pi-crew 0.9.68 → 0.10.2

package/src/extension/team-tool/api/task-claims.ts

@@ -17,13 +17,39 @@ import { canTransitionTaskStatus, isTeamTaskStatus } from "../../../state/contra
 import { withRunLockSync } from "../../../state/coordination/locks.ts";
 import { claimTask, releaseTaskClaim, transitionClaimedTaskStatus } from "../../../state/coordination/task-claims.ts";
 import { appendEvent } from "../../../state/event-log/event-log.ts";
-import { saveRunTasks } from "../../../state/stores/state-store.ts";
+import { loadRunManifestById, saveRunTasks } from "../../../state/stores/state-store.ts";
+import type { TeamTaskState } from "../../../state/types.ts";
+import { RUN_NOT_FOUND_HINT } from "../run-not-found.ts";
 import type { ApiHandlerContext, ApiOperationHandler } from "./handler-context.ts";
 
 /** Find a task by id OR stepId — the convention used by every claim op. */
-function findTaskByIdOrStepId(ctx: ApiHandlerContext, taskId: string | undefined) {
+function findTaskByIdOrStepId(tasks: TeamTaskState[], taskId: string | undefined) {
 	if (!taskId) return undefined;
-	return ctx.loaded.tasks.find((item) => item.id === taskId || item.stepId === taskId);
+	return tasks.find((item) => item.id === taskId || item.stepId === taskId);
+}
+
+/**
+ * R13-S1: fresh re-read INSIDE the lock (respond.ts:43 canonical pattern).
+ * `loaded.manifest` passed to withRunLockSync is used ONLY for lock-path
+ * derivation (locks.ts:596-598 — the lock does NOT re-read); the DATA
+ * (tasks, status) must always come from this fresh read.
+ */
+function freshRunOrMissing(
+	loaded: ApiHandlerContext["loaded"],
+	result: ApiHandlerContext["result"],
+): { manifest: import("../../../state/types.ts").TeamRunManifest; tasks: TeamTaskState[] } | ReturnType<ApiHandlerContext["result"]> {
+	const fresh = loadRunManifestById(loaded.manifest.cwd, loaded.manifest.runId);
+	if (!fresh)
+		return result(
+			`Run '${loaded.manifest.runId}' not found.${RUN_NOT_FOUND_HINT}`,
+			{
+				action: "api",
+				status: "error",
+				runId: loaded.manifest.runId,
+			},
+			true,
+		);
+	return fresh;
 }
 
 /** handleApi operation: `claim-task`. */
@@ -31,7 +57,7 @@ export const handleClaimTask: ApiOperationHandler = (ctx) => {
 	const { cfg, loaded, result, paramRequired } = ctx;
 	const taskId = typeof cfg.taskId === "string" ? cfg.taskId : undefined;
 	const owner = typeof cfg.owner === "string" ? cfg.owner : "api";
-	const task = findTaskByIdOrStepId(ctx, taskId);
+	const task = findTaskByIdOrStepId(loaded.tasks, taskId);
 	if (!task)
 		return result(
 			paramRequired(
@@ -48,13 +74,28 @@ export const handleClaimTask: ApiOperationHandler = (ctx) => {
 		);
 	try {
 		return withRunLockSync(loaded.manifest, () => {
-			const updatedTask = claimTask(task, owner);
-			const tasks = loaded.tasks.map((item) => (item.id === task.id ? updatedTask : item));
-			saveRunTasks(loaded.manifest, tasks);
-			appendEvent(loaded.manifest.eventsPath, {
+			const fresh = freshRunOrMissing(loaded, result);
+			if (!("tasks" in fresh)) return fresh;
+			const freshTask = findTaskByIdOrStepId(fresh.tasks, taskId);
+			if (!freshTask)
+				return result(
+					`Task '${taskId}' not found in run '${fresh.manifest.runId}'.`,
+					{
+						action: "api",
+						status: "error",
+						runId: fresh.manifest.runId,
+					},
+					true,
+				);
+			// R13-S1: claim operates on the FRESH task — a task that became terminal on
+			// disk keeps its terminal status (no resurrection via the stale array).
+			const updatedTask = claimTask(freshTask, owner);
+			const tasks = fresh.tasks.map((item) => (item.id === freshTask.id ? updatedTask : item));
+			saveRunTasks(fresh.manifest, tasks);
+			appendEvent(fresh.manifest.eventsPath, {
 				type: "task.claimed",
-				runId: loaded.manifest.runId,
-				taskId: task.id,
+				runId: fresh.manifest.runId,
+				taskId: freshTask.id,
 				data: {
 					owner,
 					token: "[REDACTED]",
@@ -64,8 +105,8 @@ export const handleClaimTask: ApiOperationHandler = (ctx) => {
 			return result(JSON.stringify(updatedTask.claim, null, 2), {
 				action: "api",
 				status: "ok",
-				runId: loaded.manifest.runId,
-				artifactsRoot: loaded.manifest.artifactsRoot,
+				runId: fresh.manifest.runId,
+				artifactsRoot: fresh.manifest.artifactsRoot,
 			});
 		});
 	} catch (error) {
@@ -88,7 +129,7 @@ export const handleReleaseTaskClaim: ApiOperationHandler = (ctx) => {
 	const taskId = typeof cfg.taskId === "string" ? cfg.taskId : undefined;
 	const owner = typeof cfg.owner === "string" ? cfg.owner : undefined;
 	const token = typeof cfg.token === "string" ? cfg.token : undefined;
-	const task = findTaskByIdOrStepId(ctx, taskId);
+	const task = findTaskByIdOrStepId(loaded.tasks, taskId);
 	if (!task || !owner || !token)
 		return result(
 			paramRequired(
@@ -105,20 +146,33 @@ export const handleReleaseTaskClaim: ApiOperationHandler = (ctx) => {
 		);
 	try {
 		return withRunLockSync(loaded.manifest, () => {
-			const updatedTask = releaseTaskClaim(task, owner, token);
-			const tasks = loaded.tasks.map((item) => (item.id === task.id ? updatedTask : item));
-			saveRunTasks(loaded.manifest, tasks);
-			appendEvent(loaded.manifest.eventsPath, {
+			const fresh = freshRunOrMissing(loaded, result);
+			if (!("tasks" in fresh)) return fresh;
+			const freshTask = findTaskByIdOrStepId(fresh.tasks, taskId);
+			if (!freshTask)
+				return result(
+					`Task '${taskId}' not found in run '${fresh.manifest.runId}'.`,
+					{
+						action: "api",
+						status: "error",
+						runId: fresh.manifest.runId,
+					},
+					true,
+				);
+			const updatedTask = releaseTaskClaim(freshTask, owner, token);
+			const tasks = fresh.tasks.map((item) => (item.id === freshTask.id ? updatedTask : item));
+			saveRunTasks(fresh.manifest, tasks);
+			appendEvent(fresh.manifest.eventsPath, {
 				type: "task.claim_released",
-				runId: loaded.manifest.runId,
-				taskId: task.id,
+				runId: fresh.manifest.runId,
+				taskId: freshTask.id,
 				data: { owner },
 			});
 			return result(JSON.stringify(updatedTask, null, 2), {
 				action: "api",
 				status: "ok",
-				runId: loaded.manifest.runId,
-				artifactsRoot: loaded.manifest.artifactsRoot,
+				runId: fresh.manifest.runId,
+				artifactsRoot: fresh.manifest.artifactsRoot,
 			});
 		});
 	} catch (error) {
@@ -142,7 +196,7 @@ export const handleTransitionTaskStatus: ApiOperationHandler = (ctx) => {
 	const owner = typeof cfg.owner === "string" ? cfg.owner : undefined;
 	const token = typeof cfg.token === "string" ? cfg.token : undefined;
 	const to = cfg.status;
-	const task = findTaskByIdOrStepId(ctx, taskId);
+	const task = findTaskByIdOrStepId(loaded.tasks, taskId);
 	if (!task || !owner || !token || !isTeamTaskStatus(to))
 		return result(
 			paramRequired(
@@ -157,32 +211,47 @@ export const handleTransitionTaskStatus: ApiOperationHandler = (ctx) => {
 			},
 			true,
 		);
-	if (!canTransitionTaskStatus(task.status, to))
-		return result(
-			`Invalid task status transition: ${task.status} -> ${to}`,
-			{
-				action: "api",
-				status: "error",
-				runId: loaded.manifest.runId,
-			},
-			true,
-		);
 	try {
 		return withRunLockSync(loaded.manifest, () => {
-			const updatedTask = transitionClaimedTaskStatus(task, owner, token, to);
-			const tasks = loaded.tasks.map((item) => (item.id === task.id ? updatedTask : item));
-			saveRunTasks(loaded.manifest, tasks);
-			appendEvent(loaded.manifest.eventsPath, {
+			const fresh = freshRunOrMissing(loaded, result);
+			if (!("tasks" in fresh)) return fresh;
+			const freshTask = findTaskByIdOrStepId(fresh.tasks, taskId);
+			if (!freshTask)
+				return result(
+					`Task '${taskId}' not found in run '${fresh.manifest.runId}'.`,
+					{
+						action: "api",
+						status: "error",
+						runId: fresh.manifest.runId,
+					},
+					true,
+				);
+			// R13-S1: validate the transition against FRESH task status — a task that
+			// became terminal on disk must be rejected (no terminal flip / no resurrection).
+			if (!canTransitionTaskStatus(freshTask.status, to))
+				return result(
+					`Invalid task status transition: ${freshTask.status} -> ${to}`,
+					{
+						action: "api",
+						status: "error",
+						runId: fresh.manifest.runId,
+					},
+					true,
+				);
+			const updatedTask = transitionClaimedTaskStatus(freshTask, owner, token, to);
+			const tasks = fresh.tasks.map((item) => (item.id === freshTask.id ? updatedTask : item));
+			saveRunTasks(fresh.manifest, tasks);
+			appendEvent(fresh.manifest.eventsPath, {
 				type: "task.status_transitioned",
-				runId: loaded.manifest.runId,
-				taskId: task.id,
+				runId: fresh.manifest.runId,
+				taskId: freshTask.id,
 				data: { owner, status: to },
 			});
 			return result(JSON.stringify(updatedTask, null, 2), {
 				action: "api",
 				status: "ok",
-				runId: loaded.manifest.runId,
-				artifactsRoot: loaded.manifest.artifactsRoot,
+				runId: fresh.manifest.runId,
+				artifactsRoot: fresh.manifest.artifactsRoot,
 			});
 		});
 	} catch (error) {

package/src/extension/team-tool/cancel.ts

@@ -25,12 +25,16 @@ import { RUN_NOT_FOUND_HINT } from "./run-not-found.ts";
 const RETRYABLE_STATUSES: ReadonlySet<string> = new Set(["failed", "cancelled"]);
 
 /**
- * Pure pre-lock decision for `action='retry'`: a run whose manifest status is
- * "completed" (terminal success) and has no retryable tasks has nothing to
- * retry. Returns true so the caller short-circuits with a clear message
- * BEFORE acquiring the run lock — avoiding a misleading
- * "run.lock is locked by another operation" error from a stale lock file left
- * behind by a completed async run (finding #4, real-test-2026-08-10-full-9-tier).
+ * Decision for `action='retry'`: a run whose manifest status is "completed"
+ * (terminal success) and has no retryable tasks has nothing to retry. Returns
+ * true so the caller short-circuits with a clear message instead of retrying.
+ *
+ * R13-3 fold: the caller MUST evaluate this on FRESH state read INSIDE the
+ * run lock — a pre-lock decision on a best-effort snapshot could wrongly
+ * refuse a run that was re-queued/failed on disk (finding #4,
+ * real-test-2026-08-10-full-9-tier). Kept as a short-circuit so a completed
+ * async run does not surface a misleading "run.lock is locked by another
+ * operation" error from a stale lock file left behind by that run.
  *
  * Exported for unit testing (handleRetry itself needs filesystem state).
  */
@@ -148,22 +152,43 @@ export async function handleRetry(params: TeamToolParamsValue, ctx: TeamContext,
 
 	const targetTaskId = typeof params.taskId === "string" ? params.taskId : undefined;
 
-	// Pre-lock terminal-status check: a completed run has nothing to retry.
-	// Short-circuit BEFORE acquiring the run lock so a stale lock file left by a
-	// completed async run does not surface a misleading "run.lock is locked by
-	// another operation" error (finding #4 in real-test-2026-08-10-full-9-tier).
-	if (retryShortCircuitsCompleted(loaded.manifest.status, loaded.tasks, targetTaskId)) {
-		return result(
-			`Run ${loaded.manifest.runId} is already completed; retry only applies to failed/cancelled runs.`,
-			{ action: "retry", status: "error", runId: loaded.manifest.runId },
-			true,
-		);
-	}
-
 	return withRunLockSync(loaded.manifest, () => {
+		// R13-1 (2026-08-14): fresh re-read INSIDE the lock. `loaded` was captured
+		// lock-free BEFORE the unbounded before_retry hook gap; a concurrent writer
+		// may have completed the run or re-queued tasks on disk. All decisions and
+		// writes below derive from `fresh` — never from the stale `loaded` snapshot.
+		const fresh = loadRunManifestById(loaded.manifest.cwd, params.runId!); // NOTE: inside withRunLockSync - consistent read
+		if (!fresh) return result(`Run '${params.runId}' not found.${RUN_NOT_FOUND_HINT}`, { action: "retry", status: "error" }, true);
+
+		// R15-S1 (2026-08-14): in-lock ownership re-check on the FRESH manifest.
+		// The pre-lock check above ran on the `loaded` snapshot captured BEFORE
+		// the unbounded before_retry hook gap; ownership may have changed on disk
+		// in that window. This in-lock check is authoritative — the pre-lock check
+		// remains only as the fast-path UX message.
+		if (typeof fresh.manifest.ownerSessionId === "string" && fresh.manifest.ownerSessionId !== ctx.sessionId && params.force !== true) {
+			return result(
+				`Run ${fresh.manifest.runId} belongs to another session. Use force: true to override.`,
+				{ action: "retry", status: "error", runId: fresh.manifest.runId },
+				true,
+			);
+		}
+
+		// Terminal-status check on FRESH in-lock state (R13-3 fold): a completed
+		// run has nothing to retry. Short-circuit with a clear message instead of
+		// surfacing a misleading "run.lock is locked by another operation" error
+		// from a stale lock file left by a completed async run (finding #4 in
+		// real-test-2026-08-10-full-9-tier).
+		if (retryShortCircuitsCompleted(fresh.manifest.status, fresh.tasks, targetTaskId)) {
+			return result(
+				`Run ${fresh.manifest.runId} is already completed; retry only applies to failed/cancelled runs.`,
+				{ action: "retry", status: "error", runId: fresh.manifest.runId },
+				true,
+			);
+		}
+
 		const retryableStatuses: ReadonlySet<string> = new Set(["failed", "cancelled"]);
 
-		const matchingTasks = loaded.tasks.filter((task) => {
+		const matchingTasks = fresh.tasks.filter((task) => {
 			if (targetTaskId && task.id !== targetTaskId) return false;
 			return retryableStatuses.has(task.status);
 		});
@@ -174,26 +199,26 @@ export async function handleRetry(params: TeamToolParamsValue, ctx: TeamContext,
 				{
 					action: "retry",
 					status: "error",
-					runId: loaded.manifest.runId,
+					runId: fresh.manifest.runId,
 				},
 				true,
 			);
 		}
 
 		const retriedIds = new Set(matchingTasks.map((t) => t.id));
-		const tasks = loaded.tasks.map((task) => {
+		const tasks = fresh.tasks.map((task) => {
 			if (!retriedIds.has(task.id)) return task;
 			const { error: _error, finishedAt: _finishedAt, terminalEvidence: _terminalEvidence, ...rest } = task;
 			return { ...rest, status: "queued" as const };
 		});
-		saveRunTasks(loaded.manifest, tasks);
+		saveRunTasks(fresh.manifest, tasks);
 		try {
 			saveCrewAgents(
-				loaded.manifest,
-				tasks.map((task) => recordFromTask(loaded.manifest, task, "child-process")),
+				fresh.manifest,
+				tasks.map((task) => recordFromTask(fresh.manifest, task, "child-process")),
 			);
 		} catch (error) {
-			logInternalError("team-tool.handleRetry.crewAgents", error, `runId=${loaded.manifest.runId}`);
+			logInternalError("team-tool.handleRetry.crewAgents", error, `runId=${fresh.manifest.runId}`);
 		}
 
 		const retriedTaskIds = [...retriedIds];
@@ -201,27 +226,27 @@ export async function handleRetry(params: TeamToolParamsValue, ctx: TeamContext,
 			// H1 (2026-08-10): inside a sync run-lock callback — cannot await;
 			// fire-and-forget async. task.retried is informational; the queued
 			// status is the authoritative record in tasks.json.
-			void appendEventAsync(loaded.manifest.eventsPath, {
+			void appendEventAsync(fresh.manifest.eventsPath, {
 				type: "task.retried",
-				runId: loaded.manifest.runId,
+				runId: fresh.manifest.runId,
 				taskId,
 				message: `Task ${taskId} queued for retry.`,
 			}).catch((error) =>
 				logInternalError(
 					"cancel.retry-event",
 					error instanceof Error ? error : new Error(String(error)),
-					`runId=${loaded.manifest.runId}`,
+					`runId=${fresh.manifest.runId}`,
 				),
 			);
 		}
 
-		if (deps) invalidateSnapshot(loaded.manifest.runId, runCwd, deps);
-		return result(`Retried ${retriedTaskIds.length} task(s) in run ${loaded.manifest.runId}.`, {
+		if (deps) invalidateSnapshot(fresh.manifest.runId, runCwd, deps);
+		return result(`Retried ${retriedTaskIds.length} task(s) in run ${fresh.manifest.runId}.`, {
 			action: "retry",
 			status: "ok",
-			runId: loaded.manifest.runId,
+			runId: fresh.manifest.runId,
 			retriedTaskIds: retriedTaskIds,
-			intent: `retrying ${retriedTaskIds.length} task(s) in ${loaded.manifest.runId}`,
+			intent: `retrying ${retriedTaskIds.length} task(s) in ${fresh.manifest.runId}`,
 		});
 	});
 }
@@ -290,26 +315,35 @@ export async function handleCancel(params: TeamToolParamsValue, ctx: TeamContext
 	}
 
 	return withRunLockSync(loaded.manifest, () => {
-		if ((loaded.manifest.status === "completed" || loaded.manifest.status === "cancelled") && params.force !== true)
+		// R13-2 (2026-08-14): fresh re-read INSIDE the lock. `loaded` was captured
+		// lock-free BEFORE the before_cancel hook + live-agent termination gap; a
+		// concurrent writer may have completed the run on disk. The terminal-status
+		// short-circuit and ALL writes below derive from `fresh` — never flip a
+		// terminal status (completed → cancelled) from the stale `loaded` snapshot.
+		const fresh = loadRunManifestById(loaded.manifest.cwd, loaded.manifest.runId); // NOTE: inside withRunLockSync - consistent read
+		if (!fresh)
+			return result(`Run '${loaded.manifest.runId}' not found.${RUN_NOT_FOUND_HINT}`, { action: "cancel", status: "error" }, true);
+
+		if ((fresh.manifest.status === "completed" || fresh.manifest.status === "cancelled") && params.force !== true)
 			return result(
-				`Run ${loaded.manifest.runId} is already ${loaded.manifest.status}; nothing to cancel. Use force: true to mark it cancelled anyway.`,
+				`Run ${fresh.manifest.runId} is already ${fresh.manifest.status}; nothing to cancel. Use force: true to mark it cancelled anyway.`,
 				{
 					action: "cancel",
 					status: "ok",
-					runId: loaded.manifest.runId,
-					artifactsRoot: loaded.manifest.artifactsRoot,
+					runId: fresh.manifest.runId,
+					artifactsRoot: fresh.manifest.artifactsRoot,
 				},
 			);
 
 		// Classify tasks for foreign-aware cancellation
-		const abortResult = abortOwned(loaded.manifest.runId, undefined, ctx, params.force);
+		const abortResult = abortOwned(fresh.manifest.runId, undefined, ctx, params.force);
 		if (abortResult.abortedIds.length === 0 && abortResult.foreignIds.length > 0 && params.force !== true) {
 			return result(
-				`Run ${loaded.manifest.runId} belongs to another session. Use force: true to override.`,
+				`Run ${fresh.manifest.runId} belongs to another session. Use force: true to override.`,
 				{
 					action: "cancel",
 					status: "error",
-					runId: loaded.manifest.runId,
+					runId: fresh.manifest.runId,
 					foreignIds: abortResult.foreignIds,
 				},
 				true,
@@ -321,7 +355,7 @@ export async function handleCancel(params: TeamToolParamsValue, ctx: TeamContext
 		const cancelData = cancelIntent ? { reason: cancelReason.code, intent: cancelIntent } : { reason: cancelReason.code };
 		const cancelMessage = `${cancelReason.message} (${cancelReason.code})`;
 
-		const tasks = loaded.tasks.map((task) => {
+		const tasks = fresh.tasks.map((task) => {
 			if (cancellableIds.has(task.id) && (task.status === "queued" || task.status === "running" || task.status === "waiting")) {
 				const base = {
 					...task,
@@ -342,32 +376,32 @@ export async function handleCancel(params: TeamToolParamsValue, ctx: TeamContext
 			}
 			return task;
 		});
-		saveRunTasks(loaded.manifest, tasks);
+		saveRunTasks(fresh.manifest, tasks);
 		try {
 			saveCrewAgents(
-				loaded.manifest,
-				tasks.map((task) => recordFromTask(loaded.manifest, task, loaded.manifest.runtimeResolution?.kind ?? "child-process")),
+				fresh.manifest,
+				tasks.map((task) => recordFromTask(fresh.manifest, task, fresh.manifest.runtimeResolution?.kind ?? "child-process")),
 			);
 		} catch (error) {
-			logInternalError("team-tool.handleCancel.crewAgents", error, `runId=${loaded.manifest.runId}`);
+			logInternalError("team-tool.handleCancel.crewAgents", error, `runId=${fresh.manifest.runId}`);
 		}
 		try {
-			writeForegroundInterruptRequest(loaded.manifest, cancelMessage);
+			writeForegroundInterruptRequest(fresh.manifest, cancelMessage);
 		} catch (error) {
-			logInternalError("team-tool.handleCancel.interruptRequest", error, `runId=${loaded.manifest.runId}`);
+			logInternalError("team-tool.handleCancel.interruptRequest", error, `runId=${fresh.manifest.runId}`);
 		}
-		ctx.abortForegroundRun?.(loaded.manifest.runId);
+		ctx.abortForegroundRun?.(fresh.manifest.runId);
 		for (const taskId of abortResult.abortedIds) {
-			appendEvent(loaded.manifest.eventsPath, {
+			appendEvent(fresh.manifest.eventsPath, {
 				type: "task.cancelled",
-				runId: loaded.manifest.runId,
+				runId: fresh.manifest.runId,
 				taskId,
 				message: cancelMessage,
 				data: cancelData,
 			});
 		}
 		const updated = updateRunStatus(
-			loaded.manifest,
+			fresh.manifest,
 			"cancelled",
 			`${cancelMessage} Already-finished worker processes are not retroactively changed.`,
 			{ data: cancelData },

package/src/extension/team-tool/dispatch/index.ts

@@ -26,6 +26,7 @@ export { handleAutomateDomain, handleControlDomain, handleManageDomain, handleRu
 const ACTION_TO_DOMAIN: Record<string, TeamDomain> = {
 	// run domain (9)
 	run: "run",
+	plans: "run",
 	parallel: "run",
 	plan: "run",
 	orchestrate: "run",

package/src/extension/team-tool/dispatch/run.ts

@@ -19,6 +19,7 @@ import { handleGoal } from "../goal.ts";
 import { handleOrchestrate } from "../orchestrate.ts";
 import { handleParallel } from "../parallel-dispatch.ts";
 import { handlePlan } from "../plan.ts";
+import { handlePlans } from "../plans.ts";
 
 /**
  * Actions owned by the Run domain. Single source of truth for the switch
@@ -27,7 +28,7 @@ import { handlePlan } from "../plan.ts";
  * the `default` branch errors if a RunDomainAction is added here without a
  * matching `case`.
  */
-export const RUN_DOMAIN_ACTIONS = ["run", "parallel", "plan", "orchestrate", "resume", "retry", "wait", "steer", "goal"] as const;
+export const RUN_DOMAIN_ACTIONS = ["run", "parallel", "plan", "plans", "orchestrate", "resume", "retry", "wait", "steer", "goal"] as const;
 type RunDomainAction = (typeof RUN_DOMAIN_ACTIONS)[number];
 
 export async function handleRunDomain(params: TeamToolParamsValue, ctx: TeamContext): Promise<PiTeamsToolResult> {
@@ -40,6 +41,8 @@ export async function handleRunDomain(params: TeamToolParamsValue, ctx: TeamCont
 			return handleParallel(params, ctx);
 		case "plan":
 			return handlePlan(params, ctx);
+		case "plans":
+			return handlePlans(params, ctx);
 		case "orchestrate":
 			return handleOrchestrate(params, ctx);
 		case "resume":

package/src/extension/team-tool/doctor.ts

@@ -1,7 +1,7 @@
 import { execFileSync, spawnSync } from "node:child_process";
 import * as fs from "node:fs";
 import * as path from "node:path";
-import { allAgents, discoverAgents } from "../../agents/discover-agents.ts";
+import { allAgents, discoverAgents, getSecurityEventLog } from "../../agents/discover-agents.ts";
 import { loadConfig } from "../../config/config.ts";
 import { DEFAULT_PATHS } from "../../config/defaults.ts";
 import { type DriftReport, detectDrift, formatDriftReport } from "../../config/drift-detector.ts";
@@ -14,6 +14,7 @@ import type { TeamToolParamsValue } from "../../schema/team-tool-schema.ts";
 import { TeamToolParams } from "../../schema/team-tool-schema.ts";
 import { atomicWriteFile } from "../../state/atomic-write.ts";
 import { allTeams, discoverTeams } from "../../teams/discover-teams.ts";
+import { type FatalFsCause, fsFailureLabel } from "../../utils/fs-errno.ts";
 import { projectCrewRoot, userCrewRoot } from "../../utils/paths.ts";
 import { allWorkflows, discoverWorkflows } from "../../workflows/discover-workflows.ts";
 import type { PiTeamsToolResult } from "../tool-result.ts";
@@ -26,6 +27,71 @@ interface DoctorCheck {
 	detail: string;
 }
 
+/** bug-026 sub-issue B: how many of the most recent runs to scan for tasks
+ *  carrying a fatal-fs failureCause. Bounded so doctor stays fast on projects
+ *  with long run histories. */
+const FS_FAILURE_SCAN_RUN_LIMIT = 10;
+
+function relativeTimeAgo(iso: string): string {
+	const ms = Date.now() - Date.parse(iso);
+	if (!Number.isFinite(ms)) return iso;
+	const minutes = Math.floor(ms / 60_000);
+	if (minutes < 1) return "just now";
+	if (minutes < 60) return `${minutes}m ago`;
+	const hours = Math.floor(minutes / 60);
+	if (hours < 24) return `${hours}h ago`;
+	return `${Math.floor(hours / 24)}d ago`;
+}
+
+/** bug-026 sub-issue B: scan the most recent runs (by mtime, capped) for
+ *  tasks with a fatal-fs failureCause (enospc/edquot/emfile/enfile). Reads
+ *  tasks.json directly (no state-store import) and never throws — doctor is
+ *  a diagnostic tool; unreadable runs are simply skipped. */
+function scanRecentFsFailureCauses(cwd: string): string {
+	const runsRoot = path.join(projectCrewRoot(cwd), DEFAULT_PATHS.state.runsSubdir);
+	let recentRunIds: string[];
+	try {
+		recentRunIds = fs
+			.readdirSync(runsRoot, { withFileTypes: true })
+			.filter((entry) => entry.isDirectory())
+			.map((entry) => {
+				let mtimeMs = 0;
+				try {
+					mtimeMs = fs.statSync(path.join(runsRoot, entry.name)).mtimeMs;
+				} catch {
+					/* unreadable run dir — mtime 0 sorts last */
+				}
+				return { runId: entry.name, mtimeMs };
+			})
+			.sort((a, b) => b.mtimeMs - a.mtimeMs)
+			.slice(0, FS_FAILURE_SCAN_RUN_LIMIT)
+			.map((entry) => entry.runId);
+	} catch {
+		return "no run history";
+	}
+	let count = 0;
+	let last: { runId: string; cause: FatalFsCause; finishedAt?: string } | undefined;
+	for (const runId of recentRunIds) {
+		let tasks: unknown;
+		try {
+			tasks = JSON.parse(fs.readFileSync(path.join(runsRoot, runId, "tasks.json"), "utf-8"));
+		} catch {
+			continue;
+		}
+		if (!Array.isArray(tasks)) continue;
+		for (const task of tasks) {
+			const failureCause = (task as { failureCause?: FatalFsCause }).failureCause;
+			if (!failureCause) continue;
+			count += 1;
+			const finishedAt = (task as { finishedAt?: string }).finishedAt;
+			if (!last || (finishedAt ?? "") > (last.finishedAt ?? "")) last = { runId, cause: failureCause, finishedAt };
+		}
+	}
+	if (count === 0) return `none in last ${FS_FAILURE_SCAN_RUN_LIMIT} runs`;
+	const when = last?.finishedAt ? `, ${relativeTimeAgo(last.finishedAt)}` : "";
+	return `${count} task(s) in last ${FS_FAILURE_SCAN_RUN_LIMIT} runs (last: ${last?.runId}${when}, ${fsFailureLabel(last!.cause)})`;
+}
+
 function firstOutputLine(stdout: string | null | undefined, stderr: string | null | undefined): string {
 	const output = `${stdout ?? ""}\n${stderr ?? ""}`.trim();
 	return (
@@ -43,6 +109,10 @@ function firstOutputLine(stdout: string | null | undefined, stderr: string | nul
 // file with 12 tests would take 20s+ even with empty cwd. The cache is
 // safe: a doctor check is informational, and a stale ok=true would
 // self-correct on the next process restart.
+// MISSED-2 (R5): FIFO cap so the memo cannot grow unbounded. Naturally
+// bounded by ~10-20 probed commands; the cap is a safety net (Map preserves
+// insertion order).
+const MAX_COMMAND_EXISTS_CACHE = 128;
 const commandExistsCache = new Map<string, { ok: boolean; detail: string }>();
 function commandExists(command: string, args: string[]): { ok: boolean; detail: string } {
 	const cacheKey = `${command} ${args.join(" ")}`;
@@ -74,6 +144,11 @@ function commandExists(command: string, args: string[]): { ok: boolean; detail:
 		};
 	}
 	commandExistsCache.set(cacheKey, result);
+	// MISSED-2 (R5): FIFO eviction — drop the oldest entry past the cap.
+	if (commandExistsCache.size > MAX_COMMAND_EXISTS_CACHE) {
+		const oldest = commandExistsCache.keys().next().value;
+		if (oldest !== undefined) commandExistsCache.delete(oldest);
+	}
 	return result;
 }
 
@@ -235,6 +310,14 @@ export function buildTeamDoctorReport(input: TeamDoctorReportInput): TeamDoctorR
 					ok: true,
 					detail: path.join(projectCrewRoot(input.cwd), DEFAULT_PATHS.state.artifactsSubdir),
 				},
+				{
+					// bug-026 sub-issue B: INFORMATIONAL (ok always true) — a historical
+					// disk-full incident must not permanently fail doctor. The line makes
+					// fs failureCauses discoverable without digging through run logs.
+					label: "fs failure causes",
+					ok: true,
+					detail: scanRecentFsFailureCauses(input.cwd),
+				},
 			];
 		}),
 		section("Model Routing", () => {
@@ -393,6 +476,25 @@ export function buildTeamDoctorReport(input: TeamDoctorReportInput): TeamDoctorR
 			return checks;
 		}),
 	];
+	// R7-13: surface security telemetry. The event log was previously
+	// write-only (0 production readers); doctor now reports a compact summary
+	// — total events plus the latest event's time and scope. Emitted only
+	// when events exist (cheap single line, no per-event dump). A non-empty
+	// log is informational, not a failure: blocked registrations mean the
+	// SEC-001 protection fired.
+	const securityEvents = getSecurityEventLog();
+	const lastSecurityEvent = securityEvents.at(-1);
+	if (lastSecurityEvent) {
+		sections.push(
+			section("Security", () => [
+				{
+					label: "security events",
+					ok: true,
+					detail: `${securityEvents.length} logged; last ${lastSecurityEvent.type} agent="${lastSecurityEvent.name}" at ${new Date(lastSecurityEvent.timestamp).toISOString()}`,
+				},
+			]),
+		);
+	}
 	if (input.smokeChildPi) {
 		sections.push([`Child check`, `- ${input.smokeChildPi.ok ? "OK" : "FAIL"} child Pi smoke: ${input.smokeChildPi.detail}`]);
 	}