@principles/pd-cli 1.133.0 → 1.135.0

package/src/services/rulehost-pipeline-runner.ts

@@ -45,6 +45,11 @@ import {
   DEFAULT_MAX_ROUNDS,
   SqliteApprovalQueueStore,
   getChannelRiskLevel,
+  // PRI-510: feature-flag resolvers imported from the core barrel (EP-02:
+  // pd-config-loader.ts only re-exports loadPdConfig + computeFlagsFromLoadResult;
+  // computeFeatureFlagsFromConfig / isFeatureEnabled live in core).
+  computeFeatureFlagsFromConfig,
+  isFeatureEnabled,
 } from '@principles/core/runtime-v2';
 import type {
   AdversarialLoopResult,
@@ -53,10 +58,30 @@ import type {
   RefinerRuleHostGateDeps,
   PIArtifactStore,
   ApprovalRecord,
+  BehaviorExamplePack,
+  // PRI-510: type-only import for the repair-loop deps contract (EP-02 wiring).
+  // RuntimeStateManager / StoreEventEmitter are already imported as values
+  // above; EvaluatorValidator is type-only.
+  EvaluatorRunnerDeps,
+  SeedArtificerRepairParams,
+  EvaluatorValidator,
 } from '@principles/core/runtime-v2';
+import { randomUUID, createHash } from 'node:crypto';
+import { loadPdConfig } from './pd-config-loader.js';
 /* eslint-disable @typescript-eslint/no-use-before-define -- helpers declared after main, matching codebase convention */
 import { compileDemoRule } from './demo-rule-compiler.js';
 
+/**
+ * Layer 0 content-hash function for the internalization progressive
+ * disclosure (design §6.1). Core never imports `node:crypto`, so the plugin/CLI
+ * layer injects the algorithm. Consumed only when the
+ * `artifact_summary_redundancy` flag is on; harmless otherwise.
+ *
+ * Exported so other CLI command modules (e.g. `runtime-internalization-run-once`)
+ * can reuse the same algorithm without each re-importing `node:crypto`.
+ */
+export const contentHashFn = (input: string): string => createHash('sha256').update(input).digest('hex');
+
 // ── Types ────────────────────────────────────────────────────────────────────
 
 /**
@@ -113,6 +138,10 @@ export interface RuleHostPipelineOptions {
    * capability is treated as OFF with reason 'code_rule_capability not provided'.
    */
   readonly codeRuleCapability?: CodeRuleCapability;
+  /** Explicit Artificer contract selected by the workspace feature flag. */
+  readonly contextMode?: 'v1' | 'v2';
+  /** Required in v2 mode; assembled from Owner-labelled production evidence. */
+  readonly behaviorExamplePack?: BehaviorExamplePack;
   /** Internalization channel for created tasks (default 'code_tool_hook'). */
   readonly channel?: 'prompt' | 'code_tool_hook' | 'defer_archive';
   /** Max adversarial rounds (PRD cap = 2). */
@@ -286,7 +315,7 @@ export async function runRuleHostPipeline(opts: RuleHostPipelineOptions): Promis
       stages.push({ name: 'dreamer', taskId: dreamerSeedTaskId, status: 'succeeded' });
     } else {
       const dreamerRunner = new DreamerRunner(
-        { stateManager, runtimeAdapter: agentAdapters.dreamer, eventEmitter, validator: new DefaultDreamerValidator(), artifactStore },
+        { stateManager, runtimeAdapter: agentAdapters.dreamer, eventEmitter, validator: new DefaultDreamerValidator(), artifactStore, contentHashFn },
         runnerOptsFor(agentAdapters.dreamer),
       );
       const dreamerResult = await runStage(dreamerRunner, dreamerSeedTaskId, { maxStageRetries, pollIntervalMs });
@@ -303,7 +332,7 @@ export async function runRuleHostPipeline(opts: RuleHostPipelineOptions): Promis
     const philosopherTaskId = `${correlation}-philosopher-${Date.now().toString(36)}`;
     await createInternalizationTask(stateManager, philosopherTaskId, 'philosopher', [dreamerSeedTaskId], channel, timeoutMs);
     const philosopherRunner = new PhilosopherRunner(
-      { stateManager, runtimeAdapter: agentAdapters.philosopher, eventEmitter, validator: new DefaultPhilosopherValidator(), artifactStore },
+      { stateManager, runtimeAdapter: agentAdapters.philosopher, eventEmitter, validator: new DefaultPhilosopherValidator(), artifactStore, contentHashFn },
       runnerOptsFor(agentAdapters.philosopher),
     );
     const philosopherResult = await runStage(philosopherRunner, philosopherTaskId, { maxStageRetries, pollIntervalMs });
@@ -319,7 +348,7 @@ export async function runRuleHostPipeline(opts: RuleHostPipelineOptions): Promis
     const scribeTaskId = `${correlation}-scribe-${Date.now().toString(36)}`;
     await createInternalizationTask(stateManager, scribeTaskId, 'scribe', [philosopherTaskId], channel, timeoutMs);
     const scribeRunner = new ScribeRunner(
-      { stateManager, runtimeAdapter: agentAdapters.scribe, eventEmitter, validator: new DefaultScribeValidator(), artifactStore },
+      { stateManager, runtimeAdapter: agentAdapters.scribe, eventEmitter, validator: new DefaultScribeValidator(), artifactStore, contentHashFn },
       runnerOptsFor(agentAdapters.scribe),
     );
     const scribeResult = await runStage(scribeRunner, scribeTaskId, { maxStageRetries, pollIntervalMs });
@@ -352,11 +381,25 @@ export async function runRuleHostPipeline(opts: RuleHostPipelineOptions): Promis
     }
     onProgress('adversarial_loop', 'start');
     const artificerRunner = new ArtificerRunner(
-      { stateManager, runtimeAdapter: capability.artificerAdapter, eventEmitter, validator: new DefaultArtificerValidator(), artifactStore },
+      {
+        stateManager, runtimeAdapter: capability.artificerAdapter, eventEmitter, validator: new DefaultArtificerValidator(), artifactStore,
+        contextMode: opts.contextMode ?? 'v1', behaviorExamplePack: opts.behaviorExamplePack, contentHashFn,
+      },
       runnerOptsFor(capability.artificerAdapter),
     );
+    // PRI-510 (DEFECT-004): construct EvaluatorRunnerDeps via the centralized
+    // helper so the repair-loop wiring (isRepairLoopEnabled + seeder) is
+    // actually invoked in the production CLI path. EP-02: prior code passed
+    // only the 5 base deps, leaving the repair loop as dead code at runtime.
     const evaluatorRunner = new EvaluatorRunner(
-      { stateManager, runtimeAdapter: agentAdapters.evaluator, eventEmitter, validator: new DefaultEvaluatorValidator(), artifactStore },
+      createEvaluatorRunnerDeps({
+        stateManager,
+        runtimeAdapter: agentAdapters.evaluator,
+        eventEmitter,
+        validator: new DefaultEvaluatorValidator(),
+        artifactStore,
+        workspaceDir: opts.workspaceDir,
+      }),
       { ...runnerOptsFor(agentAdapters.evaluator), gateDeps: createSandboxGateDeps() },
     );
 
@@ -405,7 +448,7 @@ export async function runRuleHostPipeline(opts: RuleHostPipelineOptions): Promis
         // Enqueue failed — the candidate artifact exists but is not in the
         // approval queue. Degrade gracefully with a structured reason (ERR-002).
         const enqueueErr = err instanceof Error ? err.message : String(err);
-        const degradeReason = `candidate_approved_but_enqueue_failed: ${enqueueErr}. Manual enqueue required: pd runtime activation dispatch --artifact-id ${loopResult.ruleArtifactId} --channel ${channel}`;
+        const degradeReason = `candidate_approved_but_enqueue_failed: ${enqueueErr}. Manual enqueue required: pd activation dispatch --artifact-id ${loopResult.ruleArtifactId} --channel ${channel}`;
         return {
           decision: pipelineDecision,
           painId: opts.painId,
@@ -528,6 +571,114 @@ async function createInternalizationTask(
   });
 }
 
+// ── PRI-510 (DEFECT-004): EvaluatorRunner repair-loop CLI wiring ────────────
+//
+// EP-02 (Production Path Wiring): PRI-509 added the `isRepairLoopEnabled` and
+// `seedArtificerRepairTask` deps to `EvaluatorRunnerDeps` (core), but the two
+// CLI production paths (runtime-internalization-run-once.ts and this file)
+// constructed `EvaluatorRunner` with only the base deps — the repair loop was
+// dead code at runtime (evaluator needs_revision seeded nothing).
+//
+// This helper centralizes the construction of the full deps so both CLI sites
+// stay in sync. The flag resolver reads `.pd/config.yaml` (the unified config
+// — ADR-0016); the seeder writes the repair task via `stateManager.createTask`
+// (the only sanctioned task-creation path; core peer runners are forbidden
+// from calling it directly — architecture-regression.test.ts enforces this).
+
+/**
+ * Inputs for {@link createEvaluatorRunnerDeps}. Carries the base `PeerRunnerDeps`
+ * fields plus `workspaceDir` (used to resolve the feature flag from
+ * `.pd/config.yaml`).
+ */
+export interface CreateEvaluatorRunnerDepsInputs {
+  readonly stateManager: RuntimeStateManager;
+  readonly runtimeAdapter: PDRuntimeAdapter;
+  readonly eventEmitter: StoreEventEmitter;
+  readonly validator: EvaluatorValidator;
+  readonly artifactStore: PIArtifactStore;
+  /** Workspace directory containing `.pd/config.yaml` (flag source). */
+  readonly workspaceDir: string;
+  /**
+   * Layer 0 content-hash function (design §6.1). Optional — defaults to the
+   * module-level sha256-hex `contentHashFn`. Allow override for tests.
+   */
+  readonly contentHashFn?: (input: string) => string;
+}
+
+/**
+ * Build the full `EvaluatorRunnerDeps` for CLI production paths, including the
+ * PRI-509 repair-loop wiring (EP-02: production path must invoke core logic).
+ *
+ * - `isRepairLoopEnabled`: reads `.pd/config.yaml` and resolves the
+ *   `evaluator_artificer_repair_loop` flag. Defaults to false when the config
+ *   is missing or malformed (rc-9: fail safe — legacy path runs, never throws).
+ * - `seedArtificerRepairTask`: creates a new `artificer` task carrying the
+ *   `repairPayload` in `diagnosticJson` (rc-1, rc-6: serialized via the
+ *   validated `createPITaskDiagnosticJson`, no `as` bypass). Reuses the
+ *   artificer runner (PRI-509 D1) rather than introducing a new task kind.
+ *
+ * Returns the newly created repair task's ID (UUIDv4, rc-7: fresh per call).
+ */
+export function createEvaluatorRunnerDeps(inputs: CreateEvaluatorRunnerDepsInputs): EvaluatorRunnerDeps {
+  const { stateManager, runtimeAdapter, eventEmitter, validator, artifactStore, workspaceDir } = inputs;
+  return {
+    stateManager,
+    runtimeAdapter,
+    eventEmitter,
+    validator,
+    artifactStore,
+    // Layer 0 (design §6.1): inject the content-hash function so the evaluator
+    // writer can attach a `predecessorSummary.contentHash` for staleness
+    // detection. Defaults to the module-level sha256-hex constant.
+    contentHashFn: inputs.contentHashFn ?? contentHashFn,
+    isRepairLoopEnabled: (): boolean => {
+      // rc-9: never throw on malformed config — fail safe to false so the
+      // legacy (non-repair) path runs. The malformed config is already
+      // surfaced by `pd config doctor` and CLI start-up warnings.
+      try {
+        const result = loadPdConfig(workspaceDir);
+        const effective = result.ok ? result.effective : result.defaults;
+        const flags = computeFeatureFlagsFromConfig(effective);
+        return isFeatureEnabled(flags, 'evaluator_artificer_repair_loop');
+      } catch {
+        return false;
+      }
+    },
+    seedArtificerRepairTask: async (params: SeedArtificerRepairParams): Promise<string> => {
+      // rc-7: each call gets a fresh task ID — never reuse a cached ID.
+      const repairTaskId = `artificer-repair-${randomUUID()}`;
+      await stateManager.createTask({
+        taskId: repairTaskId,
+        // D1 (PRI-509): task kind is 'artificer' — reuses the artificer
+        // runner, which detects repairPayload in diagnosticJson and
+        // forwards it to the prompt builder as repairFeedback.
+        taskKind: 'artificer',
+        status: 'pending',
+        attemptCount: 0,
+        maxAttempts: 3,
+        // rc-1, rc-6: serialize via the validated helper — repairPayload
+        // is untrusted LLM output but `createPITaskDiagnosticJson` writes
+        // it through `serializePITaskMetadata`, which `parsePITaskMetadata`
+        // re-validates on read (defense in depth).
+        diagnosticJson: createPITaskDiagnosticJson({
+          // PITaskMetadata fields are mutable arrays (the metadata envelope
+          // serializes them as JSON arrays). The SeedArtificerRepairParams
+          // contract carries readonly arrays (rc-1: untrusted input from the
+          // evaluator LLM). Spread to a fresh mutable array — no mutation of
+          // the caller's data.
+          dependencyTaskIds: [...params.inheritedDependencyTaskIds],
+          channel: params.inheritedChannel,
+          timeoutMs: params.inheritedTimeoutMs,
+          inputArtifactRefs: [...params.inheritedInputArtifactRefs],
+          outputArtifactRefs: [],
+          repairPayload: params.repairPayload,
+        }),
+      });
+      return repairTaskId;
+    },
+  };
+}
+
 /**
  * Run a single pipeline stage with bounded retry for transient `retried` status.
  *

package/src/services/runtime-adapter-resolver.ts

@@ -103,6 +103,7 @@ export interface ResolveAdapterOptions {
     apiKeyEnv?: string;
     baseUrl?: string;
     maxRetries?: number;
+    maxTokens?: number;
   };
   /**
    * CLI override for openclaw mode (from --openclaw-local / --openclaw-gateway flags).
@@ -215,6 +216,7 @@ export function resolveRuntimeAdapterFromConfig(opts: ResolveAdapterOptions): PD
     const apiKeyEnv = opts.piAiOverrides?.apiKeyEnv ?? configFields.apiKeyEnv;
     const baseUrl = opts.piAiOverrides?.baseUrl ?? configFields.baseUrl;
     const maxRetries = opts.piAiOverrides?.maxRetries ?? configFields.maxRetries;
+    const maxTokens = opts.piAiOverrides?.maxTokens ?? configFields.maxTokens;
     const adapterTimeoutMs = opts.timeoutMs ?? configFields.timeoutMs;
 
     // PRI-431 Step 1d + PR review fix: manual missing-field check on MERGED values
@@ -283,9 +285,11 @@ export function resolveRuntimeAdapterFromConfig(opts: ResolveAdapterOptions): PD
       model: String(model),
       apiKeyEnv: String(apiKeyEnv),
       maxRetries,
+      maxTokens,
       timeoutMs: adapterTimeoutMs,
       baseUrl,
       workspace: opts.workspaceDir,
+      ...(configFields.systemPrompt ? { systemPrompt: configFields.systemPrompt } : {}),
     });
   }
 

package/src/services/synthetic-baseline-runner.ts

@@ -21,6 +21,7 @@ import { auditCandidateLedgerConsistency } from '@principles/core/runtime-v2';
 import { OperatorHealthReadModel } from '@principles/core/runtime-v2';
 import { createInternalizationQueueReadModel } from '@principles/core/runtime-v2';
 import { createPITaskDiagnosticJson } from '@principles/core/runtime-v2';
+import { contentHashFn } from './rulehost-pipeline-runner.js';
 import {
   computeOverallStatus,
   boundedEvidence,
@@ -148,6 +149,7 @@ export async function runSyntheticBaseline(opts: SyntheticBaselineRunnerOptions)
         artifactStore: stateManager.piArtifactStore,
         validator: new DefaultDiagRootCauseValidator(),
         contextAssembler,
+        contentHashFn,
       },
       {
         owner: 'synthetic-baseline',
@@ -164,6 +166,7 @@ export async function runSyntheticBaseline(opts: SyntheticBaselineRunnerOptions)
         eventEmitter,
         artifactStore: stateManager.piArtifactStore,
         validator: new DefaultDiagDistillerValidator(),
+        contentHashFn,
       },
       {
         owner: 'synthetic-baseline',
@@ -180,6 +183,7 @@ export async function runSyntheticBaseline(opts: SyntheticBaselineRunnerOptions)
         eventEmitter,
         artifactStore: stateManager.piArtifactStore,
         committer,
+        contentHashFn,
       },
       {
         owner: 'synthetic-baseline',
@@ -214,6 +218,13 @@ export async function runSyntheticBaseline(opts: SyntheticBaselineRunnerOptions)
       painType: 'tool_failure',
       source: 'synthetic-baseline',
       reason: 'Synthetic baseline deterministic pain signal',
+      // Synthetic baseline is a deterministic smoke tool — it has no real host
+      // session to harvest evidence from. Provide a synthetic evidence entry so
+      // the PEAT-B1 admission gate (painEvidenceAdmission, default-on) does not
+      // short-circuit the pain before diagnosis. Without this, the baseline
+      // reports `short_circuited: input evidence empty` and every downstream
+      // stage fails, even though the pipeline itself is healthy.
+      evidence: [{ sourceRef: `synthetic:${painId}`, note: 'Synthetic baseline deterministic evidence anchor' }],
     });
 
     const painPassed = bridgeResult.status === 'succeeded';

package/src/utils/production-workspace-guard.test.ts

@@ -5,23 +5,27 @@ import {
   isProductionWorkspace,
   guardUatWorkspace,
   getSafeUatWorkspacePath,
+  resolveWorkspacePath,
   formatGuardRefusal,
   type GuardRefusal,
 } from './production-workspace-guard.js';
 
+// Use os.homedir()-derived paths so the tests work cross-platform
+// (previously hardcoded Windows paths like D:\.openclaw\workspace which on
+// Linux resolve to <cwd>/D:\.openclaw\workspace — meaningless).
+const HOMEDIR_WORKSPACE = path.join(os.homedir(), '.openclaw', 'workspace');
+
 const PRODUCTION_PATHS = [
-  'D:\\.openclaw\\workspace',
-  'C:\\.openclaw\\workspace',
-  'C:\\Users\\Administrator\\.openclaw\\workspace',
-  path.join(os.homedir(), '.openclaw', 'workspace'),
+  HOMEDIR_WORKSPACE,
 ];
 
 const SAFE_PATHS = [
-  'D:\\.openclaw\\workspace-test',
-  'D:\\.openclaw\\workspace-backup',
+  path.join(os.homedir(), '.openclaw', 'workspace-test'),
+  path.join(os.homedir(), '.openclaw', 'workspace-backup'),
   path.join(os.tmpdir(), 'pd-uat-workspace'),
   path.join(os.tmpdir(), 'pd-test-any'),
-  'C:\\completely-unrelated\\work',
+  // A path that is clearly unrelated on every platform
+  path.join(os.tmpdir(), 'completely-unrelated-work'),
 ];
 
 describe('isProductionWorkspace', () => {
@@ -32,18 +36,15 @@ describe('isProductionWorkspace', () => {
     expect(isProductionWorkspace(path.resolve(safePath))).toBe(false);
   });
   it('detects descendant', () => {
-    // Use a platform-appropriate descendant path so the test works on both
-    // Windows (where D:\... resolves as-is) and Linux CI (where D:\... is
-    // treated as a relative path and resolves under cwd).
-    const prodPath = path.resolve(path.join(os.homedir(), '.openclaw', 'workspace'));
+    const prodPath = path.resolve(HOMEDIR_WORKSPACE);
     const descendantPath = path.join(prodPath, 'sub', 'child');
     expect(isProductionWorkspace(descendantPath)).toBe(true);
   });
   it('rejects sibling workspace-test (ERR-030)', () => {
-    expect(isProductionWorkspace(path.resolve('D:\\.openclaw\\workspace-test'))).toBe(false);
+    expect(isProductionWorkspace(path.resolve(path.join(os.homedir(), '.openclaw', 'workspace-test')))).toBe(false);
   });
   it('rejects sibling workspace-backup (ERR-030)', () => {
-    expect(isProductionWorkspace(path.resolve('D:\\.openclaw\\workspace-backup'))).toBe(false);
+    expect(isProductionWorkspace(path.resolve(path.join(os.homedir(), '.openclaw', 'workspace-backup')))).toBe(false);
   });
 });
 
@@ -58,7 +59,7 @@ describe('guardUatWorkspace', () => {
       }
     });
     it('refuses descendant', () => {
-      const prodPath = path.resolve(path.join(os.homedir(), '.openclaw', 'workspace'));
+      const prodPath = path.resolve(HOMEDIR_WORKSPACE);
       const descendantPath = path.join(prodPath, 'subdir');
       expect(guardUatWorkspace(descendantPath, 'test').refused).toBe(true);
     });
@@ -68,8 +69,10 @@ describe('guardUatWorkspace', () => {
       const r = guardUatWorkspace(safePath, 'test');
       expect(r.refused).toBe(false);
     });
-    it.each(['D:\\.openclaw\\workspace-test', 'D:\\.openclaw\\workspace-backup'])(
-      'allows sibling: %s (ERR-030)', (p) => {
+    it.each([
+      path.join(os.homedir(), '.openclaw', 'workspace-test'),
+      path.join(os.homedir(), '.openclaw', 'workspace-backup'),
+    ])('allows sibling: %s (ERR-030)', (p) => {
         expect(guardUatWorkspace(p, 'test').refused).toBe(false);
       });
   });
@@ -77,7 +80,7 @@ describe('guardUatWorkspace', () => {
 
 describe('JSON output (EP-04)', () => {
   it('outputs single object with reason and nextAction', () => {
-    const r = guardUatWorkspace('D:\\.openclaw\\workspace', 'test');
+    const r = guardUatWorkspace(HOMEDIR_WORKSPACE, 'test');
     const json = formatGuardRefusal(r as GuardRefusal, 'test', true);
     const parsed = JSON.parse(json);
     expect(parsed).toMatchObject({
@@ -87,7 +90,7 @@ describe('JSON output (EP-04)', () => {
     expect(Array.isArray(parsed)).toBe(false);
   });
   it('no console prefixes in JSON', () => {
-    const r = guardUatWorkspace('D:\\.openclaw\\workspace', 'test');
+    const r = guardUatWorkspace(HOMEDIR_WORKSPACE, 'test');
     const json = formatGuardRefusal(r as GuardRefusal, 'test', true);
     expect(json).not.toContain('[pd-cli]');
     expect(json).not.toContain('ERROR:');
@@ -97,7 +100,7 @@ describe('JSON output (EP-04)', () => {
 
 describe('text output (EP-03)', () => {
   it('includes reason and nextAction', () => {
-    const r = guardUatWorkspace('D:\\.openclaw\\workspace', 'test');
+    const r = guardUatWorkspace(HOMEDIR_WORKSPACE, 'test');
     const text = formatGuardRefusal(r as GuardRefusal, 'test', false);
     expect(text).toContain('Reason:');
     expect(text).toContain('Next Action:');
@@ -112,4 +115,43 @@ describe('getSafeUatWorkspacePath', () => {
     expect(p1).toContain(os.tmpdir());
     expect(p1).toContain('pd-uat-workspace');
   });
-});
+});
+
+describe('resolveWorkspacePath', () => {
+  it('resolves an absolute path as-is', () => {
+    const abs = path.resolve('/tmp/my-workspace');
+    expect(resolveWorkspacePath(abs)).toBe(abs);
+  });
+
+  it('resolves a relative path against cwd', () => {
+    const result = resolveWorkspacePath('relative/path');
+    const expected = path.resolve(process.cwd(), 'relative/path');
+    expect(result).toBe(expected);
+  });
+
+  it('defaults to cwd when no input is provided', () => {
+    const result = resolveWorkspacePath(undefined);
+    expect(result).toBe(path.resolve(process.cwd()));
+  });
+});
+
+describe('PD_PRODUCTION_WORKSPACE env var (module-load-time)', () => {
+  // NOTE: PRODUCTION_WORKSPACE_PATHS is built once at module load time from
+  // process.env.PD_PRODUCTION_WORKSPACE. Setting the env var after the module
+  // is loaded does NOT change behavior. These tests verify that the default
+  // production path (HOMEDIR_WORKSPACE) is correctly protected, which is the
+  // primary regression risk.
+
+  it('guardUatWorkspace refuses the default production workspace', () => {
+    const r = guardUatWorkspace(HOMEDIR_WORKSPACE, 'test');
+    expect(r.refused).toBe(true);
+    if (r.refused) {
+      expect(r.isProduction).toBe(true);
+      expect(r.workspace).toBe(path.resolve(HOMEDIR_WORKSPACE));
+    }
+  });
+
+  it('isProductionWorkspace returns true for the default production path', () => {
+    expect(isProductionWorkspace(path.resolve(HOMEDIR_WORKSPACE))).toBe(true);
+  });
+});

package/src/utils/production-workspace-guard.ts

@@ -3,10 +3,10 @@
  *
  * Prevents UAT/runtime test commands from writing to production workspaces.
  *
- * Production workspaces are:
- * - D:\.openclaw\workspace
- * - C:\Users\Administrator\.openclaw\workspace
- * - And the default workspace resolved by OpenClaw configuration
+ * Production workspaces:
+ * - Default: ~/.openclaw/workspace (cross-platform)
+ * - Additional paths declared via PD_PRODUCTION_WORKSPACE env var
+ *   (use path.delimiter — `;` on Windows, `:` on Unix — to separate multiple paths)
  *
  * This module follows ERR-030 (path prefix matching must use segment boundaries)
  * and EP-03/EP-04 (fail loud with structured reason and nextAction).
@@ -20,19 +20,22 @@ import { existsSync } from 'fs';
 
 /**
  * List of production workspace paths that should be protected from UAT/test writes.
- * These are the default paths where PD is typically installed and used for real work.
+ * Built from: the universal default (~/.openclaw/workspace) plus any paths
+ * declared via PD_PRODUCTION_WORKSPACE.
  */
-const PRODUCTION_WORKSPACE_PATHS = [
-  // Windows default
-  path.resolve('D:\\.openclaw\\workspace'),
-  path.resolve('C:\\.openclaw\\workspace'),
-  path.resolve('C:\\Users\\Administrator\\.openclaw\\workspace'),
-  path.resolve('C:\\Users\\Admin\\.openclaw\\workspace'),
-  // Unix-like defaults
-  path.resolve(path.join(os.homedir(), '.openclaw', 'workspace')),
-  // macOS-specific
-  path.resolve(path.join(os.homedir(), '.openclaw', 'workspace')),
-];
+function buildProductionWorkspacePaths(): string[] {
+  const paths = [path.resolve(path.join(os.homedir(), '.openclaw', 'workspace'))];
+  const extra = process.env.PD_PRODUCTION_WORKSPACE;
+  if (extra) {
+    for (const p of extra.split(path.delimiter)) {
+      const trimmed = p.trim();
+      if (trimmed) paths.push(path.resolve(trimmed));
+    }
+  }
+  return paths;
+}
+
+const PRODUCTION_WORKSPACE_PATHS = buildProductionWorkspacePaths();
 
 // ── Resolution helpers ───────────────────────────────────────────────────────