pi-crew 0.9.35 → 0.9.36

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "pi-crew",
-  "version": "0.9.35",
+  "version": "0.9.36",
   "description": "Pi extension for coordinated AI teams, workflows, worktrees, and async task orchestration",
   "author": "baphuongna",
   "license": "MIT",

package/src/runtime/async-runner.ts

@@ -210,7 +210,7 @@ export const BACKGROUND_RUNNER_ENV_ALLOWLIST: string[] = [
 	// Phase 1.5: worker-thread atomic writer opt-in (RFC 15).
 	"PI_CREW_WORKER_ATOMIC_WRITER",
 	"PI_TEAMS_WORKER_ATOMIC_WRITER",
-	// Phase 1.5 #1: verification env sanitization opt-in (RFC 13 §6).
+	// Phase 1.5 #1: verification env sanitization opt-out (RFC 13 §6).
 	"PI_CREW_VERIFICATION_SANITIZE_ENV",
 	"PI_TEAMS_VERIFICATION_SANITIZE_ENV",
 	"PI_CREW_VERIFICATION_PRESERVE_ENV",

package/src/runtime/verification-gates.ts

@@ -25,8 +25,9 @@ import { redactSecretString } from "../utils/redaction.ts";
  * against adversarial workers; this kills the leak at the source by never
  * giving the verification process the secret in the first place.
  *
- * Opt-in via `PI_CREW_VERIFICATION_SANITIZE_ENV=1` to avoid breaking existing
- * flows whose tests legitimately need API access. Escape hatch:
+ * Opt-out via `PI_CREW_VERIFICATION_SANITIZE_ENV=0` or
+ * `PI_TEAMS_VERIFICATION_SANITIZE_ENV=0` to disable sanitization (e.g. for
+ * tests that legitimately need API access). Escape hatch:
  * `PI_CREW_VERIFICATION_PRESERVE_ENV=KEY1,KEY2,...` lets users explicitly opt
  * specific secrets back in (audited via the allowlist validator).
  */
@@ -62,9 +63,13 @@ const VERIFICATION_ENV_ALLOWLIST: readonly string[] = [
 	"NPM_CONFIG_GLOBALCONFIG",
 ];
 
-/** Whether env sanitization for verification is enabled (env var opt-in). */
+/** Whether env sanitization for verification is enabled (opt-out: enabled by default). */
 export function isVerificationEnvSanitizeEnabled(): boolean {
-	return process.env.PI_CREW_VERIFICATION_SANITIZE_ENV === "1" || process.env.PI_TEAMS_VERIFICATION_SANITIZE_ENV === "1";
+	// Opt-out: explicitly disabled via env var set to '0'.
+	if (process.env.PI_CREW_VERIFICATION_SANITIZE_ENV === "0" || process.env.PI_TEAMS_VERIFICATION_SANITIZE_ENV === "0") {
+		return false;
+	}
+	return true;
 }
 
 /**

package/src/state/instinct-store.ts

@@ -1,6 +1,7 @@
 import { randomUUID } from "node:crypto";
 import * as fs from "node:fs";
 import * as path from "node:path";
+import { assertSafePathId } from "../utils/safe-paths.ts";
 
 /**
  * Represents a learned instinct that guides agent behavior.
@@ -120,6 +121,7 @@ export class InstinctStore {
 			if (!savedInstinct.projectId) {
 				throw new Error("Project-scoped instinct requires a projectId");
 			}
+			assertSafePathId("projectId", savedInstinct.projectId);
 			this.appendInstinctToFile(this.getProjectInstinctPath(savedInstinct.projectId), savedInstinct);
 		}
 
@@ -163,6 +165,7 @@ export class InstinctStore {
 	 * @returns Array of instincts for the project
 	 */
 	getProjectInstincts(projectId: string): Instinct[] {
+		assertSafePathId("projectId", projectId);
 		const projectInstincts = this.readInstinctsFromFile(this.getProjectInstinctPath(projectId));
 		const globalInstincts = this.readInstinctsFromFile(this.getGlobalInstinctPath());
 		return [...projectInstincts, ...globalInstincts];
@@ -183,6 +186,7 @@ export class InstinctStore {
 				.readdirSync(projectsDir, { withFileTypes: true })
 				.filter((e) => e.isDirectory())
 				.map((e) => e.name)) {
+				assertSafePathId("projectId", projectId);
 				const filePath = path.join(projectsDir, projectId, INSTINCT_FILE);
 				const instincts = this.readInstinctsFromFile(filePath);
 				const index = instincts.findIndex((i) => i.id === instinctId);
@@ -239,6 +243,7 @@ export class InstinctStore {
 				.readdirSync(projectsDir, { withFileTypes: true })
 				.filter((e) => e.isDirectory())
 				.map((e) => e.name)) {
+				assertSafePathId("projectId", projectId);
 				const filePath = path.join(projectsDir, projectId, INSTINCT_FILE);
 				instincts = this.readInstinctsFromFile(filePath);
 				index = instincts.findIndex((i) => i.id === instinctId);

package/src/workflows/intermediate-store.ts

@@ -56,6 +56,11 @@ export function ensureIntermediateDir(config: Partial<IntermediateStoreConfig> =
  * @returns Path to the written file
  */
 export function writeIntermediate(config: Partial<IntermediateStoreConfig>, phase: string, stepId: string, data: unknown): string {
+	// Security: validate phase/stepId before building the filename to prevent
+	// path traversal via poisoned phase or stepId.
+	if (!isSafePathId(phase) || !isSafePathId(stepId)) {
+		throw new Error("Invalid phase or stepId for intermediate store");
+	}
 	const dir = ensureIntermediateDir(config);
 	const filename = `${phase}-${stepId}.json`;
 	const filePath = path.join(dir, filename);