pi-crew 0.11.50 → 0.11.52

package/CHANGELOG.md

@@ -1,5 +1,148 @@
 # Changelog
 
+## [0.11.52] — live-catch backlog: cross-session cancel reaches inline runs + heartbeat-watcher false-positive class (2026-10-30)
+
+**Fixed (runtime, live-caught run `team_20261030044630`).** Two gaps filed as backlog after the
+0.11.51 real-test battery, both root-caused from the incident artifacts (not hypotheses):
+
+1. **Cross-session cancel never reached INLINE async runs.** The foreground-control interrupt guard
+   lived ONLY in background-runner's detached `main()`. Runs executed inline in the owner session
+   process (`executeBackgroundRun` core — also the `PI_CREW_TEST_ASYNC_INLINE` seam) never polled
+   `foreground-control.json`: the incident run had `manifest.async === undefined`, zero `async.*`
+   events, and TWO interrupt requests both stuck `acknowledged:false` while worker 403288 ran ≥75s
+   post-cancel with fresh heartbeats. Fix: guard core extracted as `startRunInterruptGuard` (hosted in
+   `foreground-control.ts` with the producer — keeps the lazy-imports ratchet at 542); detached
+   `startInterruptGuard` is now a thin process-wide wrapper (behavior byte-identical: sweep +
+   stopParentGuard + exitCode 130, pinned by regression tests); `executeBackgroundRun` with no host
+   signal mounts a RUN-SCOPED guard — ack + event + `runController.abort()` ONLY, never
+   `terminateActiveChildPiProcesses()` (a global sweep would murder sibling runs' children in the same
+   host process; pinned by the SCOPED-KILL test with a real registered child). The team-run input now
+   receives the RESOLVED signal — inline runs previously had NO cancellation source at all. Guard
+   stops in a `finally`; ownership deduped by host-signal presence (no double guard).
+2. **heartbeat-watcher false-dead class.** `crew.task.heartbeat_dead` fired 3× for a live worker
+   (heartbeat silent >5min during long tool work, `task.heartbeat.pid` undefined on every task, so the
+   PID-liveness downgrade gate had nothing to read), and `handleRetry` re-queued tasks WITHOUT
+   stripping liveness fields (attempt-2 inherited attempt-1's heartbeat timestamps). Fix: (a) watcher
+   attempt-clamp — heartbeat/`agentProgress` evidence older than the current attempt's `startedAt` is
+   inadmissible; no usable evidence ⇒ elapsed from `startedAt` (a task younger than `deadMs` can never
+   be dead); (b) `handleRetry` strips `heartbeat` + `agentProgress` on re-queue (checkpoint untouched);
+   (c) child-executor pins the attempt's worker pid into `task.heartbeat` (per-attempt reset, guarded
+   spread) so the PID-gate actually functions.
+
+Also: an already-ACKED interrupt no longer warns "Ignoring unknown foreground control request" every
+poll tick until guard stop (verifier-flagged cosmetic, carried over from the pre-extraction guard).
+
+Tests: 5 new `interrupt-guard.test.ts` (inline wiring, post-stop non-consumption, SCOPED-KILL,
+detached regression, acked-silence), `async-runner-inline-interrupt.test.ts` (e2e via the real inline
+seam: mid-run request → ack ≤3s + event + terminal run + no leaked interval), 4 watcher attempt-clamp
+pins (incl. genuinely-stale-still-dead regression + no-startedAt legacy), 2 heartbeat-pid pins, +1
+lifecycle retry-strip. Leader gates: full unit+integration, typecheck, biome, format:check,
+lazy-imports 542, slop 41 — all green.
+
+## [0.11.51] — SEC-2026-11: security audit remediation (30 confirmed findings + 4 leads, 13 waves) (2026-10-30)
+
+**Fixed (security).** Full remediation of the 2026-10-29 independent security audit (skill security-audit, full
+profile, whole package @ 6063f377; 30 confirmed / 4 needs_validation / 3 rejected). Story:
+`docs/stories/SEC-2026-11-audit-remediation/`. Evidence: `/home/bom/security-audit-skill/pi-crew/run-1` (report,
+findings, fix-records). Wave-by-wave:
+
+**Fixed (CI live-probed, Windows).** Hardened git env (`GIT_CONFIG_NOSYSTEM=1`) dropped the
+Git-for-Windows system gitconfig — where the install-wide `core.autocrlf=true` default lives — so every
+hardened `git status` reported phantom modifications on pristine CRLF worktrees (verify-gate skip refusals,
+memo disabled, snapshot dirty: all fail-closed on clean trees). `buildGitSafeEnv` now re-injects ONLY the two
+eol scalars (`core.autocrlf`/`core.eol`), parsed and value-domain-checked from the canonical system gitconfig
+by trusted code, via git's env-config channel (`GIT_CONFIG_COUNT`, honored independently of NOSYSTEM). No
+include/filter/other system key can travel the channel; attacker-supplied `GIT_CONFIG_*` stays stripped
+(pinned). Diagnosed with a live windows-2025 CI probe (run 41058674711: full-env status clean vs safe-env
+`M run.js`). Test suite hardening: deadline test isolates its bound (no seeded budget racing the terminal
+status), O_NOFOLLOW symlink-swap pin skips documented on win32 (libuv no-op; binding control there is the
+Ed25519 steering signature layer), theme-stem escape plant skips documented where the OS forbids control
+chars in filenames (vector structurally absent).
+
+**Fixed (live-caught regression, real-test battery).** Ask/delegate/message were dead in every default-config
+worker session since 0.11.50: LOW-1 moved the broker token from env to the fd3 pipe, but the three tool guards
+still read the env token. Workers now bridge to fd3-resolved child broker credentials (task-identity-bound,
+settled-promise seam in `crew-broker-child.ts`; guards in `prompt-runtime.ts` / `message-tool.ts`). Proven live:
+ask park→respond(signed)→resume, message delivery, signed steer honored; pinned unit suite 5/5
+(`test/unit/prompt/low1-fd3-tool-guard.test.ts`).
+
+- **w1a broker (HIGH×2, MEDIUM)** — spawns without a task identity no longer receive the bare per-run token
+  (fail closed); bare-runId fallback retired for explicit taskId hello claims; `wait.*` authenticate via
+  task-scoped compound tokens only; durable mailbox rows + steering lines are Ed25519-signed by the root session
+  (private key heap-only, children get the public verify key via `PI_CREW_MAILBOX_VERIFY_KEY`), consumers drop
+  unsigned/invalid rows as noise; steering poll re-validates per tick (TOCTOU); inbox fence neutralization covers
+  every attacker-influenced metadata field.
+- **w1b bindings (MEDIUM, LOW)** — gatherReplies binds replies to (mailId → expected addressee) with broker-
+  authenticated `from`; api claim/release/transition gated for read_only tier + claim bound to the caller's
+  `PI_CREW_TASK_ID`.
+- **w2 verify-gate (HIGH×3)** — gate binds the tracked working tree at dispatch (temp-index treeOid), fails on
+  drift, downgrades mid-gate tamper to INCONCLUSIVE; memo key = cwd + full tracked-tree oid (dirty ⇒ memo off);
+  dependency-worktree probes refuse skip on uncommitted work even on memoized PASS.
+- **w3 dwf trust (HIGH, MEDIUM)** — user-tier `.dwf.ts`/preStepScript default-deny (`PI_CREW_TRUST_USER_DWF`);
+  dispatch-time `dynamicScriptPin` (path+sha256) persisted before load and verified on every resume arm;
+  checkpoints bound to runId with schema/clamp/verdict-allowlist hydration validation.
+- **w4a child-pi (HIGH×2)** — inference-broker in-flight cap enforced (increment + exactly-once settle; over-cap
+  429s); sandbox toolchain binds capped below the user trust boundary (no `$HOME`/`~/.pi/agent` overshoot —
+  auth.json unreachable).
+- **w4b config (HIGH, MEDIUM)** — `runtime.embeddedWorkers` user-only (sensitive); embedded routing fails closed
+  while a sandbox posture is on; S-7 read_only execution-tool floor (bash/edit/write un-expandable by
+  frontmatter; D5 write-tier parity preserved); `pi-args` emits tools from the resolved policy.
+- **w5a root-gate (HIGH, MEDIUM)** — dryRun carriers traverse the full R11-S1 matrix; delete/cleanup/init gated
+  (resolved-tier backstop in handleDelete; init scope union resolver).
+- **w5b resume (MEDIUM×2, LOW)** — resume inherits budget + deadline (manifest-derived re-arm; deadline timer
+  armed); maxTasks admission re-enforced before any side effect; special-kind adopt performs the in-lock
+  liveness recheck. Plus: perf-sampler child error listener (pre-existing abort-after-exit host crash).
+- **w6 locks (HIGH, MEDIUM, LOW)** — seed-path destination O_NOFOLLOW ancestor validation (pre+post mkdir);
+  workspace-lock refresh CAS on (dev,ino)+bytes (no clobber of a stolen lock); steal removal bound to the
+  verified corpse token + post-claim verification in both acquire loops.
+- **w7a render (MEDIUM×2, LOW)** — shared `stripTerminalSequences`; control-char theme names refused/neutralized;
+  inline-panel transcript + tool-renderers + inspect sinks sanitize OSC/CSI/control chars.
+- **w7b observability/import (MEDIUM, LOW×2)** — OTLP `redirect:'manual'` + 3xx refusal; userinfo endpoints
+  refused + origin-only error/log rendering; imported manifest fields rendered through `sanitizeImportedText`.
+- **w8 ci (MEDIUM, LOW)** — battery changed-path matching decodes git C-quoted paths (quotePath pinned,
+  fail-closed decode) so T7 live-smoke can't be blind-triggered; ci.yml tarball smoke binds the exact pack name
+  with loud existence/count/version assertions (no decoy glob).
+
+**Verification.** Per-wave regression tests (≈160 new) + sequential re-run of all 211 suite files affected by
+mid-run tree churn: green. `npm run typecheck`, `npm run lint`, `biome format`, `check-env-vars`,
+`check-lazy-imports`, `check-slop-rules`, `check-event-types-registry --enforce` all pass. Full-suite fresh run
+on the final tree pending release gate (see story validation.md).
+
+## [0.11.51] — wave 9: needs_validation leads + deferred residuals
+
+**Fixed (security hardening).** Follow-up wave closing the audit's 4 needs_validation leads (deterministic/defensive
+halves) and the residuals deferred by w1b/w7a/w7b:
+
+- **N1** legacy live-session MCP route: allowlist-shaped post-creation foreign-extension assert (typed
+  fail-closed `McpForeignExtensionError` + `live-session.foreign_extension_blocked` event) — a differently-named
+  MCP adapter can no longer silently load/connect for a read-only role when the SDK falls back to the
+  DefaultResourceLoader path.
+- **N2** version probe: `probePiVersion` failures re-arm after a 60s TTL instead of memoizing null for the
+  process lifetime — one transient cold-start miss no longer permanently drops `--no-mcp` from parity spawns on
+  hosts that support it (the empty-frontmatter `--tools` half was already closed in the first wave).
+- **N3** persisted run state: loader-level validation — per-task shape + runId binding (foreign-runId entries
+  dropped) + 10k DoG cap; manifest runKind allowlist (unknown → team-run + warn); non-object manifests fail
+  closed with quarantine. On-disk forensics preserved (in-memory drops only).
+- **N4** verification subsystem git invocations: all 16 sites (verification-worktree ×6, verify-gate-memo ×9,
+  verify-gate dirty-probe ×1) routed through the MED-1 composition (`hardenGitArgs` + `buildGitSafeEnv` +
+  `assertWorktreePointerTrusted`), closing the config-reachable helper-execution sink the audit reproduced live
+  (core.fsmonitor at a hijacked worktree). w2 tree-OID values pinned unchanged.
+- **residuals**: read_only role gates + caller audit fields on the remaining mutating api ops
+  (write-heartbeat, live-agent control cluster, mailbox send/ack/repair, foreground-interrupt);
+  `parseOtlpConfig` refuses userinfo endpoints at validation time (origin-only errors); `tool_execution_start`
+  `event.args` string leaves sanitized before ToolExecutionComponent render.
+
+42 new regression tests. Owner-observed deployment checklists for the leads' impact confirmation remain in the
+audit's NEEDS-VALIDATION.md.
+
+## [Unreleased] — test hardening
+
+**Fixed (test-only).** `waitForPreGateEvents` (classifier-pre-gate) now THROWS on timeout with counts + path
+instead of returning silently — the silent return turned a legit wait-timeout into a far-away
+`TypeError: Cannot read properties of undefined (reading 'taskId')` on `preGateEvents(...)[0]!` (the [pg-10]
+CI flake: 2 Node-22 shards, run 40797688830, 2026-10-29; rerun green). A timeout now fails AT the wait site
+with diagnostics (found vs expected `task.verifier_pre_gate` events, eventsPath, budget). Bug-030 RCA backlog item.
+
 ## [0.11.50] — LOW-1: PI_CREW_BROKER_STDIN fd3 handshake DEFAULT-ON ('0' opts out) (2026-10-28)
 
 **Changed (LOW-1 gate flip).** The broker-credential fd3 handshake route is now **DEFAULT-ON**: both gates