pi-crew 0.9.48 → 0.9.49

package/skills/research/scripts/validate-skill-structure.mjs

@@ -0,0 +1,177 @@
+#!/usr/bin/env node
+// validate-skill-structure.mjs — structural invariant checker for generated distill skills.
+// Implements F10 (awesome-persona-distill-skills finding): hard-fail if any structural assertion fails.
+// Run AFTER Phase 3 build, BEFORE Phase 4 behavioral fidelity. Self-contained (stdlib only).
+//
+// Usage:
+//   node validate-skill-structure.mjs <path-to-SKILL.md>
+//   node validate-skill-structure.mjs <skill-dir>
+//
+// Exit codes: 0 = all assertions pass (all-green → may ship); 1 = one or more failed (iterate).
+
+import { readFileSync, readdirSync, statSync, existsSync } from 'node:fs';
+import { join, dirname, basename } from 'node:path';
+
+const target = process.argv.find((a) => !a.startsWith('-') && a !== process.argv[0] && a !== process.argv[1]);
+if (!target) {
+	console.error('Usage: validate-skill-structure.mjs <path-to-SKILL.md | skill-dir> [--engine]');
+	process.exit(2);
+}
+
+// Resolve to a SKILL.md path
+let skillPath = target;
+if (statSync(target).isDirectory()) {
+	skillPath = join(target, 'SKILL.md');
+}
+if (!existsSync(skillPath)) {
+	console.error(`✗ Not found: ${skillPath}`);
+	process.exit(2);
+}
+
+const src = readFileSync(skillPath, 'utf8');
+const dir = dirname(skillPath);
+const name = basename(dir);
+const isEngine = process.argv.includes('--engine');
+const PLACEHOLDERS = [/<person>/i, /<target>/i, /<topic>/i, /<field>/i, /TODO/i, /TBD/i, /XXX/i, /YYYY-MM-DD/i, /\.\.\.\s*<\/?/i];
+
+const failures = [];
+const passes = [];
+const check = (label, ok, detail = '') => {
+	(ok ? passes : failures).push(ok ? `  ✓ ${label}` : `  ✗ ${label}${detail ? ' — ' + detail : ''}`);
+};
+
+// --- Frontmatter ---
+const fm = src.match(/^---\n([\s\S]*?)\n---/);
+check('frontmatter block present', !!fm, 'no --- block at top');
+const fmText = fm ? fm[1] : '';
+const fmField = (key) => {
+	const m = fmText.match(new RegExp(`^${key}:\\s*(.+)$`, 'm'));
+	return m ? m[1].trim() : null;
+};
+const hasFm = (key) => new RegExp(`^${key}:`, 'm').test(fmText);
+
+check('frontmatter: name', hasFm('name'));
+check('frontmatter: description', hasFm('description'));
+const desc = fmField('description');
+check('frontmatter: description ≤1 sentence (one terminal punct or one clause)',
+	desc ? desc.split(/[.。!！?？]/).filter(Boolean).length <= 2 : false,
+	desc ? `got: "${desc.slice(0, 60)}…"` : 'missing');
+check('frontmatter: triggers', hasFm('triggers') || hasFm('trigger'), 'no triggers field');
+if (!isEngine) check('frontmatter: distilled (staleness date)', hasFm('distilled') || hasFm('调研时间'), 'no distilled/调研时间 staleness anchor');
+const distilled = fmField('distilled') || fmField('调研时间');
+check('frontmatter: distilled is valid date (YYYY-MM-DD)',
+	!distilled || /^\d{4}-\d{2}-\d{2}/.test(distilled),
+	distilled ? `got "${distilled}"` : '');
+if (!isEngine) check('frontmatter: target (person|topic|software)', hasFm('target'), 'no target field');
+
+// --- Body sections ---
+check('Agentic Protocol section present', /回答工作流|Agentic Protocol/i.test(src));
+check('Agentic Protocol Step 1', /Step 1|第一步|步骤 1|### 1\b/i.test(src));
+check('Agentic Protocol Step 2', /Step 2|第二步|步骤 2|### 2\b/i.test(src));
+check('Agentic Protocol Step 3', /Step 3|第三步|步骤 3|### 3\b/i.test(src));
+
+// honest boundaries: count items (numbered list or bullets) under an honest-boundaries heading
+function countListItems(haystack, headingRe, windowChars = 2000) {
+	const m = haystack.match(headingRe);
+	if (!m) return { found: false, count: 0, block: '' };
+	const after = haystack.slice(m.index);
+	const section = after.match(/([\s\S]*?)\n##(?=[^#])/);
+	const block = section ? section[1] : after.slice(0, windowChars);
+	// count BOTH list items AND table data rows (rows with | content |, excluding separator rows)
+	const listItems = (block.match(/^\s*(?:\d+[.)]|[-*])\s+\S/gm) || []).length;
+	const tableRows = (block.match(/^\s*\|(?![\s:|-]+\|?\s*$).+\|/gm) || []).length;
+	return { found: true, count: listItems + tableRows, block };
+}
+if (!isEngine) {
+	const boundary = countListItems(src, /诚实边界|honest boundar(?:y|ies)/i);
+	check('honest boundaries (M11) ≥3', boundary.count >= 3, `found ${boundary.count} items`);
+}
+
+// --- Anti-drift tables (M9a 内在张力, M9b 反例黑名单, M12 fallback tree) — Darwin gap #2: validator previously skipped these
+if (!isEngine) {
+	const tension = countListItems(src, /M9a|内在张力|inner tension|internal tension/i);
+	check('内在张力 (M9a) ≥3 tension pairs', tension.count >= 3, tension.found ? `found ${tension.count} items` : 'section missing');
+
+	const blacklist = countListItems(src, /M9b|反例黑名单|anti.?pattern blacklist/i);
+	check('反例黑名单 (M9b) ≥7 rows', blacklist.count >= 7, blacklist.found ? `found ${blacklist.count} rows` : 'section missing');
+
+	const fallback = countListItems(src, /M12|失败模式.*[Ff]allback|[Ff]allback\s*树/i);
+	check('失败模式Fallback树 (M12) ≥8 rows', fallback.count >= 8, fallback.found ? `found ${fallback.count} rows` : 'section missing');
+}
+
+// --- FIDELITY.md companion artifact (Darwin gap #3: ship-gate requires it but nothing checked)
+const fidelityPath = join(dir, 'FIDELITY.md');
+if (existsSync(fidelityPath)) {
+	const fm2 = readFileSync(fidelityPath, 'utf8');
+	const totalMatch = fm2.match(/(?:总分|total)[：:\s*]*\*{0,2}([0-9]+)\s*\*?\s*(?:\/|／|\sout\sof\s)\s*\*?\s*100/i);
+	check('FIDELITY.md total score present', !!totalMatch, totalMatch ? `=${totalMatch[1]}/100` : 'no /100 score found');
+	const qCount = (fm2.match(/(?:Q[1-5]|问题[1-5]|question\s*[1-5])/gi) || []).length;
+	check('FIDELITY.md ≥5 test questions', qCount >= 5, `found ${qCount} question refs`);
+	check('FIDELITY.md flags single-agent/self-score caveat', /单\s*agent|single.?agent|self.?score|upper.?bound|independent/i.test(fm2), 'add single-agent upper-bound caveat');
+} else if (!isEngine) {
+	check('FIDELITY.md companion present', false, 'no FIDELITY.md in skill dir');
+}
+
+// --- EXCAVATION-CHECKLIST.md (Phase 1 protocol: track + verify each part was really read)
+const checklistPath = join(dir, 'EXCAVATION-CHECKLIST.md');
+if (existsSync(checklistPath)) {
+	const cl = readFileSync(checklistPath, 'utf8');
+	// dangling rows: status ⬜ not-started or ⏳ reading left at ship time = silently skipped/forgotten
+	const dangling = (cl.match(/\|\s*[⬜⏳][^|]*\|/gu) || []).length;
+	check('checklist: no dangling ⬜/⏳ rows (every part resolved)', dangling === 0, dangling ? `${dangling} row(s) not-started/reading — resolve to ✅📄/⏭/🧠` : '');
+	// memory ratio: parse "memory-ratio: NN%" if declared
+	const ratioMatch = cl.match(/memory-ratio[:\s]*([0-9]+)\s*%/i);
+	if (ratioMatch) {
+		const ratio = parseInt(ratioMatch[1], 10);
+		check('checklist: 🧠 memory-ratio ≤30%', ratio <= 30, `declared ${ratio}% (>30% = recap, not distillation)`);
+	} else {
+		check('checklist: declares memory-ratio', false, 'add "🧠 memory-ratio: NN% (X/Y findings)" header line');
+	}
+	// proof-of-read present: at least one verbatim-quote-with-location cell (heuristic — a ✅ row should carry a quote)
+	const proofCells = (cl.match(/"[^"]{8,}"[^|]*/g) || []).length;
+	check('checklist: ≥1 proof-of-read (verbatim quote in a ✅ row)', proofCells >= 1, `${proofCells} quote cell(s) found`);
+} else if (!isEngine) {
+	check('EXCAVATION-CHECKLIST.md present', false, 'no excavation checklist — Phase 1 protocol requires one');
+}
+
+// --- DISTILLATION-PROCESS-CHECKLIST.md (whole-pipeline tracking + the 3-empty-rounds deep-dive gate)
+const procPath = join(dir, 'DISTILLATION-PROCESS-CHECKLIST.md');
+if (existsSync(procPath)) {
+	const pc = readFileSync(procPath, 'utf8');
+	// dangling phases: ⬜/⏳ left in the phase-progress table at ship = a phase skipped
+	const danglingPhases = (pc.match(/\|\s*[⬜⏳][^|]*\|/gu) || []).length;
+	check('process: no dangling ⬜/⏳ phases (every phase completed)', danglingPhases === 0, danglingPhases ? `${danglingPhases} phase(s) not done` : '');
+	// deep-dive round log present
+	check('process: deep-dive round log present', /round log|\| *Round.*New findings/i.test(pc), 'add the round-log table');
+	// 3-empty-rounds gate recorded (≥3 consecutive zero-new rounds before leaving a phase)
+	const gateFired = /gate fires|3 consecutive (empty|zero)|GATE FIRES/i.test(pc);
+	check('process: 3-empty-rounds gate recorded (≥3 zero-new rounds)', gateFired, 'record a round-log row marked gate-fired before declaring any research phase done');
+} else if (!isEngine) {
+	check('DISTILLATION-PROCESS-CHECKLIST.md present', false, 'no process checklist — every phase + the 3-round deep-dive gate must be tracked');
+}
+
+// --- Placeholders ---
+const foundPlaceholders = PLACEHOLDERS.filter((re) => re.test(src));
+if (!isEngine) check('no unresolved placeholder text', foundPlaceholders.length === 0,
+	foundPlaceholders.map((re) => src.match(re)?.[0]).filter(Boolean).join(', '));
+
+// --- Self-containment (F9): references/sources should not dangle outside the dir ---
+const refsDir = join(dir, 'references');
+if (!isEngine) check('self-contained: no external repo paths in body (e.g. 07-调研/)',
+	!/[\w/-]*调研与分析?\/|src\/|source\//i.test(src.replace(/```[\s\S]*?```/g, '')),
+	'body references paths outside skill dir');
+
+// --- Software-specific assertions (if target: software) ---
+if (/target:\s*software/i.test(fmText) || /code-dna|代码表达DNA|code expression/i.test(src)) {
+	check('[software] Code Expression-DNA section present', /代码表达DNA|Code Expression-DNA|code.?dna/i.test(src));
+	check('[software] toolchain matrix present', /toolchain|eslint|oxlint|biome|tsconfig/i.test(src));
+	check('[software] distilled_against commit anchor', hasFm('distilled_against') || /distilled_against/i.test(src));
+}
+
+// --- Report ---
+console.log(`\nvalidate-skill-structure: ${name}`);
+console.log(`path: ${skillPath}\n`);
+passes.forEach((l) => console.log(l));
+failures.forEach((l) => console.log(l));
+console.log(`\n${passes.length} pass, ${failures.length} fail — ${failures.length === 0 ? '✅ ALL-GREEN (may ship)' : '🔴 NOT READY (iterate Phase 2→3)'}${isEngine ? ' [engine mode — generated-skill checks skipped]' : ''}\n`);
+process.exit(failures.length === 0 ? 0 : 1);

package/skills/research/scripts/verify_citations.py

@@ -0,0 +1,225 @@
+#!/usr/bin/env python3
+"""
+verify_citations.py — borrowed from Geek-skills-deep-research, ported for the
+research skill (F13: wired INTO the Agentic Protocol Step 2, never orphaned).
+
+Structural citation-integrity checker: resolves every citation marker `[n]` in
+the report against the LOCAL source pool (sources.json); flags unresolved
+citations, dangling references, non-sequential numbering, and source
+concentration (> 25% from any single source).
+
+⚠️  This is a STRUCTURAL check only — it does NOT make network requests.
+It does NOT verify HTTP 404s, redirect chains, or content-drift. A URL that
+has gone dead or been hijacked will still pass if it matches the local source
+pool. For live-URL verification, use a separate network checker (e.g.
+WebFetch HEAD) before relying on citation-liveness.
+
+Stdlib only. Python 3.9+.
+
+Usage:
+    python3 verify_citations.py <report.md> <sources.json> [--output results.json]
+    python3 verify_citations.py --self-test    # run a quick self-test
+
+Exit codes:
+    0  no unresolved / no dangling / no concentration issues
+    1  one or more issues found (see --output report)
+    2  usage error
+"""
+import json
+import re
+import sys
+from pathlib import Path
+from urllib.parse import urlparse
+
+
+SOURCE_CONCENTRATION_LIMIT = 0.25  # No single source > 25% of citations
+
+
+def normalize_url(url: str) -> str:
+    """Lowercase + strip trailing slash + strip common tracking params."""
+    url = url.strip().rstrip("/")
+    parsed = urlparse(url.lower())
+    drop_params = {"utm_source", "utm_medium", "utm_campaign", "ref", "fbclid", "gclid"}
+    # Best-effort: keep query but strip params in drop_params
+    if parsed.query:
+        parts = [p for p in parsed.query.split("&") if p.split("=")[0] not in drop_params]
+        query = "&".join(parts)
+    else:
+        query = ""
+    return f"{parsed.scheme}://{parsed.netloc}{parsed.path}{('?' + query) if query else ''}".rstrip("/")
+
+
+def url_signature(url: str):
+    """Robust (domain, path_segments[:3]) for matching."""
+    parsed = urlparse(url.lower())
+    host = parsed.hostname or ""
+    if host.startswith("www."):
+        host = host[4:]
+    segments = [s for s in parsed.path.split("/") if s][:3]
+    return (host, tuple(segments))
+
+
+def extract_citations(text: str):
+    """Find [n] markers in body. Returns list of int indices."""
+    return [int(m) for m in re.findall(r"\[(\d+)\]", text)]
+
+
+def extract_references(text: str):
+    """Find reference list. Returns dict {int_idx: (label, url)}."""
+    refs = {}
+    # Match common patterns: [1] Label — URL or [1] Label - http...
+    for m in re.finditer(r"^\s*\[(\d+)\]\s+([^—\-]+?)\s*[—\-]\s*(\S+)", text, re.MULTILINE):
+        refs[int(m.group(1))] = (m.group(2).strip(), m.group(3).strip())
+    return refs
+
+
+def main(argv):
+    if not argv or argv[0] in ("-h", "--help"):
+        print(__doc__)
+        return 0
+    if argv[0] == "--self-test":
+        return self_test()
+    if len(argv) < 2:
+        print("Usage: verify_citations.py <report.md> <sources.json> [--output results.json]", file=sys.stderr)
+        return 2
+
+    report_path = Path(argv[0])
+    sources_path = Path(argv[1])
+    output_path = None
+    if len(argv) >= 4 and argv[2] == "--output":
+        output_path = Path(argv[3])
+
+    report = report_path.read_text(encoding="utf-8")
+    sources_data = json.loads(sources_path.read_text(encoding="utf-8"))
+
+    sources = sources_data.get("sources", [])
+    sources_normalized = {normalize_url(s["url"]): s for s in sources}
+
+    citations = extract_citations(report)
+    refs = extract_references(report)
+
+    issues = []
+    stats = {
+        "report_citations": len(citations),
+        "unique_citations": len(set(citations)),
+        "references_declared": len(refs),
+        "sources_in_pool": len(sources),
+        "concentration": {},
+    }
+
+    # 1. Every [n] has a matching reference
+    for c in set(citations):
+        if c not in refs:
+            issues.append({
+                "severity": "fatal",
+                "type": "unresolved_citation",
+                "detail": f"Citation [{c}] has no matching reference entry",
+            })
+
+    # 2. Every reference URL exists in source pool
+    for idx, (label, url) in refs.items():
+        if normalize_url(url) not in sources_normalized:
+            # Try signature match
+            sig = url_signature(url)
+            match = None
+            for s_url, s in sources_normalized.items():
+                if url_signature(s_url) == sig:
+                    match = s
+                    break
+            if not match:
+                issues.append({
+                    "severity": "fatal",
+                    "type": "url_not_in_source_pool",
+                    "detail": f"Reference [{idx}] URL '{url}' not found in source pool",
+                })
+
+    # 3. Dangling references (in list but never cited)
+    for idx in refs:
+        if idx not in set(citations):
+            issues.append({
+                "severity": "warn",
+                "type": "dangling_reference",
+                "detail": f"Reference [{idx}] declared but never cited in body",
+            })
+
+    # 4. Sequential numbering, no gaps
+    if refs:
+        max_idx = max(refs.keys())
+        missing = [i for i in range(1, max_idx + 1) if i not in refs]
+        if missing:
+            issues.append({
+                "severity": "warn",
+                "type": "non_sequential_numbering",
+                "detail": f"Reference numbering gaps: {missing}",
+            })
+
+    # 5. Source concentration
+    cite_counts = {}
+    for c in citations:
+        if c in refs:
+            label = refs[c][0]
+            cite_counts[label] = cite_counts.get(label, 0) + 1
+    total = max(len(citations), 1)
+    for label, count in cite_counts.items():
+        ratio = count / total
+        stats["concentration"][label] = round(ratio, 3)
+        if ratio > SOURCE_CONCENTRATION_LIMIT:
+            issues.append({
+                "severity": "fatal",
+                "type": "source_concentration",
+                "detail": f"Source '{label}' has {count}/{total} citations ({ratio*100:.1f}%) > {SOURCE_CONCENTRATION_LIMIT*100:.0f}% limit",
+            })
+
+    result = {
+        "ok": all(i["severity"] != "fatal" for i in issues),
+        "stats": stats,
+        "issues": issues,
+    }
+
+    if output_path:
+        output_path.write_text(json.dumps(result, indent=2), encoding="utf-8")
+    else:
+        print(json.dumps(result, indent=2))
+
+    return 0 if result["ok"] else 1
+
+
+def self_test():
+    """Run a quick self-test on a fabricated report."""
+    report = """# Test
+
+Claim one [1]. Claim two [2]. Claim three [3]. Claim four [4]. Claim five [5].
+
+## References
+
+[1] Author A — https://example.com/a
+[2] Author B — https://example.org/b
+[3] Author C — https://example.net/c
+[4] Author D — https://example.io/d
+[5] Author E — https://example.dev/e
+"""
+    sources = {
+        "sources": [
+            {"url": "https://example.com/a", "title": "Author A's paper"},
+            {"url": "https://example.org/b", "title": "Author B's notes"},
+            {"url": "https://example.net/c", "title": "Author C's x"},
+            {"url": "https://example.io/d", "title": "Author D's y"},
+            {"url": "https://example.dev/e", "title": "Author E's z"},
+        ]
+    }
+    import tempfile
+    with tempfile.NamedTemporaryFile("w", suffix=".md", delete=False) as f:
+        f.write(report)
+        rp = f.name
+    with tempfile.NamedTemporaryFile("w", suffix=".json", delete=False) as f:
+        json.dump(sources, f)
+        sp = f.name
+    code = main([rp, sp])
+    Path(rp).unlink()
+    Path(sp).unlink()
+    print(f"\nself-test: exit={code} (expected 0 — 1 citation per source, no concentration)")
+    return code
+
+
+if __name__ == "__main__":
+    sys.exit(main(sys.argv[1:]))

package/skills/security-priority.json

@@ -0,0 +1,28 @@
+{
+  "version": "1.0.0",
+  "generated": "2026-05-28T06:10:00Z",
+  "source": "source/Anthropic-Cybersecurity-Skills/",
+  "description": "Prioritized security skills for pi-crew security-reviewer role",
+  "priority_skills": [
+    { "id": "detecting-ai-model-prompt-injection-attacks", "priority": "critical", "atlas": ["AML.T0051"], "category": "agent-security" },
+    { "id": "detecting-supply-chain-attacks-in-ci-cd", "priority": "critical", "atlas": ["AML.T0010", "AML.T0104"], "category": "supply-chain" },
+    { "id": "detecting-anomalous-authentication-patterns", "priority": "high", "atlas": ["AML.T0043", "AML.T0018"], "category": "auth" },
+    { "id": "detecting-typosquatting-packages-in-npm-pypi", "priority": "high", "atlas": [], "category": "supply-chain" },
+    { "id": "detecting-path-traversal", "priority": "high", "atlas": [], "category": "code-security" },
+    { "id": "detecting-command-injection", "priority": "high", "atlas": [], "category": "code-security" },
+    { "id": "detecting-sensitive-data-exposure", "priority": "high", "atlas": ["AML.T0067"], "category": "secrets" },
+    { "id": "detecting-context-poisoning-in-agent-loops", "priority": "high", "atlas": ["AML.T0051"], "category": "agent-security" },
+    { "id": "detecting-tool-invocation-abuse", "priority": "medium", "atlas": ["AML.T0051", "AML.T0054"], "category": "agent-security" },
+    { "id": "detecting-malicious-skill-loading", "priority": "medium", "atlas": ["AML.T0062"], "category": "agent-security" },
+    { "id": "detecting-credential-leakage-in-logs", "priority": "medium", "atlas": [], "category": "secrets" },
+    { "id": "detecting-session-fixation", "priority": "medium", "atlas": ["AML.T0018"], "category": "auth" },
+    { "id": "detecting-data-exfiltration-indicators", "priority": "medium", "atlas": ["AML.T0067"], "category": "data-security" },
+    { "id": "detecting-serverless-function-injection", "priority": "medium", "atlas": [], "category": "code-security" },
+    { "id": "detecting-race-condition-vulnerabilities", "priority": "medium", "atlas": ["AML.T0054"], "category": "code-security" },
+    { "id": "detecting-agent-privilege-escalation", "priority": "medium", "atlas": ["AML.T0054"], "category": "agent-security" },
+    { "id": "detecting-malicious-npm-packages", "priority": "low", "atlas": [], "category": "supply-chain" },
+    { "id": "detecting-dependency-confusion-attacks", "priority": "low", "atlas": [], "category": "supply-chain" },
+    { "id": "detecting-token-hijacking", "priority": "low", "atlas": ["AML.T0018"], "category": "auth" },
+    { "id": "detecting-race-condition-in-file-operations", "priority": "low", "atlas": ["AML.T0054"], "category": "code-security" }
+  ]
+}

package/src/config/config.ts

@@ -707,6 +707,7 @@ function parseRuntimeConfig(value: unknown): CrewRuntimeConfig | undefined {
 		allowChildProcessFallback: parseWithSchema(Type.Boolean(), obj.allowChildProcessFallback),
 		maxTurns: parsePositiveInteger(obj.maxTurns, LIMIT_CEILINGS.runtimeMaxTurns),
 		graceTurns: parsePositiveInteger(obj.graceTurns, LIMIT_CEILINGS.runtimeGraceTurns),
+		taskTimeoutMs: parsePositiveInteger(obj.taskTimeoutMs, LIMIT_CEILINGS.runtimeMaxTurns),
 		inheritContext: parseWithSchema(Type.Boolean(), obj.inheritContext) ?? true,
 		promptMode: parseWithSchema(Type.Union([Type.Literal("replace"), Type.Literal("append")]), obj.promptMode),
 		groupJoin: parseWithSchema(Type.Union([Type.Literal("off"), Type.Literal("group"), Type.Literal("smart")]), obj.groupJoin),

package/src/config/role-tools.ts

@@ -11,10 +11,13 @@ export interface RoleToolConfig {
 }
 
 export const ROLE_TOOL_CONFIGS: Record<string, RoleToolConfig> = {
-	// Explorer - Read-only, no write or execute
+	// Explorer - Read-only exploration; bash is included for git log/show
+	// (decisions stream needs commit-history mining) but edit/write stay
+	// excluded. State-mutation safety is enforced separately by
+	// READ_ONLY_ROLES in role-permission.ts.
 	explorer: {
-		tools: ["read", "grep", "find", "ls", "glob"],
-		excludeTools: ["edit", "write", "bash", "web"],
+		tools: ["read", "grep", "find", "ls", "glob", "bash"],
+		excludeTools: ["edit", "write", "web"],
 	},
 
 	// Analyst - Read and analyze, limited execution

package/src/config/types.ts

@@ -44,6 +44,14 @@ export interface CrewRuntimeConfig {
 	allowChildProcessFallback?: boolean;
 	maxTurns?: number;
 	graceTurns?: number;
+	/**
+	 * W2 fix — wall-clock timeout per task in milliseconds. When the task
+	 * exceeds this limit, input.signal is aborted which triggers the existing
+	 * SIGTERM → SIGKILL escalation in child-pi.ts. Default 0 (no timeout).
+	 * Prevents runaway agent loops (e.g. 11_build in oh-my-pi distill run that
+	 * re-verified completed files 14+ times).
+	 */
+	taskTimeoutMs?: number;
 	inheritContext?: boolean;
 	promptMode?: "replace" | "append";
 	groupJoin?: "off" | "group" | "smart";

package/src/runtime/background-runner.ts

@@ -8,6 +8,7 @@ import { withRunLockSync } from "../state/locks.ts";
 import { createRunPaths, loadRunManifestById, saveRunManifestAsync, updateRunStatus } from "../state/state-store.ts";
 import type { TeamRunManifest, TeamTaskState } from "../state/types.ts";
 import { allTeams, discoverTeams } from "../teams/discover-teams.ts";
+import { errorMessage } from "../utils/guards.ts";
 import { projectCrewRoot } from "../utils/paths.ts";
 import { allWorkflows, discoverWorkflows } from "../workflows/discover-workflows.ts";
 // Heavy runtime — lazy-loaded to avoid pulling team-runner into background-runner
@@ -175,7 +176,7 @@ function setupUnhandledRejectionGuard(
 	setExitFlag: () => void,
 ): void {
 	process.on("unhandledRejection", (reason, promise) => {
-		const message = reason instanceof Error ? reason.message : String(reason);
+		const message = errorMessage(reason);
 		console.error("[background-runner] UNHANDLED REJECTION:", reason);
 		console.error("[background-runner] Stack:", reason instanceof Error ? reason.stack : "N/A");
 		try {
@@ -234,9 +235,7 @@ function runCleanup(
 	try {
 		killed = terminateActiveChildPiProcesses();
 	} catch (error) {
-		console.log(
-			`[background-runner] runCleanup: terminateActiveChildPiProcesses error: ${error instanceof Error ? error.message : String(error)}`,
-		);
+		console.log(`[background-runner] runCleanup: terminateActiveChildPiProcesses error: ${errorMessage(error)}`);
 	}
 	console.log(`[background-runner] runCleanup: killed ${killed} child processes`);
 	// FIX Issue #5: Unregister this worker from the orphan registry on exit.
@@ -245,13 +244,13 @@ function runCleanup(
 	try {
 		unregisterWorker(process.pid);
 	} catch (error) {
-		console.log(`[background-runner] runCleanup: unregisterWorker error: ${error instanceof Error ? error.message : String(error)}`);
+		console.log(`[background-runner] runCleanup: unregisterWorker error: ${errorMessage(error)}`);
 		if (eventsPath) {
 			try {
 				appendEvent(eventsPath, {
 					type: "background.unregister_worker_failed",
 					runId: argValue("--run-id") ?? "unknown",
-					message: `unregisterWorker failed: ${error instanceof Error ? error.message : String(error)}`,
+					message: `unregisterWorker failed: ${errorMessage(error)}`,
 					data: { pid: process.pid },
 				});
 			} catch {
@@ -391,7 +390,7 @@ async function main(): Promise<void> {
 			staleMs: 30_000,
 		});
 	} catch (lockErr) {
-		throw new Error(`Failed to acquire lock for run '${runId}': ${lockErr instanceof Error ? lockErr.message : String(lockErr)}`);
+		throw new Error(`Failed to acquire lock for run '${runId}': ${errorMessage(lockErr)}`);
 	}
 	if (!loaded) throw new Error(`Run '${runId}' not found.`);
 	let { manifest, tasks } = loaded;
@@ -750,9 +749,7 @@ async function main(): Promise<void> {
 				}
 				console.log(`[background-runner] executeTeamRun returned, status=${result.manifest.status}`);
 			} catch (execError) {
-				console.log(
-					`[background-runner] executeTeamRun THREW: ${execError instanceof Error ? execError.message : String(execError)}`,
-				);
+				console.log(`[background-runner] executeTeamRun THREW: ${errorMessage(execError)}`);
 				console.log(`[background-runner] stack: ${execError instanceof Error ? execError.stack : "N/A"}`);
 				throw execError;
 			}
@@ -782,7 +779,7 @@ async function main(): Promise<void> {
 		} catch {
 			/* best-effort */
 		}
-		const message = error instanceof Error ? error.message : String(error);
+		const message = errorMessage(error);
 		manifest = updateRunStatus(manifest, "failed", message);
 		appendEvent(manifest.eventsPath, {
 			type: "async.failed",
@@ -790,7 +787,7 @@ async function main(): Promise<void> {
 			message,
 		});
 		process.exitCode = 1;
-		console.log(`[background-runner] catch block, error=${error instanceof Error ? error.message : String(error)}`);
+		console.log(`[background-runner] catch block, error=${errorMessage(error)}`);
 	} finally {
 		// FIX Issue #4: Use shared runCleanup() function for consistent cleanup
 		// across all exit paths (normal, unhandled rejection, main() exception).
@@ -807,9 +804,7 @@ async function main(): Promise<void> {
 				manifest.eventsPath,
 			);
 		} catch (cleanupError) {
-			console.error(
-				`[background-runner] runCleanup threw: ${cleanupError instanceof Error ? cleanupError.message : String(cleanupError)}`,
-			);
+			console.error(`[background-runner] runCleanup threw: ${errorMessage(cleanupError)}`);
 		}
 		// NOTE: If exitDueToRejection was set, runCleanup() already called process.exit(1)
 		// so this finally block never continues past that point.
@@ -828,7 +823,7 @@ async function main(): Promise<void> {
 try {
 	await main();
 } catch (err) {
-	console.error(`[background-runner] DEBUG: main() uncaught: ${err instanceof Error ? err.message : String(err)}`);
+	console.error(`[background-runner] DEBUG: main() uncaught: ${errorMessage(err)}`);
 	// FIX Issue #1: Set the flag so the finally block's runCleanup() call
 	// will trigger process.exit(1) after cleanup completes. Previously this
 	// called process.exit(1) directly, bypassing the finally block and leaving

package/src/runtime/heartbeat-watcher.ts

@@ -1,4 +1,5 @@
 import * as fs from "node:fs";
+import * as path from "node:path";
 import type { NotificationDescriptor } from "../extension/notification-router.ts";
 import type { MetricRegistry } from "../observability/metric-registry.ts";
 import { appendEvent } from "../state/event-log.ts";
@@ -142,6 +143,28 @@ export class HeartbeatWatcher {
 				if (level === "dead" && isProcessAlive) {
 					level = "stale";
 				}
+				// W8 fix: completion-artifact check — prevents false-positive "dead"
+				// during the exit-before-manifest-update race. When a worker process
+				// exits normally after completing its task, the result artifact is
+				// already on disk, but the manifest status update may lag by a few
+				// seconds (status + finishedAt are set atomically in task-runner.ts).
+				// If the result file exists, the task completed — downgrade to
+				// "stale" so the watcher doesn't fire a misleading "dead" notification
+				// for a task that already produced its output.
+				// W8-fix-v2 — path-traversal defense-in-depth. task.id is
+				// generated internally (e.g. "ts1", "ts2") but we still
+				// resolve the candidate path and verify it's strictly
+				// contained within <artifactsRoot>/results/. If task.id
+				// contained "../" or absolute path segments, the containment
+				// check fails and we skip the W8 check (fail-closed: don't
+				// accidentally treat a malicious task ID as "completed").
+				if (level === "dead" && !isProcessAlive && loaded.manifest.artifactsRoot) {
+					const resultsDir = path.resolve(loaded.manifest.artifactsRoot, "results");
+					const candidate = path.resolve(resultsDir, `${task.id}.txt`);
+					if (candidate.startsWith(resultsDir + path.sep) && fs.existsSync(candidate)) {
+						level = "stale";
+					}
+				}
 				this.opts.registry
 					.gauge("crew.heartbeat.staleness_ms", "Heartbeat elapsed since last seen, milliseconds")
 					.set({ runId: run.runId, taskId: task.id }, Number.isFinite(elapsed) ? elapsed : thresholds.deadMs);
@@ -161,12 +184,16 @@ export class HeartbeatWatcher {
 							elapsedMs: Number.isFinite(elapsed) ? elapsed : undefined,
 						},
 					});
+					// W9 fix — prefix title with short run label (first 8 chars of runId)
+					// so ambient notifications are scannable when multiple runs are
+					// in flight. Full runId remains in the notification object.
+					const runLabel = run.runId.slice(0, 8);
 					this.opts.router.enqueue({
 						id: `dead_${run.runId}_${task.id}`,
 						severity: "warning",
 						source: "heartbeat-watcher",
 						runId: run.runId,
-						title: `Task ${task.id} heartbeat dead`,
+						title: `[${runLabel}] Task ${task.id} heartbeat dead`,
 						body: "Background watcher detected a stuck worker.",
 					});
 					this.opts.onDead?.(run.runId, task.id, Number.isFinite(elapsed) ? elapsed : thresholds.deadMs);