patchwarden 0.4.0 → 0.6.1

package/src/runner/simpleProcess.ts

@@ -0,0 +1,223 @@
+import { spawn, spawnSync, type ChildProcess } from "node:child_process";
+import { createWriteStream, writeFileSync, readFileSync, existsSync, type WriteStream } from "node:fs";
+
+const GRACEFUL_KILL_MS = 2000;
+
+export interface SimpleProcessOptions {
+  command: string;
+  args: string[];
+  cwd: string;
+  timeoutMs: number;
+  maxStdoutBytes?: number;
+  maxStderrBytes?: number;
+  stdoutPath?: string;
+  stderrPath?: string;
+}
+
+export interface SimpleProcessResult {
+  exitCode: number | null;
+  stdout: string;
+  stderr: string;
+  spawnError: string | null;
+  timedOut: boolean;
+  stdoutTruncated: boolean;
+  stderrTruncated: boolean;
+}
+
+const DEFAULT_MAX_STDOUT = 524288;
+const DEFAULT_MAX_STDERR = 131072;
+
+export function runSimpleProcessSync(options: SimpleProcessOptions): SimpleProcessResult {
+  const maxStdout = options.maxStdoutBytes ?? DEFAULT_MAX_STDOUT;
+  const maxStderr = options.maxStderrBytes ?? DEFAULT_MAX_STDERR;
+
+  let result;
+  try {
+    result = spawnSync(options.command, options.args, {
+      cwd: options.cwd,
+      stdio: ["ignore", "pipe", "pipe"],
+      timeout: options.timeoutMs,
+      windowsHide: true,
+      maxBuffer: maxStdout + 1024,
+      encoding: "utf-8",
+    });
+  } catch (error) {
+    return {
+      exitCode: null,
+      stdout: "",
+      stderr: "",
+      spawnError: error instanceof Error ? error.message : String(error),
+      timedOut: false,
+      stdoutTruncated: false,
+      stderrTruncated: false,
+    };
+  }
+
+  const stdout = result.stdout || "";
+  const stderr = result.stderr || "";
+  const timedOut: boolean = Boolean(
+    result.signal === "SIGTERM" || result.signal === "SIGKILL" ||
+    (result.signal !== null && result.status === null) ||
+    (result.error && (result.error as any).code === "ETIMEDOUT")
+  );
+
+  if (options.stdoutPath && stdout) {
+    try { writeFileSyncAppend(options.stdoutPath, stdout); } catch {}
+  }
+  if (options.stderrPath && stderr) {
+    try { writeFileSyncAppend(options.stderrPath, stderr); } catch {}
+  }
+
+  return {
+    exitCode: result.status,
+    stdout: stdout.length > maxStdout ? stdout.slice(0, maxStdout) : stdout,
+    stderr: stderr.length > maxStderr ? stderr.slice(0, maxStderr) : stderr,
+    // If timed out, don't report spawnError — it's a timeout, not a spawn failure
+    spawnError: timedOut ? null : (result.error ? result.error.message : null),
+    timedOut,
+    stdoutTruncated: stdout.length > maxStdout,
+    stderrTruncated: stderr.length > maxStderr,
+  };
+}
+
+export async function runSimpleProcess(options: SimpleProcessOptions): Promise<SimpleProcessResult> {
+  const maxStdout = options.maxStdoutBytes ?? DEFAULT_MAX_STDOUT;
+  const maxStderr = options.maxStderrBytes ?? DEFAULT_MAX_STDERR;
+  const deadlineMs = Date.now() + options.timeoutMs;
+
+  let child: ChildProcess;
+  try {
+    child = spawn(options.command, options.args, {
+      cwd: options.cwd,
+      stdio: ["ignore", "pipe", "pipe"],
+      detached: process.platform !== "win32",
+      windowsHide: true,
+    });
+  } catch (error) {
+    return {
+      exitCode: null,
+      stdout: "",
+      stderr: "",
+      spawnError: error instanceof Error ? error.message : String(error),
+      timedOut: false,
+      stdoutTruncated: false,
+      stderrTruncated: false,
+    };
+  }
+
+  const stdoutStream = options.stdoutPath ? createWriteStream(options.stdoutPath, { flags: "a" }) : null;
+  const stderrStream = options.stderrPath ? createWriteStream(options.stderrPath, { flags: "a" }) : null;
+
+  let stdoutBuf = Buffer.alloc(0);
+  let stderrBuf = Buffer.alloc(0);
+  let stdoutTruncated = false;
+  let stderrTruncated = false;
+  let spawnError: string | null = null;
+  let timedOut = false;
+  let forceTimer: ReturnType<typeof setTimeout> | null = null;
+  let terminationStarted = false;
+
+  const requestTermination = (reason: "timeout" | "force", force: boolean) => {
+    if (terminationStarted) return;
+    terminationStarted = true;
+    if (reason === "timeout") timedOut = true;
+    if (force) {
+      forceKill(child);
+    } else {
+      gracefulKill(child);
+      forceTimer = setTimeout(() => forceKill(child), GRACEFUL_KILL_MS);
+    }
+  };
+
+  child.stdout?.on("data", (chunk: Buffer) => {
+    stdoutStream?.write(chunk);
+    if (stdoutBuf.length < maxStdout) {
+      const remaining = maxStdout - stdoutBuf.length;
+      if (chunk.length <= remaining) {
+        stdoutBuf = Buffer.concat([stdoutBuf, chunk]);
+      } else {
+        stdoutBuf = Buffer.concat([stdoutBuf, chunk.slice(0, remaining)]);
+        stdoutTruncated = true;
+      }
+    } else {
+      stdoutTruncated = true;
+    }
+  });
+
+  child.stderr?.on("data", (chunk: Buffer) => {
+    stderrStream?.write(chunk);
+    if (stderrBuf.length < maxStderr) {
+      const remaining = maxStderr - stderrBuf.length;
+      if (chunk.length <= remaining) {
+        stderrBuf = Buffer.concat([stderrBuf, chunk]);
+      } else {
+        stderrBuf = Buffer.concat([stderrBuf, chunk.slice(0, remaining)]);
+        stderrTruncated = true;
+      }
+    } else {
+      stderrTruncated = true;
+    }
+  });
+
+  const timeoutTimer = setTimeout(() => requestTermination("timeout", true), options.timeoutMs);
+
+  const exitCode = await new Promise<number | null>((resolveExit) => {
+    let settled = false;
+    const finish = (code: number | null) => {
+      if (settled) return;
+      settled = true;
+      resolveExit(code);
+    };
+    child.once("close", (code) => finish(code));
+    child.once("exit", (code) => finish(code));
+    child.once("error", (error) => {
+      spawnError = error.message;
+      finish(null);
+    });
+  });
+
+  clearTimeout(timeoutTimer);
+  if (forceTimer) clearTimeout(forceTimer);
+  stdoutStream?.destroy();
+  stderrStream?.destroy();
+
+  return {
+    exitCode,
+    stdout: stdoutBuf.toString("utf-8"),
+    stderr: stderrBuf.toString("utf-8"),
+    spawnError,
+    timedOut,
+    stdoutTruncated,
+    stderrTruncated,
+  };
+}
+
+function gracefulKill(child: ChildProcess): void {
+  try {
+    if (process.platform !== "win32" && child.pid) process.kill(-child.pid, "SIGTERM");
+    else child.kill("SIGTERM");
+  } catch {}
+}
+
+function forceKill(child: ChildProcess): void {
+  if (!child.pid) return;
+  try {
+    if (process.platform === "win32") {
+      const result = spawnSync("taskkill.exe", ["/PID", String(child.pid), "/T", "/F"], {
+        stdio: "ignore",
+        timeout: 5000,
+        windowsHide: true,
+      });
+      if (result.status !== 0) child.kill("SIGKILL");
+    } else {
+      process.kill(-child.pid, "SIGKILL");
+    }
+  } catch {
+    try { child.kill("SIGKILL"); } catch {}
+  }
+}
+
+function writeFileSyncAppend(path: string, content: string): void {
+  const existing = existsSync(path) ? readFileSync(path, "utf-8") : "";
+  writeFileSync(path, existing + content, "utf-8");
+}

package/src/runner/watch.ts

@@ -22,6 +22,8 @@ import { resolve, join, dirname } from "node:path";
 import { loadConfig, getConfig, getTasksDir, resolveWorkspaceRoot } from "../config.js";
 import { guardWorkspacePath } from "../security/pathGuard.js";
 import { guardAgentCommand, guardTestCommand } from "../security/commandGuard.js";
+import { validateAssessmentFreshness } from "../assessments/assessmentStore.js";
+import { captureRepoSnapshot } from "./changeCapture.js";
 import { runTask } from "./runTask.js";
 
 // ── Bootstrap ─────────────────────────────────────────────────────
@@ -91,14 +93,28 @@ async function tick() {
       // ── Pre-flight safety checks ──
       try {
         // Check repo_path
-        guardWorkspacePath(statusData.repo_path || wsRoot, wsRoot);
+        const resolvedRepoPath = guardWorkspacePath(statusData.resolved_repo_path || statusData.repo_path || wsRoot, wsRoot);
 
         // Check agent
         guardAgentCommand(statusData.agent, config);
 
         // Check test_command
         if (statusData.test_command) {
-          guardTestCommand(statusData.test_command, config);
+          guardTestCommand(statusData.test_command, config, resolvedRepoPath);
+        }
+        if (Array.isArray(statusData.verify_commands)) {
+          for (const command of statusData.verify_commands) {
+            guardTestCommand(String(command), config, resolvedRepoPath);
+          }
+        }
+
+        // Assessment freshness revalidation
+        if (statusData.assessment_id) {
+          const preExecSnapshot = captureRepoSnapshot(resolvedRepoPath);
+          const validation = validateAssessmentFreshness(String(statusData.assessment_id), preExecSnapshot);
+          if (!validation.valid) {
+            throw new Error(`assessment validation failed: ${validation.failure_reason}`);
+          }
         }
       } catch (err) {
         const errMsg = `[watcher] Safety check failed for ${taskId}: ${err instanceof Error ? err.message : String(err)}`;

package/src/security/commandGuard.ts

@@ -1,4 +1,4 @@
-import { PatchWardenConfig } from "../config.js";
+import { getRepoAllowedTestCommands, getRepoDirectAllowedCommands, PatchWardenConfig } from "../config.js";
 import { PatchWardenError } from "../errors.js";
 
 /**
@@ -65,7 +65,8 @@ function isSafeConfiguredCommand(command: string): boolean {
 
 export function guardTestCommand(
   testCommand: string,
-  config: PatchWardenConfig
+  config: PatchWardenConfig,
+  repoPath?: string
 ): string {
   if (!testCommand || typeof testCommand !== "string") {
     // If no test command specified, that's ok — skip tests
@@ -75,10 +76,14 @@ export function guardTestCommand(
   const trimmed = testCommand.trim();
   if (trimmed === "") return "";
 
-  if (!config.allowedTestCommands.includes(trimmed)) {
+  const allowedCommands = [
+    ...config.allowedTestCommands,
+    ...(repoPath ? getRepoAllowedTestCommands(config, repoPath) : []),
+  ];
+  if (!allowedCommands.includes(trimmed)) {
     throw new PatchWardenError(
       "test_command_not_allowlisted",
-      `Test command "${trimmed}" is not in the allowed list. Allowed: ${config.allowedTestCommands.join(", ")}`,
+      `Test command "${trimmed}" is not allowed for this repository. Allowed: ${allowedCommands.join(", ")}`,
       "Use an exact allowed command shown by create_task, or omit test_command."
     );
   }
@@ -86,6 +91,43 @@ export function guardTestCommand(
   return trimmed;
 }
 
+export function guardDirectCommand(
+  command: string,
+  config: PatchWardenConfig,
+  repoPath?: string
+): string {
+  if (!command || typeof command !== "string") {
+    throw new PatchWardenError(
+      "direct_command_required",
+      "A command string is required for run_verification.",
+      "Provide one of the allowed Direct verification commands."
+    );
+  }
+
+  const trimmed = command.trim();
+  if (trimmed === "") {
+    throw new PatchWardenError(
+      "direct_command_required",
+      "A command string is required for run_verification.",
+      "Provide one of the allowed Direct verification commands."
+    );
+  }
+
+  const allowedCommands = [
+    ...(config.directAllowedCommands || []),
+    ...(repoPath ? getRepoDirectAllowedCommands(config, repoPath) : []),
+  ];
+  if (!allowedCommands.includes(trimmed)) {
+    throw new PatchWardenError(
+      "direct_command_not_allowlisted",
+      `Direct command "${trimmed}" is not allowed. Allowed: ${allowedCommands.join(", ")}`,
+      "Use an exact allowed command from the Direct allowlist."
+    );
+  }
+
+  return trimmed;
+}
+
 /**
  * Escape a user-provided string for safe use in shell arguments.
  * We prevent injection by refusing to pass arbitrary strings to shell.

package/src/security/riskEngine.ts

@@ -0,0 +1,160 @@
+import {
+  existsSync,
+  statSync,
+} from "node:fs";
+import { resolve } from "node:path";
+import {
+  PatchWardenConfig,
+  getRepoAllowedTestCommands,
+} from "../config.js";
+import { guardWorkspacePath } from "./pathGuard.js";
+import { guardPlanContent } from "./planGuard.js";
+import { guardTestCommand } from "./commandGuard.js";
+import { isSensitivePath } from "./sensitiveGuard.js";
+import { guardRuntimeSelfModification } from "./runtimeGuard.js";
+import { PatchWardenError } from "../errors.js";
+import type { TaskTemplateName, ChangePolicy } from "../tools/taskTemplates.js";
+
+export type RiskLevel = "low" | "medium" | "high";
+export type RiskDecision = "allow" | "needs_confirm" | "blocked";
+
+export interface RiskAssessmentInput {
+  repoPath: string;
+  resolvedRepoPath: string;
+  planContent: string;
+  planTitle: string;
+  testCommand: string;
+  verifyCommands: string[];
+  template?: TaskTemplateName;
+  goal?: string;
+  agent: string;
+  config: PatchWardenConfig;
+  snapshotTruncated: boolean;
+}
+
+export interface RiskAssessmentResult {
+  risk_level: RiskLevel;
+  decision: RiskDecision;
+  reason_codes: string[];
+  risk_hints: string[];
+  hard_rule_hits: string[];
+}
+
+const DIST_COMMANDS = new Set(["npm run dist", "npm run pack"]);
+
+export function assessRisk(input: RiskAssessmentInput): RiskAssessmentResult {
+  const hardRuleHits: string[] = [];
+  const reasonCodes: string[] = [];
+
+  // ── Hard rules (guard functions). A hit means high → blocked. ──
+  let resolvedRepoPath = input.resolvedRepoPath;
+  try {
+    resolvedRepoPath = guardWorkspacePath(input.repoPath, input.config.workspaceRoot);
+  } catch (e) {
+    hardRuleHits.push(extractReason(e));
+    return finalize("high", "blocked", reasonCodes, hardRuleHits, input);
+  }
+
+  if (!existsSync(resolvedRepoPath)) {
+    hardRuleHits.push("repo_path_not_found");
+    return finalize("high", "blocked", reasonCodes, hardRuleHits, input);
+  }
+  if (!statSync(resolvedRepoPath).isDirectory()) {
+    hardRuleHits.push("repo_path_not_directory");
+    return finalize("high", "blocked", reasonCodes, hardRuleHits, input);
+  }
+
+  try {
+    guardRuntimeSelfModification(resolvedRepoPath);
+  } catch (e) {
+    hardRuleHits.push(extractReason(e));
+    return finalize("high", "blocked", reasonCodes, hardRuleHits, input);
+  }
+
+  if (!input.config.agents[input.agent]) {
+    hardRuleHits.push("agent_not_configured");
+    return finalize("high", "blocked", reasonCodes, hardRuleHits, input);
+  }
+
+  try {
+    guardPlanContent(input.planTitle, input.planContent);
+  } catch (e) {
+    hardRuleHits.push(extractReason(e));
+    return finalize("high", "blocked", reasonCodes, hardRuleHits, input);
+  }
+
+  for (const cmd of [input.testCommand, ...input.verifyCommands]) {
+    if (!cmd || cmd.trim() === "") continue;
+    try {
+      guardTestCommand(cmd, input.config, resolvedRepoPath);
+    } catch (e) {
+      hardRuleHits.push(extractReason(e));
+      return finalize("high", "blocked", reasonCodes, hardRuleHits, input);
+    }
+  }
+
+  if (input.goal) {
+    const goalPath = resolve(resolvedRepoPath, input.goal);
+    if (isSensitivePath(input.goal) || isSensitivePath(goalPath)) {
+      hardRuleHits.push("sensitive_path_in_goal");
+      return finalize("high", "blocked", reasonCodes, hardRuleHits, input);
+    }
+  }
+
+  // ── Hard rules passed. Reason codes for passing. ──
+  reasonCodes.push("repo_scoped", "no_sensitive_paths", "allowlisted_commands");
+
+  // ── Snapshot truncation (微调 #2): force needs_confirm. ──
+  if (input.snapshotTruncated) {
+    reasonCodes.push("snapshot_truncated");
+    return finalize("medium", "needs_confirm", reasonCodes, hardRuleHits, input);
+  }
+
+  // ── Medium-risk policy decisions. ──
+  if (input.template === "release_check") {
+    reasonCodes.push("release_template_needs_confirm");
+    return finalize("medium", "needs_confirm", reasonCodes, hardRuleHits, input);
+  }
+  if (input.verifyCommands.some((c) => DIST_COMMANDS.has(c.trim()))) {
+    reasonCodes.push("dist_command_needs_confirm");
+    return finalize("medium", "needs_confirm", reasonCodes, hardRuleHits, input);
+  }
+
+  // ── Low risk. ──
+  if (input.template === "inspect_only") reasonCodes.push("inspect_only_no_changes");
+  else if (input.template === "feature_small") reasonCodes.push("feature_small_scoped");
+  else if (input.template === "fix_tests") reasonCodes.push("fix_tests_scoped");
+  return finalize("low", "allow", reasonCodes, hardRuleHits, input);
+}
+
+/** Risk hints — keyword detection only, never affects risk_level (收缩 #4). */
+export function collectRiskHints(input: RiskAssessmentInput): string[] {
+  const hints: string[] = [];
+  const text = `${input.goal || ""} ${input.planContent || ""}`.toLowerCase();
+  if (/\bpackage-lock\b/.test(text)) hints.push("mentions_package_lock");
+  if (/\brelease\b|\bdist\b/.test(text)) hints.push("mentions_artifact_dir");
+  if (/\bsync\b|\bbackup\b|\bpayload\b|\bpersistence\b/.test(text)) hints.push("mentions_dev_vocab");
+  return hints;
+}
+
+function finalize(
+  risk_level: RiskLevel,
+  decision: RiskDecision,
+  reason_codes: string[],
+  hard_rule_hits: string[],
+  input: RiskAssessmentInput
+): RiskAssessmentResult {
+  return {
+    risk_level,
+    decision,
+    reason_codes,
+    risk_hints: collectRiskHints(input),
+    hard_rule_hits,
+  };
+}
+
+function extractReason(error: unknown): string {
+  if (error instanceof PatchWardenError) return error.reason;
+  if (error instanceof Error) return error.message.slice(0, 80);
+  return String(error).slice(0, 80);
+}

package/src/security/runtimeGuard.ts

@@ -0,0 +1,41 @@
+import { resolve, join, dirname } from "node:path";
+import { fileURLToPath } from "node:url";
+import { PatchWardenError } from "../errors.js";
+
+const CRITICAL_RUNTIME_DIRS = ["dist", "src", "scripts", "release"];
+
+/**
+ * Refuse operations against the active PatchWarden runtime directory or its
+ * critical subdirectories. Extracted from createTask.ts so assess-only flows
+ * and direct-session flows share the same protection.
+ */
+export function guardRuntimeSelfModification(resolvedRepoPath: string): void {
+  const runtimeRoot = resolve(dirname(fileURLToPath(import.meta.url)), "..");
+  if (
+    resolvedRepoPath === runtimeRoot ||
+    resolvedRepoPath.startsWith(runtimeRoot + resolve("/")[0])
+  ) {
+    const isCritical = CRITICAL_RUNTIME_DIRS.some((dir) => {
+      const full = join(runtimeRoot, dir);
+      return (
+        resolvedRepoPath === full ||
+        resolvedRepoPath.startsWith(full + resolve("/")[0])
+      );
+    });
+    if (resolvedRepoPath === runtimeRoot || isCritical) {
+      throw new PatchWardenError(
+        "runtime_self_modification_blocked",
+        `repo_path points to the active PatchWarden runtime or its critical subdirectories.`,
+        "Use a dev copy or git worktree for PatchWarden development. The running MCP server must not be modified by a task.",
+        true,
+        {
+          operation: "runtime_guard",
+          path: resolvedRepoPath,
+          runtime_root: runtimeRoot,
+          safe_alternative:
+            "Clone or copy PatchWarden to a separate directory for development tasks.",
+        }
+      );
+    }
+  }
+}