patchwarden 1.5.1 → 1.6.1

package/dist/logging.js

@@ -1,9 +1,11 @@
 import { createHash } from "node:crypto";
-import { appendFileSync, mkdirSync } from "node:fs";
+import { mkdirSync } from "node:fs";
 import { join } from "node:path";
 import { redactSensitiveContent } from "./security/contentRedaction.js";
-import { stableJsonStringify } from "./tools/toolRegistry.js";
+import { stableJsonStringify } from "./utils/stableJson.js";
 import { getConfig } from "./config.js";
+import { appendBoundedTextFileSync } from "./utils/boundedFile.js";
+const MAX_INVOCATION_LOG_BYTES = 5 * 1024 * 1024;
 // ── Helpers ───────────────────────────────────────────────────────
 /**
  * Returns true when PATCHWARDEN_VERBOSE_LOG is set to "true".
@@ -179,7 +181,7 @@ export function logToolInvocation(entry, options) {
         }
         mkdirSync(logsDir, { recursive: true });
         const logFilePath = join(logsDir, "invocation.log");
-        appendFileSync(logFilePath, JSON.stringify(entry) + "\n", "utf8");
+        appendBoundedTextFileSync(logFilePath, JSON.stringify(entry) + "\n", MAX_INVOCATION_LOG_BYTES);
     }
     catch (err) {
         // 日志失败不应阻断主流程，仅向 stderr 记录错误

package/dist/policy/projectPolicy.js

@@ -276,10 +276,13 @@ function pathMatchesPattern(relPath, pattern) {
         relPath.toLowerCase().startsWith(`${normalizedPattern.toLowerCase()}/`);
 }
 function parseGithubRepo(repository) {
+    const repositoryObject = repository && typeof repository === "object" && !Array.isArray(repository)
+        ? repository
+        : null;
     const raw = typeof repository === "string"
         ? repository
-        : repository && typeof repository === "object" && typeof repository.url === "string"
-            ? repository.url
+        : typeof repositoryObject?.url === "string"
+            ? repositoryObject.url
             : "";
     const match = raw.match(/github\.com[:/](.+?\/.+?)(?:\.git)?(?:[#?].*)?$/i);
     return match ? match[1] : null;

package/dist/release/releaseGate.d.ts

@@ -30,7 +30,7 @@ export interface PackedCheckResult extends StageCheckResult {
 }
 export interface HttpResponse {
     statusCode: number;
-    data: any;
+    data: unknown;
 }
 export type HttpGetFn = (url: string, headers?: Record<string, string>, timeoutMs?: number) => Promise<HttpResponse>;
 export interface ReleaseGateOptions {

package/dist/release/releaseGate.js

@@ -14,11 +14,13 @@
  * Network errors resolve to "not_checked" so transient issues don't block.
  * GITHUB_TOKEN is used as Bearer auth but never logged or returned.
  */
-import { execSync } from "node:child_process";
 import { createHash } from "node:crypto";
-import { readFileSync, writeFileSync } from "node:fs";
+import { readFileSync } from "node:fs";
 import { join } from "node:path";
 import { get } from "node:https";
+import { resolveTrustedCommandLine } from "../runner/processSecurity.js";
+import { runSimpleProcessSync } from "../runner/simpleProcess.js";
+import { atomicWriteJsonFileSync } from "../utils/atomicFile.js";
 // ── Constants ──────────────────────────────────────────────────────
 const STAGE_ORDER = [
     "local_ready",
@@ -29,6 +31,7 @@ const STAGE_ORDER = [
 ];
 const LOCAL_TIMEOUT_MS = 300000;
 const REMOTE_TIMEOUT_MS = 10000;
+const MAX_REMOTE_RESPONSE_BYTES = 5 * 1024 * 1024;
 const USER_AGENT = "PatchWarden-ReleaseGate";
 const PACK_FORBIDDEN_PATTERNS = [
     /(^|[\\/])\.env$/,
@@ -55,6 +58,14 @@ export function computeTokenDigest(token) {
 export async function httpsGetJson(url, headers, timeoutMs) {
     const timeout = timeoutMs ?? REMOTE_TIMEOUT_MS;
     return new Promise((resolve, reject) => {
+        let settled = false;
+        const fail = (error) => {
+            if (settled)
+                return;
+            settled = true;
+            clearTimeout(timer);
+            reject(error);
+        };
         const timer = setTimeout(() => {
             req.destroy(new Error(`Request timed out after ${timeout}ms`));
         }, timeout);
@@ -65,9 +76,31 @@ export async function httpsGetJson(url, headers, timeoutMs) {
                 ...(headers || {}),
             },
         }, (res) => {
+            const declaredLength = Number(res.headers["content-length"]);
+            if (Number.isFinite(declaredLength) && declaredLength > MAX_REMOTE_RESPONSE_BYTES) {
+                res.destroy();
+                fail(new Error(`Response exceeds ${MAX_REMOTE_RESPONSE_BYTES} bytes`));
+                return;
+            }
             const chunks = [];
-            res.on("data", (chunk) => chunks.push(chunk));
+            let totalBytes = 0;
+            let oversized = false;
+            res.on("data", (chunk) => {
+                if (oversized)
+                    return;
+                totalBytes += chunk.length;
+                if (totalBytes > MAX_REMOTE_RESPONSE_BYTES) {
+                    oversized = true;
+                    res.destroy();
+                    fail(new Error(`Response exceeds ${MAX_REMOTE_RESPONSE_BYTES} bytes`));
+                    return;
+                }
+                chunks.push(chunk);
+            });
             res.on("end", () => {
+                if (oversized || settled)
+                    return;
+                settled = true;
                 clearTimeout(timer);
                 const body = Buffer.concat(chunks).toString("utf-8");
                 let data = null;
@@ -81,11 +114,10 @@ export async function httpsGetJson(url, headers, timeoutMs) {
                 }
                 resolve({ statusCode: res.statusCode ?? 0, data });
             });
+            res.on("aborted", () => fail(new Error("Response was aborted before completion")));
+            res.on("error", fail);
         });
-        req.on("error", (err) => {
-            clearTimeout(timer);
-            reject(err);
-        });
+        req.on("error", fail);
     });
 }
 /**
@@ -138,12 +170,14 @@ export function checkLocalReady(repoPath) {
     const commands = ["npm.cmd run build", "npm.cmd test", "npm.cmd run doctor:ci"];
     for (const cmdStr of commands) {
         try {
-            execSync(cmdStr, {
-                cwd: repoPath,
-                encoding: "utf-8",
-                timeout: LOCAL_TIMEOUT_MS,
-                stdio: ["ignore", "pipe", "pipe"],
-            });
+            const result = runLocalCommand(repoPath, cmdStr, LOCAL_TIMEOUT_MS);
+            if (result.spawnError)
+                throw new Error(result.spawnError);
+            if (result.timedOut)
+                throw new Error(`Command timed out after ${LOCAL_TIMEOUT_MS}ms`);
+            if (result.exitCode !== 0) {
+                throw Object.assign(new Error(`Command exited with code ${result.exitCode ?? -1}`), { status: result.exitCode ?? -1 });
+            }
         }
         catch (err) {
             if (err && typeof err === "object" && "status" in err) {
@@ -170,12 +204,14 @@ export function checkLocalReady(repoPath) {
 export function checkPackedReady(repoPath) {
     let packOutput;
     try {
-        packOutput = execSync("npm.cmd pack --dry-run --json", {
-            cwd: repoPath,
-            encoding: "utf-8",
-            timeout: LOCAL_TIMEOUT_MS,
-            stdio: ["ignore", "pipe", "pipe"],
-        });
+        const result = runLocalCommand(repoPath, "npm.cmd pack --dry-run --json", LOCAL_TIMEOUT_MS, 10 * 1024 * 1024);
+        if (result.spawnError)
+            throw new Error(result.spawnError);
+        if (result.timedOut)
+            throw new Error(`npm pack timed out after ${LOCAL_TIMEOUT_MS}ms`);
+        if (result.exitCode !== 0)
+            throw new Error(`npm pack exited with code ${result.exitCode ?? -1}`);
+        packOutput = result.stdout;
     }
     catch (err) {
         return {
@@ -240,7 +276,7 @@ export function checkPackedReady(repoPath) {
     };
     const manifestPath = join(repoPath, "release-artifact-manifest.json");
     try {
-        writeFileSync(manifestPath, JSON.stringify(manifest, null, 2), "utf-8");
+        atomicWriteJsonFileSync(manifestPath, manifest);
     }
     catch (err) {
         return {
@@ -264,6 +300,17 @@ export function checkPackedReady(repoPath) {
     }
     return { status: "passed", manifestPath };
 }
+function runLocalCommand(repoPath, commandLine, timeoutMs, maxStdoutBytes = 512 * 1024) {
+    const invocation = resolveTrustedCommandLine(commandLine, repoPath);
+    return runSimpleProcessSync({
+        command: invocation.command,
+        args: invocation.argsPrefix,
+        cwd: repoPath,
+        timeoutMs,
+        maxStdoutBytes,
+        maxStderrBytes: 512 * 1024,
+    });
+}
 /**
  * Stage 3: published_verified
  * Queries the npm registry and confirms the given version exists.
@@ -280,11 +327,12 @@ export async function checkPublishedVerified(packageName, version, httpGet) {
         if (res.statusCode === 404) {
             return { status: "failed", reason: `Package "${packageName}" not found on npm registry` };
         }
-        const data = res.data;
-        if (!data || !data.versions || typeof data.versions !== "object") {
+        const data = asRecord(res.data);
+        const versions = asRecord(data?.versions);
+        if (!versions) {
             return { status: "failed", reason: "npm registry response missing versions object" };
         }
-        if (Object.prototype.hasOwnProperty.call(data.versions, version)) {
+        if (Object.prototype.hasOwnProperty.call(versions, version)) {
             return { status: "passed" };
         }
         return {
@@ -340,12 +388,12 @@ export async function checkCiVerified(repo, branch, httpGet) {
         if (res.statusCode !== 200) {
             return { status: "not_checked", reason: `GitHub API returned ${res.statusCode}` };
         }
-        const data = res.data;
+        const data = asRecord(res.data);
         const runs = Array.isArray(data?.workflow_runs) ? data.workflow_runs : [];
         if (runs.length === 0) {
             return { status: "not_checked", reason: `No CI runs found for branch "${branch}"` };
         }
-        const conclusion = runs[0]?.conclusion;
+        const conclusion = asRecord(runs[0])?.conclusion;
         if (conclusion === "success") {
             return { status: "passed" };
         }
@@ -364,6 +412,11 @@ export async function checkCiVerified(repo, branch, httpGet) {
         };
     }
 }
+function asRecord(value) {
+    return value && typeof value === "object" && !Array.isArray(value)
+        ? value
+        : null;
+}
 // ── Orchestrator ───────────────────────────────────────────────────
 /**
  * Run release-gate stages up to and including targetStage, in order.

package/dist/runner/agentInvocation.d.ts

@@ -6,7 +6,21 @@ export interface AgentInvocation {
     commandLabel: string;
     promptMode: "inline" | "file";
     promptFilePath?: string;
+    environmentVariableNames: string[];
+    blockedEnvironmentVariableNames: string[];
 }
+export interface ResolvedAgentLaunch {
+    command: string;
+    argsPrefix: string[];
+}
+/**
+ * Resolve the Windows npm shim used by OpenCode to its native executable.
+ * Node cannot spawn .cmd/.ps1 shims directly with shell disabled (EINVAL), and
+ * enabling a shell would make the task prompt part of shell parsing.
+ */
+export declare function resolveAgentExecutable(agentName: string, command: string, platform?: NodeJS.Platform, pathValue?: string, fileExists?: (path: string) => boolean, cwd?: string): string;
+/** Resolve a configured Agent to a native executable or verified npm CLI. */
+export declare function resolveAgentLaunch(agentName: string, command: string, platform?: NodeJS.Platform, pathValue?: string, fileExists?: (path: string) => boolean, cwd?: string, adapterName?: string, readText?: (path: string) => string): ResolvedAgentLaunch;
 /**
  * Build agent invocation parameters from config.
  * Replaces {repo}, {prompt}, and {prompt_file} placeholders.

package/dist/runner/agentInvocation.js

@@ -1,5 +1,89 @@
-import { basename } from "node:path";
+import { existsSync, readFileSync } from "node:fs";
+import { basename, win32 } from "node:path";
 import { guardAgentCommand, sanitizePromptArg } from "../security/commandGuard.js";
+import { resolveTrustedExecutable, sanitizeTrustedPath } from "./processSecurity.js";
+const KNOWN_AGENT_NPM_PACKAGES = Object.freeze({
+    codex: "@openai/codex",
+    claude: "@anthropic-ai/claude-code",
+    gemini: "@google/gemini-cli",
+    copilot: "@github/copilot",
+    qwen: "@qwen-code/qwen-code",
+    opencode: "opencode-ai",
+});
+/**
+ * Resolve the Windows npm shim used by OpenCode to its native executable.
+ * Node cannot spawn .cmd/.ps1 shims directly with shell disabled (EINVAL), and
+ * enabling a shell would make the task prompt part of shell parsing.
+ */
+export function resolveAgentExecutable(agentName, command, platform = process.platform, pathValue = process.env.PATH || "", fileExists = existsSync, cwd = process.cwd()) {
+    return resolveAgentLaunch(agentName, command, platform, pathValue, fileExists, cwd).command;
+}
+/** Resolve a configured Agent to a native executable or verified npm CLI. */
+export function resolveAgentLaunch(agentName, command, platform = process.platform, pathValue = process.env.PATH || "", fileExists = existsSync, cwd = process.cwd(), adapterName = agentName, readText = (path) => readFileSync(path, "utf-8")) {
+    if (platform !== "win32")
+        return { command, argsPrefix: [] };
+    const commandName = win32.basename(command).toLowerCase();
+    if (adapterName === "opencode" && new Set(["opencode", "opencode.cmd", "opencode.ps1", "opencode.bat"]).has(commandName)) {
+        const roots = win32.isAbsolute(command)
+            ? [win32.dirname(command)]
+            : sanitizeTrustedPath(pathValue, cwd, "win32").split(win32.delimiter).filter(Boolean);
+        for (const root of roots) {
+            const nativeExecutable = win32.join(root, "node_modules", "opencode-ai", "bin", "opencode.exe");
+            if (fileExists(nativeExecutable))
+                return { command: nativeExecutable, argsPrefix: [] };
+        }
+    }
+    const resolved = resolveTrustedExecutable(command, cwd, {
+        platform,
+        pathValue,
+        fileExists,
+    });
+    if (!/\.(?:cmd|bat|ps1)$/i.test(resolved))
+        return { command: resolved, argsPrefix: [] };
+    const packageName = KNOWN_AGENT_NPM_PACKAGES[adapterName] || KNOWN_AGENT_NPM_PACKAGES[agentName];
+    if (!packageName) {
+        throw new Error(`Windows shell shim is not allowed for Agent "${agentName}": ${resolved}`);
+    }
+    const packageRoot = win32.resolve(win32.dirname(resolved), "node_modules", ...packageName.split("/"));
+    const manifestPath = win32.join(packageRoot, "package.json");
+    if (!fileExists(manifestPath)) {
+        throw new Error(`Verified npm package manifest not found for Agent "${agentName}": ${manifestPath}`);
+    }
+    let manifest;
+    try {
+        manifest = JSON.parse(readText(manifestPath));
+    }
+    catch {
+        throw new Error(`Invalid npm package manifest for Agent "${agentName}": ${manifestPath}`);
+    }
+    if (manifest.name !== packageName) {
+        throw new Error(`Unexpected npm package identity for Agent "${agentName}"`);
+    }
+    const shimName = win32.basename(resolved).replace(/\.(?:cmd|bat|ps1)$/i, "");
+    const binPath = resolvePackageBin(manifest.bin, [agentName, adapterName, shimName]);
+    if (!binPath)
+        throw new Error(`npm package does not declare a CLI for Agent "${agentName}"`);
+    const cliPath = win32.resolve(packageRoot, binPath);
+    const relativeCli = win32.relative(packageRoot, cliPath);
+    if (!relativeCli || relativeCli === ".." || relativeCli.startsWith(`..${win32.sep}`) || win32.isAbsolute(relativeCli) || !fileExists(cliPath)) {
+        throw new Error(`npm CLI entry escapes or is missing for Agent "${agentName}"`);
+    }
+    const node = resolveTrustedExecutable("node", cwd, { platform, pathValue, fileExists });
+    return { command: node, argsPrefix: [cliPath] };
+}
+function resolvePackageBin(bin, names) {
+    if (typeof bin === "string")
+        return bin;
+    if (!bin || typeof bin !== "object" || Array.isArray(bin))
+        return null;
+    const entries = bin;
+    for (const name of names) {
+        if (typeof entries[name] === "string")
+            return entries[name];
+    }
+    const values = Object.values(entries).filter((value) => typeof value === "string");
+    return values.length === 1 ? values[0] : null;
+}
 /**
  * Build agent invocation parameters from config.
  * Replaces {repo}, {prompt}, and {prompt_file} placeholders.
@@ -7,6 +91,12 @@ import { guardAgentCommand, sanitizePromptArg } from "../security/commandGuard.j
  */
 export function buildAgentInvocation(agentName, repoPath, prompt, config, promptFilePath) {
     const agentCmd = guardAgentCommand(agentName, config);
+    const launch = resolveAgentLaunch(agentName, agentCmd.command, process.platform, process.env.PATH || "", existsSync, repoPath, config.agents[agentName]?.adapter || agentName);
+    const environmentVariableNames = [...(config.agents[agentName]?.envAllowlist ?? [])];
+    const blockedEnvironmentVariableNames = [
+        "CONTROL_PLANE_API_KEY",
+        config.http?.ownerTokenEnv || "PATCHWARDEN_OWNER_TOKEN",
+    ];
     const sanitizedPrompt = sanitizePromptArg(prompt);
     const hasPromptFilePlaceholder = agentCmd.args.includes("{prompt_file}");
     const promptMode = hasPromptFilePlaceholder && promptFilePath ? "file" : "inline";
@@ -20,11 +110,13 @@ export function buildAgentInvocation(agentName, repoPath, prompt, config, prompt
         return arg;
     });
     return {
-        command: agentCmd.command,
-        args: resolvedArgs,
+        command: launch.command,
+        args: [...launch.argsPrefix, ...resolvedArgs],
         cwd: repoPath,
-        commandLabel: `${basename(agentCmd.command)} (configured agent command)`,
+        commandLabel: `${basename(launch.command)} (configured agent command)`,
         promptMode,
+        environmentVariableNames,
+        blockedEnvironmentVariableNames,
         ...(promptMode === "file" && promptFilePath ? { promptFilePath } : {}),
     };
 }

package/dist/runner/changeCapture.d.ts

@@ -51,6 +51,8 @@ export interface ChangeArtifacts {
     diff: string;
     diff_available: boolean;
     diff_truncated: boolean;
+    diff_redacted?: boolean;
+    diff_redaction_categories?: string[];
     diff_size_bytes: number;
     additions: number;
     deletions: number;
@@ -66,10 +68,16 @@ export interface ChangeArtifacts {
     unavailable_reason: string | null;
     artifact_hygiene: ArtifactHygiene;
 }
-export declare function captureRepoSnapshot(repoPath: string): Promise<RepoSnapshot>;
+export declare function captureRepoSnapshot(repoPath: string, signal?: AbortSignal): Promise<RepoSnapshot>;
 export declare function writeSnapshot(taskDir: string, filename: string, snapshot: RepoSnapshot): void;
-export declare function buildChangeArtifacts(repoPath: string, before: RepoSnapshot, after: RepoSnapshot): Promise<ChangeArtifacts>;
-export declare function compareSnapshots(before: RepoSnapshot, after: RepoSnapshot): ChangedFile[];
+export declare function buildChangeArtifacts(repoPath: string, before: RepoSnapshot, after: RepoSnapshot, signal?: AbortSignal): Promise<ChangeArtifacts>;
+export declare function sanitizeDiffEvidence(input: string, maxBytes?: number): {
+    content: string;
+    truncated: boolean;
+    redacted: boolean;
+    redaction_categories: string[];
+};
+export declare function compareSnapshots(before: RepoSnapshot, after: RepoSnapshot, platform?: NodeJS.Platform): ChangedFile[];
 export declare function emptyArtifactHygiene(): ArtifactHygiene;
 export interface ExternalDirtyFile {
     path: string;
@@ -81,13 +89,13 @@ export interface ExternalDirtyFile {
  * Extract files that are dirty in the workspace but outside the target repo.
  * Used to establish a baseline before task execution.
  */
-export declare function extractExternalDirtyFiles(workspaceSnapshot: RepoSnapshot, repoPath: string, workspaceRoot: string): ExternalDirtyFile[];
+export declare function extractExternalDirtyFiles(workspaceSnapshot: RepoSnapshot, repoPath: string, workspaceRoot: string, platform?: NodeJS.Platform): ExternalDirtyFile[];
 /**
  * Compare external dirty files between baseline and post-task snapshots.
  * Returns files that are NEW (not present in baseline) or CHANGED
  * (same path but different sha256, meaning the task modified them).
  */
-export declare function findNewExternalDirtyFiles(baseline: ExternalDirtyFile[], current: ExternalDirtyFile[]): ExternalDirtyFile[];
+export declare function findNewExternalDirtyFiles(baseline: ExternalDirtyFile[], current: ExternalDirtyFile[], platform?: NodeJS.Platform): ExternalDirtyFile[];
 export interface ArtifactManifestEntry {
     path: string;
     type: string;