patchwarden 1.5.1 → 1.6.1

package/src/tools/{runTaskLoop.ts → tasks/runTaskLoop.ts}

@@ -1,14 +1,14 @@
 import { setTimeout as sleep } from "node:timers/promises";
-import { getConfig } from "../config.js";
-import { createWorktree } from "../goal/worktreeManager.js";
-import { guardWorkspacePath } from "../security/pathGuard.js";
-import { createDirectSession } from "./createDirectSession.js";
+import { getConfig } from "../../config.js";
+import { createWorktree } from "../../goal/worktreeManager.js";
+import { guardWorkspacePath } from "../../security/pathGuard.js";
+import { createDirectSession } from "../direct/createDirectSession.js";
 import { createTask, type CreateTaskInput } from "./createTask.js";
-import { recommendAgentForTask } from "./recommendAgentForTask.js";
-import { runDirectVerificationBundle } from "./runDirectVerificationBundle.js";
+import { recommendAgentForTask } from "../workspace/recommendAgentForTask.js";
+import { runDirectVerificationBundle } from "../direct/runDirectVerificationBundle.js";
 import { waitForTask } from "./waitForTask.js";
-import { safeAudit, safeAuditDirectSession, safeFinalizeDirectSession, safeResult, safeTestSummary } from "./safeViews.js";
-import type { TaskTemplateName } from "./taskTemplates.js";
+import { safeAudit, safeAuditDirectSession, safeFinalizeDirectSession, safeResult, safeTestSummary } from "../diagnostics/safeViews.js";
+import type { TaskTemplateName } from "../taskTemplates.js";
 import {
   createLineageId,
   writeTaskLineage,
@@ -202,18 +202,23 @@ export async function runTaskLoopWithDeps(
       timeout_seconds: normalized.task_timeout_seconds,
       execution_mode: "assess_only",
     };
-    const assessment = await deps.createTask(assessmentInput as CreateTaskInput & { execution_mode: "assess_only" }) as any;
+    const assessment = asRecord(await deps.createTask(assessmentInput));
     if (assessment.decision === "blocked") {
-      return finalize("blocked", "high_risk_blocked", "Risk assessment blocked task execution.", assessment.reason_codes?.join(", "));
+      return finalize(
+        "blocked",
+        "high_risk_blocked",
+        "Risk assessment blocked task execution.",
+        asArray(assessment.reason_codes).map(String).join(", "),
+      );
     }
     if (assessment.decision === "needs_confirm") {
       return finalize("blocked", "user_confirmation_required", "Ask the user to confirm the assessment before executing the loop.");
     }
 
-    const created = await deps.createTask({
+    const created = asRecord(await deps.createTask({
       execution_mode: "execute",
       assessment_id: String(assessment.assessment_id || ""),
-    }) as any;
+    }));
     const taskId = String(created.task_id || "");
     if (!taskId) {
       return finalize("failed", "policy_blocked", "create_task returned no task_id.", "create_task returned no task_id");
@@ -226,9 +231,9 @@ export async function runTaskLoopWithDeps(
       return finalize("blocked", wait.stop_reason, wait.next_action, wait.error);
     }
 
-    const result = deps.safeResult(taskId, { max_items: 8 }) as any;
-    const tests = deps.safeTestSummary(taskId) as any;
-    const audit = deps.safeAudit(taskId, { max_items: 8 }) as any;
+    const result = asRecord(deps.safeResult(taskId, { max_items: 8 }));
+    const tests = asRecord(deps.safeTestSummary(taskId));
+    const audit = asRecord(deps.safeAudit(taskId, { max_items: 8 }));
     const round = buildRound(iteration, taskId, role, result, tests, audit);
     lineage.rounds.push(round);
     lineage.updated_at = deps.now().toISOString();
@@ -267,7 +272,7 @@ async function waitUntilTerminal(
 ): Promise<{ stop_reason?: TaskLoopStopReason; next_action: string; error?: string }> {
   const deadline = Date.now() + timeoutSeconds * 1000;
   while (Date.now() < deadline) {
-    const waited = await deps.waitForTask(taskId, 30) as any;
+    const waited = await deps.waitForTask(taskId, 30);
     if (waited.terminal || TERMINAL_STATUSES.has(String(waited.status))) {
       return { next_action: waited.next_action || "safe_audit" };
     }
@@ -291,23 +296,35 @@ function buildRound(
   iteration: number,
   taskId: string,
   role: TaskLineageRound["role"],
-  result: any,
-  tests: any,
-  audit: any
+  resultValue: unknown,
+  testsValue: unknown,
+  auditValue: unknown,
 ): TaskLineageRound {
-  const failChecks = Array.isArray(audit.fail_checks) ? audit.fail_checks.map((entry: any) => String(entry.name || entry)) : [];
-  const warnChecks = Array.isArray(audit.warn_checks) ? audit.warn_checks.map((entry: any) => String(entry.name || entry)) : [];
+  const result = asRecord(resultValue);
+  const tests = asRecord(testsValue);
+  const audit = asRecord(auditValue);
+  const resultVerification = asRecord(result.verification);
+  const auditAcceptance = asRecord(audit.acceptance);
+  const failChecks = asArray(audit.fail_checks).map((entry) => {
+    const check = asRecord(entry);
+    return String(check.name || entry);
+  });
+  const warnChecks = asArray(audit.warn_checks).map((entry) => {
+    const check = asRecord(entry);
+    return String(check.name || entry);
+  });
+  const recommendedActions = asArray(audit.recommended_next_actions);
   return {
     iteration,
     task_id: taskId,
     role,
     status: String(result.status || "unknown"),
     terminal: Boolean(result.terminal),
-    verification_status: String(tests.status || result.verification?.status || "not_available"),
-    audit_verdict: String(audit.verdict || audit.acceptance?.verdict || "unknown"),
+    verification_status: String(tests.status || resultVerification.status || "not_available"),
+    audit_verdict: String(audit.verdict || auditAcceptance.verdict || "unknown"),
     fail_checks: failChecks,
     warn_checks: warnChecks,
-    next_action: String(result.next_action || audit.recommended_next_actions?.[0] || "review_task"),
+    next_action: String(result.next_action || recommendedActions[0] || "review_task"),
   };
 }
 
@@ -322,21 +339,25 @@ function isSuccessfulRound(round: TaskLineageRound): boolean {
   );
 }
 
-function isHardStop(round: TaskLineageRound, result: any, audit: any, stopOnHighRisk: boolean): boolean {
+function isHardStop(round: TaskLineageRound, resultValue: unknown, auditValue: unknown, stopOnHighRisk: boolean): boolean {
   if (["failed_scope_violation", "failed_policy_violation", "canceled"].includes(round.status)) return true;
   if (!stopOnHighRisk) return false;
   const checkNames = [...round.fail_checks, ...round.warn_checks].join(" ").toLowerCase();
-  const reason = String(result.failure_reason || audit.acceptance?.reason || "").toLowerCase();
+  const result = asRecord(resultValue);
+  const audit = asRecord(auditValue);
+  const reason = String(result.failure_reason || asRecord(audit.acceptance).reason || "").toLowerCase();
   return /scope|secret|sensitive|publish|release|policy|push/.test(`${checkNames} ${reason}`);
 }
 
-function hardStopReason(round: TaskLineageRound, result: any): TaskLoopStopReason {
+function hardStopReason(round: TaskLineageRound, resultValue: unknown): TaskLoopStopReason {
+  const result = asRecord(resultValue);
   if (round.status === "failed_scope_violation" || round.status === "failed_policy_violation") return "policy_blocked";
   if (String(result.failure_reason || "").toLowerCase().includes("timeout")) return "agent_timeout";
   return "high_risk_blocked";
 }
 
-function buildFixGoal(originalGoal: string, result: any, round: TaskLineageRound): string {
+function buildFixGoal(originalGoal: string, resultValue: unknown, round: TaskLineageRound): string {
+  const result = asRecord(resultValue);
   const failedCommand = result.failed_command ? ` Failed command: ${result.failed_command}.` : "";
   return [
     `Fix the failing verification for this PatchWarden loop without changing unrelated behavior.`,
@@ -413,8 +434,12 @@ async function runDirectVerification(
       commands: normalized.direct_verify_commands,
       timeout_seconds: normalized.direct_verify_timeout_seconds,
     });
-    const finalized = await deps.safeFinalizeDirectSession(sessionId, { max_items: 8 }) as any;
-    const audit = deps.safeAuditDirectSession(sessionId, { max_items: 8 }) as any;
+    const finalized = asRecord(await deps.safeFinalizeDirectSession(sessionId, { max_items: 8 }));
+    const audit = asRecord(deps.safeAuditDirectSession(sessionId, { max_items: 8 }));
+    const auditEvidence = asRecord(audit.evidence);
+    const auditDecision = audit.decision === "pass" || audit.decision === "warn" || audit.decision === "fail"
+      ? audit.decision
+      : "not_run";
     const evidence: TaskLineageDirectSession = {
       session_id: sessionId,
       status: bundle.status,
@@ -422,8 +447,8 @@ async function runDirectVerification(
       passed_commands: bundle.passed_commands,
       failed_commands: bundle.failed_commands,
       timed_out_commands: bundle.timed_out_commands,
-      audit_decision: audit.decision || "not_run",
-      changed_files_total: Number(finalized.changed_files_total || audit.evidence?.changed_files_total || 0),
+      audit_decision: auditDecision,
+      changed_files_total: Number(finalized.changed_files_total || auditEvidence.changed_files_total || 0),
       next_action: String(audit.next_action || bundle.next_action || "review_direct_session"),
     };
     if (bundle.status !== "passed") {
@@ -435,7 +460,7 @@ async function runDirectVerification(
         error: "Direct verification failed.",
       };
     }
-    if (audit.decision === "fail") {
+    if (auditDecision === "fail") {
       return {
         evidence,
         stop_reason: "direct_audit_failed",
@@ -448,7 +473,7 @@ async function runDirectVerification(
       evidence,
       final_status: "accepted",
       next_action: "accept",
-      warning: audit.decision === "warn" ? "Direct audit completed with warnings." : undefined,
+      warning: auditDecision === "warn" ? "Direct audit completed with warnings." : undefined,
     };
   } catch (err) {
     const message = err instanceof Error ? err.message : String(err);
@@ -467,6 +492,16 @@ async function runDirectVerification(
   }
 }
 
+function asRecord(value: unknown): Record<string, unknown> {
+  return value && typeof value === "object" && !Array.isArray(value)
+    ? value as Record<string, unknown>
+    : {};
+}
+
+function asArray(value: unknown): unknown[] {
+  return Array.isArray(value) ? value : [];
+}
+
 function normalizeInput(input: RunTaskLoopInput): Required<Omit<RunTaskLoopInput, "agent" | "scope_files" | "worktree_base_branch">> & { agent?: string; scope_files?: string[]; worktree_base_branch?: string } {
   const config = getConfig();
   const repoPath = String(input.repo_path || "").trim();

package/src/tools/{runVerification.ts → tasks/runVerification.ts}

@@ -1,9 +1,10 @@
 import {
   readDirectSession,
   appendDirectSessionVerificationRun,
-} from "../direct/directSessionStore.js";
-import { guardDirectSessionActive } from "../direct/directGuards.js";
-import { runDirectVerification } from "../direct/directVerification.js";
+  withDirectSessionMutationLockAsync,
+} from "../../direct/directSessionStore.js";
+import { guardDirectSessionActive } from "../../direct/directGuards.js";
+import { runDirectVerification } from "../../direct/directVerification.js";
 
 export interface RunVerificationInput {
   session_id: string;
@@ -29,6 +30,7 @@ export interface RunVerificationOutput {
 export async function runVerification(
   input: RunVerificationInput
 ): Promise<RunVerificationOutput> {
+  return withDirectSessionMutationLockAsync(input.session_id, async () => {
   // 1. Read session and guard active
   const session = readDirectSession(input.session_id);
   guardDirectSessionActive(session);
@@ -63,4 +65,5 @@ export async function runVerification(
       ? "Call finalize_direct_session to complete the session."
       : "Review the verification output and apply_patch to fix issues.",
   };
+  });
 }

package/src/tools/{taskLineage.ts → tasks/taskLineage.ts}

@@ -1,10 +1,11 @@
 import { randomBytes } from "node:crypto";
-import { existsSync, mkdirSync, readFileSync, writeFileSync } from "node:fs";
+import { existsSync, mkdirSync, readFileSync } from "node:fs";
 import { join, resolve } from "node:path";
-import { getConfig } from "../config.js";
-import { guardReadPath } from "../security/pathGuard.js";
-import { redactSensitiveValue } from "../security/contentRedaction.js";
-import { PatchWardenError } from "../errors.js";
+import { getConfig } from "../../config.js";
+import { guardReadPath } from "../../security/pathGuard.js";
+import { redactSensitiveValue } from "../../security/contentRedaction.js";
+import { PatchWardenError } from "../../errors.js";
+import { atomicWriteFileSync, atomicWriteJsonFileSync } from "../../utils/atomicFile.js";
 
 export type TaskLoopStopReason =
   | "success"
@@ -119,8 +120,8 @@ export function writeTaskLineage(record: TaskLineageRecord): SafeTaskLineage {
   const lineageDir = resolve(config.workspaceRoot, ".patchwarden", "lineages", record.lineage_id);
   mkdirSync(lineageDir, { recursive: true });
   const safeRecord = redactSensitiveValue(record).value as TaskLineageRecord;
-  writeFileSync(join(lineageDir, "lineage.json"), JSON.stringify(safeRecord, null, 2) + "\n", "utf-8");
-  writeFileSync(join(lineageDir, "SUMMARY.md"), buildSummaryMarkdown(safeRecord), "utf-8");
+  atomicWriteJsonFileSync(join(lineageDir, "lineage.json"), safeRecord);
+  atomicWriteFileSync(join(lineageDir, "SUMMARY.md"), buildSummaryMarkdown(safeRecord));
   return toSafeTaskLineage(safeRecord);
 }
 

package/src/tools/{taskOutputs.ts → tasks/taskOutputs.ts}

@@ -1,9 +1,13 @@
 import { getTaskFile, GetTaskFileOutput } from "./getTaskFile.js";
-import { existsSync, readFileSync, statSync } from "node:fs";
+import { existsSync, statSync } from "node:fs";
 import { join, resolve } from "node:path";
-import { getConfig, getTasksDir } from "../config.js";
-import { guardPath } from "../security/pathGuard.js";
-import { redactSensitiveContent } from "../security/contentRedaction.js";
+import { getConfig, getTasksDir } from "../../config.js";
+import { guardPath } from "../../security/pathGuard.js";
+import { redactSensitiveContent } from "../../security/contentRedaction.js";
+import {
+  readTextFilePrefixSync,
+  readTextFileTailLinesSync,
+} from "../../utils/boundedFile.js";
 
 export function getResult(taskId: string): GetTaskFileOutput {
   return getTaskFile(taskId, "result.md");
@@ -23,26 +27,25 @@ export function getDiff(taskId: string): GetTaskFileOutput {
   }
   const filePath = existsSync(preferred) ? preferred : fallback;
   guardPath(filePath, config.workspaceRoot, config.tasksDir);
-  const size = statSync(filePath).size;
-  const raw = readFileSync(filePath, "utf-8");
-  const patchHead = raw.slice(0, config.maxReadFileBytes);
-  const rawReturnedBytes = Buffer.byteLength(patchHead, "utf-8");
+  const bounded = readTextFilePrefixSync(filePath, config.maxReadFileBytes);
+  const size = bounded.totalBytes;
+  const patchHead = bounded.content;
   const redaction = redactSensitiveContent(patchHead);
   const content = redaction.content;
-  const diff = {
+  const diff: GetTaskFileOutput & { truncated: boolean } = {
     task_id: taskId,
     filename: existsSync(preferred) ? "diff.patch" : "git.diff",
     content,
     path: filePath,
     available: true,
-    truncated: size > rawReturnedBytes,
+    truncated: bounded.truncated,
     total_bytes: size,
     returned_bytes: Buffer.byteLength(content, "utf-8"),
     patch_head: content,
     diff_patch_path: filePath,
     redacted: redaction.redacted,
     redaction_categories: redaction.redaction_categories,
-  } as GetTaskFileOutput;
+  } as GetTaskFileOutput & { truncated: boolean };
   try {
     const evidence = JSON.parse(getTaskFile(taskId, "changed-files.json").content);
     return {
@@ -51,7 +54,7 @@ export function getDiff(taskId: string): GetTaskFileOutput {
       diff_available: Boolean(evidence.diff_available),
       workspace_dirty_before: Boolean(evidence.workspace_dirty_before),
       workspace_dirty_after: Boolean(evidence.workspace_dirty_after),
-      diff_truncated: Boolean(evidence.diff_truncated || (diff as any).truncated),
+      diff_truncated: Boolean(evidence.diff_truncated || diff.truncated),
       diff_size_bytes: Number(evidence.diff_size_bytes || size),
       additions: Number(evidence.additions || 0),
       deletions: Number(evidence.deletions || 0),
@@ -101,8 +104,7 @@ export function getTaskLogTail(
 
   const stat = statSync(filePath);
   const totalBytes = stat.size;
-  const raw = readFileSync(filePath, "utf-8");
-  const tail = raw.split("\n").slice(-maxLines).join("\n");
+  const tail = readTextFileTailLinesSync(filePath, maxLines);
   const content = applyRedact ? redactSensitiveContent(tail) : { content: tail, redacted: false, redaction_categories: [] as string[] };
 
   return {
@@ -134,13 +136,18 @@ function getTaskFileTail(
   }
 
   const stat = statSync(filePath);
-  const raw = readFileSync(filePath, "utf-8");
-  let content = raw;
+  const maxBytes = options.maxBytes > 0
+    ? Math.min(options.maxBytes, config.maxReadFileBytes)
+    : config.maxReadFileBytes;
+  let content: string;
   if (options.tailLines > 0) {
-    content = raw.split("\n").slice(-options.tailLines).join("\n");
-  }
-  if (options.maxBytes > 0 && Buffer.byteLength(content, "utf-8") > options.maxBytes) {
-    content = content.slice(0, options.maxBytes);
+    content = readTextFileTailLinesSync(
+      filePath,
+      Math.min(Math.max(1, options.tailLines), 1000),
+      maxBytes,
+    );
+  } else {
+    content = readTextFilePrefixSync(filePath, maxBytes).content;
   }
   const redaction = redactSensitiveContent(content);
   return {

package/src/tools/{androidDoctor.ts → workspace/androidDoctor.ts}

@@ -8,9 +8,9 @@
  * and inspects files/directories/env vars that already exist.
  */
 
-import { execSync } from "node:child_process";
 import { existsSync, readFileSync, statSync } from "node:fs";
 import { join } from "node:path";
+import { runSimpleProcessSync } from "../../runner/simpleProcess.js";
 
 // ── Types ──────────────────────────────────────────────────────────
 
@@ -47,17 +47,22 @@ const SDK_MISSING_REASON =
 // ── Helpers ────────────────────────────────────────────────────────
 
 /**
- * Run a shell command and return its trimmed combined stdout/stderr output.
+ * Run a shell-free command and return its trimmed combined stdout/stderr output.
  * Returns an empty string when the command is missing or fails so callers can
  * treat absence gracefully. A timeout guards against hanging processes.
  */
-function runCmd(cmdStr: string): string {
+function runCmd(command: string, args: readonly string[], cwd = process.cwd()): string {
   try {
-    return execSync(cmdStr, {
-      encoding: "utf-8",
-      timeout: 8000,
-      stdio: ["ignore", "pipe", "ignore"],
-    }).trim();
+    const result = runSimpleProcessSync({
+      command,
+      args: [...args],
+      cwd,
+      timeoutMs: 8000,
+      maxStdoutBytes: 64 * 1024,
+      maxStderrBytes: 64 * 1024,
+    });
+    if (result.exitCode !== 0) return "";
+    return `${result.stdout}\n${result.stderr}`.trim();
   } catch {
     return "";
   }
@@ -128,8 +133,8 @@ export function diagnoseAndroidBuild(repoPath: string): AndroidBuildDiagnostic {
   const sdkExists = sdkRoot !== "" && isDirectory(sdkRoot);
 
   // 1. java -version ------------------------------------------------------
-  // `java -version` writes to stderr; redirect with 2>&1 so execSync captures it.
-  const javaOutput = runCmd("java -version 2>&1");
+  // `java -version` normally writes to stderr; runSimpleProcessSync captures both.
+  const javaOutput = runCmd("java", ["-version"], repoPath);
   const javaVersion = parseJavaVersion(javaOutput);
   if (javaVersion) {
     const major = parseJavaMajor(javaVersion);

package/src/tools/{applyPatch.ts → workspace/applyPatch.ts}

@@ -1,19 +1,20 @@
-import { getConfig } from "../config.js";
+import { getConfig } from "../../config.js";
+import { PatchWardenError } from "../../errors.js";
 import {
   readDirectSession,
   appendDirectSessionOperation,
-} from "../direct/directSessionStore.js";
+  withDirectSessionMutationLock,
+} from "../../direct/directSessionStore.js";
 import {
   guardDirectSessionActive,
   guardDirectWritePath,
   guardDirectPatchSize,
-} from "../direct/directGuards.js";
+} from "../../direct/directGuards.js";
 import {
   applyPatchOperations,
-  validateExpectedSha256,
   computeFileSha256,
   type PatchOperation,
-} from "../direct/directPatch.js";
+} from "../../direct/directPatch.js";
 
 export interface ApplyPatchInput {
   session_id: string;
@@ -33,6 +34,7 @@ export interface ApplyPatchOutput {
 
 export function applyPatch(input: ApplyPatchInput): ApplyPatchOutput {
   const config = getConfig();
+  return withDirectSessionMutationLock(input.session_id, () => {
 
   // 1. Read session and guard active (not expired, not finalized)
   const session = readDirectSession(input.session_id);
@@ -47,26 +49,45 @@ export function applyPatch(input: ApplyPatchInput): ApplyPatchOutput {
   );
 
   // 3. Calculate patch size and guard against directMaxPatchBytes
-  const patchBytes = JSON.stringify(input.operations).length;
+  const patchBytes = Buffer.byteLength(JSON.stringify(input.operations), "utf-8");
   guardDirectPatchSize(patchBytes);
 
-  // 4. Validate expected_sha256 matches current file hash
-  const beforeSha256 = validateExpectedSha256(
-    resolvedPath,
-    input.expected_sha256
-  );
-
-  // 5. Apply patch operations
-  const patchResult = applyPatchOperations(resolvedPath, input.operations);
+  // 4. Apply against the same bytes whose hash is validated. Re-resolve the
+  // target immediately before replacement to detect link/reparse-point swaps.
+  const patchResult = applyPatchOperations(resolvedPath, input.operations, {
+    expectedSha256: input.expected_sha256,
+    maxFileBytes: config.directMaxFileBytes,
+    revalidatePath: () => guardDirectWritePath(
+      input.path,
+      session.resolved_repo_path,
+      config.workspaceRoot,
+    ),
+  });
+  const beforeSha256 = patchResult.before_sha256;
 
   // Re-read the file from disk to compute the authoritative after_sha256
-  const afterSha256 = computeFileSha256(resolvedPath);
+  const finalPath = guardDirectWritePath(
+    input.path,
+    session.resolved_repo_path,
+    config.workspaceRoot,
+  );
+  const afterSha256 = computeFileSha256(finalPath);
+  if (afterSha256 !== patchResult.after_sha256) {
+    throw new PatchWardenError(
+      "direct_target_changed_after_write",
+      `Patch target "${input.path}" changed before the operation could be recorded.`,
+      "Inspect the file and retry only after concurrent filesystem changes stop.",
+      true,
+      { path: input.path, expected_sha256: patchResult.after_sha256, actual_sha256: afterSha256 },
+    );
+  }
 
   // 6. Append operation record to session
   appendDirectSessionOperation(input.session_id, {
-    index: session.operations.length,
+    index: 0,
     timestamp: new Date().toISOString(),
     path: input.path,
+    operation_type: "patch",
     before_sha256: beforeSha256,
     after_sha256: afterSha256,
     operations_applied: patchResult.operations_applied,
@@ -83,4 +104,5 @@ export function applyPatch(input: ApplyPatchInput): ApplyPatchOutput {
     next_action:
       "Call run_verification to test the changes, or apply_patch for more edits.",
   };
+  }, config);
 }

package/src/tools/{discardWorktree.ts → workspace/discardWorktree.ts}

@@ -5,9 +5,9 @@
  * 参考 src/tools/auditTask.ts 的导出/返回风格。
  */
 
-import { getConfig } from "../config.js";
-import { guardWorkspacePath } from "../security/pathGuard.js";
-import { discardWorktree } from "../goal/worktreeManager.js";
+import { getConfig } from "../../config.js";
+import { guardWorkspacePath } from "../../security/pathGuard.js";
+import { discardWorktree } from "../../goal/worktreeManager.js";
 
 export interface DiscardWorktreeInput {
   worktree_id: string;

package/src/tools/workspace/index.ts

@@ -0,0 +1,10 @@
+export * from "./androidDoctor.js";
+export * from "./applyPatch.js";
+export * from "./discardWorktree.js";
+export * from "./listAgents.js";
+export * from "./listWorkspace.js";
+export * from "./mergeWorktree.js";
+export * from "./readWorkspaceFile.js";
+export * from "./recommendAgentForTask.js";
+export * from "./searchWorkspace.js";
+export * from "./syncFile.js";

package/src/tools/{listAgents.ts → workspace/listAgents.ts}

@@ -1,6 +1,7 @@
 import { existsSync, statSync } from "node:fs";
 import { basename, delimiter, extname, isAbsolute, join } from "node:path";
-import { getConfig } from "../config.js";
+import { getConfig } from "../../config.js";
+import { sanitizeTrustedPath } from "../../runner/processSecurity.js";
 
 export interface AgentAvailability {
   name: string;
@@ -9,6 +10,9 @@ export interface AgentAvailability {
   command: string;
   reason: string | null;
   checked_at: string;
+  adapter: string | null;
+  model: string | null;
+  capabilities: { model_override: boolean };
 }
 
 export function listAgents(): { agents: AgentAvailability[]; total: number } {
@@ -17,7 +21,7 @@ export function listAgents(): { agents: AgentAvailability[]; total: number } {
   const agents = Object.entries(config.agents)
     .sort(([left], [right]) => left.localeCompare(right))
     .map(([name, agent]) => {
-      const available = commandExists(agent.command);
+      const available = commandExists(agent.command, config.workspaceRoot);
       return {
         name,
         configured: true as const,
@@ -25,17 +29,20 @@ export function listAgents(): { agents: AgentAvailability[]; total: number } {
         command: basename(agent.command),
         reason: available ? null : "Configured executable was not found on disk or PATH.",
         checked_at: checkedAt,
+        adapter: typeof agent.adapter === "string" ? agent.adapter : ["codex", "opencode"].includes(name) ? name : null,
+        model: typeof agent.model === "string" ? agent.model : null,
+        capabilities: { model_override: typeof agent.adapter === "string" || ["codex", "opencode"].includes(name) },
       };
     });
   return { agents, total: agents.length };
 }
 
-function commandExists(command: string): boolean {
+function commandExists(command: string, workspaceRoot: string): boolean {
   if (isAbsolute(command) || command.includes("/") || command.includes("\\")) {
     return isFile(command);
   }
 
-  const pathEntries = (process.env.PATH || "").split(delimiter).filter(Boolean);
+  const pathEntries = sanitizeTrustedPath(process.env.PATH || "", workspaceRoot).split(delimiter).filter(Boolean);
   const extensions = process.platform === "win32"
     ? (process.env.PATHEXT || ".EXE;.CMD;.BAT;.COM").split(";")
     : [""];

package/src/tools/{listWorkspace.ts → workspace/listWorkspace.ts}

@@ -1,8 +1,8 @@
 import { readdirSync, statSync, existsSync } from "node:fs";
 import { resolve } from "node:path";
-import { getConfig } from "../config.js";
-import { guardPath } from "../security/pathGuard.js";
-import { guardSensitivePath } from "../security/sensitiveGuard.js";
+import { getConfig } from "../../config.js";
+import { guardPath } from "../../security/pathGuard.js";
+import { guardSensitivePath } from "../../security/sensitiveGuard.js";
 
 export interface ListEntry {
   name: string;

package/src/tools/{mergeWorktree.ts → workspace/mergeWorktree.ts}

@@ -5,9 +5,9 @@
  * 参考 src/tools/auditTask.ts 的导出/返回风格。
  */
 
-import { getConfig } from "../config.js";
-import { guardWorkspacePath } from "../security/pathGuard.js";
-import { mergeWorktree } from "../goal/worktreeManager.js";
+import { getConfig } from "../../config.js";
+import { guardWorkspacePath } from "../../security/pathGuard.js";
+import { mergeWorktree } from "../../goal/worktreeManager.js";
 
 export interface MergeWorktreeInput {
   worktree_id: string;

package/src/tools/{readWorkspaceFile.ts → workspace/readWorkspaceFile.ts}

@@ -1,14 +1,14 @@
 import { readFileSync, statSync, existsSync } from "node:fs";
 import { createHash } from "node:crypto";
 import { resolve, relative, isAbsolute } from "node:path";
-import { getConfig } from "../config.js";
-import { guardReadPath } from "../security/pathGuard.js";
-import { guardSensitivePath } from "../security/sensitiveGuard.js";
-import { redactSensitiveContent } from "../security/contentRedaction.js";
-import { PatchWardenError } from "../errors.js";
-import { readDirectSession } from "../direct/directSessionStore.js";
-import { guardDirectSessionActive, guardDirectReadPath, isBinaryFile, guardDirectFileSize } from "../direct/directGuards.js";
-import { resolveToolProfile } from "./toolCatalog.js";
+import { getConfig } from "../../config.js";
+import { guardReadPath } from "../../security/pathGuard.js";
+import { guardSensitivePath } from "../../security/sensitiveGuard.js";
+import { redactSensitiveContent } from "../../security/contentRedaction.js";
+import { PatchWardenError } from "../../errors.js";
+import { readDirectSession } from "../../direct/directSessionStore.js";
+import { guardDirectSessionActive, guardDirectReadPath, isBinaryFile, guardDirectFileSize } from "../../direct/directGuards.js";
+import { resolveToolProfile } from "../catalog/toolCatalog.js";
 
 export interface ReadWorkspaceFileOutput {
   path: string;

package/src/tools/{recommendAgentForTask.ts → workspace/recommendAgentForTask.ts}

@@ -1,6 +1,6 @@
-import { getConfig } from "../config.js";
-import { guardWorkspacePath } from "../security/pathGuard.js";
-import { routeAgent } from "../agents/agentRouter.js";
+import { getConfig } from "../../config.js";
+import { guardWorkspacePath } from "../../security/pathGuard.js";
+import { routeAgent } from "../../agents/agentRouter.js";
 
 export interface RecommendAgentForTaskInput {
   repo_path: string;