pi-crew 0.6.0 → 0.6.3

package/src/tools/safe-bash.ts

@@ -39,7 +39,8 @@ const DANGEROUS_PATTERNS = [
 
 /**
  * Linear-time check if command contains a dangerous rm pattern like "rm -rf /" or "rm -rf ~"
- * Replaces O(n²) regex backtracking with O(n) string scanning
+ * Replaces O(n²) regex backtracking with O(n) string scanning.
+ * Expanded to also block: rm -rf /etc/*, rm --recursive --force /, rm -rf ~/.ssh, etc.
  */
 function matchesDangerousRm(command: string): boolean {
 	let pos = 0;
@@ -56,32 +57,75 @@ function matchesDangerousRm(command: string): boolean {
 		// Must be followed by whitespace
 		const afterRm = rmIdx + 2;
 		if (afterRm >= len || /\s/.test(command[afterRm])) {
-			// Found "rm " - now check for -rf flags followed by / or ~
+			// Found "rm " - now check for recursive/force flags
 			let p = afterRm + 1;
+			let hasR = false;
+			let hasF = false;
 			while (p < len) {
 				// Skip whitespace
 				while (p < len && /\s/.test(command[p])) p++;
 				if (p >= len) break;
-				// Check for flag
-				if (command[p] !== "-") break;
-				p++;
-				let hasR = false, hasF = false;
-				while (p < len && /[a-zA-Z]/.test(command[p])) {
-					if (command[p] === "r" || command[p] === "R") hasR = true;
-					if (command[p] === "f" || command[p] === "F") hasF = true;
+				// Check for short flags (-r, -f, -rf, -R, -F, etc.)
+				if (command[p] === "-" && p + 1 < len && /[a-zA-Z]/.test(command[p + 1]) && command[p + 1] !== "-") {
 					p++;
+					while (p < len && /[a-zA-Z]/.test(command[p])) {
+						if (command[p] === "r" || command[p] === "R") hasR = true;
+						if (command[p] === "f" || command[p] === "F") hasF = true;
+						p++;
+					}
+					// Skip whitespace after flag
+					while (p < len && /\s/.test(command[p])) p++;
+					continue;
 				}
-				if (!hasR && !hasF) break; // Flag must have r or f
-				// Skip whitespace after flag
-				while (p < len && /\s/.test(command[p])) p++;
-			}
-			// Now check if followed by / or ~ (end or whitespace)
-			if (p < len && (command[p] === "/" || command[p] === "~")) {
-				const afterSlash = p + 1;
-				if (afterSlash >= len || /\s/.test(command[afterSlash]) || command[afterSlash] === ";") {
-					return true; // Dangerous!
+				// Check for long flags (--recursive, --force)
+				if (command[p] === "-" && p + 1 < len && command[p + 1] === "-") {
+					p += 2;
+					const flagStart = p;
+					while (p < len && /[a-zA-Z]/.test(command[p])) p++;
+					const flagName = command.slice(flagStart, p);
+					if (flagName === "recursive") hasR = true;
+					if (flagName === "force") hasF = true;
+					// Skip whitespace after flag
+					while (p < len && /\s/.test(command[p])) p++;
+					continue;
 				}
+				// Not a flag — stop parsing flags
+				break;
+			}
+			// Must have both -r and -f (or equivalents) to be dangerous
+			if (!hasR || !hasF) {
+				pos = rmIdx + 1;
+				continue;
+			}
+			// Now check if followed by dangerous targets
+			if (p >= len) {
+				pos = rmIdx + 1;
+				continue;
+			}
+			// Block: ~ (home directory references)
+			const charAtP = command[p];
+			if (charAtP === "~") return true; // Home directory reference
+			// Block: / (root or dangerous system paths)
+			if (charAtP === "/") {
+				// Exact root '/' with nothing after
+				if (p + 1 >= len || /\s/.test(command[p + 1]) || command[p + 1] === ";") return true;
+				// Block dangerous system paths
+				const rest = command.slice(p);
+				if (/^\/etc[\/\s;]/.test(rest) || rest === "/etc") return true;
+				if ((/^\/var\/(?!tmp)/.test(rest)) || rest === "/var") return true;
+				if (/^\/usr[\/\s;]/.test(rest) || rest === "/usr") return true;
+				if (/^\/boot[\/\s;]/.test(rest) || rest === "/boot") return true;
+				if (/^\/sys[\/\s;]/.test(rest) || rest === "/sys") return true;
+				if (/^\/proc[\/\s;]/.test(rest) || rest === "/proc") return true;
+				if (/^\/dev[\/\s;]/.test(rest) || rest === "/dev") return true;
+				if (/^\/root[\/\s;]/.test(rest) || rest === "/root") return true;
+				if (/^\/home[\/\s;]/.test(rest) || rest === "/home") return true;
+				// /tmp/ and other non-system absolute paths are allowed
 			}
+			// Check for sensitive relative paths: .ssh, .gnupg
+			const rest = command.slice(p);
+			if (/^\.ssh[\/\\\s;]/.test(rest)) return true;
+			if (/^\.gnupg[\/\\\s;]/.test(rest)) return true;
 		}
 		pos = rmIdx + 1;
 	}
@@ -172,8 +216,13 @@ export function isDangerous(command: string, options: SafeBashOptions = {}): str
 		}
 	}
 
-	// Normalize: remove line continuations, collapse whitespace
-	const normalized = command.replace(/\\\n/g, " ").replace(/\s+/g, " ").trim();
+	// Normalize: strip ANSI escapes and control chars, remove line continuations, collapse whitespace
+	const normalized = command
+		.replace(/\x1b\[[0-9;]*[a-zA-Z]/g, '')  // strip ANSI escapes
+		.replace(/[\x00-\x08\x0b\x0c\x0e-\x1f]/g, '')  // strip control chars
+		.replace(/\\\n/g, " ")
+		.replace(/\s+/g, " ")
+		.trim();
 
 	// Check allow patterns first (overrides)
 	for (const pattern of allowPatterns) {

package/src/types/new-api-types.ts

@@ -11,24 +11,29 @@ export type {
 // Using AgentEndEvent and AgentStartEvent instead
 
 // Type guards for pi-crew usage
-export function isToolEvent(event: AgentSessionEvent): boolean {
+/** @internal */
+function isToolEvent(event: AgentSessionEvent): boolean {
   return event.type === "tool_execution_start" || 
          event.type === "tool_execution_update" || 
          event.type === "tool_execution_end";
 }
 
-export function isAgentLifecycleEvent(event: AgentSessionEvent): boolean {
+/** @internal */
+function isAgentLifecycleEvent(event: AgentSessionEvent): boolean {
   return event.type === "agent_start" || event.type === "agent_end";
 }
 
-export function isCompactionEvent(event: AgentSessionEvent): boolean {
+/** @internal */
+function isCompactionEvent(event: AgentSessionEvent): boolean {
   return event.type === "compaction_start" || event.type === "compaction_end";
 }
 
-export function isRetryEvent(event: AgentSessionEvent): boolean {
+/** @internal */
+function isRetryEvent(event: AgentSessionEvent): boolean {
   return event.type === "auto_retry_start" || event.type === "auto_retry_end";
 }
 
-export function isQueueEvent(event: AgentSessionEvent): boolean {
+/** @internal */
+function isQueueEvent(event: AgentSessionEvent): boolean {
   return event.type === "queue_update";
 }

package/src/ui/keybinding-map.ts

@@ -21,7 +21,8 @@ export const DASHBOARD_KEYS = {
 	notification: { dismissAll: ["H"] },
 } as const;
 
-export const KEY_RESERVED = new Set<string>([
+/** @internal */
+const KEY_RESERVED = new Set<string>([
 	...DASHBOARD_KEYS.close,
 	...DASHBOARD_KEYS.select,
 	...Object.values(DASHBOARD_KEYS.root).flat(),

package/src/ui/live-run-sidebar.ts

@@ -109,7 +109,7 @@ export class LiveRunSidebar {
 
 	render(width: number): string[] {
 		const w = Math.max(36, width);
-		const loaded = loadRunManifestById(this.cwd, this.runId);
+		const loaded = loadRunManifestById(this.cwd, this.runId); // NOTE: no withRunLock - best-effort only; concurrent writes may cause inconsistency;
 		if (!loaded) {
 			return renderLines(
 				[

package/src/ui/loaders.ts

@@ -131,6 +131,10 @@ export class CountdownTimer {
 				this.emitExpire();
 			}
 		}, 1000);
+		// Defense-in-depth: never let the countdown timer keep the event loop
+		// alive. If dispose() is missed (e.g. UI unmount race), the timer must
+		// not block process exit.
+		if (typeof this.timer.unref === "function") this.timer.unref();
 	}
 
 	private emitExpire(): void {

package/src/ui/overlays/agent-picker-overlay.ts

@@ -15,7 +15,7 @@ export class AgentPickerOverlay {
 	private selected = 0;
 
 	constructor(opts: { cwd: string; runId: string; done: (selection: AgentPickerSelection | undefined) => void; theme?: unknown }) {
-		const loaded = loadRunManifestById(opts.cwd, opts.runId);
+		const loaded = loadRunManifestById(opts.cwd, opts.runId); // NOTE: no withRunLock - best-effort only; concurrent writes may cause inconsistency;
 		this.agents = loaded ? readCrewAgents(loaded.manifest) : [];
 		this.done = opts.done;
 		this.theme = asCrewTheme(opts.theme ?? {});

package/src/ui/overlays/mailbox-detail-overlay.ts

@@ -32,7 +32,7 @@ export class MailboxDetailOverlay {
 	}
 
 	private refresh(): void {
-		const loaded = loadRunManifestById(this.cwd, this.runId);
+		const loaded = loadRunManifestById(this.cwd, this.runId); // NOTE: no withRunLock - best-effort only; concurrent writes may cause inconsistency;
 		if (!loaded) return;
 		// Track task count changes to trigger re-render
 		const taskCount = loaded.tasks.length;

package/src/ui/run-action-dispatcher.ts

@@ -81,7 +81,7 @@ export function dispatchHealthRecovery(ctx: ExtensionContext, runId: string): Pr
 
 export async function dispatchKillStaleWorkers(ctx: ExtensionContext, runId: string): Promise<RunActionResult> {
 	try {
-		const loaded = loadRunManifestById(ctx.cwd, runId);
+		const loaded = loadRunManifestById(ctx.cwd, runId); // NOTE: no withRunLock - best-effort only; concurrent writes may cause inconsistency;
 		if (!loaded) return { ok: false, message: `Run '${runId}' not found.` };
 		const currentMs = Date.now();
 		const staleMs = 60_000;
@@ -111,8 +111,9 @@ export async function dispatchDiagnosticExport(ctx: ExtensionContext, runId: str
 	}
 }
 
-export function defaultNudgeAgentId(ctx: Pick<ExtensionContext, "cwd">, runId: string): string | undefined {
-	const loaded = loadRunManifestById(ctx.cwd, runId);
+/** @internal */
+function defaultNudgeAgentId(ctx: Pick<ExtensionContext, "cwd">, runId: string): string | undefined {
+	const loaded = loadRunManifestById(ctx.cwd, runId); // NOTE: no withRunLock - best-effort only; concurrent writes may cause inconsistency;
 	if (!loaded) return undefined;
 	return readCrewAgents(loaded.manifest).find((agent) => agent.status === "running" || agent.status === "queued")?.taskId;
 }

package/src/ui/run-snapshot-cache.ts

@@ -652,7 +652,7 @@ export function createRunSnapshotCache(cwd: string, options: RunSnapshotCacheOpt
 	function build(runId: string, previous?: CacheEntry): CacheEntry {
 		let loaded: ReturnType<typeof loadRunManifestById>;
 		try {
-			loaded = loadRunManifestById(cwd, runId);
+			loaded = loadRunManifestById(cwd, runId); // NOTE: no withRunLock - best-effort only; concurrent writes may cause inconsistency
 		} catch {
 			if (previous) return previous;
 			throw new Error(`Run '${runId}' could not be parsed.`);

package/src/ui/status-colors.ts

@@ -47,7 +47,8 @@ export function iconForStatus(status: RunStatus, options?: { runningGlyph?: stri
 	}
 }
 
-export function colorForActivity(activityState: string | undefined): CrewThemeColor {
+/** @internal */
+function colorForActivity(activityState: string | undefined): CrewThemeColor {
 	if (activityState === "needs_attention") return "warning";
 	if (activityState === "stale") return "error";
 	return "dim";

package/src/ui/syntax-highlight.ts

@@ -22,7 +22,8 @@ function buildCliTheme(theme: CrewTheme): Record<string, (text: string) => strin
 	};
 }
 
-export function detectLanguageFromPath(filePath: string): string | undefined {
+/** @internal */
+function detectLanguageFromPath(filePath: string): string | undefined {
 	const ext = filePath.split(".").pop()?.toLowerCase();
 	if (!ext) return undefined;
 	return languageMap[ext];

package/src/ui/tool-render.ts

@@ -29,6 +29,15 @@ export interface AgentToolResultDetails {
 	results?: Array<{ agentId?: string; status?: string; output?: string; error?: string }>;
 }
 
+/** Combined type for renderAgentToolResult — handles both nested details and flat result shapes */
+interface AgentResultData extends AgentToolResultDetails {
+	agentId?: string;
+	status?: string;
+	error?: string;
+	output?: string;
+	runId?: string;
+}
+
 // ── Helpers ─────────────────────────────────────────────────────────
 
 export function formatTokens(n: number): string {
@@ -45,7 +54,8 @@ export function formatDuration(ms: number): string {
 	return s > 0 ? `${m}m${s}s` : `${m}m`;
 }
 
-export function formatContextUsage(tokens: number, contextWindow: number | undefined): string {
+/** @internal */
+function formatContextUsage(tokens: number, contextWindow: number | undefined): string {
 	if (!contextWindow) return `${formatTokens(tokens)} ctx`;
 	const pct = (tokens / contextWindow) * 100;
 	const maxStr = contextWindow >= 1_000_000 ? `${(contextWindow / 1_000_000).toFixed(1)}M` : `${Math.round(contextWindow / 1000)}k`;
@@ -294,7 +304,7 @@ export function renderAgentToolResult(
 	_options: unknown, theme: Theme, _context: unknown,
 ): Component {
 	// Handle both nested details and flattened result shape
-	const d = (result as any).details ?? result;
+	const d = (result.details ?? result) as AgentResultData;
 	const c = new Container();
 	const w = 116;
 
@@ -351,7 +361,7 @@ export function renderAgentToolResult(
 function extractText(content: unknown[] | undefined): string {
 	if (!content) return "(no output)";
 	if (!Array.isArray(content)) return String(content);
-	return content.filter((c: any) => c?.type === "text").map((c: any) => c?.text ?? "").join("\n") || "(no output)";
+	return content.filter((c): c is Record<string, unknown> => typeof c === "object" && c !== null && (c as Record<string, unknown>).type === "text").map((c) => String((c as Record<string, unknown>).text ?? "")).join("\n") || "(no output)";
 }
 
 function parseArgs(argsStr: string | undefined): Record<string, unknown> {

package/src/utils/env-filter.ts

@@ -1,10 +1,56 @@
 import { isSecretKey } from "./redaction.ts";
 
+// Well-known LLM provider API keys that are intentionally allowlisted in
+// child-pi.ts and async-runner.ts for pass-through to worker processes.
+// These are "secret" by pattern (contain KEY/API) but are safe to allowlist
+// because they are standard provider credentials, not arbitrary secrets.
+const KNOWN_PROVIDER_KEYS = new Set([
+	"MINIMAX_API_KEY", "MINIMAX_GROUP_ID",
+	"OPENAI_API_KEY", "OPENAI_ORG_ID",
+	"ANTHROPIC_API_KEY",
+	"GOOGLE_API_KEY", "GOOGLE_GENERATIVE_LANGUAGE_API_KEY",
+	"AZURE_OPENAI_API_KEY", "AZURE_OPENAI_ENDPOINT",
+	"AWS_ACCESS_KEY_ID", "AWS_SECRET_ACCESS_KEY", "AWS_REGION",
+	"ZEU_API_KEY", "ZERODEV_API_KEY",
+]);
+
+function isKnownProviderKey(key: string): boolean {
+	return KNOWN_PROVIDER_KEYS.has(key);
+}
+
 export interface SanitizeEnvOptions {
 	/** Allow-list of env var names to preserve. Supports trailing glob, e.g. `"PI_*"`. */
 	allowList?: string[];
 }
 
+// Keywords that indicate a secret env var
+const SECRET_SUFFIXES = ["token", "api", "key", "password", "passwd", "secret", "credential", "authorization", "private"];
+
+/**
+ * Check if a glob pattern could match secret env vars.
+ * A pattern like "PI_*" is dangerous because it could match PI_TOKEN, PI_API_KEY, etc.
+ *
+ * Exception: `PI_CREW_*` is a controlled namespace — the pi-crew codebase owns
+ * every PI_CREW_* env var (PI_CREW_PARENT_PID, PI_CREW_ADAPTIVE_REPAIR, etc.)
+ * and none of them are secrets. Allowing the glob here lets child Pi processes
+ * inherit our config without needing a per-var allowlist.
+ */
+function isDangerousGlob(pattern: string): boolean {
+	if (!pattern.endsWith("*")) return false;
+	const prefix = pattern.slice(0, -1); // Remove trailing *
+	if (prefix === "") return true; // Single "*" matches everything
+	// PI_CREW_* is the pi-crew controlled namespace — no secrets live here.
+	// This covers PI_CREW_*, PI_CREW_TEAMS_*, PI_CREW_AGENT_*, etc.
+	if (prefix.startsWith("PI_CREW_") || prefix === "PI_CREW") return false;
+	// Check if combining the prefix with any secret suffix would create a secret key
+	for (const suffix of SECRET_SUFFIXES) {
+		if (isSecretKey(prefix + suffix)) {
+			return true;
+		}
+	}
+	return false;
+}
+
 /**
  * Strip env vars whose keys look like secrets before passing to child processes.
  *
@@ -14,11 +60,31 @@ export interface SanitizeEnvOptions {
 export function sanitizeEnvSecrets(env: NodeJS.ProcessEnv, options?: SanitizeEnvOptions): Record<string, string> {
 	const filtered: Record<string, string> = {};
 	if (options?.allowList && options.allowList.length > 0) {
+		// Validate allowlist patterns don't match secrets
+		for (const pattern of options.allowList) {
+			if (isDangerousGlob(pattern)) {
+				throw new Error(`Allowlist pattern "${pattern}" could match secret env vars. Use a more specific pattern.`);
+			}
+			// Validate non-glob entries don't look like secret keys.
+			// Exception 1: if the key exists in env, it was intentionally set and
+			// should be allowed through (user knows what they're doing).
+			// Exception 2: known provider keys (MINIMAX_API_KEY, etc.) are always
+			// allowed because they are standard provider credentials explicitly
+			// listed in async-runner.ts / child-pi.ts allowlists.
+			if (!pattern.endsWith("*") && isSecretKey(pattern) && !(pattern in env) && !isKnownProviderKey(pattern)) {
+				throw new Error(`Allowlist entry "${pattern}" looks like a secret key. Use a more specific pattern.`);
+			}
+		}
 		const matchers = options.allowList.map((p) => {
 			if (p.endsWith("*")) {
+				// Glob pattern: matches keys that start with the prefix AND have
+				// at least one additional character (distinguishes "PI_CREW_*" from "PI_CREW_").
+				// For example, "PI_CREW_*" matches "PI_CREW_DEPTH" but not "PI_CREW_".
+				// This ensures trailing glob patterns require extra chars, not exact-prefix-only matches.
 				const prefix = p.slice(0, -1);
 				return (k: string) => k.startsWith(prefix) && k.length > prefix.length;
 			}
+			// Exact match is case-sensitive; Unix env vars are uppercase by convention.
 			return (k: string) => k === p;
 		});
 		for (const [key, value] of Object.entries(env)) {

package/src/utils/file-coalescer.ts

@@ -6,7 +6,15 @@ interface TimerApi {
 }
 
 const defaultTimerApi: TimerApi = {
-	setTimeout: (handler, delayMs) => setTimeout(handler, delayMs),
+	setTimeout: (handler, delayMs) => {
+		const t = setTimeout(handler, delayMs);
+		// Defense in depth: never let a coalescer timer block process exit.
+		// The timer may be cleared before it fires; .unref() is idempotent.
+		if (typeof t === "object" && t && "unref" in t && typeof t.unref === "function") {
+			t.unref();
+		}
+		return t;
+	},
 	clearTimeout: (handle) => clearTimeout(handle as ReturnType<typeof setTimeout>),
 };
 

package/src/utils/fs-watch.ts

@@ -2,7 +2,8 @@ import * as fs from "node:fs";
 import * as path from "node:path";
 import type { FSWatcher, WatchListener } from "node:fs";
 
-export const FS_WATCH_RETRY_DELAY_MS = 5000;
+/** @internal */
+const FS_WATCH_RETRY_DELAY_MS = 5000;
 
 export function closeWatcher(watcher: FSWatcher | null | undefined): void {
 	if (!watcher) {
@@ -85,4 +86,5 @@ export function watchCrewState(
 }
 
 // Re-export path helper so callers don't pull node:path just for join.
-export const joinPath = path.join;
+/** @internal */
+const joinPath = path.join;

package/src/utils/gh-protocol.ts

@@ -473,7 +473,8 @@ export function resolveGitHubUrl(parsed: Parsed, scheme: "issue" | "pr", cwd: st
  * Resolve a raw `issue://` or `pr://` URL string.
  * Convenience wrapper combining parse + resolve.
  */
-export function resolveGitHubProtocol(raw: string, scheme: "issue" | "pr", cwd: string): GhResult<unknown> {
+/** @internal */
+function resolveGitHubProtocol(raw: string, scheme: "issue" | "pr", cwd: string): GhResult<unknown> {
 	const parsed = parseGitHubUrl(raw, scheme);
 	return resolveGitHubUrl(parsed, scheme, cwd);
 }

package/src/utils/paths.ts

@@ -9,7 +9,49 @@ export function packageRoot(): string {
 
 export function userPiRoot(): string {
 	const home = process.env.PI_TEAMS_HOME?.trim() || os.homedir();
-	return path.join(home, ".pi", "agent");
+	const resolved = path.join(home, ".pi", "agent");
+
+	// Reject symlinks to prevent confusion attacks where PI_TEAMS_HOME points to
+	// an attacker-controlled target via a user-owned symlink.
+	// We use lstatSync (does NOT follow) to detect symlinks before they are resolved.
+	// ENOENT is acceptable — the directory may not exist yet (caller will create it).
+	let isSymlink = false;
+	try {
+		const lstats = fs.lstatSync(resolved);
+		isSymlink = lstats.isSymbolicLink();
+	} catch (err: unknown) {
+		if (err instanceof Error && "code" in err && err.code !== "ENOENT") throw err;
+		// Path doesn't exist yet — caller will create it. Skip further validation.
+		return resolved;
+	}
+	if (isSymlink) {
+		throw new Error(
+			`userPiRoot: PI_TEAMS_HOME path "${resolved}" is a symlink. ` +
+			"Symlinks are not supported for PI_TEAMS_HOME to prevent confusion attacks. " +
+			"Set PI_TEAMS_HOME to a direct path owned by the current user.",
+		);
+	}
+
+	// Validate that the resolved path is owned by the current user
+	// to ensure security assumptions about file permissions (0o600/0o700) hold.
+	// Skip check if the directory does not exist yet.
+	try {
+		const stats = fs.statSync(resolved);
+		if (stats.uid !== os.userInfo().uid) {
+			throw new Error(
+				`userPiRoot: PI_TEAMS_HOME path "${resolved}" is not owned by the current user (uid=${os.userInfo().uid}, found uid=${stats.uid}). ` +
+				"This violates security assumptions about file permissions. Set PI_TEAMS_HOME to a path owned by the current user, or unset it to use the default.",
+			);
+		}
+	} catch (err: unknown) {
+		if (err instanceof Error && "code" in err && err.code !== "ENOENT") {
+			throw err;
+		}
+		// ENOENT from statSync means the directory was deleted between lstat and stat
+		// (race condition). This is acceptable — caller will handle.
+	}
+
+	return resolved;
 }
 
 const PROJECT_DIR_MARKERS = [".git", ".pi", ".crew", ".hg", ".svn", ".factory", ".omc"];
@@ -48,8 +90,34 @@ function hasProjectMarker(dir: string): boolean {
 	return false;
 }
 
+/** On Windows, resolve a path to its canonical long-name form.
+ *  Uses realpathSync.native to get the \\?\ long-name path, then strips
+ *  the prefix for path.relative compatibility. */
+function canonicalizePath(p: string): string {
+	try {
+		const r = fs.realpathSync.native(p);
+		return r.startsWith("\\\\?\\") ? r.slice(4) : r;
+	} catch {
+		try { return fs.realpathSync(p); } catch { return p; }
+	}
+}
+
 export function findRepoRoot(cwd: string): string | undefined {
-	const startKey = path.resolve(cwd);
+	// Resolve symlinks before walking to prevent malicious symlinks from bypassing
+	// home/temp boundary checks. If the path doesn't exist (e.g., caller passed
+	// a non-existent CWD like /tmp/no-such-dir), fall back to the lexical path
+	// and let computeRepoRoot handle the rest. ENOENT here is common for
+	// newly-created test directories and shouldn't propagate as a crash.
+	let startKey: string;
+	try {
+		startKey = fs.realpathSync(cwd);
+	} catch (error) {
+		if ((error as NodeJS.ErrnoException).code === "ENOENT") {
+			startKey = path.resolve(cwd);
+		} else {
+			throw error;
+		}
+	}
 	const cached = projectRootCache.get(startKey);
 	if (cached && Date.now() - cached.cachedAt < PROJECT_ROOT_CACHE_TTL_MS) {
 		// Re-insert to refresh LRU position.
@@ -82,18 +150,25 @@ function computeRepoRoot(start: string): string | undefined {
 }
 
 export function projectPiRoot(cwd: string): string {
-	return path.join(findRepoRoot(cwd) ?? cwd, ".pi");
+	const repoRoot = findRepoRoot(cwd) ?? cwd;
+	const piDir = path.join(repoRoot, ".pi");
+	// Use realpathSync to resolve any symlinks before returning to prevent
+	// config from being read from unexpected locations.
+	if (fs.existsSync(piDir)) return fs.realpathSync(piDir);
+	return piDir;
 }
 
 export function projectCrewRoot(cwd: string): string {
 	const repoRoot = findRepoRoot(cwd) ?? cwd;
 	const crewDir = path.join(repoRoot, ".crew");
 	// Keep an existing .crew/ stable even when .pi/ exists for project config.
-	if (fs.existsSync(crewDir)) return crewDir;
+	// Use canonicalizePath to get long-name form on Windows, matching
+	// what worktree operations and resolveRealContainedPath expect.
+	if (fs.existsSync(crewDir)) return canonicalizePath(crewDir);
 	// Legacy reuse: if .pi/ already exists for the project, namespace under .pi/teams/
 	// to avoid creating a parallel .crew/ alongside an existing pi project layout.
 	const piDir = path.join(repoRoot, ".pi");
-	if (fs.existsSync(piDir)) return path.join(piDir, "teams");
+	if (fs.existsSync(piDir)) return path.join(canonicalizePath(piDir), "teams");
 	return crewDir;
 }
 

package/src/utils/redaction.ts

@@ -7,8 +7,13 @@
 export const PEM_PRIVATE_KEY_PATTERN = /-----BEGIN [A-Z ]+PRIVATE KEY-----[\s\S]+?-----END [A-Z ]+PRIVATE KEY-----/g;
 
 // Linear-time secret key detection
+// IMPORTANT: This function must maintain linear-time guarantees.
+// The fast-path regex uses simple string alternatives with anchors only (no quantifiers),
+// and the linear scan iterates through characters once. If either path is replaced with
+// a more complex regex, catastrophic backtracking (ReDoS) could result.
+// Any modifications must preserve O(n) complexity where n = keyName.length.
 export function isSecretKey(keyName: string): boolean {
-	// Fast path: common secret key names
+	// Fast path: common secret key names (safe anchored regex, no backtracking)
 	const lower = keyName.toLowerCase();
 	if (/^(token|apikey|api_key|password|secret|credential|authorization|privatekey|private_key)$/.test(lower)) {
 		return true;