patchwarden 1.5.0 → 1.6.1

package/dist/security/runtimeGuard.js

@@ -1,6 +1,7 @@
 import { resolve, join, dirname } from "node:path";
 import { fileURLToPath } from "node:url";
 import { PatchWardenError } from "../errors.js";
+import { isPathChildOf, isSamePath } from "../utils/platform.js";
 const CRITICAL_RUNTIME_DIRS = ["dist", "src", "scripts", "release"];
 /**
  * Refuse operations against the active PatchWarden runtime directory or its
@@ -8,15 +9,17 @@ const CRITICAL_RUNTIME_DIRS = ["dist", "src", "scripts", "release"];
  * and direct-session flows share the same protection.
  */
 export function guardRuntimeSelfModification(resolvedRepoPath) {
-    const runtimeRoot = resolve(dirname(fileURLToPath(import.meta.url)), "..");
-    if (resolvedRepoPath === runtimeRoot ||
-        resolvedRepoPath.startsWith(runtimeRoot + resolve("/")[0])) {
+    // runtimeGuard lives at <package-root>/{src,dist}/security/runtimeGuard.*.
+    const runtimeRoot = resolve(dirname(fileURLToPath(import.meta.url)), "..", "..");
+    const isRuntimeRoot = isSamePath(resolvedRepoPath, runtimeRoot);
+    if (isRuntimeRoot ||
+        isPathChildOf(resolvedRepoPath, runtimeRoot)) {
         const isCritical = CRITICAL_RUNTIME_DIRS.some((dir) => {
             const full = join(runtimeRoot, dir);
-            return (resolvedRepoPath === full ||
-                resolvedRepoPath.startsWith(full + resolve("/")[0]));
+            return (isSamePath(resolvedRepoPath, full) ||
+                isPathChildOf(resolvedRepoPath, full));
         });
-        if (resolvedRepoPath === runtimeRoot || isCritical) {
+        if (isRuntimeRoot || isCritical) {
             throw new PatchWardenError("runtime_self_modification_blocked", `repo_path points to the active PatchWarden runtime or its critical subdirectories.`, "Use a dev copy or git worktree for PatchWarden development. The running MCP server must not be modified by a task.", true, {
                 operation: "runtime_guard",
                 path: resolvedRepoPath,

package/dist/security/secretComparison.d.ts

@@ -0,0 +1,3 @@
+/** Compare secret text without content-dependent byte comparison. */
+export declare function timingSafeStringEqual(actual: string, expected: string): boolean;
+export declare function firstHeaderValue(value: string | string[] | undefined): string;

package/dist/security/secretComparison.js

@@ -0,0 +1,11 @@
+import { timingSafeEqual } from "node:crypto";
+/** Compare secret text without content-dependent byte comparison. */
+export function timingSafeStringEqual(actual, expected) {
+    const actualBytes = Buffer.from(actual, "utf-8");
+    const expectedBytes = Buffer.from(expected, "utf-8");
+    return actualBytes.length === expectedBytes.length
+        && timingSafeEqual(actualBytes, expectedBytes);
+}
+export function firstHeaderValue(value) {
+    return Array.isArray(value) ? (value[0] || "") : (value || "");
+}

package/dist/security/sensitiveGuard.d.ts

@@ -1,2 +1,7 @@
+/**
+ * Detect a Windows NTFS alternate data stream suffix. The colon in an
+ * absolute drive prefix (for example, C:\\) is the only permitted colon.
+ */
+export declare function hasWindowsAlternateDataStream(filePath: string): boolean;
 export declare function isSensitivePath(filePath: string): boolean;
 export declare function guardSensitivePath(filePath: string): void;

package/dist/security/sensitiveGuard.js

@@ -7,22 +7,28 @@ const SENSITIVE_PATTERNS = [
     // Exact filenames
     /(?:^|[\\/])\.env$/i,
     /(?:^|[\\/])\.env\..+$/i,
+    /(?:^|[\\/])\.envrc$/i,
     /(?:^|[\\/])id_rsa$/i,
+    /(?:^|[\\/])id_dsa$/i,
     /(?:^|[\\/])id_ed25519$/i,
     /(?:^|[\\/])id_ecdsa$/i,
     /(?:^|[\\/])\.ssh[\\/]/i,
     // Credentials / tokens
-    /(?:^|[\\/])credentials/i,
+    /(?:^|[\\/])credentials(?:\.(?:txt|json|ya?ml|toml|ini|cfg|db))?$/i,
     /(?:^|[\\/])\.?aws[\\/]credentials/i,
     /(?:^|[\\/])\.netrc$/i,
     /(?:^|[\\/])\.npmrc$/i,
     /(?:^|[\\/])\.pypirc$/i,
-    /(?:^|[\\/])token/i,
+    /(?:^|[\\/])token$/i,
+    /(?:^|[\\/])tokens?\.(?:txt|json|ya?ml|toml|ini|cfg|db)$/i,
+    /(?:^|[\\/])token[-_](?:store|cache|data|secret|auth|credentials|backup|local|prod|production|dev|development)(?:\.[^\\/]+)?$/i,
+    /(?:^|[\\/])(?:access[_-]?token|refresh[_-]?token|api[_-]?key|client[_-]?secret)(?:\.(?:txt|json|ya?ml|ini|cfg))?$/i,
     // Private keys
     /(?:^|[\\/])[^.]+\.pem$/i,
     /(?:^|[\\/])[^.]+\.key$/i,
     /(?:^|[\\/])[^.]+\.pfx$/i,
     /(?:^|[\\/])[^.]+\.p12$/i,
+    /(?:^|[\\/])[^.]+\.ppk$/i,
     // Browser data
     /(?:^|[\\/])cookies/i,
     /(?:^|[\\/])web data$/i,
@@ -30,17 +36,30 @@ const SENSITIVE_PATTERNS = [
     /(?:^|[\\/])local state$/i,
     // Other sensitive files
     /(?:^|[\\/])\.git-credentials$/i,
+    /(?:^|[\\/])\.git[\\/]config$/i,
     /(?:^|[\\/])\.docker[\\/]config\.json$/i,
     /(?:^|[\\/])\.kube[\\/]config$/i,
+    /(?:^|[\\/])kubeconfig$/i,
+    /(?:^|[\\/])application_default_credentials\.json$/i,
+    /(?:^|[\\/])service[-_]?account(?:[-_][^\\/]+)?\.json$/i,
     /(?:^|[\\/])config\.json$/i, // generic config files often contain local tokens or service credentials
 ];
-// Files specifically inside .patchwarden are always allowed
-const SAFE_PREFIX = ".patchwarden";
+/**
+ * Detect a Windows NTFS alternate data stream suffix. The colon in an
+ * absolute drive prefix (for example, C:\\) is the only permitted colon.
+ */
+export function hasWindowsAlternateDataStream(filePath) {
+    const withoutDrivePrefix = /^[A-Za-z]:[\\/]/.test(filePath)
+        ? filePath.slice(2)
+        : filePath;
+    return withoutDrivePrefix.includes(":");
+}
 export function isSensitivePath(filePath) {
-    // Files inside .patchwarden are always safe
-    const normalized = filePath.replace(/\\/g, "/");
-    if (normalized.includes(`${SAFE_PREFIX}/`) || normalized.endsWith(SAFE_PREFIX)) {
-        return false;
+    if (filePath.includes("\0"))
+        return true;
+    // ADS can hide content behind an otherwise safe-looking filename.
+    if (hasWindowsAlternateDataStream(filePath)) {
+        return true;
     }
     for (const pattern of SENSITIVE_PATTERNS) {
         if (pattern.test(filePath)) {

package/dist/security/toolInvocationGuard.d.ts

@@ -14,8 +14,8 @@
  *
  * 加上 consumeToken 内的 token_not_found / token_expired，共 10 项调用前强制校验。
  */
-import { type PatchWardenToolMeta } from "../tools/toolRegistry.js";
-import type { ToolProfile } from "../tools/toolCatalog.js";
+import { type PatchWardenToolMeta } from "../tools/catalog/toolRegistry.js";
+import type { ToolProfile } from "../tools/catalog/toolCatalog.js";
 import type { DiscoveryTokenRecord } from "./discoveryTokenStore.js";
 export interface GuardInput {
     toolName: string;

package/dist/security/toolInvocationGuard.js

@@ -16,7 +16,7 @@
  */
 import { PatchWardenError } from "../errors.js";
 import { guardSensitivePath } from "./sensitiveGuard.js";
-import { TOOL_RISK_RANK } from "../tools/toolRegistry.js";
+import { TOOL_RISK_RANK } from "../tools/catalog/toolRegistry.js";
 // ── 内部常量 ──────────────────────────────────────────────────────
 /**
  * 常见路径参数字段名，用于 workspace_read_sensitive 校验时扫描 args。

package/dist/security/workspaceRootGuard.d.ts

@@ -0,0 +1,8 @@
+export interface WorkspaceRootValidation {
+    ok: boolean;
+    path: string;
+    reason: string | null;
+    category: "valid" | "missing" | "not_directory" | "unsafe_root";
+}
+export declare function unsafeWorkspaceRootLabel(value: string, userHome?: string): string | null;
+export declare function validateWorkspaceRoot(value: string, userHome?: string): WorkspaceRootValidation;

package/dist/security/workspaceRootGuard.js

@@ -0,0 +1,47 @@
+import { existsSync, realpathSync, statSync } from "node:fs";
+import { homedir } from "node:os";
+import { basename, normalize, resolve, win32 } from "node:path";
+function normalizeInput(value) {
+    return /^[a-z]:[\\/]/i.test(value) ? win32.normalize(value) : normalize(resolve(value));
+}
+function comparable(value) {
+    return normalizeInput(value).replace(/[\\/]+$/, "").toLowerCase();
+}
+export function unsafeWorkspaceRootLabel(value, userHome = homedir()) {
+    const resolved = normalizeInput(value);
+    const trimmed = resolved.replace(/[\\/]+$/, "");
+    const windowsStyle = /^[a-z]:[\\/]/i.test(value) || /^\\\\/.test(value);
+    const leaf = (windowsStyle ? win32.basename(trimmed) : basename(trimmed)).toLowerCase();
+    if (/^[a-z]:$/i.test(trimmed) || trimmed === "" || trimmed === "/")
+        return "drive root";
+    if (comparable(trimmed) === comparable(userHome))
+        return "user home directory";
+    if (leaf === "desktop")
+        return "Desktop";
+    if (leaf === "downloads")
+        return "Downloads";
+    if (leaf === "documents")
+        return "Documents";
+    return null;
+}
+export function validateWorkspaceRoot(value, userHome = homedir()) {
+    const lexicalPath = normalize(resolve(value || "."));
+    if (!existsSync(lexicalPath)) {
+        return { ok: false, path: lexicalPath, reason: "workspaceRoot does not exist", category: "missing" };
+    }
+    let resolved;
+    try {
+        resolved = normalize(realpathSync(lexicalPath));
+        if (!statSync(resolved).isDirectory()) {
+            return { ok: false, path: resolved, reason: "workspaceRoot is not a directory", category: "not_directory" };
+        }
+    }
+    catch {
+        return { ok: false, path: lexicalPath, reason: "workspaceRoot is not accessible", category: "not_directory" };
+    }
+    const unsafeLabel = unsafeWorkspaceRootLabel(resolved, userHome);
+    if (unsafeLabel) {
+        return { ok: false, path: resolved, reason: `workspaceRoot cannot be ${unsafeLabel}`, category: "unsafe_root" };
+    }
+    return { ok: true, path: resolved, reason: null, category: "valid" };
+}