pi-crew 0.11.49 → 0.11.51

package/src/ui/theme-discovery.ts

@@ -21,6 +21,7 @@
  */
 import * as fs from "node:fs";
 import { atomicWriteFile } from "../state/atomic-write.ts";
+import { sanitizeUntrustedLine } from "../utils/visual.ts";
 import { getAllThemes } from "./pi-ui-compat.ts";
 
 /**
@@ -125,13 +126,20 @@ function discoverPiThemesFromFs(): PiThemeInfo[] {
 			for (const file of fs.readdirSync(dir) as string[]) {
 				if (!file.endsWith(".json")) continue;
 				const name = file.slice(0, -5);
+				// w7a-render (control-char-theme-name-render): ~/.pi/agent/themes is
+				// worker-writable, so a filename stem carrying control/escape chars
+				// (OSC-52/OSC-8/CSI) is attacker-plantable. Refuse the file entirely —
+				// it can never become a picker value or a listing line.
+				if (/[\u0000-\u001f\u007f-\u009f]/.test(name)) continue;
 				if (seen.has(name)) continue;
 				const fullPath = `${dir}/${file}`;
 				let displayName: string | undefined;
 				let mode: "dark" | "light" | undefined;
 				try {
 					const json = JSON.parse(fs.readFileSync(fullPath, "utf8"));
-					displayName = typeof json.name === "string" ? json.name : undefined;
+					// The JSON body is worker-writable too — the human-friendly name is
+					// untrusted display text (w7a-render defense in depth).
+					displayName = typeof json.name === "string" ? sanitizeUntrustedLine(json.name) : undefined;
 					mode = detectThemeMode(json);
 				} catch {
 					// keep undefined
@@ -256,5 +264,9 @@ function themeLine(t: PiThemeInfo, active: string | undefined): string {
 	const isActive = t.name === active;
 	const tag = isActive ? " ← active" : "";
 	const src = t.source === "builtin" ? " (builtin)" : "";
-	return `  ${isActive ? "●" : "○"} ${t.name}${src}${tag}`;
+	// w7a-render: theme names derived from worker-writable files (fs scan or
+	// host theme list) are untrusted display text — sanitize before the
+	// listing becomes tool-result content (R4-B1). Identity comparison above
+	// stays on the raw name so switching keeps working.
+	return `  ${isActive ? "●" : "○"} ${sanitizeUntrustedLine(t.name)}${src}${tag}`;
 }

package/src/ui/tool-renderers/index.ts

@@ -27,6 +27,7 @@
 
 import { type Container, Text, visibleWidth } from "@earendil-works/pi-tui";
 import type { CrewAgentRecord } from "../../runtime/crew-agent-runtime.ts";
+import { sanitizeUntrustedLine } from "../../utils/visual.ts";
 import { AdaptiveCard } from "../adaptive-card.ts";
 import type { CrewComponent } from "../component.ts";
 import { formatCount, formatDuration, formatTokens, truncLine } from "../format-helpers.ts";
@@ -147,8 +148,12 @@ function shortRun(runId: string | undefined): string {
 /** Dim preview line (goals, prompts, output snippets) with visual truncation. */
 function previewLine(glyph: string, slot: RailSlot, text: string, theme: CrewTheme, budget: number, shorten = false): string {
 	const flat = (shorten ? shortenPath(text) : text).replace(/\n/g, " ");
+	// w7a-render (worker-output-render-unsanitized): worker/repo-derived text is
+	// sanitized BEFORE theme wrap (R4-B1) — pi-tui zero-widths escape payloads
+	// so visible-width truncation would never cut an in-window OSC/CSI payload.
+	const safe = sanitizeUntrustedLine(flat);
 	const maxLen = budget - 2;
-	const body = visibleWidth(flat) > maxLen ? `${truncVisual(flat, maxLen - 1)}…` : flat;
+	const body = visibleWidth(safe) > maxLen ? `${truncVisual(safe, maxLen - 1)}…` : safe;
 	return railLine(glyph, slot, theme.fg("dim", body), theme, budget);
 }
 
@@ -204,7 +209,9 @@ function renderTeamResult(result: Record<string, unknown>, options: unknown, the
 	// ── Streaming (partial result, collapsed view) ──
 	const isPartial = (options as Record<string, unknown>)?.isPartial === true;
 	if (isPartial && !ctx.expanded) {
-		const parsed = parseStreamingProgress(extractContentText(result?.content));
+		// w7a-render: progress text is a worker-derived channel — sanitize before
+		// parsing so every meta fragment derived from it (status/activeAgent) is escape-free.
+		const parsed = parseStreamingProgress(sanitizeUntrustedLine(extractContentText(result?.content)));
 		if (parsed) {
 			const spinner = theme.fg("accent", spinnerFrame(String(spinnerClockNow())));
 			const elapsed = theme.fg("dim", formatDuration(parsed.elapsedMs));
@@ -229,7 +236,13 @@ function renderTeamResult(result: Record<string, unknown>, options: unknown, the
 		}
 		const fallback = extractContentText(result?.content).split("\n").filter(Boolean).pop();
 		if (fallback) {
-			return railLine(RAIL.body, "borderAccent", `${theme.fg("warning", "◉")} ${theme.fg("dim", fallback)}`, theme, budget);
+			return railLine(
+				RAIL.body,
+				"borderAccent",
+				`${theme.fg("warning", "◉")} ${theme.fg("dim", sanitizeUntrustedLine(fallback))}`,
+				theme,
+				budget,
+			);
 		}
 	}
 
@@ -402,7 +415,7 @@ function renderAgentResult(result: Record<string, unknown>, options: unknown, th
 		const name = (d.agentName as string) ?? (d.agentId as string) ?? "agent";
 		const spinner = theme.fg("accent", spinnerFrame(String(d.agentId ?? "")));
 		const meta: string[] = [];
-		const progressText = extractContentText(result?.content);
+		const progressText = sanitizeUntrustedLine(extractContentText(result?.content));
 		if (progressText) {
 			const parsed = parseCompactToolProgress(progressText);
 			const elapsedSec = parsed ? Math.round(parsed.elapsedMs / 1000) : 0;
@@ -430,13 +443,20 @@ function renderAgentResult(result: Record<string, unknown>, options: unknown, th
 		const badge = statusBadge(status, theme);
 		const head = `${badge} ${theme.fg("toolTitle", theme.bold(label))}`;
 		if (d.error) {
-			return railLine(RAIL.close, "error", `${head} ${theme.fg("error", truncLine(String(d.error), budget - 24))}`, theme, budget);
+			// w7a-render: task.error can embed child-process stderr excerpts (R4-B1).
+			return railLine(
+				RAIL.close,
+				"error",
+				`${head} ${theme.fg("error", truncLine(sanitizeUntrustedLine(String(d.error)), budget - 24))}`,
+				theme,
+				budget,
+			);
 		}
 		const output = results?.length ? ((results[0] as Record<string, unknown>).output as string | undefined) : undefined;
 		const preview = output ? output.split("\n").find((l) => l.trim()) : undefined;
 		const right = theme.fg("dim", PI_EXPAND_CHORD);
 		if (preview) {
-			const left = `${head} ${theme.fg("muted", truncLine(preview, Math.max(8, budget - visibleWidth(head) - 8)))}`;
+			const left = `${head} ${theme.fg("muted", truncLine(sanitizeUntrustedLine(preview), Math.max(8, budget - visibleWidth(head) - 8)))}`;
 			return railLine(RAIL.close, closeSlot, railLeaders(left, right, budget, theme), theme, budget);
 		}
 		// Live 2026-09-16: with no output preview the cap printed a bare

package/src/utils/safe-terminal-text.ts

@@ -0,0 +1,60 @@
+/**
+ * safe-terminal-text.ts — neutralize terminal escape sequences in untrusted
+ * text (w7a-render, 2026-10-29).
+ *
+ * Worker-derived strings (inline-panel transcript text/tool names, theme
+ * filenames under ~/.pi/agent/themes, inspect error excerpts) can carry
+ * OSC/APC/DCS/SOS string sequences (OSC 52 clipboard writes, OSC 8
+ * hyperlinks, OSC 0 title sets) and CSI/C1 sequences (screen clear, cursor
+ * moves, DA1 response spoofing) that pi-tui writes to the operator terminal
+ * verbatim — pi-tui zero-widths escape payloads, so its visible-width crash
+ * guard never trips and an in-window payload reaches terminal.write
+ * byte-for-byte.
+ *
+ * Unlike `sanitizeUntrustedLine` (utils/visual.ts) — the single-line sink
+ * helper that maps ALL C0/C1 controls (including newlines) to spaces — this
+ * helper preserves printable structure (newlines, tabs) so multi-line
+ * transcript text keeps its shape; it ONLY removes escape-sequence bytes:
+ *  - OSC/APC/DCS/SOS string sequences, BEL- (`\u0007`), ST- (`ESC \`) and
+ *    C1-ST- (`\u009C`) terminated;
+ *  - CSI and other ESC-intermediate sequences, including the C1 CSI form
+ *    (`\u009B`);
+ *  - a final sweep removes any residual ESC/C1 introducer bytes (e.g.
+ *    sequences truncated mid-stream by compaction) so no control byte can
+ *    survive.
+ * SGR color sequences are stripped too: trusted components (pi-tui theme
+ * adapters) apply their own styling AFTER this boundary, so no
+ * worker-supplied styling byte survives.
+ */
+
+/**
+ * OSC (`ESC ]`), APC (`ESC _`), DCS (`ESC P`), SOS (`ESC X`) and PM (`ESC ^`)
+ * string sequences … BEL / ST (`ESC \`)/ C1-ST (`\u009C`) terminators.
+ */
+const TERMINAL_STRING_SEQUENCE_RE =
+	/(?:\u001B[\]_PX^][\s\S]*?(?:\u0007|\u001B\\|\u009C)|[\u001B\u009B][[\]()#;?]*(?:\d{1,4}(?:[;:]\d{0,4})*)?[\dA-PR-TZcf-nq-uy=><~])/g;
+
+/** Residual ESC/C1 introducer bytes (truncated sequences, malformed forms). */
+const RESIDUAL_INTRODUCER_RE = /[\u001B\u009B\u009C]/g;
+
+/** Fast path: a string without any introducer byte cannot carry a sequence. */
+function hasIntroducer(value: string): boolean {
+	return value.includes("\u001B") || value.includes("\u009B") || value.includes("\u009C");
+}
+
+/** True when the value contains bytes that only appear inside escape sequences. */
+export function hasTerminalEscapeBytes(value: string): boolean {
+	return hasIntroducer(value);
+}
+
+/**
+ * Neutralize terminal escape sequences in untrusted text.
+ * Returns a string with zero ESC/C1 control bytes: OSC/APC/DCS/SOS payloads
+ * are removed wholesale (when terminated), CSI/ESC-intermediate sequences are
+ * removed, and any residual introducer byte is dropped. Printable text
+ * (including newlines/tabs) passes through unchanged.
+ */
+export function stripTerminalSequences(value: string): string {
+	if (!hasIntroducer(value)) return value;
+	return value.replace(TERMINAL_STRING_SEQUENCE_RE, "").replace(RESIDUAL_INTRODUCER_RE, "");
+}

package/src/worktree/git-hardening.ts

@@ -206,6 +206,63 @@ export function resolveTrustedGitDir(startPath: string): string | undefined {
  *    without breaking legitimate filters — the worker-reachable path to a
  *    POISONED definition (gitdir hijack) is what the pointer guards block.
  */
+/** EOL semantics carried by the SYSTEM gitconfig (Git-for-Windows ships
+ *  `core.autocrlf=true` there — the install-wide default). Only the two
+ *  value-domain-checked keys are ever forwarded (see buildGitSafeEnv). */
+interface SystemCoreEol {
+	autocrlf?: "true" | "false" | "input";
+	eol?: "lf" | "crlf" | "native";
+}
+
+/** Strict parser for the system gitconfig's [core] eol semantics. Deliberately
+ *  NOT a gitconfig interpreter: no includes, no interpolation, no other keys —
+ *  a poisoned system config can contribute NOTHING but these two validated
+ *  scalars. Unparseable/invalid values are dropped (fail to no-injection). */
+export function parseSystemCoreEol(text: string): SystemCoreEol {
+	const result: SystemCoreEol = {};
+	let inCore = false;
+	for (const rawLine of text.split(/\r?\n/)) {
+		const line = rawLine.replace(/[\t ];*[#;].*$/, "").trim();
+		if (line.length === 0) continue;
+		const section = line.match(/^\[([A-Za-z0-9-.]+)\]$/);
+		if (section) {
+			inCore = section[1]!.toLowerCase() === "core";
+			continue;
+		}
+		if (!inCore) continue;
+		const kv = line.match(/^([A-Za-z0-9-]+)\s*=\s*(\S+)$/);
+		if (!kv) continue;
+		const key = kv[1]!.toLowerCase();
+		const value = kv[2]!.toLowerCase();
+		if (key === "autocrlf" && (value === "true" || value === "false" || value === "input")) {
+			result.autocrlf = value;
+		} else if (key === "eol" && (value === "lf" || value === "crlf" || value === "native")) {
+			result.eol = value;
+		}
+	}
+	return result;
+}
+
+/** Best-effort read of the platform's DEFAULT system gitconfig eol semantics.
+ *  The `GIT_CONFIG_SYSTEM` env var is deliberately NOT honored — forwarding it
+ *  is exactly the R-A4a vector — so a poisoned environment cannot redirect
+ *  this read; only git's canonical install paths are consulted. */
+function readSystemGitConfigEol(): SystemCoreEol {
+	let configPath: string | undefined;
+	if (process.platform === "win32") {
+		const programFiles = process.env["ProgramFiles"] ?? process.env["ProgramFiles(x86)"];
+		if (programFiles) configPath = path.join(programFiles, "Git", "etc", "gitconfig");
+	} else {
+		configPath = "/etc/gitconfig";
+	}
+	if (!configPath) return {};
+	try {
+		return parseSystemCoreEol(fs.readFileSync(configPath, "utf-8"));
+	} catch {
+		return {};
+	}
+}
+
 export function buildGitSafeEnv(locale: "C" | "en_US.UTF-8" = "C"): Record<string, string> {
 	const allowList = [
 		"PATH",
@@ -247,7 +304,7 @@ export function buildGitSafeEnv(locale: "C" | "en_US.UTF-8" = "C"): Record<strin
 		if (value === undefined) continue;
 		normalizedEnv[canonicalCase.get(key.toUpperCase()) ?? key] = value;
 	}
-	return {
+	const safeEnv: Record<string, string> = {
 		...sanitizeEnvSecrets(normalizedEnv, { allowList }),
 		LANG: locale,
 		LC_ALL: locale,
@@ -256,6 +313,26 @@ export function buildGitSafeEnv(locale: "C" | "en_US.UTF-8" = "C"): Record<strin
 		// UNCONDITIONALLY on every platform (git for Windows honours it too).
 		GIT_CONFIG_NOSYSTEM: "1",
 	};
+	// Windows-CI live probe (2026-10-30, run 41058674711): with NOSYSTEM the
+	// Git-for-Windows install-wide `core.autocrlf=true` (which lives in the
+	// SYSTEM gitconfig, not the global one) vanishes from git's eol model — a
+	// pristine worktree checked out with CRLF then compares CRLF-vs-LF and
+	// `git status` reports phantom `M <file>` on every file → every hardened
+	// dirty probe fails CLOSED on clean trees (verify-gate skip refusals, memo
+	// disabled, snapshot dirty). Forward ONLY the two eol scalars, parsed and
+	// value-domain-checked by trusted code above, via git's env-config channel
+	// (GIT_CONFIG_COUNT — honored independently of NOSYSTEM, git>=2.31). No
+	// include, no filter, no other system key can travel this channel.
+	const systemEol = readSystemGitConfigEol();
+	const eolEntries = Object.entries(systemEol) as ["autocrlf" | "eol", string][];
+	if (eolEntries.length > 0) {
+		safeEnv.GIT_CONFIG_COUNT = String(eolEntries.length);
+		eolEntries.forEach(([key, value], index) => {
+			safeEnv[`GIT_CONFIG_KEY_${index}`] = `core.${key}`;
+			safeEnv[`GIT_CONFIG_VALUE_${index}`] = value;
+		});
+	}
+	return safeEnv;
 }
 
 /** Result of the R-A3 per-command trust check (see {@link worktreeTrustCheck}). */

package/src/worktree/worktree-manager.ts

@@ -11,6 +11,7 @@ import { WINDOWS_ESSENTIAL_ENV_VARS } from "../utils/env-allowlist.ts";
 import { sanitizeEnvSecrets } from "../utils/env-filter.ts";
 import { logInternalError } from "../utils/internal-error.ts";
 import { projectCrewRoot } from "../utils/paths.ts";
+import { resolveRealContainedPath } from "../utils/safe-paths.ts";
 import {
 	assertWorktreePointerTrusted,
 	buildGitSafeEnv,
@@ -574,13 +575,22 @@ export function normalizeSeedPaths(seedPaths: string[], repoRoot: string): strin
  * Overlay seed paths from repoRoot into worktreePath.
  * Copies files and directories, creating parent dirs as needed.
  * Skips non-existent sources with logInternalError (non-fatal).
+ *
+ * Destination-side safety (W6 fix, seedpaths-dest-symlink-ancestor): the
+ * destination is resolved through an O_NOFOLLOW ancestor walk rooted at the
+ * worktree path BEFORE any destructive/copying filesystem operation. A
+ * symlinked component under the worktree — materialized by `git worktree add`
+ * from a repo-committed symlink, or planted by a prior worker and surviving a
+ * reused worktree's preserve branch — must never redirect the rmSync/cpSync
+ * (which run in the HOST process, outside any worker sandbox) to a path
+ * outside the worktree. Such entries are skipped (fail closed) with
+ * logInternalError.
  */
 export function overlaySeedPaths(repoRoot: string, worktreePath: string, seedPaths: string[]): void {
 	const normalized = normalizeSeedPaths(seedPaths, repoRoot);
 
 	for (const seedPath of normalized) {
 		const sourcePath = path.join(repoRoot, seedPath);
-		const destinationPath = path.join(worktreePath, seedPath);
 
 		let sourceStat: fs.Stats;
 		try {
@@ -599,9 +609,29 @@ export function overlaySeedPaths(repoRoot: string, worktreePath: string, seedPat
 			continue;
 		}
 
-		fs.mkdirSync(path.dirname(destinationPath), { recursive: true });
-		fs.rmSync(destinationPath, { force: true, recursive: true });
-		fs.cpSync(sourcePath, destinationPath, {
+		// Resolve the destination through the O_NOFOLLOW ancestor walk instead of
+		// a plain lexical path.join: refuse (fail closed) when the resolved path
+		// escapes the worktree or ANY existing ancestor component is a symlink.
+		// A non-existent destination leaf is fine — the overlay creates it.
+		let safeDestination: string;
+		try {
+			safeDestination = resolveRealContainedPath(worktreePath, seedPath);
+			// Create parent directories only AFTER validation, then re-validate:
+			// mkdirSync itself walks the (validated) chain to create the missing
+			// tail, but a concurrent planter must not win the gap between the two
+			// validations.
+			fs.mkdirSync(path.dirname(safeDestination), { recursive: true });
+			safeDestination = resolveRealContainedPath(worktreePath, seedPath);
+		} catch {
+			logInternalError(
+				"worktree.seedPaths.destinationUnsafe",
+				new Error(`Seed destination escapes worktree or contains symlinked components — rejected: ${seedPath}`),
+			);
+			continue;
+		}
+
+		fs.rmSync(safeDestination, { force: true, recursive: true });
+		fs.cpSync(sourcePath, safeDestination, {
 			dereference: true,
 			force: true,
 			preserveTimestamps: true,