pi-crew 0.9.53 → 0.9.55

package/src/extension/team-tool/chain-executor.ts

@@ -0,0 +1,379 @@
+/**
+ * Concrete `ChainTaskRunner` that executes each chain step as a REAL team run.
+ *
+ * This is the production wiring that makes `ChainRunner` (and Fix C's
+ * `__chainHistoryNotes`) reachable: previously `ChainRunner` had zero production
+ * callers and only existed with unit-test mock runners. Each step delegates to
+ * the existing `handleRun` (which owns config load, team/workflow discovery,
+ * worktree preconditions, manifest creation, and `executeTeamRun`), so the
+ * ~200 lines of run machinery are NOT duplicated.
+ *
+ * Context passage (the whole point of the chain feature): `enrichContextFromHandoffs`
+ * places `__chainHistory` + `__chainHistoryNotes` into `packet.context`; this
+ * executor serializes them into a `# Previous Steps in This Chain` block that is
+ * prepended to the step's goal. `handleRun` → `executeTeamRun` → worker prompt,
+ * so step N+1's worker sees step N's handoff summary and the Fix C markers.
+ *
+ * Circular-import avoidance: `handleRun` is received as an INJECTED function
+ * reference (dependency injection) rather than a static import. `run.ts` lazy-
+ * imports `chain-dispatch.ts`, which imports this file. A static import of
+ * `run.ts` here would create a `run.ts ↔ chain-executor.ts` cycle that races
+ * module-record instantiation under jiti. The DI pattern breaks the cycle.
+ *
+ * @see src/runtime/chain-runner.ts (runChain, enrichContextFromHandoffs — Fix C)
+ * @see src/extension/team-tool/run.ts (handleRun — the reused machinery)
+ */
+
+import * as fs from "node:fs";
+import * as path from "node:path";
+import type { ChainTaskRunner } from "../../runtime/chain-runner.ts";
+import type { Decision, TaskPacket, TaskResult } from "../../runtime/handoff-manager.ts";
+import { readIfSmallWithTee } from "../../runtime/task-output-context.ts";
+import type { TeamToolParamsValue } from "../../schema/team-tool-schema.ts";
+import { atomicWriteFile } from "../../state/atomic-write.ts";
+import { createRunPaths, loadRunManifestById } from "../../state/state-store.ts";
+import type { TeamRunManifest, TeamTaskState } from "../../state/types.ts";
+import type { PiTeamsToolResult } from "../tool-result.ts";
+import { textFromToolResult } from "../tool-result.ts";
+import type { TeamContext } from "./context.ts";
+
+/**
+ * Signature of `handleRun`, declared locally (type-only) to break the
+ * import cycle with run.ts. Structurally identical to
+ * `(params, ctx) => Promise<PiTeamsToolResult>`.
+ */
+export type HandleRunFn = (params: TeamToolParamsValue, ctx: TeamContext) => Promise<PiTeamsToolResult>;
+
+/** Per-step team/workflow/model overrides forwarded from the chain invocation. */
+export interface ChainExecutorOverrides {
+	team?: string;
+	workflow?: string;
+	model?: string;
+}
+
+/** Shape of one entry in `context.__chainHistory` produced by enrichContextFromHandoffs. */
+interface ChainHistoryEntry {
+	step?: string;
+	outcome?: string;
+	filesCreated?: string[];
+	filesModified?: string[];
+	decisions?: Decision[];
+	nextSteps?: string[];
+	outputText?: string;
+}
+
+/**
+ * Serialize `packet.context.__chainHistory` (+ `__chainHistoryNotes`) into a
+ * human-readable block prefixed with `# Previous Steps in This Chain`.
+ *
+ * This is the CRITICAL coupling that makes Fix C's `__chainHistoryNotes`
+ * markers visible to step N+1's worker: those markers travel as a sibling
+ * array on the context object, and only become worker-visible once formatted
+ * into the goal text here. Returns `""` when there is no history.
+ *
+ * Extracted as a pure function for unit testability (acceptance criterion 6c).
+ */
+export function formatChainHistory(context: Record<string, unknown>): string {
+	const history = context.__chainHistory;
+	if (!Array.isArray(history) || history.length === 0) {
+		return "";
+	}
+
+	const lines: string[] = ["# Previous Steps in This Chain", ""];
+
+	for (const raw of history) {
+		if (!raw || typeof raw !== "object") continue;
+		const entry = raw as ChainHistoryEntry;
+		const stepName = entry.step ?? "unknown";
+		const outcome = entry.outcome ?? "unknown";
+		lines.push(`## Step ${stepName}: ${outcome}`);
+		lines.push(`Files created: ${entry.filesCreated?.length ? entry.filesCreated.join(", ") : "none"}`);
+		lines.push(`Files modified: ${entry.filesModified?.length ? entry.filesModified.join(", ") : "none"}`);
+		if (entry.decisions?.length) {
+			lines.push("Decisions:");
+			for (const d of entry.decisions) {
+				const rationale = d && typeof d === "object" && "rationale" in d ? String(d.rationale) : "(undocumented)";
+				const decisionOutcome = d && typeof d === "object" && "outcome" in d ? String(d.outcome) : "";
+				lines.push(`- ${rationale}${decisionOutcome ? ` → ${decisionOutcome}` : ""}`);
+			}
+		}
+		if (entry.nextSteps?.length) {
+			lines.push("Next steps:");
+			for (const ns of entry.nextSteps) lines.push(`- ${ns}`);
+		}
+		if (entry.outputText) {
+			lines.push("Output:");
+			lines.push(entry.outputText);
+		}
+		lines.push("");
+	}
+
+	// Append Fix C honesty markers verbatim — these note elided/oversized history.
+	const notes = context.__chainHistoryNotes;
+	if (Array.isArray(notes)) {
+		for (const note of notes) {
+			if (typeof note === "string" && note.length > 0) lines.push(note);
+		}
+	}
+
+	return lines.join("\n").trimEnd();
+}
+
+/**
+ * Map a completed team run's manifest+tasks → a chain `TaskResult`.
+ *
+ * Outcome is derived from the manifest status, cross-checked against task
+ * statuses (a run that completed but with a failed task reads as "partial").
+ * `usage.totalTokens` sums each task's input+output tokens; `duration` from
+ * manifest timestamps; `error` is best-effort from the first failed task or
+ * the manifest summary. `filesCreated`/`filesModified` are intentionally left
+ * unset — `TeamTaskState` does not carry them, so we never fabricate them.
+ *
+ * Extracted as a pure function for unit testability (acceptance criterion 6b).
+ */
+export function mapRunToTaskResult(manifest: TeamRunManifest, tasks: TeamTaskState[]): TaskResult {
+	// Determine outcome from manifest status.
+	let outcome: TaskResult["outcome"];
+	if (manifest.status === "completed") {
+		outcome = "success";
+	} else if (manifest.status === "failed" || manifest.status === "blocked" || manifest.status === "cancelled") {
+		outcome = "failure";
+	} else {
+		// queued / planning / running → not terminal yet
+		outcome = "partial";
+	}
+
+	// Cross-check tasks: if a manifest claims completed but a task failed, it is partial.
+	const hasFailed = tasks.some((t) => t.status === "failed" || t.status === "needs_attention");
+	const hasCompleted = tasks.some((t) => t.status === "completed");
+	if (hasFailed && (hasCompleted || outcome === "success")) {
+		outcome = "partial";
+	}
+
+	// Token usage: sum task input + output.
+	let totalTokens = 0;
+	for (const t of tasks) {
+		totalTokens += (t.usage?.input ?? 0) + (t.usage?.output ?? 0);
+	}
+
+	// Duration from manifest timestamps.
+	let duration = 0;
+	const created = Date.parse(manifest.createdAt);
+	const updated = Date.parse(manifest.updatedAt);
+	if (!Number.isNaN(created) && !Number.isNaN(updated) && updated >= created) {
+		duration = updated - created;
+	}
+
+	// Error: best-effort from first failed task, else manifest summary.
+	let error: string | undefined;
+	if (outcome !== "success") {
+		const failedTask = tasks.find((t) => t.status === "failed");
+		error = failedTask?.error ?? manifest.summary;
+	}
+
+	const taskResult: TaskResult = {
+		outcome,
+		usage: { totalTokens },
+		duration,
+	};
+	if (error) taskResult.error = error;
+	return taskResult;
+}
+
+/**
+ * Read completed tasks' result artifacts and concatenate their output text.
+ * Mirrors the pattern in task-output-context.ts:collectDependencyOutputContext
+ * (readIfSmallWithTee with baseDir = artifactsRoot).
+ *
+ * Returns the concatenated output text, or undefined if no artifacts were readable.
+ */
+export function readChainStepOutput(manifest: TeamRunManifest, tasks: TeamTaskState[]): string | undefined {
+	const parts: string[] = [];
+	for (const t of tasks) {
+		if (t.status !== "completed" || !t.resultArtifact?.path) continue;
+		const read = readIfSmallWithTee(t.resultArtifact.path, {
+			baseDir: manifest.artifactsRoot,
+		});
+		if (read?.content && read.content.trim().length > 0) {
+			parts.push(read.content.trim());
+		}
+	}
+	return parts.length > 0 ? parts.join("\n\n") : undefined;
+}
+
+/**
+ * Concrete `ChainTaskRunner`: each step is a full team run via the injected
+ * `handleRun`. Step runIds are captured on `stepRunIds` so the dispatch can
+ * surface them in the summary and acceptance verification.
+ *
+ * Errors are intentionally NOT caught here — `runChain` wraps each step's
+ * `runTask` call in try/catch, records `outcome: "failure"`, and respects
+ * `continueOnError`. Letting exceptions propagate keeps the chain-runner's
+ * existing failure semantics intact.
+ */
+export class ChainTeamRunExecutor implements ChainTaskRunner {
+	/** RunId captured per executed step, in execution order. */
+	readonly stepRunIds: string[] = [];
+
+	private readonly handleRunRef: HandleRunFn;
+	private readonly ctx: TeamContext;
+	private readonly overrides: ChainExecutorOverrides;
+
+	constructor(opts: {
+		handleRun: HandleRunFn;
+		ctx: TeamContext;
+		overrides?: ChainExecutorOverrides;
+	}) {
+		this.handleRunRef = opts.handleRun;
+		this.ctx = opts.ctx;
+		this.overrides = opts.overrides ?? {};
+	}
+
+	async runTask(packet: TaskPacket): Promise<TaskResult> {
+		const context = packet.context ?? {};
+
+		// 1. Format chain history into the goal — this is how context reaches the worker.
+		//    Mirrors the parentContext pattern in child-pi.ts (parent context + task delimiter).
+		const historyPrefix = formatChainHistory(context);
+		const enrichedGoal = historyPrefix ? `${historyPrefix}\n\n---\n# Current Chain Step\n${packet.goal}` : packet.goal;
+
+		// 2. Resolve team/workflow/model: step config (set by executeStep) → overrides → default.
+		const stepTeam = (context.__chainStepTeam as string | undefined) ?? this.overrides.team ?? "default";
+		const stepWorkflow = (context.__chainStepWorkflow as string | undefined) ?? this.overrides.workflow;
+		const stepModel = (context.__chainStepModel as string | undefined) ?? this.overrides.model;
+
+		// 3. Call handleRun for the heavy lifting. async:false forces each step to
+		//    complete synchronously (overrides asyncByDefault) so the chain is sequential.
+		//    NO `chain` key here — so the run.ts guard does not re-enter chain dispatch.
+		const runParams: TeamToolParamsValue = {
+			action: "run",
+			goal: enrichedGoal,
+			team: stepTeam,
+			async: false,
+			...(stepWorkflow ? { workflow: stepWorkflow } : {}),
+			...(stepModel ? { model: stepModel } : {}),
+		};
+		const runRes = await this.handleRunRef(runParams, this.ctx);
+
+		// 4. Extract runId + map to TaskResult. If no runId, the run was blocked before
+		//    a manifest existed — map as a failure.
+		const runId = runRes.details?.runId;
+		if (!runId) {
+			return {
+				outcome: "failure",
+				error: textFromToolResult(runRes) || "Chain step produced no runId",
+			};
+		}
+		this.stepRunIds.push(runId);
+
+		const cwd = this.ctx.cwd ?? process.cwd();
+		const loaded = loadRunManifestById(cwd, runId);
+		if (!loaded) {
+			// Manifest not loadable — fall back to the tool result's own status.
+			return {
+				outcome: runRes.details?.status === "error" ? "failure" : "partial",
+			};
+		}
+		const result = mapRunToTaskResult(loaded.manifest, loaded.tasks);
+		const outputText = readChainStepOutput(loaded.manifest, loaded.tasks);
+		if (outputText) result.outputText = outputText;
+		return result;
+	}
+}
+
+// ─── test helpers (exported for unit/integration tests) ──────────────────
+
+/**
+ * Write a minimal valid run fixture (manifest + tasks + events) to `cwd`'s
+ * state root so `loadRunManifestById(cwd, runId)` validates and returns it.
+ * Used by integration tests to exercise `ChainTeamRunExecutor` with a mocked
+ * `handleRun` while still going through the REAL manifest loader + result mapper.
+ */
+export function writeRunFixture(
+	cwd: string,
+	runId: string,
+	opts: {
+		status?: TeamRunManifest["status"];
+		tasks?: TeamTaskState[];
+		summary?: string;
+		/** Worker result text to write to results/<taskId>.txt (sets resultArtifact on tasks). */
+		resultText?: string;
+		/** Task ID for the result artifact (default: "01_task"). */
+		taskId?: string;
+	},
+): TeamRunManifest {
+	const paths = createRunPaths(cwd, runId);
+	fs.mkdirSync(paths.stateRoot, { recursive: true });
+	const now = new Date().toISOString();
+	const start = new Date(Date.now() - 10_000).toISOString();
+	const taskId = opts.taskId ?? "01_task";
+
+	// Build tasks: if resultText is provided without explicit tasks, create a
+	// default completed task carrying a resultArtifact pointing at the result file.
+	let tasks = opts.tasks;
+	if (opts.resultText) {
+		const resultArtifact = {
+			kind: "result" as const,
+			path: `results/${taskId}.txt`,
+			createdAt: now,
+			producer: "worker",
+			retention: "run" as const,
+		};
+		if (!tasks || tasks.length === 0) {
+			tasks = [
+				{
+					id: taskId,
+					runId,
+					role: "executor",
+					agent: "executor",
+					title: "(chain step fixture)",
+					status: "completed",
+					dependsOn: [],
+					cwd,
+					resultArtifact,
+				},
+			];
+		} else {
+			// Attach resultArtifact to the first task if it doesn't have one.
+			tasks = tasks.map((t, i) => (i === 0 && !t.resultArtifact ? { ...t, resultArtifact } : t));
+		}
+	}
+
+	const manifest: TeamRunManifest = {
+		schemaVersion: 1,
+		runId,
+		team: "default",
+		workflow: "default",
+		goal: "(chain step fixture)",
+		status: opts.status ?? "completed",
+		workspaceMode: "single",
+		createdAt: start,
+		updatedAt: now,
+		cwd,
+		stateRoot: paths.stateRoot,
+		artifactsRoot: paths.artifactsRoot,
+		tasksPath: paths.tasksPath,
+		eventsPath: paths.eventsPath,
+		artifacts: [],
+		...(opts.summary ? { summary: opts.summary } : {}),
+	};
+
+	// Write the result artifact file + register on manifest if resultText provided.
+	if (opts.resultText) {
+		const resultDir = path.join(paths.artifactsRoot, "results");
+		fs.mkdirSync(resultDir, { recursive: true });
+		atomicWriteFile(path.join(resultDir, `${taskId}.txt`), opts.resultText);
+		manifest.artifacts.push({
+			kind: "result",
+			path: `results/${taskId}.txt`,
+			createdAt: now,
+			producer: "worker",
+			retention: "run",
+		});
+	}
+
+	atomicWriteFile(paths.manifestPath, JSON.stringify(manifest));
+	atomicWriteFile(paths.tasksPath, JSON.stringify(tasks ?? []));
+	atomicWriteFile(paths.eventsPath, "");
+	return manifest;
+}

package/src/extension/team-tool/config-patch.ts

@@ -0,0 +1,50 @@
+import { effectiveAutonomousConfig, type PiTeamsAutonomousConfig, type PiTeamsConfig, parseConfig } from "../../config/config.ts";
+
+const DANGEROUS_KEYS = new Set(["__proto__", "constructor", "prototype"]);
+
+/** Recursively strip dangerous prototype-pollution keys from all levels of an object. */
+export function sanitizeObject<T>(obj: T): T {
+	if (obj === null || obj === undefined || typeof obj !== "object") return obj;
+	if (Array.isArray(obj)) return obj.map((item) => sanitizeObject(item)) as T;
+	const safe: Record<string, unknown> = {};
+	for (const key of Object.keys(obj as Record<string, unknown>)) {
+		if (DANGEROUS_KEYS.has(key)) continue;
+		safe[key] = sanitizeObject((obj as Record<string, unknown>)[key]);
+	}
+	return safe as T;
+}
+
+export function autonomousPatchFromConfig(config: unknown): PiTeamsAutonomousConfig {
+	const rootPatch = parseConfig(config).autonomous;
+	if (rootPatch) return rootPatch;
+	return parseConfig({ autonomous: config }).autonomous ?? {};
+}
+
+export function configPatchFromConfig(config: unknown): PiTeamsConfig {
+	return parseConfig(config);
+}
+
+export function effectiveRunConfig(base: PiTeamsConfig, rawOverride: unknown): PiTeamsConfig {
+	const patch = sanitizeObject(parseConfig(rawOverride));
+	return {
+		...base,
+		...patch,
+		limits: patch.limits ? { ...(base.limits ?? {}), ...patch.limits } : base.limits,
+		runtime: patch.runtime ? { ...(base.runtime ?? {}), ...patch.runtime } : base.runtime,
+		control: patch.control ? { ...(base.control ?? {}), ...patch.control } : base.control,
+		worktree: patch.worktree ? { ...(base.worktree ?? {}), ...patch.worktree } : base.worktree,
+	};
+}
+
+export function formatAutonomyStatus(config: PiTeamsAutonomousConfig | undefined, pathValue: string, updated: boolean): string {
+	const effective = effectiveAutonomousConfig(config);
+	return [
+		updated ? "Updated pi-crew autonomous mode." : "pi-crew autonomous mode:",
+		`Path: ${pathValue}`,
+		`Profile: ${effective.profile}`,
+		`Enabled: ${effective.enabled}`,
+		`Inject policy: ${effective.injectPolicy}`,
+		`Prefer async for long tasks: ${effective.preferAsyncForLongTasks}`,
+		`Allow worktree suggestion: ${effective.allowWorktreeSuggestion}`,
+	].join("\n");
+}

package/src/extension/team-tool/context.ts

@@ -0,0 +1,149 @@
+import type { ExtensionContext } from "@earendil-works/pi-coding-agent";
+
+import type { PiTeamsConfig } from "../../config/config.ts";
+import type { MetricRegistry } from "../../observability/metric-registry.ts";
+import type { RunSnapshotCache } from "../../ui/run-snapshot-cache.ts";
+import type { TeamToolDetails } from "../team-tool-types.ts";
+import { type PiTeamsToolResult, toolResult } from "../tool-result.ts";
+
+export type TeamContext = Pick<ExtensionContext, "cwd"> &
+	Partial<Pick<ExtensionContext, "model">> & {
+		sessionId?: string;
+		modelRegistry?: unknown;
+		sessionManager?: { getBranch?: () => unknown[] };
+		events?: { emit?: (event: string, data: unknown) => void };
+		metricRegistry?: MetricRegistry;
+		signal?: AbortSignal;
+		startForegroundRun?: (runner: (signal?: AbortSignal) => Promise<void>, runId?: string) => void;
+		abortForegroundRun?: (runId: string) => boolean;
+		onRunStarted?: (runId: string) => void;
+		onJsonEvent?: (taskId: string, runId: string, event: unknown) => void;
+		config?: PiTeamsConfig;
+		getRunSnapshotCache?: (cwd: string) => RunSnapshotCache;
+	};
+
+export function withSessionId<T extends Pick<ExtensionContext, "sessionManager">>(ctx: T): T & { sessionId?: string } {
+	const sessionId = ctx.sessionManager?.getSessionId?.();
+	return sessionId ? { ...ctx, sessionId } : { ...ctx };
+}
+
+export function result(text: string, details: TeamToolDetails, isError = false): PiTeamsToolResult {
+	return toolResult(text, details, isError);
+}
+
+export function formatScoped(name: string, source: string, description: string): string {
+	return `- ${name} (${source}): ${description}`;
+}
+
+function extractTextContent(content: unknown): string {
+	if (typeof content === "string") return content;
+	if (!Array.isArray(content)) return "";
+	return content
+		.map((part) =>
+			part && typeof part === "object" && !Array.isArray(part) && typeof (part as { text?: unknown }).text === "string"
+				? (part as { text: string }).text
+				: "",
+		)
+		.filter(Boolean)
+		.join("\n");
+}
+
+/**
+ * Maximum character budget for inherited parent context (~3K tokens).
+ * When exceeded, oldest messages are dropped first (most-recent-first retention).
+ */
+export const MAX_PARENT_CONTEXT_CHARS = 12_000;
+
+/** Maximum chars for a single assistant message before truncation. */
+const MAX_ASSISTANT_MSG_CHARS = 500;
+
+/** Truncated length for oversized assistant messages. */
+const TRUNCATED_ASSISTANT_CHARS = 200;
+
+/** Messages starting with these patterns and exceeding this size are likely
+ *  file dumps / bash output — skip them to keep context relevant and compact. */
+const NOISY_THRESHOLD = 1_000;
+const NOISY_PREFIXES = ["```", "total ", "drwx", "-rw", "import ", "export "];
+
+/**
+ * Check if a message looks like noisy file/tool output (code dumps, ls output,
+ * import lists) that bloats context without helping the subagent.
+ */
+function isNoisyContent(text: string): boolean {
+	if (text.length < NOISY_THRESHOLD) return false;
+	return NOISY_PREFIXES.some((prefix) => text.startsWith(prefix));
+}
+
+/**
+ * Build a compact parent conversation context for subagent inheritance.
+ *
+ * Extracts recent user messages, assistant reasoning, and compaction summaries
+ * from the parent session. Applies a character budget (most-recent-first
+ * retention) and filters noisy content (file dumps, long bash output) to keep
+ * the inherited context relevant without bloating the subagent's token budget.
+ */
+export function buildParentContext(ctx: TeamContext): string | undefined {
+	const branch = ctx.sessionManager?.getBranch?.();
+	if (!Array.isArray(branch) || branch.length === 0) return undefined;
+	const parts: string[] = [];
+	for (const entry of branch.slice(-20)) {
+		if (!entry || typeof entry !== "object" || Array.isArray(entry)) continue;
+		const record = entry as {
+			type?: unknown;
+			message?: unknown;
+			summary?: unknown;
+		};
+		// Compaction summaries are always valuable — keep in full.
+		if (record.type === "compaction" && typeof record.summary === "string") {
+			parts.push(`[Summary]: ${record.summary}`);
+			continue;
+		}
+		const message =
+			record.message && typeof record.message === "object" && !Array.isArray(record.message)
+				? (record.message as { role?: unknown; content?: unknown })
+				: undefined;
+		if (!message || (message.role !== "user" && message.role !== "assistant")) continue;
+		let text = extractTextContent(message.content).trim();
+		if (!text) continue;
+		// Filter: skip noisy content (file dumps, long bash output).
+		if (isNoisyContent(text)) continue;
+		// Truncate: long assistant messages get shortened to key points.
+		if (message.role === "assistant" && text.length > MAX_ASSISTANT_MSG_CHARS) {
+			text = `${text.slice(0, TRUNCATED_ASSISTANT_CHARS)}…`;
+		}
+		parts.push(`[${message.role === "user" ? "User" : "Assistant"}]: ${text}`);
+	}
+	if (!parts.length) return undefined;
+
+	// Budget: keep most-recent messages first, drop oldest when over budget.
+	let totalChars = 0;
+	const budgeted: string[] = [];
+	for (const part of [...parts].reverse()) {
+		if (totalChars + part.length > MAX_PARENT_CONTEXT_CHARS) break;
+		budgeted.unshift(part);
+		totalChars += part.length;
+	}
+	if (!budgeted.length) return undefined;
+
+	return [
+		`# Parent Conversation Context`,
+		"The following context was inherited from the parent Pi session. Treat it as reference-only.",
+		"",
+		budgeted.join("\n\n"),
+	].join("\n");
+}
+
+export function configRecord(config: unknown): Record<string, unknown> {
+	if (!config || typeof config !== "object" || Array.isArray(config)) return {};
+	// AUDIT-07 defense-in-depth: filter prototype-pollution keys. Callers (api, doctor,
+	// lifecycle-actions, intent-policy, team-tool) pass `params.config` from the team-tool
+	// invocation which is NOT sanitized by the same loadConfig/sanitizeObject path.
+	const obj = config as Record<string, unknown>;
+	const DANGEROUS_KEYS = new Set(["__proto__", "constructor", "prototype"]);
+	const safe: Record<string, unknown> = {};
+	for (const [k, v] of Object.entries(obj)) {
+		if (DANGEROUS_KEYS.has(k)) continue;
+		safe[k] = v;
+	}
+	return safe;
+}

package/src/extension/team-tool/destructive-gate.ts

@@ -0,0 +1,52 @@
+/**
+ * Permission gate logic for destructive team actions (delete/forget/prune/cleanup).
+ *
+ * Extracted from register.ts `pi.on("tool_call")` handler into a pure function
+ * so the gate logic is unit-testable in isolation (the handler itself is hard
+ * to test because it's an async event listener on the Pi extension API).
+ *
+ * Returns `undefined` when the action is ALLOWED, or a block `reason` string
+ * when it should be blocked. The handler wraps this and emits the `{block, reason}`
+ * shape Pi expects.
+ *
+ * Rules (in order):
+ *  1. Non-team / non-destructive actions → allowed (caller pre-filters, but safe).
+ *  2. `cleanup` with `dryRun=true` → ALWAYS allowed (a preview writes nothing,
+ *     so gating it would block users from previewing what cleanup would do —
+ *     this was a UX bug: team action=cleanup dryRun=true returned "requires
+ *     confirm=true" even though it changed no files).
+ *  3. `confirm=true` on the input → allowed (explicit user intent).
+ *  4. `delete` with `force=true` → allowed (force bypasses reference checks).
+ *  5. Otherwise → blocked with a reason telling the user what to pass.
+ */
+
+export const DESTRUCTIVE_TEAM_ACTIONS = new Set([
+	"delete",
+	"forget",
+	"prune",
+	"cleanup",
+	"workflow-create",
+	"workflow-save",
+	"workflow-delete",
+]);
+
+export interface TeamToolInputLike {
+	action?: unknown;
+	confirm?: unknown;
+	force?: unknown;
+	dryRun?: unknown;
+}
+
+/**
+ * Decide whether a destructive team action should be blocked.
+ * @returns block reason string, or `undefined` to allow.
+ */
+export function shouldBlockDestructiveTeamAction(action: string | undefined, input: TeamToolInputLike): string | undefined {
+	if (!action || !DESTRUCTIVE_TEAM_ACTIONS.has(action)) return undefined;
+	// dryRun cleanup is a PREVIEW (no writes) — never needs confirm.
+	if (action === "cleanup" && input.dryRun === true) return undefined;
+	if (input.confirm === true) return undefined;
+	const forceBypassesReferenceChecks = action === "delete" && input.force === true;
+	if (forceBypassesReferenceChecks) return undefined;
+	return `Destructive action '${action}' requires confirm=true${action === "delete" ? " (or force=true to bypass reference checks)" : ""}.`;
+}