patchwarden 0.6.0 → 0.6.1

package/src/test/unit/sensitive-guard.test.ts

@@ -0,0 +1,124 @@
+import { describe, it } from "node:test";
+import { strict as assert } from "node:assert";
+import { isSensitivePath, guardSensitivePath } from "../../security/sensitiveGuard.js";
+import { PatchWardenError } from "../../errors.js";
+
+describe("isSensitivePath", () => {
+  it("blocks .env files", () => {
+    assert.equal(isSensitivePath(".env"), true);
+    assert.equal(isSensitivePath("path/to/.env"), true);
+    assert.equal(isSensitivePath(".env.production"), true);
+    assert.equal(isSensitivePath(".env.local"), true);
+  });
+
+  it("blocks .ENV case insensitive", () => {
+    assert.equal(isSensitivePath(".ENV"), true);
+    assert.equal(isSensitivePath("path/to/.ENV"), true);
+    assert.equal(isSensitivePath(".Env.Production"), true);
+  });
+
+  it("blocks config.json case insensitive", () => {
+    assert.equal(isSensitivePath("config.json"), true);
+    assert.equal(isSensitivePath("Config.json"), true);
+    assert.equal(isSensitivePath("CONFIG.JSON"), true);
+    assert.equal(isSensitivePath("path/to/Config.json"), true);
+  });
+
+  it("blocks SSH keys", () => {
+    assert.equal(isSensitivePath("id_rsa"), true);
+    assert.equal(isSensitivePath("id_ed25519"), true);
+    assert.equal(isSensitivePath("id_ecdsa"), true);
+    assert.equal(isSensitivePath("path/to/id_rsa"), true);
+    assert.equal(isSensitivePath(".ssh/id_rsa"), true);
+  });
+
+  it("blocks credentials and tokens", () => {
+    assert.equal(isSensitivePath("credentials"), true);
+    assert.equal(isSensitivePath("path/to/credentials.json"), true);
+    assert.equal(isSensitivePath("token.txt"), true);
+    // access_token does NOT match because the pattern requires token at start or after /
+    assert.equal(isSensitivePath("access_token"), false);
+    assert.equal(isSensitivePath("path/to/token"), true);
+    assert.equal(isSensitivePath(".netrc"), true);
+    assert.equal(isSensitivePath(".npmrc"), true);
+    assert.equal(isSensitivePath(".pypirc"), true);
+  });
+
+  it("blocks private key files", () => {
+    assert.equal(isSensitivePath("server.pem"), true);
+    assert.equal(isSensitivePath("private.key"), true);
+    assert.equal(isSensitivePath("cert.pfx"), true);
+    assert.equal(isSensitivePath("cert.p12"), true);
+  });
+
+  it("blocks browser data files", () => {
+    assert.equal(isSensitivePath("cookies"), true);
+    assert.equal(isSensitivePath("cookies.db"), true);
+    assert.equal(isSensitivePath("Web Data"), true);
+    assert.equal(isSensitivePath("Login Data"), true);
+    assert.equal(isSensitivePath("Local State"), true);
+  });
+
+  it("blocks .git-credentials", () => {
+    assert.equal(isSensitivePath(".git-credentials"), true);
+    assert.equal(isSensitivePath("path/to/.git-credentials"), true);
+  });
+
+  it("blocks docker and kube config", () => {
+    assert.equal(isSensitivePath(".docker/config.json"), true);
+    assert.equal(isSensitivePath(".kube/config"), true);
+  });
+
+  it("allows .patchwarden safe prefix", () => {
+    assert.equal(isSensitivePath(".patchwarden/tasks/task-001/status.json"), false);
+    assert.equal(isSensitivePath(".patchwarden/config.json"), false);
+    assert.equal(isSensitivePath(".patchwarden"), false);
+  });
+
+  it("allows non-sensitive files", () => {
+    assert.equal(isSensitivePath("src/main.ts"), false);
+    assert.equal(isSensitivePath("README.md"), false);
+    assert.equal(isSensitivePath("package.json"), false);
+    assert.equal(isSensitivePath("docs/guide.md"), false);
+  });
+
+  it("handles Windows backslash paths", () => {
+    assert.equal(isSensitivePath("path\\to\\.env"), true);
+    assert.equal(isSensitivePath("path\\to\\config.json"), true);
+    assert.equal(isSensitivePath(".patchwarden\\tasks\\status.json"), false);
+  });
+
+  it("handles null byte in path", () => {
+    // config.json with null byte appended — the $ anchor means this won't match
+    // because the string doesn't end with "config.json"
+    const nullPath = "config.json\x00.txt";
+    assert.equal(isSensitivePath(nullPath), false);
+    // But plain config.json still matches
+    assert.equal(isSensitivePath("config.json"), true);
+  });
+
+  it("handles Unicode lookalike characters", () => {
+    // Full-width dot (U+FF0E) should not match .env pattern
+    // This is expected behavior — Unicode lookalikes are NOT matched
+    const fullWidthPath = "\uFF0Eenv";
+    assert.equal(isSensitivePath(fullWidthPath), false);
+  });
+});
+
+describe("guardSensitivePath", () => {
+  it("throws PatchWardenError for sensitive paths", () => {
+    assert.throws(
+      () => guardSensitivePath(".env"),
+      (err: unknown) => err instanceof PatchWardenError && err.reason === "sensitive_path_blocked"
+    );
+  });
+
+  it("does not throw for non-sensitive paths", () => {
+    assert.doesNotThrow(() => guardSensitivePath("src/main.ts"));
+    assert.doesNotThrow(() => guardSensitivePath("README.md"));
+  });
+
+  it("does not throw for .patchwarden paths", () => {
+    assert.doesNotThrow(() => guardSensitivePath(".patchwarden/tasks/status.json"));
+  });
+});

package/src/test/unit/sync-file.test.ts

@@ -0,0 +1,231 @@
+import { describe, it, beforeEach, afterEach } from "node:test";
+import { strict as assert } from "node:assert";
+import { mkdtempSync, rmSync, mkdirSync, writeFileSync, readFileSync, existsSync } from "node:fs";
+import { join, resolve } from "node:path";
+import { tmpdir } from "node:os";
+import { syncFile } from "../../tools/syncFile.js";
+import { computeFileSha256 } from "../../direct/directPatch.js";
+import type { PatchWardenConfig } from "../../config.js";
+
+function makeConfig(workspaceRoot: string): PatchWardenConfig {
+  return {
+    workspaceRoot,
+    plansDir: ".patchwarden/plans",
+    tasksDir: ".patchwarden/tasks",
+    assessmentsDir: ".patchwarden/assessments",
+    assessmentTtlSeconds: 3600,
+    agents: { codex: { command: "codex", args: ["exec", "{prompt}"] } },
+    allowedTestCommands: ["npm test"],
+    repoAllowedTestCommands: {},
+    maxReadFileBytes: 200_000,
+    defaultTaskTimeoutSeconds: 900,
+    maxTaskTimeoutSeconds: 3600,
+    watcherStaleSeconds: 30,
+    directSessionsDir: ".patchwarden/direct-sessions",
+    directSessionTtlSeconds: 3600,
+    directMaxPatchBytes: 200_000,
+    directMaxFileBytes: 500_000,
+  };
+}
+
+describe("syncFile", () => {
+  let tempDir: string;
+  let config: PatchWardenConfig;
+  let repoPath: string;
+  let sessionsDir: string;
+  let sessionId: string;
+
+  beforeEach(() => {
+    tempDir = mkdtempSync(join(tmpdir(), "pw-syncfile-"));
+    config = makeConfig(tempDir);
+    repoPath = join(tempDir, "my-repo");
+    sessionsDir = join(tempDir, ".patchwarden", "direct-sessions");
+    sessionId = "test-session-001";
+
+    mkdirSync(repoPath, { recursive: true });
+    mkdirSync(join(sessionsDir, sessionId), { recursive: true });
+
+    writeFileSync(
+      join(sessionsDir, sessionId, "session.json"),
+      JSON.stringify({
+        session_id: sessionId,
+        repo_path: repoPath,
+        status: "active",
+        created_at: new Date().toISOString(),
+      }),
+      "utf-8"
+    );
+  });
+
+  afterEach(() => {
+    rmSync(tempDir, { recursive: true, force: true });
+  });
+
+  it("copies a file from source to target", () => {
+    const sourceContent = "console.log('hello world');";
+    mkdirSync(join(repoPath, "mobile_app"), { recursive: true });
+    writeFileSync(join(repoPath, "mobile_app", "app.js"), sourceContent, "utf-8");
+
+    const result = syncFile(sessionId, "mobile_app/app.js", "windows_app/app/app.js", undefined, config);
+
+    assert.equal(result.changed, true);
+    assert.equal(result.copied_bytes, sourceContent.length);
+    assert.equal(result.before_target_sha256, null);
+    assert.ok(result.after_target_sha256);
+
+    const targetContent = readFileSync(join(repoPath, "windows_app", "app", "app.js"), "utf-8");
+    assert.equal(targetContent, sourceContent);
+  });
+
+  it("returns changed=false when target already has same content", () => {
+    const sourceContent = "same content";
+    mkdirSync(join(repoPath, "src"), { recursive: true });
+    mkdirSync(join(repoPath, "dst"), { recursive: true });
+    writeFileSync(join(repoPath, "src", "file.ts"), sourceContent, "utf-8");
+    writeFileSync(join(repoPath, "dst", "file.ts"), sourceContent, "utf-8");
+
+    const result = syncFile(sessionId, "src/file.ts", "dst/file.ts", undefined, config);
+
+    assert.equal(result.changed, false);
+    assert.ok(result.before_target_sha256);
+    assert.equal(result.before_target_sha256, result.after_target_sha256);
+  });
+
+  it("returns changed=true when target has different content", () => {
+    mkdirSync(join(repoPath, "src"), { recursive: true });
+    mkdirSync(join(repoPath, "dst"), { recursive: true });
+    writeFileSync(join(repoPath, "src", "file.ts"), "new content", "utf-8");
+    writeFileSync(join(repoPath, "dst", "file.ts"), "old content", "utf-8");
+
+    const result = syncFile(sessionId, "src/file.ts", "dst/file.ts", undefined, config);
+
+    assert.equal(result.changed, true);
+    assert.notEqual(result.before_target_sha256, result.after_target_sha256);
+  });
+
+  it("rejects source path outside repo", () => {
+    mkdirSync(join(repoPath, "src"), { recursive: true });
+    writeFileSync(join(repoPath, "src", "file.ts"), "content", "utf-8");
+
+    assert.throws(
+      () => syncFile(sessionId, "../../../etc/passwd", "dst/file.ts", undefined, config),
+      Error
+    );
+  });
+
+  it("rejects target path outside repo", () => {
+    mkdirSync(join(repoPath, "src"), { recursive: true });
+    writeFileSync(join(repoPath, "src", "file.ts"), "content", "utf-8");
+
+    assert.throws(
+      () => syncFile(sessionId, "src/file.ts", "../../../etc/evil", undefined, config),
+      Error
+    );
+  });
+
+  it("rejects sensitive source files", () => {
+    writeFileSync(join(repoPath, ".env"), "SECRET=abc123", "utf-8");
+
+    assert.throws(
+      () => syncFile(sessionId, ".env", "dst/.env", undefined, config),
+      Error
+    );
+  });
+
+  it("rejects sensitive target files", () => {
+    mkdirSync(join(repoPath, "src"), { recursive: true });
+    writeFileSync(join(repoPath, "src", "file.ts"), "content", "utf-8");
+
+    assert.throws(
+      () => syncFile(sessionId, "src/file.ts", "config.json", undefined, config),
+      Error
+    );
+  });
+
+  it("rejects writing to node_modules", () => {
+    mkdirSync(join(repoPath, "src"), { recursive: true });
+    writeFileSync(join(repoPath, "src", "file.ts"), "content", "utf-8");
+
+    assert.throws(
+      () => syncFile(sessionId, "src/file.ts", "node_modules/evil/index.js", undefined, config),
+      Error
+    );
+  });
+
+  it("rejects writing to dist", () => {
+    mkdirSync(join(repoPath, "src"), { recursive: true });
+    writeFileSync(join(repoPath, "src", "file.ts"), "content", "utf-8");
+
+    assert.throws(
+      () => syncFile(sessionId, "src/file.ts", "dist/main.js", undefined, config),
+      Error
+    );
+  });
+
+  it("rejects non-existent session", () => {
+    mkdirSync(join(repoPath, "src"), { recursive: true });
+    writeFileSync(join(repoPath, "src", "file.ts"), "content", "utf-8");
+
+    assert.throws(
+      () => syncFile("non-existent-session", "src/file.ts", "dst/file.ts", undefined, config),
+      Error
+    );
+  });
+
+  it("rejects non-existent source file", () => {
+    assert.throws(
+      () => syncFile(sessionId, "non-existent/file.ts", "dst/file.ts", undefined, config),
+      Error
+    );
+  });
+
+  it("validates expected_source_sha256", () => {
+    mkdirSync(join(repoPath, "src"), { recursive: true });
+    writeFileSync(join(repoPath, "src", "file.ts"), "content", "utf-8");
+
+    const correctHash = computeFileSha256(join(repoPath, "src", "file.ts"));
+
+    const result = syncFile(sessionId, "src/file.ts", "dst/file.ts", {
+      expected_source_sha256: correctHash,
+    }, config);
+    assert.equal(result.source_sha256, correctHash);
+
+    assert.throws(
+      () => syncFile(sessionId, "src/file.ts", "dst2/file.ts", {
+        expected_source_sha256: "wronghash",
+      }, config),
+      Error
+    );
+  });
+
+  it("validates expected_target_sha256", () => {
+    mkdirSync(join(repoPath, "src"), { recursive: true });
+    mkdirSync(join(repoPath, "dst"), { recursive: true });
+    writeFileSync(join(repoPath, "src", "file.ts"), "new content", "utf-8");
+    writeFileSync(join(repoPath, "dst", "file.ts"), "old content", "utf-8");
+
+    const correctTargetHash = computeFileSha256(join(repoPath, "dst", "file.ts"));
+
+    const result = syncFile(sessionId, "src/file.ts", "dst/file.ts", {
+      expected_target_sha256: correctTargetHash,
+    }, config);
+    assert.equal(result.before_target_sha256, correctTargetHash);
+
+    assert.throws(
+      () => syncFile(sessionId, "src/file.ts", "dst/file.ts", {
+        expected_target_sha256: "wronghash",
+      }, config),
+      Error
+    );
+  });
+
+  it("creates target directory if it doesn't exist", () => {
+    mkdirSync(join(repoPath, "src"), { recursive: true });
+    writeFileSync(join(repoPath, "src", "file.ts"), "content", "utf-8");
+
+    const result = syncFile(sessionId, "src/file.ts", "deep/nested/path/file.ts", undefined, config);
+
+    assert.equal(result.changed, true);
+    assert.ok(existsSync(join(repoPath, "deep", "nested", "path", "file.ts")));
+  });
+});

package/src/test/unit/watcher-status.test.ts

@@ -0,0 +1,190 @@
+import { describe, it, beforeEach, afterEach } from "node:test";
+import { strict as assert } from "node:assert";
+import { mkdirSync, mkdtempSync, rmSync, writeFileSync, existsSync, mkdir } from "node:fs";
+import { join, dirname } from "node:path";
+import { tmpdir } from "node:os";
+import type { PatchWardenConfig } from "../../config.js";
+import { readWatcherStatus, getWatcherHeartbeatPath } from "../../watcherStatus.js";
+
+function makeConfig(workspaceRoot: string): PatchWardenConfig {
+  return {
+    workspaceRoot,
+    plansDir: ".patchwarden/plans",
+    tasksDir: ".patchwarden/tasks",
+    assessmentsDir: ".patchwarden/assessments",
+    assessmentTtlSeconds: 3600,
+    agents: { codex: { command: "codex", args: ["exec", "{prompt}"] } },
+    allowedTestCommands: ["npm test"],
+    repoAllowedTestCommands: {},
+    maxReadFileBytes: 200_000,
+    defaultTaskTimeoutSeconds: 900,
+    maxTaskTimeoutSeconds: 3600,
+    watcherStaleSeconds: 30,
+    directSessionsDir: ".patchwarden/direct-sessions",
+    directSessionTtlSeconds: 3600,
+    directMaxPatchBytes: 200_000,
+    directMaxFileBytes: 500_000,
+  };
+}
+
+describe("readWatcherStatus — watcher stale fallback", () => {
+  let tempDir: string;
+  let config: PatchWardenConfig;
+
+  beforeEach(() => {
+    tempDir = mkdtempSync(join(tmpdir(), "pw-watcher-test-"));
+    config = makeConfig(tempDir);
+    mkdirSync(join(tempDir, ".patchwarden", "tasks"), { recursive: true });
+  });
+
+  afterEach(() => {
+    rmSync(tempDir, { recursive: true, force: true });
+  });
+
+  it("returns missing when no heartbeat and no running task", () => {
+    const result = readWatcherStatus(config, Date.now());
+    assert.equal(result.status, "missing");
+    assert.equal(result.available, false);
+    assert.equal(result.activity, null);
+  });
+
+  it("returns healthy when watcher heartbeat is fresh", () => {
+    const heartbeatPath = getWatcherHeartbeatPath(config);
+    mkdirSync(dirname(heartbeatPath), { recursive: true });
+    writeFileSync(heartbeatPath, JSON.stringify({
+      status: "running",
+      pid: process.pid,
+      last_heartbeat_at: new Date().toISOString(),
+    }), "utf-8");
+
+    const result = readWatcherStatus(config, Date.now());
+    assert.equal(result.status, "healthy");
+    assert.equal(result.available, true);
+    assert.equal(result.activity, null);
+  });
+
+  it("returns stale when watcher heartbeat is old and no running task", () => {
+    const heartbeatPath = getWatcherHeartbeatPath(config);
+    mkdirSync(dirname(heartbeatPath), { recursive: true });
+    const oldTime = new Date(Date.now() - 120_000).toISOString();
+    writeFileSync(heartbeatPath, JSON.stringify({
+      status: "running",
+      pid: process.pid,
+      last_heartbeat_at: oldTime,
+    }), "utf-8");
+
+    const result = readWatcherStatus(config, Date.now());
+    assert.equal(result.status, "stale");
+    assert.equal(result.available, false);
+    assert.equal(result.activity, null);
+  });
+
+  it("returns healthy when watcher heartbeat is stale but a running task has fresh heartbeat", () => {
+    // Write stale watcher heartbeat
+    const heartbeatPath = getWatcherHeartbeatPath(config);
+    mkdirSync(dirname(heartbeatPath), { recursive: true });
+    const oldTime = new Date(Date.now() - 120_000).toISOString();
+    writeFileSync(heartbeatPath, JSON.stringify({
+      status: "running",
+      pid: process.pid,
+      last_heartbeat_at: oldTime,
+    }), "utf-8");
+
+    // Create a running task with fresh heartbeat
+    const taskDir = join(tempDir, ".patchwarden", "tasks", "test-task-001");
+    mkdirSync(taskDir, { recursive: true });
+    writeFileSync(join(taskDir, "status.json"), JSON.stringify({
+      status: "running",
+      task_id: "test-task-001",
+    }), "utf-8");
+    writeFileSync(join(taskDir, "runtime.json"), JSON.stringify({
+      phase: "executing_agent",
+      last_heartbeat_at: new Date().toISOString(),
+      current_command: "codex exec",
+    }), "utf-8");
+
+    const result = readWatcherStatus(config, Date.now());
+    assert.equal(result.status, "healthy");
+    assert.equal(result.available, true);
+    assert.ok(result.activity);
+    assert.match(result.activity!, /test-task-001/);
+  });
+
+  it("returns healthy when watcher heartbeat is missing but a running task has fresh heartbeat", () => {
+    // No watcher heartbeat file at all
+    // Create a running task with fresh heartbeat
+    const taskDir = join(tempDir, ".patchwarden", "tasks", "test-task-002");
+    mkdirSync(taskDir, { recursive: true });
+    writeFileSync(join(taskDir, "status.json"), JSON.stringify({
+      status: "running",
+      task_id: "test-task-002",
+    }), "utf-8");
+    writeFileSync(join(taskDir, "runtime.json"), JSON.stringify({
+      phase: "running_tests",
+      last_heartbeat_at: new Date().toISOString(),
+      current_command: "npm test",
+    }), "utf-8");
+
+    const result = readWatcherStatus(config, Date.now());
+    assert.equal(result.status, "healthy");
+    assert.equal(result.available, true);
+    assert.ok(result.activity);
+    assert.match(result.activity!, /test-task-002/);
+  });
+
+  it("returns stale when both watcher heartbeat and task heartbeat are old", () => {
+    const heartbeatPath = getWatcherHeartbeatPath(config);
+    mkdirSync(dirname(heartbeatPath), { recursive: true });
+    const oldTime = new Date(Date.now() - 120_000).toISOString();
+    writeFileSync(heartbeatPath, JSON.stringify({
+      status: "running",
+      pid: process.pid,
+      last_heartbeat_at: oldTime,
+    }), "utf-8");
+
+    const taskDir = join(tempDir, ".patchwarden", "tasks", "test-task-003");
+    mkdirSync(taskDir, { recursive: true });
+    writeFileSync(join(taskDir, "status.json"), JSON.stringify({
+      status: "running",
+      task_id: "test-task-003",
+    }), "utf-8");
+    writeFileSync(join(taskDir, "runtime.json"), JSON.stringify({
+      phase: "executing_agent",
+      last_heartbeat_at: oldTime,
+      current_command: "codex exec",
+    }), "utf-8");
+
+    const result = readWatcherStatus(config, Date.now());
+    assert.equal(result.status, "stale");
+    assert.equal(result.available, false);
+    assert.equal(result.activity, null);
+  });
+
+  it("does not fall back to non-running tasks", () => {
+    const heartbeatPath = getWatcherHeartbeatPath(config);
+    mkdirSync(dirname(heartbeatPath), { recursive: true });
+    const oldTime = new Date(Date.now() - 120_000).toISOString();
+    writeFileSync(heartbeatPath, JSON.stringify({
+      status: "running",
+      pid: process.pid,
+      last_heartbeat_at: oldTime,
+    }), "utf-8");
+
+    // Done task with fresh heartbeat should not trigger fallback
+    const taskDir = join(tempDir, ".patchwarden", "tasks", "test-task-004");
+    mkdirSync(taskDir, { recursive: true });
+    writeFileSync(join(taskDir, "status.json"), JSON.stringify({
+      status: "done",
+      task_id: "test-task-004",
+    }), "utf-8");
+    writeFileSync(join(taskDir, "runtime.json"), JSON.stringify({
+      phase: "completed",
+      last_heartbeat_at: new Date().toISOString(),
+      current_command: null,
+    }), "utf-8");
+
+    const result = readWatcherStatus(config, Date.now());
+    assert.equal(result.status, "stale");
+    assert.equal(result.available, false);
+  });
+});