patchwarden 1.1.0 → 1.5.1

package/dist/test/unit/goal-report.test.js

@@ -0,0 +1,159 @@
+import { describe, it, beforeEach, afterEach } from "node:test";
+import { strict as assert } from "node:assert";
+import { existsSync, mkdirSync, mkdtempSync, readFileSync, rmSync, writeFileSync } from "node:fs";
+import { join, resolve } from "node:path";
+import { tmpdir } from "node:os";
+import { reloadConfig } from "../../config.js";
+import { exportGoalReport } from "../../goal/goalReport.js";
+import { getGoalDir, writeGoalStatus } from "../../goal/goalStore.js";
+// ── Helpers ───────────────────────────────────────────────────────
+function makeSubgoal(overrides) {
+    return {
+        title: "Subgoal " + overrides.id,
+        status: "ready",
+        depends_on: [],
+        task_ids: [],
+        ...overrides,
+    };
+}
+function makeGoalStatus(subgoals, overrides = {}) {
+    const now = "2026-07-10T00:00:00.000Z";
+    return {
+        goal_id: "goal_test_001",
+        title: "Test Goal",
+        status: "active",
+        repo_path: "/repo/test",
+        created_at: now,
+        updated_at: now,
+        subgoals,
+        ...overrides,
+    };
+}
+let tempDir;
+let prevConfigEnv;
+function writeConfig() {
+    const configPath = join(tempDir, "patchwarden.config.json");
+    writeFileSync(configPath, JSON.stringify({
+        workspaceRoot: tempDir,
+        tasksDir: ".patchwarden/tasks",
+        plansDir: ".patchwarden/plans",
+        assessmentsDir: ".patchwarden/assessments",
+        agents: {
+            codex: { command: "codex", args: [] },
+            opencode: { command: "opencode", args: [] },
+        },
+        allowedTestCommands: ["npm test", "npm run build"],
+        defaultTaskTimeoutSeconds: 30,
+        maxTaskTimeoutSeconds: 120,
+    }), "utf-8");
+    prevConfigEnv = process.env.PATCHWARDEN_CONFIG;
+    process.env.PATCHWARDEN_CONFIG = configPath;
+    reloadConfig();
+}
+/**
+ * 创建 goal 目录并写入 goal_status.json（writeGoalStatus 不自动创建目录）。
+ */
+function seedGoalStatus(goalId, status, workspaceRoot) {
+    mkdirSync(getGoalDir(goalId, workspaceRoot), { recursive: true });
+    writeGoalStatus(goalId, status, workspaceRoot);
+}
+// ── Tests ─────────────────────────────────────────────────────────
+describe("goalReport", () => {
+    beforeEach(() => {
+        tempDir = mkdtempSync(join(tmpdir(), "pw-goal-report-"));
+        writeConfig();
+    });
+    afterEach(() => {
+        if (prevConfigEnv === undefined)
+            delete process.env.PATCHWARDEN_CONFIG;
+        else
+            process.env.PATCHWARDEN_CONFIG = prevConfigEnv;
+        reloadConfig();
+        rmSync(tempDir, { recursive: true, force: true });
+    });
+    it("完成 Goal 报告：所有 subgoal accepted，completion_rate=100", () => {
+        const goal = makeGoalStatus([
+            makeSubgoal({
+                id: "subgoal-001",
+                title: "Feature A",
+                status: "accepted",
+                accepted_at: "2026-07-01T00:00:00.000Z",
+            }),
+            makeSubgoal({
+                id: "subgoal-002",
+                title: "Feature B",
+                status: "accepted",
+                accepted_at: "2026-07-02T00:00:00.000Z",
+            }),
+        ], { goal_id: "goal_done_001" });
+        seedGoalStatus("goal_done_001", goal, tempDir);
+        const report = exportGoalReport("goal_done_001", { workspaceRoot: tempDir });
+        assert.equal(report.completion_rate, 100);
+        assert.equal(report.goal_id, "goal_done_001");
+        assert.equal(report.subgoals.length, 2);
+        assert.equal(report.bounded, true);
+        assert.ok(existsSync(report.files.report_md));
+        assert.ok(existsSync(report.files.report_json));
+    });
+    it("未完成 Goal 报告：有 running/ready subgoal，报告含 '未完成'", () => {
+        const goal = makeGoalStatus([
+            makeSubgoal({
+                id: "subgoal-001",
+                title: "Done",
+                status: "accepted",
+                accepted_at: "2026-07-01T00:00:00.000Z",
+            }),
+            makeSubgoal({ id: "subgoal-002", title: "WIP", status: "running" }),
+        ]);
+        seedGoalStatus("goal_wip_001", goal, tempDir);
+        const report = exportGoalReport("goal_wip_001", { workspaceRoot: tempDir });
+        const md = readFileSync(report.files.report_md, "utf-8");
+        assert.ok(md.includes("未完成"), "REPORT.md should contain '未完成' annotation");
+        assert.ok(report.risks.some((r) => r.includes("未完成")), "risks array should contain '未完成' entry");
+    });
+    it("空 Goal 报告：无 subgoal，completion_rate=0，报告含 '无子目标'", () => {
+        const goal = makeGoalStatus([]);
+        seedGoalStatus("goal_empty_001", goal, tempDir);
+        const report = exportGoalReport("goal_empty_001", { workspaceRoot: tempDir });
+        assert.equal(report.completion_rate, 0);
+        const md = readFileSync(report.files.report_md, "utf-8");
+        assert.ok(md.includes("无子目标"), "REPORT.md should contain '无子目标' annotation");
+    });
+    it("双格式输出：REPORT.md 和 report.json 同时存在", () => {
+        const goal = makeGoalStatus([
+            makeSubgoal({
+                id: "subgoal-001",
+                title: "Task A",
+                status: "accepted",
+                accepted_at: "2026-07-01T00:00:00.000Z",
+            }),
+        ]);
+        seedGoalStatus("goal_dual_001", goal, tempDir);
+        const report = exportGoalReport("goal_dual_001", { workspaceRoot: tempDir });
+        const reportDir = resolve(tempDir, ".patchwarden", "goals", "goal_dual_001", "report");
+        const mdPath = join(reportDir, "REPORT.md");
+        const jsonPath = join(reportDir, "report.json");
+        assert.ok(existsSync(mdPath), "REPORT.md should exist");
+        assert.ok(existsSync(jsonPath), "report.json should exist");
+        assert.equal(report.files.report_md, mdPath);
+        assert.equal(report.files.report_json, jsonPath);
+    });
+    it("脱敏验证：subgoal title 含敏感信息，输出中不含原始值", () => {
+        const goal = makeGoalStatus([
+            makeSubgoal({
+                id: "subgoal-001",
+                title: "Deploy with token=abcd1234",
+                status: "accepted",
+                accepted_at: "2026-07-01T00:00:00.000Z",
+            }),
+        ]);
+        seedGoalStatus("goal_redact_001", goal, tempDir);
+        const report = exportGoalReport("goal_redact_001", { workspaceRoot: tempDir });
+        const md = readFileSync(report.files.report_md, "utf-8");
+        const json = readFileSync(report.files.report_json, "utf-8");
+        assert.ok(!md.includes("abcd1234"), "REPORT.md must not contain raw secret value");
+        assert.ok(!json.includes("abcd1234"), "report.json must not contain raw secret value");
+        assert.ok(md.includes("[REDACTED]"), "REPORT.md should contain redaction marker");
+        assert.ok(json.includes("[REDACTED]"), "report.json should contain redaction marker");
+    });
+});

package/dist/test/unit/goal-subgoal-task.test.js

@@ -11,8 +11,8 @@ import { PatchWardenError } from "../../errors.js";
 //   - goal_not_found：readGoalStatus 在默认工作区找不到 goal 即抛错
 describe("createSubgoalTask", () => {
     describe("错误路径", () => {
-        it("execution_mode=assess_only 抛 invalid_execution_mode", () => {
-            assert.throws(() => createSubgoalTask({
+        it("execution_mode=assess_only 抛 invalid_execution_mode", async () => {
+            await assert.rejects(() => createSubgoalTask({
                 goal_id: "goal_nonexistent_test",
                 subgoal_title: "Sub A",
                 repo_path: "repo",
@@ -24,8 +24,8 @@ describe("createSubgoalTask", () => {
                 return true;
             });
         });
-        it("goal_id 不存在抛 goal_not_found", () => {
-            assert.throws(() => createSubgoalTask({
+        it("goal_id 不存在抛 goal_not_found", async () => {
+            await assert.rejects(() => createSubgoalTask({
                 goal_id: "goal_definitely_does_not_exist_99999",
                 subgoal_title: "Sub A",
                 repo_path: "repo",
@@ -37,10 +37,10 @@ describe("createSubgoalTask", () => {
                 return true;
             });
         });
-        it("assess_only 优先于 goal_not_found（在读取 goal 前校验）", () => {
+        it("assess_only 优先于 goal_not_found（在读取 goal 前校验）", async () => {
             // execution_mode=assess_only 应先抛 invalid_execution_mode，
             // 而不是去读不存在的 goal
-            assert.throws(() => createSubgoalTask({
+            await assert.rejects(() => createSubgoalTask({
                 goal_id: "goal_definitely_does_not_exist_99999",
                 subgoal_title: "Sub A",
                 repo_path: "repo",

package/dist/test/unit/goal-tools-registry.test.js

@@ -6,7 +6,7 @@ import { tmpdir } from "node:os";
 import { getToolDefs, handleToolCall } from "../../tools/registry.js";
 import { reloadConfig } from "../../config.js";
 import { PatchWardenError } from "../../errors.js";
-// ── 9 个 Goal Session MCP 工具名 ──────────────────────────────────
+// ── 11 个 Goal Session MCP 工具名 ─────────────────────────────────
 const GOAL_TOOL_NAMES = [
     "create_goal",
     "list_goals",
@@ -17,6 +17,8 @@ const GOAL_TOOL_NAMES = [
     "suggest_next_subgoal",
     "summarize_goal_progress",
     "export_handoff",
+    "export_goal_report",
+    "import_speckit_tasks",
 ];
 // ── 测试环境隔离：使用临时 workspaceRoot + full profile ───────────
 let tempDir;
@@ -56,21 +58,21 @@ afterEach(() => {
 // ── Tests ─────────────────────────────────────────────────────────
 describe("goal tools registry", () => {
     describe("getToolDefs — 工具定义", () => {
-        it("包含全部 9 个 goal 工具", () => {
+        it("包含全部 11 个 goal 工具", () => {
             const tools = getToolDefs();
             const names = new Set(tools.map((t) => t.name));
             for (const name of GOAL_TOOL_NAMES) {
                 assert.ok(names.has(name), `Missing tool definition: ${name}`);
             }
         });
-        it("每个 goal 工具描述以 v0.8.0 开头且 inputSchema.type 为 object", () => {
+        it("每个 goal 工具描述非空且 inputSchema.type 为 object", () => {
             const tools = getToolDefs();
             const byName = new Map(tools.map((t) => [t.name, t]));
             for (const name of GOAL_TOOL_NAMES) {
                 const tool = byName.get(name);
                 assert.ok(tool, `Tool not found: ${name}`);
                 assert.equal(tool.inputSchema.type, "object", `${name} schema type should be object`);
-                assert.ok(tool.description.startsWith("v0.8.0:"), `${name} description should start with v0.8.0:`);
+                assert.ok(typeof tool.description === "string" && tool.description.length > 0, `${name} description should be a non-empty string`);
             }
         });
         it("create_goal required 字段为 title/goal_description/repo_path", () => {

package/dist/test/unit/path-guard.test.js

@@ -69,6 +69,30 @@ describe("guardPath", () => {
             rmSync(target, { recursive: true, force: true });
         }
     });
+    it("rejects Windows junction escape", { skip: process.platform !== "win32" ? "Windows-only test" : undefined }, () => {
+        const target = mkdtempSync(join(tmpdir(), "pw-junction-target-"));
+        try {
+            const linkPath = join(tempDir, "escape-junction");
+            symlinkSync(target, linkPath, "junction");
+            assert.throws(() => guardPath("escape-junction/secret.txt", tempDir), PatchWardenError);
+        }
+        finally {
+            rmSync(target, { recursive: true, force: true });
+        }
+    });
+    it("rejects intermediate symlink escape (TOCTOU defense)", { skip: process.platform === "win32" ? "Windows symlink permissions unstable" : undefined }, () => {
+        const target = mkdtempSync(join(tmpdir(), "pw-toctou-target-"));
+        try {
+            const linkPath = join(tempDir, "escape-link");
+            symlinkSync(target, linkPath);
+            mkdirSync(join(target, "subdir"), { recursive: true });
+            writeFileSync(join(target, "subdir", "secret.txt"), "secret", "utf-8");
+            assert.throws(() => guardPath("escape-link/subdir/secret.txt", tempDir), PatchWardenError);
+        }
+        finally {
+            rmSync(target, { recursive: true, force: true });
+        }
+    });
 });
 describe("guardWorkspacePath", () => {
     let tempDir;

package/dist/test/unit/project-policy-release-mode.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/test/unit/project-policy-release-mode.test.js

@@ -0,0 +1,125 @@
+import { describe, it, beforeEach, afterEach } from "node:test";
+import { strict as assert } from "node:assert";
+import { existsSync, mkdirSync, mkdtempSync, readFileSync, rmSync, writeFileSync } from "node:fs";
+import { join } from "node:path";
+import { tmpdir } from "node:os";
+import { reloadConfig } from "../../config.js";
+import { getProjectPolicySummary } from "../../policy/projectPolicy.js";
+import { releaseCleanup, releasePrepare, releaseVerify } from "../../tools/releaseMode.js";
+let tempDir;
+let repoPath;
+let prevConfigEnv;
+function writeConfig(allowedTestCommands = ["npm test", "npm run build"]) {
+    const configPath = join(tempDir, "patchwarden.config.json");
+    writeFileSync(configPath, JSON.stringify({
+        workspaceRoot: tempDir,
+        plansDir: ".patchwarden/plans",
+        tasksDir: ".patchwarden/tasks",
+        assessmentsDir: ".patchwarden/assessments",
+        allowedTestCommands,
+        agents: {},
+        defaultTaskTimeoutSeconds: 30,
+        maxTaskTimeoutSeconds: 120,
+    }), "utf-8");
+    prevConfigEnv = process.env.PATCHWARDEN_CONFIG;
+    process.env.PATCHWARDEN_CONFIG = configPath;
+    reloadConfig(configPath);
+}
+function writePackage(version = "1.3.0") {
+    writeFileSync(join(repoPath, "package.json"), JSON.stringify({
+        name: "patchwarden-test",
+        version,
+        repository: { type: "git", url: "git+https://github.com/example/patchwarden-test.git" },
+    }), "utf-8");
+}
+describe("project policy and release mode", () => {
+    beforeEach(() => {
+        tempDir = mkdtempSync(join(tmpdir(), "pw-policy-"));
+        repoPath = join(tempDir, "repo");
+        mkdirSync(repoPath, { recursive: true });
+        writePackage();
+        writeConfig();
+    });
+    afterEach(() => {
+        if (prevConfigEnv === undefined) {
+            delete process.env.PATCHWARDEN_CONFIG;
+        }
+        else {
+            process.env.PATCHWARDEN_CONFIG = prevConfigEnv;
+        }
+        reloadConfig();
+        rmSync(tempDir, { recursive: true, force: true });
+    });
+    it("returns safe defaults when project-policy.json is missing", () => {
+        const summary = getProjectPolicySummary(repoPath);
+        assert.equal(summary.exists, false);
+        assert.equal(summary.valid, true);
+        assert.equal(summary.effective_policy.release_mode.version_source, "package.json");
+        assert.equal(summary.release_readiness.version, "1.3.0");
+    });
+    it("parses BOM-prefixed policy JSON and reports allowlist issues without granting permission", () => {
+        mkdirSync(join(repoPath, ".patchwarden"), { recursive: true });
+        writeFileSync(join(repoPath, ".patchwarden", "project-policy.json"), "\uFEFF" + JSON.stringify({
+            allowed_commands: ["npm run build", "npm publish"],
+            release_mode: {
+                version_source: "package.json",
+                required_commands: ["npm run build", "not-allowed"],
+            },
+        }), "utf-8");
+        const summary = getProjectPolicySummary(repoPath);
+        assert.equal(summary.exists, true);
+        assert.equal(summary.valid, false);
+        assert.ok(summary.issues.some((issue) => issue.code === "high_risk_command"));
+        assert.ok(summary.issues.some((issue) => issue.code === "command_not_allowlisted"));
+    });
+    it("rejects unsafe path patterns and sensitive protected paths block cleanup", () => {
+        mkdirSync(join(repoPath, ".patchwarden"), { recursive: true });
+        writeFileSync(join(repoPath, ".patchwarden", "project-policy.json"), JSON.stringify({
+            auto_cleanup: { enabled: true, patterns: ["../escape", ".git", "release_packages"], exclude: [] },
+            protected_paths: [".env", "release_packages"],
+        }), "utf-8");
+        mkdirSync(join(repoPath, "release_packages"), { recursive: true });
+        const summary = getProjectPolicySummary(repoPath);
+        assert.equal(summary.valid, false);
+        assert.ok(summary.issues.some((issue) => issue.code === "unsafe_path_pattern"));
+        const cleanup = releaseCleanup({ repo_path: repoPath, dry_run: true });
+        const skipped = cleanup.summary.skipped;
+        assert.ok(skipped.some((entry) => entry.path === "release_packages" && entry.reason === "protected_or_sensitive"));
+    });
+    it("release_cleanup defaults to dry run and writes BOM-free JSON summary", () => {
+        mkdirSync(join(repoPath, "release_packages"), { recursive: true });
+        const result = releaseCleanup({ repo_path: repoPath });
+        assert.equal(result.mode, "release_cleanup");
+        assert.equal(result.summary.dry_run, true);
+        assert.equal(existsSync(join(repoPath, "release_packages")), true);
+        const reportPath = join(repoPath, String(result.summary.report_path));
+        const raw = readFileSync(reportPath, "utf-8");
+        assert.notEqual(raw.charCodeAt(0), 0xfeff);
+        assert.doesNotThrow(() => JSON.parse(raw));
+    });
+    it("release_cleanup honors auto_cleanup.enabled=false before deleting", () => {
+        mkdirSync(join(repoPath, ".patchwarden"), { recursive: true });
+        writeFileSync(join(repoPath, ".patchwarden", "project-policy.json"), JSON.stringify({
+            auto_cleanup: { enabled: false, patterns: ["release_packages"], exclude: [] },
+        }), "utf-8");
+        mkdirSync(join(repoPath, "release_packages"), { recursive: true });
+        const result = releaseCleanup({ repo_path: repoPath, dry_run: false });
+        assert.equal(result.summary.cleanup_disabled_by_policy, true);
+        assert.deepEqual(result.summary.removed, []);
+        assert.equal(existsSync(join(repoPath, "release_packages")), true);
+    });
+    it("release_verify fails when required metadata cannot be inferred", async () => {
+        writeFileSync(join(repoPath, "package.json"), JSON.stringify({ name: "", version: "" }), "utf-8");
+        const result = await releaseVerify({ repo_path: repoPath });
+        assert.equal(result.ok, false);
+        const stages = result.summary.stages;
+        assert.equal(stages.published_verified, "failed");
+        assert.equal(stages.github_release_verified, "failed");
+        assert.equal(stages.ci_verified, "failed");
+    });
+    it("release_prepare blocks commands not accepted by the existing command guard", () => {
+        const result = releasePrepare({ repo_path: repoPath, required_commands: ["npm run build", "npm run secret"] });
+        const commands = result.summary.commands;
+        assert.equal(commands.find((entry) => entry.command === "npm run secret")?.status, "blocked");
+    });
+});

package/dist/test/unit/run-task-loop.test.d.ts

@@ -0,0 +1 @@
+export {};