patchwarden 0.4.0 → 0.6.1

package/dist/runner/simpleProcess.js

@@ -0,0 +1,206 @@
+import { spawn, spawnSync } from "node:child_process";
+import { createWriteStream, writeFileSync, readFileSync, existsSync } from "node:fs";
+const GRACEFUL_KILL_MS = 2000;
+const DEFAULT_MAX_STDOUT = 524288;
+const DEFAULT_MAX_STDERR = 131072;
+export function runSimpleProcessSync(options) {
+    const maxStdout = options.maxStdoutBytes ?? DEFAULT_MAX_STDOUT;
+    const maxStderr = options.maxStderrBytes ?? DEFAULT_MAX_STDERR;
+    let result;
+    try {
+        result = spawnSync(options.command, options.args, {
+            cwd: options.cwd,
+            stdio: ["ignore", "pipe", "pipe"],
+            timeout: options.timeoutMs,
+            windowsHide: true,
+            maxBuffer: maxStdout + 1024,
+            encoding: "utf-8",
+        });
+    }
+    catch (error) {
+        return {
+            exitCode: null,
+            stdout: "",
+            stderr: "",
+            spawnError: error instanceof Error ? error.message : String(error),
+            timedOut: false,
+            stdoutTruncated: false,
+            stderrTruncated: false,
+        };
+    }
+    const stdout = result.stdout || "";
+    const stderr = result.stderr || "";
+    const timedOut = Boolean(result.signal === "SIGTERM" || result.signal === "SIGKILL" ||
+        (result.signal !== null && result.status === null) ||
+        (result.error && result.error.code === "ETIMEDOUT"));
+    if (options.stdoutPath && stdout) {
+        try {
+            writeFileSyncAppend(options.stdoutPath, stdout);
+        }
+        catch { }
+    }
+    if (options.stderrPath && stderr) {
+        try {
+            writeFileSyncAppend(options.stderrPath, stderr);
+        }
+        catch { }
+    }
+    return {
+        exitCode: result.status,
+        stdout: stdout.length > maxStdout ? stdout.slice(0, maxStdout) : stdout,
+        stderr: stderr.length > maxStderr ? stderr.slice(0, maxStderr) : stderr,
+        // If timed out, don't report spawnError — it's a timeout, not a spawn failure
+        spawnError: timedOut ? null : (result.error ? result.error.message : null),
+        timedOut,
+        stdoutTruncated: stdout.length > maxStdout,
+        stderrTruncated: stderr.length > maxStderr,
+    };
+}
+export async function runSimpleProcess(options) {
+    const maxStdout = options.maxStdoutBytes ?? DEFAULT_MAX_STDOUT;
+    const maxStderr = options.maxStderrBytes ?? DEFAULT_MAX_STDERR;
+    const deadlineMs = Date.now() + options.timeoutMs;
+    let child;
+    try {
+        child = spawn(options.command, options.args, {
+            cwd: options.cwd,
+            stdio: ["ignore", "pipe", "pipe"],
+            detached: process.platform !== "win32",
+            windowsHide: true,
+        });
+    }
+    catch (error) {
+        return {
+            exitCode: null,
+            stdout: "",
+            stderr: "",
+            spawnError: error instanceof Error ? error.message : String(error),
+            timedOut: false,
+            stdoutTruncated: false,
+            stderrTruncated: false,
+        };
+    }
+    const stdoutStream = options.stdoutPath ? createWriteStream(options.stdoutPath, { flags: "a" }) : null;
+    const stderrStream = options.stderrPath ? createWriteStream(options.stderrPath, { flags: "a" }) : null;
+    let stdoutBuf = Buffer.alloc(0);
+    let stderrBuf = Buffer.alloc(0);
+    let stdoutTruncated = false;
+    let stderrTruncated = false;
+    let spawnError = null;
+    let timedOut = false;
+    let forceTimer = null;
+    let terminationStarted = false;
+    const requestTermination = (reason, force) => {
+        if (terminationStarted)
+            return;
+        terminationStarted = true;
+        if (reason === "timeout")
+            timedOut = true;
+        if (force) {
+            forceKill(child);
+        }
+        else {
+            gracefulKill(child);
+            forceTimer = setTimeout(() => forceKill(child), GRACEFUL_KILL_MS);
+        }
+    };
+    child.stdout?.on("data", (chunk) => {
+        stdoutStream?.write(chunk);
+        if (stdoutBuf.length < maxStdout) {
+            const remaining = maxStdout - stdoutBuf.length;
+            if (chunk.length <= remaining) {
+                stdoutBuf = Buffer.concat([stdoutBuf, chunk]);
+            }
+            else {
+                stdoutBuf = Buffer.concat([stdoutBuf, chunk.slice(0, remaining)]);
+                stdoutTruncated = true;
+            }
+        }
+        else {
+            stdoutTruncated = true;
+        }
+    });
+    child.stderr?.on("data", (chunk) => {
+        stderrStream?.write(chunk);
+        if (stderrBuf.length < maxStderr) {
+            const remaining = maxStderr - stderrBuf.length;
+            if (chunk.length <= remaining) {
+                stderrBuf = Buffer.concat([stderrBuf, chunk]);
+            }
+            else {
+                stderrBuf = Buffer.concat([stderrBuf, chunk.slice(0, remaining)]);
+                stderrTruncated = true;
+            }
+        }
+        else {
+            stderrTruncated = true;
+        }
+    });
+    const timeoutTimer = setTimeout(() => requestTermination("timeout", true), options.timeoutMs);
+    const exitCode = await new Promise((resolveExit) => {
+        let settled = false;
+        const finish = (code) => {
+            if (settled)
+                return;
+            settled = true;
+            resolveExit(code);
+        };
+        child.once("close", (code) => finish(code));
+        child.once("exit", (code) => finish(code));
+        child.once("error", (error) => {
+            spawnError = error.message;
+            finish(null);
+        });
+    });
+    clearTimeout(timeoutTimer);
+    if (forceTimer)
+        clearTimeout(forceTimer);
+    stdoutStream?.destroy();
+    stderrStream?.destroy();
+    return {
+        exitCode,
+        stdout: stdoutBuf.toString("utf-8"),
+        stderr: stderrBuf.toString("utf-8"),
+        spawnError,
+        timedOut,
+        stdoutTruncated,
+        stderrTruncated,
+    };
+}
+function gracefulKill(child) {
+    try {
+        if (process.platform !== "win32" && child.pid)
+            process.kill(-child.pid, "SIGTERM");
+        else
+            child.kill("SIGTERM");
+    }
+    catch { }
+}
+function forceKill(child) {
+    if (!child.pid)
+        return;
+    try {
+        if (process.platform === "win32") {
+            const result = spawnSync("taskkill.exe", ["/PID", String(child.pid), "/T", "/F"], {
+                stdio: "ignore",
+                timeout: 5000,
+                windowsHide: true,
+            });
+            if (result.status !== 0)
+                child.kill("SIGKILL");
+        }
+        else {
+            process.kill(-child.pid, "SIGKILL");
+        }
+    }
+    catch {
+        try {
+            child.kill("SIGKILL");
+        }
+        catch { }
+    }
+}
+function writeFileSyncAppend(path, content) {
+    const existing = existsSync(path) ? readFileSync(path, "utf-8") : "";
+    writeFileSync(path, existing + content, "utf-8");
+}

package/dist/runner/watch.js

@@ -21,6 +21,8 @@ import { resolve, join, dirname } from "node:path";
 import { loadConfig, getConfig, getTasksDir, resolveWorkspaceRoot } from "../config.js";
 import { guardWorkspacePath } from "../security/pathGuard.js";
 import { guardAgentCommand, guardTestCommand } from "../security/commandGuard.js";
+import { validateAssessmentFreshness } from "../assessments/assessmentStore.js";
+import { captureRepoSnapshot } from "./changeCapture.js";
 import { runTask } from "./runTask.js";
 // ── Bootstrap ─────────────────────────────────────────────────────
 loadConfig();
@@ -80,12 +82,25 @@ async function tick() {
             // ── Pre-flight safety checks ──
             try {
                 // Check repo_path
-                guardWorkspacePath(statusData.repo_path || wsRoot, wsRoot);
+                const resolvedRepoPath = guardWorkspacePath(statusData.resolved_repo_path || statusData.repo_path || wsRoot, wsRoot);
                 // Check agent
                 guardAgentCommand(statusData.agent, config);
                 // Check test_command
                 if (statusData.test_command) {
-                    guardTestCommand(statusData.test_command, config);
+                    guardTestCommand(statusData.test_command, config, resolvedRepoPath);
+                }
+                if (Array.isArray(statusData.verify_commands)) {
+                    for (const command of statusData.verify_commands) {
+                        guardTestCommand(String(command), config, resolvedRepoPath);
+                    }
+                }
+                // Assessment freshness revalidation
+                if (statusData.assessment_id) {
+                    const preExecSnapshot = captureRepoSnapshot(resolvedRepoPath);
+                    const validation = validateAssessmentFreshness(String(statusData.assessment_id), preExecSnapshot);
+                    if (!validation.valid) {
+                        throw new Error(`assessment validation failed: ${validation.failure_reason}`);
+                    }
                 }
             }
             catch (err) {

package/dist/security/commandGuard.d.ts

@@ -13,7 +13,8 @@ export interface AllowedCommand {
     args: string[];
 }
 export declare function guardAgentCommand(agent: string, config: PatchWardenConfig): AllowedCommand;
-export declare function guardTestCommand(testCommand: string, config: PatchWardenConfig): string;
+export declare function guardTestCommand(testCommand: string, config: PatchWardenConfig, repoPath?: string): string;
+export declare function guardDirectCommand(command: string, config: PatchWardenConfig, repoPath?: string): string;
 /**
  * Escape a user-provided string for safe use in shell arguments.
  * We prevent injection by refusing to pass arbitrary strings to shell.

package/dist/security/commandGuard.js

@@ -1,3 +1,4 @@
+import { getRepoAllowedTestCommands, getRepoDirectAllowedCommands } from "../config.js";
 import { PatchWardenError } from "../errors.js";
 export function guardAgentCommand(agent, config) {
     const agentCfg = config.agents[agent];
@@ -32,7 +33,7 @@ function isSafeConfiguredCommand(command) {
     const basename = parts[parts.length - 1] || "";
     return /^[a-zA-Z0-9._-]+$/.test(basename);
 }
-export function guardTestCommand(testCommand, config) {
+export function guardTestCommand(testCommand, config, repoPath) {
     if (!testCommand || typeof testCommand !== "string") {
         // If no test command specified, that's ok — skip tests
         return "";
@@ -40,8 +41,29 @@ export function guardTestCommand(testCommand, config) {
     const trimmed = testCommand.trim();
     if (trimmed === "")
         return "";
-    if (!config.allowedTestCommands.includes(trimmed)) {
-        throw new PatchWardenError("test_command_not_allowlisted", `Test command "${trimmed}" is not in the allowed list. Allowed: ${config.allowedTestCommands.join(", ")}`, "Use an exact allowed command shown by create_task, or omit test_command.");
+    const allowedCommands = [
+        ...config.allowedTestCommands,
+        ...(repoPath ? getRepoAllowedTestCommands(config, repoPath) : []),
+    ];
+    if (!allowedCommands.includes(trimmed)) {
+        throw new PatchWardenError("test_command_not_allowlisted", `Test command "${trimmed}" is not allowed for this repository. Allowed: ${allowedCommands.join(", ")}`, "Use an exact allowed command shown by create_task, or omit test_command.");
+    }
+    return trimmed;
+}
+export function guardDirectCommand(command, config, repoPath) {
+    if (!command || typeof command !== "string") {
+        throw new PatchWardenError("direct_command_required", "A command string is required for run_verification.", "Provide one of the allowed Direct verification commands.");
+    }
+    const trimmed = command.trim();
+    if (trimmed === "") {
+        throw new PatchWardenError("direct_command_required", "A command string is required for run_verification.", "Provide one of the allowed Direct verification commands.");
+    }
+    const allowedCommands = [
+        ...(config.directAllowedCommands || []),
+        ...(repoPath ? getRepoDirectAllowedCommands(config, repoPath) : []),
+    ];
+    if (!allowedCommands.includes(trimmed)) {
+        throw new PatchWardenError("direct_command_not_allowlisted", `Direct command "${trimmed}" is not allowed. Allowed: ${allowedCommands.join(", ")}`, "Use an exact allowed command from the Direct allowlist.");
     }
     return trimmed;
 }

package/dist/security/riskEngine.d.ts

@@ -0,0 +1,27 @@
+import { PatchWardenConfig } from "../config.js";
+import type { TaskTemplateName } from "../tools/taskTemplates.js";
+export type RiskLevel = "low" | "medium" | "high";
+export type RiskDecision = "allow" | "needs_confirm" | "blocked";
+export interface RiskAssessmentInput {
+    repoPath: string;
+    resolvedRepoPath: string;
+    planContent: string;
+    planTitle: string;
+    testCommand: string;
+    verifyCommands: string[];
+    template?: TaskTemplateName;
+    goal?: string;
+    agent: string;
+    config: PatchWardenConfig;
+    snapshotTruncated: boolean;
+}
+export interface RiskAssessmentResult {
+    risk_level: RiskLevel;
+    decision: RiskDecision;
+    reason_codes: string[];
+    risk_hints: string[];
+    hard_rule_hits: string[];
+}
+export declare function assessRisk(input: RiskAssessmentInput): RiskAssessmentResult;
+/** Risk hints — keyword detection only, never affects risk_level (收缩 #4). */
+export declare function collectRiskHints(input: RiskAssessmentInput): string[];

package/dist/security/riskEngine.js

@@ -0,0 +1,118 @@
+import { existsSync, statSync, } from "node:fs";
+import { resolve } from "node:path";
+import { guardWorkspacePath } from "./pathGuard.js";
+import { guardPlanContent } from "./planGuard.js";
+import { guardTestCommand } from "./commandGuard.js";
+import { isSensitivePath } from "./sensitiveGuard.js";
+import { guardRuntimeSelfModification } from "./runtimeGuard.js";
+import { PatchWardenError } from "../errors.js";
+const DIST_COMMANDS = new Set(["npm run dist", "npm run pack"]);
+export function assessRisk(input) {
+    const hardRuleHits = [];
+    const reasonCodes = [];
+    // ── Hard rules (guard functions). A hit means high → blocked. ──
+    let resolvedRepoPath = input.resolvedRepoPath;
+    try {
+        resolvedRepoPath = guardWorkspacePath(input.repoPath, input.config.workspaceRoot);
+    }
+    catch (e) {
+        hardRuleHits.push(extractReason(e));
+        return finalize("high", "blocked", reasonCodes, hardRuleHits, input);
+    }
+    if (!existsSync(resolvedRepoPath)) {
+        hardRuleHits.push("repo_path_not_found");
+        return finalize("high", "blocked", reasonCodes, hardRuleHits, input);
+    }
+    if (!statSync(resolvedRepoPath).isDirectory()) {
+        hardRuleHits.push("repo_path_not_directory");
+        return finalize("high", "blocked", reasonCodes, hardRuleHits, input);
+    }
+    try {
+        guardRuntimeSelfModification(resolvedRepoPath);
+    }
+    catch (e) {
+        hardRuleHits.push(extractReason(e));
+        return finalize("high", "blocked", reasonCodes, hardRuleHits, input);
+    }
+    if (!input.config.agents[input.agent]) {
+        hardRuleHits.push("agent_not_configured");
+        return finalize("high", "blocked", reasonCodes, hardRuleHits, input);
+    }
+    try {
+        guardPlanContent(input.planTitle, input.planContent);
+    }
+    catch (e) {
+        hardRuleHits.push(extractReason(e));
+        return finalize("high", "blocked", reasonCodes, hardRuleHits, input);
+    }
+    for (const cmd of [input.testCommand, ...input.verifyCommands]) {
+        if (!cmd || cmd.trim() === "")
+            continue;
+        try {
+            guardTestCommand(cmd, input.config, resolvedRepoPath);
+        }
+        catch (e) {
+            hardRuleHits.push(extractReason(e));
+            return finalize("high", "blocked", reasonCodes, hardRuleHits, input);
+        }
+    }
+    if (input.goal) {
+        const goalPath = resolve(resolvedRepoPath, input.goal);
+        if (isSensitivePath(input.goal) || isSensitivePath(goalPath)) {
+            hardRuleHits.push("sensitive_path_in_goal");
+            return finalize("high", "blocked", reasonCodes, hardRuleHits, input);
+        }
+    }
+    // ── Hard rules passed. Reason codes for passing. ──
+    reasonCodes.push("repo_scoped", "no_sensitive_paths", "allowlisted_commands");
+    // ── Snapshot truncation (微调 #2): force needs_confirm. ──
+    if (input.snapshotTruncated) {
+        reasonCodes.push("snapshot_truncated");
+        return finalize("medium", "needs_confirm", reasonCodes, hardRuleHits, input);
+    }
+    // ── Medium-risk policy decisions. ──
+    if (input.template === "release_check") {
+        reasonCodes.push("release_template_needs_confirm");
+        return finalize("medium", "needs_confirm", reasonCodes, hardRuleHits, input);
+    }
+    if (input.verifyCommands.some((c) => DIST_COMMANDS.has(c.trim()))) {
+        reasonCodes.push("dist_command_needs_confirm");
+        return finalize("medium", "needs_confirm", reasonCodes, hardRuleHits, input);
+    }
+    // ── Low risk. ──
+    if (input.template === "inspect_only")
+        reasonCodes.push("inspect_only_no_changes");
+    else if (input.template === "feature_small")
+        reasonCodes.push("feature_small_scoped");
+    else if (input.template === "fix_tests")
+        reasonCodes.push("fix_tests_scoped");
+    return finalize("low", "allow", reasonCodes, hardRuleHits, input);
+}
+/** Risk hints — keyword detection only, never affects risk_level (收缩 #4). */
+export function collectRiskHints(input) {
+    const hints = [];
+    const text = `${input.goal || ""} ${input.planContent || ""}`.toLowerCase();
+    if (/\bpackage-lock\b/.test(text))
+        hints.push("mentions_package_lock");
+    if (/\brelease\b|\bdist\b/.test(text))
+        hints.push("mentions_artifact_dir");
+    if (/\bsync\b|\bbackup\b|\bpayload\b|\bpersistence\b/.test(text))
+        hints.push("mentions_dev_vocab");
+    return hints;
+}
+function finalize(risk_level, decision, reason_codes, hard_rule_hits, input) {
+    return {
+        risk_level,
+        decision,
+        reason_codes,
+        risk_hints: collectRiskHints(input),
+        hard_rule_hits,
+    };
+}
+function extractReason(error) {
+    if (error instanceof PatchWardenError)
+        return error.reason;
+    if (error instanceof Error)
+        return error.message.slice(0, 80);
+    return String(error).slice(0, 80);
+}

package/dist/security/runtimeGuard.d.ts

@@ -0,0 +1,6 @@
+/**
+ * Refuse operations against the active PatchWarden runtime directory or its
+ * critical subdirectories. Extracted from createTask.ts so assess-only flows
+ * and direct-session flows share the same protection.
+ */
+export declare function guardRuntimeSelfModification(resolvedRepoPath: string): void;

package/dist/security/runtimeGuard.js

@@ -0,0 +1,28 @@
+import { resolve, join, dirname } from "node:path";
+import { fileURLToPath } from "node:url";
+import { PatchWardenError } from "../errors.js";
+const CRITICAL_RUNTIME_DIRS = ["dist", "src", "scripts", "release"];
+/**
+ * Refuse operations against the active PatchWarden runtime directory or its
+ * critical subdirectories. Extracted from createTask.ts so assess-only flows
+ * and direct-session flows share the same protection.
+ */
+export function guardRuntimeSelfModification(resolvedRepoPath) {
+    const runtimeRoot = resolve(dirname(fileURLToPath(import.meta.url)), "..");
+    if (resolvedRepoPath === runtimeRoot ||
+        resolvedRepoPath.startsWith(runtimeRoot + resolve("/")[0])) {
+        const isCritical = CRITICAL_RUNTIME_DIRS.some((dir) => {
+            const full = join(runtimeRoot, dir);
+            return (resolvedRepoPath === full ||
+                resolvedRepoPath.startsWith(full + resolve("/")[0]));
+        });
+        if (resolvedRepoPath === runtimeRoot || isCritical) {
+            throw new PatchWardenError("runtime_self_modification_blocked", `repo_path points to the active PatchWarden runtime or its critical subdirectories.`, "Use a dev copy or git worktree for PatchWarden development. The running MCP server must not be modified by a task.", true, {
+                operation: "runtime_guard",
+                path: resolvedRepoPath,
+                runtime_root: runtimeRoot,
+                safe_alternative: "Clone or copy PatchWarden to a separate directory for development tasks.",
+            });
+        }
+    }
+}