pi-crew 0.11.43 → 0.11.45

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "pi-crew",
-	"version": "0.11.43",
+	"version": "0.11.45",
 	"description": "Pi extension for coordinated AI teams, workflows, worktrees, and async task orchestration",
 	"author": "baphuongna",
 	"license": "MIT",

package/src/extension/cross-extension-rpc.ts

@@ -165,12 +165,21 @@ function on(events: EventBusLike, channel: string, handler: (raw: unknown) => un
 // pi-crew:rpc:live-control, and the realtime pi-crew:live-control channel) are
 // accessible to any extension on the shared event bus. Mitigations: rate
 // limiting, explicit intent, operation allowlist, cwd containment validation,
-// and HMAC origin signing (see rpc-hmac.ts). Trust model (R7-9): without a
-// valid HMAC signature every RPC surface is read-only — the request/response
-// channels enforce this via RPC_ALLOWED_OPERATIONS, and the realtime
-// pi-crew:live-control channel rejects any operation outside
-// LIVE_CONTROL_UNAUTHENTICATED_OPERATIONS (currently ALL of them, since
-// steer/stop/resume/follow-up are mutating) with a warn log and no publish.
+// and HMAC origin signing (see rpc-hmac.ts). Trust model (R7-9) — what a
+// publisher WITHOUT a valid HMAC signature may do:
+//   - pi-crew:rpc:run is the ONLY mutating channel that accepts unsigned
+//     requests. This is deliberate (SEC-03, test-pinned backward-compat):
+//     each call is rate-limited (RPC_RATE_LIMIT_MAX requests per
+//     RPC_RATE_LIMIT_WINDOW_MS — 5/60s), the payload is filtered to the
+//     ALLOWED_RPC_RUN_KEYS allowlist (unknown keys are stripped before
+//     handleTeamTool ever sees them), and config.cwd must pass containment
+//     validation (inside the project directory).
+//   - The remaining request/response channels are read-only for unsigned
+//     publishers, enforced via RPC_ALLOWED_OPERATIONS.
+//   - The realtime pi-crew:live-control channel rejects ALL unsigned
+//     operations — LIVE_CONTROL_UNAUTHENTICATED_OPERATIONS is the empty set
+//     (steer/stop/resume/follow-up are all mutating) — with a warn log and no
+//     publish.
 
 export function registerPiCrewRpc(
 	events: EventBusLike | undefined,

package/src/extension/session-summary.ts

@@ -1,9 +1,34 @@
+import { existsSync, readFileSync } from "node:fs";
 import type { ExtensionContext } from "@earendil-works/pi-coding-agent";
 import { readCrewAgents } from "../runtime/crew-agent-records.ts";
-import { isDisplayActiveRun } from "../runtime/process-status.ts";
+import { heartbeatLiveForDisplay, isDisplayActiveRun } from "../runtime/process-status.ts";
+import type { TeamRunManifest, TeamTaskState } from "../state/types.ts";
+import { readJsonFileCoalesced } from "../utils/file-coalescer.ts";
 import { extractSessionId } from "../utils/session-utils.ts";
 import { listRuns } from "./run-index.ts";
 
+/** Tasks-read TTL for the one-shot toast's heartbeat check (coalesced, live-run-sidebar pattern). */
+const SUMMARY_TASKS_READ_TTL_MS = 1000;
+
+/**
+ * Wave 16 (residual render wiring, GAP-4): coalesced tasks.json read for the
+ * active-runs toast — clones agents-jobs-browser's readLegacyRunTasks. Returns
+ * undefined on unreadable so a broken tasks.json can NEVER fabricate liveness
+ * evidence (fail-closed).
+ */
+function readSummaryRunTasks(run: TeamRunManifest): TeamTaskState[] | undefined {
+	const parse = (): TeamTaskState[] => {
+		if (!existsSync(run.tasksPath)) return [];
+		const parsed = JSON.parse(readFileSync(run.tasksPath, "utf-8")) as unknown;
+		return Array.isArray(parsed) ? (parsed as TeamTaskState[]) : [];
+	};
+	try {
+		return readJsonFileCoalesced(run.tasksPath, SUMMARY_TASKS_READ_TTL_MS, parse);
+	} catch {
+		return undefined;
+	}
+}
+
 export function notifyActiveRuns(ctx: ExtensionContext): void {
 	const sid = extractSessionId(ctx);
 	const active = listRuns(ctx.cwd)
@@ -15,7 +40,12 @@ export function notifyActiveRuns(ctx: ExtensionContext): void {
 			// Use the same display filter as the widget/powerbar — runs without
 			// real agent evidence (e.g. integration test fixtures) must not appear.
 			const agents = readCrewAgents(run);
-			return isDisplayActiveRun(run, agents);
+			if (isDisplayActiveRun(run, agents)) return true;
+			// Wave 16: this is a ONE-SHOT toast, so the lazy coalesced tasks read is
+			// in-pattern I/O — fetched ONLY when the display predicate is about to
+			// call the run inactive, so a manifest frozen mid-long-tool (fresh task
+			// heartbeats, no agent progress) still gets advertised.
+			return heartbeatLiveForDisplay(run, readSummaryRunTasks(run));
 		})
 		.slice(0, 5);
 	if (active.length === 0) return;

package/src/extension/team-tool/health-monitor.ts

@@ -5,7 +5,12 @@ import * as fs from "node:fs";
 import * as os from "node:os";
 import * as path from "node:path";
 import { readCrewAgents } from "../../runtime/crew-agent-records.ts";
-import { hasStaleAsyncProcess, isActiveRunStatus, isLikelyOrphanedActiveRun } from "../../runtime/process-status.ts";
+import {
+	hasFreshTaskHeartbeatEvidence,
+	hasStaleAsyncProcess,
+	isActiveRunStatus,
+	isLikelyOrphanedActiveRun,
+} from "../../runtime/process-status.ts";
 import type { TeamToolParamsValue } from "../../schema/team-tool-schema.ts";
 import { loadTasksWithRecovery } from "../../state/stores/state-store.ts";
 import type { TeamRunManifest, TeamTaskState } from "../../state/types.ts";
@@ -374,10 +379,15 @@ export function buildHealthReport(
 			continue;
 		}
 
-		// 3. Stuck task detection for active runs
+		// 3. Stuck task detection for active runs. Wave 16 (residual render
+		// wiring): the tasks loaded here are HOISTED — step 6 reuses them so the
+		// orphan guard consults fresh task heartbeats with ZERO extra disk reads
+		// (parity with run-dashboard's stale predicate).
+		let tasks: TeamTaskState[] | undefined;
 		if (isActiveRunStatus(run.status)) {
-			const stuck = detectStuckTasks(run, now);
-			allStuck.push(...stuck);
+			const loaded = readRunTasks(run.stateRoot);
+			tasks = loaded;
+			allStuck.push(...stuckTasksFromRecords(loaded, run.runId, now));
 		}
 
 		// 4. Only check orphan status for active runs
@@ -393,9 +403,12 @@ export function buildHealthReport(
 			continue;
 		}
 
-		// 6. Orphaned: non-async active run with no recent update
+		// 6. Orphaned: non-async active run with no recent update. Wave 16: a
+		// run whose manifest froze mid-long-tool (worker busy, event-driven
+		// writes paused) keeps stamping task heartbeats — fresh evidence
+		// suppresses the stale-no-progress label (run-dashboard parity).
 		const agents = readCrewAgents(run as TeamRunManifest);
-		if (isLikelyOrphanedActiveRun(run as TeamRunManifest, agents, now)) {
+		if (isLikelyOrphanedActiveRun(run as TeamRunManifest, agents, now) && !hasFreshTaskHeartbeatEvidence(tasks, now)) {
 			orphaned.push({
 				runId: run.runId,
 				reason: "stale-no-progress",

package/src/runtime/broker/crew-broker.ts

@@ -90,6 +90,7 @@ import {
 } from "./protocol/request-parsers.ts";
 import { recordWaitPolicyRejection, waitAuthError } from "./protocol/wait-auth.ts";
 import { handleWaitResolve } from "./protocol/wait-resolve.ts";
+import { captureSocketIdentity, type SocketIdentity, stopServerAndRemoveSocket } from "./socket-stop.ts";
 import { pushWaitingToForegroundWaiter } from "./wait-push.ts";
 import { WaitStatusCache } from "./wait-status-cache.ts";
 
@@ -144,6 +145,10 @@ export class CrewBroker {
 	private readonly taskTokens = new Map<string, BrokerToken>();
 	private server: net.Server | null = null;
 	private resolvedSocketPath: string | null = null;
+	/** [3] stop-unlink race: dev+ino of the leaf we created, captured right
+	 *  after listen() succeeded. stop() removes the path only while this
+	 *  still matches (a rebound leaf is a new inode); see socket-stop.ts. */
+	private socketIdentity: SocketIdentity | null = null;
 	private stopped = false;
 	private startingPromise: Promise<void> | null = null;
 	private readonly connections = new Set<ServerConnection>();
@@ -350,6 +355,13 @@ export class CrewBroker {
 			}
 		});
 
+		// 4.5 [3] stop-unlink race: pin the fresh leaf's identity so stop()
+		//     can prove it still owns the path before removing it (win32
+		//     named pipes have no fs leaf — nothing to pin).
+		if (process.platform !== "win32") {
+			this.socketIdentity = await captureSocketIdentity(sockPath);
+		}
+
 		// 5. Tighten socket permissions on POSIX. Node's net module has no
 		//    `mode` option (unlike `fs`), so we chmod after listen() succeeds.
 		if (process.platform !== "win32") {
@@ -432,43 +444,46 @@ export class CrewBroker {
 		}
 		this.connections.clear();
 
-		// 2. Close the server itself.
-		if (this.server) {
-			await new Promise<void>((resolve) => {
-				const srv = this.server;
+		// 2+4. Close the server AND remove the socket path in one
+		//      ownership-gated step. [3] stop-unlink race: libuv unlinks the
+		//      bind path BY NAME when the listening handle closes, so the
+		//      unlink/shield decision must wrap the close itself — see
+		//      broker/socket-stop.ts. We never touch any other path and
+		//      never `process.kill` anything.
+		const srv = this.server;
+		this.server = null;
+		const sockPath = this.resolvedSocketPath ?? this.options.socketPath;
+		const closeServer = () =>
+			new Promise<void>((resolve) => {
 				if (!srv) return resolve();
 				srv.close(() => resolve());
 				// If the server is not currently listening, close() resolves
 				// synchronously — guard with a hard timeout for safety.
 				setTimeout(() => resolve(), 250).unref();
 			});
-			this.server = null;
+		if (sockPath && process.platform !== "win32") {
+			const outcome = await stopServerAndRemoveSocket(sockPath, this.socketIdentity, closeServer);
+			if (outcome === "shielded-foreign" || outcome === "unshielded-foreign") {
+				// Path exists but is not provably ours (rebound or never bound):
+				// we did not remove it — any corpse is left for
+				// removeStaleBrokerSocket at the next start (fail-safe design).
+				logInternalError(
+					"crew-broker.stop.unlink-skipped",
+					new Error(`socket path not provably owned (${outcome}); left for removeStaleBrokerSocket`),
+					`path=${redactSecretString(sockPath)}`,
+				);
+			}
+		} else {
+			await closeServer();
 		}
+		this.resolvedSocketPath = null;
+		this.socketIdentity = null;
 
 		// 3. Clear the token map. This is the single point where the heap
 		//    state for runIds is wiped. No persistence to clean up.
 		this.tokens.clear();
 		// Task 10: drop the taskId → token index with it.
 		this.taskTokens.clear();
-
-		// 4. Unlink the recorded socket file IF we created it. We never
-		//    touch any other path. We also never `process.kill` anything.
-		const sockPath = this.resolvedSocketPath ?? this.options.socketPath;
-		if (sockPath && process.platform !== "win32") {
-			try {
-				await fsp.unlink(sockPath);
-			} catch (err) {
-				const code = (err as NodeJS.ErrnoException).code;
-				if (code !== "ENOENT") {
-					logInternalError(
-						"crew-broker.stop.unlink-failed",
-						err instanceof Error ? err : new Error(String(err)),
-						`path=${redactSecretString(sockPath)}`,
-					);
-				}
-			}
-		}
-		this.resolvedSocketPath = null;
 	}
 
 	// Connection lifecycle
@@ -759,15 +774,7 @@ export class CrewBroker {
 			}
 		}
 
-		// Bounded identity checks. taskId must be a non-empty string.
-		if (typeof taskId !== "string" || taskId.length === 0 || taskId.length > 256) {
-			this.sendErrorAndClose(conn, id, "auth", "hello rejected");
-			return;
-		}
-		if (typeof runId !== "string" || runId.length === 0 || runId.length > 256) {
-			this.sendErrorAndClose(conn, id, "auth", "hello rejected");
-			return;
-		}
+		// taskId/runId/token bounds (non-empty, ≤256) are enforced upstream by isHelloParams — protocol/request-parsers.ts.
 
 		// Bind connection identity and ack. Ack never includes the token.
 		conn.authed = true;

package/src/runtime/broker/socket-stop.ts

@@ -0,0 +1,147 @@
+/**
+ * socket-stop.ts — Ownership-gated teardown of the broker's listening socket.
+ *
+ * An AF_UNIX listener has TWO unlink vectors, and both must be owned-gated:
+ *  1. The explicit `fs.unlink` of the recorded path (CrewBroker.stop step 4).
+ *  2. libuv itself: `uv__pipe_close` unlinks the server pipe's bind path BY
+ *     NAME (no inode check) when the listening handle closes — Node's
+ *     `server.close()` deletes whatever currently sits at the path, even a
+ *     socket another listener re-bound there after ours was unlinked
+ *     (empirically verified on Node 22, 2026-10-26).
+ *
+ * The broker socket path is deterministic per sessionId, so a rebound leaf
+ * must survive our stop(). stopServerAndRemoveSocket therefore:
+ *  - Unlinks the leaf itself FIRST when its dev+ino match the identity
+ *    captured at listen() time — libuv's close-unlink then finds nothing.
+ *  - Otherwise, if ANY entry lives at the path (rebound foreign socket, or
+ *    ownership unprovable because the capture lstat failed), renames it
+ *    aside (shield) across closeServer() and renames it back afterwards:
+ *    a brief ENOENT window for new connects instead of permanent deletion
+ *    of a live foreign socket. B-LOW2: the rename-back happens ONLY while
+ *    sockPath is still absent — if a new listener re-bound the leaf during
+ *    the close, its leaf wins and the shield is kept (renaming back would
+ *    clobber the fresh bind).
+ *    A stranded shield (crash between renames, or one kept after a rebind)
+ *    keeps its `.stopping.` suffix and is swept by the corpse sweep inside
+ *    removeStaleBrokerSocket at the next start — it unlinks a shield ONLY
+ *    when the pid embedded in its name is provably dead (B-LOW1).
+ *  - Windows named pipes have no filesystem leaf: plain close only.
+ *
+ * Never throws; diagnostics flow through logInternalError with redaction.
+ */
+
+import { randomBytes } from "node:crypto";
+import * as fsp from "node:fs/promises";
+import { logInternalError } from "../../utils/internal-error.ts";
+import { redactSecretString } from "../../utils/redaction.ts";
+
+/** dev+ino of the socket leaf created by listen() — captured immediately
+ *  after a successful bind so stop() can prove continued ownership of the
+ *  path before removing it. Null when the lstat failed (stop() then treats
+ *  the leaf as NOT provably ours — the safe direction). */
+export interface SocketIdentity {
+	dev: number;
+	ino: number;
+}
+
+/** Capture the identity of the freshly-bound socket leaf (POSIX only). */
+export async function captureSocketIdentity(sockPath: string): Promise<SocketIdentity | null> {
+	try {
+		const st = await fsp.lstat(sockPath);
+		return { dev: st.dev, ino: st.ino };
+	} catch {
+		return null;
+	}
+}
+
+export type SocketStopOutcome =
+	/** Our leaf (identity matched) was unlinked by us before the close. */
+	| "unlinked"
+	/** A foreign/unpinned entry existed and was shielded across the close. */
+	| "shielded-foreign"
+	/** A foreign entry existed but the shield rename failed (close then
+	 *  unlinks it by name — the pre-fix behavior; logged loudly). */
+	| "unshielded-foreign"
+	/** Nothing lived at the path (or win32: no fs leaf at all). */
+	| "absent";
+
+/** Close the listening server and remove the socket path ONLY while we
+ *  provably own it. `closeServer` must perform the net.Server close (the
+ *  libuv by-name unlink vector) — it is called exactly once, sandwiched
+ *  inside the ownership decision. Never throws. */
+export async function stopServerAndRemoveSocket(
+	sockPath: string,
+	identity: SocketIdentity | null,
+	closeServer: () => Promise<void>,
+): Promise<SocketStopOutcome> {
+	if (process.platform === "win32") {
+		await closeServer();
+		return "absent";
+	}
+	const current = await fsp.lstat(sockPath).catch(() => null);
+	if (current === null) {
+		await closeServer();
+		return "absent";
+	}
+	const owned = identity !== null && current.dev === identity.dev && current.ino === identity.ino;
+	if (owned) {
+		// Remove our own leaf first so libuv's close-unlink finds nothing.
+		// (Microsecond TOCTOU between this unlink and the close-unlink is
+		// inherent to path-based APIs — accepted, same class as before.)
+		await fsp.unlink(sockPath).catch(() => {
+			/* best-effort: the leaf may already be gone */
+		});
+		await closeServer();
+		return "unlinked";
+	}
+	// Foreign or unprovably-owned entry: shield it across the close.
+	const shield = `${sockPath}.stopping.${process.pid}.${randomBytes(3).toString("hex")}`;
+	let shielded = false;
+	try {
+		await fsp.rename(sockPath, shield);
+		shielded = true;
+	} catch (err) {
+		logInternalError(
+			"crew-broker.stop.shield-rename-failed",
+			err instanceof Error ? err : new Error(String(err)),
+			`path=${redactSecretString(sockPath)}`,
+		);
+	}
+	try {
+		await closeServer();
+	} finally {
+		if (shielded) {
+			// B-LOW2: restore ONLY while the leaf is still absent. While our
+			// handle was closing, a new listener may have bound sockPath — a
+			// rename back would REPLACE its fresh leaf (rename clobbers the
+			// target), recreating the exact deletion bug the shield exists to
+			// prevent. When rebound: keep the shield (the corpse sweep at the
+			// next start removes it once this pid is dead) and log loudly.
+			let rebound = false;
+			try {
+				await fsp.lstat(sockPath);
+				rebound = true;
+			} catch {
+				/* still absent — safe to restore */
+			}
+			if (rebound) {
+				logInternalError(
+					"crew-broker.stop.shield-kept-rebound",
+					new Error(`socket path re-bound during close — keeping shield at ${shield} instead of clobbering the new listener`),
+					`path=${redactSecretString(sockPath)}`,
+				);
+			} else {
+				try {
+					await fsp.rename(shield, sockPath);
+				} catch (err) {
+					logInternalError(
+						"crew-broker.stop.shield-restore-failed",
+						err instanceof Error ? err : new Error(String(err)),
+						`path=${redactSecretString(shield)}`,
+					);
+				}
+			}
+		}
+	}
+	return shielded ? "shielded-foreign" : "unshielded-foreign";
+}

package/src/runtime/child-pi/child-pi-kill.ts

@@ -57,6 +57,11 @@ const identityByPid = new Map<number, ProcIdentity>();
 // Wave 11a injection seam (same shape as zombie-scanner.ts `__test`): tests seed
 // identity snapshots and swap the group reaper without a real child process.
 let reapGroupImpl: typeof reapGroup = reapGroup;
+// Wave 16 (E1): injectable /proc identity reader for killProcessPid's PID-recycle
+// re-validation — tests simulate a recycled starttime without racing the OS for
+// a real pid reuse. registerActiveChild deliberately keeps the REAL reader (its
+// identityByPid snapshot is production /proc state, not a test fixture).
+let readProcIdentityImpl: typeof readProcIdentity = readProcIdentity;
 export const __test = {
 	/** Seed the exit-time identity snapshot for a pid (as registerActiveChild would). */
 	seedIdentity(pid: number, identity: ProcIdentity | undefined): void {
@@ -71,6 +76,10 @@ export const __test = {
 	setReapGroup(fn: typeof reapGroup | undefined): void {
 		reapGroupImpl = fn ?? reapGroup;
 	},
+	/** Replace the /proc identity reader used by killProcessPid's E1 re-validation (undefined restores the real one). */
+	setReadProcIdentity(fn: typeof readProcIdentity | undefined): void {
+		readProcIdentityImpl = fn ?? readProcIdentity;
+	},
 };
 
 // Periodic cleanup of dead child process entries to prevent memory leaks.
@@ -173,9 +182,24 @@ export function killProcessPid(pid: number): void {
 		void owned.dispose();
 		return;
 	}
+	// E1 (fix-wave 16): baseline the pid's /proc starttime (stat field 22) while
+	// it is alive at kill entry; the hard-kill timer below re-reads it and
+	// refuses to signal a CHANGED starttime — the original process exited during
+	// the grace window and an unrelated process recycled the pid. Effectively
+	// Linux-only: Windows has no /proc (readProcIdentity → undefined ⇒ no
+	// baseline ⇒ the timer keeps the pre-wave unconditional behavior — see the
+	// win32 branch note below), and /proc-less POSIX (macOS) degrades the same
+	// way. Deliberately NOT the registration-snapshot pattern (identityByPid):
+	// external pid-only callers — live-session agents, cancel paths on stale
+	// pids — have no registration to consult.
+	const baselineStarttime = process.platform === "win32" ? undefined : readProcIdentityImpl(pid)?.starttime;
 	try {
 		if (process.platform === "win32") {
 			// 3.8: Windows path uses taskkill /T /F (force kill the entire tree).
+			// E1 note: Windows has no /proc, so no starttime baseline/re-validation
+			// is possible here — behavior stays exactly as before. taskkill /T /F on
+			// a recycled pid fails harmlessly ("process not found"), so the residual
+			// recycle window is not actionable on this platform.
 			// taskkill itself can silently fail (PID gone, permission denied, etc.)
 			// so verify after 2s and log a warning if the process is still alive.
 			spawnTaskkillSafe(pid);
@@ -213,6 +237,26 @@ export function killProcessPid(pid: number): void {
 		}
 		clearHardKillTimer(pid);
 		const hardKillTimer = setTimeout(() => {
+			// E1: PID-recycle re-validation immediately before the hard kill —
+			// guards BOTH the group kill (-pid) below and the absolute-pid fallback
+			// inside its catch. Skip ONLY on a proven mismatch (baseline known AND
+			// current known AND different): an unreadable current value means the pid
+			// is already gone (the kill below reports ESRCH exactly as before) or
+			// /proc is unavailable on this platform (there was never a baseline to
+			// compare against).
+			const currentStarttime = readProcIdentityImpl(pid)?.starttime;
+			if (baselineStarttime !== undefined && currentStarttime !== undefined && currentStarttime !== baselineStarttime) {
+				logInternalError(
+					"child-pi.sigkill-pid-recycled",
+					new Error(
+						`starttime changed between SIGTERM and the hard-kill timer (${baselineStarttime} → ${currentStarttime}) — pid was recycled, skipping hard kill of the unrelated new occupant`,
+					),
+					`pid=${pid}`,
+					"warn",
+				);
+				childHardKillTimers.delete(pid);
+				return;
+			}
 			try {
 				process.kill(-pid, "SIGKILL");
 			} catch (error) {

package/src/runtime/child-pi/inference-broker.ts

@@ -36,7 +36,11 @@
  * Anthropic usage events; per-worker in-flight cap; revoke(workerKey) /
  * revokeAll() kill-switch (revoked token → 401 on the NEXT request; in-flight
  * requests are allowed to drain — killing sockets mid-stream corrupts
- * transcripts without adding security, the token is already dead).
+ * transcripts without adding security, the token is already dead). The token
+ * map is keyed by the SHA-256 digest of each token, never the raw secret
+ * (constant-time discipline, same pattern as crew-broker-tokens.ts); after
+ * registerInferenceWorker hands the raw token to the caller, the broker
+ * retains only its digest.
  *
  * Honest boundary: the broker protects the REUSABLE CREDENTIAL channel only.
  * A worker can still read other host files (~/.ssh, ~/.aws, ~/.pi/agent/
@@ -88,7 +92,10 @@ const STRIP_RESPONSE_HEADERS = new Set(["content-encoding", "content-length", "t
 
 interface WorkerEntry {
 	workerKey: string;
-	token: string;
+	/** SHA-256 hex digest of the worker token — the RAW secret is handed to
+	 *  the caller by registerInferenceWorker and never retained here
+	 *  (constant-time discipline, fix-wave TASK [5]). */
+	tokenDigest: string;
 	revoked: boolean;
 	requests: number;
 	inputTokens: number;
@@ -97,6 +104,15 @@ interface WorkerEntry {
 	maxTokens: number;
 }
 
+/** Map key for the per-worker token registry: the SHA-256 hex digest of the
+ * token, NEVER the raw secret — mirrors BrokerTokenRegistry.hashToken
+ * (runtime/broker/crew-broker-tokens.ts). Hashed locally with the identical
+ * implementation instead of importing the registry class, so this module's
+ * static import graph is untouched. */
+function tokenKey(token: string): string {
+	return crypto.createHash("sha256").update(token, "utf8").digest("hex");
+}
+
 export interface InferenceBrokerSnapshot {
 	active: boolean;
 	baseUrl: string;
@@ -121,7 +137,7 @@ interface BrokerState {
 	server: http.Server;
 	port: number;
 	routes: Map<string, ProviderRoute>; // by path prefix ("/anthropic", "/openai")
-	workers: Map<string, WorkerEntry>; // by token
+	workers: Map<string, WorkerEntry>; // by SHA-256 token digest (never the raw secret)
 	byKey: Map<string, WorkerEntry>; // by workerKey
 	scopedAgentDir: string;
 }
@@ -381,7 +397,7 @@ async function handleRequest(
 		}
 		// (1) Auth — fail-closed, generic errors (never echo tokens).
 		const token = extractToken(req);
-		const worker = token ? ctx.workers.get(token) : undefined;
+		const worker = token ? ctx.workers.get(tokenKey(token)) : undefined;
 		if (!worker || worker.revoked) {
 			deny(res, 401, "invalid or revoked inference token");
 			return;
@@ -535,13 +551,22 @@ export function registerInferenceWorker(workerKey: string): string {
 	const existing = broker.byKey.get(workerKey);
 	if (existing) {
 		existing.revoked = true;
-		broker.workers.delete(existing.token);
+		broker.workers.delete(existing.tokenDigest);
 		broker.byKey.delete(workerKey);
 	}
 	const token = crypto.randomBytes(32).toString("hex");
 	const maxTokens = getCrewEnvInt(INFERENCE_BUDGET_ENV) ?? 0;
-	const entry: WorkerEntry = { workerKey, token, revoked: false, requests: 0, inputTokens: 0, outputTokens: 0, inFlight: 0, maxTokens };
-	broker.workers.set(token, entry);
+	const entry: WorkerEntry = {
+		workerKey,
+		tokenDigest: tokenKey(token),
+		revoked: false,
+		requests: 0,
+		inputTokens: 0,
+		outputTokens: 0,
+		inFlight: 0,
+		maxTokens,
+	};
+	broker.workers.set(entry.tokenDigest, entry);
 	broker.byKey.set(workerKey, entry);
 	return token;
 }
@@ -574,7 +599,7 @@ export function revokeInferenceWorker(workerKey: string): boolean {
 	const entry = broker.byKey.get(workerKey);
 	if (!entry) return false;
 	entry.revoked = true;
-	broker.workers.delete(entry.token);
+	broker.workers.delete(entry.tokenDigest);
 	broker.byKey.delete(workerKey);
 	return true;
 }
@@ -616,3 +641,10 @@ export function stopInferenceBroker(): void {
 export function __resetInferenceBrokerForTests(): void {
 	stopInferenceBroker();
 }
+
+/** @internal TESTS ONLY — the live token-map keys. By construction these are
+ * SHA-256 digests (see tokenKey); the suite pins that no RAW token ever
+ * appears as a map key (constant-time discipline). */
+export function __inferenceBrokerTokenMapKeysForTests(): string[] {
+	return broker ? [...broker.workers.keys()] : [];
+}

package/src/runtime/goal-workflow/goal-achievement.ts

@@ -24,6 +24,7 @@ import { spawnSync } from "node:child_process";
 import type { TeamRunManifest, TeamTaskState } from "../../state/types.ts";
 import { findRepoRoot } from "../../utils/paths.ts";
 import type { WorkflowConfig } from "../../workflows/workflow-config.ts";
+import { buildGitSafeEnv, hardenGitArgs } from "../../worktree/git-hardening.ts";
 
 /**
  * Roles whose job is to EDIT project source/test files (changes that appear in
@@ -54,7 +55,15 @@ export function isGitWorkingTreeClean(cwd: string): { clean: boolean; repoRoot:
 		const repoRoot = findRepoRoot(cwd);
 		if (!repoRoot) return { clean: "unknown", repoRoot: undefined };
 		// `git status --porcelain` → empty stdout means a clean working tree.
-		const res = spawnSync("git", ["-C", repoRoot, "status", "--porcelain"], { encoding: "utf8", timeout: 5_000 });
+		// R-A5 (MED-1): previously spawnSync inherited the FULL process.env —
+		// API keys could leak to config-reachable helpers git spawns. Now the
+		// sanitized env + hardenGitArgs (cwd is the trusted manifest repo root,
+		// so no gitdir-pointer guard is needed here).
+		const res = spawnSync("git", hardenGitArgs(["-C", repoRoot, "status", "--porcelain"]), {
+			encoding: "utf-8",
+			timeout: 5_000,
+			env: buildGitSafeEnv(),
+		});
 		if (res.error || res.status !== 0) return { clean: "unknown", repoRoot: undefined };
 		return { clean: res.stdout.trim().length === 0, repoRoot };
 	} catch {

package/src/runtime/pi-spawn.ts

@@ -260,7 +260,16 @@ function resolvePiCliScript(): string | undefined {
 		process.env.APPDATA ? path.join(process.env.APPDATA, "npm", "node_modules", "@earendil-works", "pi-coding-agent") : undefined,
 		process.env.APPDATA ? path.join(process.env.APPDATA, "npm", "node_modules", "@mariozechner", "pi-coding-agent") : undefined,
 		path.dirname(fileURLToPath(import.meta.url)),
-		process.cwd(),
+		// E2 (fix-wave 16): the process.cwd() root is deliberately REMOVED.
+		// findPiPackageJsonFrom matches package.json by NAME only (no version or
+		// signature check), so a booby-trapped working directory carrying a fake
+		// package.json (name=@earendil-works/pi-coding-agent + bin) would get its
+		// attacker binary spawned with the worker env — which carries the
+		// inference-broker token. Legitimate installs stay covered by the roots
+		// above (argv1 package root, `npm root -g`, %APPDATA%\npm, and the
+		// import.meta install-dir walk, which still scans every ancestor
+		// node_modules chain via findPiPackageJsonFrom) plus the bare-"pi" PATH
+		// fallback in getPiSpawnCommand.
 	].filter((entry): entry is string => Boolean(entry));
 
 	for (const root of roots) {

package/src/runtime/process-status.ts

@@ -119,6 +119,22 @@ export function hasFreshTaskHeartbeatEvidence(
 	});
 }
 
+/**
+ * Wave 16 (residual render wiring, GAP-4): tight heartbeat-liveness guard for
+ * ACTIVE display — mirrors the orphan predicate's own preconditions (active
+ * status, non-async) so a terminal or async run is never resurrected by a
+ * heartbeat. A healthy direct run mid-long-tool freezes manifest `updatedAt`
+ * and agent progress (event-driven writes) but keeps stamping
+ * `task.heartbeat.lastSeenAt`, so fresh evidence means the run is alive.
+ * Single home for the guard that run-dashboard previously kept private and
+ * agents-jobs-browser inlined; call sites OR this in ONLY — every non-stale
+ * branch and layout stays untouched. PURE: takes the tasks the caller already
+ * holds in scope (no disk read here).
+ */
+export function heartbeatLiveForDisplay(run: TeamRunManifest, tasks: TeamTaskState[] | undefined, now = Date.now()): boolean {
+	return isActiveRunStatus(run.status) && !run.async && hasFreshTaskHeartbeatEvidence(tasks, now);
+}
+
 export function isLikelyOrphanedActiveRun(
 	run: TeamRunManifest,
 	agents: CrewAgentRecord[] = [],