patchwarden 1.5.1 → 1.6.2

package/src/control/server.ts

@@ -20,31 +20,32 @@ import {
   PAGE_ALIASES,
   port,
   readBody,
-  resolveTailParam,
   sendJson,
 } from "./shared.js";
 import { recordEvent, removeStatusFile, writeStatusFile } from "./runtime.js";
-import { checkControlToken } from "./middleware/auth.js";
+import { checkControlToken, isTrustedControlHost } from "./middleware/auth.js";
 import { serveFavicon, serveStatic } from "./middleware/static.js";
-import { handleTasks, handleStaleTasks, handleTaskDetail, handleTaskSafeResult, handleTaskSafeAudit, handleTaskSafeTestSummary, handleTaskSafeDiffSummary } from "./routes/tasks.js";
-import { handleReconcile, handleTaskAudit, handleOpenTaskFolder, handleHideStale } from "./routes/taskActions.js";
-import { handleDirectSessions, handleDirectSessionDetail, handleDirectSessionSafeSummary, handleDirectSessionFinalize, handleDirectSessionAudit, handleDirectSessionHide } from "./routes/sessions.js";
-import { handleLineages, handleLineageDetail } from "./routes/lineage.js";
-import { handleEvidencePacks, handleEvidencePackDetail, handleEvidencePackExport } from "./routes/evidence.js";
-import { handleProjectPolicy, handleReleaseStatus } from "./routes/policy.js";
-import { handleWorkspace, handleWorkspaceRepos, handleWorkspaceRepoStatus } from "./routes/workspace.js";
-import { handleManageAction, handleOpenLogsFolder } from "./routes/process.js";
-import { handleStatus, handleControlCenterStatus, handleEvents, handleTunnelUiUrl, handleDiagnostics } from "./routes/status.js";
-import { handleLogs, handleAudit, handleWarnings, type LogCategory } from "./routes/audit.js";
+import { buildRoutes } from "./routeTable.js";
 
 // ── Request router ────────────────────────────────────────────────
 
 async function handleRequest(req: IncomingMessage, res: ServerResponse): Promise<void> {
-  const parsedUrl = new URL(req.url || "/", `http://${req.headers.host || host}`);
+  res.setHeader("Content-Security-Policy", "frame-ancestors 'none'");
+  res.setHeader("Cross-Origin-Resource-Policy", "same-origin");
+  res.setHeader("Referrer-Policy", "no-referrer");
+  res.setHeader("X-Content-Type-Options", "nosniff");
+  res.setHeader("X-Frame-Options", "DENY");
+
+  if (!isTrustedControlHost(req, port)) {
+    sendJson(res, 421, { error: "Untrusted Host header" });
+    return;
+  }
+
+  const parsedUrl = new URL(req.url || "/", `http://${host}:${port}`);
   const pathname = parsedUrl.pathname;
   const method = (req.method || "GET").toUpperCase();
 
-  // Static routes
+  // ── Static resource priority branches (not in routeTable.ts) ──
   if (method === "GET" && pathname === "/") {
     serveStatic(res, "pages/dashboard.html");
     return;
@@ -65,6 +66,12 @@ async function handleRequest(req: IncomingMessage, res: ServerResponse): Promise
   if (
     method === "GET" &&
     (pathname === "/colors_and_type.css" ||
+      pathname === "/desktop.css" ||
+      pathname === "/desktop-bridge.js" ||
+      pathname === "/log-parser.js" ||
+      pathname === "/i18n.js" ||
+      pathname === "/getting-started.js" ||
+      pathname === "/settings.js" ||
       pathname.startsWith("/pages/") ||
       pathname.startsWith("/partials/") ||
       pathname.startsWith("/vendor/"))
@@ -73,339 +80,27 @@ async function handleRequest(req: IncomingMessage, res: ServerResponse): Promise
     return;
   }
 
-  // GET API routes
-  if (method === "GET" && pathname === "/api/status") {
-    await handleStatus(res);
-    return;
-  }
-  if (method === "GET" && pathname === "/api/tasks") {
-    handleTasks(res, {
-      repo_path: parsedUrl.searchParams.get("repo_path") || undefined,
-      status: parsedUrl.searchParams.get("status") || undefined,
-      acceptance_status: parsedUrl.searchParams.get("acceptance_status") || undefined,
-      agent: parsedUrl.searchParams.get("agent") || undefined,
-      warning_type: parsedUrl.searchParams.get("warning_type") || undefined,
-    });
-    return;
-  }
-  if (method === "GET" && pathname === "/api/tasks/stale") {
-    handleStaleTasks(res);
-    return;
-  }
-  if (method === "GET" && pathname === "/api/lineages") {
-    handleLineages(res);
-    return;
-  }
-  const lineageMatch = pathname.match(/^\/api\/lineages\/([^/]+)$/);
-  if (method === "GET" && lineageMatch) {
-    let lineageId: string;
-    try {
-      lineageId = decodeURIComponent(lineageMatch[1]);
-    } catch {
-      lineageId = lineageMatch[1];
-    }
-    handleLineageDetail(res, lineageId);
-    return;
-  }
-  if (method === "GET" && pathname === "/api/project-policy") {
-    handleProjectPolicy(res, parsedUrl.searchParams.get("repo_path") || ".");
-    return;
-  }
-  if (method === "GET" && pathname === "/api/release/status") {
-    handleReleaseStatus(res, parsedUrl.searchParams.get("repo_path") || ".");
-    return;
-  }
-  if (method === "GET" && pathname === "/api/evidence-packs") {
-    handleEvidencePacks(res);
-    return;
-  }
-  const evidencePackMatch = pathname.match(/^\/api\/evidence-packs\/([^/]+)$/);
-  if (method === "GET" && evidencePackMatch) {
-    let lineageId: string;
-    try {
-      lineageId = decodeURIComponent(evidencePackMatch[1]);
-    } catch {
-      lineageId = evidencePackMatch[1];
-    }
-    handleEvidencePackDetail(res, lineageId);
-    return;
-  }
-  const taskMatch = pathname.match(/^\/api\/tasks\/([^/]+)$/);
-  if (method === "GET" && taskMatch) {
-    let taskId: string;
-    try {
-      taskId = decodeURIComponent(taskMatch[1]);
-    } catch {
-      taskId = taskMatch[1];
-    }
-    if (
-      taskId === "." ||
-      taskId === ".." ||
-      taskId.includes("/") ||
-      taskId.includes("\\") ||
-      taskId.includes("\0")
-    ) {
-      sendJson(res, 400, { error: "Invalid task id" });
-      return;
-    }
-    handleTaskDetail(res, taskId);
-    return;
-  }
-  // Safe, bounded views for task artifacts (no full stdout/stderr/diff).
-  const taskSafeResultMatch = pathname.match(/^\/api\/tasks\/([^/]+)\/safe-result$/);
-  if (method === "GET" && taskSafeResultMatch) {
-    let taskId: string;
-    try {
-      taskId = decodeURIComponent(taskSafeResultMatch[1]);
-    } catch {
-      taskId = taskSafeResultMatch[1];
-    }
-    handleTaskSafeResult(res, taskId);
-    return;
-  }
-  const taskSafeAuditMatch = pathname.match(/^\/api\/tasks\/([^/]+)\/safe-audit$/);
-  if (method === "GET" && taskSafeAuditMatch) {
-    let taskId: string;
-    try {
-      taskId = decodeURIComponent(taskSafeAuditMatch[1]);
-    } catch {
-      taskId = taskSafeAuditMatch[1];
-    }
-    handleTaskSafeAudit(res, taskId);
-    return;
-  }
-  const taskSafeTestSummaryMatch = pathname.match(/^\/api\/tasks\/([^/]+)\/safe-test-summary$/);
-  if (method === "GET" && taskSafeTestSummaryMatch) {
-    let taskId: string;
-    try {
-      taskId = decodeURIComponent(taskSafeTestSummaryMatch[1]);
-    } catch {
-      taskId = taskSafeTestSummaryMatch[1];
-    }
-    handleTaskSafeTestSummary(res, taskId);
-    return;
-  }
-  const taskSafeDiffSummaryMatch = pathname.match(/^\/api\/tasks\/([^/]+)\/safe-diff-summary$/);
-  if (method === "GET" && taskSafeDiffSummaryMatch) {
-    let taskId: string;
-    try {
-      taskId = decodeURIComponent(taskSafeDiffSummaryMatch[1]);
-    } catch {
-      taskId = taskSafeDiffSummaryMatch[1];
-    }
-    handleTaskSafeDiffSummary(res, taskId);
-    return;
-  }
-  // Logs: /api/logs/<category>?tail=<100|300|1000>
-  const logsMatch = pathname.match(/^\/api\/logs\/([a-z-]+)$/);
-  if (method === "GET" && logsMatch) {
-    const rawCat = logsMatch[1];
-    const category = rawCat === "core" || rawCat === "direct" || rawCat === "watcher" || rawCat === "control-center"
-      ? (rawCat as LogCategory)
-      : null;
-    if (!category) {
-      sendJson(res, 404, { error: "Unknown log category" });
-      return;
-    }
-    const tail = resolveTailParam(parsedUrl.searchParams.get("tail"));
-    handleLogs(res, category, tail);
-    return;
-  }
-  if (method === "GET" && pathname === "/api/workspace") {
-    handleWorkspace(res);
-    return;
-  }
-  if (method === "GET" && pathname === "/api/workspace/repos") {
-    handleWorkspaceRepos(res);
-    return;
-  }
-  // On-demand git status for a single repo (path-traversal safe).
-  // The repo segment is URL-decoded; traversal is rejected by guardWorkspacePath.
-  const workspaceRepoMatch = pathname.match(/^\/api\/workspace\/([^/]+(?:\/[^/]+)*)\/status$/);
-  if (method === "GET" && workspaceRepoMatch) {
-    let repoParam: string;
-    try {
-      repoParam = decodeURIComponent(workspaceRepoMatch[1]);
-    } catch {
-      sendJson(res, 400, { error: "Invalid repo path encoding" });
-      return;
-    }
-    handleWorkspaceRepoStatus(res, repoParam);
-    return;
-  }
-  if (method === "GET" && pathname === "/api/direct-sessions") {
-    handleDirectSessions(res);
-    return;
-  }
-  const directSessionSummaryMatch = pathname.match(/^\/api\/direct-sessions\/([^/]+)\/summary$/);
-  if (method === "GET" && directSessionSummaryMatch) {
-    let sessionId: string;
-    try {
-      sessionId = decodeURIComponent(directSessionSummaryMatch[1]);
-    } catch {
-      sessionId = directSessionSummaryMatch[1];
-    }
-    handleDirectSessionSafeSummary(res, sessionId);
-    return;
-  }
-  const directSessionMatch = pathname.match(/^\/api\/direct-sessions\/([^/]+)$/);
-  if (method === "GET" && directSessionMatch) {
-    let sessionId: string;
-    try {
-      sessionId = decodeURIComponent(directSessionMatch[1]);
-    } catch {
-      sessionId = directSessionMatch[1];
-    }
-    handleDirectSessionDetail(res, sessionId);
-    return;
-  }
-  if (method === "GET" && pathname === "/api/audit") {
-    handleAudit(res);
-    return;
-  }
-  if (method === "GET" && pathname === "/api/warnings") {
-    handleWarnings(res);
-    return;
-  }
-  if (method === "GET" && pathname === "/api/diagnostics") {
-    handleDiagnostics(res);
-    return;
-  }
-  if (method === "GET" && pathname === "/api/tunnel-ui-url") {
-    handleTunnelUiUrl(res);
-    return;
-  }
-  if (method === "GET" && pathname === "/api/events") {
-    const limitParam = parsedUrl.searchParams.get("limit");
-    let limit = 100;
-    if (limitParam !== null) {
-      const n = parseInt(limitParam, 10);
-      if (Number.isFinite(n) && n > 0 && n <= 1000) limit = n;
-    }
-    handleEvents(res, limit);
-    return;
-  }
-  if (method === "GET" && pathname === "/api/control-center-status") {
-    handleControlCenterStatus(res);
-    return;
-  }
-
-  // POST API routes (all require control token)
+  // ── POST routes: drain body + verify control token before dispatch ──
+  // All POST routes in the table declare `requiresToken: true`; the body is
+  // drained up-front so HTTP keep-alive connections stay clean even when the
+  // route is unknown (preserving the original handleRequest behavior).
   if (method === "POST") {
-    await readBody(req); // drain optional body
+    await readBody(req);
     if (!checkControlToken(req)) {
       sendJson(res, 403, { error: "Missing or invalid control token" });
       return;
     }
-    if (pathname === "/api/start-all") return handleManageAction(res, "start", "all");
-    if (pathname === "/api/stop-all") return handleManageAction(res, "stop", "all");
-    if (pathname === "/api/restart-all") return handleManageAction(res, "restart", "all");
-    if (pathname === "/api/core/start") return handleManageAction(res, "start", "core");
-    if (pathname === "/api/core/stop") return handleManageAction(res, "stop", "core");
-    if (pathname === "/api/direct/start") return handleManageAction(res, "start", "direct");
-    if (pathname === "/api/direct/stop") return handleManageAction(res, "stop", "direct");
-    if (pathname === "/api/open-logs-folder") {
-      handleOpenLogsFolder(res);
-      return;
-    }
-    // POST /api/direct-sessions/:sessionId/finalize — finalize a direct session
-    // (must be matched BEFORE any generic /api/direct-sessions/:sessionId pattern)
-    const finalizeDirectMatch = pathname.match(/^\/api\/direct-sessions\/([^/]+)\/finalize$/);
-    if (finalizeDirectMatch) {
-      let sessionId: string;
-      try {
-        sessionId = decodeURIComponent(finalizeDirectMatch[1]);
-      } catch {
-        sessionId = finalizeDirectMatch[1];
-      }
-      await handleDirectSessionFinalize(res, sessionId);
-      return;
-    }
-    // POST /api/direct-sessions/:sessionId/audit — audit a direct session
-    const auditDirectMatch = pathname.match(/^\/api\/direct-sessions\/([^/]+)\/audit$/);
-    if (auditDirectMatch) {
-      let sessionId: string;
-      try {
-        sessionId = decodeURIComponent(auditDirectMatch[1]);
-      } catch {
-        sessionId = auditDirectMatch[1];
-      }
-      handleDirectSessionAudit(res, sessionId);
-      return;
-    }
-    // POST /api/direct-sessions/:sessionId/hide — hide a direct session from the list
-    const hideDirectMatch = pathname.match(/^\/api\/direct-sessions\/([^/]+)\/hide$/);
-    if (hideDirectMatch) {
-      let sessionId: string;
-      try {
-        sessionId = decodeURIComponent(hideDirectMatch[1]);
-      } catch {
-        sessionId = hideDirectMatch[1];
-      }
-      handleDirectSessionHide(res, sessionId);
-      return;
-    }
-    // POST /api/tasks/:taskId/reconcile (token already validated above)
-    const reconcileMatch = pathname.match(/^\/api\/tasks\/([^/]+)\/reconcile$/);
-    if (reconcileMatch) {
-      let taskId: string;
-      try {
-        taskId = decodeURIComponent(reconcileMatch[1]);
-      } catch {
-        taskId = reconcileMatch[1];
-      }
-      handleReconcile(res, taskId);
-      return;
-    }
-    // POST /api/tasks/:taskId/audit — run audit_task safely
-    const auditMatch = pathname.match(/^\/api\/tasks\/([^/]+)\/audit$/);
-    if (auditMatch) {
-      let taskId: string;
-      try {
-        taskId = decodeURIComponent(auditMatch[1]);
-      } catch {
-        taskId = auditMatch[1];
-      }
-      handleTaskAudit(res, taskId);
-      return;
-    }
-    // POST /api/tasks/:taskId/open-folder — open task folder in file explorer
-    const openFolderMatch = pathname.match(/^\/api\/tasks\/([^/]+)\/open-folder$/);
-    if (openFolderMatch) {
-      let taskId: string;
-      try {
-        taskId = decodeURIComponent(openFolderMatch[1]);
-      } catch {
-        taskId = openFolderMatch[1];
-      }
-      handleOpenTaskFolder(res, taskId);
-      return;
-    }
-    // POST /api/tasks/:taskId/hide-stale — hide a stale task from the dashboard
-    const hideStaleMatch = pathname.match(/^\/api\/tasks\/([^/]+)\/hide-stale$/);
-    if (hideStaleMatch) {
-      let taskId: string;
-      try {
-        taskId = decodeURIComponent(hideStaleMatch[1]);
-      } catch {
-        taskId = hideStaleMatch[1];
-      }
-      handleHideStale(res, taskId);
-      return;
-    }
-    // POST /api/evidence-packs/:lineageId/export — export an evidence pack for a lineage
-    const exportPackMatch = pathname.match(/^\/api\/evidence-packs\/([^/]+)\/export$/);
-    if (exportPackMatch) {
-      let lineageId: string;
-      try {
-        lineageId = decodeURIComponent(exportPackMatch[1]);
-      } catch {
-        lineageId = exportPackMatch[1];
-      }
-      handleEvidencePackExport(res, lineageId);
-      return;
-    }
-    sendJson(res, 404, { error: "Not found" });
+  }
+
+  // ── Declarative route table dispatch ──
+  // Filter by method → match pattern (in declaration order, so specific
+  // patterns win over generic `:id`) → call handler with capture-group slice.
+  const routes = buildRoutes(parsedUrl);
+  for (const route of routes) {
+    if (route.method !== method) continue;
+    const match = pathname.match(route.pattern);
+    if (!match) continue;
+    await route.handler(res, match.slice(1));
     return;
   }
 

package/src/control/shared.ts

@@ -10,11 +10,14 @@
 import { existsSync, readFileSync, readdirSync, realpathSync, statSync } from "node:fs";
 import { delimiter, dirname, extname, isAbsolute, join, relative, resolve } from "node:path";
 import { fileURLToPath } from "node:url";
-import { randomUUID } from "node:crypto";
+import { createHash, randomUUID } from "node:crypto";
 import { homedir } from "node:os";
 import { type IncomingMessage, type ServerResponse } from "node:http";
 import { loadConfig, type PatchWardenConfig } from "../config.js";
 import { logger } from "../logging.js";
+import { readTextFilePrefixSync, readTextFileTailLinesSync } from "../utils/boundedFile.js";
+import { redactSensitiveContent, redactSensitiveValue } from "../security/contentRedaction.js";
+import { guardPath } from "../security/pathGuard.js";
 
 // ── Paths ─────────────────────────────────────────────────────────
 
@@ -22,7 +25,22 @@ export const projectRoot = resolve(dirname(fileURLToPath(import.meta.url)), ".."
 export const uiRoot = join(projectRoot, "ui");
 export const manageScriptPath = join(projectRoot, "scripts", "control", "manage-patchwarden.ps1");
 
+function resolveActiveConfigPath(): string {
+  if (process.env.PATCHWARDEN_CONFIG) return resolve(process.env.PATCHWARDEN_CONFIG);
+  for (const name of ["patchwarden.config.json", ".patchwarden.json"]) {
+    const candidate = resolve(process.cwd(), name);
+    if (existsSync(candidate)) return candidate;
+  }
+  return resolve(process.cwd(), "patchwarden.config.json");
+}
+
+export const activeConfigPath = resolveActiveConfigPath();
+export const configIdentitySha256 = createHash("sha256")
+  .update(process.platform === "win32" ? activeConfigPath.toLowerCase() : activeConfigPath)
+  .digest("hex");
+
 export const PAGE_ALIASES: Record<string, string> = {
+  "/getting-started.html": "pages/getting-started.html",
   "/dashboard.html": "pages/dashboard.html",
   "/tasks.html": "pages/tasks.html",
   "/workspace.html": "pages/workspace.html",
@@ -30,13 +48,17 @@ export const PAGE_ALIASES: Record<string, string> = {
   "/task-detail.html": "pages/task-detail.html",
   "/direct-sessions.html": "pages/direct-sessions.html",
   "/logs.html": "pages/logs.html",
+  "/settings.html": "pages/settings.html",
 };
 
 // ── Config (fault-tolerant bootstrap) ─────────────────────────────
 
 export function createFallbackConfig(): PatchWardenConfig {
   return {
-    workspaceRoot: process.cwd(),
+    // Fault-tolerant dashboard mode must not widen a rejected workspace to the
+    // caller's cwd (which could be a home or drive root). The package root is
+    // bounded and all execution capabilities remain disabled below.
+    workspaceRoot: projectRoot,
     plansDir: ".patchwarden/plans",
     tasksDir: ".patchwarden/tasks",
     assessmentsDir: ".patchwarden/assessments",
@@ -99,8 +121,6 @@ export const host = "127.0.0.1";
 // not depend on the real 8080/8081 ports being free on the host.
 export const CORE_BASE_URL = process.env.PATCHWARDEN_CORE_URL || "http://127.0.0.1:8080";
 export const DIRECT_BASE_URL = process.env.PATCHWARDEN_DIRECT_URL || "http://127.0.0.1:8081";
-export const DEFAULT_TUNNEL_CLIENT_EXE = "D:\\ai_agent\\tunnel-client-v0.0.9--context-conduit-topaz-windows-amd64\\tunnel-client.exe";
-
 export const CONTROL_CENTER_FAVICON = `<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 64 64">
   <rect width="64" height="64" rx="14" fill="#0a0e14"/>
   <path d="M32 52s17-8 17-27V14L32 8 15 14v11c0 19 17 27 17 27z" fill="#111820" stroke="#2dd4a8" stroke-width="4" stroke-linejoin="round"/>
@@ -219,8 +239,11 @@ export function readBody(req: IncomingMessage): Promise<unknown | null> {
 export function readJsonFileSafe<T = unknown>(filePath: string): T | null {
   if (!existsSync(filePath)) return null;
   try {
+    const size = statSync(filePath).size;
+    if (size > Math.max(1, config.maxReadFileBytes)) return null;
     const raw = readFileSync(filePath, "utf-8");
-    return JSON.parse(raw.charCodeAt(0) === 0xfeff ? raw.slice(1) : raw) as T;
+    const parsed = JSON.parse(raw.charCodeAt(0) === 0xfeff ? raw.slice(1) : raw);
+    return redactSensitiveValue(parsed).value as T;
   } catch {
     return null;
   }
@@ -248,18 +271,28 @@ export function readJsonFileSafeUnder<T = unknown>(root: string, relPath: string
 export function readTextFileSafe(filePath: string): string | null {
   if (!existsSync(filePath)) return null;
   try {
-    return readFileSync(filePath, "utf-8");
+    const bounded = readTextFilePrefixSync(filePath, Math.max(1, config.maxReadFileBytes));
+    return redactSensitiveContent(bounded.content).content;
+  } catch {
+    return null;
+  }
+}
+
+/** Resolve a Control Center artifact path and reject symlink/junction escapes. */
+export function guardControlPath(path: string, allowedPrefix: string): string | null {
+  try {
+    return guardPath(path, config.workspaceRoot, allowedPrefix);
   } catch {
     return null;
   }
 }
 
 export function readFileTail(filePath: string, lines = 100): string {
-  if (!existsSync(filePath)) return "";
-  const content = readFileSync(filePath, "utf-8");
-  const allLines = content.split(/\r?\n/);
-  if (allLines.length > 0 && allLines[allLines.length - 1] === "") allLines.pop();
-  return allLines.slice(-lines).join("\n");
+  try {
+    return readTextFileTailLinesSync(filePath, lines);
+  } catch {
+    return "";
+  }
 }
 
 export function findLatestLog(dir: string, pattern: RegExp): string | null {
@@ -288,6 +321,39 @@ export function findLatestLog(dir: string, pattern: RegExp): string | null {
   return join(dir, latestName);
 }
 
+// ── Routing ──────────────────────────────────────────────────────
+
+/**
+ * Declarative route descriptor consumed by `routeTable.ts` and dispatched by
+ * `server.ts`'s `handleRequest`. The handler receives the slice of path
+ * capture groups `[match[1], match[2], ...]` so wrappers can decode them via
+ * `decodeParam`. POST routes default to `requiresToken: true`.
+ */
+export interface Route {
+  method: "GET" | "POST";
+  pattern: RegExp;
+  handler: (res: ServerResponse, params: string[]) => Promise<void> | void;
+  requiresToken?: boolean; // POST defaults to true
+}
+
+/**
+ * Safely decode a path capture group, falling back to the raw value if the
+ * percent-encoding is malformed. Accepts the raw `RegExpMatchArray` or the
+ * sliced `string[]` params passed to a Route handler — both are readable by
+ * numeric index. Note: under `lib: es2024+` `RegExpMatchArray` is a tuple
+ * `[string, ...string[]]`, so we widen the parameter to `readonly string[]` to
+ * accept both shapes without forcing callers to cast.
+ */
+export function decodeParam(match: readonly string[] | RegExpMatchArray | null, index: number): string {
+  if (!match) return "";
+  const raw = match[index] || "";
+  try {
+    return decodeURIComponent(raw);
+  } catch {
+    return raw;
+  }
+}
+
 // Re-export widely-used node primitives so route modules have a single import
 // surface for path/delimiter helpers that are also needed alongside the shared
 // helpers above.

package/src/diagnostics/allowedTestCommandSafety.ts

@@ -0,0 +1,12 @@
+const DANGEROUS_ALLOWED_TEST_COMMAND_PATTERNS = [
+  /(^|\s)rm\s+-rf(?:\s|$)/i,
+  /(^|\s)del\s+\/s(?:\s|$)/i,
+  /(^|\s)format(?:\.exe)?(?:\s|$)/i,
+  /(^|\s)shutdown(?:\.exe)?(?:\s|$)/i,
+  /curl\s+[^\r\n|]*\|/i,
+  /wget\s+[^\r\n|]*\|/i,
+];
+
+export function isDangerousAllowedTestCommand(command: string): boolean {
+  return DANGEROUS_ALLOWED_TEST_COMMAND_PATTERNS.some((pattern) => pattern.test(command));
+}

package/src/direct/directAudit.ts

@@ -1,15 +1,16 @@
-import { writeFileSync } from "node:fs";
 import { join, resolve, relative, isAbsolute } from "node:path";
-import { getConfig } from "../config.js";
 import { isSensitivePath } from "../security/sensitiveGuard.js";
 import { PatchWardenError } from "../errors.js";
 import {
   readDirectSession,
   getDirectSessionDir,
+  updateDirectSession,
+  withDirectSessionMutationLock,
   type DirectSessionRecord,
   type DirectSessionVerificationRun,
 } from "./directSessionStore.js";
 import type { ChangedFile, ChangeArtifacts } from "../runner/changeCapture.js";
+import { atomicWriteFileSync, atomicWriteJsonFileSync } from "../utils/atomicFile.js";
 
 // ── Types ──────────────────────────────────────────────────────────
 
@@ -39,7 +40,7 @@ export interface DirectSessionAuditOutput {
 // ── Main audit function ────────────────────────────────────────────
 
 export function auditDirectSession(sessionId: string): DirectSessionAuditOutput {
-  const config = getConfig();
+  return withDirectSessionMutationLock(sessionId, () => {
   const session = readDirectSession(sessionId);
   const sessionDir = getDirectSessionDir(sessionId);
 
@@ -98,6 +99,15 @@ export function auditDirectSession(sessionId: string): DirectSessionAuditOutput
       reason_code: sensitiveFiles.length > 0 ? "sensitive_file_modified" : undefined,
     });
 
+    checks.push({
+      name: "sensitive_content",
+      result: artifacts.diff_redacted ? "fail" : "pass",
+      detail: artifacts.diff_redacted
+        ? `Credential-like content was redacted from diff evidence (${(artifacts.diff_redaction_categories ?? []).join(", ") || "sensitive_content"}).`
+        : "No credential-like content was detected in diff evidence.",
+      reason_code: artifacts.diff_redacted ? "sensitive_content_detected" : undefined,
+    });
+
     // Check 5: node_modules modification
     const nodeModulesChanges = findPathChanges(artifacts, "node_modules");
     checks.push({
@@ -304,14 +314,12 @@ export function auditDirectSession(sessionId: string): DirectSessionAuditOutput
   };
 
   // Write audit.json and audit.md
-  writeFileSync(
-    join(sessionDir, "audit.json"),
-    JSON.stringify(output, null, 2),
-    "utf-8"
-  );
-  writeFileSync(auditPath, formatAuditMd(output, checks, session), "utf-8");
+  atomicWriteJsonFileSync(join(sessionDir, "audit.json"), output);
+  atomicWriteFileSync(auditPath, formatAuditMd(output, checks, session));
+  updateDirectSession(sessionId, { audited: true });
 
   return output;
+  });
 }
 
 // ── Helper functions ───────────────────────────────────────────────