pi-crew 0.9.19 → 0.9.20

package/src/runtime/child-pi.ts

@@ -7,7 +7,7 @@ import { DEFAULT_CHILD_PI } from "../config/defaults.ts";
 import { registerChildProcess, unregisterChildProcess } from "../extension/crew-cleanup.ts";
 import type { WorkerExitStatus } from "../state/types.ts";
 import { WINDOWS_ESSENTIAL_ENV_VARS } from "../utils/env-allowlist.ts";
-import { sanitizeEnvSecrets } from "../utils/env-filter.ts";
+import { buildScopedAllowList, sanitizeEnvSecrets } from "../utils/env-filter.ts";
 import { logInternalError } from "../utils/internal-error.ts";
 import { redactJsonLine, redactSecretString } from "../utils/redaction.ts";
 import { resolveRealContainedPath } from "../utils/safe-paths.ts";
@@ -254,7 +254,53 @@ export interface ChildPiRunResult {
 	intermediateFindings?: string;
 }
 
-export function buildChildPiSpawnOptions(cwd: string, env: NodeJS.ProcessEnv): SpawnOptions {
+// Base allowlist of non-provider env vars always passed to child workers.
+// Provider API keys are injected dynamically via buildScopedAllowList() only
+// when a model is assigned to the task (per-task key scoping).
+const BASE_ALLOWLIST: string[] = [
+	"PATH",
+	"HOME",
+	"USER",
+	"SHELL",
+	"TERM",
+	"LANG",
+	"LC_ALL",
+	"LC_COLLATE",
+	"LC_CTYPE",
+	"LC_MESSAGES",
+	"LC_MONETARY",
+	"LC_NUMERIC",
+	"LC_TIME",
+	"XDG_CONFIG_HOME",
+	"XDG_DATA_HOME",
+	"XDG_CACHE_HOME",
+	"XDG_RUNTIME_DIR",
+	// Windows essentials — see WINDOWS_ESSENTIAL_ENV_VARS (src/utils/env-allowlist.ts).
+	...WINDOWS_ESSENTIAL_ENV_VARS,
+	"NVM_BIN",
+	"NVM_DIR",
+	"NVM_INC",
+	"NODE_DISABLE_COLORS",
+	"NODE_EXTRA_CA_CERTS",
+	"NPM_CONFIG_REGISTRY",
+	"NPM_CONFIG_USERCONFIG",
+	"NPM_CONFIG_GLOBALCONFIG",
+	"PI_CREW_DEPTH",
+	"PI_CREW_MAX_DEPTH",
+	"PI_CREW_INHERIT_PROJECT_CONTEXT",
+	"PI_CREW_INHERIT_SKILLS",
+	"PI_CREW_KIND",
+	"PI_CREW_PARENT_PID",
+	"PI_TEAMS_DEPTH",
+	"PI_TEAMS_MAX_DEPTH",
+	"PI_TEAMS_INHERIT_PROJECT_CONTEXT",
+	"PI_TEAMS_INHERIT_SKILLS",
+	"PI_TEAMS_PI_BIN",
+	"PI_TEAMS_MOCK_CHILD_PI",
+	"PI_CREW_ALLOW_MOCK",
+];
+
+export function buildChildPiSpawnOptions(cwd: string, env: NodeJS.ProcessEnv, model?: string): SpawnOptions {
 	// SECURITY FIX (Issue #1): Validate cwd before passing to spawn.
 	// If cwd comes from an untrusted source (user input, workspace config), a malicious cwd
 	// could cause the child process to operate in an attacker-controlled directory,
@@ -284,81 +330,12 @@ export function buildChildPiSpawnOptions(cwd: string, env: NodeJS.ProcessEnv): S
 	// IMPORTANT: preserve model provider API keys — they are needed by the child Pi to call the LLM.
 	// Also preserve essential non-secret vars (PATH, HOME, USER, etc.) so the child process can function.
 	// Bug #12 fix: essential env vars (PATH, HOME, etc.) are always preserved so child can find npm/node.
-	const filteredEnv = sanitizeEnvSecrets(env, {
-		allowList: [
-			/*
-			 * SECURITY WARNING: All model provider API keys below are passed to EVERY child worker.
-			 * If any child is compromised (e.g. via prompt injection), all listed keys are exposed.
-			 * This is a deliberate trade-off: multi-provider setups require the child Pi process to
-			 * authenticate with whichever provider the model routes to. Reducing keys per-child
-			 * would break multi-provider functionality. Mitigations:
-			 *   - sanitizeEnvSecrets strips all env vars NOT on this list.
-			 *   - Do NOT add wildcards ("*_API_KEY") — only explicit, intended provider keys.
-			 *   - Consider per-task key scoping if the architecture allows it in the future.
-			 *
-			 * MAINTENANCE REQUIREMENT: When new secret env vars are added to the Pi ecosystem,
-			 * they MUST be explicitly added to this allowlist to be passed to child processes.
-			 * A CI check should fail if a secret-like env var (matching patterns like *_API_KEY,
-			 * *_TOKEN, *_SECRET) is detected in the codebase but not present in this list.
-			 */
-			// NOTE: Model provider API keys are NOT needed here — child Pi uses the same
-			// config file as parent Pi. Passing keys via env is a security risk.
-			"PATH",
-			"HOME",
-			"USER",
-			"SHELL",
-			"TERM",
-			"LANG",
-			// FIX: Replaced broad wildcards (LC_*, XDG_*, NVM_*, NODE_*, npm_*) with
-			// specific names. Previously NPM_TOKEN, NODE_ENV=production, NVM_RC_VERSION
-			// all leaked through wildcards.
-			"LC_ALL",
-			"LC_COLLATE",
-			"LC_CTYPE",
-			"LC_MESSAGES",
-			"LC_MONETARY",
-			"LC_NUMERIC",
-			"LC_TIME",
-			"XDG_CONFIG_HOME",
-			"XDG_DATA_HOME",
-			"XDG_CACHE_HOME",
-			"XDG_RUNTIME_DIR",
-			// Windows essentials — see WINDOWS_ESSENTIAL_ENV_VARS (src/utils/env-allowlist.ts).
-			...WINDOWS_ESSENTIAL_ENV_VARS,
-			"NVM_BIN",
-			"NVM_DIR",
-			"NVM_INC",
-			// NODE_PATH is intentionally omitted from the allowlist.
-			// NODE_PATH can reveal user environment information (e.g., NVM paths under $HOME)
-			// and the validation at lines 286-298 only filters to standard system prefixes.
-			// Removing it entirely is cleaner than best-effort filtering.
-			"NODE_DISABLE_COLORS",
-			"NODE_EXTRA_CA_CERTS",
-			"NPM_CONFIG_REGISTRY",
-			"NPM_CONFIG_USERCONFIG",
-			"NPM_CONFIG_GLOBALCONFIG",
-			// FIX: Replace PI_CREW_*/PI_TEAMS_* wildcards with explicit list of
-			// safe vars. Wildcards are fragile — any new secret var would leak.
-			// Only non-secret execution-control vars that children legitimately need.
-			"PI_CREW_DEPTH",
-			"PI_CREW_MAX_DEPTH",
-			"PI_CREW_INHERIT_PROJECT_CONTEXT",
-			"PI_CREW_INHERIT_SKILLS",
-			// PI_CREW_KIND marks this process as a crew sub-agent (vs the user's main session).
-			// doctor --zombies matches it to safely list orphaned sub-agents only.
-			"PI_CREW_KIND",
-			// PI_CREW_PARENT_PID is needed by child-pi's parent-guard (uses
-			// process.kill(pid, 0) liveness check). The PID is not a secret.
-			"PI_CREW_PARENT_PID",
-			"PI_TEAMS_DEPTH",
-			"PI_TEAMS_MAX_DEPTH",
-			"PI_TEAMS_INHERIT_PROJECT_CONTEXT",
-			"PI_TEAMS_INHERIT_SKILLS",
-			"PI_TEAMS_PI_BIN",
-			"PI_TEAMS_MOCK_CHILD_PI",
-			"PI_CREW_ALLOW_MOCK",
-		],
-	});
+	//
+	// PER-TASK KEY SCOPING: when a model is provided, only the env keys for that
+	// provider are injected (via buildScopedAllowList). When no model is given,
+	// only BASE_ALLOWLIST system vars pass through — no provider keys leak.
+	const allowList = model ? buildScopedAllowList(BASE_ALLOWLIST, [model]) : BASE_ALLOWLIST;
+	const filteredEnv = sanitizeEnvSecrets(env, { allowList });
 	// FIX: Removed delete workarounds — with explicit allowlist, these vars
 	// are no longer auto-leaked. The wildcard approach was fragile.
 
@@ -900,10 +877,14 @@ export async function runChildPi(input: ChildPiRunInput): Promise<ChildPiRunResu
 			const child = spawn(
 				spawnSpec.command,
 				spawnSpec.args,
-				buildChildPiSpawnOptions(input.cwd, {
-					...process.env,
-					...built.env,
-				}),
+				buildChildPiSpawnOptions(
+					input.cwd,
+					{
+						...process.env,
+						...built.env,
+					},
+					input.model,
+				),
 			);
 			if (child.pid) {
 				activeChildProcesses.set(child.pid, child);

package/src/runtime/cross-extension-rpc.ts

@@ -1,4 +1,5 @@
 import * as crypto from "node:crypto";
+import { isHmacEnabled, extractSignaturePayload, verifyRpcSignature } from "../extension/rpc-hmac.ts";
 
 export interface EventBus {
 	on(event: string, handler: (data: unknown) => void): () => void;
@@ -47,6 +48,25 @@ function handleRpc<P extends { requestId: string }>(
 		if (!/^[a-zA-Z0-9_-]+$/.test(params.requestId)) {
 			throw new Error("Security: invalid requestId format");
 		}
+		// SECURITY: HMAC signature verification (when enabled).
+		if (isHmacEnabled()) {
+			const sigPayload = extractSignaturePayload(params);
+			if (!sigPayload) {
+				throw new Error("[pi-crew HMAC] Missing HMAC signature in RPC request.");
+			}
+			// Strip HMAC fields before verification (HMAC was signed over original params)
+			const originalParams = { ...params };
+			delete (originalParams as Record<string, unknown>).hmacVersion;
+			delete (originalParams as Record<string, unknown>).hmacOrigin;
+			delete (originalParams as Record<string, unknown>).hmacTimestamp;
+			delete (originalParams as Record<string, unknown>).hmacChannel;
+			delete (originalParams as Record<string, unknown>).hmacNonce;
+			delete (originalParams as Record<string, unknown>).hmacSignature;
+			const verification = verifyRpcSignature(sigPayload, originalParams);
+			if (!verification.valid) {
+				throw new Error(`[pi-crew HMAC] ${verification.reason}`);
+			}
+		}
 		try {
 			const data = await fn(params);
 			const reply: { success: true; data?: unknown } = { success: true };
@@ -72,9 +92,8 @@ export function registerCrewRpcHandlers(deps: RpcDeps): RpcHandle {
 	// operations that create or terminate child processes. Any subscriber on
 	// the shared event bus can emit these events. In a multi-extension
 	// environment, this means a malicious extension could spawn/stop agents.
-	// Mitigation (H-2): require an unguessable per-process token in addition to
-	// the legacy `source` identifier. Log all invocations for audit. A full fix
-	// still requires event-bus-level origin signing.
+	// Mitigations: HMAC origin signing (see rpc-hmac.ts) + per-process token
+	// (H-2) + legacy `source` identifier.
 	const CREW_RPC_SOURCE = "pi-crew";
 	const EXPECTED_TOKEN = getCrewRpcToken();
 

package/src/tools/safe-bash-extension.ts

@@ -14,7 +14,7 @@
 import type { ExtensionAPI } from "@earendil-works/pi-coding-agent";
 import { createBashTool } from "@earendil-works/pi-coding-agent";
 import { Type } from "@sinclair/typebox";
-import { isDangerous } from "./safe-bash.ts";
+import { checkCommand } from "./safe-bash.ts";
 
 export default function safeBashExtension(pi: ExtensionAPI): void {
 	const cwd = process.cwd();
@@ -35,7 +35,7 @@ export default function safeBashExtension(pi: ExtensionAPI): void {
 			),
 		}),
 		async execute(toolCallId, params, signal, onUpdate, ctx) {
-			const danger = isDangerous(params.command);
+			const danger = checkCommand(params.command);
 			if (danger) {
 				return {
 					details: {},

package/src/tools/safe-bash.ts

@@ -403,3 +403,103 @@ export const SAFE_BASH_PRESETS = {
 		allowPatterns: [],
 	},
 };
+
+/**
+ * === Whitelist Mode (opt-in, additive) ===
+ *
+ * A deny-by-default mode that checks the first token of a command against an
+ * explicit allowlist of read-only utilities. Enabled via
+ * `PI_CREW_SAFE_BASH_MODE=whitelist`. When NOT enabled, the legacy blacklist
+ * `isDangerous()` path is used unchanged.
+ */
+
+/** Commands permitted under whitelist mode (read-only utilities only). */
+const WHITELISTED_COMMANDS = new Set<string>([
+	"ls",
+	"cat",
+	"head",
+	"tail",
+	"wc",
+	"grep",
+	"find",
+	"echo",
+	"pwd",
+	"date",
+	"whoami",
+	"uname",
+	"df",
+	"du",
+	"file",
+	"stat",
+]);
+
+/**
+ * Shell operators/metacharacters that could chain or substitute a command past
+ * the first token. Their presence anywhere in the raw command causes the
+ * whitelist check to reject, so e.g. `ls; rm file` cannot smuggle `rm` through
+ * under a permitted first token.
+ */
+const SHELL_METACHARACTER_RE = /[|;&`()<>]|\$\(/;
+
+/**
+ * Simple shell tokenizer: extract the first token (command name) of a command,
+ * respecting single and double quotes. Leading whitespace is skipped. Quote
+ * characters are not included in the returned token (`"ls"` → `ls`). An
+ * UNMATCHED quote is treated as malformed input and returns an empty string,
+ * causing `isAllowedWhitelist()` to reject the command (unmatched quotes can
+ * indicate malformed injection attempts).
+ */
+function shellFirstToken(command: string): string {
+	let i = 0;
+	const len = command.length;
+	while (i < len && /\s/.test(command[i])) i++;
+	let token = "";
+	while (i < len) {
+		const ch = command[i];
+		if (/\s/.test(ch)) break;
+		if (ch === "'" || ch === '"') {
+			const quote = ch;
+			i++;
+			while (i < len && command[i] !== quote) {
+				token += command[i];
+				i++;
+			}
+			// Unmatched quote → malformed input, reject by returning empty string.
+			if (i >= len) return "";
+			i++; // skip closing quote
+			continue;
+		}
+		token += ch;
+		i++;
+	}
+	return token;
+}
+
+/**
+ * Whitelist check (deny-by-default). Returns true only when the command's first
+ * token is in the allowlist AND no shell operators/metacharacters are present.
+ * Quoted first tokens (e.g. `"ls" -la`) are resolved before checking.
+ */
+export function isAllowedWhitelist(command: string): boolean {
+	if (command.trim() === "") return false;
+	if (SHELL_METACHARACTER_RE.test(command)) return false;
+	const firstToken = shellFirstToken(command);
+	if (firstToken === "") return false;
+	return WHITELISTED_COMMANDS.has(firstToken);
+}
+
+/** Current safe-bash mode, controlled by the `PI_CREW_SAFE_BASH_MODE` env var. */
+export function getSafeBashMode(): "blacklist" | "whitelist" {
+	return process.env.PI_CREW_SAFE_BASH_MODE === "whitelist" ? "whitelist" : "blacklist";
+}
+
+/**
+ * Unified command check that dispatches on the active mode.
+ * @returns Error message if the command should be blocked, null if allowed.
+ */
+export function checkCommand(command: string, options: SafeBashOptions = {}): string | null {
+	if (getSafeBashMode() === "whitelist") {
+		return isAllowedWhitelist(command) ? null : "Command blocked by safe_bash whitelist: command not in allowlist";
+	}
+	return isDangerous(command, options);
+}

package/src/utils/env-filter.ts

@@ -21,10 +21,59 @@ const KNOWN_PROVIDER_KEYS = new Set([
 	"ZERODEV_API_KEY",
 ]);
 
+// Map from provider prefix (lowercase) to env var names.
+// Used by providerEnvKeys() to scope API keys per task.
+const PROVIDER_ENV_KEY_MAP: Record<string, string[]> = {
+	minimax: ["MINIMAX_API_KEY", "MINIMAX_GROUP_ID"],
+	openai: ["OPENAI_API_KEY", "OPENAI_ORG_ID"],
+	anthropic: ["ANTHROPIC_API_KEY"],
+	google: ["GOOGLE_API_KEY", "GOOGLE_GENERATIVE_LANGUAGE_API_KEY"],
+	gemini: ["GOOGLE_API_KEY", "GOOGLE_GENERATIVE_LANGUAGE_API_KEY"],
+	azure: ["AZURE_OPENAI_API_KEY", "AZURE_OPENAI_ENDPOINT"],
+	"azure-openai": ["AZURE_OPENAI_API_KEY", "AZURE_OPENAI_ENDPOINT"],
+	aws: ["AWS_ACCESS_KEY_ID", "AWS_SECRET_ACCESS_KEY", "AWS_REGION"],
+	bedrock: ["AWS_ACCESS_KEY_ID", "AWS_SECRET_ACCESS_KEY", "AWS_REGION"],
+	zai: ["ZEU_API_KEY"],
+	zerodev: ["ZERODEV_API_KEY"],
+};
+
 function isKnownProviderKey(key: string): boolean {
 	return KNOWN_PROVIDER_KEYS.has(key);
 }
 
+/**
+ * Extract provider prefix from a model ID string and return the corresponding
+ * env var names. Returns empty array for unknown/custom providers or invalid input.
+ *
+ * @param modelId - Model in "provider/modelId" format (e.g. "openai/gpt-4o")
+ * @returns Array of env var names needed for this provider
+ */
+export function providerEnvKeys(modelId: string | undefined): string[] {
+	if (!modelId) return [];
+	const separatorIndex = modelId.indexOf("/");
+	if (separatorIndex <= 0) return [];
+	const provider = modelId.substring(0, separatorIndex).toLowerCase();
+	return PROVIDER_ENV_KEY_MAP[provider] ?? [];
+}
+
+/**
+ * Build a scoped allowlist that includes system vars + only the provider keys
+ * relevant to the assigned model (and its fallback chain).
+ *
+ * @param baseAllowList - Non-provider system vars to always include
+ * @param models - Model IDs to include provider keys for (primary + fallbacks)
+ * @returns Combined allowlist with scoped provider keys
+ */
+export function buildScopedAllowList(baseAllowList: string[], models: (string | undefined)[]): string[] {
+	const providerKeys = new Set<string>();
+	for (const model of models) {
+		for (const key of providerEnvKeys(model)) {
+			providerKeys.add(key);
+		}
+	}
+	return [...baseAllowList, ...providerKeys];
+}
+
 export interface SanitizeEnvOptions {
 	/** Allow-list of env var names to preserve. Supports trailing glob, e.g. `"PI_*"`. */
 	allowList?: string[];