patchwarden 1.5.0 → 1.6.1

package/dist/runner/watch.js

@@ -16,14 +16,21 @@
  * Run: node dist/runner/watch.js
  *   or: npm run watch
  */
-import { readdirSync, readFileSync, existsSync, writeFileSync, mkdirSync, renameSync } from "node:fs";
+import { closeSync, existsSync, mkdirSync, openSync, readFileSync, readdirSync, unlinkSync, writeFileSync, } from "node:fs";
 import { resolve, join, dirname } from "node:path";
+import { pathToFileURL } from "node:url";
 import { loadConfig, getConfig, getTasksDir, resolveWorkspaceRoot } from "../config.js";
 import { guardWorkspacePath } from "../security/pathGuard.js";
 import { guardAgentCommand, guardTestCommand } from "../security/commandGuard.js";
 import { validateAssessmentFreshness } from "../assessments/assessmentStore.js";
 import { captureRepoSnapshot } from "./changeCapture.js";
-import { runTask } from "./runTask.js";
+import { mutateTaskStatus } from "./taskStatusStore.js";
+import { logger } from "../logging.js";
+import { redactSensitiveContent } from "../security/contentRedaction.js";
+import { atomicWriteFileSync } from "../utils/atomicFile.js";
+//  Note: `runTask` is imported lazily inside `tick()` via `await import("./runTask.js")`.
+//  This keeps `import { acquireWatcherLock }` side-effect-free for unit tests and
+//  avoids eagerly pulling in the full tools/dispatch graph at module load.
 // ── Bootstrap ─────────────────────────────────────────────────────
 loadConfig();
 const config = getConfig();
@@ -31,34 +38,160 @@ const tasksDir = getTasksDir(config);
 const wsRoot = resolveWorkspaceRoot(config);
 const POLL_INTERVAL_MS = 4000;
 const WATCHER_HEARTBEAT_FILE = join(dirname(tasksDir), "watcher-heartbeat.json");
+const WATCHER_LOCK_FILE = join(dirname(tasksDir), "watcher.lock");
 const WATCHER_STARTED_AT = new Date().toISOString();
 const WATCHER_INSTANCE_ID = process.env.PATCHWARDEN_WATCHER_INSTANCE_ID || `standalone-${process.pid}-${Date.now()}`;
 const WATCHER_LAUNCHER_PID = Number.isInteger(Number(process.env.PATCHWARDEN_WATCHER_LAUNCHER_PID))
     ? Number(process.env.PATCHWARDEN_WATCHER_LAUNCHER_PID)
     : null;
-mkdirSync(dirname(WATCHER_HEARTBEAT_FILE), { recursive: true });
-console.error(`[watcher] Workspace: ${wsRoot}`);
-console.error(`[watcher] Tasks:    ${tasksDir}`);
-console.error(`[watcher] Polling every ${POLL_INTERVAL_MS / 1000}s`);
-console.error(`[watcher] Press Ctrl+C to stop`);
 // Track executed tasks to prevent re-execution
 const executedTasks = new Set();
+let consecutiveTickFailures = 0;
+// ── Single-instance lock ─────────────────────────────────────────
+//  watch.ts is a long-running poller; without a lock, two watchers started
+//  against the same workspace would race on the same pending tasks. The lock
+//  is best-effort: it detects a live PID via process.kill(pid, 0) and refuses
+//  to start when one is found. A dead PID (crashed watcher) is taken over.
+export class WatcherAlreadyRunningError extends Error {
+    constructor(message) {
+        super(message);
+        this.name = "WatcherAlreadyRunningError";
+    }
+}
+function errorCode(error) {
+    return error && typeof error === "object" && "code" in error
+        ? String(error.code || "")
+        : null;
+}
+function readWatcherLock(lockFilePath) {
+    try {
+        const parsed = JSON.parse(readFileSync(lockFilePath, "utf-8"));
+        return parsed && typeof parsed === "object" && !Array.isArray(parsed)
+            ? parsed
+            : null;
+    }
+    catch {
+        return null;
+    }
+}
+function processIsAlive(pid) {
+    try {
+        process.kill(pid, 0);
+        return true;
+    }
+    catch (error) {
+        // EPERM means the process exists but the current user cannot signal it.
+        return errorCode(error) === "EPERM";
+    }
+}
+function runningWatcherError(lockData) {
+    return new WatcherAlreadyRunningError(`[watcher] Already running (pid=${lockData?.pid ?? "unknown"}, instance=${lockData?.instance_id ?? "unknown"}). Exiting.`);
+}
+function createWatcherLockExclusive(lockFilePath, content) {
+    const descriptor = openSync(lockFilePath, "wx", 0o600);
+    let writeError = null;
+    try {
+        writeFileSync(descriptor, content, "utf-8");
+    }
+    catch (error) {
+        writeError = error;
+    }
+    finally {
+        closeSync(descriptor);
+    }
+    if (writeError) {
+        try {
+            unlinkSync(lockFilePath);
+        }
+        catch { /* best effort after a partial write */ }
+        throw writeError;
+    }
+}
+/**
+ * Acquire the watcher lock at `lockFilePath`. If a lock file exists and its
+ * recorded PID is still alive (per `process.kill(pid, 0)`), throws
+ * {@link WatcherAlreadyRunningError}. Otherwise overwrites the lock atomically.
+ *
+ * Exported for unit testing; `lockFilePath` defaults to the module-level
+ * {@link WATCHER_LOCK_FILE} but tests pass a temp path.
+ */
+export function acquireWatcherLock(lockFilePath = WATCHER_LOCK_FILE) {
+    const lockContent = JSON.stringify({
+        pid: process.pid,
+        instance_id: WATCHER_INSTANCE_ID,
+        started_at: WATCHER_STARTED_AT,
+        launcher_pid: WATCHER_LAUNCHER_PID,
+    }, null, 2);
+    try {
+        createWatcherLockExclusive(lockFilePath, lockContent);
+        return;
+    }
+    catch (error) {
+        if (errorCode(error) !== "EEXIST")
+            throw error;
+    }
+    const existing = readWatcherLock(lockFilePath);
+    if (typeof existing?.pid === "number" && processIsAlive(existing.pid)) {
+        throw runningWatcherError(existing);
+    }
+    try {
+        unlinkSync(lockFilePath);
+    }
+    catch (error) {
+        if (errorCode(error) !== "ENOENT")
+            throw error;
+    }
+    try {
+        createWatcherLockExclusive(lockFilePath, lockContent);
+    }
+    catch (error) {
+        if (errorCode(error) === "EEXIST") {
+            throw runningWatcherError(readWatcherLock(lockFilePath));
+        }
+        throw error;
+    }
+}
+export function releaseWatcherLock(lockFilePath = WATCHER_LOCK_FILE, instanceId = WATCHER_INSTANCE_ID, pid = process.pid) {
+    const existing = readWatcherLock(lockFilePath);
+    if (existing?.pid !== pid || existing.instance_id !== instanceId)
+        return false;
+    try {
+        unlinkSync(lockFilePath);
+        return true;
+    }
+    catch (error) {
+        if (errorCode(error) === "ENOENT")
+            return false;
+        throw error;
+    }
+}
+export function createNonOverlappingRunner(operation, onSkipped = () => undefined) {
+    let running = false;
+    return async () => {
+        if (running) {
+            onSkipped();
+            return false;
+        }
+        running = true;
+        try {
+            await operation();
+            return true;
+        }
+        finally {
+            running = false;
+        }
+    };
+}
 // ── Main loop ─────────────────────────────────────────────────────
 async function tick() {
     try {
-        const heartbeatTemporary = `${WATCHER_HEARTBEAT_FILE}.${WATCHER_INSTANCE_ID}.tmp`;
-        writeFileSync(heartbeatTemporary, JSON.stringify({
-            status: "running",
-            pid: process.pid,
-            started_at: WATCHER_STARTED_AT,
-            last_heartbeat_at: new Date().toISOString(),
-            instance_id: WATCHER_INSTANCE_ID,
-            launcher_pid: WATCHER_LAUNCHER_PID,
-        }, null, 2), "utf-8");
-        renameSync(heartbeatTemporary, WATCHER_HEARTBEAT_FILE);
+        writeWatcherHeartbeat("running");
         // Ensure tasks directory exists
-        if (!existsSync(tasksDir))
+        if (!existsSync(tasksDir)) {
+            consecutiveTickFailures = 0;
+            writeWatcherHeartbeat("running");
             return;
+        }
         const entries = readdirSync(tasksDir, { withFileTypes: true });
         const taskDirs = entries.filter((e) => e.isDirectory());
         for (const entry of taskDirs) {
@@ -72,21 +205,34 @@ async function tick() {
                 continue;
             let statusData;
             try {
-                statusData = JSON.parse(readFileSync(statusFile, "utf-8"));
+                const parsed = JSON.parse(readFileSync(statusFile, "utf-8"));
+                if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) {
+                    throw new Error("status.json must contain an object");
+                }
+                statusData = parsed;
             }
-            catch {
-                continue; // corrupted status, skip
+            catch (error) {
+                logger.warn("[watcher] Skipping unreadable task status", {
+                    task_id: taskId,
+                    error: error instanceof Error ? error.message : String(error),
+                });
+                continue;
             }
             if (statusData.status !== "pending")
                 continue;
             // ── Pre-flight safety checks ──
             try {
                 // Check repo_path
-                const resolvedRepoPath = guardWorkspacePath(statusData.resolved_repo_path || statusData.repo_path || wsRoot, wsRoot);
+                const repoPath = typeof statusData.resolved_repo_path === "string"
+                    ? statusData.resolved_repo_path
+                    : typeof statusData.repo_path === "string"
+                        ? statusData.repo_path
+                        : wsRoot;
+                const resolvedRepoPath = guardWorkspacePath(repoPath, wsRoot);
                 // Check agent
-                guardAgentCommand(statusData.agent, config);
+                guardAgentCommand(typeof statusData.agent === "string" ? statusData.agent : "", config);
                 // Check test_command
-                if (statusData.test_command) {
+                if (typeof statusData.test_command === "string" && statusData.test_command) {
                     guardTestCommand(statusData.test_command, config, resolvedRepoPath);
                 }
                 if (Array.isArray(statusData.verify_commands)) {
@@ -95,57 +241,122 @@ async function tick() {
                     }
                 }
                 // Assessment freshness revalidation
-                if (statusData.assessment_id) {
-                    const preExecSnapshot = captureRepoSnapshot(resolvedRepoPath);
-                    const validation = validateAssessmentFreshness(String(statusData.assessment_id), preExecSnapshot);
+                if (typeof statusData.assessment_id === "string" && statusData.assessment_id) {
+                    const preExecSnapshot = await captureRepoSnapshot(resolvedRepoPath);
+                    const validation = validateAssessmentFreshness(statusData.assessment_id, preExecSnapshot);
                     if (!validation.valid) {
                         throw new Error(`assessment validation failed: ${validation.failure_reason}`);
                     }
                 }
             }
             catch (err) {
-                const errMsg = `[watcher] Safety check failed for ${taskId}: ${err instanceof Error ? err.message : String(err)}`;
-                console.error(errMsg);
+                const errMsg = redactSensitiveContent(`[watcher] Safety check failed for ${taskId}: ${err instanceof Error ? err.message : String(err)}`).content;
+                logger.error(errMsg);
                 // Write error and mark as failed so it doesn't get re-picked
                 try {
-                    writeFileSync(join(taskDir, "error.log"), errMsg, "utf-8");
-                    const data = JSON.parse(readFileSync(statusFile, "utf-8"));
-                    data.status = "failed";
-                    data.error = errMsg;
-                    data.updated_at = new Date().toISOString();
-                    writeFileSync(statusFile, JSON.stringify(data, null, 2), "utf-8");
+                    atomicWriteFileSync(join(taskDir, "error.log"), errMsg);
+                    mutateTaskStatus(statusFile, (current) => {
+                        if (current.status !== "pending")
+                            return { result: undefined };
+                        const next = {
+                            ...current,
+                            status: "failed",
+                            error: errMsg,
+                            updated_at: new Date().toISOString(),
+                        };
+                        return { next, result: undefined };
+                    });
+                }
+                catch (err) {
+                    logger.warn("watcher error-log write failed", { error: err instanceof Error ? err.message : String(err) });
                 }
-                catch { }
                 executedTasks.add(taskId);
                 continue;
             }
             // ── Execute ──
-            console.error(`[watcher] Executing: ${taskId}`);
+            logger.info(`[watcher] Executing: ${taskId}`);
             executedTasks.add(taskId);
             try {
+                const { runTask } = await import("./runTask.js");
                 const result = await runTask(taskId);
-                console.error(`[watcher] ${taskId} → ${result.status}`);
+                logger.info(`[watcher] ${taskId} → ${result.status}`);
             }
             catch (err) {
-                console.error(`[watcher] ${taskId} → error: ${err instanceof Error ? err.message : String(err)}`);
+                logger.error(`[watcher] ${taskId} → error: ${err instanceof Error ? err.message : String(err)}`);
             }
         }
+        consecutiveTickFailures = 0;
+        writeWatcherHeartbeat("running");
+    }
+    catch (err) {
+        consecutiveTickFailures += 1;
+        const message = err instanceof Error ? err.message : String(err);
+        logger.error(`[watcher] Tick error (${consecutiveTickFailures} consecutive): ${message}`);
+        try {
+            writeWatcherHeartbeat(consecutiveTickFailures >= 3 ? "degraded" : "running", message);
+        }
+        catch (heartbeatError) {
+            logger.error("[watcher] Failed to persist degraded heartbeat", {
+                error: heartbeatError instanceof Error ? heartbeatError.message : String(heartbeatError),
+            });
+        }
+    }
+}
+function writeWatcherHeartbeat(status, lastError) {
+    atomicWriteFileSync(WATCHER_HEARTBEAT_FILE, JSON.stringify({
+        status,
+        pid: process.pid,
+        started_at: WATCHER_STARTED_AT,
+        last_heartbeat_at: new Date().toISOString(),
+        instance_id: WATCHER_INSTANCE_ID,
+        launcher_pid: WATCHER_LAUNCHER_PID,
+        consecutive_failures: consecutiveTickFailures,
+        last_error: lastError ? lastError.slice(0, 500) : null,
+    }, null, 2));
+}
+// ── Start (only when executed as a script) ─────────────────────────
+//  The bootstrap below has process-wide side effects (mkdir, signal handlers,
+//  polling interval, lock acquisition). Guarding it with a main-module check
+//  keeps `import { acquireWatcherLock }` safe for unit tests — without it,
+//  importing this module would start polling the real tasks dir and register
+//  SIGINT/SIGTERM handlers that interfere with the test runner.
+const isMainModule = !!process.argv[1] && pathToFileURL(process.argv[1]).href === import.meta.url;
+if (isMainModule) {
+    mkdirSync(dirname(WATCHER_HEARTBEAT_FILE), { recursive: true });
+    logger.info(`[watcher] Workspace: ${wsRoot}`);
+    logger.info(`[watcher] Tasks:    ${tasksDir}`);
+    logger.info(`[watcher] Polling every ${POLL_INTERVAL_MS / 1000}s`);
+    logger.info(`[watcher] Press Ctrl+C to stop`);
+    try {
+        acquireWatcherLock(WATCHER_LOCK_FILE);
     }
     catch (err) {
-        console.error(`[watcher] Tick error: ${err instanceof Error ? err.message : String(err)}`);
+        if (err instanceof WatcherAlreadyRunningError) {
+            logger.error(err.message);
+            process.exit(1);
+        }
+        throw err;
+    }
+    logger.info("[watcher] Started");
+    const scheduledTick = createNonOverlappingRunner(tick, () => {
+        logger.warn("[watcher] Previous tick is still running; skipping overlapping poll");
+    });
+    setInterval(() => { void scheduledTick(); }, POLL_INTERVAL_MS);
+    // Run first tick immediately
+    void scheduledTick();
+    // Graceful shutdown
+    function shutdown() {
+        logger.info("[watcher] Stopped");
+        try {
+            releaseWatcherLock(WATCHER_LOCK_FILE);
+        }
+        catch (error) {
+            logger.warn("[watcher] Failed to release watcher lock", {
+                error: error instanceof Error ? error.message : String(error),
+            });
+        }
+        process.exit(0);
     }
+    process.once("SIGINT", shutdown);
+    process.once("SIGTERM", shutdown);
 }
-// ── Start ─────────────────────────────────────────────────────────
-console.error("[watcher] Started");
-setInterval(tick, POLL_INTERVAL_MS);
-// Run first tick immediately
-tick();
-// Graceful shutdown
-process.on("SIGINT", () => {
-    console.error("[watcher] Stopped");
-    process.exit(0);
-});
-process.on("SIGTERM", () => {
-    console.error("[watcher] Stopped");
-    process.exit(0);
-});

package/dist/security/contentRedaction.d.ts

@@ -8,5 +8,11 @@ export interface StructuredRedactionResult<T> {
     redacted: boolean;
     redaction_categories: string[];
 }
+export interface RedactionCategoryCount {
+    category: string;
+    reason: string;
+    count: number;
+}
+export declare function countRedactionsByCategory(input: string): RedactionCategoryCount[];
 export declare function redactSensitiveContent(input: string): RedactionResult;
 export declare function redactSensitiveValue<T>(input: T): StructuredRedactionResult<T>;

package/dist/security/contentRedaction.js

@@ -1,30 +1,52 @@
 const RULES = [
     {
         category: "private_key",
+        reason: "matched private key block",
         pattern: /-----BEGIN [^-\r\n]*PRIVATE KEY-----[\s\S]*?-----END [^-\r\n]*PRIVATE KEY-----/gi,
         replace: "[REDACTED PRIVATE KEY]",
     },
     {
         category: "bearer_token",
+        reason: "matched bearer token",
         pattern: /\bBearer\s+[A-Za-z0-9._~+\/-]{12,}={0,2}/gi,
         replace: "Bearer [REDACTED]",
     },
     {
         category: "npm_token",
+        reason: "matched npm auth token",
         pattern: /(\b_?authToken\s*=\s*)[^\s\r\n]+/gi,
         replace: "$1[REDACTED]",
     },
     {
         category: "credential_assignment",
-        pattern: /\b((?:access[_ -]?token|api[_ -]?key|secret|password|credential|token)\s*[:=]\s*)(["']?)([^\s,"'\]}]{8,})(["']?)/gi,
+        reason: "matched credential assignment",
+        pattern: /\b((?:(?:[A-Za-z][A-Za-z0-9]*[_ -])*(?:access[_ -]?token|refresh[_ -]?token|api[_ -]?key|secret(?:[_ -]?access)?[_ -]?key|client[_ -]?secret|private[_ -]?key|secret|password|credential|token))\s*[:=]\s*)(["']?)([^\s,"'\]}]{8,})(["']?)/gi,
         replace: "$1$2[REDACTED]$4",
     },
     {
         category: "known_token_format",
-        pattern: /\b(?:sk|ghp|github_pat)_[A-Za-z0-9_-]{16,}\b/g,
+        reason: "matched known token format",
+        pattern: /\b(?:sk-(?:proj-|ant-)?[A-Za-z0-9_-]{16,}|sk_[A-Za-z0-9_-]{16,}|gh[pousr]_[A-Za-z0-9_-]{16,}|github_pat_[A-Za-z0-9_-]{16,}|glpat-[A-Za-z0-9_-]{16,}|xox[baprs]-[A-Za-z0-9-]{16,}|(?:hf|npm)_[A-Za-z0-9_-]{16,}|(?:sk|rk)_live_[A-Za-z0-9_-]{16,}|AKIA[0-9A-Z]{16}|AIza[0-9A-Za-z_-]{35}|eyJ[A-Za-z0-9_-]{10,}\.[A-Za-z0-9_-]{10,}\.[A-Za-z0-9_-]{10,})\b/g,
         replace: "[REDACTED TOKEN]",
     },
 ];
+export function countRedactionsByCategory(input) {
+    const counts = new Map();
+    for (const rule of RULES) {
+        rule.pattern.lastIndex = 0;
+        const matches = input.match(rule.pattern);
+        if (matches && matches.length > 0) {
+            counts.set(rule.category, (counts.get(rule.category) || 0) + matches.length);
+        }
+    }
+    const result = [];
+    for (const rule of RULES) {
+        const count = counts.get(rule.category);
+        if (count)
+            result.push({ category: rule.category, reason: rule.reason, count });
+    }
+    return result;
+}
 export function redactSensitiveContent(input) {
     let content = input;
     const categories = [];

package/dist/security/discoveryTokenStore.d.ts

@@ -9,8 +9,8 @@
  * - 不持久化到磁盘（内存 Map，进程内共享，单例）
  * - token 单次使用语义（consumeToken 后即删除）
  */
-import type { ToolRisk } from "../tools/toolRegistry.js";
-import type { ToolProfile } from "../tools/toolCatalog.js";
+import type { ToolRisk } from "../tools/catalog/toolRegistry.js";
+import type { ToolProfile } from "../tools/catalog/toolCatalog.js";
 export interface DiscoveryTokenRecord {
     token: string;
     toolName: string;
@@ -31,6 +31,7 @@ export interface IssueTokenInput {
     allowedScope?: string[];
     ttlMs?: number;
 }
+export declare const MAX_ACTIVE_DISCOVERY_TOKENS = 1024;
 /**
  * 生成并保存 discovery token，返回 token id。
  * token id 格式：dst_{YYYYMMDD}_{randomHex12}

package/dist/security/discoveryTokenStore.js

@@ -13,6 +13,7 @@ import { randomBytes } from "node:crypto";
 import { PatchWardenError } from "../errors.js";
 // ── 常量 ──────────────────────────────────────────────────────────
 const DEFAULT_TTL_MS = 10 * 60 * 1000; // 10 分钟
+export const MAX_ACTIVE_DISCOVERY_TOKENS = 1024;
 // ── 模块级 token store（单例，进程内共享） ───────────────────────
 const tokenStore = new Map();
 // ── 内部工具 ──────────────────────────────────────────────────────
@@ -27,15 +28,29 @@ function generateTokenId() {
     const randomPart = randomBytes(6).toString("hex"); // 12 位 hex
     return `dst_${datePart}_${randomPart}`;
 }
+function pruneTokenStore(nowMs) {
+    for (const [token, record] of tokenStore) {
+        if (Date.parse(record.expiresAt) <= nowMs)
+            tokenStore.delete(token);
+    }
+    while (tokenStore.size >= MAX_ACTIVE_DISCOVERY_TOKENS) {
+        const oldest = tokenStore.keys().next().value;
+        if (!oldest)
+            break;
+        tokenStore.delete(oldest);
+    }
+}
 // ── 公共 API ──────────────────────────────────────────────────────
 /**
  * 生成并保存 discovery token，返回 token id。
  * token id 格式：dst_{YYYYMMDD}_{randomHex12}
  */
 export function issueToken(input) {
-    const now = new Date();
+    const nowMs = Date.now();
+    pruneTokenStore(nowMs);
+    const now = new Date(nowMs);
     const issuedAt = now.toISOString();
-    const expiresAt = new Date(Date.now() + (input.ttlMs ?? DEFAULT_TTL_MS)).toISOString();
+    const expiresAt = new Date(nowMs + (input.ttlMs ?? DEFAULT_TTL_MS)).toISOString();
     const token = generateTokenId();
     const record = {
         token,

package/dist/security/loopbackHost.d.ts

@@ -0,0 +1,2 @@
+/** Validate an HTTP Host header for a service bound to IPv4 loopback. */
+export declare function isTrustedLoopbackHostHeader(value: string | string[] | undefined, expectedPort: number): boolean;

package/dist/security/loopbackHost.js

@@ -0,0 +1,16 @@
+import { firstHeaderValue } from "./secretComparison.js";
+const LOOPBACK_HOST_RE = /^(127\.0\.0\.1|localhost)(?::([0-9]{1,5}))?$/i;
+/** Validate an HTTP Host header for a service bound to IPv4 loopback. */
+export function isTrustedLoopbackHostHeader(value, expectedPort) {
+    const raw = firstHeaderValue(value).trim();
+    const match = LOOPBACK_HOST_RE.exec(raw);
+    if (!match)
+        return false;
+    if (match[2] === undefined)
+        return true;
+    const declaredPort = Number(match[2]);
+    return Number.isInteger(declaredPort)
+        && declaredPort >= 1
+        && declaredPort <= 65_535
+        && declaredPort === expectedPort;
+}

package/dist/security/pathGuard.js

@@ -1,5 +1,5 @@
 import { basename, dirname, isAbsolute, normalize, parse, resolve, sep, } from "node:path";
-import { realpathSync } from "node:fs";
+import { lstatSync, readlinkSync, realpathSync } from "node:fs";
 import { PatchWardenError } from "../errors.js";
 export function guardPath(requestedPath, workspaceRoot, allowedPrefix) {
     const ws = normalize(resolve(workspaceRoot));
@@ -55,7 +55,7 @@ function realPathOrSelf(value) {
         return normalize(value);
     }
 }
-function realPathOrExistingPrefix(candidate) {
+function realPathOrExistingPrefix(candidate, seenLinks = new Set()) {
     const normalized = normalize(candidate);
     const root = parse(normalized).root;
     const suffix = [];
@@ -64,7 +64,33 @@ function realPathOrExistingPrefix(candidate) {
         try {
             return resolve(realpathSync(current), ...suffix);
         }
-        catch {
+        catch (error) {
+            try {
+                const metadata = lstatSync(current);
+                if (metadata.isSymbolicLink()) {
+                    const linkKey = process.platform === "win32" ? current.toLowerCase() : current;
+                    if (seenLinks.has(linkKey)) {
+                        throw new PatchWardenError("workspace_path_escape", `Symbolic link cycle detected while resolving "${candidate}"`, "Remove the cyclic link and use a path inside the configured workspace.", true, { path: candidate, operation: "path_access", safe_alternative: "Use a non-link path inside workspaceRoot." });
+                    }
+                    const nextSeen = new Set(seenLinks);
+                    nextSeen.add(linkKey);
+                    const linkTarget = readlinkSync(current);
+                    const resolvedTarget = isAbsolute(linkTarget)
+                        ? resolve(linkTarget)
+                        : resolve(dirname(current), linkTarget);
+                    return resolve(realPathOrExistingPrefix(resolvedTarget, nextSeen), ...suffix);
+                }
+            }
+            catch (linkError) {
+                if (linkError instanceof PatchWardenError)
+                    throw linkError;
+                const linkCode = linkError.code;
+                if (linkCode !== "ENOENT" && linkCode !== "ENOTDIR")
+                    throw linkError;
+            }
+            const code = error.code;
+            if (code !== "ENOENT" && code !== "ENOTDIR")
+                throw error;
             suffix.unshift(basename(current));
             const parent = dirname(current);
             if (parent === current)
@@ -72,24 +98,13 @@ function realPathOrExistingPrefix(candidate) {
             current = parent;
         }
     }
-    try {
-        return resolve(realpathSync(root || current), ...suffix);
-    }
-    catch {
-        return normalized;
-    }
+    return resolve(realpathSync(root || current), ...suffix);
 }
 function assertInside(candidate, root, requestedPath, message) {
     const normalizedRoot = normalize(root);
     const normalizedCandidate = normalize(candidate);
-    const checkRoot = process.platform === "win32"
-        ? normalizedRoot.toLowerCase()
-        : normalizedRoot;
-    const checkCandidate = process.platform === "win32"
-        ? normalizedCandidate.toLowerCase()
-        : normalizedCandidate;
-    if (checkCandidate !== checkRoot &&
-        !checkCandidate.startsWith(checkRoot + sep)) {
+    if (normalizedCandidate !== normalizedRoot &&
+        !normalizedCandidate.startsWith(normalizedRoot + sep)) {
         if (message.startsWith("Path escapes workspace")) {
             throw new PatchWardenError("workspace_path_escape", `Path escapes workspace: "${requestedPath}" resolves to "${normalizedCandidate}" which is outside "${normalizedRoot}"`, "Use a path inside the configured workspace and allowed prefix.", true, { path: requestedPath, operation: "path_access", safe_alternative: "Read a path inside the configured workspace and allowed prefix." });
         }

package/dist/security/planGuard.js

@@ -1,4 +1,5 @@
 import { PatchWardenError } from "../errors.js";
+import { redactSensitiveContent } from "./contentRedaction.js";
 const PLAN_RULES = [
     {
         id: "plan_secret_access",
@@ -35,7 +36,7 @@ export function guardPlanContent(title, content) {
             throw new PatchWardenError(rule.id, `save_plan blocked content in category "${rule.category}".`, rule.suggestion, true, {
                 operation: "save_plan",
                 matched_category: rule.category,
-                matched_text: match[0].slice(0, 160),
+                matched_text: redactSensitiveContent(match[0]).content.slice(0, 160),
             });
         }
     }