patchwarden 0.4.0 → 0.6.1

package/dist/doctor.js

@@ -17,7 +17,7 @@ import { isSensitivePath } from "./security/sensitiveGuard.js";
 import { guardPlanContent } from "./security/planGuard.js";
 import { TASK_READ_ONLY_FILES } from "./tools/getTaskFile.js";
 import { getToolDefs } from "./tools/registry.js";
-import { CHATGPT_CORE_TOOL_NAMES, selectToolsForProfile } from "./tools/toolCatalog.js";
+import { CHATGPT_CORE_TOOL_NAMES, CHATGPT_DIRECT_TOOL_NAMES, selectToolsForProfile } from "./tools/toolCatalog.js";
 import { PATCHWARDEN_VERSION } from "./version.js";
 // ── State ──────────────────────────────────────────────────────────
 let ok = 0;
@@ -59,6 +59,7 @@ function cmd(cmdStr) {
 // ══════════════════════════════════════════════════════════════════
 async function main() {
     console.log("PatchWarden Doctor\n");
+    const allowDefaultConfig = process.argv.includes("--allow-default-config");
     // 1. Node version
     const nodeVer = process.version;
     const nodeMajor = parseInt(nodeVer.slice(1).split(".")[0]);
@@ -66,6 +67,16 @@ async function main() {
     // 2. npm
     const npmVer = cmd("npm --version");
     check("npm available", npmVer !== "", npmVer || "npm not found in PATH");
+    // Local-only medium-risk confirmation entrypoint. It must exist as a package
+    // binary but must not be exposed as an MCP tool.
+    try {
+        const packageJson = JSON.parse(readFileSync(resolve(process.cwd(), "package.json"), "utf-8"));
+        check("patchwarden-confirm package binary", packageJson.bin?.["patchwarden-confirm"] === "dist/assessments/confirmCli.js", packageJson.bin?.["patchwarden-confirm"] || "missing");
+        check("patchwarden-confirm compiled entrypoint", existsSync(resolve(process.cwd(), "dist/assessments/confirmCli.js")), "run npm.cmd run build");
+    }
+    catch (error) {
+        check("patchwarden-confirm package binary", false, error instanceof Error ? error.message : String(error));
+    }
     // 3. Git
     const gitVer = cmd("git --version");
     warnCheck("Git available", gitVer !== "", gitVer || "git not found — runner git.diff will not work");
@@ -81,9 +92,15 @@ async function main() {
             break;
         }
     }
-    check("Config file exists", configPathUsed !== "", configPathUsed
+    const configDetail = configPathUsed
         ? configPathUsed
-        : 'Create one: cp examples/config.example.json patchwarden.config.json');
+        : 'Create one: cp examples/config.example.json patchwarden.config.json';
+    if (allowDefaultConfig) {
+        warnCheck("Config file exists", configPathUsed !== "", configDetail);
+    }
+    else {
+        check("Config file exists", configPathUsed !== "", configDetail);
+    }
     // 5. PATCHWARDEN_CONFIG env
     if (process.env.PATCHWARDEN_CONFIG) {
         results.push(`[OK]   PATCHWARDEN_CONFIG = ${process.env.PATCHWARDEN_CONFIG}`);
@@ -198,15 +215,26 @@ async function main() {
     try {
         process.env.PATCHWARDEN_TOOL_PROFILE = "full";
         const fullTools = getToolDefs();
-        const coreTools = selectToolsForProfile(fullTools, "chatgpt_core");
+        const coreTools = selectToolsForProfile(fullTools, "chatgpt_core", config?.enableDirectProfile);
         const createSchema = coreTools.find((tool) => tool.name === "create_task")?.inputSchema;
         const waitSchema = coreTools.find((tool) => tool.name === "wait_for_task")?.inputSchema;
-        check("Full tool profile exposes 22 tools", fullTools.length === 22, `${fullTools.length} tools`);
+        check("Full tool profile exposes 30 tools", fullTools.length === 30, `${fullTools.length} tools`);
         check(`chatgpt_core profile exposes the exact ${CHATGPT_CORE_TOOL_NAMES.length}-tool manifest`, JSON.stringify(coreTools.map((tool) => tool.name)) === JSON.stringify(CHATGPT_CORE_TOOL_NAMES), coreTools.map((tool) => tool.name).join(", "));
         check("Core task schemas expose inline_plan, verify_commands, and wait aliases", Boolean(createSchema?.properties?.inline_plan &&
             createSchema?.properties?.verify_commands &&
             waitSchema?.properties?.timeout_seconds &&
             waitSchema?.properties?.wait_seconds));
+        // chatgpt_direct profile checks
+        const directDisabledTools = selectToolsForProfile(fullTools, "chatgpt_direct", false);
+        check("chatgpt_direct disabled exposes only health_check (degraded mode)", directDisabledTools.length === 1 && directDisabledTools[0].name === "health_check", `${directDisabledTools.map((t) => t.name).join(", ")}`);
+        if (config?.enableDirectProfile) {
+            const directEnabledTools = selectToolsForProfile(fullTools, "chatgpt_direct", true);
+            check(`chatgpt_direct enabled exposes the exact ${CHATGPT_DIRECT_TOOL_NAMES.length}-tool manifest`, JSON.stringify(directEnabledTools.map((tool) => tool.name)) === JSON.stringify(CHATGPT_DIRECT_TOOL_NAMES), directEnabledTools.map((tool) => tool.name).join(", "));
+        }
+        else {
+            results.push(`[OK]   chatgpt_direct enabled check skipped (enableDirectProfile=false)`);
+            ok++;
+        }
     }
     finally {
         if (previousProfile === undefined)
@@ -259,6 +287,31 @@ async function main() {
         const compiled = resolve(process.cwd(), "dist/tools", `${t}.js`);
         check(`Tool module: ${t}`, existsSync(compiled), existsSync(compiled) ? "compiled" : "missing");
     }
+    // Direct tool module checks
+    const directToolModules = [
+        "createDirectSession",
+        "searchWorkspace",
+        "applyPatch",
+        "runVerification",
+        "finalizeDirectSession",
+        "auditSession",
+    ];
+    for (const t of directToolModules) {
+        const compiled = resolve(process.cwd(), "dist/tools", `${t}.js`);
+        check(`Direct tool module: ${t}`, existsSync(compiled), existsSync(compiled) ? "compiled" : "missing");
+    }
+    // Direct support module checks
+    const directSupportModules = [
+        "directSessionStore",
+        "directGuards",
+        "directPatch",
+        "directVerification",
+        "directAudit",
+    ];
+    for (const t of directSupportModules) {
+        const compiled = resolve(process.cwd(), "dist/direct", `${t}.js`);
+        check(`Direct support module: ${t}`, existsSync(compiled), existsSync(compiled) ? "compiled" : "missing");
+    }
     // Task directory writable
     if (config) {
         const tasksDir = resolve(config.workspaceRoot, config.tasksDir);
@@ -334,11 +387,26 @@ async function main() {
             }
         }
     }
+    // 14b. Direct profile config checks
+    if (config) {
+        const directCmds = config.directAllowedCommands || [];
+        warnCheck("directAllowedCommands is non-empty", directCmds.length > 0, directCmds.length > 0 ? `${directCmds.length} commands` : "No Direct commands configured");
+        // npm run doctor should NOT be in default Direct whitelist
+        const hasDoctor = directCmds.some((c) => c === "npm run doctor");
+        check("directAllowedCommands does not include npm run doctor", !hasDoctor, hasDoctor ? "npm run doctor found in Direct whitelist — remove it for tighter security" : "not present");
+        check("directSessionTtlSeconds is valid", config.directSessionTtlSeconds >= 60 && config.directSessionTtlSeconds <= 86400, `${config.directSessionTtlSeconds}s`);
+        check("directMaxPatchBytes is positive", config.directMaxPatchBytes > 0, `${config.directMaxPatchBytes}`);
+        check("directMaxFileBytes is positive", config.directMaxFileBytes > 0, `${config.directMaxFileBytes}`);
+    }
     // 15. Tunnel example files check
     const tunnelFiles = [
         "examples/openai-tunnel/README.md",
         "examples/openai-tunnel/tunnel-client.example.yaml",
         "examples/openai-tunnel/chatgpt-test-prompt.md",
+        "scripts/patchwarden-mcp-direct.cmd",
+        "PatchWarden.cmd",
+        "scripts/manage-patchwarden.ps1",
+        "scripts/launchers/Start-PatchWarden-Direct-Tunnel.cmd",
     ];
     for (const tf of tunnelFiles) {
         const full = resolve(process.cwd(), tf);

package/dist/logging.d.ts

@@ -0,0 +1,52 @@
+export type LogLevel = "info" | "warn" | "error" | "audit";
+export interface LogEntry {
+    timestamp: string;
+    level: LogLevel;
+    message: string;
+    [key: string]: unknown;
+}
+/**
+ * Returns true when PATCHWARDEN_VERBOSE_LOG is set to "true".
+ * Verbose mode enables logging of sanitized tool-call arguments.
+ */
+export declare function isVerboseLogging(): boolean;
+/**
+ * Structured logger that emits JSON lines to stderr.
+ *
+ * Each entry contains `timestamp`, `level`, `message`, plus any optional
+ * context fields supplied by the caller.
+ */
+export declare class Logger {
+    info(message: string, context?: Record<string, unknown>): void;
+    warn(message: string, context?: Record<string, unknown>): void;
+    error(message: string, context?: Record<string, unknown>): void;
+    /**
+     * Emit a tool-call audit log entry.
+     *
+     * Required fields: `tool`, `ok`, `duration_ms`.
+     * Optional fields: `error_reason`, `task_id`.
+     *
+     * By default raw arguments are NOT logged. When verbose mode is enabled
+     * (PATCHWARDEN_VERBOSE_LOG=true) and `args` is provided, the arguments
+     * are serialized and sanitized via `redactSensitiveContent` before being
+     * included in the `args` field.
+     */
+    audit(tool: string, ok: boolean, durationMs: number, errorReason?: string, taskId?: string, args?: unknown): void;
+}
+/** Default singleton logger instance. */
+export declare const logger: Logger;
+/**
+ * Produce a structured error log entry for an unhandled rejection or
+ * uncaught exception. Writes JSON to stderr.
+ */
+export declare function logUnhandledError(error: unknown): void;
+/**
+ * Register process-level handlers for `unhandledRejection` and
+ * `uncaughtException`.
+ *
+ * Both handlers log structured error output to stderr. The
+ * `uncaughtException` handler does NOT swallow the fatal error — after
+ * logging it exits with a non-zero status code to preserve the default
+ * crash behaviour required for truly fatal failures.
+ */
+export declare function installGlobalHandlers(): void;

package/dist/logging.js

@@ -0,0 +1,123 @@
+import { redactSensitiveContent } from "./security/contentRedaction.js";
+// ── Helpers ───────────────────────────────────────────────────────
+/**
+ * Returns true when PATCHWARDEN_VERBOSE_LOG is set to "true".
+ * Verbose mode enables logging of sanitized tool-call arguments.
+ */
+export function isVerboseLogging() {
+    return process.env.PATCHWARDEN_VERBOSE_LOG === "true";
+}
+/**
+ * Serialize a value to a JSON string, falling back to String() on failure
+ * (e.g. circular references, functions, symbols).
+ */
+function safeStringify(value) {
+    try {
+        const result = JSON.stringify(value);
+        return result === undefined ? String(value) : result;
+    }
+    catch {
+        return String(value);
+    }
+}
+/**
+ * Write a single JSON log line to stderr.
+ *
+ * All log output goes to stderr — NEVER stdout — so that MCP JSON-RPC
+ * traffic on stdout is never polluted by log messages.
+ */
+function emit(entry) {
+    process.stderr.write(JSON.stringify(entry) + "\n");
+}
+// ── Logger ────────────────────────────────────────────────────────
+/**
+ * Structured logger that emits JSON lines to stderr.
+ *
+ * Each entry contains `timestamp`, `level`, `message`, plus any optional
+ * context fields supplied by the caller.
+ */
+export class Logger {
+    info(message, context) {
+        emit({ timestamp: new Date().toISOString(), level: "info", message, ...context });
+    }
+    warn(message, context) {
+        emit({ timestamp: new Date().toISOString(), level: "warn", message, ...context });
+    }
+    error(message, context) {
+        emit({ timestamp: new Date().toISOString(), level: "error", message, ...context });
+    }
+    /**
+     * Emit a tool-call audit log entry.
+     *
+     * Required fields: `tool`, `ok`, `duration_ms`.
+     * Optional fields: `error_reason`, `task_id`.
+     *
+     * By default raw arguments are NOT logged. When verbose mode is enabled
+     * (PATCHWARDEN_VERBOSE_LOG=true) and `args` is provided, the arguments
+     * are serialized and sanitized via `redactSensitiveContent` before being
+     * included in the `args` field.
+     */
+    audit(tool, ok, durationMs, errorReason, taskId, args) {
+        const entry = {
+            timestamp: new Date().toISOString(),
+            level: "audit",
+            message: "tool_call_audit",
+            tool,
+            ok,
+            duration_ms: durationMs,
+        };
+        if (errorReason !== undefined)
+            entry.error_reason = errorReason;
+        if (taskId !== undefined)
+            entry.task_id = taskId;
+        if (args !== undefined && isVerboseLogging()) {
+            const redacted = redactSensitiveContent(safeStringify(args));
+            entry.args = redacted.content;
+        }
+        emit(entry);
+    }
+}
+/** Default singleton logger instance. */
+export const logger = new Logger();
+// ── Unhandled error helpers ───────────────────────────────────────
+/**
+ * Produce a structured error log entry for an unhandled rejection or
+ * uncaught exception. Writes JSON to stderr.
+ */
+export function logUnhandledError(error) {
+    const entry = {
+        timestamp: new Date().toISOString(),
+        level: "error",
+        message: "unhandled_error",
+        error: error instanceof Error
+            ? error.message
+            : typeof error === "string"
+                ? error
+                : safeStringify(error),
+        error_name: error instanceof Error ? error.name : typeof error,
+    };
+    if (error instanceof Error && error.stack) {
+        entry.stack = error.stack;
+    }
+    emit(entry);
+}
+/**
+ * Register process-level handlers for `unhandledRejection` and
+ * `uncaughtException`.
+ *
+ * Both handlers log structured error output to stderr. The
+ * `uncaughtException` handler does NOT swallow the fatal error — after
+ * logging it exits with a non-zero status code to preserve the default
+ * crash behaviour required for truly fatal failures.
+ */
+export function installGlobalHandlers() {
+    process.on("unhandledRejection", (reason) => {
+        logUnhandledError(reason);
+    });
+    process.on("uncaughtException", (error) => {
+        logUnhandledError(error);
+        // Do not swallow: exit with failure so the process does not continue
+        // in an undefined state.
+        process.exit(1);
+    });
+}

package/dist/runner/agentInvocation.d.ts

@@ -0,0 +1,23 @@
+import { PatchWardenConfig } from "../config.js";
+export interface AgentInvocation {
+    command: string;
+    args: string[];
+    cwd: string;
+    commandLabel: string;
+    promptMode: "inline" | "file";
+    promptFilePath?: string;
+}
+/**
+ * Build agent invocation parameters from config.
+ * Replaces {repo}, {prompt}, and {prompt_file} placeholders.
+ * runTask and agentAssessor share this function to ensure consistent agent startup.
+ */
+export declare function buildAgentInvocation(agentName: string, repoPath: string, prompt: string, config: PatchWardenConfig, promptFilePath?: string): AgentInvocation;
+/**
+ * Build task execution prompt. Mechanically extracted from runTask.ts.
+ */
+export declare function buildExecutionPrompt(plan: string, repoPath: string, testCommand: string): string;
+/**
+ * Build agentAssessor inspect-only prompt.
+ */
+export declare function buildAssessmentPrompt(goal: string, planContent: string, repoPath: string): string;

package/dist/runner/agentInvocation.js

@@ -0,0 +1,106 @@
+import { basename } from "node:path";
+import { guardAgentCommand, sanitizePromptArg } from "../security/commandGuard.js";
+/**
+ * Build agent invocation parameters from config.
+ * Replaces {repo}, {prompt}, and {prompt_file} placeholders.
+ * runTask and agentAssessor share this function to ensure consistent agent startup.
+ */
+export function buildAgentInvocation(agentName, repoPath, prompt, config, promptFilePath) {
+    const agentCmd = guardAgentCommand(agentName, config);
+    const sanitizedPrompt = sanitizePromptArg(prompt);
+    const hasPromptFilePlaceholder = agentCmd.args.includes("{prompt_file}");
+    const promptMode = hasPromptFilePlaceholder && promptFilePath ? "file" : "inline";
+    const resolvedArgs = agentCmd.args.map((arg) => {
+        if (arg === "{repo}")
+            return repoPath;
+        if (arg === "{prompt}")
+            return sanitizedPrompt;
+        if (arg === "{prompt_file}" && promptMode === "file" && promptFilePath)
+            return promptFilePath;
+        return arg;
+    });
+    return {
+        command: agentCmd.command,
+        args: resolvedArgs,
+        cwd: repoPath,
+        commandLabel: `${basename(agentCmd.command)} (configured agent command)`,
+        promptMode,
+        ...(promptMode === "file" && promptFilePath ? { promptFilePath } : {}),
+    };
+}
+/**
+ * Build task execution prompt. Mechanically extracted from runTask.ts.
+ */
+export function buildExecutionPrompt(plan, repoPath, testCommand) {
+    let prompt = `You are executing a pre-written plan in a local repository.
+
+## Repository
+${repoPath}
+
+## Plan
+${plan}
+
+## Instructions
+1. Read the plan carefully.
+2. Implement the changes in this repository only.
+3. Do NOT modify files outside this repository.
+4. Leave repository changes uncommitted for review; remote operations are outside this task.
+5. After implementing, describe what you changed.
+6. Output a summary with what was done, files modified, and issues encountered.
+`;
+    if (testCommand) {
+        prompt += `\n7. You may run ${testCommand}; PatchWarden will independently run it again for verification.`;
+    }
+    return prompt;
+}
+/**
+ * Build agentAssessor inspect-only prompt.
+ */
+export function buildAssessmentPrompt(goal, planContent, repoPath) {
+    return `You are performing a READ-ONLY risk assessment of a planned task. Do NOT modify any files.
+
+## Repository
+${repoPath}
+
+## Goal
+${goal}
+
+## Plan
+${planContent}
+
+## Instructions
+1. Read the plan and goal carefully.
+2. Inspect the repository to understand the scope of changes.
+3. Do NOT create, edit, delete, rename, or generate any files.
+4. Assess the risk level of executing this plan.
+5. Identify affected file paths within the repository.
+6. Check for destructive actions, sensitive file access, or out-of-scope changes.
+7. Output your assessment as JSON after the marker ===ASSESSMENT_JSON=== on a new line.
+
+## Required JSON output format
+After your analysis, output exactly this format:
+
+===ASSESSMENT_JSON===
+{
+  "risk_level": "low" | "medium" | "high",
+  "reason_codes": ["short", "descriptive", "codes"],
+  "affected_paths": ["relative/path/to/file"],
+  "destructive_actions": ["description of any destructive actions"],
+  "requires_user_confirm": false,
+  "confidence": 0.0,
+  "notes": "Brief summary of findings"
+}
+
+## Risk level guidelines
+- low: Small source change, no sensitive files, no destructive actions
+- medium: Multiple files, build artifacts, dependency changes, or uncertain scope
+- high: Destructive actions, sensitive file access, out-of-scope changes, or large-scale deletion
+
+## Constraints
+- affected_paths must be relative paths within the repository (no absolute paths)
+- reason_codes: max 50 entries, each max 100 chars
+- destructive_actions: max 20 entries, each max 200 chars
+- notes: max 2000 chars
+- confidence: number from 0.0 to 1.0
+`;
+}

package/dist/runner/changeCapture.d.ts

@@ -1,6 +1,8 @@
 export interface FileFingerprint {
     size: number;
     sha256: string;
+    tracked: boolean;
+    ignored: boolean;
 }
 export interface RepoSnapshot {
     captured_at: string;
@@ -9,6 +11,7 @@ export interface RepoSnapshot {
     status: string;
     workspace_dirty: boolean;
     files: Record<string, FileFingerprint>;
+    dirty_paths: string[];
     warnings: string[];
 }
 export interface ChangedFile {
@@ -17,6 +20,31 @@ export interface ChangedFile {
     old_path?: string;
     before_sha256: string | null;
     after_sha256: string | null;
+    tracked: boolean;
+    ignored: boolean;
+    kind: "source" | "build_artifact" | "runtime_generated";
+}
+export interface ClassifiedChange {
+    path: string;
+    change: ChangedFile["change"];
+    tracked: boolean;
+    ignored: boolean;
+    kind: ChangedFile["kind"];
+    reason: string;
+}
+export interface ArtifactHygiene {
+    counts: {
+        source_changes: number;
+        tracked_build_artifacts: number;
+        ignored_untracked_artifacts: number;
+        runtime_generated_files: number;
+        suspicious_changes: number;
+    };
+    source_changes: ClassifiedChange[];
+    tracked_build_artifacts: ClassifiedChange[];
+    ignored_untracked_artifacts: ClassifiedChange[];
+    runtime_generated_files: ClassifiedChange[];
+    suspicious_changes: ClassifiedChange[];
 }
 export interface ChangeArtifacts {
     changed_files: ChangedFile[];
@@ -36,8 +64,50 @@ export interface ChangeArtifacts {
     workspace_dirty_after: boolean;
     patch_mode: "textual" | "no_changes" | "hash_only";
     unavailable_reason: string | null;
+    artifact_hygiene: ArtifactHygiene;
 }
 export declare function captureRepoSnapshot(repoPath: string): RepoSnapshot;
 export declare function writeSnapshot(taskDir: string, filename: string, snapshot: RepoSnapshot): void;
 export declare function buildChangeArtifacts(repoPath: string, before: RepoSnapshot, after: RepoSnapshot): ChangeArtifacts;
 export declare function compareSnapshots(before: RepoSnapshot, after: RepoSnapshot): ChangedFile[];
+export declare function emptyArtifactHygiene(): ArtifactHygiene;
+export interface ExternalDirtyFile {
+    path: string;
+    change: ChangedFile["change"];
+    before_sha256: string | null;
+    after_sha256: string | null;
+}
+/**
+ * Extract files that are dirty in the workspace but outside the target repo.
+ * Used to establish a baseline before task execution.
+ */
+export declare function extractExternalDirtyFiles(workspaceSnapshot: RepoSnapshot, repoPath: string, workspaceRoot: string): ExternalDirtyFile[];
+/**
+ * Compare external dirty files between baseline and post-task snapshots.
+ * Returns files that are NEW (not present in baseline) or CHANGED
+ * (same path but different sha256, meaning the task modified them).
+ */
+export declare function findNewExternalDirtyFiles(baseline: ExternalDirtyFile[], current: ExternalDirtyFile[]): ExternalDirtyFile[];
+export interface ArtifactManifestEntry {
+    path: string;
+    type: string;
+    size: number;
+    sha256: string;
+    generated_by: string;
+    created_at: string;
+}
+export interface ArtifactManifest {
+    task_id: string | null;
+    generated_at: string;
+    artifacts: ArtifactManifestEntry[];
+}
+export declare function buildArtifactManifest(changedFiles: ChangedFile[], repoPath: string, taskId?: string): ArtifactManifest;
+export interface ChangedFileGroups {
+    source_changes: ChangedFile[];
+    docs_changes: ChangedFile[];
+    config_changes: ChangedFile[];
+    test_changes: ChangedFile[];
+    release_artifacts: ChangedFile[];
+    runtime_generated_files: ChangedFile[];
+}
+export declare function groupChangedFiles(changedFiles: ChangedFile[]): ChangedFileGroups;