pi-crew 0.11.44 → 0.11.45

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "pi-crew",
-	"version": "0.11.44",
+	"version": "0.11.45",
 	"description": "Pi extension for coordinated AI teams, workflows, worktrees, and async task orchestration",
 	"author": "baphuongna",
 	"license": "MIT",

package/src/extension/cross-extension-rpc.ts

@@ -165,12 +165,21 @@ function on(events: EventBusLike, channel: string, handler: (raw: unknown) => un
 // pi-crew:rpc:live-control, and the realtime pi-crew:live-control channel) are
 // accessible to any extension on the shared event bus. Mitigations: rate
 // limiting, explicit intent, operation allowlist, cwd containment validation,
-// and HMAC origin signing (see rpc-hmac.ts). Trust model (R7-9): without a
-// valid HMAC signature every RPC surface is read-only — the request/response
-// channels enforce this via RPC_ALLOWED_OPERATIONS, and the realtime
-// pi-crew:live-control channel rejects any operation outside
-// LIVE_CONTROL_UNAUTHENTICATED_OPERATIONS (currently ALL of them, since
-// steer/stop/resume/follow-up are mutating) with a warn log and no publish.
+// and HMAC origin signing (see rpc-hmac.ts). Trust model (R7-9) — what a
+// publisher WITHOUT a valid HMAC signature may do:
+//   - pi-crew:rpc:run is the ONLY mutating channel that accepts unsigned
+//     requests. This is deliberate (SEC-03, test-pinned backward-compat):
+//     each call is rate-limited (RPC_RATE_LIMIT_MAX requests per
+//     RPC_RATE_LIMIT_WINDOW_MS — 5/60s), the payload is filtered to the
+//     ALLOWED_RPC_RUN_KEYS allowlist (unknown keys are stripped before
+//     handleTeamTool ever sees them), and config.cwd must pass containment
+//     validation (inside the project directory).
+//   - The remaining request/response channels are read-only for unsigned
+//     publishers, enforced via RPC_ALLOWED_OPERATIONS.
+//   - The realtime pi-crew:live-control channel rejects ALL unsigned
+//     operations — LIVE_CONTROL_UNAUTHENTICATED_OPERATIONS is the empty set
+//     (steer/stop/resume/follow-up are all mutating) — with a warn log and no
+//     publish.
 
 export function registerPiCrewRpc(
 	events: EventBusLike | undefined,

package/src/runtime/broker/crew-broker.ts

@@ -90,6 +90,7 @@ import {
 } from "./protocol/request-parsers.ts";
 import { recordWaitPolicyRejection, waitAuthError } from "./protocol/wait-auth.ts";
 import { handleWaitResolve } from "./protocol/wait-resolve.ts";
+import { captureSocketIdentity, type SocketIdentity, stopServerAndRemoveSocket } from "./socket-stop.ts";
 import { pushWaitingToForegroundWaiter } from "./wait-push.ts";
 import { WaitStatusCache } from "./wait-status-cache.ts";
 
@@ -144,6 +145,10 @@ export class CrewBroker {
 	private readonly taskTokens = new Map<string, BrokerToken>();
 	private server: net.Server | null = null;
 	private resolvedSocketPath: string | null = null;
+	/** [3] stop-unlink race: dev+ino of the leaf we created, captured right
+	 *  after listen() succeeded. stop() removes the path only while this
+	 *  still matches (a rebound leaf is a new inode); see socket-stop.ts. */
+	private socketIdentity: SocketIdentity | null = null;
 	private stopped = false;
 	private startingPromise: Promise<void> | null = null;
 	private readonly connections = new Set<ServerConnection>();
@@ -350,6 +355,13 @@ export class CrewBroker {
 			}
 		});
 
+		// 4.5 [3] stop-unlink race: pin the fresh leaf's identity so stop()
+		//     can prove it still owns the path before removing it (win32
+		//     named pipes have no fs leaf — nothing to pin).
+		if (process.platform !== "win32") {
+			this.socketIdentity = await captureSocketIdentity(sockPath);
+		}
+
 		// 5. Tighten socket permissions on POSIX. Node's net module has no
 		//    `mode` option (unlike `fs`), so we chmod after listen() succeeds.
 		if (process.platform !== "win32") {
@@ -432,43 +444,46 @@ export class CrewBroker {
 		}
 		this.connections.clear();
 
-		// 2. Close the server itself.
-		if (this.server) {
-			await new Promise<void>((resolve) => {
-				const srv = this.server;
+		// 2+4. Close the server AND remove the socket path in one
+		//      ownership-gated step. [3] stop-unlink race: libuv unlinks the
+		//      bind path BY NAME when the listening handle closes, so the
+		//      unlink/shield decision must wrap the close itself — see
+		//      broker/socket-stop.ts. We never touch any other path and
+		//      never `process.kill` anything.
+		const srv = this.server;
+		this.server = null;
+		const sockPath = this.resolvedSocketPath ?? this.options.socketPath;
+		const closeServer = () =>
+			new Promise<void>((resolve) => {
 				if (!srv) return resolve();
 				srv.close(() => resolve());
 				// If the server is not currently listening, close() resolves
 				// synchronously — guard with a hard timeout for safety.
 				setTimeout(() => resolve(), 250).unref();
 			});
-			this.server = null;
+		if (sockPath && process.platform !== "win32") {
+			const outcome = await stopServerAndRemoveSocket(sockPath, this.socketIdentity, closeServer);
+			if (outcome === "shielded-foreign" || outcome === "unshielded-foreign") {
+				// Path exists but is not provably ours (rebound or never bound):
+				// we did not remove it — any corpse is left for
+				// removeStaleBrokerSocket at the next start (fail-safe design).
+				logInternalError(
+					"crew-broker.stop.unlink-skipped",
+					new Error(`socket path not provably owned (${outcome}); left for removeStaleBrokerSocket`),
+					`path=${redactSecretString(sockPath)}`,
+				);
+			}
+		} else {
+			await closeServer();
 		}
+		this.resolvedSocketPath = null;
+		this.socketIdentity = null;
 
 		// 3. Clear the token map. This is the single point where the heap
 		//    state for runIds is wiped. No persistence to clean up.
 		this.tokens.clear();
 		// Task 10: drop the taskId → token index with it.
 		this.taskTokens.clear();
-
-		// 4. Unlink the recorded socket file IF we created it. We never
-		//    touch any other path. We also never `process.kill` anything.
-		const sockPath = this.resolvedSocketPath ?? this.options.socketPath;
-		if (sockPath && process.platform !== "win32") {
-			try {
-				await fsp.unlink(sockPath);
-			} catch (err) {
-				const code = (err as NodeJS.ErrnoException).code;
-				if (code !== "ENOENT") {
-					logInternalError(
-						"crew-broker.stop.unlink-failed",
-						err instanceof Error ? err : new Error(String(err)),
-						`path=${redactSecretString(sockPath)}`,
-					);
-				}
-			}
-		}
-		this.resolvedSocketPath = null;
 	}
 
 	// Connection lifecycle
@@ -759,15 +774,7 @@ export class CrewBroker {
 			}
 		}
 
-		// Bounded identity checks. taskId must be a non-empty string.
-		if (typeof taskId !== "string" || taskId.length === 0 || taskId.length > 256) {
-			this.sendErrorAndClose(conn, id, "auth", "hello rejected");
-			return;
-		}
-		if (typeof runId !== "string" || runId.length === 0 || runId.length > 256) {
-			this.sendErrorAndClose(conn, id, "auth", "hello rejected");
-			return;
-		}
+		// taskId/runId/token bounds (non-empty, ≤256) are enforced upstream by isHelloParams — protocol/request-parsers.ts.
 
 		// Bind connection identity and ack. Ack never includes the token.
 		conn.authed = true;

package/src/runtime/broker/socket-stop.ts

@@ -0,0 +1,147 @@
+/**
+ * socket-stop.ts — Ownership-gated teardown of the broker's listening socket.
+ *
+ * An AF_UNIX listener has TWO unlink vectors, and both must be owned-gated:
+ *  1. The explicit `fs.unlink` of the recorded path (CrewBroker.stop step 4).
+ *  2. libuv itself: `uv__pipe_close` unlinks the server pipe's bind path BY
+ *     NAME (no inode check) when the listening handle closes — Node's
+ *     `server.close()` deletes whatever currently sits at the path, even a
+ *     socket another listener re-bound there after ours was unlinked
+ *     (empirically verified on Node 22, 2026-10-26).
+ *
+ * The broker socket path is deterministic per sessionId, so a rebound leaf
+ * must survive our stop(). stopServerAndRemoveSocket therefore:
+ *  - Unlinks the leaf itself FIRST when its dev+ino match the identity
+ *    captured at listen() time — libuv's close-unlink then finds nothing.
+ *  - Otherwise, if ANY entry lives at the path (rebound foreign socket, or
+ *    ownership unprovable because the capture lstat failed), renames it
+ *    aside (shield) across closeServer() and renames it back afterwards:
+ *    a brief ENOENT window for new connects instead of permanent deletion
+ *    of a live foreign socket. B-LOW2: the rename-back happens ONLY while
+ *    sockPath is still absent — if a new listener re-bound the leaf during
+ *    the close, its leaf wins and the shield is kept (renaming back would
+ *    clobber the fresh bind).
+ *    A stranded shield (crash between renames, or one kept after a rebind)
+ *    keeps its `.stopping.` suffix and is swept by the corpse sweep inside
+ *    removeStaleBrokerSocket at the next start — it unlinks a shield ONLY
+ *    when the pid embedded in its name is provably dead (B-LOW1).
+ *  - Windows named pipes have no filesystem leaf: plain close only.
+ *
+ * Never throws; diagnostics flow through logInternalError with redaction.
+ */
+
+import { randomBytes } from "node:crypto";
+import * as fsp from "node:fs/promises";
+import { logInternalError } from "../../utils/internal-error.ts";
+import { redactSecretString } from "../../utils/redaction.ts";
+
+/** dev+ino of the socket leaf created by listen() — captured immediately
+ *  after a successful bind so stop() can prove continued ownership of the
+ *  path before removing it. Null when the lstat failed (stop() then treats
+ *  the leaf as NOT provably ours — the safe direction). */
+export interface SocketIdentity {
+	dev: number;
+	ino: number;
+}
+
+/** Capture the identity of the freshly-bound socket leaf (POSIX only). */
+export async function captureSocketIdentity(sockPath: string): Promise<SocketIdentity | null> {
+	try {
+		const st = await fsp.lstat(sockPath);
+		return { dev: st.dev, ino: st.ino };
+	} catch {
+		return null;
+	}
+}
+
+export type SocketStopOutcome =
+	/** Our leaf (identity matched) was unlinked by us before the close. */
+	| "unlinked"
+	/** A foreign/unpinned entry existed and was shielded across the close. */
+	| "shielded-foreign"
+	/** A foreign entry existed but the shield rename failed (close then
+	 *  unlinks it by name — the pre-fix behavior; logged loudly). */
+	| "unshielded-foreign"
+	/** Nothing lived at the path (or win32: no fs leaf at all). */
+	| "absent";
+
+/** Close the listening server and remove the socket path ONLY while we
+ *  provably own it. `closeServer` must perform the net.Server close (the
+ *  libuv by-name unlink vector) — it is called exactly once, sandwiched
+ *  inside the ownership decision. Never throws. */
+export async function stopServerAndRemoveSocket(
+	sockPath: string,
+	identity: SocketIdentity | null,
+	closeServer: () => Promise<void>,
+): Promise<SocketStopOutcome> {
+	if (process.platform === "win32") {
+		await closeServer();
+		return "absent";
+	}
+	const current = await fsp.lstat(sockPath).catch(() => null);
+	if (current === null) {
+		await closeServer();
+		return "absent";
+	}
+	const owned = identity !== null && current.dev === identity.dev && current.ino === identity.ino;
+	if (owned) {
+		// Remove our own leaf first so libuv's close-unlink finds nothing.
+		// (Microsecond TOCTOU between this unlink and the close-unlink is
+		// inherent to path-based APIs — accepted, same class as before.)
+		await fsp.unlink(sockPath).catch(() => {
+			/* best-effort: the leaf may already be gone */
+		});
+		await closeServer();
+		return "unlinked";
+	}
+	// Foreign or unprovably-owned entry: shield it across the close.
+	const shield = `${sockPath}.stopping.${process.pid}.${randomBytes(3).toString("hex")}`;
+	let shielded = false;
+	try {
+		await fsp.rename(sockPath, shield);
+		shielded = true;
+	} catch (err) {
+		logInternalError(
+			"crew-broker.stop.shield-rename-failed",
+			err instanceof Error ? err : new Error(String(err)),
+			`path=${redactSecretString(sockPath)}`,
+		);
+	}
+	try {
+		await closeServer();
+	} finally {
+		if (shielded) {
+			// B-LOW2: restore ONLY while the leaf is still absent. While our
+			// handle was closing, a new listener may have bound sockPath — a
+			// rename back would REPLACE its fresh leaf (rename clobbers the
+			// target), recreating the exact deletion bug the shield exists to
+			// prevent. When rebound: keep the shield (the corpse sweep at the
+			// next start removes it once this pid is dead) and log loudly.
+			let rebound = false;
+			try {
+				await fsp.lstat(sockPath);
+				rebound = true;
+			} catch {
+				/* still absent — safe to restore */
+			}
+			if (rebound) {
+				logInternalError(
+					"crew-broker.stop.shield-kept-rebound",
+					new Error(`socket path re-bound during close — keeping shield at ${shield} instead of clobbering the new listener`),
+					`path=${redactSecretString(sockPath)}`,
+				);
+			} else {
+				try {
+					await fsp.rename(shield, sockPath);
+				} catch (err) {
+					logInternalError(
+						"crew-broker.stop.shield-restore-failed",
+						err instanceof Error ? err : new Error(String(err)),
+						`path=${redactSecretString(shield)}`,
+					);
+				}
+			}
+		}
+	}
+	return shielded ? "shielded-foreign" : "unshielded-foreign";
+}

package/src/runtime/child-pi/child-pi-kill.ts

@@ -57,6 +57,11 @@ const identityByPid = new Map<number, ProcIdentity>();
 // Wave 11a injection seam (same shape as zombie-scanner.ts `__test`): tests seed
 // identity snapshots and swap the group reaper without a real child process.
 let reapGroupImpl: typeof reapGroup = reapGroup;
+// Wave 16 (E1): injectable /proc identity reader for killProcessPid's PID-recycle
+// re-validation — tests simulate a recycled starttime without racing the OS for
+// a real pid reuse. registerActiveChild deliberately keeps the REAL reader (its
+// identityByPid snapshot is production /proc state, not a test fixture).
+let readProcIdentityImpl: typeof readProcIdentity = readProcIdentity;
 export const __test = {
 	/** Seed the exit-time identity snapshot for a pid (as registerActiveChild would). */
 	seedIdentity(pid: number, identity: ProcIdentity | undefined): void {
@@ -71,6 +76,10 @@ export const __test = {
 	setReapGroup(fn: typeof reapGroup | undefined): void {
 		reapGroupImpl = fn ?? reapGroup;
 	},
+	/** Replace the /proc identity reader used by killProcessPid's E1 re-validation (undefined restores the real one). */
+	setReadProcIdentity(fn: typeof readProcIdentity | undefined): void {
+		readProcIdentityImpl = fn ?? readProcIdentity;
+	},
 };
 
 // Periodic cleanup of dead child process entries to prevent memory leaks.
@@ -173,9 +182,24 @@ export function killProcessPid(pid: number): void {
 		void owned.dispose();
 		return;
 	}
+	// E1 (fix-wave 16): baseline the pid's /proc starttime (stat field 22) while
+	// it is alive at kill entry; the hard-kill timer below re-reads it and
+	// refuses to signal a CHANGED starttime — the original process exited during
+	// the grace window and an unrelated process recycled the pid. Effectively
+	// Linux-only: Windows has no /proc (readProcIdentity → undefined ⇒ no
+	// baseline ⇒ the timer keeps the pre-wave unconditional behavior — see the
+	// win32 branch note below), and /proc-less POSIX (macOS) degrades the same
+	// way. Deliberately NOT the registration-snapshot pattern (identityByPid):
+	// external pid-only callers — live-session agents, cancel paths on stale
+	// pids — have no registration to consult.
+	const baselineStarttime = process.platform === "win32" ? undefined : readProcIdentityImpl(pid)?.starttime;
 	try {
 		if (process.platform === "win32") {
 			// 3.8: Windows path uses taskkill /T /F (force kill the entire tree).
+			// E1 note: Windows has no /proc, so no starttime baseline/re-validation
+			// is possible here — behavior stays exactly as before. taskkill /T /F on
+			// a recycled pid fails harmlessly ("process not found"), so the residual
+			// recycle window is not actionable on this platform.
 			// taskkill itself can silently fail (PID gone, permission denied, etc.)
 			// so verify after 2s and log a warning if the process is still alive.
 			spawnTaskkillSafe(pid);
@@ -213,6 +237,26 @@ export function killProcessPid(pid: number): void {
 		}
 		clearHardKillTimer(pid);
 		const hardKillTimer = setTimeout(() => {
+			// E1: PID-recycle re-validation immediately before the hard kill —
+			// guards BOTH the group kill (-pid) below and the absolute-pid fallback
+			// inside its catch. Skip ONLY on a proven mismatch (baseline known AND
+			// current known AND different): an unreadable current value means the pid
+			// is already gone (the kill below reports ESRCH exactly as before) or
+			// /proc is unavailable on this platform (there was never a baseline to
+			// compare against).
+			const currentStarttime = readProcIdentityImpl(pid)?.starttime;
+			if (baselineStarttime !== undefined && currentStarttime !== undefined && currentStarttime !== baselineStarttime) {
+				logInternalError(
+					"child-pi.sigkill-pid-recycled",
+					new Error(
+						`starttime changed between SIGTERM and the hard-kill timer (${baselineStarttime} → ${currentStarttime}) — pid was recycled, skipping hard kill of the unrelated new occupant`,
+					),
+					`pid=${pid}`,
+					"warn",
+				);
+				childHardKillTimers.delete(pid);
+				return;
+			}
 			try {
 				process.kill(-pid, "SIGKILL");
 			} catch (error) {

package/src/runtime/child-pi/inference-broker.ts

@@ -36,7 +36,11 @@
  * Anthropic usage events; per-worker in-flight cap; revoke(workerKey) /
  * revokeAll() kill-switch (revoked token → 401 on the NEXT request; in-flight
  * requests are allowed to drain — killing sockets mid-stream corrupts
- * transcripts without adding security, the token is already dead).
+ * transcripts without adding security, the token is already dead). The token
+ * map is keyed by the SHA-256 digest of each token, never the raw secret
+ * (constant-time discipline, same pattern as crew-broker-tokens.ts); after
+ * registerInferenceWorker hands the raw token to the caller, the broker
+ * retains only its digest.
  *
  * Honest boundary: the broker protects the REUSABLE CREDENTIAL channel only.
  * A worker can still read other host files (~/.ssh, ~/.aws, ~/.pi/agent/
@@ -88,7 +92,10 @@ const STRIP_RESPONSE_HEADERS = new Set(["content-encoding", "content-length", "t
 
 interface WorkerEntry {
 	workerKey: string;
-	token: string;
+	/** SHA-256 hex digest of the worker token — the RAW secret is handed to
+	 *  the caller by registerInferenceWorker and never retained here
+	 *  (constant-time discipline, fix-wave TASK [5]). */
+	tokenDigest: string;
 	revoked: boolean;
 	requests: number;
 	inputTokens: number;
@@ -97,6 +104,15 @@ interface WorkerEntry {
 	maxTokens: number;
 }
 
+/** Map key for the per-worker token registry: the SHA-256 hex digest of the
+ * token, NEVER the raw secret — mirrors BrokerTokenRegistry.hashToken
+ * (runtime/broker/crew-broker-tokens.ts). Hashed locally with the identical
+ * implementation instead of importing the registry class, so this module's
+ * static import graph is untouched. */
+function tokenKey(token: string): string {
+	return crypto.createHash("sha256").update(token, "utf8").digest("hex");
+}
+
 export interface InferenceBrokerSnapshot {
 	active: boolean;
 	baseUrl: string;
@@ -121,7 +137,7 @@ interface BrokerState {
 	server: http.Server;
 	port: number;
 	routes: Map<string, ProviderRoute>; // by path prefix ("/anthropic", "/openai")
-	workers: Map<string, WorkerEntry>; // by token
+	workers: Map<string, WorkerEntry>; // by SHA-256 token digest (never the raw secret)
 	byKey: Map<string, WorkerEntry>; // by workerKey
 	scopedAgentDir: string;
 }
@@ -381,7 +397,7 @@ async function handleRequest(
 		}
 		// (1) Auth — fail-closed, generic errors (never echo tokens).
 		const token = extractToken(req);
-		const worker = token ? ctx.workers.get(token) : undefined;
+		const worker = token ? ctx.workers.get(tokenKey(token)) : undefined;
 		if (!worker || worker.revoked) {
 			deny(res, 401, "invalid or revoked inference token");
 			return;
@@ -535,13 +551,22 @@ export function registerInferenceWorker(workerKey: string): string {
 	const existing = broker.byKey.get(workerKey);
 	if (existing) {
 		existing.revoked = true;
-		broker.workers.delete(existing.token);
+		broker.workers.delete(existing.tokenDigest);
 		broker.byKey.delete(workerKey);
 	}
 	const token = crypto.randomBytes(32).toString("hex");
 	const maxTokens = getCrewEnvInt(INFERENCE_BUDGET_ENV) ?? 0;
-	const entry: WorkerEntry = { workerKey, token, revoked: false, requests: 0, inputTokens: 0, outputTokens: 0, inFlight: 0, maxTokens };
-	broker.workers.set(token, entry);
+	const entry: WorkerEntry = {
+		workerKey,
+		tokenDigest: tokenKey(token),
+		revoked: false,
+		requests: 0,
+		inputTokens: 0,
+		outputTokens: 0,
+		inFlight: 0,
+		maxTokens,
+	};
+	broker.workers.set(entry.tokenDigest, entry);
 	broker.byKey.set(workerKey, entry);
 	return token;
 }
@@ -574,7 +599,7 @@ export function revokeInferenceWorker(workerKey: string): boolean {
 	const entry = broker.byKey.get(workerKey);
 	if (!entry) return false;
 	entry.revoked = true;
-	broker.workers.delete(entry.token);
+	broker.workers.delete(entry.tokenDigest);
 	broker.byKey.delete(workerKey);
 	return true;
 }
@@ -616,3 +641,10 @@ export function stopInferenceBroker(): void {
 export function __resetInferenceBrokerForTests(): void {
 	stopInferenceBroker();
 }
+
+/** @internal TESTS ONLY — the live token-map keys. By construction these are
+ * SHA-256 digests (see tokenKey); the suite pins that no RAW token ever
+ * appears as a map key (constant-time discipline). */
+export function __inferenceBrokerTokenMapKeysForTests(): string[] {
+	return broker ? [...broker.workers.keys()] : [];
+}

package/src/runtime/goal-workflow/goal-achievement.ts

@@ -24,6 +24,7 @@ import { spawnSync } from "node:child_process";
 import type { TeamRunManifest, TeamTaskState } from "../../state/types.ts";
 import { findRepoRoot } from "../../utils/paths.ts";
 import type { WorkflowConfig } from "../../workflows/workflow-config.ts";
+import { buildGitSafeEnv, hardenGitArgs } from "../../worktree/git-hardening.ts";
 
 /**
  * Roles whose job is to EDIT project source/test files (changes that appear in
@@ -54,7 +55,15 @@ export function isGitWorkingTreeClean(cwd: string): { clean: boolean; repoRoot:
 		const repoRoot = findRepoRoot(cwd);
 		if (!repoRoot) return { clean: "unknown", repoRoot: undefined };
 		// `git status --porcelain` → empty stdout means a clean working tree.
-		const res = spawnSync("git", ["-C", repoRoot, "status", "--porcelain"], { encoding: "utf8", timeout: 5_000 });
+		// R-A5 (MED-1): previously spawnSync inherited the FULL process.env —
+		// API keys could leak to config-reachable helpers git spawns. Now the
+		// sanitized env + hardenGitArgs (cwd is the trusted manifest repo root,
+		// so no gitdir-pointer guard is needed here).
+		const res = spawnSync("git", hardenGitArgs(["-C", repoRoot, "status", "--porcelain"]), {
+			encoding: "utf-8",
+			timeout: 5_000,
+			env: buildGitSafeEnv(),
+		});
 		if (res.error || res.status !== 0) return { clean: "unknown", repoRoot: undefined };
 		return { clean: res.stdout.trim().length === 0, repoRoot };
 	} catch {

package/src/runtime/pi-spawn.ts

@@ -260,7 +260,16 @@ function resolvePiCliScript(): string | undefined {
 		process.env.APPDATA ? path.join(process.env.APPDATA, "npm", "node_modules", "@earendil-works", "pi-coding-agent") : undefined,
 		process.env.APPDATA ? path.join(process.env.APPDATA, "npm", "node_modules", "@mariozechner", "pi-coding-agent") : undefined,
 		path.dirname(fileURLToPath(import.meta.url)),
-		process.cwd(),
+		// E2 (fix-wave 16): the process.cwd() root is deliberately REMOVED.
+		// findPiPackageJsonFrom matches package.json by NAME only (no version or
+		// signature check), so a booby-trapped working directory carrying a fake
+		// package.json (name=@earendil-works/pi-coding-agent + bin) would get its
+		// attacker binary spawned with the worker env — which carries the
+		// inference-broker token. Legitimate installs stay covered by the roots
+		// above (argv1 package root, `npm root -g`, %APPDATA%\npm, and the
+		// import.meta install-dir walk, which still scans every ancestor
+		// node_modules chain via findPiPackageJsonFrom) plus the bare-"pi" PATH
+		// fallback in getPiSpawnCommand.
 	].filter((entry): entry is string => Boolean(entry));
 
 	for (const root of roots) {

package/src/runtime/task-runner/post-execution.ts

@@ -30,6 +30,8 @@ import type {
 	UsageState,
 	VerificationEvidence,
 } from "../../state/types.ts";
+import { logInternalError } from "../../utils/internal-error.ts";
+import { buildGitSafeEnv, hardenGitArgs, worktreeTrustCheck } from "../../worktree/git-hardening.ts";
 import { captureWorktreeDiffAsync, captureWorktreeDiffStatAsync } from "../../worktree/worktree-manager.ts";
 import { appendTaskAttentionEvent } from "../attention-events.ts";
 import { extractCommandTrace } from "../command-trace.ts";
@@ -150,16 +152,48 @@ const DRIFT_BLOCK_MARKER = /DRIFT-BLOCK\b/i;
  * READ-ONLY lanes — any entry (modified OR untracked) is an unexpected
  * mutation. Returns undefined when the tree is clean or git fails (fail-open:
  * a broken probe must not break task finalization). Note-only, never a fail.
+ * R-A2 exception: a FAILED GITDIR-POINTER GUARD is not a broken probe but a
+ * live corruption signal — it reports a mutation note (see body).
  */
 export async function detectReadLaneMutation(worktreePath: string): Promise<NonNullable<TeamTaskState["unexpectedMutation"]> | undefined> {
 	try {
+		// R-A2 (MED-1 follow-up): this probe used to be a raw execFile with the
+		// FULL process.env — API keys could leak to worker-planted fsmonitor /
+		// hook config reachable from the probed worktree. It now routes through
+		// the MED-1 hardening: hardenGitArgs config-injection overrides, the
+		// sanitized git env (no process.env inheritance), and the gitdir-pointer
+		// guard. Guard failure is fail-safe TOWARD REPORTING a mutation: a
+		// corrupted `.git` pointer in a READ-ONLY lane is itself a lane
+		// violation (the worker rewrote something it must not touch), so it
+		// surfaces as a note + internal log instead of a clean verdict.
+		const trust = worktreeTrustCheck(worktreePath);
+		if (trust.kind === "worktree" && !trust.ok) {
+			logInternalError(
+				"post-execution.readLane.gitdirMismatch",
+				new Error(`Refusing to run the mutation probe inside ${worktreePath}: ${trust.reason}`),
+				`worktreePath=${worktreePath}`,
+			);
+			return {
+				filesChanged: 0,
+				sample: [`worktree corrupted — gitdir pointer check failed (${trust.reason}); no git executed`],
+			};
+		}
 		// W10-8 one-shot git probe per read-only task — child_process is
 		// already in the platform; dynamic keeps it off the static import graph.
 		// LAZY: see above
 		const { execFile } = await import("node:child_process");
 		const out: string = await new Promise((resolve, reject) => {
-			execFile("git", ["status", "--porcelain"], { cwd: worktreePath, encoding: "utf-8", timeout: 10_000 }, (err, stdout) =>
-				err ? reject(err) : resolve(stdout),
+			execFile(
+				"git",
+				hardenGitArgs(["status", "--porcelain"]),
+				{
+					cwd: worktreePath,
+					env: buildGitSafeEnv(),
+					encoding: "utf-8",
+					timeout: 10_000,
+					windowsHide: true,
+				},
+				(err, stdout) => (err ? reject(err) : resolve(stdout)),
 			);
 		});
 		const entries = out

package/src/utils/socket-path.ts

@@ -122,11 +122,62 @@ export async function prepareBrokerSocketDir(sockPath: string): Promise<void> {
 	}
 }
 
+/** Literal-escaping helper for building filesystem-name regexes. */
+function escapeRegExp(literal: string): string {
+	return literal.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+}
+
+/**
+ * B-LOW1: sweep `${sockPath}.stopping.<pid>.<hex>` shield corpses left by
+ * broker/socket-stop.ts. stopServerAndRemoveSocket renames a foreign/unpinned
+ * socket leaf aside across the libuv close-unlink window and renames it back
+ * afterwards; a crash between those renames strands the shield forever — the
+ * plain removeStaleBrokerSocket flow only ever looks at `sockPath` itself, so
+ * the corpses previously accumulated one per crashed stop.
+ *
+ * A corpse is removed ONLY when the pid embedded in its name is provably dead
+ * (process.kill(pid, 0) → ESRCH). EPERM/any other signal result means the pid
+ * is alive (or its liveness cannot be proven) — the shield is kept (fail-safe:
+ * a live broker may still restore it). Best-effort: never throws.
+ */
+async function sweepStoppingShields(sockPath: string): Promise<void> {
+	if (process.platform === "win32") return; // named pipes have no fs leaves
+	const dir = path.dirname(sockPath);
+	const pattern = new RegExp(`^${escapeRegExp(path.basename(sockPath))}\\.stopping\\.(\\d+)\\.[0-9a-f]{1,32}$`);
+	let entries: string[];
+	try {
+		entries = await fsp.readdir(dir);
+	} catch {
+		return;
+	}
+	for (const entry of entries) {
+		const match = pattern.exec(entry);
+		if (!match) continue;
+		const pid = Number.parseInt(match[1]!, 10);
+		if (!Number.isInteger(pid) || pid <= 0) continue;
+		try {
+			process.kill(pid, 0);
+			continue; // pid alive — keep the shield
+		} catch (err) {
+			const code = (err as NodeJS.ErrnoException).code;
+			if (code !== "ESRCH") continue; // cannot prove dead — keep
+		}
+		try {
+			await fsp.unlink(path.join(dir, entry));
+		} catch {
+			/* best-effort */
+		}
+	}
+}
+
 /** Connect-then-unlink stale socket (herdr pattern). If a live broker is
  *  listening, leave the endpoint intact (EADDRINUSE will surface on bind).
  *  If a stale file exists with no listener, remove it. If the path is a
  *  symlink, refuse rather than follow.
  *
+ *  Also sweeps `${sockPath}.stopping.*` shield corpses whose recorded pid is
+ *  dead (B-LOW1 — see sweepStoppingShields).
+ *
  *  Returns "removed" when the stale entry was unlinked, "kept" when a live
  *  listener was detected, "absent" when no entry existed, "refused"
  *  when the entry is a symlink. */
@@ -138,6 +189,9 @@ export async function removeStaleBrokerSocket(
 	// the timeout branch without racing a real localhost connect.
 	netModule?: { createConnection: (path: string) => { once: (ev: string, fn: (arg?: unknown) => void) => void; destroy: () => void } },
 ): Promise<"removed" | "kept" | "absent" | "refused"> {
+	// B-LOW1: sweep stranded stop-shields first (best-effort, never affects the
+	// sockPath verdict below).
+	await sweepStoppingShields(sockPath);
 	// Reject symlinks outright.
 	let st: Awaited<ReturnType<typeof fsp.lstat>>;
 	try {