patchwarden 0.4.0 → 0.6.1

package/src/smoke-test.ts

@@ -19,16 +19,20 @@ import {
   rmSync,
   existsSync,
   readFileSync,
+  readdirSync,
   mkdtempSync,
 } from "node:fs";
 import { resolve, join, dirname } from "node:path";
 import { tmpdir } from "node:os";
-import { fileURLToPath } from "node:url";
+import { fileURLToPath, pathToFileURL } from "node:url";
 import { spawnSync } from "node:child_process";
-import { loadConfig, getConfig } from "./config.js";
+import { loadConfig, getConfig, reloadConfig } from "./config.js";
 import { savePlan } from "./tools/savePlan.js";
 import { getPlan } from "./tools/getPlan.js";
 import { createTask } from "./tools/createTask.js";
+import type { CreateTaskOutput, AssessOnlyOutput } from "./tools/createTask.js";
+import { confirmAssessment, readAssessment, computeWorkspaceFingerprint, createAssessment, type AssessmentRecord } from "./assessments/assessmentStore.js";
+import { captureRepoSnapshot } from "./runner/changeCapture.js";
 import { getTaskStatus } from "./tools/getTaskStatus.js";
 import { getResult, getDiff, getTestLog } from "./tools/taskOutputs.js";
 import { listWorkspace } from "./tools/listWorkspace.js";
@@ -44,10 +48,19 @@ import { getToolDefs } from "./tools/registry.js";
 import {
   buildToolCatalogSnapshot,
   CHATGPT_CORE_TOOL_NAMES,
+  CHATGPT_DIRECT_TOOL_NAMES,
   selectToolsForProfile,
 } from "./tools/toolCatalog.js";
 import { errorPayload } from "./errors.js";
 import { readWatcherStatus } from "./watcherStatus.js";
+import { createDirectSession } from "./tools/createDirectSession.js";
+import { searchWorkspace } from "./tools/searchWorkspace.js";
+import { applyPatch } from "./tools/applyPatch.js";
+import { runVerification } from "./tools/runVerification.js";
+import { finalizeDirectSession } from "./tools/finalizeDirectSession.js";
+import { auditSession } from "./tools/auditSession.js";
+import { readDirectSession, updateDirectSession } from "./direct/directSessionStore.js";
+import { createHash } from "node:crypto";
 
 // Resolve the actual node binary path (spawnSync needs it on WSL/Windows)
 let nodeBin = process.execPath;
@@ -76,6 +89,9 @@ writeFileSync(
         },
       },
       allowedTestCommands: ["npm test", "npm run test", "pytest", "cargo test"],
+      repoAllowedTestCommands: {
+        "scoped-repo": ["npm run release:check"],
+      },
       maxReadFileBytes: 200000,
     },
     null,
@@ -220,6 +236,28 @@ test("A3. createTask with valid agent and no test_command", () => {
     throw new Error(`Healthy watcher handoff mismatch: ${JSON.stringify(result)}`);
   }
   if (!existsSync(join(result.path, "status.json"))) throw new Error("status.json not created");
+  if (!/^task_\d{8}_\d{6}_[0-9a-f]{6}$/.test(result.task_id)) {
+    throw new Error(`Task ID is not short and opaque: ${result.task_id}`);
+  }
+});
+
+test("A3-short-id. tasks created in the same second remain unique", () => {
+  const first = createTask({ plan_id: planId, agent: "codex", repo_path: "." });
+  const second = createTask({ plan_id: planId, agent: "codex", repo_path: "." });
+  if (first.task_id === second.task_id) throw new Error("Short task IDs must remain unique");
+  for (const id of [first.task_id, second.task_id]) {
+    if (!/^task_\d{8}_\d{6}_[0-9a-f]{6}$/.test(id)) throw new Error(`Unexpected task ID format: ${id}`);
+  }
+});
+
+test("A3-legacy-id. existing long task IDs remain readable", () => {
+  const legacyId = "task_1782095536767_1782095536762_Legacy_Title";
+  const legacyDir = join(resolve(smokeWorkspace, config.tasksDir), legacyId);
+  mkdirSync(legacyDir, { recursive: true });
+  const source = JSON.parse(readFileSync(join(taskPath, "status.json"), "utf-8"));
+  source.task_id = legacyId;
+  writeFileSync(join(legacyDir, "status.json"), JSON.stringify(source, null, 2), "utf-8");
+  if (getTaskStatus(legacyId).task_id !== legacyId) throw new Error("Legacy task ID lookup failed");
 });
 
 test("A3a. stale watcher preserves the task and returns structured blocked evidence", () => {
@@ -292,6 +330,11 @@ test("A3b-summary. structured task summaries recursively redact result and verif
   if (summary.verification_summary.headline !== "166 passed" || summary.redaction_categories.length === 0) {
     throw new Error(`Structured summary evidence incomplete: ${serialized}`);
   }
+  const compact = getTaskSummary(taskId, { view: "compact", max_items: 2 });
+  const compactSerialized = JSON.stringify(compact);
+  if (!compact.redacted || compactSerialized.includes("structured-secret") || "log_tails" in compact) {
+    throw new Error(`Compact summary redaction or bounding failed: ${compactSerialized}`);
+  }
 });
 
 testReject("A2c-hardening. security wording does not bypass credential blocking", () => {
@@ -549,9 +592,9 @@ test("D8b. tool profiles are exact and schema changes alter the manifest hash",
   try {
     process.env.PATCHWARDEN_TOOL_PROFILE = "full";
     const fullTools = getToolDefs();
-    if (fullTools.length !== 22) throw new Error(`Expected 22 full tools, got ${fullTools.length}`);
+    if (fullTools.length !== 30) throw new Error(`Expected 30 full tools, got ${fullTools.length}`);
 
-    const coreTools = selectToolsForProfile(fullTools, "chatgpt_core");
+    const coreTools = selectToolsForProfile(fullTools, "chatgpt_core", getConfig().enableDirectProfile);
     const names = coreTools.map((tool) => tool.name);
     if (JSON.stringify(names) !== JSON.stringify(CHATGPT_CORE_TOOL_NAMES)) {
       throw new Error(`Unexpected chatgpt_core tools: ${JSON.stringify(names)}`);
@@ -592,6 +635,56 @@ testReject("D9. createTask rejects a non-allowlisted verify_commands entry", ()
   });
 });
 
+test("D10. repository-scoped verification is allowed only for its configured repo", () => {
+  const scopedRepo = resolve(wsRoot, "scoped-repo");
+  const otherRepo = resolve(wsRoot, "other-repo");
+  mkdirSync(scopedRepo, { recursive: true });
+  mkdirSync(otherRepo, { recursive: true });
+  const allowed = createTask({
+    plan_id: planId,
+    agent: "codex",
+    repo_path: "scoped-repo",
+    verify_commands: ["npm run release:check"],
+  });
+  if (!allowed.task_id) throw new Error("Repository-scoped command should be accepted");
+  try {
+    createTask({
+      plan_id: planId,
+      agent: "codex",
+      repo_path: "other-repo",
+      verify_commands: ["npm run release:check"],
+    });
+    throw new Error("Repository-scoped command escaped its configured repository");
+  } catch (error) {
+    const payload: any = errorPayload(error);
+    if (payload.reason !== "test_command_not_allowlisted") throw error;
+  }
+  const createTool: any = getToolDefs().find((tool) => tool.name === "create_task");
+  const advertised = createTool?.inputSchema?.properties?.verify_commands?.items?.enum || [];
+  if (!advertised.includes("npm run release:check")) throw new Error("Scoped command missing from MCP schema");
+});
+
+test("D11. repository-scoped allowlist keys cannot escape workspaceRoot", () => {
+  const invalidConfigPath = join(smokeRoot, "invalid-repo-allowlist.json");
+  writeFileSync(invalidConfigPath, JSON.stringify({
+    workspaceRoot: smokeWorkspace,
+    repoAllowedTestCommands: { "../outside": ["npm test"] },
+  }), "utf-8");
+  const configModuleUrl = pathToFileURL(resolve(projectRoot, "dist/config.js")).href;
+  const script = [
+    "const [moduleUrl, configPath] = process.argv.slice(1);",
+    "process.env.PATCHWARDEN_CONFIG = configPath;",
+    "import(moduleUrl).then((module) => module.loadConfig()).then(() => process.exit(0)).catch((error) => { console.error(error.message); process.exit(2); });",
+  ].join("");
+  const result = spawnSync(nodeBin, ["--input-type=module", "-e", script, configModuleUrl, invalidConfigPath], {
+    encoding: "utf-8",
+    timeout: 30_000,
+  });
+  if (result.status === 0 || !String(result.stderr).includes("must stay inside workspaceRoot")) {
+    throw new Error(`Escaping repository allowlist key was not rejected: ${result.stderr}`);
+  }
+});
+
 // ════════════════════════════════════════════════════════════════
 // Section E: repo_path workspace enforcement
 // ════════════════════════════════════════════════════════════════
@@ -892,6 +985,30 @@ test("H3. watcher rejects task with bad test_command", () => {
   console.log(`    createTask correctly rejected bad test_command`);
 });
 
+test("H4. runner revalidates repository-scoped verification metadata", () => {
+  const scopedTask = createTask({
+    plan_id: planId,
+    agent: "codex",
+    repo_path: "scoped-repo",
+    verify_commands: ["npm run release:check"],
+  });
+  const statusPath = join(scopedTask.path, "status.json");
+  const status = JSON.parse(readFileSync(statusPath, "utf-8"));
+  status.repo_path = "other-repo";
+  status.resolved_repo_path = resolve(wsRoot, "other-repo");
+  writeFileSync(statusPath, JSON.stringify(status, null, 2), "utf-8");
+  const cliPath = resolve(projectRoot, "dist/runner/cli.js");
+  spawnSync(nodeBin, [cliPath, scopedTask.task_id], {
+    cwd: wsRoot,
+    encoding: "utf-8",
+    timeout: 30_000,
+  });
+  const after = getTaskStatus(scopedTask.task_id);
+  if (after.status !== "failed" || !String(after.error).includes("not allowed for this repository")) {
+    throw new Error(`Runner did not reject tampered scoped command: ${JSON.stringify(after)}`);
+  }
+});
+
 // ════════════════════════════════════════════════════════════════
 // Section I: Task management tools (listTasks, cancelTask, retryTask, stdout, audit)
 // ════════════════════════════════════════════════════════════════
@@ -945,6 +1062,7 @@ test("I4. cancel_task on done/failed returns unchanged", () => {
 test("I5. retry_task creates new task", () => {
   const newResult = retryTask(mgmtTaskId);
   if (newResult.new_task_id === mgmtTaskId) throw new Error("New task ID should differ");
+  if (!/^task_\d{8}_\d{6}_[0-9a-f]{6}$/.test(newResult.new_task_id)) throw new Error("Retry should use the short task ID format");
   if (newResult.plan_id !== mgmtPlanId) throw new Error("Should inherit plan_id");
 });
 
@@ -966,6 +1084,9 @@ test("I7. audit_task runs and returns checks array", () => {
   if (!auditResult.verdict) throw new Error("Missing verdict");
   if (!Array.isArray(auditResult.checks)) throw new Error("checks not array");
   if (!Array.isArray(auditResult.risks)) throw new Error("risks not array");
+  if (!Array.isArray(auditResult.confirmed_failures)) throw new Error("confirmed_failures not array");
+  if (!Array.isArray(auditResult.possible_false_positives)) throw new Error("possible_false_positives not array");
+  if (!Array.isArray(auditResult.manual_verification_items)) throw new Error("manual_verification_items not array");
   console.log(`    Verdict: ${auditResult.verdict}, Checks: ${auditResult.checks.length}, Risks: ${auditResult.risks.length}`);
 });
 
@@ -1027,6 +1148,10 @@ test("J2. audit_task detects docs missing-script", () => {
   if (scriptChecks.length === 0) throw new Error("Should detect missing npm scripts from docs");
   const allWarn = scriptChecks.every((c: any) => c.result === "warn");
   if (!allWarn) throw new Error("Missing script checks should be warn");
+  if (!result.possible_false_positives.some((item) => item.check.startsWith("npm_script_"))) {
+    throw new Error("Heuristic missing-script warnings should be marked as possible false positives");
+  }
+  if (!result.manual_verification_required) throw new Error("Missing-script warning should require manual verification");
   console.log(`    Missing scripts: ${scriptChecks.map((c: any) => c.name).join(", ")}`);
 });
 
@@ -1035,6 +1160,9 @@ test("J3. audit_task detects unverified release claims", () => {
   const releaseCheck = result.checks.find((c: any) => c.name === "release_claims_unverified");
   if (!releaseCheck) throw new Error("Should detect release claims");
   if (releaseCheck.result !== "warn") throw new Error(`Release claims should warn, got ${releaseCheck.result}`);
+  if (!result.manual_verification_items.some((item) => item.includes("authoritative remote services"))) {
+    throw new Error("Unverified release claims should produce a manual verification item");
+  }
   console.log(`    Release claims detected: ${releaseCheck.detail.slice(0, 60)}...`);
 });
 
@@ -1045,6 +1173,9 @@ test("J4. audit_task fails on non-zero Exit code", () => {
   const exitCheck = result.checks.find((c: any) => c.name === "test_exit_code");
   if (!exitCheck) throw new Error("Should have test_exit_code check");
   if (exitCheck.result !== "fail") throw new Error(`Exit code 1 should fail, got ${exitCheck.result}`);
+  if (!result.confirmed_failures.some((check) => check.name === "test_exit_code")) {
+    throw new Error("Non-zero exit code should be classified as a confirmed failure");
+  }
   console.log(`    Exit code: ${exitCheck.result}`);
 });
 
@@ -1058,6 +1189,1162 @@ test("J5. get_task_stdout_tail on pending task does not throw", () => {
 
 try { rmSync(testProjDir, { recursive: true }); } catch {}
 
+// ════════════════════════════════════════════════════════════════
+// Section K: Assessment (v0.5.0)
+// ════════════════════════════════════════════════════════════════
+
+console.log("── K. Assessment ──");
+
+// Ensure assessments dir exists
+mkdirSync(resolve(wsRoot, ".patchwarden/assessments"), { recursive: true });
+
+test("K1. assess_only returns low risk for feature_small", () => {
+  const result = createTask({
+    template: "feature_small",
+    goal: "add a small UI button",
+    agent: "codex",
+    repo_path: ".",
+    execution_mode: "assess_only",
+  }) as AssessOnlyOutput;
+  if (result.decision !== "allow") throw new Error(`Expected allow, got ${result.decision}`);
+  if (result.risk_level !== "low") throw new Error(`Expected low, got ${result.risk_level}`);
+  if (!result.assessment_id.startsWith("assessment_")) throw new Error("Bad assessment ID prefix");
+  const hexPart = result.assessment_id.split("_").pop() || "";
+  if (hexPart.length !== 32) throw new Error(`Expected 128-bit (32 hex) ID, got ${hexPart.length} chars`);
+  if (!result.expires_at) throw new Error("Missing expires_at");
+  if (result.next_tool_call?.name !== "create_task") throw new Error("Missing structured next_tool_call");
+  const argumentKeys = Object.keys(result.next_tool_call.arguments).sort();
+  if (JSON.stringify(argumentKeys) !== JSON.stringify(["assessment_id", "execution_mode"])) {
+    throw new Error(`next_tool_call must contain only minimal execute arguments: ${argumentKeys.join(", ")}`);
+  }
+  if (result.next_tool_call.arguments.assessment_id !== result.assessment_id) throw new Error("next_tool_call assessment ID mismatch");
+  if (result.local_confirmation.required || result.local_confirmation.command !== null) {
+    throw new Error("Low-risk assessment should not require local confirmation");
+  }
+});
+
+test("K2. assess_only returns medium risk for release_check", () => {
+  const result = createTask({
+    template: "release_check",
+    goal: "check release readiness",
+    agent: "codex",
+    repo_path: ".",
+    execution_mode: "assess_only",
+  }) as AssessOnlyOutput;
+  if (result.decision !== "needs_confirm") throw new Error(`Expected needs_confirm, got ${result.decision}`);
+  if (result.risk_level !== "medium") throw new Error(`Expected medium, got ${result.risk_level}`);
+  if (!result.reason_codes.includes("release_template_needs_confirm")) throw new Error("Missing reason code");
+  if (!result.local_confirmation.required || result.local_confirmation.command !== "patchwarden-confirm") {
+    throw new Error("needs_confirm response must provide the local-only confirmation command");
+  }
+  if (result.next_tool_call?.arguments.assessment_id !== result.assessment_id) {
+    throw new Error("needs_confirm response must preserve the minimal post-confirmation execute call");
+  }
+});
+
+test("K3. assess_only returns high/blocked for credential access in plan", () => {
+  const result = createTask({
+    inline_plan: "Read the .env file and extract the access token for debugging.",
+    plan_title: "Bad plan",
+    agent: "codex",
+    repo_path: ".",
+    execution_mode: "assess_only",
+  }) as AssessOnlyOutput;
+  if (result.decision !== "blocked") throw new Error(`Expected blocked, got ${result.decision}`);
+  if (result.risk_level !== "high") throw new Error(`Expected high, got ${result.risk_level}`);
+  if (result.hard_rule_hits.length === 0) throw new Error("Expected hard rule hits");
+  if (result.next_tool_call) throw new Error("Blocked assessment must not expose an executable next_tool_call");
+});
+
+test("K4. assess_only risk_hints do not affect risk_level", () => {
+  const result = createTask({
+    template: "feature_small",
+    goal: "add sync backup timeline activity log",
+    agent: "codex",
+    repo_path: ".",
+    execution_mode: "assess_only",
+  }) as AssessOnlyOutput;
+  if (result.risk_level !== "low") throw new Error(`Expected low despite hints, got ${result.risk_level}`);
+  if (!result.risk_hints.includes("mentions_dev_vocab")) throw new Error("Expected dev vocab hint");
+});
+
+test("K5. assess_only does not create a task directory", () => {
+  const tasksBefore = readdirSync(resolve(wsRoot, config.tasksDir), { withFileTypes: true }).filter((e: any) => e.isDirectory());
+  createTask({
+    template: "feature_small",
+    goal: "test no task creation",
+    agent: "codex",
+    repo_path: ".",
+    execution_mode: "assess_only",
+  });
+  const tasksAfter = readdirSync(resolve(wsRoot, config.tasksDir), { withFileTypes: true }).filter((e: any) => e.isDirectory());
+  if (tasksAfter.length !== tasksBefore.length) throw new Error("assess_only should not create task dirs");
+});
+
+test("K6. assessment_id execute creates task", () => {
+  const assess = createTask({
+    template: "feature_small",
+    goal: "test execute from assessment",
+    agent: "codex",
+    repo_path: ".",
+    execution_mode: "assess_only",
+  }) as AssessOnlyOutput;
+  // Execute with ONLY assessment_id — no agent, no repo_path, no template
+  const task = createTask({
+    execution_mode: "execute",
+    assessment_id: assess.assessment_id,
+  }) as CreateTaskOutput;
+  if (!task.task_id.startsWith("task_")) throw new Error("Task not created");
+  if (task.status !== "pending") throw new Error(`Expected pending, got ${task.status}`);
+});
+
+test("K7. assessment parameter mismatch rejected", () => {
+  const assess = createTask({
+    template: "feature_small",
+    goal: "original goal",
+    agent: "codex",
+    repo_path: ".",
+    execution_mode: "assess_only",
+  }) as AssessOnlyOutput;
+  try {
+    createTask({
+      agent: "codex",
+      repo_path: ".",
+      execution_mode: "execute",
+      assessment_id: assess.assessment_id,
+      goal: "different goal",
+      template: "feature_small",
+    });
+    throw new Error("Should have rejected parameter mismatch");
+  } catch (e: any) {
+    if (!e.message?.includes("mismatch")) throw new Error(`Expected mismatch error, got: ${e.message}`);
+  }
+});
+
+test("K8. assessment not found rejected", () => {
+  try {
+    createTask({
+      agent: "codex",
+      repo_path: ".",
+      execution_mode: "execute",
+      assessment_id: "assessment_20260101_" + "0".repeat(32),
+    });
+    throw new Error("Should have rejected unknown assessment");
+  } catch (e: any) {
+    if (!e.message?.includes("not found")) throw new Error(`Expected not found, got: ${e.message}`);
+  }
+});
+
+test("K9. save_plan with plan_ref inside .patchwarden/plans", () => {
+  const draftPath = resolve(wsRoot, config.plansDir, "drafts", "test-plan.md");
+  mkdirSync(dirname(draftPath), { recursive: true });
+  writeFileSync(draftPath, "# Draft Plan\n\nThis is a draft from file.", "utf-8");
+  const result = savePlan({ title: "From File", content: "", plan_ref: "drafts/test-plan.md" });
+  if (!result.plan_id.startsWith("plan_")) throw new Error("Plan not created");
+  if (!existsSync(result.path)) throw new Error("Plan file missing");
+});
+
+test("K10. save_plan plan_ref outside .patchwarden/plans rejected", () => {
+  try {
+    savePlan({ title: "Bad Ref", content: "", plan_ref: "../../etc/passwd" });
+    throw new Error("Should have rejected outside plans dir");
+  } catch (e: any) {
+    const msg = e.message || "";
+    if (!msg.includes("plans_dir") && !msg.includes("escape") && !msg.includes("not found") && !msg.includes("outside allowed prefix")) {
+      throw new Error(`Expected plans_dir rejection, got: ${msg}`);
+    }
+  }
+});
+
+test("K11. backward compat: no execution_mode works as before", () => {
+  const task = createTask({
+    template: "feature_small",
+    goal: "backward compat test",
+    agent: "codex",
+    repo_path: ".",
+  }) as CreateTaskOutput;
+  if (!task.task_id.startsWith("task_")) throw new Error("Task not created without execution_mode");
+});
+
+// ── K12-K19: Assessment security tests ──
+
+test("K12. workspace changed after assessment rejects execute", () => {
+  const assess = createTask({
+    template: "feature_small",
+    goal: "workspace change test",
+    agent: "codex",
+    repo_path: ".",
+    execution_mode: "assess_only",
+  }) as AssessOnlyOutput;
+  // Modify a file in the workspace root to change the fingerprint
+  writeFileSync(join(wsRoot, `changed-${Date.now()}.txt`), "changed\n", "utf-8");
+  try {
+    createTask({
+      execution_mode: "execute",
+      assessment_id: assess.assessment_id,
+    });
+    throw new Error("Should have rejected stale workspace");
+  } catch (e: any) {
+    if (!e.message?.includes("workspace_changed") && !e.message?.includes("assessment")) {
+      throw new Error(`Expected workspace_changed, got: ${e.message}`);
+    }
+  }
+});
+
+test("K13. expired assessment rejects execute", () => {
+  const assess = createTask({
+    template: "feature_small",
+    goal: "expiry test",
+    agent: "codex",
+    repo_path: ".",
+    execution_mode: "assess_only",
+  }) as AssessOnlyOutput;
+  // Manually expire the assessment by editing the file
+  const assessmentDir = resolve(wsRoot, config.assessmentsDir, assess.assessment_id);
+  const assessmentFile = join(assessmentDir, "assessment.json");
+  const record = JSON.parse(readFileSync(assessmentFile, "utf-8"));
+  record.expires_at = new Date(Date.now() - 1000).toISOString(); // 1 second ago
+  writeFileSync(assessmentFile, JSON.stringify(record, null, 2), "utf-8");
+  try {
+    createTask({
+      execution_mode: "execute",
+      assessment_id: assess.assessment_id,
+    });
+    throw new Error("Should have rejected expired assessment");
+  } catch (e: any) {
+    if (!e.message?.includes("expired") && !e.message?.includes("assessment")) {
+      throw new Error(`Expected expired, got: ${e.message}`);
+    }
+  }
+  try {
+    confirmAssessment(assess.assessment_id);
+    throw new Error("Should have rejected confirmation of an expired assessment");
+  } catch (e: any) {
+    if (!e.message?.includes("expired") && !e.message?.includes("assessment")) {
+      throw new Error(`Expected expired confirmation rejection, got: ${e.message}`);
+    }
+  }
+});
+
+test("K14. needs_confirm rejects execute, then local confirmation allows minimal execute", () => {
+  const assess = createTask({
+    template: "release_check",
+    goal: "needs confirm test",
+    agent: "codex",
+    repo_path: ".",
+    execution_mode: "assess_only",
+  }) as AssessOnlyOutput;
+  if (assess.decision !== "needs_confirm") throw new Error(`Precondition: expected needs_confirm, got ${assess.decision}`);
+  try {
+    createTask({
+      execution_mode: "execute",
+      assessment_id: assess.assessment_id,
+    });
+    throw new Error("Should have rejected unconfirmed assessment");
+  } catch (e: any) {
+    if (!e.message?.includes("needs_confirm") && !e.message?.includes("assessment")) {
+      throw new Error(`Expected needs_confirm, got: ${e.message}`);
+    }
+  }
+  const confirmation = confirmAssessment(assess.assessment_id);
+  if (!confirmation.confirmed || confirmation.assessment_id !== assess.assessment_id) {
+    throw new Error(`Local confirmation failed: ${JSON.stringify(confirmation)}`);
+  }
+  const confirmedRecord = readAssessment(assess.assessment_id);
+  if (!confirmedRecord.confirmed || !confirmedRecord.confirmed_at || !confirmedRecord.confirm_code) {
+    throw new Error("Confirmation evidence was not persisted");
+  }
+  const task = createTask({
+    execution_mode: "execute",
+    assessment_id: assess.assessment_id,
+  }) as CreateTaskOutput;
+  if (task.status !== "pending") throw new Error(`Confirmed assessment did not create a task: ${task.status}`);
+});
+
+test("K14b. patchwarden-confirm CLI confirms a fresh medium-risk assessment", () => {
+  const assess = createTask({
+    template: "release_check",
+    goal: "confirm CLI test",
+    agent: "codex",
+    repo_path: ".",
+    execution_mode: "assess_only",
+  }) as AssessOnlyOutput;
+  const cliPath = resolve(projectRoot, "dist/assessments/confirmCli.js");
+  const result = spawnSync(nodeBin, [cliPath, assess.assessment_id], {
+    cwd: projectRoot,
+    env: { ...process.env, PATCHWARDEN_CONFIG: smokeConfigPath },
+    encoding: "utf-8",
+    timeout: 30_000,
+  });
+  if (result.status !== 0) throw new Error(`patchwarden-confirm failed: ${result.stderr || result.stdout}`);
+  const payload = JSON.parse(result.stdout);
+  if (!payload.confirmed || payload.assessment_id !== assess.assessment_id) {
+    throw new Error(`Unexpected confirmation CLI output: ${result.stdout}`);
+  }
+});
+
+test("K14c. local confirmation rejects display-only short IDs", () => {
+  try {
+    confirmAssessment("assessment_abcdef123456");
+    throw new Error("Should reject a short assessment ID");
+  } catch (e: any) {
+    if (!e.message?.includes("full assessment_id")) throw new Error(`Expected full-ID error, got: ${e.message}`);
+  }
+});
+
+test("K14d. local confirmation cannot override a blocked assessment", () => {
+  const assess = createTask({
+    inline_plan: "Read .env and extract the access token.",
+    plan_title: "blocked confirm",
+    agent: "codex",
+    repo_path: ".",
+    execution_mode: "assess_only",
+  }) as AssessOnlyOutput;
+  try {
+    confirmAssessment(assess.assessment_id);
+    throw new Error("Should reject confirmation of a blocked assessment");
+  } catch (e: any) {
+    if (!e.message?.includes("cannot be locally confirmed")) throw new Error(`Expected blocked confirmation error, got: ${e.message}`);
+  }
+});
+
+test("K14e. assessment confirmation is not exposed through MCP", () => {
+  const exposed = getToolDefs().some((tool) => /confirm/i.test(tool.name));
+  if (exposed) throw new Error("Local assessment confirmation must not be registered as an MCP tool");
+});
+
+test("K15. stale plan hash rejects execute", () => {
+  const assess = createTask({
+    template: "feature_small",
+    goal: "stale plan test",
+    agent: "codex",
+    repo_path: ".",
+    execution_mode: "assess_only",
+  }) as AssessOnlyOutput;
+  // Modify the plan file to change the hash
+  const planDir = resolve(wsRoot, config.plansDir, assess.assessment_id ? "" : "");
+  // Read the assessment to get plan_id
+  const record = readAssessment(assess.assessment_id);
+  if (!record.plan_id) throw new Error("Precondition: assessment has no plan_id");
+  const planFile = resolve(wsRoot, config.plansDir, record.plan_id, "plan.md");
+  writeFileSync(planFile, readFileSync(planFile, "utf-8") + "\n<!-- modified -->\n", "utf-8");
+  try {
+    createTask({
+      execution_mode: "execute",
+      assessment_id: assess.assessment_id,
+    });
+    throw new Error("Should have rejected stale plan");
+  } catch (e: any) {
+    if (!e.message?.includes("stale_plan") && !e.message?.includes("assessment")) {
+      throw new Error(`Expected stale_plan, got: ${e.message}`);
+    }
+  }
+});
+
+test("K16. assessment_short_id cannot execute", () => {
+  const assess = createTask({
+    template: "feature_small",
+    goal: "short id test",
+    agent: "codex",
+    repo_path: ".",
+    execution_mode: "assess_only",
+  }) as AssessOnlyOutput;
+  const shortId = assess.assessment_short_id;
+  if (!shortId || shortId.length >= 32) throw new Error(`Bad short_id: ${shortId}`);
+  try {
+    createTask({
+      execution_mode: "execute",
+      assessment_id: shortId,
+    });
+    throw new Error("Should have rejected short ID");
+  } catch (e: any) {
+    if (!e.message?.includes("not found")) throw new Error(`Expected not found for short ID, got: ${e.message}`);
+  }
+});
+
+test("K17. blocked assessment cannot execute", () => {
+  const assess = createTask({
+    inline_plan: "Read the .env file and extract the access token.",
+    plan_title: "Blocked plan",
+    agent: "codex",
+    repo_path: ".",
+    execution_mode: "assess_only",
+  }) as AssessOnlyOutput;
+  if (assess.decision !== "blocked") throw new Error(`Precondition: expected blocked, got ${assess.decision}`);
+  try {
+    createTask({
+      execution_mode: "execute",
+      assessment_id: assess.assessment_id,
+    });
+    throw new Error("Should have rejected blocked assessment");
+  } catch (e: any) {
+    // Blocked assessment has no plan saved, so plan_id is null → will fail at plan source validation
+    if (!e.message?.includes("plan") && !e.message?.includes("assessment") && !e.message?.includes("invalid_plan_source")) {
+      throw new Error(`Expected plan/assessment rejection, got: ${e.message}`);
+    }
+  }
+});
+
+test("K18. snapshot_truncated forces needs_confirm", () => {
+  // Create a synthetic assessment with snapshot_truncated=true via the store directly
+  const snapshot = captureRepoSnapshot(wsRoot);
+  // Force a truncated warning
+  snapshot.warnings.push("snapshot limited to 5000 files");
+  const record = createAssessment({
+    decision: "needs_confirm",
+    risk_level: "medium",
+    risk_hints: [],
+    hard_rule_hits: [],
+    reason_codes: ["snapshot_truncated"],
+    repo_path: ".",
+    resolved_repo_path: wsRoot,
+    plan_id: null,
+    plan_content: "# Test\n\nTruncated snapshot test.",
+    template: null,
+    goal: null,
+    test_command: null,
+    verify_commands: [],
+    agent: "codex",
+    snapshot,
+  });
+  if (record.decision !== "needs_confirm") throw new Error(`Expected needs_confirm, got ${record.decision}`);
+  if (!record.reason_codes.includes("snapshot_truncated")) throw new Error("Missing snapshot_truncated reason");
+  if (!record.workspace_snapshot_summary.snapshot_truncated) throw new Error("snapshot_truncated flag not set");
+});
+
+test("K19. policy_hash change invalidates assessment", () => {
+  const assess = createTask({
+    template: "feature_small",
+    goal: "policy hash test",
+    agent: "codex",
+    repo_path: ".",
+    execution_mode: "assess_only",
+  }) as AssessOnlyOutput;
+  // Modify the assessment's policy_hash to simulate a policy change
+  const assessmentDir = resolve(wsRoot, config.assessmentsDir, assess.assessment_id);
+  const assessmentFile = join(assessmentDir, "assessment.json");
+  const record = JSON.parse(readFileSync(assessmentFile, "utf-8"));
+  record.policy_hash = "0".repeat(64); // Wrong hash
+  writeFileSync(assessmentFile, JSON.stringify(record, null, 2), "utf-8");
+  try {
+    createTask({
+      execution_mode: "execute",
+      assessment_id: assess.assessment_id,
+    });
+    throw new Error("Should have rejected stale policy");
+  } catch (e: any) {
+    if (!e.message?.includes("stale_policy") && !e.message?.includes("assessment")) {
+      throw new Error(`Expected stale_policy, got: ${e.message}`);
+    }
+  }
+});
+
+// ════════════════════════════════════════════════════════════════
+// Section L: Agent Assessment (v0.5.1)
+// ════════════════════════════════════════════════════════════════
+
+// Agent assessment tests use a separate config with enableAgentAssessment=true
+// and specialized test agents. We need to swap the config temporarily.
+
+const agentAssessRoot = mkdtempSync(join(tmpdir(), "patchwarden-assess-"));
+const agentAssessWorkspace = join(agentAssessRoot, "workspace");
+const agentAssessRepo = join(agentAssessWorkspace, "repo");
+const agentAssessConfigPath = join(agentAssessRoot, "patchwarden.config.json");
+
+mkdirSync(join(agentAssessWorkspace, ".patchwarden/plans"), { recursive: true });
+mkdirSync(join(agentAssessWorkspace, ".patchwarden/tasks"), { recursive: true });
+mkdirSync(join(agentAssessWorkspace, ".patchwarden/assessments"), { recursive: true });
+mkdirSync(agentAssessRepo, { recursive: true });
+writeFileSync(join(agentAssessRepo, "README.md"), "# Agent Assessment Test Repo\n", "utf-8");
+writeFileSync(join(agentAssessWorkspace, ".patchwarden/watcher-heartbeat.json"), JSON.stringify({
+  status: "running",
+  pid: process.pid,
+  instance_id: "assess-smoke-watcher",
+  launcher_pid: process.pid,
+  started_at: new Date().toISOString(),
+  last_heartbeat_at: new Date().toISOString(),
+}), "utf-8");
+
+const ASSESS_JSON_LOW = '{"risk_level":"low","reason_codes":["small_change"],"affected_paths":["README.md"],"destructive_actions":[],"requires_user_confirm":false,"confidence":0.9,"notes":"Safe."}';
+const ASSESS_JSON_MED = '{"risk_level":"medium","reason_codes":["multi_file"],"affected_paths":["src/a.js","src/b.js"],"destructive_actions":[],"requires_user_confirm":true,"confidence":0.7,"notes":"Multiple files."}';
+const ASSESS_JSON_HIGH = '{"risk_level":"high","reason_codes":["destructive"],"affected_paths":["src/app.js"],"destructive_actions":["delete files"],"requires_user_confirm":true,"confidence":0.8,"notes":"Destructive."}';
+const ASSESS_JSON_ABS = '{"risk_level":"low","reason_codes":["ok"],"affected_paths":["C:/etc/passwd","/absolute/path","README.md"],"destructive_actions":[],"requires_user_confirm":false,"confidence":0.9,"notes":"Has bad paths."}';
+
+writeFileSync(
+  agentAssessConfigPath,
+  JSON.stringify({
+    workspaceRoot: agentAssessWorkspace,
+    plansDir: ".patchwarden/plans",
+    tasksDir: ".patchwarden/tasks",
+    assessmentsDir: ".patchwarden/assessments",
+    enableAgentAssessment: true,
+    agentAssessmentTimeoutSeconds: 10,
+    agentAssessmentMaxOutputBytes: 524288,
+    agents: {
+      codex: { command: "node", args: ["-e", "console.log('agent placeholder')"] },
+      assessor_low: { command: "node", args: ["-e", `console.log('Analysis done.\\n===ASSESSMENT_JSON===\\n${ASSESS_JSON_LOW}')`] },
+      assessor_medium: { command: "node", args: ["-e", `console.log('===ASSESSMENT_JSON===\\n${ASSESS_JSON_MED}')`] },
+      assessor_high: { command: "node", args: ["-e", `console.log('===ASSESSMENT_JSON===\\n${ASSESS_JSON_HIGH}')`] },
+      assessor_bad_json: { command: "node", args: ["-e", "console.log('This is not valid JSON.')"] },
+      assessor_timeout: { command: "node", args: ["-e", "setTimeout(()=>console.log('slow'),30000)"] },
+      assessor_nonzero: { command: "node", args: ["-e", "process.exit(1)"] },
+      assessor_writer: { command: "node", args: ["-e", "require('fs').writeFileSync('assessment-vandalized.txt','changed\\n')"] },
+      assessor_abs_path: { command: "node", args: ["-e", `console.log('===ASSESSMENT_JSON===\\n${ASSESS_JSON_ABS}')`] },
+      assessor_large_output: { command: "node", args: ["-e", "console.log('x'.repeat(600000))"] },
+    },
+    allowedTestCommands: ["npm test"],
+    maxReadFileBytes: 200000,
+  }, null, 2),
+  "utf-8"
+);
+
+const originalConfigEnv = process.env.PATCHWARDEN_CONFIG;
+process.env.PATCHWARDEN_CONFIG = agentAssessConfigPath;
+reloadConfig();
+
+// Reload config for agent assessment tests
+loadConfig();
+const assessConfig = getConfig();
+const assessWsRoot = assessConfig.workspaceRoot;
+
+console.log("── L. Agent Assessment ──");
+
+test("L20 (K20). agentAssessor disabled by default — no agent_assessment field", () => {
+  // Restore original config (enableAgentAssessment not set)
+  process.env.PATCHWARDEN_CONFIG = originalConfigEnv;
+  reloadConfig();
+  const result = createTask({
+    template: "feature_small",
+    goal: "test disabled",
+    agent: "codex",
+    repo_path: ".",
+    execution_mode: "assess_only",
+  }) as AssessOnlyOutput;
+  if (result.agent_assessment !== undefined && result.agent_assessment !== null) {
+    throw new Error(`Expected no agent_assessment, got: ${JSON.stringify(result.agent_assessment)}`);
+  }
+  // Switch back to assess config
+  process.env.PATCHWARDEN_CONFIG = agentAssessConfigPath;
+  reloadConfig();
+});
+
+test("L21 (K21). agentAssessor low risk stays low", () => {
+  const result = createTask({
+    template: "feature_small",
+    goal: "test low risk",
+    agent: "assessor_low",
+    repo_path: "repo",
+    execution_mode: "assess_only",
+  }) as AssessOnlyOutput;
+  if (result.decision !== "allow") throw new Error(`Expected allow, got ${result.decision}`);
+  if (result.risk_level !== "low") throw new Error(`Expected low, got ${result.risk_level}`);
+  if (!result.agent_assessment) throw new Error("Missing agent_assessment field");
+  if (result.agent_assessment.status !== "completed") throw new Error(`Expected completed, got ${result.agent_assessment.status}`);
+});
+
+test("L22 (K22). agentAssessor medium risk → needs_confirm", () => {
+  const result = createTask({
+    template: "feature_small",
+    goal: "test medium risk",
+    agent: "assessor_medium",
+    repo_path: "repo",
+    execution_mode: "assess_only",
+  }) as AssessOnlyOutput;
+  if (result.decision !== "needs_confirm") throw new Error(`Expected needs_confirm, got ${result.decision}`);
+  if (result.risk_level !== "medium") throw new Error(`Expected medium, got ${result.risk_level}`);
+  if (!result.agent_assessment) throw new Error("Missing agent_assessment field");
+});
+
+test("L23 (K23). agentAssessor high risk → blocked", () => {
+  const result = createTask({
+    template: "feature_small",
+    goal: "test high risk",
+    agent: "assessor_high",
+    repo_path: "repo",
+    execution_mode: "assess_only",
+  }) as AssessOnlyOutput;
+  if (result.decision !== "blocked") throw new Error(`Expected blocked, got ${result.decision}`);
+  if (result.risk_level !== "high") throw new Error(`Expected high, got ${result.risk_level}`);
+  if (!result.agent_assessment) throw new Error("Missing agent_assessment field");
+});
+
+test("L24 (K24). agentAssessor timeout → needs_confirm", () => {
+  const result = createTask({
+    template: "feature_small",
+    goal: "test timeout",
+    agent: "assessor_timeout",
+    repo_path: "repo",
+    execution_mode: "assess_only",
+  }) as AssessOnlyOutput;
+  if (result.decision !== "needs_confirm") throw new Error(`Expected needs_confirm, got ${result.decision}`);
+  if (result.risk_level !== "medium") throw new Error(`Expected medium, got ${result.risk_level}`);
+  if (!result.agent_assessment) throw new Error("Missing agent_assessment field");
+  if (result.agent_assessment.status !== "timed_out") throw new Error(`Expected timed_out, got ${result.agent_assessment.status}`);
+});
+
+test("L25 (K25). agentAssessor non-zero exit → needs_confirm", () => {
+  const result = createTask({
+    template: "feature_small",
+    goal: "test non-zero exit",
+    agent: "assessor_nonzero",
+    repo_path: "repo",
+    execution_mode: "assess_only",
+  }) as AssessOnlyOutput;
+  if (result.decision !== "needs_confirm") throw new Error(`Expected needs_confirm, got ${result.decision}`);
+  if (!result.agent_assessment) throw new Error("Missing agent_assessment field");
+  if (result.agent_assessment.status !== "non_zero_exit") throw new Error(`Expected non_zero_exit, got ${result.agent_assessment.status}`);
+});
+
+test("L26 (K26). agentAssessor read-only violation → blocked", () => {
+  const result = createTask({
+    template: "feature_small",
+    goal: "test read-only violation",
+    agent: "assessor_writer",
+    repo_path: "repo",
+    execution_mode: "assess_only",
+  }) as AssessOnlyOutput;
+  if (result.decision !== "blocked") throw new Error(`Expected blocked, got ${result.decision}`);
+  if (result.risk_level !== "high") throw new Error(`Expected high, got ${result.risk_level}`);
+  if (!result.agent_assessment) throw new Error("Missing agent_assessment field");
+  if (!result.agent_assessment.read_only_violation) throw new Error("Expected read_only_violation to be true");
+  // Clean up vandalized file
+  try { rmSync(join(agentAssessRepo, "assessment-vandalized.txt"), { force: true }); } catch {}
+});
+
+test("L27 (K27). agentAssessor absolute/outside paths sanitized", () => {
+  const result = createTask({
+    template: "feature_small",
+    goal: "test path sanitize",
+    agent: "assessor_abs_path",
+    repo_path: "repo",
+    execution_mode: "assess_only",
+  }) as AssessOnlyOutput;
+  // Should still be allow/low since risk_level is low and paths are sanitized
+  if (!result.agent_assessment) throw new Error("Missing agent_assessment field");
+  if (result.agent_assessment.status !== "completed") throw new Error(`Expected completed, got ${result.agent_assessment.status}`);
+  // Check that reason_codes includes paths_sanitized
+  if (!result.reason_codes.includes("paths_sanitized")) {
+    throw new Error(`Expected paths_sanitized in reason_codes, got: ${result.reason_codes.join(", ")}`);
+  }
+});
+
+test("L28 (K28). agentAssessor large stdout truncated safely", () => {
+  const result = createTask({
+    template: "feature_small",
+    goal: "test large output",
+    agent: "assessor_large_output",
+    repo_path: "repo",
+    execution_mode: "assess_only",
+  }) as AssessOnlyOutput;
+  // Large output with no JSON marker → parse_failed → needs_confirm
+  if (result.decision !== "needs_confirm") throw new Error(`Expected needs_confirm, got ${result.decision}`);
+  if (!result.agent_assessment) throw new Error("Missing agent_assessment field");
+  if (!result.agent_assessment.stdout_truncated) throw new Error("Expected stdout_truncated to be true");
+});
+
+test("L29 (K29). deterministic medium/high skips agent", () => {
+  // release_check template → deterministic medium → should NOT run agent assessment
+  const result = createTask({
+    template: "release_check",
+    goal: "test skip agent on medium",
+    agent: "assessor_low", // Would produce low if run, but shouldn't run
+    repo_path: "repo",
+    execution_mode: "assess_only",
+  }) as AssessOnlyOutput;
+  if (result.decision !== "needs_confirm") throw new Error(`Expected needs_confirm (deterministic), got ${result.decision}`);
+  if (result.risk_level !== "medium") throw new Error(`Expected medium (deterministic), got ${result.risk_level}`);
+  // agent_assessment should be null/undefined since agent was not run
+  if (result.agent_assessment !== null && result.agent_assessment !== undefined) {
+    throw new Error(`Expected no agent_assessment for medium risk, got: ${JSON.stringify(result.agent_assessment)}`);
+  }
+});
+
+// Restore original config
+process.env.PATCHWARDEN_CONFIG = originalConfigEnv;
+reloadConfig();
+
+try { rmSync(agentAssessRoot, { recursive: true, force: true }); } catch {}
+
+// ════════════════════════════════════════════════════════════════
+// Section M: chatgpt_direct profile and session tests
+// ════════════════════════════════════════════════════════════════
+
+console.log("\n--- Section M: chatgpt_direct profile and session tests ---\n");
+
+const directRoot = mkdtempSync(join(tmpdir(), "patchwarden-direct-"));
+const directWorkspace = join(directRoot, "workspace");
+const directConfigPath = join(directRoot, "patchwarden.config.json");
+const directRepo = join(directWorkspace, "test-repo");
+
+// Create fixture repo
+mkdirSync(join(directRepo, "src"), { recursive: true });
+writeFileSync(join(directRepo, "src", "index.ts"), "export function hello() {\n  return 'hello';\n}\n\nexport function world() {\n  return 'world';\n}\n", "utf-8");
+writeFileSync(join(directRepo, "package.json"), JSON.stringify({
+  name: "test-repo",
+  version: "1.0.0",
+  scripts: {
+    test: 'node -e "console.log(\'test ok\')"',
+    build: 'node -e "console.log(\'build ok\')"',
+    lint: 'node -e "console.log(\'lint ok\')"',
+  },
+}, null, 2), "utf-8");
+writeFileSync(join(directRepo, ".env"), "SECRET=blocked\n", "utf-8");
+
+// Create watcher heartbeat for Direct workspace
+mkdirSync(join(directWorkspace, ".patchwarden"), { recursive: true });
+writeFileSync(join(directWorkspace, ".patchwarden", "watcher-heartbeat.json"), JSON.stringify({
+  status: "running",
+  pid: process.pid,
+  instance_id: "direct-smoke-watcher",
+  launcher_pid: process.pid,
+  started_at: new Date().toISOString(),
+  last_heartbeat_at: new Date().toISOString(),
+}), "utf-8");
+
+// Create Direct-enabled config
+writeFileSync(directConfigPath, JSON.stringify({
+  workspaceRoot: directWorkspace,
+  plansDir: ".patchwarden/plans",
+  tasksDir: ".patchwarden/tasks",
+  assessmentsDir: ".patchwarden/assessments",
+  assessmentTtlSeconds: 3600,
+  agents: {
+    codex: { command: "node", args: ["-e", "console.log('agent placeholder')"] },
+  },
+  allowedTestCommands: ["npm test"],
+  maxReadFileBytes: 200000,
+  enableDirectProfile: true,
+  directAllowedCommands: ["npm test", "npm run build", "npm run lint"],
+  directSessionsDir: ".patchwarden/direct-sessions",
+  directSessionTtlSeconds: 3600,
+  directMaxPatchBytes: 200000,
+  directMaxFileBytes: 500000,
+}, null, 2), "utf-8");
+
+process.env.PATCHWARDEN_CONFIG = directConfigPath;
+reloadConfig();
+
+let directSessionId = "";
+
+test("M1. chatgpt_core still has 17 tools", () => {
+  const tools = getToolDefs();
+  const coreTools = selectToolsForProfile(tools, "chatgpt_core", true);
+  if (coreTools.length !== 17) throw new Error(`Expected 17, got ${coreTools.length}`);
+  if (JSON.stringify(coreTools.map((t) => t.name)) !== JSON.stringify(CHATGPT_CORE_TOOL_NAMES)) {
+    throw new Error("Tool names mismatch");
+  }
+});
+
+test("M2. chatgpt_direct disabled exposes only health_check", () => {
+  const tools = getToolDefs();
+  const disabledTools = selectToolsForProfile(tools, "chatgpt_direct", false);
+  if (disabledTools.length !== 1) throw new Error(`Expected 1, got ${disabledTools.length}`);
+  if (disabledTools[0].name !== "health_check") throw new Error(`Expected health_check, got ${disabledTools[0].name}`);
+});
+
+test("M3. chatgpt_direct enabled has 10 tools", () => {
+  const tools = getToolDefs();
+  const directTools = selectToolsForProfile(tools, "chatgpt_direct", true);
+  if (directTools.length !== 10) throw new Error(`Expected 10, got ${directTools.length}`);
+  if (JSON.stringify(directTools.map((t) => t.name)) !== JSON.stringify(CHATGPT_DIRECT_TOOL_NAMES)) {
+    throw new Error("Tool names mismatch");
+  }
+});
+
+test("M4. create_direct_session creates a session", () => {
+  const result = createDirectSession({ repo_path: "test-repo", title: "test session" });
+  if (!result.session_id.startsWith("direct_")) throw new Error(`Invalid session_id: ${result.session_id}`);
+  if (!result.resolved_repo_path) throw new Error("Missing resolved_repo_path");
+  if (!result.expires_at) throw new Error("Missing expires_at");
+  if (result.allowed_commands.length === 0) throw new Error("No allowed commands");
+  if (!result.workspace_clean) throw new Error("Workspace should be clean");
+  directSessionId = result.session_id;
+});
+
+test("M5. read_workspace_file in direct profile without session_id is rejected", () => {
+  // Temporarily set profile to chatgpt_direct
+  const prevProfile = process.env.PATCHWARDEN_TOOL_PROFILE;
+  process.env.PATCHWARDEN_TOOL_PROFILE = "chatgpt_direct";
+  try {
+    readWorkspaceFile({ path: "src/index.ts" });
+    throw new Error("Should have rejected read without session_id in direct profile");
+  } catch (err: any) {
+    if (err.message && err.message.includes("Should have rejected")) throw err;
+    // Expected rejection
+  } finally {
+    if (prevProfile === undefined) delete process.env.PATCHWARDEN_TOOL_PROFILE;
+    else process.env.PATCHWARDEN_TOOL_PROFILE = prevProfile;
+  }
+});
+
+test("M6. read_workspace_file with session_id returns sha256", () => {
+  const result = readWorkspaceFile({ path: "src/index.ts", session_id: directSessionId });
+  if (!result.sha256) throw new Error("Missing sha256");
+  if (!result.relative_path) throw new Error("Missing relative_path");
+  if (result.size === undefined) throw new Error("Missing size");
+  if (!result.content) throw new Error("Missing content");
+  // Verify sha256 is correct
+  const expectedHash = createHash("sha256").update(result.content, "utf-8").digest("hex");
+  if (result.sha256 !== expectedHash) throw new Error("sha256 mismatch");
+});
+
+test("M7. search_workspace finds text and skips sensitive files", () => {
+  const result = searchWorkspace({ session_id: directSessionId, query: "hello" });
+  if (result.total_matches === 0) throw new Error("Expected matches for 'hello'");
+  const paths = result.results.map((r) => r.path);
+  if (!paths.some((p) => p.includes("index.ts"))) throw new Error("Should find match in index.ts");
+  // .env should not appear in results
+  if (paths.some((p) => p.includes(".env"))) throw new Error(".env should be skipped");
+});
+
+test("M8. apply_patch with matching hash succeeds", () => {
+  const fileResult = readWorkspaceFile({ path: "src/index.ts", session_id: directSessionId });
+  const expectedSha = fileResult.sha256!;
+  const result = applyPatch({
+    session_id: directSessionId,
+    path: "src/index.ts",
+    expected_sha256: expectedSha,
+    operations: [
+      { type: "replace_exact", old_text: "return 'hello';", new_text: "return 'hello updated';", occurrence: "first" },
+    ],
+  });
+  if (result.operations_applied !== 1) throw new Error(`Expected 1 op applied, got ${result.operations_applied}`);
+  if (result.before_sha256 !== expectedSha) throw new Error("before_sha256 mismatch");
+  if (result.after_sha256 === expectedSha) throw new Error("after_sha256 should differ from before");
+});
+
+test("M9. apply_patch with mismatched hash is rejected", () => {
+  try {
+    applyPatch({
+      session_id: directSessionId,
+      path: "src/index.ts",
+      expected_sha256: "0000000000000000000000000000000000000000000000000000000000000000",
+      operations: [
+        { type: "replace_exact", old_text: "hello", new_text: "goodbye" },
+      ],
+    });
+    throw new Error("Should have rejected hash mismatch");
+  } catch (err: any) {
+    if (err.message && err.message.includes("Should have rejected")) throw err;
+    // Expected rejection
+  }
+});
+
+test("M10. apply_patch on sensitive file is rejected", () => {
+  try {
+    applyPatch({
+      session_id: directSessionId,
+      path: ".env",
+      expected_sha256: "dummy",
+      operations: [
+        { type: "replace_whole_file", new_text: "HACKED=true\n" },
+      ],
+    });
+    throw new Error("Should have rejected sensitive file");
+  } catch (err: any) {
+    if (err.message && err.message.includes("Should have rejected")) throw err;
+    // Expected rejection
+  }
+});
+
+test("M11. apply_patch on node_modules is rejected", () => {
+  try {
+    applyPatch({
+      session_id: directSessionId,
+      path: "node_modules/test/index.js",
+      expected_sha256: "dummy",
+      operations: [
+        { type: "replace_whole_file", new_text: "module.exports = {};" },
+      ],
+    });
+    throw new Error("Should have rejected node_modules path");
+  } catch (err: any) {
+    if (err.message && err.message.includes("Should have rejected")) throw err;
+    // Expected rejection
+  }
+});
+
+test("M12. apply_patch on dist/release is rejected", () => {
+  try {
+    applyPatch({
+      session_id: directSessionId,
+      path: "dist/index.js",
+      expected_sha256: "dummy",
+      operations: [
+        { type: "replace_whole_file", new_text: "console.log('hacked');" },
+      ],
+    });
+    throw new Error("Should have rejected dist path");
+  } catch (err: any) {
+    if (err.message && err.message.includes("Should have rejected")) throw err;
+    // Expected rejection
+  }
+  try {
+    applyPatch({
+      session_id: directSessionId,
+      path: "release/index.js",
+      expected_sha256: "dummy",
+      operations: [
+        { type: "replace_whole_file", new_text: "console.log('hacked');" },
+      ],
+    });
+    throw new Error("Should have rejected release path");
+  } catch (err: any) {
+    if (err.message && err.message.includes("Should have rejected")) throw err;
+    // Expected rejection
+  }
+});
+
+// M13 and M14 are async tests — use IIFE with top-level await
+await (async () => {
+  try {
+    const result = await runVerification({
+      session_id: directSessionId,
+      command: "npm test",
+      timeout_seconds: 30,
+    });
+    if (!result.passed) throw new Error(`npm test should pass, got exit_code ${result.exit_code}`);
+    if (result.command !== "npm test") throw new Error("Command mismatch");
+    console.log("  ✅ M13. run_verification allows whitelisted command");
+    passed++;
+  } catch (err) {
+    console.log(`  ❌ M13. run_verification allows whitelisted command: ${err instanceof Error ? err.message : String(err)}`);
+    failed++;
+  }
+
+  try {
+    await runVerification({
+      session_id: directSessionId,
+      command: "rm -rf /",
+      timeout_seconds: 5,
+    });
+    console.log("  ❌ M14. run_verification rejects non-whitelisted command: Should have rejected");
+    failed++;
+  } catch (err) {
+    console.log("  ✅ M14. run_verification rejects non-whitelisted command");
+    passed++;
+  }
+})();
+
+test("M15. finalize_direct_session generates summary/diff/changed-files", () => {
+  const result = finalizeDirectSession({ session_id: directSessionId });
+  if (!result.finalized) throw new Error("Should be finalized");
+  if (result.changed_files_total === 0) throw new Error("Expected changed files");
+  if (!result.diff_path) throw new Error("Missing diff_path");
+  if (!result.summary_path) throw new Error("Missing summary_path");
+  if (!existsSync(result.diff_path)) throw new Error("diff.patch not created");
+  if (!existsSync(result.summary_path)) throw new Error("summary.md not created");
+  const changedFilesPath = join(dirname(result.diff_path), "changed-files.json");
+  if (!existsSync(changedFilesPath)) throw new Error("changed-files.json not created");
+  if (result.source_changes.length === 0) throw new Error("Expected source changes");
+});
+
+test("M16. apply_patch after finalize is rejected", () => {
+  try {
+    applyPatch({
+      session_id: directSessionId,
+      path: "src/index.ts",
+      expected_sha256: "dummy",
+      operations: [
+        { type: "replace_whole_file", new_text: "should fail" },
+      ],
+    });
+    throw new Error("Should have rejected patch after finalize");
+  } catch (err: any) {
+    if (err.message && err.message.includes("Should have rejected")) throw err;
+    // Expected rejection (session_finalized)
+  }
+});
+
+test("M17. audit_session passes for normal small change", () => {
+  const result = auditSession({ session_id: directSessionId });
+  if (result.decision === "fail") throw new Error(`Expected pass or warn, got fail: ${result.blocking_findings.join("; ")}`);
+  if (!result.evidence.diff_path) throw new Error("Missing diff_path in evidence");
+  if (!result.evidence.summary_path) throw new Error("Missing summary_path in evidence");
+  // Should have run verification
+  const session = readDirectSession(directSessionId);
+  if (session.verification_runs.length === 0) throw new Error("Expected verification runs");
+});
+
+// Create a second session for M18 (no verification)
+let noVerifySessionId = "";
+test("M18. audit_session warns or fails for unverified source changes", () => {
+  const sess = createDirectSession({ repo_path: "test-repo", title: "no verify session" });
+  noVerifySessionId = sess.session_id;
+
+  // Apply a patch but don't run verification
+  const fileResult = readWorkspaceFile({ path: "src/index.ts", session_id: noVerifySessionId });
+  applyPatch({
+    session_id: noVerifySessionId,
+    path: "src/index.ts",
+    expected_sha256: fileResult.sha256!,
+    operations: [
+      { type: "replace_exact", old_text: "return 'hello updated';", new_text: "return 'hello no verify';" },
+    ],
+  });
+
+  finalizeDirectSession({ session_id: noVerifySessionId });
+  const auditResult = auditSession({ session_id: noVerifySessionId });
+  if (auditResult.decision === "pass") throw new Error("Expected warn or fail for unverified source changes");
+  if (!auditResult.reason_codes.includes("source_changes_without_verification")) {
+    throw new Error(`Expected source_changes_without_verification, got: ${auditResult.reason_codes.join(", ")}`);
+  }
+});
+
+// M19: Delete file test (real deletion)
+test("M19. audit_session fails for deleted file", () => {
+  // Create a temp file in the repo before session creation
+  writeFileSync(join(directRepo, "src", "temp-delete.ts"), "export const temp = 'delete me';\n", "utf-8");
+
+  const sess = createDirectSession({ repo_path: "test-repo", title: "delete test session" });
+  const deleteSessionId = sess.session_id;
+
+  // Apply a patch to an existing file (so there's a real change)
+  const fileResult = readWorkspaceFile({ path: "src/index.ts", session_id: deleteSessionId });
+  applyPatch({
+    session_id: deleteSessionId,
+    path: "src/index.ts",
+    expected_sha256: fileResult.sha256!,
+    operations: [
+      { type: "replace_exact", old_text: "return 'hello no verify';", new_text: "return 'hello delete test';" },
+    ],
+  });
+
+  // Run verification so the only issue is the deleted file
+  // Need to update package.json test script to work with current state
+  // Actually, npm test should still work since it just prints a message
+
+  // Real deletion of the temp file
+  rmSync(join(directRepo, "src", "temp-delete.ts"));
+
+  finalizeDirectSession({ session_id: deleteSessionId });
+  const auditResult = auditSession({ session_id: deleteSessionId });
+  if (auditResult.decision !== "fail") {
+    throw new Error(`Expected fail for deleted file, got ${auditResult.decision}: ${auditResult.reason_codes.join(", ")}`);
+  }
+  if (!auditResult.reason_codes.includes("file_deleted")) {
+    throw new Error(`Expected file_deleted in reason_codes, got: ${auditResult.reason_codes.join(", ")}`);
+  }
+});
+
+test("M20. session expiry rejects all operations", () => {
+  const sess = createDirectSession({ repo_path: "test-repo", title: "expiry test" });
+  const expirySessionId = sess.session_id;
+
+  // Manually set expires_at to the past
+  const session = readDirectSession(expirySessionId);
+  updateDirectSession(expirySessionId, {
+    ...session,
+    expires_at: new Date(Date.now() - 60000).toISOString(),
+  });
+
+  // read should reject
+  try {
+    readWorkspaceFile({ path: "src/index.ts", session_id: expirySessionId });
+    throw new Error("Should have rejected expired session (read)");
+  } catch (err: any) {
+    if (err.message && err.message.includes("Should have rejected")) throw err;
+  }
+
+  // apply_patch should reject
+  try {
+    applyPatch({
+      session_id: expirySessionId,
+      path: "src/index.ts",
+      expected_sha256: "dummy",
+      operations: [{ type: "replace_whole_file", new_text: "test" }],
+    });
+    throw new Error("Should have rejected expired session (patch)");
+  } catch (err: any) {
+    if (err.message && err.message.includes("Should have rejected")) throw err;
+  }
+
+  // search should reject
+  try {
+    searchWorkspace({ session_id: expirySessionId, query: "hello" });
+    throw new Error("Should have rejected expired session (search)");
+  } catch (err: any) {
+    if (err.message && err.message.includes("Should have rejected")) throw err;
+  }
+});
+
+// M21. Direct read blocks .patchwarden internal paths
+test("M21. read_workspace_file blocks .patchwarden internal paths", () => {
+  const sess = createDirectSession({ repo_path: "test-repo", title: "internal path test" });
+  const internalSessionId = sess.session_id;
+
+  // Try to read the session file itself
+  try {
+    readWorkspaceFile({
+      path: `.patchwarden/direct-sessions/${internalSessionId}/session.json`,
+      session_id: internalSessionId,
+    });
+    throw new Error("Should have rejected .patchwarden internal path read");
+  } catch (err: any) {
+    if (err.message && err.message.includes("Should have rejected")) throw err;
+    if (!err.reason || err.reason !== "internal_patchwarden_path_blocked") {
+      throw new Error(`Expected internal_patchwarden_path_blocked, got: ${err.reason || err.message}`);
+    }
+  }
+
+  // Try to read any .patchwarden file
+  try {
+    readWorkspaceFile({
+      path: ".patchwarden/watcher-heartbeat.json",
+      session_id: internalSessionId,
+    });
+    throw new Error("Should have rejected .patchwarden internal path read (2)");
+  } catch (err: any) {
+    if (err.message && err.message.includes("Should have rejected")) throw err;
+    if (!err.reason || err.reason !== "internal_patchwarden_path_blocked") {
+      throw new Error(`Expected internal_patchwarden_path_blocked, got: ${err.reason || err.message}`);
+    }
+  }
+});
+
+// M22. Binary detection with null byte works for extensionless files
+test("M22. binary detection blocks extensionless files with null bytes", () => {
+  // Create a blob file with null bytes in the fixture repo
+  const blobPath = join(directRepo, "blob");
+  writeFileSync(blobPath, Buffer.from("abc\x00def", "binary"));
+
+  const sess = createDirectSession({ repo_path: "test-repo", title: "binary test" });
+  const binarySessionId = sess.session_id;
+
+  // read should reject
+  try {
+    readWorkspaceFile({ path: "blob", session_id: binarySessionId });
+    throw new Error("Should have rejected binary file read");
+  } catch (err: any) {
+    if (err.message && err.message.includes("Should have rejected")) throw err;
+    if (!err.reason || err.reason !== "binary_file_blocked") {
+      throw new Error(`Expected binary_file_blocked, got: ${err.reason || err.message}`);
+    }
+  }
+
+  // apply_patch should reject
+  try {
+    applyPatch({
+      session_id: binarySessionId,
+      path: "blob",
+      expected_sha256: "dummy",
+      operations: [{ type: "replace_whole_file", new_text: "safe" }],
+    });
+    throw new Error("Should have rejected binary file patch");
+  } catch (err: any) {
+    if (err.message && err.message.includes("Should have rejected")) throw err;
+    if (!err.reason || err.reason !== "binary_file_blocked") {
+      throw new Error(`Expected binary_file_blocked, got: ${err.reason || err.message}`);
+    }
+  }
+});
+
+// Restore original config
+process.env.PATCHWARDEN_CONFIG = originalConfigEnv;
+reloadConfig();
+
+try { rmSync(directRoot, { recursive: true, force: true }); } catch {}
+
 // ════════════════════════════════════════════════════════════════
 // Summary
 // ════════════════════════════════════════════════════════════════