patchwarden 0.6.1 → 1.1.0

package/dist/tools/goalSubgoalTask.js

@@ -0,0 +1,110 @@
+/**
+ * v0.8.0: createSubgoalTask — 原子地将一个新 subgoal 关联到一个新任务。
+ *
+ * 流程（原子语义）：
+ *   1. 读取 goal_status.json（不存在则抛 goal_not_found）
+ *   2. addSubgoal（校验 depends_on 引用已有 subgoal）
+ *   3. createTask 创建关联任务（写入 goal_id / subgoal_id 到 task status.json）
+ *   4. linkTaskToSubgoal（将 task_id 关联到 subgoal）
+ *   5. updateSubgoalStatus(running)（ready → running）
+ *   6. 写回 goal_status.json
+ *
+ * 注意：
+ *   - createSubgoalTask 强制 execution_mode 为 "execute"，因为 assess_only 不产生可关联的 task。
+ *   - createTask 内部使用 getConfig()，因此 workspaceRoot 由全局配置决定。
+ */
+import { readGoalStatus, writeGoalStatus } from "../goal/goalStore.js";
+import { addSubgoal, linkTaskToSubgoal, updateSubgoalStatus } from "../goal/goalStatus.js";
+import { createTask } from "./createTask.js";
+import { createWorktree, discardWorktree } from "../goal/worktreeManager.js";
+import { getConfig } from "../config.js";
+import { PatchWardenError } from "../errors.js";
+// ── 函数实现 ──────────────────────────────────────────────────────
+/**
+ * 原子地创建一个 subgoal 并关联到一个新任务。
+ *
+ * @throws PatchWardenError("goal_not_found") 当 goal_id 不存在
+ * @throws PatchWardenError("invalid_dependency") 当 depends_on 引用不存在的 subgoal
+ * @throws PatchWardenError("invalid_execution_mode") 当 execution_mode 为 "assess_only"
+ */
+export function createSubgoalTask(input) {
+    // assess_only 不产生 task，无法关联到 subgoal
+    if (input.execution_mode === "assess_only") {
+        throw new PatchWardenError("invalid_execution_mode", "createSubgoalTask does not support execution_mode \"assess_only\"", "Use execution_mode \"execute\" (default) so a task is created and linked to the subgoal.", true, { goal_id: input.goal_id, execution_mode: input.execution_mode });
+    }
+    // 1. 读取 goal_status.json，如果不存在抛 goal_not_found
+    let goalStatus;
+    try {
+        goalStatus = readGoalStatus(input.goal_id);
+    }
+    catch {
+        throw new PatchWardenError("goal_not_found", `Goal "${input.goal_id}" not found`, "Call list_goals to see available goals.", true, { goal_id: input.goal_id });
+    }
+    // 2. addSubgoal（校验 depends_on）
+    const { goalStatus: withSubgoal, subgoalId } = addSubgoal(goalStatus, input.subgoal_title, input.depends_on ?? []);
+    // 2.5 Worktree 隔离（默认开启）：为该 subgoal task 创建独立 git worktree，
+    //     用 worktree 路径作为 createTask 的 repo_path，避免并发 task 互相污染。
+    //     isolate_worktree === false 时退化为原行为（使用 input.repo_path）。
+    const isolate = input.isolate_worktree !== false;
+    let repoPathForTask = input.repo_path;
+    let worktreeId = null;
+    if (isolate) {
+        const workspaceRoot = getConfig().workspaceRoot;
+        const wt = createWorktree(input.goal_id, subgoalId, workspaceRoot);
+        repoPathForTask = wt.worktreePath;
+        worktreeId = wt.worktreeId;
+    }
+    // 3. 调用 createTask 创建关联任务（强制 execute 模式，确保返回 CreateTaskOutput）
+    let taskId;
+    try {
+        const taskResult = createTask({
+            plan_id: input.plan_id,
+            inline_plan: input.inline_plan,
+            plan_title: input.plan_title,
+            template: input.template,
+            goal: input.goal,
+            agent: input.agent,
+            repo_path: repoPathForTask,
+            test_command: input.test_command,
+            verify_commands: input.verify_commands,
+            timeout_seconds: input.timeout_seconds,
+            execution_mode: "execute",
+            assessment_id: input.assessment_id,
+            scope: input.scope,
+            forbidden: input.forbidden,
+            verification: input.verification,
+            done_evidence: input.done_evidence,
+            goal_id: input.goal_id,
+            subgoal_id: subgoalId,
+        });
+        // execution_mode 为 "execute"，createTask 返回 CreateTaskOutput（含 task_id）
+        taskId = taskResult.task_id;
+    }
+    catch (createTaskErr) {
+        // createTask 失败：清理已创建的隔离 worktree，避免遗留半成品（best effort）
+        if (isolate && worktreeId) {
+            try {
+                discardWorktree(worktreeId, getConfig().workspaceRoot);
+            }
+            catch { /* ignore cleanup failure，向上抛出原始 createTask 错误 */ }
+        }
+        throw createTaskErr;
+    }
+    // 4. linkTaskToSubgoal + updateSubgoalStatus(running)
+    const withTask = linkTaskToSubgoal(withSubgoal, subgoalId, taskId);
+    let withRunning = updateSubgoalStatus(withTask, subgoalId, "running");
+    // 4.5 隔离模式下，把 worktree_id 记录到 subgoal 对象（写入 goal_status.json）
+    if (isolate && worktreeId) {
+        const newSubgoals = withRunning.subgoals.map((s) => s.id === subgoalId
+            ? { ...s, worktree_id: worktreeId }
+            : s);
+        withRunning = { ...withRunning, subgoals: newSubgoals };
+    }
+    // 5. 写回 goal_status.json
+    writeGoalStatus(input.goal_id, withRunning);
+    return {
+        subgoal_id: subgoalId,
+        task_id: taskId,
+        subgoal_status: "running",
+    };
+}

package/dist/tools/healthCheck.d.ts

@@ -69,6 +69,7 @@ export declare function healthCheck(catalog?: ToolCatalogSnapshot, input?: Healt
     agent_status: {
         [k: string]: string;
     };
+    search_tool_count?: 5 | undefined;
     direct_tool_count?: number | undefined;
     status: string;
     server_version: string;

package/dist/tools/healthCheck.js

@@ -5,7 +5,7 @@ import { getConfig, getTasksDir, getDirectSessionsDir, resolveWorkspaceRoot } fr
 import { listAgents } from "./listAgents.js";
 import { redactSensitiveContent, redactSensitiveValue } from "../security/contentRedaction.js";
 import { PATCHWARDEN_VERSION, TOOL_SCHEMA_EPOCH } from "../version.js";
-import { CHATGPT_CORE_TOOL_NAMES, CHATGPT_DIRECT_TOOL_NAMES, resolveToolProfile } from "./toolCatalog.js";
+import { CHATGPT_CORE_TOOL_NAMES, CHATGPT_DIRECT_TOOL_NAMES, CHATGPT_SEARCH_TOOL_NAMES, resolveToolProfile } from "./toolCatalog.js";
 import { readWatcherStatus } from "../watcherStatus.js";
 import { listTasks } from "./listTasks.js";
 const SERVER_STARTED_AT = Date.now();
@@ -39,6 +39,9 @@ export function healthCheck(catalog, input = {}) {
             profileErrors.push("Direct profile is disabled (enableDirectProfile=false). Only health_check is available. Set enableDirectProfile: true to enable Direct session tools.");
             profileConsistent = false;
         }
+        else if (activeProfile === "chatgpt_search") {
+            expectedNames = [...CHATGPT_SEARCH_TOOL_NAMES];
+        }
         if (expectedNames) {
             const catalogNames = new Set(catalog.tool_names);
             for (const name of expectedNames) {
@@ -95,6 +98,7 @@ export function healthCheck(catalog, input = {}) {
         direct_sessions_dir: directSessions,
         direct_session_ttl_seconds: config.directSessionTtlSeconds,
         ...(activeProfile === "chatgpt_direct" ? { direct_tool_count: config.enableDirectProfile ? CHATGPT_DIRECT_TOOL_NAMES.length : 1 } : {}),
+        ...(activeProfile === "chatgpt_search" ? { search_tool_count: CHATGPT_SEARCH_TOOL_NAMES.length } : {}),
         connector_visibility: {
             status: "not_observable_server_side",
             verification: "Refresh or reconnect the Connector and verify tools/list from a new ChatGPT conversation.",

package/dist/tools/invokeDiscoveredTool.d.ts

@@ -0,0 +1,37 @@
+/**
+ * v0.8.1: invoke_discovered_tool MCP 工具封装层。
+ *
+ * 受控动态调用链：agent 必须先 discover_tools 获取 discoveryToken，
+ * 再凭 token 调用工具。本模块串联 consumeToken → toolMeta 查找 →
+ * 防递归 → checkInvocation → dispatch → logToolInvocation，
+ * 任一环节失败都记审计日志并返回错误结果，不向上层抛错。
+ */
+import type { ToolProfile } from "./toolCatalog.js";
+import type { ToolDef } from "./registry.js";
+export interface InvokeDiscoveredToolInput {
+    toolName: string;
+    arguments: Record<string, unknown>;
+    discoveryToken: string;
+    assessmentId?: string;
+}
+export type ToolDispatch = (name: string, args: Record<string, unknown>) => Promise<unknown>;
+export interface InvokeDiscoveredToolContext {
+    tools: ToolDef[];
+    profile: ToolProfile;
+    dispatch: ToolDispatch;
+}
+export interface InvokeDiscoveredToolResult {
+    ok: boolean;
+    result?: unknown;
+    error?: {
+        reason: string;
+        message: string;
+    };
+    invocation_log_written: boolean;
+}
+/**
+ * 受控动态调用入口。串联 token 消费、toolMeta 查找、防递归、
+ * 8 项守卫校验、工具分发和审计日志。任何环节失败都记日志并返回
+ * 错误结果，不向上层抛错。
+ */
+export declare function invokeDiscoveredTool(input: InvokeDiscoveredToolInput, context: InvokeDiscoveredToolContext): Promise<InvokeDiscoveredToolResult>;

package/dist/tools/invokeDiscoveredTool.js

@@ -0,0 +1,112 @@
+/**
+ * v0.8.1: invoke_discovered_tool MCP 工具封装层。
+ *
+ * 受控动态调用链：agent 必须先 discover_tools 获取 discoveryToken，
+ * 再凭 token 调用工具。本模块串联 consumeToken → toolMeta 查找 →
+ * 防递归 → checkInvocation → dispatch → logToolInvocation，
+ * 任一环节失败都记审计日志并返回错误结果，不向上层抛错。
+ */
+import { consumeToken } from "../security/discoveryTokenStore.js";
+import { checkInvocation } from "../security/toolInvocationGuard.js";
+import { logToolInvocation, computeArgumentsDigest } from "../logging.js";
+import { buildToolRegistry } from "./toolRegistry.js";
+import { PatchWardenError } from "../errors.js";
+// ── 内部错误码常量 ────────────────────────────────────────────────
+const RECURSIVE_INVOCATION_BLOCKED = "recursive_invocation_blocked";
+const TOOL_NOT_REGISTERED = "tool_not_registered";
+const DISPATCH_ERROR = "dispatch_error";
+// ── 公共 API ──────────────────────────────────────────────────────
+/**
+ * 受控动态调用入口。串联 token 消费、toolMeta 查找、防递归、
+ * 8 项守卫校验、工具分发和审计日志。任何环节失败都记日志并返回
+ * 错误结果，不向上层抛错。
+ */
+export async function invokeDiscoveredTool(input, context) {
+    const startTime = Date.now();
+    const argumentsDigest = computeArgumentsDigest(input.arguments);
+    let tokenRecord = null;
+    let toolMeta = null;
+    const writeLog = (result, errorCode) => {
+        const durationMs = Date.now() - startTime;
+        logToolInvocation({
+            timestamp: new Date().toISOString(),
+            toolName: input.toolName,
+            discoveryToken: input.discoveryToken,
+            risk: toolMeta?.risk ?? "unknown",
+            profile: context.profile,
+            arguments_digest: argumentsDigest,
+            ...(tokenRecord?.allowedScope ? { allowedScope: tokenRecord.allowedScope } : {}),
+            result,
+            ...(errorCode ? { error_code: errorCode } : {}),
+            duration_ms: durationMs,
+        });
+    };
+    const fail = (reason, message) => {
+        writeLog("error", reason);
+        return {
+            ok: false,
+            error: { reason, message },
+            invocation_log_written: true,
+        };
+    };
+    try {
+        // 1. consumeToken（单次使用语义，token_not_found / token_expired 在此抛出）
+        try {
+            tokenRecord = consumeToken(input.discoveryToken);
+        }
+        catch (err) {
+            if (err instanceof PatchWardenError) {
+                return fail(err.reason, err.message);
+            }
+            return fail("token_error", err instanceof Error ? err.message : String(err));
+        }
+        // 2. 查 toolMeta（防止调用未注册工具）
+        const registry = buildToolRegistry(context.tools);
+        toolMeta = registry.find((meta) => meta.name === input.toolName) ?? null;
+        if (!toolMeta) {
+            return fail(TOOL_NOT_REGISTERED, `Tool "${input.toolName}" is not registered in the tool registry.`);
+        }
+        // 3. 防递归：禁止调用 invoke_discovered_tool 自身（防止绕过守卫）
+        if (input.toolName === "invoke_discovered_tool") {
+            return fail(RECURSIVE_INVOCATION_BLOCKED, "Recursive invocation of invoke_discovered_tool is blocked. invoke_discovered_tool cannot call itself.");
+        }
+        // 4. checkInvocation（8 项调用前强制校验）
+        try {
+            checkInvocation({
+                toolName: input.toolName,
+                toolMeta,
+                args: input.arguments,
+                discoveryTokenRecord: tokenRecord,
+                profile: context.profile,
+                assessmentId: input.assessmentId,
+            });
+        }
+        catch (err) {
+            if (err instanceof PatchWardenError) {
+                return fail(err.reason, err.message);
+            }
+            return fail("guard_error", err instanceof Error ? err.message : String(err));
+        }
+        // 5. dispatch（调用实际工具 handler）
+        let dispatchResult;
+        try {
+            dispatchResult = await context.dispatch(input.toolName, input.arguments);
+        }
+        catch (err) {
+            const message = err instanceof Error ? err.message : String(err);
+            return fail(DISPATCH_ERROR, `Dispatch failed for tool "${input.toolName}": ${message}`);
+        }
+        // 6. 成功 → 记审计日志 → 返回成功结果
+        writeLog("ok");
+        return {
+            ok: true,
+            result: dispatchResult,
+            invocation_log_written: true,
+        };
+    }
+    catch (err) {
+        // 兜底：任何意外错误都记日志并返回错误结果（不抛给上层）
+        const message = err instanceof Error ? err.message : String(err);
+        return fail("unexpected_error", `Unexpected error during invoke_discovered_tool: ${message}`);
+    }
+}

package/dist/tools/listTasks.d.ts

@@ -1,4 +1,4 @@
-import type { TaskPhase, TaskStatus } from "./createTask.js";
+import type { TaskPhase, TaskStatus, AcceptanceStatus } from "./createTask.js";
 import { type PendingReason, type WatcherState, type WatcherStatusSnapshot } from "../watcherStatus.js";
 export interface TaskEntry {
     task_id: string;
@@ -7,6 +7,7 @@ export interface TaskEntry {
     agent: string;
     status: TaskStatus;
     phase: TaskPhase;
+    acceptance_status: AcceptanceStatus;
     created_at: string;
     updated_at: string;
     workspace_root: string;
@@ -25,6 +26,7 @@ export interface ListTasksInput {
     status?: string;
     repo_path?: string;
     active_only?: boolean;
+    acceptance_status?: string;
     limit?: number;
 }
 export interface ListTasksOutput {

package/dist/tools/listTasks.js

@@ -9,6 +9,7 @@ export function listTasks(input) {
     const plansDir = getPlansDir(config);
     const limit = input?.limit && input.limit > 0 ? Math.min(input.limit, 100) : 20;
     const filterStatus = input?.status || null;
+    const filterAcceptance = input?.acceptance_status || null;
     const filterRepo = input?.repo_path?.trim().replace(/\\/g, "/") || null;
     const watcher = readWatcherStatus(config);
     if (!existsSync(tasksDir)) {
@@ -40,7 +41,14 @@ export function listTasks(input) {
             const runtime = readTaskRuntime(taskDir);
             if (filterStatus && data.status !== filterStatus)
                 continue;
-            if (input?.active_only && data.status !== "pending" && data.status !== "running")
+            if (filterAcceptance) {
+                const taskAcceptance = data.status === "done_by_agent"
+                    ? (typeof data.acceptance_status === "string" ? data.acceptance_status : "pending")
+                    : null;
+                if (taskAcceptance !== filterAcceptance)
+                    continue;
+            }
+            if (input?.active_only && !["pending", "running", "collecting_artifacts"].includes(String(data.status)))
                 continue;
             const normalizedRepo = String(data.repo_path || ".").replace(/\\/g, "/");
             const normalizedResolvedRepo = String(data.resolved_repo_path || "").replace(/\\/g, "/");
@@ -64,6 +72,10 @@ export function listTasks(input) {
                 }
             }
             const phase = runtime.phase || data.phase || "queued";
+            const VALID_ACCEPTANCE = ["pending", "accepted", "rejected", "needs_fix", "blocked"];
+            const acceptanceStatus = data.status === "done_by_agent"
+                ? (typeof data.acceptance_status === "string" && VALID_ACCEPTANCE.includes(data.acceptance_status) ? data.acceptance_status : "pending")
+                : null;
             tasks.push({
                 task_id: taskId,
                 plan_id: data.plan_id || "",
@@ -71,6 +83,7 @@ export function listTasks(input) {
                 agent: data.agent || "",
                 status: data.status || "pending",
                 phase,
+                acceptance_status: acceptanceStatus,
                 created_at: data.created_at || "",
                 updated_at: data.updated_at || "",
                 workspace_root: data.workspace_root || config.workspaceRoot,

package/dist/tools/mergeWorktree.d.ts

@@ -0,0 +1,24 @@
+/**
+ * v1.0.0 Part B: merge_worktree MCP 工具 handler — 把隔离 worktree 的 branch
+ * 合并回主工作区，并将 worktree 状态置为 "merged"。
+ *
+ * 参考 src/tools/auditTask.ts 的导出/返回风格。
+ */
+export interface MergeWorktreeInput {
+    worktree_id: string;
+    repo_path: string;
+}
+export interface MergeWorktreeOutput {
+    worktree_id: string;
+    status: "merged";
+    merged_at: string;
+}
+/**
+ * 合并指定 worktree 的 branch 回 repo_path（主工作区）。
+ *
+ * @throws PatchWardenError("workspace_path_escape") 当 repo_path 逃逸出 workspaceRoot
+ * @throws PatchWardenError("worktree_not_found") 当 worktree 不存在
+ * @throws PatchWardenError("invalid_worktree_state") 当 worktree 非 active
+ * @throws PatchWardenError("worktree_merge_failed") 当 git merge 失败
+ */
+export declare function mergeWorktreeTool(input: MergeWorktreeInput): MergeWorktreeOutput;

package/dist/tools/mergeWorktree.js

@@ -0,0 +1,27 @@
+/**
+ * v1.0.0 Part B: merge_worktree MCP 工具 handler — 把隔离 worktree 的 branch
+ * 合并回主工作区，并将 worktree 状态置为 "merged"。
+ *
+ * 参考 src/tools/auditTask.ts 的导出/返回风格。
+ */
+import { getConfig } from "../config.js";
+import { guardWorkspacePath } from "../security/pathGuard.js";
+import { mergeWorktree } from "../goal/worktreeManager.js";
+/**
+ * 合并指定 worktree 的 branch 回 repo_path（主工作区）。
+ *
+ * @throws PatchWardenError("workspace_path_escape") 当 repo_path 逃逸出 workspaceRoot
+ * @throws PatchWardenError("worktree_not_found") 当 worktree 不存在
+ * @throws PatchWardenError("invalid_worktree_state") 当 worktree 非 active
+ * @throws PatchWardenError("worktree_merge_failed") 当 git merge 失败
+ */
+export function mergeWorktreeTool(input) {
+    const config = getConfig();
+    const repoPathSafe = guardWorkspacePath(input.repo_path, config.workspaceRoot);
+    mergeWorktree(input.worktree_id, repoPathSafe);
+    return {
+        worktree_id: input.worktree_id,
+        status: "merged",
+        merged_at: new Date().toISOString(),
+    };
+}

package/dist/tools/reconcileTasks.d.ts

@@ -0,0 +1,41 @@
+import { type PatchWardenConfig } from "../config.js";
+import { type DiagnosisType, type DiagnosisConfidence, type SafeAction } from "./diagnoseTask.js";
+export type ReconcileMode = "report_only" | "safe_fix";
+export interface ReconcileTasksInput {
+    max_age_minutes?: number;
+    mode?: ReconcileMode;
+    include_done_candidates?: boolean;
+}
+export interface ReconcileTaskReport {
+    task_id: string;
+    status: string;
+    phase: string | null;
+    diagnosis: DiagnosisType;
+    confidence: DiagnosisConfidence;
+    reasons: string[];
+    safe_actions: SafeAction[];
+    age_seconds: number | null;
+    action_taken: "left_unchanged" | "marked_failed_stale" | "marked_orphaned" | "marked_done_by_agent";
+    previous_status: string | null;
+    new_status: string | null;
+    applied_at: string | null;
+    applied_by: string | null;
+    evidence_summary: {
+        heartbeat_age_seconds: number | null;
+        stdout_age_seconds: number | null;
+        child_pid: number | null;
+        child_pid_alive: boolean | null;
+        watcher_owns_task: boolean;
+    };
+}
+export interface ReconcileTasksOutput {
+    mode: ReconcileMode;
+    scanned: number;
+    candidates: number;
+    reconciled: number;
+    skipped_low_confidence: number;
+    skipped_active_watcher: number;
+    reports: ReconcileTaskReport[];
+    reconcile_log_path: string | null;
+}
+export declare function reconcileTasks(input?: ReconcileTasksInput, config?: PatchWardenConfig): ReconcileTasksOutput;