patchwarden 1.5.0 → 1.6.1

package/scripts/checks/build-output-check.js

@@ -0,0 +1,37 @@
+#!/usr/bin/env node
+import assert from "node:assert/strict";
+import { existsSync, mkdirSync, mkdtempSync, rmSync, writeFileSync } from "node:fs";
+import { tmpdir } from "node:os";
+import { relative, resolve } from "node:path";
+import { fileURLToPath } from "node:url";
+import { cleanGeneratedOutput } from "../lib/clean-generated-output.js";
+import { collectMatchingFiles } from "../lib/file-discovery.js";
+
+const root = resolve(fileURLToPath(new URL("../..", import.meta.url)));
+const sourceRoot = resolve(root, "src", "test", "unit");
+const compiledRoot = resolve(root, "dist", "test", "unit");
+
+const sourceTests = collectMatchingFiles(sourceRoot, (name) => name.endsWith(".test.ts"))
+  .map((path) => relative(sourceRoot, path).replace(/\\/g, "/").replace(/\.ts$/, ".js"));
+const compiledTests = collectMatchingFiles(compiledRoot, (name) => name.endsWith(".test.js"))
+  .map((path) => relative(compiledRoot, path).replace(/\\/g, "/"));
+
+assert.deepEqual(compiledTests, sourceTests, "compiled unit tests must exactly match source test paths");
+assert.ok(compiledTests.some((path) => path.includes("/")), "unit discovery must include nested tests");
+
+const fixtureRoot = mkdtempSync(resolve(tmpdir(), "patchwarden-clean-build-"));
+try {
+  const fixtureDist = resolve(fixtureRoot, "dist");
+  const outside = resolve(fixtureRoot, "keep.txt");
+  mkdirSync(fixtureDist);
+  writeFileSync(resolve(fixtureDist, "stale.js"), "stale\n", "utf8");
+  writeFileSync(outside, "keep\n", "utf8");
+  cleanGeneratedOutput(fixtureRoot, fixtureDist);
+  assert.equal(existsSync(fixtureDist), false, "clean build must remove stale dist contents");
+  assert.equal(existsSync(outside), true, "clean build must preserve files outside dist");
+  assert.throws(() => cleanGeneratedOutput(fixtureRoot, resolve(fixtureRoot, "release")), /Refusing/);
+} finally {
+  rmSync(fixtureRoot, { recursive: true, force: true });
+}
+
+console.log(`[build-output-check] OK: ${sourceTests.length} source tests match ${compiledTests.length} compiled tests.`);

package/scripts/checks/control-center-smoke.js

@@ -121,9 +121,9 @@ process.on("SIGTERM", () => {
   process.exit(143);
 });
 
-function httpGet(url) {
+function httpGet(url, headers = {}) {
   return new Promise((resolve, reject) => {
-    const req = http.get(url, (res) => {
+    const req = http.get(url, { headers }, (res) => {
       let data = "";
       res.on("data", (chunk) => (data += chunk));
       res.on("end", () => resolve({ status: res.statusCode, headers: res.headers, body: data }));
@@ -133,6 +133,34 @@ function httpGet(url) {
   });
 }
 
+async function testLoopbackHostBoundary() {
+  const name = "Control Center rejects DNS-rebinding Host headers and cannot be framed";
+  try {
+    const hostileToken = await httpGet(`${BASE_URL}/control-token.json`, {
+      Host: "patchwarden.attacker.invalid",
+    });
+    const hostilePage = await httpGet(`${BASE_URL}/`, {
+      Host: "127.0.0.1.attacker.invalid",
+    });
+    const localPage = await httpGet(`${BASE_URL}/`);
+    const problems = [];
+    if (hostileToken.status !== 421 || hostileToken.body.includes("token")) {
+      problems.push(`hostile token request returned ${hostileToken.status}: ${hostileToken.body.slice(0, 120)}`);
+    }
+    if (hostilePage.status !== 421) problems.push(`hostile page request returned ${hostilePage.status}`);
+    if (localPage.status !== 200) problems.push(`loopback page returned ${localPage.status}`);
+    if (String(localPage.headers["x-frame-options"] || "").toUpperCase() !== "DENY") {
+      problems.push("X-Frame-Options is not DENY");
+    }
+    if (!String(localPage.headers["content-security-policy"] || "").includes("frame-ancestors 'none'")) {
+      problems.push("CSP does not deny frame ancestors");
+    }
+    record(name, problems.length === 0, problems.join("; "));
+  } catch (err) {
+    record(name, false, `error: ${err.message}`);
+  }
+}
+
 function httpPost(url, headers = {}) {
   return new Promise((resolve, reject) => {
     const parsed = new URL(url);
@@ -221,6 +249,12 @@ async function testStaticFiles() {
     const root = await httpGet(`${BASE_URL}/`);
     const vendor = await httpGet(`${BASE_URL}/vendor/tailwindcss-browser.js`);
     const css = await httpGet(`${BASE_URL}/colors_and_type.css`);
+    const desktopCss = await httpGet(`${BASE_URL}/desktop.css`);
+    const desktopBridge = await httpGet(`${BASE_URL}/desktop-bridge.js`);
+    const i18n = await httpGet(`${BASE_URL}/i18n.js`);
+    const gettingStarted = await httpGet(`${BASE_URL}/pages/getting-started.html`);
+    const gettingStartedJs = await httpGet(`${BASE_URL}/getting-started.js`);
+    const settings = await httpGet(`${BASE_URL}/pages/settings.html`);
     const favicon = await httpGet(`${BASE_URL}/favicon.ico`);
 
     const checks = [];
@@ -228,7 +262,8 @@ async function testStaticFiles() {
     const rootCt = root.headers["content-type"] || "";
     if (!rootCt.includes("text/html")) checks.push(`GET / -> Content-Type ${rootCt} (expected text/html)`);
     if (!root.body.includes("setup-checklist-card")) checks.push("dashboard missing setup checklist card");
-    if (!root.body.includes("Show Core / Direct log tails")) checks.push("dashboard activity log is not collapsed behind a summary");
+    if (!root.body.includes("查看 Core / Direct 本次日志尾部")) checks.push("dashboard activity log is not collapsed behind a summary");
+    if (!root.body.includes("pw-dashboard-toolbar")) checks.push("dashboard missing stable desktop toolbar layout");
     if (!root.body.includes("evidence-pack-card")) checks.push("dashboard missing v1.5 evidence pack card");
 
     if (vendor.status !== 200) checks.push(`GET /vendor/tailwindcss-browser.js -> status ${vendor.status}`);
@@ -239,6 +274,31 @@ async function testStaticFiles() {
     const cssCt = css.headers["content-type"] || "";
     if (!cssCt.includes("text/css")) checks.push(`GET /colors_and_type.css -> Content-Type ${cssCt}`);
 
+    if (desktopCss.status !== 200 || !(desktopCss.headers["content-type"] || "").includes("text/css")) {
+      checks.push("desktop refinement stylesheet is not served as CSS");
+    }
+    if (desktopBridge.status !== 200 || !(desktopBridge.headers["content-type"] || "").includes("javascript")) {
+      checks.push("desktop bridge is not served as JavaScript");
+    }
+    if (i18n.status !== 200 || !i18n.body.includes("applyTranslations") || !i18n.body.includes('"zh-CN"') || !i18n.body.includes("en:")) {
+      checks.push("shared Chinese/English translation dictionary is unavailable");
+    }
+    if (gettingStarted.status !== 200 || (gettingStarted.body.match(/class="readiness-item"/g) || []).length !== 4 || !gettingStarted.body.includes("home.manual")) {
+      checks.push("desktop getting-started page is missing its four readiness checks or manual ChatGPT state");
+    }
+    if (gettingStartedJs.status !== 200 || !gettingStartedJs.body.includes('fetchJson("/api/status")') || !gettingStartedJs.body.includes("health_check")) {
+      checks.push("getting-started controller is missing bounded Tunnel status or health_check guidance");
+    }
+    if (settings.status !== 200 || !settings.body.includes("/settings.js")) {
+      checks.push("desktop settings page is unavailable or missing its bounded bridge");
+    }
+    for (const marker of ["detectTunnel", "chooseTunnel", "enableDirectProfile", "proxyScope", "saveRuntime", "tunnelId", "runtimeKey", "provisionTunnel", "forgetCredential", "language"]) {
+      if (!settings.body.includes(marker)) checks.push(`desktop settings missing runtime control: ${marker}`);
+    }
+    if (!desktopBridge.body.includes("patchwardenApplyTheme") || !desktopBridge.body.includes("请求超过 10 秒")) {
+      checks.push("desktop bridge is missing renderer theme propagation or bounded loading timeout");
+    }
+
     if (favicon.status !== 200) checks.push(`GET /favicon.ico -> status ${favicon.status}`);
     const faviconCt = favicon.headers["content-type"] || "";
     if (!faviconCt.includes("image/svg+xml")) checks.push(`GET /favicon.ico -> Content-Type ${faviconCt}`);
@@ -268,6 +328,9 @@ async function testPageNavigationRoutes() {
     "/pages/workspace.html",
     "/pages/audit.html",
     "/pages/task-detail.html?id=smoke",
+    "/settings.html",
+    "/pages/settings.html",
+    "/pages/getting-started.html",
   ];
 
   for (const route of routes) {
@@ -411,6 +474,13 @@ async function testTasksJson() {
     if (!Array.isArray(json.tasks)) problems.push("'tasks' is not an array");
     if (typeof json.total !== "number") problems.push("'total' is not a number");
     if (typeof json.returned !== "number") problems.push("'returned' is not a number");
+    if (!(json.nextCursor === null || typeof json.nextCursor === "string")) problems.push("'nextCursor' is neither null nor string");
+    if (!isObject(json.filters) || !isObject(json.filters.applied) || !isObject(json.filters.options)) problems.push("'filters' contract is missing");
+
+    const traversal = await httpGet(`${BASE_URL}/api/tasks/..%2Foutside`);
+    if (traversal.status !== 400) {
+      problems.push(`encoded task traversal returned ${traversal.status} (expected 400)`);
+    }
 
     if (problems.length === 0) {
       record(name, true);
@@ -823,7 +893,7 @@ async function testStaleTasksApi() {
 
 // ── Test 12: GET /api/workspace/<traversal>/status -> 400 ───────
 async function testWorkspaceRepoPathTraversal() {
-  const name = "Test 12: /api/workspace/<traversal>/status rejected with 400";
+  const name = "Test 12: workspace status rejects traversal without rejecting dotted names";
   // Use percent-encoded dots to bypass URL-parser segment normalization;
   // after decode the repoParam is "../secret" which contains ".." and is
   // rejected by the server's traversal guard.
@@ -833,7 +903,12 @@ async function testWorkspaceRepoPathTraversal() {
     if (res.status === 400) {
       const json = tryJson(res.body);
       if (json && typeof json.error === "string" && /traversal/i.test(json.error)) {
-        record(name, true);
+        const dotted = await httpGet(`${BASE_URL}/api/workspace/release..candidate/status`);
+        if (dotted.status === 404) {
+          record(name, true);
+        } else {
+          record(name, false, `valid dotted repo name returned ${dotted.status} (expected 404 for missing directory)`);
+        }
       } else {
         record(name, false, `status 400 but error field missing/invalid: ${res.body.slice(0, 200)}`);
       }
@@ -882,10 +957,17 @@ async function testDirectSessionsEmptyList() {
     const problems = [];
     if (!Array.isArray(json.sessions)) problems.push("'sessions' is not an array");
     if (typeof json.total !== "number") problems.push("'total' is not a number");
+    if (!(json.nextCursor === null || typeof json.nextCursor === "string")) problems.push("'nextCursor' is neither null nor string");
+    if (!isObject(json.filters) || !isObject(json.filters.options)) problems.push("'filters' contract is missing");
+    if (typeof json.direct_profile_enabled !== "boolean") problems.push("'direct_profile_enabled' is not a boolean");
     if (json.reason !== null && typeof json.reason !== "string") problems.push("'reason' is neither null nor string");
     if (Array.isArray(json.sessions) && json.sessions.length !== json.total) {
       problems.push(`sessions.length (${json.sessions.length}) != total (${json.total})`);
     }
+    const invalidDetail = await httpGet(`${BASE_URL}/api/direct-sessions/invalid.id`);
+    const invalidSummary = await httpGet(`${BASE_URL}/api/direct-sessions/invalid.id/summary`);
+    if (invalidDetail.status !== 400) problems.push(`invalid detail id returned ${invalidDetail.status} (expected 400)`);
+    if (invalidSummary.status !== 400) problems.push(`invalid summary id returned ${invalidSummary.status} (expected 400)`);
     if (problems.length === 0) {
       record(name, true);
     } else {
@@ -915,6 +997,8 @@ async function testLogsTailParam() {
     if (typeof json.stderr !== "string") problems.push("'stderr' is not a string");
     if (json.tail !== 300) problems.push(`'tail' is ${json.tail} (expected 300)`);
     if (json.category !== "core") problems.push(`'category' is ${json.category} (expected "core")`);
+    if (json.historical_snapshot !== true) problems.push("'historical_snapshot' is not true");
+    if (json.redacted !== true) problems.push("'redacted' is not true");
     if (problems.length === 0) {
       record(name, true);
     } else {
@@ -1088,6 +1172,351 @@ async function testControlCenterStatusApi() {
   }
 }
 
+// ── Test 21: GET /api/workspace/repos returns valid JSON with repos array ──
+async function testWorkspaceReposApi() {
+  const name = "Test 21: /api/workspace/repos returns valid JSON with repos array";
+  try {
+    const res = await httpGet(`${BASE_URL}/api/workspace/repos`);
+    if (res.status !== 200) {
+      record(name, false, `status ${res.status} (expected 200)`);
+      return;
+    }
+    const json = tryJson(res.body);
+    if (!json || !isObject(json)) {
+      record(name, false, `body is not a JSON object: ${res.body.slice(0, 200)}`);
+      return;
+    }
+    const problems = [];
+    if (!Array.isArray(json.repos)) problems.push("'repos' is not an array");
+    if (typeof json.workspace_root !== "string" && json.workspace_root !== null) {
+      problems.push("'workspace_root' is neither string nor null");
+    }
+    if (Array.isArray(json.repos)) {
+      for (let i = 0; i < json.repos.length; i++) {
+        const repo = json.repos[i];
+        if (!isObject(repo)) {
+          problems.push(`repos[${i}] is not an object`);
+          continue;
+        }
+        if (typeof repo.name !== "string") problems.push(`repos[${i}].name not string`);
+        if (typeof repo.path !== "string") problems.push(`repos[${i}].path not string`);
+        if (typeof repo.has_package_json !== "boolean") problems.push(`repos[${i}].has_package_json not boolean`);
+      }
+    }
+    if (problems.length === 0) {
+      record(name, true);
+    } else {
+      record(name, false, problems.join("; "));
+    }
+  } catch (err) {
+    record(name, false, `error: ${err.message}`);
+  }
+}
+
+// ── Test 22: /api/release/status no longer mentions release_prepare and has ready_state ──
+async function testReleaseStatusFields() {
+  const name = "Test 22: /api/release/status has ready_state and no release_prepare text";
+  try {
+    const res = await httpGet(`${BASE_URL}/api/release/status?repo_path=.`);
+    if (res.status !== 200) {
+      record(name, false, `status ${res.status} (expected 200)`);
+      return;
+    }
+    const json = tryJson(res.body);
+    if (!json || !isObject(json)) {
+      record(name, false, `body is not a JSON object: ${res.body.slice(0, 200)}`);
+      return;
+    }
+    const problems = [];
+    if (!("ready_state" in json)) problems.push("missing 'ready_state' field");
+    if (typeof json.ready_state !== "string") problems.push("'ready_state' is not a string");
+    if (!("package_name" in json)) problems.push("missing 'package_name' field");
+    if (!("version_source" in json)) problems.push("missing 'version_source' field");
+    if (!("version_consistent" in json)) problems.push("missing 'version_consistent' field");
+    if (!Array.isArray(json.required_commands)) problems.push("'required_commands' is not an array");
+    if (typeof json.commands_blocked_count !== "number") problems.push("'commands_blocked_count' is not a number");
+    // The old misleading "release_prepare" text must no longer appear.
+    if (res.body.includes("release_prepare")) {
+      problems.push("response still contains 'release_prepare' text");
+    }
+    if (Array.isArray(json.required_commands)) {
+      for (let i = 0; i < json.required_commands.length; i++) {
+        const cmd = json.required_commands[i];
+        if (!isObject(cmd)) {
+          problems.push(`required_commands[${i}] is not an object`);
+          continue;
+        }
+        if (typeof cmd.command !== "string") problems.push(`required_commands[${i}].command not string`);
+        if (typeof cmd.allowed !== "boolean") problems.push(`required_commands[${i}].allowed not boolean`);
+        if (!("blocked_reason" in cmd)) problems.push(`required_commands[${i}] missing 'blocked_reason'`);
+      }
+    }
+    if (problems.length === 0) {
+      record(name, true);
+    } else {
+      record(name, false, problems.join("; "));
+    }
+  } catch (err) {
+    record(name, false, `error: ${err.message}`);
+  }
+}
+
+// ── Test 23: Safe task endpoints return valid JSON without full content ──
+async function testSafeTaskEndpoints() {
+  const name = "Test 23: safe task endpoints return valid JSON without stdout/stderr/diff";
+  const endpoints = [
+    "safe-result",
+    "safe-audit",
+    "safe-test-summary",
+    "safe-diff-summary",
+  ];
+  const problems = [];
+  for (const ep of endpoints) {
+    try {
+      const res = await httpGet(`${BASE_URL}/api/tasks/nonexistent-smoke-task/${ep}`);
+      if (res.status !== 200) {
+        problems.push(`/api/tasks/:id/${ep} -> status ${res.status} (expected 200, not 500)`);
+        continue;
+      }
+      const json = tryJson(res.body);
+      if (!json || !isObject(json)) {
+        problems.push(`/api/tasks/:id/${ep} body is not a JSON object: ${res.body.slice(0, 120)}`);
+        continue;
+      }
+      // Safe endpoints must NOT expose full stdout/stderr/diff content.
+      const text = res.body.toLowerCase();
+      if (text.includes('"stdout"') && text.includes('"stderr"')) {
+        // Some safe endpoints may include a "stdout" key as a bounded field; the
+        // invariant we care about is that they don't return the full raw logs.
+        // We only flag if both stdout AND stderr appear together (log-shaped).
+        problems.push(`/api/tasks/:id/${ep} may leak stdout+stderr shaped fields`);
+      }
+      if (text.includes('"diff_patch"')) {
+        problems.push(`/api/tasks/:id/${ep} leaks 'diff_patch' field`);
+      }
+    } catch (err) {
+      problems.push(`/api/tasks/:id/${ep} error: ${err.message}`);
+    }
+  }
+  if (problems.length === 0) {
+    record(name, true);
+  } else {
+    record(name, false, problems.join("; "));
+  }
+}
+
+// ── Test 24: /api/tasks?status=running returns valid filtered JSON ──
+async function testTasksFilter() {
+  const name = "Test 24: /api/tasks?status=running returns valid filtered JSON";
+  try {
+    const res = await httpGet(`${BASE_URL}/api/tasks?status=running`);
+    if (res.status !== 200) {
+      record(name, false, `status ${res.status} (expected 200)`);
+      return;
+    }
+    const json = tryJson(res.body);
+    if (!json || !isObject(json)) {
+      record(name, false, `body is not a JSON object: ${res.body.slice(0, 200)}`);
+      return;
+    }
+    const problems = [];
+    if (!Array.isArray(json.tasks)) problems.push("'tasks' is not an array");
+    if (typeof json.total !== "number") problems.push("'total' is not a number");
+    if (typeof json.returned !== "number") problems.push("'returned' is not a number");
+    // Every returned task must match the filter (if any tasks exist).
+    if (Array.isArray(json.tasks)) {
+      for (let i = 0; i < json.tasks.length; i++) {
+        if (json.tasks[i].status !== "running") {
+          problems.push(`tasks[${i}].status is '${json.tasks[i].status}' (expected 'running')`);
+        }
+      }
+      if (json.tasks.length !== json.total) {
+        problems.push(`tasks.length (${json.tasks.length}) != total (${json.total})`);
+      }
+    }
+    if (problems.length === 0) {
+      record(name, true);
+    } else {
+      record(name, false, problems.join("; "));
+    }
+  } catch (err) {
+    record(name, false, `error: ${err.message}`);
+  }
+}
+
+// ── Test 25: /api/tasks/stale has explanation and next_action on stale tasks ──
+async function testStaleTasksExplanation() {
+  const name = "Test 25: /api/tasks/stale stale tasks have explanation and next_action";
+  try {
+    const res = await httpGet(`${BASE_URL}/api/tasks/stale`);
+    if (res.status !== 200) {
+      record(name, false, `status ${res.status} (expected 200)`);
+      return;
+    }
+    const json = tryJson(res.body);
+    if (!json || !isObject(json)) {
+      record(name, false, `body is not a JSON object: ${res.body.slice(0, 200)}`);
+      return;
+    }
+    const problems = [];
+    if (!Array.isArray(json.stale_tasks)) problems.push("'stale_tasks' is not an array");
+    if (Array.isArray(json.stale_tasks) && json.stale_tasks.length > 0) {
+      for (let i = 0; i < json.stale_tasks.length; i++) {
+        const t = json.stale_tasks[i];
+        if (!isObject(t)) {
+          problems.push(`stale_tasks[${i}] is not an object`);
+          continue;
+        }
+        if (typeof t.explanation !== "string" || t.explanation.length === 0) {
+          problems.push(`stale_tasks[${i}] missing 'explanation' string`);
+        }
+        if (typeof t.next_action !== "string" || t.next_action.length === 0) {
+          problems.push(`stale_tasks[${i}] missing 'next_action' string`);
+        }
+        if (typeof t.reason_code !== "string") {
+          problems.push(`stale_tasks[${i}] missing 'reason_code' string`);
+        }
+      }
+    }
+    if (problems.length === 0) {
+      record(name, true);
+    } else {
+      record(name, false, problems.join("; "));
+    }
+  } catch (err) {
+    record(name, false, `error: ${err.message}`);
+  }
+}
+
+// ── Test 26: POST /api/tasks/:taskId/hide-stale token gate + valid response ──
+async function testHideStaleNoToken() {
+  const name = "Test 26: POST /api/tasks/:taskId/hide-stale without token -> 403";
+  try {
+    const res = await httpPost(`${BASE_URL}/api/tasks/nonexistent/hide-stale`, {});
+    if (res.status !== 403) {
+      record(name, false, `status ${res.status} (expected 403 — token gate must fire before hide-stale runs)`);
+      return;
+    }
+    const json = tryJson(res.body);
+    if (!json || typeof json.error !== "string") {
+      record(name, false, `response body missing 'error' field: ${res.body.slice(0, 200)}`);
+      return;
+    }
+    record(name, true);
+  } catch (err) {
+    record(name, false, `error: ${err.message}`);
+  }
+}
+
+async function testHideStaleWithToken(token) {
+  const name = "Test 27: POST /api/tasks/:taskId/hide-stale with token returns valid JSON";
+  try {
+    const res = await httpPost(`${BASE_URL}/api/tasks/nonexistent/hide-stale`, {
+      "X-PatchWarden-Control-Token": token,
+    });
+    if (res.status !== 200) {
+      record(name, false, `status ${res.status} (expected 200)`);
+      return;
+    }
+    const json = tryJson(res.body);
+    if (!json || !isObject(json)) {
+      record(name, false, `body is not a JSON object: ${res.body.slice(0, 200)}`);
+      return;
+    }
+    if (json.ok !== true) {
+      record(name, false, `expected ok=true, got: ${res.body.slice(0, 200)}`);
+      return;
+    }
+    if (json.hidden !== "nonexistent") {
+      record(name, false, `expected hidden='nonexistent', got: ${json.hidden}`);
+      return;
+    }
+    record(name, true);
+  } catch (err) {
+    record(name, false, `error: ${err.message}`);
+  }
+}
+
+// ── Test 28: GET /api/warnings returns valid JSON ───────────────
+async function testWarningsApi() {
+  const name = "Test 28: /api/warnings returns valid JSON with warnings array";
+  try {
+    const res = await httpGet(`${BASE_URL}/api/warnings`);
+    if (res.status !== 200) {
+      record(name, false, `status ${res.status} (expected 200)`);
+      return;
+    }
+    const json = tryJson(res.body);
+    if (!json || !isObject(json)) {
+      record(name, false, `body is not a JSON object: ${res.body.slice(0, 200)}`);
+      return;
+    }
+    const problems = [];
+    if (!Array.isArray(json.warnings)) problems.push("'warnings' is not an array");
+    if (typeof json.total !== "number") problems.push("'total' is not a number");
+    if (Array.isArray(json.warnings)) {
+      for (let i = 0; i < json.warnings.length; i++) {
+        const w = json.warnings[i];
+        if (!isObject(w)) {
+          problems.push(`warnings[${i}] is not an object`);
+          continue;
+        }
+        if (typeof w.type !== "string") problems.push(`warnings[${i}].type is not a string`);
+        if (typeof w.severity !== "string") problems.push(`warnings[${i}].severity is not a string`);
+        if (typeof w.affected_tasks_count !== "number") problems.push(`warnings[${i}].affected_tasks_count is not a number`);
+        if (typeof w.recommended_action !== "string") problems.push(`warnings[${i}].recommended_action is not a string`);
+      }
+    }
+    if (problems.length === 0) {
+      record(name, true);
+    } else {
+      record(name, false, problems.join("; "));
+    }
+  } catch (err) {
+    record(name, false, `error: ${err.message}`);
+  }
+}
+
+// ── Test 29: GET /api/diagnostics returns valid JSON with redaction ─
+async function testDiagnosticsApi() {
+  const name = "Test 29: /api/diagnostics returns valid JSON with required fields and redaction";
+  try {
+    const res = await httpGet(`${BASE_URL}/api/diagnostics`);
+    if (res.status !== 200) {
+      record(name, false, `status ${res.status} (expected 200)`);
+      return;
+    }
+    const json = tryJson(res.body);
+    if (!json || !isObject(json)) {
+      record(name, false, `body is not a JSON object: ${res.body.slice(0, 200)}`);
+      return;
+    }
+    const problems = [];
+    if (typeof json.server_version !== "string") problems.push("'server_version' is not a string");
+    if (typeof json.schema_epoch !== "string") problems.push("'schema_epoch' is not a string");
+    if (typeof json.watcher_status !== "string") problems.push("'watcher_status' is not a string");
+    if (typeof json.workspace_root !== "string" && json.workspace_root !== null) {
+      problems.push("'workspace_root' is neither string nor null");
+    }
+    if (typeof json.direct_profile_enabled !== "boolean") problems.push("'direct_profile_enabled' is not a boolean");
+    // Redaction: response body must not contain sensitive keywords
+    const lower = res.body.toLowerCase();
+    const forbidden = ["token", "password", "secret", "credential", "api_key"];
+    for (const word of forbidden) {
+      if (lower.includes(word)) {
+        problems.push(`response body contains forbidden word '${word}' (redaction failure)`);
+      }
+    }
+    if (problems.length === 0) {
+      record(name, true);
+    } else {
+      record(name, false, problems.join("; "));
+    }
+  } catch (err) {
+    record(name, false, `error: ${err.message}`);
+  }
+}
+
 async function main() {
   // Sanity: ensure the compiled server exists before spawning.
   if (!existsSync(serverPath) || !statSync(serverPath).isFile()) {
@@ -1095,7 +1524,7 @@ async function main() {
     process.exit(1);
   }
 
-  child = spawn("node", [serverPath], {
+  child = spawn(process.execPath, [serverPath], {
     cwd: projectRoot,
     env: {
       ...process.env,
@@ -1135,6 +1564,7 @@ async function main() {
     console.log(`[control-center-smoke] server ready at ${BASE_URL}`);
 
     await testStaticFiles();
+    await testLoopbackHostBoundary();
     await testPageNavigationRoutes();
     await testStatusJson();
     await testTasksJson();
@@ -1159,6 +1589,17 @@ async function main() {
     await testControlCenterLogApi();
     await testRestartAllNoToken();
     await testControlCenterStatusApi();
+    // v1.5.1 Dashboard UI optimization coverage
+    await testWorkspaceReposApi();
+    await testReleaseStatusFields();
+    await testSafeTaskEndpoints();
+    await testTasksFilter();
+    await testStaleTasksExplanation();
+    await testHideStaleNoToken();
+    if (token) await testHideStaleWithToken(token);
+    // P1 Task 10/11 coverage
+    await testWarningsApi();
+    await testDiagnosticsApi();
 
     // Use token to silence unused-var linters and confirm we actually fetched it.
     if (token) {

package/scripts/checks/control-smoke.js

@@ -139,12 +139,13 @@ try {
 
   const expectedFiles = [
     "PatchWarden.cmd",
-    "PatchWarden-Control.cmd",
-    "PatchWarden-Control-Tray.cmd",
-    "PatchWarden-Desktop.cmd",
-    "Restart-PatchWarden-Control.cmd",
-    "Stop-PatchWarden.cmd",
+    "scripts/launchers/PatchWarden-Control.cmd",
+    "scripts/launchers/PatchWarden-Control-Tray.cmd",
+    "scripts/launchers/PatchWarden-Desktop.cmd",
+    "scripts/launchers/Restart-PatchWarden-Control.cmd",
+    "scripts/launchers/Stop-PatchWarden.cmd",
     "scripts/control/manage-patchwarden.ps1",
+    "scripts/control/run-background-supervisor.ps1",
     "scripts/control/stop-patchwarden.ps1",
     "scripts/launchers/Start-PatchWarden-Tunnel.cmd",
     "scripts/launchers/Start-PatchWarden-Direct-Tunnel.cmd",
@@ -158,14 +159,24 @@ try {
   if (!rootEntry.includes("manage-patchwarden.ps1")) {
     throw new Error("PatchWarden.cmd does not invoke the consolidated manager");
   }
-  const stopEntry = readFileSync(join(root, "Stop-PatchWarden.cmd"), "utf8");
-  if (!stopEntry.includes("scripts\\control\\stop-patchwarden.ps1")) {
+  const stopEntry = readFileSync(join(root, "scripts", "launchers", "Stop-PatchWarden.cmd"), "utf8");
+  if (!stopEntry.includes("control\\stop-patchwarden.ps1")) {
     throw new Error("Stop-PatchWarden.cmd does not invoke the one-click shutdown script");
   }
-  const desktopEntry = readFileSync(join(root, "PatchWarden-Desktop.cmd"), "utf8");
+  const desktopEntry = readFileSync(join(root, "scripts", "launchers", "PatchWarden-Desktop.cmd"), "utf8");
   if (!desktopEntry.includes("control-center-tray.ps1") || !desktopEntry.includes("WindowStyle Hidden")) {
     throw new Error("PatchWarden-Desktop.cmd must launch the tray hidden as the daily desktop entry");
   }
+  const managerSource = readFileSync(manager, "utf8");
+  const wrapperSource = readFileSync(join(root, "scripts", "control", "run-background-supervisor.ps1"), "utf8");
+  for (const expected of ["supervisor-status.json", "supervisor.stdout.log", "supervisor.stderr.log", "run-background-supervisor.ps1", "Write-BackgroundStartingState"]) {
+    if (!managerSource.includes(expected)) {
+      throw new Error(`background manager is missing supervisor observability: ${expected}`);
+    }
+  }
+  if (!wrapperSource.includes("1> $stdout 2> $stderr") || wrapperSource.includes("CONTROL_PLANE_API_KEY")) {
+    throw new Error("background wrapper must redirect supervisor logs without credential arguments");
+  }
   console.log("ok - control handles orphan cleanup, scoped kill, port conflicts, health fallback, and Core/Direct lifecycle actions");
 } finally {
   if (fakeTunnel?.exitCode === null) fakeTunnel.kill();