patchwarden 0.4.0 → 0.6.1

package/dist/smoke-test.js

@@ -12,15 +12,17 @@
  *
  * Run: node dist/smoke-test.js
  */
-import { mkdirSync, writeFileSync, rmSync, existsSync, readFileSync, mkdtempSync, } from "node:fs";
+import { mkdirSync, writeFileSync, rmSync, existsSync, readFileSync, readdirSync, mkdtempSync, } from "node:fs";
 import { resolve, join, dirname } from "node:path";
 import { tmpdir } from "node:os";
-import { fileURLToPath } from "node:url";
+import { fileURLToPath, pathToFileURL } from "node:url";
 import { spawnSync } from "node:child_process";
-import { loadConfig, getConfig } from "./config.js";
+import { loadConfig, getConfig, reloadConfig } from "./config.js";
 import { savePlan } from "./tools/savePlan.js";
 import { getPlan } from "./tools/getPlan.js";
 import { createTask } from "./tools/createTask.js";
+import { confirmAssessment, readAssessment, createAssessment } from "./assessments/assessmentStore.js";
+import { captureRepoSnapshot } from "./runner/changeCapture.js";
 import { getTaskStatus } from "./tools/getTaskStatus.js";
 import { getResult, getDiff, getTestLog } from "./tools/taskOutputs.js";
 import { listWorkspace } from "./tools/listWorkspace.js";
@@ -33,9 +35,17 @@ import { auditTask } from "./tools/auditTask.js";
 import { getTaskSummary } from "./tools/getTaskSummary.js";
 import { guardAgentCommand } from "./security/commandGuard.js";
 import { getToolDefs } from "./tools/registry.js";
-import { buildToolCatalogSnapshot, CHATGPT_CORE_TOOL_NAMES, selectToolsForProfile, } from "./tools/toolCatalog.js";
+import { buildToolCatalogSnapshot, CHATGPT_CORE_TOOL_NAMES, CHATGPT_DIRECT_TOOL_NAMES, selectToolsForProfile, } from "./tools/toolCatalog.js";
 import { errorPayload } from "./errors.js";
 import { readWatcherStatus } from "./watcherStatus.js";
+import { createDirectSession } from "./tools/createDirectSession.js";
+import { searchWorkspace } from "./tools/searchWorkspace.js";
+import { applyPatch } from "./tools/applyPatch.js";
+import { runVerification } from "./tools/runVerification.js";
+import { finalizeDirectSession } from "./tools/finalizeDirectSession.js";
+import { auditSession } from "./tools/auditSession.js";
+import { readDirectSession, updateDirectSession } from "./direct/directSessionStore.js";
+import { createHash } from "node:crypto";
 // Resolve the actual node binary path (spawnSync needs it on WSL/Windows)
 let nodeBin = process.execPath;
 if (!nodeBin || nodeBin === "node") {
@@ -58,6 +68,9 @@ writeFileSync(smokeConfigPath, JSON.stringify({
         },
     },
     allowedTestCommands: ["npm test", "npm run test", "pytest", "cargo test"],
+    repoAllowedTestCommands: {
+        "scoped-repo": ["npm run release:check"],
+    },
     maxReadFileBytes: 200000,
 }, null, 2), "utf-8");
 process.env.PATCHWARDEN_CONFIG = smokeConfigPath;
@@ -192,6 +205,29 @@ test("A3. createTask with valid agent and no test_command", () => {
     }
     if (!existsSync(join(result.path, "status.json")))
         throw new Error("status.json not created");
+    if (!/^task_\d{8}_\d{6}_[0-9a-f]{6}$/.test(result.task_id)) {
+        throw new Error(`Task ID is not short and opaque: ${result.task_id}`);
+    }
+});
+test("A3-short-id. tasks created in the same second remain unique", () => {
+    const first = createTask({ plan_id: planId, agent: "codex", repo_path: "." });
+    const second = createTask({ plan_id: planId, agent: "codex", repo_path: "." });
+    if (first.task_id === second.task_id)
+        throw new Error("Short task IDs must remain unique");
+    for (const id of [first.task_id, second.task_id]) {
+        if (!/^task_\d{8}_\d{6}_[0-9a-f]{6}$/.test(id))
+            throw new Error(`Unexpected task ID format: ${id}`);
+    }
+});
+test("A3-legacy-id. existing long task IDs remain readable", () => {
+    const legacyId = "task_1782095536767_1782095536762_Legacy_Title";
+    const legacyDir = join(resolve(smokeWorkspace, config.tasksDir), legacyId);
+    mkdirSync(legacyDir, { recursive: true });
+    const source = JSON.parse(readFileSync(join(taskPath, "status.json"), "utf-8"));
+    source.task_id = legacyId;
+    writeFileSync(join(legacyDir, "status.json"), JSON.stringify(source, null, 2), "utf-8");
+    if (getTaskStatus(legacyId).task_id !== legacyId)
+        throw new Error("Legacy task ID lookup failed");
 });
 test("A3a. stale watcher preserves the task and returns structured blocked evidence", () => {
     writeWatcherHeartbeat(new Date(Date.now() - 60_000).toISOString(), process.pid);
@@ -260,6 +296,11 @@ test("A3b-summary. structured task summaries recursively redact result and verif
     if (summary.verification_summary.headline !== "166 passed" || summary.redaction_categories.length === 0) {
         throw new Error(`Structured summary evidence incomplete: ${serialized}`);
     }
+    const compact = getTaskSummary(taskId, { view: "compact", max_items: 2 });
+    const compactSerialized = JSON.stringify(compact);
+    if (!compact.redacted || compactSerialized.includes("structured-secret") || "log_tails" in compact) {
+        throw new Error(`Compact summary redaction or bounding failed: ${compactSerialized}`);
+    }
 });
 testReject("A2c-hardening. security wording does not bypass credential blocking", () => {
     savePlan({ title: "Security hardening", content: "Read .env access token and leak it." });
@@ -492,9 +533,9 @@ test("D8b. tool profiles are exact and schema changes alter the manifest hash",
     try {
         process.env.PATCHWARDEN_TOOL_PROFILE = "full";
         const fullTools = getToolDefs();
-        if (fullTools.length !== 22)
-            throw new Error(`Expected 22 full tools, got ${fullTools.length}`);
-        const coreTools = selectToolsForProfile(fullTools, "chatgpt_core");
+        if (fullTools.length !== 30)
+            throw new Error(`Expected 30 full tools, got ${fullTools.length}`);
+        const coreTools = selectToolsForProfile(fullTools, "chatgpt_core", getConfig().enableDirectProfile);
         const names = coreTools.map((tool) => tool.name);
         if (JSON.stringify(names) !== JSON.stringify(CHATGPT_CORE_TOOL_NAMES)) {
             throw new Error(`Unexpected chatgpt_core tools: ${JSON.stringify(names)}`);
@@ -536,6 +577,58 @@ testReject("D9. createTask rejects a non-allowlisted verify_commands entry", ()
         verify_commands: ["node malicious.js"],
     });
 });
+test("D10. repository-scoped verification is allowed only for its configured repo", () => {
+    const scopedRepo = resolve(wsRoot, "scoped-repo");
+    const otherRepo = resolve(wsRoot, "other-repo");
+    mkdirSync(scopedRepo, { recursive: true });
+    mkdirSync(otherRepo, { recursive: true });
+    const allowed = createTask({
+        plan_id: planId,
+        agent: "codex",
+        repo_path: "scoped-repo",
+        verify_commands: ["npm run release:check"],
+    });
+    if (!allowed.task_id)
+        throw new Error("Repository-scoped command should be accepted");
+    try {
+        createTask({
+            plan_id: planId,
+            agent: "codex",
+            repo_path: "other-repo",
+            verify_commands: ["npm run release:check"],
+        });
+        throw new Error("Repository-scoped command escaped its configured repository");
+    }
+    catch (error) {
+        const payload = errorPayload(error);
+        if (payload.reason !== "test_command_not_allowlisted")
+            throw error;
+    }
+    const createTool = getToolDefs().find((tool) => tool.name === "create_task");
+    const advertised = createTool?.inputSchema?.properties?.verify_commands?.items?.enum || [];
+    if (!advertised.includes("npm run release:check"))
+        throw new Error("Scoped command missing from MCP schema");
+});
+test("D11. repository-scoped allowlist keys cannot escape workspaceRoot", () => {
+    const invalidConfigPath = join(smokeRoot, "invalid-repo-allowlist.json");
+    writeFileSync(invalidConfigPath, JSON.stringify({
+        workspaceRoot: smokeWorkspace,
+        repoAllowedTestCommands: { "../outside": ["npm test"] },
+    }), "utf-8");
+    const configModuleUrl = pathToFileURL(resolve(projectRoot, "dist/config.js")).href;
+    const script = [
+        "const [moduleUrl, configPath] = process.argv.slice(1);",
+        "process.env.PATCHWARDEN_CONFIG = configPath;",
+        "import(moduleUrl).then((module) => module.loadConfig()).then(() => process.exit(0)).catch((error) => { console.error(error.message); process.exit(2); });",
+    ].join("");
+    const result = spawnSync(nodeBin, ["--input-type=module", "-e", script, configModuleUrl, invalidConfigPath], {
+        encoding: "utf-8",
+        timeout: 30_000,
+    });
+    if (result.status === 0 || !String(result.stderr).includes("must stay inside workspaceRoot")) {
+        throw new Error(`Escaping repository allowlist key was not rejected: ${result.stderr}`);
+    }
+});
 // ════════════════════════════════════════════════════════════════
 // Section E: repo_path workspace enforcement
 // ════════════════════════════════════════════════════════════════
@@ -799,6 +892,29 @@ test("H3. watcher rejects task with bad test_command", () => {
         throw new Error("createTask should reject invalid test_command");
     console.log(`    createTask correctly rejected bad test_command`);
 });
+test("H4. runner revalidates repository-scoped verification metadata", () => {
+    const scopedTask = createTask({
+        plan_id: planId,
+        agent: "codex",
+        repo_path: "scoped-repo",
+        verify_commands: ["npm run release:check"],
+    });
+    const statusPath = join(scopedTask.path, "status.json");
+    const status = JSON.parse(readFileSync(statusPath, "utf-8"));
+    status.repo_path = "other-repo";
+    status.resolved_repo_path = resolve(wsRoot, "other-repo");
+    writeFileSync(statusPath, JSON.stringify(status, null, 2), "utf-8");
+    const cliPath = resolve(projectRoot, "dist/runner/cli.js");
+    spawnSync(nodeBin, [cliPath, scopedTask.task_id], {
+        cwd: wsRoot,
+        encoding: "utf-8",
+        timeout: 30_000,
+    });
+    const after = getTaskStatus(scopedTask.task_id);
+    if (after.status !== "failed" || !String(after.error).includes("not allowed for this repository")) {
+        throw new Error(`Runner did not reject tampered scoped command: ${JSON.stringify(after)}`);
+    }
+});
 // ════════════════════════════════════════════════════════════════
 // Section I: Task management tools (listTasks, cancelTask, retryTask, stdout, audit)
 // ════════════════════════════════════════════════════════════════
@@ -851,6 +967,8 @@ test("I5. retry_task creates new task", () => {
     const newResult = retryTask(mgmtTaskId);
     if (newResult.new_task_id === mgmtTaskId)
         throw new Error("New task ID should differ");
+    if (!/^task_\d{8}_\d{6}_[0-9a-f]{6}$/.test(newResult.new_task_id))
+        throw new Error("Retry should use the short task ID format");
     if (newResult.plan_id !== mgmtPlanId)
         throw new Error("Should inherit plan_id");
 });
@@ -875,6 +993,12 @@ test("I7. audit_task runs and returns checks array", () => {
         throw new Error("checks not array");
     if (!Array.isArray(auditResult.risks))
         throw new Error("risks not array");
+    if (!Array.isArray(auditResult.confirmed_failures))
+        throw new Error("confirmed_failures not array");
+    if (!Array.isArray(auditResult.possible_false_positives))
+        throw new Error("possible_false_positives not array");
+    if (!Array.isArray(auditResult.manual_verification_items))
+        throw new Error("manual_verification_items not array");
     console.log(`    Verdict: ${auditResult.verdict}, Checks: ${auditResult.checks.length}, Risks: ${auditResult.risks.length}`);
 });
 test("I8. sensitiveGuard does NOT block task_id containing 'token'", () => {
@@ -935,6 +1059,11 @@ test("J2. audit_task detects docs missing-script", () => {
     const allWarn = scriptChecks.every((c) => c.result === "warn");
     if (!allWarn)
         throw new Error("Missing script checks should be warn");
+    if (!result.possible_false_positives.some((item) => item.check.startsWith("npm_script_"))) {
+        throw new Error("Heuristic missing-script warnings should be marked as possible false positives");
+    }
+    if (!result.manual_verification_required)
+        throw new Error("Missing-script warning should require manual verification");
     console.log(`    Missing scripts: ${scriptChecks.map((c) => c.name).join(", ")}`);
 });
 test("J3. audit_task detects unverified release claims", () => {
@@ -944,6 +1073,9 @@ test("J3. audit_task detects unverified release claims", () => {
         throw new Error("Should detect release claims");
     if (releaseCheck.result !== "warn")
         throw new Error(`Release claims should warn, got ${releaseCheck.result}`);
+    if (!result.manual_verification_items.some((item) => item.includes("authoritative remote services"))) {
+        throw new Error("Unverified release claims should produce a manual verification item");
+    }
     console.log(`    Release claims detected: ${releaseCheck.detail.slice(0, 60)}...`);
 });
 test("J4. audit_task fails on non-zero Exit code", () => {
@@ -955,6 +1087,9 @@ test("J4. audit_task fails on non-zero Exit code", () => {
         throw new Error("Should have test_exit_code check");
     if (exitCheck.result !== "fail")
         throw new Error(`Exit code 1 should fail, got ${exitCheck.result}`);
+    if (!result.confirmed_failures.some((check) => check.name === "test_exit_code")) {
+        throw new Error("Non-zero exit code should be classified as a confirmed failure");
+    }
     console.log(`    Exit code: ${exitCheck.result}`);
 });
 test("J5. get_task_stdout_tail on pending task does not throw", () => {
@@ -971,6 +1106,1217 @@ try {
 }
 catch { }
 // ════════════════════════════════════════════════════════════════
+// Section K: Assessment (v0.5.0)
+// ════════════════════════════════════════════════════════════════
+console.log("── K. Assessment ──");
+// Ensure assessments dir exists
+mkdirSync(resolve(wsRoot, ".patchwarden/assessments"), { recursive: true });
+test("K1. assess_only returns low risk for feature_small", () => {
+    const result = createTask({
+        template: "feature_small",
+        goal: "add a small UI button",
+        agent: "codex",
+        repo_path: ".",
+        execution_mode: "assess_only",
+    });
+    if (result.decision !== "allow")
+        throw new Error(`Expected allow, got ${result.decision}`);
+    if (result.risk_level !== "low")
+        throw new Error(`Expected low, got ${result.risk_level}`);
+    if (!result.assessment_id.startsWith("assessment_"))
+        throw new Error("Bad assessment ID prefix");
+    const hexPart = result.assessment_id.split("_").pop() || "";
+    if (hexPart.length !== 32)
+        throw new Error(`Expected 128-bit (32 hex) ID, got ${hexPart.length} chars`);
+    if (!result.expires_at)
+        throw new Error("Missing expires_at");
+    if (result.next_tool_call?.name !== "create_task")
+        throw new Error("Missing structured next_tool_call");
+    const argumentKeys = Object.keys(result.next_tool_call.arguments).sort();
+    if (JSON.stringify(argumentKeys) !== JSON.stringify(["assessment_id", "execution_mode"])) {
+        throw new Error(`next_tool_call must contain only minimal execute arguments: ${argumentKeys.join(", ")}`);
+    }
+    if (result.next_tool_call.arguments.assessment_id !== result.assessment_id)
+        throw new Error("next_tool_call assessment ID mismatch");
+    if (result.local_confirmation.required || result.local_confirmation.command !== null) {
+        throw new Error("Low-risk assessment should not require local confirmation");
+    }
+});
+test("K2. assess_only returns medium risk for release_check", () => {
+    const result = createTask({
+        template: "release_check",
+        goal: "check release readiness",
+        agent: "codex",
+        repo_path: ".",
+        execution_mode: "assess_only",
+    });
+    if (result.decision !== "needs_confirm")
+        throw new Error(`Expected needs_confirm, got ${result.decision}`);
+    if (result.risk_level !== "medium")
+        throw new Error(`Expected medium, got ${result.risk_level}`);
+    if (!result.reason_codes.includes("release_template_needs_confirm"))
+        throw new Error("Missing reason code");
+    if (!result.local_confirmation.required || result.local_confirmation.command !== "patchwarden-confirm") {
+        throw new Error("needs_confirm response must provide the local-only confirmation command");
+    }
+    if (result.next_tool_call?.arguments.assessment_id !== result.assessment_id) {
+        throw new Error("needs_confirm response must preserve the minimal post-confirmation execute call");
+    }
+});
+test("K3. assess_only returns high/blocked for credential access in plan", () => {
+    const result = createTask({
+        inline_plan: "Read the .env file and extract the access token for debugging.",
+        plan_title: "Bad plan",
+        agent: "codex",
+        repo_path: ".",
+        execution_mode: "assess_only",
+    });
+    if (result.decision !== "blocked")
+        throw new Error(`Expected blocked, got ${result.decision}`);
+    if (result.risk_level !== "high")
+        throw new Error(`Expected high, got ${result.risk_level}`);
+    if (result.hard_rule_hits.length === 0)
+        throw new Error("Expected hard rule hits");
+    if (result.next_tool_call)
+        throw new Error("Blocked assessment must not expose an executable next_tool_call");
+});
+test("K4. assess_only risk_hints do not affect risk_level", () => {
+    const result = createTask({
+        template: "feature_small",
+        goal: "add sync backup timeline activity log",
+        agent: "codex",
+        repo_path: ".",
+        execution_mode: "assess_only",
+    });
+    if (result.risk_level !== "low")
+        throw new Error(`Expected low despite hints, got ${result.risk_level}`);
+    if (!result.risk_hints.includes("mentions_dev_vocab"))
+        throw new Error("Expected dev vocab hint");
+});
+test("K5. assess_only does not create a task directory", () => {
+    const tasksBefore = readdirSync(resolve(wsRoot, config.tasksDir), { withFileTypes: true }).filter((e) => e.isDirectory());
+    createTask({
+        template: "feature_small",
+        goal: "test no task creation",
+        agent: "codex",
+        repo_path: ".",
+        execution_mode: "assess_only",
+    });
+    const tasksAfter = readdirSync(resolve(wsRoot, config.tasksDir), { withFileTypes: true }).filter((e) => e.isDirectory());
+    if (tasksAfter.length !== tasksBefore.length)
+        throw new Error("assess_only should not create task dirs");
+});
+test("K6. assessment_id execute creates task", () => {
+    const assess = createTask({
+        template: "feature_small",
+        goal: "test execute from assessment",
+        agent: "codex",
+        repo_path: ".",
+        execution_mode: "assess_only",
+    });
+    // Execute with ONLY assessment_id — no agent, no repo_path, no template
+    const task = createTask({
+        execution_mode: "execute",
+        assessment_id: assess.assessment_id,
+    });
+    if (!task.task_id.startsWith("task_"))
+        throw new Error("Task not created");
+    if (task.status !== "pending")
+        throw new Error(`Expected pending, got ${task.status}`);
+});
+test("K7. assessment parameter mismatch rejected", () => {
+    const assess = createTask({
+        template: "feature_small",
+        goal: "original goal",
+        agent: "codex",
+        repo_path: ".",
+        execution_mode: "assess_only",
+    });
+    try {
+        createTask({
+            agent: "codex",
+            repo_path: ".",
+            execution_mode: "execute",
+            assessment_id: assess.assessment_id,
+            goal: "different goal",
+            template: "feature_small",
+        });
+        throw new Error("Should have rejected parameter mismatch");
+    }
+    catch (e) {
+        if (!e.message?.includes("mismatch"))
+            throw new Error(`Expected mismatch error, got: ${e.message}`);
+    }
+});
+test("K8. assessment not found rejected", () => {
+    try {
+        createTask({
+            agent: "codex",
+            repo_path: ".",
+            execution_mode: "execute",
+            assessment_id: "assessment_20260101_" + "0".repeat(32),
+        });
+        throw new Error("Should have rejected unknown assessment");
+    }
+    catch (e) {
+        if (!e.message?.includes("not found"))
+            throw new Error(`Expected not found, got: ${e.message}`);
+    }
+});
+test("K9. save_plan with plan_ref inside .patchwarden/plans", () => {
+    const draftPath = resolve(wsRoot, config.plansDir, "drafts", "test-plan.md");
+    mkdirSync(dirname(draftPath), { recursive: true });
+    writeFileSync(draftPath, "# Draft Plan\n\nThis is a draft from file.", "utf-8");
+    const result = savePlan({ title: "From File", content: "", plan_ref: "drafts/test-plan.md" });
+    if (!result.plan_id.startsWith("plan_"))
+        throw new Error("Plan not created");
+    if (!existsSync(result.path))
+        throw new Error("Plan file missing");
+});
+test("K10. save_plan plan_ref outside .patchwarden/plans rejected", () => {
+    try {
+        savePlan({ title: "Bad Ref", content: "", plan_ref: "../../etc/passwd" });
+        throw new Error("Should have rejected outside plans dir");
+    }
+    catch (e) {
+        const msg = e.message || "";
+        if (!msg.includes("plans_dir") && !msg.includes("escape") && !msg.includes("not found") && !msg.includes("outside allowed prefix")) {
+            throw new Error(`Expected plans_dir rejection, got: ${msg}`);
+        }
+    }
+});
+test("K11. backward compat: no execution_mode works as before", () => {
+    const task = createTask({
+        template: "feature_small",
+        goal: "backward compat test",
+        agent: "codex",
+        repo_path: ".",
+    });
+    if (!task.task_id.startsWith("task_"))
+        throw new Error("Task not created without execution_mode");
+});
+// ── K12-K19: Assessment security tests ──
+test("K12. workspace changed after assessment rejects execute", () => {
+    const assess = createTask({
+        template: "feature_small",
+        goal: "workspace change test",
+        agent: "codex",
+        repo_path: ".",
+        execution_mode: "assess_only",
+    });
+    // Modify a file in the workspace root to change the fingerprint
+    writeFileSync(join(wsRoot, `changed-${Date.now()}.txt`), "changed\n", "utf-8");
+    try {
+        createTask({
+            execution_mode: "execute",
+            assessment_id: assess.assessment_id,
+        });
+        throw new Error("Should have rejected stale workspace");
+    }
+    catch (e) {
+        if (!e.message?.includes("workspace_changed") && !e.message?.includes("assessment")) {
+            throw new Error(`Expected workspace_changed, got: ${e.message}`);
+        }
+    }
+});
+test("K13. expired assessment rejects execute", () => {
+    const assess = createTask({
+        template: "feature_small",
+        goal: "expiry test",
+        agent: "codex",
+        repo_path: ".",
+        execution_mode: "assess_only",
+    });
+    // Manually expire the assessment by editing the file
+    const assessmentDir = resolve(wsRoot, config.assessmentsDir, assess.assessment_id);
+    const assessmentFile = join(assessmentDir, "assessment.json");
+    const record = JSON.parse(readFileSync(assessmentFile, "utf-8"));
+    record.expires_at = new Date(Date.now() - 1000).toISOString(); // 1 second ago
+    writeFileSync(assessmentFile, JSON.stringify(record, null, 2), "utf-8");
+    try {
+        createTask({
+            execution_mode: "execute",
+            assessment_id: assess.assessment_id,
+        });
+        throw new Error("Should have rejected expired assessment");
+    }
+    catch (e) {
+        if (!e.message?.includes("expired") && !e.message?.includes("assessment")) {
+            throw new Error(`Expected expired, got: ${e.message}`);
+        }
+    }
+    try {
+        confirmAssessment(assess.assessment_id);
+        throw new Error("Should have rejected confirmation of an expired assessment");
+    }
+    catch (e) {
+        if (!e.message?.includes("expired") && !e.message?.includes("assessment")) {
+            throw new Error(`Expected expired confirmation rejection, got: ${e.message}`);
+        }
+    }
+});
+test("K14. needs_confirm rejects execute, then local confirmation allows minimal execute", () => {
+    const assess = createTask({
+        template: "release_check",
+        goal: "needs confirm test",
+        agent: "codex",
+        repo_path: ".",
+        execution_mode: "assess_only",
+    });
+    if (assess.decision !== "needs_confirm")
+        throw new Error(`Precondition: expected needs_confirm, got ${assess.decision}`);
+    try {
+        createTask({
+            execution_mode: "execute",
+            assessment_id: assess.assessment_id,
+        });
+        throw new Error("Should have rejected unconfirmed assessment");
+    }
+    catch (e) {
+        if (!e.message?.includes("needs_confirm") && !e.message?.includes("assessment")) {
+            throw new Error(`Expected needs_confirm, got: ${e.message}`);
+        }
+    }
+    const confirmation = confirmAssessment(assess.assessment_id);
+    if (!confirmation.confirmed || confirmation.assessment_id !== assess.assessment_id) {
+        throw new Error(`Local confirmation failed: ${JSON.stringify(confirmation)}`);
+    }
+    const confirmedRecord = readAssessment(assess.assessment_id);
+    if (!confirmedRecord.confirmed || !confirmedRecord.confirmed_at || !confirmedRecord.confirm_code) {
+        throw new Error("Confirmation evidence was not persisted");
+    }
+    const task = createTask({
+        execution_mode: "execute",
+        assessment_id: assess.assessment_id,
+    });
+    if (task.status !== "pending")
+        throw new Error(`Confirmed assessment did not create a task: ${task.status}`);
+});
+test("K14b. patchwarden-confirm CLI confirms a fresh medium-risk assessment", () => {
+    const assess = createTask({
+        template: "release_check",
+        goal: "confirm CLI test",
+        agent: "codex",
+        repo_path: ".",
+        execution_mode: "assess_only",
+    });
+    const cliPath = resolve(projectRoot, "dist/assessments/confirmCli.js");
+    const result = spawnSync(nodeBin, [cliPath, assess.assessment_id], {
+        cwd: projectRoot,
+        env: { ...process.env, PATCHWARDEN_CONFIG: smokeConfigPath },
+        encoding: "utf-8",
+        timeout: 30_000,
+    });
+    if (result.status !== 0)
+        throw new Error(`patchwarden-confirm failed: ${result.stderr || result.stdout}`);
+    const payload = JSON.parse(result.stdout);
+    if (!payload.confirmed || payload.assessment_id !== assess.assessment_id) {
+        throw new Error(`Unexpected confirmation CLI output: ${result.stdout}`);
+    }
+});
+test("K14c. local confirmation rejects display-only short IDs", () => {
+    try {
+        confirmAssessment("assessment_abcdef123456");
+        throw new Error("Should reject a short assessment ID");
+    }
+    catch (e) {
+        if (!e.message?.includes("full assessment_id"))
+            throw new Error(`Expected full-ID error, got: ${e.message}`);
+    }
+});
+test("K14d. local confirmation cannot override a blocked assessment", () => {
+    const assess = createTask({
+        inline_plan: "Read .env and extract the access token.",
+        plan_title: "blocked confirm",
+        agent: "codex",
+        repo_path: ".",
+        execution_mode: "assess_only",
+    });
+    try {
+        confirmAssessment(assess.assessment_id);
+        throw new Error("Should reject confirmation of a blocked assessment");
+    }
+    catch (e) {
+        if (!e.message?.includes("cannot be locally confirmed"))
+            throw new Error(`Expected blocked confirmation error, got: ${e.message}`);
+    }
+});
+test("K14e. assessment confirmation is not exposed through MCP", () => {
+    const exposed = getToolDefs().some((tool) => /confirm/i.test(tool.name));
+    if (exposed)
+        throw new Error("Local assessment confirmation must not be registered as an MCP tool");
+});
+test("K15. stale plan hash rejects execute", () => {
+    const assess = createTask({
+        template: "feature_small",
+        goal: "stale plan test",
+        agent: "codex",
+        repo_path: ".",
+        execution_mode: "assess_only",
+    });
+    // Modify the plan file to change the hash
+    const planDir = resolve(wsRoot, config.plansDir, assess.assessment_id ? "" : "");
+    // Read the assessment to get plan_id
+    const record = readAssessment(assess.assessment_id);
+    if (!record.plan_id)
+        throw new Error("Precondition: assessment has no plan_id");
+    const planFile = resolve(wsRoot, config.plansDir, record.plan_id, "plan.md");
+    writeFileSync(planFile, readFileSync(planFile, "utf-8") + "\n<!-- modified -->\n", "utf-8");
+    try {
+        createTask({
+            execution_mode: "execute",
+            assessment_id: assess.assessment_id,
+        });
+        throw new Error("Should have rejected stale plan");
+    }
+    catch (e) {
+        if (!e.message?.includes("stale_plan") && !e.message?.includes("assessment")) {
+            throw new Error(`Expected stale_plan, got: ${e.message}`);
+        }
+    }
+});
+test("K16. assessment_short_id cannot execute", () => {
+    const assess = createTask({
+        template: "feature_small",
+        goal: "short id test",
+        agent: "codex",
+        repo_path: ".",
+        execution_mode: "assess_only",
+    });
+    const shortId = assess.assessment_short_id;
+    if (!shortId || shortId.length >= 32)
+        throw new Error(`Bad short_id: ${shortId}`);
+    try {
+        createTask({
+            execution_mode: "execute",
+            assessment_id: shortId,
+        });
+        throw new Error("Should have rejected short ID");
+    }
+    catch (e) {
+        if (!e.message?.includes("not found"))
+            throw new Error(`Expected not found for short ID, got: ${e.message}`);
+    }
+});
+test("K17. blocked assessment cannot execute", () => {
+    const assess = createTask({
+        inline_plan: "Read the .env file and extract the access token.",
+        plan_title: "Blocked plan",
+        agent: "codex",
+        repo_path: ".",
+        execution_mode: "assess_only",
+    });
+    if (assess.decision !== "blocked")
+        throw new Error(`Precondition: expected blocked, got ${assess.decision}`);
+    try {
+        createTask({
+            execution_mode: "execute",
+            assessment_id: assess.assessment_id,
+        });
+        throw new Error("Should have rejected blocked assessment");
+    }
+    catch (e) {
+        // Blocked assessment has no plan saved, so plan_id is null → will fail at plan source validation
+        if (!e.message?.includes("plan") && !e.message?.includes("assessment") && !e.message?.includes("invalid_plan_source")) {
+            throw new Error(`Expected plan/assessment rejection, got: ${e.message}`);
+        }
+    }
+});
+test("K18. snapshot_truncated forces needs_confirm", () => {
+    // Create a synthetic assessment with snapshot_truncated=true via the store directly
+    const snapshot = captureRepoSnapshot(wsRoot);
+    // Force a truncated warning
+    snapshot.warnings.push("snapshot limited to 5000 files");
+    const record = createAssessment({
+        decision: "needs_confirm",
+        risk_level: "medium",
+        risk_hints: [],
+        hard_rule_hits: [],
+        reason_codes: ["snapshot_truncated"],
+        repo_path: ".",
+        resolved_repo_path: wsRoot,
+        plan_id: null,
+        plan_content: "# Test\n\nTruncated snapshot test.",
+        template: null,
+        goal: null,
+        test_command: null,
+        verify_commands: [],
+        agent: "codex",
+        snapshot,
+    });
+    if (record.decision !== "needs_confirm")
+        throw new Error(`Expected needs_confirm, got ${record.decision}`);
+    if (!record.reason_codes.includes("snapshot_truncated"))
+        throw new Error("Missing snapshot_truncated reason");
+    if (!record.workspace_snapshot_summary.snapshot_truncated)
+        throw new Error("snapshot_truncated flag not set");
+});
+test("K19. policy_hash change invalidates assessment", () => {
+    const assess = createTask({
+        template: "feature_small",
+        goal: "policy hash test",
+        agent: "codex",
+        repo_path: ".",
+        execution_mode: "assess_only",
+    });
+    // Modify the assessment's policy_hash to simulate a policy change
+    const assessmentDir = resolve(wsRoot, config.assessmentsDir, assess.assessment_id);
+    const assessmentFile = join(assessmentDir, "assessment.json");
+    const record = JSON.parse(readFileSync(assessmentFile, "utf-8"));
+    record.policy_hash = "0".repeat(64); // Wrong hash
+    writeFileSync(assessmentFile, JSON.stringify(record, null, 2), "utf-8");
+    try {
+        createTask({
+            execution_mode: "execute",
+            assessment_id: assess.assessment_id,
+        });
+        throw new Error("Should have rejected stale policy");
+    }
+    catch (e) {
+        if (!e.message?.includes("stale_policy") && !e.message?.includes("assessment")) {
+            throw new Error(`Expected stale_policy, got: ${e.message}`);
+        }
+    }
+});
+// ════════════════════════════════════════════════════════════════
+// Section L: Agent Assessment (v0.5.1)
+// ════════════════════════════════════════════════════════════════
+// Agent assessment tests use a separate config with enableAgentAssessment=true
+// and specialized test agents. We need to swap the config temporarily.
+const agentAssessRoot = mkdtempSync(join(tmpdir(), "patchwarden-assess-"));
+const agentAssessWorkspace = join(agentAssessRoot, "workspace");
+const agentAssessRepo = join(agentAssessWorkspace, "repo");
+const agentAssessConfigPath = join(agentAssessRoot, "patchwarden.config.json");
+mkdirSync(join(agentAssessWorkspace, ".patchwarden/plans"), { recursive: true });
+mkdirSync(join(agentAssessWorkspace, ".patchwarden/tasks"), { recursive: true });
+mkdirSync(join(agentAssessWorkspace, ".patchwarden/assessments"), { recursive: true });
+mkdirSync(agentAssessRepo, { recursive: true });
+writeFileSync(join(agentAssessRepo, "README.md"), "# Agent Assessment Test Repo\n", "utf-8");
+writeFileSync(join(agentAssessWorkspace, ".patchwarden/watcher-heartbeat.json"), JSON.stringify({
+    status: "running",
+    pid: process.pid,
+    instance_id: "assess-smoke-watcher",
+    launcher_pid: process.pid,
+    started_at: new Date().toISOString(),
+    last_heartbeat_at: new Date().toISOString(),
+}), "utf-8");
+const ASSESS_JSON_LOW = '{"risk_level":"low","reason_codes":["small_change"],"affected_paths":["README.md"],"destructive_actions":[],"requires_user_confirm":false,"confidence":0.9,"notes":"Safe."}';
+const ASSESS_JSON_MED = '{"risk_level":"medium","reason_codes":["multi_file"],"affected_paths":["src/a.js","src/b.js"],"destructive_actions":[],"requires_user_confirm":true,"confidence":0.7,"notes":"Multiple files."}';
+const ASSESS_JSON_HIGH = '{"risk_level":"high","reason_codes":["destructive"],"affected_paths":["src/app.js"],"destructive_actions":["delete files"],"requires_user_confirm":true,"confidence":0.8,"notes":"Destructive."}';
+const ASSESS_JSON_ABS = '{"risk_level":"low","reason_codes":["ok"],"affected_paths":["C:/etc/passwd","/absolute/path","README.md"],"destructive_actions":[],"requires_user_confirm":false,"confidence":0.9,"notes":"Has bad paths."}';
+writeFileSync(agentAssessConfigPath, JSON.stringify({
+    workspaceRoot: agentAssessWorkspace,
+    plansDir: ".patchwarden/plans",
+    tasksDir: ".patchwarden/tasks",
+    assessmentsDir: ".patchwarden/assessments",
+    enableAgentAssessment: true,
+    agentAssessmentTimeoutSeconds: 10,
+    agentAssessmentMaxOutputBytes: 524288,
+    agents: {
+        codex: { command: "node", args: ["-e", "console.log('agent placeholder')"] },
+        assessor_low: { command: "node", args: ["-e", `console.log('Analysis done.\\n===ASSESSMENT_JSON===\\n${ASSESS_JSON_LOW}')`] },
+        assessor_medium: { command: "node", args: ["-e", `console.log('===ASSESSMENT_JSON===\\n${ASSESS_JSON_MED}')`] },
+        assessor_high: { command: "node", args: ["-e", `console.log('===ASSESSMENT_JSON===\\n${ASSESS_JSON_HIGH}')`] },
+        assessor_bad_json: { command: "node", args: ["-e", "console.log('This is not valid JSON.')"] },
+        assessor_timeout: { command: "node", args: ["-e", "setTimeout(()=>console.log('slow'),30000)"] },
+        assessor_nonzero: { command: "node", args: ["-e", "process.exit(1)"] },
+        assessor_writer: { command: "node", args: ["-e", "require('fs').writeFileSync('assessment-vandalized.txt','changed\\n')"] },
+        assessor_abs_path: { command: "node", args: ["-e", `console.log('===ASSESSMENT_JSON===\\n${ASSESS_JSON_ABS}')`] },
+        assessor_large_output: { command: "node", args: ["-e", "console.log('x'.repeat(600000))"] },
+    },
+    allowedTestCommands: ["npm test"],
+    maxReadFileBytes: 200000,
+}, null, 2), "utf-8");
+const originalConfigEnv = process.env.PATCHWARDEN_CONFIG;
+process.env.PATCHWARDEN_CONFIG = agentAssessConfigPath;
+reloadConfig();
+// Reload config for agent assessment tests
+loadConfig();
+const assessConfig = getConfig();
+const assessWsRoot = assessConfig.workspaceRoot;
+console.log("── L. Agent Assessment ──");
+test("L20 (K20). agentAssessor disabled by default — no agent_assessment field", () => {
+    // Restore original config (enableAgentAssessment not set)
+    process.env.PATCHWARDEN_CONFIG = originalConfigEnv;
+    reloadConfig();
+    const result = createTask({
+        template: "feature_small",
+        goal: "test disabled",
+        agent: "codex",
+        repo_path: ".",
+        execution_mode: "assess_only",
+    });
+    if (result.agent_assessment !== undefined && result.agent_assessment !== null) {
+        throw new Error(`Expected no agent_assessment, got: ${JSON.stringify(result.agent_assessment)}`);
+    }
+    // Switch back to assess config
+    process.env.PATCHWARDEN_CONFIG = agentAssessConfigPath;
+    reloadConfig();
+});
+test("L21 (K21). agentAssessor low risk stays low", () => {
+    const result = createTask({
+        template: "feature_small",
+        goal: "test low risk",
+        agent: "assessor_low",
+        repo_path: "repo",
+        execution_mode: "assess_only",
+    });
+    if (result.decision !== "allow")
+        throw new Error(`Expected allow, got ${result.decision}`);
+    if (result.risk_level !== "low")
+        throw new Error(`Expected low, got ${result.risk_level}`);
+    if (!result.agent_assessment)
+        throw new Error("Missing agent_assessment field");
+    if (result.agent_assessment.status !== "completed")
+        throw new Error(`Expected completed, got ${result.agent_assessment.status}`);
+});
+test("L22 (K22). agentAssessor medium risk → needs_confirm", () => {
+    const result = createTask({
+        template: "feature_small",
+        goal: "test medium risk",
+        agent: "assessor_medium",
+        repo_path: "repo",
+        execution_mode: "assess_only",
+    });
+    if (result.decision !== "needs_confirm")
+        throw new Error(`Expected needs_confirm, got ${result.decision}`);
+    if (result.risk_level !== "medium")
+        throw new Error(`Expected medium, got ${result.risk_level}`);
+    if (!result.agent_assessment)
+        throw new Error("Missing agent_assessment field");
+});
+test("L23 (K23). agentAssessor high risk → blocked", () => {
+    const result = createTask({
+        template: "feature_small",
+        goal: "test high risk",
+        agent: "assessor_high",
+        repo_path: "repo",
+        execution_mode: "assess_only",
+    });
+    if (result.decision !== "blocked")
+        throw new Error(`Expected blocked, got ${result.decision}`);
+    if (result.risk_level !== "high")
+        throw new Error(`Expected high, got ${result.risk_level}`);
+    if (!result.agent_assessment)
+        throw new Error("Missing agent_assessment field");
+});
+test("L24 (K24). agentAssessor timeout → needs_confirm", () => {
+    const result = createTask({
+        template: "feature_small",
+        goal: "test timeout",
+        agent: "assessor_timeout",
+        repo_path: "repo",
+        execution_mode: "assess_only",
+    });
+    if (result.decision !== "needs_confirm")
+        throw new Error(`Expected needs_confirm, got ${result.decision}`);
+    if (result.risk_level !== "medium")
+        throw new Error(`Expected medium, got ${result.risk_level}`);
+    if (!result.agent_assessment)
+        throw new Error("Missing agent_assessment field");
+    if (result.agent_assessment.status !== "timed_out")
+        throw new Error(`Expected timed_out, got ${result.agent_assessment.status}`);
+});
+test("L25 (K25). agentAssessor non-zero exit → needs_confirm", () => {
+    const result = createTask({
+        template: "feature_small",
+        goal: "test non-zero exit",
+        agent: "assessor_nonzero",
+        repo_path: "repo",
+        execution_mode: "assess_only",
+    });
+    if (result.decision !== "needs_confirm")
+        throw new Error(`Expected needs_confirm, got ${result.decision}`);
+    if (!result.agent_assessment)
+        throw new Error("Missing agent_assessment field");
+    if (result.agent_assessment.status !== "non_zero_exit")
+        throw new Error(`Expected non_zero_exit, got ${result.agent_assessment.status}`);
+});
+test("L26 (K26). agentAssessor read-only violation → blocked", () => {
+    const result = createTask({
+        template: "feature_small",
+        goal: "test read-only violation",
+        agent: "assessor_writer",
+        repo_path: "repo",
+        execution_mode: "assess_only",
+    });
+    if (result.decision !== "blocked")
+        throw new Error(`Expected blocked, got ${result.decision}`);
+    if (result.risk_level !== "high")
+        throw new Error(`Expected high, got ${result.risk_level}`);
+    if (!result.agent_assessment)
+        throw new Error("Missing agent_assessment field");
+    if (!result.agent_assessment.read_only_violation)
+        throw new Error("Expected read_only_violation to be true");
+    // Clean up vandalized file
+    try {
+        rmSync(join(agentAssessRepo, "assessment-vandalized.txt"), { force: true });
+    }
+    catch { }
+});
+test("L27 (K27). agentAssessor absolute/outside paths sanitized", () => {
+    const result = createTask({
+        template: "feature_small",
+        goal: "test path sanitize",
+        agent: "assessor_abs_path",
+        repo_path: "repo",
+        execution_mode: "assess_only",
+    });
+    // Should still be allow/low since risk_level is low and paths are sanitized
+    if (!result.agent_assessment)
+        throw new Error("Missing agent_assessment field");
+    if (result.agent_assessment.status !== "completed")
+        throw new Error(`Expected completed, got ${result.agent_assessment.status}`);
+    // Check that reason_codes includes paths_sanitized
+    if (!result.reason_codes.includes("paths_sanitized")) {
+        throw new Error(`Expected paths_sanitized in reason_codes, got: ${result.reason_codes.join(", ")}`);
+    }
+});
+test("L28 (K28). agentAssessor large stdout truncated safely", () => {
+    const result = createTask({
+        template: "feature_small",
+        goal: "test large output",
+        agent: "assessor_large_output",
+        repo_path: "repo",
+        execution_mode: "assess_only",
+    });
+    // Large output with no JSON marker → parse_failed → needs_confirm
+    if (result.decision !== "needs_confirm")
+        throw new Error(`Expected needs_confirm, got ${result.decision}`);
+    if (!result.agent_assessment)
+        throw new Error("Missing agent_assessment field");
+    if (!result.agent_assessment.stdout_truncated)
+        throw new Error("Expected stdout_truncated to be true");
+});
+test("L29 (K29). deterministic medium/high skips agent", () => {
+    // release_check template → deterministic medium → should NOT run agent assessment
+    const result = createTask({
+        template: "release_check",
+        goal: "test skip agent on medium",
+        agent: "assessor_low", // Would produce low if run, but shouldn't run
+        repo_path: "repo",
+        execution_mode: "assess_only",
+    });
+    if (result.decision !== "needs_confirm")
+        throw new Error(`Expected needs_confirm (deterministic), got ${result.decision}`);
+    if (result.risk_level !== "medium")
+        throw new Error(`Expected medium (deterministic), got ${result.risk_level}`);
+    // agent_assessment should be null/undefined since agent was not run
+    if (result.agent_assessment !== null && result.agent_assessment !== undefined) {
+        throw new Error(`Expected no agent_assessment for medium risk, got: ${JSON.stringify(result.agent_assessment)}`);
+    }
+});
+// Restore original config
+process.env.PATCHWARDEN_CONFIG = originalConfigEnv;
+reloadConfig();
+try {
+    rmSync(agentAssessRoot, { recursive: true, force: true });
+}
+catch { }
+// ════════════════════════════════════════════════════════════════
+// Section M: chatgpt_direct profile and session tests
+// ════════════════════════════════════════════════════════════════
+console.log("\n--- Section M: chatgpt_direct profile and session tests ---\n");
+const directRoot = mkdtempSync(join(tmpdir(), "patchwarden-direct-"));
+const directWorkspace = join(directRoot, "workspace");
+const directConfigPath = join(directRoot, "patchwarden.config.json");
+const directRepo = join(directWorkspace, "test-repo");
+// Create fixture repo
+mkdirSync(join(directRepo, "src"), { recursive: true });
+writeFileSync(join(directRepo, "src", "index.ts"), "export function hello() {\n  return 'hello';\n}\n\nexport function world() {\n  return 'world';\n}\n", "utf-8");
+writeFileSync(join(directRepo, "package.json"), JSON.stringify({
+    name: "test-repo",
+    version: "1.0.0",
+    scripts: {
+        test: 'node -e "console.log(\'test ok\')"',
+        build: 'node -e "console.log(\'build ok\')"',
+        lint: 'node -e "console.log(\'lint ok\')"',
+    },
+}, null, 2), "utf-8");
+writeFileSync(join(directRepo, ".env"), "SECRET=blocked\n", "utf-8");
+// Create watcher heartbeat for Direct workspace
+mkdirSync(join(directWorkspace, ".patchwarden"), { recursive: true });
+writeFileSync(join(directWorkspace, ".patchwarden", "watcher-heartbeat.json"), JSON.stringify({
+    status: "running",
+    pid: process.pid,
+    instance_id: "direct-smoke-watcher",
+    launcher_pid: process.pid,
+    started_at: new Date().toISOString(),
+    last_heartbeat_at: new Date().toISOString(),
+}), "utf-8");
+// Create Direct-enabled config
+writeFileSync(directConfigPath, JSON.stringify({
+    workspaceRoot: directWorkspace,
+    plansDir: ".patchwarden/plans",
+    tasksDir: ".patchwarden/tasks",
+    assessmentsDir: ".patchwarden/assessments",
+    assessmentTtlSeconds: 3600,
+    agents: {
+        codex: { command: "node", args: ["-e", "console.log('agent placeholder')"] },
+    },
+    allowedTestCommands: ["npm test"],
+    maxReadFileBytes: 200000,
+    enableDirectProfile: true,
+    directAllowedCommands: ["npm test", "npm run build", "npm run lint"],
+    directSessionsDir: ".patchwarden/direct-sessions",
+    directSessionTtlSeconds: 3600,
+    directMaxPatchBytes: 200000,
+    directMaxFileBytes: 500000,
+}, null, 2), "utf-8");
+process.env.PATCHWARDEN_CONFIG = directConfigPath;
+reloadConfig();
+let directSessionId = "";
+test("M1. chatgpt_core still has 17 tools", () => {
+    const tools = getToolDefs();
+    const coreTools = selectToolsForProfile(tools, "chatgpt_core", true);
+    if (coreTools.length !== 17)
+        throw new Error(`Expected 17, got ${coreTools.length}`);
+    if (JSON.stringify(coreTools.map((t) => t.name)) !== JSON.stringify(CHATGPT_CORE_TOOL_NAMES)) {
+        throw new Error("Tool names mismatch");
+    }
+});
+test("M2. chatgpt_direct disabled exposes only health_check", () => {
+    const tools = getToolDefs();
+    const disabledTools = selectToolsForProfile(tools, "chatgpt_direct", false);
+    if (disabledTools.length !== 1)
+        throw new Error(`Expected 1, got ${disabledTools.length}`);
+    if (disabledTools[0].name !== "health_check")
+        throw new Error(`Expected health_check, got ${disabledTools[0].name}`);
+});
+test("M3. chatgpt_direct enabled has 10 tools", () => {
+    const tools = getToolDefs();
+    const directTools = selectToolsForProfile(tools, "chatgpt_direct", true);
+    if (directTools.length !== 10)
+        throw new Error(`Expected 10, got ${directTools.length}`);
+    if (JSON.stringify(directTools.map((t) => t.name)) !== JSON.stringify(CHATGPT_DIRECT_TOOL_NAMES)) {
+        throw new Error("Tool names mismatch");
+    }
+});
+test("M4. create_direct_session creates a session", () => {
+    const result = createDirectSession({ repo_path: "test-repo", title: "test session" });
+    if (!result.session_id.startsWith("direct_"))
+        throw new Error(`Invalid session_id: ${result.session_id}`);
+    if (!result.resolved_repo_path)
+        throw new Error("Missing resolved_repo_path");
+    if (!result.expires_at)
+        throw new Error("Missing expires_at");
+    if (result.allowed_commands.length === 0)
+        throw new Error("No allowed commands");
+    if (!result.workspace_clean)
+        throw new Error("Workspace should be clean");
+    directSessionId = result.session_id;
+});
+test("M5. read_workspace_file in direct profile without session_id is rejected", () => {
+    // Temporarily set profile to chatgpt_direct
+    const prevProfile = process.env.PATCHWARDEN_TOOL_PROFILE;
+    process.env.PATCHWARDEN_TOOL_PROFILE = "chatgpt_direct";
+    try {
+        readWorkspaceFile({ path: "src/index.ts" });
+        throw new Error("Should have rejected read without session_id in direct profile");
+    }
+    catch (err) {
+        if (err.message && err.message.includes("Should have rejected"))
+            throw err;
+        // Expected rejection
+    }
+    finally {
+        if (prevProfile === undefined)
+            delete process.env.PATCHWARDEN_TOOL_PROFILE;
+        else
+            process.env.PATCHWARDEN_TOOL_PROFILE = prevProfile;
+    }
+});
+test("M6. read_workspace_file with session_id returns sha256", () => {
+    const result = readWorkspaceFile({ path: "src/index.ts", session_id: directSessionId });
+    if (!result.sha256)
+        throw new Error("Missing sha256");
+    if (!result.relative_path)
+        throw new Error("Missing relative_path");
+    if (result.size === undefined)
+        throw new Error("Missing size");
+    if (!result.content)
+        throw new Error("Missing content");
+    // Verify sha256 is correct
+    const expectedHash = createHash("sha256").update(result.content, "utf-8").digest("hex");
+    if (result.sha256 !== expectedHash)
+        throw new Error("sha256 mismatch");
+});
+test("M7. search_workspace finds text and skips sensitive files", () => {
+    const result = searchWorkspace({ session_id: directSessionId, query: "hello" });
+    if (result.total_matches === 0)
+        throw new Error("Expected matches for 'hello'");
+    const paths = result.results.map((r) => r.path);
+    if (!paths.some((p) => p.includes("index.ts")))
+        throw new Error("Should find match in index.ts");
+    // .env should not appear in results
+    if (paths.some((p) => p.includes(".env")))
+        throw new Error(".env should be skipped");
+});
+test("M8. apply_patch with matching hash succeeds", () => {
+    const fileResult = readWorkspaceFile({ path: "src/index.ts", session_id: directSessionId });
+    const expectedSha = fileResult.sha256;
+    const result = applyPatch({
+        session_id: directSessionId,
+        path: "src/index.ts",
+        expected_sha256: expectedSha,
+        operations: [
+            { type: "replace_exact", old_text: "return 'hello';", new_text: "return 'hello updated';", occurrence: "first" },
+        ],
+    });
+    if (result.operations_applied !== 1)
+        throw new Error(`Expected 1 op applied, got ${result.operations_applied}`);
+    if (result.before_sha256 !== expectedSha)
+        throw new Error("before_sha256 mismatch");
+    if (result.after_sha256 === expectedSha)
+        throw new Error("after_sha256 should differ from before");
+});
+test("M9. apply_patch with mismatched hash is rejected", () => {
+    try {
+        applyPatch({
+            session_id: directSessionId,
+            path: "src/index.ts",
+            expected_sha256: "0000000000000000000000000000000000000000000000000000000000000000",
+            operations: [
+                { type: "replace_exact", old_text: "hello", new_text: "goodbye" },
+            ],
+        });
+        throw new Error("Should have rejected hash mismatch");
+    }
+    catch (err) {
+        if (err.message && err.message.includes("Should have rejected"))
+            throw err;
+        // Expected rejection
+    }
+});
+test("M10. apply_patch on sensitive file is rejected", () => {
+    try {
+        applyPatch({
+            session_id: directSessionId,
+            path: ".env",
+            expected_sha256: "dummy",
+            operations: [
+                { type: "replace_whole_file", new_text: "HACKED=true\n" },
+            ],
+        });
+        throw new Error("Should have rejected sensitive file");
+    }
+    catch (err) {
+        if (err.message && err.message.includes("Should have rejected"))
+            throw err;
+        // Expected rejection
+    }
+});
+test("M11. apply_patch on node_modules is rejected", () => {
+    try {
+        applyPatch({
+            session_id: directSessionId,
+            path: "node_modules/test/index.js",
+            expected_sha256: "dummy",
+            operations: [
+                { type: "replace_whole_file", new_text: "module.exports = {};" },
+            ],
+        });
+        throw new Error("Should have rejected node_modules path");
+    }
+    catch (err) {
+        if (err.message && err.message.includes("Should have rejected"))
+            throw err;
+        // Expected rejection
+    }
+});
+test("M12. apply_patch on dist/release is rejected", () => {
+    try {
+        applyPatch({
+            session_id: directSessionId,
+            path: "dist/index.js",
+            expected_sha256: "dummy",
+            operations: [
+                { type: "replace_whole_file", new_text: "console.log('hacked');" },
+            ],
+        });
+        throw new Error("Should have rejected dist path");
+    }
+    catch (err) {
+        if (err.message && err.message.includes("Should have rejected"))
+            throw err;
+        // Expected rejection
+    }
+    try {
+        applyPatch({
+            session_id: directSessionId,
+            path: "release/index.js",
+            expected_sha256: "dummy",
+            operations: [
+                { type: "replace_whole_file", new_text: "console.log('hacked');" },
+            ],
+        });
+        throw new Error("Should have rejected release path");
+    }
+    catch (err) {
+        if (err.message && err.message.includes("Should have rejected"))
+            throw err;
+        // Expected rejection
+    }
+});
+// M13 and M14 are async tests — use IIFE with top-level await
+await (async () => {
+    try {
+        const result = await runVerification({
+            session_id: directSessionId,
+            command: "npm test",
+            timeout_seconds: 30,
+        });
+        if (!result.passed)
+            throw new Error(`npm test should pass, got exit_code ${result.exit_code}`);
+        if (result.command !== "npm test")
+            throw new Error("Command mismatch");
+        console.log("  ✅ M13. run_verification allows whitelisted command");
+        passed++;
+    }
+    catch (err) {
+        console.log(`  ❌ M13. run_verification allows whitelisted command: ${err instanceof Error ? err.message : String(err)}`);
+        failed++;
+    }
+    try {
+        await runVerification({
+            session_id: directSessionId,
+            command: "rm -rf /",
+            timeout_seconds: 5,
+        });
+        console.log("  ❌ M14. run_verification rejects non-whitelisted command: Should have rejected");
+        failed++;
+    }
+    catch (err) {
+        console.log("  ✅ M14. run_verification rejects non-whitelisted command");
+        passed++;
+    }
+})();
+test("M15. finalize_direct_session generates summary/diff/changed-files", () => {
+    const result = finalizeDirectSession({ session_id: directSessionId });
+    if (!result.finalized)
+        throw new Error("Should be finalized");
+    if (result.changed_files_total === 0)
+        throw new Error("Expected changed files");
+    if (!result.diff_path)
+        throw new Error("Missing diff_path");
+    if (!result.summary_path)
+        throw new Error("Missing summary_path");
+    if (!existsSync(result.diff_path))
+        throw new Error("diff.patch not created");
+    if (!existsSync(result.summary_path))
+        throw new Error("summary.md not created");
+    const changedFilesPath = join(dirname(result.diff_path), "changed-files.json");
+    if (!existsSync(changedFilesPath))
+        throw new Error("changed-files.json not created");
+    if (result.source_changes.length === 0)
+        throw new Error("Expected source changes");
+});
+test("M16. apply_patch after finalize is rejected", () => {
+    try {
+        applyPatch({
+            session_id: directSessionId,
+            path: "src/index.ts",
+            expected_sha256: "dummy",
+            operations: [
+                { type: "replace_whole_file", new_text: "should fail" },
+            ],
+        });
+        throw new Error("Should have rejected patch after finalize");
+    }
+    catch (err) {
+        if (err.message && err.message.includes("Should have rejected"))
+            throw err;
+        // Expected rejection (session_finalized)
+    }
+});
+test("M17. audit_session passes for normal small change", () => {
+    const result = auditSession({ session_id: directSessionId });
+    if (result.decision === "fail")
+        throw new Error(`Expected pass or warn, got fail: ${result.blocking_findings.join("; ")}`);
+    if (!result.evidence.diff_path)
+        throw new Error("Missing diff_path in evidence");
+    if (!result.evidence.summary_path)
+        throw new Error("Missing summary_path in evidence");
+    // Should have run verification
+    const session = readDirectSession(directSessionId);
+    if (session.verification_runs.length === 0)
+        throw new Error("Expected verification runs");
+});
+// Create a second session for M18 (no verification)
+let noVerifySessionId = "";
+test("M18. audit_session warns or fails for unverified source changes", () => {
+    const sess = createDirectSession({ repo_path: "test-repo", title: "no verify session" });
+    noVerifySessionId = sess.session_id;
+    // Apply a patch but don't run verification
+    const fileResult = readWorkspaceFile({ path: "src/index.ts", session_id: noVerifySessionId });
+    applyPatch({
+        session_id: noVerifySessionId,
+        path: "src/index.ts",
+        expected_sha256: fileResult.sha256,
+        operations: [
+            { type: "replace_exact", old_text: "return 'hello updated';", new_text: "return 'hello no verify';" },
+        ],
+    });
+    finalizeDirectSession({ session_id: noVerifySessionId });
+    const auditResult = auditSession({ session_id: noVerifySessionId });
+    if (auditResult.decision === "pass")
+        throw new Error("Expected warn or fail for unverified source changes");
+    if (!auditResult.reason_codes.includes("source_changes_without_verification")) {
+        throw new Error(`Expected source_changes_without_verification, got: ${auditResult.reason_codes.join(", ")}`);
+    }
+});
+// M19: Delete file test (real deletion)
+test("M19. audit_session fails for deleted file", () => {
+    // Create a temp file in the repo before session creation
+    writeFileSync(join(directRepo, "src", "temp-delete.ts"), "export const temp = 'delete me';\n", "utf-8");
+    const sess = createDirectSession({ repo_path: "test-repo", title: "delete test session" });
+    const deleteSessionId = sess.session_id;
+    // Apply a patch to an existing file (so there's a real change)
+    const fileResult = readWorkspaceFile({ path: "src/index.ts", session_id: deleteSessionId });
+    applyPatch({
+        session_id: deleteSessionId,
+        path: "src/index.ts",
+        expected_sha256: fileResult.sha256,
+        operations: [
+            { type: "replace_exact", old_text: "return 'hello no verify';", new_text: "return 'hello delete test';" },
+        ],
+    });
+    // Run verification so the only issue is the deleted file
+    // Need to update package.json test script to work with current state
+    // Actually, npm test should still work since it just prints a message
+    // Real deletion of the temp file
+    rmSync(join(directRepo, "src", "temp-delete.ts"));
+    finalizeDirectSession({ session_id: deleteSessionId });
+    const auditResult = auditSession({ session_id: deleteSessionId });
+    if (auditResult.decision !== "fail") {
+        throw new Error(`Expected fail for deleted file, got ${auditResult.decision}: ${auditResult.reason_codes.join(", ")}`);
+    }
+    if (!auditResult.reason_codes.includes("file_deleted")) {
+        throw new Error(`Expected file_deleted in reason_codes, got: ${auditResult.reason_codes.join(", ")}`);
+    }
+});
+test("M20. session expiry rejects all operations", () => {
+    const sess = createDirectSession({ repo_path: "test-repo", title: "expiry test" });
+    const expirySessionId = sess.session_id;
+    // Manually set expires_at to the past
+    const session = readDirectSession(expirySessionId);
+    updateDirectSession(expirySessionId, {
+        ...session,
+        expires_at: new Date(Date.now() - 60000).toISOString(),
+    });
+    // read should reject
+    try {
+        readWorkspaceFile({ path: "src/index.ts", session_id: expirySessionId });
+        throw new Error("Should have rejected expired session (read)");
+    }
+    catch (err) {
+        if (err.message && err.message.includes("Should have rejected"))
+            throw err;
+    }
+    // apply_patch should reject
+    try {
+        applyPatch({
+            session_id: expirySessionId,
+            path: "src/index.ts",
+            expected_sha256: "dummy",
+            operations: [{ type: "replace_whole_file", new_text: "test" }],
+        });
+        throw new Error("Should have rejected expired session (patch)");
+    }
+    catch (err) {
+        if (err.message && err.message.includes("Should have rejected"))
+            throw err;
+    }
+    // search should reject
+    try {
+        searchWorkspace({ session_id: expirySessionId, query: "hello" });
+        throw new Error("Should have rejected expired session (search)");
+    }
+    catch (err) {
+        if (err.message && err.message.includes("Should have rejected"))
+            throw err;
+    }
+});
+// M21. Direct read blocks .patchwarden internal paths
+test("M21. read_workspace_file blocks .patchwarden internal paths", () => {
+    const sess = createDirectSession({ repo_path: "test-repo", title: "internal path test" });
+    const internalSessionId = sess.session_id;
+    // Try to read the session file itself
+    try {
+        readWorkspaceFile({
+            path: `.patchwarden/direct-sessions/${internalSessionId}/session.json`,
+            session_id: internalSessionId,
+        });
+        throw new Error("Should have rejected .patchwarden internal path read");
+    }
+    catch (err) {
+        if (err.message && err.message.includes("Should have rejected"))
+            throw err;
+        if (!err.reason || err.reason !== "internal_patchwarden_path_blocked") {
+            throw new Error(`Expected internal_patchwarden_path_blocked, got: ${err.reason || err.message}`);
+        }
+    }
+    // Try to read any .patchwarden file
+    try {
+        readWorkspaceFile({
+            path: ".patchwarden/watcher-heartbeat.json",
+            session_id: internalSessionId,
+        });
+        throw new Error("Should have rejected .patchwarden internal path read (2)");
+    }
+    catch (err) {
+        if (err.message && err.message.includes("Should have rejected"))
+            throw err;
+        if (!err.reason || err.reason !== "internal_patchwarden_path_blocked") {
+            throw new Error(`Expected internal_patchwarden_path_blocked, got: ${err.reason || err.message}`);
+        }
+    }
+});
+// M22. Binary detection with null byte works for extensionless files
+test("M22. binary detection blocks extensionless files with null bytes", () => {
+    // Create a blob file with null bytes in the fixture repo
+    const blobPath = join(directRepo, "blob");
+    writeFileSync(blobPath, Buffer.from("abc\x00def", "binary"));
+    const sess = createDirectSession({ repo_path: "test-repo", title: "binary test" });
+    const binarySessionId = sess.session_id;
+    // read should reject
+    try {
+        readWorkspaceFile({ path: "blob", session_id: binarySessionId });
+        throw new Error("Should have rejected binary file read");
+    }
+    catch (err) {
+        if (err.message && err.message.includes("Should have rejected"))
+            throw err;
+        if (!err.reason || err.reason !== "binary_file_blocked") {
+            throw new Error(`Expected binary_file_blocked, got: ${err.reason || err.message}`);
+        }
+    }
+    // apply_patch should reject
+    try {
+        applyPatch({
+            session_id: binarySessionId,
+            path: "blob",
+            expected_sha256: "dummy",
+            operations: [{ type: "replace_whole_file", new_text: "safe" }],
+        });
+        throw new Error("Should have rejected binary file patch");
+    }
+    catch (err) {
+        if (err.message && err.message.includes("Should have rejected"))
+            throw err;
+        if (!err.reason || err.reason !== "binary_file_blocked") {
+            throw new Error(`Expected binary_file_blocked, got: ${err.reason || err.message}`);
+        }
+    }
+});
+// Restore original config
+process.env.PATCHWARDEN_CONFIG = originalConfigEnv;
+reloadConfig();
+try {
+    rmSync(directRoot, { recursive: true, force: true });
+}
+catch { }
+// ════════════════════════════════════════════════════════════════
 // Summary
 // ════════════════════════════════════════════════════════════════
 console.log(`\n${"=".repeat(50)}`);