pi-crew 0.9.53 → 0.9.55

package/src/extension/team-tool/status.ts

@@ -0,0 +1,260 @@
+import { loadConfig } from "../../config/config.ts";
+import { applyAttentionState, formatActivityAge, resolveCrewControlConfig } from "../../runtime/agent-control.ts";
+import { extractCommandTrace } from "../../runtime/command-trace.ts";
+import { verifyTaskCompletion } from "../../runtime/completion-guard.ts";
+import { readCrewAgents } from "../../runtime/crew-agent-records.ts";
+import { evaluateRunEffectiveness } from "../../runtime/effectiveness.ts";
+import { computePhaseProgress } from "../../runtime/phase-progress.ts";
+import { checkProcessLiveness, isActiveRunStatus } from "../../runtime/process-status.ts";
+import { formatTaskGraphLines, waitingReason } from "../../runtime/task-display.ts";
+import type { TeamToolParamsValue } from "../../schema/team-tool-schema.ts";
+import { appendEvent, readEvents } from "../../state/event-log.ts";
+import { readDeliveryState, readMailbox } from "../../state/mailbox.ts";
+import { loadRunManifestById, saveRunTasks, updateRunStatus } from "../../state/state-store.ts";
+import { aggregateUsage, formatCost, formatUsage } from "../../state/usage.ts";
+import { formatDuration } from "../../ui/format-helpers.ts";
+import { locateRunCwd } from "../team-tool.ts";
+import type { PiTeamsToolResult } from "../tool-result.ts";
+import { result, type TeamContext } from "./context.ts";
+import { RUN_NOT_FOUND_HINT } from "./run-not-found.ts";
+
+export function handleStatus(params: TeamToolParamsValue, ctx: TeamContext): PiTeamsToolResult {
+	if (!params.runId) return result("Status requires runId.", { action: "status", status: "error" }, true);
+	const runCwd = locateRunCwd(params.runId, ctx.cwd);
+	if (!runCwd) return result(`Run '${params.runId}' not found.${RUN_NOT_FOUND_HINT}`, { action: "status", status: "error" }, true);
+	const loaded = loadRunManifestById(runCwd, params.runId); // NOTE: no withRunLock - best-effort only; concurrent writes may cause inconsistency
+	if (!loaded) return result(`Run '${params.runId}' not found.${RUN_NOT_FOUND_HINT}`, { action: "status", status: "error" }, true);
+	let { manifest, tasks } = loaded;
+	// DX (Round 16 F3): compact status mode. Default = full (backward compatible).
+	// details=false gives a tight summary (status, goal, counts, failed/attention
+	// errors) for quick checks without 40 lines of dense key=value noise.
+	const fullDetails = params.details !== false;
+	let asyncLivenessLine: string | undefined;
+	if (manifest.async) {
+		const asyncState = manifest.async;
+		const liveness = checkProcessLiveness(asyncState.pid);
+		asyncLivenessLine = `Async: pid=${asyncState.pid ?? "unknown"} alive=${liveness.alive ? "true" : "false"} detail=${liveness.detail} log=${asyncState.logPath} spawnedAt=${asyncState.spawnedAt}`;
+		if (!liveness.alive && isActiveRunStatus(manifest.status)) {
+			manifest = updateRunStatus(manifest, "failed", `Async process stale: ${liveness.detail}`);
+			tasks = tasks.map((task) =>
+				task.status === "running"
+					? {
+							...task,
+							status: "cancelled" as const,
+							finishedAt: new Date().toISOString(),
+							error: "Async process died; task was not completed.",
+						}
+					: task,
+			);
+			saveRunTasks(manifest, tasks);
+			appendEvent(manifest.eventsPath, {
+				type: "async.stale",
+				runId: manifest.runId,
+				message: liveness.detail,
+				data: { pid: asyncState.pid },
+			});
+		}
+	}
+	const counts = new Map<string, number>();
+	for (const task of tasks) counts.set(task.status, (counts.get(task.status) ?? 0) + 1);
+	const phaseProgress = computePhaseProgress(tasks);
+	const allEvents = readEvents(manifest.eventsPath);
+	const events = allEvents.slice(-8);
+	const attentionByTask = new Map(
+		allEvents.filter((event) => event.type === "task.attention" && event.taskId).map((event) => [event.taskId!, event]),
+	);
+	const controlConfig = resolveCrewControlConfig(loadConfig(ctx.cwd).config);
+	const crewAgents = readCrewAgents(manifest).map((agent) => applyAttentionState(manifest, agent, controlConfig));
+	const artifactLines = manifest.artifacts
+		.slice(-10)
+		.map(
+			(artifact) => `- ${artifact.kind}: ${artifact.path}${artifact.sizeBytes !== undefined ? ` (${artifact.sizeBytes} bytes)` : ""}`,
+		);
+	const deliveryState = readDeliveryState(manifest);
+	const ackTimeoutMs = loadConfig(ctx.cwd).config.runtime?.groupJoinAckTimeoutMs;
+	const groupJoinLines: string[] = [];
+	for (const message of readMailbox(manifest, "outbox")
+		.filter((m) => m.data?.kind === "group_join")
+		.slice(-5)) {
+		const ack = deliveryState.messages[message.id] === "acknowledged" ? "acknowledged" : "pending";
+		const ageMs = Date.now() - new Date(message.createdAt).getTime();
+		const requestId = String(message.data?.requestId ?? "unknown");
+		const timedOut = ack === "pending" && ackTimeoutMs !== undefined && Number.isFinite(ageMs) && ageMs > ackTimeoutMs;
+		if (timedOut && !allEvents.some((event) => event.type === "agent.group_join.ack_timeout" && event.data?.requestId === requestId)) {
+			appendEvent(manifest.eventsPath, {
+				type: "agent.group_join.ack_timeout",
+				runId: manifest.runId,
+				message: "Group join delivery ack timed out; mailbox delivery remains the fallback.",
+				data: {
+					requestId,
+					messageId: message.id,
+					batchId: message.data?.batchId,
+					partial: message.data?.partial,
+					ageMs,
+					ackTimeoutMs,
+				},
+			});
+		}
+		groupJoinLines.push(
+			`- ${String(message.data?.partial) === "true" ? "partial" : "completed"} request=${requestId} message=${message.id} ack=${timedOut ? "timeout" : ack}`,
+		);
+	}
+	const totalUsage = aggregateUsage(tasks);
+	const completedTasks = tasks.filter((task) => task.status === "completed");
+	const effectiveness = evaluateRunEffectiveness({
+		manifest,
+		tasks,
+		executeWorkers: manifest.runtimeResolution?.kind !== "scaffold",
+		runtimeConfig: loadConfig(ctx.cwd).config.runtime,
+	});
+	const noObservedWorkTasks = effectiveness.noObservedWorkTaskIds
+		.map((id) => tasks.find((task) => task.id === id))
+		.filter((task): task is (typeof tasks)[number] => task !== undefined);
+	const attentionTasks = effectiveness.needsAttentionTaskIds
+		.map((id) => tasks.find((task) => task.id === id))
+		.filter((task): task is (typeof tasks)[number] => task !== undefined);
+	const activeAgents = crewAgents.filter((agent) => agent.status === "running");
+	const completedAgents = crewAgents.filter((agent) => agent.status !== "running");
+	const waitingTasks = tasks.filter((task) => task.status === "queued" || task.status === "waiting");
+	const agentLine = (agent: (typeof crewAgents)[number]): string =>
+		`- ${agent.id} [${agent.status}] ${agent.role} -> ${agent.agent} runtime=${agent.runtime}${agent.model ? ` model=${agent.model}` : ""}${agent.usage ? ` usage=${formatUsage(agent.usage)}` : ""}${agent.usage?.cost ? ` cost=${formatCost(agent.usage.cost)}` : ""}${agent.progress?.activityState ? ` activityState=${agent.progress.activityState}` : ""}${formatActivityAge(agent) ? ` activity=${formatActivityAge(agent)}` : ""}${agent.progress?.currentTool ? ` tool=${agent.progress.currentTool}` : ""}${agent.toolUses ? ` tools=${agent.toolUses}` : ""}${!agent.usage && agent.progress?.tokens ? ` tokens=${agent.progress.tokens}` : ""}${agent.progress?.turns ? ` turns=${agent.progress.turns}` : ""}${agent.jsonEvents !== undefined ? ` jsonEvents=${agent.jsonEvents}` : ""}${agent.outputPath ? ` output=${agent.outputPath}` : ""}${agent.transcriptPath ? ` transcript=${agent.transcriptPath}` : ""}${agent.statusPath ? ` status=${agent.statusPath}` : ""}${agent.error ? ` error=${agent.error}` : ""}`;
+	const lines = [
+		`Run: ${manifest.runId}`,
+		`Team: ${manifest.team}`,
+		`Workflow: ${manifest.workflow ?? "(none)"}`,
+		`Status: ${manifest.status}`,
+		`Progress: ${phaseProgress.overallPercentage}% (~${formatDuration(phaseProgress.estimatedRemainingMs)} remaining)`,
+		`Workspace mode: ${manifest.workspaceMode}`,
+		...(manifest.runtimeResolution
+			? [
+					`Runtime: ${manifest.runtimeResolution.kind}`,
+					`Runtime safety: ${manifest.runtimeResolution.safety}`,
+					`Runtime requested: ${manifest.runtimeResolution.requestedMode}${manifest.runtimeResolution.reason ? ` (${manifest.runtimeResolution.reason})` : ""}`,
+				]
+			: []),
+		`Goal: ${manifest.goal}`,
+		`Created: ${manifest.createdAt}`,
+		`Updated: ${manifest.updatedAt}`,
+		`State: ${manifest.stateRoot}`,
+		`Artifacts: ${manifest.artifactsRoot}`,
+		...(asyncLivenessLine ? [asyncLivenessLine] : []),
+		"Task graph:",
+		...formatTaskGraphLines(tasks),
+		"Tasks:",
+		...(tasks.length
+			? tasks.map(
+					(task) =>
+						`- ${task.id} [${task.status}] ${task.role} -> ${task.agent}${task.taskPacket ? ` scope=${task.taskPacket.scope}` : ""}${task.verification ? ` green=${task.verification.observedGreenLevel}/${task.verification.requiredGreenLevel}` : ""}${task.modelAttempts?.length ? ` attempts=${task.modelAttempts.length}` : ""}${task.modelRouting ? ` modelRouting=${task.modelRouting.requested ? `${task.modelRouting.requested}->` : ""}${task.modelRouting.resolved}${task.modelRouting.usedAttempt ? ` attempt=${task.modelRouting.usedAttempt + 1}` : ""}` : ""}${task.agentProgress?.activityState ? ` activityState=${task.agentProgress.activityState}` : ""}${(() => {
+							const t = extractCommandTrace(task.agentProgress?.recentTools);
+							return t.summary ? ` ${t.summary}` : "";
+						})()}${attentionByTask.get(task.id)?.data?.reason ? ` attention=${String(attentionByTask.get(task.id)?.data?.reason)}` : ""}${task.jsonEvents !== undefined ? ` jsonEvents=${task.jsonEvents}` : ""}${task.usage ? ` usage=${JSON.stringify(task.usage)}` : ""}${task.resultArtifact ? ` result=${task.resultArtifact.path}` : ""}${task.transcriptArtifact ? ` transcript=${task.transcriptArtifact.path}` : ""}${task.worktree ? ` worktree=${task.worktree.path}` : ""}${task.error ? ` error=${task.error}` : ""}`,
+				)
+			: ["- (none)"]),
+		`Task counts: ${[...counts.entries()].map(([status, count]) => `${status}=${count}`).join(", ") || "none"}`,
+		"Effectiveness:",
+		`- observable=${effectiveness.observable}/${Math.max(1, effectiveness.completed)} completed tasks`,
+		`- workerExecution=${effectiveness.workerExecution} guard=${effectiveness.guardMode} severity=${effectiveness.severity}`,
+		`- noObservedWork=${effectiveness.noObservedWorkTaskIds.length ? effectiveness.noObservedWorkTaskIds.join(",") : "none"}`,
+		`- needsAttention=${effectiveness.needsAttentionTaskIds.length ? effectiveness.needsAttentionTaskIds.join(",") : "none"}`,
+		"Completion verification",
+		...(tasks.filter((t) => t.status === "completed").length
+			? tasks
+					.filter((t) => t.status === "completed")
+					.map((t) => {
+						const guard = verifyTaskCompletion(t, manifest);
+						return `- ${t.id} green=${guard.greenLevel}/3${guard.warnings.length ? ` warnings=[${guard.warnings.join(", ")}]` : ""}`;
+					})
+			: ["- (no completed tasks)"]),
+		"Active agents:",
+		...(activeAgents.length ? activeAgents.map(agentLine) : ["- (none)"]),
+		"Waiting tasks:",
+		...(waitingTasks.length
+			? waitingTasks.map((task) => `- ${task.id} [queued] ${task.role} -> ${task.agent} ${waitingReason(task, tasks) ?? "waiting"}`)
+			: ["- (none)"]),
+		"Completed agents:",
+		...(completedAgents.length ? completedAgents.map(agentLine) : ["- (none)"]),
+		"Policy decisions:",
+		...(manifest.policyDecisions?.length
+			? manifest.policyDecisions.map(
+					(item) => `- ${item.action} (${item.reason})${item.taskId ? ` ${item.taskId}` : ""}: ${item.message}`,
+				)
+			: ["- (none)"]),
+		`Total usage: ${formatUsage(totalUsage)}`,
+		"Group joins:",
+		...(groupJoinLines.length ? groupJoinLines : ["- (none)"]),
+		"",
+		"Recent artifacts:",
+		...(artifactLines.length ? artifactLines : ["- (none)"]),
+		"",
+		"Recent events:",
+		...(events.length
+			? events.map(
+					(event) =>
+						`- ${event.time} ${event.type}${event.taskId ? ` ${event.taskId}` : ""}${event.message ? `: ${event.message}` : ""}`,
+				)
+			: ["- (none)"]),
+	];
+	if (!fullDetails) {
+		return result(buildCompactStatus(manifest, tasks, counts, asyncLivenessLine, phaseProgress).join("\n"), {
+			action: "status",
+			status: "ok",
+			runId: manifest.runId,
+			artifactsRoot: manifest.artifactsRoot,
+			intent: `status ${manifest.runId}: ${manifest.status} (compact)`,
+		});
+	}
+	return result(lines.join("\n"), {
+		action: "status",
+		status: "ok",
+		runId: manifest.runId,
+		artifactsRoot: manifest.artifactsRoot,
+		intent: `status ${manifest.runId}: ${manifest.status}`,
+	});
+}
+
+/**
+ * Compact status builder (DX: Round 16 F3). A tight summary for quick checks:
+ * identity, status, goal, task counts, and ONLY failed / attention task
+ * errors — not the 40-line dense dump. Invoked when params.details === false.
+ *
+ * Exported for unit testing.
+ */
+export function buildCompactStatus(
+	manifest: {
+		runId: string;
+		team: string;
+		workflow?: string;
+		status: string;
+		goal: string;
+		workspaceMode?: string;
+	},
+	tasks: Array<{
+		id: string;
+		status: string;
+		role: string;
+		agent: string;
+		error?: string;
+	}>,
+	counts: Map<string, number>,
+	asyncLivenessLine?: string,
+	progress?: { overallPercentage: number; estimatedRemainingMs: number },
+): string[] {
+	const failedOrAttention = tasks.filter((t) => t.status === "failed" || t.status === "needs_attention" || t.status === "cancelled");
+	const lines = [
+		`Run: ${manifest.runId}`,
+		`Team: ${manifest.team}${manifest.workflow ? ` (${manifest.workflow})` : ""}`,
+		`Status: ${manifest.status}`,
+		...(progress ? [`Progress: ${progress.overallPercentage}% (~${formatDuration(progress.estimatedRemainingMs)} remaining)`] : []),
+		`Goal: ${manifest.goal}`,
+		...(asyncLivenessLine ? [asyncLivenessLine] : []),
+		`Tasks: ${[...counts.entries()].map(([s, c]) => `${s}=${c}`).join(", ") || "none"}`,
+	];
+	if (failedOrAttention.length > 0) {
+		lines.push("Issues:");
+		for (const t of failedOrAttention) {
+			lines.push(`- ${t.id} [${t.status}] ${t.role}: ${t.error ?? "(no error detail)"}`);
+		}
+	}
+	lines.push("Tip: pass details=true for full output (task graph, agents, effectiveness, events).");
+	return lines;
+}

package/src/extension/team-tool/workflow-manage.ts

@@ -0,0 +1,261 @@
+/**
+ * team-tool/workflow-manage.ts — Handlers for the 5 workflow-management actions (P3).
+ *
+ * Plan: 07-PLAN.md v3 P3 + §0c C3 (destructive-gate, NOT autonomous-policy) + C5 (paths).
+ *
+ * Actions:
+ *   - workflow-create : write a .dwf.ts from params.config.script. SECURITY: gated by
+ *                       destructive-gate.ts (confirm:true required) + path-allowlist
+ *                       (resolveRealContainedPath) + content validation. NEVER auto-invoked
+ *                       by the agent (the gate enforces this).
+ *   - workflow-get    : return a workflow's source/metadata (read-only).
+ *   - workflow-list   : list all workflows incl. runtime discriminator (extends existing list).
+ *   - workflow-save   : persist an ephemeral script as a named reusable workflow.
+ *   - workflow-delete : remove a dynamic workflow file (confirm-gated).
+ */
+
+import { existsSync, readFileSync, rmSync, writeFileSync } from "node:fs";
+import { dirname, join } from "node:path";
+import type { TeamToolParamsValue } from "../../schema/team-tool-schema.ts";
+import { logInternalError } from "../../utils/internal-error.ts";
+import { packageRoot, projectCrewRoot, userPiRoot } from "../../utils/paths.ts";
+import { assertSafePathId, resolveRealContainedPath } from "../../utils/safe-paths.ts";
+import { allWorkflows, discoverWorkflows } from "../../workflows/discover-workflows.ts";
+import { result, type TeamContext } from "./context.ts";
+
+/** The 3 allowed bases for dynamic-workflow scripts (§0c C5). */
+function allowedWorkflowDirs(cwd: string): string[] {
+	// Fix round-6: align with discoverWorkflows (which reads userPiRoot/workflows, NOT
+	// userCrewRoot/workflows). The old userCrewRoot path silently orphaned user-scope workflows.
+	return [join(projectCrewRoot(cwd), "workflows"), join(userPiRoot(), "workflows"), join(packageRoot(), "workflows")];
+}
+
+/** Best-effort ADVISORY content check (review H-3): trivially bypassable
+ * (require('child'+'_process'), globalThis.process.mainModule.require, dynamic import,
+ *  String.fromCharCode, etc.). This is NOT a security boundary — it catches only
+ *  the most obvious accidental violations. The real boundary is the path-allowlist
+ *  + commit-review trust model. Do NOT rely on this for security. */
+const FORBIDDEN_PATTERNS = [
+	/require\s*\(\s*['"]child_process['"]/,
+	/\bprocess\.exit\s*\(/,
+	/import\s+.*['"]net['"]/,
+	/import\s+.*['"]http['"]/,
+	/import\s+.*['"]https['"]/,
+	/eval\s*\(\s*new\s+Function/,
+];
+
+function validateScriptContent(content: string): string | undefined {
+	for (const pattern of FORBIDDEN_PATTERNS) {
+		if (pattern.test(content)) {
+			return `Script content matches a forbidden pattern (${pattern.source}). Dynamic workflows must not spawn processes, exit, or make network calls directly — use ctx.agent().`;
+		}
+	}
+	return undefined;
+}
+
+/** Resolve a workflow name + scope to a safe write path inside an allowed dir. */
+function resolveWorkflowWritePath(cwd: string, name: string, scope: "user" | "project" = "project"): string {
+	assertSafePathId("workflowName", name);
+	// Fix round-6: user scope must use userPiRoot/workflows (matches discovery), not userCrewRoot.
+	const base = scope === "user" ? join(userPiRoot(), "workflows") : join(projectCrewRoot(cwd), "workflows");
+	return resolveRealContainedPath(base, `${name}.dwf.ts`);
+}
+
+export function handleWorkflowCreate(params: TeamToolParamsValue, ctx: TeamContext): ReturnType<typeof result> {
+	// SECURITY (§0c C3): the destructive-gate.ts set enforces confirm:true BEFORE this handler
+	// runs (the run is blocked at the tool_call layer if confirm is missing). We re-check here
+	// as defense-in-depth in case the gate is bypassed.
+	if (params.confirm !== true) {
+		return result(
+			"workflow-create is a new arbitrary-code-execution surface and requires confirm:true. Add the action to DESTRUCTIVE_TEAM_ACTIONS (destructive-gate.ts) so the runtime gate enforces this.",
+			{ action: "workflow-create", status: "error" },
+			true,
+		);
+	}
+	const name = params.config?.name as string | undefined;
+	const script = params.config?.script as string | undefined;
+	if (!name || typeof name !== "string") {
+		return result(
+			"workflow-create requires config.name (the workflow name, path-safe).",
+			{ action: "workflow-create", status: "error" },
+			true,
+		);
+	}
+	if (!script || typeof script !== "string") {
+		return result("workflow-create requires config.script (the .dwf.ts source).", { action: "workflow-create", status: "error" }, true);
+	}
+	const validationError = validateScriptContent(script);
+	if (validationError) {
+		return result(`workflow-create rejected: ${validationError}`, { action: "workflow-create", status: "error" }, true);
+	}
+	try {
+		const scope = (params.scope === "user" ? "user" : "project") as "user" | "project";
+		const filePath = resolveWorkflowWritePath(ctx.cwd, name, scope);
+		writeFileSync(filePath, script, "utf-8");
+		return result(
+			`Dynamic workflow '${name}' created at ${filePath}.\n\nIt is now runnable via: team action='run' workflow='${name}' goal='...'\n/scripts are commit-reviewed (postinstall-equivalent trust — see docs/dynamic-workflows.md).`,
+			{
+				action: "workflow-create",
+				status: "ok",
+				data: { name, filePath, scope },
+			},
+			false,
+		);
+	} catch (error) {
+		const message = error instanceof Error ? error.message : String(error);
+		return result(`workflow-create failed: ${message}`, { action: "workflow-create", status: "error" }, true);
+	}
+}
+
+export function handleWorkflowGet(params: TeamToolParamsValue, ctx: TeamContext): ReturnType<typeof result> {
+	const name = (params.config?.name as string | undefined) ?? params.workflow;
+	if (!name) return result("workflow-get requires config.name or workflow.", { action: "workflow-get", status: "error" }, true);
+	const wf = allWorkflows(discoverWorkflows(ctx.cwd)).find((w) => w.name === name);
+	if (!wf) return result(`Workflow '${name}' not found.`, { action: "workflow-get", status: "error" }, true);
+	const isDynamic = wf.runtime === "dynamic";
+	let source = "(static workflow — no script source)";
+	if (isDynamic && wf.filePath && existsSync(wf.filePath)) {
+		try {
+			source = readFileSync(wf.filePath, "utf-8").slice(0, 8000);
+		} catch (error) {
+			logInternalError("workflow-manage.get", error, `filePath=${wf.filePath}`);
+		}
+	}
+	return result(
+		[
+			`Workflow: ${wf.name} [${isDynamic ? "dynamic" : "static"}]`,
+			`  description: ${wf.description}`,
+			`  source: ${wf.source}`,
+			`  filePath: ${wf.filePath}`,
+			isDynamic ? `  dynamicScript: ${wf.dynamicScript}` : `  steps: ${wf.steps.length}`,
+			"",
+			isDynamic ? "Script source:" : "",
+			isDynamic ? "```" : "",
+			isDynamic ? source : "",
+			isDynamic ? "```" : "",
+		]
+			.filter(Boolean)
+			.join("\n"),
+		{
+			action: "workflow-get",
+			status: "ok",
+			data: {
+				name: wf.name,
+				runtime: wf.runtime ?? "static",
+				filePath: wf.filePath,
+			},
+		},
+		false,
+	);
+}
+
+export function handleWorkflowList(params: TeamToolParamsValue, ctx: TeamContext): ReturnType<typeof result> {
+	const workflows = allWorkflows(discoverWorkflows(ctx.cwd));
+	if (workflows.length === 0) return result("No workflows found.", { action: "workflow-list", status: "ok" }, false);
+	const lines = workflows.map((w) => {
+		const tag = w.runtime === "dynamic" ? "[dynamic]" : "[static] ";
+		const detail = w.runtime === "dynamic" ? (w.dynamicScript ?? w.filePath) : `${w.steps.length} steps`;
+		return `  ${tag} ${w.name.padEnd(20)} ${detail}`;
+	});
+	return result(
+		`Workflows (${workflows.length}):\n${lines.join("\n")}`,
+		{
+			action: "workflow-list",
+			status: "ok",
+			data: {
+				count: workflows.length,
+				workflows: workflows.map((w) => ({
+					name: w.name,
+					runtime: w.runtime ?? "static",
+				})),
+			},
+		},
+		false,
+	);
+}
+
+export function handleWorkflowSave(params: TeamToolParamsValue, ctx: TeamContext): ReturnType<typeof result> {
+	// H-1 (review): workflow-save writes an arbitrary .dwf.ts (ACE-equivalent) — gate it
+	// via destructive-gate.ts confirm:true (now in DESTRUCTIVE_TEAM_ACTIONS) + re-check here.
+	if (params.confirm !== true) {
+		return result(
+			"workflow-save writes an executable .dwf.ts and requires confirm:true (gated by destructive-gate.ts).",
+			{ action: "workflow-save", status: "error" },
+			true,
+		);
+	}
+	// workflow-save: persist an ephemeral run's script as a named reusable workflow.
+	// Reads the source from config.script (the caller provides what to save).
+	const name = params.config?.name as string | undefined;
+	const script = params.config?.script as string | undefined;
+	if (!name || !script)
+		return result("workflow-save requires config.name + config.script.", { action: "workflow-save", status: "error" }, true);
+	const validationError = validateScriptContent(script);
+	if (validationError) return result(`workflow-save rejected: ${validationError}`, { action: "workflow-save", status: "error" }, true);
+	try {
+		const filePath = resolveWorkflowWritePath(ctx.cwd, name, "project");
+		writeFileSync(filePath, script, "utf-8");
+		return result(
+			`Saved dynamic workflow '${name}' → ${filePath}.`,
+			{ action: "workflow-save", status: "ok", data: { name, filePath } },
+			false,
+		);
+	} catch (error) {
+		const message = error instanceof Error ? error.message : String(error);
+		return result(`workflow-save failed: ${message}`, { action: "workflow-save", status: "error" }, true);
+	}
+}
+
+export function handleWorkflowDelete(params: TeamToolParamsValue, ctx: TeamContext): ReturnType<typeof result> {
+	// workflow-delete is destructive (removes a file) — gated by destructive-gate.ts confirm:true.
+	if (params.confirm !== true) {
+		return result(
+			"workflow-delete requires confirm:true (gated by destructive-gate.ts).",
+			{ action: "workflow-delete", status: "error" },
+			true,
+		);
+	}
+	const name = (params.config?.name as string | undefined) ?? params.workflow;
+	if (!name) return result("workflow-delete requires config.name.", { action: "workflow-delete", status: "error" }, true);
+	const wf = allWorkflows(discoverWorkflows(ctx.cwd)).find((w) => w.name === name);
+	if (!wf) return result(`Workflow '${name}' not found.`, { action: "workflow-delete", status: "error" }, true);
+	if (wf.runtime !== "dynamic")
+		return result(
+			`Workflow '${name}' is not a dynamic workflow (only .dwf.ts files can be deleted via this action).`,
+			{ action: "workflow-delete", status: "error" },
+			true,
+		);
+	try {
+		assertSafePathId("workflowName", name);
+		// Verify the file is inside an allowed dir before deleting.
+		const allowed = allowedWorkflowDirs(ctx.cwd);
+		const contained = allowed.some((base) => {
+			try {
+				return resolveRealContainedPath(base, wf.filePath) === wf.filePath;
+			} catch {
+				return false;
+			}
+		});
+		if (!contained)
+			return result(
+				`Refusing to delete '${wf.filePath}': not inside an allowed workflows directory.`,
+				{ action: "workflow-delete", status: "error" },
+				true,
+			);
+		rmSync(wf.filePath, { force: true });
+		return result(
+			`Deleted dynamic workflow '${name}' (${wf.filePath}).`,
+			{
+				action: "workflow-delete",
+				status: "ok",
+				data: { name, filePath: wf.filePath },
+			},
+			false,
+		);
+	} catch (error) {
+		const message = error instanceof Error ? error.message : String(error);
+		return result(`workflow-delete failed: ${message}`, { action: "workflow-delete", status: "error" }, true);
+	}
+}
+
+void dirname; // (import kept for future expansion; currently unused)

package/src/extension/team-tool-types.ts

@@ -0,0 +1,26 @@
+export interface TeamToolDetails {
+	action: string;
+	status: "ok" | "error" | "planned";
+	runId?: string;
+	artifactsRoot?: string;
+	abortedIds?: string[];
+	missingIds?: string[];
+	foreignIds?: string[];
+	intent?: string;
+	resumedIds?: string[];
+	retriedTaskIds?: string[];
+	mailboxIds?: string[];
+	/** Resource scope affected by the action (e.g. cleanup: "project"). */
+	scope?: string;
+	/** Run metrics for compact display in TUI tool result rendering. */
+	metrics?: {
+		taskCount?: number;
+		completedCount?: number;
+		totalTokens?: number;
+		totalCost?: number;
+		durationMs?: number;
+		consistencyScore?: number;
+	};
+	/** Structured data for programmatic consumption (e.g. TUI widgets). */
+	data?: Record<string, unknown>;
+}