pi-crew 0.6.1 → 0.6.3

package/src/worktree/cleanup.ts

@@ -6,6 +6,7 @@ import { writeArtifact } from "../state/artifact-store.ts";
 import { projectCrewRoot } from "../utils/paths.ts";
 import { DEFAULT_PATHS } from "../config/defaults.ts";
 import { sanitizeEnvSecrets } from "../utils/env-filter.ts";
+import { logInternalError } from "../utils/internal-error.ts";
 
 export interface WorktreeCleanupResult {
 	removed: string[];
@@ -15,17 +16,33 @@ export interface WorktreeCleanupResult {
 	committedBranches: string[];
 }
 
-const GIT_SAFE_ENV = { ...sanitizeEnvSecrets(process.env, { allowList: ["PATH", "HOME", "USER", "USERPROFILE", "SHELL", "TERM", "LANG", "LC_ALL", "LC_COLLATE", "LC_CTYPE", "LC_MESSAGES", "XDG_CONFIG_HOME", "XDG_DATA_HOME", "XDG_CACHE_HOME", "NVM_BIN", "NVM_DIR", "NODE_PATH", "GIT_CONFIG_GLOBAL", "GIT_CONFIG_SYSTEM", "GIT_AUTHOR_NAME", "GIT_AUTHOR_EMAIL", "GIT_COMMITTER_NAME", "GIT_COMMITTER_EMAIL", "PI_*", "PI_CREW_*"] }), LANG: "C", LC_ALL: "C" };
+// SECURITY: PI_* and PI_CREW_* wildcards removed — they could match secret vars like PI_PASSWORD.
+// Git operations do not need PI_CREW_* execution-control vars.
+const GIT_SAFE_ENV = { ...sanitizeEnvSecrets(process.env, { allowList: ["PATH", "HOME", "USER", "USERPROFILE", "SHELL", "TERM", "LANG", "LC_ALL", "LC_COLLATE", "LC_CTYPE", "LC_MESSAGES", "XDG_CONFIG_HOME", "XDG_DATA_HOME", "XDG_CACHE_HOME", "NVM_BIN", "NVM_DIR", "NODE_PATH", "GIT_CONFIG_GLOBAL", "GIT_CONFIG_SYSTEM", "GIT_AUTHOR_NAME", "GIT_AUTHOR_EMAIL", "GIT_COMMITTER_NAME", "GIT_COMMITTER_EMAIL"] }), LANG: "C", LC_ALL: "C" };
+
+function sanitizeBranchPart(value: string): string {
+	return value.toLowerCase().replace(/[^a-z0-9._/-]+/g, "-").replace(/^-+|-+$/g, "") || "task";
+}
+
+function sanitizeFilename(value: string): string {
+	// Strip control chars and newlines for safe artifact filenames
+	return value.slice(0, 200).replace(/[\x00-\x1f\x7f-\x9f\r\n]+/g, " ");
+}
 
 function git(cwd: string, args: string[]): string {
-	return execFileSync("git", args, { cwd, encoding: "utf-8", stdio: ["ignore", "pipe", "pipe"], env: GIT_SAFE_ENV, windowsHide: true }).trim();
+	try {
+		return execFileSync("git", args, { cwd, encoding: "utf-8", stdio: ["ignore", "pipe", "pipe"], env: GIT_SAFE_ENV, windowsHide: true }).trim();
+	} catch (error) {
+		const message = error instanceof Error ? error.message : String(error);
+		throw new Error(`git ${args.join(" ")} failed: ${message}`);
+	}
 }
 
-function isDirty(worktreePath: string): boolean {
+function isDirty(worktreePath: string): boolean | "error" {
 	try {
 		return git(worktreePath, ["status", "--porcelain"]).trim().length > 0;
 	} catch {
-		return true;
+		return "error";
 	}
 }
 
@@ -39,61 +56,112 @@ function captureDiff(worktreePath: string): string {
 }
 
 export function cleanupRunWorktrees(manifest: TeamRunManifest, options: { force?: boolean; signal?: AbortSignal } = {}): WorktreeCleanupResult {
-	const worktreeRoot = path.join(projectCrewRoot(manifest.cwd), DEFAULT_PATHS.state.worktreesSubdir, manifest.runId);
+	const sanitizedRunId = manifest.runId.replace(/[^a-zA-Z0-9._-]/g, "-").replace(/^-+|-+$/g, "") || "run";
+	const worktreeRoot = path.join(projectCrewRoot(manifest.cwd), DEFAULT_PATHS.state.worktreesSubdir, sanitizedRunId);
 	const result: WorktreeCleanupResult = { removed: [], preserved: [], artifactPaths: [], committedBranches: [] };
 	if (!fs.existsSync(worktreeRoot)) return result;
 
 	// M3 fix: use withFileTypes to avoid race between readdirSync and statSync.
+	// Rely on Dirent.isDirectory() instead of a separate statSync to eliminate TOCTOU window.
 	const withFileTypes = fs.readdirSync(worktreeRoot, { withFileTypes: true });
 	for (const entry of withFileTypes) {
 		if (options.signal?.aborted) break;
 		if (!entry.isDirectory()) continue;
+		// Issue 1 fix: check signal before each git operation to respect abort faster
+		if (options.signal?.aborted) break;
 		const worktreePath = path.join(worktreeRoot, entry.name);
-		try {
-			const stat = fs.statSync(worktreePath);
-			if (!stat.isDirectory()) continue;
-		} catch {
-			// Entry deleted between readdir and stat — skip safely.
-			continue;
-		}
+		if (options.signal?.aborted) break;
 		const dirty = isDirty(worktreePath);
-		const branchName = `pi-crew/${manifest.runId}/${entry.name}`;
+		const branchName = `pi-crew/${manifest.runId}/${sanitizeBranchPart(entry.name)}`;
+		const safeBranchName = sanitizeBranchPart(entry.name);
 		if (dirty) {
+			// Issue 1 fix: check signal before git operations
+			if (options.signal?.aborted) break;
 			// Commit changes to a branch instead of just preserving the worktree
 			try {
+				// Issue 2 fix: verify status before and after add to ensure atomicity
+				const statusBefore = git(worktreePath, ["status", "--porcelain"]);
 				execFileSync("git", ["add", "-A"], { cwd: worktreePath, encoding: "utf-8", stdio: ["ignore", "pipe", "pipe"], env: GIT_SAFE_ENV, windowsHide: true });
+				// Verify no unexpected changes were added (only staged the original dirty files)
+				const statusAfterAdd = git(worktreePath, ["status", "--porcelain"]);
+				if (statusAfterAdd !== statusBefore) {
+					// Something changed between our status check and add - abort to avoid including unexpected changes
+					throw new Error("worktree state changed unexpectedly during add; refusing to commit");
+				}
+				// Issue 1 fix: check signal before commit
+				if (options.signal?.aborted) break;
 				let safeDesc = entry.name.slice(0, 200);
 				// SECURITY: Strip any newlines that could be injected via a malicious worktree name
 				// to prevent newline injection in git commit messages
 				if (safeDesc.includes("\n")) {
-					safeDesc = safeDesc.replace(/[\r\n]+/g, " ");
+					safeDesc = safeDesc.replace(/[\x00-\x08\x0B\x0C\x0E-\x1F\x7F]+/g, " ");
 				}
 				execFileSync("git", ["commit", "-m", `pi-crew: ${safeDesc}`], { cwd: worktreePath, encoding: "utf-8", stdio: ["ignore", "pipe", "pipe"], env: GIT_SAFE_ENV, windowsHide: true });
+				// Issue 1 fix: check signal before branch creation
+				if (options.signal?.aborted) break;
 				// Create branch in the main repo pointing to this worktree's HEAD
+				let branchError: Error | null = null;
 				try {
 					execFileSync("git", ["branch", branchName], { cwd: worktreePath, encoding: "utf-8", stdio: ["ignore", "pipe", "pipe"], env: GIT_SAFE_ENV, windowsHide: true });
-				} catch {
+				} catch (err) {
+					branchError = err instanceof Error ? err : new Error(String(err));
 					// Branch already exists — use timestamp suffix
 					const tsBranch = `${branchName}-${Date.now()}`;
-					execFileSync("git", ["branch", tsBranch], { cwd: worktreePath, encoding: "utf-8", stdio: ["ignore", "pipe", "pipe"], env: GIT_SAFE_ENV, windowsHide: true });
+					try {
+						execFileSync("git", ["branch", tsBranch], { cwd: worktreePath, encoding: "utf-8", stdio: ["ignore", "pipe", "pipe"], env: GIT_SAFE_ENV, windowsHide: true });
+					} catch (err2) {
+						// Both branch attempts failed — accumulate error for outer catch
+						const err2_msg = err2 instanceof Error ? err2.message : String(err2);
+						throw new Error(`branch creation failed (${branchName} already exists): ${branchError.message}; fallback branch also failed: ${err2_msg}`);
+					}
 				}
 				result.committedBranches.push(branchName);
-				// Remove the worktree (branch persists)
+				// Issue 1 fix: check signal before worktree remove
+				if (options.signal?.aborted) break;
+				// Remove the worktree (branch persists).
+				// NOTE: If git worktree remove fails here after the commit succeeded,
+				// the worktree directory remains on disk orphaned from the branch.
+				// The committed changes are safe in the branch and recoverable via:
+				//   git branch -D <branchName>   (to clean up the branch)
+				//   rm -rf <worktreePath>        (to clean up the orphaned directory)
 				const removeArgs = ["worktree", "remove", "--force", worktreePath];
-				git(manifest.cwd, removeArgs);
-				result.removed.push(worktreePath);
+				// Capture git status before removal since worktree won't exist after successful remove
+				const gitStatusBeforeRemove = git(worktreePath, ["status", "--porcelain"]);
+				try {
+					git(manifest.cwd, removeArgs);
+					result.removed.push(worktreePath);
+				} catch (removeError) {
+					// Commit succeeded but worktree remove failed — directory is orphaned
+					// Issue 1 fix: use fs.rmSync as fallback to clean up orphaned directory
+					try {
+						fs.rmSync(worktreePath, { recursive: true, force: true });
+						result.removed.push(worktreePath);
+					} catch {
+						result.preserved.push({ path: worktreePath, reason: `commit succeeded but worktree remove failed: ${removeError instanceof Error ? removeError.message : String(removeError)}; fs.rmSync fallback also failed` });
+					}
+					const artifact = writeArtifact(manifest.artifactsRoot, {
+						kind: "metadata",
+						relativePath: `metadata/worktree-branch-${safeBranchName}.json`,
+						content: JSON.stringify({ worktreePath, branch: branchName, committedAt: new Date().toISOString(), mergeCommand: `git merge ${branchName}`, gitStatusAtCommit: gitStatusBeforeRemove }, null, 2),
+						producer: "worktree-cleanup",
+					});
+					result.artifactPaths.push(artifact.path);
+					continue;
+				}
 				const artifact = writeArtifact(manifest.artifactsRoot, {
 					kind: "metadata",
-					relativePath: `metadata/worktree-branch-${entry.name}.json`,
-					content: JSON.stringify({ worktreePath, branch: branchName, committedAt: new Date().toISOString(), mergeCommand: `git merge ${branchName}` }, null, 2),
+					relativePath: `metadata/worktree-branch-${safeBranchName}.json`,
+					content: JSON.stringify({ worktreePath, branch: branchName, committedAt: new Date().toISOString(), mergeCommand: `git merge ${branchName}`, gitStatusAtCommit: gitStatusBeforeRemove }, null, 2),
 					producer: "worktree-cleanup",
 				});
 				result.artifactPaths.push(artifact.path);
 			} catch (error) {
 				// Fallback to preserving dirty worktree
+				// FIX: entry is a DirEnt object, must use entry.name
+				const safeFallbackName = sanitizeFilename(entry.name);
 				const artifact = writeArtifact(manifest.artifactsRoot, {
 					kind: "diff",
-					relativePath: `cleanup/${entry}.diff`,
+					relativePath: `cleanup/${safeFallbackName}.diff`,
 					content: captureDiff(worktreePath),
 					producer: "worktree-cleanup",
 				});
@@ -102,6 +170,10 @@ export function cleanupRunWorktrees(manifest: TeamRunManifest, options: { force?
 			}
 			continue;
 		}
+		// Issue 3 fix: sanitize entry.name before using in git commands
+		const safeEntryName = sanitizeBranchPart(entry.name);
+		// Issue 1 fix: check signal before non-dirty worktree remove
+		if (options.signal?.aborted) break;
 		const args = ["worktree", "remove"];
 		if (options.force) args.push("--force");
 		args.push(worktreePath);
@@ -115,9 +187,25 @@ export function cleanupRunWorktrees(manifest: TeamRunManifest, options: { force?
 	}
 
 	try {
-		if (fs.existsSync(worktreeRoot) && fs.readdirSync(worktreeRoot).length === 0) fs.rmSync(worktreeRoot, { recursive: true, force: true });
-	} catch {
+		// Issue 2 fix: run git worktree prune to clean up any orphaned worktree references
+		// after processing all worktrees. This helps clean up directories left orphaned
+		// when git worktree remove failed after a successful commit.
+		git(manifest.cwd, ["worktree", "prune"]);
+	} catch (error) {
 		// Non-critical cleanup.
+		logInternalError("cleanup.worktreePrune", error instanceof Error ? error : new Error(String(error)));
+	}
+	try {
+		// Issue 1 fix: Use rmdirSync which fails atomically on non-empty directories,
+		// avoiding TOCTOU race between readdirSync check and rmSync removal.
+		// Ignore ENOENT (already removed) and ENOTEMPTY (became non-empty between check and remove).
+		fs.rmdirSync(worktreeRoot);
+	} catch (error) {
+		// Non-critical cleanup. Ignore ENOENT and ENOTEMPTY.
+		const code = (error as NodeJS.ErrnoException).code;
+		if (code !== "ENOENT" && code !== "ENOTEMPTY") {
+			// Optionally log unexpected errors in debug mode
+		}
 	}
 	return result;
 }

package/src/worktree/worktree-manager.ts

@@ -25,11 +25,16 @@ export interface WorktreeDiffStat {
 }
 
 function git(cwd: string, args: string[]): string {
-	return execFileSync("git", args, { cwd, encoding: "utf-8", stdio: ["ignore", "pipe", "pipe"], env: { ...sanitizeEnvSecrets(process.env, { allowList: ["PATH", "HOME", "USER", "USERPROFILE", "SHELL", "TERM", "LANG", "LC_ALL", "LC_COLLATE", "LC_CTYPE", "LC_MESSAGES", "XDG_CONFIG_HOME", "XDG_DATA_HOME", "XDG_CACHE_HOME", "NVM_BIN", "NVM_DIR", "NODE_PATH", "GIT_CONFIG_GLOBAL", "GIT_CONFIG_SYSTEM", "GIT_AUTHOR_NAME", "GIT_AUTHOR_EMAIL", "GIT_COMMITTER_NAME", "GIT_COMMITTER_EMAIL", "PI_*", "PI_CREW_*"] }), LANG: "C", LC_ALL: "C" }, windowsHide: true }).trim();
+	// SECURITY: PI_* and PI_CREW_* wildcards removed — they could match secret vars like PI_PASSWORD.
+// Git operations do not need PI_CREW_* execution-control vars.
+return execFileSync("git", args, { cwd, encoding: "utf-8", stdio: ["ignore", "pipe", "pipe"], env: { ...sanitizeEnvSecrets(process.env, { allowList: ["PATH", "HOME", "USER", "USERPROFILE", "SHELL", "TERM", "LANG", "LC_ALL", "LC_COLLATE", "LC_CTYPE", "LC_MESSAGES", "XDG_CONFIG_HOME", "XDG_DATA_HOME", "XDG_CACHE_HOME", "NVM_BIN", "NVM_DIR", "NODE_PATH", "GIT_CONFIG_GLOBAL", "GIT_CONFIG_SYSTEM", "GIT_AUTHOR_NAME", "GIT_AUTHOR_EMAIL", "GIT_COMMITTER_NAME", "GIT_COMMITTER_EMAIL"] }), LANG: "en_US.UTF-8", LC_ALL: "en_US.UTF-8" }, windowsHide: true }).trim();
 }
 
+// Dots are removed from branch names since they are used in path construction,
+// and dots could cause ambiguity with relative path handling on some platforms.
+// Branch names themselves support dots in git, but we strip them for safe path use.
 function sanitizeBranchPart(value: string): string {
-	return value.toLowerCase().replace(/[^a-z0-9._/-]+/g, "-").replace(/^-+|-+$/g, "") || "task";
+	return value.toLowerCase().replace(/[^a-z0-9_/-]+/g, "-").replace(/^-+|-+$/g, "") || "task";
 }
 
 export function findGitRoot(cwd: string): string {
@@ -64,7 +69,7 @@ function linkNodeModulesIfPresent(repoRoot: string, worktreePath: string): boole
 function normalizeSyntheticPath(worktreePath: string, rawPath: string): string {
 	const resolved = path.resolve(worktreePath, rawPath);
 	const relative = path.relative(worktreePath, resolved);
-	if (!relative || relative === "." || relative.startsWith("..") || path.isAbsolute(relative)) throw new Error(`synthetic path escapes worktree: ${rawPath}`);
+	if (!relative || relative.startsWith("..") || path.isAbsolute(relative)) throw new Error(`synthetic path escapes worktree: ${rawPath}`);
 	return path.normalize(relative);
 }
 
@@ -118,6 +123,12 @@ function runSetupHook(manifest: TeamRunManifest, task: TeamTaskState, repoRoot:
 	}
 	// SECURITY WARNING: Home directory hooks (~/.pi/hooks/) are user-writable and not project-scoped.
 	// A rogue npm postinstall script could place malicious hooks there. Log for visibility.
+	//
+	// SECURITY ASSUMPTION: This function trusts that the hook scripts themselves are not malicious.
+	// Hook scripts are executed with the same privileges as the Pi process. The caller is responsible
+	// for ensuring that only trusted hook scripts are configured. Path containment validation
+	// (isAllowedSetupHook, isHookPathContainedInRepoRoot) prevents hook scripts from writing outside
+	// the worktree, but cannot prevent a trusted hook from performing harmful operations within it.
 	if (path.isAbsolute(rawHookPath)) {
 		logInternalError("worktree.setupHook.homeHook", new Error("Home directory hook used — ensure ~/.pi/hooks/ is trusted"), `hookPath=${rawHookPath}`);
 	}
@@ -128,8 +139,14 @@ function runSetupHook(manifest: TeamRunManifest, task: TeamTaskState, repoRoot:
 		logInternalError("worktree.setupHook.contained", new Error("hook path escapes repoRoot after realpath resolution: " + hookPath), `repoRoot=${repoRoot}`);
 		return [];
 	}
-	if (!fs.existsSync(hookPath) || fs.statSync(hookPath).isDirectory()) {
-		logInternalError("worktree.setupHook.missing", new Error("hook not found or is directory: " + hookPath), `cwd=${manifest.cwd}`);
+	try {
+		const hookStat = fs.lstatSync(hookPath);
+		if (!hookStat.isFile()) {
+			logInternalError("worktree.setupHook.missing", new Error("hook not found or is directory: " + hookPath), `cwd=${manifest.cwd}`);
+			return [];
+		}
+	} catch {
+		logInternalError("worktree.setupHook.missing", new Error("hook not found: " + hookPath), `cwd=${manifest.cwd}`);
 		return [];
 	}
 	const nodeHook = hookPath.endsWith(".js") || hookPath.endsWith(".cjs") || hookPath.endsWith(".mjs");
@@ -142,26 +159,41 @@ function runSetupHook(manifest: TeamRunManifest, task: TeamTaskState, repoRoot:
 	if (process.platform === "win32" && !nodeHook && !isBatchFile) {
 		logInternalError("worktree.setupHook.windowsNoShell", new Error("Non-node, non-batch hook skipped on Windows (shell:true disabled for security)"), `hook=${hookPath}`);
 	}
+	// SECURITY: Resolve the hook to its real path before execution to close the TOCTOU window.
+	// This prevents a symlink swap between the containment check and actual execution.
+	// KNOWN LIMITATION: There is a residual TOCTOU window between realpathSync validation
+	// (line 166) and spawnSync execution (line 183). A sufficiently fast attacker could
+	// theoretically swap the symlink between these two operations. The realpathSync + O_NOFOLLOW
+	// approach minimizes but does not eliminate this window. To fully close it, consider
+	// opening the hook file once via a file descriptor and executing via fd passing (not available
+	// in Node.js spawnSync). This is documented as a known limitation rather than a bug.
+	let realHookPath: string;
+	try {
+		realHookPath = fs.realpathSync(hookPath);
+	} catch {
+		logInternalError("worktree.setupHook.realpath", new Error("hook realpath resolution failed: " + hookPath), `cwd=${manifest.cwd}`);
+		return [];
+	}
 	const result = isBatchFile
-		? spawnSync("cmd.exe", ["/c", hookPath], {
+		? spawnSync("cmd.exe", ["/c", realHookPath], {
 			cwd: worktreePath,
 			encoding: "utf-8",
 			input: JSON.stringify({ version: 1, repoRoot, worktreePath, agentCwd: worktreePath, branch, runId: manifest.runId, taskId: task.id, agent: task.agent }),
 			timeout: cfg.setupHookTimeoutMs ?? 30_000,
 			shell: false,  // cmd.exe /c handles batch files safely
 			env: sanitizeEnvSecrets(process.env, {
-				allowList: ["PATH", "HOME", "USERPROFILE", "TEMP", "TMP", "TMPDIR", "LANG", "LC_ALL", "PI_*"],
+				allowList: ["PATH", "HOME", "USERPROFILE", "TEMP", "TMP", "TMPDIR", "LANG", "LC_ALL"],
 			}),
 			windowsHide: true,
 		})
-		: spawnSync(nodeHook ? process.execPath : hookPath, nodeHook ? [hookPath] : [], {
+		: spawnSync(nodeHook ? process.execPath : realHookPath, nodeHook ? [realHookPath] : [], {
 			cwd: worktreePath,
 			encoding: "utf-8",
 			input: JSON.stringify({ version: 1, repoRoot, worktreePath, agentCwd: worktreePath, branch, runId: manifest.runId, taskId: task.id, agent: task.agent }),
 			timeout: cfg.setupHookTimeoutMs ?? 30_000,
-			shell: useShell,
+			shell: false,
 			env: sanitizeEnvSecrets(process.env, {
-				allowList: ["PATH", "HOME", "USERPROFILE", "TEMP", "TMP", "TMPDIR", "LANG", "LC_ALL", "PI_*"],
+				allowList: ["PATH", "HOME", "USERPROFILE", "TEMP", "TMP", "TMPDIR", "LANG", "LC_ALL"],
 			}),
 			windowsHide: true,
 		});
@@ -226,6 +258,24 @@ export function normalizeSeedPaths(seedPaths: string[], repoRoot: string): strin
 			throw new Error(`seedPaths entries must stay inside repoRoot: ${entry}`);
 		}
 
+		// Reject symlinks to prevent escape via symlink-based path traversal.
+		// This check is also performed in overlaySeedPaths for defense-in-depth.
+		// ENOENT is acceptable — seed paths may reference files that don't exist yet
+		// (they are validated at copy time by overlaySeedPaths).
+		try {
+			const stat = fs.lstatSync(absolutePath);
+			if (stat.isSymbolicLink()) {
+				throw new Error(`seedPaths entries cannot be symlinks: ${entry}`);
+			}
+		} catch (error) {
+			if (error instanceof Error && error.message.startsWith("seedPaths entries")) throw error;
+			// ENOENT is acceptable — seed paths may reference files that don't exist yet.
+			// Skip symlink check but still include the path in results.
+			if (!(error instanceof Error && "code" in error && (error as NodeJS.ErrnoException).code === "ENOENT")) {
+				throw new Error(`seedPaths entries must be accessible: ${entry}`);
+			}
+		}
+
 		const normalizedPath = relativePath.split(path.sep).join("/");
 		if (seen.has(normalizedPath)) continue;
 		seen.add(normalizedPath);
@@ -247,15 +297,27 @@ export function overlaySeedPaths(repoRoot: string, worktreePath: string, seedPat
 		const sourcePath = path.join(repoRoot, seedPath);
 		const destinationPath = path.join(worktreePath, seedPath);
 
-		if (!fs.existsSync(sourcePath)) {
+		let sourceStat: fs.Stats;
+		try {
+			sourceStat = fs.lstatSync(sourcePath);
+		} catch {
 			logInternalError("worktree.seedPaths.missing", new Error(`Seed path does not exist: ${seedPath}`));
 			continue;
 		}
+		// Reject symlinks in seed paths to prevent copying symlinks into worktree (which could point outside repoRoot).
+		if (sourceStat.isSymbolicLink()) {
+			logInternalError("worktree.seedPaths.symlink", new Error(`Seed path is a symlink — rejected: ${seedPath}`));
+			continue;
+		}
+		if (!sourceStat.isFile() && !sourceStat.isDirectory()) {
+			logInternalError("worktree.seedPaths.invalid", new Error(`Seed path is neither file nor directory: ${seedPath}`));
+			continue;
+		}
 
 		fs.mkdirSync(path.dirname(destinationPath), { recursive: true });
 		fs.rmSync(destinationPath, { force: true, recursive: true });
 		fs.cpSync(sourcePath, destinationPath, {
-			dereference: false,
+			dereference: true,
 			force: true,
 			preserveTimestamps: true,
 			recursive: true,
@@ -268,11 +330,44 @@ export function prepareTaskWorkspace(manifest: TeamRunManifest, task: TeamTaskSt
 	const repoRoot = findGitRoot(manifest.cwd);
 	const loadedConfig = loadConfig(manifest.cwd);
 	if (loadedConfig.config.requireCleanWorktreeLeader !== false) assertCleanLeader(repoRoot);
-	const worktreeRoot = path.join(projectCrewRoot(manifest.cwd), DEFAULT_PATHS.state.worktreesSubdir, manifest.runId);
+	const sanitizedRunId = manifest.runId.replace(/[^a-zA-Z0-9._-]/g, "-").replace(/^-+|-+$/g, "") || "run";
+	const worktreeRoot = path.join(projectCrewRoot(manifest.cwd), DEFAULT_PATHS.state.worktreesSubdir, sanitizedRunId);
 	fs.mkdirSync(worktreeRoot, { recursive: true });
-	const worktreePath = path.join(worktreeRoot, task.id);
+	// Resolve through realpathSync.native to get long-name form on Windows.
+	// git worktree uses long-name paths, so we must match. If .native fails,
+	// fall back to non-native (preserves input form).
+	let resolvedWorktreeRoot = worktreeRoot;
+	try {
+		const r = fs.realpathSync.native(worktreeRoot);
+		resolvedWorktreeRoot = r.startsWith("\\\\?\\") ? r.slice(4) : r;
+	} catch {
+		try { resolvedWorktreeRoot = fs.realpathSync(worktreeRoot); } catch { /* keep as-is */ }
+	}
+	const sanitizedTaskId = sanitizeBranchPart(task.id);
+	const worktreePath = path.join(resolvedWorktreeRoot, sanitizedTaskId);
 	const branch = `pi-crew/${sanitizeBranchPart(manifest.runId)}/${sanitizeBranchPart(task.id)}`;
-	if (fs.existsSync(worktreePath)) {
+	// Use `git worktree list --porcelain` to atomically verify the worktree exists.
+	// This avoids a TOCTOU race between fs.existsSync and git branch verification.
+	let worktreeExists = false;
+	try {
+		const worktreeList = git(repoRoot, ["worktree", "list", "--porcelain"]);
+		// `git worktree list --porcelain` outputs "worktree /path" per entry.
+		// We must compare against the path part (after "worktree ").
+		// On Windows, git may return forward-slash long-name paths while
+		// worktreePath uses short-name backslash form. Resolve both through
+		// realpathSync.native (which always returns long-name on Windows)
+		// for consistent comparison.
+		const normalizedWtPath = process.platform === "win32" ? (() => { try { const r = fs.realpathSync.native(worktreePath); return r.startsWith("\\\\?\\") ? r.slice(4) : r; } catch { return worktreePath; } })().replace(/\\/g, "/").toLowerCase() : worktreePath;
+		worktreeExists = worktreeList.split("\n").some((line) => {
+			const trimmed = line.trim();
+			const matchPath = trimmed.startsWith("worktree ") ? trimmed.slice(9) : trimmed;
+			if (process.platform === "win32") {
+				return matchPath.replace(/\\/g, "/").toLowerCase() === normalizedWtPath;
+			}
+			return matchPath === worktreePath;
+		});
+	} catch { worktreeExists = false; }
+	if (worktreeExists) {
 		let currentBranch: string;
 		try {
 			currentBranch = git(worktreePath, ["rev-parse", "--abbrev-ref", "HEAD"]);
@@ -282,16 +377,27 @@ export function prepareTaskWorkspace(manifest: TeamRunManifest, task: TeamTaskSt
 		if (currentBranch !== branch) {
 			throw new Error(`Existing worktree branch mismatch at ${worktreePath}: expected '${branch}', got '${currentBranch}'.`);
 		}
+		// Check for uncommitted changes from previous run before reusing
+		const dirtyStatus = git(worktreePath, ["status", "--porcelain"]);
+		if (dirtyStatus.trim()) {
+			// Discard uncommitted changes to ensure clean slate for new task
+			logInternalError("worktree.reused.dirty", new Error(`Discarding uncommitted changes in reused worktree at ${worktreePath}`), `runId=${manifest.runId}, taskId=${task.id}, dirtyStatus=${dirtyStatus.trim()}`);
+			git(worktreePath, ["checkout", "--", "."]);
+			git(worktreePath, ["clean", "-fd"]);
+		}
 		// Overlay seed paths from config + step-level seedPaths (reused worktree)
 		const globalSeedPaths = loadedConfig.config.worktree?.seedPaths ?? [];
 		const mergedReused = normalizeSeedPaths([...globalSeedPaths, ...(stepSeedPaths ?? [])], repoRoot);
 		if (mergedReused.length > 0) {
 			overlaySeedPaths(repoRoot, worktreePath, mergedReused);
 		}
+		// Re-validate leader is still clean before reusing — leader state may have changed since first preparation
+		assertCleanLeader(repoRoot);
 		return { cwd: worktreePath, worktreePath, branch, reused: true };
 	}
 	pruneStaleWorktrees(repoRoot);
 	const exists = branchExists(repoRoot, branch);
+	let worktreeCreated = false;
 	try {
 		if (exists.local) {
 			git(repoRoot, ["worktree", "add", worktreePath, branch]);
@@ -301,7 +407,14 @@ export function prepareTaskWorkspace(manifest: TeamRunManifest, task: TeamTaskSt
 			}
 			git(repoRoot, ["worktree", "add", "-b", branch, worktreePath, "HEAD"]);
 		}
+		worktreeCreated = true;
 	} catch (error) {
+		// Clean up orphaned worktree directory if git worktree add failed
+		if (fs.existsSync(worktreePath)) {
+			try {
+				fs.rmSync(worktreePath, { recursive: true, force: true });
+			} catch { /* best-effort cleanup */ }
+		}
 		const msg = error instanceof Error ? error.message : String(error);
 		if (/already checked out|is already used by worktree/i.test(msg)) {
 			throw new Error(`Branch '${branch}' is checked out at another worktree. Run \`team cleanup runId=${manifest.runId} force=true\` or manually remove the conflicting worktree.`);

package/test-bugs-all.mjs

@@ -69,13 +69,17 @@ if (completedIdsFix) {
 
 // Check dist file
 console.log("\n=== Checking dist/index.mjs ===");
-const distContent = fs.readFileSync("dist/index.mjs", "utf-8");
-const distNeedsAttention = distContent.includes('t2.status === "completed" || t2.status === "needs_attention"');
-if (distNeedsAttention) {
-    console.log("  ✅ Bug #20 fix is in dist/index.mjs");
+if (fs.existsSync("dist/index.mjs")) {
+	const distContent = fs.readFileSync("dist/index.mjs", "utf-8");
+	const distNeedsAttention = distContent.includes('t2.status === "completed" || t2.status === "needs_attention"');
+	if (distNeedsAttention) {
+		console.log("  ✅ Bug #20 fix is in dist/index.mjs");
+	} else {
+		console.log("  ❌ Bug #20 fix NOT in dist/index.mjs - rebuild needed");
+		allPassed = false;
+	}
 } else {
-    console.log("  ❌ Bug #20 fix NOT in dist/index.mjs - rebuild needed");
-    allPassed = false;
+	console.log("  ⚠️  dist/index.mjs not found - run npm run build first");
 }
 
 console.log("\n" + "=".repeat(40));

package/test-integration-check.ts

@@ -65,7 +65,9 @@ test("fast-fix team run completes successfully with mock child Pi", async () =>
 
 	const prevExec = process.env.PI_TEAMS_EXECUTE_WORKERS;
 	const prevMock = process.env.PI_TEAMS_MOCK_CHILD_PI;
+	const prevAllow = process.env.PI_CREW_ALLOW_MOCK;
 	process.env.PI_TEAMS_EXECUTE_WORKERS = "1";
+	process.env.PI_CREW_ALLOW_MOCK = "1";
 	process.env.PI_TEAMS_MOCK_CHILD_PI = "success";
 
 	try {
@@ -109,6 +111,8 @@ test("fast-fix team run completes successfully with mock child Pi", async () =>
 		else process.env.PI_TEAMS_EXECUTE_WORKERS = prevExec;
 		if (prevMock === undefined) delete process.env.PI_TEAMS_MOCK_CHILD_PI;
 		else process.env.PI_TEAMS_MOCK_CHILD_PI = prevMock;
+		if (prevAllow === undefined) delete process.env.PI_CREW_ALLOW_MOCK;
+		else process.env.PI_CREW_ALLOW_MOCK = prevAllow;
 		fs.rmSync(cwd, { recursive: true, force: true });
 	}
 });