pi-crew 0.11.43 → 0.11.45

package/src/runtime/task-runner/post-execution.ts

@@ -30,6 +30,8 @@ import type {
 	UsageState,
 	VerificationEvidence,
 } from "../../state/types.ts";
+import { logInternalError } from "../../utils/internal-error.ts";
+import { buildGitSafeEnv, hardenGitArgs, worktreeTrustCheck } from "../../worktree/git-hardening.ts";
 import { captureWorktreeDiffAsync, captureWorktreeDiffStatAsync } from "../../worktree/worktree-manager.ts";
 import { appendTaskAttentionEvent } from "../attention-events.ts";
 import { extractCommandTrace } from "../command-trace.ts";
@@ -150,16 +152,48 @@ const DRIFT_BLOCK_MARKER = /DRIFT-BLOCK\b/i;
  * READ-ONLY lanes — any entry (modified OR untracked) is an unexpected
  * mutation. Returns undefined when the tree is clean or git fails (fail-open:
  * a broken probe must not break task finalization). Note-only, never a fail.
+ * R-A2 exception: a FAILED GITDIR-POINTER GUARD is not a broken probe but a
+ * live corruption signal — it reports a mutation note (see body).
  */
 export async function detectReadLaneMutation(worktreePath: string): Promise<NonNullable<TeamTaskState["unexpectedMutation"]> | undefined> {
 	try {
+		// R-A2 (MED-1 follow-up): this probe used to be a raw execFile with the
+		// FULL process.env — API keys could leak to worker-planted fsmonitor /
+		// hook config reachable from the probed worktree. It now routes through
+		// the MED-1 hardening: hardenGitArgs config-injection overrides, the
+		// sanitized git env (no process.env inheritance), and the gitdir-pointer
+		// guard. Guard failure is fail-safe TOWARD REPORTING a mutation: a
+		// corrupted `.git` pointer in a READ-ONLY lane is itself a lane
+		// violation (the worker rewrote something it must not touch), so it
+		// surfaces as a note + internal log instead of a clean verdict.
+		const trust = worktreeTrustCheck(worktreePath);
+		if (trust.kind === "worktree" && !trust.ok) {
+			logInternalError(
+				"post-execution.readLane.gitdirMismatch",
+				new Error(`Refusing to run the mutation probe inside ${worktreePath}: ${trust.reason}`),
+				`worktreePath=${worktreePath}`,
+			);
+			return {
+				filesChanged: 0,
+				sample: [`worktree corrupted — gitdir pointer check failed (${trust.reason}); no git executed`],
+			};
+		}
 		// W10-8 one-shot git probe per read-only task — child_process is
 		// already in the platform; dynamic keeps it off the static import graph.
 		// LAZY: see above
 		const { execFile } = await import("node:child_process");
 		const out: string = await new Promise((resolve, reject) => {
-			execFile("git", ["status", "--porcelain"], { cwd: worktreePath, encoding: "utf-8", timeout: 10_000 }, (err, stdout) =>
-				err ? reject(err) : resolve(stdout),
+			execFile(
+				"git",
+				hardenGitArgs(["status", "--porcelain"]),
+				{
+					cwd: worktreePath,
+					env: buildGitSafeEnv(),
+					encoding: "utf-8",
+					timeout: 10_000,
+					windowsHide: true,
+				},
+				(err, stdout) => (err ? reject(err) : resolve(stdout)),
 			);
 		});
 		const entries = out

package/src/ui/agents-jobs-browser.ts

@@ -60,7 +60,7 @@ import type { CrewAgentRecord } from "../runtime/crew-agent-runtime.ts";
 import type { LiveAgentHandle } from "../runtime/live-session/live-agent-manager.ts";
 import type { ManifestCache } from "../runtime/manifest-cache.ts";
 import { createManifestCache } from "../runtime/manifest-cache.ts";
-import { hasFreshTaskHeartbeatEvidence, isActiveRunStatus, isDisplayActiveRun } from "../runtime/process-status.ts";
+import { heartbeatLiveForDisplay, isDisplayActiveRun } from "../runtime/process-status.ts";
 import type { ScheduledJob } from "../runtime/scheduling/scheduler.ts";
 import { surfaceGateEnvSnapshot } from "../runtime/surface/resolve-surface.ts";
 import { getTaskUsage } from "../runtime/usage-tracker.ts";
@@ -504,8 +504,7 @@ export class AgentsJobsBrowser {
 					// heartbeats are fresh (this loop already does per-run I/O — one more
 					// coalesced read is in-pattern). Terminal/async runs are never
 					// resurrected (isActiveRunStatus && !run.async).
-					const heartbeatLive =
-						isActiveRunStatus(run.status) && !run.async && hasFreshTaskHeartbeatEvidence(readLegacyRunTasks(run), nowMs);
+					const heartbeatLive = heartbeatLiveForDisplay(run, readLegacyRunTasks(run), nowMs);
 					if (isDisplayActiveRun(run, agents, nowMs) || heartbeatLive) runs.push({ run, agents });
 				} catch {
 					/* unreadable — skip */

package/src/ui/powerbar-publisher.ts

@@ -5,7 +5,7 @@ import { readCrewAgents } from "../runtime/crew-agent-records.ts";
 import { listLiveAgents, listLiveAgentsByWorkspace } from "../runtime/live-session/live-agent-manager.ts";
 import type { ManifestCache } from "../runtime/manifest-cache.ts";
 import { isPlanApprovalPending } from "../runtime/plan-approval.ts";
-import { isDisplayActiveRun } from "../runtime/process-status.ts";
+import { heartbeatLiveForDisplay, isDisplayActiveRun } from "../runtime/process-status.ts";
 import type { TeamRunManifest, TeamTaskState } from "../state/types.ts";
 import { aggregateUsage } from "../state/usage.ts";
 import { readJsonFileCoalesced } from "../utils/file-coalescer.ts";
@@ -307,7 +307,11 @@ class PowerbarPublisher {
 				}
 				return { run, agents, tasks: readTasks(run.tasksPath), snapshot };
 			})
-			.filter((item) => isDisplayActiveRun(item.run, item.agents));
+			// Wave 16 (residual render wiring): item.tasks is already in scope
+			// (snapshot.tasks | readTasks fallback) — OR-ing the heartbeat guard in
+			// adds ZERO extra disk reads; a frozen-manifest run stays in the
+			// powerbar while its task heartbeats stay fresh.
+			.filter((item) => isDisplayActiveRun(item.run, item.agents) || heartbeatLiveForDisplay(item.run, item.tasks));
 		if (!active.length) {
 			this.#lastActiveKey = undefined;
 			this.#lastProgressKey = undefined;

package/src/ui/run-dashboard.ts

@@ -10,12 +10,7 @@ import { readCrewAgents } from "../runtime/crew-agent-records.ts";
 import type { CrewAgentRecord } from "../runtime/crew-agent-runtime.ts";
 import { getLiveAgentContextPercent } from "../runtime/live-session/live-agent-manager.ts";
 import { isPlanApprovalPending } from "../runtime/plan-approval.ts";
-import {
-	hasFreshTaskHeartbeatEvidence,
-	isActiveRunStatus,
-	isDisplayActiveRun,
-	isLikelyOrphanedActiveRun,
-} from "../runtime/process-status.ts";
+import { heartbeatLiveForDisplay, isActiveRunStatus, isDisplayActiveRun, isLikelyOrphanedActiveRun } from "../runtime/process-status.ts";
 import type { ScheduledJob } from "../runtime/scheduling/scheduler.ts";
 import type { TeamRunManifest, TeamTaskState, UsageState } from "../state/types.ts";
 import { aggregateUsage } from "../state/usage.ts";
@@ -368,19 +363,6 @@ function taskForAgent(tasks: TeamTaskState[], agent: CrewAgentRecord): TeamTaskS
 	return tasks.find((task) => task.id === agent.taskId);
 }
 
-/**
- * Wave 15 (F2, GAP-0): tight heartbeat-liveness guard for ACTIVE display —
- * mirrors the orphan predicate's own preconditions (active status, non-async)
- * so a terminal or async run is never resurrected by a heartbeat. A healthy
- * direct run mid-long-tool freezes manifest `updatedAt` and agent progress
- * (event-driven writes) but keeps stamping `task.heartbeat.lastSeenAt`, so
- * fresh evidence means the run is alive. Call sites OR this in ONLY — every
- * non-stale branch and layout stays untouched.
- */
-function heartbeatLiveForDisplay(run: TeamRunManifest, tasks: TeamTaskState[] | undefined, now = Date.now()): boolean {
-	return isActiveRunStatus(run.status) && !run.async && hasFreshTaskHeartbeatEvidence(tasks, now);
-}
-
 function modelForTask(task: TeamTaskState | undefined): string | undefined {
 	const attempts = task?.modelAttempts;
 	if (!attempts?.length) return undefined;

package/src/ui/widget/widget-model.ts

@@ -9,7 +9,7 @@ import { readCrewAgents } from "../../runtime/crew-agent-records.ts";
 import type { CrewAgentRecord } from "../../runtime/crew-agent-runtime.ts";
 import { evictStaleLiveAgentHandles } from "../../runtime/live-session/live-agent-manager.ts";
 import type { ManifestCache } from "../../runtime/manifest-cache.ts";
-import { isDisplayActiveRun } from "../../runtime/process-status.ts";
+import { heartbeatLiveForDisplay, isDisplayActiveRun } from "../../runtime/process-status.ts";
 import { reconcileAllStaleRuns } from "../../runtime/recovery/crash-recovery.ts";
 import type { TeamRunManifest } from "../../state/types.ts";
 import { goalFlagSuffix } from "../goal-flag.ts";
@@ -61,42 +61,55 @@ export function activeWidgetRuns(
 	// workspaceId stays in scope: crash recovery below is still session-scoped.
 	const runs = preloadedManifests ?? (manifestCache ? manifestCache.list(20) : listRecentRuns(cwd, 20));
 
-	return runs
-		.map((run) => {
-			try {
-				// U7 (spec 2026-10-09): prefer the committed-state read when the
-				// cache exposes it. `readForRender` returns the SAME cached
-				// snapshot `get` would (identical render — parity), but a lapsed
-				// TTL schedules the coalesced ASYNC refresh (80ms batch → stamp
-				// check → rebuild only when files changed) instead of waiting for
-				// an external poller to notice. Structural check: legacy callers
-				// and test doubles may implement only `get`.
-				const committed = snapshotCache as
-					| { readForRender?: (runId: string) => RunUiSnapshot | undefined; get?: (runId: string) => RunUiSnapshot | undefined }
-					| undefined;
-				const snapshot =
-					typeof committed?.readForRender === "function" ? committed.readForRender(run.runId) : snapshotCache?.get(run.runId);
-				if (snapshot) {
-					return {
-						run: snapshot.manifest,
-						agents: snapshot.agents,
-						snapshot,
-					};
+	return (
+		runs
+			.map((run) => {
+				try {
+					// U7 (spec 2026-10-09): prefer the committed-state read when the
+					// cache exposes it. `readForRender` returns the SAME cached
+					// snapshot `get` would (identical render — parity), but a lapsed
+					// TTL schedules the coalesced ASYNC refresh (80ms batch → stamp
+					// check → rebuild only when files changed) instead of waiting for
+					// an external poller to notice. Structural check: legacy callers
+					// and test doubles may implement only `get`.
+					const committed = snapshotCache as
+						| {
+								readForRender?: (runId: string) => RunUiSnapshot | undefined;
+								get?: (runId: string) => RunUiSnapshot | undefined;
+						  }
+						| undefined;
+					const snapshot =
+						typeof committed?.readForRender === "function" ? committed.readForRender(run.runId) : snapshotCache?.get(run.runId);
+					if (snapshot) {
+						return {
+							run: snapshot.manifest,
+							agents: snapshot.agents,
+							snapshot,
+						};
+					}
+					// P0-6: render from snapshots only — never read disk on every
+					// render tick. When the snapshot cache is provided but hasn't
+					// populated yet (first frame after `updateCrewWidget`), drop the
+					// run from the result so the widget paints "(loading…)" instead
+					// of calling `agentsFor(run) → readCrewAgents`. Legacy callers
+					// (no snapshotCache) keep the disk-read fallback for tests/dev.
+					if (snapshotCache) return null;
+					return { run, agents: agentsFor(run) };
+				} catch {
+					if (snapshotCache) return null;
+					return { run, agents: agentsFor(run) };
 				}
-				// P0-6: render from snapshots only — never read disk on every
-				// render tick. When the snapshot cache is provided but hasn't
-				// populated yet (first frame after `updateCrewWidget`), drop the
-				// run from the result so the widget paints "(loading…)" instead
-				// of calling `agentsFor(run) → readCrewAgents`. Legacy callers
-				// (no snapshotCache) keep the disk-read fallback for tests/dev.
-				if (snapshotCache) return null;
-				return { run, agents: agentsFor(run) };
-			} catch {
-				if (snapshotCache) return null;
-				return { run, agents: agentsFor(run) };
-			}
-		})
-		.filter((item): item is WidgetRun => item !== null && isDisplayActiveRun(item.run, item.agents));
+			})
+			// Wave 16 (residual render wiring): the dock's high-frequency tick NEVER
+			// gains a disk read here — only the snapshot the render path already
+			// holds. OR-in ONLY: a run hidden because its manifest froze mid-long-tool
+			// stays visible while its task heartbeats are fresh (GAP-4 mix-A).
+			.filter(
+				(item): item is WidgetRun =>
+					item !== null &&
+					(isDisplayActiveRun(item.run, item.agents, now) || heartbeatLiveForDisplay(item.run, item.snapshot?.tasks, now)),
+			)
+	);
 }
 
 /**

package/src/utils/socket-path.ts

@@ -122,11 +122,62 @@ export async function prepareBrokerSocketDir(sockPath: string): Promise<void> {
 	}
 }
 
+/** Literal-escaping helper for building filesystem-name regexes. */
+function escapeRegExp(literal: string): string {
+	return literal.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+}
+
+/**
+ * B-LOW1: sweep `${sockPath}.stopping.<pid>.<hex>` shield corpses left by
+ * broker/socket-stop.ts. stopServerAndRemoveSocket renames a foreign/unpinned
+ * socket leaf aside across the libuv close-unlink window and renames it back
+ * afterwards; a crash between those renames strands the shield forever — the
+ * plain removeStaleBrokerSocket flow only ever looks at `sockPath` itself, so
+ * the corpses previously accumulated one per crashed stop.
+ *
+ * A corpse is removed ONLY when the pid embedded in its name is provably dead
+ * (process.kill(pid, 0) → ESRCH). EPERM/any other signal result means the pid
+ * is alive (or its liveness cannot be proven) — the shield is kept (fail-safe:
+ * a live broker may still restore it). Best-effort: never throws.
+ */
+async function sweepStoppingShields(sockPath: string): Promise<void> {
+	if (process.platform === "win32") return; // named pipes have no fs leaves
+	const dir = path.dirname(sockPath);
+	const pattern = new RegExp(`^${escapeRegExp(path.basename(sockPath))}\\.stopping\\.(\\d+)\\.[0-9a-f]{1,32}$`);
+	let entries: string[];
+	try {
+		entries = await fsp.readdir(dir);
+	} catch {
+		return;
+	}
+	for (const entry of entries) {
+		const match = pattern.exec(entry);
+		if (!match) continue;
+		const pid = Number.parseInt(match[1]!, 10);
+		if (!Number.isInteger(pid) || pid <= 0) continue;
+		try {
+			process.kill(pid, 0);
+			continue; // pid alive — keep the shield
+		} catch (err) {
+			const code = (err as NodeJS.ErrnoException).code;
+			if (code !== "ESRCH") continue; // cannot prove dead — keep
+		}
+		try {
+			await fsp.unlink(path.join(dir, entry));
+		} catch {
+			/* best-effort */
+		}
+	}
+}
+
 /** Connect-then-unlink stale socket (herdr pattern). If a live broker is
  *  listening, leave the endpoint intact (EADDRINUSE will surface on bind).
  *  If a stale file exists with no listener, remove it. If the path is a
  *  symlink, refuse rather than follow.
  *
+ *  Also sweeps `${sockPath}.stopping.*` shield corpses whose recorded pid is
+ *  dead (B-LOW1 — see sweepStoppingShields).
+ *
  *  Returns "removed" when the stale entry was unlinked, "kept" when a live
  *  listener was detected, "absent" when no entry existed, "refused"
  *  when the entry is a symlink. */
@@ -138,6 +189,9 @@ export async function removeStaleBrokerSocket(
 	// the timeout branch without racing a real localhost connect.
 	netModule?: { createConnection: (path: string) => { once: (ev: string, fn: (arg?: unknown) => void) => void; destroy: () => void } },
 ): Promise<"removed" | "kept" | "absent" | "refused"> {
+	// B-LOW1: sweep stranded stop-shields first (best-effort, never affects the
+	// sockPath verdict below).
+	await sweepStoppingShields(sockPath);
 	// Reject symlinks outright.
 	let st: Awaited<ReturnType<typeof fsp.lstat>>;
 	try {

package/src/worktree/branch-freshness.ts

@@ -1,25 +1,12 @@
 import { execFileSync } from "node:child_process";
-import { WINDOWS_ESSENTIAL_ENV_VARS } from "../utils/env-allowlist.ts";
-import { sanitizeEnvSecrets } from "../utils/env-filter.ts";
+import { buildGitSafeEnv, hardenGitArgs } from "../worktree/git-hardening.ts";
 
-// Read-only git operations only (rev-list, rev-parse, log). Sanitize env to
-// avoid leaking API keys/tokens to any git hook/alias/credential-helper.
-// C-1 fix (code-review 2026-06-23): previously inherited the full parent env.
-const GIT_SAFE_ENV = sanitizeEnvSecrets(process.env, {
-	allowList: [
-		"PATH",
-		"HOME",
-		"USER",
-		...WINDOWS_ESSENTIAL_ENV_VARS,
-		"SHELL",
-		"TERM",
-		"LANG",
-		"LC_ALL",
-		"GIT_CONFIG_GLOBAL",
-		"GIT_CONFIG_SYSTEM",
-		"GIT_EXEC_PATH",
-	],
-});
+// Read-only git operations only (rev-list, rev-parse, log). C-1 fix
+// (code-review 2026-06-23): never inherit the full parent env — API keys
+// must not reach git hooks/aliases/credential-helpers. R-A6 (MED-1
+// uniformity): env + argv now come from the shared git-hardening helpers
+// (sanitizeEnvSecrets allowList, GIT_CONFIG_NOSYSTEM=1, config-injection
+// overrides) instead of a drifting local GIT_SAFE_ENV copy.
 
 export type BranchFreshnessStatus = "fresh" | "stale" | "diverged" | "unknown";
 export type StaleBranchPolicy = "warn" | "block" | "auto_rebase" | "auto_merge_forward";
@@ -36,11 +23,11 @@ export interface BranchFreshness {
 }
 
 function git(cwd: string, args: string[]): string {
-	return execFileSync("git", args, {
+	return execFileSync("git", hardenGitArgs(args), {
 		cwd,
+		env: buildGitSafeEnv(),
 		encoding: "utf-8",
 		stdio: ["ignore", "pipe", "pipe"],
-		env: GIT_SAFE_ENV,
 		windowsHide: true,
 	}).trim();
 }

package/src/worktree/cleanup.ts

@@ -4,10 +4,15 @@ import * as path from "node:path";
 import { DEFAULT_PATHS } from "../config/defaults.ts";
 import { writeArtifact } from "../state/stores/artifact-store.ts";
 import type { TeamRunManifest } from "../state/types.ts";
-import { WINDOWS_ESSENTIAL_ENV_VARS } from "../utils/env-allowlist.ts";
-import { sanitizeEnvSecrets } from "../utils/env-filter.ts";
 import { logInternalError } from "../utils/internal-error.ts";
 import { projectCrewRoot } from "../utils/paths.ts";
+import {
+	assertWorktreePointerTrusted,
+	buildGitSafeEnv,
+	hardenGitArgs,
+	resolveTrustedGitDir,
+	verifyWorktreeGitdirPointer,
+} from "./git-hardening.ts";
 
 export interface WorktreeCleanupResult {
 	removed: string[];
@@ -17,39 +22,16 @@ export interface WorktreeCleanupResult {
 	committedBranches: string[];
 }
 
-// SECURITY: PI_* and PI_CREW_* wildcards removed — they could match secret vars like PI_PASSWORD.
-// Git operations do not need PI_CREW_* execution-control vars.
-const GIT_SAFE_ENV = {
-	...sanitizeEnvSecrets(process.env, {
-		allowList: [
-			"PATH",
-			"HOME",
-			"USER",
-			...WINDOWS_ESSENTIAL_ENV_VARS,
-			"SHELL",
-			"TERM",
-			"LANG",
-			"LC_ALL",
-			"LC_COLLATE",
-			"LC_CTYPE",
-			"LC_MESSAGES",
-			"XDG_CONFIG_HOME",
-			"XDG_DATA_HOME",
-			"XDG_CACHE_HOME",
-			"NVM_BIN",
-			"NVM_DIR",
-			"NODE_PATH",
-			"GIT_CONFIG_GLOBAL",
-			"GIT_CONFIG_SYSTEM",
-			"GIT_AUTHOR_NAME",
-			"GIT_AUTHOR_EMAIL",
-			"GIT_COMMITTER_NAME",
-			"GIT_COMMITTER_EMAIL",
-		],
-	}),
-	LANG: "C",
-	LC_ALL: "C",
-};
+// MED-1 / R-A4: shared sanitized env for every git spawn (see
+// buildGitSafeEnv in git-hardening.ts — allowList-based secret stripping,
+// GIT_CONFIG_NOSYSTEM=1, GIT_CONFIG_SYSTEM dropped from the allowlist,
+// GIT_CONFIG_GLOBAL kept for commit identity with the documented residual
+// that trusted-config filter definitions remain executable).
+// Built per call (not module-load) so late env changes (tests, config reload)
+// are honored.
+function gitSafeEnv(): Record<string, string> {
+	return buildGitSafeEnv();
+}
 
 function sanitizeBranchPart(value: string): string {
 	return (
@@ -66,12 +48,20 @@ function sanitizeFilename(value: string): string {
 }
 
 function git(cwd: string, args: string[]): string {
+	// R-A3: re-verify the gitdir pointer before EVERY command whose cwd sits
+	// inside a linked worktree (TOCTOU: the entry-level guard in
+	// cleanupRunWorktrees can be invalidated by a still-live worker flipping
+	// the `.git` pointer mid-chain). Throws OUTSIDE the execFile try so the
+	// error propagates unwrapped into the existing "corrupted" handling paths.
+	assertWorktreePointerTrusted(cwd);
 	try {
-		return execFileSync("git", args, {
+		// MED-1: harden EVERY git invocation (config-injection overrides +
+		// diff/commit neutralizers). See src/worktree/git-hardening.ts.
+		return execFileSync("git", hardenGitArgs(args), {
 			cwd,
+			env: gitSafeEnv(),
 			encoding: "utf-8",
 			stdio: ["ignore", "pipe", "pipe"],
-			env: GIT_SAFE_ENV,
 			windowsHide: true,
 		}).trim();
 	} catch (error) {
@@ -116,6 +106,9 @@ export function cleanupRunWorktrees(
 		committedBranches: [],
 	};
 	if (!fs.existsSync(worktreeRoot)) return result;
+	// MED-1: resolve the TRUSTED git common dir once (from the orchestrator-owned
+	// main repo — never from inside a worktree) for the per-entry gitdir guard.
+	const trustedGitDir = resolveTrustedGitDir(manifest.cwd);
 
 	// M3 fix: use withFileTypes to avoid race between readdirSync and statSync.
 	// Rely on Dirent.isDirectory() instead of a separate statSync to eliminate TOCTOU window.
@@ -127,6 +120,46 @@ export function cleanupRunWorktrees(
 		if (options.signal?.aborted) break;
 		const worktreePath = path.join(worktreeRoot, entry.name);
 		if (options.signal?.aborted) break;
+		// MED-1 gitdir-hijack guard: a worker can rewrite the worktree `.git`
+		// pointer file to an attacker-controlled directory whose poisoned `config`
+		// would execute hooks/filters/fsmonitor in the orchestrator context. Before
+		// ANY git runs with cwd inside the worktree, the pointer must resolve to the
+		// git-registered admin dir (see src/worktree/git-hardening.ts). On mismatch
+		// NO git runs from inside; removal is only attempted (force) from the
+		// trusted main-repo cwd, and the worktree is otherwise preserved.
+		const gitdirCheck = trustedGitDir
+			? verifyWorktreeGitdirPointer(worktreePath, trustedGitDir)
+			: { ok: false, reason: `main repository git dir not found under ${manifest.cwd}` };
+		if (!gitdirCheck.ok) {
+			logInternalError(
+				"cleanup.worktree.gitdirMismatch",
+				new Error(`Refusing to run git inside ${worktreePath}: ${gitdirCheck.reason}`),
+				`runId=${manifest.runId}`,
+			);
+			if (options.force) {
+				let removed = false;
+				try {
+					git(manifest.cwd, ["worktree", "remove", "--force", worktreePath]);
+					removed = true;
+				} catch {
+					try {
+						fs.rmSync(worktreePath, { recursive: true, force: true });
+						removed = true;
+					} catch {
+						/* keep as preserved */
+					}
+				}
+				if (removed) {
+					result.removed.push(worktreePath);
+					continue;
+				}
+			}
+			result.preserved.push({
+				path: worktreePath,
+				reason: `worktree corrupted — gitdir pointer check failed (${gitdirCheck.reason}); no git executed inside; inspect manually or remove with force=true`,
+			});
+			continue;
+		}
 		const dirty = isDirty(worktreePath);
 		const branchName = `pi-crew/${manifest.runId}/${sanitizeBranchPart(entry.name)}`;
 		const safeBranchName = sanitizeBranchPart(entry.name);
@@ -156,13 +189,9 @@ export function cleanupRunWorktrees(
 			try {
 				// Issue 2 fix: verify status before and after add to ensure atomicity
 				const statusBefore = git(worktreePath, ["status", "--porcelain"]);
-				execFileSync("git", ["add", "-A"], {
-					cwd: worktreePath,
-					encoding: "utf-8",
-					stdio: ["ignore", "pipe", "pipe"],
-					env: GIT_SAFE_ENV,
-					windowsHide: true,
-				});
+				// MED-1: routed through the hardened git() helper (fsmonitor/hooksPath
+				// disabled) — a worker-planted config must not execute on `git add`.
+				git(worktreePath, ["add", "-A"]);
 				// Verify no unexpected changes were added (only staged the original dirty files)
 				const statusAfterAdd = git(worktreePath, ["status", "--porcelain"]);
 				if (statusAfterAdd !== statusBefore) {
@@ -177,37 +206,21 @@ export function cleanupRunWorktrees(
 				if (safeDesc.includes("\n")) {
 					safeDesc = safeDesc.replace(/[\x00-\x08\x0B\x0C\x0E-\x1F\x7F]+/g, " ");
 				}
-				execFileSync("git", ["commit", "-m", `pi-crew: ${safeDesc}`], {
-					cwd: worktreePath,
-					encoding: "utf-8",
-					stdio: ["ignore", "pipe", "pipe"],
-					env: GIT_SAFE_ENV,
-					windowsHide: true,
-				});
+				// MED-1: --no-verify + hooksPath= neutralize every commit hook
+				// (pre-commit/commit-msg/prepare-commit-msg/post-commit).
+				git(worktreePath, ["commit", "-m", `pi-crew: ${safeDesc}`]);
 				// Issue 1 fix: check signal before branch creation
 				if (options.signal?.aborted) break;
 				// Create branch in the main repo pointing to this worktree's HEAD
 				let branchError: Error | null = null;
 				try {
-					execFileSync("git", ["branch", branchName], {
-						cwd: worktreePath,
-						encoding: "utf-8",
-						stdio: ["ignore", "pipe", "pipe"],
-						env: GIT_SAFE_ENV,
-						windowsHide: true,
-					});
+					git(worktreePath, ["branch", branchName]);
 				} catch (err) {
 					branchError = err instanceof Error ? err : new Error(String(err));
 					// Branch already exists — use timestamp suffix
 					const tsBranch = `${branchName}-${Date.now()}`;
 					try {
-						execFileSync("git", ["branch", tsBranch], {
-							cwd: worktreePath,
-							encoding: "utf-8",
-							stdio: ["ignore", "pipe", "pipe"],
-							env: GIT_SAFE_ENV,
-							windowsHide: true,
-						});
+						git(worktreePath, ["branch", tsBranch]);
 					} catch (err2) {
 						// Both branch attempts failed — accumulate error for outer catch
 						const err2_msg = err2 instanceof Error ? err2.message : String(err2);