patchwarden 0.4.0 → 0.6.0

package/dist/doctor.js

@@ -17,7 +17,7 @@ import { isSensitivePath } from "./security/sensitiveGuard.js";
 import { guardPlanContent } from "./security/planGuard.js";
 import { TASK_READ_ONLY_FILES } from "./tools/getTaskFile.js";
 import { getToolDefs } from "./tools/registry.js";
-import { CHATGPT_CORE_TOOL_NAMES, selectToolsForProfile } from "./tools/toolCatalog.js";
+import { CHATGPT_CORE_TOOL_NAMES, CHATGPT_DIRECT_TOOL_NAMES, selectToolsForProfile } from "./tools/toolCatalog.js";
 import { PATCHWARDEN_VERSION } from "./version.js";
 // ── State ──────────────────────────────────────────────────────────
 let ok = 0;
@@ -59,6 +59,7 @@ function cmd(cmdStr) {
 // ══════════════════════════════════════════════════════════════════
 async function main() {
     console.log("PatchWarden Doctor\n");
+    const allowDefaultConfig = process.argv.includes("--allow-default-config");
     // 1. Node version
     const nodeVer = process.version;
     const nodeMajor = parseInt(nodeVer.slice(1).split(".")[0]);
@@ -66,6 +67,16 @@ async function main() {
     // 2. npm
     const npmVer = cmd("npm --version");
     check("npm available", npmVer !== "", npmVer || "npm not found in PATH");
+    // Local-only medium-risk confirmation entrypoint. It must exist as a package
+    // binary but must not be exposed as an MCP tool.
+    try {
+        const packageJson = JSON.parse(readFileSync(resolve(process.cwd(), "package.json"), "utf-8"));
+        check("patchwarden-confirm package binary", packageJson.bin?.["patchwarden-confirm"] === "dist/assessments/confirmCli.js", packageJson.bin?.["patchwarden-confirm"] || "missing");
+        check("patchwarden-confirm compiled entrypoint", existsSync(resolve(process.cwd(), "dist/assessments/confirmCli.js")), "run npm.cmd run build");
+    }
+    catch (error) {
+        check("patchwarden-confirm package binary", false, error instanceof Error ? error.message : String(error));
+    }
     // 3. Git
     const gitVer = cmd("git --version");
     warnCheck("Git available", gitVer !== "", gitVer || "git not found — runner git.diff will not work");
@@ -81,9 +92,15 @@ async function main() {
             break;
         }
     }
-    check("Config file exists", configPathUsed !== "", configPathUsed
+    const configDetail = configPathUsed
         ? configPathUsed
-        : 'Create one: cp examples/config.example.json patchwarden.config.json');
+        : 'Create one: cp examples/config.example.json patchwarden.config.json';
+    if (allowDefaultConfig) {
+        warnCheck("Config file exists", configPathUsed !== "", configDetail);
+    }
+    else {
+        check("Config file exists", configPathUsed !== "", configDetail);
+    }
     // 5. PATCHWARDEN_CONFIG env
     if (process.env.PATCHWARDEN_CONFIG) {
         results.push(`[OK]   PATCHWARDEN_CONFIG = ${process.env.PATCHWARDEN_CONFIG}`);
@@ -198,15 +215,26 @@ async function main() {
     try {
         process.env.PATCHWARDEN_TOOL_PROFILE = "full";
         const fullTools = getToolDefs();
-        const coreTools = selectToolsForProfile(fullTools, "chatgpt_core");
+        const coreTools = selectToolsForProfile(fullTools, "chatgpt_core", config?.enableDirectProfile);
         const createSchema = coreTools.find((tool) => tool.name === "create_task")?.inputSchema;
         const waitSchema = coreTools.find((tool) => tool.name === "wait_for_task")?.inputSchema;
-        check("Full tool profile exposes 22 tools", fullTools.length === 22, `${fullTools.length} tools`);
+        check("Full tool profile exposes 28 tools", fullTools.length === 28, `${fullTools.length} tools`);
         check(`chatgpt_core profile exposes the exact ${CHATGPT_CORE_TOOL_NAMES.length}-tool manifest`, JSON.stringify(coreTools.map((tool) => tool.name)) === JSON.stringify(CHATGPT_CORE_TOOL_NAMES), coreTools.map((tool) => tool.name).join(", "));
         check("Core task schemas expose inline_plan, verify_commands, and wait aliases", Boolean(createSchema?.properties?.inline_plan &&
             createSchema?.properties?.verify_commands &&
             waitSchema?.properties?.timeout_seconds &&
             waitSchema?.properties?.wait_seconds));
+        // chatgpt_direct profile checks
+        const directDisabledTools = selectToolsForProfile(fullTools, "chatgpt_direct", false);
+        check("chatgpt_direct disabled exposes only health_check (degraded mode)", directDisabledTools.length === 1 && directDisabledTools[0].name === "health_check", `${directDisabledTools.map((t) => t.name).join(", ")}`);
+        if (config?.enableDirectProfile) {
+            const directEnabledTools = selectToolsForProfile(fullTools, "chatgpt_direct", true);
+            check(`chatgpt_direct enabled exposes the exact ${CHATGPT_DIRECT_TOOL_NAMES.length}-tool manifest`, JSON.stringify(directEnabledTools.map((tool) => tool.name)) === JSON.stringify(CHATGPT_DIRECT_TOOL_NAMES), directEnabledTools.map((tool) => tool.name).join(", "));
+        }
+        else {
+            results.push(`[OK]   chatgpt_direct enabled check skipped (enableDirectProfile=false)`);
+            ok++;
+        }
     }
     finally {
         if (previousProfile === undefined)
@@ -259,6 +287,31 @@ async function main() {
         const compiled = resolve(process.cwd(), "dist/tools", `${t}.js`);
         check(`Tool module: ${t}`, existsSync(compiled), existsSync(compiled) ? "compiled" : "missing");
     }
+    // Direct tool module checks
+    const directToolModules = [
+        "createDirectSession",
+        "searchWorkspace",
+        "applyPatch",
+        "runVerification",
+        "finalizeDirectSession",
+        "auditSession",
+    ];
+    for (const t of directToolModules) {
+        const compiled = resolve(process.cwd(), "dist/tools", `${t}.js`);
+        check(`Direct tool module: ${t}`, existsSync(compiled), existsSync(compiled) ? "compiled" : "missing");
+    }
+    // Direct support module checks
+    const directSupportModules = [
+        "directSessionStore",
+        "directGuards",
+        "directPatch",
+        "directVerification",
+        "directAudit",
+    ];
+    for (const t of directSupportModules) {
+        const compiled = resolve(process.cwd(), "dist/direct", `${t}.js`);
+        check(`Direct support module: ${t}`, existsSync(compiled), existsSync(compiled) ? "compiled" : "missing");
+    }
     // Task directory writable
     if (config) {
         const tasksDir = resolve(config.workspaceRoot, config.tasksDir);
@@ -334,11 +387,26 @@ async function main() {
             }
         }
     }
+    // 14b. Direct profile config checks
+    if (config) {
+        const directCmds = config.directAllowedCommands || [];
+        warnCheck("directAllowedCommands is non-empty", directCmds.length > 0, directCmds.length > 0 ? `${directCmds.length} commands` : "No Direct commands configured");
+        // npm run doctor should NOT be in default Direct whitelist
+        const hasDoctor = directCmds.some((c) => c === "npm run doctor");
+        check("directAllowedCommands does not include npm run doctor", !hasDoctor, hasDoctor ? "npm run doctor found in Direct whitelist — remove it for tighter security" : "not present");
+        check("directSessionTtlSeconds is valid", config.directSessionTtlSeconds >= 60 && config.directSessionTtlSeconds <= 86400, `${config.directSessionTtlSeconds}s`);
+        check("directMaxPatchBytes is positive", config.directMaxPatchBytes > 0, `${config.directMaxPatchBytes}`);
+        check("directMaxFileBytes is positive", config.directMaxFileBytes > 0, `${config.directMaxFileBytes}`);
+    }
     // 15. Tunnel example files check
     const tunnelFiles = [
         "examples/openai-tunnel/README.md",
         "examples/openai-tunnel/tunnel-client.example.yaml",
         "examples/openai-tunnel/chatgpt-test-prompt.md",
+        "scripts/patchwarden-mcp-direct.cmd",
+        "PatchWarden.cmd",
+        "scripts/manage-patchwarden.ps1",
+        "scripts/launchers/Start-PatchWarden-Direct-Tunnel.cmd",
     ];
     for (const tf of tunnelFiles) {
         const full = resolve(process.cwd(), tf);

package/dist/runner/agentInvocation.d.ts

@@ -0,0 +1,23 @@
+import { PatchWardenConfig } from "../config.js";
+export interface AgentInvocation {
+    command: string;
+    args: string[];
+    cwd: string;
+    commandLabel: string;
+    promptMode: "inline" | "file";
+    promptFilePath?: string;
+}
+/**
+ * Build agent invocation parameters from config.
+ * Replaces {repo}, {prompt}, and {prompt_file} placeholders.
+ * runTask and agentAssessor share this function to ensure consistent agent startup.
+ */
+export declare function buildAgentInvocation(agentName: string, repoPath: string, prompt: string, config: PatchWardenConfig, promptFilePath?: string): AgentInvocation;
+/**
+ * Build task execution prompt. Mechanically extracted from runTask.ts.
+ */
+export declare function buildExecutionPrompt(plan: string, repoPath: string, testCommand: string): string;
+/**
+ * Build agentAssessor inspect-only prompt.
+ */
+export declare function buildAssessmentPrompt(goal: string, planContent: string, repoPath: string): string;

package/dist/runner/agentInvocation.js

@@ -0,0 +1,106 @@
+import { basename } from "node:path";
+import { guardAgentCommand, sanitizePromptArg } from "../security/commandGuard.js";
+/**
+ * Build agent invocation parameters from config.
+ * Replaces {repo}, {prompt}, and {prompt_file} placeholders.
+ * runTask and agentAssessor share this function to ensure consistent agent startup.
+ */
+export function buildAgentInvocation(agentName, repoPath, prompt, config, promptFilePath) {
+    const agentCmd = guardAgentCommand(agentName, config);
+    const sanitizedPrompt = sanitizePromptArg(prompt);
+    const hasPromptFilePlaceholder = agentCmd.args.includes("{prompt_file}");
+    const promptMode = hasPromptFilePlaceholder && promptFilePath ? "file" : "inline";
+    const resolvedArgs = agentCmd.args.map((arg) => {
+        if (arg === "{repo}")
+            return repoPath;
+        if (arg === "{prompt}")
+            return sanitizedPrompt;
+        if (arg === "{prompt_file}" && promptMode === "file" && promptFilePath)
+            return promptFilePath;
+        return arg;
+    });
+    return {
+        command: agentCmd.command,
+        args: resolvedArgs,
+        cwd: repoPath,
+        commandLabel: `${basename(agentCmd.command)} (configured agent command)`,
+        promptMode,
+        ...(promptMode === "file" && promptFilePath ? { promptFilePath } : {}),
+    };
+}
+/**
+ * Build task execution prompt. Mechanically extracted from runTask.ts.
+ */
+export function buildExecutionPrompt(plan, repoPath, testCommand) {
+    let prompt = `You are executing a pre-written plan in a local repository.
+
+## Repository
+${repoPath}
+
+## Plan
+${plan}
+
+## Instructions
+1. Read the plan carefully.
+2. Implement the changes in this repository only.
+3. Do NOT modify files outside this repository.
+4. Leave repository changes uncommitted for review; remote operations are outside this task.
+5. After implementing, describe what you changed.
+6. Output a summary with what was done, files modified, and issues encountered.
+`;
+    if (testCommand) {
+        prompt += `\n7. You may run ${testCommand}; PatchWarden will independently run it again for verification.`;
+    }
+    return prompt;
+}
+/**
+ * Build agentAssessor inspect-only prompt.
+ */
+export function buildAssessmentPrompt(goal, planContent, repoPath) {
+    return `You are performing a READ-ONLY risk assessment of a planned task. Do NOT modify any files.
+
+## Repository
+${repoPath}
+
+## Goal
+${goal}
+
+## Plan
+${planContent}
+
+## Instructions
+1. Read the plan and goal carefully.
+2. Inspect the repository to understand the scope of changes.
+3. Do NOT create, edit, delete, rename, or generate any files.
+4. Assess the risk level of executing this plan.
+5. Identify affected file paths within the repository.
+6. Check for destructive actions, sensitive file access, or out-of-scope changes.
+7. Output your assessment as JSON after the marker ===ASSESSMENT_JSON=== on a new line.
+
+## Required JSON output format
+After your analysis, output exactly this format:
+
+===ASSESSMENT_JSON===
+{
+  "risk_level": "low" | "medium" | "high",
+  "reason_codes": ["short", "descriptive", "codes"],
+  "affected_paths": ["relative/path/to/file"],
+  "destructive_actions": ["description of any destructive actions"],
+  "requires_user_confirm": false,
+  "confidence": 0.0,
+  "notes": "Brief summary of findings"
+}
+
+## Risk level guidelines
+- low: Small source change, no sensitive files, no destructive actions
+- medium: Multiple files, build artifacts, dependency changes, or uncertain scope
+- high: Destructive actions, sensitive file access, out-of-scope changes, or large-scale deletion
+
+## Constraints
+- affected_paths must be relative paths within the repository (no absolute paths)
+- reason_codes: max 50 entries, each max 100 chars
+- destructive_actions: max 20 entries, each max 200 chars
+- notes: max 2000 chars
+- confidence: number from 0.0 to 1.0
+`;
+}

package/dist/runner/changeCapture.d.ts

@@ -1,6 +1,8 @@
 export interface FileFingerprint {
     size: number;
     sha256: string;
+    tracked: boolean;
+    ignored: boolean;
 }
 export interface RepoSnapshot {
     captured_at: string;
@@ -17,6 +19,31 @@ export interface ChangedFile {
     old_path?: string;
     before_sha256: string | null;
     after_sha256: string | null;
+    tracked: boolean;
+    ignored: boolean;
+    kind: "source" | "build_artifact" | "runtime_generated";
+}
+export interface ClassifiedChange {
+    path: string;
+    change: ChangedFile["change"];
+    tracked: boolean;
+    ignored: boolean;
+    kind: ChangedFile["kind"];
+    reason: string;
+}
+export interface ArtifactHygiene {
+    counts: {
+        source_changes: number;
+        tracked_build_artifacts: number;
+        ignored_untracked_artifacts: number;
+        runtime_generated_files: number;
+        suspicious_changes: number;
+    };
+    source_changes: ClassifiedChange[];
+    tracked_build_artifacts: ClassifiedChange[];
+    ignored_untracked_artifacts: ClassifiedChange[];
+    runtime_generated_files: ClassifiedChange[];
+    suspicious_changes: ClassifiedChange[];
 }
 export interface ChangeArtifacts {
     changed_files: ChangedFile[];
@@ -36,8 +63,10 @@ export interface ChangeArtifacts {
     workspace_dirty_after: boolean;
     patch_mode: "textual" | "no_changes" | "hash_only";
     unavailable_reason: string | null;
+    artifact_hygiene: ArtifactHygiene;
 }
 export declare function captureRepoSnapshot(repoPath: string): RepoSnapshot;
 export declare function writeSnapshot(taskDir: string, filename: string, snapshot: RepoSnapshot): void;
 export declare function buildChangeArtifacts(repoPath: string, before: RepoSnapshot, after: RepoSnapshot): ChangeArtifacts;
 export declare function compareSnapshots(before: RepoSnapshot, after: RepoSnapshot): ChangedFile[];
+export declare function emptyArtifactHygiene(): ArtifactHygiene;

package/dist/runner/changeCapture.js

@@ -13,11 +13,26 @@ export function captureRepoSnapshot(repoPath) {
     let head = null;
     let status = "";
     let paths = [];
+    const trackedPaths = new Set();
+    const ignoredPaths = new Set();
     if (isGit) {
         const headResult = runGit(repoPath, ["rev-parse", "HEAD"]);
         if (headResult.status === 0)
             head = headResult.stdout.trim() || null;
         status = runGit(repoPath, ["status", "--porcelain=v1", "-uall"]).stdout.trimEnd();
+        const tracked = runGit(repoPath, ["ls-files", "-z"]);
+        if (tracked.status === 0) {
+            for (const path of tracked.stdout.split("\0").filter(Boolean))
+                trackedPaths.add(normalizePath(path));
+        }
+        const ignored = runGit(repoPath, ["ls-files", "-o", "-i", "--exclude-standard", "-z"]);
+        if (ignored.status === 0) {
+            for (const path of ignored.stdout.split("\0").filter(Boolean))
+                ignoredPaths.add(normalizePath(path));
+        }
+        else {
+            warnings.push("git ignored-file discovery failed; ignored classification may be incomplete");
+        }
         const listed = runGit(repoPath, ["ls-files", "-co", "--exclude-standard", "-z"]);
         if (listed.status === 0) {
             paths = [...new Set([
@@ -40,7 +55,7 @@ export function captureRepoSnapshot(repoPath) {
     }
     const files = {};
     for (const inputPath of paths.sort()) {
-        const normalized = inputPath.replace(/\\/g, "/");
+        const normalized = normalizePath(inputPath);
         if (!normalized || normalized.startsWith(".patchwarden/") || isSensitivePath(normalized))
             continue;
         const absolutePath = resolve(repoPath, inputPath);
@@ -51,7 +66,12 @@ export function captureRepoSnapshot(repoPath) {
             const sha256 = stat.size <= MAX_HASH_BYTES
                 ? createHash("sha256").update(readFileSync(absolutePath)).digest("hex")
                 : `large-file:${stat.size}:${Math.trunc(stat.mtimeMs)}`;
-            files[normalized] = { size: stat.size, sha256 };
+            files[normalized] = {
+                size: stat.size,
+                sha256,
+                tracked: trackedPaths.has(normalized),
+                ignored: !trackedPaths.has(normalized) && ignoredPaths.has(normalized),
+            };
         }
         catch {
             warnings.push(`could not fingerprint: ${normalized}`);
@@ -72,6 +92,7 @@ export function writeSnapshot(taskDir, filename, snapshot) {
 }
 export function buildChangeArtifacts(repoPath, before, after) {
     const changedFiles = compareSnapshots(before, after);
+    const artifactHygiene = classifyArtifactHygiene(changedFiles);
     const sections = [];
     const scopedPaths = [...new Set(changedFiles.flatMap((file) => file.old_path ? [file.old_path, file.path] : [file.path]))];
     if (before.is_git && after.is_git && scopedPaths.length > 0) {
@@ -122,6 +143,7 @@ export function buildChangeArtifacts(repoPath, before, after) {
                 ? "Git could not produce a textual patch for the changed files; hash evidence remains available."
                 : "Repository is not a Git worktree; only bounded hash evidence is available.")
             : null,
+        artifact_hygiene: artifactHygiene,
     };
 }
 function buildFileStats(repoPath, before, after, changedFiles) {
@@ -168,13 +190,13 @@ export function compareSnapshots(before, after) {
         const left = before.files[path];
         const right = after.files[path];
         if (!left && right) {
-            changed.push({ path, change: "added", before_sha256: null, after_sha256: right.sha256 });
+            changed.push(classifyChangedFile(path, "added", null, right));
         }
         else if (left && !right) {
-            changed.push({ path, change: "deleted", before_sha256: left.sha256, after_sha256: null });
+            changed.push(classifyChangedFile(path, "deleted", left, null));
         }
         else if (left.sha256 !== right.sha256) {
-            changed.push({ path, change: "modified", before_sha256: left.sha256, after_sha256: right.sha256 });
+            changed.push(classifyChangedFile(path, "modified", left, right));
         }
     }
     const deletedByHash = new Map();
@@ -198,11 +220,91 @@ export function compareSnapshots(before, after) {
             change: "renamed",
             before_sha256: source.before_sha256,
             after_sha256: file.after_sha256,
+            tracked: file.tracked || source.tracked,
+            ignored: file.ignored,
+            kind: classifyPathKind(file.path),
         });
     }
     return [...changed.filter((item) => !consumed.has(item)), ...renamed]
         .sort((left, right) => left.path.localeCompare(right.path));
 }
+export function emptyArtifactHygiene() {
+    return {
+        counts: {
+            source_changes: 0,
+            tracked_build_artifacts: 0,
+            ignored_untracked_artifacts: 0,
+            runtime_generated_files: 0,
+            suspicious_changes: 0,
+        },
+        source_changes: [],
+        tracked_build_artifacts: [],
+        ignored_untracked_artifacts: [],
+        runtime_generated_files: [],
+        suspicious_changes: [],
+    };
+}
+function classifyChangedFile(path, change, before, after) {
+    return {
+        path,
+        change,
+        before_sha256: before?.sha256 || null,
+        after_sha256: after?.sha256 || null,
+        tracked: Boolean(after?.tracked || before?.tracked),
+        ignored: Boolean(after?.ignored ?? before?.ignored),
+        kind: classifyPathKind(path),
+    };
+}
+function classifyArtifactHygiene(changes) {
+    const hygiene = emptyArtifactHygiene();
+    const entries = changes.map((change) => ({
+        path: change.path,
+        change: change.change,
+        tracked: change.tracked,
+        ignored: change.ignored,
+        kind: change.kind,
+        reason: classificationReason(change),
+    }));
+    hygiene.source_changes = entries.filter((entry) => entry.kind === "source" && !entry.ignored);
+    hygiene.tracked_build_artifacts = entries.filter((entry) => entry.kind === "build_artifact" && entry.tracked);
+    hygiene.ignored_untracked_artifacts = entries.filter((entry) => entry.ignored && !entry.tracked);
+    hygiene.runtime_generated_files = entries.filter((entry) => entry.kind === "runtime_generated");
+    hygiene.suspicious_changes = entries.filter((entry) => (entry.kind === "build_artifact" || entry.kind === "runtime_generated") && !entry.ignored);
+    hygiene.counts = {
+        source_changes: hygiene.source_changes.length,
+        tracked_build_artifacts: hygiene.tracked_build_artifacts.length,
+        ignored_untracked_artifacts: hygiene.ignored_untracked_artifacts.length,
+        runtime_generated_files: hygiene.runtime_generated_files.length,
+        suspicious_changes: hygiene.suspicious_changes.length,
+    };
+    return hygiene;
+}
+function classifyPathKind(path) {
+    const normalized = normalizePath(path).toLowerCase();
+    const parts = normalized.split("/");
+    const basename = parts[parts.length - 1] || "";
+    if (basename === "sync-store.json" || /\.(log|tmp|temp|pid)$/.test(basename))
+        return "runtime_generated";
+    if (parts.some((part) => ["dist", "release", "build", "out", "coverage", ".next"].includes(part)))
+        return "build_artifact";
+    if (/\.(exe|dll|pak|bin|zip|tgz|tar\.gz)$/.test(basename))
+        return "build_artifact";
+    return "source";
+}
+function classificationReason(change) {
+    if (change.ignored)
+        return "untracked path is ignored by repository Git rules";
+    if (change.kind === "build_artifact" && change.tracked)
+        return "artifact-like path is tracked by Git and requires review";
+    if (change.kind === "build_artifact")
+        return "artifact-like path is not ignored and requires review";
+    if (change.kind === "runtime_generated")
+        return "runtime-generated path is not ignored and requires review";
+    return change.tracked ? "tracked source change" : "untracked source change";
+}
+function normalizePath(value) {
+    return value.replace(/\\/g, "/");
+}
 function walkWorkspace(root) {
     const result = [];
     const visit = (directory) => {