patchwarden 1.5.0 → 1.5.1

package/dist/test/unit/apply-patch.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/test/unit/apply-patch.test.js

@@ -0,0 +1,225 @@
+import { describe, it, beforeEach, afterEach } from "node:test";
+import { strict as assert } from "node:assert";
+import { mkdtempSync, rmSync, mkdirSync, writeFileSync, readFileSync } from "node:fs";
+import { join } from "node:path";
+import { tmpdir } from "node:os";
+import { createHash } from "node:crypto";
+import { applyPatch } from "../../tools/applyPatch.js";
+import { createDirectSession } from "../../direct/directSessionStore.js";
+import { reloadConfig } from "../../config.js";
+import { PatchWardenError } from "../../errors.js";
+// ── Helpers ────────────────────────────────────────────────────────
+function sha256(content) {
+    return createHash("sha256").update(content, "utf-8").digest("hex");
+}
+function makeSnapshot() {
+    return {
+        captured_at: new Date().toISOString(),
+        is_git: false,
+        head: null,
+        status: "",
+        workspace_dirty: false,
+        files: {},
+        dirty_paths: [],
+        warnings: [],
+    };
+}
+function bootstrapWorkspace(prefix, maxPatchBytes) {
+    const tempDir = mkdtempSync(join(tmpdir(), prefix));
+    const repoPath = join(tempDir, "my-repo");
+    mkdirSync(repoPath, { recursive: true });
+    mkdirSync(join(repoPath, "src"), { recursive: true });
+    const configPath = join(tempDir, "patchwarden.config.json");
+    writeFileSync(configPath, JSON.stringify({
+        workspaceRoot: tempDir,
+        agents: { codex: { command: "codex", args: ["exec", "{prompt}"] } },
+        allowedTestCommands: ["npm test"],
+        directMaxPatchBytes: maxPatchBytes,
+        directMaxFileBytes: 500_000,
+    }), "utf-8");
+    process.env.PATCHWARDEN_CONFIG = configPath;
+    reloadConfig();
+    const session = createDirectSession({
+        repo_path: "my-repo",
+        resolved_repo_path: repoPath,
+        title: "applyPatch test",
+        snapshot: makeSnapshot(),
+    });
+    return { tempDir, repoPath, sessionId: session.session_id };
+}
+function teardownWorkspace(tempDir) {
+    rmSync(tempDir, { recursive: true, force: true });
+    delete process.env.PATCHWARDEN_CONFIG;
+    reloadConfig();
+}
+// ── Success cases ──────────────────────────────────────────────────
+describe("applyPatch success cases", () => {
+    let tempDir;
+    let repoPath;
+    let sessionId;
+    beforeEach(() => {
+        const ws = bootstrapWorkspace("pw-applypatch-ok-", 200_000);
+        tempDir = ws.tempDir;
+        repoPath = ws.repoPath;
+        sessionId = ws.sessionId;
+    });
+    afterEach(() => {
+        teardownWorkspace(tempDir);
+    });
+    it("applies replace_exact operation", () => {
+        const filePath = join(repoPath, "src", "main.ts");
+        const original = "hello world";
+        writeFileSync(filePath, original, "utf-8");
+        const operations = [
+            { type: "replace_exact", old_text: "world", new_text: "there" },
+        ];
+        const result = applyPatch({
+            session_id: sessionId,
+            path: "src/main.ts",
+            expected_sha256: sha256(original),
+            operations,
+        });
+        assert.equal(result.path, "src/main.ts");
+        assert.equal(result.before_sha256, sha256(original));
+        assert.equal(result.after_sha256, sha256("hello there"));
+        assert.equal(result.operations_applied, 1);
+        assert.equal(result.bytes_changed, 0);
+        assert.ok(result.next_action.length > 0);
+        assert.equal(readFileSync(filePath, "utf-8"), "hello there");
+    });
+    it("applies insert_before operation", () => {
+        const filePath = join(repoPath, "src", "main.ts");
+        const original = "hello world";
+        writeFileSync(filePath, original, "utf-8");
+        const operations = [
+            { type: "insert_before", old_text: "world", new_text: "beautiful " },
+        ];
+        const result = applyPatch({
+            session_id: sessionId,
+            path: "src/main.ts",
+            expected_sha256: sha256(original),
+            operations,
+        });
+        assert.equal(readFileSync(filePath, "utf-8"), "hello beautiful world");
+        assert.equal(result.after_sha256, sha256("hello beautiful world"));
+        assert.equal(result.operations_applied, 1);
+        assert.equal(result.bytes_changed, 10);
+    });
+    it("applies insert_after operation", () => {
+        const filePath = join(repoPath, "src", "main.ts");
+        const original = "hello world";
+        writeFileSync(filePath, original, "utf-8");
+        const operations = [
+            { type: "insert_after", old_text: "hello", new_text: " beautiful" },
+        ];
+        const result = applyPatch({
+            session_id: sessionId,
+            path: "src/main.ts",
+            expected_sha256: sha256(original),
+            operations,
+        });
+        assert.equal(readFileSync(filePath, "utf-8"), "hello beautiful world");
+        assert.equal(result.after_sha256, sha256("hello beautiful world"));
+        assert.equal(result.operations_applied, 1);
+        assert.equal(result.bytes_changed, 10);
+    });
+    it("applies replace_whole_file operation", () => {
+        const filePath = join(repoPath, "src", "main.ts");
+        const original = "hello world";
+        writeFileSync(filePath, original, "utf-8");
+        const newContent = "completely new content";
+        const operations = [
+            { type: "replace_whole_file", new_text: newContent },
+        ];
+        const result = applyPatch({
+            session_id: sessionId,
+            path: "src/main.ts",
+            expected_sha256: sha256(original),
+            operations,
+        });
+        assert.equal(readFileSync(filePath, "utf-8"), newContent);
+        assert.equal(result.after_sha256, sha256(newContent));
+        assert.equal(result.operations_applied, 1);
+        assert.equal(result.bytes_changed, 11);
+    });
+});
+// ── Rejection cases ────────────────────────────────────────────────
+describe("applyPatch rejection cases", () => {
+    let tempDir;
+    let repoPath;
+    let sessionId;
+    beforeEach(() => {
+        const ws = bootstrapWorkspace("pw-applypatch-rej-", 200_000);
+        tempDir = ws.tempDir;
+        repoPath = ws.repoPath;
+        sessionId = ws.sessionId;
+    });
+    afterEach(() => {
+        teardownWorkspace(tempDir);
+    });
+    it("rejects when expected_sha256 does not match", () => {
+        const filePath = join(repoPath, "src", "main.ts");
+        writeFileSync(filePath, "hello world", "utf-8");
+        assert.throws(() => applyPatch({
+            session_id: sessionId,
+            path: "src/main.ts",
+            expected_sha256: "0".repeat(64),
+            operations: [{ type: "replace_whole_file", new_text: "new" }],
+        }), (err) => err instanceof PatchWardenError && err.reason === "file_hash_mismatch");
+        // File content must remain unchanged after rejection
+        assert.equal(readFileSync(filePath, "utf-8"), "hello world");
+    });
+    it("rejects binary files (e.g. .png)", () => {
+        const filePath = join(repoPath, "src", "image.png");
+        writeFileSync(filePath, "fake png content", "utf-8");
+        assert.throws(() => applyPatch({
+            session_id: sessionId,
+            path: "src/image.png",
+            expected_sha256: sha256("fake png content"),
+            operations: [{ type: "replace_whole_file", new_text: "new" }],
+        }), (err) => err instanceof PatchWardenError && err.reason === "binary_file_blocked");
+        // File content must remain unchanged after rejection
+        assert.equal(readFileSync(filePath, "utf-8"), "fake png content");
+    });
+    it("rejects paths outside workspaceRoot", () => {
+        assert.throws(() => applyPatch({
+            session_id: sessionId,
+            path: "../../../etc/passwd",
+            expected_sha256: sha256("dummy"),
+            operations: [{ type: "replace_whole_file", new_text: "new" }],
+        }), PatchWardenError);
+    });
+});
+// ── Patch size limit ───────────────────────────────────────────────
+describe("applyPatch patch size limit", () => {
+    let tempDir;
+    let repoPath;
+    let sessionId;
+    beforeEach(() => {
+        const ws = bootstrapWorkspace("pw-applypatch-size-", 100);
+        tempDir = ws.tempDir;
+        repoPath = ws.repoPath;
+        sessionId = ws.sessionId;
+    });
+    afterEach(() => {
+        teardownWorkspace(tempDir);
+    });
+    it("rejects patches exceeding directMaxPatchBytes", () => {
+        const filePath = join(repoPath, "src", "main.ts");
+        writeFileSync(filePath, "hello world", "utf-8");
+        // Build a patch whose JSON.stringify length exceeds the 100-byte limit
+        const bigText = "x".repeat(80);
+        const operations = [
+            { type: "replace_whole_file", new_text: bigText },
+        ];
+        assert.ok(JSON.stringify(operations).length > 100);
+        assert.throws(() => applyPatch({
+            session_id: sessionId,
+            path: "src/main.ts",
+            expected_sha256: sha256("hello world"),
+            operations,
+        }), (err) => err instanceof PatchWardenError && err.reason === "patch_too_large");
+        // File content must remain unchanged after rejection
+        assert.equal(readFileSync(filePath, "utf-8"), "hello world");
+    });
+});

package/dist/test/unit/create-task.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/test/unit/create-task.test.js

@@ -0,0 +1,197 @@
+import { describe, it, beforeEach, afterEach } from "node:test";
+import { strict as assert } from "node:assert";
+import { mkdtempSync, rmSync, mkdirSync, writeFileSync, existsSync, readFileSync, readdirSync, } from "node:fs";
+import { join, dirname } from "node:path";
+import { tmpdir } from "node:os";
+import { reloadConfig } from "../../config.js";
+import { createTask } from "../../tools/createTask.js";
+import { savePlan } from "../../tools/savePlan.js";
+import { PatchWardenError } from "../../errors.js";
+// ── Helpers ───────────────────────────────────────────────────────
+let tempDir;
+let prevConfigEnv;
+function writeConfig(workspaceRoot) {
+    const configPath = join(tempDir, "patchwarden.config.json");
+    writeFileSync(configPath, JSON.stringify({
+        workspaceRoot,
+        tasksDir: ".patchwarden/tasks",
+        plansDir: ".patchwarden/plans",
+        assessmentsDir: ".patchwarden/assessments",
+        directSessionsDir: ".patchwarden/direct-sessions",
+        agents: {
+            codex: { command: "codex", args: ["exec", "{prompt}"] },
+        },
+        allowedTestCommands: ["npm test", "npm run build"],
+        defaultTaskTimeoutSeconds: 60,
+        maxTaskTimeoutSeconds: 300,
+        watcherStaleSeconds: 30,
+    }), "utf-8");
+    prevConfigEnv = process.env.PATCHWARDEN_CONFIG;
+    process.env.PATCHWARDEN_CONFIG = configPath;
+    reloadConfig();
+}
+/** Write a fresh watcher heartbeat so readWatcherStatus reports healthy. */
+function writeFreshHeartbeat(workspaceRoot) {
+    const heartbeatPath = join(workspaceRoot, ".patchwarden", "watcher-heartbeat.json");
+    mkdirSync(dirname(heartbeatPath), { recursive: true });
+    writeFileSync(heartbeatPath, JSON.stringify({
+        status: "running",
+        pid: process.pid,
+        last_heartbeat_at: new Date().toISOString(),
+        instance_id: "test-instance",
+    }), "utf-8");
+}
+describe("createTask", () => {
+    beforeEach(() => {
+        tempDir = mkdtempSync(join(tmpdir(), "pw-createtask-"));
+    });
+    afterEach(() => {
+        if (prevConfigEnv === undefined)
+            delete process.env.PATCHWARDEN_CONFIG;
+        else
+            process.env.PATCHWARDEN_CONFIG = prevConfigEnv;
+        reloadConfig();
+        rmSync(tempDir, { recursive: true, force: true });
+    });
+    // ── 1. inline_plan source ──────────────────────────────────────
+    it("creates a task from inline_plan, writes status.json, and allocates a task directory", async () => {
+        writeConfig(tempDir);
+        mkdirSync(join(tempDir, "my-repo"), { recursive: true });
+        writeFreshHeartbeat(tempDir);
+        const result = await createTask({
+            inline_plan: "## Goal\nAdd a hello-world print statement to main.ts.",
+            agent: "codex",
+            repo_path: "my-repo",
+        });
+        const out = result;
+        assert.ok(out.task_id.startsWith("task_"), `task_id should start with "task_", got: ${out.task_id}`);
+        assert.equal(out.status, "pending");
+        assert.equal(out.plan_source, "inline");
+        assert.equal(out.agent, "codex");
+        assert.equal(out.execution_blocked, false);
+        assert.ok(existsSync(out.path), "task directory should exist");
+        assert.ok(existsSync(join(out.path, "status.json")), "status.json should exist");
+        const status = JSON.parse(readFileSync(join(out.path, "status.json"), "utf-8"));
+        assert.equal(status.task_id, out.task_id);
+        assert.equal(status.status, "pending");
+        assert.equal(status.phase, "queued");
+        assert.equal(status.agent, "codex");
+        assert.equal(status.plan_source, "inline");
+        assert.equal(status.repo_path, "my-repo");
+    });
+    // ── 2. template source ─────────────────────────────────────────
+    it("creates a task from a built-in template (feature_small)", async () => {
+        writeConfig(tempDir);
+        mkdirSync(join(tempDir, "my-repo"), { recursive: true });
+        writeFreshHeartbeat(tempDir);
+        const result = await createTask({
+            template: "feature_small",
+            goal: "Add a utility function for string truncation.",
+            agent: "codex",
+            repo_path: "my-repo",
+        });
+        const out = result;
+        assert.ok(out.task_id.startsWith("task_"));
+        assert.equal(out.plan_source, "template");
+        assert.equal(out.template, "feature_small");
+        assert.ok(existsSync(join(out.path, "status.json")));
+        const status = JSON.parse(readFileSync(join(out.path, "status.json"), "utf-8"));
+        assert.equal(status.template, "feature_small");
+        assert.equal(status.plan_source, "template");
+    });
+    // ── 3. plan_id source ──────────────────────────────────────────
+    it("creates a task from a previously saved plan_id", async () => {
+        writeConfig(tempDir);
+        mkdirSync(join(tempDir, "my-repo"), { recursive: true });
+        writeFreshHeartbeat(tempDir);
+        const saved = savePlan({
+            title: "Pre-saved plan",
+            content: "## Goal\nDo something safe and repo-local.",
+        });
+        const result = await createTask({
+            plan_id: saved.plan_id,
+            agent: "codex",
+            repo_path: "my-repo",
+        });
+        const out = result;
+        assert.equal(out.plan_id, saved.plan_id);
+        assert.equal(out.plan_source, "saved");
+        assert.ok(existsSync(join(out.path, "status.json")));
+        const status = JSON.parse(readFileSync(join(out.path, "status.json"), "utf-8"));
+        assert.equal(status.plan_id, saved.plan_id);
+        assert.equal(status.plan_source, "saved");
+    });
+    // ── 4. assess_only mode ────────────────────────────────────────
+    it("returns a risk assessment instead of creating a task in assess_only mode", async () => {
+        writeConfig(tempDir);
+        mkdirSync(join(tempDir, "my-repo"), { recursive: true });
+        const result = await createTask({
+            inline_plan: "## Goal\nAdd a print statement to main.ts.",
+            agent: "codex",
+            repo_path: "my-repo",
+            execution_mode: "assess_only",
+        });
+        const out = result;
+        assert.ok(out.assessment_id, "assessment_id should be present");
+        assert.ok(out.assessment_short_id, "assessment_short_id should be present");
+        assert.equal(out.decision, "allow");
+        assert.equal(out.risk_level, "low");
+        assert.ok(out.next_tool_call, "next_tool_call should be present for allow decision");
+        assert.equal(out.next_tool_call.name, "create_task");
+        assert.equal(out.next_tool_call.arguments.execution_mode, "execute");
+        assert.equal(out.next_tool_call.arguments.assessment_id, out.assessment_id);
+        // No task directory should be created in assess_only mode
+        assert.equal("task_id" in out, false, "assess_only output should not contain task_id");
+        const tasksDir = join(tempDir, ".patchwarden", "tasks");
+        if (existsSync(tasksDir)) {
+            const taskEntries = readdirSync(tasksDir).filter((name) => name.startsWith("task_"));
+            assert.equal(taskEntries.length, 0, "no task directory should be created in assess_only mode");
+        }
+    });
+    // ── 5. agent not configured ────────────────────────────────────
+    it("throws PatchWardenError (agent_not_configured) when the agent is not registered", async () => {
+        writeConfig(tempDir);
+        mkdirSync(join(tempDir, "my-repo"), { recursive: true });
+        await assert.rejects(() => createTask({
+            inline_plan: "## Goal\nDo something.",
+            agent: "ghost-agent",
+            repo_path: "my-repo",
+        }), (err) => {
+            assert.ok(err instanceof PatchWardenError, "should throw PatchWardenError");
+            assert.equal(err.reason, "agent_not_configured");
+            return true;
+        });
+    });
+    // ── 6. repo_path escapes workspace ─────────────────────────────
+    it("throws workspace_path_escape when repo_path is outside workspaceRoot", async () => {
+        writeConfig(tempDir);
+        mkdirSync(join(tempDir, "my-repo"), { recursive: true });
+        await assert.rejects(() => createTask({
+            inline_plan: "## Goal\nDo something.",
+            agent: "codex",
+            repo_path: "../outside-workspace",
+        }), (err) => {
+            assert.ok(err instanceof PatchWardenError, "should throw PatchWardenError");
+            assert.equal(err.reason, "workspace_path_escape");
+            return true;
+        });
+    });
+    // ── 7. watcher not running ─────────────────────────────────────
+    it("returns execution_blocked: true when watcher is not running", async () => {
+        writeConfig(tempDir);
+        mkdirSync(join(tempDir, "my-repo"), { recursive: true });
+        // No watcher heartbeat file → watcher status is "missing"
+        const result = await createTask({
+            inline_plan: "## Goal\nDo something.",
+            agent: "codex",
+            repo_path: "my-repo",
+        });
+        const out = result;
+        assert.equal(out.execution_blocked, true);
+        assert.equal(out.watcher.available, false);
+        assert.equal(out.watcher.status, "missing");
+        assert.equal(out.next_tool_call.name, "health_check");
+        // Task is still created (queued) despite being blocked
+        assert.ok(existsSync(join(out.path, "status.json")));
+    });
+});

package/dist/test/unit/direct-guards.test.js

@@ -3,8 +3,9 @@ import { strict as assert } from "node:assert";
 import { mkdtempSync, rmSync, mkdirSync, writeFileSync } from "node:fs";
 import { join, resolve } from "node:path";
 import { tmpdir } from "node:os";
-import { guardDirectPath, guardDirectWritePath, guardDirectReadPath, isBinaryFile } from "../../direct/directGuards.js";
+import { guardDirectPath, guardDirectWritePath, guardDirectReadPath, guardDirectPatchSize, guardDirectFileSize, isBinaryFile } from "../../direct/directGuards.js";
 import { PatchWardenError } from "../../errors.js";
+import { reloadConfig } from "../../config.js";
 function makeConfig(workspaceRoot) {
     return {
         workspaceRoot,
@@ -130,26 +131,65 @@ describe("guardDirectPatchSize", () => {
     let tempDir;
     beforeEach(() => {
         tempDir = mkdtempSync(join(tmpdir(), "pw-patchsize-"));
-        process.env.PATCHWARDEN_CONFIG = "";
+        // Write a real config file so getConfig() picks it up
+        const configPath = join(tempDir, "patchwarden.config.json");
+        writeFileSync(configPath, JSON.stringify({
+            workspaceRoot: tempDir,
+            agents: { codex: { command: "codex", args: ["exec", "{prompt}"] } },
+            allowedTestCommands: ["npm test"],
+            directMaxPatchBytes: 1000,
+            directMaxFileBytes: 5000,
+        }), "utf-8");
+        process.env.PATCHWARDEN_CONFIG = configPath;
+        reloadConfig();
     });
     afterEach(() => {
         rmSync(tempDir, { recursive: true, force: true });
         delete process.env.PATCHWARDEN_CONFIG;
+        reloadConfig();
     });
     it("allows patches within size limit", () => {
-        // We can't easily call this without a config, so just test the logic
-        // guardDirectPatchSize calls getConfig() internally
-        // We'll test it indirectly by checking it doesn't throw for small sizes
-        // when config is loaded with defaults
-        // Skip if no config available
+        assert.doesNotThrow(() => guardDirectPatchSize(500));
+        assert.doesNotThrow(() => guardDirectPatchSize(1000));
     });
     it("rejects patches exceeding size limit", () => {
-        // This test would need config setup; skip for now
+        assert.throws(() => guardDirectPatchSize(1001), (err) => err instanceof PatchWardenError && err.reason === "patch_too_large");
+        assert.throws(() => guardDirectPatchSize(999999), (err) => err instanceof PatchWardenError && err.reason === "patch_too_large");
+    });
+    it("allows zero-size patch", () => {
+        assert.doesNotThrow(() => guardDirectPatchSize(0));
     });
 });
 describe("guardDirectFileSize", () => {
+    let tempDir;
+    beforeEach(() => {
+        tempDir = mkdtempSync(join(tmpdir(), "pw-filesize-"));
+        const configPath = join(tempDir, "patchwarden.config.json");
+        writeFileSync(configPath, JSON.stringify({
+            workspaceRoot: tempDir,
+            agents: { codex: { command: "codex", args: ["exec", "{prompt}"] } },
+            allowedTestCommands: ["npm test"],
+            directMaxPatchBytes: 1000,
+            directMaxFileBytes: 5000,
+        }), "utf-8");
+        process.env.PATCHWARDEN_CONFIG = configPath;
+        reloadConfig();
+    });
+    afterEach(() => {
+        rmSync(tempDir, { recursive: true, force: true });
+        delete process.env.PATCHWARDEN_CONFIG;
+        reloadConfig();
+    });
     it("allows files within size limit", () => {
-        // Similar to above, needs config
+        assert.doesNotThrow(() => guardDirectFileSize(100));
+        assert.doesNotThrow(() => guardDirectFileSize(5000));
+    });
+    it("rejects files exceeding size limit", () => {
+        assert.throws(() => guardDirectFileSize(5001), (err) => err instanceof PatchWardenError && err.reason === "file_too_large");
+        assert.throws(() => guardDirectFileSize(9999999), (err) => err instanceof PatchWardenError && err.reason === "file_too_large");
+    });
+    it("allows zero-size file", () => {
+        assert.doesNotThrow(() => guardDirectFileSize(0));
     });
 });
 describe("isBinaryFile", () => {
@@ -210,4 +250,79 @@ describe("isBinaryFile", () => {
     it("returns false for non-existent files without binary extension", () => {
         assert.equal(isBinaryFile(join(tempDir, "nonexistent.txt")), false);
     });
+    // ── Adversarial: null byte beyond 8KB read window ──
+    it("detects null byte at position 8200 (beyond old 8KB window)", () => {
+        // Previously isBinaryFile only read the first 8192 bytes, so a null byte
+        // at position 8200 would bypass detection. Now we scan up to 1 MB.
+        const stealthBinary = join(tempDir, "stealth.txt");
+        const buffer = Buffer.alloc(8200, 0x41); // 8200 bytes of 'A'
+        buffer[8199] = 0; // null byte just beyond the old 8KB read window
+        writeFileSync(stealthBinary, buffer);
+        assert.equal(isBinaryFile(stealthBinary), true);
+    });
+    it("detects null byte at exactly position 8192 (first byte beyond old window)", () => {
+        const stealthBinary = join(tempDir, "boundary-plus.txt");
+        const buffer = Buffer.alloc(8193, 0x41);
+        buffer[8192] = 0; // first byte beyond the old 8KB read window
+        writeFileSync(stealthBinary, buffer);
+        assert.equal(isBinaryFile(stealthBinary), true);
+    });
+    it("detects null byte at 100KB offset", () => {
+        const deepBinary = join(tempDir, "deep.txt");
+        const buffer = Buffer.alloc(102400, 0x41);
+        buffer[102399] = 0;
+        writeFileSync(deepBinary, buffer);
+        assert.equal(isBinaryFile(deepBinary), true);
+    });
+    it("detects null byte at 1MB offset (scan limit boundary)", () => {
+        const limitBinary = join(tempDir, "limit.txt");
+        const buffer = Buffer.alloc(1_048_576, 0x41);
+        buffer[1_048_575] = 0;
+        writeFileSync(limitBinary, buffer);
+        assert.equal(isBinaryFile(limitBinary), true);
+    });
+    it("does not scan beyond 1MB limit", () => {
+        // A null byte just past the 1MB scan limit should NOT be detected.
+        // This documents the remaining scan boundary.
+        const overLimit = join(tempDir, "over-limit.txt");
+        const buffer = Buffer.alloc(1_048_577, 0x41);
+        buffer[1_048_576] = 0; // first byte beyond scan limit
+        writeFileSync(overLimit, buffer);
+        assert.equal(isBinaryFile(overLimit), false);
+    });
+});
+// ── Adversarial: Windows backslash prefix bypass attempts ──
+describe("guardDirectWritePath adversarial separator tests", () => {
+    let tempDir;
+    let repoPath;
+    beforeEach(() => {
+        tempDir = mkdtempSync(join(tmpdir(), "pw-directsep-"));
+        repoPath = join(tempDir, "my-repo");
+        mkdirSync(repoPath, { recursive: true });
+        mkdirSync(join(repoPath, "src"), { recursive: true });
+    });
+    afterEach(() => {
+        rmSync(tempDir, { recursive: true, force: true });
+    });
+    it("blocks node_modules with backslash prefix", () => {
+        assert.throws(() => guardDirectWritePath("node_modules\\evil\\index.js", repoPath, tempDir), (err) => err instanceof PatchWardenError && err.reason === "blocked_artifact_path");
+    });
+    it("blocks dist with backslash prefix", () => {
+        assert.throws(() => guardDirectWritePath("dist\\main.js", repoPath, tempDir), (err) => err instanceof PatchWardenError && err.reason === "blocked_artifact_path");
+    });
+    it("blocks release with backslash prefix", () => {
+        assert.throws(() => guardDirectWritePath("release\\app.exe", repoPath, tempDir), (err) => err instanceof PatchWardenError && err.reason === "blocked_artifact_path");
+    });
+    it("blocks nested node_modules with mixed separators", () => {
+        assert.throws(() => guardDirectWritePath("src\\node_modules/evil\\index.js", repoPath, tempDir), (err) => err instanceof PatchWardenError && err.reason === "blocked_artifact_path");
+    });
+    it("blocks .patchwarden with backslash prefix", () => {
+        assert.throws(() => guardDirectWritePath(".patchwarden\\tasks\\evil.json", repoPath, tempDir), (err) => err instanceof PatchWardenError && err.reason === "internal_patchwarden_path_blocked");
+    });
+    it("blocks .env with backslash prefix", () => {
+        assert.throws(() => guardDirectWritePath("path\\to\\.env", repoPath, tempDir), (err) => err instanceof PatchWardenError && err.reason === "sensitive_path_blocked");
+    });
+    it("blocks config.json with backslash path", () => {
+        assert.throws(() => guardDirectWritePath("subdir\\config.json", repoPath, tempDir), (err) => err instanceof PatchWardenError && err.reason === "sensitive_path_blocked");
+    });
 });