGuidanceBlock(agent?: AgentConfig): string {
-	if (!agent || agent.loadMode !== "lean" || !agent.defaultTools?.length) return "";
+	if (agent?.loadMode !== "lean" || !agent.defaultTools?.length) return "";
 	return [
 		"# Tool Guidance",
 		`This role uses a focused tool set. Preferred tools: ${agent.defaultTools.join(", ")}.`,
@@ -267,7 +267,7 @@ export async function renderTaskPrompt(
 		memoryBlock,
 		task.taskPacket?.outputSchema ? renderOutputSchemaBlock(task.taskPacket.outputSchema) : "",
 		"Task:",
-		step.task.replaceAll("{goal}", manifest.goal),
+		sanitizeTaskText(step.task.replaceAll("{goal}", manifest.goal)),
 		"",
 		"When your task is complete, structure your final output using this handoff template:",
 		HANDOFF_TEMPLATE,

package/src/runtime/task-runner/run-projection.ts

@@ -1,5 +1,6 @@
 import type { MailboxMessage } from "../../state/mailbox.ts";
 import type { ArtifactDescriptor, TeamRunManifest, TeamTaskState } from "../../state/types.ts";
+import { sanitizeTaskText } from "../task-packet.ts";
 
 export interface RunProjectionSource {
 	kind: "events" | "mailbox" | "artifacts" | "ui_metadata" | "runtime_metadata";
@@ -64,7 +65,8 @@ export function transformRunContextBeforeWorkerStart(input: {
 		});
 		lines.push(`Pending messages (${messages.length}/${input.pendingMailbox.length}):`);
 		for (const msg of messages) {
-			lines.push(`- ${msg.kind ?? "message"}: ${msg.body.slice(0, 100)}`);
+			const safeBody = sanitizeTaskText(msg.body.slice(0, 100));
+			lines.push(`- ${msg.kind ?? "message"}: ${safeBody}`);
 		}
 	}
 

package/src/runtime/task-runner/state-helpers.ts

@@ -24,6 +24,14 @@ export function updateTask(tasks: TeamTaskState[], updated: TeamTaskState): Team
  * committed first; retry with the fresh state. This is O(retry) under contention but
  * converges in the normal single-writer case.
  *
+ * ST-7: pass `skipCoalesce: true` when persisting a TERMINAL task status
+ * (completed/failed/cancelled/needs_attention/skipped). Without this the
+ * underlying `saveRunTasksCoalesced` would buffer the write for 50ms; a
+ * SIGKILL in that window loses the terminal update and crash recovery
+ * would see "running" in tasks.json while events.jsonl already shows
+ * "completed". For non-terminal transitions (heartbeat, progress) the
+ * default buffered write is fine and matches prior behavior.
+ *
  * @param checkpointPhase - Optional checkpoint phase to include in the task state alongside the update.
  */
 export function persistSingleTaskUpdate(
@@ -31,6 +39,7 @@ export function persistSingleTaskUpdate(
 	fallbackTasks: TeamTaskState[],
 	updated: TeamTaskState,
 	checkpointPhase?: TaskCheckpointState["phase"],
+	skipCoalesce: boolean = false,
 ): TeamTaskState[] {
 	const MAX_CAS_ATTEMPTS = 100;
 	let baseMtime = 0;
@@ -126,7 +135,10 @@ export function persistSingleTaskUpdate(
 				// non-coalesced writers; the flushPendingAtomicWrites() guard at
 				// the top of the retry loop ensures reads see any other coalesced
 				// writer's flushed-before-this-call state.
-				saveRunTasksCoalesced(manifest, merged);
+				// ST-7: terminal transitions (skipCoalesce=true) bypass the 50ms
+				// coalesce window so a SIGKILL after the persist completes cannot
+				// leave tasks.json stale with a non-terminal status.
+				saveRunTasksCoalesced(manifest, merged, skipCoalesce);
 			} catch (err) {
 				logInternalError("persistSingleTaskUpdate", err, undefined, "error");
 				throw err;

package/src/runtime/task-runner.ts

@@ -15,11 +15,10 @@ import type {
 	OperationTerminalEvidence,
 	TeamRunManifest,
 	TeamTaskState,
-	UsageState,
 	VerificationEvidence,
 } from "../state/types.ts";
 import { logInternalError } from "../utils/internal-error.ts";
-import { resolveRealContainedPath } from "../utils/safe-paths.ts";
+import { resolveContainedPath, resolveRealContainedPath } from "../utils/safe-paths.ts";
 import type { WorkflowStep } from "../workflows/workflow-config.ts";
 import { captureWorktreeDiffAsync, captureWorktreeDiffStatAsync, prepareTaskWorkspaceAsync } from "../worktree/worktree-manager.ts";
 import { reserveControlChannel } from "./agent-control.ts";
@@ -35,7 +34,7 @@ import {
 	recordFromTask,
 	upsertCrewAgent,
 } from "./crew-agent-records.ts";
-import type { CrewAgentProgress, CrewRuntimeKind } from "./crew-agent-runtime.ts";
+import type { CrewRuntimeKind } from "./crew-agent-runtime.ts";
 import { crewHooks } from "./crew-hooks.ts";
 import { bridgeEventFromJsonEvent, registerStreamBridge } from "./event-stream-bridge.ts";
 import { createVerificationEvidence } from "./green-contract.ts";
@@ -87,7 +86,7 @@ registerYieldTool();
 async function appendSteeringAsync(steeringDir: string, taskId: string, steers: string[]): Promise<void> {
 	try {
 		await fs.promises.mkdir(steeringDir, { recursive: true });
-		const steeringPath = `${steeringDir}/${taskId}.jsonl`;
+		const steeringPath = resolveContainedPath(steeringDir, `${taskId}.jsonl`);
 		const lines = steers
 			.map(
 				(msg) =>
@@ -254,10 +253,18 @@ export async function runTeamTask(input: TaskRunnerInput): Promise<{ manifest: T
 		if (input.step.preStepScript) {
 			const scriptTimeout = input.step.preStepTimeout ?? 30_000;
 			const scriptArgs = input.step.preStepArgs ?? [];
+			appendEventFireAndForget(manifest.eventsPath, {
+				type: "hook.pre_step_started",
+				runId: manifest.runId,
+				taskId: task.id,
+				data: { script: input.step.preStepScript, argCount: scriptArgs.length, timeoutMs: scriptTimeout },
+			});
 			// SECURITY (M-1 fix, code-review 2026-06-23): use the project's safe-path
 			// primitive instead of a hand-rolled path.resolve + startsWith check.
 			// The lexical check passed a symlinked ancestor, letting execFileSync
 			// follow it and execute a script outside cwd. Throws on escape.
+			// Keep validation outside the optional-execution catch: preStepOptional
+			// must never bypass a path-containment failure.
 			resolveRealContainedPath(manifest.cwd, input.step.preStepScript);
 			try {
 				// LAZY: defer dynamic import of node:child_process to its call site.
@@ -268,9 +275,22 @@ export async function runTeamTask(input: TaskRunnerInput): Promise<{ manifest: T
 					cwd: manifest.cwd,
 					maxBuffer: 1024 * 1024, // 1MB cap
 				});
+				appendEventFireAndForget(manifest.eventsPath, {
+					type: "hook.pre_step_completed",
+					runId: manifest.runId,
+					taskId: task.id,
+					data: { script: input.step.preStepScript, outputBytes: Buffer.byteLength(preStepOutput, "utf8") },
+				});
 			} catch (err) {
 				const msg = err instanceof Error ? err.message : String(err);
 				const exitCode = (err as NodeJS.ErrnoException & { status?: number }).status;
+				appendEventFireAndForget(manifest.eventsPath, {
+					type: "hook.pre_step_failed",
+					runId: manifest.runId,
+					taskId: task.id,
+					message: `pre-step hook failed (exit ${exitCode ?? "?"})`,
+					data: { script: input.step.preStepScript, exitCode: exitCode ?? null, optional: input.step.preStepOptional === true },
+				});
 				// E1 (Round 15): structured CrewError with code E009 + help hint,
 				// instead of a raw Error. Surfaces the script path, exit code, and stderr.
 				// Round 21 (E4): if preStepOptional is set, a failing hook is NON-FATAL.
@@ -484,7 +504,7 @@ export async function runTeamTask(input: TaskRunnerInput): Promise<{ manifest: T
 					runId: manifest.runId,
 					agentId: task.id,
 					artifactsRoot: manifest.artifactsRoot,
-					steeringFile: `${manifest.artifactsRoot}/steering/${task.id}.jsonl`,
+					steeringFile: resolveContainedPath(`${manifest.artifactsRoot}/steering`, `${task.id}.jsonl`),
 					onSpawn: (pid) => {
 						try {
 							({ task, tasks } = checkpointTask(manifest, tasks, task, "child-spawned", pid));
@@ -1222,9 +1242,14 @@ export async function runTeamTask(input: TaskRunnerInput): Promise<{ manifest: T
 		// stale manifest and overwrite this task's freshly-written artifacts, silently
 		// losing them. persistSingleTaskUpdate is re-entrance-safe (runLockHeldByUs guard),
 		// so nesting it inside this lock is a no-op re-acquire, not a deadlock.
+		// ST-7: this is a terminal transition (task.status is completed/failed/needs_attention),
+		// pass skipCoalesce=true so the terminal update is durable — a SIGKILL in the
+		// 50ms coalesce window must NOT leave tasks.json showing the prior non-terminal
+		// status, otherwise crash recovery would see inconsistency between tasks.json
+		// (running) and events.jsonl (terminal).
 		tasks = await withRunLock(manifest, async () => {
 			await saveRunManifestAsync(manifest);
-			return persistSingleTaskUpdate(manifest, tasks, task);
+			return persistSingleTaskUpdate(manifest, tasks, task, undefined, true);
 		});
 		upsertCrewAgent(manifest, recordFromTask(manifest, task, runtimeKind));
 		// Execute task_result hook before emitting terminal event

package/src/runtime/team-runner.ts

@@ -9,6 +9,7 @@ import type { MetricRegistry } from "../observability/metric-registry.ts";
 import { PluginRegistry } from "../plugins/plugin-registry.ts";
 import { NextJsPlugin, VitePlugin, VitestPlugin } from "../plugins/plugins/index.ts";
 import { hashArtifactContent as hashContent, writeArtifact } from "../state/artifact-store.ts";
+import { atomicWriteFile, flushPendingAtomicWrites } from "../state/atomic-write.ts";
 import { appendEvent, appendEventAsync, appendEventBuffered, appendEventFireAndForget, flushEventLogBuffer } from "../state/event-log.ts";
 import { HealthStore } from "../state/health-store.ts";
 import { withRunLock } from "../state/locks.ts";
@@ -84,7 +85,7 @@ function startTeamRunHeartbeat(stateRoot: string, runId: string): () => void {
 			// captured manifest.updatedAt once at startup, making the value
 			// permanently stale throughout the run.
 			const now = new Date().toISOString();
-			fs.writeFileSync(
+			atomicWriteFile(
 				heartbeatPath,
 				JSON.stringify({
 					pid: process.pid,
@@ -93,7 +94,7 @@ function startTeamRunHeartbeat(stateRoot: string, runId: string): () => void {
 					kind: "team-runner",
 					lastTaskUpdateAt: now,
 				}),
-				{ encoding: "utf-8", mode: 0o600 },
+				{ mode: 0o600 },
 			);
 		} catch {
 			// best-effort
@@ -1614,6 +1615,11 @@ async function executeTeamRunCore(
 		// Read committed manifest from disk inside the lock so artifact merge is based
 		// on committed state, not in-memory state that may differ from disk.
 		const mergeResult = await withRunLock(manifest, async () => {
+			// NEW-D1: flush any pending coalesced atomic writes before reading from
+			// disk. Without this, a worker's async manifest save (coalesced by
+			// atomic-write) may not be committed yet, causing a lost-update on the
+			// merge read. flushPendingAtomicWrites forces all queued writes to disk.
+			flushPendingAtomicWrites();
 			const disk = loadRunManifestById(manifest.cwd, manifest.runId);
 			const diskManifest = disk?.manifest ?? manifest;
 			const diskArtifacts = diskManifest.artifacts;

package/src/runtime/verification-gates.ts

@@ -13,7 +13,7 @@ import { spawn } from "node:child_process";
 import * as fs from "node:fs";
 import * as path from "node:path";
 import { writeArtifact } from "../state/artifact-store.ts";
-import type { ArtifactDescriptor, GreenLevel, VerificationCommandResult, VerificationContract } from "../state/types.ts";
+import type { GreenLevel, VerificationCommandResult, VerificationContract } from "../state/types.ts";
 import { WINDOWS_ESSENTIAL_ENV_VARS } from "../utils/env-allowlist.ts";
 import { sanitizeEnvSecrets } from "../utils/env-filter.ts";
 import { redactSecretString } from "../utils/redaction.ts";
@@ -154,13 +154,61 @@ export const CARGO_RUST_GATES: Array<{
 // `npm test > ~/.ssh/authorized_keys`) and used char-class semantics instead of
 // a lookahead. Now `[<>](?![&\d])` blocks BOTH `<` and `>` file redirects while
 // still permitting fd-duplication forms (`2>&1`, `1>&2`, `>&2`, `<&3`) via the
-// negative lookahead (a `>`/`<` followed by `&` or a digit is allowed).
-const DANGEROUS_SHELL_PATTERNS = /(?:;|&&|\|\||\$\(|`|\$\{|\$\w|\b(eval|exec)\b|[<>](?![&\d])|[\r\n])/;
+// negative lookahead (a `>`/`<` followed by `&` or a digit is allowed). A bare
+// `&` is also blocked so an allowed gate cannot background itself and start a
+// second command.
+const DANGEROUS_SHELL_PATTERNS = /(?:;|&&|\|\||\$\(|`|\$\{|\$\w|\b(eval|exec)\b|[<>](?![&\d])|(?<![<>])&|[\r\n])/;
+
+/**
+ * Verification gates intentionally execute project-controlled code, but they
+ * must enter through a known build/test runner. Interpreter eval modes and
+ * arbitrary utilities are excluded: `node -e`, `python -c`, `curl`, etc. can
+ * otherwise execute attacker-provided code without any shell metacharacters.
+ *
+ * Prefixes are token-bound and each side of a pipeline is checked separately,
+ * preventing an allowed prefix such as `npm test | node -e ...` from bypassing
+ * the restriction. Keep this list focused on common verification commands.
+ */
+const ALLOWED_GATE_COMMAND_PATTERNS: readonly RegExp[] = [
+	/^npm\s+(?:test(?:\s|$)|run(?:-script)?\s+[A-Za-z0-9_.:-]+(?:\s|$))/,
+	/^pnpm\s+(?:test(?:\s|$)|run\s+[A-Za-z0-9_.:-]+(?:\s|$))/,
+	/^yarn\s+(?:test(?:\s|$)|run\s+[A-Za-z0-9_.:-]+(?:\s|$))/,
+	/^npx\s+(?:--no-install\s+)?(?:biome|eslint|tsc)(?:\s|$)/,
+	/^(?:biome|eslint|tsc)(?:\s|$)/,
+	/^node\s+(?:(?:--experimental-strip-types|--no-warnings)\s+)*--test(?:\s|$)/,
+	/^python(?:3(?:\.\d+)*)?\s+-m\s+(?:pytest|unittest)(?:\s|$)/,
+	/^pytest(?:\s|$)/,
+	/^cargo\s+(?:build|check|clippy|fmt|test)(?:\s|$)/,
+	/^go\s+(?:build|test|vet)(?:\s|$)/,
+	/^bun\s+test(?:\s|$)/,
+	/^deno\s+(?:check|lint|test)(?:\s|$)/,
+	/^dotnet\s+(?:build|test)(?:\s|$)/,
+	/^(?:gradle|\.\/gradlew)\s+(?:build|check|test)(?:\s|$)/,
+	/^(?:mvn|\.\/mvnw)\s+(?:package|test|verify)(?:\s|$)/,
+	/^make\s+(?:build|check|lint|test)(?:\s|$)/,
+	/^(?:echo|false|printenv|printf|true)(?:\s|$)/,
+	/^(?:grep|head|rg|tail)(?:\s|$)/,
+];
+
+const NODE_EVAL_MODE_PATTERN = /(?:^|\s)["']?(?:(?:-e|-p)(?!-)|--(?:eval|print)(?:=|\s|["']|$))/;
+
+function validateAllowedGateCommands(normalized: string, original: string): void {
+	const pipelineCommands = normalized.split("|").map((part) => part.trim());
+	for (const pipelineCommand of pipelineCommands) {
+		if (/^node(?:\s|$)/.test(pipelineCommand) && NODE_EVAL_MODE_PATTERN.test(pipelineCommand)) {
+			throw new Error(`Security: verification gate command rejected (Node eval/print mode is not allowed): ${original}`);
+		}
+		if (!pipelineCommand || !ALLOWED_GATE_COMMAND_PATTERNS.some((pattern) => pattern.test(pipelineCommand))) {
+			throw new Error(`Security: verification gate command rejected (command is not allowlisted): ${original}`);
+		}
+	}
+}
 
 /**
  * Validate a verification gate command is safe to execute.
- * Rejects commands with shell metacharacters that could enable injection.
- * Allows: pipes (|), redirection of stderr (2>&1), and basic npm/cargo/npx commands.
+ * Rejects commands with shell metacharacters that could enable injection and
+ * commands outside the verification-runner allowlist. Allows safe pipelines
+ * and stderr fd duplication (`2>&1`).
  */
 /** @internal — exported for injection-guard unit testing (Round 25). */
 export function __test__validateGateCommand(command: string): void {
@@ -187,6 +235,7 @@ function validateGateCommand(command: string): void {
 	if (DANGEROUS_SHELL_PATTERNS.test(normalized)) {
 		throw new Error(`Security: verification gate command rejected (dangerous shell pattern): ${command}`);
 	}
+	validateAllowedGateCommands(normalized, command);
 }
 
 async function executeCommand(