patchwarden 1.5.0 → 1.6.1

package/src/tools/evidencePack.ts

@@ -1,205 +0,0 @@
-import { existsSync, mkdirSync, readdirSync, readFileSync, writeFileSync } from "node:fs";
-import { join, resolve } from "node:path";
-import { getConfig } from "../config.js";
-import { guardReadPath, guardWorkspacePath } from "../security/pathGuard.js";
-import { redactSensitiveValue } from "../security/contentRedaction.js";
-import { getProjectPolicySummary } from "../policy/projectPolicy.js";
-import { getTaskLineage, type SafeTaskLineage } from "./taskLineage.js";
-import { getLastToolCatalogSnapshot } from "./toolCatalog.js";
-import { PATCHWARDEN_VERSION, TOOL_SCHEMA_EPOCH } from "../version.js";
-import { PatchWardenError } from "../errors.js";
-
-export interface SafeEvidencePack {
-  evidence_pack_id: string;
-  lineage_id: string;
-  generated_at: string;
-  path: string;
-  files: {
-    json: string;
-    markdown: string;
-  };
-  lineage: SafeTaskLineage;
-  policy: {
-    valid: boolean;
-    issue_count: number;
-    release_readiness: unknown;
-  };
-  catalog: {
-    server_version: string;
-    schema_epoch: string;
-    tool_profile: string | null;
-    tool_count: number | null;
-    tool_manifest_sha256: string | null;
-  };
-  omitted: string[];
-  next_action: string;
-  bounded: true;
-}
-
-export function exportTaskEvidencePack(input: { lineage_id: string; max_items?: number }): SafeEvidencePack {
-  const lineageId = normalizeLineageId(input.lineage_id);
-  const maxItems = normalizeMaxItems(input.max_items);
-  const config = getConfig();
-  const lineage = getTaskLineage(lineageId, { max_items: maxItems });
-  const packDir = resolve(config.workspaceRoot, ".patchwarden", "evidence-packs", lineageId);
-  guardWorkspacePath(packDir, config.workspaceRoot);
-  mkdirSync(packDir, { recursive: true });
-
-  const policySummary = readPolicySummary(lineage.repo_path);
-  const catalog = safeCatalog();
-  const generatedAt = new Date().toISOString();
-  const safePack = redactSensitiveValue({
-    evidence_pack_id: `evidence_${lineageId}`,
-    lineage_id: lineageId,
-    generated_at: generatedAt,
-    path: packDir,
-    files: {
-      json: join(packDir, "evidence.json"),
-      markdown: join(packDir, "EVIDENCE.md"),
-    },
-    lineage,
-    policy: {
-      valid: policySummary.valid,
-      issue_count: policySummary.issues.length,
-      release_readiness: policySummary.release_readiness,
-    },
-    catalog,
-    omitted: ["stdout", "stderr", "diff", "verification command logs", "full artifact markdown", "sensitive file contents"],
-    next_action: buildNextAction(lineage),
-    bounded: true,
-  }).value as SafeEvidencePack;
-
-  writeFileSync(safePack.files.json, JSON.stringify(safePack, null, 2) + "\n", "utf-8");
-  writeFileSync(safePack.files.markdown, buildEvidenceMarkdown(safePack), "utf-8");
-  return safePack;
-}
-
-export function listEvidencePacks(options: { max_items?: number } = {}): { evidence_packs: SafeEvidencePack[]; total: number; truncated: boolean } {
-  const maxItems = normalizeMaxItems(options.max_items);
-  const config = getConfig();
-  const root = resolve(config.workspaceRoot, ".patchwarden", "evidence-packs");
-  guardWorkspacePath(root, config.workspaceRoot);
-  if (!existsSync(root)) return { evidence_packs: [], total: 0, truncated: false };
-  const packs = readdirSync(root, { withFileTypes: true })
-    .filter((entry) => entry.isDirectory())
-    .map((entry) => readEvidencePack(entry.name))
-    .filter((entry): entry is SafeEvidencePack => entry !== null)
-    .sort((a, b) => b.generated_at.localeCompare(a.generated_at));
-  return {
-    evidence_packs: packs.slice(0, maxItems),
-    total: packs.length,
-    truncated: packs.length > maxItems,
-  };
-}
-
-export function readEvidencePack(lineageId: string): SafeEvidencePack | null {
-  const safeLineageId = normalizeLineageId(lineageId);
-  const config = getConfig();
-  const filePath = resolve(config.workspaceRoot, ".patchwarden", "evidence-packs", safeLineageId, "evidence.json");
-  guardReadPath(filePath, config.workspaceRoot, ".patchwarden/evidence-packs");
-  if (!existsSync(filePath)) return null;
-  const raw = readFileSync(filePath, "utf-8").replace(/^\uFEFF/, "");
-  return redactSensitiveValue(JSON.parse(raw)).value as SafeEvidencePack;
-}
-
-function normalizeLineageId(value: string): string {
-  const lineageId = String(value || "").trim();
-  if (!/^[A-Za-z0-9_-]+$/.test(lineageId)) {
-    throw new PatchWardenError(
-      "invalid_lineage_id",
-      "lineage_id may contain only letters, numbers, underscores, and hyphens.",
-      "Pass a lineage_id returned by run_task_loop.",
-      true,
-      { lineage_id: lineageId }
-    );
-  }
-  return lineageId;
-}
-
-function normalizeMaxItems(value: number | undefined): number {
-  if (value === undefined) return 12;
-  if (!Number.isInteger(value) || value < 1 || value > 50) {
-    throw new Error("max_items must be an integer from 1 to 50.");
-  }
-  return value;
-}
-
-function readPolicySummary(repoPath: string): { valid: boolean; issues: unknown[]; release_readiness: unknown } {
-  try {
-    const policy = getProjectPolicySummary(repoPath || ".");
-    return {
-      valid: Boolean(policy.valid),
-      issues: Array.isArray(policy.issues) ? policy.issues : [],
-      release_readiness: policy.release_readiness || null,
-    };
-  } catch (err) {
-    return {
-      valid: false,
-      issues: [{ code: "policy_unavailable", message: err instanceof Error ? err.message : String(err) }],
-      release_readiness: null,
-    };
-  }
-}
-
-function safeCatalog(): SafeEvidencePack["catalog"] {
-  try {
-    const catalog = getLastToolCatalogSnapshot();
-    if (!catalog) throw new Error("catalog snapshot unavailable");
-    return {
-      server_version: catalog.server_version,
-      schema_epoch: catalog.schema_epoch,
-      tool_profile: catalog.tool_profile,
-      tool_count: catalog.tool_count,
-      tool_manifest_sha256: catalog.tool_manifest_sha256,
-    };
-  } catch {
-    return {
-      server_version: PATCHWARDEN_VERSION,
-      schema_epoch: TOOL_SCHEMA_EPOCH,
-      tool_profile: null,
-      tool_count: null,
-      tool_manifest_sha256: null,
-    };
-  }
-}
-
-function buildNextAction(lineage: SafeTaskLineage): string {
-  if (lineage.stop_reason === "success") return "Use this evidence pack for review or release readiness.";
-  return lineage.next_action || "Review lineage before exporting release evidence.";
-}
-
-function buildEvidenceMarkdown(pack: SafeEvidencePack): string {
-  const direct = pack.lineage.tasks.direct_sessions
-    .map((entry) => `- ${entry.session_id}: status=${entry.status || "unknown"}, audit=${entry.audit_decision || "unknown"}`)
-    .join("\n");
-  const rounds = pack.lineage.rounds
-    .map((round) => `- ${round.role} ${round.task_id}: status=${round.status}, verification=${round.verification_status}, audit=${round.audit_verdict}`)
-    .join("\n");
-  return [
-    "# PatchWarden Evidence Pack",
-    "",
-    `- Evidence pack: ${pack.evidence_pack_id}`,
-    `- Lineage: ${pack.lineage_id}`,
-    `- Generated: ${pack.generated_at}`,
-    `- Final status: ${pack.lineage.final_status}`,
-    `- Stop reason: ${pack.lineage.stop_reason}`,
-    `- Worktree: ${pack.lineage.worktree.isolation_mode} (${pack.lineage.worktree.status})`,
-    `- Tool manifest: ${pack.catalog.tool_manifest_sha256 || "unavailable"}`,
-    "",
-    "## Verification Rounds",
-    rounds || "- None.",
-    "",
-    "## Direct Evidence",
-    direct || "- None.",
-    "",
-    "## Policy And Release",
-    `- Policy valid: ${pack.policy.valid}`,
-    `- Policy issue count: ${pack.policy.issue_count}`,
-    "",
-    "## Omitted",
-    ...pack.omitted.map((item) => `- ${item}`),
-    "",
-    `Next action: ${pack.next_action}`,
-    "",
-  ].join("\n");
-}

package/src/tools/retryTask.ts

@@ -1,53 +0,0 @@
-import { readFileSync, writeFileSync, existsSync } from "node:fs";
-import { join } from "node:path";
-import { getTasksDir, getConfig } from "../config.js";
-import { guardReadPath } from "../security/pathGuard.js";
-import { createTask } from "./createTask.js";
-
-export function retryTask(taskId: string) {
-  const config = getConfig();
-  const tasksDir = getTasksDir(config);
-  const taskDir = join(tasksDir, taskId);
-  const statusFile = join(taskDir, "status.json");
-
-  guardReadPath(statusFile, config.workspaceRoot, config.tasksDir);
-
-  if (!existsSync(statusFile)) {
-    throw new Error(`Task not found: "${taskId}"`);
-  }
-
-  const data = JSON.parse(readFileSync(statusFile, "utf-8"));
-
-  if (!data.plan_id || !data.agent) {
-    throw new Error(`Task "${taskId}" is missing plan_id or agent. Cannot retry.`);
-  }
-
-  // Create a new task with the same parameters
-  const newTask = createTask({
-    plan_id: data.plan_id,
-    agent: data.agent,
-    repo_path: data.repo_path,
-    test_command: data.test_command,
-    verify_commands: data.verify_commands,
-    timeout_seconds: data.timeout_seconds,
-  });
-
-  // Record retry relationship in the new task
-  const newStatusFile = join(newTask.path, "status.json");
-  const newData = JSON.parse(readFileSync(newStatusFile, "utf-8"));
-  newData.retry_of = taskId;
-  newData.retry_count = (data.retry_count || 0) + 1;
-  newData.plan_source = data.plan_source || "saved";
-  newData.template = data.template || null;
-  newData.change_policy = data.change_policy || "repo_scoped_changes";
-  writeFileSync(newStatusFile, JSON.stringify(newData, null, 2), "utf-8");
-
-  return {
-    original_task_id: taskId,
-    new_task_id: newTask.task_id,
-    plan_id: newTask.plan_id,
-    agent: newTask.agent,
-    status: newTask.status,
-    message: `New task created from retry of ${taskId}. Original task is unchanged.`,
-  };
-}

package/src/tools/syncFile.ts

@@ -1,122 +0,0 @@
-import { readFileSync, writeFileSync, existsSync, mkdirSync, statSync } from "node:fs";
-import { createHash } from "node:crypto";
-import { dirname, resolve, relative, isAbsolute } from "node:path";
-import { PatchWardenError } from "../errors.js";
-import { getConfig, type PatchWardenConfig } from "../config.js";
-import { guardDirectPath, guardDirectWritePath } from "../direct/directGuards.js";
-import { guardSensitivePath } from "../security/sensitiveGuard.js";
-import { computeFileSha256 } from "../direct/directPatch.js";
-
-export interface SyncFileResult {
-  source_path: string;
-  target_path: string;
-  before_target_sha256: string | null;
-  after_target_sha256: string;
-  source_sha256: string;
-  copied_bytes: number;
-  changed: boolean;
-}
-
-/**
- * Copy a file from source to target within the same session repo.
- * Both source and target must be inside the session's repo_path.
- */
-export function syncFile(
-  sessionId: string,
-  sourcePath: string,
-  targetPath: string,
-  options?: {
-    expected_source_sha256?: string;
-    expected_target_sha256?: string;
-  },
-  config?: PatchWardenConfig
-): SyncFileResult {
-  const cfg = config || getConfig();
-  const sessionsDir = resolve(cfg.workspaceRoot, cfg.directSessionsDir);
-
-  // Load session to get repo_path
-  const sessionFile = resolve(sessionsDir, sessionId, "session.json");
-  if (!existsSync(sessionFile)) {
-    throw new PatchWardenError(
-      "direct_session_not_found",
-      `Direct session "${sessionId}" not found.`,
-      "Create a direct session first using direct_start_session.",
-      true,
-      { session_id: sessionId }
-    );
-  }
-
-  const session = JSON.parse(readFileSync(sessionFile, "utf-8"));
-  const repoPath = resolve(session.repo_path);
-  const workspaceRoot = cfg.workspaceRoot;
-
-  // Guard source path — must be inside repo
-  const resolvedSource = guardDirectPath(sourcePath, repoPath, workspaceRoot);
-  guardSensitivePath(resolvedSource);
-
-  if (!existsSync(resolvedSource)) {
-    throw new PatchWardenError(
-      "source_file_not_found",
-      `Source file does not exist: "${sourcePath}".`,
-      "Ensure the source path is correct.",
-      true,
-      { source_path: sourcePath }
-    );
-  }
-
-  // Guard target path — must be inside repo, not in blocked dirs
-  const resolvedTarget = guardDirectWritePath(targetPath, repoPath, workspaceRoot);
-  guardSensitivePath(resolvedTarget);
-
-  // Verify source sha256 if provided
-  const sourceSha256 = computeFileSha256(resolvedSource);
-  if (options?.expected_source_sha256 && options.expected_source_sha256 !== sourceSha256) {
-    throw new PatchWardenError(
-      "source_hash_mismatch",
-      `Source file hash mismatch. Expected "${options.expected_source_sha256}" but got "${sourceSha256}".`,
-      "Re-read the source file to get the current sha256.",
-      true,
-      { expected_sha256: options.expected_source_sha256, actual_sha256: sourceSha256 }
-    );
-  }
-
-  // Get target sha256 before copy
-  let beforeTargetSha256: string | null = null;
-  if (existsSync(resolvedTarget)) {
-    beforeTargetSha256 = computeFileSha256(resolvedTarget);
-    // Verify target sha256 if provided
-    if (options?.expected_target_sha256 && options.expected_target_sha256 !== beforeTargetSha256) {
-      throw new PatchWardenError(
-        "target_hash_mismatch",
-        `Target file hash mismatch. Expected "${options.expected_target_sha256}" but got "${beforeTargetSha256}".`,
-        "Re-read the target file to get the current sha256.",
-        true,
-        { expected_sha256: options.expected_target_sha256, actual_sha256: beforeTargetSha256 }
-      );
-    }
-  }
-
-  // Read source content
-  const sourceContent = readFileSync(resolvedSource);
-  const copiedBytes = sourceContent.length;
-
-  // Create target directory if needed
-  mkdirSync(dirname(resolvedTarget), { recursive: true });
-
-  // Write to target
-  writeFileSync(resolvedTarget, sourceContent, "utf-8");
-
-  // Compute after hash
-  const afterTargetSha256 = computeFileSha256(resolvedTarget);
-  const changed = beforeTargetSha256 !== afterTargetSha256;
-
-  return {
-    source_path: sourcePath,
-    target_path: targetPath,
-    before_target_sha256: beforeTargetSha256,
-    after_target_sha256: afterTargetSha256,
-    source_sha256: sourceSha256,
-    copied_bytes: copiedBytes,
-    changed,
-  };
-}