pi-crew 0.6.0 → 0.6.3

package/src/utils/safe-paths.ts

@@ -11,37 +11,314 @@ export function assertSafePathId(kind: string, value: string): string {
 }
 
 export function resolveContainedPath(baseDir: string, targetPath: string): string {
+	if (targetPath.includes('\0')) {
+		throw new Error(`Security: path contains null byte`);
+	}
 	const base = path.resolve(baseDir);
 	const resolved = path.isAbsolute(targetPath) ? path.resolve(targetPath) : path.resolve(base, targetPath);
-	const relative = path.relative(base, resolved);
+	// On Windows, paths are case-insensitive and short-name (8.3) aliases may
+	// differ from long-name forms (e.g. C:\Users\RUNNER~1 vs C:\Users\runneradmin).
+	// We normalize both paths to their canonical form by resolving through
+	// realpathSync, walking up ancestors for non-existent paths.
+	const baseNorm = process.platform === "win32" ? resolveWindowsCanonical(base) : base;
+	const resolvedNorm = process.platform === "win32" ? resolveWindowsCanonical(resolved) : resolved;
+	const relative = process.platform === "win32"
+		? path.relative(baseNorm.toLowerCase(), resolvedNorm.toLowerCase())
+		: path.relative(base, resolved);
 	if (relative.startsWith("..") || path.isAbsolute(relative)) throw new Error(`Path is outside ${baseDir}: ${targetPath}`);
 	return resolved;
 }
 
+/**
+ * On Windows, resolve a path to its canonical (long-name) form.
+ * Walks up ancestors until finding one that exists, then joins back down.
+ * This handles paths where intermediate directories don't exist yet but
+ * their ancestors do (and may use short-name aliases).
+ */
+function resolveWindowsCanonical(p: string): string {
+	try {
+		// Use regular realpathSync (not .native) to preserve the input path form.
+		// On Windows CI, .native always returns long-name (runneradmin) while
+		// non-native preserves short-name (RUNNER~1). Using non-native ensures
+		// the returned form matches what os.tmpdir() and mkdtempSync produce.
+		let real = fs.realpathSync(p);
+		// Guard against NTFS internal paths (e.g. C:\$Extend\$Deleted)
+		if (real.includes("$Extend") || real.includes("$Deleted")) throw new Error("NTFS internal path");
+		return real;
+	} catch {
+		// Fallback: try realpathSync (non-native) which may succeed where .native fails
+		try {
+			const real = fs.realpathSync(p);
+			return real;
+		} catch { /* proceed to ancestor walk */ }
+		// Walk up to find the deepest existing ancestor
+		const parts: string[] = [];
+		let current = p;
+		while (current !== path.dirname(current)) {
+			try {
+				// Use non-native to preserve input path form
+				let real = fs.realpathSync(current);
+				// Guard against NTFS internal paths
+				if (real.includes("$Extend") || real.includes("$Deleted")) throw new Error("NTFS internal path");
+				// Found existing ancestor — join with remaining parts in reverse order
+				// (parts were pushed bottom-up, so iterate from last to first)
+				for (let i = parts.length - 1; i >= 0; i--) {
+					real = path.join(real, parts[i]);
+				}
+				return real;
+			} catch { /* keep walking */ }
+			parts.push(path.basename(current));
+			current = path.dirname(current);
+		}
+		// Couldn't resolve any ancestor — return original
+		return p;
+	}
+}
+
+/**
+ * Resolve a target path to its real (symlink-resolved) absolute path while
+ * guaranteeing the result stays inside `baseDir`.
+ *
+ * ## Security model — asymmetric ancestor handling
+ *
+ * `baseDir` and `targetPath` are validated with different policies because
+ * they play different roles:
+ *
+ * - **baseDir** (the container): all ancestors MUST exist and MUST NOT be
+ *   symlinks. We refuse to operate if any component is missing or symlinked,
+ *   because a symlinked container could point the caller outside the
+ *   intended trust boundary (e.g. `/var/run -> /run` resolving into an
+ *   attacker-controlled directory).
+ *
+ * - **targetPath** (the contained file): the FINAL component may be
+ *   non-existent (for write operations creating a new file) and EXISTING
+ *   ancestors of the target may also be missing. We DO require that any
+ *   ancestor that DOES exist must not be a symlink — an attacker who can
+ *   create a directory in the container must not be able to redirect the
+ *   file being created.
+ *
+ * This asymmetry is intentional: callers that need to create a new file
+ * pass a non-existent targetPath. Callers that operate on an existing file
+ * get full symlink protection. Callers MUST NOT pass a symlinked
+ * intermediate component; if you need to, use `resolveContainedPath`
+ * instead (which only checks the resolved path, not the chain).
+ *
+ * Throws on:
+ *   - null byte in targetPath
+ *   - targetPath resolves outside baseDir
+ *   - any existing ancestor (base or target) is a symlink
+ *   - baseDir itself does not exist
+ *
+ * Returns the resolved real path on success, or the resolved (but not
+ * realpathed) path when the target does not exist yet.
+ *
+ * NOTE: There is a race condition window between validation and use where an
+ * attacker could create a directory component after validation but before the
+ * file is created. Callers MUST create parent directories atomically
+ * (e.g., mkdirSync with { recursive: true }) and use O_CREAT | O_NOFOLLOW | O_EXCL
+ * for atomic file creation, as atomicWriteFile does. This ensures the entire
+ * operation is atomic and prevents TOCTOU attacks.
+ */
 export function resolveRealContainedPath(baseDir: string, targetPath: string): string {
+	if (targetPath.includes('\0')) {
+		throw new Error(`Security: path contains null byte`);
+	}
 	const resolved = resolveContainedPath(baseDir, targetPath);
+
+	// Open baseDir with O_NOFOLLOW to atomically validate no symlinks in the path.
+	// O_NOFOLLOW makes the open fail with ELOOP if any path component is a symlink.
+	let baseFd: number | undefined;
+	try {
+		baseFd = fs.openSync(baseDir, fs.constants.O_RDONLY | fs.constants.O_NOFOLLOW);
+	} catch (error) {
+		const errCode = (error as NodeJS.ErrnoException).code;
+		if (errCode === "ENOENT") {
+			// baseDir doesn't exist yet — create it and retry
+			try {
+				fs.mkdirSync(baseDir, { recursive: true });
+				baseFd = fs.openSync(baseDir, fs.constants.O_RDONLY | fs.constants.O_NOFOLLOW);
+			} catch (retryError) {
+				throw new Error(`Cannot open base directory ${baseDir}: ${retryError instanceof Error ? retryError.message : String(retryError)}`);
+			}
+		} else if (errCode === "ELOOP") {
+			// On macOS, system directories like /var → /private/var contain symlinks.
+			// If baseDir is under such a path, resolve through realpath and retry.
+			if (process.platform === "darwin") {
+				try {
+					const realBaseDir = fs.realpathSync(baseDir);
+					if (realBaseDir !== baseDir) {
+						baseFd = fs.openSync(realBaseDir, fs.constants.O_RDONLY | fs.constants.O_NOFOLLOW);
+						baseDir = realBaseDir; // update for later use
+						// Fall through to fstatSync below
+					}
+				} catch { /* throw original */ }
+			}
+			if (baseFd === undefined) throw new Error("Refusing to resolve: baseDir path contains a symlink: " + baseDir);
+		} else {
+			throw new Error(`Cannot open base directory ${baseDir}: ${error instanceof Error ? error.message : String(error)}`);
+		}
+	}
 	let realBase: string;
-	let realTarget: string;
 	try {
-		realBase = fs.realpathSync.native(baseDir);
-	} catch (baseError) {
-		throw new Error(`Cannot resolve real path of base directory ${baseDir}: ${baseError instanceof Error ? baseError.message : String(baseError)}`);
+		const stat = fs.fstatSync(baseFd);
+		if (!stat.isDirectory()) throw new Error(`baseDir ${baseDir} is not a directory`);
+		// Use regular realpathSync (not .native) to preserve input path form.
+		// On Windows CI, .native always returns long-name form (runneradmin)
+		// while non-native preserves short-name (RUNNER~1). Using non-native
+		// ensures the result matches what the caller passed in.
+		realBase = fs.realpathSync(baseDir);
+	} catch (error) {
+		// baseDir MUST exist and be resolvable for the containment guarantee to hold.
+		// Callers creating new directories must create baseDir atomically (e.g.,
+		// mkdirSync with { recursive: true }) BEFORE calling this function, and use
+		// O_NOFOLLOW|O_CREAT|O_EXCL for the actual file creation to ensure atomicity.
+		// The safe-paths validation and the file creation are two separate operations
+		// with a gap between them — callers must close this gap with atomic primitives.
+		throw new Error(`Cannot resolve real path of base directory ${baseDir}: ${error instanceof Error ? error.message : String(error)}`);
+	} finally {
+		fs.closeSync(baseFd);
+	}
+
+	// Walk the ancestor chain of the resolved target path, using O_NOFOLLOW
+	// on each ancestor to atomically validate none are symlinks.
+	const O_NOFOLLOW = fs.constants.O_NOFOLLOW;
+	const O_RDONLY = fs.constants.O_RDONLY;
+	const resolvedParts = resolved.split(path.sep);
+	let resolvedAccumulated = "";
+	if (resolvedParts[0] === "") resolvedAccumulated = "/"; // Unix root
+	for (let i = 1; i < resolvedParts.length; i++) {
+		if (resolvedParts[i] === "") continue;
+		resolvedAccumulated = path.join(resolvedAccumulated, resolvedParts[i]);
+		try {
+			const fd = fs.openSync(resolvedAccumulated, O_RDONLY | O_NOFOLLOW);
+			fs.closeSync(fd);
+		} catch (error) {
+			if ((error as NodeJS.ErrnoException).code === "ELOOP") {
+			// On macOS, /var → /private/var, /tmp → /private/tmp, /etc → /private/etc
+			// are system symlinks managed by the OS. Allow them.
+			if (process.platform === "darwin") {
+				const resolvedSymlink = resolvedAccumulated;
+				const knownDarwinSymlinks = ["/var", "/tmp", "/etc", "/private/var", "/private/tmp", "/private/etc"];
+				if (knownDarwinSymlinks.includes(resolvedSymlink)) continue;
+			}
+			throw new Error("Refusing to resolve: target path ancestor is a symlink: " + resolvedAccumulated);
+		}
+			// EPERM on Windows when opening a directory — skip validation
+			if ((error as NodeJS.ErrnoException).code === "EPERM" && process.platform === "win32") continue;
+			// ENOENT means component doesn't exist — that's OK. Only existing symlinks
+			// are a security risk (symlinks to attacker-controlled targets). Non-existent
+			// paths can be created by the caller and don't pose a symlink risk.
+			if ((error as NodeJS.ErrnoException).code !== "ENOENT") throw error;
+			// For the final component (target itself), ENOENT is expected for non-existent targets.
+			if (i === resolvedParts.length - 1) continue;
+			// For non-final components (parent directories), ENOENT is also acceptable —
+			// the caller will create them before the write operation if needed.
+			// We only need to ensure no existing path component is a symlink.
+			continue;
+		}
+	}
+
+	// Open the target with O_NOFOLLOW to catch any symlinks.
+	// ENOENT is acceptable for write operations — the file may not exist yet.
+	let targetFd: number;
+	try {
+		targetFd = fs.openSync(resolved, O_RDONLY | O_NOFOLLOW);
+	} catch (error) {
+		if ((error as NodeJS.ErrnoException).code === "ELOOP") throw new Error("Refusing to resolve: target path is a symlink: " + resolved);
+		// EPERM on Windows when opening a directory — treat as non-existent
+		if ((error as NodeJS.ErrnoException).code === "EPERM" && process.platform === "win32") return resolved;
+		if ((error as NodeJS.ErrnoException).code === "ENOENT") {
+			// Target doesn't exist yet — that's OK for write operations.
+			// All ancestors have been validated above (no symlinks).
+			// The caller will create the file with atomic primitives.
+			return resolved;
+		}
+		throw new Error(`Cannot open ${resolved}: ${error instanceof Error ? error.message : String(error)}`);
 	}
+
+	let realTarget: string;
 	try {
-		realTarget = fs.realpathSync.native(resolved);
+		// Use regular realpathSync (not .native) to preserve input path form.
+		realTarget = fs.realpathSync(resolved);
 	} catch (targetError) {
 		if ((targetError as NodeJS.ErrnoException).code === "ENOENT") {
-			throw new Error(`Path does not exist: ${resolved}`);
+			// Target doesn't exist yet — this is OK for write operations.
+			// Return the resolved path so the caller can create the file.
+			// We already validated all ancestors are not symlinks above.
+			return resolved;
 		}
 		throw new Error(`Cannot resolve real path of ${resolved}: ${targetError instanceof Error ? targetError.message : String(targetError)}`);
+	} finally {
+		fs.closeSync(targetFd);
+	}
+
+	// Re-validate the ancestor chain of the resolved path to catch any TOCTOU
+	// races that occurred between the initial O_NOFOLLOW validation and the
+	// realpathSync call. An attacker could have replaced a validated ancestor
+	// with a symlink during this window.
+	//
+	// Skip the final path component (realTarget itself) — we just successfully
+	// realpathSync'd it, so it exists. Re-validating it can spuriously fail on
+	// Windows where the resolved path uses short-name (8.3) form that
+	// openSync cannot reopen, or where the realpathSync result differs in
+	// case/separator form from the original.
+	//
+	// Walk via path.dirname which is portable across all platforms and
+	// correctly handles extended-length (\\?\), UNC (\\server\share), and
+	// short-name paths on Windows without manual parsing.
+	let ancestor = path.dirname(realTarget);
+	while (ancestor && ancestor !== path.dirname(ancestor)) {
+		try {
+			const fd = fs.openSync(ancestor, O_RDONLY | O_NOFOLLOW);
+			fs.closeSync(fd);
+		} catch (error) {
+			const errCode = (error as NodeJS.ErrnoException).code;
+			if (errCode === "ELOOP") throw new Error("Refusing to resolve: TOCTOU race detected, path became a symlink: " + ancestor);
+			// Windows: EPERM can occur when opening system directories (e.g. C:\)
+			// or NTFS internal paths ($Extend/$Deleted). Skip and continue walking.
+			if (process.platform === "win32" && errCode === "EPERM") {
+				if (ancestor.includes("$Extend") || ancestor.includes("$Deleted")) {
+					// NTFS internal path — stop walking, we've reached the filesystem root
+					break;
+				}
+				// System directory — continue walking up
+				ancestor = path.dirname(ancestor);
+				continue;
+			}
+			if (errCode !== "ENOENT") throw error;
+			// ENOENT on an ancestor of realTarget after realpathSync is concerning
+			// — the path existed when we validated it but now doesn't. This could
+			// indicate a race or attack. For safety, treat this as an error.
+			throw new Error(`Cannot validate resolved path: ${ancestor} disappeared after realpathSync: ${error instanceof Error ? error.message : String(error)}`);
+		}
+		ancestor = path.dirname(ancestor);
+	}
+
+	// Verify the resolved real path is still within baseDir.
+	// On Windows, realpathSync.native may return different short/long-name forms
+	// for the same physical directory depending on how the path was opened.
+	// Use resolveWindowsCanonical (same as resolveContainedPath) to normalize
+	// both paths consistently before comparison.
+	if (process.platform === "win32") {
+		const normBase = resolveWindowsCanonical(realBase).replace(/\\/g, "/").toLowerCase();
+		const normTarget = resolveWindowsCanonical(realTarget).replace(/\\/g, "/").toLowerCase();
+		if (!normTarget.startsWith(normBase + "/") && normBase !== normTarget) {
+			throw new Error(`Path is outside ${baseDir}: ${targetPath}`);
+		}
+	} else {
+		const relative = path.relative(realBase, realTarget);
+		if (relative.startsWith("..") || path.isAbsolute(relative)) throw new Error(`Path is outside ${baseDir}: ${targetPath}`);
 	}
-	const relative = path.relative(realBase, realTarget);
-	if (relative.startsWith("..") || path.isAbsolute(relative)) throw new Error(`Path is outside ${baseDir}: ${targetPath}`);
 	return realTarget;
 }
 
 export function resolveContainedRelativePath(baseDir: string, relativePath: string, kind = "path"): string {
-	const normalized = relativePath.replaceAll("\\", "/").replace(/^\.\/+/, "");
+	if (relativePath.includes('\0')) {
+		throw new Error(`Security: path contains null byte: ${kind}`);
+	}
+	const normalized = relativePath.replace(/\\/g, "/").replace(/^\.\/+/, "");
+	// Detect Windows absolute paths (C:\, \\server\share) that path.isAbsolute may miss after normalization
+	if (/^[A-Za-z]:/.test(normalized)) throw new Error(`Invalid ${kind}: ${relativePath}`);
 	if (!normalized || normalized.split("/").some((segment) => segment === "..") || path.isAbsolute(normalized)) throw new Error(`Invalid ${kind}: ${relativePath}`);
 	return resolveContainedPath(baseDir, path.resolve(baseDir, normalized));
 }

package/src/worktree/cleanup.ts

@@ -5,6 +5,8 @@ import type { TeamRunManifest } from "../state/types.ts";
 import { writeArtifact } from "../state/artifact-store.ts";
 import { projectCrewRoot } from "../utils/paths.ts";
 import { DEFAULT_PATHS } from "../config/defaults.ts";
+import { sanitizeEnvSecrets } from "../utils/env-filter.ts";
+import { logInternalError } from "../utils/internal-error.ts";
 
 export interface WorktreeCleanupResult {
 	removed: string[];
@@ -14,15 +16,33 @@ export interface WorktreeCleanupResult {
 	committedBranches: string[];
 }
 
+// SECURITY: PI_* and PI_CREW_* wildcards removed — they could match secret vars like PI_PASSWORD.
+// Git operations do not need PI_CREW_* execution-control vars.
+const GIT_SAFE_ENV = { ...sanitizeEnvSecrets(process.env, { allowList: ["PATH", "HOME", "USER", "USERPROFILE", "SHELL", "TERM", "LANG", "LC_ALL", "LC_COLLATE", "LC_CTYPE", "LC_MESSAGES", "XDG_CONFIG_HOME", "XDG_DATA_HOME", "XDG_CACHE_HOME", "NVM_BIN", "NVM_DIR", "NODE_PATH", "GIT_CONFIG_GLOBAL", "GIT_CONFIG_SYSTEM", "GIT_AUTHOR_NAME", "GIT_AUTHOR_EMAIL", "GIT_COMMITTER_NAME", "GIT_COMMITTER_EMAIL"] }), LANG: "C", LC_ALL: "C" };
+
+function sanitizeBranchPart(value: string): string {
+	return value.toLowerCase().replace(/[^a-z0-9._/-]+/g, "-").replace(/^-+|-+$/g, "") || "task";
+}
+
+function sanitizeFilename(value: string): string {
+	// Strip control chars and newlines for safe artifact filenames
+	return value.slice(0, 200).replace(/[\x00-\x1f\x7f-\x9f\r\n]+/g, " ");
+}
+
 function git(cwd: string, args: string[]): string {
-	return execFileSync("git", args, { cwd, encoding: "utf-8", stdio: ["ignore", "pipe", "pipe"], env: { ...process.env, LANG: "C", LC_ALL: "C" }, windowsHide: true }).trim();
+	try {
+		return execFileSync("git", args, { cwd, encoding: "utf-8", stdio: ["ignore", "pipe", "pipe"], env: GIT_SAFE_ENV, windowsHide: true }).trim();
+	} catch (error) {
+		const message = error instanceof Error ? error.message : String(error);
+		throw new Error(`git ${args.join(" ")} failed: ${message}`);
+	}
 }
 
-function isDirty(worktreePath: string): boolean {
+function isDirty(worktreePath: string): boolean | "error" {
 	try {
 		return git(worktreePath, ["status", "--porcelain"]).trim().length > 0;
 	} catch {
-		return true;
+		return "error";
 	}
 }
 
@@ -36,61 +56,112 @@ function captureDiff(worktreePath: string): string {
 }
 
 export function cleanupRunWorktrees(manifest: TeamRunManifest, options: { force?: boolean; signal?: AbortSignal } = {}): WorktreeCleanupResult {
-	const worktreeRoot = path.join(projectCrewRoot(manifest.cwd), DEFAULT_PATHS.state.worktreesSubdir, manifest.runId);
+	const sanitizedRunId = manifest.runId.replace(/[^a-zA-Z0-9._-]/g, "-").replace(/^-+|-+$/g, "") || "run";
+	const worktreeRoot = path.join(projectCrewRoot(manifest.cwd), DEFAULT_PATHS.state.worktreesSubdir, sanitizedRunId);
 	const result: WorktreeCleanupResult = { removed: [], preserved: [], artifactPaths: [], committedBranches: [] };
 	if (!fs.existsSync(worktreeRoot)) return result;
 
 	// M3 fix: use withFileTypes to avoid race between readdirSync and statSync.
+	// Rely on Dirent.isDirectory() instead of a separate statSync to eliminate TOCTOU window.
 	const withFileTypes = fs.readdirSync(worktreeRoot, { withFileTypes: true });
 	for (const entry of withFileTypes) {
 		if (options.signal?.aborted) break;
 		if (!entry.isDirectory()) continue;
+		// Issue 1 fix: check signal before each git operation to respect abort faster
+		if (options.signal?.aborted) break;
 		const worktreePath = path.join(worktreeRoot, entry.name);
-		try {
-			const stat = fs.statSync(worktreePath);
-			if (!stat.isDirectory()) continue;
-		} catch {
-			// Entry deleted between readdir and stat — skip safely.
-			continue;
-		}
+		if (options.signal?.aborted) break;
 		const dirty = isDirty(worktreePath);
-		const branchName = `pi-crew/${manifest.runId}/${entry.name}`;
+		const branchName = `pi-crew/${manifest.runId}/${sanitizeBranchPart(entry.name)}`;
+		const safeBranchName = sanitizeBranchPart(entry.name);
 		if (dirty) {
+			// Issue 1 fix: check signal before git operations
+			if (options.signal?.aborted) break;
 			// Commit changes to a branch instead of just preserving the worktree
 			try {
-				execFileSync("git", ["add", "-A"], { cwd: worktreePath, encoding: "utf-8", stdio: ["ignore", "pipe", "pipe"], env: { ...process.env, LANG: "C", LC_ALL: "C" }, windowsHide: true });
+				// Issue 2 fix: verify status before and after add to ensure atomicity
+				const statusBefore = git(worktreePath, ["status", "--porcelain"]);
+				execFileSync("git", ["add", "-A"], { cwd: worktreePath, encoding: "utf-8", stdio: ["ignore", "pipe", "pipe"], env: GIT_SAFE_ENV, windowsHide: true });
+				// Verify no unexpected changes were added (only staged the original dirty files)
+				const statusAfterAdd = git(worktreePath, ["status", "--porcelain"]);
+				if (statusAfterAdd !== statusBefore) {
+					// Something changed between our status check and add - abort to avoid including unexpected changes
+					throw new Error("worktree state changed unexpectedly during add; refusing to commit");
+				}
+				// Issue 1 fix: check signal before commit
+				if (options.signal?.aborted) break;
 				let safeDesc = entry.name.slice(0, 200);
 				// SECURITY: Strip any newlines that could be injected via a malicious worktree name
 				// to prevent newline injection in git commit messages
 				if (safeDesc.includes("\n")) {
-					safeDesc = safeDesc.replace(/[\r\n]+/g, " ");
+					safeDesc = safeDesc.replace(/[\x00-\x08\x0B\x0C\x0E-\x1F\x7F]+/g, " ");
 				}
-				execFileSync("git", ["commit", "-m", `pi-crew: ${safeDesc}`], { cwd: worktreePath, encoding: "utf-8", stdio: ["ignore", "pipe", "pipe"], env: { ...process.env, LANG: "C", LC_ALL: "C" }, windowsHide: true });
+				execFileSync("git", ["commit", "-m", `pi-crew: ${safeDesc}`], { cwd: worktreePath, encoding: "utf-8", stdio: ["ignore", "pipe", "pipe"], env: GIT_SAFE_ENV, windowsHide: true });
+				// Issue 1 fix: check signal before branch creation
+				if (options.signal?.aborted) break;
 				// Create branch in the main repo pointing to this worktree's HEAD
+				let branchError: Error | null = null;
 				try {
-					execFileSync("git", ["branch", branchName], { cwd: worktreePath, encoding: "utf-8", stdio: ["ignore", "pipe", "pipe"], env: { ...process.env, LANG: "C", LC_ALL: "C" }, windowsHide: true });
-				} catch {
+					execFileSync("git", ["branch", branchName], { cwd: worktreePath, encoding: "utf-8", stdio: ["ignore", "pipe", "pipe"], env: GIT_SAFE_ENV, windowsHide: true });
+				} catch (err) {
+					branchError = err instanceof Error ? err : new Error(String(err));
 					// Branch already exists — use timestamp suffix
 					const tsBranch = `${branchName}-${Date.now()}`;
-					execFileSync("git", ["branch", tsBranch], { cwd: worktreePath, encoding: "utf-8", stdio: ["ignore", "pipe", "pipe"], env: { ...process.env, LANG: "C", LC_ALL: "C" }, windowsHide: true });
+					try {
+						execFileSync("git", ["branch", tsBranch], { cwd: worktreePath, encoding: "utf-8", stdio: ["ignore", "pipe", "pipe"], env: GIT_SAFE_ENV, windowsHide: true });
+					} catch (err2) {
+						// Both branch attempts failed — accumulate error for outer catch
+						const err2_msg = err2 instanceof Error ? err2.message : String(err2);
+						throw new Error(`branch creation failed (${branchName} already exists): ${branchError.message}; fallback branch also failed: ${err2_msg}`);
+					}
 				}
 				result.committedBranches.push(branchName);
-				// Remove the worktree (branch persists)
+				// Issue 1 fix: check signal before worktree remove
+				if (options.signal?.aborted) break;
+				// Remove the worktree (branch persists).
+				// NOTE: If git worktree remove fails here after the commit succeeded,
+				// the worktree directory remains on disk orphaned from the branch.
+				// The committed changes are safe in the branch and recoverable via:
+				//   git branch -D <branchName>   (to clean up the branch)
+				//   rm -rf <worktreePath>        (to clean up the orphaned directory)
 				const removeArgs = ["worktree", "remove", "--force", worktreePath];
-				git(manifest.cwd, removeArgs);
-				result.removed.push(worktreePath);
+				// Capture git status before removal since worktree won't exist after successful remove
+				const gitStatusBeforeRemove = git(worktreePath, ["status", "--porcelain"]);
+				try {
+					git(manifest.cwd, removeArgs);
+					result.removed.push(worktreePath);
+				} catch (removeError) {
+					// Commit succeeded but worktree remove failed — directory is orphaned
+					// Issue 1 fix: use fs.rmSync as fallback to clean up orphaned directory
+					try {
+						fs.rmSync(worktreePath, { recursive: true, force: true });
+						result.removed.push(worktreePath);
+					} catch {
+						result.preserved.push({ path: worktreePath, reason: `commit succeeded but worktree remove failed: ${removeError instanceof Error ? removeError.message : String(removeError)}; fs.rmSync fallback also failed` });
+					}
+					const artifact = writeArtifact(manifest.artifactsRoot, {
+						kind: "metadata",
+						relativePath: `metadata/worktree-branch-${safeBranchName}.json`,
+						content: JSON.stringify({ worktreePath, branch: branchName, committedAt: new Date().toISOString(), mergeCommand: `git merge ${branchName}`, gitStatusAtCommit: gitStatusBeforeRemove }, null, 2),
+						producer: "worktree-cleanup",
+					});
+					result.artifactPaths.push(artifact.path);
+					continue;
+				}
 				const artifact = writeArtifact(manifest.artifactsRoot, {
 					kind: "metadata",
-					relativePath: `metadata/worktree-branch-${entry.name}.json`,
-					content: JSON.stringify({ worktreePath, branch: branchName, committedAt: new Date().toISOString(), mergeCommand: `git merge ${branchName}` }, null, 2),
+					relativePath: `metadata/worktree-branch-${safeBranchName}.json`,
+					content: JSON.stringify({ worktreePath, branch: branchName, committedAt: new Date().toISOString(), mergeCommand: `git merge ${branchName}`, gitStatusAtCommit: gitStatusBeforeRemove }, null, 2),
 					producer: "worktree-cleanup",
 				});
 				result.artifactPaths.push(artifact.path);
 			} catch (error) {
 				// Fallback to preserving dirty worktree
+				// FIX: entry is a DirEnt object, must use entry.name
+				const safeFallbackName = sanitizeFilename(entry.name);
 				const artifact = writeArtifact(manifest.artifactsRoot, {
 					kind: "diff",
-					relativePath: `cleanup/${entry}.diff`,
+					relativePath: `cleanup/${safeFallbackName}.diff`,
 					content: captureDiff(worktreePath),
 					producer: "worktree-cleanup",
 				});
@@ -99,6 +170,10 @@ export function cleanupRunWorktrees(manifest: TeamRunManifest, options: { force?
 			}
 			continue;
 		}
+		// Issue 3 fix: sanitize entry.name before using in git commands
+		const safeEntryName = sanitizeBranchPart(entry.name);
+		// Issue 1 fix: check signal before non-dirty worktree remove
+		if (options.signal?.aborted) break;
 		const args = ["worktree", "remove"];
 		if (options.force) args.push("--force");
 		args.push(worktreePath);
@@ -112,9 +187,25 @@ export function cleanupRunWorktrees(manifest: TeamRunManifest, options: { force?
 	}
 
 	try {
-		if (fs.existsSync(worktreeRoot) && fs.readdirSync(worktreeRoot).length === 0) fs.rmSync(worktreeRoot, { recursive: true, force: true });
-	} catch {
+		// Issue 2 fix: run git worktree prune to clean up any orphaned worktree references
+		// after processing all worktrees. This helps clean up directories left orphaned
+		// when git worktree remove failed after a successful commit.
+		git(manifest.cwd, ["worktree", "prune"]);
+	} catch (error) {
 		// Non-critical cleanup.
+		logInternalError("cleanup.worktreePrune", error instanceof Error ? error : new Error(String(error)));
+	}
+	try {
+		// Issue 1 fix: Use rmdirSync which fails atomically on non-empty directories,
+		// avoiding TOCTOU race between readdirSync check and rmSync removal.
+		// Ignore ENOENT (already removed) and ENOTEMPTY (became non-empty between check and remove).
+		fs.rmdirSync(worktreeRoot);
+	} catch (error) {
+		// Non-critical cleanup. Ignore ENOENT and ENOTEMPTY.
+		const code = (error as NodeJS.ErrnoException).code;
+		if (code !== "ENOENT" && code !== "ENOTEMPTY") {
+			// Optionally log unexpected errors in debug mode
+		}
 	}
 	return result;
 }