patchwarden 1.1.0 → 1.5.0

package/src/policy/projectPolicy.ts

@@ -0,0 +1,344 @@
+import { existsSync, readFileSync, statSync } from "node:fs";
+import { dirname, isAbsolute, join, relative, resolve, sep } from "node:path";
+import {
+  getAllConfiguredDirectCommands,
+  getAllConfiguredTestCommands,
+  getConfig,
+  type PatchWardenConfig,
+} from "../config.js";
+import { guardTestCommand } from "../security/commandGuard.js";
+import { guardWorkspacePath } from "../security/pathGuard.js";
+import { isSensitivePath } from "../security/sensitiveGuard.js";
+
+export interface ProjectPolicy {
+  allowed_commands: string[];
+  auto_cleanup: {
+    enabled: boolean;
+    patterns: string[];
+    exclude: string[];
+  };
+  high_risk_commands: string[];
+  protected_paths: string[];
+  release_mode: {
+    version_source: string;
+    required_commands: string[];
+  };
+}
+
+export interface ProjectPolicyIssue {
+  code: string;
+  severity: "error" | "warn";
+  field: string;
+  message: string;
+}
+
+export interface ReleaseReadinessSummary {
+  version_source: string;
+  version: string | null;
+  package_json_version: string | null;
+  package_name: string | null;
+  version_consistent: boolean | null;
+  required_commands: Array<{
+    command: string;
+    allowed: boolean;
+    reason: string | null;
+  }>;
+}
+
+export interface ProjectPolicySummary {
+  repo_path: string;
+  resolved_repo_path: string;
+  policy_path: string;
+  exists: boolean;
+  valid: boolean;
+  effective_policy: ProjectPolicy;
+  issues: ProjectPolicyIssue[];
+  release_readiness: ReleaseReadinessSummary;
+}
+
+const DEFAULT_POLICY: ProjectPolicy = {
+  allowed_commands: [],
+  auto_cleanup: {
+    enabled: true,
+    patterns: ["release-artifact-manifest.json", "frontend/dist", "release_packages"],
+    exclude: [".git", ".patchwarden", "node_modules", "docs", "samples"],
+  },
+  high_risk_commands: ["npm publish", "git push", "git tag", "gh release create"],
+  protected_paths: [".env", ".env.*", ".ssh", ".npmrc", ".pypirc", "patchwarden.config.json"],
+  release_mode: {
+    version_source: "package.json",
+    required_commands: ["npm run build", "npm test"],
+  },
+};
+
+const DANGEROUS_COMMAND_RE = /\b(?:publish|push|tag|release\s+create|deploy)\b/i;
+const DANGEROUS_PATTERN_RE = /(^|[\\/])(?:\.git|node_modules)([\\/]|$)|^\*\*$|^\/|^[A-Za-z]:[\\/]/i;
+
+export function getProjectPolicySummary(repoPathInput: string): ProjectPolicySummary {
+  const config = getConfig();
+  const repoPath = guardWorkspacePath(repoPathInput, config.workspaceRoot);
+  const policyPath = join(repoPath, ".patchwarden", "project-policy.json");
+  const issues: ProjectPolicyIssue[] = [];
+  let rawPolicy: Partial<ProjectPolicy> = {};
+  let exists = false;
+
+  if (existsSync(policyPath)) {
+    exists = true;
+    try {
+      const raw = readFileSync(policyPath, "utf-8").replace(/^\uFEFF/, "");
+      rawPolicy = JSON.parse(raw) as Partial<ProjectPolicy>;
+    } catch (err) {
+      issues.push({
+        code: "policy_json_invalid",
+        severity: "error",
+        field: ".patchwarden/project-policy.json",
+        message: `Project policy is not valid JSON: ${err instanceof Error ? err.message : String(err)}`,
+      });
+    }
+  }
+
+  const effective = normalizePolicy(rawPolicy, issues);
+  validateProjectPolicy(repoPath, effective, issues, config);
+
+  return {
+    repo_path: repoPathInput,
+    resolved_repo_path: repoPath,
+    policy_path: ".patchwarden/project-policy.json",
+    exists,
+    valid: !issues.some((issue) => issue.severity === "error"),
+    effective_policy: effective,
+    issues,
+    release_readiness: buildReleaseReadiness(repoPath, effective, config),
+  };
+}
+
+export function getDefaultProjectPolicy(): ProjectPolicy {
+  return clonePolicy(DEFAULT_POLICY);
+}
+
+export function commandAllowedByProjectPolicy(command: string, summary: ProjectPolicySummary): { allowed: boolean; reason: string | null } {
+  const trimmed = command.trim();
+  if (!trimmed) return { allowed: false, reason: "empty_command" };
+  if (summary.effective_policy.high_risk_commands.includes(trimmed) || DANGEROUS_COMMAND_RE.test(trimmed)) {
+    return { allowed: false, reason: "high_risk_command" };
+  }
+  if (
+    summary.effective_policy.allowed_commands.length > 0 &&
+    !summary.effective_policy.allowed_commands.includes(trimmed)
+  ) {
+    return { allowed: false, reason: "not_in_project_policy_allowed_commands" };
+  }
+  const readiness = summary.release_readiness.required_commands.find((entry) => entry.command === trimmed);
+  if (readiness && !readiness.allowed) {
+    return { allowed: false, reason: readiness.reason || "not_allowlisted_by_patchwarden_config" };
+  }
+  return { allowed: true, reason: null };
+}
+
+export function isProtectedByProjectPolicy(relPath: string, policy: ProjectPolicy): boolean {
+  const normalized = normalizeRelPath(relPath);
+  if (!normalized) return true;
+  if (isSensitivePath(normalized)) return true;
+  return policy.protected_paths.some((pattern) => pathMatchesPattern(normalized, pattern));
+}
+
+export function resolveVersionFromPolicy(repoPath: string, policy: ProjectPolicy): string | null {
+  const source = policy.release_mode.version_source || "package.json";
+  if (source === "package.json") return readPackageJson(repoPath).version;
+  if (source === "src/version.ts") {
+    const versionFile = safeRepoFile(repoPath, "src/version.ts");
+    if (!versionFile) return null;
+    const text = readFileSync(versionFile, "utf-8");
+    const match = text.match(/PATCHWARDEN_VERSION\s*=\s*["']([^"']+)["']/);
+    return match ? match[1] : null;
+  }
+  const file = safeRepoFile(repoPath, source);
+  if (!file) return null;
+  const text = readFileSync(file, "utf-8").replace(/^\uFEFF/, "").trim();
+  return text.split(/\r?\n/)[0]?.trim() || null;
+}
+
+export function readPackageJson(repoPath: string): { name: string | null; version: string | null; githubRepo: string | null } {
+  const packagePath = join(repoPath, "package.json");
+  if (!existsSync(packagePath)) return { name: null, version: null, githubRepo: null };
+  try {
+    const data = JSON.parse(readFileSync(packagePath, "utf-8").replace(/^\uFEFF/, ""));
+    return {
+      name: typeof data.name === "string" ? data.name : null,
+      version: typeof data.version === "string" ? data.version : null,
+      githubRepo: parseGithubRepo(data.repository),
+    };
+  } catch {
+    return { name: null, version: null, githubRepo: null };
+  }
+}
+
+function normalizePolicy(raw: Partial<ProjectPolicy>, issues: ProjectPolicyIssue[]): ProjectPolicy {
+  const policy = clonePolicy(DEFAULT_POLICY);
+  const object = raw && typeof raw === "object" && !Array.isArray(raw) ? raw : {};
+  policy.allowed_commands = stringArrayOrDefault(object.allowed_commands, policy.allowed_commands, "allowed_commands", issues);
+  policy.high_risk_commands = stringArrayOrDefault(object.high_risk_commands, policy.high_risk_commands, "high_risk_commands", issues);
+  policy.protected_paths = stringArrayOrDefault(object.protected_paths, policy.protected_paths, "protected_paths", issues);
+
+  if (object.auto_cleanup && typeof object.auto_cleanup === "object" && !Array.isArray(object.auto_cleanup)) {
+    const cleanup = object.auto_cleanup as Partial<ProjectPolicy["auto_cleanup"]>;
+    if (cleanup.enabled !== undefined && typeof cleanup.enabled !== "boolean") {
+      issues.push({ code: "invalid_type", severity: "error", field: "auto_cleanup.enabled", message: "auto_cleanup.enabled must be a boolean." });
+    } else if (cleanup.enabled !== undefined) {
+      policy.auto_cleanup.enabled = cleanup.enabled;
+    }
+    policy.auto_cleanup.patterns = stringArrayOrDefault(cleanup.patterns, policy.auto_cleanup.patterns, "auto_cleanup.patterns", issues);
+    policy.auto_cleanup.exclude = stringArrayOrDefault(cleanup.exclude, policy.auto_cleanup.exclude, "auto_cleanup.exclude", issues);
+  }
+
+  if (object.release_mode && typeof object.release_mode === "object" && !Array.isArray(object.release_mode)) {
+    const releaseMode = object.release_mode as Partial<ProjectPolicy["release_mode"]>;
+    if (releaseMode.version_source !== undefined && typeof releaseMode.version_source !== "string") {
+      issues.push({ code: "invalid_type", severity: "error", field: "release_mode.version_source", message: "release_mode.version_source must be a string." });
+    } else if (releaseMode.version_source) {
+      policy.release_mode.version_source = releaseMode.version_source.trim();
+    }
+    policy.release_mode.required_commands = stringArrayOrDefault(releaseMode.required_commands, policy.release_mode.required_commands, "release_mode.required_commands", issues);
+  }
+
+  return policy;
+}
+
+function validateProjectPolicy(repoPath: string, policy: ProjectPolicy, issues: ProjectPolicyIssue[], config: PatchWardenConfig): void {
+  for (const [field, commands] of [
+    ["allowed_commands", policy.allowed_commands],
+    ["high_risk_commands", policy.high_risk_commands],
+    ["release_mode.required_commands", policy.release_mode.required_commands],
+  ] as const) {
+    for (const command of commands) {
+      if (field !== "high_risk_commands" && DANGEROUS_COMMAND_RE.test(command)) {
+        issues.push({ code: "high_risk_command", severity: "error", field, message: `Command is release/destructive risk and cannot be auto-executed: ${command}` });
+      }
+      if (field !== "high_risk_commands") {
+        try {
+          guardTestCommand(command, config, repoPath);
+        } catch {
+          issues.push({ code: "command_not_allowlisted", severity: "warn", field, message: `Command is not allowed by existing PatchWarden config: ${command}` });
+        }
+      }
+    }
+  }
+
+  for (const field of ["auto_cleanup.patterns", "auto_cleanup.exclude", "protected_paths"] as const) {
+    const values = field === "auto_cleanup.patterns"
+      ? policy.auto_cleanup.patterns
+      : field === "auto_cleanup.exclude"
+        ? policy.auto_cleanup.exclude
+        : policy.protected_paths;
+    for (const value of values) {
+      if (!value.trim()) {
+        issues.push({ code: "empty_path_pattern", severity: "error", field, message: "Path patterns must be non-empty." });
+        continue;
+      }
+      const blocksCriticalDirectory = field === "auto_cleanup.patterns" && DANGEROUS_PATTERN_RE.test(value);
+      if (value.includes("\0") || value.includes("..") || isAbsolute(value) || blocksCriticalDirectory) {
+        issues.push({ code: "unsafe_path_pattern", severity: "error", field, message: `Unsafe path pattern rejected: ${value}` });
+      }
+    }
+  }
+
+  const versionSource = policy.release_mode.version_source;
+  if (versionSource && versionSource !== "package.json" && versionSource !== "src/version.ts") {
+    const resolved = safeRepoFile(repoPath, versionSource);
+    if (!resolved) {
+      issues.push({ code: "version_source_invalid", severity: "error", field: "release_mode.version_source", message: `Version source is outside repo, sensitive, or missing: ${versionSource}` });
+    }
+  }
+}
+
+function buildReleaseReadiness(repoPath: string, policy: ProjectPolicy, config: PatchWardenConfig): ReleaseReadinessSummary {
+  const packageJson = readPackageJson(repoPath);
+  let version: string | null = null;
+  try {
+    version = resolveVersionFromPolicy(repoPath, policy);
+  } catch {
+    version = null;
+  }
+  return {
+    version_source: policy.release_mode.version_source,
+    version,
+    package_json_version: packageJson.version,
+    package_name: packageJson.name,
+    version_consistent: version && packageJson.version ? version === packageJson.version : null,
+    required_commands: policy.release_mode.required_commands.map((command) => {
+      try {
+        guardTestCommand(command, config, repoPath);
+        return { command, allowed: true, reason: null };
+      } catch (err) {
+        return { command, allowed: false, reason: err instanceof Error ? err.message : String(err) };
+      }
+    }),
+  };
+}
+
+function safeRepoFile(repoPath: string, relPath: string): string | null {
+  const normalized = normalizeRelPath(relPath);
+  if (!normalized || isSensitivePath(normalized)) return null;
+  const candidate = resolve(repoPath, normalized);
+  const rel = relative(repoPath, candidate);
+  if (isAbsolute(rel) || rel === ".." || rel.startsWith(`..${sep}`)) return null;
+  if (!existsSync(candidate) || !statSync(candidate).isFile()) return null;
+  const parent = dirname(candidate);
+  const parentRel = relative(repoPath, parent);
+  if (parentRel === ".." || parentRel.startsWith(`..${sep}`)) return null;
+  return candidate;
+}
+
+function stringArrayOrDefault(value: unknown, fallback: string[], field: string, issues: ProjectPolicyIssue[]): string[] {
+  if (value === undefined) return [...fallback];
+  if (!Array.isArray(value) || value.some((entry) => typeof entry !== "string")) {
+    issues.push({ code: "invalid_type", severity: "error", field, message: `${field} must be an array of strings.` });
+    return [...fallback];
+  }
+  return [...new Set(value.map((entry) => entry.trim()).filter(Boolean))];
+}
+
+function clonePolicy(policy: ProjectPolicy): ProjectPolicy {
+  return {
+    allowed_commands: [...policy.allowed_commands],
+    auto_cleanup: {
+      enabled: policy.auto_cleanup.enabled,
+      patterns: [...policy.auto_cleanup.patterns],
+      exclude: [...policy.auto_cleanup.exclude],
+    },
+    high_risk_commands: [...policy.high_risk_commands],
+    protected_paths: [...policy.protected_paths],
+    release_mode: {
+      version_source: policy.release_mode.version_source,
+      required_commands: [...policy.release_mode.required_commands],
+    },
+  };
+}
+
+function normalizeRelPath(value: string): string {
+  return value.trim().replace(/\\/g, "/").replace(/^\.\//, "").replace(/\/+$/, "");
+}
+
+function pathMatchesPattern(relPath: string, pattern: string): boolean {
+  const normalizedPattern = normalizeRelPath(pattern);
+  if (!normalizedPattern) return false;
+  if (normalizedPattern.includes("*")) {
+    const escaped = normalizedPattern
+      .split("*")
+      .map((part) => part.replace(/[.+?^${}()|[\]\\]/g, "\\$&"))
+      .join("[^/]*");
+    return new RegExp(`^${escaped}$`, "i").test(relPath);
+  }
+  return relPath.toLowerCase() === normalizedPattern.toLowerCase() ||
+    relPath.toLowerCase().startsWith(`${normalizedPattern.toLowerCase()}/`);
+}
+
+function parseGithubRepo(repository: unknown): string | null {
+  const raw = typeof repository === "string"
+    ? repository
+    : repository && typeof repository === "object" && typeof (repository as any).url === "string"
+      ? (repository as any).url
+      : "";
+  const match = raw.match(/github\.com[:/](.+?\/.+?)(?:\.git)?(?:[#?].*)?$/i);
+  return match ? match[1] : null;
+}

package/src/smoke-test.ts

@@ -592,7 +592,7 @@ test("D8b. tool profiles are exact and schema changes alter the manifest hash",
   try {
     process.env.PATCHWARDEN_TOOL_PROFILE = "full";
     const fullTools = getToolDefs();
-    if (fullTools.length !== 54) throw new Error(`Expected 54 full tools, got ${fullTools.length}`);
+    if (fullTools.length !== 64) throw new Error(`Expected 64 full tools, got ${fullTools.length}`);
 
     const coreTools = selectToolsForProfile(fullTools, "chatgpt_core", getConfig().enableDirectProfile);
     const names = coreTools.map((tool) => tool.name);
@@ -1934,10 +1934,10 @@ reloadConfig();
 
 let directSessionId = "";
 
-test("M1. chatgpt_core still has 21 tools", () => {
+test("M1. chatgpt_core still has the expected tool manifest", () => {
   const tools = getToolDefs();
   const coreTools = selectToolsForProfile(tools, "chatgpt_core", true);
-  if (coreTools.length !== 21) throw new Error(`Expected 21, got ${coreTools.length}`);
+  if (coreTools.length !== CHATGPT_CORE_TOOL_NAMES.length) throw new Error(`Expected ${CHATGPT_CORE_TOOL_NAMES.length}, got ${coreTools.length}`);
   if (JSON.stringify(coreTools.map((t) => t.name)) !== JSON.stringify(CHATGPT_CORE_TOOL_NAMES)) {
     throw new Error("Tool names mismatch");
   }
@@ -1950,10 +1950,10 @@ test("M2. chatgpt_direct disabled exposes only health_check", () => {
   if (disabledTools[0].name !== "health_check") throw new Error(`Expected health_check, got ${disabledTools[0].name}`);
 });
 
-test("M3. chatgpt_direct enabled has 13 tools", () => {
+test("M3. chatgpt_direct enabled has 14 tools", () => {
   const tools = getToolDefs();
   const directTools = selectToolsForProfile(tools, "chatgpt_direct", true);
-  if (directTools.length !== 13) throw new Error(`Expected 13, got ${directTools.length}`);
+  if (directTools.length !== CHATGPT_DIRECT_TOOL_NAMES.length) throw new Error(`Expected ${CHATGPT_DIRECT_TOOL_NAMES.length}, got ${directTools.length}`);
   if (JSON.stringify(directTools.map((t) => t.name)) !== JSON.stringify(CHATGPT_DIRECT_TOOL_NAMES)) {
     throw new Error("Tool names mismatch");
   }

package/src/test/unit/evidence-pack.test.ts

@@ -0,0 +1,142 @@
+import { describe, it, beforeEach, afterEach } from "node:test";
+import { strict as assert } from "node:assert";
+import { mkdtempSync, rmSync, writeFileSync, readFileSync } from "node:fs";
+import { join } from "node:path";
+import { tmpdir } from "node:os";
+import { reloadConfig } from "../../config.js";
+import { recommendAgentForTask } from "../../tools/recommendAgentForTask.js";
+import { exportTaskEvidencePack, listEvidencePacks, readEvidencePack } from "../../tools/evidencePack.js";
+import { writeTaskLineage } from "../../tools/taskLineage.js";
+
+let tempDir: string;
+let prevConfigEnv: string | undefined;
+
+function writeConfig() {
+  const configPath = join(tempDir, "patchwarden.config.json");
+  writeFileSync(
+    configPath,
+    JSON.stringify({
+      workspaceRoot: tempDir,
+      tasksDir: ".patchwarden/tasks",
+      plansDir: ".patchwarden/plans",
+      assessmentsDir: ".patchwarden/assessments",
+      agents: {
+        codex: { command: "codex", args: [] },
+        opencode: { command: "opencode", args: [] },
+      },
+      allowedTestCommands: ["npm test", "npm run build"],
+      defaultTaskTimeoutSeconds: 30,
+      maxTaskTimeoutSeconds: 120,
+    }),
+    "utf-8"
+  );
+  prevConfigEnv = process.env.PATCHWARDEN_CONFIG;
+  process.env.PATCHWARDEN_CONFIG = configPath;
+  reloadConfig();
+}
+
+describe("v1.5 evidence packs and agent recommendations", () => {
+  beforeEach(() => {
+    tempDir = mkdtempSync(join(tmpdir(), "pw-evidence-"));
+    writeConfig();
+  });
+
+  afterEach(() => {
+    if (prevConfigEnv === undefined) delete process.env.PATCHWARDEN_CONFIG;
+    else process.env.PATCHWARDEN_CONFIG = prevConfigEnv;
+    reloadConfig();
+    rmSync(tempDir, { recursive: true, force: true });
+  });
+
+  it("recommends an agent without creating task evidence", () => {
+    const recommendation = recommendAgentForTask({
+      repo_path: ".",
+      goal: "Refactor two modules safely",
+      scope_files: ["src/a.ts", "src/b.ts"],
+    });
+
+    assert.equal(recommendation.bounded, true);
+    assert.ok(["codex", "opencode"].includes(recommendation.recommended_agent));
+    assert.ok(Array.isArray(recommendation.suggested_verify_commands));
+    const payload = JSON.stringify(recommendation);
+    assert.ok(!payload.includes("stdout"));
+    assert.ok(!payload.includes("stderr"));
+    assert.ok(!payload.includes("diff"));
+  });
+
+  it("exports bounded BOM-free evidence pack from lineage", () => {
+    writeTaskLineage({
+      lineage_id: "lineage_v15_pack",
+      goal: "Export evidence",
+      repo_path: ".",
+      created_at: "2026-07-05T12:00:00.000Z",
+      updated_at: "2026-07-05T12:01:00.000Z",
+      final_status: "accepted",
+      stop_reason: "success",
+      next_action: "accept",
+      main_task: "task-main",
+      fix_tasks: [],
+      cleanup_tasks: [],
+      direct_sessions: [{
+        session_id: "direct-one",
+        status: "passed",
+        command_count: 1,
+        passed_commands: 1,
+        failed_commands: 0,
+        timed_out_commands: 0,
+        audit_decision: "pass",
+        changed_files_total: 0,
+        next_action: "accept",
+      }],
+      rounds: [{
+        iteration: 1,
+        task_id: "task-main",
+        role: "main",
+        status: "done_by_agent",
+        terminal: true,
+        verification_status: "passed",
+        audit_verdict: "pass",
+        fail_checks: [],
+        warn_checks: [],
+        next_action: "accept",
+      }],
+      warnings: [],
+      errors: [],
+      worktree: {
+        isolation_mode: "worktree",
+        worktree_id: "wt-one",
+        worktree_path: join(tempDir, "_workspacetrees", "wt-one"),
+        branch: "pw-test",
+        cleanup: "keep",
+        status: "active",
+        next_action: "merge or discard explicitly",
+      },
+      agent_routing: {
+        requested_agent: "auto",
+        selected_agent: "codex",
+        reason: "test route",
+        fallback: false,
+      },
+    });
+
+    const pack = exportTaskEvidencePack({ lineage_id: "lineage_v15_pack" });
+    assert.equal(pack.bounded, true);
+    assert.equal(pack.lineage.worktree.worktree_id, "wt-one");
+    assert.equal(pack.lineage.agent_routing?.selected_agent, "codex");
+    const raw = readFileSync(pack.files.json);
+    assert.notEqual(raw[0], 0xef);
+    JSON.parse(raw.toString("utf-8"));
+
+    const payload = JSON.stringify(pack);
+    assert.ok(!payload.includes("stdout_tail"));
+    assert.ok(!payload.includes("stderr_tail"));
+    assert.ok(!payload.includes("diff.patch"));
+    assert.ok(!payload.includes("verification.log"));
+
+    const readBack = readEvidencePack("lineage_v15_pack");
+    assert.equal(readBack?.lineage_id, "lineage_v15_pack");
+    const listed = listEvidencePacks();
+    assert.equal(listed.total, 1);
+    assert.equal(listed.evidence_packs[0].lineage_id, "lineage_v15_pack");
+  });
+});

package/src/test/unit/project-policy-release-mode.test.ts

@@ -0,0 +1,156 @@
+import { describe, it, beforeEach, afterEach } from "node:test";
+import { strict as assert } from "node:assert";
+import { existsSync, mkdirSync, mkdtempSync, readFileSync, rmSync, writeFileSync } from "node:fs";
+import { join } from "node:path";
+import { tmpdir } from "node:os";
+import { reloadConfig } from "../../config.js";
+import { getProjectPolicySummary } from "../../policy/projectPolicy.js";
+import { releaseCleanup, releasePrepare, releaseVerify } from "../../tools/releaseMode.js";
+
+let tempDir: string;
+let repoPath: string;
+let prevConfigEnv: string | undefined;
+
+function writeConfig(allowedTestCommands = ["npm test", "npm run build"]): void {
+  const configPath = join(tempDir, "patchwarden.config.json");
+  writeFileSync(
+    configPath,
+    JSON.stringify({
+      workspaceRoot: tempDir,
+      plansDir: ".patchwarden/plans",
+      tasksDir: ".patchwarden/tasks",
+      assessmentsDir: ".patchwarden/assessments",
+      allowedTestCommands,
+      agents: {},
+      defaultTaskTimeoutSeconds: 30,
+      maxTaskTimeoutSeconds: 120,
+    }),
+    "utf-8",
+  );
+  prevConfigEnv = process.env.PATCHWARDEN_CONFIG;
+  process.env.PATCHWARDEN_CONFIG = configPath;
+  reloadConfig(configPath);
+}
+
+function writePackage(version = "1.3.0"): void {
+  writeFileSync(
+    join(repoPath, "package.json"),
+    JSON.stringify({
+      name: "patchwarden-test",
+      version,
+      repository: { type: "git", url: "git+https://github.com/example/patchwarden-test.git" },
+    }),
+    "utf-8",
+  );
+}
+
+describe("project policy and release mode", () => {
+  beforeEach(() => {
+    tempDir = mkdtempSync(join(tmpdir(), "pw-policy-"));
+    repoPath = join(tempDir, "repo");
+    mkdirSync(repoPath, { recursive: true });
+    writePackage();
+    writeConfig();
+  });
+
+  afterEach(() => {
+    if (prevConfigEnv === undefined) {
+      delete process.env.PATCHWARDEN_CONFIG;
+    } else {
+      process.env.PATCHWARDEN_CONFIG = prevConfigEnv;
+    }
+    reloadConfig();
+    rmSync(tempDir, { recursive: true, force: true });
+  });
+
+  it("returns safe defaults when project-policy.json is missing", () => {
+    const summary = getProjectPolicySummary(repoPath);
+    assert.equal(summary.exists, false);
+    assert.equal(summary.valid, true);
+    assert.equal(summary.effective_policy.release_mode.version_source, "package.json");
+    assert.equal(summary.release_readiness.version, "1.3.0");
+  });
+
+  it("parses BOM-prefixed policy JSON and reports allowlist issues without granting permission", () => {
+    mkdirSync(join(repoPath, ".patchwarden"), { recursive: true });
+    writeFileSync(
+      join(repoPath, ".patchwarden", "project-policy.json"),
+      "\uFEFF" + JSON.stringify({
+        allowed_commands: ["npm run build", "npm publish"],
+        release_mode: {
+          version_source: "package.json",
+          required_commands: ["npm run build", "not-allowed"],
+        },
+      }),
+      "utf-8",
+    );
+    const summary = getProjectPolicySummary(repoPath);
+    assert.equal(summary.exists, true);
+    assert.equal(summary.valid, false);
+    assert.ok(summary.issues.some((issue) => issue.code === "high_risk_command"));
+    assert.ok(summary.issues.some((issue) => issue.code === "command_not_allowlisted"));
+  });
+
+  it("rejects unsafe path patterns and sensitive protected paths block cleanup", () => {
+    mkdirSync(join(repoPath, ".patchwarden"), { recursive: true });
+    writeFileSync(
+      join(repoPath, ".patchwarden", "project-policy.json"),
+      JSON.stringify({
+        auto_cleanup: { enabled: true, patterns: ["../escape", ".git", "release_packages"], exclude: [] },
+        protected_paths: [".env", "release_packages"],
+      }),
+      "utf-8",
+    );
+    mkdirSync(join(repoPath, "release_packages"), { recursive: true });
+    const summary = getProjectPolicySummary(repoPath);
+    assert.equal(summary.valid, false);
+    assert.ok(summary.issues.some((issue) => issue.code === "unsafe_path_pattern"));
+    const cleanup = releaseCleanup({ repo_path: repoPath, dry_run: true });
+    const skipped = cleanup.summary.skipped as Array<{ path: string; reason: string }>;
+    assert.ok(skipped.some((entry) => entry.path === "release_packages" && entry.reason === "protected_or_sensitive"));
+  });
+
+  it("release_cleanup defaults to dry run and writes BOM-free JSON summary", () => {
+    mkdirSync(join(repoPath, "release_packages"), { recursive: true });
+    const result = releaseCleanup({ repo_path: repoPath });
+    assert.equal(result.mode, "release_cleanup");
+    assert.equal((result.summary as any).dry_run, true);
+    assert.equal(existsSync(join(repoPath, "release_packages")), true);
+    const reportPath = join(repoPath, String((result.summary as any).report_path));
+    const raw = readFileSync(reportPath, "utf-8");
+    assert.notEqual(raw.charCodeAt(0), 0xfeff);
+    assert.doesNotThrow(() => JSON.parse(raw));
+  });
+
+  it("release_cleanup honors auto_cleanup.enabled=false before deleting", () => {
+    mkdirSync(join(repoPath, ".patchwarden"), { recursive: true });
+    writeFileSync(
+      join(repoPath, ".patchwarden", "project-policy.json"),
+      JSON.stringify({
+        auto_cleanup: { enabled: false, patterns: ["release_packages"], exclude: [] },
+      }),
+      "utf-8",
+    );
+    mkdirSync(join(repoPath, "release_packages"), { recursive: true });
+    const result = releaseCleanup({ repo_path: repoPath, dry_run: false });
+    assert.equal((result.summary as any).cleanup_disabled_by_policy, true);
+    assert.deepEqual((result.summary as any).removed, []);
+    assert.equal(existsSync(join(repoPath, "release_packages")), true);
+  });
+
+  it("release_verify fails when required metadata cannot be inferred", async () => {
+    writeFileSync(join(repoPath, "package.json"), JSON.stringify({ name: "", version: "" }), "utf-8");
+    const result = await releaseVerify({ repo_path: repoPath });
+    assert.equal(result.ok, false);
+    const stages = result.summary.stages as Record<string, string>;
+    assert.equal(stages.published_verified, "failed");
+    assert.equal(stages.github_release_verified, "failed");
+    assert.equal(stages.ci_verified, "failed");
+  });
+
+  it("release_prepare blocks commands not accepted by the existing command guard", () => {
+    const result = releasePrepare({ repo_path: repoPath, required_commands: ["npm run build", "npm run secret"] });
+    const commands = result.summary.commands as Array<{ command: string; status: string }>;
+    assert.equal(commands.find((entry) => entry.command === "npm run secret")?.status, "blocked");
+  });
+});