pi-crew 0.6.0 → 0.6.3

package/src/worktree/worktree-manager.ts

@@ -25,11 +25,16 @@ export interface WorktreeDiffStat {
 }
 
 function git(cwd: string, args: string[]): string {
-	return execFileSync("git", args, { cwd, encoding: "utf-8", stdio: ["ignore", "pipe", "pipe"], env: { ...process.env, LANG: "C", LC_ALL: "C" }, windowsHide: true }).trim();
+	// SECURITY: PI_* and PI_CREW_* wildcards removed — they could match secret vars like PI_PASSWORD.
+// Git operations do not need PI_CREW_* execution-control vars.
+return execFileSync("git", args, { cwd, encoding: "utf-8", stdio: ["ignore", "pipe", "pipe"], env: { ...sanitizeEnvSecrets(process.env, { allowList: ["PATH", "HOME", "USER", "USERPROFILE", "SHELL", "TERM", "LANG", "LC_ALL", "LC_COLLATE", "LC_CTYPE", "LC_MESSAGES", "XDG_CONFIG_HOME", "XDG_DATA_HOME", "XDG_CACHE_HOME", "NVM_BIN", "NVM_DIR", "NODE_PATH", "GIT_CONFIG_GLOBAL", "GIT_CONFIG_SYSTEM", "GIT_AUTHOR_NAME", "GIT_AUTHOR_EMAIL", "GIT_COMMITTER_NAME", "GIT_COMMITTER_EMAIL"] }), LANG: "en_US.UTF-8", LC_ALL: "en_US.UTF-8" }, windowsHide: true }).trim();
 }
 
+// Dots are removed from branch names since they are used in path construction,
+// and dots could cause ambiguity with relative path handling on some platforms.
+// Branch names themselves support dots in git, but we strip them for safe path use.
 function sanitizeBranchPart(value: string): string {
-	return value.toLowerCase().replace(/[^a-z0-9._/-]+/g, "-").replace(/^-+|-+$/g, "") || "task";
+	return value.toLowerCase().replace(/[^a-z0-9_/-]+/g, "-").replace(/^-+|-+$/g, "") || "task";
 }
 
 export function findGitRoot(cwd: string): string {
@@ -64,7 +69,7 @@ function linkNodeModulesIfPresent(repoRoot: string, worktreePath: string): boole
 function normalizeSyntheticPath(worktreePath: string, rawPath: string): string {
 	const resolved = path.resolve(worktreePath, rawPath);
 	const relative = path.relative(worktreePath, resolved);
-	if (!relative || relative === "." || relative.startsWith("..") || path.isAbsolute(relative)) throw new Error(`synthetic path escapes worktree: ${rawPath}`);
+	if (!relative || relative.startsWith("..") || path.isAbsolute(relative)) throw new Error(`synthetic path escapes worktree: ${rawPath}`);
 	return path.normalize(relative);
 }
 
@@ -118,6 +123,12 @@ function runSetupHook(manifest: TeamRunManifest, task: TeamTaskState, repoRoot:
 	}
 	// SECURITY WARNING: Home directory hooks (~/.pi/hooks/) are user-writable and not project-scoped.
 	// A rogue npm postinstall script could place malicious hooks there. Log for visibility.
+	//
+	// SECURITY ASSUMPTION: This function trusts that the hook scripts themselves are not malicious.
+	// Hook scripts are executed with the same privileges as the Pi process. The caller is responsible
+	// for ensuring that only trusted hook scripts are configured. Path containment validation
+	// (isAllowedSetupHook, isHookPathContainedInRepoRoot) prevents hook scripts from writing outside
+	// the worktree, but cannot prevent a trusted hook from performing harmful operations within it.
 	if (path.isAbsolute(rawHookPath)) {
 		logInternalError("worktree.setupHook.homeHook", new Error("Home directory hook used — ensure ~/.pi/hooks/ is trusted"), `hookPath=${rawHookPath}`);
 	}
@@ -128,8 +139,14 @@ function runSetupHook(manifest: TeamRunManifest, task: TeamTaskState, repoRoot:
 		logInternalError("worktree.setupHook.contained", new Error("hook path escapes repoRoot after realpath resolution: " + hookPath), `repoRoot=${repoRoot}`);
 		return [];
 	}
-	if (!fs.existsSync(hookPath) || fs.statSync(hookPath).isDirectory()) {
-		logInternalError("worktree.setupHook.missing", new Error("hook not found or is directory: " + hookPath), `cwd=${manifest.cwd}`);
+	try {
+		const hookStat = fs.lstatSync(hookPath);
+		if (!hookStat.isFile()) {
+			logInternalError("worktree.setupHook.missing", new Error("hook not found or is directory: " + hookPath), `cwd=${manifest.cwd}`);
+			return [];
+		}
+	} catch {
+		logInternalError("worktree.setupHook.missing", new Error("hook not found: " + hookPath), `cwd=${manifest.cwd}`);
 		return [];
 	}
 	const nodeHook = hookPath.endsWith(".js") || hookPath.endsWith(".cjs") || hookPath.endsWith(".mjs");
@@ -142,26 +159,41 @@ function runSetupHook(manifest: TeamRunManifest, task: TeamTaskState, repoRoot:
 	if (process.platform === "win32" && !nodeHook && !isBatchFile) {
 		logInternalError("worktree.setupHook.windowsNoShell", new Error("Non-node, non-batch hook skipped on Windows (shell:true disabled for security)"), `hook=${hookPath}`);
 	}
+	// SECURITY: Resolve the hook to its real path before execution to close the TOCTOU window.
+	// This prevents a symlink swap between the containment check and actual execution.
+	// KNOWN LIMITATION: There is a residual TOCTOU window between realpathSync validation
+	// (line 166) and spawnSync execution (line 183). A sufficiently fast attacker could
+	// theoretically swap the symlink between these two operations. The realpathSync + O_NOFOLLOW
+	// approach minimizes but does not eliminate this window. To fully close it, consider
+	// opening the hook file once via a file descriptor and executing via fd passing (not available
+	// in Node.js spawnSync). This is documented as a known limitation rather than a bug.
+	let realHookPath: string;
+	try {
+		realHookPath = fs.realpathSync(hookPath);
+	} catch {
+		logInternalError("worktree.setupHook.realpath", new Error("hook realpath resolution failed: " + hookPath), `cwd=${manifest.cwd}`);
+		return [];
+	}
 	const result = isBatchFile
-		? spawnSync("cmd.exe", ["/c", hookPath], {
+		? spawnSync("cmd.exe", ["/c", realHookPath], {
 			cwd: worktreePath,
 			encoding: "utf-8",
 			input: JSON.stringify({ version: 1, repoRoot, worktreePath, agentCwd: worktreePath, branch, runId: manifest.runId, taskId: task.id, agent: task.agent }),
 			timeout: cfg.setupHookTimeoutMs ?? 30_000,
 			shell: false,  // cmd.exe /c handles batch files safely
 			env: sanitizeEnvSecrets(process.env, {
-				allowList: ["PATH", "HOME", "USERPROFILE", "TEMP", "TMP", "TMPDIR", "LANG", "LC_ALL", "PI_*"],
+				allowList: ["PATH", "HOME", "USERPROFILE", "TEMP", "TMP", "TMPDIR", "LANG", "LC_ALL"],
 			}),
 			windowsHide: true,
 		})
-		: spawnSync(nodeHook ? process.execPath : hookPath, nodeHook ? [hookPath] : [], {
+		: spawnSync(nodeHook ? process.execPath : realHookPath, nodeHook ? [realHookPath] : [], {
 			cwd: worktreePath,
 			encoding: "utf-8",
 			input: JSON.stringify({ version: 1, repoRoot, worktreePath, agentCwd: worktreePath, branch, runId: manifest.runId, taskId: task.id, agent: task.agent }),
 			timeout: cfg.setupHookTimeoutMs ?? 30_000,
-			shell: useShell,
+			shell: false,
 			env: sanitizeEnvSecrets(process.env, {
-				allowList: ["PATH", "HOME", "USERPROFILE", "TEMP", "TMP", "TMPDIR", "LANG", "LC_ALL", "PI_*"],
+				allowList: ["PATH", "HOME", "USERPROFILE", "TEMP", "TMP", "TMPDIR", "LANG", "LC_ALL"],
 			}),
 			windowsHide: true,
 		});
@@ -226,6 +258,24 @@ export function normalizeSeedPaths(seedPaths: string[], repoRoot: string): strin
 			throw new Error(`seedPaths entries must stay inside repoRoot: ${entry}`);
 		}
 
+		// Reject symlinks to prevent escape via symlink-based path traversal.
+		// This check is also performed in overlaySeedPaths for defense-in-depth.
+		// ENOENT is acceptable — seed paths may reference files that don't exist yet
+		// (they are validated at copy time by overlaySeedPaths).
+		try {
+			const stat = fs.lstatSync(absolutePath);
+			if (stat.isSymbolicLink()) {
+				throw new Error(`seedPaths entries cannot be symlinks: ${entry}`);
+			}
+		} catch (error) {
+			if (error instanceof Error && error.message.startsWith("seedPaths entries")) throw error;
+			// ENOENT is acceptable — seed paths may reference files that don't exist yet.
+			// Skip symlink check but still include the path in results.
+			if (!(error instanceof Error && "code" in error && (error as NodeJS.ErrnoException).code === "ENOENT")) {
+				throw new Error(`seedPaths entries must be accessible: ${entry}`);
+			}
+		}
+
 		const normalizedPath = relativePath.split(path.sep).join("/");
 		if (seen.has(normalizedPath)) continue;
 		seen.add(normalizedPath);
@@ -247,15 +297,27 @@ export function overlaySeedPaths(repoRoot: string, worktreePath: string, seedPat
 		const sourcePath = path.join(repoRoot, seedPath);
 		const destinationPath = path.join(worktreePath, seedPath);
 
-		if (!fs.existsSync(sourcePath)) {
+		let sourceStat: fs.Stats;
+		try {
+			sourceStat = fs.lstatSync(sourcePath);
+		} catch {
 			logInternalError("worktree.seedPaths.missing", new Error(`Seed path does not exist: ${seedPath}`));
 			continue;
 		}
+		// Reject symlinks in seed paths to prevent copying symlinks into worktree (which could point outside repoRoot).
+		if (sourceStat.isSymbolicLink()) {
+			logInternalError("worktree.seedPaths.symlink", new Error(`Seed path is a symlink — rejected: ${seedPath}`));
+			continue;
+		}
+		if (!sourceStat.isFile() && !sourceStat.isDirectory()) {
+			logInternalError("worktree.seedPaths.invalid", new Error(`Seed path is neither file nor directory: ${seedPath}`));
+			continue;
+		}
 
 		fs.mkdirSync(path.dirname(destinationPath), { recursive: true });
 		fs.rmSync(destinationPath, { force: true, recursive: true });
 		fs.cpSync(sourcePath, destinationPath, {
-			dereference: false,
+			dereference: true,
 			force: true,
 			preserveTimestamps: true,
 			recursive: true,
@@ -268,11 +330,44 @@ export function prepareTaskWorkspace(manifest: TeamRunManifest, task: TeamTaskSt
 	const repoRoot = findGitRoot(manifest.cwd);
 	const loadedConfig = loadConfig(manifest.cwd);
 	if (loadedConfig.config.requireCleanWorktreeLeader !== false) assertCleanLeader(repoRoot);
-	const worktreeRoot = path.join(projectCrewRoot(manifest.cwd), DEFAULT_PATHS.state.worktreesSubdir, manifest.runId);
+	const sanitizedRunId = manifest.runId.replace(/[^a-zA-Z0-9._-]/g, "-").replace(/^-+|-+$/g, "") || "run";
+	const worktreeRoot = path.join(projectCrewRoot(manifest.cwd), DEFAULT_PATHS.state.worktreesSubdir, sanitizedRunId);
 	fs.mkdirSync(worktreeRoot, { recursive: true });
-	const worktreePath = path.join(worktreeRoot, task.id);
+	// Resolve through realpathSync.native to get long-name form on Windows.
+	// git worktree uses long-name paths, so we must match. If .native fails,
+	// fall back to non-native (preserves input form).
+	let resolvedWorktreeRoot = worktreeRoot;
+	try {
+		const r = fs.realpathSync.native(worktreeRoot);
+		resolvedWorktreeRoot = r.startsWith("\\\\?\\") ? r.slice(4) : r;
+	} catch {
+		try { resolvedWorktreeRoot = fs.realpathSync(worktreeRoot); } catch { /* keep as-is */ }
+	}
+	const sanitizedTaskId = sanitizeBranchPart(task.id);
+	const worktreePath = path.join(resolvedWorktreeRoot, sanitizedTaskId);
 	const branch = `pi-crew/${sanitizeBranchPart(manifest.runId)}/${sanitizeBranchPart(task.id)}`;
-	if (fs.existsSync(worktreePath)) {
+	// Use `git worktree list --porcelain` to atomically verify the worktree exists.
+	// This avoids a TOCTOU race between fs.existsSync and git branch verification.
+	let worktreeExists = false;
+	try {
+		const worktreeList = git(repoRoot, ["worktree", "list", "--porcelain"]);
+		// `git worktree list --porcelain` outputs "worktree /path" per entry.
+		// We must compare against the path part (after "worktree ").
+		// On Windows, git may return forward-slash long-name paths while
+		// worktreePath uses short-name backslash form. Resolve both through
+		// realpathSync.native (which always returns long-name on Windows)
+		// for consistent comparison.
+		const normalizedWtPath = process.platform === "win32" ? (() => { try { const r = fs.realpathSync.native(worktreePath); return r.startsWith("\\\\?\\") ? r.slice(4) : r; } catch { return worktreePath; } })().replace(/\\/g, "/").toLowerCase() : worktreePath;
+		worktreeExists = worktreeList.split("\n").some((line) => {
+			const trimmed = line.trim();
+			const matchPath = trimmed.startsWith("worktree ") ? trimmed.slice(9) : trimmed;
+			if (process.platform === "win32") {
+				return matchPath.replace(/\\/g, "/").toLowerCase() === normalizedWtPath;
+			}
+			return matchPath === worktreePath;
+		});
+	} catch { worktreeExists = false; }
+	if (worktreeExists) {
 		let currentBranch: string;
 		try {
 			currentBranch = git(worktreePath, ["rev-parse", "--abbrev-ref", "HEAD"]);
@@ -282,16 +377,27 @@ export function prepareTaskWorkspace(manifest: TeamRunManifest, task: TeamTaskSt
 		if (currentBranch !== branch) {
 			throw new Error(`Existing worktree branch mismatch at ${worktreePath}: expected '${branch}', got '${currentBranch}'.`);
 		}
+		// Check for uncommitted changes from previous run before reusing
+		const dirtyStatus = git(worktreePath, ["status", "--porcelain"]);
+		if (dirtyStatus.trim()) {
+			// Discard uncommitted changes to ensure clean slate for new task
+			logInternalError("worktree.reused.dirty", new Error(`Discarding uncommitted changes in reused worktree at ${worktreePath}`), `runId=${manifest.runId}, taskId=${task.id}, dirtyStatus=${dirtyStatus.trim()}`);
+			git(worktreePath, ["checkout", "--", "."]);
+			git(worktreePath, ["clean", "-fd"]);
+		}
 		// Overlay seed paths from config + step-level seedPaths (reused worktree)
 		const globalSeedPaths = loadedConfig.config.worktree?.seedPaths ?? [];
 		const mergedReused = normalizeSeedPaths([...globalSeedPaths, ...(stepSeedPaths ?? [])], repoRoot);
 		if (mergedReused.length > 0) {
 			overlaySeedPaths(repoRoot, worktreePath, mergedReused);
 		}
+		// Re-validate leader is still clean before reusing — leader state may have changed since first preparation
+		assertCleanLeader(repoRoot);
 		return { cwd: worktreePath, worktreePath, branch, reused: true };
 	}
 	pruneStaleWorktrees(repoRoot);
 	const exists = branchExists(repoRoot, branch);
+	let worktreeCreated = false;
 	try {
 		if (exists.local) {
 			git(repoRoot, ["worktree", "add", worktreePath, branch]);
@@ -301,7 +407,14 @@ export function prepareTaskWorkspace(manifest: TeamRunManifest, task: TeamTaskSt
 			}
 			git(repoRoot, ["worktree", "add", "-b", branch, worktreePath, "HEAD"]);
 		}
+		worktreeCreated = true;
 	} catch (error) {
+		// Clean up orphaned worktree directory if git worktree add failed
+		if (fs.existsSync(worktreePath)) {
+			try {
+				fs.rmSync(worktreePath, { recursive: true, force: true });
+			} catch { /* best-effort cleanup */ }
+		}
 		const msg = error instanceof Error ? error.message : String(error);
 		if (/already checked out|is already used by worktree/i.test(msg)) {
 			throw new Error(`Branch '${branch}' is checked out at another worktree. Run \`team cleanup runId=${manifest.runId} force=true\` or manually remove the conflicting worktree.`);

package/test-bugs-all.mjs

@@ -69,13 +69,17 @@ if (completedIdsFix) {
 
 // Check dist file
 console.log("\n=== Checking dist/index.mjs ===");
-const distContent = fs.readFileSync("dist/index.mjs", "utf-8");
-const distNeedsAttention = distContent.includes('t2.status === "completed" || t2.status === "needs_attention"');
-if (distNeedsAttention) {
-    console.log("  ✅ Bug #20 fix is in dist/index.mjs");
+if (fs.existsSync("dist/index.mjs")) {
+	const distContent = fs.readFileSync("dist/index.mjs", "utf-8");
+	const distNeedsAttention = distContent.includes('t2.status === "completed" || t2.status === "needs_attention"');
+	if (distNeedsAttention) {
+		console.log("  ✅ Bug #20 fix is in dist/index.mjs");
+	} else {
+		console.log("  ❌ Bug #20 fix NOT in dist/index.mjs - rebuild needed");
+		allPassed = false;
+	}
 } else {
-    console.log("  ❌ Bug #20 fix NOT in dist/index.mjs - rebuild needed");
-    allPassed = false;
+	console.log("  ⚠️  dist/index.mjs not found - run npm run build first");
 }
 
 console.log("\n" + "=".repeat(40));

package/test-integration-check.ts

@@ -65,7 +65,9 @@ test("fast-fix team run completes successfully with mock child Pi", async () =>
 
 	const prevExec = process.env.PI_TEAMS_EXECUTE_WORKERS;
 	const prevMock = process.env.PI_TEAMS_MOCK_CHILD_PI;
+	const prevAllow = process.env.PI_CREW_ALLOW_MOCK;
 	process.env.PI_TEAMS_EXECUTE_WORKERS = "1";
+	process.env.PI_CREW_ALLOW_MOCK = "1";
 	process.env.PI_TEAMS_MOCK_CHILD_PI = "success";
 
 	try {
@@ -109,6 +111,8 @@ test("fast-fix team run completes successfully with mock child Pi", async () =>
 		else process.env.PI_TEAMS_EXECUTE_WORKERS = prevExec;
 		if (prevMock === undefined) delete process.env.PI_TEAMS_MOCK_CHILD_PI;
 		else process.env.PI_TEAMS_MOCK_CHILD_PI = prevMock;
+		if (prevAllow === undefined) delete process.env.PI_CREW_ALLOW_MOCK;
+		else process.env.PI_CREW_ALLOW_MOCK = prevAllow;
 		fs.rmSync(cwd, { recursive: true, force: true });
 	}
 });