patchwarden 1.5.0 → 1.5.1

package/dist/test/unit/evidence-pack.test.js

@@ -1,6 +1,6 @@
 import { describe, it, beforeEach, afterEach } from "node:test";
 import { strict as assert } from "node:assert";
-import { mkdtempSync, rmSync, writeFileSync, readFileSync } from "node:fs";
+import { existsSync, mkdirSync, mkdtempSync, rmSync, writeFileSync, readFileSync } from "node:fs";
 import { join } from "node:path";
 import { tmpdir } from "node:os";
 import { reloadConfig } from "../../config.js";
@@ -126,5 +126,99 @@ describe("v1.5 evidence packs and agent recommendations", () => {
         const listed = listEvidencePacks();
         assert.equal(listed.total, 1);
         assert.equal(listed.evidence_packs[0].lineage_id, "lineage_v15_pack");
+        // v2: all six structured artifact files should exist.
+        for (const key of ["risk", "verify", "diffstat", "lineage", "attestation", "redactions"]) {
+            assert.ok(existsSync(pack.files[key]), `${key} file should exist`);
+        }
+        // v2: attestation.json must carry the required provenance fields.
+        const attestation = JSON.parse(readFileSync(pack.files.attestation, "utf-8"));
+        assert.ok(attestation.patchwarden_version, "attestation should have patchwarden_version");
+        assert.ok(attestation.package_version, "attestation should have package_version");
+        assert.ok(attestation.commit, "attestation should have commit");
+        assert.ok(attestation.node_version, "attestation should have node_version");
+        assert.ok(attestation.os, "attestation should have os");
+        assert.ok(attestation.schema_epoch, "attestation should have schema_epoch");
+        // v2: redactions.json must have the audit structure even when empty.
+        const redactions = JSON.parse(readFileSync(pack.files.redactions, "utf-8"));
+        assert.ok(Array.isArray(redactions.redactions), "redactions should be an array");
+        assert.equal(typeof redactions.total_redacted, "number", "total_redacted should be a number");
+    });
+    it("exports v2 structured artifacts and redacts secrets in diffstat", () => {
+        const secretValue = "ghp_1234567890abcdefghijklmnop";
+        // Create a task directory with file-stats.json containing a secret in a file path.
+        const taskDir = join(tempDir, ".patchwarden", "tasks", "task-v2-secret");
+        mkdirSync(taskDir, { recursive: true });
+        writeFileSync(join(taskDir, "file-stats.json"), JSON.stringify({
+            task_id: "task-v2-secret",
+            additions: 5,
+            deletions: 2,
+            files: [{
+                    path: `secrets/${secretValue}.json`,
+                    status: "modified",
+                    additions: 5,
+                    deletions: 2,
+                }],
+        }), "utf-8");
+        writeTaskLineage({
+            lineage_id: "lineage_v2_secret",
+            goal: "Export v2 evidence with diffstat",
+            repo_path: ".",
+            created_at: "2026-07-09T12:00:00.000Z",
+            updated_at: "2026-07-09T12:01:00.000Z",
+            final_status: "accepted",
+            stop_reason: "success",
+            next_action: "accept",
+            main_task: "task-v2-secret",
+            fix_tasks: [],
+            cleanup_tasks: [],
+            direct_sessions: [],
+            rounds: [{
+                    iteration: 1,
+                    task_id: "task-v2-secret",
+                    role: "main",
+                    status: "done_by_agent",
+                    terminal: true,
+                    verification_status: "passed",
+                    audit_verdict: "pass",
+                    fail_checks: [],
+                    warn_checks: ["minor scope drift"],
+                    next_action: "accept",
+                }],
+            warnings: [],
+            errors: [],
+            worktree: {
+                isolation_mode: "current_repo",
+                cleanup: "keep",
+                status: "not_used",
+                next_action: "none",
+            },
+        });
+        const pack = exportTaskEvidencePack({ lineage_id: "lineage_v2_secret" });
+        // All six v2 files should exist.
+        for (const key of ["risk", "verify", "diffstat", "lineage", "attestation", "redactions"]) {
+            assert.ok(existsSync(pack.files[key]), `${key} file should exist`);
+        }
+        // The original secret must not appear in any v2 file.
+        for (const key of ["risk", "verify", "diffstat", "lineage", "attestation", "redactions"]) {
+            const content = readFileSync(pack.files[key], "utf-8");
+            assert.ok(!content.includes(secretValue), `${key} should not contain the original secret value`);
+        }
+        // redactions.json should have detected the secret via diffstat aggregation.
+        const redactions = JSON.parse(readFileSync(pack.files.redactions, "utf-8"));
+        assert.ok(redactions.total_redacted > 0, "redactions.json should have detected the secret");
+        assert.ok(!JSON.stringify(redactions).includes(secretValue), "redactions.json should not contain the original secret value");
+        // risk.json should carry the warn_check as a medium-severity risk.
+        const risk = JSON.parse(readFileSync(pack.files.risk, "utf-8"));
+        assert.ok(risk.count > 0, "risk.json should have at least one risk item");
+        assert.equal(risk.by_severity.medium, 1, "should have one medium-severity risk");
+        // verify.json should carry the round verification record.
+        const verify = JSON.parse(readFileSync(pack.files.verify, "utf-8"));
+        assert.ok(verify.count > 0, "verify.json should have at least one record");
+        assert.equal(verify.records[0].verification_status, "passed");
+        // lineage.json should carry the bounded summary.
+        const lineageSummary = JSON.parse(readFileSync(pack.files.lineage, "utf-8"));
+        assert.equal(lineageSummary.lineage_id, "lineage_v2_secret");
+        assert.equal(lineageSummary.iterations_count, 1);
+        assert.equal(lineageSummary.final_status, "accepted");
     });
 });

package/dist/test/unit/get-task-status.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/test/unit/get-task-status.test.js

@@ -0,0 +1,174 @@
+import { describe, it, beforeEach, afterEach } from "node:test";
+import { strict as assert } from "node:assert";
+import { mkdtempSync, rmSync, mkdirSync, writeFileSync } from "node:fs";
+import { join } from "node:path";
+import { tmpdir } from "node:os";
+import { reloadConfig } from "../../config.js";
+import { getTaskStatus } from "../../tools/getTaskStatus.js";
+let tempDir;
+let tasksDir;
+let prevConfigEnv;
+function writeConfig() {
+    const configPath = join(tempDir, "patchwarden.config.json");
+    writeFileSync(configPath, JSON.stringify({
+        workspaceRoot: tempDir,
+        tasksDir: ".patchwarden/tasks",
+        plansDir: ".patchwarden/plans",
+        assessmentsDir: ".patchwarden/assessments",
+        directSessionsDir: ".patchwarden/direct-sessions",
+        agents: { codex: { command: "codex", args: ["exec", "{prompt}"] } },
+        allowedTestCommands: ["npm test"],
+    }), "utf-8");
+    prevConfigEnv = process.env.PATCHWARDEN_CONFIG;
+    process.env.PATCHWARDEN_CONFIG = configPath;
+    reloadConfig();
+}
+function writeTaskStatus(taskId, status) {
+    const taskDir = join(tasksDir, taskId);
+    mkdirSync(taskDir, { recursive: true });
+    writeFileSync(join(taskDir, "status.json"), JSON.stringify(status, null, 2), "utf-8");
+    return taskDir;
+}
+function writeTaskRuntime(taskDir, runtime) {
+    writeFileSync(join(taskDir, "runtime.json"), JSON.stringify(runtime, null, 2), "utf-8");
+}
+describe("getTaskStatus", () => {
+    beforeEach(() => {
+        tempDir = mkdtempSync(join(tmpdir(), "pw-getstatus-"));
+        tasksDir = join(tempDir, ".patchwarden", "tasks");
+        mkdirSync(tasksDir, { recursive: true });
+        writeConfig();
+    });
+    afterEach(() => {
+        if (prevConfigEnv === undefined)
+            delete process.env.PATCHWARDEN_CONFIG;
+        else
+            process.env.PATCHWARDEN_CONFIG = prevConfigEnv;
+        reloadConfig();
+        rmSync(tempDir, { recursive: true, force: true });
+    });
+    // ── pending ──
+    it("reads pending status task", () => {
+        writeTaskStatus("task-pending-001", {
+            task_id: "task-pending-001",
+            plan_id: "plan-001",
+            agent: "codex",
+            workspace_root: tempDir,
+            repo_path: "repo",
+            resolved_repo_path: join(tempDir, "repo"),
+            status: "pending",
+            phase: "queued",
+            created_at: "2026-07-12T10:00:00Z",
+            updated_at: "2026-07-12T10:00:01Z",
+            timeout_seconds: 900,
+            error: null,
+        });
+        const result = getTaskStatus("task-pending-001");
+        assert.equal(result.task_id, "task-pending-001");
+        assert.equal(result.status, "pending");
+        assert.equal(result.phase, "queued");
+        assert.equal(result.agent, "codex");
+        assert.equal(result.plan_id, "plan-001");
+        assert.equal(result.error, null);
+        // No watcher heartbeat → watcher missing → pending task is execution_blocked
+        assert.equal(result.execution_blocked, true);
+        assert.equal(result.watcher_status, "missing");
+        assert.equal(result.pending_reason, "queued_but_watcher_missing");
+    });
+    // ── running ──
+    it("reads running status task and merges runtime.json", () => {
+        const taskDir = writeTaskStatus("task-running-001", {
+            task_id: "task-running-001",
+            plan_id: "plan-001",
+            agent: "codex",
+            workspace_root: tempDir,
+            repo_path: "repo",
+            resolved_repo_path: join(tempDir, "repo"),
+            status: "running",
+            phase: "executing_agent",
+            created_at: "2026-07-12T10:00:00Z",
+            started_at: "2026-07-12T10:00:05Z",
+            updated_at: "2026-07-12T10:00:10Z",
+            timeout_seconds: 900,
+            error: null,
+        });
+        writeTaskRuntime(taskDir, {
+            phase: "executing_agent",
+            last_heartbeat_at: "2026-07-12T10:00:12Z",
+            current_command: "codex exec --prompt",
+        });
+        const result = getTaskStatus("task-running-001");
+        assert.equal(result.status, "running");
+        assert.equal(result.phase, "executing_agent");
+        assert.equal(result.current_command, "codex exec --prompt");
+        assert.equal(result.last_heartbeat_at, "2026-07-12T10:00:12Z");
+        assert.equal(result.started_at, "2026-07-12T10:00:05Z");
+        // running (not pending) → execution_blocked is false
+        assert.equal(result.execution_blocked, false);
+        assert.equal(result.pending_reason, "agent_running");
+    });
+    // ── done ──
+    it("reads done status task", () => {
+        writeTaskStatus("task-done-001", {
+            task_id: "task-done-001",
+            plan_id: "plan-001",
+            agent: "codex",
+            workspace_root: tempDir,
+            repo_path: "repo",
+            resolved_repo_path: join(tempDir, "repo"),
+            status: "done",
+            phase: "completed",
+            created_at: "2026-07-12T10:00:00Z",
+            started_at: "2026-07-12T10:00:05Z",
+            finished_at: "2026-07-12T10:05:00Z",
+            updated_at: "2026-07-12T10:05:00Z",
+            timeout_seconds: 900,
+            verify_status: "passed",
+            error: null,
+        });
+        const result = getTaskStatus("task-done-001");
+        assert.equal(result.status, "done");
+        assert.equal(result.phase, "completed");
+        assert.equal(result.finished_at, "2026-07-12T10:05:00Z");
+        assert.equal(result.verify_status, "passed");
+        assert.equal(result.execution_blocked, false);
+        assert.equal(result.pending_reason, null);
+    });
+    // ── failed ──
+    it("reads failed status task", () => {
+        writeTaskStatus("task-failed-001", {
+            task_id: "task-failed-001",
+            plan_id: "plan-001",
+            agent: "codex",
+            workspace_root: tempDir,
+            repo_path: "repo",
+            resolved_repo_path: join(tempDir, "repo"),
+            status: "failed",
+            phase: "failed",
+            created_at: "2026-07-12T10:00:00Z",
+            started_at: "2026-07-12T10:00:05Z",
+            finished_at: "2026-07-12T10:05:00Z",
+            updated_at: "2026-07-12T10:05:00Z",
+            timeout_seconds: 900,
+            error: "Agent exited with code 1",
+        });
+        const result = getTaskStatus("task-failed-001");
+        assert.equal(result.status, "failed");
+        assert.equal(result.phase, "failed");
+        assert.equal(result.error, "Agent exited with code 1");
+        assert.equal(result.finished_at, "2026-07-12T10:05:00Z");
+        assert.equal(result.execution_blocked, false);
+    });
+    // ── status.json missing ──
+    it("throws when status.json is missing (task not found)", () => {
+        // guardReadPath throws "File not found" before the existsSync "Task not found" check
+        assert.throws(() => getTaskStatus("non-existent-task"), /(File not found|Task not found)/);
+    });
+    // ── status.json corrupt ──
+    it("throws when status.json is corrupt", () => {
+        const taskDir = join(tasksDir, "task-corrupt-001");
+        mkdirSync(taskDir, { recursive: true });
+        writeFileSync(join(taskDir, "status.json"), "{not valid json", "utf-8");
+        assert.throws(() => getTaskStatus("task-corrupt-001"), SyntaxError);
+    });
+});

package/dist/test/unit/get-task-summary.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/test/unit/get-task-summary.test.js

@@ -0,0 +1,146 @@
+import { describe, it, beforeEach, afterEach } from "node:test";
+import { strict as assert } from "node:assert";
+import { mkdtempSync, rmSync, mkdirSync, writeFileSync } from "node:fs";
+import { join } from "node:path";
+import { tmpdir } from "node:os";
+import { reloadConfig } from "../../config.js";
+import { getTaskSummary } from "../../tools/getTaskSummary.js";
+let tempDir;
+let tasksDir;
+let prevConfigEnv;
+function writeConfig() {
+    const configPath = join(tempDir, "patchwarden.config.json");
+    writeFileSync(configPath, JSON.stringify({
+        workspaceRoot: tempDir,
+        tasksDir: ".patchwarden/tasks",
+        plansDir: ".patchwarden/plans",
+        assessmentsDir: ".patchwarden/assessments",
+        directSessionsDir: ".patchwarden/direct-sessions",
+        agents: { codex: { command: "codex", args: ["exec", "{prompt}"] } },
+        allowedTestCommands: ["npm test"],
+    }), "utf-8");
+    prevConfigEnv = process.env.PATCHWARDEN_CONFIG;
+    process.env.PATCHWARDEN_CONFIG = configPath;
+    reloadConfig();
+}
+function writeTaskStatus(taskId, status) {
+    const taskDir = join(tasksDir, taskId);
+    mkdirSync(taskDir, { recursive: true });
+    writeFileSync(join(taskDir, "status.json"), JSON.stringify(status, null, 2), "utf-8");
+    return taskDir;
+}
+function baseStatus(taskId, overrides = {}) {
+    return {
+        task_id: taskId,
+        plan_id: "plan-001",
+        agent: "codex",
+        workspace_root: tempDir,
+        repo_path: "repo",
+        resolved_repo_path: join(tempDir, "repo"),
+        created_at: "2026-07-12T10:00:00Z",
+        started_at: "2026-07-12T10:00:05Z",
+        finished_at: "2026-07-12T10:05:00Z",
+        updated_at: "2026-07-12T10:05:00Z",
+        timeout_seconds: 900,
+        error: null,
+        ...overrides,
+    };
+}
+describe("getTaskSummary", () => {
+    beforeEach(() => {
+        tempDir = mkdtempSync(join(tmpdir(), "pw-getsummary-"));
+        tasksDir = join(tempDir, ".patchwarden", "tasks");
+        mkdirSync(tasksDir, { recursive: true });
+        writeConfig();
+    });
+    afterEach(() => {
+        if (prevConfigEnv === undefined)
+            delete process.env.PATCHWARDEN_CONFIG;
+        else
+            process.env.PATCHWARDEN_CONFIG = prevConfigEnv;
+        reloadConfig();
+        rmSync(tempDir, { recursive: true, force: true });
+    });
+    // ── compact mode ──
+    it("returns compact summary in compact mode", () => {
+        writeTaskStatus("task-compact-001", baseStatus("task-compact-001", {
+            status: "done",
+            phase: "completed",
+            verify_status: "passed",
+        }));
+        const result = getTaskSummary("task-compact-001", { view: "compact" });
+        assert.equal(result.view, "compact");
+        assert.equal(result.task_id, "task-compact-001");
+        assert.equal(result.status, "done");
+        assert.equal(result.terminal, true);
+        // compact-only fields
+        assert.equal(typeof result.changed_files_total, "number");
+        assert.equal(typeof result.release_artifacts_count, "number");
+        assert.ok(result.artifact_hygiene);
+        assert.ok("max_items" in result.artifact_hygiene);
+    });
+    // ── full / standard mode ──
+    it("returns full summary in standard mode", () => {
+        writeTaskStatus("task-full-001", baseStatus("task-full-001", {
+            status: "done",
+            phase: "completed",
+            verify_status: "passed",
+        }));
+        const result = getTaskSummary("task-full-001");
+        // standard mode has no `view` field
+        assert.equal(result.view, undefined);
+        assert.equal(result.task_id, "task-full-001");
+        assert.equal(result.status, "done");
+        assert.equal(result.terminal, true);
+        // full-mode-only fields
+        assert.ok("log_tails" in result);
+        assert.ok("artifacts" in result);
+        assert.ok("failed_command_detail" in result);
+        assert.ok("acceptance_reviewed_at" in result);
+    });
+    // ── task not found ──
+    it("throws when task does not exist", () => {
+        assert.throws(() => getTaskSummary("non-existent-task"), /(File not found|Task not found)/);
+    });
+    // ── terminal: done ──
+    it("returns terminal summary for done task with passed verification", () => {
+        writeTaskStatus("task-done-001", baseStatus("task-done-001", {
+            status: "done",
+            phase: "completed",
+            verify_status: "passed",
+        }));
+        const result = getTaskSummary("task-done-001");
+        assert.equal(result.terminal, true);
+        assert.equal(result.status, "done");
+        assert.equal(result.verify_status, "passed");
+        // done + verify passed → ready_for_review
+        assert.equal(result.acceptance_status, "ready_for_review");
+    });
+    // ── terminal: failed ──
+    it("returns terminal summary for failed task", () => {
+        writeTaskStatus("task-failed-001", baseStatus("task-failed-001", {
+            status: "failed",
+            phase: "failed",
+            error: "Agent exited with code 1",
+        }));
+        const result = getTaskSummary("task-failed-001");
+        assert.equal(result.terminal, true);
+        assert.equal(result.status, "failed");
+        assert.equal(result.acceptance_status, "failed");
+        assert.ok(result.errors.includes("Agent exited with code 1"));
+    });
+    // ── running (non-terminal) ──
+    it("returns non-terminal summary for running task", () => {
+        writeTaskStatus("task-running-001", baseStatus("task-running-001", {
+            status: "running",
+            phase: "executing_agent",
+            started_at: "2026-07-12T10:00:00Z",
+            finished_at: undefined,
+        }));
+        const result = getTaskSummary("task-running-001");
+        assert.equal(result.terminal, false);
+        assert.equal(result.status, "running");
+        assert.equal(result.phase, "executing_agent");
+        assert.equal(result.acceptance_status, "pending");
+    });
+});

package/dist/test/unit/goal-report.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/test/unit/goal-report.test.js

@@ -0,0 +1,159 @@
+import { describe, it, beforeEach, afterEach } from "node:test";
+import { strict as assert } from "node:assert";
+import { existsSync, mkdirSync, mkdtempSync, readFileSync, rmSync, writeFileSync } from "node:fs";
+import { join, resolve } from "node:path";
+import { tmpdir } from "node:os";
+import { reloadConfig } from "../../config.js";
+import { exportGoalReport } from "../../goal/goalReport.js";
+import { getGoalDir, writeGoalStatus } from "../../goal/goalStore.js";
+// ── Helpers ───────────────────────────────────────────────────────
+function makeSubgoal(overrides) {
+    return {
+        title: "Subgoal " + overrides.id,
+        status: "ready",
+        depends_on: [],
+        task_ids: [],
+        ...overrides,
+    };
+}
+function makeGoalStatus(subgoals, overrides = {}) {
+    const now = "2026-07-10T00:00:00.000Z";
+    return {
+        goal_id: "goal_test_001",
+        title: "Test Goal",
+        status: "active",
+        repo_path: "/repo/test",
+        created_at: now,
+        updated_at: now,
+        subgoals,
+        ...overrides,
+    };
+}
+let tempDir;
+let prevConfigEnv;
+function writeConfig() {
+    const configPath = join(tempDir, "patchwarden.config.json");
+    writeFileSync(configPath, JSON.stringify({
+        workspaceRoot: tempDir,
+        tasksDir: ".patchwarden/tasks",
+        plansDir: ".patchwarden/plans",
+        assessmentsDir: ".patchwarden/assessments",
+        agents: {
+            codex: { command: "codex", args: [] },
+            opencode: { command: "opencode", args: [] },
+        },
+        allowedTestCommands: ["npm test", "npm run build"],
+        defaultTaskTimeoutSeconds: 30,
+        maxTaskTimeoutSeconds: 120,
+    }), "utf-8");
+    prevConfigEnv = process.env.PATCHWARDEN_CONFIG;
+    process.env.PATCHWARDEN_CONFIG = configPath;
+    reloadConfig();
+}
+/**
+ * 创建 goal 目录并写入 goal_status.json（writeGoalStatus 不自动创建目录）。
+ */
+function seedGoalStatus(goalId, status, workspaceRoot) {
+    mkdirSync(getGoalDir(goalId, workspaceRoot), { recursive: true });
+    writeGoalStatus(goalId, status, workspaceRoot);
+}
+// ── Tests ─────────────────────────────────────────────────────────
+describe("goalReport", () => {
+    beforeEach(() => {
+        tempDir = mkdtempSync(join(tmpdir(), "pw-goal-report-"));
+        writeConfig();
+    });
+    afterEach(() => {
+        if (prevConfigEnv === undefined)
+            delete process.env.PATCHWARDEN_CONFIG;
+        else
+            process.env.PATCHWARDEN_CONFIG = prevConfigEnv;
+        reloadConfig();
+        rmSync(tempDir, { recursive: true, force: true });
+    });
+    it("完成 Goal 报告：所有 subgoal accepted，completion_rate=100", () => {
+        const goal = makeGoalStatus([
+            makeSubgoal({
+                id: "subgoal-001",
+                title: "Feature A",
+                status: "accepted",
+                accepted_at: "2026-07-01T00:00:00.000Z",
+            }),
+            makeSubgoal({
+                id: "subgoal-002",
+                title: "Feature B",
+                status: "accepted",
+                accepted_at: "2026-07-02T00:00:00.000Z",
+            }),
+        ], { goal_id: "goal_done_001" });
+        seedGoalStatus("goal_done_001", goal, tempDir);
+        const report = exportGoalReport("goal_done_001", { workspaceRoot: tempDir });
+        assert.equal(report.completion_rate, 100);
+        assert.equal(report.goal_id, "goal_done_001");
+        assert.equal(report.subgoals.length, 2);
+        assert.equal(report.bounded, true);
+        assert.ok(existsSync(report.files.report_md));
+        assert.ok(existsSync(report.files.report_json));
+    });
+    it("未完成 Goal 报告：有 running/ready subgoal，报告含 '未完成'", () => {
+        const goal = makeGoalStatus([
+            makeSubgoal({
+                id: "subgoal-001",
+                title: "Done",
+                status: "accepted",
+                accepted_at: "2026-07-01T00:00:00.000Z",
+            }),
+            makeSubgoal({ id: "subgoal-002", title: "WIP", status: "running" }),
+        ]);
+        seedGoalStatus("goal_wip_001", goal, tempDir);
+        const report = exportGoalReport("goal_wip_001", { workspaceRoot: tempDir });
+        const md = readFileSync(report.files.report_md, "utf-8");
+        assert.ok(md.includes("未完成"), "REPORT.md should contain '未完成' annotation");
+        assert.ok(report.risks.some((r) => r.includes("未完成")), "risks array should contain '未完成' entry");
+    });
+    it("空 Goal 报告：无 subgoal，completion_rate=0，报告含 '无子目标'", () => {
+        const goal = makeGoalStatus([]);
+        seedGoalStatus("goal_empty_001", goal, tempDir);
+        const report = exportGoalReport("goal_empty_001", { workspaceRoot: tempDir });
+        assert.equal(report.completion_rate, 0);
+        const md = readFileSync(report.files.report_md, "utf-8");
+        assert.ok(md.includes("无子目标"), "REPORT.md should contain '无子目标' annotation");
+    });
+    it("双格式输出：REPORT.md 和 report.json 同时存在", () => {
+        const goal = makeGoalStatus([
+            makeSubgoal({
+                id: "subgoal-001",
+                title: "Task A",
+                status: "accepted",
+                accepted_at: "2026-07-01T00:00:00.000Z",
+            }),
+        ]);
+        seedGoalStatus("goal_dual_001", goal, tempDir);
+        const report = exportGoalReport("goal_dual_001", { workspaceRoot: tempDir });
+        const reportDir = resolve(tempDir, ".patchwarden", "goals", "goal_dual_001", "report");
+        const mdPath = join(reportDir, "REPORT.md");
+        const jsonPath = join(reportDir, "report.json");
+        assert.ok(existsSync(mdPath), "REPORT.md should exist");
+        assert.ok(existsSync(jsonPath), "report.json should exist");
+        assert.equal(report.files.report_md, mdPath);
+        assert.equal(report.files.report_json, jsonPath);
+    });
+    it("脱敏验证：subgoal title 含敏感信息，输出中不含原始值", () => {
+        const goal = makeGoalStatus([
+            makeSubgoal({
+                id: "subgoal-001",
+                title: "Deploy with token=abcd1234",
+                status: "accepted",
+                accepted_at: "2026-07-01T00:00:00.000Z",
+            }),
+        ]);
+        seedGoalStatus("goal_redact_001", goal, tempDir);
+        const report = exportGoalReport("goal_redact_001", { workspaceRoot: tempDir });
+        const md = readFileSync(report.files.report_md, "utf-8");
+        const json = readFileSync(report.files.report_json, "utf-8");
+        assert.ok(!md.includes("abcd1234"), "REPORT.md must not contain raw secret value");
+        assert.ok(!json.includes("abcd1234"), "report.json must not contain raw secret value");
+        assert.ok(md.includes("[REDACTED]"), "REPORT.md should contain redaction marker");
+        assert.ok(json.includes("[REDACTED]"), "report.json should contain redaction marker");
+    });
+});

package/dist/test/unit/goal-subgoal-task.test.js

@@ -11,8 +11,8 @@ import { PatchWardenError } from "../../errors.js";
 //   - goal_not_found：readGoalStatus 在默认工作区找不到 goal 即抛错
 describe("createSubgoalTask", () => {
     describe("错误路径", () => {
-        it("execution_mode=assess_only 抛 invalid_execution_mode", () => {
-            assert.throws(() => createSubgoalTask({
+        it("execution_mode=assess_only 抛 invalid_execution_mode", async () => {
+            await assert.rejects(() => createSubgoalTask({
                 goal_id: "goal_nonexistent_test",
                 subgoal_title: "Sub A",
                 repo_path: "repo",
@@ -24,8 +24,8 @@ describe("createSubgoalTask", () => {
                 return true;
             });
         });
-        it("goal_id 不存在抛 goal_not_found", () => {
-            assert.throws(() => createSubgoalTask({
+        it("goal_id 不存在抛 goal_not_found", async () => {
+            await assert.rejects(() => createSubgoalTask({
                 goal_id: "goal_definitely_does_not_exist_99999",
                 subgoal_title: "Sub A",
                 repo_path: "repo",
@@ -37,10 +37,10 @@ describe("createSubgoalTask", () => {
                 return true;
             });
         });
-        it("assess_only 优先于 goal_not_found（在读取 goal 前校验）", () => {
+        it("assess_only 优先于 goal_not_found（在读取 goal 前校验）", async () => {
             // execution_mode=assess_only 应先抛 invalid_execution_mode，
             // 而不是去读不存在的 goal
-            assert.throws(() => createSubgoalTask({
+            await assert.rejects(() => createSubgoalTask({
                 goal_id: "goal_definitely_does_not_exist_99999",
                 subgoal_title: "Sub A",
                 repo_path: "repo",