perf(executor): recover approved steps on engine restart

When the engine restarts mid-step, an in-progress step may have already
passed plan + code review but not yet been flipped to done by the agent's
next task_update call. Previously, the next executor pass re-entered the
step and replayed both reviews — measured at 5-20 min of pure waste per
restart (observed in FN-2215 Step 1 and FN-2207 Step 6).

recoverApprovedStepsOnResume scans the task log for any in-progress step
whose most recent "code review Step N: APPROVE" entry is newer than its
most recent "Step N → pending" transition, and marks those steps done
before execute() runs. Safely skips steps that were reset after approval
(e.g. by a workflow revision) or only received REVISE verdicts.

Called from both the engine-restart path (resumeOrphaned) and the
unpause path, matching the two places the task log shows as vulnerable
to this race.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

packages/core/src/store.ts

@@ -31,6 +31,53 @@ const TASK_ACTIVITY_LOG_OUTCOME_LIMIT = 4_000;
 const ARCHIVE_AGENT_LOG_SNAPSHOT_LIMIT = 25;
 const ARCHIVE_AGENT_LOG_SNIPPET_LIMIT = 160;
 
+/**
+ * Reject branch names that would be unsafe to interpolate into a shell command.
+ * The allowed set is a conservative subset of git's refname rules: alphanumerics,
+ * `_`, `.`, `/`, `+`, and `-`, with the same leading/trailing/segment restrictions
+ * git enforces. Any branch that fails this check is rejected before reaching the
+ * shell, so no branch-name value can inject shell metacharacters.
+ */
+function assertSafeGitBranchName(name: string): void {
+  if (
+    !name ||
+    name.length > 255 ||
+    name.startsWith("-") ||
+    name.startsWith(".") ||
+    name.startsWith("/") ||
+    name.endsWith("/") ||
+    name.endsWith(".") ||
+    name.endsWith(".lock") ||
+    name.includes("..") ||
+    name.includes("@{") ||
+    !/^[A-Za-z0-9._/+-]+$/.test(name)
+  ) {
+    throw new Error(`Unsafe git branch name: ${JSON.stringify(name)}`);
+  }
+}
+
+/**
+ * Reject filesystem paths that would be unsafe to interpolate into a shell
+ * command. Worktree paths are generated by fusion itself and are expected to
+ * be absolute, but `task.worktree` is writable via the authenticated API, so
+ * validate at the shell boundary as defense-in-depth.
+ */
+function assertSafeAbsolutePath(path: string): void {
+  const isAbsolute = path.startsWith("/") || /^[A-Za-z]:[\\/]/.test(path);
+  if (
+    !path ||
+    path.length > 4096 ||
+    !isAbsolute ||
+    path.startsWith("-") ||
+    // Reject shell metacharacters, quotes, control chars, and NULs.
+    /["'`$\n\r\t;&|<>()*?\[\]{}\\\0]/.test(
+      path.replace(/^[A-Za-z]:/, ""), // ignore the drive-letter colon on Windows
+    )
+  ) {
+    throw new Error(`Unsafe path: ${JSON.stringify(path)}`);
+  }
+}
+
 function truncateTaskLogOutcome(outcome: string | undefined): string | undefined {
   if (!outcome || outcome.length <= TASK_ACTIVITY_LOG_OUTCOME_LIMIT) {
     return outcome;
@@ -2916,6 +2963,13 @@ export class TaskStore extends EventEmitter<TaskStoreEvents> {
 
     const deleted: string[] = [];
     for (const branch of branches) {
+      try {
+        assertSafeGitBranchName(branch);
+      } catch {
+        // Skip branches whose names would be unsafe to pass through a shell.
+        // A malformed stored value should not become a command-injection vector.
+        continue;
+      }
       const verify = await this.runGitCommand(`git rev-parse --verify "${branch}"`);
       if (verify.exitCode !== 0) {
         continue;
@@ -3034,6 +3088,9 @@ export class TaskStore extends EventEmitter<TaskStoreEvents> {
       const dir = this.taskDir(id);
       const task = await this.readTaskJson(dir);
       const branch = `fusion/${id.toLowerCase()}`;
+      // Branch is derived from the task id (already validated at create time),
+      // but assert as defense-in-depth against future id-format changes.
+      assertSafeGitBranchName(branch);
 
       if (task.column === "done") {
         const result: MergeResult = {
@@ -3048,6 +3105,7 @@ export class TaskStore extends EventEmitter<TaskStoreEvents> {
         const changed = this.clearDoneTransientFields(task);
 
         if (worktreePath && existsSync(worktreePath)) {
+          assertSafeAbsolutePath(worktreePath);
           const removeWorktree = await this.runGitCommand(`git worktree remove "${worktreePath}" --force`, 120_000);
           if (removeWorktree.exitCode === 0) {
             result.worktreeRemoved = true;
@@ -3130,6 +3188,7 @@ export class TaskStore extends EventEmitter<TaskStoreEvents> {
 
       // 3. Remove worktree
       if (worktreePath && existsSync(worktreePath)) {
+        assertSafeAbsolutePath(worktreePath);
         const removeWorktree = await this.runGitCommand(`git worktree remove "${worktreePath}" --force`, 120_000);
         if (removeWorktree.exitCode === 0) {
           result.worktreeRemoved = true;