patchwarden 1.5.1 → 1.6.2

package/src/assessments/securitySnapshot.ts

@@ -0,0 +1,231 @@
+import { createHash } from "node:crypto";
+import { resolve, win32 } from "node:path";
+import type { PatchWardenConfig } from "../config.js";
+import { getRepoAllowedTestCommands, getRepoDirectAllowedCommands } from "../config.js";
+import { stableJsonStringify } from "../utils/stableJson.js";
+import type { ProjectPolicy } from "../policy/projectPolicy.js";
+
+/**
+ * Version the security snapshot independently from the server/schema version.
+ * Changing the fields or their canonicalization should invalidate old records.
+ */
+export const ASSESSMENT_SECURITY_SNAPSHOT_VERSION = "assessment-security-v2";
+
+export type SecuritySnapshotCategory =
+  | "schema_epoch"
+  | "tool_profile"
+  | "tool_manifest"
+  | "workspace_root"
+  | "repo_boundary"
+  | "agent_launch"
+  | "allowed_commands"
+  | "repo_allowed_test_commands"
+  | "direct_allowed_commands"
+  | "repo_direct_allowed_commands"
+  | "sensitive_path_rules"
+  | "protected_paths"
+  | "project_policy"
+  | "risk_rules"
+  | "confirmation_policy"
+  | "task_parameters"
+  | "release_protection"
+  | "direct_profile"
+  | "assessment_ttl"
+  | "timeout_policy";
+
+export interface AssessmentSecuritySnapshotInput {
+  config: PatchWardenConfig;
+  schemaEpoch: string;
+  toolProfile: string;
+  toolManifestSha256: string;
+  agent: string;
+  repoPath: string;
+  changePolicy?: string | null;
+  template?: string | null;
+  verifyCommands?: string[];
+  testCommand?: string | null;
+  taskTimeoutSeconds?: number | null;
+  scope?: string[];
+  forbidden?: string[];
+  verification?: string[];
+  doneEvidence?: string[];
+  riskRulesVersion?: string;
+  projectPolicy?: ProjectPolicy | null;
+  projectPolicyValid?: boolean | null;
+  projectPolicyIssues?: Array<{ code: string; severity: string; field: string }>;
+}
+
+export interface AssessmentSecuritySnapshot {
+  assessment_security_snapshot_version: string;
+  components: Record<SecuritySnapshotCategory, unknown>;
+}
+
+export interface AssessmentSecuritySnapshotComparison {
+  equal: boolean;
+  expected_hash: string;
+  actual_hash: string;
+  changed_field_names: SecuritySnapshotCategory[];
+}
+
+function canonicalPath(value: string): string {
+  const rawValue = String(value);
+  if (/^[a-z]:[\\/]/i.test(rawValue)) {
+    return win32.normalize(rawValue).replace(/\\/g, "/").replace(/\/+$/, "").toLowerCase();
+  }
+  const normalized = resolve(rawValue).replace(/\\/g, "/").replace(/\/+$/, "");
+  return process.platform === "win32" ? normalized.toLowerCase() : normalized;
+}
+
+function sortedUnique(values: readonly string[] | undefined): string[] {
+  return [...new Set((values || []).map((value) => String(value).trim()))]
+    .filter(Boolean)
+    .sort((left, right) => left.localeCompare(right));
+}
+
+function sortedUniqueTaskPaths(values: readonly string[] | undefined): string[] {
+  return sortedUnique(values?.map((value) => {
+    const normalized = String(value).replace(/\\/g, "/").replace(/^\.\//, "").replace(/\/{2,}/g, "/");
+    return process.platform === "win32" ? normalized.toLowerCase() : normalized;
+  }));
+}
+
+function sortedAgentConfig(config: PatchWardenConfig): Record<string, unknown> {
+  return Object.fromEntries(Object.entries(config.agents)
+    .sort(([left], [right]) => left.localeCompare(right))
+    .map(([name, agent]) => [name, {
+      command: agent.command,
+      args: [...agent.args],
+      adapter: agent.adapter || null,
+      model: agent.model || null,
+      envAllowlist: sortedUnique(agent.envAllowlist),
+    }]));
+}
+
+/** Build only security-relevant configuration; runtime state is deliberately absent. */
+export function buildAssessmentSecuritySnapshot(input: AssessmentSecuritySnapshotInput): AssessmentSecuritySnapshot {
+  const { config } = input;
+  const repoPath = canonicalPath(input.repoPath);
+  const components: Record<SecuritySnapshotCategory, unknown> = {
+    schema_epoch: input.schemaEpoch,
+    tool_profile: input.toolProfile,
+    tool_manifest: input.toolManifestSha256,
+    workspace_root: canonicalPath(config.workspaceRoot),
+    repo_boundary: {
+      workspace_root: canonicalPath(config.workspaceRoot),
+      repo_path: repoPath,
+      repo_aliases: Object.fromEntries(Object.entries(config.repoAliases || {})
+        .sort(([left], [right]) => left.localeCompare(right))
+        .map(([key, value]) => [key, canonicalPath(resolve(config.workspaceRoot, value))])),
+    },
+    agent_launch: {
+      selected_agent: input.agent,
+      configured_agents: sortedAgentConfig(config),
+    },
+    allowed_commands: {
+      configured: sortedUnique(config.allowedTestCommands),
+      project: sortedUnique(input.projectPolicy?.allowed_commands),
+    },
+    repo_allowed_test_commands: sortedUnique(getRepoAllowedTestCommands(config, repoPath)),
+    direct_allowed_commands: sortedUnique(config.directAllowedCommands),
+    repo_direct_allowed_commands: sortedUnique(getRepoDirectAllowedCommands(config, repoPath)),
+    sensitive_path_rules: "sensitive-path-rules-v1",
+    protected_paths: sortedUnique(input.projectPolicy?.protected_paths || [
+      ".env", ".env.*", ".ssh", ".npmrc", ".pypirc", "patchwarden.config.json",
+    ]),
+    project_policy: {
+      valid: input.projectPolicyValid ?? null,
+      effective_policy: input.projectPolicy || null,
+      issues: [...(input.projectPolicyIssues || [])]
+        .map((issue) => ({ code: issue.code, severity: issue.severity, field: issue.field }))
+        .sort((left, right) => stableJsonStringify(left).localeCompare(stableJsonStringify(right))),
+    },
+    risk_rules: {
+      implementation: input.riskRulesVersion || "risk-engine-v1",
+      project_high_risk_commands: sortedUnique(input.projectPolicy?.high_risk_commands),
+    },
+    confirmation_policy: {
+      change_policy: input.changePolicy || "repo_scoped_changes",
+      template: input.template || null,
+    },
+    task_parameters: {
+      test_command: input.testCommand || null,
+      verify_commands: sortedUnique(input.verifyCommands),
+      timeout_seconds: input.taskTimeoutSeconds ?? config.defaultTaskTimeoutSeconds,
+      scope: sortedUniqueTaskPaths(input.scope),
+      forbidden: sortedUniqueTaskPaths(input.forbidden),
+      verification: sortedUnique(input.verification),
+      done_evidence: sortedUniqueTaskPaths(input.doneEvidence),
+    },
+    release_protection: {
+      high_risk_commands: sortedUnique(input.projectPolicy?.high_risk_commands || [
+        "npm publish", "git push", "git tag", "gh release create",
+      ]),
+      release_mode: input.projectPolicy?.release_mode || {
+        version_source: "package.json",
+        required_commands: ["npm run build", "npm test"],
+      },
+      artifact_rules: "artifact-rules-v1",
+    },
+    direct_profile: Boolean(config.enableDirectProfile),
+    assessment_ttl: config.assessmentTtlSeconds,
+    timeout_policy: {
+      default_task_timeout_seconds: config.defaultTaskTimeoutSeconds,
+      max_task_timeout_seconds: config.maxTaskTimeoutSeconds,
+    },
+  };
+
+  return {
+    assessment_security_snapshot_version: ASSESSMENT_SECURITY_SNAPSHOT_VERSION,
+    components,
+  };
+}
+
+/** Recursively sort object keys while preserving array order where it matters. */
+export function canonicalizeAssessmentSecuritySnapshot(snapshot: AssessmentSecuritySnapshot): AssessmentSecuritySnapshot {
+  const canonicalize = (value: unknown): unknown => {
+    if (Array.isArray(value)) return value.map(canonicalize);
+    if (value !== null && typeof value === "object") {
+      return Object.fromEntries(Object.entries(value as Record<string, unknown>)
+        .sort(([left], [right]) => left.localeCompare(right))
+        .map(([key, entry]) => [key, canonicalize(entry)]));
+    }
+    return value;
+  };
+  return canonicalize(snapshot) as AssessmentSecuritySnapshot;
+}
+
+export function hashAssessmentSecuritySnapshot(snapshot: AssessmentSecuritySnapshot): string {
+  return createHash("sha256")
+    .update(stableJsonStringify(canonicalizeAssessmentSecuritySnapshot(snapshot)))
+    .digest("hex");
+}
+
+export function getAssessmentSecuritySnapshotComponentHashes(
+  snapshot: AssessmentSecuritySnapshot,
+): Record<SecuritySnapshotCategory, string> {
+  return Object.fromEntries(Object.entries(snapshot.components).map(([name, value]) => [
+    name,
+    createHash("sha256").update(stableJsonStringify(value)).digest("hex"),
+  ])) as Record<SecuritySnapshotCategory, string>;
+}
+
+export function compareAssessmentSecuritySnapshots(
+  expected: AssessmentSecuritySnapshot,
+  actual: AssessmentSecuritySnapshot,
+): AssessmentSecuritySnapshotComparison {
+  const expectedHash = hashAssessmentSecuritySnapshot(expected);
+  const actualHash = hashAssessmentSecuritySnapshot(actual);
+  const expectedComponents = getAssessmentSecuritySnapshotComponentHashes(expected);
+  const actualComponents = getAssessmentSecuritySnapshotComponentHashes(actual);
+  const changed = (Object.keys(actualComponents) as SecuritySnapshotCategory[])
+    .filter((name) => expectedComponents[name] !== actualComponents[name]);
+  if (expected.assessment_security_snapshot_version !== actual.assessment_security_snapshot_version) {
+    changed.unshift("schema_epoch");
+  }
+  return {
+    equal: expectedHash === actualHash,
+    expected_hash: expectedHash,
+    actual_hash: actualHash,
+    changed_field_names: [...new Set(changed)],
+  };
+}

package/src/config.ts

@@ -1,11 +1,15 @@
 import { readFileSync, existsSync } from "node:fs";
-import { isAbsolute, relative, resolve, sep } from "node:path";
+import { basename, isAbsolute, relative, resolve, sep } from "node:path";
+import { validateWorkspaceRoot } from "./security/workspaceRootGuard.js";
 
 // ── Type definitions ──────────────────────────────────────────────
 
 export interface AgentConfig {
   command: string;
   args: string[];
+  envAllowlist?: string[];
+  adapter?: string;
+  model?: string;
 }
 
 export interface PatchWardenConfig {
@@ -31,6 +35,12 @@ export interface PatchWardenConfig {
   agentAssessmentMaxOutputBytes?: number;
   agentAssessmentAgentName?: string;
   enableDirectProfile?: boolean;
+  tunnelClientPath?: string;
+  tunnelProxy?: {
+    scope: "shared" | "separate";
+    core: { mode: "environment" | "none" | "manual"; url?: string };
+    direct: { mode: "environment" | "none" | "manual"; url?: string };
+  };
   directSessionsDir: string;
   directSessionTtlSeconds: number;
   directMaxPatchBytes: number;
@@ -47,16 +57,7 @@ const DEFAULT_CONFIG: PatchWardenConfig = {
   tasksDir: ".patchwarden/tasks",
   assessmentsDir: ".patchwarden/assessments",
   assessmentTtlSeconds: 3600,
-  agents: {
-    codex: {
-      command: "codex",
-      args: ["exec", "--cd", "{repo}", "{prompt}"],
-    },
-    opencode: {
-      command: "opencode",
-      args: ["run", "{prompt}"],
-    },
-  },
+  agents: {},
   allowedTestCommands: [
     "npm test",
     "npm run test",
@@ -175,6 +176,11 @@ function normalizeConfig(config: PatchWardenConfig): PatchWardenConfig {
   if (!config.workspaceRoot || typeof config.workspaceRoot !== "string") {
     throw new Error("workspaceRoot must be a non-empty string");
   }
+  const workspaceValidation = validateWorkspaceRoot(config.workspaceRoot);
+  if (!workspaceValidation.ok) {
+    throw new Error(`Invalid workspaceRoot: ${workspaceValidation.reason} (${workspaceValidation.path})`);
+  }
+  config.workspaceRoot = workspaceValidation.path;
   if (!config.plansDir || typeof config.plansDir !== "string") {
     throw new Error("plansDir must be a non-empty string");
   }
@@ -190,6 +196,20 @@ function normalizeConfig(config: PatchWardenConfig): PatchWardenConfig {
   if (!config.agents || typeof config.agents !== "object") {
     throw new Error("agents must be an object");
   }
+  const agents: Record<string, AgentConfig> = {};
+  for (const [agentName, agent] of Object.entries(config.agents)) {
+    if (!agent || typeof agent !== "object" || typeof agent.command !== "string" || !Array.isArray(agent.args)) {
+      throw new Error(`agents["${agentName}"] must define command and args`);
+    }
+    const envAllowlist = agent.envAllowlist ?? [];
+    if (!Array.isArray(envAllowlist) || envAllowlist.some((name) => typeof name !== "string" || !/^[A-Za-z_][A-Za-z0-9_]*$/.test(name))) {
+      throw new Error(`agents["${agentName}"].envAllowlist must contain only environment variable names`);
+    }
+    const blockedNames = new Set(["CONTROL_PLANE_API_KEY", "PATCHWARDEN_OWNER_TOKEN", config.http?.ownerTokenEnv?.toUpperCase()]);
+    const blocked = envAllowlist.find((name) => blockedNames.has(name.toUpperCase()));
+    if (blocked) throw new Error(`agents["${agentName}"].envAllowlist cannot include reserved variable "${blocked}"`);
+    agents[agentName] = { ...agent, args: [...agent.args], envAllowlist: [...new Set(envAllowlist)] };
+  }
   if (!Array.isArray(config.allowedTestCommands)) {
     throw new Error("allowedTestCommands must be an array");
   }
@@ -263,8 +283,14 @@ function normalizeConfig(config: PatchWardenConfig): PatchWardenConfig {
     if (config.http.host !== undefined && typeof config.http.host !== "string") {
       throw new Error("http.host must be a string");
     }
-    if (config.http.ownerTokenEnv !== undefined && typeof config.http.ownerTokenEnv !== "string") {
-      throw new Error("http.ownerTokenEnv must be a string");
+    if (
+      config.http.ownerTokenEnv !== undefined
+      && (
+        typeof config.http.ownerTokenEnv !== "string"
+        || !/^[A-Za-z_][A-Za-z0-9_]*$/.test(config.http.ownerTokenEnv)
+      )
+    ) {
+      throw new Error("http.ownerTokenEnv must be a valid environment variable name");
     }
   }
   if (config.enableRunTaskTool !== undefined && typeof config.enableRunTaskTool !== "boolean") {
@@ -289,6 +315,36 @@ function normalizeConfig(config: PatchWardenConfig): PatchWardenConfig {
   if (config.enableDirectProfile !== undefined && typeof config.enableDirectProfile !== "boolean") {
     throw new Error("enableDirectProfile must be a boolean");
   }
+  if (config.tunnelClientPath !== undefined) {
+    if (typeof config.tunnelClientPath !== "string" || !isAbsolute(config.tunnelClientPath)) {
+      throw new Error("tunnelClientPath must be an absolute path");
+    }
+    if (basename(config.tunnelClientPath).toLowerCase() !== "tunnel-client.exe") {
+      throw new Error("tunnelClientPath must point to tunnel-client.exe");
+    }
+  }
+  if (config.tunnelProxy !== undefined) {
+    if (!config.tunnelProxy || typeof config.tunnelProxy !== "object" || !["shared", "separate"].includes(config.tunnelProxy.scope)) {
+      throw new Error("tunnelProxy.scope must be shared or separate");
+    }
+    for (const key of ["core", "direct"] as const) {
+      const endpoint = config.tunnelProxy[key];
+      if (!endpoint || typeof endpoint !== "object" || !["environment", "none", "manual"].includes(endpoint.mode)) {
+        throw new Error(`tunnelProxy.${key}.mode must be environment, none, or manual`);
+      }
+      if (endpoint.mode === "manual") {
+        if (typeof endpoint.url !== "string") throw new Error(`tunnelProxy.${key}.url is required in manual mode`);
+        let parsed: URL;
+        try { parsed = new URL(endpoint.url); } catch { throw new Error(`tunnelProxy.${key}.url must be a valid URL`); }
+        if (!["http:", "https:", "socks5:"].includes(parsed.protocol)) {
+          throw new Error(`tunnelProxy.${key}.url must use http, https, or socks5`);
+        }
+        if (parsed.username || parsed.password) throw new Error(`tunnelProxy.${key}.url must not contain credentials`);
+      } else if (endpoint.url !== undefined) {
+        throw new Error(`tunnelProxy.${key}.url is only allowed in manual mode`);
+      }
+    }
+  }
   if (!config.directSessionsDir || typeof config.directSessionsDir !== "string") {
     throw new Error("directSessionsDir must be a non-empty string");
   }
@@ -331,6 +387,7 @@ function normalizeConfig(config: PatchWardenConfig): PatchWardenConfig {
 
   return {
     ...config,
+    agents,
     workspaceRoot: resolve(config.workspaceRoot),
     allowedTestCommands: [...new Set(config.allowedTestCommands.map((command) => command.trim()))],
     repoAllowedTestCommands,

package/src/control/fileManager.ts

@@ -0,0 +1,40 @@
+import { spawn } from "node:child_process";
+import { join } from "node:path";
+import { buildChildEnvironment, resolveTrustedExecutable } from "../runner/processSecurity.js";
+
+const FILE_MANAGER_ENVIRONMENT = [
+  "DISPLAY",
+  "WAYLAND_DISPLAY",
+  "DBUS_SESSION_BUS_ADDRESS",
+  "XDG_RUNTIME_DIR",
+] as const;
+
+/** Launch a trusted platform file manager without inheriting ambient secrets. */
+export function launchFileManager(target: string, cwd: string): boolean {
+  try {
+    const env = buildChildEnvironment({ cwd, allowedNames: FILE_MANAGER_ENVIRONMENT });
+    const requested = fileManagerCommand(env);
+    const command = resolveTrustedExecutable(requested, cwd, { pathValue: env.PATH });
+    const child = spawn(command, [target], {
+      cwd,
+      detached: true,
+      env,
+      stdio: "ignore",
+      windowsHide: true,
+    });
+    child.on("error", () => { /* opening a convenience viewer is best effort */ });
+    child.unref();
+    return true;
+  } catch {
+    return false;
+  }
+}
+
+function fileManagerCommand(env: NodeJS.ProcessEnv): string {
+  if (process.platform === "win32") {
+    const windowsRoot = env.SystemRoot || env.WINDIR;
+    return windowsRoot ? join(windowsRoot, "explorer.exe") : "explorer.exe";
+  }
+  if (process.platform === "darwin") return "open";
+  return "xdg-open";
+}

package/src/control/middleware/auth.ts

@@ -7,11 +7,29 @@
  * action must pass through `checkControlToken` first.
  */
 import { type IncomingMessage } from "node:http";
+import { firstHeaderValue, timingSafeStringEqual } from "../../security/secretComparison.js";
+import { isTrustedLoopbackHostHeader } from "../../security/loopbackHost.js";
 import { controlToken } from "../shared.js";
 
 export function checkControlToken(req: IncomingMessage): boolean {
-  const header = req.headers["x-patchwarden-control-token"];
-  const provided = Array.isArray(header) ? header[0] : header;
-  if (typeof provided !== "string" || provided.length === 0) return false;
-  return provided === controlToken;
+  const provided = firstHeaderValue(req.headers["x-patchwarden-control-token"]);
+  return provided.length > 0 && timingSafeStringEqual(provided, controlToken);
+}
+
+/**
+ * Reject non-loopback Host headers before exposing the browser-readable
+ * control token. Binding to 127.0.0.1 alone does not prevent DNS rebinding.
+ */
+export function isTrustedControlHost(
+  req: IncomingMessage,
+  expectedPort: number,
+): boolean {
+  return isTrustedControlHostHeader(req.headers.host, expectedPort);
+}
+
+export function isTrustedControlHostHeader(
+  value: string | string[] | undefined,
+  expectedPort: number,
+): boolean {
+  return isTrustedLoopbackHostHeader(value, expectedPort);
 }

package/src/control/middleware/static.ts

@@ -5,7 +5,7 @@
  * assets, css) with path-traversal protection, plus the inline SVG favicon.
  * Content types are mapped from `CONTENT_TYPES` in shared.ts.
  */
-import { existsSync, readFileSync, statSync } from "node:fs";
+import { existsSync, readFileSync, realpathSync, statSync } from "node:fs";
 import { extname, isAbsolute, relative, resolve } from "node:path";
 import { type ServerResponse } from "node:http";
 import {
@@ -51,9 +51,22 @@ export function serveStatic(res: ServerResponse, urlPath: string): void {
       sendJson(res, 404, { error: "Not found" });
       return;
     }
-    const ext = extname(candidate).toLowerCase();
+    // Resolve links before reading. Lexical `..` checks alone do not stop a
+    // symlink or junction inside `ui/` from pointing outside the bundle.
+    const realRoot = realpathSync(uiRoot);
+    const realCandidate = realpathSync(candidate);
+    const realRelative = relative(realRoot, realCandidate);
+    if (realRelative === "" || realRelative.startsWith("..") || isAbsolute(realRelative)) {
+      sendJson(res, 403, { error: "Forbidden" });
+      return;
+    }
+    if (!statSync(realCandidate).isFile()) {
+      sendJson(res, 404, { error: "Not found" });
+      return;
+    }
+    const ext = extname(realCandidate).toLowerCase();
     const contentType = CONTENT_TYPES[ext] || "application/octet-stream";
-    const content = readFileSync(candidate);
+    const content = readFileSync(realCandidate);
     res.writeHead(200, { "Content-Type": contentType });
     res.end(content);
   } catch (err) {