patchwarden 1.5.0 → 1.6.1

package/src/direct/directAudit.ts

@@ -1,15 +1,16 @@
-import { writeFileSync } from "node:fs";
 import { join, resolve, relative, isAbsolute } from "node:path";
-import { getConfig } from "../config.js";
 import { isSensitivePath } from "../security/sensitiveGuard.js";
 import { PatchWardenError } from "../errors.js";
 import {
   readDirectSession,
   getDirectSessionDir,
+  updateDirectSession,
+  withDirectSessionMutationLock,
   type DirectSessionRecord,
   type DirectSessionVerificationRun,
 } from "./directSessionStore.js";
 import type { ChangedFile, ChangeArtifacts } from "../runner/changeCapture.js";
+import { atomicWriteFileSync, atomicWriteJsonFileSync } from "../utils/atomicFile.js";
 
 // ── Types ──────────────────────────────────────────────────────────
 
@@ -39,7 +40,7 @@ export interface DirectSessionAuditOutput {
 // ── Main audit function ────────────────────────────────────────────
 
 export function auditDirectSession(sessionId: string): DirectSessionAuditOutput {
-  const config = getConfig();
+  return withDirectSessionMutationLock(sessionId, () => {
   const session = readDirectSession(sessionId);
   const sessionDir = getDirectSessionDir(sessionId);
 
@@ -98,6 +99,15 @@ export function auditDirectSession(sessionId: string): DirectSessionAuditOutput
       reason_code: sensitiveFiles.length > 0 ? "sensitive_file_modified" : undefined,
     });
 
+    checks.push({
+      name: "sensitive_content",
+      result: artifacts.diff_redacted ? "fail" : "pass",
+      detail: artifacts.diff_redacted
+        ? `Credential-like content was redacted from diff evidence (${(artifacts.diff_redaction_categories ?? []).join(", ") || "sensitive_content"}).`
+        : "No credential-like content was detected in diff evidence.",
+      reason_code: artifacts.diff_redacted ? "sensitive_content_detected" : undefined,
+    });
+
     // Check 5: node_modules modification
     const nodeModulesChanges = findPathChanges(artifacts, "node_modules");
     checks.push({
@@ -304,14 +314,12 @@ export function auditDirectSession(sessionId: string): DirectSessionAuditOutput
   };
 
   // Write audit.json and audit.md
-  writeFileSync(
-    join(sessionDir, "audit.json"),
-    JSON.stringify(output, null, 2),
-    "utf-8"
-  );
-  writeFileSync(auditPath, formatAuditMd(output, checks, session), "utf-8");
+  atomicWriteJsonFileSync(join(sessionDir, "audit.json"), output);
+  atomicWriteFileSync(auditPath, formatAuditMd(output, checks, session));
+  updateDirectSession(sessionId, { audited: true });
 
   return output;
+  });
 }
 
 // ── Helper functions ───────────────────────────────────────────────

package/src/direct/directGuards.ts

@@ -1,9 +1,12 @@
-import { resolve, relative, isAbsolute, sep } from "node:path";
+import { relative } from "node:path";
 import { existsSync, statSync, openSync, readSync, closeSync } from "node:fs";
 import { PatchWardenError } from "../errors.js";
-import { isSensitivePath } from "../security/sensitiveGuard.js";
-import { guardWorkspacePath } from "../security/pathGuard.js";
-import { getConfig } from "../config.js";
+import {
+  hasWindowsAlternateDataStream,
+  isSensitivePath,
+} from "../security/sensitiveGuard.js";
+import { guardPath, guardWorkspacePath } from "../security/pathGuard.js";
+import { getConfig, type PatchWardenConfig } from "../config.js";
 import type { DirectSessionRecord } from "./directSessionStore.js";
 
 // ── Session state guards ───────────────────────────────────────────
@@ -55,36 +58,34 @@ export function guardDirectPath(
   resolvedRepoPath: string,
   workspaceRoot: string
 ): string {
-  const config = getConfig();
-  const resolved = resolve(resolvedRepoPath, filePath);
-  const normalizedRepo = resolve(resolvedRepoPath);
-  const normalizedWs = resolve(workspaceRoot);
-
-  // Check path is inside workspace root
-  const relToWs = relative(normalizedWs, resolved);
-  if (isAbsolute(relToWs) || relToWs.startsWith("..")) {
+  if (hasWindowsAlternateDataStream(filePath)) {
     throw new PatchWardenError(
-      "path_outside_repo",
-      `Path "${filePath}" resolves outside the session repo.`,
-      "Use a relative path inside the session's repo_path.",
+      "windows_ads_path_blocked",
+      `Path "${filePath}" contains a Windows alternate data stream suffix.`,
+      "Use a normal relative file path without a colon or NTFS stream name.",
       true,
       { path: filePath, operation: "direct_path_access" }
     );
   }
 
-  // Check path is inside repo_path
-  const relToRepo = relative(normalizedRepo, resolved);
-  if (isAbsolute(relToRepo) || relToRepo.startsWith("..")) {
-    throw new PatchWardenError(
-      "path_outside_repo",
-      `Path "${filePath}" is outside the session repo_path "${resolvedRepoPath}".`,
-      "Use a relative path inside the session's repo_path.",
-      true,
-      { path: filePath, operation: "direct_path_access" }
-    );
+  // Resolve the repo first so a repo-level symlink/junction cannot escape the
+  // workspace. guardPath then resolves the candidate or its nearest existing
+  // parent, closing intermediate symlink/junction escapes for new files too.
+  try {
+    const guardedRepo = guardWorkspacePath(resolvedRepoPath, workspaceRoot);
+    return guardPath(filePath, guardedRepo);
+  } catch (error) {
+    if (error instanceof PatchWardenError && error.reason === "workspace_path_escape") {
+      throw new PatchWardenError(
+        "path_outside_repo",
+        `Path "${filePath}" resolves outside the session repo.`,
+        "Use a relative path inside the session's repo_path.",
+        true,
+        { path: filePath, operation: "direct_path_access" }
+      );
+    }
+    throw error;
   }
-
-  return resolved;
 }
 
 /**
@@ -96,13 +97,15 @@ export function guardDirectReadPath(
   workspaceRoot: string
 ): string {
   const resolved = guardDirectPath(filePath, resolvedRepoPath, workspaceRoot);
-  const normalized = filePath.replace(/\\/g, "/");
+  const policyPaths = directPolicyPaths(
+    filePath,
+    resolved,
+    resolvedRepoPath,
+    workspaceRoot
+  );
 
   // Block internal PatchWarden paths (sessions, tasks, plans, assessments)
-  if (
-    normalized.startsWith(".patchwarden/") ||
-    normalized.includes("/.patchwarden/")
-  ) {
+  if (policyPaths.some((path) => hasPathSegment(path, ".patchwarden"))) {
     throw new PatchWardenError(
       "internal_patchwarden_path_blocked",
       `Access denied: "${filePath}" is inside the internal .patchwarden directory.`,
@@ -112,7 +115,7 @@ export function guardDirectReadPath(
     );
   }
 
-  if (isSensitivePath(filePath)) {
+  if (policyPaths.some((path) => isSensitivePath(path))) {
     throw new PatchWardenError(
       "sensitive_path_blocked",
       `Access denied: "${filePath}" matches a sensitive file pattern.`,
@@ -145,13 +148,15 @@ export function guardDirectWritePath(
   workspaceRoot: string
 ): string {
   const resolved = guardDirectPath(filePath, resolvedRepoPath, workspaceRoot);
-  const normalized = filePath.replace(/\\/g, "/");
+  const policyPaths = directPolicyPaths(
+    filePath,
+    resolved,
+    resolvedRepoPath,
+    workspaceRoot
+  );
 
   // Block internal PatchWarden paths
-  if (
-    normalized.startsWith(".patchwarden/") ||
-    normalized.includes("/.patchwarden/")
-  ) {
+  if (policyPaths.some((path) => hasPathSegment(path, ".patchwarden"))) {
     throw new PatchWardenError(
       "internal_patchwarden_path_blocked",
       `Modification denied: "${filePath}" is inside the internal .patchwarden directory.`,
@@ -161,7 +166,7 @@ export function guardDirectWritePath(
     );
   }
 
-  if (isSensitivePath(normalized)) {
+  if (policyPaths.some((path) => isSensitivePath(path))) {
     throw new PatchWardenError(
       "sensitive_path_blocked",
       `Modification denied: "${filePath}" matches a sensitive file pattern.`,
@@ -172,7 +177,7 @@ export function guardDirectWritePath(
   }
 
   // Block node_modules
-  if (normalized.startsWith("node_modules/") || normalized.includes("/node_modules/")) {
+  if (policyPaths.some((path) => hasPathSegment(path, "node_modules"))) {
     throw new PatchWardenError(
       "blocked_artifact_path",
       `Modification denied: "${filePath}" is inside node_modules.`,
@@ -183,7 +188,7 @@ export function guardDirectWritePath(
   }
 
   // Block release/
-  if (normalized.startsWith("release/") || normalized.includes("/release/")) {
+  if (policyPaths.some((path) => hasPathSegment(path, "release"))) {
     throw new PatchWardenError(
       "blocked_artifact_path",
       `Modification denied: "${filePath}" is inside the release directory.`,
@@ -194,7 +199,7 @@ export function guardDirectWritePath(
   }
 
   // Block dist/
-  if (normalized.startsWith("dist/") || normalized.includes("/dist/")) {
+  if (policyPaths.some((path) => hasPathSegment(path, "dist"))) {
     throw new PatchWardenError(
       "blocked_artifact_path",
       `Modification denied: "${filePath}" is inside the dist directory.`,
@@ -217,6 +222,27 @@ export function guardDirectWritePath(
   return resolved;
 }
 
+function directPolicyPaths(
+  requestedPath: string,
+  resolvedPath: string,
+  resolvedRepoPath: string,
+  workspaceRoot: string
+): string[] {
+  const guardedRepo = guardWorkspacePath(resolvedRepoPath, workspaceRoot);
+  return [
+    requestedPath.replace(/\\/g, "/"),
+    relative(guardedRepo, resolvedPath).replace(/\\/g, "/"),
+  ];
+}
+
+function hasPathSegment(filePath: string, expectedSegment: string): boolean {
+  const expected = expectedSegment.toLowerCase();
+  return filePath
+    .split("/")
+    .filter(Boolean)
+    .some((segment) => segment.toLowerCase() === expected);
+}
+
 // ── Size guards ────────────────────────────────────────────────────
 
 export function guardDirectPatchSize(patchBytes: number): void {
@@ -232,8 +258,10 @@ export function guardDirectPatchSize(patchBytes: number): void {
   }
 }
 
-export function guardDirectFileSize(fileBytes: number): void {
-  const config = getConfig();
+export function guardDirectFileSize(
+  fileBytes: number,
+  config: PatchWardenConfig = getConfig(),
+): void {
   if (fileBytes > config.directMaxFileBytes) {
     throw new PatchWardenError(
       "file_too_large",
@@ -257,22 +285,43 @@ const BINARY_EXTENSIONS = new Set([
   ".wasm", ".node",
 ]);
 
+/**
+ * Maximum bytes to scan for null-byte detection when the extension is not
+ * a known binary type. 1 MB catches binary content embedded deep in files
+ * (e.g., null bytes at offset 8200) without reading excessively large files.
+ */
+const BINARY_SCAN_LIMIT = 1_048_576; // 1 MB
+const BINARY_SCAN_CHUNK = 65536; // 64 KB per read
+
 export function isBinaryFile(filePath: string): boolean {
   const normalized = filePath.replace(/\\/g, "/").toLowerCase();
   for (const ext of BINARY_EXTENSIONS) {
     if (normalized.endsWith(ext)) return true;
   }
 
-  // Check file content for null bytes (simple heuristic)
+  // Scan file content for null bytes in chunks up to BINARY_SCAN_LIMIT.
+  // Previously only the first 8 KB were checked, allowing null bytes at
+  // offset 8193+ to bypass detection.
   try {
+    const stat = statSync(filePath);
+    const scanSize = Math.min(stat.size, BINARY_SCAN_LIMIT);
     const fd = openSync(filePath, "r");
-    const buffer = Buffer.alloc(8192);
-    const bytesRead = readSync(fd, buffer, 0, 8192, 0);
-    closeSync(fd);
-    for (let i = 0; i < bytesRead; i++) {
-      if (buffer[i] === 0) return true;
+    try {
+      const chunk = Buffer.alloc(BINARY_SCAN_CHUNK);
+      let scanned = 0;
+      while (scanned < scanSize) {
+        const toRead = Math.min(BINARY_SCAN_CHUNK, scanSize - scanned);
+        const bytesRead = readSync(fd, chunk, 0, toRead, scanned);
+        if (bytesRead === 0) break;
+        for (let i = 0; i < bytesRead; i++) {
+          if (chunk[i] === 0) return true;
+        }
+        scanned += bytesRead;
+      }
+      return false;
+    } finally {
+      closeSync(fd);
     }
-    return false;
   } catch {
     return false;
   }

package/src/direct/directPatch.ts

@@ -1,7 +1,8 @@
-import { readFileSync, writeFileSync, existsSync, mkdirSync } from "node:fs";
+import { closeSync, existsSync, fstatSync, openSync, readFileSync } from "node:fs";
 import { createHash } from "node:crypto";
-import { dirname, resolve } from "node:path";
 import { PatchWardenError } from "../errors.js";
+import { atomicWriteFileSync } from "../utils/atomicFile.js";
+import { redactSensitiveContent } from "../security/contentRedaction.js";
 
 // ── Types ──────────────────────────────────────────────────────────
 
@@ -36,6 +37,12 @@ export function computeContentSha256(content: string): string {
   return createHash("sha256").update(content, "utf-8").digest("hex");
 }
 
+export interface ApplyPatchOptions {
+  expectedSha256?: string;
+  maxFileBytes?: number;
+  revalidatePath?: () => string;
+}
+
 export function validateExpectedSha256(
   filePath: string,
   expectedSha256: string
@@ -68,7 +75,8 @@ export function validateExpectedSha256(
 
 export function applyPatchOperations(
   filePath: string,
-  operations: PatchOperation[]
+  operations: PatchOperation[],
+  options: ApplyPatchOptions = {},
 ): ApplyPatchResult {
   if (!existsSync(filePath)) {
     throw new PatchWardenError(
@@ -80,8 +88,40 @@ export function applyPatchOperations(
     );
   }
 
-  const beforeContent = readFileSync(filePath, "utf-8");
-  const beforeSha256 = computeContentSha256(beforeContent);
+  let descriptor: number | null = null;
+  let beforeBytes: Buffer;
+  let existingMode: number;
+  try {
+    descriptor = openSync(filePath, "r");
+    const metadata = fstatSync(descriptor);
+    if (!metadata.isFile()) {
+      throw new PatchWardenError(
+        "direct_target_not_file",
+        `Patch target is not a regular file: "${filePath}".`,
+        "Choose an existing text file inside the Direct session repository.",
+      );
+    }
+    guardFileByteLimit(metadata.size, options.maxFileBytes);
+    existingMode = metadata.mode;
+    beforeBytes = readFileSync(descriptor);
+  } finally {
+    if (descriptor !== null) closeSync(descriptor);
+  }
+  guardFileByteLimit(beforeBytes.length, options.maxFileBytes);
+  const beforeSha256 = createHash("sha256").update(beforeBytes).digest("hex");
+  if (options.expectedSha256 && beforeSha256 !== options.expectedSha256) {
+    throw fileHashMismatch(options.expectedSha256, beforeSha256);
+  }
+  const beforeContent = beforeBytes.toString("utf-8");
+  if (!Buffer.from(beforeContent, "utf-8").equals(beforeBytes)) {
+    throw new PatchWardenError(
+      "unsupported_text_encoding",
+      `File "${filePath}" is not valid UTF-8 text.`,
+      "Use a normal task or convert the file to UTF-8 before Direct editing.",
+      true,
+      { path: filePath },
+    );
+  }
   let content = beforeContent;
   let operationsApplied = 0;
 
@@ -91,13 +131,33 @@ export function applyPatchOperations(
   }
 
   const afterSha256 = computeContentSha256(content);
+  guardFileByteLimit(Buffer.byteLength(content, "utf-8"), options.maxFileBytes);
+  const sensitive = redactSensitiveContent(content);
+  if (sensitive.redacted) {
+    throw new PatchWardenError(
+      "sensitive_content_blocked",
+      `Patch result contains credential-like content (${sensitive.redaction_categories.join(", ")}).`,
+      "Remove the sensitive value and retry with placeholders or environment-variable references.",
+      true,
+      { path: filePath, redaction_categories: sensitive.redaction_categories },
+    );
+  }
   const bytesChanged = Math.abs(
     Buffer.byteLength(content, "utf-8") - Buffer.byteLength(beforeContent, "utf-8")
   );
 
-  // Ensure parent directory exists (should already exist for existing files)
-  mkdirSync(dirname(filePath), { recursive: true });
-  writeFileSync(filePath, content, "utf-8");
+  if (options.revalidatePath && !samePath(options.revalidatePath(), filePath)) {
+    throw new PatchWardenError(
+      "direct_path_changed_during_write",
+      `Patch target path changed while preparing "${filePath}".`,
+      "Retry only after concurrent filesystem changes stop.",
+      true,
+      { path: filePath, operation: "apply_patch" },
+    );
+  }
+  const currentSha256 = computeFileSha256(filePath);
+  if (currentSha256 !== beforeSha256) throw fileHashMismatch(beforeSha256, currentSha256);
+  atomicWriteFileSync(filePath, content, { mode: existingMode });
 
   return {
     before_sha256: beforeSha256,
@@ -107,6 +167,33 @@ export function applyPatchOperations(
   };
 }
 
+function guardFileByteLimit(fileBytes: number, maxFileBytes: number | undefined): void {
+  if (maxFileBytes === undefined || fileBytes <= maxFileBytes) return;
+  throw new PatchWardenError(
+    "file_too_large",
+    `File size ${fileBytes} bytes exceeds maximum ${maxFileBytes} bytes.`,
+    "Use a normal task for larger files.",
+    true,
+    { file_bytes: fileBytes, max_bytes: maxFileBytes },
+  );
+}
+
+function fileHashMismatch(expectedSha256: string, actualSha256: string): PatchWardenError {
+  return new PatchWardenError(
+    "file_hash_mismatch",
+    `File hash mismatch. Expected "${expectedSha256}" but got "${actualSha256}".`,
+    "Re-read the file to get the current sha256, then retry the patch.",
+    true,
+    { expected_sha256: expectedSha256, actual_sha256: actualSha256 },
+  );
+}
+
+function samePath(left: string, right: string): boolean {
+  return process.platform === "win32"
+    ? left.toLowerCase() === right.toLowerCase()
+    : left === right;
+}
+
 function applySingleOperation(
   content: string,
   op: PatchOperation