patchwarden 1.5.0 → 1.5.1

package/src/test/unit/apply-patch.test.ts

@@ -0,0 +1,293 @@
+import { describe, it, beforeEach, afterEach } from "node:test";
+import { strict as assert } from "node:assert";
+import { mkdtempSync, rmSync, mkdirSync, writeFileSync, readFileSync } from "node:fs";
+import { join } from "node:path";
+import { tmpdir } from "node:os";
+import { createHash } from "node:crypto";
+import { applyPatch } from "../../tools/applyPatch.js";
+import { createDirectSession } from "../../direct/directSessionStore.js";
+import { reloadConfig } from "../../config.js";
+import { PatchWardenError } from "../../errors.js";
+import type { RepoSnapshot } from "../../runner/changeCapture.js";
+import type { PatchOperation } from "../../direct/directPatch.js";
+
+// ── Helpers ────────────────────────────────────────────────────────
+
+function sha256(content: string): string {
+  return createHash("sha256").update(content, "utf-8").digest("hex");
+}
+
+function makeSnapshot(): RepoSnapshot {
+  return {
+    captured_at: new Date().toISOString(),
+    is_git: false,
+    head: null,
+    status: "",
+    workspace_dirty: false,
+    files: {},
+    dirty_paths: [],
+    warnings: [],
+  };
+}
+
+function bootstrapWorkspace(prefix: string, maxPatchBytes: number): {
+  tempDir: string;
+  repoPath: string;
+  sessionId: string;
+} {
+  const tempDir = mkdtempSync(join(tmpdir(), prefix));
+  const repoPath = join(tempDir, "my-repo");
+  mkdirSync(repoPath, { recursive: true });
+  mkdirSync(join(repoPath, "src"), { recursive: true });
+
+  const configPath = join(tempDir, "patchwarden.config.json");
+  writeFileSync(configPath, JSON.stringify({
+    workspaceRoot: tempDir,
+    agents: { codex: { command: "codex", args: ["exec", "{prompt}"] } },
+    allowedTestCommands: ["npm test"],
+    directMaxPatchBytes: maxPatchBytes,
+    directMaxFileBytes: 500_000,
+  }), "utf-8");
+  process.env.PATCHWARDEN_CONFIG = configPath;
+  reloadConfig();
+
+  const session = createDirectSession({
+    repo_path: "my-repo",
+    resolved_repo_path: repoPath,
+    title: "applyPatch test",
+    snapshot: makeSnapshot(),
+  });
+
+  return { tempDir, repoPath, sessionId: session.session_id };
+}
+
+function teardownWorkspace(tempDir: string): void {
+  rmSync(tempDir, { recursive: true, force: true });
+  delete process.env.PATCHWARDEN_CONFIG;
+  reloadConfig();
+}
+
+// ── Success cases ──────────────────────────────────────────────────
+
+describe("applyPatch success cases", () => {
+  let tempDir: string;
+  let repoPath: string;
+  let sessionId: string;
+
+  beforeEach(() => {
+    const ws = bootstrapWorkspace("pw-applypatch-ok-", 200_000);
+    tempDir = ws.tempDir;
+    repoPath = ws.repoPath;
+    sessionId = ws.sessionId;
+  });
+
+  afterEach(() => {
+    teardownWorkspace(tempDir);
+  });
+
+  it("applies replace_exact operation", () => {
+    const filePath = join(repoPath, "src", "main.ts");
+    const original = "hello world";
+    writeFileSync(filePath, original, "utf-8");
+
+    const operations: PatchOperation[] = [
+      { type: "replace_exact", old_text: "world", new_text: "there" },
+    ];
+
+    const result = applyPatch({
+      session_id: sessionId,
+      path: "src/main.ts",
+      expected_sha256: sha256(original),
+      operations,
+    });
+
+    assert.equal(result.path, "src/main.ts");
+    assert.equal(result.before_sha256, sha256(original));
+    assert.equal(result.after_sha256, sha256("hello there"));
+    assert.equal(result.operations_applied, 1);
+    assert.equal(result.bytes_changed, 0);
+    assert.ok(result.next_action.length > 0);
+    assert.equal(readFileSync(filePath, "utf-8"), "hello there");
+  });
+
+  it("applies insert_before operation", () => {
+    const filePath = join(repoPath, "src", "main.ts");
+    const original = "hello world";
+    writeFileSync(filePath, original, "utf-8");
+
+    const operations: PatchOperation[] = [
+      { type: "insert_before", old_text: "world", new_text: "beautiful " },
+    ];
+
+    const result = applyPatch({
+      session_id: sessionId,
+      path: "src/main.ts",
+      expected_sha256: sha256(original),
+      operations,
+    });
+
+    assert.equal(readFileSync(filePath, "utf-8"), "hello beautiful world");
+    assert.equal(result.after_sha256, sha256("hello beautiful world"));
+    assert.equal(result.operations_applied, 1);
+    assert.equal(result.bytes_changed, 10);
+  });
+
+  it("applies insert_after operation", () => {
+    const filePath = join(repoPath, "src", "main.ts");
+    const original = "hello world";
+    writeFileSync(filePath, original, "utf-8");
+
+    const operations: PatchOperation[] = [
+      { type: "insert_after", old_text: "hello", new_text: " beautiful" },
+    ];
+
+    const result = applyPatch({
+      session_id: sessionId,
+      path: "src/main.ts",
+      expected_sha256: sha256(original),
+      operations,
+    });
+
+    assert.equal(readFileSync(filePath, "utf-8"), "hello beautiful world");
+    assert.equal(result.after_sha256, sha256("hello beautiful world"));
+    assert.equal(result.operations_applied, 1);
+    assert.equal(result.bytes_changed, 10);
+  });
+
+  it("applies replace_whole_file operation", () => {
+    const filePath = join(repoPath, "src", "main.ts");
+    const original = "hello world";
+    writeFileSync(filePath, original, "utf-8");
+
+    const newContent = "completely new content";
+    const operations: PatchOperation[] = [
+      { type: "replace_whole_file", new_text: newContent },
+    ];
+
+    const result = applyPatch({
+      session_id: sessionId,
+      path: "src/main.ts",
+      expected_sha256: sha256(original),
+      operations,
+    });
+
+    assert.equal(readFileSync(filePath, "utf-8"), newContent);
+    assert.equal(result.after_sha256, sha256(newContent));
+    assert.equal(result.operations_applied, 1);
+    assert.equal(result.bytes_changed, 11);
+  });
+});
+
+// ── Rejection cases ────────────────────────────────────────────────
+
+describe("applyPatch rejection cases", () => {
+  let tempDir: string;
+  let repoPath: string;
+  let sessionId: string;
+
+  beforeEach(() => {
+    const ws = bootstrapWorkspace("pw-applypatch-rej-", 200_000);
+    tempDir = ws.tempDir;
+    repoPath = ws.repoPath;
+    sessionId = ws.sessionId;
+  });
+
+  afterEach(() => {
+    teardownWorkspace(tempDir);
+  });
+
+  it("rejects when expected_sha256 does not match", () => {
+    const filePath = join(repoPath, "src", "main.ts");
+    writeFileSync(filePath, "hello world", "utf-8");
+
+    assert.throws(
+      () => applyPatch({
+        session_id: sessionId,
+        path: "src/main.ts",
+        expected_sha256: "0".repeat(64),
+        operations: [{ type: "replace_whole_file", new_text: "new" }],
+      }),
+      (err: unknown) =>
+        err instanceof PatchWardenError && err.reason === "file_hash_mismatch"
+    );
+
+    // File content must remain unchanged after rejection
+    assert.equal(readFileSync(filePath, "utf-8"), "hello world");
+  });
+
+  it("rejects binary files (e.g. .png)", () => {
+    const filePath = join(repoPath, "src", "image.png");
+    writeFileSync(filePath, "fake png content", "utf-8");
+
+    assert.throws(
+      () => applyPatch({
+        session_id: sessionId,
+        path: "src/image.png",
+        expected_sha256: sha256("fake png content"),
+        operations: [{ type: "replace_whole_file", new_text: "new" }],
+      }),
+      (err: unknown) =>
+        err instanceof PatchWardenError && err.reason === "binary_file_blocked"
+    );
+
+    // File content must remain unchanged after rejection
+    assert.equal(readFileSync(filePath, "utf-8"), "fake png content");
+  });
+
+  it("rejects paths outside workspaceRoot", () => {
+    assert.throws(
+      () => applyPatch({
+        session_id: sessionId,
+        path: "../../../etc/passwd",
+        expected_sha256: sha256("dummy"),
+        operations: [{ type: "replace_whole_file", new_text: "new" }],
+      }),
+      PatchWardenError
+    );
+  });
+});
+
+// ── Patch size limit ───────────────────────────────────────────────
+
+describe("applyPatch patch size limit", () => {
+  let tempDir: string;
+  let repoPath: string;
+  let sessionId: string;
+
+  beforeEach(() => {
+    const ws = bootstrapWorkspace("pw-applypatch-size-", 100);
+    tempDir = ws.tempDir;
+    repoPath = ws.repoPath;
+    sessionId = ws.sessionId;
+  });
+
+  afterEach(() => {
+    teardownWorkspace(tempDir);
+  });
+
+  it("rejects patches exceeding directMaxPatchBytes", () => {
+    const filePath = join(repoPath, "src", "main.ts");
+    writeFileSync(filePath, "hello world", "utf-8");
+
+    // Build a patch whose JSON.stringify length exceeds the 100-byte limit
+    const bigText = "x".repeat(80);
+    const operations: PatchOperation[] = [
+      { type: "replace_whole_file", new_text: bigText },
+    ];
+    assert.ok(JSON.stringify(operations).length > 100);
+
+    assert.throws(
+      () => applyPatch({
+        session_id: sessionId,
+        path: "src/main.ts",
+        expected_sha256: sha256("hello world"),
+        operations,
+      }),
+      (err: unknown) =>
+        err instanceof PatchWardenError && err.reason === "patch_too_large"
+    );
+
+    // File content must remain unchanged after rejection
+    assert.equal(readFileSync(filePath, "utf-8"), "hello world");
+  });
+});

package/src/test/unit/create-task.test.ts

@@ -0,0 +1,255 @@
+import { describe, it, beforeEach, afterEach } from "node:test";
+import { strict as assert } from "node:assert";
+import {
+  mkdtempSync,
+  rmSync,
+  mkdirSync,
+  writeFileSync,
+  existsSync,
+  readFileSync,
+  readdirSync,
+} from "node:fs";
+import { join, dirname } from "node:path";
+import { tmpdir } from "node:os";
+import { reloadConfig } from "../../config.js";
+import { createTask, type CreateTaskOutput, type AssessOnlyOutput } from "../../tools/createTask.js";
+import { savePlan } from "../../tools/savePlan.js";
+import { PatchWardenError } from "../../errors.js";
+
+// ── Helpers ───────────────────────────────────────────────────────
+
+let tempDir: string;
+let prevConfigEnv: string | undefined;
+
+function writeConfig(workspaceRoot: string): void {
+  const configPath = join(tempDir, "patchwarden.config.json");
+  writeFileSync(
+    configPath,
+    JSON.stringify({
+      workspaceRoot,
+      tasksDir: ".patchwarden/tasks",
+      plansDir: ".patchwarden/plans",
+      assessmentsDir: ".patchwarden/assessments",
+      directSessionsDir: ".patchwarden/direct-sessions",
+      agents: {
+        codex: { command: "codex", args: ["exec", "{prompt}"] },
+      },
+      allowedTestCommands: ["npm test", "npm run build"],
+      defaultTaskTimeoutSeconds: 60,
+      maxTaskTimeoutSeconds: 300,
+      watcherStaleSeconds: 30,
+    }),
+    "utf-8"
+  );
+  prevConfigEnv = process.env.PATCHWARDEN_CONFIG;
+  process.env.PATCHWARDEN_CONFIG = configPath;
+  reloadConfig();
+}
+
+/** Write a fresh watcher heartbeat so readWatcherStatus reports healthy. */
+function writeFreshHeartbeat(workspaceRoot: string): void {
+  const heartbeatPath = join(workspaceRoot, ".patchwarden", "watcher-heartbeat.json");
+  mkdirSync(dirname(heartbeatPath), { recursive: true });
+  writeFileSync(
+    heartbeatPath,
+    JSON.stringify({
+      status: "running",
+      pid: process.pid,
+      last_heartbeat_at: new Date().toISOString(),
+      instance_id: "test-instance",
+    }),
+    "utf-8"
+  );
+}
+
+describe("createTask", () => {
+  beforeEach(() => {
+    tempDir = mkdtempSync(join(tmpdir(), "pw-createtask-"));
+  });
+
+  afterEach(() => {
+    if (prevConfigEnv === undefined) delete process.env.PATCHWARDEN_CONFIG;
+    else process.env.PATCHWARDEN_CONFIG = prevConfigEnv;
+    reloadConfig();
+    rmSync(tempDir, { recursive: true, force: true });
+  });
+
+  // ── 1. inline_plan source ──────────────────────────────────────
+
+  it("creates a task from inline_plan, writes status.json, and allocates a task directory", async () => {
+    writeConfig(tempDir);
+    mkdirSync(join(tempDir, "my-repo"), { recursive: true });
+    writeFreshHeartbeat(tempDir);
+
+    const result = await createTask({
+      inline_plan: "## Goal\nAdd a hello-world print statement to main.ts.",
+      agent: "codex",
+      repo_path: "my-repo",
+    });
+
+    const out = result as CreateTaskOutput;
+    assert.ok(out.task_id.startsWith("task_"), `task_id should start with "task_", got: ${out.task_id}`);
+    assert.equal(out.status, "pending");
+    assert.equal(out.plan_source, "inline");
+    assert.equal(out.agent, "codex");
+    assert.equal(out.execution_blocked, false);
+    assert.ok(existsSync(out.path), "task directory should exist");
+    assert.ok(existsSync(join(out.path, "status.json")), "status.json should exist");
+
+    const status = JSON.parse(readFileSync(join(out.path, "status.json"), "utf-8"));
+    assert.equal(status.task_id, out.task_id);
+    assert.equal(status.status, "pending");
+    assert.equal(status.phase, "queued");
+    assert.equal(status.agent, "codex");
+    assert.equal(status.plan_source, "inline");
+    assert.equal(status.repo_path, "my-repo");
+  });
+
+  // ── 2. template source ─────────────────────────────────────────
+
+  it("creates a task from a built-in template (feature_small)", async () => {
+    writeConfig(tempDir);
+    mkdirSync(join(tempDir, "my-repo"), { recursive: true });
+    writeFreshHeartbeat(tempDir);
+
+    const result = await createTask({
+      template: "feature_small",
+      goal: "Add a utility function for string truncation.",
+      agent: "codex",
+      repo_path: "my-repo",
+    });
+
+    const out = result as CreateTaskOutput;
+    assert.ok(out.task_id.startsWith("task_"));
+    assert.equal(out.plan_source, "template");
+    assert.equal(out.template, "feature_small");
+    assert.ok(existsSync(join(out.path, "status.json")));
+
+    const status = JSON.parse(readFileSync(join(out.path, "status.json"), "utf-8"));
+    assert.equal(status.template, "feature_small");
+    assert.equal(status.plan_source, "template");
+  });
+
+  // ── 3. plan_id source ──────────────────────────────────────────
+
+  it("creates a task from a previously saved plan_id", async () => {
+    writeConfig(tempDir);
+    mkdirSync(join(tempDir, "my-repo"), { recursive: true });
+    writeFreshHeartbeat(tempDir);
+
+    const saved = savePlan({
+      title: "Pre-saved plan",
+      content: "## Goal\nDo something safe and repo-local.",
+    });
+    const result = await createTask({
+      plan_id: saved.plan_id,
+      agent: "codex",
+      repo_path: "my-repo",
+    });
+
+    const out = result as CreateTaskOutput;
+    assert.equal(out.plan_id, saved.plan_id);
+    assert.equal(out.plan_source, "saved");
+    assert.ok(existsSync(join(out.path, "status.json")));
+
+    const status = JSON.parse(readFileSync(join(out.path, "status.json"), "utf-8"));
+    assert.equal(status.plan_id, saved.plan_id);
+    assert.equal(status.plan_source, "saved");
+  });
+
+  // ── 4. assess_only mode ────────────────────────────────────────
+
+  it("returns a risk assessment instead of creating a task in assess_only mode", async () => {
+    writeConfig(tempDir);
+    mkdirSync(join(tempDir, "my-repo"), { recursive: true });
+
+    const result = await createTask({
+      inline_plan: "## Goal\nAdd a print statement to main.ts.",
+      agent: "codex",
+      repo_path: "my-repo",
+      execution_mode: "assess_only",
+    });
+
+    const out = result as AssessOnlyOutput;
+    assert.ok(out.assessment_id, "assessment_id should be present");
+    assert.ok(out.assessment_short_id, "assessment_short_id should be present");
+    assert.equal(out.decision, "allow");
+    assert.equal(out.risk_level, "low");
+    assert.ok(out.next_tool_call, "next_tool_call should be present for allow decision");
+    assert.equal(out.next_tool_call!.name, "create_task");
+    assert.equal(out.next_tool_call!.arguments.execution_mode, "execute");
+    assert.equal(out.next_tool_call!.arguments.assessment_id, out.assessment_id);
+
+    // No task directory should be created in assess_only mode
+    assert.equal("task_id" in out, false, "assess_only output should not contain task_id");
+    const tasksDir = join(tempDir, ".patchwarden", "tasks");
+    if (existsSync(tasksDir)) {
+      const taskEntries = readdirSync(tasksDir).filter((name) => name.startsWith("task_"));
+      assert.equal(taskEntries.length, 0, "no task directory should be created in assess_only mode");
+    }
+  });
+
+  // ── 5. agent not configured ────────────────────────────────────
+
+  it("throws PatchWardenError (agent_not_configured) when the agent is not registered", async () => {
+    writeConfig(tempDir);
+    mkdirSync(join(tempDir, "my-repo"), { recursive: true });
+
+    await assert.rejects(
+      () =>
+        createTask({
+          inline_plan: "## Goal\nDo something.",
+          agent: "ghost-agent",
+          repo_path: "my-repo",
+        }),
+      (err: unknown) => {
+        assert.ok(err instanceof PatchWardenError, "should throw PatchWardenError");
+        assert.equal((err as PatchWardenError).reason, "agent_not_configured");
+        return true;
+      }
+    );
+  });
+
+  // ── 6. repo_path escapes workspace ─────────────────────────────
+
+  it("throws workspace_path_escape when repo_path is outside workspaceRoot", async () => {
+    writeConfig(tempDir);
+    mkdirSync(join(tempDir, "my-repo"), { recursive: true });
+
+    await assert.rejects(
+      () =>
+        createTask({
+          inline_plan: "## Goal\nDo something.",
+          agent: "codex",
+          repo_path: "../outside-workspace",
+        }),
+      (err: unknown) => {
+        assert.ok(err instanceof PatchWardenError, "should throw PatchWardenError");
+        assert.equal((err as PatchWardenError).reason, "workspace_path_escape");
+        return true;
+      }
+    );
+  });
+
+  // ── 7. watcher not running ─────────────────────────────────────
+
+  it("returns execution_blocked: true when watcher is not running", async () => {
+    writeConfig(tempDir);
+    mkdirSync(join(tempDir, "my-repo"), { recursive: true });
+    // No watcher heartbeat file → watcher status is "missing"
+
+    const result = await createTask({
+      inline_plan: "## Goal\nDo something.",
+      agent: "codex",
+      repo_path: "my-repo",
+    });
+
+    const out = result as CreateTaskOutput;
+    assert.equal(out.execution_blocked, true);
+    assert.equal(out.watcher.available, false);
+    assert.equal(out.watcher.status, "missing");
+    assert.equal(out.next_tool_call.name, "health_check");
+    // Task is still created (queued) despite being blocked
+    assert.ok(existsSync(join(out.path, "status.json")));
+  });
+});