patchwarden 1.5.0 → 1.6.1

package/dist/direct/directGuards.js

@@ -1,7 +1,8 @@
-import { resolve, relative, isAbsolute } from "node:path";
+import { relative } from "node:path";
 import { existsSync, statSync, openSync, readSync, closeSync } from "node:fs";
 import { PatchWardenError } from "../errors.js";
-import { isSensitivePath } from "../security/sensitiveGuard.js";
+import { hasWindowsAlternateDataStream, isSensitivePath, } from "../security/sensitiveGuard.js";
+import { guardPath, guardWorkspacePath } from "../security/pathGuard.js";
 import { getConfig } from "../config.js";
 // ── Session state guards ───────────────────────────────────────────
 export function guardDirectSessionActive(session) {
@@ -23,34 +24,34 @@ export function guardDirectSessionFinalized(session) {
  * inside both the repo and the workspace root.
  */
 export function guardDirectPath(filePath, resolvedRepoPath, workspaceRoot) {
-    const config = getConfig();
-    const resolved = resolve(resolvedRepoPath, filePath);
-    const normalizedRepo = resolve(resolvedRepoPath);
-    const normalizedWs = resolve(workspaceRoot);
-    // Check path is inside workspace root
-    const relToWs = relative(normalizedWs, resolved);
-    if (isAbsolute(relToWs) || relToWs.startsWith("..")) {
-        throw new PatchWardenError("path_outside_repo", `Path "${filePath}" resolves outside the session repo.`, "Use a relative path inside the session's repo_path.", true, { path: filePath, operation: "direct_path_access" });
-    }
-    // Check path is inside repo_path
-    const relToRepo = relative(normalizedRepo, resolved);
-    if (isAbsolute(relToRepo) || relToRepo.startsWith("..")) {
-        throw new PatchWardenError("path_outside_repo", `Path "${filePath}" is outside the session repo_path "${resolvedRepoPath}".`, "Use a relative path inside the session's repo_path.", true, { path: filePath, operation: "direct_path_access" });
+    if (hasWindowsAlternateDataStream(filePath)) {
+        throw new PatchWardenError("windows_ads_path_blocked", `Path "${filePath}" contains a Windows alternate data stream suffix.`, "Use a normal relative file path without a colon or NTFS stream name.", true, { path: filePath, operation: "direct_path_access" });
+    }
+    // Resolve the repo first so a repo-level symlink/junction cannot escape the
+    // workspace. guardPath then resolves the candidate or its nearest existing
+    // parent, closing intermediate symlink/junction escapes for new files too.
+    try {
+        const guardedRepo = guardWorkspacePath(resolvedRepoPath, workspaceRoot);
+        return guardPath(filePath, guardedRepo);
+    }
+    catch (error) {
+        if (error instanceof PatchWardenError && error.reason === "workspace_path_escape") {
+            throw new PatchWardenError("path_outside_repo", `Path "${filePath}" resolves outside the session repo.`, "Use a relative path inside the session's repo_path.", true, { path: filePath, operation: "direct_path_access" });
+        }
+        throw error;
     }
-    return resolved;
 }
 /**
  * Guard a read path: must be inside repo, not sensitive, not binary.
  */
 export function guardDirectReadPath(filePath, resolvedRepoPath, workspaceRoot) {
     const resolved = guardDirectPath(filePath, resolvedRepoPath, workspaceRoot);
-    const normalized = filePath.replace(/\\/g, "/");
+    const policyPaths = directPolicyPaths(filePath, resolved, resolvedRepoPath, workspaceRoot);
     // Block internal PatchWarden paths (sessions, tasks, plans, assessments)
-    if (normalized.startsWith(".patchwarden/") ||
-        normalized.includes("/.patchwarden/")) {
+    if (policyPaths.some((path) => hasPathSegment(path, ".patchwarden"))) {
         throw new PatchWardenError("internal_patchwarden_path_blocked", `Access denied: "${filePath}" is inside the internal .patchwarden directory.`, "Internal PatchWarden files cannot be accessed through Direct mode.", true, { path: filePath, operation: "direct_read" });
     }
-    if (isSensitivePath(filePath)) {
+    if (policyPaths.some((path) => isSensitivePath(path))) {
         throw new PatchWardenError("sensitive_path_blocked", `Access denied: "${filePath}" matches a sensitive file pattern.`, "Read only non-sensitive files within the session repo.", true, { path: filePath, operation: "direct_read" });
     }
     if (existsSync(resolved) && statSync(resolved).isFile() && isBinaryFile(resolved)) {
@@ -64,25 +65,24 @@ export function guardDirectReadPath(filePath, resolvedRepoPath, workspaceRoot) {
  */
 export function guardDirectWritePath(filePath, resolvedRepoPath, workspaceRoot) {
     const resolved = guardDirectPath(filePath, resolvedRepoPath, workspaceRoot);
-    const normalized = filePath.replace(/\\/g, "/");
+    const policyPaths = directPolicyPaths(filePath, resolved, resolvedRepoPath, workspaceRoot);
     // Block internal PatchWarden paths
-    if (normalized.startsWith(".patchwarden/") ||
-        normalized.includes("/.patchwarden/")) {
+    if (policyPaths.some((path) => hasPathSegment(path, ".patchwarden"))) {
         throw new PatchWardenError("internal_patchwarden_path_blocked", `Modification denied: "${filePath}" is inside the internal .patchwarden directory.`, "Internal PatchWarden files cannot be modified through Direct mode.", true, { path: filePath, operation: "direct_write" });
     }
-    if (isSensitivePath(normalized)) {
+    if (policyPaths.some((path) => isSensitivePath(path))) {
         throw new PatchWardenError("sensitive_path_blocked", `Modification denied: "${filePath}" matches a sensitive file pattern.`, "Do not modify .env, credentials, keys, or other sensitive files.", true, { path: filePath, operation: "direct_write" });
     }
     // Block node_modules
-    if (normalized.startsWith("node_modules/") || normalized.includes("/node_modules/")) {
+    if (policyPaths.some((path) => hasPathSegment(path, "node_modules"))) {
         throw new PatchWardenError("blocked_artifact_path", `Modification denied: "${filePath}" is inside node_modules.`, "Do not modify dependencies directly. Use package management tools instead.", true, { path: filePath, operation: "direct_write" });
     }
     // Block release/
-    if (normalized.startsWith("release/") || normalized.includes("/release/")) {
+    if (policyPaths.some((path) => hasPathSegment(path, "release"))) {
         throw new PatchWardenError("blocked_artifact_path", `Modification denied: "${filePath}" is inside the release directory.`, "Do not manually modify release artifacts.", true, { path: filePath, operation: "direct_write" });
     }
     // Block dist/
-    if (normalized.startsWith("dist/") || normalized.includes("/dist/")) {
+    if (policyPaths.some((path) => hasPathSegment(path, "dist"))) {
         throw new PatchWardenError("blocked_artifact_path", `Modification denied: "${filePath}" is inside the dist directory.`, "Do not manually modify build output. Modify source files instead.", true, { path: filePath, operation: "direct_write" });
     }
     if (existsSync(resolved) && statSync(resolved).isFile() && isBinaryFile(resolved)) {
@@ -90,6 +90,20 @@ export function guardDirectWritePath(filePath, resolvedRepoPath, workspaceRoot)
     }
     return resolved;
 }
+function directPolicyPaths(requestedPath, resolvedPath, resolvedRepoPath, workspaceRoot) {
+    const guardedRepo = guardWorkspacePath(resolvedRepoPath, workspaceRoot);
+    return [
+        requestedPath.replace(/\\/g, "/"),
+        relative(guardedRepo, resolvedPath).replace(/\\/g, "/"),
+    ];
+}
+function hasPathSegment(filePath, expectedSegment) {
+    const expected = expectedSegment.toLowerCase();
+    return filePath
+        .split("/")
+        .filter(Boolean)
+        .some((segment) => segment.toLowerCase() === expected);
+}
 // ── Size guards ────────────────────────────────────────────────────
 export function guardDirectPatchSize(patchBytes) {
     const config = getConfig();
@@ -97,8 +111,7 @@ export function guardDirectPatchSize(patchBytes) {
         throw new PatchWardenError("patch_too_large", `Patch size ${patchBytes} bytes exceeds maximum ${config.directMaxPatchBytes} bytes.`, "Split the patch into smaller operations or reduce the patch size.", true, { patch_bytes: patchBytes, max_bytes: config.directMaxPatchBytes });
     }
 }
-export function guardDirectFileSize(fileBytes) {
-    const config = getConfig();
+export function guardDirectFileSize(fileBytes, config = getConfig()) {
     if (fileBytes > config.directMaxFileBytes) {
         throw new PatchWardenError("file_too_large", `File size ${fileBytes} bytes exceeds maximum ${config.directMaxFileBytes} bytes.`, "Use search_workspace to find specific content, or split the read into smaller portions.", true, { file_bytes: fileBytes, max_bytes: config.directMaxFileBytes });
     }
@@ -113,23 +126,45 @@ const BINARY_EXTENSIONS = new Set([
     ".bin", ".dat", ".pak", ".pfx", ".p12", ".class", ".jar", ".war",
     ".wasm", ".node",
 ]);
+/**
+ * Maximum bytes to scan for null-byte detection when the extension is not
+ * a known binary type. 1 MB catches binary content embedded deep in files
+ * (e.g., null bytes at offset 8200) without reading excessively large files.
+ */
+const BINARY_SCAN_LIMIT = 1_048_576; // 1 MB
+const BINARY_SCAN_CHUNK = 65536; // 64 KB per read
 export function isBinaryFile(filePath) {
     const normalized = filePath.replace(/\\/g, "/").toLowerCase();
     for (const ext of BINARY_EXTENSIONS) {
         if (normalized.endsWith(ext))
             return true;
     }
-    // Check file content for null bytes (simple heuristic)
+    // Scan file content for null bytes in chunks up to BINARY_SCAN_LIMIT.
+    // Previously only the first 8 KB were checked, allowing null bytes at
+    // offset 8193+ to bypass detection.
     try {
+        const stat = statSync(filePath);
+        const scanSize = Math.min(stat.size, BINARY_SCAN_LIMIT);
         const fd = openSync(filePath, "r");
-        const buffer = Buffer.alloc(8192);
-        const bytesRead = readSync(fd, buffer, 0, 8192, 0);
-        closeSync(fd);
-        for (let i = 0; i < bytesRead; i++) {
-            if (buffer[i] === 0)
-                return true;
+        try {
+            const chunk = Buffer.alloc(BINARY_SCAN_CHUNK);
+            let scanned = 0;
+            while (scanned < scanSize) {
+                const toRead = Math.min(BINARY_SCAN_CHUNK, scanSize - scanned);
+                const bytesRead = readSync(fd, chunk, 0, toRead, scanned);
+                if (bytesRead === 0)
+                    break;
+                for (let i = 0; i < bytesRead; i++) {
+                    if (chunk[i] === 0)
+                        return true;
+                }
+                scanned += bytesRead;
+            }
+            return false;
+        }
+        finally {
+            closeSync(fd);
         }
-        return false;
     }
     catch {
         return false;

package/dist/direct/directPatch.d.ts

@@ -13,5 +13,10 @@ export interface ApplyPatchResult {
 }
 export declare function computeFileSha256(filePath: string): string;
 export declare function computeContentSha256(content: string): string;
+export interface ApplyPatchOptions {
+    expectedSha256?: string;
+    maxFileBytes?: number;
+    revalidatePath?: () => string;
+}
 export declare function validateExpectedSha256(filePath: string, expectedSha256: string): string;
-export declare function applyPatchOperations(filePath: string, operations: PatchOperation[]): ApplyPatchResult;
+export declare function applyPatchOperations(filePath: string, operations: PatchOperation[], options?: ApplyPatchOptions): ApplyPatchResult;

package/dist/direct/directPatch.js

@@ -1,7 +1,8 @@
-import { readFileSync, writeFileSync, existsSync, mkdirSync } from "node:fs";
+import { closeSync, existsSync, fstatSync, openSync, readFileSync } from "node:fs";
 import { createHash } from "node:crypto";
-import { dirname } from "node:path";
 import { PatchWardenError } from "../errors.js";
+import { atomicWriteFileSync } from "../utils/atomicFile.js";
+import { redactSensitiveContent } from "../security/contentRedaction.js";
 // ── Hash helpers ───────────────────────────────────────────────────
 export function computeFileSha256(filePath) {
     const content = readFileSync(filePath);
@@ -21,12 +22,36 @@ export function validateExpectedSha256(filePath, expectedSha256) {
     return currentHash;
 }
 // ── Patch application ──────────────────────────────────────────────
-export function applyPatchOperations(filePath, operations) {
+export function applyPatchOperations(filePath, operations, options = {}) {
     if (!existsSync(filePath)) {
         throw new PatchWardenError("patch_anchor_not_found", `File does not exist: "${filePath}".`, "Ensure the file exists before applying a patch. Direct mode does not support creating new files.", true, { path: filePath });
     }
-    const beforeContent = readFileSync(filePath, "utf-8");
-    const beforeSha256 = computeContentSha256(beforeContent);
+    let descriptor = null;
+    let beforeBytes;
+    let existingMode;
+    try {
+        descriptor = openSync(filePath, "r");
+        const metadata = fstatSync(descriptor);
+        if (!metadata.isFile()) {
+            throw new PatchWardenError("direct_target_not_file", `Patch target is not a regular file: "${filePath}".`, "Choose an existing text file inside the Direct session repository.");
+        }
+        guardFileByteLimit(metadata.size, options.maxFileBytes);
+        existingMode = metadata.mode;
+        beforeBytes = readFileSync(descriptor);
+    }
+    finally {
+        if (descriptor !== null)
+            closeSync(descriptor);
+    }
+    guardFileByteLimit(beforeBytes.length, options.maxFileBytes);
+    const beforeSha256 = createHash("sha256").update(beforeBytes).digest("hex");
+    if (options.expectedSha256 && beforeSha256 !== options.expectedSha256) {
+        throw fileHashMismatch(options.expectedSha256, beforeSha256);
+    }
+    const beforeContent = beforeBytes.toString("utf-8");
+    if (!Buffer.from(beforeContent, "utf-8").equals(beforeBytes)) {
+        throw new PatchWardenError("unsupported_text_encoding", `File "${filePath}" is not valid UTF-8 text.`, "Use a normal task or convert the file to UTF-8 before Direct editing.", true, { path: filePath });
+    }
     let content = beforeContent;
     let operationsApplied = 0;
     for (const op of operations) {
@@ -34,10 +59,19 @@ export function applyPatchOperations(filePath, operations) {
         operationsApplied++;
     }
     const afterSha256 = computeContentSha256(content);
+    guardFileByteLimit(Buffer.byteLength(content, "utf-8"), options.maxFileBytes);
+    const sensitive = redactSensitiveContent(content);
+    if (sensitive.redacted) {
+        throw new PatchWardenError("sensitive_content_blocked", `Patch result contains credential-like content (${sensitive.redaction_categories.join(", ")}).`, "Remove the sensitive value and retry with placeholders or environment-variable references.", true, { path: filePath, redaction_categories: sensitive.redaction_categories });
+    }
     const bytesChanged = Math.abs(Buffer.byteLength(content, "utf-8") - Buffer.byteLength(beforeContent, "utf-8"));
-    // Ensure parent directory exists (should already exist for existing files)
-    mkdirSync(dirname(filePath), { recursive: true });
-    writeFileSync(filePath, content, "utf-8");
+    if (options.revalidatePath && !samePath(options.revalidatePath(), filePath)) {
+        throw new PatchWardenError("direct_path_changed_during_write", `Patch target path changed while preparing "${filePath}".`, "Retry only after concurrent filesystem changes stop.", true, { path: filePath, operation: "apply_patch" });
+    }
+    const currentSha256 = computeFileSha256(filePath);
+    if (currentSha256 !== beforeSha256)
+        throw fileHashMismatch(beforeSha256, currentSha256);
+    atomicWriteFileSync(filePath, content, { mode: existingMode });
     return {
         before_sha256: beforeSha256,
         after_sha256: afterSha256,
@@ -45,6 +79,19 @@ export function applyPatchOperations(filePath, operations) {
         bytes_changed: bytesChanged,
     };
 }
+function guardFileByteLimit(fileBytes, maxFileBytes) {
+    if (maxFileBytes === undefined || fileBytes <= maxFileBytes)
+        return;
+    throw new PatchWardenError("file_too_large", `File size ${fileBytes} bytes exceeds maximum ${maxFileBytes} bytes.`, "Use a normal task for larger files.", true, { file_bytes: fileBytes, max_bytes: maxFileBytes });
+}
+function fileHashMismatch(expectedSha256, actualSha256) {
+    return new PatchWardenError("file_hash_mismatch", `File hash mismatch. Expected "${expectedSha256}" but got "${actualSha256}".`, "Re-read the file to get the current sha256, then retry the patch.", true, { expected_sha256: expectedSha256, actual_sha256: actualSha256 });
+}
+function samePath(left, right) {
+    return process.platform === "win32"
+        ? left.toLowerCase() === right.toLowerCase()
+        : left === right;
+}
 function applySingleOperation(content, op) {
     switch (op.type) {
         case "replace_exact":

package/dist/direct/directSessionStore.d.ts

@@ -1,9 +1,12 @@
+import { PatchWardenConfig } from "../config.js";
 import { type RepoSnapshot, type ChangeArtifacts } from "../runner/changeCapture.js";
 export interface DirectSessionOperation {
     index: number;
     timestamp: string;
     path: string;
-    before_sha256: string;
+    operation_type?: "patch" | "sync";
+    source_path?: string;
+    before_sha256: string | null;
     after_sha256: string;
     operations_applied: number;
     bytes_changed: number;
@@ -48,12 +51,19 @@ export interface DirectSessionCreateInput {
     snapshot: RepoSnapshot;
 }
 export declare function generateDirectSessionId(): string;
-export declare function createDirectSessionDir(sessionId: string): string;
-export declare function getDirectSessionDir(sessionId: string): string;
+/**
+ * Direct session IDs are directory names. Keep one shared, bounded grammar so
+ * MCP tools and Control Center routes cannot disagree about traversal input.
+ */
+export declare function isValidDirectSessionId(sessionId: string): boolean;
+export declare function createDirectSessionDir(sessionId: string, config?: PatchWardenConfig): string;
+export declare function getDirectSessionDir(sessionId: string, config?: PatchWardenConfig): string;
 export declare function createDirectSession(input: DirectSessionCreateInput): DirectSessionRecord;
-export declare function readDirectSession(sessionId: string): DirectSessionRecord;
+export declare function readDirectSession(sessionId: string, config?: PatchWardenConfig): DirectSessionRecord;
 export declare function updateDirectSession(sessionId: string, updates: Partial<DirectSessionRecord>): DirectSessionRecord;
-export declare function appendDirectSessionOperation(sessionId: string, operation: DirectSessionOperation): DirectSessionRecord;
+export declare function appendDirectSessionOperation(sessionId: string, operation: DirectSessionOperation, config?: PatchWardenConfig): DirectSessionRecord;
+export declare function withDirectSessionMutationLock<R>(sessionId: string, action: () => R, config?: PatchWardenConfig): R;
+export declare function withDirectSessionMutationLockAsync<R>(sessionId: string, action: () => Promise<R>, config?: PatchWardenConfig): Promise<R>;
 export declare function appendDirectSessionVerificationRun(sessionId: string, run: DirectSessionVerificationRun): DirectSessionRecord;
 export interface DirectSessionValidationResult {
     valid: boolean;
@@ -61,5 +71,5 @@ export interface DirectSessionValidationResult {
     session: DirectSessionRecord | null;
 }
 export declare function validateDirectSessionFreshness(sessionId: string): DirectSessionValidationResult;
-export declare function finalizeDirectSessionRecord(sessionId: string, afterSnapshot: RepoSnapshot, changeArtifacts: ChangeArtifacts): DirectSessionRecord;
+export declare function finalizeDirectSessionRecord(sessionId: string, changeArtifacts: ChangeArtifacts): DirectSessionRecord;
 export declare function computeWorkspaceFingerprint(snapshot: RepoSnapshot): string;

package/dist/direct/directSessionStore.js

@@ -1,11 +1,14 @@
-import { mkdirSync, writeFileSync, existsSync, readFileSync, } from "node:fs";
+import { mkdirSync, existsSync, } from "node:fs";
 import { createHash, randomBytes } from "node:crypto";
 import { resolve, join } from "node:path";
 import { getDirectSessionsDir, getConfig, getRepoDirectAllowedCommands, } from "../config.js";
 import { guardPath } from "../security/pathGuard.js";
 import { PatchWardenError } from "../errors.js";
 import { PATCHWARDEN_VERSION, TOOL_SCHEMA_EPOCH } from "../version.js";
-import { getLastToolCatalogSnapshot } from "../tools/toolCatalog.js";
+import { atomicWriteFileSync, atomicWriteJsonFileSync } from "../utils/atomicFile.js";
+import { redactSensitiveContent } from "../security/contentRedaction.js";
+import { mutateLockedJsonFileSync, readJsonObjectFileSync, withFileLock, withFileLockSync, } from "../utils/lockedJsonFile.js";
+import { getLastToolCatalogSnapshot } from "../tools/catalog/toolCatalog.js";
 // ── ID generation ──────────────────────────────────────────────────
 export function generateDirectSessionId() {
     const timestamp = new Date()
@@ -16,21 +19,32 @@ export function generateDirectSessionId() {
     const randomHex = randomBytes(16).toString("hex");
     return `direct_${timestamp}_${randomHex}`;
 }
+/**
+ * Direct session IDs are directory names. Keep one shared, bounded grammar so
+ * MCP tools and Control Center routes cannot disagree about traversal input.
+ */
+export function isValidDirectSessionId(sessionId) {
+    return /^[A-Za-z0-9][A-Za-z0-9_-]{0,127}$/.test(sessionId);
+}
+function guardDirectSessionId(sessionId) {
+    if (!isValidDirectSessionId(sessionId)) {
+        throw new PatchWardenError("invalid_session_id", `Direct session ID "${sessionId}" is invalid.`, "Use the session_id returned by create_direct_session.", true, { session_id: sessionId });
+    }
+}
 // ── Directory management ───────────────────────────────────────────
-export function createDirectSessionDir(sessionId) {
-    const config = getConfig();
+export function createDirectSessionDir(sessionId, config = getConfig()) {
+    guardDirectSessionId(sessionId);
     const sessionsDir = getDirectSessionsDir(config);
     guardPath(sessionsDir, config.workspaceRoot, config.directSessionsDir);
     mkdirSync(sessionsDir, { recursive: true });
-    const dir = resolve(sessionsDir, sessionId);
-    guardPath(dir, config.workspaceRoot, config.directSessionsDir);
+    const dir = getDirectSessionDir(sessionId, config);
     mkdirSync(dir, { recursive: true });
     return dir;
 }
-export function getDirectSessionDir(sessionId) {
-    const config = getConfig();
+export function getDirectSessionDir(sessionId, config = getConfig()) {
+    guardDirectSessionId(sessionId);
     const sessionsDir = getDirectSessionsDir(config);
-    return resolve(sessionsDir, sessionId);
+    return guardPath(resolve(sessionsDir, sessionId), config.workspaceRoot, config.directSessionsDir);
 }
 // ── CRUD ───────────────────────────────────────────────────────────
 export function createDirectSession(input) {
@@ -48,7 +62,11 @@ export function createDirectSession(input) {
     const expiresAt = new Date(now.getTime() + config.directSessionTtlSeconds * 1000).toISOString();
     const record = {
         session_id: sessionId,
-        title: input.title || "",
+        title: redactSensitiveContent(input.title || "")
+            .content
+            .replace(/[\r\n\t]+/g, " ")
+            .trim()
+            .slice(0, 500),
         repo_path: input.repo_path,
         resolved_repo_path: input.resolved_repo_path,
         created_at: now.toISOString(),
@@ -66,36 +84,55 @@ export function createDirectSession(input) {
         audited: false,
         change_artifacts: null,
     };
-    writeFileSync(join(dir, "session.json"), JSON.stringify(record, null, 2), "utf-8");
+    atomicWriteJsonFileSync(join(dir, "session.json"), record);
     return record;
 }
-export function readDirectSession(sessionId) {
-    const config = getConfig();
-    const sessionsDir = getDirectSessionsDir(config);
-    const dir = resolve(sessionsDir, sessionId);
-    const file = join(dir, "session.json");
-    guardPath(file, config.workspaceRoot, config.directSessionsDir);
+export function readDirectSession(sessionId, config = getConfig()) {
+    const file = getDirectSessionFile(sessionId, config);
     if (!existsSync(file)) {
         throw new PatchWardenError("session_not_found", `Direct session "${sessionId}" not found.`, "Call create_direct_session first to get a valid session_id.", true, { session_id: sessionId });
     }
-    return JSON.parse(readFileSync(file, "utf-8"));
+    let value;
+    try {
+        value = readJsonObjectFileSync(file);
+    }
+    catch {
+        throw invalidDirectSessionRecord(sessionId, "session.json is not valid JSON");
+    }
+    return validateDirectSessionRecord(sessionId, value);
 }
 export function updateDirectSession(sessionId, updates) {
-    const session = readDirectSession(sessionId);
-    const updated = { ...session, ...updates };
-    const dir = getDirectSessionDir(sessionId);
-    writeFileSync(join(dir, "session.json"), JSON.stringify(updated, null, 2), "utf-8");
-    return updated;
+    return mutateDirectSessionRecord(sessionId, (session) => ({
+        ...session,
+        ...updates,
+        session_id: session.session_id,
+    }));
+}
+export function appendDirectSessionOperation(sessionId, operation, config = getConfig()) {
+    return mutateDirectSessionRecord(sessionId, (session) => ({
+        ...session,
+        operations: [
+            ...session.operations,
+            {
+                ...operation,
+                index: session.operations.reduce((max, entry) => Math.max(max, entry.index), -1) + 1,
+            },
+        ],
+    }), config);
 }
-export function appendDirectSessionOperation(sessionId, operation) {
-    const session = readDirectSession(sessionId);
-    const operations = [...session.operations, operation];
-    return updateDirectSession(sessionId, { operations });
+export function withDirectSessionMutationLock(sessionId, action, config = getConfig()) {
+    const lockTarget = join(getDirectSessionDir(sessionId, config), "workspace-mutation");
+    return withFileLockSync(lockTarget, action, directSessionBusyOptions(sessionId));
+}
+export function withDirectSessionMutationLockAsync(sessionId, action, config = getConfig()) {
+    const lockTarget = join(getDirectSessionDir(sessionId, config), "workspace-mutation");
+    return withFileLock(lockTarget, action, directSessionBusyOptions(sessionId));
 }
 export function appendDirectSessionVerificationRun(sessionId, run) {
-    const session = readDirectSession(sessionId);
-    const verification_runs = [...session.verification_runs, run];
-    return updateDirectSession(sessionId, { verification_runs });
+    return mutateDirectSessionRecord(sessionId, (session) => ({
+        ...session,
+        verification_runs: [...session.verification_runs, run],
+    }));
 }
 export function validateDirectSessionFreshness(sessionId) {
     let session;
@@ -124,20 +161,22 @@ export function validateDirectSessionFreshness(sessionId) {
     return { valid: true, failure_reason: null, session };
 }
 // ── Finalization ───────────────────────────────────────────────────
-export function finalizeDirectSessionRecord(sessionId, afterSnapshot, changeArtifacts) {
+export function finalizeDirectSessionRecord(sessionId, changeArtifacts) {
     const dir = getDirectSessionDir(sessionId);
     // Write change artifacts to session directory
-    writeFileSync(join(dir, "changed-files.json"), JSON.stringify(changeArtifacts.changed_files, null, 2), "utf-8");
-    writeFileSync(join(dir, "diff.patch"), changeArtifacts.diff, "utf-8");
+    atomicWriteJsonFileSync(join(dir, "changed-files.json"), changeArtifacts.changed_files);
+    atomicWriteFileSync(join(dir, "diff.patch"), changeArtifacts.diff);
     const summary = {
         changed_files_total: changeArtifacts.changed_files.length,
         additions: changeArtifacts.additions,
         deletions: changeArtifacts.deletions,
         patch_mode: changeArtifacts.patch_mode,
+        diff_redacted: changeArtifacts.diff_redacted === true,
+        diff_redaction_categories: changeArtifacts.diff_redaction_categories ?? [],
         artifact_hygiene: changeArtifacts.artifact_hygiene,
     };
-    writeFileSync(join(dir, "summary.json"), JSON.stringify(summary, null, 2), "utf-8");
-    writeFileSync(join(dir, "summary.md"), formatSummaryMd(changeArtifacts), "utf-8");
+    atomicWriteJsonFileSync(join(dir, "summary.json"), summary);
+    atomicWriteFileSync(join(dir, "summary.md"), formatSummaryMd(changeArtifacts));
     return updateDirectSession(sessionId, {
         finalized: true,
         finalized_at: new Date().toISOString(),
@@ -166,6 +205,58 @@ function extractReason(error) {
         return error.message.slice(0, 80);
     return String(error).slice(0, 80);
 }
+function invalidDirectSessionRecord(sessionId, detail) {
+    return new PatchWardenError("invalid_session_record", `Direct session "${sessionId}" is invalid: ${detail}.`, "Create a new direct session and do not modify its internal session.json file.", true, { session_id: sessionId });
+}
+function getDirectSessionFile(sessionId, config = getConfig()) {
+    const dir = getDirectSessionDir(sessionId, config);
+    return guardPath(join(dir, "session.json"), config.workspaceRoot, config.directSessionsDir);
+}
+function mutateDirectSessionRecord(sessionId, mutation, config = getConfig()) {
+    const file = getDirectSessionFile(sessionId, config);
+    if (!existsSync(file)) {
+        throw new PatchWardenError("session_not_found", `Direct session "${sessionId}" not found.`, "Call create_direct_session first to get a valid session_id.", true, { session_id: sessionId });
+    }
+    return mutateLockedJsonFileSync(file, (current) => {
+        const session = validateDirectSessionRecord(sessionId, current);
+        const next = mutation(session);
+        return { next, result: next };
+    }, {
+        // Session-record appends are short serialized writes. Give Windows
+        // antivirus-delayed lock detachment enough time to finish instead of
+        // dropping concurrent operation or verification evidence.
+        waitMs: 10_000,
+        busyError: () => new PatchWardenError("direct_session_busy", `Direct session "${sessionId}" is currently being updated.`, "Retry after the current Direct operation completes.", true, { session_id: sessionId }),
+    });
+}
+function directSessionBusyOptions(sessionId) {
+    return {
+        waitMs: 0,
+        busyError: () => new PatchWardenError("direct_session_busy", `Direct session "${sessionId}" already has a workspace operation in progress.`, "Wait for the active patch, sync, verification, or finalization to finish, then retry.", true, { session_id: sessionId }),
+    };
+}
+function validateDirectSessionRecord(sessionId, value) {
+    if (!value || typeof value !== "object" || Array.isArray(value)) {
+        throw invalidDirectSessionRecord(sessionId, "session.json must contain an object");
+    }
+    const record = value;
+    if (record.session_id !== sessionId) {
+        throw invalidDirectSessionRecord(sessionId, "session_id does not match its directory");
+    }
+    if (typeof record.resolved_repo_path !== "string" || record.resolved_repo_path.trim() === "") {
+        throw invalidDirectSessionRecord(sessionId, "resolved_repo_path is missing");
+    }
+    if (typeof record.expires_at !== "string" || !Number.isFinite(Date.parse(record.expires_at))) {
+        throw invalidDirectSessionRecord(sessionId, "expires_at is invalid");
+    }
+    if (typeof record.finalized !== "boolean") {
+        throw invalidDirectSessionRecord(sessionId, "finalized must be a boolean");
+    }
+    if (!Array.isArray(record.operations) || !Array.isArray(record.verification_runs)) {
+        throw invalidDirectSessionRecord(sessionId, "operation or verification history is invalid");
+    }
+    return record;
+}
 function formatSummaryMd(artifacts) {
     const lines = [
         "# Direct Session Change Summary",
@@ -174,6 +265,7 @@ function formatSummaryMd(artifacts) {
         `**Additions:** ${artifacts.additions}`,
         `**Deletions:** ${artifacts.deletions}`,
         `**Patch mode:** ${artifacts.patch_mode}`,
+        `**Diff redacted:** ${artifacts.diff_redacted === true ? "yes" : "no"}`,
         "",
         "## Artifact Hygiene",
         "",

package/dist/direct/directVerification.js

@@ -1,10 +1,11 @@
-import { writeFileSync } from "node:fs";
 import { join } from "node:path";
 import { getConfig } from "../config.js";
 import { guardDirectCommand } from "../security/commandGuard.js";
 import { redactSensitiveContent } from "../security/contentRedaction.js";
 import { runSimpleProcess } from "../runner/simpleProcess.js";
+import { resolveTrustedCommandLine } from "../runner/processSecurity.js";
 import { getDirectSessionDir } from "./directSessionStore.js";
+import { atomicWriteJsonFileSync } from "../utils/atomicFile.js";
 const MAX_TAIL_CHARS = 10_000;
 const DEFAULT_TIMEOUT_SECONDS = 120;
 export async function runDirectVerification(input) {
@@ -13,7 +14,7 @@ export async function runDirectVerification(input) {
     const timeoutSeconds = input.timeoutSeconds ?? DEFAULT_TIMEOUT_SECONDS;
     const timeoutMs = timeoutSeconds * 1000;
     // Parse command into command + args
-    const parts = parseCommand(allowedCommand);
+    const parts = parseCommand(allowedCommand, input.resolvedRepoPath);
     if (!parts) {
         throw new Error(`Failed to parse command: "${allowedCommand}"`);
     }
@@ -73,27 +74,18 @@ export async function runDirectVerification(input) {
         ],
         spawn_error: result.spawnError,
     };
-    writeFileSync(join(sessionDir, "verification.json"), JSON.stringify(verificationJson, null, 2), "utf-8");
+    atomicWriteJsonFileSync(join(sessionDir, "verification.json"), verificationJson);
     return { run, log_path: logPath };
 }
 // ── Helpers ────────────────────────────────────────────────────────
-function parseCommand(command) {
+function parseCommand(command, cwd) {
     const trimmed = command.trim();
     if (!trimmed)
         return null;
-    // Simple split by spaces - sufficient for allowlisted commands like "npm test"
-    const parts = trimmed.split(/\s+/);
-    // On Windows, npm/npx are batch files (.cmd) and spawn() cannot find them
-    // without shell resolution. Wrap with cmd.exe /c for those commands.
-    if (process.platform === "win32" && (parts[0] === "npm" || parts[0] === "npx")) {
-        return {
-            command: "cmd",
-            args: ["/c", ...parts],
-        };
-    }
+    const invocation = resolveTrustedCommandLine(trimmed, cwd);
     return {
-        command: parts[0],
-        args: parts.slice(1),
+        command: invocation.command,
+        args: invocation.argsPrefix,
     };
 }
 function truncateTail(content, maxChars) {