pi-crew 0.6.1 → 0.6.3

package/src/hooks/registry.ts

@@ -5,19 +5,42 @@ import { runEventBus } from "../ui/run-event-bus.ts";
 
 const registry = new Map<HookName, HookDefinition[]>();
 
+// Track hook IDs registered by pi-crew for scope-aware cleanup
+const _piCrewHookIds = new Set<number>();
+let _nextHookId = 1;
+
 // SECURITY: Hooks are currently global (registered once, applied to all workspaces).
 // For multi-workspace environments, consider filtering hooks by workspace scope:
 //   const workspaceHooks = getHooks(name).filter(h => !h.workspaceId || h.workspaceId === ctx.workspaceId);
 // This prevents globally-registered hooks from operating on runs they weren't designed for.
 
-export function registerHook(definition: HookDefinition): void {
+export function registerHook(definition: HookDefinition): number {
+	const hookId = _nextHookId++;
+	_piCrewHookIds.add(hookId);
 	const hooks = registry.get(definition.name) ?? [];
-	hooks.push(definition);
+	hooks.push({ ...definition, _hookId: hookId });
 	registry.set(definition.name, hooks);
+	return hookId;
 }
 
 export function clearHooks(): void {
 	registry.clear();
+	_piCrewHookIds.clear();
+	_nextHookId = 1;
+}
+
+// Scope-aware hook clearing: only removes hooks registered by pi-crew
+export function clearHooksScoped(): void {
+	for (const [name, hooks] of registry) {
+		const remaining = hooks.filter((h) => !("_hookId" in h && _piCrewHookIds.has((h as { _hookId?: number })._hookId ?? -1)));
+		if (remaining.length === 0) {
+			registry.delete(name);
+		} else {
+			registry.set(name, remaining);
+		}
+	}
+	_piCrewHookIds.clear();
+	_nextHookId = 1;
 }
 
 export function getHooks(name: HookName): HookDefinition[] {
@@ -27,28 +50,69 @@ export function getHooks(name: HookName): HookDefinition[] {
 export async function executeHook(name: HookName, ctx: HookContext): Promise<HookExecutionReport> {
 	const hooks = getHooks(name);
 	if (hooks.length === 0) return { hookName: name, outcome: "allow", durationMs: 0 };
-	// SECURITY: If ctx contains a workspaceId, filter hooks to only those scoped to
-	// this workspace. This prevents globally-registered hooks from operating on runs
-	// they weren't designed for.
-	// SECURITY: Hooks without workspaceId match ALL workspaces. This is intentional
-	// for globally-applicable hooks (e.g., logging, metrics). For multi-tenant
-	// environments, all hooks should set workspaceId to prevent cross-workspace access.
-	const scopedHooks = hooks.filter((h) => !h.workspaceId || h.workspaceId === ctx.workspaceId);
+	// SECURITY: Filter hooks by workspace scope.
+	//   - Global hooks (no workspaceId) match all contexts UNLESS ctx explicitly
+	//     opts out via `includeGlobalHooks: false`. This is the documented
+	//     behavior: "Hooks without workspaceId match ALL workspaces".
+	//   - Scoped hooks (workspaceId set) require an exact match with ctx.workspaceId.
+	//   - If ctx has no workspaceId, scoped hooks are excluded (they can't match).
+	//   - `includeGlobalHooks: true` on ctx forces inclusion of global hooks even
+	//     when ctx has a workspaceId.
+	const scopedHooks = hooks.filter((h) => {
+		// Scoped hook: must match ctx.workspaceId exactly
+		if (h.workspaceId !== undefined) {
+			return h.workspaceId === ctx.workspaceId;
+		}
+		// Global hook (no workspaceId): include unless ctx explicitly excludes
+		return ctx.includeGlobalHooks !== false;
+	});
 	if (scopedHooks.length === 0) return { hookName: name, outcome: "allow", durationMs: 0 };
-	const POLLUTED_KEYS = new Set(["__proto__", "constructor", "prototype"]);
+	const POLLUTED_KEYS = new Set(["__proto__", "constructor", "prototype", "hasOwnProperty", "toString", "valueOf", "isPrototypeOf", "propertyIsEnumerable", "__defineGetter__", "__defineSetter__", "__lookupGetter__", "__lookupSetter__"].map((k) => k.toLowerCase().normalize("NFKC")));
 	function sanitizeMergeData(data: Record<string, unknown>): Record<string, unknown> {
 		const clean: Record<string, unknown> = {};
 		for (const [k, v] of Object.entries(data)) {
-			if (!POLLUTED_KEYS.has(k)) clean[k] = v;
+			if (!POLLUTED_KEYS.has(k.toLowerCase())) {
+				if (v !== null && typeof v === "object") {
+					if (Array.isArray(v)) {
+						// Sanitize array elements that are objects
+						clean[k] = v.map((item) => (item !== null && typeof item === "object" && !Array.isArray(item) ? sanitizeMergeData(item as Record<string, unknown>) : item));
+					} else {
+						clean[k] = sanitizeMergeData(v as Record<string, unknown>);
+					}
+				} else {
+					clean[k] = v;
+				}
+			}
 		}
 		return clean;
 	}
+	// Sanitize ctx by stripping dangerous property names before passing to handlers.
+	// Hook authors must NOT set these keys directly on ctx: [...POLLUTED_KEYS]
+	// This sanitization runs at the start of executeHook to prevent prototype pollution attacks.
+	function sanitizeContext(ctx: HookContext): HookContext {
+		for (const key of Object.keys(ctx)) {
+			if (POLLUTED_KEYS.has(key.toLowerCase())) {
+				delete ctx[key];
+			}
+		}
+		return ctx;
+	}
+	function sanitizeErrorMessage(message: string): string {
+		// Remove file paths, environment variable references, and other potentially sensitive data
+		return message
+			.replace(/\/[^:\s]+/g, "[path]")
+			.replace(/\b[A-Z_0-9]+\s*=/g, "[env]")
+			.replace(/\b\d+\.\d+\.\d+\.\d+\b/g, "[ip]");
+	}
 	const start = Date.now();
 	const diagnostics: string[] = [];
 	let capturedModifications: Record<string, unknown> | undefined;
 	for (const hook of scopedHooks) {
 			try {
-				const result: HookResult = await hook.handler(ctx);
+				const result: HookResult = await hook.handler(sanitizeContext(ctx));
+				// SECURITY: Sanitize any direct mutations the handler may have made to ctx.
+				// This prevents hooks from injecting dangerous properties via direct ctx assignment.
+				sanitizeContext(ctx);
 				if (hook.mode === "blocking" && result.outcome === "block") {
 					return { hookName: name, outcome: "block", durationMs: Date.now() - start, reason: result.reason };
 				}
@@ -57,7 +121,7 @@ export async function executeHook(name: HookName, ctx: HookContext): Promise<Hoo
 				capturedModifications = { ...result.data };
 			}
 		} catch (error) {
-			const message = error instanceof Error ? error.message : String(error);
+			const message = sanitizeErrorMessage(error instanceof Error ? error.message : String(error));
 			if (hook.mode === "blocking") {
 				return { hookName: name, outcome: "block", durationMs: Date.now() - start, reason: `Hook error: ${message}` };
 			}

package/src/hooks/types.ts

@@ -31,6 +31,13 @@ export interface HookContext {
 	runId: string;
 	taskId?: string;
 	cwd: string;
+	// NOTE: Hooks receive a shared mutable context object. A hook may directly set
+	// properties on ctx, but MUST NOT set dangerous names like "__proto__",
+	// "constructor", "prototype", etc. (see registry.ts POLLUTED_KEYS).
+	// Hook authors are trusted but must avoid prototype pollution attacks.
+	// The sanitizeMergeData function prevents dangerous properties from propagating
+	// via result.data merge, and a runtime guard sanitizes ctx before passing to
+	// handlers AND after handler execution to catch direct mutations.
 	[key: string]: unknown;
 }
 
@@ -47,6 +54,8 @@ export interface HookDefinition {
 	// SECURITY: Optional workspace scoping. When set, the hook only executes for
 	// runs in the specified workspace. When absent, the hook applies to all runs.
 	workspaceId?: string;
+	/** @internal Internal hook ID for scope-aware cleanup. */
+	_hookId?: number;
 }
 
 export interface HookExecutionReport {

package/src/plugins/plugin-define.ts

@@ -0,0 +1,6 @@
+/**
+ * Simplifies plugin struct definition.
+ */
+export function definePlugin<T extends { name: string; enablers: readonly string[] }>(spec: T): T {
+  return spec;
+}

package/src/plugins/plugin-registry.ts

@@ -0,0 +1,32 @@
+export interface Plugin {
+  readonly name: string;
+  readonly enablers: readonly string[];
+  readonly entryPatterns?: readonly string[];
+  readonly configPatterns?: readonly string[];
+  readonly toolingDependencies?: readonly string[];
+  readonly pathAliases?: readonly string[][];
+  readonly virtualModulePrefixes?: readonly string[];
+}
+
+export class PluginRegistry {
+  private plugins: Plugin[] = [];
+
+  register(plugin: Plugin): void {
+    this.plugins.push(plugin);
+  }
+
+  activePlugins(allDeps: string[]): Plugin[] {
+    return this.plugins.filter((p) =>
+      p.enablers.some((enabler) => {
+        if (enabler.endsWith("/")) {
+          return allDeps.some((d) => d.startsWith(enabler));
+        }
+        return allDeps.includes(enabler);
+      }),
+    );
+  }
+
+  allPlugins(): Plugin[] {
+    return [...this.plugins];
+  }
+}

package/src/plugins/plugins/index.ts

@@ -0,0 +1,3 @@
+export { NextJsPlugin } from "./nextjs.ts";
+export { VitestPlugin } from "./vitest.ts";
+export { VitePlugin } from "./vite.ts";

package/src/plugins/plugins/nextjs.ts

@@ -0,0 +1,19 @@
+import { definePlugin } from "../plugin-define.ts";
+
+export const NextJsPlugin = definePlugin({
+  name: "nextjs",
+  enablers: ["next"],
+  entryPatterns: [
+    "src/app/**/*.{ts,tsx}",
+    "src/pages/**/*.{ts,tsx}",
+    "src/app/**/page.{ts,tsx}",
+    "src/app/**/layout.{ts,tsx}",
+    "src/app/**/route.{ts,tsx}",
+    "middleware.{ts,js}",
+    "next.config.{ts,js,mjs}",
+  ],
+  configPatterns: ["next.config.{ts,js,mjs}"],
+  toolingDependencies: ["next", "@next/font", "@next/mdx"],
+  pathAliases: [["~", "src"]],
+  virtualModulePrefixes: ["next:"],
+});

package/src/plugins/plugins/vite.ts

@@ -0,0 +1,14 @@
+import { definePlugin } from "../plugin-define.ts";
+
+export const VitePlugin = definePlugin({
+  name: "vite",
+  enablers: ["vite", "rolldown-vite"],
+  entryPatterns: [
+    "src/main.{ts,tsx,js,jsx}",
+    "src/index.{ts,tsx,js,jsx}",
+    "index.html",
+  ],
+  configPatterns: ["vite.config.{ts,js,mts,mjs}"],
+  toolingDependencies: ["vite"],
+  virtualModulePrefixes: ["virtual:"],
+});

package/src/plugins/plugins/vitest.ts

@@ -0,0 +1,14 @@
+import { definePlugin } from "../plugin-define.ts";
+
+export const VitestPlugin = definePlugin({
+  name: "vitest",
+  enablers: ["vitest"],
+  entryPatterns: [
+    "**/*.test.{ts,tsx}",
+    "**/*.spec.{ts,tsx}",
+    "src/**/*.test.{ts,tsx}",
+    "src/**/*.spec.{ts,tsx}",
+  ],
+  configPatterns: ["vitest.config.{ts,js,mjs}", "vite.config.ts"],
+  toolingDependencies: ["vitest"],
+});

package/src/runtime/async-runner.ts

@@ -6,6 +6,10 @@ import { fileURLToPath, pathToFileURL } from "node:url";
 import { logInternalError } from "../utils/internal-error.ts";
 import { appendEvent } from "../state/event-log.ts";
 import { sanitizeEnvSecrets } from "../utils/env-filter.ts";
+import {
+	registerWorker,
+	unregisterWorker,
+} from "./orphan-worker-registry.ts";
 import type { TeamRunManifest } from "../state/types.ts";
 
 
@@ -179,15 +183,24 @@ export async function spawnBackgroundTeamRun(manifest: TeamRunManifest): Promise
 			"NPM_CONFIG_REGISTRY",
 			"NPM_CONFIG_USERCONFIG",
 			"NPM_CONFIG_GLOBALCONFIG",
-			"PI_*",
-			"PI_CREW_*",
-			"PI_TEAMS_*",
+			// FIX: explicit list matches child-pi.ts to prevent regression.
+			// PI_CREW_PARENT_PID is needed for parent-guard (liveness check).
+			"PI_CREW_DEPTH",
+			"PI_CREW_MAX_DEPTH",
+			"PI_CREW_INHERIT_PROJECT_CONTEXT",
+			"PI_CREW_INHERIT_SKILLS",
+			"PI_CREW_PARENT_PID",
+			"PI_TEAMS_DEPTH",
+			"PI_TEAMS_MAX_DEPTH",
+			"PI_TEAMS_INHERIT_PROJECT_CONTEXT",
+			"PI_TEAMS_INHERIT_SKILLS",
+			"PI_TEAMS_PI_BIN",
+			"PI_TEAMS_MOCK_CHILD_PI",
+			"PI_CREW_ALLOW_MOCK",
 		],
 	});
-	// Block execution control vars from leaking
-	delete filteredEnv.PI_CREW_PARENT_PID;
-	delete filteredEnv.PI_CREW_EXECUTE_WORKERS;
-	delete filteredEnv.PI_TEAMS_EXECUTE_WORKERS;
+	// FIX: removed delete workarounds — with explicit allowlist, these vars
+	// are no longer auto-leaked. Matches child-pi.ts.
 
 	const loader = resolveTypeScriptLoader();
 	if (!loader) {
@@ -223,6 +236,21 @@ export async function spawnBackgroundTeamRun(manifest: TeamRunManifest): Promise
 	});
 	child.unref();
 
+	// Track this worker in the orphan registry so it can be killed on
+	// session_start of a future session if the parent pi process is killed.
+	if (child.pid) {
+		registerWorker(
+			child.pid,
+			manifest.ownerSessionId ?? "unknown",
+			manifest.runId,
+			process.pid, // parentPid — used by cleanup to verify session is dead
+		);
+		// Best-effort: unregister when child exits. Background-runner writes
+		// the marker file before it dies, so we unregister on the next
+		// cleanup tick. But the child "exit" event won't fire because we
+		// unref'd and the stdio is piped + ignored.
+	}
+
 	return { pid: child.pid, logPath };
 }