patchwarden 0.4.0

package/dist/runner/watch.d.ts

@@ -0,0 +1,19 @@
+#!/usr/bin/env node
+/**
+ * PatchWarden Watcher
+ *
+ * Polls .patchwarden/tasks/ for pending tasks and executes them automatically.
+ * This is the recommended way to run tasks — ChatGPT creates tasks,
+ * the watcher picks them up and runs them locally.
+ *
+ * Safety invariants (enforced every tick):
+ *  - repo_path must be inside workspace
+ *  - agent must be in allowlist
+ *  - test_command must be in allowlist (or empty)
+ *  - Each task runs at most once (no retry loop)
+ *  - No auto commit, no auto push, no file deletion
+ *
+ * Run: node dist/runner/watch.js
+ *   or: npm run watch
+ */
+export {};

package/dist/runner/watch.js

@@ -0,0 +1,136 @@
+#!/usr/bin/env node
+/**
+ * PatchWarden Watcher
+ *
+ * Polls .patchwarden/tasks/ for pending tasks and executes them automatically.
+ * This is the recommended way to run tasks — ChatGPT creates tasks,
+ * the watcher picks them up and runs them locally.
+ *
+ * Safety invariants (enforced every tick):
+ *  - repo_path must be inside workspace
+ *  - agent must be in allowlist
+ *  - test_command must be in allowlist (or empty)
+ *  - Each task runs at most once (no retry loop)
+ *  - No auto commit, no auto push, no file deletion
+ *
+ * Run: node dist/runner/watch.js
+ *   or: npm run watch
+ */
+import { readdirSync, readFileSync, existsSync, writeFileSync, mkdirSync, renameSync } from "node:fs";
+import { resolve, join, dirname } from "node:path";
+import { loadConfig, getConfig, getTasksDir, resolveWorkspaceRoot } from "../config.js";
+import { guardWorkspacePath } from "../security/pathGuard.js";
+import { guardAgentCommand, guardTestCommand } from "../security/commandGuard.js";
+import { runTask } from "./runTask.js";
+// ── Bootstrap ─────────────────────────────────────────────────────
+loadConfig();
+const config = getConfig();
+const tasksDir = getTasksDir(config);
+const wsRoot = resolveWorkspaceRoot(config);
+const POLL_INTERVAL_MS = 4000;
+const WATCHER_HEARTBEAT_FILE = join(dirname(tasksDir), "watcher-heartbeat.json");
+const WATCHER_STARTED_AT = new Date().toISOString();
+const WATCHER_INSTANCE_ID = process.env.PATCHWARDEN_WATCHER_INSTANCE_ID || `standalone-${process.pid}-${Date.now()}`;
+const WATCHER_LAUNCHER_PID = Number.isInteger(Number(process.env.PATCHWARDEN_WATCHER_LAUNCHER_PID))
+    ? Number(process.env.PATCHWARDEN_WATCHER_LAUNCHER_PID)
+    : null;
+mkdirSync(dirname(WATCHER_HEARTBEAT_FILE), { recursive: true });
+console.error(`[watcher] Workspace: ${wsRoot}`);
+console.error(`[watcher] Tasks:    ${tasksDir}`);
+console.error(`[watcher] Polling every ${POLL_INTERVAL_MS / 1000}s`);
+console.error(`[watcher] Press Ctrl+C to stop`);
+// Track executed tasks to prevent re-execution
+const executedTasks = new Set();
+// ── Main loop ─────────────────────────────────────────────────────
+async function tick() {
+    try {
+        const heartbeatTemporary = `${WATCHER_HEARTBEAT_FILE}.${WATCHER_INSTANCE_ID}.tmp`;
+        writeFileSync(heartbeatTemporary, JSON.stringify({
+            status: "running",
+            pid: process.pid,
+            started_at: WATCHER_STARTED_AT,
+            last_heartbeat_at: new Date().toISOString(),
+            instance_id: WATCHER_INSTANCE_ID,
+            launcher_pid: WATCHER_LAUNCHER_PID,
+        }, null, 2), "utf-8");
+        renameSync(heartbeatTemporary, WATCHER_HEARTBEAT_FILE);
+        // Ensure tasks directory exists
+        if (!existsSync(tasksDir))
+            return;
+        const entries = readdirSync(tasksDir, { withFileTypes: true });
+        const taskDirs = entries.filter((e) => e.isDirectory());
+        for (const entry of taskDirs) {
+            const taskId = entry.name;
+            // Skip already-executed tasks
+            if (executedTasks.has(taskId))
+                continue;
+            const taskDir = resolve(tasksDir, taskId);
+            const statusFile = join(taskDir, "status.json");
+            if (!existsSync(statusFile))
+                continue;
+            let statusData;
+            try {
+                statusData = JSON.parse(readFileSync(statusFile, "utf-8"));
+            }
+            catch {
+                continue; // corrupted status, skip
+            }
+            if (statusData.status !== "pending")
+                continue;
+            // ── Pre-flight safety checks ──
+            try {
+                // Check repo_path
+                guardWorkspacePath(statusData.repo_path || wsRoot, wsRoot);
+                // Check agent
+                guardAgentCommand(statusData.agent, config);
+                // Check test_command
+                if (statusData.test_command) {
+                    guardTestCommand(statusData.test_command, config);
+                }
+            }
+            catch (err) {
+                const errMsg = `[watcher] Safety check failed for ${taskId}: ${err instanceof Error ? err.message : String(err)}`;
+                console.error(errMsg);
+                // Write error and mark as failed so it doesn't get re-picked
+                try {
+                    writeFileSync(join(taskDir, "error.log"), errMsg, "utf-8");
+                    const data = JSON.parse(readFileSync(statusFile, "utf-8"));
+                    data.status = "failed";
+                    data.error = errMsg;
+                    data.updated_at = new Date().toISOString();
+                    writeFileSync(statusFile, JSON.stringify(data, null, 2), "utf-8");
+                }
+                catch { }
+                executedTasks.add(taskId);
+                continue;
+            }
+            // ── Execute ──
+            console.error(`[watcher] Executing: ${taskId}`);
+            executedTasks.add(taskId);
+            try {
+                const result = await runTask(taskId);
+                console.error(`[watcher] ${taskId} → ${result.status}`);
+            }
+            catch (err) {
+                console.error(`[watcher] ${taskId} → error: ${err instanceof Error ? err.message : String(err)}`);
+            }
+        }
+    }
+    catch (err) {
+        console.error(`[watcher] Tick error: ${err instanceof Error ? err.message : String(err)}`);
+    }
+}
+// ── Start ─────────────────────────────────────────────────────────
+console.error("[watcher] Started");
+setInterval(tick, POLL_INTERVAL_MS);
+// Run first tick immediately
+tick();
+// Graceful shutdown
+process.on("SIGINT", () => {
+    console.error("[watcher] Stopped");
+    process.exit(0);
+});
+process.on("SIGTERM", () => {
+    console.error("[watcher] Stopped");
+    process.exit(0);
+});

package/dist/security/commandGuard.d.ts

@@ -0,0 +1,22 @@
+import { PatchWardenConfig } from "../config.js";
+/**
+ * Command guard: ensure only allow-listed commands can execute.
+ *
+ * Rules:
+ * - Agent commands must be registered in config.agents
+ * - Test commands must be in config.allowedTestCommands (exact match)
+ * - No arbitrary shell commands are allowed
+ * - Placeholders {repo} and {prompt} are replaced safely
+ */
+export interface AllowedCommand {
+    command: string;
+    args: string[];
+}
+export declare function guardAgentCommand(agent: string, config: PatchWardenConfig): AllowedCommand;
+export declare function guardTestCommand(testCommand: string, config: PatchWardenConfig): string;
+/**
+ * Escape a user-provided string for safe use in shell arguments.
+ * We prevent injection by refusing to pass arbitrary strings to shell.
+ * Instead, the prompt is passed as a command argument via spawn, not shell.
+ */
+export declare function sanitizePromptArg(prompt: string): string;

package/dist/security/commandGuard.js

@@ -0,0 +1,56 @@
+import { PatchWardenError } from "../errors.js";
+export function guardAgentCommand(agent, config) {
+    const agentCfg = config.agents[agent];
+    if (!agentCfg) {
+        throw new PatchWardenError("agent_not_configured", `Agent "${agent}" is not configured. Allowed agents: ${Object.keys(config.agents).join(", ")}`, "Call list_agents and use one of the configured agent names.");
+    }
+    // Validate args don't contain shell metacharacters
+    const resolvedArgs = agentCfg.args.map((arg) => {
+        // {repo} and {prompt} are safe placeholders
+        if (arg === "{repo}" || arg === "{prompt}")
+            return arg;
+        // Other literal args ok
+        return arg;
+    });
+    // Validate command or configured executable path.
+    // Absolute paths are allowed only because they come from the local config,
+    // never from the MCP caller. We still reject traversal and shell syntax.
+    if (!isSafeConfiguredCommand(agentCfg.command)) {
+        throw new PatchWardenError("agent_command_invalid", `Invalid agent command name: "${agentCfg.command}"`, "Fix the locally configured executable path; MCP callers cannot override agent commands.");
+    }
+    return { command: agentCfg.command, args: resolvedArgs };
+}
+function isSafeConfiguredCommand(command) {
+    if (!command || typeof command !== "string")
+        return false;
+    if (/[\x00-\x1F"'`|&;<>()$]/.test(command))
+        return false;
+    const normalized = command.replace(/\\/g, "/");
+    const parts = normalized.split("/");
+    if (parts.some((part) => part === ".."))
+        return false;
+    const basename = parts[parts.length - 1] || "";
+    return /^[a-zA-Z0-9._-]+$/.test(basename);
+}
+export function guardTestCommand(testCommand, config) {
+    if (!testCommand || typeof testCommand !== "string") {
+        // If no test command specified, that's ok — skip tests
+        return "";
+    }
+    const trimmed = testCommand.trim();
+    if (trimmed === "")
+        return "";
+    if (!config.allowedTestCommands.includes(trimmed)) {
+        throw new PatchWardenError("test_command_not_allowlisted", `Test command "${trimmed}" is not in the allowed list. Allowed: ${config.allowedTestCommands.join(", ")}`, "Use an exact allowed command shown by create_task, or omit test_command.");
+    }
+    return trimmed;
+}
+/**
+ * Escape a user-provided string for safe use in shell arguments.
+ * We prevent injection by refusing to pass arbitrary strings to shell.
+ * Instead, the prompt is passed as a command argument via spawn, not shell.
+ */
+export function sanitizePromptArg(prompt) {
+    // Remove null bytes and control characters
+    return prompt.replace(/[\x00-\x08\x0B\x0C\x0E-\x1F]/g, "");
+}

package/dist/security/contentRedaction.d.ts

@@ -0,0 +1,12 @@
+export interface RedactionResult {
+    content: string;
+    redacted: boolean;
+    redaction_categories: string[];
+}
+export interface StructuredRedactionResult<T> {
+    value: T;
+    redacted: boolean;
+    redaction_categories: string[];
+}
+export declare function redactSensitiveContent(input: string): RedactionResult;
+export declare function redactSensitiveValue<T>(input: T): StructuredRedactionResult<T>;

package/dist/security/contentRedaction.js

@@ -0,0 +1,65 @@
+const RULES = [
+    {
+        category: "private_key",
+        pattern: /-----BEGIN [^-\r\n]*PRIVATE KEY-----[\s\S]*?-----END [^-\r\n]*PRIVATE KEY-----/gi,
+        replace: "[REDACTED PRIVATE KEY]",
+    },
+    {
+        category: "bearer_token",
+        pattern: /\bBearer\s+[A-Za-z0-9._~+\/-]{12,}={0,2}/gi,
+        replace: "Bearer [REDACTED]",
+    },
+    {
+        category: "npm_token",
+        pattern: /(\b_?authToken\s*=\s*)[^\s\r\n]+/gi,
+        replace: "$1[REDACTED]",
+    },
+    {
+        category: "credential_assignment",
+        pattern: /\b((?:access[_ -]?token|api[_ -]?key|secret|password|credential|token)\s*[:=]\s*)(["']?)([^\s,"'\]}]{8,})(["']?)/gi,
+        replace: "$1$2[REDACTED]$4",
+    },
+    {
+        category: "known_token_format",
+        pattern: /\b(?:sk|ghp|github_pat)_[A-Za-z0-9_-]{16,}\b/g,
+        replace: "[REDACTED TOKEN]",
+    },
+];
+export function redactSensitiveContent(input) {
+    let content = input;
+    const categories = [];
+    for (const rule of RULES) {
+        rule.pattern.lastIndex = 0;
+        if (!rule.pattern.test(content))
+            continue;
+        rule.pattern.lastIndex = 0;
+        content = content.replace(rule.pattern, rule.replace);
+        categories.push(rule.category);
+    }
+    return {
+        content,
+        redacted: categories.length > 0,
+        redaction_categories: [...new Set(categories)],
+    };
+}
+export function redactSensitiveValue(input) {
+    const categories = [];
+    const visit = (value) => {
+        if (typeof value === "string") {
+            const result = redactSensitiveContent(value);
+            categories.push(...result.redaction_categories);
+            return result.content;
+        }
+        if (Array.isArray(value))
+            return value.map(visit);
+        if (value && typeof value === "object") {
+            return Object.fromEntries(Object.entries(value).map(([key, entry]) => [key, visit(entry)]));
+        }
+        return value;
+    };
+    return {
+        value: visit(input),
+        redacted: categories.length > 0,
+        redaction_categories: [...new Set(categories)],
+    };
+}

package/dist/security/pathGuard.d.ts

@@ -0,0 +1,3 @@
+export declare function guardPath(requestedPath: string, workspaceRoot: string, allowedPrefix?: string): string;
+export declare function guardReadPath(requestedPath: string, workspaceRoot: string, allowedPrefix?: string): string;
+export declare function guardWorkspacePath(inputPath: string, workspaceRoot: string): string;

package/dist/security/pathGuard.js

@@ -0,0 +1,98 @@
+import { basename, dirname, isAbsolute, normalize, parse, resolve, sep, } from "node:path";
+import { realpathSync } from "node:fs";
+import { PatchWardenError } from "../errors.js";
+export function guardPath(requestedPath, workspaceRoot, allowedPrefix) {
+    const ws = normalize(resolve(workspaceRoot));
+    const candidate = requestedPath === "" || requestedPath === "."
+        ? ws
+        : normalize(isAbsolute(requestedPath)
+            ? resolve(requestedPath)
+            : resolve(ws, requestedPath));
+    const realCandidate = realPathOrExistingPrefix(candidate);
+    const realWs = realPathOrSelf(ws);
+    assertInside(realCandidate, realWs, requestedPath, "Path escapes workspace");
+    if (allowedPrefix) {
+        const prefixPath = normalize(resolve(ws, allowedPrefix));
+        assertInside(realCandidate, realPathOrExistingPrefix(prefixPath), requestedPath, `Path outside allowed prefix: "${requestedPath}" is not under "${allowedPrefix}"`);
+    }
+    return normalize(realCandidate);
+}
+export function guardReadPath(requestedPath, workspaceRoot, allowedPrefix) {
+    const guarded = guardPath(requestedPath, workspaceRoot, allowedPrefix);
+    try {
+        return realpathSync(guarded);
+    }
+    catch {
+        throw new Error(`File not found: "${requestedPath}"`);
+    }
+}
+export function guardWorkspacePath(inputPath, workspaceRoot) {
+    const ws = normalize(resolve(workspaceRoot));
+    const input = inputPath || ".";
+    const winDriveMatch = input.match(/^([A-Za-z]):[/\\]/);
+    const wsDriveMatch = ws.match(/^([A-Za-z]):[/\\]/);
+    if (winDriveMatch && wsDriveMatch) {
+        if (winDriveMatch[1].toLowerCase() !== wsDriveMatch[1].toLowerCase()) {
+            throw new PatchWardenError("workspace_path_escape", `repo_path "${input}" is on drive ${winDriveMatch[1].toUpperCase()}: ` +
+                `but workspace is on drive ${wsDriveMatch[1].toUpperCase()}:. All paths must be under the configured workspace.`, "Pass a repo_path located under the configured workspaceRoot.", true, { path: input, operation: "resolve_repo_path", safe_alternative: "Use a repository path inside workspaceRoot." });
+        }
+    }
+    else if (winDriveMatch && !wsDriveMatch) {
+        throw new PatchWardenError("workspace_path_escape", `repo_path "${input}" appears to be a Windows path but workspace ` +
+            `"${workspaceRoot}" is a Unix path. All paths must be under the configured workspace.`, "Use the same path style as workspaceRoot and keep repo_path inside it.", true, { path: input, operation: "resolve_repo_path", safe_alternative: "Use the workspaceRoot path style and an internal repository path." });
+    }
+    const resolved = normalize(isAbsolute(input) ? resolve(input) : resolve(ws, input));
+    const realResolved = realPathOrExistingPrefix(resolved);
+    const realWs = realPathOrSelf(ws);
+    assertInside(realResolved, realWs, input, `repo_path "${input}" is outside workspace "${workspaceRoot}". All paths must be under the configured workspace.`);
+    return normalize(realResolved);
+}
+function realPathOrSelf(value) {
+    try {
+        return realpathSync(value);
+    }
+    catch {
+        return normalize(value);
+    }
+}
+function realPathOrExistingPrefix(candidate) {
+    const normalized = normalize(candidate);
+    const root = parse(normalized).root;
+    const suffix = [];
+    let current = normalized;
+    while (current && current !== root) {
+        try {
+            return resolve(realpathSync(current), ...suffix);
+        }
+        catch {
+            suffix.unshift(basename(current));
+            const parent = dirname(current);
+            if (parent === current)
+                break;
+            current = parent;
+        }
+    }
+    try {
+        return resolve(realpathSync(root || current), ...suffix);
+    }
+    catch {
+        return normalized;
+    }
+}
+function assertInside(candidate, root, requestedPath, message) {
+    const normalizedRoot = normalize(root);
+    const normalizedCandidate = normalize(candidate);
+    const checkRoot = process.platform === "win32"
+        ? normalizedRoot.toLowerCase()
+        : normalizedRoot;
+    const checkCandidate = process.platform === "win32"
+        ? normalizedCandidate.toLowerCase()
+        : normalizedCandidate;
+    if (checkCandidate !== checkRoot &&
+        !checkCandidate.startsWith(checkRoot + sep)) {
+        if (message.startsWith("Path escapes workspace")) {
+            throw new PatchWardenError("workspace_path_escape", `Path escapes workspace: "${requestedPath}" resolves to "${normalizedCandidate}" which is outside "${normalizedRoot}"`, "Use a path inside the configured workspace and allowed prefix.", true, { path: requestedPath, operation: "path_access", safe_alternative: "Read a path inside the configured workspace and allowed prefix." });
+        }
+        throw new PatchWardenError("workspace_path_escape", message, "Use a path inside the configured workspace and allowed prefix.", true, { path: requestedPath, operation: "path_access", safe_alternative: "Read a path inside the configured workspace and allowed prefix." });
+    }
+}

package/dist/security/planGuard.d.ts

@@ -0,0 +1 @@
+export declare function guardPlanContent(title: string, content: string): void;

package/dist/security/planGuard.js

@@ -0,0 +1,65 @@
+import { PatchWardenError } from "../errors.js";
+const PLAN_RULES = [
+    {
+        id: "plan_secret_access",
+        category: "credential_access",
+        pattern: /(?:\b(?:read|open|cat|dump|extract|steal|exfiltrat\w*|leak)\b|读取|查看|打开|导出|窃取|泄露)[^.!?;。！？；\r\n]{0,60}?(?:\.env\b|\.npmrc\b|access[ _-]?token|api[ _-]?key|token\b|credentials?\b|id_rsa\b|id_ed25519\b|ssh[^.!?;。！？；\r\n]{0,12}private[^.!?;。！？；\r\n]{0,8}key|private[^.!?;。！？；\r\n]{0,8}key|密钥|令牌|凭据|私钥)/is,
+        suggestion: "Rewrite the plan to avoid reading, exporting, or exposing credentials and secret files.",
+    },
+    {
+        id: "plan_secret_access_reversed",
+        category: "credential_access",
+        pattern: /(?:\.env\b|\.npmrc\b|access[ _-]?token|api[ _-]?key|credentials?\b|id_rsa\b|id_ed25519\b|ssh[^.!?;。！？；\r\n]{0,12}private[^.!?;。！？；\r\n]{0,8}key|private[^.!?;。！？；\r\n]{0,8}key|密钥|令牌|凭据|私钥)[^.!?;。！？；\r\n]{0,60}?(?:\b(?:read|open|cat|dump|extract|steal|exfiltrat\w*|leak)\b|读取|查看|打开|导出|窃取|泄露)/is,
+        suggestion: "Rewrite the plan to avoid reading, exporting, or exposing credentials and secret files.",
+    },
+    {
+        id: "plan_destructive_delete",
+        category: "destructive_disk_operation",
+        pattern: /(?:rm\s+-rf\s+(?:\/|~|[a-z]:[\\/])|remove-item.{0,80}(?:c:\\users|recurse.{0,20}force)|删除.{0,30}(?:用户目录|主目录|整个磁盘|全盘|系统盘)|清空.{0,20}(?:磁盘|用户目录|主目录))/is,
+        suggestion: "Limit deletion to explicit project-local temporary files and require a preview or backup first.",
+    },
+    {
+        id: "plan_malicious_persistence",
+        category: "malicious_persistence_or_exfiltration",
+        pattern: /(?:\b(?:install|create|deploy)\b|植入|安装|创建).{0,50}(?:backdoor|keylogger|credential stealer|data stealer|后门|键盘记录|窃密)|(?:\b(?:persist|persistence)\b|持久化).{0,40}(?:malware|payload|backdoor|恶意|后门)/is,
+        suggestion: "Remove persistence, backdoor, credential theft, or data-exfiltration instructions.",
+    },
+];
+export function guardPlanContent(title, content) {
+    const text = `${title}\n${content}`;
+    for (const rule of PLAN_RULES) {
+        for (const match of text.matchAll(globalPattern(rule.pattern))) {
+            const index = match.index ?? 0;
+            if (isDirectlyNegated(text, index, match[0]))
+                continue;
+            throw new PatchWardenError(rule.id, `save_plan blocked content in category "${rule.category}".`, rule.suggestion, true, {
+                operation: "save_plan",
+                matched_category: rule.category,
+                matched_text: match[0].slice(0, 160),
+            });
+        }
+    }
+}
+function globalPattern(pattern) {
+    const flags = pattern.flags.includes("g") ? pattern.flags : `${pattern.flags}g`;
+    return new RegExp(pattern.source, flags);
+}
+function isDirectlyNegated(text, matchIndex, matchedText) {
+    const prefix = currentClause(text.slice(Math.max(0, matchIndex - 160), matchIndex));
+    const englishDirect = /\b(?:do not|don't|never|must not|should not|shall not|cannot|can't|won't|shouldn't|mustn't|avoid|refrain from|forbids?|blocks?|prevents?)\s+(?:(?:any|all|the|a|an|users?|agents?|tools?|process(?:es)?|attempts?)\s+){0,5}(?:(?:from|to)\s+)?$/i;
+    const chineseDirect = /(?:禁止|不要|不得|严禁|避免|防止|阻止|勿|别|不可|不应)(?:(?:任何|所有|用户|代理|工具|程序|进程|尝试|执行|进行)\s*){0,4}$/;
+    if (englishDirect.test(prefix) || chineseDirect.test(prefix))
+        return true;
+    const clauseAndMatch = `${prefix}${matchedText}`;
+    const englishNegatedAction = /\b(?:do not|don't|never|must not|should not|shall not|cannot|can't|won't|shouldn't|mustn't|avoid|refrain from|forbids?|blocks?|prevents?)\s+(?:(?:any|all|the|a|an|users?|agents?|tools?|process(?:es)?|attempts?)\s+){0,5}(?:(?:from|to)\s+)?(?:read|open|cat|dump|extract|steal|exfiltrat\w*|leak|delete|remove|install|create|deploy)\b/i;
+    const chineseNegatedAction = /(?:禁止|不要|不得|严禁|避免|防止|阻止|勿|别|不可|不应)(?:(?:任何|所有|用户|代理|工具|程序|进程|尝试|执行|进行)\s*){0,4}(?:读取|查看|打开|导出|窃取|泄露|删除|安装|创建|植入)/s;
+    if (englishNegatedAction.test(clauseAndMatch) || chineseNegatedAction.test(clauseAndMatch))
+        return true;
+    const englishReversed = /\b(?:must not|should not|shall not|cannot|can't|may not|never)\s+be\s+(?:read|opened|dumped|extracted|exported|deleted|removed|installed|created|deployed)\b/i;
+    const chineseReversed = /(?:禁止|不得|严禁|不可|不应).{0,12}(?:读取|查看|打开|导出|窃取|泄露|删除|安装|创建|植入)/s;
+    return englishReversed.test(matchedText) || chineseReversed.test(matchedText);
+}
+function currentClause(prefix) {
+    const boundary = Math.max(prefix.lastIndexOf("\n"), prefix.lastIndexOf("."), prefix.lastIndexOf("!"), prefix.lastIndexOf("?"), prefix.lastIndexOf(";"), prefix.lastIndexOf("。"), prefix.lastIndexOf("！"), prefix.lastIndexOf("？"), prefix.lastIndexOf("；"));
+    return prefix.slice(boundary + 1);
+}

package/dist/security/sensitiveGuard.d.ts

@@ -0,0 +1,2 @@
+export declare function isSensitivePath(filePath: string): boolean;
+export declare function guardSensitivePath(filePath: string): void;

package/dist/security/sensitiveGuard.js

@@ -0,0 +1,60 @@
+import { PatchWardenError } from "../errors.js";
+/**
+ * Sensitive file guard: block reads of files likely to contain secrets.
+ * Returns true if the file is ALLOWED (not sensitive).
+ */
+const SENSITIVE_PATTERNS = [
+    // Exact filenames
+    /(?:^|[\\/])\.env$/i,
+    /(?:^|[\\/])\.env\..+$/i,
+    /(?:^|[\\/])id_rsa$/i,
+    /(?:^|[\\/])id_ed25519$/i,
+    /(?:^|[\\/])id_ecdsa$/i,
+    /(?:^|[\\/])\.ssh[\\/]/i,
+    // Credentials / tokens
+    /(?:^|[\\/])credentials/i,
+    /(?:^|[\\/])\.?aws[\\/]credentials/i,
+    /(?:^|[\\/])\.netrc$/i,
+    /(?:^|[\\/])\.npmrc$/i,
+    /(?:^|[\\/])\.pypirc$/i,
+    /(?:^|[\\/])token/i,
+    // Private keys
+    /(?:^|[\\/])[^.]+\.pem$/i,
+    /(?:^|[\\/])[^.]+\.key$/i,
+    /(?:^|[\\/])[^.]+\.pfx$/i,
+    /(?:^|[\\/])[^.]+\.p12$/i,
+    // Browser data
+    /(?:^|[\\/])cookies/i,
+    /(?:^|[\\/])web data$/i,
+    /(?:^|[\\/])login data$/i,
+    /(?:^|[\\/])local state$/i,
+    // Other sensitive files
+    /(?:^|[\\/])\.git-credentials$/i,
+    /(?:^|[\\/])\.docker[\\/]config\.json$/i,
+    /(?:^|[\\/])\.kube[\\/]config$/i,
+    /(?:^|[\\/])config\.json$/i, // generic config files often contain local tokens or service credentials
+];
+// Files specifically inside .patchwarden are always allowed
+const SAFE_PREFIX = ".patchwarden";
+export function isSensitivePath(filePath) {
+    // Files inside .patchwarden are always safe
+    const normalized = filePath.replace(/\\/g, "/");
+    if (normalized.includes(`${SAFE_PREFIX}/`) || normalized.endsWith(SAFE_PREFIX)) {
+        return false;
+    }
+    for (const pattern of SENSITIVE_PATTERNS) {
+        if (pattern.test(filePath)) {
+            return true;
+        }
+    }
+    return false;
+}
+export function guardSensitivePath(filePath) {
+    if (isSensitivePath(filePath)) {
+        throw new PatchWardenError("sensitive_path_blocked", `Access denied: "${filePath}" matches a sensitive file pattern. Reading this file is not permitted.`, "Read only non-sensitive task artifacts or workspace files.", true, {
+            path: filePath,
+            operation: "read",
+            safe_alternative: "Read a non-sensitive task artifact, or remove secret material and retry.",
+        });
+    }
+}

package/dist/smoke-test.d.ts

@@ -0,0 +1,15 @@
+/**
+ * PatchWarden Security Smoke Tests
+ *
+ * Covers all security requirements:
+ * 1. Workspace containment (path escape, readWorkspaceFile uses safePath)
+ * 2. Sensitive file rejection
+ * 3. test_command allowlist enforcement
+ * 4. repo_path workspace enforcement
+ * 5. plan_id existence validation
+ * 6. Runner CLI real execution
+ * 7. Task output file read restrictions
+ *
+ * Run: node dist/smoke-test.js
+ */
+export {};