pi-crew 0.6.0 → 0.6.3

package/src/runtime/retry-runner.ts

@@ -72,10 +72,16 @@ export class RetryRunner {
 	private _disposed = false;
 	private _handoffs: HandoffSummary[] = [];
 
+	private taskRunner: TaskRunnerLike;
+	private handoffManager: HandoffManager;
+
 	constructor(
-		private taskRunner: TaskRunnerLike,
-		private handoffManager: HandoffManager,
-	) {}
+		taskRunner: TaskRunnerLike,
+		handoffManager: HandoffManager,
+	) {
+		this.taskRunner = taskRunner;
+		this.handoffManager = handoffManager;
+	}
 
 	/**
 	 * Check if this runner has been disposed.

package/src/runtime/{drift-detectors.ts → run-drift.ts}

@@ -208,7 +208,7 @@ export function runDriftDetection(ctx: DriftContext, maxPasses = 2): DriftReport
 					newFindings++;
 				}
 			} catch (error) {
-				logInternalError("drift-detectors", error, `detector=${detector.name} runId=${ctx.manifest?.runId}`);
+				logInternalError("run-drift", error, `detector=${detector.name} runId=${ctx.manifest?.runId}`);
 			}
 		}
 

package/src/runtime/run-tracker.ts

@@ -1,21 +1,31 @@
-import type { TeamRunManifest, TeamTaskState } from "../state/types.ts";
 import * as fs from "node:fs";
 import * as path from "node:path";
 import { loadRunManifestById } from "../state/state-store.ts";
+import type { TeamRunManifest, TeamTaskState } from "../state/types.ts";
+import { projectCrewRoot } from "../utils/paths.ts";
 import { isFinishedRunStatus } from "./process-status.ts";
 
 export interface ActiveRunPromise {
 	promise: Promise<{ manifest: TeamRunManifest; tasks: TeamTaskState[] }>;
-	resolve: (value: { manifest: TeamRunManifest; tasks: TeamTaskState[] }) => void;
+	resolve: (value: {
+		manifest: TeamRunManifest;
+		tasks: TeamTaskState[];
+	}) => void;
 	reject: (reason: unknown) => void;
 }
 
 const activeRunPromises = new Map<string, ActiveRunPromise>();
 
 export function registerRunPromise(runId: string): ActiveRunPromise {
-	let resolve!: (value: { manifest: TeamRunManifest; tasks: TeamTaskState[] }) => void;
+	let resolve!: (value: {
+		manifest: TeamRunManifest;
+		tasks: TeamTaskState[];
+	}) => void;
 	let reject!: (reason: unknown) => void;
-	const promise = new Promise<{ manifest: TeamRunManifest; tasks: TeamTaskState[] }>((res, rej) => {
+	const promise = new Promise<{
+		manifest: TeamRunManifest;
+		tasks: TeamTaskState[];
+	}>((res, rej) => {
 		resolve = res;
 		reject = rej;
 	});
@@ -24,7 +34,10 @@ export function registerRunPromise(runId: string): ActiveRunPromise {
 	return entry;
 }
 
-export function resolveRunPromise(runId: string, result: { manifest: TeamRunManifest; tasks: TeamTaskState[] }): void {
+export function resolveRunPromise(
+	runId: string,
+	result: { manifest: TeamRunManifest; tasks: TeamTaskState[] },
+): void {
 	const entry = activeRunPromises.get(runId);
 	if (entry) {
 		entry.resolve(result);
@@ -55,7 +68,7 @@ export async function waitForRun(
 	const deadline = Date.now() + timeoutMs;
 
 	// Fast path: already terminal on disk
-	const loaded = loadRunManifestById(cwd, runId);
+	const loaded = loadRunManifestById(cwd, runId); // NOTE: no withRunLock - best-effort only; concurrent writes may cause inconsistency;
 	if (loaded && isFinishedRunStatus(loaded.manifest.status)) {
 		return loaded;
 	}
@@ -65,7 +78,13 @@ export async function waitForRun(
 	if (entry) {
 		let timer: ReturnType<typeof setTimeout> | undefined;
 		const timeoutPromise = new Promise<never>((_, reject) => {
-			timer = setTimeout(() => reject(new Error(`waitForRun timed out after ${timeoutMs}ms`)), timeoutMs);
+			timer = setTimeout(
+				() =>
+					reject(
+						new Error(`waitForRun timed out after ${timeoutMs}ms`),
+					),
+				timeoutMs,
+			);
 		});
 		try {
 			return await Promise.race([entry.promise, timeoutPromise]);
@@ -78,15 +97,24 @@ export async function waitForRun(
 	let attempt = 0;
 	while (Date.now() < deadline) {
 		if (attempt === 0) {
-			// Early exit: if the run directory doesn't exist, don't waste time polling
-			const runDir = path.join(cwd, ".crew", "state", "runs", runId);
+			// Early exit: if the run directory doesn't exist, don't waste time polling.
+			// Use projectCrewRoot() to honour the .pi/teams/ fallback for .pi-based
+			// projects (see issue #29). Without this, the hardcoded `.crew/state/runs/`
+			// path never resolves in projects that use the `.pi/` layout, the throw
+			// escapes via subagent-manager.ts:281, and pi crashes with uncaughtException.
+			const runDir = path.join(
+				projectCrewRoot(cwd),
+				"state",
+				"runs",
+				runId,
+			);
 			if (!fs.existsSync(runDir)) {
 				throw new Error(
 					`Run ${runId} not found. No run directory at ${runDir}`,
 				);
 			}
 		}
-		const fresh = loadRunManifestById(cwd, runId);
+		const fresh = loadRunManifestById(cwd, runId); // NOTE: no withRunLock - best-effort only; concurrent writes may cause inconsistency;
 		if (fresh && isFinishedRunStatus(fresh.manifest.status)) {
 			return fresh;
 		}

package/src/runtime/sandbox.ts

@@ -21,28 +21,38 @@ const FORBIDDEN_PATTERNS = [
 	// Global escape vectors
 	/\bglobalThis\b/,                 // globalThis reference
 	/\bglobal\b/,                      // global reference (Node.js)
+	// Block constructor chain escape vectors:
+	//   - `.constructor` followed by `(`, `.`, `;`, or end-of-line/string
+	//   - `[constructor]` or `["constructor"]` bracket access on any value
+	// The bare `constructor` keyword in a class body is safe and allowed.
+	/\.constructor\s*\(/,              // Block obj.constructor() chain calls
+	/\.constructor\s*(?:\.|$|;|,|\s)/, // Block obj.constructor at end, semicolon, comma, or whitespace
+	/\[\s*['"]?constructor['"]?\s*\]/, // Block ["constructor"] or ['constructor'] or [constructor]
 ] as const;
 
+Object.freeze(FORBIDDEN_PATTERNS);
+
 /**
- * Whitelist of allowed identifiers for strict mode.
- * Only these identifiers can be used in sandboxed code.
+ * SECURITY (HIGH #3 fix): Normalize source code before forbidden-pattern checks
+ * to prevent unicode-escape bypasses.
+ *
+ * Attackers can write `import\u0028"fs"\u0029` which compiles as
+ * `import("fs")` but does not match the regex `/import\s*\(/`.
+ *
+ * This function:
+ * 1. Strips null bytes (used to split keywords across boundaries)
+ * 2. Decodes \uXXXX escape sequences so regexes see the actual characters
  */
-const ALLOWED_IDENTIFIERS = new Set([
-	// Built-in constructors
-	"Array", "Boolean", "Date", "Error", "Function", "JSON", "Map", "Number", "Object", "Promise", "RegExp", "Set", "String", "Symbol",
-	// Static methods
-	"ArrayBuffer", "Uint8Array", "parseInt", "parseFloat", "isNaN", "isFinite",
-	// URI encoding
-	"encodeURI", "decodeURI", "encodeURIComponent", "decodeURIComponent",
-	// Math (read-only)
-	"Math",
-	// Console (safe methods only)
-	"console",
-	// Process (limited)
-	"process",
-]);
-
-Object.freeze(FORBIDDEN_PATTERNS);
+export function normalizeCodeForValidation(code: string): string {
+	// Strip null bytes
+	let normalized = code.replace(/\0/g, "");
+	// Decode common unicode escapes: \u0028 → (
+	normalized = normalized.replace(
+		/\\u([0-9a-fA-F]{4})/g,
+		(_, hex) => String.fromCharCode(Number.parseInt(hex, 16)),
+	);
+	return normalized;
+}
 
 export interface SandboxOptions {
 	timeout?: number;
@@ -76,7 +86,16 @@ export class WorkflowSandbox {
 		const safeEnv = Object.freeze(sanitizeEnvSecrets(process.env, {
 			allowList: [
 				"NODE_ENV",
-				"PI_CREW_*",
+				// Note: PI_CREW_* globs are not used here because isDangerousGlob
+				// flags them as potentially matching secret env vars (PI_CREW_token,
+				// PI_CREW_api_key, etc.). Instead, list the specific PI_CREW env vars
+				// that sandboxed code legitimately needs.
+				"PI_CREW_DEPTH",
+				"PI_CREW_INHERIT_PROJECT_CONTEXT",
+				"PI_CREW_INHERIT_SKILLS",
+				"PI_CREW_MOCK_LIVE_SESSION",
+				"PI_CREW_SKIP_HOME_CHECK",
+				"PI_CREW_WARM_POOL_SIZE",
 				"PATH",
 				"PATH_SEPARATOR",
 				"USERPROFILE",
@@ -204,15 +223,17 @@ export class WorkflowSandbox {
 	 * ensure compilation is safe.
 	 */
 	private validateScript(code: string): void {
+		// SECURITY (HIGH #3 fix): Normalize unicode escapes before pattern matching
+		const normalized = normalizeCodeForValidation(code);
 		// Check for ESM/module patterns
 		for (const pattern of FORBIDDEN_PATTERNS) {
-			if (pattern.test(code)) {
+			if (pattern.test(normalized)) {
 				throw new Error(`Forbidden pattern detected: ${pattern.source}`);
 			}
 		}
 
 		// Check for import.meta specifically (C4)
-		if (/import\.meta/.test(code)) {
+		if (/import\.meta/.test(normalized)) {
 			throw new Error("import.meta is not allowed in sandboxed code");
 		}
 

package/src/runtime/scheduler.ts

@@ -15,11 +15,13 @@ export interface ScheduledJob {
 	lastStatus?: "success" | "error" | "running";
 	nextRun?: string;
 	runCount: number;
+	/** Run IDs spawned by this job. Used to cancel runs when job is removed. */
+	spawnedRunIds?: string[];
 }
 
 export type ScheduleChangeEvent =
 	| { type: "added"; job: ScheduledJob }
-	| { type: "removed"; jobId: string }
+	| { type: "removed"; jobId: string; spawnedRunIds?: string[] }
 	| { type: "updated"; job: ScheduledJob }
 	| { type: "fired"; jobId: string; agentId: string; name: string }
 	| { type: "error"; jobId: string; error: string };
@@ -30,17 +32,21 @@ export class CrewScheduler {
 	private emit?: (event: ScheduleChangeEvent) => void;
 	private executor?: (job: ScheduledJob) => string;
 	private finalizer?: (jobId: string, agentId: string) => void;
+	private runCancelFn?: (runId: string) => void;
 
 	start(
 		options: {
 			emit: (event: ScheduleChangeEvent) => void;
 			executor: (job: ScheduledJob) => string;
 			finalizer: (jobId: string, agentId: string) => void;
+			/** Optional callback to cancel a spawned run by runId. */
+			runCancelFn?: (runId: string) => void;
 		},
 	): void {
 		this.emit = options.emit;
 		this.executor = options.executor;
 		this.finalizer = options.finalizer;
+		this.runCancelFn = options.runCancelFn;
 	}
 
 	stop(): void {
@@ -52,6 +58,7 @@ export class CrewScheduler {
 		this.emit = undefined;
 		this.executor = undefined;
 		this.finalizer = undefined;
+		this.runCancelFn = undefined;
 	}
 
 	add(job: ScheduledJob): void {
@@ -61,9 +68,17 @@ export class CrewScheduler {
 	}
 
 	remove(id: string): boolean {
+		const job = this.jobs.get(id);
+		const spawnedRunIds = job?.spawnedRunIds;
 		this.disarm(id);
+		// Cancel all spawned runs that are still active
+		if (spawnedRunIds && this.runCancelFn) {
+			for (const runId of spawnedRunIds) {
+				try { this.runCancelFn(runId); } catch { /* best-effort */ }
+			}
+		}
 		const ok = this.jobs.delete(id);
-		if (ok) this.emit?.({ type: "removed", jobId: id });
+		if (ok) this.emit?.({ type: "removed", jobId: id, spawnedRunIds });
 		return ok;
 	}
 
@@ -82,6 +97,14 @@ export class CrewScheduler {
 		return [...this.jobs.values()];
 	}
 
+	/** Record a runId spawned by a job. Call this after executor fires. */
+	recordSpawnedRun(jobId: string, runId: string): void {
+		const job = this.jobs.get(jobId);
+		if (!job) return;
+		const spawnedRunIds = [...(job.spawnedRunIds ?? []), runId];
+		this.jobs.set(jobId, { ...job, spawnedRunIds });
+	}
+
 	private arm(job: ScheduledJob): void {
 		if (this.timers.has(job.id)) return;
 		if (job.scheduleType === "interval" && job.intervalMs) {

package/src/runtime/semaphore.ts

@@ -88,7 +88,8 @@ export interface ParallelResult<R> {
  *
  * Adapted from oh-my-pi's `mapWithConcurrencyLimit`.
  */
-export async function mapWithFailFast<T, R>(
+/** @internal */
+async function mapWithFailFast<T, R>(
 	items: T[],
 	concurrency: number,
 	fn: (item: T, index: number, signal: AbortSignal) => Promise<R>,

package/src/runtime/settings-store.ts

@@ -20,6 +20,18 @@ const MAX_TURNS_CEILING = 10_000;
 const GRACE_TURNS_CEILING = 1_000;
 const VALID_JOIN_MODES = new Set<JoinMode>(["async", "group", "smart"]);
 
+/**
+ * M2: Validate that a scheduled job object has required fields before passing to scheduler.
+ * Prevents opaque unknown[] from reaching CrewScheduler.add() without validation.
+ */
+function validateScheduledJob(job: unknown): boolean {
+	if (!job || typeof job !== "object") return false;
+	const obj = job as Record<string, unknown>;
+	return typeof obj.id === "string" && obj.id.length > 0
+		&& typeof obj.scheduleType === "string"
+		&& typeof obj.enabled === "boolean";
+}
+
 function sanitizeSettings(raw: unknown): CrewSettings {
 	if (!raw || typeof raw !== "object") return {};
 	const r = raw as Record<string, unknown>;
@@ -57,9 +69,9 @@ function sanitizeSettings(raw: unknown): CrewSettings {
 	if (typeof r.notifierIntervalMs === "number" && r.notifierIntervalMs >= 1000) {
 		out.notifierIntervalMs = r.notifierIntervalMs;
 	}
-	// Pass through scheduledJobs as opaque array (validated by crewScheduler.add)
+	// Pass through scheduledJobs after basic validation
 	if (Array.isArray(r.scheduledJobs)) {
-		out.scheduledJobs = r.scheduledJobs;
+		out.scheduledJobs = (r.scheduledJobs as unknown[]).filter(validateScheduledJob);
 	}
 	return out;
 }