patchwarden 1.5.1 → 1.6.2

package/src/security/runtimeGuard.ts

@@ -1,6 +1,7 @@
 import { resolve, join, dirname } from "node:path";
 import { fileURLToPath } from "node:url";
 import { PatchWardenError } from "../errors.js";
+import { isPathChildOf, isSamePath } from "../utils/platform.js";
 
 const CRITICAL_RUNTIME_DIRS = ["dist", "src", "scripts", "release"];
 
@@ -10,19 +11,21 @@ const CRITICAL_RUNTIME_DIRS = ["dist", "src", "scripts", "release"];
  * and direct-session flows share the same protection.
  */
 export function guardRuntimeSelfModification(resolvedRepoPath: string): void {
-  const runtimeRoot = resolve(dirname(fileURLToPath(import.meta.url)), "..");
+  // runtimeGuard lives at <package-root>/{src,dist}/security/runtimeGuard.*.
+  const runtimeRoot = resolve(dirname(fileURLToPath(import.meta.url)), "..", "..");
+  const isRuntimeRoot = isSamePath(resolvedRepoPath, runtimeRoot);
   if (
-    resolvedRepoPath === runtimeRoot ||
-    resolvedRepoPath.startsWith(runtimeRoot + resolve("/")[0])
+    isRuntimeRoot ||
+    isPathChildOf(resolvedRepoPath, runtimeRoot)
   ) {
     const isCritical = CRITICAL_RUNTIME_DIRS.some((dir) => {
       const full = join(runtimeRoot, dir);
       return (
-        resolvedRepoPath === full ||
-        resolvedRepoPath.startsWith(full + resolve("/")[0])
+        isSamePath(resolvedRepoPath, full) ||
+        isPathChildOf(resolvedRepoPath, full)
       );
     });
-    if (resolvedRepoPath === runtimeRoot || isCritical) {
+    if (isRuntimeRoot || isCritical) {
       throw new PatchWardenError(
         "runtime_self_modification_blocked",
         `repo_path points to the active PatchWarden runtime or its critical subdirectories.`,

package/src/security/secretComparison.ts

@@ -0,0 +1,13 @@
+import { timingSafeEqual } from "node:crypto";
+
+/** Compare secret text without content-dependent byte comparison. */
+export function timingSafeStringEqual(actual: string, expected: string): boolean {
+  const actualBytes = Buffer.from(actual, "utf-8");
+  const expectedBytes = Buffer.from(expected, "utf-8");
+  return actualBytes.length === expectedBytes.length
+    && timingSafeEqual(actualBytes, expectedBytes);
+}
+
+export function firstHeaderValue(value: string | string[] | undefined): string {
+  return Array.isArray(value) ? (value[0] || "") : (value || "");
+}

package/src/security/sensitiveGuard.ts

@@ -8,22 +8,28 @@ const SENSITIVE_PATTERNS = [
   // Exact filenames
   /(?:^|[\\/])\.env$/i,
   /(?:^|[\\/])\.env\..+$/i,
+  /(?:^|[\\/])\.envrc$/i,
   /(?:^|[\\/])id_rsa$/i,
+  /(?:^|[\\/])id_dsa$/i,
   /(?:^|[\\/])id_ed25519$/i,
   /(?:^|[\\/])id_ecdsa$/i,
   /(?:^|[\\/])\.ssh[\\/]/i,
   // Credentials / tokens
-  /(?:^|[\\/])credentials/i,
+  /(?:^|[\\/])credentials(?:\.(?:txt|json|ya?ml|toml|ini|cfg|db))?$/i,
   /(?:^|[\\/])\.?aws[\\/]credentials/i,
   /(?:^|[\\/])\.netrc$/i,
   /(?:^|[\\/])\.npmrc$/i,
   /(?:^|[\\/])\.pypirc$/i,
-  /(?:^|[\\/])token/i,
+  /(?:^|[\\/])token$/i,
+  /(?:^|[\\/])tokens?\.(?:txt|json|ya?ml|toml|ini|cfg|db)$/i,
+  /(?:^|[\\/])token[-_](?:store|cache|data|secret|auth|credentials|backup|local|prod|production|dev|development)(?:\.[^\\/]+)?$/i,
+  /(?:^|[\\/])(?:access[_-]?token|refresh[_-]?token|api[_-]?key|client[_-]?secret)(?:\.(?:txt|json|ya?ml|ini|cfg))?$/i,
   // Private keys
   /(?:^|[\\/])[^.]+\.pem$/i,
   /(?:^|[\\/])[^.]+\.key$/i,
   /(?:^|[\\/])[^.]+\.pfx$/i,
   /(?:^|[\\/])[^.]+\.p12$/i,
+  /(?:^|[\\/])[^.]+\.ppk$/i,
   // Browser data
   /(?:^|[\\/])cookies/i,
   /(?:^|[\\/])web data$/i,
@@ -31,19 +37,32 @@ const SENSITIVE_PATTERNS = [
   /(?:^|[\\/])local state$/i,
   // Other sensitive files
   /(?:^|[\\/])\.git-credentials$/i,
+  /(?:^|[\\/])\.git[\\/]config$/i,
   /(?:^|[\\/])\.docker[\\/]config\.json$/i,
   /(?:^|[\\/])\.kube[\\/]config$/i,
+  /(?:^|[\\/])kubeconfig$/i,
+  /(?:^|[\\/])application_default_credentials\.json$/i,
+  /(?:^|[\\/])service[-_]?account(?:[-_][^\\/]+)?\.json$/i,
   /(?:^|[\\/])config\.json$/i, // generic config files often contain local tokens or service credentials
 ];
 
-// Files specifically inside .patchwarden are always allowed
-const SAFE_PREFIX = ".patchwarden";
+/**
+ * Detect a Windows NTFS alternate data stream suffix. The colon in an
+ * absolute drive prefix (for example, C:\\) is the only permitted colon.
+ */
+export function hasWindowsAlternateDataStream(filePath: string): boolean {
+  const withoutDrivePrefix = /^[A-Za-z]:[\\/]/.test(filePath)
+    ? filePath.slice(2)
+    : filePath;
+  return withoutDrivePrefix.includes(":");
+}
 
 export function isSensitivePath(filePath: string): boolean {
-  // Files inside .patchwarden are always safe
-  const normalized = filePath.replace(/\\/g, "/");
-  if (normalized.includes(`${SAFE_PREFIX}/`) || normalized.endsWith(SAFE_PREFIX)) {
-    return false;
+  if (filePath.includes("\0")) return true;
+
+  // ADS can hide content behind an otherwise safe-looking filename.
+  if (hasWindowsAlternateDataStream(filePath)) {
+    return true;
   }
 
   for (const pattern of SENSITIVE_PATTERNS) {

package/src/security/toolInvocationGuard.ts

@@ -17,8 +17,8 @@
 
 import { PatchWardenError } from "../errors.js";
 import { guardSensitivePath } from "./sensitiveGuard.js";
-import { TOOL_RISK_RANK, type PatchWardenToolMeta } from "../tools/toolRegistry.js";
-import type { ToolProfile } from "../tools/toolCatalog.js";
+import { TOOL_RISK_RANK, type PatchWardenToolMeta } from "../tools/catalog/toolRegistry.js";
+import type { ToolProfile } from "../tools/catalog/toolCatalog.js";
 import type { DiscoveryTokenRecord } from "./discoveryTokenStore.js";
 
 // ── 类型定义 ──────────────────────────────────────────────────────

package/src/security/workspaceRootGuard.ts

@@ -0,0 +1,53 @@
+import { existsSync, realpathSync, statSync } from "node:fs";
+import { homedir } from "node:os";
+import { basename, normalize, resolve, win32 } from "node:path";
+
+export interface WorkspaceRootValidation {
+  ok: boolean;
+  path: string;
+  reason: string | null;
+  category: "valid" | "missing" | "not_directory" | "unsafe_root";
+}
+
+function normalizeInput(value: string): string {
+  return /^[a-z]:[\\/]/i.test(value) ? win32.normalize(value) : normalize(resolve(value));
+}
+
+function comparable(value: string): string {
+  return normalizeInput(value).replace(/[\\/]+$/, "").toLowerCase();
+}
+
+export function unsafeWorkspaceRootLabel(value: string, userHome = homedir()): string | null {
+  const resolved = normalizeInput(value);
+  const trimmed = resolved.replace(/[\\/]+$/, "");
+  const windowsStyle = /^[a-z]:[\\/]/i.test(value) || /^\\\\/.test(value);
+  const leaf = (windowsStyle ? win32.basename(trimmed) : basename(trimmed)).toLowerCase();
+
+  if (/^[a-z]:$/i.test(trimmed) || trimmed === "" || trimmed === "/") return "drive root";
+  if (comparable(trimmed) === comparable(userHome)) return "user home directory";
+  if (leaf === "desktop") return "Desktop";
+  if (leaf === "downloads") return "Downloads";
+  if (leaf === "documents") return "Documents";
+  return null;
+}
+
+export function validateWorkspaceRoot(value: string, userHome = homedir()): WorkspaceRootValidation {
+  const lexicalPath = normalize(resolve(value || "."));
+  if (!existsSync(lexicalPath)) {
+    return { ok: false, path: lexicalPath, reason: "workspaceRoot does not exist", category: "missing" };
+  }
+  let resolved: string;
+  try {
+    resolved = normalize(realpathSync(lexicalPath));
+    if (!statSync(resolved).isDirectory()) {
+      return { ok: false, path: resolved, reason: "workspaceRoot is not a directory", category: "not_directory" };
+    }
+  } catch {
+    return { ok: false, path: lexicalPath, reason: "workspaceRoot is not accessible", category: "not_directory" };
+  }
+  const unsafeLabel = unsafeWorkspaceRootLabel(resolved, userHome);
+  if (unsafeLabel) {
+    return { ok: false, path: resolved, reason: `workspaceRoot cannot be ${unsafeLabel}`, category: "unsafe_root" };
+  }
+  return { ok: true, path: resolved, reason: null, category: "valid" };
+}

package/src/smoke-test.ts

@@ -27,22 +27,22 @@ import { tmpdir } from "node:os";
 import { fileURLToPath } from "node:url";
 import { spawnSync } from "node:child_process";
 import { loadConfig, getConfig, getTasksDir, reloadConfig } from "./config.js";
-import { savePlan } from "./tools/savePlan.js";
-import { getPlan } from "./tools/getPlan.js";
-import { createTask } from "./tools/createTask.js";
-import type { CreateTaskOutput, AssessOnlyOutput } from "./tools/createTask.js";
+import { savePlan } from "./tools/goals/savePlan.js";
+import { getPlan } from "./tools/goals/getPlan.js";
+import { createTask } from "./tools/tasks/createTask.js";
+import type { CreateTaskOutput, AssessOnlyOutput } from "./tools/tasks/createTask.js";
 import { confirmAssessment, readAssessment, computeWorkspaceFingerprint, createAssessment, type AssessmentRecord } from "./assessments/assessmentStore.js";
 import { captureRepoSnapshot } from "./runner/changeCapture.js";
-import { getTaskStatus } from "./tools/getTaskStatus.js";
-import { getResult, getDiff, getTestLog } from "./tools/taskOutputs.js";
-import { listWorkspace } from "./tools/listWorkspace.js";
-import { readWorkspaceFile } from "./tools/readWorkspaceFile.js";
-import { listTasks } from "./tools/listTasks.js";
-import { cancelTask } from "./tools/cancelTask.js";
-import { retryTask } from "./tools/retryTask.js";
-import { getTaskStdoutTail } from "./tools/getTaskStdoutTail.js";
-import { auditTask } from "./tools/auditTask.js";
-import { getTaskSummary } from "./tools/getTaskSummary.js";
+import { getTaskStatus } from "./tools/tasks/getTaskStatus.js";
+import { getResult, getDiff, getTestLog } from "./tools/tasks/taskOutputs.js";
+import { listWorkspace } from "./tools/workspace/listWorkspace.js";
+import { readWorkspaceFile } from "./tools/workspace/readWorkspaceFile.js";
+import { listTasks } from "./tools/tasks/listTasks.js";
+import { cancelTask } from "./tools/tasks/cancelTask.js";
+import { retryTask } from "./tools/tasks/retryTask.js";
+import { getTaskStdoutTail } from "./tools/tasks/getTaskStdoutTail.js";
+import { auditTask } from "./tools/diagnostics/auditTask.js";
+import { getTaskSummary } from "./tools/tasks/getTaskSummary.js";
 import { guardAgentCommand } from "./security/commandGuard.js";
 import { getToolDefs } from "./tools/registry.js";
 import {
@@ -50,15 +50,15 @@ import {
   CHATGPT_CORE_TOOL_NAMES,
   CHATGPT_DIRECT_TOOL_NAMES,
   selectToolsForProfile,
-} from "./tools/toolCatalog.js";
+} from "./tools/catalog/toolCatalog.js";
 import { errorPayload } from "./errors.js";
 import { readWatcherStatus } from "./watcherStatus.js";
-import { createDirectSession } from "./tools/createDirectSession.js";
-import { searchWorkspace } from "./tools/searchWorkspace.js";
-import { applyPatch } from "./tools/applyPatch.js";
-import { runVerification } from "./tools/runVerification.js";
-import { finalizeDirectSession } from "./tools/finalizeDirectSession.js";
-import { auditSession } from "./tools/auditSession.js";
+import { createDirectSession } from "./tools/direct/createDirectSession.js";
+import { searchWorkspace } from "./tools/workspace/searchWorkspace.js";
+import { applyPatch } from "./tools/workspace/applyPatch.js";
+import { runVerification } from "./tools/tasks/runVerification.js";
+import { finalizeDirectSession } from "./tools/direct/finalizeDirectSession.js";
+import { auditSession } from "./tools/diagnostics/auditSession.js";
 import { readDirectSession, updateDirectSession } from "./direct/directSessionStore.js";
 import { createHash } from "node:crypto";
 
@@ -463,6 +463,8 @@ const sensitiveFiles = [
   "cookies.sqlite",
   ".git-credentials",
   "config.json",
+  ".patchwarden/.env",
+  ".patchwarden/credentials.json",
 ];
 
 for (const sf of sensitiveFiles) {
@@ -471,9 +473,8 @@ for (const sf of sensitiveFiles) {
   });
 }
 
-// Files inside .patchwarden should always be allowed
-await test("C. readWorkspaceFile allows .patchwarden/plans/...", () => {
-  // This should work because .patchwarden files are whitelisted
+// Ordinary PatchWarden artifacts remain readable through their dedicated tool.
+await test("C. getPlan reads ordinary .patchwarden/plans artifacts", () => {
   const plan = savePlan({ title: "Allowlist Test", content: "test" });
   const result = getPlan({ plan_id: plan.plan_id });
   if (!result.content.includes("test")) throw new Error("Should allow .patchwarden reads");
@@ -1337,7 +1338,7 @@ await test("K8. assessment not found rejected", async () => {
       agent: "codex",
       repo_path: ".",
       execution_mode: "execute",
-      assessment_id: "assessment_20260101_" + "0".repeat(32),
+      assessment_id: "assessment_20260101_000000_" + "0".repeat(32),
     });
     throw new Error("Should have rejected unknown assessment");
   } catch (e: any) {
@@ -1568,7 +1569,7 @@ await test("K16. assessment_short_id cannot execute", async () => {
     });
     throw new Error("Should have rejected short ID");
   } catch (e: any) {
-    if (!e.message?.includes("not found")) throw new Error(`Expected not found for short ID, got: ${e.message}`);
+    if (e.reason !== "assessment_id_invalid") throw new Error(`Expected assessment_id_invalid for short ID, got: ${e.reason || e.message}`);
   }
 });
 

package/src/tools/catalog/index.ts

@@ -0,0 +1,4 @@
+export * from "./toolCatalog.js";
+export * from "./toolRegistry.js";
+export * from "./toolSearch.js";
+export * from "./toolUsageStats.js";

package/src/tools/{toolCatalog.ts → catalog/toolCatalog.ts}

@@ -1,5 +1,6 @@
 import { createHash } from "node:crypto";
-import { PATCHWARDEN_VERSION, TOOL_SCHEMA_EPOCH } from "../version.js";
+import { PATCHWARDEN_VERSION, TOOL_SCHEMA_EPOCH } from "../../version.js";
+import { stableJsonStringify } from "../../utils/stableJson.js";
 
 export type ToolProfile = "full" | "chatgpt_core" | "chatgpt_direct" | "chatgpt_search";
 
@@ -124,7 +125,7 @@ export function buildToolCatalogSnapshot(tools: CatalogTool[], profile: ToolProf
     inputSchema: tool.inputSchema,
   }));
   const tool_manifest_sha256 = createHash("sha256")
-    .update(stableJson(manifestInput))
+    .update(stableJsonStringify(manifestInput))
     .digest("hex");
   lastSnapshot = {
     server_version: PATCHWARDEN_VERSION,
@@ -140,13 +141,3 @@ export function buildToolCatalogSnapshot(tools: CatalogTool[], profile: ToolProf
 export function getLastToolCatalogSnapshot(): ToolCatalogSnapshot | null {
   return lastSnapshot ? { ...lastSnapshot, tool_names: [...lastSnapshot.tool_names] } : null;
 }
-
-function stableJson(value: unknown): string {
-  if (Array.isArray(value)) return `[${value.map(stableJson).join(",")}]`;
-  if (value && typeof value === "object") {
-    const entries = Object.entries(value as Record<string, unknown>)
-      .sort(([left], [right]) => left.localeCompare(right));
-    return `{${entries.map(([key, entry]) => `${JSON.stringify(key)}:${stableJson(entry)}`).join(",")}}`;
-  }
-  return JSON.stringify(value);
-}

package/src/tools/{toolRegistry.ts → catalog/toolRegistry.ts}

@@ -7,8 +7,9 @@
  */
 
 import { createHash } from "node:crypto";
+import { stableJsonStringify } from "../../utils/stableJson.js";
 import type { ToolProfile } from "./toolCatalog.js";
-import type { ToolDef } from "./registry.js";
+import type { ToolDef } from "../definitions/toolDefs.js";
 
 // ── 风险分级 ──────────────────────────────────────────────────────
 
@@ -109,7 +110,7 @@ const STATIC_TOOL_META: Record<string, StaticToolMeta> = {
     summary: "列出已配置的本地 agent 及其可用性",
     profiles: ["full", "chatgpt_core"],
     modes: ["delegate", "diagnostic"],
-    tags: ["agent", "list", "config", "codex", "opencode"],
+    tags: ["agent", "list", "config", "local-cli", "model"],
     aliases: ["agents", "list_agent"],
     risk: "readonly",
     requiresConfirmation: false,
@@ -254,7 +255,7 @@ const STATIC_TOOL_META: Record<string, StaticToolMeta> = {
     modes: ["delegate", "audit"],
     tags: ["safe", "audit", "checks", "acceptance", "task"],
     aliases: ["safe_audit", "audit_summary"],
-    risk: "readonly",
+    risk: "workspace_write",
     requiresConfirmation: false,
     relatedTools: ["audit_task", "safe_result"],
   },
@@ -601,7 +602,7 @@ const STATIC_TOOL_META: Record<string, StaticToolMeta> = {
     modes: ["direct", "audit"],
     tags: ["safe", "direct", "finalize", "summary"],
     aliases: ["safe_finalize", "finalize_summary"],
-    risk: "readonly",
+    risk: "workspace_write",
     requiresConfirmation: false,
     relatedTools: ["finalize_direct_session", "safe_direct_summary"],
   },
@@ -612,7 +613,7 @@ const STATIC_TOOL_META: Record<string, StaticToolMeta> = {
     modes: ["direct", "audit"],
     tags: ["safe", "direct", "audit", "session"],
     aliases: ["safe_direct_audit", "audit_direct_summary"],
-    risk: "readonly",
+    risk: "workspace_write",
     requiresConfirmation: false,
     relatedTools: ["audit_session", "safe_finalize_direct_session"],
   },
@@ -857,17 +858,7 @@ const STATIC_TOOL_META: Record<string, StaticToolMeta> = {
 /**
  * 稳定 JSON 序列化：按字段名排序，避免 key 顺序导致 digest 漂移。
  */
-export function stableJsonStringify(value: unknown): string {
-  if (Array.isArray(value)) {
-    return `[${value.map(stableJsonStringify).join(",")}]`;
-  }
-  if (value !== null && typeof value === "object") {
-    const entries = Object.entries(value as Record<string, unknown>)
-      .sort(([left], [right]) => left.localeCompare(right));
-    return `{${entries.map(([key, entry]) => `${JSON.stringify(key)}:${stableJsonStringify(entry)}`).join(",")}}`;
-  }
-  return JSON.stringify(value);
-}
+export { stableJsonStringify };
 
 /**
  * 计算 inputSchema 的 sha256 digest。