patchwarden 0.4.0 → 0.6.1

package/src/test/unit/android-doctor.test.ts

@@ -0,0 +1,158 @@
+import { describe, it, beforeEach, afterEach } from "node:test";
+import { strict as assert } from "node:assert";
+import { mkdirSync, mkdtempSync, rmSync, writeFileSync } from "node:fs";
+import { join } from "node:path";
+import { tmpdir } from "node:os";
+import {
+  diagnoseAndroidBuild,
+  type AndroidBuildDiagnosticReport,
+} from "../../tools/androidDoctor.js";
+
+const VALID_STATUSES = ["ok", "warn", "fail", "skip"] as const;
+
+/** Restore an env var to its original value (deleted when undefined). */
+function restoreEnv(key: string, value: string | undefined) {
+  if (value === undefined) delete process.env[key];
+  else process.env[key] = value;
+}
+
+describe("diagnoseAndroidBuild", () => {
+  let tempDir: string;
+  let savedJavaHome: string | undefined;
+  let savedAndroidHome: string | undefined;
+  let savedAndroidSdkRoot: string | undefined;
+
+  beforeEach(() => {
+    tempDir = mkdtempSync(join(tmpdir(), "pw-android-doctor-"));
+    savedJavaHome = process.env.JAVA_HOME;
+    savedAndroidHome = process.env.ANDROID_HOME;
+    savedAndroidSdkRoot = process.env.ANDROID_SDK_ROOT;
+  });
+
+  afterEach(() => {
+    rmSync(tempDir, { recursive: true, force: true });
+    restoreEnv("JAVA_HOME", savedJavaHome);
+    restoreEnv("ANDROID_HOME", savedAndroidHome);
+    restoreEnv("ANDROID_SDK_ROOT", savedAndroidSdkRoot);
+  });
+
+  it("returns a skip result when no android_app directory exists", () => {
+    const result = diagnoseAndroidBuild(tempDir);
+    assert.equal(result.status, "skip");
+    assert.equal((result as { reason: string }).reason, "No android_app directory found");
+  });
+
+  it("returns a structured diagnostic report when android_app exists", () => {
+    const androidApp = join(tempDir, "android_app");
+    mkdirSync(join(androidApp, "app"), { recursive: true });
+    mkdirSync(join(androidApp, "gradle", "wrapper"), { recursive: true });
+    writeFileSync(join(androidApp, "gradlew"), "#!/bin/sh\necho gradle\n");
+    writeFileSync(join(androidApp, "settings.gradle.kts"), 'pluginManagement { repositories { google() } }\n');
+    writeFileSync(join(androidApp, "app", "build.gradle.kts"), 'plugins { id("com.android.application") }\n');
+    writeFileSync(
+      join(androidApp, "gradle", "wrapper", "gradle-wrapper.properties"),
+      "distributionUrl=https://services.gradle.org/distributions/gradle-8.5-bin.zip\n",
+    );
+
+    // Make SDK-related checks deterministic regardless of the host environment.
+    delete process.env.ANDROID_HOME;
+    delete process.env.ANDROID_SDK_ROOT;
+
+    const result = diagnoseAndroidBuild(tempDir);
+    assert.notEqual(result.status, "skip");
+    const report = result as AndroidBuildDiagnosticReport;
+
+    assert.equal(report.repo_path, tempDir);
+    assert.equal(report.android_app_path, join(tempDir, "android_app"));
+    assert.ok(Array.isArray(report.checks));
+    assert.equal(report.checks.length, 10);
+
+    for (const item of report.checks) {
+      assert.equal(typeof item.check, "string");
+      assert.ok(item.check.length > 0);
+      assert.ok((VALID_STATUSES as readonly string[]).includes(item.status));
+      assert.equal(typeof item.reason, "string");
+      assert.equal(typeof item.suggested_fix, "string");
+    }
+
+    // Overall status follows the fail > warn > ok precedence.
+    const hasFail = report.checks.some((c) => c.status === "fail");
+    const hasWarn = report.checks.some((c) => c.status === "warn");
+    const expected = hasFail ? "fail" : hasWarn ? "warn" : "ok";
+    assert.equal(report.status, expected);
+
+    // The expected check names are all present.
+    const checkNames = report.checks.map((c) => c.check);
+    assert.ok(checkNames.includes("java -version"));
+    assert.ok(checkNames.includes("JAVA_HOME"));
+    assert.ok(checkNames.includes("ANDROID_HOME"));
+    assert.ok(checkNames.includes("ANDROID_SDK_ROOT"));
+    assert.ok(checkNames.includes("Android SDK platform"));
+    assert.ok(checkNames.includes("Android build-tools"));
+    assert.ok(checkNames.includes("Gradle wrapper"));
+    assert.ok(checkNames.includes("android_app/settings.gradle.kts"));
+    assert.ok(checkNames.includes("android_app/app/build.gradle.kts"));
+    assert.ok(checkNames.includes("APK output path"));
+
+    // Files we created should be detected as ok.
+    const gradleCheck = report.checks.find((c) => c.check === "Gradle wrapper");
+    assert.equal(gradleCheck?.status, "ok");
+
+    const settingsCheck = report.checks.find((c) => c.check === "android_app/settings.gradle.kts");
+    assert.equal(settingsCheck?.status, "ok");
+
+    const appBuildCheck = report.checks.find((c) => c.check === "android_app/app/build.gradle.kts");
+    assert.equal(appBuildCheck?.status, "ok");
+  });
+
+  it("reports a missing JAVA_HOME as warn or fail", () => {
+    const androidApp = join(tempDir, "android_app");
+    mkdirSync(androidApp, { recursive: true });
+
+    delete process.env.JAVA_HOME;
+    delete process.env.ANDROID_HOME;
+    delete process.env.ANDROID_SDK_ROOT;
+
+    const result = diagnoseAndroidBuild(tempDir);
+    const report = result as AndroidBuildDiagnosticReport;
+    const javaHomeCheck = report.checks.find((c) => c.check === "JAVA_HOME");
+    assert.ok(javaHomeCheck, "JAVA_HOME check should exist");
+    assert.ok(
+      javaHomeCheck!.status === "warn" || javaHomeCheck!.status === "fail",
+      `expected warn or fail, got ${javaHomeCheck!.status}`,
+    );
+  });
+
+  it("reports a missing ANDROID_HOME as fail with the SDK-missing message", () => {
+    const androidApp = join(tempDir, "android_app");
+    mkdirSync(androidApp, { recursive: true });
+
+    delete process.env.ANDROID_HOME;
+    delete process.env.ANDROID_SDK_ROOT;
+
+    const result = diagnoseAndroidBuild(tempDir);
+    const report = result as AndroidBuildDiagnosticReport;
+    const androidHomeCheck = report.checks.find((c) => c.check === "ANDROID_HOME");
+    assert.ok(androidHomeCheck, "ANDROID_HOME check should exist");
+    assert.equal(androidHomeCheck!.status, "fail");
+    assert.ok(
+      androidHomeCheck!.reason.includes(
+        "Android project exists, APK not built because Android SDK is missing.",
+      ),
+      `reason should mention the SDK-missing sentence, got: ${androidHomeCheck!.reason}`,
+    );
+
+    // With the SDK missing, the overall status must be fail.
+    assert.equal(report.status, "fail");
+
+    // The APK output check should also carry the SDK-missing reason and be skipped.
+    const apkCheck = report.checks.find((c) => c.check === "APK output path");
+    assert.ok(apkCheck, "APK output path check should exist");
+    assert.equal(apkCheck!.status, "skip");
+    assert.ok(
+      apkCheck!.reason.includes(
+        "Android project exists, APK not built because Android SDK is missing.",
+      ),
+    );
+  });
+});

package/src/test/unit/chinese-path.test.ts

@@ -0,0 +1,106 @@
+import { describe, it, beforeEach, afterEach } from "node:test";
+import { strict as assert } from "node:assert";
+import { mkdtempSync, rmSync, mkdirSync, writeFileSync, readFileSync, existsSync } from "node:fs";
+import { join, resolve } from "node:path";
+import { tmpdir } from "node:os";
+
+describe("Chinese path handling", () => {
+  let tempDir: string;
+
+  beforeEach(() => {
+    tempDir = mkdtempSync(join(tmpdir(), "pw-chinese-"));
+  });
+
+  afterEach(() => {
+    rmSync(tempDir, { recursive: true, force: true });
+  });
+
+  it("writes and reads status.json with Chinese repo_path", () => {
+    const chinesePath = "念念小伴_release";
+    const status = {
+      task_id: "test-001",
+      status: "pending",
+      repo_path: chinesePath,
+      resolved_repo_path: resolve(tempDir, chinesePath),
+    };
+    const statusFile = join(tempDir, "status.json");
+    writeFileSync(statusFile, JSON.stringify(status, null, 2), "utf-8");
+
+    const raw = readFileSync(statusFile, "utf-8");
+    const parsed = JSON.parse(raw);
+    assert.equal(parsed.repo_path, chinesePath);
+    assert.equal(parsed.resolved_repo_path, resolve(tempDir, chinesePath));
+  });
+
+  it("preserves Chinese characters through JSON stringify/parse", () => {
+    const testPaths = [
+      "念念小伴_release",
+      "测试项目",
+      "项目目录/子目录",
+      "日本語プロジェクト",
+      "한국어_프로젝트",
+    ];
+    for (const path of testPaths) {
+      const json = JSON.stringify({ repo_path: path });
+      const parsed = JSON.parse(json);
+      assert.equal(parsed.repo_path, path, `Path "${path}" was corrupted`);
+    }
+  });
+
+  it("creates and reads directories with Chinese names", () => {
+    const chineseDir = join(tempDir, "念念小伴_release");
+    mkdirSync(chineseDir, { recursive: true });
+    assert.ok(existsSync(chineseDir));
+
+    const filePath = join(chineseDir, "status.json");
+    const data = { repo_path: "念念小伴_release", status: "running" };
+    writeFileSync(filePath, JSON.stringify(data, null, 2), "utf-8");
+
+    const raw = readFileSync(filePath, "utf-8");
+    const parsed = JSON.parse(raw);
+    assert.equal(parsed.repo_path, "念念小伴_release");
+  });
+
+  it("handles Chinese characters in result.md", () => {
+    const resultMd = [
+      "# PatchWarden Task Result",
+      "",
+      "## Status",
+      "done",
+      "",
+      "## Files changed",
+      "- modified: 念念小伴_release/src/main.ts",
+      "- added: 测试项目/config.json",
+      "",
+    ].join("\n");
+    const resultFile = join(tempDir, "result.md");
+    writeFileSync(resultFile, resultMd, "utf-8");
+
+    const content = readFileSync(resultFile, "utf-8");
+    assert.ok(content.includes("念念小伴_release"));
+    assert.ok(content.includes("测试项目"));
+  });
+
+  it("handles mixed Chinese and ASCII paths", () => {
+    const mixedPath = "src/组件/Button.tsx";
+    const data = { path: mixedPath };
+    const json = JSON.stringify(data);
+    const parsed = JSON.parse(json);
+    assert.equal(parsed.path, mixedPath);
+  });
+
+  it("handles Chinese characters in error messages", () => {
+    const errorMsg = 'repo_path "念念小伴_release" is outside workspace';
+    const errorFile = join(tempDir, "error.log");
+    writeFileSync(errorFile, errorMsg, "utf-8");
+
+    const content = readFileSync(errorFile, "utf-8");
+    assert.ok(content.includes("念念小伴_release"));
+  });
+
+  it("handles Windows backslash paths with Chinese characters", () => {
+    const winPath = "念念小伴_release\\src\\main.ts";
+    const normalized = winPath.replace(/\\/g, "/");
+    assert.equal(normalized, "念念小伴_release/src/main.ts");
+  });
+});

package/src/test/unit/command-guard.test.ts

@@ -0,0 +1,221 @@
+import { describe, it, beforeEach, afterEach } from "node:test";
+import { strict as assert } from "node:assert";
+import { mkdtempSync, rmSync } from "node:fs";
+import { join } from "node:path";
+import { tmpdir } from "node:os";
+import { guardAgentCommand, guardTestCommand, guardDirectCommand, sanitizePromptArg } from "../../security/commandGuard.js";
+import { PatchWardenError } from "../../errors.js";
+import type { PatchWardenConfig } from "../../config.js";
+
+function makeConfig(workspaceRoot: string): PatchWardenConfig {
+  return {
+    workspaceRoot,
+    plansDir: ".patchwarden/plans",
+    tasksDir: ".patchwarden/tasks",
+    assessmentsDir: ".patchwarden/assessments",
+    assessmentTtlSeconds: 3600,
+    agents: {
+      codex: { command: "codex", args: ["exec", "{repo}", "{prompt}"] },
+      opencode: { command: "opencode", args: ["run", "{prompt}"] },
+    },
+    allowedTestCommands: ["npm test", "npm run build", "npm run lint"],
+    repoAllowedTestCommands: {},
+    maxReadFileBytes: 200_000,
+    defaultTaskTimeoutSeconds: 900,
+    maxTaskTimeoutSeconds: 3600,
+    watcherStaleSeconds: 30,
+    directSessionsDir: ".patchwarden/direct-sessions",
+    directSessionTtlSeconds: 3600,
+    directMaxPatchBytes: 200_000,
+    directMaxFileBytes: 500_000,
+    directAllowedCommands: ["npm test", "npm run build"],
+    repoDirectAllowedCommands: {},
+  };
+}
+
+describe("guardTestCommand", () => {
+  let tempDir: string;
+  let config: PatchWardenConfig;
+
+  beforeEach(() => {
+    tempDir = mkdtempSync(join(tmpdir(), "pw-cmdguard-"));
+    config = makeConfig(tempDir);
+  });
+
+  afterEach(() => {
+    rmSync(tempDir, { recursive: true, force: true });
+  });
+
+  it("allows exact match from allowlist", () => {
+    assert.equal(guardTestCommand("npm test", config), "npm test");
+    assert.equal(guardTestCommand("npm run build", config), "npm run build");
+    assert.equal(guardTestCommand("npm run lint", config), "npm run lint");
+  });
+
+  it("trims leading spaces and matches", () => {
+    assert.equal(guardTestCommand(" npm test", config), "npm test");
+  });
+
+  it("trims trailing spaces and matches", () => {
+    assert.equal(guardTestCommand("npm test ", config), "npm test");
+  });
+
+  it("trims and matches with double spaces in middle (trim only affects ends)", () => {
+    // "npm  test" has double space — trim() only trims ends, so "npm  test" != "npm test"
+    assert.throws(
+      () => guardTestCommand("npm  test", config),
+      PatchWardenError
+    );
+  });
+
+  it("rejects non-allowlisted commands", () => {
+    assert.throws(
+      () => guardTestCommand("rm -rf /", config),
+      PatchWardenError
+    );
+    assert.throws(
+      () => guardTestCommand("curl http://evil.com", config),
+      PatchWardenError
+    );
+  });
+
+  it("returns empty string for empty or undefined command", () => {
+    assert.equal(guardTestCommand("", config), "");
+    assert.equal(guardTestCommand(undefined as unknown as string, config), "");
+  });
+
+  it("returns empty string for whitespace-only command", () => {
+    assert.equal(guardTestCommand("   ", config), "");
+  });
+
+  it("cannot be bypassed by parameter concatenation", () => {
+    // "npm test && rm -rf /" is not in the allowlist
+    assert.throws(
+      () => guardTestCommand("npm test && rm -rf /", config),
+      PatchWardenError
+    );
+    // "npm test; evil" is not in the allowlist
+    assert.throws(
+      () => guardTestCommand("npm test; evil", config),
+      PatchWardenError
+    );
+  });
+});
+
+describe("guardAgentCommand", () => {
+  let tempDir: string;
+  let config: PatchWardenConfig;
+
+  beforeEach(() => {
+    tempDir = mkdtempSync(join(tmpdir(), "pw-agentguard-"));
+    config = makeConfig(tempDir);
+  });
+
+  afterEach(() => {
+    rmSync(tempDir, { recursive: true, force: true });
+  });
+
+  it("allows configured agents", () => {
+    const result = guardAgentCommand("codex", config);
+    assert.equal(result.command, "codex");
+    assert.deepEqual(result.args, ["exec", "{repo}", "{prompt}"]);
+
+    const result2 = guardAgentCommand("opencode", config);
+    assert.equal(result2.command, "opencode");
+  });
+
+  it("rejects unconfigured agents", () => {
+    assert.throws(
+      () => guardAgentCommand("evil-agent", config),
+      (err: unknown) => err instanceof PatchWardenError && err.reason === "agent_not_configured"
+    );
+  });
+
+  it("rejects empty agent name", () => {
+    assert.throws(
+      () => guardAgentCommand("", config),
+      PatchWardenError
+    );
+  });
+});
+
+describe("guardDirectCommand", () => {
+  let tempDir: string;
+  let config: PatchWardenConfig;
+
+  beforeEach(() => {
+    tempDir = mkdtempSync(join(tmpdir(), "pw-directcmd-"));
+    config = makeConfig(tempDir);
+  });
+
+  afterEach(() => {
+    rmSync(tempDir, { recursive: true, force: true });
+  });
+
+  it("allows commands from direct allowlist", () => {
+    assert.equal(guardDirectCommand("npm test", config), "npm test");
+    assert.equal(guardDirectCommand("npm run build", config), "npm run build");
+  });
+
+  it("rejects non-allowlisted direct commands", () => {
+    assert.throws(
+      () => guardDirectCommand("rm -rf /", config),
+      PatchWardenError
+    );
+  });
+
+  it("rejects empty command", () => {
+    assert.throws(
+      () => guardDirectCommand("", config),
+      PatchWardenError
+    );
+  });
+});
+
+describe("sanitizePromptArg", () => {
+  it("removes null bytes", () => {
+    const input = "hello\x00world";
+    const result = sanitizePromptArg(input);
+    assert.equal(result, "helloworld");
+  });
+
+  it("removes control characters (except tab and newline)", () => {
+    const input = "hello\x01\x02\x03world";
+    const result = sanitizePromptArg(input);
+    assert.equal(result, "helloworld");
+  });
+
+  it("preserves tab characters", () => {
+    const input = "hello\tworld";
+    const result = sanitizePromptArg(input);
+    assert.equal(result, "hello\tworld");
+  });
+
+  it("preserves newline characters", () => {
+    const input = "hello\nworld";
+    const result = sanitizePromptArg(input);
+    assert.equal(result, "hello\nworld");
+  });
+
+  it("preserves carriage return", () => {
+    const input = "hello\rworld";
+    const result = sanitizePromptArg(input);
+    assert.equal(result, "hello\rworld");
+  });
+
+  it("preserves normal text", () => {
+    const input = "Fix the bug in main.ts";
+    const result = sanitizePromptArg(input);
+    assert.equal(result, input);
+  });
+
+  it("removes vertical tab and form feed", () => {
+    const input = "hello\x0B\x0Cworld";
+    const result = sanitizePromptArg(input);
+    assert.equal(result, "helloworld");
+  });
+
+  it("handles empty string", () => {
+    assert.equal(sanitizePromptArg(""), "");
+  });
+});