patchwarden 1.1.0 → 1.5.1

package/src/test/unit/get-task-summary.test.ts

@@ -0,0 +1,173 @@
+import { describe, it, beforeEach, afterEach } from "node:test";
+import { strict as assert } from "node:assert";
+import { mkdtempSync, rmSync, mkdirSync, writeFileSync } from "node:fs";
+import { join } from "node:path";
+import { tmpdir } from "node:os";
+import { reloadConfig } from "../../config.js";
+import { getTaskSummary } from "../../tools/getTaskSummary.js";
+
+let tempDir: string;
+let tasksDir: string;
+let prevConfigEnv: string | undefined;
+
+function writeConfig(): void {
+  const configPath = join(tempDir, "patchwarden.config.json");
+  writeFileSync(
+    configPath,
+    JSON.stringify({
+      workspaceRoot: tempDir,
+      tasksDir: ".patchwarden/tasks",
+      plansDir: ".patchwarden/plans",
+      assessmentsDir: ".patchwarden/assessments",
+      directSessionsDir: ".patchwarden/direct-sessions",
+      agents: { codex: { command: "codex", args: ["exec", "{prompt}"] } },
+      allowedTestCommands: ["npm test"],
+    }),
+    "utf-8"
+  );
+  prevConfigEnv = process.env.PATCHWARDEN_CONFIG;
+  process.env.PATCHWARDEN_CONFIG = configPath;
+  reloadConfig();
+}
+
+function writeTaskStatus(taskId: string, status: Record<string, unknown>): string {
+  const taskDir = join(tasksDir, taskId);
+  mkdirSync(taskDir, { recursive: true });
+  writeFileSync(join(taskDir, "status.json"), JSON.stringify(status, null, 2), "utf-8");
+  return taskDir;
+}
+
+function baseStatus(taskId: string, overrides: Record<string, unknown> = {}): Record<string, unknown> {
+  return {
+    task_id: taskId,
+    plan_id: "plan-001",
+    agent: "codex",
+    workspace_root: tempDir,
+    repo_path: "repo",
+    resolved_repo_path: join(tempDir, "repo"),
+    created_at: "2026-07-12T10:00:00Z",
+    started_at: "2026-07-12T10:00:05Z",
+    finished_at: "2026-07-12T10:05:00Z",
+    updated_at: "2026-07-12T10:05:00Z",
+    timeout_seconds: 900,
+    error: null,
+    ...overrides,
+  };
+}
+
+describe("getTaskSummary", () => {
+  beforeEach(() => {
+    tempDir = mkdtempSync(join(tmpdir(), "pw-getsummary-"));
+    tasksDir = join(tempDir, ".patchwarden", "tasks");
+    mkdirSync(tasksDir, { recursive: true });
+    writeConfig();
+  });
+
+  afterEach(() => {
+    if (prevConfigEnv === undefined) delete process.env.PATCHWARDEN_CONFIG;
+    else process.env.PATCHWARDEN_CONFIG = prevConfigEnv;
+    reloadConfig();
+    rmSync(tempDir, { recursive: true, force: true });
+  });
+
+  // ── compact mode ──
+  it("returns compact summary in compact mode", () => {
+    writeTaskStatus("task-compact-001", baseStatus("task-compact-001", {
+      status: "done",
+      phase: "completed",
+      verify_status: "passed",
+    }));
+
+    const result = getTaskSummary("task-compact-001", { view: "compact" });
+
+    assert.equal(result.view, "compact");
+    assert.equal(result.task_id, "task-compact-001");
+    assert.equal(result.status, "done");
+    assert.equal(result.terminal, true);
+    // compact-only fields
+    assert.equal(typeof result.changed_files_total, "number");
+    assert.equal(typeof result.release_artifacts_count, "number");
+    assert.ok(result.artifact_hygiene);
+    assert.ok("max_items" in result.artifact_hygiene);
+  });
+
+  // ── full / standard mode ──
+  it("returns full summary in standard mode", () => {
+    writeTaskStatus("task-full-001", baseStatus("task-full-001", {
+      status: "done",
+      phase: "completed",
+      verify_status: "passed",
+    }));
+
+    const result = getTaskSummary("task-full-001");
+
+    // standard mode has no `view` field
+    assert.equal((result as unknown as { view?: string }).view, undefined);
+    assert.equal(result.task_id, "task-full-001");
+    assert.equal(result.status, "done");
+    assert.equal(result.terminal, true);
+    // full-mode-only fields
+    assert.ok("log_tails" in result);
+    assert.ok("artifacts" in result);
+    assert.ok("failed_command_detail" in result);
+    assert.ok("acceptance_reviewed_at" in result);
+  });
+
+  // ── task not found ──
+  it("throws when task does not exist", () => {
+    assert.throws(
+      () => getTaskSummary("non-existent-task"),
+      /(File not found|Task not found)/
+    );
+  });
+
+  // ── terminal: done ──
+  it("returns terminal summary for done task with passed verification", () => {
+    writeTaskStatus("task-done-001", baseStatus("task-done-001", {
+      status: "done",
+      phase: "completed",
+      verify_status: "passed",
+    }));
+
+    const result = getTaskSummary("task-done-001");
+
+    assert.equal(result.terminal, true);
+    assert.equal(result.status, "done");
+    assert.equal(result.verify_status, "passed");
+    // done + verify passed → ready_for_review
+    assert.equal(result.acceptance_status, "ready_for_review");
+  });
+
+  // ── terminal: failed ──
+  it("returns terminal summary for failed task", () => {
+    writeTaskStatus("task-failed-001", baseStatus("task-failed-001", {
+      status: "failed",
+      phase: "failed",
+      error: "Agent exited with code 1",
+    }));
+
+    const result = getTaskSummary("task-failed-001");
+
+    assert.equal(result.terminal, true);
+    assert.equal(result.status, "failed");
+    assert.equal(result.acceptance_status, "failed");
+    assert.ok(result.errors.includes("Agent exited with code 1"));
+  });
+
+  // ── running (non-terminal) ──
+  it("returns non-terminal summary for running task", () => {
+    writeTaskStatus("task-running-001", baseStatus("task-running-001", {
+      status: "running",
+      phase: "executing_agent",
+      started_at: "2026-07-12T10:00:00Z",
+      finished_at: undefined,
+    }));
+
+    const result = getTaskSummary("task-running-001");
+
+    assert.equal(result.terminal, false);
+    assert.equal(result.status, "running");
+    assert.equal(result.phase, "executing_agent");
+    assert.equal(result.acceptance_status, "pending");
+  });
+});

package/src/test/unit/goal-report.test.ts

@@ -0,0 +1,189 @@
+import { describe, it, beforeEach, afterEach } from "node:test";
+import { strict as assert } from "node:assert";
+import { existsSync, mkdirSync, mkdtempSync, readFileSync, rmSync, writeFileSync } from "node:fs";
+import { join, resolve } from "node:path";
+import { tmpdir } from "node:os";
+import { reloadConfig } from "../../config.js";
+import { exportGoalReport } from "../../goal/goalReport.js";
+import { getGoalDir, writeGoalStatus } from "../../goal/goalStore.js";
+import type { GoalStatus, Subgoal } from "../../goal/goalStatus.js";
+
+// ── Helpers ───────────────────────────────────────────────────────
+
+function makeSubgoal(overrides: Partial<Subgoal> & { id: string }): Subgoal {
+  return {
+    title: "Subgoal " + overrides.id,
+    status: "ready",
+    depends_on: [],
+    task_ids: [],
+    ...overrides,
+  };
+}
+
+function makeGoalStatus(subgoals: Subgoal[], overrides: Partial<GoalStatus> = {}): GoalStatus {
+  const now = "2026-07-10T00:00:00.000Z";
+  return {
+    goal_id: "goal_test_001",
+    title: "Test Goal",
+    status: "active",
+    repo_path: "/repo/test",
+    created_at: now,
+    updated_at: now,
+    subgoals,
+    ...overrides,
+  };
+}
+
+let tempDir: string;
+let prevConfigEnv: string | undefined;
+
+function writeConfig(): void {
+  const configPath = join(tempDir, "patchwarden.config.json");
+  writeFileSync(
+    configPath,
+    JSON.stringify({
+      workspaceRoot: tempDir,
+      tasksDir: ".patchwarden/tasks",
+      plansDir: ".patchwarden/plans",
+      assessmentsDir: ".patchwarden/assessments",
+      agents: {
+        codex: { command: "codex", args: [] },
+        opencode: { command: "opencode", args: [] },
+      },
+      allowedTestCommands: ["npm test", "npm run build"],
+      defaultTaskTimeoutSeconds: 30,
+      maxTaskTimeoutSeconds: 120,
+    }),
+    "utf-8"
+  );
+  prevConfigEnv = process.env.PATCHWARDEN_CONFIG;
+  process.env.PATCHWARDEN_CONFIG = configPath;
+  reloadConfig();
+}
+
+/**
+ * 创建 goal 目录并写入 goal_status.json（writeGoalStatus 不自动创建目录）。
+ */
+function seedGoalStatus(goalId: string, status: GoalStatus, workspaceRoot: string): void {
+  mkdirSync(getGoalDir(goalId, workspaceRoot), { recursive: true });
+  writeGoalStatus(goalId, status, workspaceRoot);
+}
+
+// ── Tests ─────────────────────────────────────────────────────────
+
+describe("goalReport", () => {
+  beforeEach(() => {
+    tempDir = mkdtempSync(join(tmpdir(), "pw-goal-report-"));
+    writeConfig();
+  });
+
+  afterEach(() => {
+    if (prevConfigEnv === undefined) delete process.env.PATCHWARDEN_CONFIG;
+    else process.env.PATCHWARDEN_CONFIG = prevConfigEnv;
+    reloadConfig();
+    rmSync(tempDir, { recursive: true, force: true });
+  });
+
+  it("完成 Goal 报告：所有 subgoal accepted，completion_rate=100", () => {
+    const goal = makeGoalStatus([
+      makeSubgoal({
+        id: "subgoal-001",
+        title: "Feature A",
+        status: "accepted",
+        accepted_at: "2026-07-01T00:00:00.000Z",
+      }),
+      makeSubgoal({
+        id: "subgoal-002",
+        title: "Feature B",
+        status: "accepted",
+        accepted_at: "2026-07-02T00:00:00.000Z",
+      }),
+    ], { goal_id: "goal_done_001" });
+    seedGoalStatus("goal_done_001", goal, tempDir);
+
+    const report = exportGoalReport("goal_done_001", { workspaceRoot: tempDir });
+
+    assert.equal(report.completion_rate, 100);
+    assert.equal(report.goal_id, "goal_done_001");
+    assert.equal(report.subgoals.length, 2);
+    assert.equal(report.bounded, true);
+    assert.ok(existsSync(report.files.report_md));
+    assert.ok(existsSync(report.files.report_json));
+  });
+
+  it("未完成 Goal 报告：有 running/ready subgoal，报告含 '未完成'", () => {
+    const goal = makeGoalStatus([
+      makeSubgoal({
+        id: "subgoal-001",
+        title: "Done",
+        status: "accepted",
+        accepted_at: "2026-07-01T00:00:00.000Z",
+      }),
+      makeSubgoal({ id: "subgoal-002", title: "WIP", status: "running" }),
+    ]);
+    seedGoalStatus("goal_wip_001", goal, tempDir);
+
+    const report = exportGoalReport("goal_wip_001", { workspaceRoot: tempDir });
+
+    const md = readFileSync(report.files.report_md, "utf-8");
+    assert.ok(md.includes("未完成"), "REPORT.md should contain '未完成' annotation");
+    assert.ok(
+      report.risks.some((r) => r.includes("未完成")),
+      "risks array should contain '未完成' entry"
+    );
+  });
+
+  it("空 Goal 报告：无 subgoal，completion_rate=0，报告含 '无子目标'", () => {
+    const goal = makeGoalStatus([]);
+    seedGoalStatus("goal_empty_001", goal, tempDir);
+
+    const report = exportGoalReport("goal_empty_001", { workspaceRoot: tempDir });
+
+    assert.equal(report.completion_rate, 0);
+    const md = readFileSync(report.files.report_md, "utf-8");
+    assert.ok(md.includes("无子目标"), "REPORT.md should contain '无子目标' annotation");
+  });
+
+  it("双格式输出：REPORT.md 和 report.json 同时存在", () => {
+    const goal = makeGoalStatus([
+      makeSubgoal({
+        id: "subgoal-001",
+        title: "Task A",
+        status: "accepted",
+        accepted_at: "2026-07-01T00:00:00.000Z",
+      }),
+    ]);
+    seedGoalStatus("goal_dual_001", goal, tempDir);
+
+    const report = exportGoalReport("goal_dual_001", { workspaceRoot: tempDir });
+
+    const reportDir = resolve(tempDir, ".patchwarden", "goals", "goal_dual_001", "report");
+    const mdPath = join(reportDir, "REPORT.md");
+    const jsonPath = join(reportDir, "report.json");
+    assert.ok(existsSync(mdPath), "REPORT.md should exist");
+    assert.ok(existsSync(jsonPath), "report.json should exist");
+    assert.equal(report.files.report_md, mdPath);
+    assert.equal(report.files.report_json, jsonPath);
+  });
+
+  it("脱敏验证：subgoal title 含敏感信息，输出中不含原始值", () => {
+    const goal = makeGoalStatus([
+      makeSubgoal({
+        id: "subgoal-001",
+        title: "Deploy with token=abcd1234",
+        status: "accepted",
+        accepted_at: "2026-07-01T00:00:00.000Z",
+      }),
+    ]);
+    seedGoalStatus("goal_redact_001", goal, tempDir);
+
+    const report = exportGoalReport("goal_redact_001", { workspaceRoot: tempDir });
+
+    const md = readFileSync(report.files.report_md, "utf-8");
+    const json = readFileSync(report.files.report_json, "utf-8");
+    assert.ok(!md.includes("abcd1234"), "REPORT.md must not contain raw secret value");
+    assert.ok(!json.includes("abcd1234"), "report.json must not contain raw secret value");
+    assert.ok(md.includes("[REDACTED]"), "REPORT.md should contain redaction marker");
+    assert.ok(json.includes("[REDACTED]"), "report.json should contain redaction marker");
+  });
+});

package/src/test/unit/goal-subgoal-task.test.ts

@@ -14,8 +14,8 @@ import { PatchWardenError } from "../../errors.js";
 describe("createSubgoalTask", () => {
 
   describe("错误路径", () => {
-    it("execution_mode=assess_only 抛 invalid_execution_mode", () => {
-      assert.throws(
+    it("execution_mode=assess_only 抛 invalid_execution_mode", async () => {
+      await assert.rejects(
         () =>
           createSubgoalTask({
             goal_id: "goal_nonexistent_test",
@@ -32,8 +32,8 @@ describe("createSubgoalTask", () => {
       );
     });
 
-    it("goal_id 不存在抛 goal_not_found", () => {
-      assert.throws(
+    it("goal_id 不存在抛 goal_not_found", async () => {
+      await assert.rejects(
         () =>
           createSubgoalTask({
             goal_id: "goal_definitely_does_not_exist_99999",
@@ -50,10 +50,10 @@ describe("createSubgoalTask", () => {
       );
     });
 
-    it("assess_only 优先于 goal_not_found（在读取 goal 前校验）", () => {
+    it("assess_only 优先于 goal_not_found（在读取 goal 前校验）", async () => {
       // execution_mode=assess_only 应先抛 invalid_execution_mode，
       // 而不是去读不存在的 goal
-      assert.throws(
+      await assert.rejects(
         () =>
           createSubgoalTask({
             goal_id: "goal_definitely_does_not_exist_99999",

package/src/test/unit/goal-tools-registry.test.ts

@@ -7,7 +7,7 @@ import { getToolDefs, handleToolCall } from "../../tools/registry.js";
 import { reloadConfig } from "../../config.js";
 import { PatchWardenError } from "../../errors.js";
 
-// ── 9 个 Goal Session MCP 工具名 ──────────────────────────────────
+// ── 11 个 Goal Session MCP 工具名 ─────────────────────────────────
 
 const GOAL_TOOL_NAMES = [
   "create_goal",
@@ -19,6 +19,8 @@ const GOAL_TOOL_NAMES = [
   "suggest_next_subgoal",
   "summarize_goal_progress",
   "export_handoff",
+  "export_goal_report",
+  "import_speckit_tasks",
 ] as const;
 
 // ── 测试环境隔离：使用临时 workspaceRoot + full profile ───────────
@@ -67,7 +69,7 @@ afterEach(() => {
 describe("goal tools registry", () => {
 
   describe("getToolDefs — 工具定义", () => {
-    it("包含全部 9 个 goal 工具", () => {
+    it("包含全部 11 个 goal 工具", () => {
       const tools = getToolDefs();
       const names = new Set(tools.map((t) => t.name));
       for (const name of GOAL_TOOL_NAMES) {
@@ -75,7 +77,7 @@ describe("goal tools registry", () => {
       }
     });
 
-    it("每个 goal 工具描述以 v0.8.0 开头且 inputSchema.type 为 object", () => {
+    it("每个 goal 工具描述非空且 inputSchema.type 为 object", () => {
       const tools = getToolDefs();
       const byName = new Map(tools.map((t) => [t.name, t]));
       for (const name of GOAL_TOOL_NAMES) {
@@ -83,8 +85,8 @@ describe("goal tools registry", () => {
         assert.ok(tool, `Tool not found: ${name}`);
         assert.equal(tool.inputSchema.type, "object", `${name} schema type should be object`);
         assert.ok(
-          tool.description.startsWith("v0.8.0:"),
-          `${name} description should start with v0.8.0:`
+          typeof tool.description === "string" && tool.description.length > 0,
+          `${name} description should be a non-empty string`
         );
       }
     });

package/src/test/unit/path-guard.test.ts

@@ -96,6 +96,36 @@ describe("guardPath", () => {
       rmSync(target, { recursive: true, force: true });
     }
   });
+
+  it("rejects Windows junction escape", { skip: process.platform !== "win32" ? "Windows-only test" : undefined }, () => {
+    const target = mkdtempSync(join(tmpdir(), "pw-junction-target-"));
+    try {
+      const linkPath = join(tempDir, "escape-junction");
+      symlinkSync(target, linkPath, "junction");
+      assert.throws(
+        () => guardPath("escape-junction/secret.txt", tempDir),
+        PatchWardenError
+      );
+    } finally {
+      rmSync(target, { recursive: true, force: true });
+    }
+  });
+
+  it("rejects intermediate symlink escape (TOCTOU defense)", { skip: process.platform === "win32" ? "Windows symlink permissions unstable" : undefined }, () => {
+    const target = mkdtempSync(join(tmpdir(), "pw-toctou-target-"));
+    try {
+      const linkPath = join(tempDir, "escape-link");
+      symlinkSync(target, linkPath);
+      mkdirSync(join(target, "subdir"), { recursive: true });
+      writeFileSync(join(target, "subdir", "secret.txt"), "secret", "utf-8");
+      assert.throws(
+        () => guardPath("escape-link/subdir/secret.txt", tempDir),
+        PatchWardenError
+      );
+    } finally {
+      rmSync(target, { recursive: true, force: true });
+    }
+  });
 });
 
 describe("guardWorkspacePath", () => {

package/src/test/unit/project-policy-release-mode.test.ts

@@ -0,0 +1,156 @@
+import { describe, it, beforeEach, afterEach } from "node:test";
+import { strict as assert } from "node:assert";
+import { existsSync, mkdirSync, mkdtempSync, readFileSync, rmSync, writeFileSync } from "node:fs";
+import { join } from "node:path";
+import { tmpdir } from "node:os";
+import { reloadConfig } from "../../config.js";
+import { getProjectPolicySummary } from "../../policy/projectPolicy.js";
+import { releaseCleanup, releasePrepare, releaseVerify } from "../../tools/releaseMode.js";
+
+let tempDir: string;
+let repoPath: string;
+let prevConfigEnv: string | undefined;
+
+function writeConfig(allowedTestCommands = ["npm test", "npm run build"]): void {
+  const configPath = join(tempDir, "patchwarden.config.json");
+  writeFileSync(
+    configPath,
+    JSON.stringify({
+      workspaceRoot: tempDir,
+      plansDir: ".patchwarden/plans",
+      tasksDir: ".patchwarden/tasks",
+      assessmentsDir: ".patchwarden/assessments",
+      allowedTestCommands,
+      agents: {},
+      defaultTaskTimeoutSeconds: 30,
+      maxTaskTimeoutSeconds: 120,
+    }),
+    "utf-8",
+  );
+  prevConfigEnv = process.env.PATCHWARDEN_CONFIG;
+  process.env.PATCHWARDEN_CONFIG = configPath;
+  reloadConfig(configPath);
+}
+
+function writePackage(version = "1.3.0"): void {
+  writeFileSync(
+    join(repoPath, "package.json"),
+    JSON.stringify({
+      name: "patchwarden-test",
+      version,
+      repository: { type: "git", url: "git+https://github.com/example/patchwarden-test.git" },
+    }),
+    "utf-8",
+  );
+}
+
+describe("project policy and release mode", () => {
+  beforeEach(() => {
+    tempDir = mkdtempSync(join(tmpdir(), "pw-policy-"));
+    repoPath = join(tempDir, "repo");
+    mkdirSync(repoPath, { recursive: true });
+    writePackage();
+    writeConfig();
+  });
+
+  afterEach(() => {
+    if (prevConfigEnv === undefined) {
+      delete process.env.PATCHWARDEN_CONFIG;
+    } else {
+      process.env.PATCHWARDEN_CONFIG = prevConfigEnv;
+    }
+    reloadConfig();
+    rmSync(tempDir, { recursive: true, force: true });
+  });
+
+  it("returns safe defaults when project-policy.json is missing", () => {
+    const summary = getProjectPolicySummary(repoPath);
+    assert.equal(summary.exists, false);
+    assert.equal(summary.valid, true);
+    assert.equal(summary.effective_policy.release_mode.version_source, "package.json");
+    assert.equal(summary.release_readiness.version, "1.3.0");
+  });
+
+  it("parses BOM-prefixed policy JSON and reports allowlist issues without granting permission", () => {
+    mkdirSync(join(repoPath, ".patchwarden"), { recursive: true });
+    writeFileSync(
+      join(repoPath, ".patchwarden", "project-policy.json"),
+      "\uFEFF" + JSON.stringify({
+        allowed_commands: ["npm run build", "npm publish"],
+        release_mode: {
+          version_source: "package.json",
+          required_commands: ["npm run build", "not-allowed"],
+        },
+      }),
+      "utf-8",
+    );
+    const summary = getProjectPolicySummary(repoPath);
+    assert.equal(summary.exists, true);
+    assert.equal(summary.valid, false);
+    assert.ok(summary.issues.some((issue) => issue.code === "high_risk_command"));
+    assert.ok(summary.issues.some((issue) => issue.code === "command_not_allowlisted"));
+  });
+
+  it("rejects unsafe path patterns and sensitive protected paths block cleanup", () => {
+    mkdirSync(join(repoPath, ".patchwarden"), { recursive: true });
+    writeFileSync(
+      join(repoPath, ".patchwarden", "project-policy.json"),
+      JSON.stringify({
+        auto_cleanup: { enabled: true, patterns: ["../escape", ".git", "release_packages"], exclude: [] },
+        protected_paths: [".env", "release_packages"],
+      }),
+      "utf-8",
+    );
+    mkdirSync(join(repoPath, "release_packages"), { recursive: true });
+    const summary = getProjectPolicySummary(repoPath);
+    assert.equal(summary.valid, false);
+    assert.ok(summary.issues.some((issue) => issue.code === "unsafe_path_pattern"));
+    const cleanup = releaseCleanup({ repo_path: repoPath, dry_run: true });
+    const skipped = cleanup.summary.skipped as Array<{ path: string; reason: string }>;
+    assert.ok(skipped.some((entry) => entry.path === "release_packages" && entry.reason === "protected_or_sensitive"));
+  });
+
+  it("release_cleanup defaults to dry run and writes BOM-free JSON summary", () => {
+    mkdirSync(join(repoPath, "release_packages"), { recursive: true });
+    const result = releaseCleanup({ repo_path: repoPath });
+    assert.equal(result.mode, "release_cleanup");
+    assert.equal((result.summary as any).dry_run, true);
+    assert.equal(existsSync(join(repoPath, "release_packages")), true);
+    const reportPath = join(repoPath, String((result.summary as any).report_path));
+    const raw = readFileSync(reportPath, "utf-8");
+    assert.notEqual(raw.charCodeAt(0), 0xfeff);
+    assert.doesNotThrow(() => JSON.parse(raw));
+  });
+
+  it("release_cleanup honors auto_cleanup.enabled=false before deleting", () => {
+    mkdirSync(join(repoPath, ".patchwarden"), { recursive: true });
+    writeFileSync(
+      join(repoPath, ".patchwarden", "project-policy.json"),
+      JSON.stringify({
+        auto_cleanup: { enabled: false, patterns: ["release_packages"], exclude: [] },
+      }),
+      "utf-8",
+    );
+    mkdirSync(join(repoPath, "release_packages"), { recursive: true });
+    const result = releaseCleanup({ repo_path: repoPath, dry_run: false });
+    assert.equal((result.summary as any).cleanup_disabled_by_policy, true);
+    assert.deepEqual((result.summary as any).removed, []);
+    assert.equal(existsSync(join(repoPath, "release_packages")), true);
+  });
+
+  it("release_verify fails when required metadata cannot be inferred", async () => {
+    writeFileSync(join(repoPath, "package.json"), JSON.stringify({ name: "", version: "" }), "utf-8");
+    const result = await releaseVerify({ repo_path: repoPath });
+    assert.equal(result.ok, false);
+    const stages = result.summary.stages as Record<string, string>;
+    assert.equal(stages.published_verified, "failed");
+    assert.equal(stages.github_release_verified, "failed");
+    assert.equal(stages.ci_verified, "failed");
+  });
+
+  it("release_prepare blocks commands not accepted by the existing command guard", () => {
+    const result = releasePrepare({ repo_path: repoPath, required_commands: ["npm run build", "npm run secret"] });
+    const commands = result.summary.commands as Array<{ command: string; status: string }>;
+    assert.equal(commands.find((entry) => entry.command === "npm run secret")?.status, "blocked");
+  });
+});