pi-crew 0.11.44 → 0.11.46

package/src/runtime/child-pi/child-pi-kill.ts

@@ -57,6 +57,11 @@ const identityByPid = new Map<number, ProcIdentity>();
 // Wave 11a injection seam (same shape as zombie-scanner.ts `__test`): tests seed
 // identity snapshots and swap the group reaper without a real child process.
 let reapGroupImpl: typeof reapGroup = reapGroup;
+// Wave 16 (E1): injectable /proc identity reader for killProcessPid's PID-recycle
+// re-validation — tests simulate a recycled starttime without racing the OS for
+// a real pid reuse. registerActiveChild deliberately keeps the REAL reader (its
+// identityByPid snapshot is production /proc state, not a test fixture).
+let readProcIdentityImpl: typeof readProcIdentity = readProcIdentity;
 export const __test = {
 	/** Seed the exit-time identity snapshot for a pid (as registerActiveChild would). */
 	seedIdentity(pid: number, identity: ProcIdentity | undefined): void {
@@ -71,6 +76,10 @@ export const __test = {
 	setReapGroup(fn: typeof reapGroup | undefined): void {
 		reapGroupImpl = fn ?? reapGroup;
 	},
+	/** Replace the /proc identity reader used by killProcessPid's E1 re-validation (undefined restores the real one). */
+	setReadProcIdentity(fn: typeof readProcIdentity | undefined): void {
+		readProcIdentityImpl = fn ?? readProcIdentity;
+	},
 };
 
 // Periodic cleanup of dead child process entries to prevent memory leaks.
@@ -173,9 +182,24 @@ export function killProcessPid(pid: number): void {
 		void owned.dispose();
 		return;
 	}
+	// E1 (fix-wave 16): baseline the pid's /proc starttime (stat field 22) while
+	// it is alive at kill entry; the hard-kill timer below re-reads it and
+	// refuses to signal a CHANGED starttime — the original process exited during
+	// the grace window and an unrelated process recycled the pid. Effectively
+	// Linux-only: Windows has no /proc (readProcIdentity → undefined ⇒ no
+	// baseline ⇒ the timer keeps the pre-wave unconditional behavior — see the
+	// win32 branch note below), and /proc-less POSIX (macOS) degrades the same
+	// way. Deliberately NOT the registration-snapshot pattern (identityByPid):
+	// external pid-only callers — live-session agents, cancel paths on stale
+	// pids — have no registration to consult.
+	const baselineStarttime = process.platform === "win32" ? undefined : readProcIdentityImpl(pid)?.starttime;
 	try {
 		if (process.platform === "win32") {
 			// 3.8: Windows path uses taskkill /T /F (force kill the entire tree).
+			// E1 note: Windows has no /proc, so no starttime baseline/re-validation
+			// is possible here — behavior stays exactly as before. taskkill /T /F on
+			// a recycled pid fails harmlessly ("process not found"), so the residual
+			// recycle window is not actionable on this platform.
 			// taskkill itself can silently fail (PID gone, permission denied, etc.)
 			// so verify after 2s and log a warning if the process is still alive.
 			spawnTaskkillSafe(pid);
@@ -213,6 +237,26 @@ export function killProcessPid(pid: number): void {
 		}
 		clearHardKillTimer(pid);
 		const hardKillTimer = setTimeout(() => {
+			// E1: PID-recycle re-validation immediately before the hard kill —
+			// guards BOTH the group kill (-pid) below and the absolute-pid fallback
+			// inside its catch. Skip ONLY on a proven mismatch (baseline known AND
+			// current known AND different): an unreadable current value means the pid
+			// is already gone (the kill below reports ESRCH exactly as before) or
+			// /proc is unavailable on this platform (there was never a baseline to
+			// compare against).
+			const currentStarttime = readProcIdentityImpl(pid)?.starttime;
+			if (baselineStarttime !== undefined && currentStarttime !== undefined && currentStarttime !== baselineStarttime) {
+				logInternalError(
+					"child-pi.sigkill-pid-recycled",
+					new Error(
+						`starttime changed between SIGTERM and the hard-kill timer (${baselineStarttime} → ${currentStarttime}) — pid was recycled, skipping hard kill of the unrelated new occupant`,
+					),
+					`pid=${pid}`,
+					"warn",
+				);
+				childHardKillTimers.delete(pid);
+				return;
+			}
 			try {
 				process.kill(-pid, "SIGKILL");
 			} catch (error) {

package/src/runtime/child-pi/child-pi-spawn.ts

@@ -20,10 +20,12 @@ import type { SpawnOptions } from "node:child_process";
 import * as fs from "node:fs";
 import * as path from "node:path";
 import { childPiBaseAllowlist } from "../../config/env-allowlist-registry.ts";
+import { getCrewEnv } from "../../config/env-vars.ts";
 import { isScratchpadEnabledForRole } from "../../config/role-tools.ts";
 import { buildScopedAllowList, providerEnvKeys, sanitizeEnvSecrets } from "../../utils/env-filter.ts";
 import { logInternalError } from "../../utils/internal-error.ts";
 import { resolveRealContainedPath } from "../../utils/safe-paths.ts";
+import { buildBrokerStdinLine } from "../broker/stdin-handshake.ts";
 import { buildPiWorkerArgs, createSafeTempDir, getPiTempBase } from "../model/pi-args.ts";
 import { getPiSpawnCommand } from "../pi-spawn.ts";
 import { findLatestScratchpadSnapshot } from "../scratchpad/snapshot-lookup.ts";
@@ -44,6 +46,19 @@ import {
 // NOT set this (their sessions persist and benefit from long-lived cache).
 export const PI_CACHE_RETENTION_ENV = "PI_CACHE_RETENTION";
 
+/** LOW-1 residual closure (2026-10-27): when the inter-pi broker credentials
+ * are present, the per-task compound TOKEN travels over the spawn stdin pipe
+ * (one `buildBrokerStdinLine` payload, heap → pipe → heap — same shape as the
+ * F4 background-runner handshake) instead of the child env. Set
+ * PI_CREW_BROKER_STDIN=0 to roll back to the legacy env route (token in
+ * built.env, stdin stays "ignore"). Default ON. Only the headless JSON spawn
+ * branch consumes the payload: the RPC branch (stdin is the JSONL protocol
+ * channel) and the surface TUI panes keep the env route, so their env is
+ * untouched. */
+export function resolveBrokerStdinHandshakeEnabled(): boolean {
+	return getCrewEnv("PI_CREW_BROKER_STDIN") !== "0";
+}
+
 // ── Env allowlist (base set always passed to children) ──────────────────
 // Provider API keys are injected dynamically via buildScopedAllowList() only
 // when a model is assigned to the task (per-task key scoping).
@@ -258,6 +273,7 @@ export function buildFinalChildPiSpawnOptions(
 	model?: string,
 	modelChain?: (string | undefined)[],
 	workerCacheSplit?: boolean,
+	stdinBrokerPayload?: string,
 ): SpawnOptions {
 	// (a) Canary: builtEnv must contain ONLY PI_CREW_*/PI_TEAMS_* keys.
 	assertOnlyControlEnvKeys(builtEnv);
@@ -287,7 +303,18 @@ export function buildFinalChildPiSpawnOptions(
 	if (workerCacheSplit) {
 		spawnOptions.env[PI_CACHE_RETENTION_ENV] = "short";
 	}
-	// (d) Return the composed SpawnOptions for spawn(...).
+	// (d) LOW-1 closure: when the caller will hand the broker token to the child
+	// over the stdin pipe (headless JSON branch — it passes the payload it got
+	// from prepareSpawnContext), switch stdin from "ignore" to "pipe" and strip
+	// the secret from the env as defense-in-depth (prepareSpawnContext already
+	// omits it; the delete guards direct builtEnv constructions in tests/callers
+	// that still carry it). RPC branch / surface workerEnv snapshots call
+	// WITHOUT this param → env keeps the token and nothing else changes.
+	if (stdinBrokerPayload !== undefined) {
+		spawnOptions.stdio = ["pipe", "pipe", "pipe"];
+		delete spawnOptions.env.PI_CREW_BROKER_TOKEN;
+	}
+	// (e) Return the composed SpawnOptions for spawn(...).
 	return spawnOptions;
 }
 
@@ -310,6 +337,12 @@ export interface SpawnContext {
 	builtEnv: Record<string, string | undefined>;
 	/** v0.11.31: inference-broker worker key that owns this spawn's token (cleanup/revoke bookkeeping). */
 	inferenceWorkerKey?: string;
+	/** LOW-1 closure: one-line broker credential payload to write to the
+	 * child's stdin right after spawn (headless JSON branch ONLY — the RPC
+	 * branch owns stdin for its JSONL protocol and surface panes are TTY).
+	 * Present ⇒ PI_CREW_BROKER_TOKEN is NOT in builtEnv (token travels
+	 * heap → pipe → heap instead). Undefined ⇒ legacy env route. */
+	brokerStdinPayload?: string;
 }
 
 /**
@@ -364,6 +397,9 @@ export function prepareSpawnContext(
 	// a per-spawn unique.
 	const inferenceSnapshot = requireInferenceBrokerIfEnabled();
 	let inferenceWorkerKey: string | undefined;
+	// LOW-1 closure: stdin handshake payload for the headless JSON branch (see
+	// the brokerSpawn block below). Undefined = env route (legacy/rollback).
+	let brokerStdinPayload: string | undefined;
 	if (inferenceSnapshot.active) {
 		// v0.11.36: the agentId derivation is SHARED with the exit-revoke wrapper
 		// (runChildPi finally) via inferenceWorkerKeyForAgent — both sides must
@@ -415,11 +451,23 @@ export function prepareSpawnContext(
 	// Phase 0 inter-pi broker: inject socket path + token (control-namespace keys,
 	// safe under assertOnlyControlEnvKeys). Only when the parent broker issued
 	// credentials for this run — i.e. the broker is enabled AND this run is
-	// eligible. The token is heap-only on the parent; the child receives it
-	// solely through env. NEVER persisted to disk.
+	// eligible. NEVER persisted to disk.
+	// LOW-1 closure: by default the TOKEN leaves the env entirely — it rides the
+	// spawn stdin pipe as a single buildBrokerStdinLine payload (ctx
+	// .brokerStdinPayload; the headless JSON branch pipes stdin and writes it
+	// right after spawn). SOCKET/RUN_ID/TASK_ID stay in env (non-secret, needed
+	// by the worker bootstrap to bind + validate the stdin payload). Rollback
+	// gate PI_CREW_BROKER_STDIN=0 (or a legacy shape without runId/taskId to
+	// bind the payload to) keeps the env route bit-for-bit.
 	if (input.brokerSpawn?.socketPath && input.brokerSpawn.token) {
 		built.env.PI_CREW_BROKER_SOCKET = input.brokerSpawn.socketPath;
-		built.env.PI_CREW_BROKER_TOKEN = input.brokerSpawn.token;
+		if (resolveBrokerStdinHandshakeEnabled() && input.runId && input.agentId) {
+			brokerStdinPayload = buildBrokerStdinLine(input.runId, input.brokerSpawn.socketPath, {
+				[input.agentId]: input.brokerSpawn.token,
+			});
+		} else {
+			built.env.PI_CREW_BROKER_TOKEN = input.brokerSpawn.token;
+		}
 		// runId/taskId are threaded unconditionally above (I5); nothing to add here.
 	}
 	// WP-9 (R9): the worker self-reporting channel env is UNCONDITIONAL —
@@ -499,6 +547,7 @@ export function prepareSpawnContext(
 			tempDir: built.tempDir,
 			builtEnv: built.env,
 			inferenceWorkerKey,
+			...(brokerStdinPayload !== undefined ? { brokerStdinPayload } : {}),
 		},
 	};
 }

package/src/runtime/child-pi/child-pi.ts

@@ -852,7 +852,18 @@ async function runChildPiInner(input: ChildPiRunInput): Promise<ChildPiRunResult
 			// R6-8: modelChain threads the candidate chain for provider-key scoping.
 			// v0.11.38 W10-1: workerCacheSplit — headless single-run workers opt into
 			// short prompt-cache retention (see PI_CACHE_RETENTION_ENV).
-			const spawnOptions = buildFinalChildPiSpawnOptions(input.cwd, mergedEnv, builtEnv, input.model, input.modelChain, true);
+			// LOW-1 closure: ctx.brokerStdinPayload (when present) switches stdin to
+			// "pipe" + strips PI_CREW_BROKER_TOKEN from the child env — the token
+			// travels over the stdin pipe right after spawn instead (heap → pipe → heap).
+			const spawnOptions = buildFinalChildPiSpawnOptions(
+				input.cwd,
+				mergedEnv,
+				builtEnv,
+				input.model,
+				input.modelChain,
+				true,
+				spawnPrep.ctx.brokerStdinPayload,
+			);
 			// v0.11.36 OS boundary: when the sandbox is on, the headless spawn is
 			// wrapped in bwrap. Mounts: cwd RW (the worker edits the project), the
 			// scoped inference agent dir RW (pi writes session state under it), and
@@ -909,6 +920,26 @@ async function runChildPiInner(input: ChildPiRunInput): Promise<ChildPiRunResult
 					ts: new Date().toISOString(),
 				});
 			}
+			// LOW-1 closure: hand the worker its broker credential over stdin — one
+			// buildBrokerStdinLine JSON line (v2, per-task compound token), then close
+			// the pipe. Mirror of the F4 async-runner handshake; the worker-side
+			// reader (crew-broker-child.ts via stdin-handshake.readStdinFirstLine)
+			// binds it by runId + taskId. Best-effort in BOTH directions: any write
+			// failure (EPIPE on a fast-exiting child, destroyed stream) leaves the
+			// worker creds-less exactly like a broker-less spawn — never throws out
+			// of the spawn path.
+			if (spawnPrep.ctx.brokerStdinPayload) {
+				try {
+					child.stdin?.write(spawnPrep.ctx.brokerStdinPayload);
+				} catch {
+					/* best-effort: worker proceeds creds-less */
+				}
+				try {
+					child.stdin?.end();
+				} catch {
+					/* EPIPE: child already died — spawn error handling owns that */
+				}
+			}
 			// P0-1: O(1)-amortized bounded accumulators (segment ring) — replaces the O(n²)
 			// appendBoundedTail rebuild-per-line pattern that re-scanned 512 KiB every line.
 			const stdoutTail = new BoundedTail();

package/src/runtime/child-pi/inference-broker.ts

@@ -36,7 +36,11 @@
  * Anthropic usage events; per-worker in-flight cap; revoke(workerKey) /
  * revokeAll() kill-switch (revoked token → 401 on the NEXT request; in-flight
  * requests are allowed to drain — killing sockets mid-stream corrupts
- * transcripts without adding security, the token is already dead).
+ * transcripts without adding security, the token is already dead). The token
+ * map is keyed by the SHA-256 digest of each token, never the raw secret
+ * (constant-time discipline, same pattern as crew-broker-tokens.ts); after
+ * registerInferenceWorker hands the raw token to the caller, the broker
+ * retains only its digest.
  *
  * Honest boundary: the broker protects the REUSABLE CREDENTIAL channel only.
  * A worker can still read other host files (~/.ssh, ~/.aws, ~/.pi/agent/
@@ -88,7 +92,10 @@ const STRIP_RESPONSE_HEADERS = new Set(["content-encoding", "content-length", "t
 
 interface WorkerEntry {
 	workerKey: string;
-	token: string;
+	/** SHA-256 hex digest of the worker token — the RAW secret is handed to
+	 *  the caller by registerInferenceWorker and never retained here
+	 *  (constant-time discipline, fix-wave TASK [5]). */
+	tokenDigest: string;
 	revoked: boolean;
 	requests: number;
 	inputTokens: number;
@@ -97,6 +104,15 @@ interface WorkerEntry {
 	maxTokens: number;
 }
 
+/** Map key for the per-worker token registry: the SHA-256 hex digest of the
+ * token, NEVER the raw secret — mirrors BrokerTokenRegistry.hashToken
+ * (runtime/broker/crew-broker-tokens.ts). Hashed locally with the identical
+ * implementation instead of importing the registry class, so this module's
+ * static import graph is untouched. */
+function tokenKey(token: string): string {
+	return crypto.createHash("sha256").update(token, "utf8").digest("hex");
+}
+
 export interface InferenceBrokerSnapshot {
 	active: boolean;
 	baseUrl: string;
@@ -121,7 +137,7 @@ interface BrokerState {
 	server: http.Server;
 	port: number;
 	routes: Map<string, ProviderRoute>; // by path prefix ("/anthropic", "/openai")
-	workers: Map<string, WorkerEntry>; // by token
+	workers: Map<string, WorkerEntry>; // by SHA-256 token digest (never the raw secret)
 	byKey: Map<string, WorkerEntry>; // by workerKey
 	scopedAgentDir: string;
 }
@@ -381,7 +397,7 @@ async function handleRequest(
 		}
 		// (1) Auth — fail-closed, generic errors (never echo tokens).
 		const token = extractToken(req);
-		const worker = token ? ctx.workers.get(token) : undefined;
+		const worker = token ? ctx.workers.get(tokenKey(token)) : undefined;
 		if (!worker || worker.revoked) {
 			deny(res, 401, "invalid or revoked inference token");
 			return;
@@ -535,13 +551,22 @@ export function registerInferenceWorker(workerKey: string): string {
 	const existing = broker.byKey.get(workerKey);
 	if (existing) {
 		existing.revoked = true;
-		broker.workers.delete(existing.token);
+		broker.workers.delete(existing.tokenDigest);
 		broker.byKey.delete(workerKey);
 	}
 	const token = crypto.randomBytes(32).toString("hex");
 	const maxTokens = getCrewEnvInt(INFERENCE_BUDGET_ENV) ?? 0;
-	const entry: WorkerEntry = { workerKey, token, revoked: false, requests: 0, inputTokens: 0, outputTokens: 0, inFlight: 0, maxTokens };
-	broker.workers.set(token, entry);
+	const entry: WorkerEntry = {
+		workerKey,
+		tokenDigest: tokenKey(token),
+		revoked: false,
+		requests: 0,
+		inputTokens: 0,
+		outputTokens: 0,
+		inFlight: 0,
+		maxTokens,
+	};
+	broker.workers.set(entry.tokenDigest, entry);
 	broker.byKey.set(workerKey, entry);
 	return token;
 }
@@ -574,7 +599,7 @@ export function revokeInferenceWorker(workerKey: string): boolean {
 	const entry = broker.byKey.get(workerKey);
 	if (!entry) return false;
 	entry.revoked = true;
-	broker.workers.delete(entry.token);
+	broker.workers.delete(entry.tokenDigest);
 	broker.byKey.delete(workerKey);
 	return true;
 }
@@ -616,3 +641,10 @@ export function stopInferenceBroker(): void {
 export function __resetInferenceBrokerForTests(): void {
 	stopInferenceBroker();
 }
+
+/** @internal TESTS ONLY — the live token-map keys. By construction these are
+ * SHA-256 digests (see tokenKey); the suite pins that no RAW token ever
+ * appears as a map key (constant-time discipline). */
+export function __inferenceBrokerTokenMapKeysForTests(): string[] {
+	return broker ? [...broker.workers.keys()] : [];
+}

package/src/runtime/goal-workflow/goal-achievement.ts

@@ -24,6 +24,7 @@ import { spawnSync } from "node:child_process";
 import type { TeamRunManifest, TeamTaskState } from "../../state/types.ts";
 import { findRepoRoot } from "../../utils/paths.ts";
 import type { WorkflowConfig } from "../../workflows/workflow-config.ts";
+import { buildGitSafeEnv, hardenGitArgs } from "../../worktree/git-hardening.ts";
 
 /**
  * Roles whose job is to EDIT project source/test files (changes that appear in
@@ -54,7 +55,15 @@ export function isGitWorkingTreeClean(cwd: string): { clean: boolean; repoRoot:
 		const repoRoot = findRepoRoot(cwd);
 		if (!repoRoot) return { clean: "unknown", repoRoot: undefined };
 		// `git status --porcelain` → empty stdout means a clean working tree.
-		const res = spawnSync("git", ["-C", repoRoot, "status", "--porcelain"], { encoding: "utf8", timeout: 5_000 });
+		// R-A5 (MED-1): previously spawnSync inherited the FULL process.env —
+		// API keys could leak to config-reachable helpers git spawns. Now the
+		// sanitized env + hardenGitArgs (cwd is the trusted manifest repo root,
+		// so no gitdir-pointer guard is needed here).
+		const res = spawnSync("git", hardenGitArgs(["-C", repoRoot, "status", "--porcelain"]), {
+			encoding: "utf-8",
+			timeout: 5_000,
+			env: buildGitSafeEnv(),
+		});
 		if (res.error || res.status !== 0) return { clean: "unknown", repoRoot: undefined };
 		return { clean: res.stdout.trim().length === 0, repoRoot };
 	} catch {

package/src/runtime/pi-spawn.ts

@@ -260,7 +260,16 @@ function resolvePiCliScript(): string | undefined {
 		process.env.APPDATA ? path.join(process.env.APPDATA, "npm", "node_modules", "@earendil-works", "pi-coding-agent") : undefined,
 		process.env.APPDATA ? path.join(process.env.APPDATA, "npm", "node_modules", "@mariozechner", "pi-coding-agent") : undefined,
 		path.dirname(fileURLToPath(import.meta.url)),
-		process.cwd(),
+		// E2 (fix-wave 16): the process.cwd() root is deliberately REMOVED.
+		// findPiPackageJsonFrom matches package.json by NAME only (no version or
+		// signature check), so a booby-trapped working directory carrying a fake
+		// package.json (name=@earendil-works/pi-coding-agent + bin) would get its
+		// attacker binary spawned with the worker env — which carries the
+		// inference-broker token. Legitimate installs stay covered by the roots
+		// above (argv1 package root, `npm root -g`, %APPDATA%\npm, and the
+		// import.meta install-dir walk, which still scans every ancestor
+		// node_modules chain via findPiPackageJsonFrom) plus the bare-"pi" PATH
+		// fallback in getPiSpawnCommand.
 	].filter((entry): entry is string => Boolean(entry));
 
 	for (const root of roots) {

package/src/runtime/task-runner/post-execution.ts

@@ -30,6 +30,8 @@ import type {
 	UsageState,
 	VerificationEvidence,
 } from "../../state/types.ts";
+import { logInternalError } from "../../utils/internal-error.ts";
+import { buildGitSafeEnv, hardenGitArgs, worktreeTrustCheck } from "../../worktree/git-hardening.ts";
 import { captureWorktreeDiffAsync, captureWorktreeDiffStatAsync } from "../../worktree/worktree-manager.ts";
 import { appendTaskAttentionEvent } from "../attention-events.ts";
 import { extractCommandTrace } from "../command-trace.ts";
@@ -150,16 +152,48 @@ const DRIFT_BLOCK_MARKER = /DRIFT-BLOCK\b/i;
  * READ-ONLY lanes — any entry (modified OR untracked) is an unexpected
  * mutation. Returns undefined when the tree is clean or git fails (fail-open:
  * a broken probe must not break task finalization). Note-only, never a fail.
+ * R-A2 exception: a FAILED GITDIR-POINTER GUARD is not a broken probe but a
+ * live corruption signal — it reports a mutation note (see body).
  */
 export async function detectReadLaneMutation(worktreePath: string): Promise<NonNullable<TeamTaskState["unexpectedMutation"]> | undefined> {
 	try {
+		// R-A2 (MED-1 follow-up): this probe used to be a raw execFile with the
+		// FULL process.env — API keys could leak to worker-planted fsmonitor /
+		// hook config reachable from the probed worktree. It now routes through
+		// the MED-1 hardening: hardenGitArgs config-injection overrides, the
+		// sanitized git env (no process.env inheritance), and the gitdir-pointer
+		// guard. Guard failure is fail-safe TOWARD REPORTING a mutation: a
+		// corrupted `.git` pointer in a READ-ONLY lane is itself a lane
+		// violation (the worker rewrote something it must not touch), so it
+		// surfaces as a note + internal log instead of a clean verdict.
+		const trust = worktreeTrustCheck(worktreePath);
+		if (trust.kind === "worktree" && !trust.ok) {
+			logInternalError(
+				"post-execution.readLane.gitdirMismatch",
+				new Error(`Refusing to run the mutation probe inside ${worktreePath}: ${trust.reason}`),
+				`worktreePath=${worktreePath}`,
+			);
+			return {
+				filesChanged: 0,
+				sample: [`worktree corrupted — gitdir pointer check failed (${trust.reason}); no git executed`],
+			};
+		}
 		// W10-8 one-shot git probe per read-only task — child_process is
 		// already in the platform; dynamic keeps it off the static import graph.
 		// LAZY: see above
 		const { execFile } = await import("node:child_process");
 		const out: string = await new Promise((resolve, reject) => {
-			execFile("git", ["status", "--porcelain"], { cwd: worktreePath, encoding: "utf-8", timeout: 10_000 }, (err, stdout) =>
-				err ? reject(err) : resolve(stdout),
+			execFile(
+				"git",
+				hardenGitArgs(["status", "--porcelain"]),
+				{
+					cwd: worktreePath,
+					env: buildGitSafeEnv(),
+					encoding: "utf-8",
+					timeout: 10_000,
+					windowsHide: true,
+				},
+				(err, stdout) => (err ? reject(err) : resolve(stdout)),
 			);
 		});
 		const entries = out

package/src/utils/socket-path.ts

@@ -122,11 +122,62 @@ export async function prepareBrokerSocketDir(sockPath: string): Promise<void> {
 	}
 }
 
+/** Literal-escaping helper for building filesystem-name regexes. */
+function escapeRegExp(literal: string): string {
+	return literal.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+}
+
+/**
+ * B-LOW1: sweep `${sockPath}.stopping.<pid>.<hex>` shield corpses left by
+ * broker/socket-stop.ts. stopServerAndRemoveSocket renames a foreign/unpinned
+ * socket leaf aside across the libuv close-unlink window and renames it back
+ * afterwards; a crash between those renames strands the shield forever — the
+ * plain removeStaleBrokerSocket flow only ever looks at `sockPath` itself, so
+ * the corpses previously accumulated one per crashed stop.
+ *
+ * A corpse is removed ONLY when the pid embedded in its name is provably dead
+ * (process.kill(pid, 0) → ESRCH). EPERM/any other signal result means the pid
+ * is alive (or its liveness cannot be proven) — the shield is kept (fail-safe:
+ * a live broker may still restore it). Best-effort: never throws.
+ */
+async function sweepStoppingShields(sockPath: string): Promise<void> {
+	if (process.platform === "win32") return; // named pipes have no fs leaves
+	const dir = path.dirname(sockPath);
+	const pattern = new RegExp(`^${escapeRegExp(path.basename(sockPath))}\\.stopping\\.(\\d+)\\.[0-9a-f]{1,32}$`);
+	let entries: string[];
+	try {
+		entries = await fsp.readdir(dir);
+	} catch {
+		return;
+	}
+	for (const entry of entries) {
+		const match = pattern.exec(entry);
+		if (!match) continue;
+		const pid = Number.parseInt(match[1]!, 10);
+		if (!Number.isInteger(pid) || pid <= 0) continue;
+		try {
+			process.kill(pid, 0);
+			continue; // pid alive — keep the shield
+		} catch (err) {
+			const code = (err as NodeJS.ErrnoException).code;
+			if (code !== "ESRCH") continue; // cannot prove dead — keep
+		}
+		try {
+			await fsp.unlink(path.join(dir, entry));
+		} catch {
+			/* best-effort */
+		}
+	}
+}
+
 /** Connect-then-unlink stale socket (herdr pattern). If a live broker is
  *  listening, leave the endpoint intact (EADDRINUSE will surface on bind).
  *  If a stale file exists with no listener, remove it. If the path is a
  *  symlink, refuse rather than follow.
  *
+ *  Also sweeps `${sockPath}.stopping.*` shield corpses whose recorded pid is
+ *  dead (B-LOW1 — see sweepStoppingShields).
+ *
  *  Returns "removed" when the stale entry was unlinked, "kept" when a live
  *  listener was detected, "absent" when no entry existed, "refused"
  *  when the entry is a symlink. */
@@ -138,6 +189,9 @@ export async function removeStaleBrokerSocket(
 	// the timeout branch without racing a real localhost connect.
 	netModule?: { createConnection: (path: string) => { once: (ev: string, fn: (arg?: unknown) => void) => void; destroy: () => void } },
 ): Promise<"removed" | "kept" | "absent" | "refused"> {
+	// B-LOW1: sweep stranded stop-shields first (best-effort, never affects the
+	// sockPath verdict below).
+	await sweepStoppingShields(sockPath);
 	// Reject symlinks outright.
 	let st: Awaited<ReturnType<typeof fsp.lstat>>;
 	try {

package/src/worktree/branch-freshness.ts

@@ -1,25 +1,12 @@
 import { execFileSync } from "node:child_process";
-import { WINDOWS_ESSENTIAL_ENV_VARS } from "../utils/env-allowlist.ts";
-import { sanitizeEnvSecrets } from "../utils/env-filter.ts";
+import { buildGitSafeEnv, hardenGitArgs } from "../worktree/git-hardening.ts";
 
-// Read-only git operations only (rev-list, rev-parse, log). Sanitize env to
-// avoid leaking API keys/tokens to any git hook/alias/credential-helper.
-// C-1 fix (code-review 2026-06-23): previously inherited the full parent env.
-const GIT_SAFE_ENV = sanitizeEnvSecrets(process.env, {
-	allowList: [
-		"PATH",
-		"HOME",
-		"USER",
-		...WINDOWS_ESSENTIAL_ENV_VARS,
-		"SHELL",
-		"TERM",
-		"LANG",
-		"LC_ALL",
-		"GIT_CONFIG_GLOBAL",
-		"GIT_CONFIG_SYSTEM",
-		"GIT_EXEC_PATH",
-	],
-});
+// Read-only git operations only (rev-list, rev-parse, log). C-1 fix
+// (code-review 2026-06-23): never inherit the full parent env — API keys
+// must not reach git hooks/aliases/credential-helpers. R-A6 (MED-1
+// uniformity): env + argv now come from the shared git-hardening helpers
+// (sanitizeEnvSecrets allowList, GIT_CONFIG_NOSYSTEM=1, config-injection
+// overrides) instead of a drifting local GIT_SAFE_ENV copy.
 
 export type BranchFreshnessStatus = "fresh" | "stale" | "diverged" | "unknown";
 export type StaleBranchPolicy = "warn" | "block" | "auto_rebase" | "auto_merge_forward";
@@ -36,11 +23,11 @@ export interface BranchFreshness {
 }
 
 function git(cwd: string, args: string[]): string {
-	return execFileSync("git", args, {
+	return execFileSync("git", hardenGitArgs(args), {
 		cwd,
+		env: buildGitSafeEnv(),
 		encoding: "utf-8",
 		stdio: ["ignore", "pipe", "pipe"],
-		env: GIT_SAFE_ENV,
 		windowsHide: true,
 	}).trim();
 }