patchwarden 0.6.4 → 1.5.0

package/src/test/unit/invoke-discovered-tool.test.ts

@@ -0,0 +1,216 @@
+import { describe, it, beforeEach } from "node:test";
+import { strict as assert } from "node:assert";
+import {
+  invokeDiscoveredTool,
+  type InvokeDiscoveredToolContext,
+  type InvokeDiscoveredToolInput,
+} from "../../tools/invokeDiscoveredTool.js";
+import { issueToken, clearAllTokens } from "../../security/discoveryTokenStore.js";
+import { computeSchemaDigest, type ToolRisk } from "../../tools/toolRegistry.js";
+import type { ToolDef } from "../../tools/registry.js";
+
+// ── Helpers ───────────────────────────────────────────────────────
+
+function makeToolDef(name: string): ToolDef {
+  return {
+    name,
+    description: `Mock ${name} tool`,
+    inputSchema: { type: "object", properties: {} },
+  };
+}
+
+const MOCK_TOOLS: ToolDef[] = [
+  "safe_status",
+  "get_diff",
+  "save_plan",
+  "invoke_discovered_tool",
+  "__test_credential_tool",
+].map(makeToolDef);
+
+function makeContext(overrides: Partial<InvokeDiscoveredToolContext> = {}): InvokeDiscoveredToolContext {
+  return {
+    tools: MOCK_TOOLS,
+    profile: "full",
+    dispatch: async () => ({ ok: true }),
+    ...overrides,
+  };
+}
+
+function issueTokenFor(toolName: string, risk: ToolRisk): string {
+  return issueToken({
+    toolName,
+    risk,
+    query: "test query",
+    schemaDigest: computeSchemaDigest({}),
+    profile: "full",
+  });
+}
+
+function makeInput(overrides: Partial<InvokeDiscoveredToolInput> = {}): InvokeDiscoveredToolInput {
+  return {
+    toolName: "safe_status",
+    arguments: {},
+    discoveryToken: "",
+    ...overrides,
+  };
+}
+
+// ── Tests ─────────────────────────────────────────────────────────
+
+describe("invokeDiscoveredTool", () => {
+  beforeEach(() => {
+    clearAllTokens();
+  });
+
+  describe("合法调用", () => {
+    it("readonly 工具 + 有效 token + dispatch 成功 → ok=true", async () => {
+      const token = issueTokenFor("safe_status", "readonly");
+      const result = await invokeDiscoveredTool(
+        makeInput({
+          toolName: "safe_status",
+          arguments: { task_id: "t-1" },
+          discoveryToken: token,
+        }),
+        makeContext({
+          dispatch: async () => ({ status: "pending" }),
+        }),
+      );
+      assert.equal(result.ok, true);
+      assert.ok(result.result, "result should be present");
+      assert.deepEqual(result.result, { status: "pending" });
+      assert.equal(result.invocation_log_written, true);
+      assert.equal(result.error, undefined);
+    });
+  });
+
+  describe("token 校验", () => {
+    it("token 不存在 → ok=false, reason=token_not_found", async () => {
+      const result = await invokeDiscoveredTool(
+        makeInput({
+          toolName: "safe_status",
+          arguments: {},
+          discoveryToken: "tok",
+        }),
+        makeContext(),
+      );
+      assert.equal(result.ok, false);
+      assert.equal(result.error?.reason, "token_not_found");
+      assert.equal(result.invocation_log_written, true);
+    });
+
+    it("token toolName 不匹配 → ok=false, reason=token_tool_mismatch", async () => {
+      const token = issueTokenFor("safe_status", "readonly");
+      const result = await invokeDiscoveredTool(
+        makeInput({
+          toolName: "get_diff",
+          arguments: { task_id: "t-1" },
+          discoveryToken: token,
+        }),
+        makeContext(),
+      );
+      assert.equal(result.ok, false);
+      assert.equal(result.error?.reason, "token_tool_mismatch");
+    });
+  });
+
+  describe("toolMeta 查找", () => {
+    it("工具未注册 → ok=false, reason=tool_not_registered", async () => {
+      const token = issueTokenFor("safe_status", "readonly");
+      const result = await invokeDiscoveredTool(
+        makeInput({
+          toolName: "safe_status",
+          arguments: {},
+          discoveryToken: token,
+        }),
+        makeContext({
+          tools: [makeToolDef("get_diff")],
+        }),
+      );
+      assert.equal(result.ok, false);
+      assert.equal(result.error?.reason, "tool_not_registered");
+    });
+  });
+
+  describe("防递归", () => {
+    it("toolName=invoke_discovered_tool → ok=false, reason=recursive_invocation_blocked", async () => {
+      const token = issueTokenFor("invoke_discovered_tool", "command");
+      const result = await invokeDiscoveredTool(
+        makeInput({
+          toolName: "invoke_discovered_tool",
+          arguments: {},
+          discoveryToken: token,
+        }),
+        makeContext(),
+      );
+      assert.equal(result.ok, false);
+      assert.equal(result.error?.reason, "recursive_invocation_blocked");
+    });
+  });
+
+  describe("守卫校验", () => {
+    it("credential_sensitive 工具 → ok=false, reason=credential_sensitive_blocked", async () => {
+      const token = issueTokenFor("__test_credential_tool", "credential_sensitive");
+      const result = await invokeDiscoveredTool(
+        makeInput({
+          toolName: "__test_credential_tool",
+          arguments: {},
+          discoveryToken: token,
+        }),
+        makeContext(),
+      );
+      assert.equal(result.ok, false);
+      assert.equal(result.error?.reason, "credential_sensitive_blocked");
+    });
+
+    it("workspace_write 缺 assessmentId → ok=false, reason=assessment_required", async () => {
+      const token = issueTokenFor("save_plan", "workspace_write");
+      const result = await invokeDiscoveredTool(
+        makeInput({
+          toolName: "save_plan",
+          arguments: {},
+          discoveryToken: token,
+        }),
+        makeContext(),
+      );
+      assert.equal(result.ok, false);
+      assert.equal(result.error?.reason, "assessment_required");
+    });
+  });
+
+  describe("dispatch", () => {
+    it("dispatch 抛错 → ok=false, reason=dispatch_error", async () => {
+      const token = issueTokenFor("safe_status", "readonly");
+      const result = await invokeDiscoveredTool(
+        makeInput({
+          toolName: "safe_status",
+          arguments: {},
+          discoveryToken: token,
+        }),
+        makeContext({
+          dispatch: async () => {
+            throw new Error("boom");
+          },
+        }),
+      );
+      assert.equal(result.ok, false);
+      assert.equal(result.error?.reason, "dispatch_error");
+      assert.ok(result.error?.message.includes("boom"), `expected message to contain "boom", got "${result.error?.message}"`);
+    });
+
+    it("成功调用 → invocation_log_written=true", async () => {
+      const token = issueTokenFor("safe_status", "readonly");
+      const result = await invokeDiscoveredTool(
+        makeInput({
+          toolName: "safe_status",
+          arguments: { task_id: "t-log" },
+          discoveryToken: token,
+        }),
+        makeContext({
+          dispatch: async () => ({ status: "done" }),
+        }),
+      );
+      assert.equal(result.ok, true);
+      assert.equal(result.invocation_log_written, true);
+    });
+  });
+});

package/src/test/unit/logging.test.ts

@@ -1,6 +1,16 @@
 import { describe, it, beforeEach, afterEach } from "node:test";
 import { strict as assert } from "node:assert";
-import { Logger, logUnhandledError, installGlobalHandlers } from "../../logging.js";
+import { mkdtempSync, rmSync, readFileSync, existsSync, writeFileSync } from "node:fs";
+import { join } from "node:path";
+import { tmpdir } from "node:os";
+import {
+  Logger,
+  logUnhandledError,
+  installGlobalHandlers,
+  computeArgumentsDigest,
+  logToolInvocation,
+  type InvocationLogEntry,
+} from "../../logging.js";
 
 // ── Test helpers ──────────────────────────────────────────────────
 
@@ -166,9 +176,10 @@ describe("Logger — verbose mode (PATCHWARDEN_VERBOSE_LOG)", () => {
     delete process.env.PATCHWARDEN_VERBOSE_LOG;
 
     const log = new Logger();
+    const fakeToken = "sk_" + "FAKE_TOKEN_VALUE_123456";
     const sensitiveArgs = {
       prompt: "fix the bug",
-      token: "ghp_" + "a".repeat(20),
+      token: fakeToken,
     };
 
     const entries = captureJson(() => {
@@ -182,16 +193,17 @@ describe("Logger — verbose mode (PATCHWARDEN_VERBOSE_LOG)", () => {
     assert.equal(entry.args, undefined);
     // The raw token must not appear anywhere in the serialized entry
     const raw = JSON.stringify(entry);
-    assert.ok(!raw.includes("ghp_"), "raw token must not leak into log output");
+    assert.ok(!raw.includes(fakeToken), "raw token must not leak into log output");
   });
 
   it("logs sanitized args when PATCHWARDEN_VERBOSE_LOG=true", () => {
     process.env.PATCHWARDEN_VERBOSE_LOG = "true";
 
     const log = new Logger();
+    const fakeToken = "sk_" + "FAKE_TOKEN_VALUE_123456";
     const sensitiveArgs = {
       prompt: "fix the bug",
-      token: "ghp_" + "a".repeat(20),
+      token: fakeToken,
     };
 
     const entries = captureJson(() => {
@@ -205,7 +217,7 @@ describe("Logger — verbose mode (PATCHWARDEN_VERBOSE_LOG)", () => {
     assert.ok(entry.args !== undefined, "args should be logged in verbose mode");
     const argsStr = String(entry.args);
     assert.ok(argsStr.includes("[REDACTED TOKEN]"), "sensitive token must be redacted");
-    assert.ok(!argsStr.includes("ghp_"), "raw token must not appear in args");
+    assert.ok(!argsStr.includes(fakeToken), "raw token must not appear in args");
     // non-sensitive content is preserved
     assert.ok(argsStr.includes("fix the bug"), "non-sensitive args content is preserved");
   });
@@ -323,3 +335,163 @@ describe("installGlobalHandlers", () => {
     }
   });
 });
+
+// ── computeArgumentsDigest ───────────────────────────────────────
+
+describe("computeArgumentsDigest", () => {
+  it("returns the same digest for identical arguments (stability)", () => {
+    const args = { b: 2, a: 1, nested: { y: "yes", x: [1, 2] } };
+    const d1 = computeArgumentsDigest(args);
+    const d2 = computeArgumentsDigest(args);
+    assert.equal(d1, d2);
+  });
+
+  it("returns the same digest regardless of key order (stable serialization)", () => {
+    const d1 = computeArgumentsDigest({ a: 1, b: 2 });
+    const d2 = computeArgumentsDigest({ b: 2, a: 1 });
+    assert.equal(d1, d2);
+  });
+
+  it("returns different digests for different arguments", () => {
+    const d1 = computeArgumentsDigest({ a: 1 });
+    const d2 = computeArgumentsDigest({ a: 2 });
+    assert.notEqual(d1, d2);
+  });
+
+  it("returns a 'sha256:' prefixed digest", () => {
+    const digest = computeArgumentsDigest({ foo: "bar" });
+    assert.ok(
+      digest.startsWith("sha256:"),
+      `digest should start with "sha256:", got: ${digest}`,
+    );
+    // full format: sha256: + 64 lowercase hex chars
+    assert.match(digest, /^sha256:[a-f0-9]{64}$/);
+  });
+
+  it("does not leak raw argument values into the digest string", () => {
+    const fakeToken = "tok-value";
+    const sensitiveArgs = { token: fakeToken, prompt: "hello-world" };
+    const digest = computeArgumentsDigest(sensitiveArgs);
+    assert.ok(
+      !digest.includes(fakeToken),
+      "digest must not leak raw token value",
+    );
+    assert.ok(
+      !digest.includes("hello-world"),
+      "digest must not leak raw prompt value",
+    );
+  });
+});
+
+// ── logToolInvocation ────────────────────────────────────────────
+
+describe("logToolInvocation", () => {
+  let tempDir: string;
+
+  beforeEach(() => {
+    tempDir = mkdtempSync(join(tmpdir(), "pw-invlog-"));
+  });
+
+  afterEach(() => {
+    rmSync(tempDir, { recursive: true, force: true });
+  });
+
+  function sampleEntry(overrides: Partial<InvocationLogEntry> = {}): InvocationLogEntry {
+    return {
+      timestamp: new Date().toISOString(),
+      toolName: "read_workspace_file",
+      discoveryToken: "tok",
+      risk: "workspace_read_sensitive",
+      profile: "full",
+      arguments_digest: "sha256:" + "0".repeat(64),
+      result: "ok",
+      duration_ms: 42,
+      ...overrides,
+    };
+  }
+
+  it("writes an entry to invocation.log inside the provided logsDir", () => {
+    const logsDir = join(tempDir, ".patchwarden", "logs");
+    const entry = sampleEntry();
+    logToolInvocation(entry, { logsDir });
+
+    const logPath = join(logsDir, "invocation.log");
+    assert.ok(existsSync(logPath), "invocation.log should be created");
+
+    const content = readFileSync(logPath, "utf-8");
+    const lines = content.trim().split("\n");
+    assert.equal(lines.length, 1, "exactly one JSON line should be written");
+
+    const parsed = JSON.parse(lines[0]);
+    assert.equal(parsed.toolName, "read_workspace_file");
+    assert.equal(parsed.discoveryToken, "tok");
+    assert.equal(parsed.risk, "workspace_read_sensitive");
+    assert.equal(parsed.profile, "full");
+    assert.equal(parsed.result, "ok");
+    assert.equal(parsed.duration_ms, 42);
+    assert.match(parsed.arguments_digest, /^sha256:[a-f0-9]{64}$/);
+    assert.ok(!Number.isNaN(Date.parse(parsed.timestamp)));
+  });
+
+  it("appends multiple entries as JSON Lines", () => {
+    const logsDir = join(tempDir, "logs");
+    logToolInvocation(sampleEntry({ duration_ms: 1 }), { logsDir });
+    logToolInvocation(
+      sampleEntry({ duration_ms: 2, result: "error", error_code: "blocked" }),
+      { logsDir },
+    );
+
+    const content = readFileSync(join(logsDir, "invocation.log"), "utf-8");
+    const lines = content.trim().split("\n");
+    assert.equal(lines.length, 2);
+
+    const first = JSON.parse(lines[0]);
+    const second = JSON.parse(lines[1]);
+    assert.equal(first.duration_ms, 1);
+    assert.equal(first.result, "ok");
+    assert.equal(second.duration_ms, 2);
+    assert.equal(second.result, "error");
+    assert.equal(second.error_code, "blocked");
+  });
+
+  it("includes allowedScope and error_code when provided", () => {
+    const logsDir = join(tempDir, "logs");
+    logToolInvocation(
+      sampleEntry({
+        allowedScope: ["src/", "docs/"],
+        result: "error",
+        error_code: "scope_violation",
+      }),
+      { logsDir },
+    );
+
+    const parsed = JSON.parse(
+      readFileSync(join(logsDir, "invocation.log"), "utf-8").trim(),
+    );
+    assert.deepEqual(parsed.allowedScope, ["src/", "docs/"]);
+    assert.equal(parsed.error_code, "scope_violation");
+  });
+
+  it("omits error_code and allowedScope when not provided", () => {
+    const logsDir = join(tempDir, "logs");
+    logToolInvocation(sampleEntry(), { logsDir });
+
+    const parsed = JSON.parse(
+      readFileSync(join(logsDir, "invocation.log"), "utf-8").trim(),
+    );
+    assert.equal(parsed.error_code, undefined);
+    assert.equal(parsed.allowedScope, undefined);
+  });
+
+  it("does not throw when the log directory cannot be created", () => {
+    // Create a file, then attempt to use a path beneath it as logsDir.
+    // mkdirSync will fail with ENOTDIR because the parent is a file.
+    const blockingFile = join(tempDir, "blocker");
+    writeFileSync(blockingFile, "x", "utf-8");
+    const impossibleLogsDir = join(blockingFile, "subdir");
+
+    assert.doesNotThrow(() => {
+      logToolInvocation(sampleEntry(), { logsDir: impossibleLogsDir });
+    });
+  });
+});

package/src/test/unit/post-task-cleanup.test.ts

@@ -0,0 +1,53 @@
+import { describe, it } from "node:test";
+import { strict as assert } from "node:assert";
+import { execFileSync } from "node:child_process";
+import { existsSync, mkdirSync, mkdtempSync, readFileSync, rmSync, writeFileSync } from "node:fs";
+import { join } from "node:path";
+import { tmpdir } from "node:os";
+import { runPostTaskCleanup } from "../../runner/postTaskCleanup.js";
+
+describe("postTaskCleanup", () => {
+  it("removes untracked low-risk artifacts and skips tracked or excluded paths", () => {
+    const root = mkdtempSync(join(tmpdir(), "pw-cleanup-"));
+    try {
+      execFileSync("git", ["init"], { cwd: root, stdio: "ignore" });
+      execFileSync("git", ["config", "user.email", "test@example.com"], { cwd: root, stdio: "ignore" });
+      execFileSync("git", ["config", "user.name", "PatchWarden Test"], { cwd: root, stdio: "ignore" });
+
+      mkdirSync(join(root, "tracked", "__pycache__"), { recursive: true });
+      writeFileSync(join(root, "tracked", "__pycache__", "keep.pyc"), "tracked", "utf-8");
+      execFileSync("git", ["add", "."], { cwd: root, stdio: "ignore" });
+      execFileSync("git", ["commit", "-m", "init"], { cwd: root, stdio: "ignore" });
+
+      mkdirSync(join(root, "backend", "__pycache__"), { recursive: true });
+      mkdirSync(join(root, ".venv", "__pycache__"), { recursive: true });
+      mkdirSync(join(root, ".patchwarden", "tasks", "old-task", "__pycache__"), { recursive: true });
+      mkdirSync(join(root, "node_modules", "pkg", "__pycache__"), { recursive: true });
+      mkdirSync(join(root, "docs", "__pycache__"), { recursive: true });
+      writeFileSync(join(root, "backend", "__pycache__", "drop.pyc"), "drop", "utf-8");
+      writeFileSync(join(root, ".venv", "__pycache__", "skip.pyc"), "skip", "utf-8");
+      writeFileSync(join(root, ".patchwarden", "tasks", "old-task", "__pycache__", "skip.pyc"), "skip", "utf-8");
+      writeFileSync(join(root, "node_modules", "pkg", "__pycache__", "skip.pyc"), "skip", "utf-8");
+      writeFileSync(join(root, "docs", "__pycache__", "skip.pyc"), "skip", "utf-8");
+
+      const taskDir = join(root, ".patchwarden", "tasks", "task-1");
+      mkdirSync(taskDir, { recursive: true });
+      const report = runPostTaskCleanup(root, taskDir);
+
+      assert.ok(report.removed.some((entry) => entry.path === "backend/__pycache__"));
+      assert.ok(report.skipped.some((entry) => entry.path === "tracked/__pycache__" && entry.skip_reason === "tracked_by_git"));
+      assert.equal(report.source_files_touched, 0);
+      assert.ok(!existsSync(join(root, "backend", "__pycache__")));
+      assert.ok(existsSync(join(root, "tracked", "__pycache__", "keep.pyc")));
+      assert.ok(existsSync(join(root, ".venv", "__pycache__", "skip.pyc")));
+      assert.ok(existsSync(join(root, ".patchwarden", "tasks", "old-task", "__pycache__", "skip.pyc")));
+      assert.ok(existsSync(join(root, "node_modules", "pkg", "__pycache__", "skip.pyc")));
+      assert.ok(existsSync(join(root, "docs", "__pycache__", "skip.pyc")));
+
+      const written = JSON.parse(readFileSync(join(taskDir, "post-task-cleanup.json"), "utf-8"));
+      assert.equal(written.enabled, true);
+    } finally {
+      rmSync(root, { recursive: true, force: true });
+    }
+  });
+});

package/src/test/unit/project-policy-release-mode.test.ts

@@ -0,0 +1,156 @@
+import { describe, it, beforeEach, afterEach } from "node:test";
+import { strict as assert } from "node:assert";
+import { existsSync, mkdirSync, mkdtempSync, readFileSync, rmSync, writeFileSync } from "node:fs";
+import { join } from "node:path";
+import { tmpdir } from "node:os";
+import { reloadConfig } from "../../config.js";
+import { getProjectPolicySummary } from "../../policy/projectPolicy.js";
+import { releaseCleanup, releasePrepare, releaseVerify } from "../../tools/releaseMode.js";
+
+let tempDir: string;
+let repoPath: string;
+let prevConfigEnv: string | undefined;
+
+function writeConfig(allowedTestCommands = ["npm test", "npm run build"]): void {
+  const configPath = join(tempDir, "patchwarden.config.json");
+  writeFileSync(
+    configPath,
+    JSON.stringify({
+      workspaceRoot: tempDir,
+      plansDir: ".patchwarden/plans",
+      tasksDir: ".patchwarden/tasks",
+      assessmentsDir: ".patchwarden/assessments",
+      allowedTestCommands,
+      agents: {},
+      defaultTaskTimeoutSeconds: 30,
+      maxTaskTimeoutSeconds: 120,
+    }),
+    "utf-8",
+  );
+  prevConfigEnv = process.env.PATCHWARDEN_CONFIG;
+  process.env.PATCHWARDEN_CONFIG = configPath;
+  reloadConfig(configPath);
+}
+
+function writePackage(version = "1.3.0"): void {
+  writeFileSync(
+    join(repoPath, "package.json"),
+    JSON.stringify({
+      name: "patchwarden-test",
+      version,
+      repository: { type: "git", url: "git+https://github.com/example/patchwarden-test.git" },
+    }),
+    "utf-8",
+  );
+}
+
+describe("project policy and release mode", () => {
+  beforeEach(() => {
+    tempDir = mkdtempSync(join(tmpdir(), "pw-policy-"));
+    repoPath = join(tempDir, "repo");
+    mkdirSync(repoPath, { recursive: true });
+    writePackage();
+    writeConfig();
+  });
+
+  afterEach(() => {
+    if (prevConfigEnv === undefined) {
+      delete process.env.PATCHWARDEN_CONFIG;
+    } else {
+      process.env.PATCHWARDEN_CONFIG = prevConfigEnv;
+    }
+    reloadConfig();
+    rmSync(tempDir, { recursive: true, force: true });
+  });
+
+  it("returns safe defaults when project-policy.json is missing", () => {
+    const summary = getProjectPolicySummary(repoPath);
+    assert.equal(summary.exists, false);
+    assert.equal(summary.valid, true);
+    assert.equal(summary.effective_policy.release_mode.version_source, "package.json");
+    assert.equal(summary.release_readiness.version, "1.3.0");
+  });
+
+  it("parses BOM-prefixed policy JSON and reports allowlist issues without granting permission", () => {
+    mkdirSync(join(repoPath, ".patchwarden"), { recursive: true });
+    writeFileSync(
+      join(repoPath, ".patchwarden", "project-policy.json"),
+      "\uFEFF" + JSON.stringify({
+        allowed_commands: ["npm run build", "npm publish"],
+        release_mode: {
+          version_source: "package.json",
+          required_commands: ["npm run build", "not-allowed"],
+        },
+      }),
+      "utf-8",
+    );
+    const summary = getProjectPolicySummary(repoPath);
+    assert.equal(summary.exists, true);
+    assert.equal(summary.valid, false);
+    assert.ok(summary.issues.some((issue) => issue.code === "high_risk_command"));
+    assert.ok(summary.issues.some((issue) => issue.code === "command_not_allowlisted"));
+  });
+
+  it("rejects unsafe path patterns and sensitive protected paths block cleanup", () => {
+    mkdirSync(join(repoPath, ".patchwarden"), { recursive: true });
+    writeFileSync(
+      join(repoPath, ".patchwarden", "project-policy.json"),
+      JSON.stringify({
+        auto_cleanup: { enabled: true, patterns: ["../escape", ".git", "release_packages"], exclude: [] },
+        protected_paths: [".env", "release_packages"],
+      }),
+      "utf-8",
+    );
+    mkdirSync(join(repoPath, "release_packages"), { recursive: true });
+    const summary = getProjectPolicySummary(repoPath);
+    assert.equal(summary.valid, false);
+    assert.ok(summary.issues.some((issue) => issue.code === "unsafe_path_pattern"));
+    const cleanup = releaseCleanup({ repo_path: repoPath, dry_run: true });
+    const skipped = cleanup.summary.skipped as Array<{ path: string; reason: string }>;
+    assert.ok(skipped.some((entry) => entry.path === "release_packages" && entry.reason === "protected_or_sensitive"));
+  });
+
+  it("release_cleanup defaults to dry run and writes BOM-free JSON summary", () => {
+    mkdirSync(join(repoPath, "release_packages"), { recursive: true });
+    const result = releaseCleanup({ repo_path: repoPath });
+    assert.equal(result.mode, "release_cleanup");
+    assert.equal((result.summary as any).dry_run, true);
+    assert.equal(existsSync(join(repoPath, "release_packages")), true);
+    const reportPath = join(repoPath, String((result.summary as any).report_path));
+    const raw = readFileSync(reportPath, "utf-8");
+    assert.notEqual(raw.charCodeAt(0), 0xfeff);
+    assert.doesNotThrow(() => JSON.parse(raw));
+  });
+
+  it("release_cleanup honors auto_cleanup.enabled=false before deleting", () => {
+    mkdirSync(join(repoPath, ".patchwarden"), { recursive: true });
+    writeFileSync(
+      join(repoPath, ".patchwarden", "project-policy.json"),
+      JSON.stringify({
+        auto_cleanup: { enabled: false, patterns: ["release_packages"], exclude: [] },
+      }),
+      "utf-8",
+    );
+    mkdirSync(join(repoPath, "release_packages"), { recursive: true });
+    const result = releaseCleanup({ repo_path: repoPath, dry_run: false });
+    assert.equal((result.summary as any).cleanup_disabled_by_policy, true);
+    assert.deepEqual((result.summary as any).removed, []);
+    assert.equal(existsSync(join(repoPath, "release_packages")), true);
+  });
+
+  it("release_verify fails when required metadata cannot be inferred", async () => {
+    writeFileSync(join(repoPath, "package.json"), JSON.stringify({ name: "", version: "" }), "utf-8");
+    const result = await releaseVerify({ repo_path: repoPath });
+    assert.equal(result.ok, false);
+    const stages = result.summary.stages as Record<string, string>;
+    assert.equal(stages.published_verified, "failed");
+    assert.equal(stages.github_release_verified, "failed");
+    assert.equal(stages.ci_verified, "failed");
+  });
+
+  it("release_prepare blocks commands not accepted by the existing command guard", () => {
+    const result = releasePrepare({ repo_path: repoPath, required_commands: ["npm run build", "npm run secret"] });
+    const commands = result.summary.commands as Array<{ command: string; status: string }>;
+    assert.equal(commands.find((entry) => entry.command === "npm run secret")?.status, "blocked");
+  });
+});