patchwarden 1.5.1 → 1.6.1

package/scripts/release/pack-clean.js

@@ -1,6 +1,6 @@
 #!/usr/bin/env node
 import {
-  cpSync,
+  copyFileSync,
   existsSync,
   mkdirSync,
   readFileSync,
@@ -16,7 +16,8 @@ import { fileURLToPath } from "node:url";
 
 const scriptDir = resolve(fileURLToPath(new URL(".", import.meta.url)));
 const root = resolve(scriptDir, "..", "..");
-const releaseDir = resolve(root, "release");
+const releaseRoot = resolve(root, "release");
+const releaseDir = resolve(releaseRoot, "package");
 const archivePath = resolve(root, "patchwarden-release.tar.gz");
 
 // Read version from package.json for zip naming
@@ -31,11 +32,6 @@ const include = [
   "src",
   "ui",
   "PatchWarden.cmd",
-  "PatchWarden-Control.cmd",
-  "PatchWarden-Control-Tray.cmd",
-  "PatchWarden-Desktop.cmd",
-  "Restart-PatchWarden-Control.cmd",
-  "Stop-PatchWarden.cmd",
   ".gitignore",
   "LICENSE",
   "README.md",
@@ -57,6 +53,8 @@ const forbidden = [
   /(^|[\\/])\.env$/,
   /\.log$/,
   /^docs[\\/]optimization-proposal\.md$/i,
+  /^docs[\\/]archive(?:[\\/]|$)/i,
+  /^(?:dist|src)[\\/]test(?:[\\/]|$)/i,
   /(^|[\\/])kill-patchwarden\.(cmd|ps1)$/i,
 ];
 
@@ -173,9 +171,15 @@ function readZipEntryNames(zipPath) {
   return names;
 }
 
+const stageRelativeToRoot = toPosix(relative(root, releaseDir));
+if (stageRelativeToRoot !== "release/package") {
+  throw new Error(`Refusing to clean non-isolated release staging path: ${stageRelativeToRoot}`);
+}
+
 console.log("[pack-clean] Preparing clean release directory...");
 rmSync(releaseDir, { recursive: true, force: true });
 rmSync(archivePath, { force: true });
+mkdirSync(releaseRoot, { recursive: true });
 mkdirSync(releaseDir, { recursive: true });
 
 for (const item of include) {
@@ -185,17 +189,26 @@ for (const item of include) {
     console.log(`  skip missing: ${item}`);
     continue;
   }
-  cpSync(source, target, {
-    recursive: true,
-    filter(sourcePath) {
-      const rel = toPosix(relative(root, sourcePath));
-      return !isForbidden(rel);
-    },
-  });
+  copyAllowedEntry(source, target);
   console.log(`  copied: ${item}`);
 }
 
+// Keep an independent second boundary before the fail-closed validation. This
+// protects package contents if a future copy implementation changes behavior.
+pruneForbiddenEntries(releaseDir);
+
 const releaseFiles = listFiles(releaseDir);
+const requiredReleaseEntries = ["package.json", "README.md", "dist/index.js"];
+const missingReleaseEntries = requiredReleaseEntries.filter(
+  (entry) => !existsSync(resolve(releaseDir, entry))
+);
+if (releaseFiles.length === 0 || missingReleaseEntries.length > 0) {
+  console.error("[pack-clean] Release directory is incomplete:");
+  for (const entry of missingReleaseEntries) {
+    console.error(`  missing: ${entry}`);
+  }
+  process.exit(1);
+}
 const badReleaseEntries = releaseFiles.filter((file) =>
   isForbidden(toPosix(relative(releaseDir, file)))
 );
@@ -296,6 +309,38 @@ function listFiles(dir) {
   return entries;
 }
 
+function copyAllowedEntry(source, target) {
+  const rel = toPosix(relative(root, source));
+  if (isForbidden(rel)) {
+    return;
+  }
+
+  const stat = statSync(source);
+  if (stat.isDirectory()) {
+    mkdirSync(target, { recursive: true });
+    for (const name of readdirSync(source)) {
+      copyAllowedEntry(join(source, name), join(target, name));
+    }
+    return;
+  }
+
+  copyFileSync(source, target);
+}
+
+function pruneForbiddenEntries(dir) {
+  for (const name of readdirSync(dir)) {
+    const fullPath = join(dir, name);
+    const rel = toPosix(relative(releaseDir, fullPath));
+    if (isForbidden(rel)) {
+      rmSync(fullPath, { recursive: true, force: true });
+      continue;
+    }
+    if (statSync(fullPath).isDirectory()) {
+      pruneForbiddenEntries(fullPath);
+    }
+  }
+}
+
 function isForbidden(value) {
   return forbidden.some((pattern) => pattern.test(value));
 }

package/src/assessments/agentAssessor.ts

@@ -1,10 +1,11 @@
-import { writeFileSync } from "node:fs";
-import { resolve, relative, isAbsolute } from "node:path";
+import { resolve, relative, isAbsolute, sep } from "node:path";
 import { PatchWardenConfig } from "../config.js";
 import { buildAgentInvocation, buildAssessmentPrompt } from "../runner/agentInvocation.js";
 import { runSimpleProcessSync } from "../runner/simpleProcess.js";
 import { captureRepoSnapshot, compareSnapshots, type RepoSnapshot, type ChangedFile } from "../runner/changeCapture.js";
 import type { AgentAssessmentOutput, AgentAssessmentSummary } from "./assessmentStore.js";
+import { atomicWriteFileSync, atomicWriteJsonFileSync } from "../utils/atomicFile.js";
+import { redactSensitiveContent } from "../security/contentRedaction.js";
 
 const ASSESSMENT_MARKER = "===ASSESSMENT_JSON===";
 
@@ -45,9 +46,11 @@ export async function runAgentAssessment(input: AgentAssessorInput): Promise<Age
   };
 
   // ── 1. Build prompt and write to file for {prompt_file} support ──
-  const assessmentPrompt = buildAssessmentPrompt(input.goal, input.planContent, input.repoPath);
+  const safeGoal = redactSensitiveContent(input.goal).content.slice(0, 10_000);
+  const safePlan = redactSensitiveContent(input.planContent).content.slice(0, 1024 * 1024);
+  const assessmentPrompt = buildAssessmentPrompt(safeGoal, safePlan, input.repoPath);
   const promptFilePath = resolve(input.assessmentDir, "agent-assessment-prompt.md");
-  writeFileSync(promptFilePath, assessmentPrompt, "utf-8");
+  atomicWriteFileSync(promptFilePath, assessmentPrompt);
   logPaths.prompt = promptFilePath;
 
   // ── 2. Before snapshot (repo-scoped) ──
@@ -89,6 +92,8 @@ export async function runAgentAssessment(input: AgentAssessorInput): Promise<Age
     maxStderrBytes: Math.max(16384, Math.floor(input.maxOutputBytes / 4)),
     stdoutPath: logPaths.stdout,
     stderrPath: logPaths.stderr,
+    environmentVariableNames: invocation.environmentVariableNames,
+    blockedEnvironmentVariableNames: invocation.blockedEnvironmentVariableNames,
   });
 
   // ── 5. After snapshot + read-only violation check ──
@@ -123,11 +128,11 @@ export async function runAgentAssessment(input: AgentAssessorInput): Promise<Age
       stderr_truncated: result.stderrTruncated,
       log_paths: { ...logPaths, violation: resolve(input.assessmentDir, "agent-assessment-violation.json") },
     };
-    writeFileSync(summary.log_paths.violation!, JSON.stringify({
+    atomicWriteJsonFileSync(summary.log_paths.violation!, {
       violation: "read_only_violation",
       files: violationFiles,
       exit_code: result.exitCode,
-    }, null, 2), "utf-8");
+    });
     writeSummary(logPaths.assessment, summary);
     return summary;
   }
@@ -253,12 +258,16 @@ function parseAssessmentJson(stdout: string, repoPath: string): ParsedAssessment
   const jsonEnd = jsonText.lastIndexOf("}");
   if (jsonStart < 0 || jsonEnd < 0 || jsonEnd <= jsonStart) return { output: null, sanitized_reasons };
 
-  let parsed: any;
+  let parsedValue: unknown;
   try {
-    parsed = JSON.parse(jsonText.slice(jsonStart, jsonEnd + 1));
+    parsedValue = JSON.parse(jsonText.slice(jsonStart, jsonEnd + 1));
   } catch {
     return { output: null, sanitized_reasons };
   }
+  if (!parsedValue || typeof parsedValue !== "object" || Array.isArray(parsedValue)) {
+    return { output: null, sanitized_reasons };
+  }
+  const parsed = parsedValue as Record<string, unknown>;
 
   // ── Strict validation ──
   if (parsed.risk_level !== "low" && parsed.risk_level !== "medium" && parsed.risk_level !== "high") {
@@ -272,7 +281,9 @@ function parseAssessmentJson(stdout: string, repoPath: string): ParsedAssessment
 
   if (!Array.isArray(parsed.reason_codes)) return { output: null, sanitized_reasons };
   if (parsed.reason_codes.length > 50) return { output: null, sanitized_reasons };
-  const reasonCodes = parsed.reason_codes.filter((r: any) => typeof r === "string" && r.length <= 100);
+  const reasonCodes = parsed.reason_codes.filter((reason): reason is string =>
+    typeof reason === "string" && reason.length <= 100
+  );
   if (reasonCodes.length !== parsed.reason_codes.length) {
     sanitized_reasons.push("reason_codes_filtered");
   }
@@ -287,7 +298,10 @@ function parseAssessmentJson(stdout: string, repoPath: string): ParsedAssessment
     if (isAbsolute(p)) { pathsSanitized = true; continue; }
     const resolved = resolve(repoPath, p);
     const rel = relative(repoPath, resolved);
-    if (rel.startsWith("..")) { pathsSanitized = true; continue; }
+    if (rel === ".." || rel.startsWith(`..${sep}`) || isAbsolute(rel)) {
+      pathsSanitized = true;
+      continue;
+    }
     affectedPaths.push(p);
   }
   if (pathsSanitized) {
@@ -297,7 +311,7 @@ function parseAssessmentJson(stdout: string, repoPath: string): ParsedAssessment
   if (!Array.isArray(parsed.destructive_actions)) return { output: null, sanitized_reasons };
   if (parsed.destructive_actions.length > 20) return { output: null, sanitized_reasons };
   const destructiveActions = parsed.destructive_actions.filter(
-    (d: any) => typeof d === "string" && d.length <= 200
+    (action): action is string => typeof action === "string" && action.length <= 200
   );
 
   if (typeof parsed.requires_user_confirm !== "boolean") return { output: null, sanitized_reasons };
@@ -320,5 +334,5 @@ function parseAssessmentJson(stdout: string, repoPath: string): ParsedAssessment
 }
 
 function writeSummary(path: string, summary: AgentAssessmentSummary): void {
-  writeFileSync(path, JSON.stringify(summary, null, 2), "utf-8");
+  atomicWriteJsonFileSync(path, summary);
 }

package/src/assessments/assessmentStore.ts

@@ -1,17 +1,18 @@
 import {
   mkdirSync,
-  writeFileSync,
   existsSync,
   readFileSync,
-  renameSync,
 } from "node:fs";
 import { createHash, randomBytes } from "node:crypto";
 import { resolve, join } from "node:path";
 import { getAssessmentsDir, getConfig, getRepoAllowedTestCommands, PatchWardenConfig } from "../config.js";
 import { guardPath } from "../security/pathGuard.js";
 import { PatchWardenError } from "../errors.js";
+import { redactSensitiveContent } from "../security/contentRedaction.js";
+import { atomicWriteJsonFileSync } from "../utils/atomicFile.js";
+import { withFileLockSync } from "../utils/lockedJsonFile.js";
 import { TOOL_SCHEMA_EPOCH } from "../version.js";
-import { getLastToolCatalogSnapshot } from "../tools/toolCatalog.js";
+import { getLastToolCatalogSnapshot } from "../tools/catalog/toolCatalog.js";
 import { captureRepoSnapshot, type RepoSnapshot } from "../runner/changeCapture.js";
 import type { RiskAssessmentResult } from "../security/riskEngine.js";
 import type { TaskTemplateName, ChangePolicy } from "../tools/taskTemplates.js";
@@ -203,7 +204,7 @@ export function createAssessment(input: AssessmentCreateInput): AssessmentRecord
     repo_path: input.repo_path,
     resolved_repo_path: input.resolved_repo_path,
     template: input.template || null,
-    goal: input.goal || null,
+    goal: input.goal ? redactSensitiveContent(input.goal).content : null,
     test_command: input.test_command || null,
     verify_commands: input.verify_commands || [],
     agent: input.agent,
@@ -216,7 +217,7 @@ export function createAssessment(input: AssessmentCreateInput): AssessmentRecord
     agent_assessment_summary: input.agent_assessment_summary || null,
   };
 
-  writeFileSync(join(dir, "assessment.json"), JSON.stringify(record, null, 2), "utf-8");
+  atomicWriteJsonFileSync(join(dir, "assessment.json"), record);
 
   return record;
 }
@@ -323,6 +324,10 @@ export async function confirmAssessment(assessmentId: string): Promise<Assessmen
     );
   }
 
+  const config = getConfig();
+  const assessmentFile = resolve(getAssessmentsDir(config), assessmentId, "assessment.json");
+  guardPath(assessmentFile, config.workspaceRoot, config.assessmentsDir);
+
   const assessment = readAssessment(assessmentId);
   if (assessment.decision !== "needs_confirm" || !assessment.requires_confirm) {
     throw new PatchWardenError(
@@ -335,43 +340,50 @@ export async function confirmAssessment(assessmentId: string): Promise<Assessmen
   }
 
   const snapshot = await captureRepoSnapshot(assessment.resolved_repo_path);
-  const validation = validateAssessmentFreshness(assessmentId, snapshot, {
-    allow_unconfirmed: true,
-    // A standalone CLI has no active MCP profile snapshot. The execute path
-    // still performs the full tool-manifest check before creating the task.
-    skip_tool_manifest: true,
-  });
-  if (!validation.valid || !validation.assessment) {
-    throw new PatchWardenError(
-      validation.failure_reason || "assessment_validation_failed",
-      `Assessment "${assessmentId}" cannot be confirmed: ${validation.failure_reason || "validation_failed"}.`,
-      "Run create_task with execution_mode=assess_only again, then confirm the new assessment locally."
-    );
-  }
 
-  const confirmedAt = validation.assessment.confirmed_at || new Date().toISOString();
-  const confirmedRecord: AssessmentRecord = {
-    ...validation.assessment,
-    confirmed: true,
-    confirmed_at: confirmedAt,
-    confirm_code: validation.assessment.confirm_code || randomBytes(8).toString("hex"),
-  };
-  const config = getConfig();
-  const assessmentFile = resolve(getAssessmentsDir(config), assessmentId, "assessment.json");
-  guardPath(assessmentFile, config.workspaceRoot, config.assessmentsDir);
-  const temporaryFile = `${assessmentFile}.${process.pid}.${randomBytes(4).toString("hex")}.tmp`;
-  guardPath(temporaryFile, config.workspaceRoot, config.assessmentsDir);
-  writeFileSync(temporaryFile, JSON.stringify(confirmedRecord, null, 2), "utf-8");
-  renameSync(temporaryFile, assessmentFile);
+  // Re-read and write while holding one cross-process lock. Concurrent local
+  // confirmers may compute snapshots in parallel, but they cannot replace one
+  // another's confirmation metadata from a stale assessment record.
+  return withFileLockSync(assessmentFile, () => {
+    const validation = validateAssessmentFreshness(assessmentId, snapshot, {
+      allow_unconfirmed: true,
+      // A standalone CLI has no active MCP profile snapshot. The execute path
+      // still performs the full tool-manifest check before creating the task.
+      skip_tool_manifest: true,
+    });
+    if (!validation.valid || !validation.assessment) {
+      throw new PatchWardenError(
+        validation.failure_reason || "assessment_validation_failed",
+        `Assessment "${assessmentId}" cannot be confirmed: ${validation.failure_reason || "validation_failed"}.`,
+        "Run create_task with execution_mode=assess_only again, then confirm the new assessment locally."
+      );
+    }
+    if (validation.assessment.decision !== "needs_confirm" || !validation.assessment.requires_confirm) {
+      throw new PatchWardenError(
+        "assessment_confirmation_not_allowed",
+        `Assessment "${assessmentId}" is no longer eligible for local confirmation.`,
+        "Run create_task with execution_mode=assess_only again."
+      );
+    }
 
-  return {
-    assessment_id: assessmentId,
-    decision: "needs_confirm",
-    confirmed: true,
-    confirmed_at: confirmedAt,
-    expires_at: confirmedRecord.expires_at,
-    next_action: "Call create_task with only execution_mode=execute and this full assessment_id.",
-  };
+    const confirmedAt = validation.assessment.confirmed_at || new Date().toISOString();
+    const confirmedRecord: AssessmentRecord = {
+      ...validation.assessment,
+      confirmed: true,
+      confirmed_at: confirmedAt,
+      confirm_code: validation.assessment.confirm_code || randomBytes(8).toString("hex"),
+    };
+    atomicWriteJsonFileSync(assessmentFile, confirmedRecord);
+
+    return {
+      assessment_id: assessmentId,
+      decision: "needs_confirm",
+      confirmed: true,
+      confirmed_at: confirmedAt,
+      expires_at: confirmedRecord.expires_at,
+      next_action: "Call create_task with only execution_mode=execute and this full assessment_id.",
+    };
+  });
 }
 
 export function computeWorkspaceFingerprint(snapshot: RepoSnapshot): string {

package/src/config.ts

@@ -1,11 +1,15 @@
 import { readFileSync, existsSync } from "node:fs";
-import { isAbsolute, relative, resolve, sep } from "node:path";
+import { basename, isAbsolute, relative, resolve, sep } from "node:path";
+import { validateWorkspaceRoot } from "./security/workspaceRootGuard.js";
 
 // ── Type definitions ──────────────────────────────────────────────
 
 export interface AgentConfig {
   command: string;
   args: string[];
+  envAllowlist?: string[];
+  adapter?: string;
+  model?: string;
 }
 
 export interface PatchWardenConfig {
@@ -31,6 +35,12 @@ export interface PatchWardenConfig {
   agentAssessmentMaxOutputBytes?: number;
   agentAssessmentAgentName?: string;
   enableDirectProfile?: boolean;
+  tunnelClientPath?: string;
+  tunnelProxy?: {
+    scope: "shared" | "separate";
+    core: { mode: "environment" | "none" | "manual"; url?: string };
+    direct: { mode: "environment" | "none" | "manual"; url?: string };
+  };
   directSessionsDir: string;
   directSessionTtlSeconds: number;
   directMaxPatchBytes: number;
@@ -47,16 +57,7 @@ const DEFAULT_CONFIG: PatchWardenConfig = {
   tasksDir: ".patchwarden/tasks",
   assessmentsDir: ".patchwarden/assessments",
   assessmentTtlSeconds: 3600,
-  agents: {
-    codex: {
-      command: "codex",
-      args: ["exec", "--cd", "{repo}", "{prompt}"],
-    },
-    opencode: {
-      command: "opencode",
-      args: ["run", "{prompt}"],
-    },
-  },
+  agents: {},
   allowedTestCommands: [
     "npm test",
     "npm run test",
@@ -175,6 +176,11 @@ function normalizeConfig(config: PatchWardenConfig): PatchWardenConfig {
   if (!config.workspaceRoot || typeof config.workspaceRoot !== "string") {
     throw new Error("workspaceRoot must be a non-empty string");
   }
+  const workspaceValidation = validateWorkspaceRoot(config.workspaceRoot);
+  if (!workspaceValidation.ok) {
+    throw new Error(`Invalid workspaceRoot: ${workspaceValidation.reason} (${workspaceValidation.path})`);
+  }
+  config.workspaceRoot = workspaceValidation.path;
   if (!config.plansDir || typeof config.plansDir !== "string") {
     throw new Error("plansDir must be a non-empty string");
   }
@@ -190,6 +196,20 @@ function normalizeConfig(config: PatchWardenConfig): PatchWardenConfig {
   if (!config.agents || typeof config.agents !== "object") {
     throw new Error("agents must be an object");
   }
+  const agents: Record<string, AgentConfig> = {};
+  for (const [agentName, agent] of Object.entries(config.agents)) {
+    if (!agent || typeof agent !== "object" || typeof agent.command !== "string" || !Array.isArray(agent.args)) {
+      throw new Error(`agents["${agentName}"] must define command and args`);
+    }
+    const envAllowlist = agent.envAllowlist ?? [];
+    if (!Array.isArray(envAllowlist) || envAllowlist.some((name) => typeof name !== "string" || !/^[A-Za-z_][A-Za-z0-9_]*$/.test(name))) {
+      throw new Error(`agents["${agentName}"].envAllowlist must contain only environment variable names`);
+    }
+    const blockedNames = new Set(["CONTROL_PLANE_API_KEY", "PATCHWARDEN_OWNER_TOKEN", config.http?.ownerTokenEnv?.toUpperCase()]);
+    const blocked = envAllowlist.find((name) => blockedNames.has(name.toUpperCase()));
+    if (blocked) throw new Error(`agents["${agentName}"].envAllowlist cannot include reserved variable "${blocked}"`);
+    agents[agentName] = { ...agent, args: [...agent.args], envAllowlist: [...new Set(envAllowlist)] };
+  }
   if (!Array.isArray(config.allowedTestCommands)) {
     throw new Error("allowedTestCommands must be an array");
   }
@@ -263,8 +283,14 @@ function normalizeConfig(config: PatchWardenConfig): PatchWardenConfig {
     if (config.http.host !== undefined && typeof config.http.host !== "string") {
       throw new Error("http.host must be a string");
     }
-    if (config.http.ownerTokenEnv !== undefined && typeof config.http.ownerTokenEnv !== "string") {
-      throw new Error("http.ownerTokenEnv must be a string");
+    if (
+      config.http.ownerTokenEnv !== undefined
+      && (
+        typeof config.http.ownerTokenEnv !== "string"
+        || !/^[A-Za-z_][A-Za-z0-9_]*$/.test(config.http.ownerTokenEnv)
+      )
+    ) {
+      throw new Error("http.ownerTokenEnv must be a valid environment variable name");
     }
   }
   if (config.enableRunTaskTool !== undefined && typeof config.enableRunTaskTool !== "boolean") {
@@ -289,6 +315,36 @@ function normalizeConfig(config: PatchWardenConfig): PatchWardenConfig {
   if (config.enableDirectProfile !== undefined && typeof config.enableDirectProfile !== "boolean") {
     throw new Error("enableDirectProfile must be a boolean");
   }
+  if (config.tunnelClientPath !== undefined) {
+    if (typeof config.tunnelClientPath !== "string" || !isAbsolute(config.tunnelClientPath)) {
+      throw new Error("tunnelClientPath must be an absolute path");
+    }
+    if (basename(config.tunnelClientPath).toLowerCase() !== "tunnel-client.exe") {
+      throw new Error("tunnelClientPath must point to tunnel-client.exe");
+    }
+  }
+  if (config.tunnelProxy !== undefined) {
+    if (!config.tunnelProxy || typeof config.tunnelProxy !== "object" || !["shared", "separate"].includes(config.tunnelProxy.scope)) {
+      throw new Error("tunnelProxy.scope must be shared or separate");
+    }
+    for (const key of ["core", "direct"] as const) {
+      const endpoint = config.tunnelProxy[key];
+      if (!endpoint || typeof endpoint !== "object" || !["environment", "none", "manual"].includes(endpoint.mode)) {
+        throw new Error(`tunnelProxy.${key}.mode must be environment, none, or manual`);
+      }
+      if (endpoint.mode === "manual") {
+        if (typeof endpoint.url !== "string") throw new Error(`tunnelProxy.${key}.url is required in manual mode`);
+        let parsed: URL;
+        try { parsed = new URL(endpoint.url); } catch { throw new Error(`tunnelProxy.${key}.url must be a valid URL`); }
+        if (!["http:", "https:", "socks5:"].includes(parsed.protocol)) {
+          throw new Error(`tunnelProxy.${key}.url must use http, https, or socks5`);
+        }
+        if (parsed.username || parsed.password) throw new Error(`tunnelProxy.${key}.url must not contain credentials`);
+      } else if (endpoint.url !== undefined) {
+        throw new Error(`tunnelProxy.${key}.url is only allowed in manual mode`);
+      }
+    }
+  }
   if (!config.directSessionsDir || typeof config.directSessionsDir !== "string") {
     throw new Error("directSessionsDir must be a non-empty string");
   }
@@ -331,6 +387,7 @@ function normalizeConfig(config: PatchWardenConfig): PatchWardenConfig {
 
   return {
     ...config,
+    agents,
     workspaceRoot: resolve(config.workspaceRoot),
     allowedTestCommands: [...new Set(config.allowedTestCommands.map((command) => command.trim()))],
     repoAllowedTestCommands,

package/src/control/fileManager.ts

@@ -0,0 +1,40 @@
+import { spawn } from "node:child_process";
+import { join } from "node:path";
+import { buildChildEnvironment, resolveTrustedExecutable } from "../runner/processSecurity.js";
+
+const FILE_MANAGER_ENVIRONMENT = [
+  "DISPLAY",
+  "WAYLAND_DISPLAY",
+  "DBUS_SESSION_BUS_ADDRESS",
+  "XDG_RUNTIME_DIR",
+] as const;
+
+/** Launch a trusted platform file manager without inheriting ambient secrets. */
+export function launchFileManager(target: string, cwd: string): boolean {
+  try {
+    const env = buildChildEnvironment({ cwd, allowedNames: FILE_MANAGER_ENVIRONMENT });
+    const requested = fileManagerCommand(env);
+    const command = resolveTrustedExecutable(requested, cwd, { pathValue: env.PATH });
+    const child = spawn(command, [target], {
+      cwd,
+      detached: true,
+      env,
+      stdio: "ignore",
+      windowsHide: true,
+    });
+    child.on("error", () => { /* opening a convenience viewer is best effort */ });
+    child.unref();
+    return true;
+  } catch {
+    return false;
+  }
+}
+
+function fileManagerCommand(env: NodeJS.ProcessEnv): string {
+  if (process.platform === "win32") {
+    const windowsRoot = env.SystemRoot || env.WINDIR;
+    return windowsRoot ? join(windowsRoot, "explorer.exe") : "explorer.exe";
+  }
+  if (process.platform === "darwin") return "open";
+  return "xdg-open";
+}

package/src/control/middleware/auth.ts

@@ -7,11 +7,29 @@
  * action must pass through `checkControlToken` first.
  */
 import { type IncomingMessage } from "node:http";
+import { firstHeaderValue, timingSafeStringEqual } from "../../security/secretComparison.js";
+import { isTrustedLoopbackHostHeader } from "../../security/loopbackHost.js";
 import { controlToken } from "../shared.js";
 
 export function checkControlToken(req: IncomingMessage): boolean {
-  const header = req.headers["x-patchwarden-control-token"];
-  const provided = Array.isArray(header) ? header[0] : header;
-  if (typeof provided !== "string" || provided.length === 0) return false;
-  return provided === controlToken;
+  const provided = firstHeaderValue(req.headers["x-patchwarden-control-token"]);
+  return provided.length > 0 && timingSafeStringEqual(provided, controlToken);
+}
+
+/**
+ * Reject non-loopback Host headers before exposing the browser-readable
+ * control token. Binding to 127.0.0.1 alone does not prevent DNS rebinding.
+ */
+export function isTrustedControlHost(
+  req: IncomingMessage,
+  expectedPort: number,
+): boolean {
+  return isTrustedControlHostHeader(req.headers.host, expectedPort);
+}
+
+export function isTrustedControlHostHeader(
+  value: string | string[] | undefined,
+  expectedPort: number,
+): boolean {
+  return isTrustedLoopbackHostHeader(value, expectedPort);
 }

package/src/control/middleware/static.ts

@@ -5,7 +5,7 @@
  * assets, css) with path-traversal protection, plus the inline SVG favicon.
  * Content types are mapped from `CONTENT_TYPES` in shared.ts.
  */
-import { existsSync, readFileSync, statSync } from "node:fs";
+import { existsSync, readFileSync, realpathSync, statSync } from "node:fs";
 import { extname, isAbsolute, relative, resolve } from "node:path";
 import { type ServerResponse } from "node:http";
 import {
@@ -51,9 +51,22 @@ export function serveStatic(res: ServerResponse, urlPath: string): void {
       sendJson(res, 404, { error: "Not found" });
       return;
     }
-    const ext = extname(candidate).toLowerCase();
+    // Resolve links before reading. Lexical `..` checks alone do not stop a
+    // symlink or junction inside `ui/` from pointing outside the bundle.
+    const realRoot = realpathSync(uiRoot);
+    const realCandidate = realpathSync(candidate);
+    const realRelative = relative(realRoot, realCandidate);
+    if (realRelative === "" || realRelative.startsWith("..") || isAbsolute(realRelative)) {
+      sendJson(res, 403, { error: "Forbidden" });
+      return;
+    }
+    if (!statSync(realCandidate).isFile()) {
+      sendJson(res, 404, { error: "Not found" });
+      return;
+    }
+    const ext = extname(realCandidate).toLowerCase();
     const contentType = CONTENT_TYPES[ext] || "application/octet-stream";
-    const content = readFileSync(candidate);
+    const content = readFileSync(realCandidate);
     res.writeHead(200, { "Content-Type": contentType });
     res.end(content);
   } catch (err) {