patchwarden 0.6.4 → 1.1.0

package/dist/runner/runTask.js

@@ -11,6 +11,7 @@ import { buildAgentInvocation, buildExecutionPrompt } from "./agentInvocation.js
 import { buildChangeArtifacts, captureRepoSnapshot, compareSnapshots, emptyArtifactHygiene, writeSnapshot, extractExternalDirtyFiles, findNewExternalDirtyFiles, buildArtifactManifest, groupChangedFiles, } from "./changeCapture.js";
 import { errorPayload } from "../errors.js";
 import { diagnoseAndroidBuild } from "../tools/androidDoctor.js";
+import { runPostTaskCleanup } from "./postTaskCleanup.js";
 const HEARTBEAT_INTERVAL_MS = 2000;
 const GRACEFUL_KILL_MS = 2000;
 const MAX_CAPTURE_CHARS = 100_000;
@@ -81,6 +82,14 @@ export async function runTask(taskId) {
         current_command: null,
         error: null,
     });
+    // v0.7.0: record task_started_at and watcher_instance_id so diagnose_task
+    // can detect PID reuse and orphaned tasks. watcher_instance_id comes from
+    // the watcher process env; when run_task MCP tool is used directly, this
+    // field is intentionally left undefined so ownership cannot be falsely claimed.
+    writeTaskRuntime(taskDir, {
+        task_started_at: new Date(startedAtMs).toISOString(),
+        watcher_instance_id: process.env.PATCHWARDEN_WATCHER_INSTANCE_ID || undefined,
+    });
     setTaskPhase(taskDir, "preparing", null, "Capturing pre-task repository state.");
     let beforeSnapshot;
     let beforeWorkspaceSnapshot;
@@ -166,7 +175,7 @@ export async function runTask(taskId) {
                     : `Verification command \"${failedVerification.command}\" exited with code ${failedVerification.exitCode}.`;
             }
             else if (verifyResults.length === verifyCommands.length) {
-                finalStatus = "done";
+                finalStatus = "done_by_agent";
             }
             else {
                 finalError = "Verification did not complete all configured commands.";
@@ -174,13 +183,35 @@ export async function runTask(taskId) {
         }
         else {
             testResult = skippedTest(testCommand, repoPath, "No verification command configured.");
-            finalStatus = "done";
+            finalStatus = "done_by_agent";
         }
     }
     catch (error) {
         lastCaughtError = error;
         finalError = errorMessage(error);
     }
+    let cleanupReport = {
+        enabled: true,
+        removed: [],
+        skipped: [],
+        source_files_touched: 0,
+    };
+    if (finalStatus !== "canceled") {
+        try {
+            cleanupReport = runPostTaskCleanup(repoPath, taskDir);
+            updateStatus(taskDir, { cleanup: cleanupReport });
+        }
+        catch (error) {
+            cleanupReport = {
+                enabled: true,
+                removed: [],
+                skipped: [{ path: ".", reason: "post_task_cleanup", skip_reason: errorMessage(error) }],
+                source_files_touched: 0,
+            };
+            writeFileSync(join(taskDir, "post-task-cleanup.json"), JSON.stringify(cleanupReport, null, 2), "utf-8");
+            updateStatus(taskDir, { cleanup: cleanupReport });
+        }
+    }
     setTaskPhase(taskDir, "collecting_artifacts", null, "Capturing post-task state and writing reports.");
     const artifactCollectionStartedAt = new Date().toISOString();
     let changes;
@@ -252,7 +283,7 @@ export async function runTask(taskId) {
             "",
         ].join("\n"), "utf-8");
         // Don't override test failure with artifact failure
-        if (finalStatus === "done") {
+        if (finalStatus === "done_by_agent") {
             finalError = `Change capture failed: ${artifactCollectionError}`;
             finalStatus = "failed";
         }
@@ -276,7 +307,7 @@ export async function runTask(taskId) {
     }
     catch (error) {
         finalError ||= `Workspace scope capture failed: ${errorMessage(error)}`;
-        if (finalStatus === "done")
+        if (finalStatus === "done_by_agent")
             finalStatus = "failed";
     }
     // Phase 4: Pre-existing external dirty files are warnings, not failures
@@ -338,9 +369,9 @@ export async function runTask(taskId) {
     }
     writeFileSync(join(taskDir, "verify.json"), JSON.stringify(verifyJson, null, 2), "utf-8");
     writeFileSync(join(taskDir, "verify.log"), buildVerifyLog(verifyJson.commands), "utf-8");
-    if (!["canceled", "done", "failed_verification", "failed_scope_violation", "failed_policy_violation"].includes(finalStatus))
+    if (!["canceled", "done_by_agent", "failed_verification", "failed_scope_violation", "failed_policy_violation"].includes(finalStatus))
         finalStatus = "failed";
-    const finalPhase = finalStatus === "done" ? "completed" : finalStatus;
+    const finalPhase = finalStatus === "done_by_agent" ? "done_by_agent" : finalStatus;
     const followup = buildFailureFollowup(finalStatus, finalError, verifyJson.commands);
     // Phase 7: Run Android build environment diagnostics if android_app exists
     const androidDiagnostic = diagnoseAndroidBuild(repoPath);
@@ -400,6 +431,7 @@ export async function runTask(taskId) {
         artifact_collection_error: artifactCollectionError,
         artifact_collection_started_at: artifactCollectionStartedAt,
         artifact_collection_finished_at: artifactCollectionFinishedAt,
+        cleanup: cleanupReport,
         artifact_manifest: artifactManifest,
         out_of_scope_changes: outOfScopeChanges,
         new_out_of_scope_changes: newOutOfScopeChanges,
@@ -417,7 +449,7 @@ export async function runTask(taskId) {
         commands_observed: [],
         verify: verifyJson,
         artifacts: [
-            "result.md", "result.json", "diff.patch", "git.diff", "test.log", "verify.log", "verify.json", "changed-files.json", "file-stats.json", "artifact_manifest.json",
+            "result.md", "result.json", "diff.patch", "git.diff", "test.log", "verify.log", "verify.json", "changed-files.json", "file-stats.json", "artifact_manifest.json", "post-task-cleanup.json",
             ...(outOfScopeChanges.length > 0 ? ["rollback_scope_violation_plan.md", "rollback-plan.json"] : []),
             ...(artifactStatus !== "collected" ? ["partial_result.md"] : []),
         ],
@@ -433,7 +465,7 @@ export async function runTask(taskId) {
         failed_command: followup.failed_command,
         suggested_next_action: followup.suggested_next_action,
         safe_followup_prompt: followup.safe_followup_prompt,
-        next_steps: finalStatus === "done"
+        next_steps: finalStatus === "done_by_agent"
             ? ["Review get_task_summary and audit_task before accepting the work."]
             : ["Resolve the reported failure before accepting the work."],
     }, null, 2), "utf-8");
@@ -459,6 +491,7 @@ export async function runTask(taskId) {
         artifact_collection_error: artifactCollectionError,
         artifact_collection_started_at: artifactCollectionStartedAt,
         artifact_collection_finished_at: artifactCollectionFinishedAt,
+        cleanup: cleanupReport,
         out_of_scope_changes: outOfScopeChanges,
         new_out_of_scope_changes: newOutOfScopeChanges,
         preexisting_external_dirty_files: preexistingExternalDirty,
@@ -469,6 +502,7 @@ export async function runTask(taskId) {
         workspace_dirty_before: changes.workspace_dirty_before,
         workspace_dirty_after: changes.workspace_dirty_after,
         workspace_dirty: changes.workspace_dirty_after,
+        acceptance_status: finalStatus === "done_by_agent" ? "pending" : null,
     });
     writeTaskRuntime(taskDir, {
         phase: finalPhase,
@@ -485,7 +519,7 @@ export async function runTask(taskId) {
 }
 function buildFailureFollowup(status, error, commands) {
     const failed = commands.find((command) => command.status !== "passed");
-    if (status === "done") {
+    if (status === "done_by_agent" || status === "done") {
         return {
             failure_reason: null,
             failed_command: null,
@@ -548,6 +582,12 @@ async function runManagedProcess(options) {
     catch (error) {
         return { exitCode: null, stdout: "", stderr: "", spawnError: errorMessage(error), terminationReason: null };
     }
+    // v0.7.0: record child_started_at immediately so diagnose_task can detect
+    // PID reuse by comparing this timestamp with the live process start time.
+    writeTaskRuntime(options.taskDir, {
+        child_pid: child.pid,
+        child_started_at: new Date().toISOString(),
+    });
     const stdoutStream = openStream(options.stdoutPath);
     const stderrStream = openStream(options.stderrPath);
     let stdout = "";
@@ -795,7 +835,7 @@ function buildResultMarkdown(input) {
         input.error || "Agent execution and configured verification completed successfully.",
         "",
         "## Risks",
-        input.status === "done"
+        input.status === "done_by_agent" || input.status === "done"
             ? "- Review git.diff and changed-files.json before accepting the task."
             : "- Task did not complete successfully; outputs may be partial.",
         "",

package/dist/security/discoveryTokenStore.d.ts

@@ -0,0 +1,62 @@
+/**
+ * v0.8.1: discovery token store — server-side token store for invoke_discovered_tool.
+ *
+ * discover_tools 为每个搜索结果生成 discoveryToken，server-side 保存 token 真实信息。
+ * invoke_discovered_tool 只接受 token id（不信任客户端回传的 token JSON）。
+ *
+ * 安全契约：
+ * - 不引入第三方 npm 依赖（用 node:crypto 的 randomBytes）
+ * - 不持久化到磁盘（内存 Map，进程内共享，单例）
+ * - token 单次使用语义（consumeToken 后即删除）
+ */
+import type { ToolRisk } from "../tools/toolRegistry.js";
+import type { ToolProfile } from "../tools/toolCatalog.js";
+export interface DiscoveryTokenRecord {
+    token: string;
+    toolName: string;
+    risk: ToolRisk;
+    allowedScope?: string[];
+    issuedAt: string;
+    expiresAt: string;
+    query: string;
+    schemaDigest: string;
+    profile: ToolProfile;
+}
+export interface IssueTokenInput {
+    toolName: string;
+    risk: ToolRisk;
+    query: string;
+    schemaDigest: string;
+    profile: ToolProfile;
+    allowedScope?: string[];
+    ttlMs?: number;
+}
+/**
+ * 生成并保存 discovery token，返回 token id。
+ * token id 格式：dst_{YYYYMMDD}_{randomHex12}
+ */
+export declare function issueToken(input: IssueTokenInput): string;
+/**
+ * 消费 token（单次使用语义）。
+ * - 不存在 → 抛 PatchWardenError("token_not_found")
+ * - 过期（expiresAt 早于现在）→ 抛 PatchWardenError("token_expired")
+ * - 有效 → 从 store 删除并返回 record
+ */
+export declare function consumeToken(tokenId: string): DiscoveryTokenRecord;
+/**
+ * 只读查看 token，不消费、不校验过期。
+ * 不存在返回 null，存在返回 record（不删除）。
+ */
+export declare function peekToken(tokenId: string): DiscoveryTokenRecord | null;
+/**
+ * 撤销 token，返回是否删除成功。
+ */
+export declare function revokeToken(tokenId: string): boolean;
+/**
+ * 清空所有 token（测试用）。
+ */
+export declare function clearAllTokens(): void;
+/**
+ * 返回当前 store 中的 token 数量（测试/诊断用）。
+ */
+export declare function getActiveTokenCount(): number;

package/dist/security/discoveryTokenStore.js

@@ -0,0 +1,100 @@
+/**
+ * v0.8.1: discovery token store — server-side token store for invoke_discovered_tool.
+ *
+ * discover_tools 为每个搜索结果生成 discoveryToken，server-side 保存 token 真实信息。
+ * invoke_discovered_tool 只接受 token id（不信任客户端回传的 token JSON）。
+ *
+ * 安全契约：
+ * - 不引入第三方 npm 依赖（用 node:crypto 的 randomBytes）
+ * - 不持久化到磁盘（内存 Map，进程内共享，单例）
+ * - token 单次使用语义（consumeToken 后即删除）
+ */
+import { randomBytes } from "node:crypto";
+import { PatchWardenError } from "../errors.js";
+// ── 常量 ──────────────────────────────────────────────────────────
+const DEFAULT_TTL_MS = 10 * 60 * 1000; // 10 分钟
+// ── 模块级 token store（单例，进程内共享） ───────────────────────
+const tokenStore = new Map();
+// ── 内部工具 ──────────────────────────────────────────────────────
+function formatDatePart(date) {
+    const y = date.getFullYear();
+    const m = String(date.getMonth() + 1).padStart(2, "0");
+    const d = String(date.getDate()).padStart(2, "0");
+    return `${y}${m}${d}`;
+}
+function generateTokenId() {
+    const datePart = formatDatePart(new Date());
+    const randomPart = randomBytes(6).toString("hex"); // 12 位 hex
+    return `dst_${datePart}_${randomPart}`;
+}
+// ── 公共 API ──────────────────────────────────────────────────────
+/**
+ * 生成并保存 discovery token，返回 token id。
+ * token id 格式：dst_{YYYYMMDD}_{randomHex12}
+ */
+export function issueToken(input) {
+    const now = new Date();
+    const issuedAt = now.toISOString();
+    const expiresAt = new Date(Date.now() + (input.ttlMs ?? DEFAULT_TTL_MS)).toISOString();
+    const token = generateTokenId();
+    const record = {
+        token,
+        toolName: input.toolName,
+        risk: input.risk,
+        allowedScope: input.allowedScope,
+        issuedAt,
+        expiresAt,
+        query: input.query,
+        schemaDigest: input.schemaDigest,
+        profile: input.profile,
+    };
+    tokenStore.set(token, record);
+    return token;
+}
+/**
+ * 消费 token（单次使用语义）。
+ * - 不存在 → 抛 PatchWardenError("token_not_found")
+ * - 过期（expiresAt 早于现在）→ 抛 PatchWardenError("token_expired")
+ * - 有效 → 从 store 删除并返回 record
+ */
+export function consumeToken(tokenId) {
+    const record = tokenStore.get(tokenId);
+    if (!record) {
+        throw new PatchWardenError("token_not_found", `Discovery token not found: ${tokenId}`, "Call discover_tools to obtain a fresh discovery token before invoking invoke_discovered_tool.", true, { token: tokenId });
+    }
+    const now = Date.now();
+    const expiresAtMs = Date.parse(record.expiresAt);
+    if (expiresAtMs < now) {
+        // 过期 token 从 store 删除，避免累积
+        tokenStore.delete(tokenId);
+        throw new PatchWardenError("token_expired", `Discovery token expired: ${tokenId}`, "Call discover_tools again to obtain a fresh discovery token.", true, { token: tokenId, expired_at: record.expiresAt });
+    }
+    tokenStore.delete(tokenId);
+    return record;
+}
+/**
+ * 只读查看 token，不消费、不校验过期。
+ * 不存在返回 null，存在返回 record（不删除）。
+ */
+export function peekToken(tokenId) {
+    const record = tokenStore.get(tokenId);
+    return record ?? null;
+}
+/**
+ * 撤销 token，返回是否删除成功。
+ */
+export function revokeToken(tokenId) {
+    return tokenStore.delete(tokenId);
+}
+/**
+ * 清空所有 token（测试用）。
+ */
+export function clearAllTokens() {
+    tokenStore.clear();
+}
+/**
+ * 返回当前 store 中的 token 数量（测试/诊断用）。
+ */
+export function getActiveTokenCount() {
+    return tokenStore.size;
+}

package/dist/security/toolInvocationGuard.d.ts

@@ -0,0 +1,35 @@
+/**
+ * v0.8.1: toolInvocationGuard — invoke_discovered_tool 调用前强制校验。
+ *
+ * consumeToken 已完成 token 存在性与过期校验，guard 收到的是已消费的 record。
+ * guard 依次执行 8 项校验，任一失败抛出对应错误码：
+ *   1. token_tool_mismatch       — toolName 与 record.toolName 一致性
+ *   2. profile_not_allowed        — toolMeta.profiles 必须包含当前 profile
+ *   3. risk_exceeded              — toolMeta.risk 不能超过 record.risk（schema 漂移拦截）
+ *   4. sensitive_path_blocked     — workspace_read_sensitive 路径敏感校验
+ *   5. assessment_required        — workspace_write 需要 assessmentId
+ *   6. command_not_allowed        — command 工具 args.command 元字符预检
+ *   7. release_confirmation_required — release 工具需要 assessmentId
+ *   8. credential_sensitive_blocked — credential_sensitive 总是拒绝
+ *
+ * 加上 consumeToken 内的 token_not_found / token_expired，共 10 项调用前强制校验。
+ */
+import { type PatchWardenToolMeta } from "../tools/toolRegistry.js";
+import type { ToolProfile } from "../tools/toolCatalog.js";
+import type { DiscoveryTokenRecord } from "./discoveryTokenStore.js";
+export interface GuardInput {
+    toolName: string;
+    toolMeta: PatchWardenToolMeta;
+    args: Record<string, unknown>;
+    discoveryTokenRecord: DiscoveryTokenRecord;
+    profile: ToolProfile;
+    assessmentId?: string;
+}
+export interface GuardResult {
+    allowed: boolean;
+}
+export type InvocationErrorCode = "token_tool_mismatch" | "profile_not_allowed" | "risk_exceeded" | "sensitive_path_blocked" | "assessment_required" | "command_not_allowed" | "release_confirmation_required" | "credential_sensitive_blocked";
+/**
+ * 调用前强制校验。任一校验失败抛 PatchWardenError，全部通过返回 { allowed: true }。
+ */
+export declare function checkInvocation(input: GuardInput): GuardResult;

package/dist/security/toolInvocationGuard.js

@@ -0,0 +1,153 @@
+/**
+ * v0.8.1: toolInvocationGuard — invoke_discovered_tool 调用前强制校验。
+ *
+ * consumeToken 已完成 token 存在性与过期校验，guard 收到的是已消费的 record。
+ * guard 依次执行 8 项校验，任一失败抛出对应错误码：
+ *   1. token_tool_mismatch       — toolName 与 record.toolName 一致性
+ *   2. profile_not_allowed        — toolMeta.profiles 必须包含当前 profile
+ *   3. risk_exceeded              — toolMeta.risk 不能超过 record.risk（schema 漂移拦截）
+ *   4. sensitive_path_blocked     — workspace_read_sensitive 路径敏感校验
+ *   5. assessment_required        — workspace_write 需要 assessmentId
+ *   6. command_not_allowed        — command 工具 args.command 元字符预检
+ *   7. release_confirmation_required — release 工具需要 assessmentId
+ *   8. credential_sensitive_blocked — credential_sensitive 总是拒绝
+ *
+ * 加上 consumeToken 内的 token_not_found / token_expired，共 10 项调用前强制校验。
+ */
+import { PatchWardenError } from "../errors.js";
+import { guardSensitivePath } from "./sensitiveGuard.js";
+import { TOOL_RISK_RANK } from "../tools/toolRegistry.js";
+// ── 内部常量 ──────────────────────────────────────────────────────
+/**
+ * 常见路径参数字段名，用于 workspace_read_sensitive 校验时扫描 args。
+ * 任一字段为字符串路径都会触发 guardSensitivePath。
+ */
+const PATH_ARG_FIELDS = [
+    "path",
+    "file",
+    "filePath",
+    "file_path",
+    "filename",
+    "repo_path",
+    "repoPath",
+    "target_path",
+    "targetPath",
+    "destination",
+    "dest",
+];
+/**
+ * shell 元字符黑名单，用于 command 风险工具 args.command 预检。
+ * 真正的白名单校验在 handler 内通过 commandGuard 完成，guard 只做元字符预检。
+ */
+const SHELL_METACHAR_PATTERN = /[|&;`$()<>]/;
+// ── 公共 API ──────────────────────────────────────────────────────
+/**
+ * 调用前强制校验。任一校验失败抛 PatchWardenError，全部通过返回 { allowed: true }。
+ */
+export function checkInvocation(input) {
+    const { toolName, toolMeta, args, discoveryTokenRecord, profile, assessmentId } = input;
+    // ① toolName 一致性：toolName 必须等于 record.toolName
+    if (toolName !== discoveryTokenRecord.toolName) {
+        throw new PatchWardenError("token_tool_mismatch", `Token tool mismatch: token was issued for "${discoveryTokenRecord.toolName}" but invocation targets "${toolName}".`, "Call discover_tools again and use a token issued for the intended tool name.", true, {
+            token: discoveryTokenRecord.token,
+            expected_tool: discoveryTokenRecord.toolName,
+            actual_tool: toolName,
+        });
+    }
+    // ② profile 允许：toolMeta.profiles 必须包含当前 profile
+    if (!toolMeta.profiles.includes(profile)) {
+        throw new PatchWardenError("profile_not_allowed", `Profile "${profile}" is not allowed for tool "${toolName}". Allowed profiles: ${toolMeta.profiles.join(", ")}.`, "Switch to a profile that exposes this tool, or call discover_tools under a supported profile.", true, {
+            tool: toolName,
+            current_profile: profile,
+            allowed_profiles: toolMeta.profiles,
+        });
+    }
+    // ③ 风险等级校验：toolMeta.risk 不能超过 record.risk
+    //    token record 的 risk 是 discover 时记录的工具 risk，应与 toolMeta.risk 一致。
+    //    如果工具 schema 漂移导致 risk 变了，这里会拦截。
+    const toolRiskRank = TOOL_RISK_RANK[toolMeta.risk];
+    const tokenRiskRank = TOOL_RISK_RANK[discoveryTokenRecord.risk];
+    if (toolRiskRank > tokenRiskRank) {
+        throw new PatchWardenError("risk_exceeded", `Risk exceeded: tool "${toolName}" risk is "${toolMeta.risk}" (rank ${toolRiskRank}) but discovery token was issued for risk "${discoveryTokenRecord.risk}" (rank ${tokenRiskRank}). Tool schema may have drifted.`, "Call discover_tools again to obtain a fresh token reflecting the current tool risk.", true, {
+            tool: toolName,
+            tool_risk: toolMeta.risk,
+            token_risk: discoveryTokenRecord.risk,
+            tool_risk_rank: toolRiskRank,
+            token_risk_rank: tokenRiskRank,
+        });
+    }
+    // ④ workspace_read_sensitive：检查 args 中的路径参数
+    checkSensitivePaths(toolMeta, toolName, args);
+    // ⑤ workspace_write：要求 assessmentId 非空
+    if (toolMeta.risk === "workspace_write") {
+        if (!assessmentId || assessmentId.trim() === "") {
+            throw new PatchWardenError("assessment_required", `Assessment required: tool "${toolName}" has workspace_write risk and requires a non-empty assessmentId.`, "Run the assessment flow first and pass the resulting assessmentId to invoke_discovered_tool.", true, {
+                tool: toolName,
+                risk: toolMeta.risk,
+            });
+        }
+    }
+    // ⑥ command：args.command 元字符预检
+    if (toolMeta.risk === "command") {
+        checkCommandMetachars(toolMeta, toolName, args);
+    }
+    // ⑦ release：要求 assessmentId 非空（二次确认语义）
+    if (toolMeta.risk === "release") {
+        if (!assessmentId || assessmentId.trim() === "") {
+            throw new PatchWardenError("release_confirmation_required", `Release confirmation required: tool "${toolName}" has release risk and requires a non-empty assessmentId as explicit confirmation.`, "Run the release assessment flow first and pass the resulting assessmentId to confirm the release.", true, {
+                tool: toolName,
+                risk: toolMeta.risk,
+            });
+        }
+    }
+    // ⑧ credential_sensitive：总是拒绝
+    if (toolMeta.risk === "credential_sensitive") {
+        throw new PatchWardenError("credential_sensitive_blocked", `Credential-sensitive tool "${toolName}" cannot be invoked through invoke_discovered_tool.`, "Use the dedicated credential-handling tooling outside the dynamic invoke path.", true, {
+            tool: toolName,
+            risk: toolMeta.risk,
+        });
+    }
+    return { allowed: true };
+}
+// ── 内部校验函数 ──────────────────────────────────────────────────
+/**
+ * workspace_read_sensitive 风险工具：扫描 args 中的路径参数字段，
+ * 对每个字符串路径调用 guardSensitivePath（敏感路径会抛 sensitive_path_blocked）。
+ * 没有路径参数则跳过。
+ */
+function checkSensitivePaths(toolMeta, toolName, args) {
+    if (toolMeta.risk !== "workspace_read_sensitive") {
+        return;
+    }
+    for (const field of PATH_ARG_FIELDS) {
+        const value = args[field];
+        if (typeof value === "string" && value.length > 0) {
+            // guardSensitivePath 内部会在敏感时抛 PatchWardenError("sensitive_path_blocked", ...)
+            guardSensitivePath(value);
+        }
+    }
+}
+/**
+ * command 风险工具：args.command 元字符预检。
+ * - args.command 不存在或为空 → 跳过（handler 内部会再校验）
+ * - 含 shell 元字符 → 抛 command_not_allowed
+ * 真正的白名单校验在 handler 内通过 commandGuard 完成。
+ */
+function checkCommandMetachars(_toolMeta, toolName, args) {
+    const command = args.command;
+    if (command === undefined || command === null) {
+        return;
+    }
+    if (typeof command !== "string") {
+        return;
+    }
+    if (command.trim() === "") {
+        return;
+    }
+    if (SHELL_METACHAR_PATTERN.test(command)) {
+        throw new PatchWardenError("command_not_allowed", `Command not allowed: tool "${toolName}" args.command contains shell metacharacters. Detected pattern in "${command}".`, "Provide a plain command without shell metacharacters (| & ; ` $ ( ) < >). The handler will validate against the command allowlist.", true, {
+            tool: toolName,
+            command,
+        });
+    }
+}

package/dist/smoke-test.js

@@ -17,7 +17,7 @@ import { resolve, join, dirname } from "node:path";
 import { tmpdir } from "node:os";
 import { fileURLToPath, pathToFileURL } from "node:url";
 import { spawnSync } from "node:child_process";
-import { loadConfig, getConfig, reloadConfig } from "./config.js";
+import { loadConfig, getConfig, getTasksDir, reloadConfig } from "./config.js";
 import { savePlan } from "./tools/savePlan.js";
 import { getPlan } from "./tools/getPlan.js";
 import { createTask } from "./tools/createTask.js";
@@ -533,8 +533,8 @@ test("D8b. tool profiles are exact and schema changes alter the manifest hash",
     try {
         process.env.PATCHWARDEN_TOOL_PROFILE = "full";
         const fullTools = getToolDefs();
-        if (fullTools.length !== 30)
-            throw new Error(`Expected 30 full tools, got ${fullTools.length}`);
+        if (fullTools.length !== 54)
+            throw new Error(`Expected 54 full tools, got ${fullTools.length}`);
         const coreTools = selectToolsForProfile(fullTools, "chatgpt_core", getConfig().enableDirectProfile);
         const names = coreTools.map((tool) => tool.name);
         if (JSON.stringify(names) !== JSON.stringify(CHATGPT_CORE_TOOL_NAMES)) {
@@ -926,6 +926,11 @@ test("I1. list_tasks returns tasks array", () => {
     mgmtPlanId = savePlan({ title: "Mgmt Test", content: "# Test" }).plan_id;
     mgmtTaskId = createTask({ plan_id: mgmtPlanId, agent: "codex", repo_path: "." }).task_id;
     mgmtTaskId2 = createTask({ plan_id: mgmtPlanId, agent: "codex", repo_path: "." }).task_id;
+    const collectingStatusFile = join(getTasksDir(getConfig()), mgmtTaskId2, "status.json");
+    const collectingStatus = JSON.parse(readFileSync(collectingStatusFile, "utf-8"));
+    collectingStatus.status = "collecting_artifacts";
+    collectingStatus.phase = "collecting_artifacts";
+    writeFileSync(collectingStatusFile, JSON.stringify(collectingStatus, null, 2), "utf-8");
     const result = listTasks({ limit: 5 });
     if (!Array.isArray(result.tasks))
         throw new Error("tasks not array");
@@ -943,9 +948,12 @@ test("I2b. list_tasks filters by repo and active status with watcher evidence",
     if (result.returned !== result.tasks.length || !result.watcher?.status) {
         throw new Error(`Missing list_tasks pagination or watcher evidence: ${JSON.stringify(result)}`);
     }
-    if (result.tasks.some((task) => !["pending", "running"].includes(task.status) || task.repo_path !== ".")) {
+    if (result.tasks.some((task) => !["pending", "running", "collecting_artifacts"].includes(task.status) || task.repo_path !== ".")) {
         throw new Error(`list_tasks active/repo filter mismatch: ${JSON.stringify(result.tasks)}`);
     }
+    if (!result.tasks.some((task) => task.task_id === mgmtTaskId2 && task.status === "collecting_artifacts")) {
+        throw new Error(`list_tasks active_only omitted collecting_artifacts task: ${JSON.stringify(result.tasks)}`);
+    }
 });
 test("I3. cancel_task cancels pending task", () => {
     const task = createTask({ plan_id: mgmtPlanId, agent: "codex", repo_path: "." });
@@ -1866,11 +1874,11 @@ writeFileSync(directConfigPath, JSON.stringify({
 process.env.PATCHWARDEN_CONFIG = directConfigPath;
 reloadConfig();
 let directSessionId = "";
-test("M1. chatgpt_core still has 17 tools", () => {
+test("M1. chatgpt_core still has 21 tools", () => {
     const tools = getToolDefs();
     const coreTools = selectToolsForProfile(tools, "chatgpt_core", true);
-    if (coreTools.length !== 17)
-        throw new Error(`Expected 17, got ${coreTools.length}`);
+    if (coreTools.length !== 21)
+        throw new Error(`Expected 21, got ${coreTools.length}`);
     if (JSON.stringify(coreTools.map((t) => t.name)) !== JSON.stringify(CHATGPT_CORE_TOOL_NAMES)) {
         throw new Error("Tool names mismatch");
     }
@@ -1883,11 +1891,11 @@ test("M2. chatgpt_direct disabled exposes only health_check", () => {
     if (disabledTools[0].name !== "health_check")
         throw new Error(`Expected health_check, got ${disabledTools[0].name}`);
 });
-test("M3. chatgpt_direct enabled has 10 tools", () => {
+test("M3. chatgpt_direct enabled has 13 tools", () => {
     const tools = getToolDefs();
     const directTools = selectToolsForProfile(tools, "chatgpt_direct", true);
-    if (directTools.length !== 10)
-        throw new Error(`Expected 10, got ${directTools.length}`);
+    if (directTools.length !== 13)
+        throw new Error(`Expected 13, got ${directTools.length}`);
     if (JSON.stringify(directTools.map((t) => t.name)) !== JSON.stringify(CHATGPT_DIRECT_TOOL_NAMES)) {
         throw new Error("Tool names mismatch");
     }

package/dist/taskRuntime.d.ts

@@ -5,6 +5,23 @@ export interface TaskRuntimeData {
     current_command: string | null;
     runner_pid?: number;
     child_pid?: number;
+    /**
+     * v0.7.0: ISO timestamp when the child process was spawned.
+     * Used by diagnose_task to detect PID reuse: if a live PID exists but
+     * its start time does not match child_started_at, the OS likely reused the PID.
+     */
+    child_started_at?: string;
+    /**
+     * v0.7.0: ISO timestamp when the task itself started (runner began executing).
+     * Distinct from child_started_at, which records when the agent child process spawned.
+     */
+    task_started_at?: string;
+    /**
+     * v0.7.0: Watcher instance ID that picked up and is executing this task.
+     * Used by diagnose_task to detect orphaned tasks when the current watcher
+     * instance_id differs from the one recorded at task start.
+     */
+    watcher_instance_id?: string;
 }
 export declare function readTaskRuntime(taskDir: string): Partial<TaskRuntimeData>;
 export declare function writeTaskRuntime(taskDir: string, patch: Partial<TaskRuntimeData>): TaskRuntimeData;

package/dist/test/unit/acceptance-engine.test.d.ts

@@ -0,0 +1 @@
+export {};