patchwarden 0.4.0 → 0.6.0

package/src/tools/finalizeDirectSession.ts

@@ -0,0 +1,144 @@
+import { join, resolve, relative, isAbsolute } from "node:path";
+import {
+  readDirectSession,
+  updateDirectSession,
+  finalizeDirectSessionRecord,
+  getDirectSessionDir,
+} from "../direct/directSessionStore.js";
+import { guardDirectSessionActive } from "../direct/directGuards.js";
+import {
+  captureRepoSnapshot,
+  buildChangeArtifacts,
+  type ChangeArtifacts,
+  type ClassifiedChange,
+  type ChangedFile,
+} from "../runner/changeCapture.js";
+
+// ── Types ──────────────────────────────────────────────────────────
+
+export interface FinalizeDirectSessionInput {
+  session_id: string;
+}
+
+export interface FinalizeDirectSessionOutput {
+  session_id: string;
+  changed_files_total: number;
+  source_changes: ClassifiedChange[];
+  tracked_build_artifacts: ClassifiedChange[];
+  runtime_generated_files: ClassifiedChange[];
+  suspicious_changes: ClassifiedChange[];
+  out_of_scope_changes: ClassifiedChange[];
+  verification_summary: Record<string, "passed" | "failed">;
+  diff_path: string;
+  summary_path: string;
+  finalized: boolean;
+  next_action: string;
+}
+
+// ── Main function ──────────────────────────────────────────────────
+
+export function finalizeDirectSession(
+  input: FinalizeDirectSessionInput
+): FinalizeDirectSessionOutput {
+  const { session_id } = input;
+
+  // 1. Read session and guard active (not expired, not finalized)
+  const session = readDirectSession(session_id);
+  guardDirectSessionActive(session);
+
+  // 2. Capture after snapshot
+  const afterSnapshot = captureRepoSnapshot(session.resolved_repo_path);
+
+  // 3. Build change artifacts from before/after snapshots
+  const changeArtifacts = buildChangeArtifacts(
+    session.resolved_repo_path,
+    session.workspace_snapshot_before,
+    afterSnapshot
+  );
+
+  // 4. Finalize session record — writes changed-files.json, diff.patch,
+  //    summary.json, summary.md and marks the session as finalized.
+  finalizeDirectSessionRecord(session_id, afterSnapshot, changeArtifacts);
+
+  // 5. Build verification summary from session.verification_runs
+  const verification_summary: Record<string, "passed" | "failed"> = {};
+  for (const run of session.verification_runs) {
+    verification_summary[run.command] = run.passed ? "passed" : "failed";
+  }
+
+  // 6. Identify out-of-scope changes (paths outside resolved_repo_path)
+  const out_of_scope_changes = findOutOfScopeChanges(
+    changeArtifacts,
+    session.resolved_repo_path
+  );
+
+  // 7. Build compact summary with categorized changes
+  const sessionDir = getDirectSessionDir(session_id);
+
+  return {
+    session_id,
+    changed_files_total: changeArtifacts.changed_files.length,
+    source_changes: changeArtifacts.artifact_hygiene.source_changes,
+    tracked_build_artifacts:
+      changeArtifacts.artifact_hygiene.tracked_build_artifacts,
+    runtime_generated_files:
+      changeArtifacts.artifact_hygiene.runtime_generated_files,
+    suspicious_changes: changeArtifacts.artifact_hygiene.suspicious_changes,
+    out_of_scope_changes,
+    verification_summary,
+    diff_path: join(sessionDir, "diff.patch"),
+    summary_path: join(sessionDir, "summary.md"),
+    finalized: true,
+    next_action: "Call audit_session to independently review the changes.",
+  };
+}
+
+// ── Helpers ────────────────────────────────────────────────────────
+
+/**
+ * Filter changeArtifacts.changed_files for paths that resolve outside the
+ * session's resolved_repo_path and map them to ClassifiedChange format.
+ */
+function findOutOfScopeChanges(
+  artifacts: ChangeArtifacts,
+  resolvedRepoPath: string
+): ClassifiedChange[] {
+  const normalizedRepo = resolve(resolvedRepoPath);
+  return artifacts.changed_files
+    .filter((file) => {
+      const fullPath = resolve(normalizedRepo, file.path);
+      const rel = relative(normalizedRepo, fullPath);
+      return isAbsolute(rel) || rel.startsWith("..");
+    })
+    .map((file) => toClassifiedChange(file));
+}
+
+/**
+ * Map a ChangedFile to the ClassifiedChange format by adding a reason string.
+ */
+function toClassifiedChange(file: ChangedFile): ClassifiedChange {
+  return {
+    path: file.path,
+    change: file.change,
+    tracked: file.tracked,
+    ignored: file.ignored,
+    kind: file.kind,
+    reason: classificationReason(file),
+  };
+}
+
+/**
+ * Produce a human-readable reason for a changed file classification.
+ * Mirrors the logic in changeCapture.ts classifyArtifactHygiene.
+ */
+function classificationReason(change: ChangedFile): string {
+  if (change.ignored)
+    return "untracked path is ignored by repository Git rules";
+  if (change.kind === "build_artifact" && change.tracked)
+    return "artifact-like path is tracked by Git and requires review";
+  if (change.kind === "build_artifact")
+    return "artifact-like path is not ignored and requires review";
+  if (change.kind === "runtime_generated")
+    return "runtime-generated path is not ignored and requires review";
+  return change.tracked ? "tracked source change" : "untracked source change";
+}

package/src/tools/getTaskSummary.ts

@@ -78,9 +78,54 @@ export interface TaskSummaryOutput {
   watcher: unknown;
   pending_reason: string | null;
   execution_blocked: boolean;
+  artifact_hygiene: Record<string, unknown>;
 }
 
-export function getTaskSummary(taskId: string): TaskSummaryOutput {
+export interface CompactTaskSummaryOutput {
+  view: "compact";
+  task_id: string;
+  status: string;
+  terminal: boolean;
+  acceptance_status: TaskSummaryOutput["acceptance_status"];
+  phase: string;
+  repo_path: string;
+  changed_files_total: number;
+  out_of_scope_changes_total: number;
+  artifact_hygiene: {
+    counts: Record<string, number>;
+    source_changes: unknown[];
+    tracked_build_artifacts: unknown[];
+    ignored_untracked_artifacts: unknown[];
+    runtime_generated_files: unknown[];
+    suspicious_changes: unknown[];
+    max_items: number;
+    truncated: boolean;
+  };
+  verification_summary: TaskSummaryOutput["verification_summary"];
+  summary: string;
+  warnings: string[];
+  errors: string[];
+  failure_reason: string | null;
+  failed_command: string | null;
+  suggested_next_action: string;
+  execution_blocked: boolean;
+  pending_reason: string | null;
+  redacted: boolean;
+  redaction_categories: string[];
+}
+
+export interface GetTaskSummaryOptions {
+  view?: "compact" | "standard";
+  max_items?: number;
+}
+
+export type TaskSummaryResult = TaskSummaryOutput | CompactTaskSummaryOutput;
+
+export function getTaskSummary(taskId: string): TaskSummaryOutput;
+export function getTaskSummary(taskId: string, options: { view: "compact"; max_items?: number }): CompactTaskSummaryOutput;
+export function getTaskSummary(taskId: string, options: { view?: "standard"; max_items?: number }): TaskSummaryOutput;
+export function getTaskSummary(taskId: string, options: GetTaskSummaryOptions): TaskSummaryResult;
+export function getTaskSummary(taskId: string, options: GetTaskSummaryOptions = {}): TaskSummaryResult {
   const config = getConfig();
   const taskDir = resolve(getTasksDir(config), taskId);
   const statusFile = join(taskDir, "status.json");
@@ -156,6 +201,10 @@ export function getTaskSummary(taskId: string): TaskSummaryOutput {
     ? Math.max(0, (Number.isFinite(finishedAt) ? finishedAt : Date.now()) - startedAt)
     : 0;
   const changedFiles = asArray(result.changed_files ?? status.changed_files);
+  const changedFilesRead = tryReadJson(join(taskDir, "changed-files.json"));
+  const artifactHygiene = asRecord(result.artifact_hygiene ?? changedFilesRead.data.artifact_hygiene ?? {
+    counts: status.artifact_hygiene_counts || {},
+  });
   const verifyCommands = asArray(verify.commands ?? result.verify_commands ?? result.verify?.commands);
   const testLogSummary = summarizeTestLog(join(taskDir, "test.log"));
   const verificationSummary = buildVerificationSummary(verifyStatus, verifyCommands, testLogSummary);
@@ -227,7 +276,11 @@ export function getTaskSummary(taskId: string): TaskSummaryOutput {
     watcher: status.watcher,
     pending_reason: status.pending_reason || null,
     execution_blocked: Boolean(status.execution_blocked),
+    artifact_hygiene: artifactHygiene,
   };
+  if ((options.view || "standard") === "compact") {
+    return buildCompactSummary(output, normalizeMaxItems(options.max_items));
+  }
   const safe = redactSensitiveValue(output);
   return {
     ...safe.value,
@@ -236,6 +289,59 @@ export function getTaskSummary(taskId: string): TaskSummaryOutput {
   } as TaskSummaryOutput;
 }
 
+function buildCompactSummary(output: Record<string, any>, maxItems: number): CompactTaskSummaryOutput {
+  const hygiene = asRecord(output.artifact_hygiene);
+  const groupNames = [
+    "source_changes",
+    "tracked_build_artifacts",
+    "ignored_untracked_artifacts",
+    "runtime_generated_files",
+    "suspicious_changes",
+  ] as const;
+  const groups = Object.fromEntries(groupNames.map((name) => [name, asArray(hygiene[name]).slice(0, maxItems)]));
+  const truncated = groupNames.some((name) => asArray(hygiene[name]).length > maxItems);
+  const compact = {
+    view: "compact" as const,
+    task_id: String(output.task_id),
+    status: String(output.status),
+    terminal: Boolean(output.terminal),
+    acceptance_status: output.acceptance_status,
+    phase: String(output.phase),
+    repo_path: String(output.repo_path),
+    changed_files_total: asArray(output.changed_files).length,
+    out_of_scope_changes_total: asArray(output.out_of_scope_changes).length,
+    artifact_hygiene: {
+      counts: asRecord(hygiene.counts) as Record<string, number>,
+      ...groups,
+      max_items: maxItems,
+      truncated,
+    },
+    verification_summary: output.verification_summary,
+    summary: String(output.summary).slice(0, 1000),
+    warnings: asArray(output.warnings).slice(0, maxItems),
+    errors: asArray(output.errors).slice(0, maxItems),
+    failure_reason: output.failure_reason || null,
+    failed_command: output.failed_command || null,
+    suggested_next_action: String(output.suggested_next_action),
+    execution_blocked: Boolean(output.execution_blocked),
+    pending_reason: output.pending_reason || null,
+  };
+  const safe = redactSensitiveValue(compact);
+  return {
+    ...safe.value,
+    redacted: safe.redacted,
+    redaction_categories: safe.redaction_categories,
+  } as CompactTaskSummaryOutput;
+}
+
+function normalizeMaxItems(value: number | undefined): number {
+  if (value === undefined) return 8;
+  if (!Number.isInteger(value) || value < 1 || value > 50) {
+    throw new Error("max_items must be an integer from 1 to 50.");
+  }
+  return value;
+}
+
 function tryReadJson(path: string): { data: Record<string, any>; error?: string } {
   if (!existsSync(path)) return { data: {} };
   try {
@@ -249,6 +355,10 @@ function asArray(value: unknown): any[] {
   return Array.isArray(value) ? value : [];
 }
 
+function asRecord(value: unknown): Record<string, any> {
+  return value && typeof value === "object" && !Array.isArray(value) ? value as Record<string, any> : {};
+}
+
 function summarizeTestLog(path: string): string {
   if (!existsSync(path)) return "test.log missing";
   const text = readFileSync(path, "utf-8");

package/src/tools/healthCheck.ts

@@ -1,12 +1,12 @@
 import { accessSync, constants, existsSync, readFileSync } from "node:fs";
 import { homedir } from "node:os";
 import { dirname, join } from "node:path";
-import { getConfig, getTasksDir, resolveWorkspaceRoot } from "../config.js";
+import { getConfig, getTasksDir, getDirectSessionsDir, resolveWorkspaceRoot } from "../config.js";
 import { listAgents } from "./listAgents.js";
 import { redactSensitiveContent, redactSensitiveValue } from "../security/contentRedaction.js";
 import { PATCHWARDEN_VERSION, TOOL_SCHEMA_EPOCH } from "../version.js";
 import type { ToolCatalogSnapshot } from "./toolCatalog.js";
-import { CHATGPT_CORE_TOOL_NAMES, resolveToolProfile } from "./toolCatalog.js";
+import { CHATGPT_CORE_TOOL_NAMES, CHATGPT_DIRECT_TOOL_NAMES, resolveToolProfile } from "./toolCatalog.js";
 import { readWatcherStatus } from "../watcherStatus.js";
 import { listTasks } from "./listTasks.js";
 
@@ -35,9 +35,17 @@ export function healthCheck(catalog?: ToolCatalogSnapshot, input: HealthCheckInp
   let profileConsistent = true;
   if (catalog) {
     const activeProfile = resolveToolProfile(config.toolProfile);
-    const expectedNames = activeProfile === "chatgpt_core"
-      ? [...CHATGPT_CORE_TOOL_NAMES]
-      : null; // full profile: all tools are accepted
+    let expectedNames: string[] | null = null;
+    if (activeProfile === "chatgpt_core") {
+      expectedNames = [...CHATGPT_CORE_TOOL_NAMES];
+    } else if (activeProfile === "chatgpt_direct" && config.enableDirectProfile) {
+      expectedNames = [...CHATGPT_DIRECT_TOOL_NAMES];
+    } else if (activeProfile === "chatgpt_direct" && !config.enableDirectProfile) {
+      // Degraded mode: only health_check should be exposed
+      expectedNames = ["health_check"];
+      profileErrors.push("Direct profile is disabled (enableDirectProfile=false). Only health_check is available. Set enableDirectProfile: true to enable Direct session tools.");
+      profileConsistent = false;
+    }
     if (expectedNames) {
       const catalogNames = new Set(catalog.tool_names);
       for (const name of expectedNames) {
@@ -76,6 +84,11 @@ export function healthCheck(catalog?: ToolCatalogSnapshot, input: HealthCheckInp
   const status = watcher.available && workspace.available && tasks.available && agentReady && catalogConsistent
     ? "healthy"
     : "degraded";
+
+  const directSessionsDir = getDirectSessionsDir(config);
+  const directSessions = directoryStatus(directSessionsDir, true, workspaceRoot);
+  const activeProfile = resolveToolProfile(config.toolProfile);
+
   return {
     status,
     server_version: catalog?.server_version || PATCHWARDEN_VERSION,
@@ -89,11 +102,15 @@ export function healthCheck(catalog?: ToolCatalogSnapshot, input: HealthCheckInp
     catalog_consistent: catalogConsistent,
     mismatch_report: mismatchReport,
     tunnel_catalog_comparison: tunnelCatalogComparison,
+    direct_profile_enabled: config.enableDirectProfile ?? false,
+    direct_sessions_dir: directSessions,
+    direct_session_ttl_seconds: config.directSessionTtlSeconds,
+    ...(activeProfile === "chatgpt_direct" ? { direct_tool_count: config.enableDirectProfile ? CHATGPT_DIRECT_TOOL_NAMES.length : 1 } : {}),
     connector_visibility: {
       status: "not_observable_server_side",
       verification: "Refresh or reconnect the Connector and verify tools/list from a new ChatGPT conversation.",
       refresh_steps: [
-        "1. Run Check-PatchWarden-Health.cmd to confirm tool_profile=chatgpt_core, tool_count=16, and catalog_consistent=true.",
+        "1. Run PatchWarden.cmd health to confirm the active profile, tool count, and catalog consistency.",
         "2. In ChatGPT Platform, refresh or reconnect the Connector (do not reuse an old session).",
         "3. Open a NEW ChatGPT conversation (old conversations retain their cached tool catalog).",
         "4. Call health_check in the new conversation; verify tool_manifest_sha256 matches the local report.",

package/src/tools/readWorkspaceFile.ts

@@ -1,8 +1,14 @@
-import { readFileSync, statSync } from "node:fs";
+import { readFileSync, statSync, existsSync } from "node:fs";
+import { createHash } from "node:crypto";
+import { resolve, relative, isAbsolute } from "node:path";
 import { getConfig } from "../config.js";
 import { guardReadPath } from "../security/pathGuard.js";
 import { guardSensitivePath } from "../security/sensitiveGuard.js";
 import { redactSensitiveContent } from "../security/contentRedaction.js";
+import { PatchWardenError } from "../errors.js";
+import { readDirectSession } from "../direct/directSessionStore.js";
+import { guardDirectSessionActive, guardDirectReadPath, isBinaryFile, guardDirectFileSize } from "../direct/directGuards.js";
+import { resolveToolProfile } from "./toolCatalog.js";
 
 export interface ReadWorkspaceFileOutput {
   path: string;
@@ -10,11 +16,41 @@ export interface ReadWorkspaceFileOutput {
   size: number;
   redacted?: boolean;
   redaction_categories?: string[];
+  // Direct mode extensions
+  relative_path?: string;
+  sha256?: string;
 }
 
-export function readWorkspaceFile(relativePath: string): ReadWorkspaceFileOutput {
+export interface ReadWorkspaceFileInput {
+  path: string;
+  session_id?: string;
+}
+
+export function readWorkspaceFile(input: string | ReadWorkspaceFileInput): ReadWorkspaceFileOutput {
   const config = getConfig();
 
+  // Support both old string API and new object API
+  const relativePath = typeof input === "string" ? input : input.path;
+  const sessionId = typeof input === "string" ? undefined : input.session_id;
+
+  // Direct mode: session_id provided
+  if (sessionId) {
+    return readWorkspaceFileDirect(relativePath, sessionId);
+  }
+
+  // In chatgpt_direct profile, session_id is required
+  const profile = resolveToolProfile(config.toolProfile);
+  if (profile === "chatgpt_direct") {
+    throw new PatchWardenError(
+      "session_id_required",
+      "session_id is required when using the chatgpt_direct profile.",
+      "Provide a session_id from create_direct_session.",
+      true,
+      { operation: "read_workspace_file" }
+    );
+  }
+
+  // Compatibility mode: no session_id, original behavior
   const safePath = guardReadPath(relativePath, config.workspaceRoot);
   guardSensitivePath(safePath);
 
@@ -39,3 +75,50 @@ export function readWorkspaceFile(relativePath: string): ReadWorkspaceFileOutput
     redaction_categories: redaction.redaction_categories,
   };
 }
+
+function readWorkspaceFileDirect(relativePath: string, sessionId: string): ReadWorkspaceFileOutput {
+  const config = getConfig();
+  const session = readDirectSession(sessionId);
+  guardDirectSessionActive(session);
+
+  // Resolve path within session's repo
+  const safePath = guardDirectReadPath(relativePath, session.resolved_repo_path, config.workspaceRoot);
+
+  if (!existsSync(safePath)) {
+    throw new PatchWardenError(
+      "file_not_found",
+      `File "${relativePath}" not found in session repo.`,
+      "Use search_workspace to find available files.",
+      true,
+      { path: relativePath, session_id: sessionId }
+    );
+  }
+
+  const stat = statSync(safePath);
+  guardDirectFileSize(stat.size);
+
+  // Block binary files
+  if (isBinaryFile(safePath)) {
+    throw new PatchWardenError(
+      "binary_file_blocked",
+      `File "${relativePath}" appears to be a binary file.`,
+      "Binary files cannot be read in Direct mode.",
+      true,
+      { path: relativePath }
+    );
+  }
+
+  const content = readFileSync(safePath, "utf-8");
+  const redaction = redactSensitiveContent(content);
+  const sha256 = createHash("sha256").update(content, "utf-8").digest("hex");
+
+  return {
+    path: safePath,
+    relative_path: relativePath,
+    content: redaction.content,
+    size: stat.size,
+    sha256,
+    redacted: redaction.redacted,
+    redaction_categories: redaction.redaction_categories,
+  };
+}