patchwarden 1.1.0 → 1.5.1

package/dist/direct/directGuards.js

@@ -113,23 +113,45 @@ const BINARY_EXTENSIONS = new Set([
     ".bin", ".dat", ".pak", ".pfx", ".p12", ".class", ".jar", ".war",
     ".wasm", ".node",
 ]);
+/**
+ * Maximum bytes to scan for null-byte detection when the extension is not
+ * a known binary type. 1 MB catches binary content embedded deep in files
+ * (e.g., null bytes at offset 8200) without reading excessively large files.
+ */
+const BINARY_SCAN_LIMIT = 1_048_576; // 1 MB
+const BINARY_SCAN_CHUNK = 65536; // 64 KB per read
 export function isBinaryFile(filePath) {
     const normalized = filePath.replace(/\\/g, "/").toLowerCase();
     for (const ext of BINARY_EXTENSIONS) {
         if (normalized.endsWith(ext))
             return true;
     }
-    // Check file content for null bytes (simple heuristic)
+    // Scan file content for null bytes in chunks up to BINARY_SCAN_LIMIT.
+    // Previously only the first 8 KB were checked, allowing null bytes at
+    // offset 8193+ to bypass detection.
     try {
+        const stat = statSync(filePath);
+        const scanSize = Math.min(stat.size, BINARY_SCAN_LIMIT);
         const fd = openSync(filePath, "r");
-        const buffer = Buffer.alloc(8192);
-        const bytesRead = readSync(fd, buffer, 0, 8192, 0);
-        closeSync(fd);
-        for (let i = 0; i < bytesRead; i++) {
-            if (buffer[i] === 0)
-                return true;
+        try {
+            const chunk = Buffer.alloc(BINARY_SCAN_CHUNK);
+            let scanned = 0;
+            while (scanned < scanSize) {
+                const toRead = Math.min(BINARY_SCAN_CHUNK, scanSize - scanned);
+                const bytesRead = readSync(fd, chunk, 0, toRead, scanned);
+                if (bytesRead === 0)
+                    break;
+                for (let i = 0; i < bytesRead; i++) {
+                    if (chunk[i] === 0)
+                        return true;
+                }
+                scanned += bytesRead;
+            }
+            return false;
+        }
+        finally {
+            closeSync(fd);
         }
-        return false;
     }
     catch {
         return false;

package/dist/direct/directSessionStore.d.ts

@@ -13,6 +13,8 @@ export interface DirectSessionVerificationRun {
     exit_code: number | null;
     passed: boolean;
     timed_out: boolean;
+    redacted?: boolean;
+    redaction_categories?: string[];
     stdout_tail: string;
     stderr_tail: string;
     started_at: string;

package/dist/direct/directVerification.js

@@ -40,6 +40,13 @@ export async function runDirectVerification(input) {
         exit_code: result.exitCode,
         passed,
         timed_out: result.timedOut,
+        redacted: stdoutRedacted.redacted || stderrRedacted.redacted,
+        redaction_categories: [
+            ...new Set([
+                ...stdoutRedacted.redaction_categories,
+                ...stderrRedacted.redaction_categories,
+            ]),
+        ],
         stdout_tail: stdoutTail,
         stderr_tail: stderrTail,
         started_at: startedAt,

package/dist/doctor.d.ts

@@ -7,4 +7,21 @@
  * Checks 15 aspects of the environment and configuration.
  * Never modifies files, installs dependencies, or starts services.
  */
-export {};
+import { type PatchWardenConfig } from "./config.js";
+export type DoctorCheckLevel = "OK" | "WARN" | "FAIL";
+export interface DoctorCheckResult {
+    level: DoctorCheckLevel;
+    message: string;
+    details?: string;
+}
+export interface DoctorCheck {
+    id: string;
+    description: string;
+    run(context: DoctorContext): DoctorCheckResult[] | Promise<DoctorCheckResult[]>;
+}
+export interface DoctorContext {
+    config: PatchWardenConfig | null;
+    configError: string | null;
+    allowDefaultConfig: boolean;
+    configPathUsed: string;
+}