patchwarden 1.5.0 → 1.6.1

package/scripts/release/pack-clean.js

@@ -1,6 +1,6 @@
 #!/usr/bin/env node
 import {
-  cpSync,
+  copyFileSync,
   existsSync,
   mkdirSync,
   readFileSync,
@@ -16,7 +16,8 @@ import { fileURLToPath } from "node:url";
 
 const scriptDir = resolve(fileURLToPath(new URL(".", import.meta.url)));
 const root = resolve(scriptDir, "..", "..");
-const releaseDir = resolve(root, "release");
+const releaseRoot = resolve(root, "release");
+const releaseDir = resolve(releaseRoot, "package");
 const archivePath = resolve(root, "patchwarden-release.tar.gz");
 
 // Read version from package.json for zip naming
@@ -31,11 +32,6 @@ const include = [
   "src",
   "ui",
   "PatchWarden.cmd",
-  "PatchWarden-Control.cmd",
-  "PatchWarden-Control-Tray.cmd",
-  "PatchWarden-Desktop.cmd",
-  "Restart-PatchWarden-Control.cmd",
-  "Stop-PatchWarden.cmd",
   ".gitignore",
   "LICENSE",
   "README.md",
@@ -57,6 +53,8 @@ const forbidden = [
   /(^|[\\/])\.env$/,
   /\.log$/,
   /^docs[\\/]optimization-proposal\.md$/i,
+  /^docs[\\/]archive(?:[\\/]|$)/i,
+  /^(?:dist|src)[\\/]test(?:[\\/]|$)/i,
   /(^|[\\/])kill-patchwarden\.(cmd|ps1)$/i,
 ];
 
@@ -173,9 +171,15 @@ function readZipEntryNames(zipPath) {
   return names;
 }
 
+const stageRelativeToRoot = toPosix(relative(root, releaseDir));
+if (stageRelativeToRoot !== "release/package") {
+  throw new Error(`Refusing to clean non-isolated release staging path: ${stageRelativeToRoot}`);
+}
+
 console.log("[pack-clean] Preparing clean release directory...");
 rmSync(releaseDir, { recursive: true, force: true });
 rmSync(archivePath, { force: true });
+mkdirSync(releaseRoot, { recursive: true });
 mkdirSync(releaseDir, { recursive: true });
 
 for (const item of include) {
@@ -185,17 +189,26 @@ for (const item of include) {
     console.log(`  skip missing: ${item}`);
     continue;
   }
-  cpSync(source, target, {
-    recursive: true,
-    filter(sourcePath) {
-      const rel = toPosix(relative(root, sourcePath));
-      return !isForbidden(rel);
-    },
-  });
+  copyAllowedEntry(source, target);
   console.log(`  copied: ${item}`);
 }
 
+// Keep an independent second boundary before the fail-closed validation. This
+// protects package contents if a future copy implementation changes behavior.
+pruneForbiddenEntries(releaseDir);
+
 const releaseFiles = listFiles(releaseDir);
+const requiredReleaseEntries = ["package.json", "README.md", "dist/index.js"];
+const missingReleaseEntries = requiredReleaseEntries.filter(
+  (entry) => !existsSync(resolve(releaseDir, entry))
+);
+if (releaseFiles.length === 0 || missingReleaseEntries.length > 0) {
+  console.error("[pack-clean] Release directory is incomplete:");
+  for (const entry of missingReleaseEntries) {
+    console.error(`  missing: ${entry}`);
+  }
+  process.exit(1);
+}
 const badReleaseEntries = releaseFiles.filter((file) =>
   isForbidden(toPosix(relative(releaseDir, file)))
 );
@@ -296,6 +309,38 @@ function listFiles(dir) {
   return entries;
 }
 
+function copyAllowedEntry(source, target) {
+  const rel = toPosix(relative(root, source));
+  if (isForbidden(rel)) {
+    return;
+  }
+
+  const stat = statSync(source);
+  if (stat.isDirectory()) {
+    mkdirSync(target, { recursive: true });
+    for (const name of readdirSync(source)) {
+      copyAllowedEntry(join(source, name), join(target, name));
+    }
+    return;
+  }
+
+  copyFileSync(source, target);
+}
+
+function pruneForbiddenEntries(dir) {
+  for (const name of readdirSync(dir)) {
+    const fullPath = join(dir, name);
+    const rel = toPosix(relative(releaseDir, fullPath));
+    if (isForbidden(rel)) {
+      rmSync(fullPath, { recursive: true, force: true });
+      continue;
+    }
+    if (statSync(fullPath).isDirectory()) {
+      pruneForbiddenEntries(fullPath);
+    }
+  }
+}
+
 function isForbidden(value) {
   return forbidden.some((pattern) => pattern.test(value));
 }

package/src/assessments/agentAssessor.ts

@@ -1,10 +1,11 @@
-import { writeFileSync } from "node:fs";
-import { resolve, relative, isAbsolute } from "node:path";
+import { resolve, relative, isAbsolute, sep } from "node:path";
 import { PatchWardenConfig } from "../config.js";
 import { buildAgentInvocation, buildAssessmentPrompt } from "../runner/agentInvocation.js";
 import { runSimpleProcessSync } from "../runner/simpleProcess.js";
 import { captureRepoSnapshot, compareSnapshots, type RepoSnapshot, type ChangedFile } from "../runner/changeCapture.js";
 import type { AgentAssessmentOutput, AgentAssessmentSummary } from "./assessmentStore.js";
+import { atomicWriteFileSync, atomicWriteJsonFileSync } from "../utils/atomicFile.js";
+import { redactSensitiveContent } from "../security/contentRedaction.js";
 
 const ASSESSMENT_MARKER = "===ASSESSMENT_JSON===";
 
@@ -21,7 +22,7 @@ export interface AgentAssessorInput {
   config: PatchWardenConfig;
 }
 
-export function runAgentAssessment(input: AgentAssessorInput): AgentAssessmentSummary {
+export async function runAgentAssessment(input: AgentAssessorInput): Promise<AgentAssessmentSummary> {
   const logPaths: AgentAssessmentSummary["log_paths"] = {
     stdout: resolve(input.assessmentDir, "agent-assessment-stdout.log"),
     stderr: resolve(input.assessmentDir, "agent-assessment-stderr.log"),
@@ -45,15 +46,17 @@ export function runAgentAssessment(input: AgentAssessorInput): AgentAssessmentSu
   };
 
   // ── 1. Build prompt and write to file for {prompt_file} support ──
-  const assessmentPrompt = buildAssessmentPrompt(input.goal, input.planContent, input.repoPath);
+  const safeGoal = redactSensitiveContent(input.goal).content.slice(0, 10_000);
+  const safePlan = redactSensitiveContent(input.planContent).content.slice(0, 1024 * 1024);
+  const assessmentPrompt = buildAssessmentPrompt(safeGoal, safePlan, input.repoPath);
   const promptFilePath = resolve(input.assessmentDir, "agent-assessment-prompt.md");
-  writeFileSync(promptFilePath, assessmentPrompt, "utf-8");
+  atomicWriteFileSync(promptFilePath, assessmentPrompt);
   logPaths.prompt = promptFilePath;
 
   // ── 2. Before snapshot (repo-scoped) ──
   let repoBefore: RepoSnapshot;
   try {
-    repoBefore = captureRepoSnapshot(input.repoPath);
+    repoBefore = await captureRepoSnapshot(input.repoPath);
   } catch {
     // If we can't capture before snapshot, conservatively skip agent assessment
     emptySummary.status = "spawn_failed";
@@ -89,13 +92,15 @@ export function runAgentAssessment(input: AgentAssessorInput): AgentAssessmentSu
     maxStderrBytes: Math.max(16384, Math.floor(input.maxOutputBytes / 4)),
     stdoutPath: logPaths.stdout,
     stderrPath: logPaths.stderr,
+    environmentVariableNames: invocation.environmentVariableNames,
+    blockedEnvironmentVariableNames: invocation.blockedEnvironmentVariableNames,
   });
 
   // ── 5. After snapshot + read-only violation check ──
   let readOnlyViolation = false;
   let violationFiles: string[] = [];
   try {
-    const repoAfter = captureRepoSnapshot(input.repoPath);
+    const repoAfter = await captureRepoSnapshot(input.repoPath);
     const changes = compareSnapshots(repoBefore, repoAfter);
     if (changes.length > 0) {
       readOnlyViolation = true;
@@ -123,11 +128,11 @@ export function runAgentAssessment(input: AgentAssessorInput): AgentAssessmentSu
       stderr_truncated: result.stderrTruncated,
       log_paths: { ...logPaths, violation: resolve(input.assessmentDir, "agent-assessment-violation.json") },
     };
-    writeFileSync(summary.log_paths.violation!, JSON.stringify({
+    atomicWriteJsonFileSync(summary.log_paths.violation!, {
       violation: "read_only_violation",
       files: violationFiles,
       exit_code: result.exitCode,
-    }, null, 2), "utf-8");
+    });
     writeSummary(logPaths.assessment, summary);
     return summary;
   }
@@ -253,12 +258,16 @@ function parseAssessmentJson(stdout: string, repoPath: string): ParsedAssessment
   const jsonEnd = jsonText.lastIndexOf("}");
   if (jsonStart < 0 || jsonEnd < 0 || jsonEnd <= jsonStart) return { output: null, sanitized_reasons };
 
-  let parsed: any;
+  let parsedValue: unknown;
   try {
-    parsed = JSON.parse(jsonText.slice(jsonStart, jsonEnd + 1));
+    parsedValue = JSON.parse(jsonText.slice(jsonStart, jsonEnd + 1));
   } catch {
     return { output: null, sanitized_reasons };
   }
+  if (!parsedValue || typeof parsedValue !== "object" || Array.isArray(parsedValue)) {
+    return { output: null, sanitized_reasons };
+  }
+  const parsed = parsedValue as Record<string, unknown>;
 
   // ── Strict validation ──
   if (parsed.risk_level !== "low" && parsed.risk_level !== "medium" && parsed.risk_level !== "high") {
@@ -272,7 +281,9 @@ function parseAssessmentJson(stdout: string, repoPath: string): ParsedAssessment
 
   if (!Array.isArray(parsed.reason_codes)) return { output: null, sanitized_reasons };
   if (parsed.reason_codes.length > 50) return { output: null, sanitized_reasons };
-  const reasonCodes = parsed.reason_codes.filter((r: any) => typeof r === "string" && r.length <= 100);
+  const reasonCodes = parsed.reason_codes.filter((reason): reason is string =>
+    typeof reason === "string" && reason.length <= 100
+  );
   if (reasonCodes.length !== parsed.reason_codes.length) {
     sanitized_reasons.push("reason_codes_filtered");
   }
@@ -287,7 +298,10 @@ function parseAssessmentJson(stdout: string, repoPath: string): ParsedAssessment
     if (isAbsolute(p)) { pathsSanitized = true; continue; }
     const resolved = resolve(repoPath, p);
     const rel = relative(repoPath, resolved);
-    if (rel.startsWith("..")) { pathsSanitized = true; continue; }
+    if (rel === ".." || rel.startsWith(`..${sep}`) || isAbsolute(rel)) {
+      pathsSanitized = true;
+      continue;
+    }
     affectedPaths.push(p);
   }
   if (pathsSanitized) {
@@ -297,7 +311,7 @@ function parseAssessmentJson(stdout: string, repoPath: string): ParsedAssessment
   if (!Array.isArray(parsed.destructive_actions)) return { output: null, sanitized_reasons };
   if (parsed.destructive_actions.length > 20) return { output: null, sanitized_reasons };
   const destructiveActions = parsed.destructive_actions.filter(
-    (d: any) => typeof d === "string" && d.length <= 200
+    (action): action is string => typeof action === "string" && action.length <= 200
   );
 
   if (typeof parsed.requires_user_confirm !== "boolean") return { output: null, sanitized_reasons };
@@ -320,5 +334,5 @@ function parseAssessmentJson(stdout: string, repoPath: string): ParsedAssessment
 }
 
 function writeSummary(path: string, summary: AgentAssessmentSummary): void {
-  writeFileSync(path, JSON.stringify(summary, null, 2), "utf-8");
+  atomicWriteJsonFileSync(path, summary);
 }

package/src/assessments/assessmentStore.ts

@@ -1,17 +1,18 @@
 import {
   mkdirSync,
-  writeFileSync,
   existsSync,
   readFileSync,
-  renameSync,
 } from "node:fs";
 import { createHash, randomBytes } from "node:crypto";
 import { resolve, join } from "node:path";
 import { getAssessmentsDir, getConfig, getRepoAllowedTestCommands, PatchWardenConfig } from "../config.js";
 import { guardPath } from "../security/pathGuard.js";
 import { PatchWardenError } from "../errors.js";
+import { redactSensitiveContent } from "../security/contentRedaction.js";
+import { atomicWriteJsonFileSync } from "../utils/atomicFile.js";
+import { withFileLockSync } from "../utils/lockedJsonFile.js";
 import { TOOL_SCHEMA_EPOCH } from "../version.js";
-import { getLastToolCatalogSnapshot } from "../tools/toolCatalog.js";
+import { getLastToolCatalogSnapshot } from "../tools/catalog/toolCatalog.js";
 import { captureRepoSnapshot, type RepoSnapshot } from "../runner/changeCapture.js";
 import type { RiskAssessmentResult } from "../security/riskEngine.js";
 import type { TaskTemplateName, ChangePolicy } from "../tools/taskTemplates.js";
@@ -203,7 +204,7 @@ export function createAssessment(input: AssessmentCreateInput): AssessmentRecord
     repo_path: input.repo_path,
     resolved_repo_path: input.resolved_repo_path,
     template: input.template || null,
-    goal: input.goal || null,
+    goal: input.goal ? redactSensitiveContent(input.goal).content : null,
     test_command: input.test_command || null,
     verify_commands: input.verify_commands || [],
     agent: input.agent,
@@ -216,7 +217,7 @@ export function createAssessment(input: AssessmentCreateInput): AssessmentRecord
     agent_assessment_summary: input.agent_assessment_summary || null,
   };
 
-  writeFileSync(join(dir, "assessment.json"), JSON.stringify(record, null, 2), "utf-8");
+  atomicWriteJsonFileSync(join(dir, "assessment.json"), record);
 
   return record;
 }
@@ -314,7 +315,7 @@ export function validateAssessmentFreshness(
  * This is intentionally not registered as an MCP tool: a remote client may
  * request confirmation, but it cannot grant confirmation to itself.
  */
-export function confirmAssessment(assessmentId: string): AssessmentConfirmationResult {
+export async function confirmAssessment(assessmentId: string): Promise<AssessmentConfirmationResult> {
   if (!/^assessment_\d{8}_\d{6}_[0-9a-f]{32}$/.test(assessmentId)) {
     throw new PatchWardenError(
       "assessment_id_invalid",
@@ -323,6 +324,10 @@ export function confirmAssessment(assessmentId: string): AssessmentConfirmationR
     );
   }
 
+  const config = getConfig();
+  const assessmentFile = resolve(getAssessmentsDir(config), assessmentId, "assessment.json");
+  guardPath(assessmentFile, config.workspaceRoot, config.assessmentsDir);
+
   const assessment = readAssessment(assessmentId);
   if (assessment.decision !== "needs_confirm" || !assessment.requires_confirm) {
     throw new PatchWardenError(
@@ -334,44 +339,51 @@ export function confirmAssessment(assessmentId: string): AssessmentConfirmationR
     );
   }
 
-  const snapshot = captureRepoSnapshot(assessment.resolved_repo_path);
-  const validation = validateAssessmentFreshness(assessmentId, snapshot, {
-    allow_unconfirmed: true,
-    // A standalone CLI has no active MCP profile snapshot. The execute path
-    // still performs the full tool-manifest check before creating the task.
-    skip_tool_manifest: true,
-  });
-  if (!validation.valid || !validation.assessment) {
-    throw new PatchWardenError(
-      validation.failure_reason || "assessment_validation_failed",
-      `Assessment "${assessmentId}" cannot be confirmed: ${validation.failure_reason || "validation_failed"}.`,
-      "Run create_task with execution_mode=assess_only again, then confirm the new assessment locally."
-    );
-  }
-
-  const confirmedAt = validation.assessment.confirmed_at || new Date().toISOString();
-  const confirmedRecord: AssessmentRecord = {
-    ...validation.assessment,
-    confirmed: true,
-    confirmed_at: confirmedAt,
-    confirm_code: validation.assessment.confirm_code || randomBytes(8).toString("hex"),
-  };
-  const config = getConfig();
-  const assessmentFile = resolve(getAssessmentsDir(config), assessmentId, "assessment.json");
-  guardPath(assessmentFile, config.workspaceRoot, config.assessmentsDir);
-  const temporaryFile = `${assessmentFile}.${process.pid}.${randomBytes(4).toString("hex")}.tmp`;
-  guardPath(temporaryFile, config.workspaceRoot, config.assessmentsDir);
-  writeFileSync(temporaryFile, JSON.stringify(confirmedRecord, null, 2), "utf-8");
-  renameSync(temporaryFile, assessmentFile);
+  const snapshot = await captureRepoSnapshot(assessment.resolved_repo_path);
+
+  // Re-read and write while holding one cross-process lock. Concurrent local
+  // confirmers may compute snapshots in parallel, but they cannot replace one
+  // another's confirmation metadata from a stale assessment record.
+  return withFileLockSync(assessmentFile, () => {
+    const validation = validateAssessmentFreshness(assessmentId, snapshot, {
+      allow_unconfirmed: true,
+      // A standalone CLI has no active MCP profile snapshot. The execute path
+      // still performs the full tool-manifest check before creating the task.
+      skip_tool_manifest: true,
+    });
+    if (!validation.valid || !validation.assessment) {
+      throw new PatchWardenError(
+        validation.failure_reason || "assessment_validation_failed",
+        `Assessment "${assessmentId}" cannot be confirmed: ${validation.failure_reason || "validation_failed"}.`,
+        "Run create_task with execution_mode=assess_only again, then confirm the new assessment locally."
+      );
+    }
+    if (validation.assessment.decision !== "needs_confirm" || !validation.assessment.requires_confirm) {
+      throw new PatchWardenError(
+        "assessment_confirmation_not_allowed",
+        `Assessment "${assessmentId}" is no longer eligible for local confirmation.`,
+        "Run create_task with execution_mode=assess_only again."
+      );
+    }
 
-  return {
-    assessment_id: assessmentId,
-    decision: "needs_confirm",
-    confirmed: true,
-    confirmed_at: confirmedAt,
-    expires_at: confirmedRecord.expires_at,
-    next_action: "Call create_task with only execution_mode=execute and this full assessment_id.",
-  };
+    const confirmedAt = validation.assessment.confirmed_at || new Date().toISOString();
+    const confirmedRecord: AssessmentRecord = {
+      ...validation.assessment,
+      confirmed: true,
+      confirmed_at: confirmedAt,
+      confirm_code: validation.assessment.confirm_code || randomBytes(8).toString("hex"),
+    };
+    atomicWriteJsonFileSync(assessmentFile, confirmedRecord);
+
+    return {
+      assessment_id: assessmentId,
+      decision: "needs_confirm",
+      confirmed: true,
+      confirmed_at: confirmedAt,
+      expires_at: confirmedRecord.expires_at,
+      next_action: "Call create_task with only execution_mode=execute and this full assessment_id.",
+    };
+  });
 }
 
 export function computeWorkspaceFingerprint(snapshot: RepoSnapshot): string {

package/src/assessments/confirmCli.ts

@@ -10,20 +10,21 @@
 import { loadConfig } from "../config.js";
 import { confirmAssessment } from "./assessmentStore.js";
 import { errorPayload } from "../errors.js";
+import { logger } from "../logging.js";
 
 loadConfig();
 
 const assessmentId = process.argv[2];
 if (!assessmentId || process.argv.length !== 3) {
-  console.error("Usage: patchwarden-confirm <full_assessment_id>");
-  console.error("The display-only assessment_short_id is not accepted.");
+  logger.info("Usage: patchwarden-confirm <full_assessment_id>");
+  logger.info("The display-only assessment_short_id is not accepted.");
   process.exit(1);
 }
 
 try {
-  const result = confirmAssessment(assessmentId);
+  const result = await confirmAssessment(assessmentId);
   console.log(JSON.stringify(result, null, 2));
 } catch (error) {
-  console.error(JSON.stringify(errorPayload(error), null, 2));
+  logger.error("confirm_assessment_failed", { error: errorPayload(error) });
   process.exit(1);
 }

package/src/config.ts

@@ -1,11 +1,15 @@
 import { readFileSync, existsSync } from "node:fs";
-import { isAbsolute, relative, resolve, sep } from "node:path";
+import { basename, isAbsolute, relative, resolve, sep } from "node:path";
+import { validateWorkspaceRoot } from "./security/workspaceRootGuard.js";
 
 // ── Type definitions ──────────────────────────────────────────────
 
 export interface AgentConfig {
   command: string;
   args: string[];
+  envAllowlist?: string[];
+  adapter?: string;
+  model?: string;
 }
 
 export interface PatchWardenConfig {
@@ -23,11 +27,20 @@ export interface PatchWardenConfig {
   watcherStaleSeconds: number;
   toolProfile?: "full" | "chatgpt_core" | "chatgpt_direct" | "chatgpt_search";
   repoAliases?: Record<string, string>;
+  httpPort?: number;
+  http?: { port?: number; host?: string; ownerTokenEnv?: string };
+  enableRunTaskTool?: boolean;
   enableAgentAssessment?: boolean;
   agentAssessmentTimeoutSeconds?: number;
   agentAssessmentMaxOutputBytes?: number;
   agentAssessmentAgentName?: string;
   enableDirectProfile?: boolean;
+  tunnelClientPath?: string;
+  tunnelProxy?: {
+    scope: "shared" | "separate";
+    core: { mode: "environment" | "none" | "manual"; url?: string };
+    direct: { mode: "environment" | "none" | "manual"; url?: string };
+  };
   directSessionsDir: string;
   directSessionTtlSeconds: number;
   directMaxPatchBytes: number;
@@ -44,16 +57,7 @@ const DEFAULT_CONFIG: PatchWardenConfig = {
   tasksDir: ".patchwarden/tasks",
   assessmentsDir: ".patchwarden/assessments",
   assessmentTtlSeconds: 3600,
-  agents: {
-    codex: {
-      command: "codex",
-      args: ["exec", "--cd", "{repo}", "{prompt}"],
-    },
-    opencode: {
-      command: "opencode",
-      args: ["run", "{prompt}"],
-    },
-  },
+  agents: {},
   allowedTestCommands: [
     "npm test",
     "npm run test",
@@ -172,6 +176,11 @@ function normalizeConfig(config: PatchWardenConfig): PatchWardenConfig {
   if (!config.workspaceRoot || typeof config.workspaceRoot !== "string") {
     throw new Error("workspaceRoot must be a non-empty string");
   }
+  const workspaceValidation = validateWorkspaceRoot(config.workspaceRoot);
+  if (!workspaceValidation.ok) {
+    throw new Error(`Invalid workspaceRoot: ${workspaceValidation.reason} (${workspaceValidation.path})`);
+  }
+  config.workspaceRoot = workspaceValidation.path;
   if (!config.plansDir || typeof config.plansDir !== "string") {
     throw new Error("plansDir must be a non-empty string");
   }
@@ -187,6 +196,20 @@ function normalizeConfig(config: PatchWardenConfig): PatchWardenConfig {
   if (!config.agents || typeof config.agents !== "object") {
     throw new Error("agents must be an object");
   }
+  const agents: Record<string, AgentConfig> = {};
+  for (const [agentName, agent] of Object.entries(config.agents)) {
+    if (!agent || typeof agent !== "object" || typeof agent.command !== "string" || !Array.isArray(agent.args)) {
+      throw new Error(`agents["${agentName}"] must define command and args`);
+    }
+    const envAllowlist = agent.envAllowlist ?? [];
+    if (!Array.isArray(envAllowlist) || envAllowlist.some((name) => typeof name !== "string" || !/^[A-Za-z_][A-Za-z0-9_]*$/.test(name))) {
+      throw new Error(`agents["${agentName}"].envAllowlist must contain only environment variable names`);
+    }
+    const blockedNames = new Set(["CONTROL_PLANE_API_KEY", "PATCHWARDEN_OWNER_TOKEN", config.http?.ownerTokenEnv?.toUpperCase()]);
+    const blocked = envAllowlist.find((name) => blockedNames.has(name.toUpperCase()));
+    if (blocked) throw new Error(`agents["${agentName}"].envAllowlist cannot include reserved variable "${blocked}"`);
+    agents[agentName] = { ...agent, args: [...agent.args], envAllowlist: [...new Set(envAllowlist)] };
+  }
   if (!Array.isArray(config.allowedTestCommands)) {
     throw new Error("allowedTestCommands must be an array");
   }
@@ -233,6 +256,46 @@ function normalizeConfig(config: PatchWardenConfig): PatchWardenConfig {
   ) {
     throw new Error('toolProfile must be "full", "chatgpt_core", "chatgpt_direct", or "chatgpt_search"');
   }
+  if (config.repoAliases !== undefined) {
+    if (typeof config.repoAliases !== "object" || config.repoAliases === null || Array.isArray(config.repoAliases)) {
+      throw new Error("repoAliases must be an object mapping alias names to repository paths");
+    }
+    for (const [alias, target] of Object.entries(config.repoAliases)) {
+      if (typeof target !== "string") {
+        throw new Error(`repoAliases["${alias}"] must be a string`);
+      }
+    }
+  }
+  if (config.httpPort !== undefined) {
+    if (typeof config.httpPort !== "number" || !Number.isInteger(config.httpPort) || config.httpPort < 1 || config.httpPort > 65535) {
+      throw new Error("httpPort must be an integer from 1 to 65535");
+    }
+  }
+  if (config.http !== undefined) {
+    if (typeof config.http !== "object" || config.http === null || Array.isArray(config.http)) {
+      throw new Error("http must be an object");
+    }
+    if (config.http.port !== undefined) {
+      if (typeof config.http.port !== "number" || !Number.isInteger(config.http.port) || config.http.port < 1 || config.http.port > 65535) {
+        throw new Error("http.port must be an integer from 1 to 65535");
+      }
+    }
+    if (config.http.host !== undefined && typeof config.http.host !== "string") {
+      throw new Error("http.host must be a string");
+    }
+    if (
+      config.http.ownerTokenEnv !== undefined
+      && (
+        typeof config.http.ownerTokenEnv !== "string"
+        || !/^[A-Za-z_][A-Za-z0-9_]*$/.test(config.http.ownerTokenEnv)
+      )
+    ) {
+      throw new Error("http.ownerTokenEnv must be a valid environment variable name");
+    }
+  }
+  if (config.enableRunTaskTool !== undefined && typeof config.enableRunTaskTool !== "boolean") {
+    throw new Error("enableRunTaskTool must be a boolean");
+  }
   if (config.enableAgentAssessment !== undefined && typeof config.enableAgentAssessment !== "boolean") {
     throw new Error("enableAgentAssessment must be a boolean");
   }
@@ -252,6 +315,36 @@ function normalizeConfig(config: PatchWardenConfig): PatchWardenConfig {
   if (config.enableDirectProfile !== undefined && typeof config.enableDirectProfile !== "boolean") {
     throw new Error("enableDirectProfile must be a boolean");
   }
+  if (config.tunnelClientPath !== undefined) {
+    if (typeof config.tunnelClientPath !== "string" || !isAbsolute(config.tunnelClientPath)) {
+      throw new Error("tunnelClientPath must be an absolute path");
+    }
+    if (basename(config.tunnelClientPath).toLowerCase() !== "tunnel-client.exe") {
+      throw new Error("tunnelClientPath must point to tunnel-client.exe");
+    }
+  }
+  if (config.tunnelProxy !== undefined) {
+    if (!config.tunnelProxy || typeof config.tunnelProxy !== "object" || !["shared", "separate"].includes(config.tunnelProxy.scope)) {
+      throw new Error("tunnelProxy.scope must be shared or separate");
+    }
+    for (const key of ["core", "direct"] as const) {
+      const endpoint = config.tunnelProxy[key];
+      if (!endpoint || typeof endpoint !== "object" || !["environment", "none", "manual"].includes(endpoint.mode)) {
+        throw new Error(`tunnelProxy.${key}.mode must be environment, none, or manual`);
+      }
+      if (endpoint.mode === "manual") {
+        if (typeof endpoint.url !== "string") throw new Error(`tunnelProxy.${key}.url is required in manual mode`);
+        let parsed: URL;
+        try { parsed = new URL(endpoint.url); } catch { throw new Error(`tunnelProxy.${key}.url must be a valid URL`); }
+        if (!["http:", "https:", "socks5:"].includes(parsed.protocol)) {
+          throw new Error(`tunnelProxy.${key}.url must use http, https, or socks5`);
+        }
+        if (parsed.username || parsed.password) throw new Error(`tunnelProxy.${key}.url must not contain credentials`);
+      } else if (endpoint.url !== undefined) {
+        throw new Error(`tunnelProxy.${key}.url is only allowed in manual mode`);
+      }
+    }
+  }
   if (!config.directSessionsDir || typeof config.directSessionsDir !== "string") {
     throw new Error("directSessionsDir must be a non-empty string");
   }
@@ -294,6 +387,7 @@ function normalizeConfig(config: PatchWardenConfig): PatchWardenConfig {
 
   return {
     ...config,
+    agents,
     workspaceRoot: resolve(config.workspaceRoot),
     allowedTestCommands: [...new Set(config.allowedTestCommands.map((command) => command.trim()))],
     repoAllowedTestCommands,

package/src/control/fileManager.ts

@@ -0,0 +1,40 @@
+import { spawn } from "node:child_process";
+import { join } from "node:path";
+import { buildChildEnvironment, resolveTrustedExecutable } from "../runner/processSecurity.js";
+
+const FILE_MANAGER_ENVIRONMENT = [
+  "DISPLAY",
+  "WAYLAND_DISPLAY",
+  "DBUS_SESSION_BUS_ADDRESS",
+  "XDG_RUNTIME_DIR",
+] as const;
+
+/** Launch a trusted platform file manager without inheriting ambient secrets. */
+export function launchFileManager(target: string, cwd: string): boolean {
+  try {
+    const env = buildChildEnvironment({ cwd, allowedNames: FILE_MANAGER_ENVIRONMENT });
+    const requested = fileManagerCommand(env);
+    const command = resolveTrustedExecutable(requested, cwd, { pathValue: env.PATH });
+    const child = spawn(command, [target], {
+      cwd,
+      detached: true,
+      env,
+      stdio: "ignore",
+      windowsHide: true,
+    });
+    child.on("error", () => { /* opening a convenience viewer is best effort */ });
+    child.unref();
+    return true;
+  } catch {
+    return false;
+  }
+}
+
+function fileManagerCommand(env: NodeJS.ProcessEnv): string {
+  if (process.platform === "win32") {
+    const windowsRoot = env.SystemRoot || env.WINDIR;
+    return windowsRoot ? join(windowsRoot, "explorer.exe") : "explorer.exe";
+  }
+  if (process.platform === "darwin") return "open";
+  return "xdg-open";
+}