patchwarden 0.4.0

package/src/runner/watch.ts

@@ -0,0 +1,152 @@
+#!/usr/bin/env node
+/**
+ * PatchWarden Watcher
+ *
+ * Polls .patchwarden/tasks/ for pending tasks and executes them automatically.
+ * This is the recommended way to run tasks — ChatGPT creates tasks,
+ * the watcher picks them up and runs them locally.
+ *
+ * Safety invariants (enforced every tick):
+ *  - repo_path must be inside workspace
+ *  - agent must be in allowlist
+ *  - test_command must be in allowlist (or empty)
+ *  - Each task runs at most once (no retry loop)
+ *  - No auto commit, no auto push, no file deletion
+ *
+ * Run: node dist/runner/watch.js
+ *   or: npm run watch
+ */
+
+import { readdirSync, readFileSync, existsSync, writeFileSync, mkdirSync, renameSync } from "node:fs";
+import { resolve, join, dirname } from "node:path";
+import { loadConfig, getConfig, getTasksDir, resolveWorkspaceRoot } from "../config.js";
+import { guardWorkspacePath } from "../security/pathGuard.js";
+import { guardAgentCommand, guardTestCommand } from "../security/commandGuard.js";
+import { runTask } from "./runTask.js";
+
+// ── Bootstrap ─────────────────────────────────────────────────────
+
+loadConfig();
+const config = getConfig();
+const tasksDir = getTasksDir(config);
+const wsRoot = resolveWorkspaceRoot(config);
+
+const POLL_INTERVAL_MS = 4000;
+const WATCHER_HEARTBEAT_FILE = join(dirname(tasksDir), "watcher-heartbeat.json");
+const WATCHER_STARTED_AT = new Date().toISOString();
+const WATCHER_INSTANCE_ID = process.env.PATCHWARDEN_WATCHER_INSTANCE_ID || `standalone-${process.pid}-${Date.now()}`;
+const WATCHER_LAUNCHER_PID = Number.isInteger(Number(process.env.PATCHWARDEN_WATCHER_LAUNCHER_PID))
+  ? Number(process.env.PATCHWARDEN_WATCHER_LAUNCHER_PID)
+  : null;
+mkdirSync(dirname(WATCHER_HEARTBEAT_FILE), { recursive: true });
+
+console.error(`[watcher] Workspace: ${wsRoot}`);
+console.error(`[watcher] Tasks:    ${tasksDir}`);
+console.error(`[watcher] Polling every ${POLL_INTERVAL_MS / 1000}s`);
+console.error(`[watcher] Press Ctrl+C to stop`);
+
+// Track executed tasks to prevent re-execution
+const executedTasks = new Set<string>();
+
+// ── Main loop ─────────────────────────────────────────────────────
+
+async function tick() {
+  try {
+    const heartbeatTemporary = `${WATCHER_HEARTBEAT_FILE}.${WATCHER_INSTANCE_ID}.tmp`;
+    writeFileSync(heartbeatTemporary, JSON.stringify({
+      status: "running",
+      pid: process.pid,
+      started_at: WATCHER_STARTED_AT,
+      last_heartbeat_at: new Date().toISOString(),
+      instance_id: WATCHER_INSTANCE_ID,
+      launcher_pid: WATCHER_LAUNCHER_PID,
+    }, null, 2), "utf-8");
+    renameSync(heartbeatTemporary, WATCHER_HEARTBEAT_FILE);
+    // Ensure tasks directory exists
+    if (!existsSync(tasksDir)) return;
+
+    const entries = readdirSync(tasksDir, { withFileTypes: true });
+    const taskDirs = entries.filter((e) => e.isDirectory());
+
+    for (const entry of taskDirs) {
+      const taskId = entry.name;
+
+      // Skip already-executed tasks
+      if (executedTasks.has(taskId)) continue;
+
+      const taskDir = resolve(tasksDir, taskId);
+      const statusFile = join(taskDir, "status.json");
+
+      if (!existsSync(statusFile)) continue;
+
+      let statusData: any;
+      try {
+        statusData = JSON.parse(readFileSync(statusFile, "utf-8"));
+      } catch {
+        continue; // corrupted status, skip
+      }
+
+      if (statusData.status !== "pending") continue;
+
+      // ── Pre-flight safety checks ──
+      try {
+        // Check repo_path
+        guardWorkspacePath(statusData.repo_path || wsRoot, wsRoot);
+
+        // Check agent
+        guardAgentCommand(statusData.agent, config);
+
+        // Check test_command
+        if (statusData.test_command) {
+          guardTestCommand(statusData.test_command, config);
+        }
+      } catch (err) {
+        const errMsg = `[watcher] Safety check failed for ${taskId}: ${err instanceof Error ? err.message : String(err)}`;
+        console.error(errMsg);
+
+        // Write error and mark as failed so it doesn't get re-picked
+        try {
+          writeFileSync(join(taskDir, "error.log"), errMsg, "utf-8");
+          const data = JSON.parse(readFileSync(statusFile, "utf-8"));
+          data.status = "failed";
+          data.error = errMsg;
+          data.updated_at = new Date().toISOString();
+          writeFileSync(statusFile, JSON.stringify(data, null, 2), "utf-8");
+        } catch {}
+        executedTasks.add(taskId);
+        continue;
+      }
+
+      // ── Execute ──
+      console.error(`[watcher] Executing: ${taskId}`);
+      executedTasks.add(taskId);
+
+      try {
+        const result = await runTask(taskId);
+        console.error(`[watcher] ${taskId} → ${result.status}`);
+      } catch (err) {
+        console.error(`[watcher] ${taskId} → error: ${err instanceof Error ? err.message : String(err)}`);
+      }
+    }
+  } catch (err) {
+    console.error(`[watcher] Tick error: ${err instanceof Error ? err.message : String(err)}`);
+  }
+}
+
+// ── Start ─────────────────────────────────────────────────────────
+
+console.error("[watcher] Started");
+setInterval(tick, POLL_INTERVAL_MS);
+
+// Run first tick immediately
+tick();
+
+// Graceful shutdown
+process.on("SIGINT", () => {
+  console.error("[watcher] Stopped");
+  process.exit(0);
+});
+process.on("SIGTERM", () => {
+  console.error("[watcher] Stopped");
+  process.exit(0);
+});

package/src/security/commandGuard.ts

@@ -0,0 +1,97 @@
+import { PatchWardenConfig } from "../config.js";
+import { PatchWardenError } from "../errors.js";
+
+/**
+ * Command guard: ensure only allow-listed commands can execute.
+ *
+ * Rules:
+ * - Agent commands must be registered in config.agents
+ * - Test commands must be in config.allowedTestCommands (exact match)
+ * - No arbitrary shell commands are allowed
+ * - Placeholders {repo} and {prompt} are replaced safely
+ */
+
+export interface AllowedCommand {
+  command: string;
+  args: string[];
+}
+
+export function guardAgentCommand(
+  agent: string,
+  config: PatchWardenConfig
+): AllowedCommand {
+  const agentCfg = config.agents[agent];
+  if (!agentCfg) {
+    throw new PatchWardenError(
+      "agent_not_configured",
+      `Agent "${agent}" is not configured. Allowed agents: ${Object.keys(config.agents).join(", ")}`,
+      "Call list_agents and use one of the configured agent names."
+    );
+  }
+
+  // Validate args don't contain shell metacharacters
+  const resolvedArgs = agentCfg.args.map((arg) => {
+    // {repo} and {prompt} are safe placeholders
+    if (arg === "{repo}" || arg === "{prompt}") return arg;
+    // Other literal args ok
+    return arg;
+  });
+
+  // Validate command or configured executable path.
+  // Absolute paths are allowed only because they come from the local config,
+  // never from the MCP caller. We still reject traversal and shell syntax.
+  if (!isSafeConfiguredCommand(agentCfg.command)) {
+    throw new PatchWardenError(
+      "agent_command_invalid",
+      `Invalid agent command name: "${agentCfg.command}"`,
+      "Fix the locally configured executable path; MCP callers cannot override agent commands."
+    );
+  }
+
+  return { command: agentCfg.command, args: resolvedArgs };
+}
+
+function isSafeConfiguredCommand(command: string): boolean {
+  if (!command || typeof command !== "string") return false;
+  if (/[\x00-\x1F"'`|&;<>()$]/.test(command)) return false;
+
+  const normalized = command.replace(/\\/g, "/");
+  const parts = normalized.split("/");
+  if (parts.some((part) => part === "..")) return false;
+
+  const basename = parts[parts.length - 1] || "";
+  return /^[a-zA-Z0-9._-]+$/.test(basename);
+}
+
+export function guardTestCommand(
+  testCommand: string,
+  config: PatchWardenConfig
+): string {
+  if (!testCommand || typeof testCommand !== "string") {
+    // If no test command specified, that's ok — skip tests
+    return "";
+  }
+
+  const trimmed = testCommand.trim();
+  if (trimmed === "") return "";
+
+  if (!config.allowedTestCommands.includes(trimmed)) {
+    throw new PatchWardenError(
+      "test_command_not_allowlisted",
+      `Test command "${trimmed}" is not in the allowed list. Allowed: ${config.allowedTestCommands.join(", ")}`,
+      "Use an exact allowed command shown by create_task, or omit test_command."
+    );
+  }
+
+  return trimmed;
+}
+
+/**
+ * Escape a user-provided string for safe use in shell arguments.
+ * We prevent injection by refusing to pass arbitrary strings to shell.
+ * Instead, the prompt is passed as a command argument via spawn, not shell.
+ */
+export function sanitizePromptArg(prompt: string): string {
+  // Remove null bytes and control characters
+  return prompt.replace(/[\x00-\x08\x0B\x0C\x0E-\x1F]/g, "");
+}

package/src/security/contentRedaction.ts

@@ -0,0 +1,85 @@
+export interface RedactionResult {
+  content: string;
+  redacted: boolean;
+  redaction_categories: string[];
+}
+
+export interface StructuredRedactionResult<T> {
+  value: T;
+  redacted: boolean;
+  redaction_categories: string[];
+}
+
+interface RedactionRule {
+  category: string;
+  pattern: RegExp;
+  replace: string;
+}
+
+const RULES: RedactionRule[] = [
+  {
+    category: "private_key",
+    pattern: /-----BEGIN [^-\r\n]*PRIVATE KEY-----[\s\S]*?-----END [^-\r\n]*PRIVATE KEY-----/gi,
+    replace: "[REDACTED PRIVATE KEY]",
+  },
+  {
+    category: "bearer_token",
+    pattern: /\bBearer\s+[A-Za-z0-9._~+\/-]{12,}={0,2}/gi,
+    replace: "Bearer [REDACTED]",
+  },
+  {
+    category: "npm_token",
+    pattern: /(\b_?authToken\s*=\s*)[^\s\r\n]+/gi,
+    replace: "$1[REDACTED]",
+  },
+  {
+    category: "credential_assignment",
+    pattern: /\b((?:access[_ -]?token|api[_ -]?key|secret|password|credential|token)\s*[:=]\s*)(["']?)([^\s,"'\]}]{8,})(["']?)/gi,
+    replace: "$1$2[REDACTED]$4",
+  },
+  {
+    category: "known_token_format",
+    pattern: /\b(?:sk|ghp|github_pat)_[A-Za-z0-9_-]{16,}\b/g,
+    replace: "[REDACTED TOKEN]",
+  },
+];
+
+export function redactSensitiveContent(input: string): RedactionResult {
+  let content = input;
+  const categories: string[] = [];
+  for (const rule of RULES) {
+    rule.pattern.lastIndex = 0;
+    if (!rule.pattern.test(content)) continue;
+    rule.pattern.lastIndex = 0;
+    content = content.replace(rule.pattern, rule.replace);
+    categories.push(rule.category);
+  }
+  return {
+    content,
+    redacted: categories.length > 0,
+    redaction_categories: [...new Set(categories)],
+  };
+}
+
+export function redactSensitiveValue<T>(input: T): StructuredRedactionResult<T> {
+  const categories: string[] = [];
+  const visit = (value: unknown): unknown => {
+    if (typeof value === "string") {
+      const result = redactSensitiveContent(value);
+      categories.push(...result.redaction_categories);
+      return result.content;
+    }
+    if (Array.isArray(value)) return value.map(visit);
+    if (value && typeof value === "object") {
+      return Object.fromEntries(
+        Object.entries(value as Record<string, unknown>).map(([key, entry]) => [key, visit(entry)])
+      );
+    }
+    return value;
+  };
+  return {
+    value: visit(input) as T,
+    redacted: categories.length > 0,
+    redaction_categories: [...new Set(categories)],
+  };
+}

package/src/security/pathGuard.ts

@@ -0,0 +1,175 @@
+import {
+  basename,
+  dirname,
+  isAbsolute,
+  normalize,
+  parse,
+  resolve,
+  sep,
+} from "node:path";
+import { realpathSync } from "node:fs";
+import { PatchWardenError } from "../errors.js";
+
+export function guardPath(
+  requestedPath: string,
+  workspaceRoot: string,
+  allowedPrefix?: string
+): string {
+  const ws = normalize(resolve(workspaceRoot));
+  const candidate =
+    requestedPath === "" || requestedPath === "."
+      ? ws
+      : normalize(
+          isAbsolute(requestedPath)
+            ? resolve(requestedPath)
+            : resolve(ws, requestedPath)
+        );
+
+  const realCandidate = realPathOrExistingPrefix(candidate);
+  const realWs = realPathOrSelf(ws);
+
+  assertInside(realCandidate, realWs, requestedPath, "Path escapes workspace");
+
+  if (allowedPrefix) {
+    const prefixPath = normalize(resolve(ws, allowedPrefix));
+    assertInside(
+      realCandidate,
+      realPathOrExistingPrefix(prefixPath),
+      requestedPath,
+      `Path outside allowed prefix: "${requestedPath}" is not under "${allowedPrefix}"`
+    );
+  }
+
+  return normalize(realCandidate);
+}
+
+export function guardReadPath(
+  requestedPath: string,
+  workspaceRoot: string,
+  allowedPrefix?: string
+): string {
+  const guarded = guardPath(requestedPath, workspaceRoot, allowedPrefix);
+
+  try {
+    return realpathSync(guarded);
+  } catch {
+    throw new Error(`File not found: "${requestedPath}"`);
+  }
+}
+
+export function guardWorkspacePath(
+  inputPath: string,
+  workspaceRoot: string
+): string {
+  const ws = normalize(resolve(workspaceRoot));
+  const input = inputPath || ".";
+
+  const winDriveMatch = input.match(/^([A-Za-z]):[/\\]/);
+  const wsDriveMatch = ws.match(/^([A-Za-z]):[/\\]/);
+  if (winDriveMatch && wsDriveMatch) {
+    if (winDriveMatch[1].toLowerCase() !== wsDriveMatch[1].toLowerCase()) {
+      throw new PatchWardenError(
+        "workspace_path_escape",
+        `repo_path "${input}" is on drive ${winDriveMatch[1].toUpperCase()}: ` +
+          `but workspace is on drive ${wsDriveMatch[1].toUpperCase()}:. All paths must be under the configured workspace.`,
+        "Pass a repo_path located under the configured workspaceRoot.",
+        true,
+        { path: input, operation: "resolve_repo_path", safe_alternative: "Use a repository path inside workspaceRoot." }
+      );
+    }
+  } else if (winDriveMatch && !wsDriveMatch) {
+    throw new PatchWardenError(
+      "workspace_path_escape",
+      `repo_path "${input}" appears to be a Windows path but workspace ` +
+        `"${workspaceRoot}" is a Unix path. All paths must be under the configured workspace.`,
+      "Use the same path style as workspaceRoot and keep repo_path inside it.",
+      true,
+      { path: input, operation: "resolve_repo_path", safe_alternative: "Use the workspaceRoot path style and an internal repository path." }
+    );
+  }
+
+  const resolved = normalize(
+    isAbsolute(input) ? resolve(input) : resolve(ws, input)
+  );
+  const realResolved = realPathOrExistingPrefix(resolved);
+  const realWs = realPathOrSelf(ws);
+
+  assertInside(
+    realResolved,
+    realWs,
+    input,
+    `repo_path "${input}" is outside workspace "${workspaceRoot}". All paths must be under the configured workspace.`
+  );
+
+  return normalize(realResolved);
+}
+
+function realPathOrSelf(value: string): string {
+  try {
+    return realpathSync(value);
+  } catch {
+    return normalize(value);
+  }
+}
+
+function realPathOrExistingPrefix(candidate: string): string {
+  const normalized = normalize(candidate);
+  const root = parse(normalized).root;
+  const suffix: string[] = [];
+  let current = normalized;
+
+  while (current && current !== root) {
+    try {
+      return resolve(realpathSync(current), ...suffix);
+    } catch {
+      suffix.unshift(basename(current));
+      const parent = dirname(current);
+      if (parent === current) break;
+      current = parent;
+    }
+  }
+
+  try {
+    return resolve(realpathSync(root || current), ...suffix);
+  } catch {
+    return normalized;
+  }
+}
+
+function assertInside(
+  candidate: string,
+  root: string,
+  requestedPath: string,
+  message: string
+): void {
+  const normalizedRoot = normalize(root);
+  const normalizedCandidate = normalize(candidate);
+  const checkRoot = process.platform === "win32"
+    ? normalizedRoot.toLowerCase()
+    : normalizedRoot;
+  const checkCandidate = process.platform === "win32"
+    ? normalizedCandidate.toLowerCase()
+    : normalizedCandidate;
+
+  if (
+    checkCandidate !== checkRoot &&
+    !checkCandidate.startsWith(checkRoot + sep)
+  ) {
+    if (message.startsWith("Path escapes workspace")) {
+      throw new PatchWardenError(
+        "workspace_path_escape",
+        `Path escapes workspace: "${requestedPath}" resolves to "${normalizedCandidate}" which is outside "${normalizedRoot}"`,
+        "Use a path inside the configured workspace and allowed prefix.",
+        true,
+        { path: requestedPath, operation: "path_access", safe_alternative: "Read a path inside the configured workspace and allowed prefix." }
+      );
+    }
+    throw new PatchWardenError(
+      "workspace_path_escape",
+      message,
+      "Use a path inside the configured workspace and allowed prefix.",
+      true,
+      { path: requestedPath, operation: "path_access", safe_alternative: "Read a path inside the configured workspace and allowed prefix." }
+    );
+  }
+}

package/src/security/planGuard.ts

@@ -0,0 +1,93 @@
+import { PatchWardenError } from "../errors.js";
+
+interface PlanRule {
+  id: string;
+  category: string;
+  pattern: RegExp;
+  suggestion: string;
+}
+
+const PLAN_RULES: PlanRule[] = [
+  {
+    id: "plan_secret_access",
+    category: "credential_access",
+    pattern: /(?:\b(?:read|open|cat|dump|extract|steal|exfiltrat\w*|leak)\b|读取|查看|打开|导出|窃取|泄露)[^.!?;。！？；\r\n]{0,60}?(?:\.env\b|\.npmrc\b|access[ _-]?token|api[ _-]?key|token\b|credentials?\b|id_rsa\b|id_ed25519\b|ssh[^.!?;。！？；\r\n]{0,12}private[^.!?;。！？；\r\n]{0,8}key|private[^.!?;。！？；\r\n]{0,8}key|密钥|令牌|凭据|私钥)/is,
+    suggestion: "Rewrite the plan to avoid reading, exporting, or exposing credentials and secret files.",
+  },
+  {
+    id: "plan_secret_access_reversed",
+    category: "credential_access",
+    pattern: /(?:\.env\b|\.npmrc\b|access[ _-]?token|api[ _-]?key|credentials?\b|id_rsa\b|id_ed25519\b|ssh[^.!?;。！？；\r\n]{0,12}private[^.!?;。！？；\r\n]{0,8}key|private[^.!?;。！？；\r\n]{0,8}key|密钥|令牌|凭据|私钥)[^.!?;。！？；\r\n]{0,60}?(?:\b(?:read|open|cat|dump|extract|steal|exfiltrat\w*|leak)\b|读取|查看|打开|导出|窃取|泄露)/is,
+    suggestion: "Rewrite the plan to avoid reading, exporting, or exposing credentials and secret files.",
+  },
+  {
+    id: "plan_destructive_delete",
+    category: "destructive_disk_operation",
+    pattern: /(?:rm\s+-rf\s+(?:\/|~|[a-z]:[\\/])|remove-item.{0,80}(?:c:\\users|recurse.{0,20}force)|删除.{0,30}(?:用户目录|主目录|整个磁盘|全盘|系统盘)|清空.{0,20}(?:磁盘|用户目录|主目录))/is,
+    suggestion: "Limit deletion to explicit project-local temporary files and require a preview or backup first.",
+  },
+  {
+    id: "plan_malicious_persistence",
+    category: "malicious_persistence_or_exfiltration",
+    pattern: /(?:\b(?:install|create|deploy)\b|植入|安装|创建).{0,50}(?:backdoor|keylogger|credential stealer|data stealer|后门|键盘记录|窃密)|(?:\b(?:persist|persistence)\b|持久化).{0,40}(?:malware|payload|backdoor|恶意|后门)/is,
+    suggestion: "Remove persistence, backdoor, credential theft, or data-exfiltration instructions.",
+  },
+];
+
+export function guardPlanContent(title: string, content: string): void {
+  const text = `${title}\n${content}`;
+  for (const rule of PLAN_RULES) {
+    for (const match of text.matchAll(globalPattern(rule.pattern))) {
+      const index = match.index ?? 0;
+      if (isDirectlyNegated(text, index, match[0])) continue;
+
+      throw new PatchWardenError(
+        rule.id,
+        `save_plan blocked content in category "${rule.category}".`,
+        rule.suggestion,
+        true,
+        {
+          operation: "save_plan",
+          matched_category: rule.category,
+          matched_text: match[0].slice(0, 160),
+        }
+      );
+    }
+  }
+}
+
+function globalPattern(pattern: RegExp): RegExp {
+  const flags = pattern.flags.includes("g") ? pattern.flags : `${pattern.flags}g`;
+  return new RegExp(pattern.source, flags);
+}
+
+function isDirectlyNegated(text: string, matchIndex: number, matchedText: string): boolean {
+  const prefix = currentClause(text.slice(Math.max(0, matchIndex - 160), matchIndex));
+  const englishDirect = /\b(?:do not|don't|never|must not|should not|shall not|cannot|can't|won't|shouldn't|mustn't|avoid|refrain from|forbids?|blocks?|prevents?)\s+(?:(?:any|all|the|a|an|users?|agents?|tools?|process(?:es)?|attempts?)\s+){0,5}(?:(?:from|to)\s+)?$/i;
+  const chineseDirect = /(?:禁止|不要|不得|严禁|避免|防止|阻止|勿|别|不可|不应)(?:(?:任何|所有|用户|代理|工具|程序|进程|尝试|执行|进行)\s*){0,4}$/;
+  if (englishDirect.test(prefix) || chineseDirect.test(prefix)) return true;
+
+  const clauseAndMatch = `${prefix}${matchedText}`;
+  const englishNegatedAction = /\b(?:do not|don't|never|must not|should not|shall not|cannot|can't|won't|shouldn't|mustn't|avoid|refrain from|forbids?|blocks?|prevents?)\s+(?:(?:any|all|the|a|an|users?|agents?|tools?|process(?:es)?|attempts?)\s+){0,5}(?:(?:from|to)\s+)?(?:read|open|cat|dump|extract|steal|exfiltrat\w*|leak|delete|remove|install|create|deploy)\b/i;
+  const chineseNegatedAction = /(?:禁止|不要|不得|严禁|避免|防止|阻止|勿|别|不可|不应)(?:(?:任何|所有|用户|代理|工具|程序|进程|尝试|执行|进行)\s*){0,4}(?:读取|查看|打开|导出|窃取|泄露|删除|安装|创建|植入)/s;
+  if (englishNegatedAction.test(clauseAndMatch) || chineseNegatedAction.test(clauseAndMatch)) return true;
+
+  const englishReversed = /\b(?:must not|should not|shall not|cannot|can't|may not|never)\s+be\s+(?:read|opened|dumped|extracted|exported|deleted|removed|installed|created|deployed)\b/i;
+  const chineseReversed = /(?:禁止|不得|严禁|不可|不应).{0,12}(?:读取|查看|打开|导出|窃取|泄露|删除|安装|创建|植入)/s;
+  return englishReversed.test(matchedText) || chineseReversed.test(matchedText);
+}
+
+function currentClause(prefix: string): string {
+  const boundary = Math.max(
+    prefix.lastIndexOf("\n"),
+    prefix.lastIndexOf("."),
+    prefix.lastIndexOf("!"),
+    prefix.lastIndexOf("?"),
+    prefix.lastIndexOf(";"),
+    prefix.lastIndexOf("。"),
+    prefix.lastIndexOf("！"),
+    prefix.lastIndexOf("？"),
+    prefix.lastIndexOf("；")
+  );
+  return prefix.slice(boundary + 1);
+}

package/src/security/sensitiveGuard.ts

@@ -0,0 +1,72 @@
+import { PatchWardenError } from "../errors.js";
+
+/**
+ * Sensitive file guard: block reads of files likely to contain secrets.
+ * Returns true if the file is ALLOWED (not sensitive).
+ */
+const SENSITIVE_PATTERNS = [
+  // Exact filenames
+  /(?:^|[\\/])\.env$/i,
+  /(?:^|[\\/])\.env\..+$/i,
+  /(?:^|[\\/])id_rsa$/i,
+  /(?:^|[\\/])id_ed25519$/i,
+  /(?:^|[\\/])id_ecdsa$/i,
+  /(?:^|[\\/])\.ssh[\\/]/i,
+  // Credentials / tokens
+  /(?:^|[\\/])credentials/i,
+  /(?:^|[\\/])\.?aws[\\/]credentials/i,
+  /(?:^|[\\/])\.netrc$/i,
+  /(?:^|[\\/])\.npmrc$/i,
+  /(?:^|[\\/])\.pypirc$/i,
+  /(?:^|[\\/])token/i,
+  // Private keys
+  /(?:^|[\\/])[^.]+\.pem$/i,
+  /(?:^|[\\/])[^.]+\.key$/i,
+  /(?:^|[\\/])[^.]+\.pfx$/i,
+  /(?:^|[\\/])[^.]+\.p12$/i,
+  // Browser data
+  /(?:^|[\\/])cookies/i,
+  /(?:^|[\\/])web data$/i,
+  /(?:^|[\\/])login data$/i,
+  /(?:^|[\\/])local state$/i,
+  // Other sensitive files
+  /(?:^|[\\/])\.git-credentials$/i,
+  /(?:^|[\\/])\.docker[\\/]config\.json$/i,
+  /(?:^|[\\/])\.kube[\\/]config$/i,
+  /(?:^|[\\/])config\.json$/i, // generic config files often contain local tokens or service credentials
+];
+
+// Files specifically inside .patchwarden are always allowed
+const SAFE_PREFIX = ".patchwarden";
+
+export function isSensitivePath(filePath: string): boolean {
+  // Files inside .patchwarden are always safe
+  const normalized = filePath.replace(/\\/g, "/");
+  if (normalized.includes(`${SAFE_PREFIX}/`) || normalized.endsWith(SAFE_PREFIX)) {
+    return false;
+  }
+
+  for (const pattern of SENSITIVE_PATTERNS) {
+    if (pattern.test(filePath)) {
+      return true;
+    }
+  }
+
+  return false;
+}
+
+export function guardSensitivePath(filePath: string): void {
+  if (isSensitivePath(filePath)) {
+    throw new PatchWardenError(
+      "sensitive_path_blocked",
+      `Access denied: "${filePath}" matches a sensitive file pattern. Reading this file is not permitted.`,
+      "Read only non-sensitive task artifacts or workspace files.",
+      true,
+      {
+        path: filePath,
+        operation: "read",
+        safe_alternative: "Read a non-sensitive task artifact, or remove secret material and retry.",
+      }
+    );
+  }
+}