patchwarden 1.5.1 → 1.6.2

package/src/runner/watch.ts

@@ -17,15 +17,35 @@
  *   or: npm run watch
  */
 
-import { readdirSync, readFileSync, existsSync, writeFileSync, mkdirSync, renameSync } from "node:fs";
+import {
+  closeSync,
+  existsSync,
+  mkdirSync,
+  openSync,
+  readFileSync,
+  readdirSync,
+  unlinkSync,
+  writeFileSync,
+} from "node:fs";
 import { resolve, join, dirname } from "node:path";
+import { pathToFileURL } from "node:url";
 import { loadConfig, getConfig, getTasksDir, resolveWorkspaceRoot } from "../config.js";
 import { guardWorkspacePath } from "../security/pathGuard.js";
 import { guardAgentCommand, guardTestCommand } from "../security/commandGuard.js";
 import { validateAssessmentFreshness } from "../assessments/assessmentStore.js";
 import { captureRepoSnapshot } from "./changeCapture.js";
-import { runTask } from "./runTask.js";
+import { mutateTaskStatus } from "./taskStatusStore.js";
 import { logger } from "../logging.js";
+import { redactSensitiveContent } from "../security/contentRedaction.js";
+import { atomicWriteFileSync } from "../utils/atomicFile.js";
+import { reconcileTasks } from "../tools/tasks/reconcileTasks.js";
+import {
+  buildAssessmentValidationFailureDiagnostic,
+  recordAssessmentValidationFailure,
+} from "../assessments/assessmentDiagnostics.js";
+//  Note: `runTask` is imported lazily inside `tick()` via `await import("./runTask.js")`.
+//  This keeps `import { acquireWatcherLock }` side-effect-free for unit tests and
+//  avoids eagerly pulling in the full tools/dispatch graph at module load.
 
 // ── Bootstrap ─────────────────────────────────────────────────────
 
@@ -36,37 +56,184 @@ const wsRoot = resolveWorkspaceRoot(config);
 
 const POLL_INTERVAL_MS = 4000;
 const WATCHER_HEARTBEAT_FILE = join(dirname(tasksDir), "watcher-heartbeat.json");
+const WATCHER_LOCK_FILE = join(dirname(tasksDir), "watcher.lock");
 const WATCHER_STARTED_AT = new Date().toISOString();
 const WATCHER_INSTANCE_ID = process.env.PATCHWARDEN_WATCHER_INSTANCE_ID || `standalone-${process.pid}-${Date.now()}`;
 const WATCHER_LAUNCHER_PID = Number.isInteger(Number(process.env.PATCHWARDEN_WATCHER_LAUNCHER_PID))
   ? Number(process.env.PATCHWARDEN_WATCHER_LAUNCHER_PID)
   : null;
-mkdirSync(dirname(WATCHER_HEARTBEAT_FILE), { recursive: true });
-
-logger.info(`[watcher] Workspace: ${wsRoot}`);
-logger.info(`[watcher] Tasks:    ${tasksDir}`);
-logger.info(`[watcher] Polling every ${POLL_INTERVAL_MS / 1000}s`);
-logger.info(`[watcher] Press Ctrl+C to stop`);
-
 // Track executed tasks to prevent re-execution
 const executedTasks = new Set<string>();
+let consecutiveTickFailures = 0;
+let activeTaskId: string | null = null;
+let activeTaskPhase: string | null = null;
+let tickRunning = false;
+let tickStartedAt: string | null = null;
+let lastTickCompletedAt: string | null = null;
+
+// ── Single-instance lock ─────────────────────────────────────────
+//  watch.ts is a long-running poller; without a lock, two watchers started
+//  against the same workspace would race on the same pending tasks. The lock
+//  is best-effort: it detects a live PID via process.kill(pid, 0) and refuses
+//  to start when one is found. A dead PID (crashed watcher) is taken over.
+
+export class WatcherAlreadyRunningError extends Error {
+  constructor(message: string) {
+    super(message);
+    this.name = "WatcherAlreadyRunningError";
+  }
+}
+
+type WatcherLockFile = {
+  pid?: number;
+  instance_id?: string;
+  started_at?: string;
+  launcher_pid?: number | null;
+};
+
+function errorCode(error: unknown): string | null {
+  return error && typeof error === "object" && "code" in error
+    ? String((error as NodeJS.ErrnoException).code || "")
+    : null;
+}
+
+function readWatcherLock(lockFilePath: string): WatcherLockFile | null {
+  try {
+    const parsed: unknown = JSON.parse(readFileSync(lockFilePath, "utf-8"));
+    return parsed && typeof parsed === "object" && !Array.isArray(parsed)
+      ? parsed as WatcherLockFile
+      : null;
+  } catch {
+    return null;
+  }
+}
+
+function processIsAlive(pid: number): boolean {
+  try {
+    process.kill(pid, 0);
+    return true;
+  } catch (error) {
+    // EPERM means the process exists but the current user cannot signal it.
+    return errorCode(error) === "EPERM";
+  }
+}
+
+function runningWatcherError(lockData: WatcherLockFile | null): WatcherAlreadyRunningError {
+  return new WatcherAlreadyRunningError(
+    `[watcher] Already running (pid=${lockData?.pid ?? "unknown"}, instance=${lockData?.instance_id ?? "unknown"}). Exiting.`,
+  );
+}
+
+function createWatcherLockExclusive(lockFilePath: string, content: string): void {
+  const descriptor = openSync(lockFilePath, "wx", 0o600);
+  let writeError: unknown = null;
+  try {
+    writeFileSync(descriptor, content, "utf-8");
+  } catch (error) {
+    writeError = error;
+  } finally {
+    closeSync(descriptor);
+  }
+  if (writeError) {
+    try { unlinkSync(lockFilePath); } catch { /* best effort after a partial write */ }
+    throw writeError;
+  }
+}
+
+/**
+ * Acquire the watcher lock at `lockFilePath`. If a lock file exists and its
+ * recorded PID is still alive (per `process.kill(pid, 0)`), throws
+ * {@link WatcherAlreadyRunningError}. Otherwise overwrites the lock atomically.
+ *
+ * Exported for unit testing; `lockFilePath` defaults to the module-level
+ * {@link WATCHER_LOCK_FILE} but tests pass a temp path.
+ */
+export function acquireWatcherLock(lockFilePath: string = WATCHER_LOCK_FILE): void {
+  const lockContent = JSON.stringify({
+    pid: process.pid,
+    instance_id: WATCHER_INSTANCE_ID,
+    started_at: WATCHER_STARTED_AT,
+    launcher_pid: WATCHER_LAUNCHER_PID,
+  }, null, 2);
+  try {
+    createWatcherLockExclusive(lockFilePath, lockContent);
+    return;
+  } catch (error) {
+    if (errorCode(error) !== "EEXIST") throw error;
+  }
+
+  const existing = readWatcherLock(lockFilePath);
+  if (typeof existing?.pid === "number" && processIsAlive(existing.pid)) {
+    throw runningWatcherError(existing);
+  }
+
+  try {
+    unlinkSync(lockFilePath);
+  } catch (error) {
+    if (errorCode(error) !== "ENOENT") throw error;
+  }
+
+  try {
+    createWatcherLockExclusive(lockFilePath, lockContent);
+  } catch (error) {
+    if (errorCode(error) === "EEXIST") {
+      throw runningWatcherError(readWatcherLock(lockFilePath));
+    }
+    throw error;
+  }
+}
+
+export function releaseWatcherLock(
+  lockFilePath: string = WATCHER_LOCK_FILE,
+  instanceId: string = WATCHER_INSTANCE_ID,
+  pid: number = process.pid,
+): boolean {
+  const existing = readWatcherLock(lockFilePath);
+  if (existing?.pid !== pid || existing.instance_id !== instanceId) return false;
+  try {
+    unlinkSync(lockFilePath);
+    return true;
+  } catch (error) {
+    if (errorCode(error) === "ENOENT") return false;
+    throw error;
+  }
+}
+
+export function createNonOverlappingRunner(
+  operation: () => Promise<void>,
+  onSkipped: () => void = () => undefined,
+): () => Promise<boolean> {
+  let running = false;
+  return async () => {
+    if (running) {
+      onSkipped();
+      return false;
+    }
+    running = true;
+    try {
+      await operation();
+      return true;
+    } finally {
+      running = false;
+    }
+  };
+}
 
 // ── Main loop ─────────────────────────────────────────────────────
 
 async function tick() {
+  tickRunning = true;
+  tickStartedAt = new Date().toISOString();
   try {
-    const heartbeatTemporary = `${WATCHER_HEARTBEAT_FILE}.${WATCHER_INSTANCE_ID}.tmp`;
-    writeFileSync(heartbeatTemporary, JSON.stringify({
-      status: "running",
-      pid: process.pid,
-      started_at: WATCHER_STARTED_AT,
-      last_heartbeat_at: new Date().toISOString(),
-      instance_id: WATCHER_INSTANCE_ID,
-      launcher_pid: WATCHER_LAUNCHER_PID,
-    }, null, 2), "utf-8");
-    renameSync(heartbeatTemporary, WATCHER_HEARTBEAT_FILE);
+    writeWatcherHeartbeat("running");
     // Ensure tasks directory exists
-    if (!existsSync(tasksDir)) return;
+    if (!existsSync(tasksDir)) {
+      consecutiveTickFailures = 0;
+      writeWatcherHeartbeat("running");
+      return;
+    }
+
+    reconcileInterruptedTasks();
 
     const entries = readdirSync(tasksDir, { withFileTypes: true });
     const taskDirs = entries.filter((e) => e.isDirectory());
@@ -82,11 +249,19 @@ async function tick() {
 
       if (!existsSync(statusFile)) continue;
 
-      let statusData: any;
+      let statusData: Record<string, unknown>;
       try {
-        statusData = JSON.parse(readFileSync(statusFile, "utf-8"));
-      } catch {
-        continue; // corrupted status, skip
+        const parsed: unknown = JSON.parse(readFileSync(statusFile, "utf-8"));
+        if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) {
+          throw new Error("status.json must contain an object");
+        }
+        statusData = parsed as Record<string, unknown>;
+      } catch (error) {
+        logger.warn("[watcher] Skipping unreadable task status", {
+          task_id: taskId,
+          error: error instanceof Error ? error.message : String(error),
+        });
+        continue;
       }
 
       if (statusData.status !== "pending") continue;
@@ -94,13 +269,18 @@ async function tick() {
       // ── Pre-flight safety checks ──
       try {
         // Check repo_path
-        const resolvedRepoPath = guardWorkspacePath(statusData.resolved_repo_path || statusData.repo_path || wsRoot, wsRoot);
+        const repoPath = typeof statusData.resolved_repo_path === "string"
+          ? statusData.resolved_repo_path
+          : typeof statusData.repo_path === "string"
+            ? statusData.repo_path
+            : wsRoot;
+        const resolvedRepoPath = guardWorkspacePath(repoPath, wsRoot);
 
         // Check agent
-        guardAgentCommand(statusData.agent, config);
+        guardAgentCommand(typeof statusData.agent === "string" ? statusData.agent : "", config);
 
         // Check test_command
-        if (statusData.test_command) {
+        if (typeof statusData.test_command === "string" && statusData.test_command) {
           guardTestCommand(statusData.test_command, config, resolvedRepoPath);
         }
         if (Array.isArray(statusData.verify_commands)) {
@@ -110,25 +290,34 @@ async function tick() {
         }
 
         // Assessment freshness revalidation
-        if (statusData.assessment_id) {
+        if (typeof statusData.assessment_id === "string" && statusData.assessment_id) {
           const preExecSnapshot = await captureRepoSnapshot(resolvedRepoPath);
-          const validation = validateAssessmentFreshness(String(statusData.assessment_id), preExecSnapshot);
+          const validation = validateAssessmentFreshness(statusData.assessment_id, preExecSnapshot);
           if (!validation.valid) {
-            throw new Error(`assessment validation failed: ${validation.failure_reason}`);
+            recordAssessmentValidationFailure(validation);
+            const diagnostic = buildAssessmentValidationFailureDiagnostic(validation);
+            throw new Error(`assessment validation failed: ${JSON.stringify(diagnostic)}`);
           }
         }
       } catch (err) {
-        const errMsg = `[watcher] Safety check failed for ${taskId}: ${err instanceof Error ? err.message : String(err)}`;
+        const errMsg = redactSensitiveContent(
+          `[watcher] Safety check failed for ${taskId}: ${err instanceof Error ? err.message : String(err)}`,
+        ).content;
         logger.error(errMsg);
 
         // Write error and mark as failed so it doesn't get re-picked
         try {
-          writeFileSync(join(taskDir, "error.log"), errMsg, "utf-8");
-          const data = JSON.parse(readFileSync(statusFile, "utf-8"));
-          data.status = "failed";
-          data.error = errMsg;
-          data.updated_at = new Date().toISOString();
-          writeFileSync(statusFile, JSON.stringify(data, null, 2), "utf-8");
+          atomicWriteFileSync(join(taskDir, "error.log"), errMsg);
+          mutateTaskStatus(statusFile, (current) => {
+            if (current.status !== "pending") return { result: undefined };
+            const next = {
+              ...current,
+              status: "failed",
+              error: errMsg,
+              updated_at: new Date().toISOString(),
+            };
+            return { next, result: undefined };
+          });
         } catch (err) {
           logger.warn("watcher error-log write failed", { error: err instanceof Error ? err.message : String(err) });
         }
@@ -139,33 +328,140 @@ async function tick() {
       // ── Execute ──
       logger.info(`[watcher] Executing: ${taskId}`);
       executedTasks.add(taskId);
+      activeTaskId = taskId;
+      activeTaskPhase = "executing_agent";
 
       try {
+        const { runTask } = await import("./runTask.js");
         const result = await runTask(taskId);
+        activeTaskPhase = result.status;
         logger.info(`[watcher] ${taskId} → ${result.status}`);
       } catch (err) {
+        activeTaskPhase = "error";
         logger.error(`[watcher] ${taskId} → error: ${err instanceof Error ? err.message : String(err)}`);
+      } finally {
+        activeTaskId = null;
+        activeTaskPhase = null;
       }
     }
+    consecutiveTickFailures = 0;
+    writeWatcherHeartbeat("running");
   } catch (err) {
-    logger.error(`[watcher] Tick error: ${err instanceof Error ? err.message : String(err)}`);
+    consecutiveTickFailures += 1;
+    const message = err instanceof Error ? err.message : String(err);
+    logger.error(`[watcher] Tick error (${consecutiveTickFailures} consecutive): ${message}`);
+    try {
+      writeWatcherHeartbeat(consecutiveTickFailures >= 3 ? "degraded" : "running", message);
+    } catch (heartbeatError) {
+      logger.error("[watcher] Failed to persist degraded heartbeat", {
+        error: heartbeatError instanceof Error ? heartbeatError.message : String(heartbeatError),
+      });
+    }
+  } finally {
+    tickRunning = false;
+    lastTickCompletedAt = new Date().toISOString();
+  }
+}
+
+function reconcileInterruptedTasks(): void {
+  const result = reconcileTasks({
+    mode: "safe_fix",
+    max_age_minutes: Math.max(config.watcherStaleSeconds / 60, 1 / 60),
+    include_done_candidates: true,
+  }, config);
+  if (result.reconciled > 0) {
+    logger.warn("[watcher] Reconciled tasks left by a previous runner", {
+      reconciled: result.reconciled,
+      task_ids: result.reports
+        .filter((report) => report.action_taken !== "left_unchanged")
+        .map((report) => report.task_id)
+        .slice(0, 20),
+    });
   }
 }
 
-// ── Start ─────────────────────────────────────────────────────────
+function writeWatcherHeartbeat(status: "running" | "degraded", lastError?: string): void {
+  atomicWriteFileSync(WATCHER_HEARTBEAT_FILE, JSON.stringify({
+    status,
+    pid: process.pid,
+    started_at: WATCHER_STARTED_AT,
+    last_heartbeat_at: new Date().toISOString(),
+    instance_id: WATCHER_INSTANCE_ID,
+    launcher_pid: WATCHER_LAUNCHER_PID,
+    consecutive_failures: consecutiveTickFailures,
+    last_error: lastError ? lastError.slice(0, 500) : null,
+    heartbeat_source: "independent_interval",
+    tick_running: tickRunning,
+    tick_started_at: tickStartedAt,
+    last_tick_completed_at: lastTickCompletedAt,
+    active_task_id: activeTaskId,
+    active_task_phase: activeTaskPhase,
+  }, null, 2));
+}
+
+function startWatcherHeartbeatLoop(): ReturnType<typeof setInterval> {
+  const intervalMs = Math.min(2000, Math.max(1000, Math.floor(config.watcherStaleSeconds * 1000 / 3)));
+  const timer = setInterval(() => {
+    try {
+      writeWatcherHeartbeat("running");
+    } catch (error) {
+      logger.warn("[watcher] Independent heartbeat write failed", {
+        error: error instanceof Error ? error.message : String(error),
+      });
+    }
+  }, intervalMs);
+  timer.unref?.();
+  return timer;
+}
+
+// ── Start (only when executed as a script) ─────────────────────────
+//  The bootstrap below has process-wide side effects (mkdir, signal handlers,
+//  polling interval, lock acquisition). Guarding it with a main-module check
+//  keeps `import { acquireWatcherLock }` safe for unit tests — without it,
+//  importing this module would start polling the real tasks dir and register
+//  SIGINT/SIGTERM handlers that interfere with the test runner.
+
+const isMainModule = !!process.argv[1] && pathToFileURL(process.argv[1]).href === import.meta.url;
+
+if (isMainModule) {
+  mkdirSync(dirname(WATCHER_HEARTBEAT_FILE), { recursive: true });
 
-logger.info("[watcher] Started");
-setInterval(tick, POLL_INTERVAL_MS);
+  logger.info(`[watcher] Workspace: ${wsRoot}`);
+  logger.info(`[watcher] Tasks:    ${tasksDir}`);
+  logger.info(`[watcher] Polling every ${POLL_INTERVAL_MS / 1000}s`);
+  logger.info(`[watcher] Press Ctrl+C to stop`);
 
-// Run first tick immediately
-tick();
+  try {
+    acquireWatcherLock(WATCHER_LOCK_FILE);
+  } catch (err) {
+    if (err instanceof WatcherAlreadyRunningError) {
+      logger.error(err.message);
+      process.exit(1);
+    }
+    throw err;
+  }
+
+  logger.info("[watcher] Started");
+  const heartbeatTimer = startWatcherHeartbeatLoop();
+  const scheduledTick = createNonOverlappingRunner(tick, () => {
+    logger.warn("[watcher] Previous tick is still running; skipping overlapping poll");
+  });
+  setInterval(() => { void scheduledTick(); }, POLL_INTERVAL_MS);
 
-// Graceful shutdown
-process.on("SIGINT", () => {
-  logger.info("[watcher] Stopped");
-  process.exit(0);
-});
-process.on("SIGTERM", () => {
-  logger.info("[watcher] Stopped");
-  process.exit(0);
-});
+  // Run first tick immediately
+  void scheduledTick();
+
+  // Graceful shutdown
+  function shutdown(): void {
+    logger.info("[watcher] Stopped");
+    clearInterval(heartbeatTimer);
+    try { releaseWatcherLock(WATCHER_LOCK_FILE); } catch (error) {
+      logger.warn("[watcher] Failed to release watcher lock", {
+        error: error instanceof Error ? error.message : String(error),
+      });
+    }
+    process.exit(0);
+  }
+  process.once("SIGINT", shutdown);
+  process.once("SIGTERM", shutdown);
+}

package/src/security/contentRedaction.ts

@@ -39,13 +39,13 @@ const RULES: RedactionRule[] = [
   {
     category: "credential_assignment",
     reason: "matched credential assignment",
-    pattern: /\b((?:access[_ -]?token|api[_ -]?key|secret|password|credential|token)\s*[:=]\s*)(["']?)([^\s,"'\]}]{8,})(["']?)/gi,
+    pattern: /\b((?:(?:[A-Za-z][A-Za-z0-9]*[_ -])*(?:access[_ -]?token|refresh[_ -]?token|api[_ -]?key|secret(?:[_ -]?access)?[_ -]?key|client[_ -]?secret|private[_ -]?key|secret|password|credential|token))\s*[:=]\s*)(["']?)([^\s,"'\]}]{8,})(["']?)/gi,
     replace: "$1$2[REDACTED]$4",
   },
   {
     category: "known_token_format",
     reason: "matched known token format",
-    pattern: /\b(?:sk|ghp|github_pat)_[A-Za-z0-9_-]{16,}\b/g,
+    pattern: /\b(?:sk-(?:proj-|ant-)?[A-Za-z0-9_-]{16,}|sk_[A-Za-z0-9_-]{16,}|gh[pousr]_[A-Za-z0-9_-]{16,}|github_pat_[A-Za-z0-9_-]{16,}|glpat-[A-Za-z0-9_-]{16,}|xox[baprs]-[A-Za-z0-9-]{16,}|(?:hf|npm)_[A-Za-z0-9_-]{16,}|(?:sk|rk)_live_[A-Za-z0-9_-]{16,}|AKIA[0-9A-Z]{16}|AIza[0-9A-Za-z_-]{35}|eyJ[A-Za-z0-9_-]{10,}\.[A-Za-z0-9_-]{10,}\.[A-Za-z0-9_-]{10,})\b/g,
     replace: "[REDACTED TOKEN]",
   },
 ];

package/src/security/discoveryTokenStore.ts

@@ -12,8 +12,8 @@
 
 import { randomBytes } from "node:crypto";
 import { PatchWardenError } from "../errors.js";
-import type { ToolRisk } from "../tools/toolRegistry.js";
-import type { ToolProfile } from "../tools/toolCatalog.js";
+import type { ToolRisk } from "../tools/catalog/toolRegistry.js";
+import type { ToolProfile } from "../tools/catalog/toolCatalog.js";
 
 // ── 类型定义 ──────────────────────────────────────────────────────
 
@@ -42,6 +42,7 @@ export interface IssueTokenInput {
 // ── 常量 ──────────────────────────────────────────────────────────
 
 const DEFAULT_TTL_MS = 10 * 60 * 1000; // 10 分钟
+export const MAX_ACTIVE_DISCOVERY_TOKENS = 1024;
 
 // ── 模块级 token store（单例，进程内共享） ───────────────────────
 
@@ -62,6 +63,17 @@ function generateTokenId(): string {
   return `dst_${datePart}_${randomPart}`;
 }
 
+function pruneTokenStore(nowMs: number): void {
+  for (const [token, record] of tokenStore) {
+    if (Date.parse(record.expiresAt) <= nowMs) tokenStore.delete(token);
+  }
+  while (tokenStore.size >= MAX_ACTIVE_DISCOVERY_TOKENS) {
+    const oldest = tokenStore.keys().next().value as string | undefined;
+    if (!oldest) break;
+    tokenStore.delete(oldest);
+  }
+}
+
 // ── 公共 API ──────────────────────────────────────────────────────
 
 /**
@@ -69,9 +81,11 @@ function generateTokenId(): string {
  * token id 格式：dst_{YYYYMMDD}_{randomHex12}
  */
 export function issueToken(input: IssueTokenInput): string {
-  const now = new Date();
+  const nowMs = Date.now();
+  pruneTokenStore(nowMs);
+  const now = new Date(nowMs);
   const issuedAt = now.toISOString();
-  const expiresAt = new Date(Date.now() + (input.ttlMs ?? DEFAULT_TTL_MS)).toISOString();
+  const expiresAt = new Date(nowMs + (input.ttlMs ?? DEFAULT_TTL_MS)).toISOString();
   const token = generateTokenId();
 
   const record: DiscoveryTokenRecord = {

package/src/security/loopbackHost.ts

@@ -0,0 +1,19 @@
+import { firstHeaderValue } from "./secretComparison.js";
+
+const LOOPBACK_HOST_RE = /^(127\.0\.0\.1|localhost)(?::([0-9]{1,5}))?$/i;
+
+/** Validate an HTTP Host header for a service bound to IPv4 loopback. */
+export function isTrustedLoopbackHostHeader(
+  value: string | string[] | undefined,
+  expectedPort: number,
+): boolean {
+  const raw = firstHeaderValue(value).trim();
+  const match = LOOPBACK_HOST_RE.exec(raw);
+  if (!match) return false;
+  if (match[2] === undefined) return true;
+  const declaredPort = Number(match[2]);
+  return Number.isInteger(declaredPort)
+    && declaredPort >= 1
+    && declaredPort <= 65_535
+    && declaredPort === expectedPort;
+}

package/src/security/pathGuard.ts

@@ -7,7 +7,7 @@ import {
   resolve,
   sep,
 } from "node:path";
-import { realpathSync } from "node:fs";
+import { lstatSync, readlinkSync, realpathSync } from "node:fs";
 import { PatchWardenError } from "../errors.js";
 
 export function guardPath(
@@ -112,7 +112,7 @@ function realPathOrSelf(value: string): string {
   }
 }
 
-function realPathOrExistingPrefix(candidate: string): string {
+function realPathOrExistingPrefix(candidate: string, seenLinks = new Set<string>()): string {
   const normalized = normalize(candidate);
   const root = parse(normalized).root;
   const suffix: string[] = [];
@@ -121,7 +121,36 @@ function realPathOrExistingPrefix(candidate: string): string {
   while (current && current !== root) {
     try {
       return resolve(realpathSync(current), ...suffix);
-    } catch {
+    } catch (error) {
+      try {
+        const metadata = lstatSync(current);
+        if (metadata.isSymbolicLink()) {
+          const linkKey = process.platform === "win32" ? current.toLowerCase() : current;
+          if (seenLinks.has(linkKey)) {
+            throw new PatchWardenError(
+              "workspace_path_escape",
+              `Symbolic link cycle detected while resolving "${candidate}"`,
+              "Remove the cyclic link and use a path inside the configured workspace.",
+              true,
+              { path: candidate, operation: "path_access", safe_alternative: "Use a non-link path inside workspaceRoot." }
+            );
+          }
+          const nextSeen = new Set(seenLinks);
+          nextSeen.add(linkKey);
+          const linkTarget = readlinkSync(current);
+          const resolvedTarget = isAbsolute(linkTarget)
+            ? resolve(linkTarget)
+            : resolve(dirname(current), linkTarget);
+          return resolve(realPathOrExistingPrefix(resolvedTarget, nextSeen), ...suffix);
+        }
+      } catch (linkError) {
+        if (linkError instanceof PatchWardenError) throw linkError;
+        const linkCode = (linkError as NodeJS.ErrnoException).code;
+        if (linkCode !== "ENOENT" && linkCode !== "ENOTDIR") throw linkError;
+      }
+
+      const code = (error as NodeJS.ErrnoException).code;
+      if (code !== "ENOENT" && code !== "ENOTDIR") throw error;
       suffix.unshift(basename(current));
       const parent = dirname(current);
       if (parent === current) break;
@@ -129,11 +158,7 @@ function realPathOrExistingPrefix(candidate: string): string {
     }
   }
 
-  try {
-    return resolve(realpathSync(root || current), ...suffix);
-  } catch {
-    return normalized;
-  }
+  return resolve(realpathSync(root || current), ...suffix);
 }
 
 function assertInside(
@@ -144,16 +169,10 @@ function assertInside(
 ): void {
   const normalizedRoot = normalize(root);
   const normalizedCandidate = normalize(candidate);
-  const checkRoot = process.platform === "win32"
-    ? normalizedRoot.toLowerCase()
-    : normalizedRoot;
-  const checkCandidate = process.platform === "win32"
-    ? normalizedCandidate.toLowerCase()
-    : normalizedCandidate;
 
   if (
-    checkCandidate !== checkRoot &&
-    !checkCandidate.startsWith(checkRoot + sep)
+    normalizedCandidate !== normalizedRoot &&
+    !normalizedCandidate.startsWith(normalizedRoot + sep)
   ) {
     if (message.startsWith("Path escapes workspace")) {
       throw new PatchWardenError(

package/src/security/planGuard.ts

@@ -1,4 +1,5 @@
 import { PatchWardenError } from "../errors.js";
+import { redactSensitiveContent } from "./contentRedaction.js";
 
 interface PlanRule {
   id: string;
@@ -49,7 +50,7 @@ export function guardPlanContent(title: string, content: string): void {
         {
           operation: "save_plan",
           matched_category: rule.category,
-          matched_text: match[0].slice(0, 160),
+          matched_text: redactSensitiveContent(match[0]).content.slice(0, 160),
         }
       );
     }