patchwarden 0.6.0 → 0.6.1

package/src/test/unit/logging.test.ts

@@ -0,0 +1,325 @@
+import { describe, it, beforeEach, afterEach } from "node:test";
+import { strict as assert } from "node:assert";
+import { Logger, logUnhandledError, installGlobalHandlers } from "../../logging.js";
+
+// ── Test helpers ──────────────────────────────────────────────────
+
+/**
+ * Capture everything written to stderr during `fn` and return it as an
+ * array of raw chunks (one per `process.stderr.write` call).
+ */
+function captureStderr(fn: () => void): string[] {
+  const chunks: string[] = [];
+  const original = process.stderr.write;
+  process.stderr.write = ((chunk: string | Uint8Array) => {
+    chunks.push(typeof chunk === "string" ? chunk : Buffer.from(chunk).toString("utf-8"));
+    return true;
+  }) as typeof process.stderr.write;
+  try {
+    fn();
+  } finally {
+    process.stderr.write = original;
+  }
+  return chunks;
+}
+
+/**
+ * Capture stderr and return the parsed JSON objects (one per log line).
+ */
+function captureJson(fn: () => void): Record<string, unknown>[] {
+  const chunks = captureStderr(fn);
+  return chunks
+    .flatMap((chunk) => chunk.split("\n"))
+    .map((line) => line.trim())
+    .filter((line) => line.length > 0)
+    .map((line) => JSON.parse(line));
+}
+
+// ── Logger: stderr output ─────────────────────────────────────────
+
+describe("Logger — stderr output", () => {
+  it("writes JSON log entries to stderr (never stdout)", () => {
+    const log = new Logger();
+    const entries = captureJson(() => {
+      log.info("hello from test", { component: "unit-test" });
+    });
+
+    assert.equal(entries.length, 1);
+    const entry = entries[0];
+
+    assert.equal(entry.level, "info");
+    assert.equal(entry.message, "hello from test");
+    assert.equal(entry.component, "unit-test");
+    assert.equal(typeof entry.timestamp, "string");
+    // timestamp must be a valid ISO date
+    assert.ok(!Number.isNaN(Date.parse(entry.timestamp as string)));
+  });
+
+  it("supports warn and error levels", () => {
+    const log = new Logger();
+    const entries = captureJson(() => {
+      log.warn("careful");
+      log.error("broken");
+    });
+
+    assert.equal(entries.length, 2);
+    assert.equal(entries[0].level, "warn");
+    assert.equal(entries[0].message, "careful");
+    assert.equal(entries[1].level, "error");
+    assert.equal(entries[1].message, "broken");
+  });
+
+  it("does not write anything to stdout", () => {
+    const originalStdout = process.stdout.write;
+    let stdoutWritten = false;
+    process.stdout.write = (() => {
+      stdoutWritten = true;
+      return true;
+    }) as typeof process.stdout.write;
+
+    try {
+      const log = new Logger();
+      log.info("should not touch stdout");
+      log.warn("nor this");
+      log.error("nor this");
+    } finally {
+      process.stdout.write = originalStdout;
+    }
+
+    assert.equal(stdoutWritten, false, "Logger must never write to stdout");
+  });
+});
+
+// ── Logger: audit ─────────────────────────────────────────────────
+
+describe("Logger.audit — format", () => {
+  it("produces an audit log entry with all required fields", () => {
+    const log = new Logger();
+    const entries = captureJson(() => {
+      log.audit("createTask", true, 150, undefined, "task-001");
+    });
+
+    assert.equal(entries.length, 1);
+    const entry = entries[0];
+
+    // Required core fields
+    assert.equal(entry.level, "audit");
+    assert.equal(typeof entry.timestamp, "string");
+    assert.ok(!Number.isNaN(Date.parse(entry.timestamp as string)));
+    assert.equal(typeof entry.message, "string");
+
+    // Audit-specific fields
+    assert.equal(entry.tool, "createTask");
+    assert.equal(entry.ok, true);
+    assert.equal(entry.duration_ms, 150);
+    assert.equal(entry.task_id, "task-001");
+
+    // error_reason should be absent when not provided
+    assert.equal(entry.error_reason, undefined);
+  });
+
+  it("includes error_reason when the tool call failed", () => {
+    const log = new Logger();
+    const entries = captureJson(() => {
+      log.audit("applyPatch", false, 3000, "command_blocked", "task-002");
+    });
+
+    assert.equal(entries.length, 1);
+    const entry = entries[0];
+
+    assert.equal(entry.ok, false);
+    assert.equal(entry.error_reason, "command_blocked");
+    assert.equal(entry.task_id, "task-002");
+  });
+
+  it("omits task_id when not provided", () => {
+    const log = new Logger();
+    const entries = captureJson(() => {
+      log.audit("healthCheck", true, 5);
+    });
+
+    assert.equal(entries.length, 1);
+    const entry = entries[0];
+    assert.equal(entry.task_id, undefined);
+    assert.equal(entry.error_reason, undefined);
+  });
+});
+
+// ── Logger: verbose mode ──────────────────────────────────────────
+
+describe("Logger — verbose mode (PATCHWARDEN_VERBOSE_LOG)", () => {
+  let savedEnv: string | undefined;
+
+  beforeEach(() => {
+    savedEnv = process.env.PATCHWARDEN_VERBOSE_LOG;
+  });
+
+  afterEach(() => {
+    if (savedEnv === undefined) {
+      delete process.env.PATCHWARDEN_VERBOSE_LOG;
+    } else {
+      process.env.PATCHWARDEN_VERBOSE_LOG = savedEnv;
+    }
+  });
+
+  it("does not log args by default (verbose mode off)", () => {
+    delete process.env.PATCHWARDEN_VERBOSE_LOG;
+
+    const log = new Logger();
+    const sensitiveArgs = {
+      prompt: "fix the bug",
+      token: "ghp_" + "a".repeat(20),
+    };
+
+    const entries = captureJson(() => {
+      log.audit("createTask", true, 100, undefined, "task-003", sensitiveArgs);
+    });
+
+    assert.equal(entries.length, 1);
+    const entry = entries[0];
+
+    // args must NOT be present when verbose mode is off
+    assert.equal(entry.args, undefined);
+    // The raw token must not appear anywhere in the serialized entry
+    const raw = JSON.stringify(entry);
+    assert.ok(!raw.includes("ghp_"), "raw token must not leak into log output");
+  });
+
+  it("logs sanitized args when PATCHWARDEN_VERBOSE_LOG=true", () => {
+    process.env.PATCHWARDEN_VERBOSE_LOG = "true";
+
+    const log = new Logger();
+    const sensitiveArgs = {
+      prompt: "fix the bug",
+      token: "ghp_" + "a".repeat(20),
+    };
+
+    const entries = captureJson(() => {
+      log.audit("createTask", true, 100, undefined, "task-004", sensitiveArgs);
+    });
+
+    assert.equal(entries.length, 1);
+    const entry = entries[0];
+
+    // args must be present and redacted
+    assert.ok(entry.args !== undefined, "args should be logged in verbose mode");
+    const argsStr = String(entry.args);
+    assert.ok(argsStr.includes("[REDACTED TOKEN]"), "sensitive token must be redacted");
+    assert.ok(!argsStr.includes("ghp_"), "raw token must not appear in args");
+    // non-sensitive content is preserved
+    assert.ok(argsStr.includes("fix the bug"), "non-sensitive args content is preserved");
+  });
+
+  it("does not log args when PATCHWARDEN_VERBOSE_LOG is set but not 'true'", () => {
+    process.env.PATCHWARDEN_VERBOSE_LOG = "false";
+
+    const log = new Logger();
+    const entries = captureJson(() => {
+      log.audit("createTask", true, 100, undefined, "task-005", { prompt: "hello" });
+    });
+
+    assert.equal(entries.length, 1);
+    assert.equal(entries[0].args, undefined);
+  });
+});
+
+// ── logUnhandledError ─────────────────────────────────────────────
+
+describe("logUnhandledError", () => {
+  it("produces structured JSON output for Error instances", () => {
+    const error = new Error("something went wrong");
+    error.name = "CustomError";
+
+    const entries = captureJson(() => {
+      logUnhandledError(error);
+    });
+
+    assert.equal(entries.length, 1);
+    const entry = entries[0];
+
+    assert.equal(entry.level, "error");
+    assert.equal(entry.message, "unhandled_error");
+    assert.equal(entry.error, "something went wrong");
+    assert.equal(entry.error_name, "CustomError");
+    assert.equal(typeof entry.timestamp, "string");
+    assert.ok(!Number.isNaN(Date.parse(entry.timestamp as string)));
+    assert.equal(typeof entry.stack, "string");
+    assert.ok((entry.stack as string).includes("something went wrong"));
+  });
+
+  it("handles non-Error values (string)", () => {
+    const entries = captureJson(() => {
+      logUnhandledError("a plain string rejection");
+    });
+
+    assert.equal(entries.length, 1);
+    const entry = entries[0];
+
+    assert.equal(entry.level, "error");
+    assert.equal(entry.error, "a plain string rejection");
+    assert.equal(entry.error_name, "string");
+    assert.equal(entry.stack, undefined);
+  });
+
+  it("handles non-Error values (object)", () => {
+    const entries = captureJson(() => {
+      logUnhandledError({ code: 42, detail: "weird" });
+    });
+
+    assert.equal(entries.length, 1);
+    const entry = entries[0];
+
+    assert.equal(entry.level, "error");
+    assert.ok(String(entry.error).includes("42"));
+    assert.equal(entry.error_name, "object");
+  });
+});
+
+// ── installGlobalHandlers ─────────────────────────────────────────
+
+describe("installGlobalHandlers", () => {
+  it("does not throw when called", () => {
+    // Save existing listeners so we can restore them afterwards and avoid
+    // the fatal `uncaughtException` handler interfering with the test
+    // runner.
+    const origUnhandled = process.listeners("unhandledRejection");
+    const origUncaught = process.listeners("uncaughtException");
+
+    process.removeAllListeners("unhandledRejection");
+    process.removeAllListeners("uncaughtException");
+
+    try {
+      assert.doesNotThrow(() => installGlobalHandlers());
+
+      // Verify the handlers were actually registered
+      assert.ok(process.listenerCount("unhandledRejection") >= 1);
+      assert.ok(process.listenerCount("uncaughtException") >= 1);
+    } finally {
+      // Restore original listeners
+      process.removeAllListeners("unhandledRejection");
+      process.removeAllListeners("uncaughtException");
+      for (const fn of origUnhandled) process.on("unhandledRejection", fn);
+      for (const fn of origUncaught) process.on("uncaughtException", fn);
+    }
+  });
+
+  it("can be called multiple times without throwing", () => {
+    const origUnhandled = process.listeners("unhandledRejection");
+    const origUncaught = process.listeners("uncaughtException");
+
+    process.removeAllListeners("unhandledRejection");
+    process.removeAllListeners("uncaughtException");
+
+    try {
+      assert.doesNotThrow(() => {
+        installGlobalHandlers();
+        installGlobalHandlers();
+      });
+    } finally {
+      process.removeAllListeners("unhandledRejection");
+      process.removeAllListeners("uncaughtException");
+      for (const fn of origUnhandled) process.on("unhandledRejection", fn);
+      for (const fn of origUncaught) process.on("uncaughtException", fn);
+    }
+  });
+});

package/src/test/unit/path-guard.test.ts

@@ -0,0 +1,150 @@
+import { describe, it, beforeEach, afterEach } from "node:test";
+import { strict as assert } from "node:assert";
+import { mkdtempSync, rmSync, mkdirSync, writeFileSync, symlinkSync } from "node:fs";
+import { join, resolve, sep } from "node:path";
+import { tmpdir } from "node:os";
+import { guardPath, guardWorkspacePath } from "../../security/pathGuard.js";
+import { PatchWardenError } from "../../errors.js";
+
+describe("guardPath", () => {
+  let tempDir: string;
+
+  beforeEach(() => {
+    tempDir = mkdtempSync(join(tmpdir(), "pw-pathguard-"));
+  });
+
+  afterEach(() => {
+    rmSync(tempDir, { recursive: true, force: true });
+  });
+
+  it("allows paths inside workspace", () => {
+    const result = guardPath("src/main.ts", tempDir);
+    assert.ok(result.startsWith(tempDir));
+    assert.ok(result.includes("src"));
+    assert.ok(result.includes("main.ts"));
+  });
+
+  it("allows root workspace path", () => {
+    const result = guardPath(".", tempDir);
+    assert.equal(result, resolve(tempDir));
+  });
+
+  it("allows empty path as workspace root", () => {
+    const result = guardPath("", tempDir);
+    assert.equal(result, resolve(tempDir));
+  });
+
+  it("rejects path traversal with ..", () => {
+    assert.throws(
+      () => guardPath("../../../etc/passwd", tempDir),
+      PatchWardenError
+    );
+  });
+
+  it("rejects path traversal nested with ..", () => {
+    assert.throws(
+      () => guardPath("src/../../../etc/passwd", tempDir),
+      PatchWardenError
+    );
+  });
+
+  it("rejects absolute path outside workspace", () => {
+    const outside = process.platform === "win32" ? "C:\\Windows\\System32" : "/etc";
+    assert.throws(
+      () => guardPath(outside, tempDir),
+      PatchWardenError
+    );
+  });
+
+  it("allows absolute path inside workspace", () => {
+    const insidePath = join(tempDir, "src", "main.ts");
+    mkdirSync(join(tempDir, "src"), { recursive: true });
+    writeFileSync(insidePath, "test", "utf-8");
+    const result = guardPath(insidePath, tempDir);
+    assert.equal(result, resolve(insidePath));
+  });
+
+  it("enforces allowedPrefix", () => {
+    mkdirSync(join(tempDir, "allowed"), { recursive: true });
+    mkdirSync(join(tempDir, "forbidden"), { recursive: true });
+    // Path inside allowed prefix works
+    const okResult = guardPath("allowed/file.ts", tempDir, "allowed");
+    assert.ok(okResult.includes("allowed"));
+    // Path outside allowed prefix fails
+    assert.throws(
+      () => guardPath("forbidden/file.ts", tempDir, "allowed"),
+      PatchWardenError
+    );
+  });
+
+  it("handles Windows mixed separators", () => {
+    const mixedPath = "src\\subdir/file.ts";
+    const result = guardPath(mixedPath, tempDir);
+    assert.ok(result.startsWith(tempDir));
+  });
+
+  it("rejects symlink escape", { skip: process.platform === "win32" ? "Windows symlink permissions unstable" : undefined }, () => {
+    const target = mkdtempSync(join(tmpdir(), "pw-symlink-target-"));
+    try {
+      const linkPath = join(tempDir, "escape-link");
+      symlinkSync(target, linkPath);
+      assert.throws(
+        () => guardPath("escape-link/secret.txt", tempDir),
+        PatchWardenError
+      );
+    } finally {
+      rmSync(target, { recursive: true, force: true });
+    }
+  });
+});
+
+describe("guardWorkspacePath", () => {
+  let tempDir: string;
+
+  beforeEach(() => {
+    tempDir = mkdtempSync(join(tmpdir(), "pw-wspath-"));
+  });
+
+  afterEach(() => {
+    rmSync(tempDir, { recursive: true, force: true });
+  });
+
+  it("allows relative path inside workspace", () => {
+    const result = guardWorkspacePath("my-repo", tempDir);
+    assert.equal(result, resolve(tempDir, "my-repo"));
+  });
+
+  it("allows absolute path inside workspace", () => {
+    const absPath = join(tempDir, "my-repo");
+    const result = guardWorkspacePath(absPath, tempDir);
+    assert.equal(result, resolve(absPath));
+  });
+
+  it("rejects path outside workspace", () => {
+    assert.throws(
+      () => guardWorkspacePath("../../../etc", tempDir),
+      PatchWardenError
+    );
+  });
+
+  it("rejects different drive letter on Windows", { skip: process.platform !== "win32" ? "Windows-only test" : undefined }, () => {
+    // If workspace is on C:, a D: path should be rejected
+    const wsDrive = tempDir.match(/^([A-Za-z]):/);
+    if (!wsDrive) return;
+    const otherDrive = wsDrive[1].toLowerCase() === "c" ? "D" : "C";
+    assert.throws(
+      () => guardWorkspacePath(`${otherDrive}:\\some\\repo`, tempDir),
+      (err: unknown) => err instanceof PatchWardenError && err.reason === "workspace_path_escape"
+    );
+  });
+
+  it("defaults to workspace root for empty input", () => {
+    const result = guardWorkspacePath("", tempDir);
+    assert.equal(result, resolve(tempDir));
+  });
+
+  it("defaults to workspace root for dot input", () => {
+    const result = guardWorkspacePath(".", tempDir);
+    assert.equal(result, resolve(tempDir));
+  });
+});

package/src/test/unit/safe-status.test.ts

@@ -0,0 +1,187 @@
+import { describe, it, beforeEach, afterEach } from "node:test";
+import { strict as assert } from "node:assert";
+import { mkdtempSync, rmSync, mkdirSync, writeFileSync } from "node:fs";
+import { join, resolve } from "node:path";
+import { tmpdir } from "node:os";
+import { safeStatus } from "../../tools/safeStatus.js";
+import type { PatchWardenConfig } from "../../config.js";
+
+function makeConfig(workspaceRoot: string): PatchWardenConfig {
+  return {
+    workspaceRoot,
+    plansDir: ".patchwarden/plans",
+    tasksDir: ".patchwarden/tasks",
+    assessmentsDir: ".patchwarden/assessments",
+    assessmentTtlSeconds: 3600,
+    agents: { codex: { command: "codex", args: ["exec", "{prompt}"] } },
+    allowedTestCommands: ["npm test"],
+    repoAllowedTestCommands: {},
+    maxReadFileBytes: 200_000,
+    defaultTaskTimeoutSeconds: 900,
+    maxTaskTimeoutSeconds: 3600,
+    watcherStaleSeconds: 30,
+    directSessionsDir: ".patchwarden/direct-sessions",
+    directSessionTtlSeconds: 3600,
+    directMaxPatchBytes: 200_000,
+    directMaxFileBytes: 500_000,
+  };
+}
+
+describe("safeStatus", () => {
+  let tempDir: string;
+  let config: PatchWardenConfig;
+  let tasksDir: string;
+
+  beforeEach(() => {
+    tempDir = mkdtempSync(join(tmpdir(), "pw-safestatus-"));
+    config = makeConfig(tempDir);
+    tasksDir = join(tempDir, ".patchwarden", "tasks");
+    mkdirSync(tasksDir, { recursive: true });
+  });
+
+  afterEach(() => {
+    rmSync(tempDir, { recursive: true, force: true });
+  });
+
+  function writeTaskStatus(taskId: string, status: Record<string, unknown>) {
+    const taskDir = join(tasksDir, taskId);
+    mkdirSync(taskDir, { recursive: true });
+    writeFileSync(join(taskDir, "status.json"), JSON.stringify(status, null, 2), "utf-8");
+    return taskDir;
+  }
+
+  function writeTaskRuntime(taskDir: string, runtime: Record<string, unknown>) {
+    writeFileSync(join(taskDir, "runtime.json"), JSON.stringify(runtime, null, 2), "utf-8");
+  }
+
+  it("returns not_found for non-existent task", () => {
+    const result = safeStatus("non-existent-task", config);
+    assert.equal(result.task_id, "non-existent-task");
+    assert.equal(result.status, "not_found");
+    assert.equal(result.phase, null);
+    assert.equal(result.error_code, null);
+    assert.equal(result.error_summary, null);
+  });
+
+  it("returns correct status for pending task", () => {
+    writeTaskStatus("task-pending-001", {
+      task_id: "task-pending-001",
+      status: "pending",
+      phase: "queued",
+      created_at: "2026-06-24T10:00:00Z",
+      updated_at: "2026-06-24T10:00:01Z",
+    });
+
+    const result = safeStatus("task-pending-001", config);
+    assert.equal(result.task_id, "task-pending-001");
+    assert.equal(result.status, "pending");
+    assert.equal(result.created_at, "2026-06-24T10:00:00Z");
+    assert.equal(result.error_code, null);
+    assert.equal(result.error_summary, null);
+  });
+
+  it("returns correct status for running task", () => {
+    const taskDir = writeTaskStatus("task-running-001", {
+      task_id: "task-running-001",
+      status: "running",
+      phase: "executing_agent",
+      created_at: "2026-06-24T10:00:00Z",
+      started_at: "2026-06-24T10:00:05Z",
+      updated_at: "2026-06-24T10:00:10Z",
+    });
+    writeTaskRuntime(taskDir, {
+      phase: "executing_agent",
+      last_heartbeat_at: "2026-06-24T10:00:12Z",
+      current_command: "codex exec",
+    });
+
+    const result = safeStatus("task-running-001", config);
+    assert.equal(result.status, "running");
+    assert.equal(result.phase, "executing_agent");
+    assert.equal(result.current_command, "codex exec");
+    assert.equal(result.last_heartbeat_at, "2026-06-24T10:00:12Z");
+    assert.equal(result.started_at, "2026-06-24T10:00:05Z");
+  });
+
+  it("returns correct status for done task", () => {
+    writeTaskStatus("task-done-001", {
+      task_id: "task-done-001",
+      status: "done",
+      phase: "completed",
+      created_at: "2026-06-24T10:00:00Z",
+      started_at: "2026-06-24T10:00:05Z",
+      finished_at: "2026-06-24T10:05:00Z",
+      verify_status: "passed",
+    });
+
+    const result = safeStatus("task-done-001", config);
+    assert.equal(result.status, "done");
+    assert.equal(result.phase, "completed");
+    assert.equal(result.finished_at, "2026-06-24T10:05:00Z");
+    assert.equal(result.verify_status, "passed");
+    assert.equal(result.error_code, null);
+  });
+
+  it("returns correct status for failed task", () => {
+    writeTaskStatus("task-failed-001", {
+      task_id: "task-failed-001",
+      status: "failed_verification",
+      phase: "failed_verification",
+      created_at: "2026-06-24T10:00:00Z",
+      started_at: "2026-06-24T10:00:05Z",
+      finished_at: "2026-06-24T10:05:00Z",
+      error: 'Verification command "npm test" exited with code 1.',
+      verify_status: "failed",
+    });
+
+    const result = safeStatus("task-failed-001", config);
+    assert.equal(result.status, "failed_verification");
+    assert.equal(result.error_code, "failed_verification");
+    assert.ok(result.error_summary);
+    assert.ok(result.error_summary!.includes("npm test"));
+  });
+
+  it("does not return diff or file content", () => {
+    const taskDir = writeTaskStatus("task-safe-001", {
+      task_id: "task-safe-001",
+      status: "done",
+      phase: "completed",
+      created_at: "2026-06-24T10:00:00Z",
+    });
+    writeFileSync(join(taskDir, "result.md"), "# Secret result content", "utf-8");
+    writeFileSync(join(taskDir, "git.diff"), "secret diff content", "utf-8");
+    writeFileSync(join(taskDir, "test.log"), "secret test log", "utf-8");
+
+    const result = safeStatus("task-safe-001", config);
+    const resultStr = JSON.stringify(result);
+    assert.ok(!resultStr.includes("Secret result content"));
+    assert.ok(!resultStr.includes("secret diff content"));
+    assert.ok(!resultStr.includes("secret test log"));
+  });
+
+  it("truncates long error messages", () => {
+    const longError = "x".repeat(300);
+    writeTaskStatus("task-longerror-001", {
+      task_id: "task-longerror-001",
+      status: "failed",
+      phase: "failed",
+      error: longError,
+    });
+
+    const result = safeStatus("task-longerror-001", config);
+    assert.ok(result.error_summary!.length < 300);
+    assert.ok(result.error_summary!.endsWith("..."));
+  });
+
+  it("returns artifact_status when present", () => {
+    writeTaskStatus("task-artifact-001", {
+      task_id: "task-artifact-001",
+      status: "done",
+      phase: "completed",
+      artifact_status: "collected",
+    });
+
+    const result = safeStatus("task-artifact-001", config);
+    assert.equal(result.artifact_status, "collected");
+  });
+});