pi-crew 0.11.44 → 0.11.46

package/CHANGELOG.md

@@ -1,6 +1,72 @@
 # Changelog
 
-## [Unreleased]
+## [0.11.46] — broker hygiene: token off the child env (stdin handshake) + crew-broker split (2026-10-27)
+
+Follow-up wave to the 0.11.45 security hardening: closes the LOW-1 residual (broker token in child env) and pays
+structural debt (crew-broker.ts at 1970/2000 wc-gate) before it blocks further work.
+
+**Changed — broker token now travels over spawn stdin, off the child env (LOW-1 closure).** Headless JSON workers
+receive the per-task compound `PI_CREW_BROKER_TOKEN` as a single `buildBrokerStdinLine` v2 payload written to the
+child's stdin right after spawn (heap → pipe → heap — same shape as the F4 background-runner handshake), instead of
+`/proc/<pid>/environ`-visible env. `PI_CREW_BROKER_SOCKET`/`RUN_ID`/`TASK_ID` stay in env (non-secret, needed by the
+worker bootstrap to bind + validate the payload). The worker-side reader (`startChildBrokerClientAsync`) activates
+only when the env token is absent, binds the payload by runId + taskId, cross-checks the socket path, and never
+throws — any mismatch leaves the worker creds-less exactly like today. RPC-mode workers (`--mode rpc` argv guard)
+and surface TUI panes keep the env/launch-script routes untouched. Rollback gate `PI_CREW_BROKER_STDIN=0` restores
+the legacy env route on both sides bit-for-bit. Backward-compat matrix pinned by tests: old-parent→new-worker (env
+route), new-parent→new-worker (stdin), rollback, garbage/wrong-run/socket-mismatch payloads, silent stdin.
+
+**Changed — `handleDelegateRequest` extracted from crew-broker.ts (1970 → 1693 lines).** Pure move into
+`src/runtime/broker/crew-broker-delegate-request.ts` via the same deps-object pattern as `protocol/wait-resolve.ts`;
+public `CrewBroker` API unchanged, zero test churn (diff audit: byte-identical modulo `this.`→`deps.` + dedent).
+Re-opens ~300 lines of wc-gate headroom. `scripts/check-lazy-imports.mjs` budget 539 → 540 (new static graph node
+from the split; dynamic import is not an escape — the single-file bundle walks `import()` edges too).
+
+## [0.11.45] — security hardening wave: worktree git-injection class closed + verified review fixes (2026-10-27)
+
+### Security hardening wave — worktree git-injection (MED-1) + verified review fixes
+
+Cold-verified adversarial review of v0.11.44 surfaced one CONFIRMED code-exec class finding (git config/hook injection
+in worker-controlled worktrees) plus two same-class bypass vectors found while fixing it. This wave closes the full
+attack surface, not just the original report.
+
+**Fixed — git config/hook injection via worker-controlled worktrees (MED-1, CONFIRMED).** Every git invocation that
+runs with `cwd` inside a worktree is now routed through `src/worktree/git-hardening.ts`:
+`-c core.fsmonitor=false -c core.hooksPath= -c core.attributesFile=` (empty `hooksPath` neutralizes
+prepare-commit-msg/post-commit that `--no-verify` does not block), `--no-textconv --no-ext-diff` on `diff`,
+`--no-verify` on `commit`, plus `GIT_CONFIG_NOSYSTEM=1` and a shared `buildGitSafeEnv()` (drops `process.env`
+inheritance and `GIT_CONFIG_SYSTEM`). A gitdir-pointer guard (`verifyWorktreeGitdirPointer` + per-command
+`assertWorktreePointerTrusted`) defeats `.git`-pointer hijack and the R-A3 TOCTOU (pointer flipped mid-chain aborts
+the chain as corrupted). Covers `cleanup.ts`, `worktree-manager.ts` (incl. diff-capture fns R-A1), `post-execution.ts`
+read-lane probe (R-A2 — previously raw git with full env secrets), `branch-freshness.ts`, `goal-achievement.ts`.
+Regression tests use live poisoned-config fixtures (fsmonitor/hooks/textconv/filter.clean/diff.external) and assert
+no marker execution. Residual (documented in-code): filter definitions in genuinely-trusted global config remain
+executable — required for commit identity.
+
+**Fixed — broker `stop()` unlink race (R-MINOR-2).** Socket leaf identity (`dev`/`ino`) is pinned right after
+`listen()` in the new `src/runtime/broker/socket-stop.ts`; `stop()` unlinks only while it still owns the inode,
+renames the leaf aside while closing, restores only if the path is still `ENOENT` (B-LOW2), and stale
+`.stopping.<pid>.*` shields are swept once their pid is dead (B-LOW1).
+
+**Fixed — kill-timer PID-recycle window (E1).** `killProcessPid` snapshots `/proc/<pid>/stat` starttime at entry and
+re-validates before the 3s SIGKILL (group + absolute-pid fallback); proven mismatch skips the kill with a warn log.
+win32//proc-less platforms keep legacy behavior (documented).
+
+**Changed — inference-broker token map keyed by SHA-256 digest (R-LOW-4).** Raw secrets are no longer map keys nor
+retained broker-side after registration, matching `crew-broker-tokens` constant-time discipline.
+
+**Changed — pi CLI resolution no longer falls back to `process.cwd()` (E2).** A planted `package.json` matching the
+pi package name could otherwise be spawned as a worker with broker-token env in degenerate installs.
+
+**Docs — corrected the R7-9 trust-model comment** in `cross-extension-rpc.ts` (`rpc:run` is the only mutating channel
+accepting unsigned RPCs — rate-limited + cwd-contained; live-control rejects all unsigned ops), and removed the dead
+hello length-check shadowed by `isHelloParams` bounds (crew-broker.ts back under the wc-gate ceiling).
+
+**CI — nightly now runs `npm audit --audit-level=high` (signal-only, `continue-on-error`) and `test:coverage`**
+(first workflow to execute the existing coverage script; job timeout 30→45 min).
+
+**Tests:** worktree suites 92/92, task-runner 213/213, socket/goal suites 146/146, `test:critical` 125/125,
+`tsc --noEmit` + biome + wc-gate all clean.
 
 ## [0.11.44] — fix wave 16: full-backlog burn-down — liveness wiring everywhere + rmSync sweep complete + T-6(b) harden (2026-10-26)