patchwarden 1.5.1 → 1.6.2

package/dist/security/runtimeGuard.js

@@ -1,6 +1,7 @@
 import { resolve, join, dirname } from "node:path";
 import { fileURLToPath } from "node:url";
 import { PatchWardenError } from "../errors.js";
+import { isPathChildOf, isSamePath } from "../utils/platform.js";
 const CRITICAL_RUNTIME_DIRS = ["dist", "src", "scripts", "release"];
 /**
  * Refuse operations against the active PatchWarden runtime directory or its
@@ -8,15 +9,17 @@ const CRITICAL_RUNTIME_DIRS = ["dist", "src", "scripts", "release"];
  * and direct-session flows share the same protection.
  */
 export function guardRuntimeSelfModification(resolvedRepoPath) {
-    const runtimeRoot = resolve(dirname(fileURLToPath(import.meta.url)), "..");
-    if (resolvedRepoPath === runtimeRoot ||
-        resolvedRepoPath.startsWith(runtimeRoot + resolve("/")[0])) {
+    // runtimeGuard lives at <package-root>/{src,dist}/security/runtimeGuard.*.
+    const runtimeRoot = resolve(dirname(fileURLToPath(import.meta.url)), "..", "..");
+    const isRuntimeRoot = isSamePath(resolvedRepoPath, runtimeRoot);
+    if (isRuntimeRoot ||
+        isPathChildOf(resolvedRepoPath, runtimeRoot)) {
         const isCritical = CRITICAL_RUNTIME_DIRS.some((dir) => {
             const full = join(runtimeRoot, dir);
-            return (resolvedRepoPath === full ||
-                resolvedRepoPath.startsWith(full + resolve("/")[0]));
+            return (isSamePath(resolvedRepoPath, full) ||
+                isPathChildOf(resolvedRepoPath, full));
         });
-        if (resolvedRepoPath === runtimeRoot || isCritical) {
+        if (isRuntimeRoot || isCritical) {
             throw new PatchWardenError("runtime_self_modification_blocked", `repo_path points to the active PatchWarden runtime or its critical subdirectories.`, "Use a dev copy or git worktree for PatchWarden development. The running MCP server must not be modified by a task.", true, {
                 operation: "runtime_guard",
                 path: resolvedRepoPath,

package/dist/security/secretComparison.d.ts

@@ -0,0 +1,3 @@
+/** Compare secret text without content-dependent byte comparison. */
+export declare function timingSafeStringEqual(actual: string, expected: string): boolean;
+export declare function firstHeaderValue(value: string | string[] | undefined): string;

package/dist/security/secretComparison.js

@@ -0,0 +1,11 @@
+import { timingSafeEqual } from "node:crypto";
+/** Compare secret text without content-dependent byte comparison. */
+export function timingSafeStringEqual(actual, expected) {
+    const actualBytes = Buffer.from(actual, "utf-8");
+    const expectedBytes = Buffer.from(expected, "utf-8");
+    return actualBytes.length === expectedBytes.length
+        && timingSafeEqual(actualBytes, expectedBytes);
+}
+export function firstHeaderValue(value) {
+    return Array.isArray(value) ? (value[0] || "") : (value || "");
+}

package/dist/security/sensitiveGuard.d.ts

@@ -1,2 +1,7 @@
+/**
+ * Detect a Windows NTFS alternate data stream suffix. The colon in an
+ * absolute drive prefix (for example, C:\\) is the only permitted colon.
+ */
+export declare function hasWindowsAlternateDataStream(filePath: string): boolean;
 export declare function isSensitivePath(filePath: string): boolean;
 export declare function guardSensitivePath(filePath: string): void;

package/dist/security/sensitiveGuard.js

@@ -7,22 +7,28 @@ const SENSITIVE_PATTERNS = [
     // Exact filenames
     /(?:^|[\\/])\.env$/i,
     /(?:^|[\\/])\.env\..+$/i,
+    /(?:^|[\\/])\.envrc$/i,
     /(?:^|[\\/])id_rsa$/i,
+    /(?:^|[\\/])id_dsa$/i,
     /(?:^|[\\/])id_ed25519$/i,
     /(?:^|[\\/])id_ecdsa$/i,
     /(?:^|[\\/])\.ssh[\\/]/i,
     // Credentials / tokens
-    /(?:^|[\\/])credentials/i,
+    /(?:^|[\\/])credentials(?:\.(?:txt|json|ya?ml|toml|ini|cfg|db))?$/i,
     /(?:^|[\\/])\.?aws[\\/]credentials/i,
     /(?:^|[\\/])\.netrc$/i,
     /(?:^|[\\/])\.npmrc$/i,
     /(?:^|[\\/])\.pypirc$/i,
-    /(?:^|[\\/])token/i,
+    /(?:^|[\\/])token$/i,
+    /(?:^|[\\/])tokens?\.(?:txt|json|ya?ml|toml|ini|cfg|db)$/i,
+    /(?:^|[\\/])token[-_](?:store|cache|data|secret|auth|credentials|backup|local|prod|production|dev|development)(?:\.[^\\/]+)?$/i,
+    /(?:^|[\\/])(?:access[_-]?token|refresh[_-]?token|api[_-]?key|client[_-]?secret)(?:\.(?:txt|json|ya?ml|ini|cfg))?$/i,
     // Private keys
     /(?:^|[\\/])[^.]+\.pem$/i,
     /(?:^|[\\/])[^.]+\.key$/i,
     /(?:^|[\\/])[^.]+\.pfx$/i,
     /(?:^|[\\/])[^.]+\.p12$/i,
+    /(?:^|[\\/])[^.]+\.ppk$/i,
     // Browser data
     /(?:^|[\\/])cookies/i,
     /(?:^|[\\/])web data$/i,
@@ -30,17 +36,30 @@ const SENSITIVE_PATTERNS = [
     /(?:^|[\\/])local state$/i,
     // Other sensitive files
     /(?:^|[\\/])\.git-credentials$/i,
+    /(?:^|[\\/])\.git[\\/]config$/i,
     /(?:^|[\\/])\.docker[\\/]config\.json$/i,
     /(?:^|[\\/])\.kube[\\/]config$/i,
+    /(?:^|[\\/])kubeconfig$/i,
+    /(?:^|[\\/])application_default_credentials\.json$/i,
+    /(?:^|[\\/])service[-_]?account(?:[-_][^\\/]+)?\.json$/i,
     /(?:^|[\\/])config\.json$/i, // generic config files often contain local tokens or service credentials
 ];
-// Files specifically inside .patchwarden are always allowed
-const SAFE_PREFIX = ".patchwarden";
+/**
+ * Detect a Windows NTFS alternate data stream suffix. The colon in an
+ * absolute drive prefix (for example, C:\\) is the only permitted colon.
+ */
+export function hasWindowsAlternateDataStream(filePath) {
+    const withoutDrivePrefix = /^[A-Za-z]:[\\/]/.test(filePath)
+        ? filePath.slice(2)
+        : filePath;
+    return withoutDrivePrefix.includes(":");
+}
 export function isSensitivePath(filePath) {
-    // Files inside .patchwarden are always safe
-    const normalized = filePath.replace(/\\/g, "/");
-    if (normalized.includes(`${SAFE_PREFIX}/`) || normalized.endsWith(SAFE_PREFIX)) {
-        return false;
+    if (filePath.includes("\0"))
+        return true;
+    // ADS can hide content behind an otherwise safe-looking filename.
+    if (hasWindowsAlternateDataStream(filePath)) {
+        return true;
     }
     for (const pattern of SENSITIVE_PATTERNS) {
         if (pattern.test(filePath)) {

package/dist/security/toolInvocationGuard.d.ts

@@ -14,8 +14,8 @@
  *
  * 加上 consumeToken 内的 token_not_found / token_expired，共 10 项调用前强制校验。
  */
-import { type PatchWardenToolMeta } from "../tools/toolRegistry.js";
-import type { ToolProfile } from "../tools/toolCatalog.js";
+import { type PatchWardenToolMeta } from "../tools/catalog/toolRegistry.js";
+import type { ToolProfile } from "../tools/catalog/toolCatalog.js";
 import type { DiscoveryTokenRecord } from "./discoveryTokenStore.js";
 export interface GuardInput {
     toolName: string;

package/dist/security/toolInvocationGuard.js

@@ -16,7 +16,7 @@
  */
 import { PatchWardenError } from "../errors.js";
 import { guardSensitivePath } from "./sensitiveGuard.js";
-import { TOOL_RISK_RANK } from "../tools/toolRegistry.js";
+import { TOOL_RISK_RANK } from "../tools/catalog/toolRegistry.js";
 // ── 内部常量 ──────────────────────────────────────────────────────
 /**
  * 常见路径参数字段名，用于 workspace_read_sensitive 校验时扫描 args。

package/dist/security/workspaceRootGuard.d.ts

@@ -0,0 +1,8 @@
+export interface WorkspaceRootValidation {
+    ok: boolean;
+    path: string;
+    reason: string | null;
+    category: "valid" | "missing" | "not_directory" | "unsafe_root";
+}
+export declare function unsafeWorkspaceRootLabel(value: string, userHome?: string): string | null;
+export declare function validateWorkspaceRoot(value: string, userHome?: string): WorkspaceRootValidation;

package/dist/security/workspaceRootGuard.js

@@ -0,0 +1,47 @@
+import { existsSync, realpathSync, statSync } from "node:fs";
+import { homedir } from "node:os";
+import { basename, normalize, resolve, win32 } from "node:path";
+function normalizeInput(value) {
+    return /^[a-z]:[\\/]/i.test(value) ? win32.normalize(value) : normalize(resolve(value));
+}
+function comparable(value) {
+    return normalizeInput(value).replace(/[\\/]+$/, "").toLowerCase();
+}
+export function unsafeWorkspaceRootLabel(value, userHome = homedir()) {
+    const resolved = normalizeInput(value);
+    const trimmed = resolved.replace(/[\\/]+$/, "");
+    const windowsStyle = /^[a-z]:[\\/]/i.test(value) || /^\\\\/.test(value);
+    const leaf = (windowsStyle ? win32.basename(trimmed) : basename(trimmed)).toLowerCase();
+    if (/^[a-z]:$/i.test(trimmed) || trimmed === "" || trimmed === "/")
+        return "drive root";
+    if (comparable(trimmed) === comparable(userHome))
+        return "user home directory";
+    if (leaf === "desktop")
+        return "Desktop";
+    if (leaf === "downloads")
+        return "Downloads";
+    if (leaf === "documents")
+        return "Documents";
+    return null;
+}
+export function validateWorkspaceRoot(value, userHome = homedir()) {
+    const lexicalPath = normalize(resolve(value || "."));
+    if (!existsSync(lexicalPath)) {
+        return { ok: false, path: lexicalPath, reason: "workspaceRoot does not exist", category: "missing" };
+    }
+    let resolved;
+    try {
+        resolved = normalize(realpathSync(lexicalPath));
+        if (!statSync(resolved).isDirectory()) {
+            return { ok: false, path: resolved, reason: "workspaceRoot is not a directory", category: "not_directory" };
+        }
+    }
+    catch {
+        return { ok: false, path: lexicalPath, reason: "workspaceRoot is not accessible", category: "not_directory" };
+    }
+    const unsafeLabel = unsafeWorkspaceRootLabel(resolved, userHome);
+    if (unsafeLabel) {
+        return { ok: false, path: resolved, reason: `workspaceRoot cannot be ${unsafeLabel}`, category: "unsafe_root" };
+    }
+    return { ok: true, path: resolved, reason: null, category: "valid" };
+}

package/dist/smoke-test.js

@@ -18,32 +18,32 @@ import { tmpdir } from "node:os";
 import { fileURLToPath } from "node:url";
 import { spawnSync } from "node:child_process";
 import { loadConfig, getConfig, getTasksDir, reloadConfig } from "./config.js";
-import { savePlan } from "./tools/savePlan.js";
-import { getPlan } from "./tools/getPlan.js";
-import { createTask } from "./tools/createTask.js";
+import { savePlan } from "./tools/goals/savePlan.js";
+import { getPlan } from "./tools/goals/getPlan.js";
+import { createTask } from "./tools/tasks/createTask.js";
 import { confirmAssessment, readAssessment, createAssessment } from "./assessments/assessmentStore.js";
 import { captureRepoSnapshot } from "./runner/changeCapture.js";
-import { getTaskStatus } from "./tools/getTaskStatus.js";
-import { getResult, getDiff, getTestLog } from "./tools/taskOutputs.js";
-import { listWorkspace } from "./tools/listWorkspace.js";
-import { readWorkspaceFile } from "./tools/readWorkspaceFile.js";
-import { listTasks } from "./tools/listTasks.js";
-import { cancelTask } from "./tools/cancelTask.js";
-import { retryTask } from "./tools/retryTask.js";
-import { getTaskStdoutTail } from "./tools/getTaskStdoutTail.js";
-import { auditTask } from "./tools/auditTask.js";
-import { getTaskSummary } from "./tools/getTaskSummary.js";
+import { getTaskStatus } from "./tools/tasks/getTaskStatus.js";
+import { getResult, getDiff, getTestLog } from "./tools/tasks/taskOutputs.js";
+import { listWorkspace } from "./tools/workspace/listWorkspace.js";
+import { readWorkspaceFile } from "./tools/workspace/readWorkspaceFile.js";
+import { listTasks } from "./tools/tasks/listTasks.js";
+import { cancelTask } from "./tools/tasks/cancelTask.js";
+import { retryTask } from "./tools/tasks/retryTask.js";
+import { getTaskStdoutTail } from "./tools/tasks/getTaskStdoutTail.js";
+import { auditTask } from "./tools/diagnostics/auditTask.js";
+import { getTaskSummary } from "./tools/tasks/getTaskSummary.js";
 import { guardAgentCommand } from "./security/commandGuard.js";
 import { getToolDefs } from "./tools/registry.js";
-import { buildToolCatalogSnapshot, CHATGPT_CORE_TOOL_NAMES, CHATGPT_DIRECT_TOOL_NAMES, selectToolsForProfile, } from "./tools/toolCatalog.js";
+import { buildToolCatalogSnapshot, CHATGPT_CORE_TOOL_NAMES, CHATGPT_DIRECT_TOOL_NAMES, selectToolsForProfile, } from "./tools/catalog/toolCatalog.js";
 import { errorPayload } from "./errors.js";
 import { readWatcherStatus } from "./watcherStatus.js";
-import { createDirectSession } from "./tools/createDirectSession.js";
-import { searchWorkspace } from "./tools/searchWorkspace.js";
-import { applyPatch } from "./tools/applyPatch.js";
-import { runVerification } from "./tools/runVerification.js";
-import { finalizeDirectSession } from "./tools/finalizeDirectSession.js";
-import { auditSession } from "./tools/auditSession.js";
+import { createDirectSession } from "./tools/direct/createDirectSession.js";
+import { searchWorkspace } from "./tools/workspace/searchWorkspace.js";
+import { applyPatch } from "./tools/workspace/applyPatch.js";
+import { runVerification } from "./tools/tasks/runVerification.js";
+import { finalizeDirectSession } from "./tools/direct/finalizeDirectSession.js";
+import { auditSession } from "./tools/diagnostics/auditSession.js";
 import { readDirectSession, updateDirectSession } from "./direct/directSessionStore.js";
 import { createHash } from "node:crypto";
 // Resolve the actual node binary path (spawnSync needs it on WSL/Windows)
@@ -418,15 +418,16 @@ const sensitiveFiles = [
     "cookies.sqlite",
     ".git-credentials",
     "config.json",
+    ".patchwarden/.env",
+    ".patchwarden/credentials.json",
 ];
 for (const sf of sensitiveFiles) {
     await testReject(`C. readWorkspaceFile blocks "${sf}"`, () => {
         readWorkspaceFile(sf);
     });
 }
-// Files inside .patchwarden should always be allowed
-await test("C. readWorkspaceFile allows .patchwarden/plans/...", () => {
-    // This should work because .patchwarden files are whitelisted
+// Ordinary PatchWarden artifacts remain readable through their dedicated tool.
+await test("C. getPlan reads ordinary .patchwarden/plans artifacts", () => {
     const plan = savePlan({ title: "Allowlist Test", content: "test" });
     const result = getPlan({ plan_id: plan.plan_id });
     if (!result.content.includes("test"))
@@ -1268,7 +1269,7 @@ await test("K8. assessment not found rejected", async () => {
             agent: "codex",
             repo_path: ".",
             execution_mode: "execute",
-            assessment_id: "assessment_20260101_" + "0".repeat(32),
+            assessment_id: "assessment_20260101_000000_" + "0".repeat(32),
         });
         throw new Error("Should have rejected unknown assessment");
     }
@@ -1508,8 +1509,8 @@ await test("K16. assessment_short_id cannot execute", async () => {
         throw new Error("Should have rejected short ID");
     }
     catch (e) {
-        if (!e.message?.includes("not found"))
-            throw new Error(`Expected not found for short ID, got: ${e.message}`);
+        if (e.reason !== "assessment_id_invalid")
+            throw new Error(`Expected assessment_id_invalid for short ID, got: ${e.reason || e.message}`);
     }
 });
 await test("K17. blocked assessment cannot execute", async () => {

package/dist/tools/catalog/index.d.ts

@@ -0,0 +1,4 @@
+export * from "./toolCatalog.js";
+export * from "./toolRegistry.js";
+export * from "./toolSearch.js";
+export * from "./toolUsageStats.js";

package/dist/tools/catalog/index.js

@@ -0,0 +1,4 @@
+export * from "./toolCatalog.js";
+export * from "./toolRegistry.js";
+export * from "./toolSearch.js";
+export * from "./toolUsageStats.js";

package/dist/tools/{toolCatalog.js → catalog/toolCatalog.js}

@@ -1,5 +1,6 @@
 import { createHash } from "node:crypto";
-import { PATCHWARDEN_VERSION, TOOL_SCHEMA_EPOCH } from "../version.js";
+import { PATCHWARDEN_VERSION, TOOL_SCHEMA_EPOCH } from "../../version.js";
+import { stableJsonStringify } from "../../utils/stableJson.js";
 export const CHATGPT_CORE_TOOL_NAMES = [
     "health_check",
     "list_agents",
@@ -101,7 +102,7 @@ export function buildToolCatalogSnapshot(tools, profile) {
         inputSchema: tool.inputSchema,
     }));
     const tool_manifest_sha256 = createHash("sha256")
-        .update(stableJson(manifestInput))
+        .update(stableJsonStringify(manifestInput))
         .digest("hex");
     lastSnapshot = {
         server_version: PATCHWARDEN_VERSION,
@@ -116,13 +117,3 @@ export function buildToolCatalogSnapshot(tools, profile) {
 export function getLastToolCatalogSnapshot() {
     return lastSnapshot ? { ...lastSnapshot, tool_names: [...lastSnapshot.tool_names] } : null;
 }
-function stableJson(value) {
-    if (Array.isArray(value))
-        return `[${value.map(stableJson).join(",")}]`;
-    if (value && typeof value === "object") {
-        const entries = Object.entries(value)
-            .sort(([left], [right]) => left.localeCompare(right));
-        return `{${entries.map(([key, entry]) => `${JSON.stringify(key)}:${stableJson(entry)}`).join(",")}}`;
-    }
-    return JSON.stringify(value);
-}

package/dist/tools/{toolRegistry.d.ts → catalog/toolRegistry.d.ts}

@@ -5,8 +5,9 @@
  * schema digest 使用稳定字段顺序的 canonical JSON → sha256 计算，
  * 用于检测工具 schema 漂移、release check 校验、discover_tools 返回。
  */
+import { stableJsonStringify } from "../../utils/stableJson.js";
 import type { ToolProfile } from "./toolCatalog.js";
-import type { ToolDef } from "./registry.js";
+import type { ToolDef } from "../definitions/toolDefs.js";
 export type ToolRisk = "readonly" | "workspace_read_sensitive" | "workspace_write" | "command" | "release" | "credential_sensitive";
 export declare const TOOL_RISK_RANK: Record<ToolRisk, number>;
 export type ToolMode = "delegate" | "direct" | "audit" | "release" | "diagnostic";
@@ -42,7 +43,7 @@ interface StaticToolMeta {
 /**
  * 稳定 JSON 序列化：按字段名排序，避免 key 顺序导致 digest 漂移。
  */
-export declare function stableJsonStringify(value: unknown): string;
+export { stableJsonStringify };
 /**
  * 计算 inputSchema 的 sha256 digest。
  * 返回格式："sha256:<hex>"
@@ -58,4 +59,3 @@ export declare function buildToolRegistry(tools: ToolDef[]): PatchWardenToolMeta
  * 获取单个工具的元数据（不含 schema digest，digest 需从 registry 获取）。
  */
 export declare function getStaticToolMeta(name: string): StaticToolMeta | undefined;
-export {};

package/dist/tools/{toolRegistry.js → catalog/toolRegistry.js}

@@ -6,6 +6,7 @@
  * 用于检测工具 schema 漂移、release check 校验、discover_tools 返回。
  */
 import { createHash } from "node:crypto";
+import { stableJsonStringify } from "../../utils/stableJson.js";
 export const TOOL_RISK_RANK = {
     readonly: 0,
     workspace_read_sensitive: 1,
@@ -56,7 +57,7 @@ const STATIC_TOOL_META = {
         summary: "列出已配置的本地 agent 及其可用性",
         profiles: ["full", "chatgpt_core"],
         modes: ["delegate", "diagnostic"],
-        tags: ["agent", "list", "config", "codex", "opencode"],
+        tags: ["agent", "list", "config", "local-cli", "model"],
         aliases: ["agents", "list_agent"],
         risk: "readonly",
         requiresConfirmation: false,
@@ -201,7 +202,7 @@ const STATIC_TOOL_META = {
         modes: ["delegate", "audit"],
         tags: ["safe", "audit", "checks", "acceptance", "task"],
         aliases: ["safe_audit", "audit_summary"],
-        risk: "readonly",
+        risk: "workspace_write",
         requiresConfirmation: false,
         relatedTools: ["audit_task", "safe_result"],
     },
@@ -545,7 +546,7 @@ const STATIC_TOOL_META = {
         modes: ["direct", "audit"],
         tags: ["safe", "direct", "finalize", "summary"],
         aliases: ["safe_finalize", "finalize_summary"],
-        risk: "readonly",
+        risk: "workspace_write",
         requiresConfirmation: false,
         relatedTools: ["finalize_direct_session", "safe_direct_summary"],
     },
@@ -556,7 +557,7 @@ const STATIC_TOOL_META = {
         modes: ["direct", "audit"],
         tags: ["safe", "direct", "audit", "session"],
         aliases: ["safe_direct_audit", "audit_direct_summary"],
-        risk: "readonly",
+        risk: "workspace_write",
         requiresConfirmation: false,
         relatedTools: ["audit_session", "safe_finalize_direct_session"],
     },
@@ -798,17 +799,7 @@ const STATIC_TOOL_META = {
 /**
  * 稳定 JSON 序列化：按字段名排序，避免 key 顺序导致 digest 漂移。
  */
-export function stableJsonStringify(value) {
-    if (Array.isArray(value)) {
-        return `[${value.map(stableJsonStringify).join(",")}]`;
-    }
-    if (value !== null && typeof value === "object") {
-        const entries = Object.entries(value)
-            .sort(([left], [right]) => left.localeCompare(right));
-        return `{${entries.map(([key, entry]) => `${JSON.stringify(key)}:${stableJsonStringify(entry)}`).join(",")}}`;
-    }
-    return JSON.stringify(value);
-}
+export { stableJsonStringify };
 /**
  * 计算 inputSchema 的 sha256 digest。
  * 返回格式："sha256:<hex>"

package/dist/tools/definitions/toolDefs.d.ts

@@ -0,0 +1,18 @@
+/**
+ * Tool definitions for PatchWarden MCP server.
+ *
+ * Extracted from registry.ts to keep the registry focused on dispatch
+ * wiring. getToolDefs() builds the active tool list based on config
+ * (test/direct allow-lists, agent names, profile selection) and refreshes
+ * the tool catalog snapshot as a side effect.
+ */
+export interface ToolDef {
+    name: string;
+    description: string;
+    inputSchema: {
+        type: "object";
+        properties: Record<string, unknown>;
+        required?: string[];
+    };
+}
+export declare function getToolDefs(): ToolDef[];