pi-crew 0.5.14 → 0.5.17

package/src/worktree/worktree-manager.ts

@@ -116,6 +116,11 @@ function runSetupHook(manifest: TeamRunManifest, task: TeamTaskState, repoRoot:
 		logInternalError("worktree.setupHook.rejected", new Error("hook path not allowed: " + rawHookPath), `cwd=${manifest.cwd}`);
 		return [];
 	}
+	// SECURITY WARNING: Home directory hooks (~/.pi/hooks/) are user-writable and not project-scoped.
+	// A rogue npm postinstall script could place malicious hooks there. Log for visibility.
+	if (path.isAbsolute(rawHookPath)) {
+		logInternalError("worktree.setupHook.homeHook", new Error("Home directory hook used — ensure ~/.pi/hooks/ is trusted"), `hookPath=${rawHookPath}`);
+	}
 	const hookPath = path.isAbsolute(rawHookPath) ? rawHookPath : path.resolve(repoRoot, rawHookPath);
 	// SECURITY: Verify the resolved hook path is contained within the real repoRoot.
 	// This prevents symlink-based escape where repoRoot is a symlink.
@@ -201,7 +206,64 @@ function pruneStaleWorktrees(repoRoot: string): void {
 	catch { /* best-effort */ }
 }
 
-export function prepareTaskWorkspace(manifest: TeamRunManifest, task: TeamTaskState): PreparedTaskWorkspace {
+/**
+ * Normalize and validate seed paths — ensure all paths stay within repoRoot.
+ * Rejects path traversal (../) and absolute paths.
+ */
+export function normalizeSeedPaths(seedPaths: string[], repoRoot: string): string[] {
+	const resolvedRepoRoot = path.resolve(repoRoot);
+	const entries = Array.isArray(seedPaths) ? seedPaths : [];
+	const seen = new Set<string>();
+	const normalized: string[] = [];
+
+	for (const entry of entries) {
+		if (typeof entry !== "string" || entry.trim().length === 0) continue;
+
+		const absolutePath = path.resolve(resolvedRepoRoot, entry);
+		const relativePath = path.relative(resolvedRepoRoot, absolutePath);
+
+		if (relativePath.startsWith("..") || path.isAbsolute(relativePath)) {
+			throw new Error(`seedPaths entries must stay inside repoRoot: ${entry}`);
+		}
+
+		const normalizedPath = relativePath.split(path.sep).join("/");
+		if (seen.has(normalizedPath)) continue;
+		seen.add(normalizedPath);
+		normalized.push(normalizedPath);
+	}
+
+	return normalized;
+}
+
+/**
+ * Overlay seed paths from repoRoot into worktreePath.
+ * Copies files and directories, creating parent dirs as needed.
+ * Skips non-existent sources with logInternalError (non-fatal).
+ */
+export function overlaySeedPaths(repoRoot: string, worktreePath: string, seedPaths: string[]): void {
+	const normalized = normalizeSeedPaths(seedPaths, repoRoot);
+
+	for (const seedPath of normalized) {
+		const sourcePath = path.join(repoRoot, seedPath);
+		const destinationPath = path.join(worktreePath, seedPath);
+
+		if (!fs.existsSync(sourcePath)) {
+			logInternalError("worktree.seedPaths.missing", new Error(`Seed path does not exist: ${seedPath}`));
+			continue;
+		}
+
+		fs.mkdirSync(path.dirname(destinationPath), { recursive: true });
+		fs.rmSync(destinationPath, { force: true, recursive: true });
+		fs.cpSync(sourcePath, destinationPath, {
+			dereference: false,
+			force: true,
+			preserveTimestamps: true,
+			recursive: true,
+		});
+	}
+}
+
+export function prepareTaskWorkspace(manifest: TeamRunManifest, task: TeamTaskState, stepSeedPaths?: string[]): PreparedTaskWorkspace {
 	if (manifest.workspaceMode !== "worktree") return { cwd: task.cwd };
 	const repoRoot = findGitRoot(manifest.cwd);
 	const loadedConfig = loadConfig(manifest.cwd);
@@ -220,6 +282,12 @@ export function prepareTaskWorkspace(manifest: TeamRunManifest, task: TeamTaskSt
 		if (currentBranch !== branch) {
 			throw new Error(`Existing worktree branch mismatch at ${worktreePath}: expected '${branch}', got '${currentBranch}'.`);
 		}
+		// Overlay seed paths from config + step-level seedPaths (reused worktree)
+		const globalSeedPaths = loadedConfig.config.worktree?.seedPaths ?? [];
+		const mergedReused = normalizeSeedPaths([...globalSeedPaths, ...(stepSeedPaths ?? [])], repoRoot);
+		if (mergedReused.length > 0) {
+			overlaySeedPaths(repoRoot, worktreePath, mergedReused);
+		}
 		return { cwd: worktreePath, worktreePath, branch, reused: true };
 	}
 	pruneStaleWorktrees(repoRoot);
@@ -242,6 +310,12 @@ export function prepareTaskWorkspace(manifest: TeamRunManifest, task: TeamTaskSt
 	}
 	const syntheticPaths = runSetupHook(manifest, task, repoRoot, worktreePath, branch);
 	const nodeModulesLinked = loadedConfig.config.worktree?.linkNodeModules === true ? linkNodeModulesIfPresent(repoRoot, worktreePath) : false;
+	// Overlay seed paths from config + step-level seedPaths
+	const globalSeedPaths = loadedConfig.config.worktree?.seedPaths ?? [];
+	const merged = normalizeSeedPaths([...globalSeedPaths, ...(stepSeedPaths ?? [])], repoRoot);
+	if (merged.length > 0) {
+		overlaySeedPaths(repoRoot, worktreePath, merged);
+	}
 	return { cwd: worktreePath, worktreePath, branch, reused: false, nodeModulesLinked, syntheticPaths };
 }