pi-crew 0.11.49 → 0.11.51

package/CHANGELOG.md

@@ -1,5 +1,121 @@
 # Changelog
 
+## [0.11.51] — SEC-2026-11: security audit remediation (30 confirmed findings + 4 leads, 13 waves) (2026-10-30)
+
+**Fixed (security).** Full remediation of the 2026-10-29 independent security audit (skill security-audit, full
+profile, whole package @ 6063f377; 30 confirmed / 4 needs_validation / 3 rejected). Story:
+`docs/stories/SEC-2026-11-audit-remediation/`. Evidence: `/home/bom/security-audit-skill/pi-crew/run-1` (report,
+findings, fix-records). Wave-by-wave:
+
+**Fixed (CI live-probed, Windows).** Hardened git env (`GIT_CONFIG_NOSYSTEM=1`) dropped the
+Git-for-Windows system gitconfig — where the install-wide `core.autocrlf=true` default lives — so every
+hardened `git status` reported phantom modifications on pristine CRLF worktrees (verify-gate skip refusals,
+memo disabled, snapshot dirty: all fail-closed on clean trees). `buildGitSafeEnv` now re-injects ONLY the two
+eol scalars (`core.autocrlf`/`core.eol`), parsed and value-domain-checked from the canonical system gitconfig
+by trusted code, via git's env-config channel (`GIT_CONFIG_COUNT`, honored independently of NOSYSTEM). No
+include/filter/other system key can travel the channel; attacker-supplied `GIT_CONFIG_*` stays stripped
+(pinned). Diagnosed with a live windows-2025 CI probe (run 41058674711: full-env status clean vs safe-env
+`M run.js`). Test suite hardening: deadline test isolates its bound (no seeded budget racing the terminal
+status), O_NOFOLLOW symlink-swap pin skips documented on win32 (libuv no-op; binding control there is the
+Ed25519 steering signature layer), theme-stem escape plant skips documented where the OS forbids control
+chars in filenames (vector structurally absent).
+
+**Fixed (live-caught regression, real-test battery).** Ask/delegate/message were dead in every default-config
+worker session since 0.11.50: LOW-1 moved the broker token from env to the fd3 pipe, but the three tool guards
+still read the env token. Workers now bridge to fd3-resolved child broker credentials (task-identity-bound,
+settled-promise seam in `crew-broker-child.ts`; guards in `prompt-runtime.ts` / `message-tool.ts`). Proven live:
+ask park→respond(signed)→resume, message delivery, signed steer honored; pinned unit suite 5/5
+(`test/unit/prompt/low1-fd3-tool-guard.test.ts`).
+
+- **w1a broker (HIGH×2, MEDIUM)** — spawns without a task identity no longer receive the bare per-run token
+  (fail closed); bare-runId fallback retired for explicit taskId hello claims; `wait.*` authenticate via
+  task-scoped compound tokens only; durable mailbox rows + steering lines are Ed25519-signed by the root session
+  (private key heap-only, children get the public verify key via `PI_CREW_MAILBOX_VERIFY_KEY`), consumers drop
+  unsigned/invalid rows as noise; steering poll re-validates per tick (TOCTOU); inbox fence neutralization covers
+  every attacker-influenced metadata field.
+- **w1b bindings (MEDIUM, LOW)** — gatherReplies binds replies to (mailId → expected addressee) with broker-
+  authenticated `from`; api claim/release/transition gated for read_only tier + claim bound to the caller's
+  `PI_CREW_TASK_ID`.
+- **w2 verify-gate (HIGH×3)** — gate binds the tracked working tree at dispatch (temp-index treeOid), fails on
+  drift, downgrades mid-gate tamper to INCONCLUSIVE; memo key = cwd + full tracked-tree oid (dirty ⇒ memo off);
+  dependency-worktree probes refuse skip on uncommitted work even on memoized PASS.
+- **w3 dwf trust (HIGH, MEDIUM)** — user-tier `.dwf.ts`/preStepScript default-deny (`PI_CREW_TRUST_USER_DWF`);
+  dispatch-time `dynamicScriptPin` (path+sha256) persisted before load and verified on every resume arm;
+  checkpoints bound to runId with schema/clamp/verdict-allowlist hydration validation.
+- **w4a child-pi (HIGH×2)** — inference-broker in-flight cap enforced (increment + exactly-once settle; over-cap
+  429s); sandbox toolchain binds capped below the user trust boundary (no `$HOME`/`~/.pi/agent` overshoot —
+  auth.json unreachable).
+- **w4b config (HIGH, MEDIUM)** — `runtime.embeddedWorkers` user-only (sensitive); embedded routing fails closed
+  while a sandbox posture is on; S-7 read_only execution-tool floor (bash/edit/write un-expandable by
+  frontmatter; D5 write-tier parity preserved); `pi-args` emits tools from the resolved policy.
+- **w5a root-gate (HIGH, MEDIUM)** — dryRun carriers traverse the full R11-S1 matrix; delete/cleanup/init gated
+  (resolved-tier backstop in handleDelete; init scope union resolver).
+- **w5b resume (MEDIUM×2, LOW)** — resume inherits budget + deadline (manifest-derived re-arm; deadline timer
+  armed); maxTasks admission re-enforced before any side effect; special-kind adopt performs the in-lock
+  liveness recheck. Plus: perf-sampler child error listener (pre-existing abort-after-exit host crash).
+- **w6 locks (HIGH, MEDIUM, LOW)** — seed-path destination O_NOFOLLOW ancestor validation (pre+post mkdir);
+  workspace-lock refresh CAS on (dev,ino)+bytes (no clobber of a stolen lock); steal removal bound to the
+  verified corpse token + post-claim verification in both acquire loops.
+- **w7a render (MEDIUM×2, LOW)** — shared `stripTerminalSequences`; control-char theme names refused/neutralized;
+  inline-panel transcript + tool-renderers + inspect sinks sanitize OSC/CSI/control chars.
+- **w7b observability/import (MEDIUM, LOW×2)** — OTLP `redirect:'manual'` + 3xx refusal; userinfo endpoints
+  refused + origin-only error/log rendering; imported manifest fields rendered through `sanitizeImportedText`.
+- **w8 ci (MEDIUM, LOW)** — battery changed-path matching decodes git C-quoted paths (quotePath pinned,
+  fail-closed decode) so T7 live-smoke can't be blind-triggered; ci.yml tarball smoke binds the exact pack name
+  with loud existence/count/version assertions (no decoy glob).
+
+**Verification.** Per-wave regression tests (≈160 new) + sequential re-run of all 211 suite files affected by
+mid-run tree churn: green. `npm run typecheck`, `npm run lint`, `biome format`, `check-env-vars`,
+`check-lazy-imports`, `check-slop-rules`, `check-event-types-registry --enforce` all pass. Full-suite fresh run
+on the final tree pending release gate (see story validation.md).
+
+## [0.11.51] — wave 9: needs_validation leads + deferred residuals
+
+**Fixed (security hardening).** Follow-up wave closing the audit's 4 needs_validation leads (deterministic/defensive
+halves) and the residuals deferred by w1b/w7a/w7b:
+
+- **N1** legacy live-session MCP route: allowlist-shaped post-creation foreign-extension assert (typed
+  fail-closed `McpForeignExtensionError` + `live-session.foreign_extension_blocked` event) — a differently-named
+  MCP adapter can no longer silently load/connect for a read-only role when the SDK falls back to the
+  DefaultResourceLoader path.
+- **N2** version probe: `probePiVersion` failures re-arm after a 60s TTL instead of memoizing null for the
+  process lifetime — one transient cold-start miss no longer permanently drops `--no-mcp` from parity spawns on
+  hosts that support it (the empty-frontmatter `--tools` half was already closed in the first wave).
+- **N3** persisted run state: loader-level validation — per-task shape + runId binding (foreign-runId entries
+  dropped) + 10k DoG cap; manifest runKind allowlist (unknown → team-run + warn); non-object manifests fail
+  closed with quarantine. On-disk forensics preserved (in-memory drops only).
+- **N4** verification subsystem git invocations: all 16 sites (verification-worktree ×6, verify-gate-memo ×9,
+  verify-gate dirty-probe ×1) routed through the MED-1 composition (`hardenGitArgs` + `buildGitSafeEnv` +
+  `assertWorktreePointerTrusted`), closing the config-reachable helper-execution sink the audit reproduced live
+  (core.fsmonitor at a hijacked worktree). w2 tree-OID values pinned unchanged.
+- **residuals**: read_only role gates + caller audit fields on the remaining mutating api ops
+  (write-heartbeat, live-agent control cluster, mailbox send/ack/repair, foreground-interrupt);
+  `parseOtlpConfig` refuses userinfo endpoints at validation time (origin-only errors); `tool_execution_start`
+  `event.args` string leaves sanitized before ToolExecutionComponent render.
+
+42 new regression tests. Owner-observed deployment checklists for the leads' impact confirmation remain in the
+audit's NEEDS-VALIDATION.md.
+
+## [Unreleased] — test hardening
+
+**Fixed (test-only).** `waitForPreGateEvents` (classifier-pre-gate) now THROWS on timeout with counts + path
+instead of returning silently — the silent return turned a legit wait-timeout into a far-away
+`TypeError: Cannot read properties of undefined (reading 'taskId')` on `preGateEvents(...)[0]!` (the [pg-10]
+CI flake: 2 Node-22 shards, run 40797688830, 2026-10-29; rerun green). A timeout now fails AT the wait site
+with diagnostics (found vs expected `task.verifier_pre_gate` events, eventsPath, budget). Bug-030 RCA backlog item.
+
+## [0.11.50] — LOW-1: PI_CREW_BROKER_STDIN fd3 handshake DEFAULT-ON ('0' opts out) (2026-10-28)
+
+**Changed (LOW-1 gate flip).** The broker-credential fd3 handshake route is now **DEFAULT-ON**: both gates
+(`child-pi-spawn.resolveBrokerStdinHandshakeEnabled`, `crew-broker-child.resolveBrokerStdinFallbackEnabled`) flipped
+from `=== "1"` (opt-in, v0.11.48–0.11.49) to `!== "0"` — only the exact value `0` opts out (rollback to the
+bit-for-bit legacy env route, unchanged contract). Safe now because the v0.11.49 fd3 dedicated-pipe transport removed
+the fd0/readPipedStdin race that caused the 0.11.46/47 silent-worker-death incident. The FIX-1 spawner write of
+`"1"` stays (pins the child route deterministically + keeps a default-ON parent compatible with pre-flip workers
+whose mirror gate still reads `=== "1"`); an opted-out parent keeps the token in the child env, which independently
+disarms the worker reader. New live-worker integration pin: DEFAULT (gate unset) + fd3 payload → alive + no leak
+(unit seams are structurally blind to this failure class — run the real-test battery T7 before publishing).
+
 ## [0.11.49] — 0.11.46/47 incident ROOT-CAUSED & CLOSED: fd0 handshake race → fd3 dedicated pipe; T7 nonce binding; review fix wave (2026-10-28)
 
 **Root cause (dynamically confirmed 5/5 + on-disk leak proof).** pi's `readPipedStdin` (main.js:52-65) consumes ALL