patchwarden 1.5.1 → 1.6.2

package/dist/assessments/assessmentStore.js

@@ -1,12 +1,18 @@
-import { mkdirSync, writeFileSync, existsSync, readFileSync, renameSync, } from "node:fs";
+import { mkdirSync, existsSync, readFileSync, } from "node:fs";
 import { createHash, randomBytes } from "node:crypto";
 import { resolve, join } from "node:path";
 import { getAssessmentsDir, getConfig, getRepoAllowedTestCommands } from "../config.js";
 import { guardPath } from "../security/pathGuard.js";
 import { PatchWardenError } from "../errors.js";
+import { redactSensitiveContent } from "../security/contentRedaction.js";
+import { atomicWriteJsonFileSync } from "../utils/atomicFile.js";
+import { withFileLockSync } from "../utils/lockedJsonFile.js";
 import { TOOL_SCHEMA_EPOCH } from "../version.js";
-import { getLastToolCatalogSnapshot } from "../tools/toolCatalog.js";
+import { buildToolCatalogSnapshot, resolveToolProfile, } from "../tools/catalog/toolCatalog.js";
+import { getToolDefs } from "../tools/definitions/toolDefs.js";
 import { captureRepoSnapshot } from "../runner/changeCapture.js";
+import { getProjectPolicySummary } from "../policy/projectPolicy.js";
+import { ASSESSMENT_SECURITY_SNAPSHOT_VERSION, buildAssessmentSecuritySnapshot, getAssessmentSecuritySnapshotComponentHashes, hashAssessmentSecuritySnapshot, } from "./securitySnapshot.js";
 const SENSITIVE_PATH_RULES_SIGNATURE = "v1";
 const ARTIFACT_RULES_SIGNATURE = "v1";
 export function generateAssessmentId() {
@@ -32,7 +38,7 @@ export function createAssessment(input) {
     const planHash = input.plan_content
         ? createHash("sha256").update(input.plan_content).digest("hex")
         : null;
-    const toolManifest = getLastToolCatalogSnapshot()?.tool_manifest_sha256 || computeFallbackManifestHash(config);
+    const toolManifest = getCurrentToolManifest(config);
     const workspaceFingerprint = computeWorkspaceFingerprint(input.snapshot);
     const snapshotTruncated = input.snapshot.warnings.some((w) => w.includes("snapshot limited"));
     const policyHash = computePolicyHash({
@@ -45,6 +51,21 @@ export function createAssessment(input) {
         artifact_rules: ARTIFACT_RULES_SIGNATURE,
         schema_epoch: TOOL_SCHEMA_EPOCH,
     });
+    const executionConfig = computeExecutionConfigFingerprint(config, {
+        agent: input.agent,
+        tool_manifest_sha256: toolManifest,
+        tool_profile: resolveToolProfile(config.toolProfile),
+        repo_path: input.resolved_repo_path,
+        change_policy: input.change_policy || "repo_scoped_changes",
+        template: input.template || null,
+        verify_commands: input.verify_commands || [],
+        test_command: input.test_command || null,
+        task_timeout_seconds: input.timeout_seconds,
+        scope: input.scope,
+        forbidden: input.forbidden,
+        verification: input.verification,
+        done_evidence: input.done_evidence,
+    });
     const now = new Date();
     const expiresAt = new Date(now.getTime() + config.assessmentTtlSeconds * 1000).toISOString();
     const record = {
@@ -59,6 +80,12 @@ export function createAssessment(input) {
         plan_id: input.plan_id,
         policy_hash: policyHash,
         tool_manifest_sha256: toolManifest,
+        execution_config_hash: executionConfig.hash,
+        execution_config_component_hashes: executionConfig.components,
+        assessment_security_snapshot_version: ASSESSMENT_SECURITY_SNAPSHOT_VERSION,
+        assessment_security_snapshot_sha256: executionConfig.hash,
+        assessment_security_snapshot_component_hashes: executionConfig.components,
+        assessment_schema_epoch: TOOL_SCHEMA_EPOCH,
         workspace_fingerprint: workspaceFingerprint,
         workspace_snapshot_summary: {
             head: input.snapshot.head,
@@ -71,22 +98,30 @@ export function createAssessment(input) {
         repo_path: input.repo_path,
         resolved_repo_path: input.resolved_repo_path,
         template: input.template || null,
-        goal: input.goal || null,
+        goal: input.goal ? redactSensitiveContent(input.goal).content : null,
         test_command: input.test_command || null,
         verify_commands: input.verify_commands || [],
         agent: input.agent,
         timeout_seconds: input.timeout_seconds,
         change_policy: input.change_policy || "repo_scoped_changes",
+        scope: input.scope || [],
+        forbidden: input.forbidden || [],
+        verification: input.verification || [],
+        done_evidence: input.done_evidence || [],
         requires_confirm: input.decision === "needs_confirm",
         confirmed: false,
         confirmed_at: null,
         confirm_code: null,
+        used_at: null,
         agent_assessment_summary: input.agent_assessment_summary || null,
     };
-    writeFileSync(join(dir, "assessment.json"), JSON.stringify(record, null, 2), "utf-8");
+    atomicWriteJsonFileSync(join(dir, "assessment.json"), record);
     return record;
 }
 export function readAssessment(assessmentId) {
+    if (!/^assessment_\d{8}_\d{6}_[0-9a-f]{32}$/.test(assessmentId)) {
+        throw new PatchWardenError("assessment_id_invalid", "A full assessment_id with 32 hexadecimal random characters is required.", "Copy the complete assessment_id from the assess_only response; assessment_short_id is display-only.");
+    }
     const config = getConfig();
     const assessmentsDir = getAssessmentsDir(config);
     const dir = resolve(assessmentsDir, assessmentId);
@@ -95,9 +130,36 @@ export function readAssessment(assessmentId) {
     if (!existsSync(file)) {
         throw new PatchWardenError("assessment_not_found", `Assessment "${assessmentId}" not found.`, "Call create_task with execution_mode=assess_only first to get a valid assessment_id.", true, { assessment_id: assessmentId });
     }
-    return JSON.parse(readFileSync(file, "utf-8"));
+    try {
+        const parsed = JSON.parse(readFileSync(file, "utf-8"));
+        if (!parsed || typeof parsed !== "object" || parsed.assessment_id !== assessmentId) {
+            throw new Error("record identity mismatch");
+        }
+        return parsed;
+    }
+    catch (error) {
+        throw new PatchWardenError("assessment_corrupted", `Assessment "${assessmentId}" cannot be read as a valid record.`, "Run create_task with execution_mode=assess_only again.", true, { assessment_id: assessmentId, failure_category: "invalid_assessment_record" });
+    }
+}
+/** Atomically consume an Assessment before creating its one allowed task. */
+export function markAssessmentUsed(assessmentId) {
+    const config = getConfig();
+    const assessmentFile = resolve(getAssessmentsDir(config), assessmentId, "assessment.json");
+    guardPath(assessmentFile, config.workspaceRoot, config.assessmentsDir);
+    return withFileLockSync(assessmentFile, () => {
+        const assessment = readAssessment(assessmentId);
+        if (assessment.used_at) {
+            throw new PatchWardenError("assessment_used", `Assessment "${assessmentId}" has already been used.`, "Run create_task with execution_mode=assess_only again to obtain a new assessment_id.", true, { assessment_id: assessmentId, used_at: assessment.used_at });
+        }
+        const consumed = { ...assessment, used_at: new Date().toISOString() };
+        atomicWriteJsonFileSync(assessmentFile, consumed);
+        return consumed;
+    });
 }
 export function validateAssessmentFreshness(assessmentId, currentSnapshot, options = {}) {
+    if (!/^assessment_\d{8}_\d{6}_[0-9a-f]{32}$/.test(assessmentId)) {
+        return { valid: false, failure_reason: "assessment_id_invalid", assessment: null };
+    }
     let assessment;
     try {
         assessment = readAssessment(assessmentId);
@@ -121,18 +183,70 @@ export function validateAssessmentFreshness(assessmentId, currentSnapshot, optio
             return { valid: false, failure_reason: "assessment_stale_plan", assessment };
         }
     }
+    const config = getConfig();
+    const currentManifest = getCurrentToolManifest(config);
     if (!options.skip_tool_manifest) {
-        const currentManifest = getLastToolCatalogSnapshot()?.tool_manifest_sha256 ||
-            computeFallbackManifestHash(getConfig());
-        if (currentManifest !== assessment.tool_manifest_sha256) {
-            return { valid: false, failure_reason: "assessment_stale_config", assessment };
+        // Legacy records need the standalone manifest check. Versioned security
+        // snapshots compare the manifest together with the source config, so the
+        // diagnostic can report both "tool_manifest" and e.g. "allowed_commands".
+        if (currentManifest !== assessment.tool_manifest_sha256 && !assessment.assessment_security_snapshot_sha256) {
+            return {
+                valid: false,
+                failure_reason: "assessment_stale_config",
+                assessment,
+                expected_hash: assessment.tool_manifest_sha256,
+                actual_hash: currentManifest,
+                config_change_categories: ["tool_manifest"],
+            };
         }
     }
     const currentFingerprint = computeWorkspaceFingerprint(currentSnapshot);
     if (currentFingerprint !== assessment.workspace_fingerprint) {
         return { valid: false, failure_reason: "assessment_workspace_changed", assessment };
     }
-    const config = getConfig();
+    if (assessment.execution_config_hash) {
+        const currentExecutionConfig = computeExecutionConfigFingerprint(config, {
+            agent: assessment.agent,
+            tool_manifest_sha256: currentManifest,
+            tool_profile: resolveToolProfile(config.toolProfile),
+            repo_path: assessment.resolved_repo_path,
+            change_policy: assessment.change_policy || "repo_scoped_changes",
+            template: assessment.template || null,
+            verify_commands: assessment.verify_commands || [],
+            test_command: assessment.test_command || null,
+            task_timeout_seconds: assessment.timeout_seconds,
+            scope: assessment.scope,
+            forbidden: assessment.forbidden,
+            verification: assessment.verification,
+            done_evidence: assessment.done_evidence,
+        });
+        if (assessment.assessment_security_snapshot_version
+            && assessment.assessment_security_snapshot_version !== ASSESSMENT_SECURITY_SNAPSHOT_VERSION) {
+            return {
+                valid: false,
+                failure_reason: "assessment_snapshot_version_incompatible",
+                assessment,
+                expected_hash: assessment.execution_config_hash,
+                actual_hash: currentExecutionConfig.hash,
+                config_change_categories: ["schema_epoch"],
+            };
+        }
+        if (currentExecutionConfig.hash !== assessment.execution_config_hash) {
+            const previousComponents = assessment.execution_config_component_hashes;
+            const changedCategories = previousComponents
+                ? Object.keys(currentExecutionConfig.components)
+                    .filter((category) => previousComponents[category] !== currentExecutionConfig.components[category])
+                : ["execution_config"];
+            return {
+                valid: false,
+                failure_reason: "assessment_stale_config",
+                assessment,
+                expected_hash: assessment.execution_config_hash,
+                actual_hash: currentExecutionConfig.hash,
+                config_change_categories: changedCategories.length > 0 ? changedCategories : ["execution_config"],
+            };
+        }
+    }
     const currentPolicyHash = computePolicyHash({
         change_policy: assessment.change_policy || "repo_scoped_changes",
         template: assessment.template || null,
@@ -160,6 +274,9 @@ export async function confirmAssessment(assessmentId) {
     if (!/^assessment_\d{8}_\d{6}_[0-9a-f]{32}$/.test(assessmentId)) {
         throw new PatchWardenError("assessment_id_invalid", "Local confirmation requires the full assessment_id (32 hexadecimal random characters).", "Copy the complete assessment_id from the assess_only response; assessment_short_id is display-only.");
     }
+    const config = getConfig();
+    const assessmentFile = resolve(getAssessmentsDir(config), assessmentId, "assessment.json");
+    guardPath(assessmentFile, config.workspaceRoot, config.assessmentsDir);
     const assessment = readAssessment(assessmentId);
     if (assessment.decision !== "needs_confirm" || !assessment.requires_confirm) {
         throw new PatchWardenError("assessment_confirmation_not_allowed", `Assessment "${assessmentId}" has decision "${assessment.decision}" and cannot be locally confirmed.`, assessment.decision === "blocked"
@@ -167,37 +284,39 @@ export async function confirmAssessment(assessmentId) {
             : "This assessment does not require confirmation; execute it with the minimal assessment_id call.");
     }
     const snapshot = await captureRepoSnapshot(assessment.resolved_repo_path);
-    const validation = validateAssessmentFreshness(assessmentId, snapshot, {
-        allow_unconfirmed: true,
-        // A standalone CLI has no active MCP profile snapshot. The execute path
-        // still performs the full tool-manifest check before creating the task.
-        skip_tool_manifest: true,
+    // Re-read and write while holding one cross-process lock. Concurrent local
+    // confirmers may compute snapshots in parallel, but they cannot replace one
+    // another's confirmation metadata from a stale assessment record.
+    return withFileLockSync(assessmentFile, () => {
+        const validation = validateAssessmentFreshness(assessmentId, snapshot, {
+            allow_unconfirmed: true,
+            // A standalone CLI has no active MCP profile snapshot. The execute path
+            // still performs the full tool-manifest check before creating the task.
+            skip_tool_manifest: true,
+        });
+        if (!validation.valid || !validation.assessment) {
+            throw new PatchWardenError(validation.failure_reason || "assessment_validation_failed", `Assessment "${assessmentId}" cannot be confirmed: ${validation.failure_reason || "validation_failed"}.`, "Run create_task with execution_mode=assess_only again, then confirm the new assessment locally.");
+        }
+        if (validation.assessment.decision !== "needs_confirm" || !validation.assessment.requires_confirm) {
+            throw new PatchWardenError("assessment_confirmation_not_allowed", `Assessment "${assessmentId}" is no longer eligible for local confirmation.`, "Run create_task with execution_mode=assess_only again.");
+        }
+        const confirmedAt = validation.assessment.confirmed_at || new Date().toISOString();
+        const confirmedRecord = {
+            ...validation.assessment,
+            confirmed: true,
+            confirmed_at: confirmedAt,
+            confirm_code: validation.assessment.confirm_code || randomBytes(8).toString("hex"),
+        };
+        atomicWriteJsonFileSync(assessmentFile, confirmedRecord);
+        return {
+            assessment_id: assessmentId,
+            decision: "needs_confirm",
+            confirmed: true,
+            confirmed_at: confirmedAt,
+            expires_at: confirmedRecord.expires_at,
+            next_action: "Call create_task with only execution_mode=execute and this full assessment_id.",
+        };
     });
-    if (!validation.valid || !validation.assessment) {
-        throw new PatchWardenError(validation.failure_reason || "assessment_validation_failed", `Assessment "${assessmentId}" cannot be confirmed: ${validation.failure_reason || "validation_failed"}.`, "Run create_task with execution_mode=assess_only again, then confirm the new assessment locally.");
-    }
-    const confirmedAt = validation.assessment.confirmed_at || new Date().toISOString();
-    const confirmedRecord = {
-        ...validation.assessment,
-        confirmed: true,
-        confirmed_at: confirmedAt,
-        confirm_code: validation.assessment.confirm_code || randomBytes(8).toString("hex"),
-    };
-    const config = getConfig();
-    const assessmentFile = resolve(getAssessmentsDir(config), assessmentId, "assessment.json");
-    guardPath(assessmentFile, config.workspaceRoot, config.assessmentsDir);
-    const temporaryFile = `${assessmentFile}.${process.pid}.${randomBytes(4).toString("hex")}.tmp`;
-    guardPath(temporaryFile, config.workspaceRoot, config.assessmentsDir);
-    writeFileSync(temporaryFile, JSON.stringify(confirmedRecord, null, 2), "utf-8");
-    renameSync(temporaryFile, assessmentFile);
-    return {
-        assessment_id: assessmentId,
-        decision: "needs_confirm",
-        confirmed: true,
-        confirmed_at: confirmedAt,
-        expires_at: confirmedRecord.expires_at,
-        next_action: "Call create_task with only execution_mode=execute and this full assessment_id.",
-    };
 }
 export function computeWorkspaceFingerprint(snapshot) {
     const fileHashes = Object.entries(snapshot.files)
@@ -224,10 +343,53 @@ export function computePolicyHash(input) {
 function getRepoAllowedCommands(config, repoPath) {
     return getRepoAllowedTestCommands(config, repoPath);
 }
-function computeFallbackManifestHash(config) {
-    return createHash("sha256")
-        .update(`${TOOL_SCHEMA_EPOCH}:${config.toolProfile || "full"}`)
-        .digest("hex");
+function getCurrentToolManifest(config) {
+    // The catalog cache is process-local. Rebuild the canonical catalog here so
+    // MCP and the independent Watcher derive the same manifest across processes.
+    const profile = resolveToolProfile(config.toolProfile);
+    return buildToolCatalogSnapshot(getToolDefs(), profile).tool_manifest_sha256;
+}
+export function computeExecutionConfigHash(config, input) {
+    return computeExecutionConfigFingerprint(config, input).hash;
+}
+function computeExecutionConfigFingerprint(config, input) {
+    let projectPolicy = null;
+    let projectPolicyValid = null;
+    let projectPolicyIssues = [];
+    try {
+        const summary = getProjectPolicySummary(input.repo_path);
+        projectPolicy = summary.effective_policy;
+        projectPolicyValid = summary.valid;
+        projectPolicyIssues = summary.issues.map(({ code, severity, field }) => ({ code, severity, field }));
+    }
+    catch {
+        // A workspace-root change can make the old repository inaccessible. The
+        // workspace_root component still fails closed without exposing the path.
+    }
+    const snapshot = buildAssessmentSecuritySnapshot({
+        config,
+        schemaEpoch: TOOL_SCHEMA_EPOCH,
+        toolProfile: input.tool_profile,
+        toolManifestSha256: input.tool_manifest_sha256,
+        agent: input.agent,
+        repoPath: input.repo_path,
+        changePolicy: input.change_policy,
+        template: input.template,
+        verifyCommands: input.verify_commands,
+        testCommand: input.test_command,
+        taskTimeoutSeconds: input.task_timeout_seconds,
+        scope: input.scope,
+        forbidden: input.forbidden,
+        verification: input.verification,
+        doneEvidence: input.done_evidence,
+        projectPolicy,
+        projectPolicyValid,
+        projectPolicyIssues,
+    });
+    return {
+        hash: hashAssessmentSecuritySnapshot(snapshot),
+        components: getAssessmentSecuritySnapshotComponentHashes(snapshot),
+    };
 }
 function extractReason(error) {
     if (error instanceof PatchWardenError)

package/dist/assessments/securitySnapshot.d.ts

@@ -0,0 +1,50 @@
+import type { PatchWardenConfig } from "../config.js";
+import type { ProjectPolicy } from "../policy/projectPolicy.js";
+/**
+ * Version the security snapshot independently from the server/schema version.
+ * Changing the fields or their canonicalization should invalidate old records.
+ */
+export declare const ASSESSMENT_SECURITY_SNAPSHOT_VERSION = "assessment-security-v2";
+export type SecuritySnapshotCategory = "schema_epoch" | "tool_profile" | "tool_manifest" | "workspace_root" | "repo_boundary" | "agent_launch" | "allowed_commands" | "repo_allowed_test_commands" | "direct_allowed_commands" | "repo_direct_allowed_commands" | "sensitive_path_rules" | "protected_paths" | "project_policy" | "risk_rules" | "confirmation_policy" | "task_parameters" | "release_protection" | "direct_profile" | "assessment_ttl" | "timeout_policy";
+export interface AssessmentSecuritySnapshotInput {
+    config: PatchWardenConfig;
+    schemaEpoch: string;
+    toolProfile: string;
+    toolManifestSha256: string;
+    agent: string;
+    repoPath: string;
+    changePolicy?: string | null;
+    template?: string | null;
+    verifyCommands?: string[];
+    testCommand?: string | null;
+    taskTimeoutSeconds?: number | null;
+    scope?: string[];
+    forbidden?: string[];
+    verification?: string[];
+    doneEvidence?: string[];
+    riskRulesVersion?: string;
+    projectPolicy?: ProjectPolicy | null;
+    projectPolicyValid?: boolean | null;
+    projectPolicyIssues?: Array<{
+        code: string;
+        severity: string;
+        field: string;
+    }>;
+}
+export interface AssessmentSecuritySnapshot {
+    assessment_security_snapshot_version: string;
+    components: Record<SecuritySnapshotCategory, unknown>;
+}
+export interface AssessmentSecuritySnapshotComparison {
+    equal: boolean;
+    expected_hash: string;
+    actual_hash: string;
+    changed_field_names: SecuritySnapshotCategory[];
+}
+/** Build only security-relevant configuration; runtime state is deliberately absent. */
+export declare function buildAssessmentSecuritySnapshot(input: AssessmentSecuritySnapshotInput): AssessmentSecuritySnapshot;
+/** Recursively sort object keys while preserving array order where it matters. */
+export declare function canonicalizeAssessmentSecuritySnapshot(snapshot: AssessmentSecuritySnapshot): AssessmentSecuritySnapshot;
+export declare function hashAssessmentSecuritySnapshot(snapshot: AssessmentSecuritySnapshot): string;
+export declare function getAssessmentSecuritySnapshotComponentHashes(snapshot: AssessmentSecuritySnapshot): Record<SecuritySnapshotCategory, string>;
+export declare function compareAssessmentSecuritySnapshots(expected: AssessmentSecuritySnapshot, actual: AssessmentSecuritySnapshot): AssessmentSecuritySnapshotComparison;

package/dist/assessments/securitySnapshot.js

@@ -0,0 +1,158 @@
+import { createHash } from "node:crypto";
+import { resolve, win32 } from "node:path";
+import { getRepoAllowedTestCommands, getRepoDirectAllowedCommands } from "../config.js";
+import { stableJsonStringify } from "../utils/stableJson.js";
+/**
+ * Version the security snapshot independently from the server/schema version.
+ * Changing the fields or their canonicalization should invalidate old records.
+ */
+export const ASSESSMENT_SECURITY_SNAPSHOT_VERSION = "assessment-security-v2";
+function canonicalPath(value) {
+    const rawValue = String(value);
+    if (/^[a-z]:[\\/]/i.test(rawValue)) {
+        return win32.normalize(rawValue).replace(/\\/g, "/").replace(/\/+$/, "").toLowerCase();
+    }
+    const normalized = resolve(rawValue).replace(/\\/g, "/").replace(/\/+$/, "");
+    return process.platform === "win32" ? normalized.toLowerCase() : normalized;
+}
+function sortedUnique(values) {
+    return [...new Set((values || []).map((value) => String(value).trim()))]
+        .filter(Boolean)
+        .sort((left, right) => left.localeCompare(right));
+}
+function sortedUniqueTaskPaths(values) {
+    return sortedUnique(values?.map((value) => {
+        const normalized = String(value).replace(/\\/g, "/").replace(/^\.\//, "").replace(/\/{2,}/g, "/");
+        return process.platform === "win32" ? normalized.toLowerCase() : normalized;
+    }));
+}
+function sortedAgentConfig(config) {
+    return Object.fromEntries(Object.entries(config.agents)
+        .sort(([left], [right]) => left.localeCompare(right))
+        .map(([name, agent]) => [name, {
+            command: agent.command,
+            args: [...agent.args],
+            adapter: agent.adapter || null,
+            model: agent.model || null,
+            envAllowlist: sortedUnique(agent.envAllowlist),
+        }]));
+}
+/** Build only security-relevant configuration; runtime state is deliberately absent. */
+export function buildAssessmentSecuritySnapshot(input) {
+    const { config } = input;
+    const repoPath = canonicalPath(input.repoPath);
+    const components = {
+        schema_epoch: input.schemaEpoch,
+        tool_profile: input.toolProfile,
+        tool_manifest: input.toolManifestSha256,
+        workspace_root: canonicalPath(config.workspaceRoot),
+        repo_boundary: {
+            workspace_root: canonicalPath(config.workspaceRoot),
+            repo_path: repoPath,
+            repo_aliases: Object.fromEntries(Object.entries(config.repoAliases || {})
+                .sort(([left], [right]) => left.localeCompare(right))
+                .map(([key, value]) => [key, canonicalPath(resolve(config.workspaceRoot, value))])),
+        },
+        agent_launch: {
+            selected_agent: input.agent,
+            configured_agents: sortedAgentConfig(config),
+        },
+        allowed_commands: {
+            configured: sortedUnique(config.allowedTestCommands),
+            project: sortedUnique(input.projectPolicy?.allowed_commands),
+        },
+        repo_allowed_test_commands: sortedUnique(getRepoAllowedTestCommands(config, repoPath)),
+        direct_allowed_commands: sortedUnique(config.directAllowedCommands),
+        repo_direct_allowed_commands: sortedUnique(getRepoDirectAllowedCommands(config, repoPath)),
+        sensitive_path_rules: "sensitive-path-rules-v1",
+        protected_paths: sortedUnique(input.projectPolicy?.protected_paths || [
+            ".env", ".env.*", ".ssh", ".npmrc", ".pypirc", "patchwarden.config.json",
+        ]),
+        project_policy: {
+            valid: input.projectPolicyValid ?? null,
+            effective_policy: input.projectPolicy || null,
+            issues: [...(input.projectPolicyIssues || [])]
+                .map((issue) => ({ code: issue.code, severity: issue.severity, field: issue.field }))
+                .sort((left, right) => stableJsonStringify(left).localeCompare(stableJsonStringify(right))),
+        },
+        risk_rules: {
+            implementation: input.riskRulesVersion || "risk-engine-v1",
+            project_high_risk_commands: sortedUnique(input.projectPolicy?.high_risk_commands),
+        },
+        confirmation_policy: {
+            change_policy: input.changePolicy || "repo_scoped_changes",
+            template: input.template || null,
+        },
+        task_parameters: {
+            test_command: input.testCommand || null,
+            verify_commands: sortedUnique(input.verifyCommands),
+            timeout_seconds: input.taskTimeoutSeconds ?? config.defaultTaskTimeoutSeconds,
+            scope: sortedUniqueTaskPaths(input.scope),
+            forbidden: sortedUniqueTaskPaths(input.forbidden),
+            verification: sortedUnique(input.verification),
+            done_evidence: sortedUniqueTaskPaths(input.doneEvidence),
+        },
+        release_protection: {
+            high_risk_commands: sortedUnique(input.projectPolicy?.high_risk_commands || [
+                "npm publish", "git push", "git tag", "gh release create",
+            ]),
+            release_mode: input.projectPolicy?.release_mode || {
+                version_source: "package.json",
+                required_commands: ["npm run build", "npm test"],
+            },
+            artifact_rules: "artifact-rules-v1",
+        },
+        direct_profile: Boolean(config.enableDirectProfile),
+        assessment_ttl: config.assessmentTtlSeconds,
+        timeout_policy: {
+            default_task_timeout_seconds: config.defaultTaskTimeoutSeconds,
+            max_task_timeout_seconds: config.maxTaskTimeoutSeconds,
+        },
+    };
+    return {
+        assessment_security_snapshot_version: ASSESSMENT_SECURITY_SNAPSHOT_VERSION,
+        components,
+    };
+}
+/** Recursively sort object keys while preserving array order where it matters. */
+export function canonicalizeAssessmentSecuritySnapshot(snapshot) {
+    const canonicalize = (value) => {
+        if (Array.isArray(value))
+            return value.map(canonicalize);
+        if (value !== null && typeof value === "object") {
+            return Object.fromEntries(Object.entries(value)
+                .sort(([left], [right]) => left.localeCompare(right))
+                .map(([key, entry]) => [key, canonicalize(entry)]));
+        }
+        return value;
+    };
+    return canonicalize(snapshot);
+}
+export function hashAssessmentSecuritySnapshot(snapshot) {
+    return createHash("sha256")
+        .update(stableJsonStringify(canonicalizeAssessmentSecuritySnapshot(snapshot)))
+        .digest("hex");
+}
+export function getAssessmentSecuritySnapshotComponentHashes(snapshot) {
+    return Object.fromEntries(Object.entries(snapshot.components).map(([name, value]) => [
+        name,
+        createHash("sha256").update(stableJsonStringify(value)).digest("hex"),
+    ]));
+}
+export function compareAssessmentSecuritySnapshots(expected, actual) {
+    const expectedHash = hashAssessmentSecuritySnapshot(expected);
+    const actualHash = hashAssessmentSecuritySnapshot(actual);
+    const expectedComponents = getAssessmentSecuritySnapshotComponentHashes(expected);
+    const actualComponents = getAssessmentSecuritySnapshotComponentHashes(actual);
+    const changed = Object.keys(actualComponents)
+        .filter((name) => expectedComponents[name] !== actualComponents[name]);
+    if (expected.assessment_security_snapshot_version !== actual.assessment_security_snapshot_version) {
+        changed.unshift("schema_epoch");
+    }
+    return {
+        equal: expectedHash === actualHash,
+        expected_hash: expectedHash,
+        actual_hash: actualHash,
+        changed_field_names: [...new Set(changed)],
+    };
+}

package/dist/config.d.ts

@@ -1,6 +1,9 @@
 export interface AgentConfig {
     command: string;
     args: string[];
+    envAllowlist?: string[];
+    adapter?: string;
+    model?: string;
 }
 export interface PatchWardenConfig {
     workspaceRoot: string;
@@ -29,6 +32,18 @@ export interface PatchWardenConfig {
     agentAssessmentMaxOutputBytes?: number;
     agentAssessmentAgentName?: string;
     enableDirectProfile?: boolean;
+    tunnelClientPath?: string;
+    tunnelProxy?: {
+        scope: "shared" | "separate";
+        core: {
+            mode: "environment" | "none" | "manual";
+            url?: string;
+        };
+        direct: {
+            mode: "environment" | "none" | "manual";
+            url?: string;
+        };
+    };
     directSessionsDir: string;
     directSessionTtlSeconds: number;
     directMaxPatchBytes: number;