pi-crew 0.5.5 → 0.5.6

package/src/runtime/team-runner.ts

@@ -36,6 +36,7 @@ import { registerRunPromise, resolveRunPromise, rejectRunPromise } from "./run-t
 import { clearTrackedTaskUsage } from "./usage-tracker.ts";
 import { CrewCancellationError, buildSyntheticTerminalEvidence, cancellationReasonFromSignal } from "./cancellation.ts";
 import { effectivenessPolicyDecision, evaluateRunEffectiveness, formatRunEffectivenessLines } from "./effectiveness.ts";
+import { logInternalError } from "../utils/internal-error.ts";
 
 export interface ExecuteTeamRunInput {
 	manifest: TeamRunManifest;
@@ -279,7 +280,7 @@ export async function executeTeamRun(input: ExecuteTeamRunInput): Promise<{ mani
 		resolveRunPromise(manifest.runId, result);
 		cleanupUsage();
 		// Terminate live agents for this run — agents are done when the run ends.
-		void terminateLiveAgentsForRun(manifest.runId, "completed", appendEvent, manifest.eventsPath).catch(() => {});
+		void terminateLiveAgentsForRun(manifest.runId, "completed", appendEvent, manifest.eventsPath).catch((error) => logInternalError("team-runner.completed.terminate", error, `runId=${manifest.runId}`));
 
 		// Emit run completion hook (100% reliable, fire-and-forget)
 		crewHooks.emit({ type: "run_completed", timestamp: new Date().toISOString(), runId: manifest.runId, data: { status: result.manifest.status, taskCount: result.tasks.length } });
@@ -519,7 +520,7 @@ async function executeTeamRunCore(
 						attemptId: (attempt) => `${manifest.runId}:${task.id}:attempt-${attempt}`,
 						onAttemptFailed: (attempt, error, delayMs, info) => {
 							lastAttemptId = info.attemptId;
-							appendEventAsync(manifest.eventsPath, { type: "crew.task.retry_attempt", runId: manifest.runId, taskId: task.id, message: error.message, data: { attempt, attemptId: info.attemptId, delayMs }, metadata: { attemptId: info.attemptId } }).catch(() => {});
+							appendEventAsync(manifest.eventsPath, { type: "crew.task.retry_attempt", runId: manifest.runId, taskId: task.id, message: error.message, data: { attempt, attemptId: info.attemptId, delayMs }, metadata: { attemptId: info.attemptId } }).catch((error) => logInternalError("team-runner.retry-attempt", error, `taskId=${task.id}`));
 							input.metricRegistry?.histogram("crew.task.retry_delay_ms", "Retry backoff delay, milliseconds").observe({ runId: manifest.runId, taskId: task.id }, delayMs);
 						},
 						onRetryGivenUp: (attempts, error, info) => {
@@ -536,7 +537,7 @@ async function executeTeamRunCore(
 						const freshManifest = fresh?.manifest ?? manifest;
 						const freshTasks = fresh?.tasks ?? tasks;
 						const cancelledTasks = freshTasks.map((item) => item.id === task.id && (item.status === "queued" || item.status === "running") ? { ...item, status: "cancelled" as const, finishedAt: new Date().toISOString(), error: `${reason.message} (${reason.code})` } : item);
-						appendEventAsync(freshManifest.eventsPath, { type: "task.cancelled", runId: freshManifest.runId, taskId: task.id, message: reason.message, data: { reason, phase: "retry" }, metadata: lastAttemptId ? { attemptId: lastAttemptId } : undefined }).catch(() => {});
+						appendEventAsync(freshManifest.eventsPath, { type: "task.cancelled", runId: freshManifest.runId, taskId: task.id, message: reason.message, data: { reason, phase: "retry" }, metadata: lastAttemptId ? { attemptId: lastAttemptId } : undefined }).catch((error) => logInternalError("team-runner.cancelled", error, `taskId=${task.id}`));
 						return { manifest: updateRunStatus(freshManifest, "cancelled", reason.message), tasks: cancelledTasks };
 					}
 					if (lastFailed) return lastFailed;

package/src/schema/team-tool-schema.ts

@@ -68,6 +68,9 @@ export const TeamToolParams = Type.Object({
 				Type.Literal("orchestrate"),
 				Type.Literal("schedule"),
 				Type.Literal("scheduled"),
+				Type.Literal("anchor"),
+				Type.Literal("auto-summarize"),
+				Type.Literal("auto_boomerang"),
 			],
 			{ description: "Team action. Defaults to 'list' when omitted." },
 		),
@@ -209,6 +212,27 @@ export const TeamToolParams = Type.Object({
 			description: "Mark certain bash commands as excludeFromContext to reduce context tokens (default: false).",
 		}),
 	),
+	// Budget tracking options
+	budgetTotal: Type.Optional(
+		Type.Number({
+			description: "Total token budget for the run. When set, enables budget tracking with default 80% warning and 95% abort thresholds.",
+			minimum: 1,
+		}),
+	),
+	budgetWarning: Type.Optional(
+		Type.Number({
+			description: "Budget warning threshold as a fraction (0-1). Default: 0.8 (80%). Emits warning event when this threshold is crossed.",
+			minimum: 0,
+			maximum: 1,
+		}),
+	),
+	budgetAbort: Type.Optional(
+		Type.Number({
+			description: "Budget abort threshold as a fraction (0-1). Default: 0.95 (95%). Aborts further execution when this threshold is crossed.",
+			minimum: 0,
+			maximum: 1,
+		}),
+	),
 });
 
 export interface TeamToolParamsValue {
@@ -294,4 +318,10 @@ export interface TeamToolParamsValue {
 	once?: string | number;
 	/** Mark certain bash commands as excludeFromContext to reduce context tokens (default: false). */
 	excludeContextBash?: boolean;
+	/** Total token budget for the run. When set, enables budget tracking. */
+	budgetTotal?: number;
+	/** Budget warning threshold as a fraction (0-1). Default: 0.8. */
+	budgetWarning?: number;
+	/** Budget abort threshold as a fraction (0-1). Default: 0.95. */
+	budgetAbort?: number;
 }

package/src/skills/discover-skills.ts

@@ -6,6 +6,9 @@ import { isSafePathId, resolveContainedPath, resolveRealContainedPath } from "..
 
 const PACKAGE_SKILLS_DIR = path.resolve(path.dirname(fileURLToPath(import.meta.url)), "..", "..", "skills");
 
+const CACHE_TTL_MS = 30_000; // 30 seconds
+let cache: { skills: SkillDescriptor[]; cachedAt: number; cwd: string } | null = null;
+
 export interface SkillDescriptor {
 	name: string;
 	description: string;
@@ -28,6 +31,7 @@ function frontmatterDescription(content: string): string | undefined {
 }
 
 export function discoverSkills(cwd: string): SkillDescriptor[] {
+	if (cache && cache.cwd === cwd && Date.now() - cache.cachedAt < CACHE_TTL_MS) return cache.skills;
 	const results: SkillDescriptor[] = [];
 	for (const dir of listSkillDirs(cwd)) {
 		if (!fs.existsSync(dir.root)) continue;
@@ -63,5 +67,6 @@ export function discoverSkills(cwd: string): SkillDescriptor[] {
 			logInternalError("discoverSkills.readdir", error, `root=${dir.root}`);
 		}
 	}
+	cache = { skills: results, cachedAt: Date.now(), cwd };
 	return results;
 }

package/src/state/active-run-registry.ts

@@ -10,6 +10,9 @@ import { sharedScanCache } from "../utils/scan-cache.ts";
 import { sleepSync } from "../utils/sleep.ts";
 import { logInternalError } from "../utils/internal-error.ts";
 
+/** Magic bytes prefix for binary registry to prevent deserialization of hostile files. */
+const BINARY_MAGIC = Buffer.from("PICREW2BIN", "utf-8");
+
 export interface ActiveRunRegistryEntry {
 	runId: string;
 	cwd: string;
@@ -111,7 +114,11 @@ export function readActiveRunRegistry(maxEntries = DEFAULT_CACHE.manifestMaxEntr
 	// corrupt; this lets a 2-release migration co-exist with old readers.
 	try {
 		const buf = fs.readFileSync(registryBinaryPath());
-		parsed = deserialize(buf);
+		// Security: verify magic bytes before deserializing to prevent RCE from hostile files
+		if (buf.length < BINARY_MAGIC.length || !buf.slice(0, BINARY_MAGIC.length).equals(BINARY_MAGIC)) {
+			throw new Error("Invalid binary registry: missing magic bytes");
+		}
+		parsed = deserialize(buf.slice(BINARY_MAGIC.length));
 	} catch {
 		try {
 			parsed = JSON.parse(fs.readFileSync(registryPath(), "utf-8"));
@@ -135,7 +142,7 @@ function writeEntries(entries: ActiveRunRegistryEntry[]): void {
 	atomicWriteJson(registryPath(), trimmed);
 	try {
 		const tempBin = `${registryBinaryPath()}.${process.pid}.${Date.now()}.tmp`;
-		fs.writeFileSync(tempBin, serialize(trimmed));
+		fs.writeFileSync(tempBin, Buffer.concat([BINARY_MAGIC, serialize(trimmed)]));
 		fs.renameSync(tempBin, registryBinaryPath());
 	} catch (error) {
 		logInternalError("active-run-registry.binary-write", error);

package/src/state/contracts.ts

@@ -67,6 +67,15 @@ export const TEAM_EVENT_TYPES = [
 	"task.resumed",
 	"task.retried",
 	"supervisor.contact",
+	// Budget tracking events
+	"budget.initialized",
+	"budget.warning",
+	"budget.exhausted",
+	// Phase tracking events
+	"phase.started",
+	"phase.completed",
+	"phase.skipped",
+	"phase.failed",
 ] as const;
 export type TeamEventType = typeof TEAM_EVENT_TYPES[number];
 

package/src/state/crew-init.ts

@@ -108,9 +108,9 @@ export async function ensureCrewDirectory(cwd: string): Promise<void> {
 	];
 
 	for (const dir of dirs) {
-		if (!fs.existsSync(dir)) {
-			fs.mkdirSync(dir, { recursive: true });
-		}
+		// Use mkdirSync directly with recursive:true to avoid TOCTOU race.
+		// This is atomic and doesn't require existsSync check.
+		fs.mkdirSync(dir, { recursive: true });
 	}
 
 	// 2. Create .gitkeep placeholders in directories that should be tracked

package/src/state/decision-ledger.ts

@@ -1,5 +1,6 @@
 import { readFileSync, writeFileSync, existsSync, mkdirSync } from "fs";
 import { dirname } from "path";
+import { atomicWriteFile } from "./atomic-write.ts";
 
 export interface CoherenceMark {
 	matchesPrior: boolean;
@@ -21,9 +22,12 @@ export interface RolloutEntry {
 
 /**
  * Get the ledger file path for a given run ID.
+ * SECURITY: Accept stateRoot param to use it for path computation
+ * instead of hardcoded path, ensuring stateRoot containment.
  */
-function getLedgerPath(runId: string): string {
-	return `.crew/state/runs/${runId}/decision-ledger.jsonl`;
+function getLedgerPath(runId: string, stateRoot?: string): string {
+	const base = stateRoot ?? `.crew/state/runs/${runId}`;
+	return `${base}/decision-ledger.jsonl`;
 }
 
 /**
@@ -44,19 +48,19 @@ function computeCoherence(entry: RolloutEntry, ledger: RolloutEntry[]): Coherenc
 		entry.decisionMark === previousEntry.decisionMark ||
 		Boolean(entry.priorWinner && entry.topCandidates.includes(entry.priorWinner));
 
-	// Check last 3 entries for recursive pattern
-	const recentEntries = ledger.slice(-3);
+	// Check last 10 entries for recursive pattern
+	const recentEntries = ledger.slice(-10);
 	const recentDecisions = recentEntries.map((e) => e.decisionMark);
 	const currentDecision = entry.decisionMark;
 
 	const recursiveMatches = recentDecisions.filter((d) => d === currentDecision).length;
-	const matchesRecursive = recursiveMatches >= 2;
+	const matchesRecursive = recursiveMatches >= Math.ceil(recentDecisions.length / 2); // At least half match
 
 	const promotionAllowed = matchesPrior || matchesRecursive;
 
 	let reason: string;
 	if (matchesPrior && matchesRecursive) {
-		reason = `Matches prior winner and recursive pattern (${recursiveMatches}/3 recent decisions)`;
+		reason = `Matches prior winner and recursive pattern (${recursiveMatches}/${recentDecisions.length} recent decisions)`;
 	} else if (matchesPrior) {
 		reason = `Matches prior winner decision`;
 	} else if (matchesRecursive) {
@@ -94,17 +98,17 @@ export function initLedger(runId: string): void {
 /**
  * Append a new entry to the decision ledger.
  * Automatically computes and adds coherence marks.
+ * FIX: Uses atomic write to prevent partial writes on crash.
  */
 export function appendEntry(runId: string, entry: RolloutEntry): RolloutEntry {
-	const ledgerPath = getLedgerPath(runId);
-
 	// Ensure directory exists
+	const ledgerPath = getLedgerPath(runId);
 	const dir = dirname(ledgerPath);
 	if (!existsSync(dir)) {
 		mkdirSync(dir, { recursive: true });
 	}
 
-	// Get existing entries to compute coherence
+	// Get existing entries to compute coherence (and use same result for write)
 	const ledger = getLedger(runId);
 
 	// Compute coherence
@@ -114,9 +118,11 @@ export function appendEntry(runId: string, entry: RolloutEntry): RolloutEntry {
 		coherenceMark,
 	};
 
-	// Append to JSONL file
+	// Append to JSONL file using atomic write to prevent corruption
+	// Use the already-loaded ledger content (no double-read)
 	const line = JSON.stringify(entryWithCoherence) + "\n";
-	writeFileSync(ledgerPath, line, { flag: "a", encoding: "utf-8" });
+	const existingContent = ledger.length > 0 ? ledger.map((e) => JSON.stringify(e)).join("\n") + "\n" : "";
+	atomicWriteFile(ledgerPath, existingContent + line);
 	return entryWithCoherence;
 }
 
@@ -233,7 +239,7 @@ function overrideLastEntry(runId: string, coherenceMark: import("./types.js").Co
 	ledger[lastIndex] = { ...ledger[lastIndex], coherenceMark };
 	// Rewrite entire ledger to preserve all entries
 	const ledgerPath = getLedgerPath(runId);
-	writeFileSync(ledgerPath, ledger.map((e) => JSON.stringify(e)).join("\n") + "\n", "utf-8");
+	atomicWriteFile(ledgerPath, ledger.map((e) => JSON.stringify(e)).join("\n") + "\n");
 	return ledger[lastIndex];
 }
 
@@ -270,28 +276,22 @@ export function promoteCandidate(runId: string, candidate: string): RolloutEntry
 		coherenceMark,
 	};
 
-	// Update last entry in memory if there are existing entries
-	if (ledger.length > 0) {
-		const lastIndex = ledger.length - 1;
-		ledger[lastIndex] = entry;
-	} else {
-		// No existing entries - just write this one
-		ledger.push(entry);
-	}
+	// Always push new entry (append-only pattern)
+	ledger.push(entry);
 
-	// Rewrite entire ledger to preserve all entries
+	// Rewrite entire ledger atomically to preserve all entries
 	const ledgerPath = getLedgerPath(runId);
 	const dir = dirname(ledgerPath);
 	if (!existsSync(dir)) {
 		mkdirSync(dir, { recursive: true });
 	}
-	writeFileSync(ledgerPath, ledger.map((e) => JSON.stringify(e)).join("\n") + "\n", "utf-8");
+	atomicWriteFile(ledgerPath, ledger.map((e) => JSON.stringify(e)).join("\n") + "\n");
 
 	return entry;
 }
 
 /**
- * Decay a candidate by marking it as decayed with proper coherence.
+ * Decay a candidate by marking it as accepted with proper coherence.
  */
 export function decayCandidate(runId: string, candidate: string): RolloutEntry {
 	const latestDecision = getLatestDecision(runId);
@@ -323,14 +323,8 @@ export function decayCandidate(runId: string, candidate: string): RolloutEntry {
 		coherenceMark,
 	};
 
-	// Update last entry in memory if there are existing entries
-	if (ledger.length > 0) {
-		const lastIndex = ledger.length - 1;
-		ledger[lastIndex] = entry;
-	} else {
-		// No existing entries - just write this one
-		ledger.push(entry);
-	}
+	// Always push new entry (append-only pattern)
+	ledger.push(entry);
 
 	// Rewrite entire ledger to preserve all entries
 	const ledgerPath = getLedgerPath(runId);
@@ -338,7 +332,7 @@ export function decayCandidate(runId: string, candidate: string): RolloutEntry {
 	if (!existsSync(dir)) {
 		mkdirSync(dir, { recursive: true });
 	}
-	writeFileSync(ledgerPath, ledger.map((e) => JSON.stringify(e)).join("\n") + "\n", "utf-8");
+	atomicWriteFile(ledgerPath, ledger.map((e) => JSON.stringify(e)).join("\n") + "\n");
 
 	return entry;
 }

package/src/state/event-log-rotation.ts

@@ -209,9 +209,9 @@ export function getEventLogStats(eventsPath: string): EventLogStats | undefined
 						if (newlineCount === 0) firstLineBytes = offset + i + 1;
 						newlineCount++;
 					}
-					}
-					offset += bytesRead;
 				}
+				offset += bytesRead;
+			}
 			} finally {
 				fs.closeSync(scanFd);
 			}

package/src/state/event-log.ts

@@ -293,7 +293,7 @@ export async function appendEventAsync(eventsPath: string, event: AppendTeamEven
 		}
 		return fullEvent;
 	});
-	asyncQueues.set(queueKey, next.catch(() => {}));
+	asyncQueues.set(queueKey, next.catch((error) => { logInternalError("event-log.async-queue", error, eventsPath); asyncQueues.delete(queueKey); }));
 	return next;
 }
 
@@ -425,8 +425,16 @@ function flushOneEventLogBuffer(eventsPath: string): void {
 	bufferedQueues.delete(eventsPath);
 	const timer = bufferedTimers.get(eventsPath);
 	if (timer) clearTimeout(timer);
+	// MEDIUM-13: Delete timer entry only after successful flush (in finally block)
 	bufferedTimers.delete(eventsPath);
 	if (!queue || queue.length === 0) return;
+	
+	// HIGH-10: Clean up queue if it exceeds limit to prevent unbounded growth
+	if (queue.length > 1000) {
+		// Keep only the last 500 entries
+		queue.splice(0, queue.length - 500);
+	}
+	
 	try {
 		withEventLogLockSync(eventsPath, () => {
 			for (const item of queue) {

package/src/state/mailbox.ts

@@ -289,6 +289,16 @@ export function readDeliveryState(manifest: TeamRunManifest): MailboxDeliverySta
 
 function writeDeliveryState(manifest: TeamRunManifest, state: MailboxDeliveryState): void {
 	ensureRunMailbox(manifest);
+	// Prune oldest entries if capped
+	const MAX_DELIVERY_MESSAGES = 10000;
+	if (Object.keys(state.messages).length > MAX_DELIVERY_MESSAGES) {
+		const sorted = Object.entries(state.messages).sort(([, a], [, b]) => {
+			const order = { queued: 0, delivered: 1, acknowledged: 2 };
+			return (order[a] ?? 3) - (order[b] ?? 3);
+		});
+		const trimmed = sorted.slice(0, MAX_DELIVERY_MESSAGES);
+		state.messages = Object.fromEntries(trimmed);
+	}
 	atomicWriteFile(deliveryFile(manifest, true), `${JSON.stringify(redactSecrets(state), null, 2)}\n`);
 }
 

package/src/state/run-cache.ts

@@ -3,6 +3,8 @@ import * as path from "node:path";
 import * as crypto from "node:crypto";
 import { projectCrewRoot } from "../utils/paths.ts";
 import type { TeamTaskState } from "./types.ts";
+import { atomicWriteFile } from "./atomic-write.ts";
+import { withFileLockSync } from "./locks.ts";
 
 const DEFAULT_CACHE_TTL_MS = 60 * 60 * 1000; // 1 hour
 
@@ -31,6 +33,7 @@ export function computeRunCacheKey(goal: string, team: string, workflow: string,
     .update(normalized)
     .update(team)
     .update(workflow)
+    .update(_cwd)
     .digest("hex")
     .slice(0, 16);
 }
@@ -61,12 +64,15 @@ export function getCachedRun(cwd: string, cacheKey: string): CacheEntry | null {
     const entry = JSON.parse(fs.readFileSync(entryPath, "utf-8")) as CacheEntry;
 
     if (Date.now() > entry.expiresAt) {
-      // Remove expired entry
-      try {
-        fs.unlinkSync(entryPath);
-      } catch { /* ignore */ }
-      delete index[cacheKey];
-      fs.writeFileSync(indexPath, JSON.stringify(index), "utf-8");
+      // Remove expired entry — use lock + atomic write to prevent index corruption
+      withFileLockSync(indexPath, () => {
+        try {
+          fs.unlinkSync(entryPath);
+        } catch { /* ignore */ }
+        const updatedIndex = JSON.parse(fs.readFileSync(indexPath, "utf-8")) as CacheIndex;
+        delete updatedIndex[cacheKey];
+        atomicWriteFile(indexPath, JSON.stringify(updatedIndex));
+      });
       return null;
     }
 
@@ -109,14 +115,18 @@ export function saveRunToCache(
   const entryPath = path.join(dir, `${cacheKey}.json`);
   fs.writeFileSync(entryPath, JSON.stringify(entry), "utf-8");
 
-  // Update index
+  // Update index with atomic write: write to temp file then rename
   const indexPath = path.join(dir, "index.json");
   const index: CacheIndex = fs.existsSync(indexPath)
     ? JSON.parse(fs.readFileSync(indexPath, "utf-8"))
     : {};
 
   index[cacheKey] = entryPath;
-  fs.writeFileSync(indexPath, JSON.stringify(index), "utf-8");
+  
+  // Atomic write: write to temp file first, then rename
+  const tempPath = path.join(dir, "index.json.tmp");
+  fs.writeFileSync(tempPath, JSON.stringify(index), "utf-8");
+  fs.renameSync(tempPath, indexPath);
 }
 
 /**

package/src/tools/safe-bash-extension.ts

@@ -68,6 +68,7 @@ export default function safeBashExtension(pi: ExtensionAPI): void {
 			"Execute a bash command safely. Blocks dangerous commands like `rm -rf /`, `sudo`, `curl | sh`, etc.",
 		parameters: Type.Object({
 			command: Type.String({ description: "Bash command to execute" }),
+			/** Timeout in seconds (optional). Default: no timeout. If exceeded, the command is killed. */
 			timeout: Type.Optional(
 				Type.Number({ description: "Timeout in seconds (optional)" }),
 			),

package/src/tools/safe-bash.ts

@@ -1,50 +1,144 @@
 /**
  * Safe Bash Tool for pi-crew
  * Wraps bash with dangerous command blocking
+ * Uses linear-time scanning to prevent ReDoS attacks
  */
 
 import { Type } from "@sinclair/typebox";
 
-// Dangerous command patterns to block
+// Backward-compatible pattern array (kept for getPatterns API)
+// IMPORTANT: Line 8 (rm pattern with nested quantifiers) has been replaced
+// with linear-time checking in isDangerous() to prevent ReDoS attacks.
 const DANGEROUS_PATTERNS = [
-	// rm -rf / or rm -rf ~ (catastrophic root/home deletion)
-	/\brm\s+(-[a-zA-Z]*[rf][a-zA-Z]*\s*)+(\/|~)(\s*$)/,
-	/\brm\s+(-[a-zA-Z]*[rf][a-zA-Z]*\s*)+(\/|~)($|\s)/,
-	// Privilege escalation
+	// NOTE: rm patterns handled by matchesDangerousRm() for linear-time safety
 	/\bsudo\b/,
 	/\bsu\s+root\b/,
-	// Filesystem destruction
 	/\bmkfs\b/,
 	/\bdd\s+if=/,
-	// Fork bomb
 	/^:\s*\(\s*\)\s*\{.*\|.*&.*\}\s*;.*$/,
-	// Device writing
 	/>\s*\/dev\/[sh]d[a-z]/,
 	/\bchmod\s+(-[a-zA-Z]+\s+)?777\s+\//,
 	/\bchown\s+(-[a-zA-Z]+\s+)?root/,
-	// Pipe to shell (download and execute)
 	/\bcurl\s.*\|\s*(ba)?sh/i,
 	/\bwget\s.*\|\s*(ba)?sh/i,
-	// System shutdown/reboot
 	/\bshutdown\b/,
 	/\breboot\b/,
 	/\binit\s+0\b/,
-	// Kill critical processes
 	/\bkill\s+-9\s+1\b/,
 	/\bkillall\b/,
-	// Encoded commands
 	/\|\s*base64\s+-d/,
 	/\|\s*python.*-c/,
 	/\|\s*perl.*-e/,
 	/\|\s*ruby.*-e/,
-	// Network to shell
-	/\bbash\s+-i\s+>\s*\&/,
+	/\bbash\s+-i\s*>\s*\&/,
 	/\bexec\s+.*bash/,
-	// /etc/passwd manipulation
 	/\becho\s+.*>\s*\/etc\/passwd/,
 	/\bcat\s+.*>\s*\/etc\/passwd/,
 ];
 
+/**
+ * Linear-time check if command contains a dangerous rm pattern like "rm -rf /" or "rm -rf ~"
+ * Replaces O(n²) regex backtracking with O(n) string scanning
+ */
+function matchesDangerousRm(command: string): boolean {
+	let pos = 0;
+	const len = command.length;
+	// Find "rm" at word boundary
+	while (pos < len) {
+		const rmIdx = command.indexOf("rm", pos);
+		if (rmIdx === -1) return false;
+		// Check word boundary before "rm"
+		if (rmIdx > 0 && /\w/.test(command[rmIdx - 1])) {
+			pos = rmIdx + 1;
+			continue;
+		}
+		// Must be followed by whitespace
+		const afterRm = rmIdx + 2;
+		if (afterRm >= len || /\s/.test(command[afterRm])) {
+			// Found "rm " - now check for -rf flags followed by / or ~
+			let p = afterRm + 1;
+			while (p < len) {
+				// Skip whitespace
+				while (p < len && /\s/.test(command[p])) p++;
+				if (p >= len) break;
+				// Check for flag
+				if (command[p] !== "-") break;
+				p++;
+				let hasR = false, hasF = false;
+				while (p < len && /[a-zA-Z]/.test(command[p])) {
+					if (command[p] === "r" || command[p] === "R") hasR = true;
+					if (command[p] === "f" || command[p] === "F") hasF = true;
+					p++;
+				}
+				if (!hasR && !hasF) break; // Flag must have r or f
+				// Skip whitespace after flag
+				while (p < len && /\s/.test(command[p])) p++;
+			}
+			// Now check if followed by / or ~ (end or whitespace)
+			if (p < len && (command[p] === "/" || command[p] === "~")) {
+				const afterSlash = p + 1;
+				if (afterSlash >= len || /\s/.test(command[afterSlash]) || command[afterSlash] === ";") {
+					return true; // Dangerous!
+				}
+			}
+		}
+		pos = rmIdx + 1;
+	}
+	return false;
+}
+
+/**
+ * Linear-time check for fork bomb pattern: :() { ... | ... & ... } ; ...
+ */
+function matchesForkBomb(command: string): boolean {
+	// Must start with :
+	const trimmed = command.trimStart();
+	if (!trimmed.startsWith(":")) return false;
+	// Find () after :
+	const parenIdx = trimmed.indexOf("()");
+	if (parenIdx === -1 || parenIdx > 10) return false; // : must be close to ()
+	// Find { after ()
+	const braceIdx = trimmed.indexOf("{", parenIdx);
+	if (braceIdx === -1 || braceIdx > parenIdx + 5) return false;
+	// Find } closing brace
+	const closeBrace = trimmed.indexOf("}", braceIdx);
+	if (closeBrace === -1) return false;
+	// Check content between braces for | and &
+	const content = trimmed.slice(braceIdx + 1, closeBrace);
+	if (content.includes("|") && content.includes("&")) return true;
+	return false;
+}
+
+/**
+ * Check for encoded command patterns (pipe to shell)
+ */
+function matchesEncodedPipe(command: string): boolean {
+	const lower = command.toLowerCase();
+	const pipeIdx = lower.indexOf("|");
+	if (pipeIdx === -1) return false;
+	const afterPipe = lower.slice(pipeIdx + 1).trimStart();
+	if (afterPipe.startsWith("base64") || afterPipe.startsWith("python") || afterPipe.startsWith("perl") || afterPipe.startsWith("ruby")) {
+		// Check if followed by -d or -c or -e
+		const rest = afterPipe.slice(6).trimStart();
+		if (rest.startsWith("-d") || rest.startsWith("-c") || rest.startsWith("-e")) return true;
+	}
+	return false;
+}
+
+/**
+ * Check if command contains a specific dangerous substring
+ */
+function containsDangerous(command: string, pattern: string): boolean {
+	return command.indexOf(pattern) !== -1;
+}
+
+/**
+ * Check if command starts with dangerous prefix
+ */
+function startsWithDangerous(command: string, pattern: string): boolean {
+	return command.trimStart().startsWith(pattern);
+}
+
 export interface SafeBashOptions {
 	/** Enable/disable safe mode. Default: true */
 	enabled?: boolean;
@@ -75,9 +169,47 @@ export function isDangerous(command: string, options: SafeBashOptions = {}): str
 		}
 	}
 
-	// Check dangerous patterns
-	const allPatterns = [...DANGEROUS_PATTERNS, ...additionalPatterns];
-	for (const pattern of allPatterns) {
+	// Use linear-time scanning functions for critical patterns
+	if (matchesDangerousRm(normalized)) {
+		return "Command blocked by safe_bash: dangerous rm pattern detected";
+	}
+	if (matchesForkBomb(normalized)) {
+		return "Command blocked by safe_bash: fork bomb pattern detected";
+	}
+	if (matchesEncodedPipe(normalized)) {
+		return "Command blocked by safe_bash: encoded pipe to shell detected";
+	}
+
+	// Check remaining patterns using regex (these are safe from ReDoS)
+	for (const pattern of DANGEROUS_PATTERNS) {
+		if (pattern.test(normalized)) {
+			return `Command blocked by safe_bash: matches dangerous pattern \`${pattern}\``;
+		}
+	}
+
+	// Additional shell injection checks using regex for non-critical patterns
+	// Block command substitution $(...)
+	if (/\$\([^)]*\)/.test(command)) {
+		return "Command blocked by safe_bash: command substitution $(...) is not allowed";
+	}
+	// Block backtick substitution
+	const backtickRe = /`[^`]*`/;
+	if (backtickRe.test(command)) {
+		return "Command blocked by safe_bash: backtick substitution is not allowed";
+	}
+	// Block here-docs <<
+	if (/<<\s*['"]?[\w-]+['"]?/.test(command) || /\$<<\s*['"]?[\w-]+['"]?/.test(command)) {
+		return "Command blocked by safe_bash: here-doc is not allowed";
+	}
+	// Block ${...} variable expansion containing shell metacharacters (pipes, redirects, &&/||)
+	const varExpRe = /\$\{([^}]*)\}/;
+	const varMatch = command.match(varExpRe);
+	if (varMatch && /[|&;<>]/.test(varMatch[1])) {
+		return "Command blocked by safe_bash: variable expansion with shell metacharacters is not allowed";
+	}
+
+	// Check additional patterns (user-provided regex)
+	for (const pattern of additionalPatterns) {
 		if (pattern.test(normalized)) {
 			return `Command blocked by safe_bash: matches dangerous pattern \`${pattern}\``;
 		}
@@ -142,8 +274,8 @@ export function createSafeBash(options: SafeBashOptions = {}) {
  * These can be used in allowPatterns for specific use cases
  */
 export const COMMON_SAFE_PATTERNS = {
-	// Safe rm with specific paths
-	safeRm: /\brm\s+(-[a-zA-Z]*f[a-zA-Z]*\s+)?((?![\/~])\/)?(tmp|cache|node_modules|dist|build)\//,
+	// Safe rm with specific paths - uses simple contains check
+	safeRm: /rm\s+(-[a-zA-Z]*f[a-zA-Z]*\s+)?((?![\/~])\/)?(tmp|cache|node_modules|dist|build)\//,
 	// Safe git operations
 	safeGit: /\bgit\s+(clone|pull|push|commit|add|status|diff|log|branch|checkout|merge|rebase)/,
 	// Safe npm/yarn/pnpm