patchwarden 1.5.1 → 1.6.2

package/src/goal/worktreeManager.ts

@@ -23,17 +23,18 @@ import {
   existsSync,
   mkdirSync,
   readFileSync,
-  renameSync,
-  writeFileSync,
   rmSync,
 } from "node:fs";
-import { join } from "node:path";
+import { join, normalize } from "node:path";
 import { execFileSync } from "node:child_process";
 import { randomBytes } from "node:crypto";
 import { getConfig } from "../config.js";
-import { guardWorkspacePath } from "../security/pathGuard.js";
+import { guardPath, guardWorkspacePath } from "../security/pathGuard.js";
 import { guardSensitivePath } from "../security/sensitiveGuard.js";
 import { PatchWardenError } from "../errors.js";
+import { buildGitEnvironment, resolveTrustedExecutable } from "../runner/processSecurity.js";
+import { atomicWriteJsonFileSync } from "../utils/atomicFile.js";
+import { withFileLockSync } from "../utils/lockedJsonFile.js";
 
 // ── 类型定义 ──────────────────────────────────────────────────────
 
@@ -56,9 +57,12 @@ export const WorktreeDir = "_workspacetrees";
 
 /** 归档目录名（discard 后保留状态），位于 .patchwarden 下，始终为安全路径。 */
 const WORKTREE_ARCHIVE_DIR = ".patchwarden/worktree-archive";
+const WORKTREE_LOCK_DIR = ".patchwarden/worktree-locks";
 
 const GIT_TIMEOUT_MS = 30000;
 const GIT_BRANCH_TIMEOUT_MS = 15000;
+const WORKTREE_ID_MAX_LENGTH = 32;
+const WORKTREE_ID_PATTERN = /^wt_[a-z0-9]{1,16}_[a-f0-9]{12}$/;
 
 // ── 辅助：解析 workspaceRoot ──────────────────────────────────────
 
@@ -66,20 +70,43 @@ function resolveWorkspaceRoot(workspaceRoot?: string): string {
   return workspaceRoot ?? getConfig().workspaceRoot;
 }
 
+/** Accept only IDs emitted by generateWorktreeId(). */
+export function assertValidWorktreeId(worktreeId: string): void {
+  if (
+    worktreeId.length > WORKTREE_ID_MAX_LENGTH ||
+    !WORKTREE_ID_PATTERN.test(worktreeId)
+  ) {
+    throw new PatchWardenError(
+      "invalid_worktree_id",
+      "Invalid worktree id. Expected the wt_<base36 timestamp>_<12 hex chars> format.",
+      "Use the worktree_id returned by create_subgoal_task.",
+      true,
+      { worktree_id_length: worktreeId.length }
+    );
+  }
+}
+
 // ── 目录路径解析 ──────────────────────────────────────────────────
 
 /**
  * 返回 `<workspaceRoot>/_workspacetrees` 目录路径。不自动创建目录。
  */
 export function getWorktreesDir(workspaceRoot?: string): string {
-  return join(resolveWorkspaceRoot(workspaceRoot), WorktreeDir);
+  const wsRoot = resolveWorkspaceRoot(workspaceRoot);
+  return guardPath(join(wsRoot, WorktreeDir), wsRoot, WorktreeDir);
 }
 
 /**
  * 返回 `<getWorktreesDir()>/<worktreeId>` 路径。
  */
 export function getWorktreeDir(worktreeId: string, workspaceRoot?: string): string {
-  return join(getWorktreesDir(workspaceRoot), worktreeId);
+  assertValidWorktreeId(worktreeId);
+  const wsRoot = resolveWorkspaceRoot(workspaceRoot);
+  return guardPath(
+    join(getWorktreesDir(wsRoot), worktreeId),
+    wsRoot,
+    WorktreeDir
+  );
 }
 
 // ── ID 与 branch 生成 ─────────────────────────────────────────────
@@ -105,23 +132,110 @@ function sanitizeBranchSegment(value: string): string {
   return cleaned === "" ? "x" : cleaned;
 }
 
+function samePath(left: string, right: string): boolean {
+  const normalizedLeft = normalize(left);
+  const normalizedRight = normalize(right);
+  return process.platform === "win32"
+    ? normalizedLeft.toLowerCase() === normalizedRight.toLowerCase()
+    : normalizedLeft === normalizedRight;
+}
+
+function withWorktreeRepositoryLock<R>(workspaceRoot: string, action: () => R): R {
+  const wsRoot = resolveWorkspaceRoot(workspaceRoot);
+  const lockDir = guardPath(join(wsRoot, WORKTREE_LOCK_DIR), wsRoot, WORKTREE_LOCK_DIR);
+  mkdirSync(lockDir, { recursive: true });
+  return withFileLockSync(join(lockDir, "repository-mutation"), action, {
+    waitMs: 0,
+    busyError: () => new PatchWardenError(
+      "worktree_busy",
+      "Another managed worktree operation is already changing this repository.",
+      "Retry after the active create, merge, or discard operation finishes.",
+      true,
+    ),
+  });
+}
+
+function invalidWorktreeStatus(
+  worktreeId: string,
+  message: string
+): never {
+  throw new PatchWardenError(
+    "invalid_worktree_status",
+    `Invalid worktree status for "${worktreeId}": ${message}`,
+    "Do not edit worktree_status.json manually; recreate the isolated worktree.",
+    true,
+    { worktree_id: worktreeId }
+  );
+}
+
+function validateWorktreeStatus(
+  value: unknown,
+  worktreeId: string,
+  workspaceRoot: string,
+  expectedPath: string
+): WorktreeStatus {
+  if (!value || typeof value !== "object" || Array.isArray(value)) {
+    return invalidWorktreeStatus(worktreeId, "expected a JSON object");
+  }
+
+  const candidate = value as Record<string, unknown>;
+  const statusValues = new Set(["active", "merged", "discarded"]);
+  if (
+    typeof candidate.worktree_id !== "string" ||
+    typeof candidate.goal_id !== "string" ||
+    typeof candidate.subgoal_id !== "string" ||
+    typeof candidate.path !== "string" ||
+    typeof candidate.created_at !== "string" ||
+    typeof candidate.status !== "string" ||
+    !statusValues.has(candidate.status) ||
+    typeof candidate.branch !== "string"
+  ) {
+    return invalidWorktreeStatus(worktreeId, "missing or invalid required fields");
+  }
+
+  if (candidate.worktree_id !== worktreeId) {
+    return invalidWorktreeStatus(worktreeId, "worktree_id does not match its directory");
+  }
+
+  let guardedStatusPath: string;
+  try {
+    guardedStatusPath = guardPath(candidate.path, workspaceRoot, WorktreeDir);
+  } catch {
+    return invalidWorktreeStatus(worktreeId, "path is outside the managed worktree root");
+  }
+  if (!samePath(guardedStatusPath, expectedPath)) {
+    return invalidWorktreeStatus(worktreeId, "path does not match its directory");
+  }
+
+  const expectedBranch = `pw-${sanitizeBranchSegment(candidate.goal_id)}-${sanitizeBranchSegment(candidate.subgoal_id)}`;
+  if (candidate.branch !== expectedBranch) {
+    return invalidWorktreeStatus(worktreeId, "branch does not match goal and subgoal metadata");
+  }
+
+  if (
+    (candidate.merged_at !== undefined && typeof candidate.merged_at !== "string") ||
+    (candidate.discarded_at !== undefined && typeof candidate.discarded_at !== "string")
+  ) {
+    return invalidWorktreeStatus(worktreeId, "invalid lifecycle timestamp");
+  }
+
+  return candidate as unknown as WorktreeStatus;
+}
+
 // ── 原子写 ────────────────────────────────────────────────────────
 
-/**
- * 原子写入 status 文件：先写到 `.tmp` 文件，再 renameSync。
- * 参考 goalStore.ts writeGoalStatus 的模式。
- */
 function writeStatusAtomic(statusFilePath: string, status: WorktreeStatus): void {
-  const tmpPath = statusFilePath + ".tmp";
-  writeFileSync(tmpPath, JSON.stringify(status, null, 2) + "\n", "utf-8");
-  renameSync(tmpPath, statusFilePath);
+  atomicWriteJsonFileSync(statusFilePath, status);
 }
 
 function runGit(args: string[], cwd: string, timeoutMs: number): void {
-  execFileSync("git", args, {
+  const env = buildGitEnvironment(cwd);
+  execFileSync(resolveTrustedExecutable("git", cwd, { pathValue: env.PATH }), args, {
     cwd,
     timeout: timeoutMs,
     stdio: ["pipe", "pipe", "pipe"],
+    windowsHide: true,
+    env,
   });
 }
 
@@ -157,6 +271,7 @@ export function createWorktree(
   subgoalId: string,
   workspaceRoot: string
 ): { worktreeId: string; worktreePath: string; branch: string } {
+  return withWorktreeRepositoryLock(workspaceRoot, () => {
   const wsRoot = resolveWorkspaceRoot(workspaceRoot);
 
   const worktreeId = generateWorktreeId();
@@ -222,6 +337,7 @@ export function createWorktree(
       }
     );
   }
+  });
 }
 
 /**
@@ -241,12 +357,13 @@ export function readWorktreeStatus(
   const statusFilePath = join(worktreePath, "worktree_status.json");
   if (!existsSync(statusFilePath)) return null;
 
+  let parsed: unknown;
   try {
-    const raw = readFileSync(statusFilePath, "utf-8");
-    return JSON.parse(raw) as WorktreeStatus;
+    parsed = JSON.parse(readFileSync(statusFilePath, "utf-8"));
   } catch {
-    return null;
+    return invalidWorktreeStatus(worktreeId, "file is not valid JSON");
   }
+  return validateWorktreeStatus(parsed, worktreeId, wsRoot, worktreePath);
 }
 
 /**
@@ -264,6 +381,7 @@ export function mergeWorktree(
   worktreeId: string,
   workspaceRoot: string
 ): { status: "merged" } {
+  return withWorktreeRepositoryLock(workspaceRoot, () => {
   const wsRoot = resolveWorkspaceRoot(workspaceRoot);
   const worktreePath = getWorktreeDir(worktreeId, workspaceRoot);
 
@@ -313,6 +431,7 @@ export function mergeWorktree(
   writeStatusAtomic(statusFilePath, updatedStatus);
 
   return { status: "merged" };
+  });
 }
 
 /**
@@ -333,6 +452,7 @@ export function discardWorktree(
   worktreeId: string,
   workspaceRoot: string
 ): { status: "discarded" } {
+  return withWorktreeRepositoryLock(workspaceRoot, () => {
   const wsRoot = resolveWorkspaceRoot(workspaceRoot);
   const worktreePath = getWorktreeDir(worktreeId, workspaceRoot);
 
@@ -364,10 +484,6 @@ export function discardWorktree(
   try {
     runGit(["worktree", "remove", "--force", worktreePath], wsRoot, GIT_TIMEOUT_MS);
   } catch (err) {
-    // git remove 失败时再尝试直接删目录（best effort），然后抛错
-    try {
-      rmSync(worktreePath, { recursive: true, force: true });
-    } catch { /* ignore */ }
     throw new PatchWardenError(
       "worktree_discard_failed",
       `Failed to remove worktree "${worktreeId}": ${gitErrorMessage(err)}`,
@@ -391,7 +507,7 @@ export function discardWorktree(
 
   const archiveDir = join(wsRoot, WORKTREE_ARCHIVE_DIR);
   guardWorkspacePath(archiveDir, wsRoot);
-  // .patchwarden 路径在 sensitiveGuard 中始终视为安全（SAFE_PREFIX），无需额外校验
+  // The archive path is workspace-confined and contains only managed status metadata.
 
   try {
     mkdirSync(archiveDir, { recursive: true });
@@ -401,4 +517,5 @@ export function discardWorktree(
   writeStatusAtomic(archiveFilePath, archivedStatus);
 
   return { status: "discarded" };
+  });
 }

package/src/httpServer.ts

@@ -16,16 +16,21 @@
  */
 
 import { createServer, IncomingMessage, ServerResponse } from "node:http";
-import { existsSync, mkdirSync, readFileSync, writeFileSync } from "node:fs";
+import { existsSync, mkdirSync, readFileSync } from "node:fs";
 import { join, resolve } from "node:path";
 import { Server } from "@modelcontextprotocol/sdk/server/index.js";
 import { StreamableHTTPServerTransport } from "@modelcontextprotocol/sdk/server/streamableHttp.js";
 import { loadConfig, getTasksDir } from "./config.js";
 import { registerTools } from "./tools/registry.js";
-import { healthCheck } from "./tools/healthCheck.js";
+import { healthCheck } from "./tools/diagnostics/healthCheck.js";
 import { getToolCatalogSnapshot } from "./tools/registry.js";
 import { PATCHWARDEN_VERSION } from "./version.js";
 import { logger } from "./logging.js";
+import { firstHeaderValue, timingSafeStringEqual } from "./security/secretComparison.js";
+import { redactSensitiveContent } from "./security/contentRedaction.js";
+import { atomicWriteJsonFileSync } from "./utils/atomicFile.js";
+import { mutateTaskStatus } from "./runner/taskStatusStore.js";
+import { isTrustedLoopbackHostHeader } from "./security/loopbackHost.js";
 
 // ── Bootstrap ─────────────────────────────────────────────────────
 
@@ -44,6 +49,16 @@ logger.info(`[patchwarden-http] ⚠️  Bound to 127.0.0.1 only — not exposed
 const httpCfg = config.http || {};
 const ownerTokenEnv = httpCfg.ownerTokenEnv || "PATCHWARDEN_OWNER_TOKEN";
 const ownerToken = process.env[ownerTokenEnv] || "";
+const MAX_ADMIN_BODY_BYTES = 64 * 1024;
+const MAX_ACCEPTANCE_NOTES_CHARS = 10_000;
+const REVIEWABLE_TASK_STATUSES = new Set([
+  "done_by_agent",
+  "done",
+  "accepted",
+  "rejected",
+  "needs_fix",
+  "blocked",
+]);
 
 if (ownerToken) {
   logger.info(`[patchwarden-http] 🔒 Owner token required (env: ${ownerTokenEnv})`);
@@ -54,15 +69,15 @@ if (ownerToken) {
 function checkOwnerToken(req: IncomingMessage): boolean {
   if (!ownerToken) return true; // no token configured — allow all
 
-  const authHeader = req.headers["authorization"] || "";
-  const customHeader = req.headers["x-patchwarden-token"] || "";
+  const authHeader = firstHeaderValue(req.headers["authorization"]);
+  const customHeader = firstHeaderValue(req.headers["x-patchwarden-token"]);
 
   if (authHeader.startsWith("Bearer ")) {
-    return authHeader.slice(7) === ownerToken;
+    return timingSafeStringEqual(authHeader.slice(7), ownerToken);
   }
 
-  if (typeof customHeader === "string" && customHeader.length > 0) {
-    return customHeader === ownerToken;
+  if (customHeader.length > 0) {
+    return timingSafeStringEqual(customHeader, ownerToken);
   }
 
   return false;
@@ -82,11 +97,22 @@ function handleAcceptance(taskId: string, status: "accepted" | "rejected", body:
     throw Object.assign(new Error(`Task "${taskId}" not found.`), { statusCode: 404 });
   }
   let notes = "";
-  try {
-    const parsed = JSON.parse(body || "{}");
-    notes = String(parsed.notes || parsed.reason || "");
-  } catch {
-    // no body or invalid JSON — notes stays empty
+  if (body.trim()) {
+    let parsed: unknown;
+    try {
+      parsed = JSON.parse(body);
+    } catch {
+      throw httpError(400, "Acceptance body must be valid JSON.");
+    }
+    if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) {
+      throw httpError(400, "Acceptance body must be a JSON object.");
+    }
+    const record = parsed as Record<string, unknown>;
+    const rawNotes = record.notes ?? record.reason ?? "";
+    if (typeof rawNotes !== "string") {
+      throw httpError(400, "Acceptance notes or reason must be a string.");
+    }
+    notes = redactSensitiveContent(rawNotes).content.slice(0, MAX_ACCEPTANCE_NOTES_CHARS);
   }
   const acceptance = {
     status,
@@ -94,23 +120,69 @@ function handleAcceptance(taskId: string, status: "accepted" | "rejected", body:
     reviewer: "human",
     notes,
   };
-  writeFileSync(filePath, JSON.stringify(acceptance, null, 2), "utf-8");
-
-  // Also update the task's status.json with acceptance_status
+  // Commit the review artifact and status annotation while holding the same
+  // status lock used by the runner, cancel, and audit paths.
   const statusFile = join(taskDir, "status.json");
-  if (existsSync(statusFile)) {
-    try {
-      const current = JSON.parse(readFileSync(statusFile, "utf-8"));
-      current.acceptance_status = status;
-      current.acceptance_reviewed_at = acceptance.reviewed_at;
-      writeFileSync(statusFile, JSON.stringify(current, null, 2), "utf-8");
-    } catch {
-      // status.json update is best-effort
-    }
+  if (!existsSync(statusFile)) {
+    throw httpError(409, `Task "${taskId}" has no status.json to review.`);
   }
+  mutateTaskStatus(statusFile, (current) => {
+    if (!REVIEWABLE_TASK_STATUSES.has(String(current.status || ""))) {
+      throw httpError(409, `Task "${taskId}" is not in a reviewable terminal state.`);
+    }
+    atomicWriteJsonFileSync(filePath, acceptance);
+    const next = {
+      ...current,
+      acceptance_status: status,
+      acceptance_reviewed_at: acceptance.reviewed_at,
+      updated_at: new Date().toISOString(),
+    };
+    return { next, result: next };
+  });
   return acceptance;
 }
 
+function httpError(statusCode: number, message: string): Error & { statusCode: number } {
+  return Object.assign(new Error(message), { statusCode });
+}
+
+function readBoundedRequestBody(req: IncomingMessage, maxBytes: number): Promise<string> {
+  const declaredLength = Number(firstHeaderValue(req.headers["content-length"]));
+  if (Number.isFinite(declaredLength) && declaredLength > maxBytes) {
+    req.resume();
+    return Promise.reject(httpError(413, `Request body exceeds ${maxBytes} bytes.`));
+  }
+  return new Promise((resolveBody, rejectBody) => {
+    const chunks: Buffer[] = [];
+    let total = 0;
+    let settled = false;
+    req.on("data", (chunk: Buffer | string) => {
+      if (settled) return;
+      const buffer = Buffer.isBuffer(chunk) ? chunk : Buffer.from(chunk);
+      total += buffer.length;
+      if (total > maxBytes) {
+        settled = true;
+        req.resume();
+        rejectBody(httpError(413, `Request body exceeds ${maxBytes} bytes.`));
+        return;
+      }
+      chunks.push(buffer);
+    });
+    req.on("end", () => {
+      if (!settled) {
+        settled = true;
+        resolveBody(Buffer.concat(chunks).toString("utf-8"));
+      }
+    });
+    req.on("error", (error) => {
+      if (!settled) {
+        settled = true;
+        rejectBody(error);
+      }
+    });
+  });
+}
+
 function readAcceptance(taskId: string): object {
   const filePath = getAcceptancePath(taskId);
   if (!existsSync(filePath)) {
@@ -181,6 +253,16 @@ function parseAdminUrl(url: string) {
 // ── HTTP server ───────────────────────────────────────────────────
 
 const httpServer = createServer(async (req: IncomingMessage, res: ServerResponse) => {
+  if (!isTrustedLoopbackHostHeader(req.headers.host, port)) {
+    res.writeHead(421, {
+      "Content-Type": "application/json; charset=utf-8",
+      "Cache-Control": "no-store",
+      "X-Content-Type-Options": "nosniff",
+    });
+    res.end(JSON.stringify({ error: "Untrusted Host header" }));
+    return;
+  }
+
   // Health check endpoints
   if (req.method === "GET" && (req.url === "/healthz" || req.url === "/readyz")) {
     const health = healthCheck(getToolCatalogSnapshot());
@@ -206,9 +288,7 @@ const httpServer = createServer(async (req: IncomingMessage, res: ServerResponse
         return;
       }
       if ((admin.action === "accept" || admin.action === "reject") && req.method === "POST") {
-        const chunks: Buffer[] = [];
-        for await (const chunk of req) { chunks.push(Buffer.isBuffer(chunk) ? chunk : Buffer.from(chunk)); }
-        const body = Buffer.concat(chunks).toString("utf-8");
+        const body = await readBoundedRequestBody(req, MAX_ADMIN_BODY_BYTES);
         const acceptance = handleAcceptance(admin.taskId, admin.action === "accept" ? "accepted" : "rejected", body);
         res.writeHead(200, { "Content-Type": "application/json" });
         res.end(JSON.stringify(acceptance, null, 2));
@@ -216,10 +296,13 @@ const httpServer = createServer(async (req: IncomingMessage, res: ServerResponse
       }
       res.writeHead(405, { "Content-Type": "application/json" });
       res.end(JSON.stringify({ error: "Method not allowed for this admin endpoint." }));
-    } catch (err: any) {
-      const statusCode = err.statusCode || 500;
+    } catch (err: unknown) {
+      const statusCode = err && typeof err === "object" && "statusCode" in err
+        ? Number((err as { statusCode?: unknown }).statusCode) || 500
+        : 500;
+      const message = err instanceof Error ? err.message : "Internal server error";
       res.writeHead(statusCode, { "Content-Type": "application/json" });
-      res.end(JSON.stringify({ error: err.message || "Internal server error" }));
+      res.end(JSON.stringify({ error: message }));
     }
     return;
   }

package/src/logging.ts

@@ -1,9 +1,12 @@
 import { createHash } from "node:crypto";
-import { appendFileSync, mkdirSync } from "node:fs";
+import { mkdirSync } from "node:fs";
 import { join } from "node:path";
 import { redactSensitiveContent } from "./security/contentRedaction.js";
-import { stableJsonStringify } from "./tools/toolRegistry.js";
+import { stableJsonStringify } from "./utils/stableJson.js";
 import { getConfig } from "./config.js";
+import { appendBoundedTextFileSync } from "./utils/boundedFile.js";
+
+const MAX_INVOCATION_LOG_BYTES = 5 * 1024 * 1024;
 
 // ── Types ─────────────────────────────────────────────────────────
 
@@ -234,7 +237,11 @@ export function logToolInvocation(
 
     mkdirSync(logsDir, { recursive: true });
     const logFilePath = join(logsDir, "invocation.log");
-    appendFileSync(logFilePath, JSON.stringify(entry) + "\n", "utf8");
+    appendBoundedTextFileSync(
+      logFilePath,
+      JSON.stringify(entry) + "\n",
+      MAX_INVOCATION_LOG_BYTES,
+    );
   } catch (err) {
     // 日志失败不应阻断主流程，仅向 stderr 记录错误
     try {

package/src/policy/projectPolicy.ts

@@ -334,10 +334,13 @@ function pathMatchesPattern(relPath: string, pattern: string): boolean {
 }
 
 function parseGithubRepo(repository: unknown): string | null {
+  const repositoryObject = repository && typeof repository === "object" && !Array.isArray(repository)
+    ? repository as Record<string, unknown>
+    : null;
   const raw = typeof repository === "string"
     ? repository
-    : repository && typeof repository === "object" && typeof (repository as any).url === "string"
-      ? (repository as any).url
+    : typeof repositoryObject?.url === "string"
+      ? repositoryObject.url
       : "";
   const match = raw.match(/github\.com[:/](.+?\/.+?)(?:\.git)?(?:[#?].*)?$/i);
   return match ? match[1] : null;