patchwarden 1.5.1 → 1.6.1

package/dist/direct/directAudit.js

@@ -1,245 +1,254 @@
-import { writeFileSync } from "node:fs";
 import { join, resolve, relative, isAbsolute } from "node:path";
-import { getConfig } from "../config.js";
 import { isSensitivePath } from "../security/sensitiveGuard.js";
-import { readDirectSession, getDirectSessionDir, } from "./directSessionStore.js";
+import { readDirectSession, getDirectSessionDir, updateDirectSession, withDirectSessionMutationLock, } from "./directSessionStore.js";
+import { atomicWriteFileSync, atomicWriteJsonFileSync } from "../utils/atomicFile.js";
 // ── Main audit function ────────────────────────────────────────────
 export function auditDirectSession(sessionId) {
-    const config = getConfig();
-    const session = readDirectSession(sessionId);
-    const sessionDir = getDirectSessionDir(sessionId);
-    const checks = [];
-    const reasonCodes = [];
-    const blockingFindings = [];
-    const warnings = [];
-    // Check 1: session finalized
-    checks.push({
-        name: "session_finalized",
-        result: session.finalized ? "pass" : "fail",
-        detail: session.finalized
-            ? "Session has been finalized."
-            : "Session has not been finalized. Call finalize_direct_session first.",
-        reason_code: session.finalized ? undefined : "session_not_finalized",
-    });
-    // Get change artifacts if available
-    const artifacts = session.change_artifacts;
-    // Check 2: diff empty
-    const changedFilesTotal = artifacts?.changed_files?.length ?? 0;
-    checks.push({
-        name: "diff_empty",
-        result: changedFilesTotal === 0 ? "warn" : "pass",
-        detail: changedFilesTotal === 0
-            ? "No file changes detected in this session."
-            : `${changedFilesTotal} file(s) changed.`,
-        reason_code: changedFilesTotal === 0 ? "empty_diff" : undefined,
-    });
-    if (artifacts) {
-        // Check 3: out-of-scope changes
-        const outOfScope = findOutOfScopeChanges(artifacts, session.resolved_repo_path);
-        checks.push({
-            name: "out_of_scope_changes",
-            result: outOfScope.length === 0 ? "pass" : "fail",
-            detail: outOfScope.length === 0
-                ? "All changes are within the session repo_path."
-                : `${outOfScope.length} file(s) modified outside session repo_path: ${outOfScope.join(", ")}`,
-            reason_code: outOfScope.length > 0 ? "out_of_scope_changes" : undefined,
-        });
-        // Check 4: sensitive files
-        const sensitiveFiles = findSensitiveChanges(artifacts);
+    return withDirectSessionMutationLock(sessionId, () => {
+        const session = readDirectSession(sessionId);
+        const sessionDir = getDirectSessionDir(sessionId);
+        const checks = [];
+        const reasonCodes = [];
+        const blockingFindings = [];
+        const warnings = [];
+        // Check 1: session finalized
         checks.push({
-            name: "sensitive_file_access",
-            result: sensitiveFiles.length === 0 ? "pass" : "fail",
-            detail: sensitiveFiles.length === 0
-                ? "No sensitive files modified."
-                : `Sensitive files modified: ${sensitiveFiles.join(", ")}`,
-            reason_code: sensitiveFiles.length > 0 ? "sensitive_file_modified" : undefined,
+            name: "session_finalized",
+            result: session.finalized ? "pass" : "fail",
+            detail: session.finalized
+                ? "Session has been finalized."
+                : "Session has not been finalized. Call finalize_direct_session first.",
+            reason_code: session.finalized ? undefined : "session_not_finalized",
         });
-        // Check 5: node_modules modification
-        const nodeModulesChanges = findPathChanges(artifacts, "node_modules");
+        // Get change artifacts if available
+        const artifacts = session.change_artifacts;
+        // Check 2: diff empty
+        const changedFilesTotal = artifacts?.changed_files?.length ?? 0;
         checks.push({
-            name: "node_modules_modified",
-            result: nodeModulesChanges.length === 0 ? "pass" : "fail",
-            detail: nodeModulesChanges.length === 0
-                ? "No node_modules modifications."
-                : `node_modules modified: ${nodeModulesChanges.join(", ")}`,
-            reason_code: nodeModulesChanges.length > 0 ? "node_modules_modified" : undefined,
+            name: "diff_empty",
+            result: changedFilesTotal === 0 ? "warn" : "pass",
+            detail: changedFilesTotal === 0
+                ? "No file changes detected in this session."
+                : `${changedFilesTotal} file(s) changed.`,
+            reason_code: changedFilesTotal === 0 ? "empty_diff" : undefined,
         });
-        // Check 6: release/dist modification
-        const releaseChanges = findPathChanges(artifacts, "release");
-        const distChanges = findPathChanges(artifacts, "dist");
-        const artifactDirChanges = [...releaseChanges, ...distChanges];
-        const hasBuildArtifacts = artifacts.artifact_hygiene.counts.tracked_build_artifacts > 0;
+        if (artifacts) {
+            // Check 3: out-of-scope changes
+            const outOfScope = findOutOfScopeChanges(artifacts, session.resolved_repo_path);
+            checks.push({
+                name: "out_of_scope_changes",
+                result: outOfScope.length === 0 ? "pass" : "fail",
+                detail: outOfScope.length === 0
+                    ? "All changes are within the session repo_path."
+                    : `${outOfScope.length} file(s) modified outside session repo_path: ${outOfScope.join(", ")}`,
+                reason_code: outOfScope.length > 0 ? "out_of_scope_changes" : undefined,
+            });
+            // Check 4: sensitive files
+            const sensitiveFiles = findSensitiveChanges(artifacts);
+            checks.push({
+                name: "sensitive_file_access",
+                result: sensitiveFiles.length === 0 ? "pass" : "fail",
+                detail: sensitiveFiles.length === 0
+                    ? "No sensitive files modified."
+                    : `Sensitive files modified: ${sensitiveFiles.join(", ")}`,
+                reason_code: sensitiveFiles.length > 0 ? "sensitive_file_modified" : undefined,
+            });
+            checks.push({
+                name: "sensitive_content",
+                result: artifacts.diff_redacted ? "fail" : "pass",
+                detail: artifacts.diff_redacted
+                    ? `Credential-like content was redacted from diff evidence (${(artifacts.diff_redaction_categories ?? []).join(", ") || "sensitive_content"}).`
+                    : "No credential-like content was detected in diff evidence.",
+                reason_code: artifacts.diff_redacted ? "sensitive_content_detected" : undefined,
+            });
+            // Check 5: node_modules modification
+            const nodeModulesChanges = findPathChanges(artifacts, "node_modules");
+            checks.push({
+                name: "node_modules_modified",
+                result: nodeModulesChanges.length === 0 ? "pass" : "fail",
+                detail: nodeModulesChanges.length === 0
+                    ? "No node_modules modifications."
+                    : `node_modules modified: ${nodeModulesChanges.join(", ")}`,
+                reason_code: nodeModulesChanges.length > 0 ? "node_modules_modified" : undefined,
+            });
+            // Check 6: release/dist modification
+            const releaseChanges = findPathChanges(artifacts, "release");
+            const distChanges = findPathChanges(artifacts, "dist");
+            const artifactDirChanges = [...releaseChanges, ...distChanges];
+            const hasBuildArtifacts = artifacts.artifact_hygiene.counts.tracked_build_artifacts > 0;
+            checks.push({
+                name: "release_dist_modified",
+                result: artifactDirChanges.length === 0
+                    ? "pass"
+                    : hasBuildArtifacts
+                        ? "warn"
+                        : "fail",
+                detail: artifactDirChanges.length === 0
+                    ? "No release/dist modifications."
+                    : `release/dist modified: ${artifactDirChanges.join(", ")}${hasBuildArtifacts ? " (build-generated)" : " (not build-generated)"}`,
+                reason_code: artifactDirChanges.length > 0
+                    ? hasBuildArtifacts
+                        ? "build_artifact_modified"
+                        : "release_dist_manually_modified"
+                    : undefined,
+            });
+            // Check 7: file deletion
+            const deletedFiles = artifacts.changed_files.filter((f) => f.change === "deleted");
+            checks.push({
+                name: "file_deletion",
+                result: deletedFiles.length === 0 ? "pass" : "fail",
+                detail: deletedFiles.length === 0
+                    ? "No files deleted."
+                    : `Files deleted: ${deletedFiles.map((f) => f.path).join(", ")}`,
+                reason_code: deletedFiles.length > 0 ? "file_deleted" : undefined,
+            });
+            // Check 8: file rename
+            const renamedFiles = artifacts.changed_files.filter((f) => f.change === "renamed");
+            checks.push({
+                name: "file_rename",
+                result: renamedFiles.length === 0 ? "pass" : "fail",
+                detail: renamedFiles.length === 0
+                    ? "No files renamed."
+                    : `Files renamed: ${renamedFiles.map((f) => `${f.old_path} → ${f.path}`).join(", ")}`,
+                reason_code: renamedFiles.length > 0 ? "file_renamed" : undefined,
+            });
+            // Check 9: package-lock / dependency changes
+            const packageLockChanges = artifacts.changed_files.filter((f) => f.path === "package-lock.json" ||
+                f.path === "package.json" ||
+                f.path === "yarn.lock" ||
+                f.path === "pnpm-lock.yaml");
+            checks.push({
+                name: "dependency_changes",
+                result: packageLockChanges.length === 0 ? "pass" : "warn",
+                detail: packageLockChanges.length === 0
+                    ? "No dependency file changes."
+                    : `Dependency files changed: ${packageLockChanges.map((f) => f.path).join(", ")}`,
+                reason_code: packageLockChanges.length > 0 ? "dependency_file_changed" : undefined,
+            });
+            // Check 13: title vs changed files consistency (warning only)
+            if (session.title && changedFilesTotal > 0) {
+                checks.push({
+                    name: "title_change_consistency",
+                    result: "pass",
+                    detail: `Session title: "${session.title}", ${changedFilesTotal} file(s) changed. (Semantic check not performed - deterministic audit only.)`,
+                    reason_code: undefined,
+                });
+            }
+            else {
+                checks.push({
+                    name: "title_change_consistency",
+                    result: "pass",
+                    detail: "No title provided or no changes to compare.",
+                });
+            }
+            // Check 14: suspicious changes
+            const suspiciousCount = artifacts.artifact_hygiene.counts.suspicious_changes;
+            checks.push({
+                name: "suspicious_changes",
+                result: suspiciousCount === 0 ? "pass" : "warn",
+                detail: suspiciousCount === 0
+                    ? "No suspicious changes detected."
+                    : `${suspiciousCount} suspicious change(s) detected.`,
+                reason_code: suspiciousCount > 0 ? "suspicious_changes" : undefined,
+            });
+            // Check 15: runtime generated files
+            const runtimeCount = artifacts.artifact_hygiene.counts.runtime_generated_files;
+            checks.push({
+                name: "runtime_generated_files",
+                result: runtimeCount === 0 ? "pass" : "warn",
+                detail: runtimeCount === 0
+                    ? "No runtime-generated files detected."
+                    : `${runtimeCount} runtime-generated file(s) detected.`,
+                reason_code: runtimeCount > 0 ? "runtime_generated_files" : undefined,
+            });
+            // Check 16: tracked build artifacts
+            const buildArtifactCount = artifacts.artifact_hygiene.counts.tracked_build_artifacts;
+            checks.push({
+                name: "tracked_build_artifacts",
+                result: buildArtifactCount === 0 ? "pass" : "warn",
+                detail: buildArtifactCount === 0
+                    ? "No tracked build artifacts detected."
+                    : `${buildArtifactCount} tracked build artifact(s) detected.`,
+                reason_code: buildArtifactCount > 0 ? "tracked_build_artifacts" : undefined,
+            });
+        }
+        // Check 10: at least one verification command run
+        const verificationRuns = session.verification_runs || [];
+        const hasVerification = verificationRuns.length > 0;
+        const hasSourceChanges = artifacts
+            ? artifacts.changed_files.some((f) => f.kind === "source")
+            : false;
         checks.push({
-            name: "release_dist_modified",
-            result: artifactDirChanges.length === 0
+            name: "verification_run",
+            result: hasVerification
                 ? "pass"
-                : hasBuildArtifacts
-                    ? "warn"
-                    : "fail",
-            detail: artifactDirChanges.length === 0
-                ? "No release/dist modifications."
-                : `release/dist modified: ${artifactDirChanges.join(", ")}${hasBuildArtifacts ? " (build-generated)" : " (not build-generated)"}`,
-            reason_code: artifactDirChanges.length > 0
-                ? hasBuildArtifacts
-                    ? "build_artifact_modified"
-                    : "release_dist_manually_modified"
+                : hasSourceChanges
+                    ? "fail"
+                    : "warn",
+            detail: hasVerification
+                ? `${verificationRuns.length} verification command(s) run.`
+                : hasSourceChanges
+                    ? "Source files were modified but no verification commands were run."
+                    : "No verification commands were run (no source changes detected).",
+            reason_code: !hasVerification
+                ? hasSourceChanges
+                    ? "source_changes_without_verification"
+                    : "no_verification_run"
                 : undefined,
         });
-        // Check 7: file deletion
-        const deletedFiles = artifacts.changed_files.filter((f) => f.change === "deleted");
-        checks.push({
-            name: "file_deletion",
-            result: deletedFiles.length === 0 ? "pass" : "fail",
-            detail: deletedFiles.length === 0
-                ? "No files deleted."
-                : `Files deleted: ${deletedFiles.map((f) => f.path).join(", ")}`,
-            reason_code: deletedFiles.length > 0 ? "file_deleted" : undefined,
-        });
-        // Check 8: file rename
-        const renamedFiles = artifacts.changed_files.filter((f) => f.change === "renamed");
-        checks.push({
-            name: "file_rename",
-            result: renamedFiles.length === 0 ? "pass" : "fail",
-            detail: renamedFiles.length === 0
-                ? "No files renamed."
-                : `Files renamed: ${renamedFiles.map((f) => `${f.old_path} → ${f.path}`).join(", ")}`,
-            reason_code: renamedFiles.length > 0 ? "file_renamed" : undefined,
-        });
-        // Check 9: package-lock / dependency changes
-        const packageLockChanges = artifacts.changed_files.filter((f) => f.path === "package-lock.json" ||
-            f.path === "package.json" ||
-            f.path === "yarn.lock" ||
-            f.path === "pnpm-lock.yaml");
-        checks.push({
-            name: "dependency_changes",
-            result: packageLockChanges.length === 0 ? "pass" : "warn",
-            detail: packageLockChanges.length === 0
-                ? "No dependency file changes."
-                : `Dependency files changed: ${packageLockChanges.map((f) => f.path).join(", ")}`,
-            reason_code: packageLockChanges.length > 0 ? "dependency_file_changed" : undefined,
-        });
-        // Check 13: title vs changed files consistency (warning only)
-        if (session.title && changedFilesTotal > 0) {
+        // Check 11: verification commands passed
+        if (hasVerification) {
+            const allPassed = verificationRuns.every((r) => r.passed);
             checks.push({
-                name: "title_change_consistency",
-                result: "pass",
-                detail: `Session title: "${session.title}", ${changedFilesTotal} file(s) changed. (Semantic check not performed - deterministic audit only.)`,
-                reason_code: undefined,
+                name: "verification_passed",
+                result: allPassed ? "pass" : "fail",
+                detail: allPassed
+                    ? "All verification commands passed."
+                    : `${verificationRuns.filter((r) => !r.passed).length} verification command(s) failed.`,
+                reason_code: !allPassed ? "verification_failed" : undefined,
             });
         }
-        else {
-            checks.push({
-                name: "title_change_consistency",
-                result: "pass",
-                detail: "No title provided or no changes to compare.",
-            });
+        // Collect results
+        for (const check of checks) {
+            if (check.reason_code)
+                reasonCodes.push(check.reason_code);
+            if (check.result === "fail")
+                blockingFindings.push(`${check.name}: ${check.detail}`);
+            if (check.result === "warn")
+                warnings.push(`${check.name}: ${check.detail}`);
         }
-        // Check 14: suspicious changes
-        const suspiciousCount = artifacts.artifact_hygiene.counts.suspicious_changes;
-        checks.push({
-            name: "suspicious_changes",
-            result: suspiciousCount === 0 ? "pass" : "warn",
-            detail: suspiciousCount === 0
-                ? "No suspicious changes detected."
-                : `${suspiciousCount} suspicious change(s) detected.`,
-            reason_code: suspiciousCount > 0 ? "suspicious_changes" : undefined,
-        });
-        // Check 15: runtime generated files
-        const runtimeCount = artifacts.artifact_hygiene.counts.runtime_generated_files;
-        checks.push({
-            name: "runtime_generated_files",
-            result: runtimeCount === 0 ? "pass" : "warn",
-            detail: runtimeCount === 0
-                ? "No runtime-generated files detected."
-                : `${runtimeCount} runtime-generated file(s) detected.`,
-            reason_code: runtimeCount > 0 ? "runtime_generated_files" : undefined,
-        });
-        // Check 16: tracked build artifacts
-        const buildArtifactCount = artifacts.artifact_hygiene.counts.tracked_build_artifacts;
-        checks.push({
-            name: "tracked_build_artifacts",
-            result: buildArtifactCount === 0 ? "pass" : "warn",
-            detail: buildArtifactCount === 0
-                ? "No tracked build artifacts detected."
-                : `${buildArtifactCount} tracked build artifact(s) detected.`,
-            reason_code: buildArtifactCount > 0 ? "tracked_build_artifacts" : undefined,
-        });
-    }
-    // Check 10: at least one verification command run
-    const verificationRuns = session.verification_runs || [];
-    const hasVerification = verificationRuns.length > 0;
-    const hasSourceChanges = artifacts
-        ? artifacts.changed_files.some((f) => f.kind === "source")
-        : false;
-    checks.push({
-        name: "verification_run",
-        result: hasVerification
-            ? "pass"
-            : hasSourceChanges
-                ? "fail"
-                : "warn",
-        detail: hasVerification
-            ? `${verificationRuns.length} verification command(s) run.`
-            : hasSourceChanges
-                ? "Source files were modified but no verification commands were run."
-                : "No verification commands were run (no source changes detected).",
-        reason_code: !hasVerification
-            ? hasSourceChanges
-                ? "source_changes_without_verification"
-                : "no_verification_run"
-            : undefined,
+        // Determine decision
+        const hasFail = checks.some((c) => c.result === "fail");
+        const hasWarn = checks.some((c) => c.result === "warn");
+        const decision = hasFail ? "fail" : hasWarn ? "warn" : "pass";
+        const diffPath = join(sessionDir, "diff.patch");
+        const summaryPath = join(sessionDir, "summary.md");
+        const auditPath = join(sessionDir, "audit.md");
+        const output = {
+            session_id: sessionId,
+            decision,
+            reason_codes: reasonCodes,
+            blocking_findings: blockingFindings,
+            warnings,
+            evidence: {
+                changed_files_total: changedFilesTotal,
+                verification_runs: verificationRuns,
+                diff_path: diffPath,
+                summary_path: summaryPath,
+                audit_path: auditPath,
+            },
+            next_action: decision === "pass"
+                ? "Audit passed. Changes are safe to accept."
+                : decision === "warn"
+                    ? "Audit completed with warnings. Review the warnings before accepting changes."
+                    : "Audit failed. Review the blocking findings and create a new session to fix issues.",
+        };
+        // Write audit.json and audit.md
+        atomicWriteJsonFileSync(join(sessionDir, "audit.json"), output);
+        atomicWriteFileSync(auditPath, formatAuditMd(output, checks, session));
+        updateDirectSession(sessionId, { audited: true });
+        return output;
     });
-    // Check 11: verification commands passed
-    if (hasVerification) {
-        const allPassed = verificationRuns.every((r) => r.passed);
-        checks.push({
-            name: "verification_passed",
-            result: allPassed ? "pass" : "fail",
-            detail: allPassed
-                ? "All verification commands passed."
-                : `${verificationRuns.filter((r) => !r.passed).length} verification command(s) failed.`,
-            reason_code: !allPassed ? "verification_failed" : undefined,
-        });
-    }
-    // Collect results
-    for (const check of checks) {
-        if (check.reason_code)
-            reasonCodes.push(check.reason_code);
-        if (check.result === "fail")
-            blockingFindings.push(`${check.name}: ${check.detail}`);
-        if (check.result === "warn")
-            warnings.push(`${check.name}: ${check.detail}`);
-    }
-    // Determine decision
-    const hasFail = checks.some((c) => c.result === "fail");
-    const hasWarn = checks.some((c) => c.result === "warn");
-    const decision = hasFail ? "fail" : hasWarn ? "warn" : "pass";
-    const diffPath = join(sessionDir, "diff.patch");
-    const summaryPath = join(sessionDir, "summary.md");
-    const auditPath = join(sessionDir, "audit.md");
-    const output = {
-        session_id: sessionId,
-        decision,
-        reason_codes: reasonCodes,
-        blocking_findings: blockingFindings,
-        warnings,
-        evidence: {
-            changed_files_total: changedFilesTotal,
-            verification_runs: verificationRuns,
-            diff_path: diffPath,
-            summary_path: summaryPath,
-            audit_path: auditPath,
-        },
-        next_action: decision === "pass"
-            ? "Audit passed. Changes are safe to accept."
-            : decision === "warn"
-                ? "Audit completed with warnings. Review the warnings before accepting changes."
-                : "Audit failed. Review the blocking findings and create a new session to fix issues.",
-    };
-    // Write audit.json and audit.md
-    writeFileSync(join(sessionDir, "audit.json"), JSON.stringify(output, null, 2), "utf-8");
-    writeFileSync(auditPath, formatAuditMd(output, checks, session), "utf-8");
-    return output;
 }
 // ── Helper functions ───────────────────────────────────────────────
 function findOutOfScopeChanges(artifacts, resolvedRepoPath) {

package/dist/direct/directGuards.d.ts

@@ -1,3 +1,4 @@
+import { type PatchWardenConfig } from "../config.js";
 import type { DirectSessionRecord } from "./directSessionStore.js";
 export declare function guardDirectSessionActive(session: DirectSessionRecord): void;
 export declare function guardDirectSessionFinalized(session: DirectSessionRecord): void;
@@ -16,5 +17,5 @@ export declare function guardDirectReadPath(filePath: string, resolvedRepoPath:
  */
 export declare function guardDirectWritePath(filePath: string, resolvedRepoPath: string, workspaceRoot: string): string;
 export declare function guardDirectPatchSize(patchBytes: number): void;
-export declare function guardDirectFileSize(fileBytes: number): void;
+export declare function guardDirectFileSize(fileBytes: number, config?: PatchWardenConfig): void;
 export declare function isBinaryFile(filePath: string): boolean;

package/dist/direct/directGuards.js

@@ -1,7 +1,8 @@
-import { resolve, relative, isAbsolute } from "node:path";
+import { relative } from "node:path";
 import { existsSync, statSync, openSync, readSync, closeSync } from "node:fs";
 import { PatchWardenError } from "../errors.js";
-import { isSensitivePath } from "../security/sensitiveGuard.js";
+import { hasWindowsAlternateDataStream, isSensitivePath, } from "../security/sensitiveGuard.js";
+import { guardPath, guardWorkspacePath } from "../security/pathGuard.js";
 import { getConfig } from "../config.js";
 // ── Session state guards ───────────────────────────────────────────
 export function guardDirectSessionActive(session) {
@@ -23,34 +24,34 @@ export function guardDirectSessionFinalized(session) {
  * inside both the repo and the workspace root.
  */
 export function guardDirectPath(filePath, resolvedRepoPath, workspaceRoot) {
-    const config = getConfig();
-    const resolved = resolve(resolvedRepoPath, filePath);
-    const normalizedRepo = resolve(resolvedRepoPath);
-    const normalizedWs = resolve(workspaceRoot);
-    // Check path is inside workspace root
-    const relToWs = relative(normalizedWs, resolved);
-    if (isAbsolute(relToWs) || relToWs.startsWith("..")) {
-        throw new PatchWardenError("path_outside_repo", `Path "${filePath}" resolves outside the session repo.`, "Use a relative path inside the session's repo_path.", true, { path: filePath, operation: "direct_path_access" });
-    }
-    // Check path is inside repo_path
-    const relToRepo = relative(normalizedRepo, resolved);
-    if (isAbsolute(relToRepo) || relToRepo.startsWith("..")) {
-        throw new PatchWardenError("path_outside_repo", `Path "${filePath}" is outside the session repo_path "${resolvedRepoPath}".`, "Use a relative path inside the session's repo_path.", true, { path: filePath, operation: "direct_path_access" });
+    if (hasWindowsAlternateDataStream(filePath)) {
+        throw new PatchWardenError("windows_ads_path_blocked", `Path "${filePath}" contains a Windows alternate data stream suffix.`, "Use a normal relative file path without a colon or NTFS stream name.", true, { path: filePath, operation: "direct_path_access" });
+    }
+    // Resolve the repo first so a repo-level symlink/junction cannot escape the
+    // workspace. guardPath then resolves the candidate or its nearest existing
+    // parent, closing intermediate symlink/junction escapes for new files too.
+    try {
+        const guardedRepo = guardWorkspacePath(resolvedRepoPath, workspaceRoot);
+        return guardPath(filePath, guardedRepo);
+    }
+    catch (error) {
+        if (error instanceof PatchWardenError && error.reason === "workspace_path_escape") {
+            throw new PatchWardenError("path_outside_repo", `Path "${filePath}" resolves outside the session repo.`, "Use a relative path inside the session's repo_path.", true, { path: filePath, operation: "direct_path_access" });
+        }
+        throw error;
     }
-    return resolved;
 }
 /**
  * Guard a read path: must be inside repo, not sensitive, not binary.
  */
 export function guardDirectReadPath(filePath, resolvedRepoPath, workspaceRoot) {
     const resolved = guardDirectPath(filePath, resolvedRepoPath, workspaceRoot);
-    const normalized = filePath.replace(/\\/g, "/");
+    const policyPaths = directPolicyPaths(filePath, resolved, resolvedRepoPath, workspaceRoot);
     // Block internal PatchWarden paths (sessions, tasks, plans, assessments)
-    if (normalized.startsWith(".patchwarden/") ||
-        normalized.includes("/.patchwarden/")) {
+    if (policyPaths.some((path) => hasPathSegment(path, ".patchwarden"))) {
         throw new PatchWardenError("internal_patchwarden_path_blocked", `Access denied: "${filePath}" is inside the internal .patchwarden directory.`, "Internal PatchWarden files cannot be accessed through Direct mode.", true, { path: filePath, operation: "direct_read" });
     }
-    if (isSensitivePath(filePath)) {
+    if (policyPaths.some((path) => isSensitivePath(path))) {
         throw new PatchWardenError("sensitive_path_blocked", `Access denied: "${filePath}" matches a sensitive file pattern.`, "Read only non-sensitive files within the session repo.", true, { path: filePath, operation: "direct_read" });
     }
     if (existsSync(resolved) && statSync(resolved).isFile() && isBinaryFile(resolved)) {
@@ -64,25 +65,24 @@ export function guardDirectReadPath(filePath, resolvedRepoPath, workspaceRoot) {
  */
 export function guardDirectWritePath(filePath, resolvedRepoPath, workspaceRoot) {
     const resolved = guardDirectPath(filePath, resolvedRepoPath, workspaceRoot);
-    const normalized = filePath.replace(/\\/g, "/");
+    const policyPaths = directPolicyPaths(filePath, resolved, resolvedRepoPath, workspaceRoot);
     // Block internal PatchWarden paths
-    if (normalized.startsWith(".patchwarden/") ||
-        normalized.includes("/.patchwarden/")) {
+    if (policyPaths.some((path) => hasPathSegment(path, ".patchwarden"))) {
         throw new PatchWardenError("internal_patchwarden_path_blocked", `Modification denied: "${filePath}" is inside the internal .patchwarden directory.`, "Internal PatchWarden files cannot be modified through Direct mode.", true, { path: filePath, operation: "direct_write" });
     }
-    if (isSensitivePath(normalized)) {
+    if (policyPaths.some((path) => isSensitivePath(path))) {
         throw new PatchWardenError("sensitive_path_blocked", `Modification denied: "${filePath}" matches a sensitive file pattern.`, "Do not modify .env, credentials, keys, or other sensitive files.", true, { path: filePath, operation: "direct_write" });
     }
     // Block node_modules
-    if (normalized.startsWith("node_modules/") || normalized.includes("/node_modules/")) {
+    if (policyPaths.some((path) => hasPathSegment(path, "node_modules"))) {
         throw new PatchWardenError("blocked_artifact_path", `Modification denied: "${filePath}" is inside node_modules.`, "Do not modify dependencies directly. Use package management tools instead.", true, { path: filePath, operation: "direct_write" });
     }
     // Block release/
-    if (normalized.startsWith("release/") || normalized.includes("/release/")) {
+    if (policyPaths.some((path) => hasPathSegment(path, "release"))) {
         throw new PatchWardenError("blocked_artifact_path", `Modification denied: "${filePath}" is inside the release directory.`, "Do not manually modify release artifacts.", true, { path: filePath, operation: "direct_write" });
     }
     // Block dist/
-    if (normalized.startsWith("dist/") || normalized.includes("/dist/")) {
+    if (policyPaths.some((path) => hasPathSegment(path, "dist"))) {
         throw new PatchWardenError("blocked_artifact_path", `Modification denied: "${filePath}" is inside the dist directory.`, "Do not manually modify build output. Modify source files instead.", true, { path: filePath, operation: "direct_write" });
     }
     if (existsSync(resolved) && statSync(resolved).isFile() && isBinaryFile(resolved)) {
@@ -90,6 +90,20 @@ export function guardDirectWritePath(filePath, resolvedRepoPath, workspaceRoot)
     }
     return resolved;
 }
+function directPolicyPaths(requestedPath, resolvedPath, resolvedRepoPath, workspaceRoot) {
+    const guardedRepo = guardWorkspacePath(resolvedRepoPath, workspaceRoot);
+    return [
+        requestedPath.replace(/\\/g, "/"),
+        relative(guardedRepo, resolvedPath).replace(/\\/g, "/"),
+    ];
+}
+function hasPathSegment(filePath, expectedSegment) {
+    const expected = expectedSegment.toLowerCase();
+    return filePath
+        .split("/")
+        .filter(Boolean)
+        .some((segment) => segment.toLowerCase() === expected);
+}
 // ── Size guards ────────────────────────────────────────────────────
 export function guardDirectPatchSize(patchBytes) {
     const config = getConfig();
@@ -97,8 +111,7 @@ export function guardDirectPatchSize(patchBytes) {
         throw new PatchWardenError("patch_too_large", `Patch size ${patchBytes} bytes exceeds maximum ${config.directMaxPatchBytes} bytes.`, "Split the patch into smaller operations or reduce the patch size.", true, { patch_bytes: patchBytes, max_bytes: config.directMaxPatchBytes });
     }
 }
-export function guardDirectFileSize(fileBytes) {
-    const config = getConfig();
+export function guardDirectFileSize(fileBytes, config = getConfig()) {
     if (fileBytes > config.directMaxFileBytes) {
         throw new PatchWardenError("file_too_large", `File size ${fileBytes} bytes exceeds maximum ${config.directMaxFileBytes} bytes.`, "Use search_workspace to find specific content, or split the read into smaller portions.", true, { file_bytes: fileBytes, max_bytes: config.directMaxFileBytes });
     }

package/dist/direct/directPatch.d.ts

@@ -13,5 +13,10 @@ export interface ApplyPatchResult {
 }
 export declare function computeFileSha256(filePath: string): string;
 export declare function computeContentSha256(content: string): string;
+export interface ApplyPatchOptions {
+    expectedSha256?: string;
+    maxFileBytes?: number;
+    revalidatePath?: () => string;
+}
 export declare function validateExpectedSha256(filePath: string, expectedSha256: string): string;
-export declare function applyPatchOperations(filePath: string, operations: PatchOperation[]): ApplyPatchResult;
+export declare function applyPatchOperations(filePath: string, operations: PatchOperation[], options?: ApplyPatchOptions): ApplyPatchResult;