patchwarden 1.5.1 → 1.6.1

package/dist/direct/directPatch.js

@@ -1,7 +1,8 @@
-import { readFileSync, writeFileSync, existsSync, mkdirSync } from "node:fs";
+import { closeSync, existsSync, fstatSync, openSync, readFileSync } from "node:fs";
 import { createHash } from "node:crypto";
-import { dirname } from "node:path";
 import { PatchWardenError } from "../errors.js";
+import { atomicWriteFileSync } from "../utils/atomicFile.js";
+import { redactSensitiveContent } from "../security/contentRedaction.js";
 // ── Hash helpers ───────────────────────────────────────────────────
 export function computeFileSha256(filePath) {
     const content = readFileSync(filePath);
@@ -21,12 +22,36 @@ export function validateExpectedSha256(filePath, expectedSha256) {
     return currentHash;
 }
 // ── Patch application ──────────────────────────────────────────────
-export function applyPatchOperations(filePath, operations) {
+export function applyPatchOperations(filePath, operations, options = {}) {
     if (!existsSync(filePath)) {
         throw new PatchWardenError("patch_anchor_not_found", `File does not exist: "${filePath}".`, "Ensure the file exists before applying a patch. Direct mode does not support creating new files.", true, { path: filePath });
     }
-    const beforeContent = readFileSync(filePath, "utf-8");
-    const beforeSha256 = computeContentSha256(beforeContent);
+    let descriptor = null;
+    let beforeBytes;
+    let existingMode;
+    try {
+        descriptor = openSync(filePath, "r");
+        const metadata = fstatSync(descriptor);
+        if (!metadata.isFile()) {
+            throw new PatchWardenError("direct_target_not_file", `Patch target is not a regular file: "${filePath}".`, "Choose an existing text file inside the Direct session repository.");
+        }
+        guardFileByteLimit(metadata.size, options.maxFileBytes);
+        existingMode = metadata.mode;
+        beforeBytes = readFileSync(descriptor);
+    }
+    finally {
+        if (descriptor !== null)
+            closeSync(descriptor);
+    }
+    guardFileByteLimit(beforeBytes.length, options.maxFileBytes);
+    const beforeSha256 = createHash("sha256").update(beforeBytes).digest("hex");
+    if (options.expectedSha256 && beforeSha256 !== options.expectedSha256) {
+        throw fileHashMismatch(options.expectedSha256, beforeSha256);
+    }
+    const beforeContent = beforeBytes.toString("utf-8");
+    if (!Buffer.from(beforeContent, "utf-8").equals(beforeBytes)) {
+        throw new PatchWardenError("unsupported_text_encoding", `File "${filePath}" is not valid UTF-8 text.`, "Use a normal task or convert the file to UTF-8 before Direct editing.", true, { path: filePath });
+    }
     let content = beforeContent;
     let operationsApplied = 0;
     for (const op of operations) {
@@ -34,10 +59,19 @@ export function applyPatchOperations(filePath, operations) {
         operationsApplied++;
     }
     const afterSha256 = computeContentSha256(content);
+    guardFileByteLimit(Buffer.byteLength(content, "utf-8"), options.maxFileBytes);
+    const sensitive = redactSensitiveContent(content);
+    if (sensitive.redacted) {
+        throw new PatchWardenError("sensitive_content_blocked", `Patch result contains credential-like content (${sensitive.redaction_categories.join(", ")}).`, "Remove the sensitive value and retry with placeholders or environment-variable references.", true, { path: filePath, redaction_categories: sensitive.redaction_categories });
+    }
     const bytesChanged = Math.abs(Buffer.byteLength(content, "utf-8") - Buffer.byteLength(beforeContent, "utf-8"));
-    // Ensure parent directory exists (should already exist for existing files)
-    mkdirSync(dirname(filePath), { recursive: true });
-    writeFileSync(filePath, content, "utf-8");
+    if (options.revalidatePath && !samePath(options.revalidatePath(), filePath)) {
+        throw new PatchWardenError("direct_path_changed_during_write", `Patch target path changed while preparing "${filePath}".`, "Retry only after concurrent filesystem changes stop.", true, { path: filePath, operation: "apply_patch" });
+    }
+    const currentSha256 = computeFileSha256(filePath);
+    if (currentSha256 !== beforeSha256)
+        throw fileHashMismatch(beforeSha256, currentSha256);
+    atomicWriteFileSync(filePath, content, { mode: existingMode });
     return {
         before_sha256: beforeSha256,
         after_sha256: afterSha256,
@@ -45,6 +79,19 @@ export function applyPatchOperations(filePath, operations) {
         bytes_changed: bytesChanged,
     };
 }
+function guardFileByteLimit(fileBytes, maxFileBytes) {
+    if (maxFileBytes === undefined || fileBytes <= maxFileBytes)
+        return;
+    throw new PatchWardenError("file_too_large", `File size ${fileBytes} bytes exceeds maximum ${maxFileBytes} bytes.`, "Use a normal task for larger files.", true, { file_bytes: fileBytes, max_bytes: maxFileBytes });
+}
+function fileHashMismatch(expectedSha256, actualSha256) {
+    return new PatchWardenError("file_hash_mismatch", `File hash mismatch. Expected "${expectedSha256}" but got "${actualSha256}".`, "Re-read the file to get the current sha256, then retry the patch.", true, { expected_sha256: expectedSha256, actual_sha256: actualSha256 });
+}
+function samePath(left, right) {
+    return process.platform === "win32"
+        ? left.toLowerCase() === right.toLowerCase()
+        : left === right;
+}
 function applySingleOperation(content, op) {
     switch (op.type) {
         case "replace_exact":

package/dist/direct/directSessionStore.d.ts

@@ -1,9 +1,12 @@
+import { PatchWardenConfig } from "../config.js";
 import { type RepoSnapshot, type ChangeArtifacts } from "../runner/changeCapture.js";
 export interface DirectSessionOperation {
     index: number;
     timestamp: string;
     path: string;
-    before_sha256: string;
+    operation_type?: "patch" | "sync";
+    source_path?: string;
+    before_sha256: string | null;
     after_sha256: string;
     operations_applied: number;
     bytes_changed: number;
@@ -48,12 +51,19 @@ export interface DirectSessionCreateInput {
     snapshot: RepoSnapshot;
 }
 export declare function generateDirectSessionId(): string;
-export declare function createDirectSessionDir(sessionId: string): string;
-export declare function getDirectSessionDir(sessionId: string): string;
+/**
+ * Direct session IDs are directory names. Keep one shared, bounded grammar so
+ * MCP tools and Control Center routes cannot disagree about traversal input.
+ */
+export declare function isValidDirectSessionId(sessionId: string): boolean;
+export declare function createDirectSessionDir(sessionId: string, config?: PatchWardenConfig): string;
+export declare function getDirectSessionDir(sessionId: string, config?: PatchWardenConfig): string;
 export declare function createDirectSession(input: DirectSessionCreateInput): DirectSessionRecord;
-export declare function readDirectSession(sessionId: string): DirectSessionRecord;
+export declare function readDirectSession(sessionId: string, config?: PatchWardenConfig): DirectSessionRecord;
 export declare function updateDirectSession(sessionId: string, updates: Partial<DirectSessionRecord>): DirectSessionRecord;
-export declare function appendDirectSessionOperation(sessionId: string, operation: DirectSessionOperation): DirectSessionRecord;
+export declare function appendDirectSessionOperation(sessionId: string, operation: DirectSessionOperation, config?: PatchWardenConfig): DirectSessionRecord;
+export declare function withDirectSessionMutationLock<R>(sessionId: string, action: () => R, config?: PatchWardenConfig): R;
+export declare function withDirectSessionMutationLockAsync<R>(sessionId: string, action: () => Promise<R>, config?: PatchWardenConfig): Promise<R>;
 export declare function appendDirectSessionVerificationRun(sessionId: string, run: DirectSessionVerificationRun): DirectSessionRecord;
 export interface DirectSessionValidationResult {
     valid: boolean;
@@ -61,5 +71,5 @@ export interface DirectSessionValidationResult {
     session: DirectSessionRecord | null;
 }
 export declare function validateDirectSessionFreshness(sessionId: string): DirectSessionValidationResult;
-export declare function finalizeDirectSessionRecord(sessionId: string, afterSnapshot: RepoSnapshot, changeArtifacts: ChangeArtifacts): DirectSessionRecord;
+export declare function finalizeDirectSessionRecord(sessionId: string, changeArtifacts: ChangeArtifacts): DirectSessionRecord;
 export declare function computeWorkspaceFingerprint(snapshot: RepoSnapshot): string;

package/dist/direct/directSessionStore.js

@@ -1,11 +1,14 @@
-import { mkdirSync, writeFileSync, existsSync, readFileSync, } from "node:fs";
+import { mkdirSync, existsSync, } from "node:fs";
 import { createHash, randomBytes } from "node:crypto";
 import { resolve, join } from "node:path";
 import { getDirectSessionsDir, getConfig, getRepoDirectAllowedCommands, } from "../config.js";
 import { guardPath } from "../security/pathGuard.js";
 import { PatchWardenError } from "../errors.js";
 import { PATCHWARDEN_VERSION, TOOL_SCHEMA_EPOCH } from "../version.js";
-import { getLastToolCatalogSnapshot } from "../tools/toolCatalog.js";
+import { atomicWriteFileSync, atomicWriteJsonFileSync } from "../utils/atomicFile.js";
+import { redactSensitiveContent } from "../security/contentRedaction.js";
+import { mutateLockedJsonFileSync, readJsonObjectFileSync, withFileLock, withFileLockSync, } from "../utils/lockedJsonFile.js";
+import { getLastToolCatalogSnapshot } from "../tools/catalog/toolCatalog.js";
 // ── ID generation ──────────────────────────────────────────────────
 export function generateDirectSessionId() {
     const timestamp = new Date()
@@ -16,21 +19,32 @@ export function generateDirectSessionId() {
     const randomHex = randomBytes(16).toString("hex");
     return `direct_${timestamp}_${randomHex}`;
 }
+/**
+ * Direct session IDs are directory names. Keep one shared, bounded grammar so
+ * MCP tools and Control Center routes cannot disagree about traversal input.
+ */
+export function isValidDirectSessionId(sessionId) {
+    return /^[A-Za-z0-9][A-Za-z0-9_-]{0,127}$/.test(sessionId);
+}
+function guardDirectSessionId(sessionId) {
+    if (!isValidDirectSessionId(sessionId)) {
+        throw new PatchWardenError("invalid_session_id", `Direct session ID "${sessionId}" is invalid.`, "Use the session_id returned by create_direct_session.", true, { session_id: sessionId });
+    }
+}
 // ── Directory management ───────────────────────────────────────────
-export function createDirectSessionDir(sessionId) {
-    const config = getConfig();
+export function createDirectSessionDir(sessionId, config = getConfig()) {
+    guardDirectSessionId(sessionId);
     const sessionsDir = getDirectSessionsDir(config);
     guardPath(sessionsDir, config.workspaceRoot, config.directSessionsDir);
     mkdirSync(sessionsDir, { recursive: true });
-    const dir = resolve(sessionsDir, sessionId);
-    guardPath(dir, config.workspaceRoot, config.directSessionsDir);
+    const dir = getDirectSessionDir(sessionId, config);
     mkdirSync(dir, { recursive: true });
     return dir;
 }
-export function getDirectSessionDir(sessionId) {
-    const config = getConfig();
+export function getDirectSessionDir(sessionId, config = getConfig()) {
+    guardDirectSessionId(sessionId);
     const sessionsDir = getDirectSessionsDir(config);
-    return resolve(sessionsDir, sessionId);
+    return guardPath(resolve(sessionsDir, sessionId), config.workspaceRoot, config.directSessionsDir);
 }
 // ── CRUD ───────────────────────────────────────────────────────────
 export function createDirectSession(input) {
@@ -48,7 +62,11 @@ export function createDirectSession(input) {
     const expiresAt = new Date(now.getTime() + config.directSessionTtlSeconds * 1000).toISOString();
     const record = {
         session_id: sessionId,
-        title: input.title || "",
+        title: redactSensitiveContent(input.title || "")
+            .content
+            .replace(/[\r\n\t]+/g, " ")
+            .trim()
+            .slice(0, 500),
         repo_path: input.repo_path,
         resolved_repo_path: input.resolved_repo_path,
         created_at: now.toISOString(),
@@ -66,36 +84,55 @@ export function createDirectSession(input) {
         audited: false,
         change_artifacts: null,
     };
-    writeFileSync(join(dir, "session.json"), JSON.stringify(record, null, 2), "utf-8");
+    atomicWriteJsonFileSync(join(dir, "session.json"), record);
     return record;
 }
-export function readDirectSession(sessionId) {
-    const config = getConfig();
-    const sessionsDir = getDirectSessionsDir(config);
-    const dir = resolve(sessionsDir, sessionId);
-    const file = join(dir, "session.json");
-    guardPath(file, config.workspaceRoot, config.directSessionsDir);
+export function readDirectSession(sessionId, config = getConfig()) {
+    const file = getDirectSessionFile(sessionId, config);
     if (!existsSync(file)) {
         throw new PatchWardenError("session_not_found", `Direct session "${sessionId}" not found.`, "Call create_direct_session first to get a valid session_id.", true, { session_id: sessionId });
     }
-    return JSON.parse(readFileSync(file, "utf-8"));
+    let value;
+    try {
+        value = readJsonObjectFileSync(file);
+    }
+    catch {
+        throw invalidDirectSessionRecord(sessionId, "session.json is not valid JSON");
+    }
+    return validateDirectSessionRecord(sessionId, value);
 }
 export function updateDirectSession(sessionId, updates) {
-    const session = readDirectSession(sessionId);
-    const updated = { ...session, ...updates };
-    const dir = getDirectSessionDir(sessionId);
-    writeFileSync(join(dir, "session.json"), JSON.stringify(updated, null, 2), "utf-8");
-    return updated;
+    return mutateDirectSessionRecord(sessionId, (session) => ({
+        ...session,
+        ...updates,
+        session_id: session.session_id,
+    }));
+}
+export function appendDirectSessionOperation(sessionId, operation, config = getConfig()) {
+    return mutateDirectSessionRecord(sessionId, (session) => ({
+        ...session,
+        operations: [
+            ...session.operations,
+            {
+                ...operation,
+                index: session.operations.reduce((max, entry) => Math.max(max, entry.index), -1) + 1,
+            },
+        ],
+    }), config);
 }
-export function appendDirectSessionOperation(sessionId, operation) {
-    const session = readDirectSession(sessionId);
-    const operations = [...session.operations, operation];
-    return updateDirectSession(sessionId, { operations });
+export function withDirectSessionMutationLock(sessionId, action, config = getConfig()) {
+    const lockTarget = join(getDirectSessionDir(sessionId, config), "workspace-mutation");
+    return withFileLockSync(lockTarget, action, directSessionBusyOptions(sessionId));
+}
+export function withDirectSessionMutationLockAsync(sessionId, action, config = getConfig()) {
+    const lockTarget = join(getDirectSessionDir(sessionId, config), "workspace-mutation");
+    return withFileLock(lockTarget, action, directSessionBusyOptions(sessionId));
 }
 export function appendDirectSessionVerificationRun(sessionId, run) {
-    const session = readDirectSession(sessionId);
-    const verification_runs = [...session.verification_runs, run];
-    return updateDirectSession(sessionId, { verification_runs });
+    return mutateDirectSessionRecord(sessionId, (session) => ({
+        ...session,
+        verification_runs: [...session.verification_runs, run],
+    }));
 }
 export function validateDirectSessionFreshness(sessionId) {
     let session;
@@ -124,20 +161,22 @@ export function validateDirectSessionFreshness(sessionId) {
     return { valid: true, failure_reason: null, session };
 }
 // ── Finalization ───────────────────────────────────────────────────
-export function finalizeDirectSessionRecord(sessionId, afterSnapshot, changeArtifacts) {
+export function finalizeDirectSessionRecord(sessionId, changeArtifacts) {
     const dir = getDirectSessionDir(sessionId);
     // Write change artifacts to session directory
-    writeFileSync(join(dir, "changed-files.json"), JSON.stringify(changeArtifacts.changed_files, null, 2), "utf-8");
-    writeFileSync(join(dir, "diff.patch"), changeArtifacts.diff, "utf-8");
+    atomicWriteJsonFileSync(join(dir, "changed-files.json"), changeArtifacts.changed_files);
+    atomicWriteFileSync(join(dir, "diff.patch"), changeArtifacts.diff);
     const summary = {
         changed_files_total: changeArtifacts.changed_files.length,
         additions: changeArtifacts.additions,
         deletions: changeArtifacts.deletions,
         patch_mode: changeArtifacts.patch_mode,
+        diff_redacted: changeArtifacts.diff_redacted === true,
+        diff_redaction_categories: changeArtifacts.diff_redaction_categories ?? [],
         artifact_hygiene: changeArtifacts.artifact_hygiene,
     };
-    writeFileSync(join(dir, "summary.json"), JSON.stringify(summary, null, 2), "utf-8");
-    writeFileSync(join(dir, "summary.md"), formatSummaryMd(changeArtifacts), "utf-8");
+    atomicWriteJsonFileSync(join(dir, "summary.json"), summary);
+    atomicWriteFileSync(join(dir, "summary.md"), formatSummaryMd(changeArtifacts));
     return updateDirectSession(sessionId, {
         finalized: true,
         finalized_at: new Date().toISOString(),
@@ -166,6 +205,58 @@ function extractReason(error) {
         return error.message.slice(0, 80);
     return String(error).slice(0, 80);
 }
+function invalidDirectSessionRecord(sessionId, detail) {
+    return new PatchWardenError("invalid_session_record", `Direct session "${sessionId}" is invalid: ${detail}.`, "Create a new direct session and do not modify its internal session.json file.", true, { session_id: sessionId });
+}
+function getDirectSessionFile(sessionId, config = getConfig()) {
+    const dir = getDirectSessionDir(sessionId, config);
+    return guardPath(join(dir, "session.json"), config.workspaceRoot, config.directSessionsDir);
+}
+function mutateDirectSessionRecord(sessionId, mutation, config = getConfig()) {
+    const file = getDirectSessionFile(sessionId, config);
+    if (!existsSync(file)) {
+        throw new PatchWardenError("session_not_found", `Direct session "${sessionId}" not found.`, "Call create_direct_session first to get a valid session_id.", true, { session_id: sessionId });
+    }
+    return mutateLockedJsonFileSync(file, (current) => {
+        const session = validateDirectSessionRecord(sessionId, current);
+        const next = mutation(session);
+        return { next, result: next };
+    }, {
+        // Session-record appends are short serialized writes. Give Windows
+        // antivirus-delayed lock detachment enough time to finish instead of
+        // dropping concurrent operation or verification evidence.
+        waitMs: 10_000,
+        busyError: () => new PatchWardenError("direct_session_busy", `Direct session "${sessionId}" is currently being updated.`, "Retry after the current Direct operation completes.", true, { session_id: sessionId }),
+    });
+}
+function directSessionBusyOptions(sessionId) {
+    return {
+        waitMs: 0,
+        busyError: () => new PatchWardenError("direct_session_busy", `Direct session "${sessionId}" already has a workspace operation in progress.`, "Wait for the active patch, sync, verification, or finalization to finish, then retry.", true, { session_id: sessionId }),
+    };
+}
+function validateDirectSessionRecord(sessionId, value) {
+    if (!value || typeof value !== "object" || Array.isArray(value)) {
+        throw invalidDirectSessionRecord(sessionId, "session.json must contain an object");
+    }
+    const record = value;
+    if (record.session_id !== sessionId) {
+        throw invalidDirectSessionRecord(sessionId, "session_id does not match its directory");
+    }
+    if (typeof record.resolved_repo_path !== "string" || record.resolved_repo_path.trim() === "") {
+        throw invalidDirectSessionRecord(sessionId, "resolved_repo_path is missing");
+    }
+    if (typeof record.expires_at !== "string" || !Number.isFinite(Date.parse(record.expires_at))) {
+        throw invalidDirectSessionRecord(sessionId, "expires_at is invalid");
+    }
+    if (typeof record.finalized !== "boolean") {
+        throw invalidDirectSessionRecord(sessionId, "finalized must be a boolean");
+    }
+    if (!Array.isArray(record.operations) || !Array.isArray(record.verification_runs)) {
+        throw invalidDirectSessionRecord(sessionId, "operation or verification history is invalid");
+    }
+    return record;
+}
 function formatSummaryMd(artifacts) {
     const lines = [
         "# Direct Session Change Summary",
@@ -174,6 +265,7 @@ function formatSummaryMd(artifacts) {
         `**Additions:** ${artifacts.additions}`,
         `**Deletions:** ${artifacts.deletions}`,
         `**Patch mode:** ${artifacts.patch_mode}`,
+        `**Diff redacted:** ${artifacts.diff_redacted === true ? "yes" : "no"}`,
         "",
         "## Artifact Hygiene",
         "",

package/dist/direct/directVerification.js

@@ -1,10 +1,11 @@
-import { writeFileSync } from "node:fs";
 import { join } from "node:path";
 import { getConfig } from "../config.js";
 import { guardDirectCommand } from "../security/commandGuard.js";
 import { redactSensitiveContent } from "../security/contentRedaction.js";
 import { runSimpleProcess } from "../runner/simpleProcess.js";
+import { resolveTrustedCommandLine } from "../runner/processSecurity.js";
 import { getDirectSessionDir } from "./directSessionStore.js";
+import { atomicWriteJsonFileSync } from "../utils/atomicFile.js";
 const MAX_TAIL_CHARS = 10_000;
 const DEFAULT_TIMEOUT_SECONDS = 120;
 export async function runDirectVerification(input) {
@@ -13,7 +14,7 @@ export async function runDirectVerification(input) {
     const timeoutSeconds = input.timeoutSeconds ?? DEFAULT_TIMEOUT_SECONDS;
     const timeoutMs = timeoutSeconds * 1000;
     // Parse command into command + args
-    const parts = parseCommand(allowedCommand);
+    const parts = parseCommand(allowedCommand, input.resolvedRepoPath);
     if (!parts) {
         throw new Error(`Failed to parse command: "${allowedCommand}"`);
     }
@@ -73,27 +74,18 @@ export async function runDirectVerification(input) {
         ],
         spawn_error: result.spawnError,
     };
-    writeFileSync(join(sessionDir, "verification.json"), JSON.stringify(verificationJson, null, 2), "utf-8");
+    atomicWriteJsonFileSync(join(sessionDir, "verification.json"), verificationJson);
     return { run, log_path: logPath };
 }
 // ── Helpers ────────────────────────────────────────────────────────
-function parseCommand(command) {
+function parseCommand(command, cwd) {
     const trimmed = command.trim();
     if (!trimmed)
         return null;
-    // Simple split by spaces - sufficient for allowlisted commands like "npm test"
-    const parts = trimmed.split(/\s+/);
-    // On Windows, npm/npx are batch files (.cmd) and spawn() cannot find them
-    // without shell resolution. Wrap with cmd.exe /c for those commands.
-    if (process.platform === "win32" && (parts[0] === "npm" || parts[0] === "npx")) {
-        return {
-            command: "cmd",
-            args: ["/c", ...parts],
-        };
-    }
+    const invocation = resolveTrustedCommandLine(trimmed, cwd);
     return {
-        command: parts[0],
-        args: parts.slice(1),
+        command: invocation.command,
+        args: invocation.argsPrefix,
     };
 }
 function truncateTail(content, maxChars) {

package/dist/doctor.js

@@ -9,28 +9,36 @@
  */
 import { existsSync, statSync, readFileSync, mkdirSync, writeFileSync, rmSync } from "node:fs";
 import { isAbsolute, resolve, normalize, join } from "node:path";
-import { execSync } from "node:child_process";
 import { createServer } from "node:net";
 import { getConfig } from "./config.js";
 import { guardPath, guardWorkspacePath } from "./security/pathGuard.js";
 import { isSensitivePath } from "./security/sensitiveGuard.js";
 import { guardPlanContent } from "./security/planGuard.js";
-import { TASK_READ_ONLY_FILES } from "./tools/getTaskFile.js";
+import { TASK_READ_ONLY_FILES } from "./tools/tasks/getTaskFile.js";
 import { getToolDefs } from "./tools/registry.js";
-import { CHATGPT_CORE_TOOL_NAMES, CHATGPT_DIRECT_TOOL_NAMES, selectToolsForProfile } from "./tools/toolCatalog.js";
-import { buildToolRegistry } from "./tools/toolRegistry.js";
-import { runAllSchemaDriftChecks } from "./tools/schemaDriftCheck.js";
+import { CHATGPT_CORE_TOOL_NAMES, CHATGPT_DIRECT_TOOL_NAMES, selectToolsForProfile } from "./tools/catalog/toolCatalog.js";
+import { buildToolRegistry } from "./tools/catalog/toolRegistry.js";
+import { runAllSchemaDriftChecks } from "./tools/diagnostics/schemaDriftCheck.js";
 import { runReleaseGateCheck } from "./release/releaseGate.js";
 import { PATCHWARDEN_VERSION } from "./version.js";
 import { logger } from "./logging.js";
+import { unsafeWorkspaceRootLabel } from "./security/workspaceRootGuard.js";
+import { runSimpleProcessSync } from "./runner/simpleProcess.js";
+import { resolveAgentLaunch } from "./runner/agentInvocation.js";
 // ── Helpers ────────────────────────────────────────────────────────
-function cmd(cmdStr) {
+function cmd(command, args = []) {
     try {
-        return execSync(cmdStr, {
-            encoding: "utf-8",
-            timeout: 5000,
-            stdio: ["ignore", "pipe", "ignore"], // suppress stdin and stderr
-        }).trim();
+        const result = runSimpleProcessSync({
+            command,
+            args: [...args],
+            cwd: process.cwd(),
+            timeoutMs: 5000,
+            maxStdoutBytes: 64 * 1024,
+            maxStderrBytes: 64 * 1024,
+        });
+        if (result.exitCode !== 0)
+            return "";
+        return `${result.stdout}${result.stderr}`.trim();
     }
     catch {
         return "";
@@ -75,7 +83,7 @@ const checkNpmAvailable = {
     id: "npm-available",
     description: "npm available",
     run() {
-        const npmVer = cmd("npm --version");
+        const npmVer = cmd(process.platform === "win32" ? "npm.cmd" : "npm", ["--version"]);
         return [checkResult("npm available", npmVer !== "", npmVer || "npm not found in PATH")];
     },
 };
@@ -101,7 +109,7 @@ const checkGitAvailable = {
     id: "git-available",
     description: "Git available",
     run() {
-        const gitVer = cmd("git --version");
+        const gitVer = cmd("git", ["--version"]);
         return [warnCheckResult("Git available", gitVer !== "", gitVer || "git not found — runner git.diff will not work")];
     },
 };
@@ -154,17 +162,9 @@ const checkWorkspaceRoot = {
         }
         catch { }
         results.push(checkResult("workspaceRoot is directory", isDir, ws));
-        const dangerousRoots = [
-            { pattern: /^[A-Za-z]:\\?$/, label: "drive root" },
-            { pattern: /\\Users\\[^\\]+$/, label: "user home directory" },
-            { pattern: /\\Desktop$/, label: "Desktop" },
-            { pattern: /\\Downloads$/, label: "Downloads" },
-            { pattern: /\\Documents$/, label: "Documents" },
-        ];
-        for (const { pattern, label } of dangerousRoots) {
-            if (pattern.test(ws)) {
-                results.push(warnResult(`workspaceRoot is ${label}: ${ws} — consider narrowing to a project directory`));
-            }
+        const unsafeLabel = unsafeWorkspaceRootLabel(ws);
+        if (unsafeLabel) {
+            results.push(warnResult(`workspaceRoot is ${unsafeLabel}: ${ws} — consider narrowing to a project directory`));
         }
         return results;
     },
@@ -258,7 +258,9 @@ const checkServerVersion = {
         const packageJson = JSON.parse(readFileSync(resolve(process.cwd(), "package.json"), "utf-8"));
         return [
             checkResult("Server version matches package.json", packageJson.version === PATCHWARDEN_VERSION, `${PATCHWARDEN_VERSION} vs ${packageJson.version}`),
-            checkResult("Manifest preflight script exists", existsSync(resolve(process.cwd(), "scripts/checks/mcp-manifest-check.js")), "scripts/checks/mcp-manifest-check.js"),
+            process.env.PATCHWARDEN_DESKTOP_RUNTIME === "1"
+                ? okResult("Manifest preflight covered by compiled desktop runtime checks")
+                : checkResult("Manifest preflight script exists", existsSync(resolve(process.cwd(), "scripts/checks/mcp-manifest-check.js")), "scripts/checks/mcp-manifest-check.js"),
         ];
     },
 };
@@ -375,23 +377,23 @@ const checkToolModules = {
     description: "Tool module checks",
     run() {
         const newTools = [
-            "listTasks",
-            "listAgents",
-            "cancelTask",
-            "killTask",
-            "retryTask",
-            "getTaskProgress",
-            "getTaskSummary",
-            "waitForTask",
-            "getTaskStdoutTail",
-            "healthCheck",
-            "auditTask",
+            { name: "listTasks", subdir: "tasks" },
+            { name: "listAgents", subdir: "workspace" },
+            { name: "cancelTask", subdir: "tasks" },
+            { name: "killTask", subdir: "tasks" },
+            { name: "retryTask", subdir: "tasks" },
+            { name: "getTaskProgress", subdir: "tasks" },
+            { name: "getTaskSummary", subdir: "tasks" },
+            { name: "waitForTask", subdir: "tasks" },
+            { name: "getTaskStdoutTail", subdir: "tasks" },
+            { name: "healthCheck", subdir: "diagnostics" },
+            { name: "auditTask", subdir: "diagnostics" },
         ];
         const results = [];
         for (const t of newTools) {
-            const compiled = resolve(process.cwd(), "dist/tools", `${t}.js`);
+            const compiled = resolve(process.cwd(), "dist/tools", t.subdir, `${t.name}.js`);
             const exists = existsSync(compiled);
-            results.push(checkResult(`Tool module: ${t}`, exists, exists ? "compiled" : "missing"));
+            results.push(checkResult(`Tool module: ${t.name}`, exists, exists ? "compiled" : "missing"));
         }
         return results;
     },
@@ -401,18 +403,18 @@ const checkDirectToolModules = {
     description: "Direct tool module checks",
     run() {
         const directToolModules = [
-            "createDirectSession",
-            "searchWorkspace",
-            "applyPatch",
-            "runVerification",
-            "finalizeDirectSession",
-            "auditSession",
+            { name: "createDirectSession", subdir: "direct" },
+            { name: "searchWorkspace", subdir: "workspace" },
+            { name: "applyPatch", subdir: "workspace" },
+            { name: "runVerification", subdir: "tasks" },
+            { name: "finalizeDirectSession", subdir: "direct" },
+            { name: "auditSession", subdir: "diagnostics" },
         ];
         const results = [];
         for (const t of directToolModules) {
-            const compiled = resolve(process.cwd(), "dist/tools", `${t}.js`);
+            const compiled = resolve(process.cwd(), "dist/tools", t.subdir, `${t.name}.js`);
             const exists = existsSync(compiled);
-            results.push(checkResult(`Direct tool module: ${t}`, exists, exists ? "compiled" : "missing"));
+            results.push(checkResult(`Direct tool module: ${t.name}`, exists, exists ? "compiled" : "missing"));
         }
         return results;
     },
@@ -514,8 +516,7 @@ const checkAgentCommands = {
         if (!context.config)
             return [];
         const results = [];
-        const agents = context.config.agents || {};
-        for (const [name, agentCfg] of Object.entries(agents)) {
+        for (const [name, agentCfg] of Object.entries(context.config.agents)) {
             const cmdName = agentCfg.command;
             const looksLikePath = isAbsolute(cmdName) || cmdName.includes("/") || cmdName.includes("\\");
             if (looksLikePath) {
@@ -523,11 +524,20 @@ const checkAgentCommands = {
                 results.push(warnCheckResult(`Agent "${name}" command available`, agentExists, agentExists ? `Found: ${cmdName}` : `"${cmdName}" does not exist — agent tasks will fail`));
                 continue;
             }
-            // Platform-appropriate lookup: 'where' on Windows, 'command -v' on Unix
+            // Use an argumentized lookup utility; never interpolate config into a shell.
             const isWin = process.platform === "win32";
-            const lookupCmd = isWin ? `where ${cmdName}` : `command -v ${cmdName}`;
-            const fallbackCmd = isWin ? `command -v ${cmdName}` : `which ${cmdName}`;
-            const found = cmd(lookupCmd) || cmd(fallbackCmd);
+            let found = "";
+            if (isWin) {
+                try {
+                    found = resolveAgentLaunch(name, cmdName, process.platform, process.env.PATH || "", existsSync, context.config.workspaceRoot, typeof agentCfg.adapter === "string" ? agentCfg.adapter : name).command;
+                }
+                catch {
+                    found = "";
+                }
+            }
+            else {
+                found = cmd("which", [cmdName]);
+            }
             results.push(warnCheckResult(`Agent "${name}" command available`, found !== "", found ? `Found: ${found.split("\n")[0]}` : `"${cmdName}" not in PATH — agent tasks will fail`));
         }
         return results;

package/dist/goal/acceptanceEngine.d.ts

@@ -12,7 +12,7 @@
  *   3. 存在 warn 级检查项或文档不同步 → NEEDS_FIX
  *   4. 所有检查通过 → ACCEPTED
  */
-import type { AcceptanceStatus } from "../tools/createTask.js";
+import type { AcceptanceStatus } from "../tools/tasks/createTask.js";
 export type AcceptanceVerdict = "ACCEPTED" | "NEEDS_FIX" | "REJECTED" | "BLOCKED_BY_APPROVAL";
 export interface AcceptanceCheck {
     name: string;