patchwarden 1.5.1 → 1.6.2

package/dist/test/unit/audit-checks.test.js

@@ -1,350 +0,0 @@
-import { describe, it, beforeEach, afterEach } from "node:test";
-import { strict as assert } from "node:assert";
-import { mkdirSync, mkdtempSync, rmSync, writeFileSync } from "node:fs";
-import { join } from "node:path";
-import { tmpdir } from "node:os";
-import { checkForbiddenScope, checkDoneEvidenceMissing, checkReadmeChangelogSync, checkPackageManifestConsistency, checkSensitivePathAccess, checkUnrecordedCommandExecution, } from "../../tools/auditTask.js";
-// ── Helpers ───────────────────────────────────────────────────────
-function makeChangedFile(path, change = "modified", oldPath) {
-    return {
-        path,
-        change,
-        old_path: oldPath,
-        before_sha256: null,
-        after_sha256: null,
-        tracked: true,
-        ignored: false,
-        kind: "source",
-    };
-}
-describe("auditTask new checks", () => {
-    let tempDir;
-    beforeEach(() => {
-        tempDir = mkdtempSync(join(tmpdir(), "pw-audit-checks-"));
-    });
-    afterEach(() => {
-        rmSync(tempDir, { recursive: true, force: true });
-    });
-    // ── 1. checkForbiddenScope ──────────────────────────────────────
-    describe("checkForbiddenScope", () => {
-        it("returns null when forbidden is null (skip)", () => {
-            const result = checkForbiddenScope([makeChangedFile("src/index.ts")], null);
-            assert.equal(result, null);
-        });
-        it("returns null when forbidden is empty array (skip)", () => {
-            const result = checkForbiddenScope([makeChangedFile("src/index.ts")], []);
-            assert.equal(result, null);
-        });
-        it("returns pass when changedFiles is empty", () => {
-            const result = checkForbiddenScope([], ["src/security/**"]);
-            assert.notEqual(result, null);
-            assert.equal(result.result, "pass");
-            assert.equal(result.name, "forbidden_scope_violation");
-        });
-        it("returns pass when no changed file matches forbidden patterns", () => {
-            const result = checkForbiddenScope([makeChangedFile("src/tools/auditTask.ts")], ["src/security/**"]);
-            assert.equal(result.result, "pass");
-        });
-        it("returns fail when a changed file matches a ** glob (src/security/** matches src/security/pathGuard.ts)", () => {
-            const result = checkForbiddenScope([makeChangedFile("src/security/pathGuard.ts")], ["src/security/**"]);
-            assert.equal(result.result, "fail");
-            assert.ok(result.detail.includes("src/security/pathGuard.ts"));
-            assert.ok(result.detail.includes("forbidden paths"));
-        });
-        it("returns fail for src/tools/* matching src/tools/auditTask.ts (single segment)", () => {
-            const result = checkForbiddenScope([makeChangedFile("src/tools/auditTask.ts")], ["src/tools/*"]);
-            assert.equal(result.result, "fail");
-        });
-        it("returns fail for src/tools/** matching src/tools/auditTask.ts", () => {
-            const result = checkForbiddenScope([makeChangedFile("src/tools/auditTask.ts")], ["src/tools/**"]);
-            assert.equal(result.result, "fail");
-        });
-        it("single * does NOT match nested path (src/tools/* does not match src/tools/sub/file.ts)", () => {
-            const result = checkForbiddenScope([makeChangedFile("src/tools/sub/file.ts")], ["src/tools/*"]);
-            assert.equal(result.result, "pass");
-        });
-        it("checks old_path for renamed files", () => {
-            const result = checkForbiddenScope([makeChangedFile("src/new-path.ts", "renamed", "src/secret/old.ts")], ["src/secret/**"]);
-            assert.equal(result.result, "fail");
-            assert.ok(result.detail.includes("src/secret/old.ts"));
-        });
-        it("handles backslash path separators", () => {
-            const result = checkForbiddenScope([makeChangedFile("src\\security\\pathGuard.ts")], ["src/security/**"]);
-            assert.equal(result.result, "fail");
-        });
-        it("deduplicates hit paths in detail", () => {
-            const result = checkForbiddenScope([makeChangedFile("src/secret/a.ts"), makeChangedFile("src/secret/a.ts")], ["src/secret/**"]);
-            const occurrences = result.detail.split("src/secret/a.ts").length - 1;
-            assert.equal(occurrences, 1, "path should appear only once");
-        });
-    });
-    // ── 2. checkDoneEvidenceMissing ─────────────────────────────────
-    describe("checkDoneEvidenceMissing", () => {
-        it("returns null when doneEvidence is null (skip)", () => {
-            const result = checkDoneEvidenceMissing(tempDir, null);
-            assert.equal(result, null);
-        });
-        it("returns null when doneEvidence is empty (skip)", () => {
-            const result = checkDoneEvidenceMissing(tempDir, []);
-            assert.equal(result, null);
-        });
-        it("returns pass when all evidence files exist", () => {
-            writeFileSync(join(tempDir, "result.md"), "# Result", "utf-8");
-            writeFileSync(join(tempDir, "test.log"), "ok", "utf-8");
-            const result = checkDoneEvidenceMissing(tempDir, ["result.md", "test.log"]);
-            assert.equal(result.result, "pass");
-            assert.equal(result.name, "done_evidence_missing");
-            assert.ok(result.detail.includes("present"));
-        });
-        it("returns warn when some evidence files are missing", () => {
-            writeFileSync(join(tempDir, "result.md"), "# Result", "utf-8");
-            const result = checkDoneEvidenceMissing(tempDir, ["result.md", "test.log", "git.diff"]);
-            assert.equal(result.result, "warn");
-            assert.ok(result.detail.includes("test.log"));
-            assert.ok(result.detail.includes("git.diff"));
-            assert.ok(!result.detail.includes("result.md"));
-        });
-        it("returns warn when all evidence files are missing", () => {
-            const result = checkDoneEvidenceMissing(tempDir, ["result.md", "test.log"]);
-            assert.equal(result.result, "warn");
-            assert.ok(result.detail.includes("result.md"));
-            assert.ok(result.detail.includes("test.log"));
-        });
-    });
-    // ── 3. checkReadmeChangelogSync ─────────────────────────────────
-    describe("checkReadmeChangelogSync", () => {
-        it("returns null when no code files changed (skip)", () => {
-            const result = checkReadmeChangelogSync([
-                makeChangedFile("README.md"),
-                makeChangedFile("docs/guide.md"),
-            ]);
-            assert.equal(result, null);
-        });
-        it("returns null when changedFiles is empty (skip)", () => {
-            const result = checkReadmeChangelogSync([]);
-            assert.equal(result, null);
-        });
-        it("returns warn when code changed but no README/CHANGELOG updated", () => {
-            const result = checkReadmeChangelogSync([
-                makeChangedFile("src/index.ts"),
-                makeChangedFile("src/tools/auditTask.ts"),
-            ]);
-            assert.equal(result.result, "warn");
-            assert.equal(result.name, "readme_changelog_sync");
-            assert.ok(result.detail.includes("not updated"));
-        });
-        it("returns pass when README.md is also changed", () => {
-            const result = checkReadmeChangelogSync([
-                makeChangedFile("src/index.ts"),
-                makeChangedFile("README.md"),
-            ]);
-            assert.equal(result.result, "pass");
-        });
-        it("returns pass when CHANGELOG.md is also changed", () => {
-            const result = checkReadmeChangelogSync([
-                makeChangedFile("src/index.ts"),
-                makeChangedFile("CHANGELOG.md"),
-            ]);
-            assert.equal(result.result, "pass");
-        });
-        it("is case-insensitive for README.md basename", () => {
-            const result = checkReadmeChangelogSync([
-                makeChangedFile("src/index.ts"),
-                makeChangedFile("docs/Readme.md"),
-            ]);
-            assert.equal(result.result, "pass");
-        });
-        it("detects code files by various extensions", () => {
-            const extensions = [".ts", ".js", ".py", ".go", ".rs", ".java"];
-            for (const ext of extensions) {
-                const result = checkReadmeChangelogSync([makeChangedFile(`src/file${ext}`)]);
-                assert.equal(result.result, "warn", `extension ${ext} should be detected as code`);
-            }
-        });
-        it("does not treat .md as code", () => {
-            const result = checkReadmeChangelogSync([makeChangedFile("docs/guide.md")]);
-            assert.equal(result, null);
-        });
-    });
-    // ── 4. checkPackageManifestConsistency ──────────────────────────
-    describe("checkPackageManifestConsistency", () => {
-        it("returns null when package.json is not in changed files (skip)", () => {
-            const result = checkPackageManifestConsistency([makeChangedFile("src/index.ts")], tempDir);
-            assert.equal(result, null);
-        });
-        it("returns pass when package.json has valid name and version", () => {
-            writeFileSync(join(tempDir, "package.json"), JSON.stringify({ name: "patchwarden", version: "0.7.2" }), "utf-8");
-            const result = checkPackageManifestConsistency([makeChangedFile("package.json")], tempDir);
-            assert.equal(result.result, "pass");
-            assert.equal(result.name, "package_manifest_consistency");
-        });
-        it("returns warn when package.json is missing version field", () => {
-            writeFileSync(join(tempDir, "package.json"), JSON.stringify({ name: "patchwarden" }), "utf-8");
-            const result = checkPackageManifestConsistency([makeChangedFile("package.json")], tempDir);
-            assert.equal(result.result, "warn");
-        });
-        it("returns warn when package.json is missing name field", () => {
-            writeFileSync(join(tempDir, "package.json"), JSON.stringify({ version: "0.7.2" }), "utf-8");
-            const result = checkPackageManifestConsistency([makeChangedFile("package.json")], tempDir);
-            assert.equal(result.result, "warn");
-        });
-        it("returns warn when package.json is invalid JSON", () => {
-            writeFileSync(join(tempDir, "package.json"), "{ not valid json", "utf-8");
-            const result = checkPackageManifestConsistency([makeChangedFile("package.json")], tempDir);
-            assert.equal(result.result, "warn");
-        });
-        it("returns warn when package.json does not exist on disk", () => {
-            const result = checkPackageManifestConsistency([makeChangedFile("package.json")], tempDir);
-            assert.equal(result.result, "warn");
-        });
-        it("detects package.json case-insensitively by basename", () => {
-            writeFileSync(join(tempDir, "package.json"), JSON.stringify({ name: "x", version: "1.0.0" }), "utf-8");
-            const result = checkPackageManifestConsistency([makeChangedFile("subdir/Package.json")], tempDir);
-            assert.equal(result.result, "pass");
-        });
-        it("returns warn when name/version are empty strings", () => {
-            writeFileSync(join(tempDir, "package.json"), JSON.stringify({ name: "", version: "" }), "utf-8");
-            const result = checkPackageManifestConsistency([makeChangedFile("package.json")], tempDir);
-            assert.equal(result.result, "warn");
-        });
-    });
-    // ── 5. checkSensitivePathAccess ─────────────────────────────────
-    describe("checkSensitivePathAccess", () => {
-        it("returns null when changedFiles is empty (skip)", () => {
-            const result = checkSensitivePathAccess([]);
-            assert.equal(result, null);
-        });
-        it("returns pass when no sensitive paths are accessed", () => {
-            const result = checkSensitivePathAccess([
-                makeChangedFile("src/index.ts"),
-                makeChangedFile("README.md"),
-            ]);
-            assert.equal(result.result, "pass");
-            assert.equal(result.name, "sensitive_path_access");
-            assert.ok(result.detail.includes("No sensitive"));
-        });
-        it("returns fail when .env is accessed", () => {
-            const result = checkSensitivePathAccess([makeChangedFile(".env")]);
-            assert.equal(result.result, "fail");
-            assert.ok(result.detail.includes(".env"));
-        });
-        it("returns fail when id_rsa is accessed", () => {
-            const result = checkSensitivePathAccess([makeChangedFile("id_rsa")]);
-            assert.equal(result.result, "fail");
-        });
-        it("returns fail when credentials.json is accessed", () => {
-            const result = checkSensitivePathAccess([makeChangedFile("credentials.json")]);
-            assert.equal(result.result, "fail");
-        });
-        it("returns fail when a sensitive path is in a subdirectory", () => {
-            const result = checkSensitivePathAccess([
-                makeChangedFile("src/index.ts"),
-                makeChangedFile("config/secrets.pem"),
-            ]);
-            assert.equal(result.result, "fail");
-            assert.ok(result.detail.includes("config/secrets.pem"));
-        });
-        it("returns fail when old_path of a renamed file is sensitive", () => {
-            const result = checkSensitivePathAccess([
-                makeChangedFile("src/new-location.ts", "renamed", ".env"),
-            ]);
-            assert.equal(result.result, "fail");
-            assert.ok(result.detail.includes(".env"));
-        });
-        it("returns pass for src/index.ts (non-sensitive)", () => {
-            const result = checkSensitivePathAccess([makeChangedFile("src/index.ts")]);
-            assert.equal(result.result, "pass");
-        });
-        it("deduplicates hit paths in detail", () => {
-            const result = checkSensitivePathAccess([
-                makeChangedFile(".env"),
-                makeChangedFile(".env"),
-            ]);
-            const occurrences = result.detail.split(".env").length - 1;
-            assert.equal(occurrences, 1, "path should appear only once");
-        });
-    });
-    // ── 6. checkUnrecordedCommandExecution ──────────────────────────
-    describe("checkUnrecordedCommandExecution", () => {
-        it("returns null when both contents are null (skip)", () => {
-            const result = checkUnrecordedCommandExecution(null, null, [], null);
-            assert.equal(result, null);
-        });
-        it("returns null when both contents are empty strings (skip)", () => {
-            const result = checkUnrecordedCommandExecution("", "", [], null);
-            assert.equal(result, null);
-        });
-        it("returns pass when test log command is in whitelist (npm test)", () => {
-            const result = checkUnrecordedCommandExecution("Running npm test\nExit code: 0", null, [], "npm test");
-            assert.equal(result.result, "pass");
-            assert.equal(result.name, "unrecorded_command_execution");
-            assert.ok(result.detail.includes("whitelist"));
-        });
-        it("returns warn when npm run build is not in whitelist", () => {
-            const result = checkUnrecordedCommandExecution("Running npm run build\nDone", null, [], null);
-            assert.equal(result.result, "warn");
-            assert.ok(result.detail.includes("build"));
-        });
-        it("returns pass when npm run build IS in whitelist (via verify_commands)", () => {
-            const result = checkUnrecordedCommandExecution("Running npm run build\nDone", null, ["npm run build"], null);
-            assert.equal(result.result, "pass");
-        });
-        it("returns pass when npm run build IS in whitelist (via test_command)", () => {
-            const result = checkUnrecordedCommandExecution("Running npm run build\nDone", null, [], "npm run build");
-            assert.equal(result.result, "pass");
-        });
-        it("scans result.md content as well as test.log", () => {
-            const result = checkUnrecordedCommandExecution(null, "I ran npm run deploy to publish", ["npm test"], "npm test");
-            assert.equal(result.result, "warn");
-            assert.ok(result.detail.includes("deploy"));
-        });
-        it("handles npm.cmd variant", () => {
-            const result = checkUnrecordedCommandExecution("npm.cmd run build\nDone", null, [], null);
-            assert.equal(result.result, "warn");
-            assert.ok(result.detail.includes("build"));
-        });
-        it("handles npx commands", () => {
-            const result = checkUnrecordedCommandExecution("npx eslint src/\nDone", null, [], null);
-            assert.equal(result.result, "warn");
-            assert.ok(result.detail.includes("eslint"));
-        });
-        it("handles node commands", () => {
-            const result = checkUnrecordedCommandExecution("node ./scripts/check.js\nDone", null, [], null);
-            assert.equal(result.result, "warn");
-            assert.ok(result.detail.includes("scripts/check.js"));
-        });
-        it("returns pass when whitelist contains all discovered commands", () => {
-            const log = "npm run build && npm test && npx tsc";
-            const result = checkUnrecordedCommandExecution(log, null, ["npm run build", "npx tsc"], "npm test");
-            assert.equal(result.result, "pass");
-        });
-        it("recognizes commands reached transitively through npm scripts and local verifier files", () => {
-            mkdirSync(join(tempDir, "scripts"), { recursive: true });
-            writeFileSync(join(tempDir, "package.json"), JSON.stringify({
-                scripts: {
-                    test: "node scripts/verify-all.js",
-                    build: "node scripts/build.js",
-                    check: "node scripts/check.js",
-                },
-            }), "utf-8");
-            writeFileSync(join(tempDir, "scripts", "verify-all.js"), "npm run build\nnpm run check\n", "utf-8");
-            const result = checkUnrecordedCommandExecution("npm test\nnode scripts/verify-all.js\nnpm run build\nnpm run check\n", null, [], "npm test", tempDir);
-            assert.equal(result.result, "pass");
-            assert.ok(result.detail.includes("transitive_verified_command"));
-        });
-        it("fails high-risk publication commands even when they look intentional", () => {
-            const result = checkUnrecordedCommandExecution("npm publish --access public\n", null, ["npm publish --access public"], null, tempDir);
-            assert.equal(result.result, "fail");
-            assert.ok(result.detail.includes("High-risk"));
-        });
-        it("returns pass when there are no commands in the log", () => {
-            const result = checkUnrecordedCommandExecution("No commands here, just text.\nExit code: 0", null, [], null);
-            assert.equal(result.result, "pass");
-        });
-        it("deduplicates unrecorded commands in detail", () => {
-            const result = checkUnrecordedCommandExecution("npm run build && npm run build && npm run build", null, [], null);
-            const occurrences = result.detail.split("build").length - 1;
-            assert.equal(occurrences, 1, "command should appear only once");
-        });
-    });
-});

package/dist/test/unit/chinese-path.test.d.ts

@@ -1 +0,0 @@
-export {};

package/dist/test/unit/chinese-path.test.js

@@ -1,91 +0,0 @@
-import { describe, it, beforeEach, afterEach } from "node:test";
-import { strict as assert } from "node:assert";
-import { mkdtempSync, rmSync, mkdirSync, writeFileSync, readFileSync, existsSync } from "node:fs";
-import { join, resolve } from "node:path";
-import { tmpdir } from "node:os";
-describe("Chinese path handling", () => {
-    let tempDir;
-    beforeEach(() => {
-        tempDir = mkdtempSync(join(tmpdir(), "pw-chinese-"));
-    });
-    afterEach(() => {
-        rmSync(tempDir, { recursive: true, force: true });
-    });
-    it("writes and reads status.json with Chinese repo_path", () => {
-        const chinesePath = "念念小伴_release";
-        const status = {
-            task_id: "test-001",
-            status: "pending",
-            repo_path: chinesePath,
-            resolved_repo_path: resolve(tempDir, chinesePath),
-        };
-        const statusFile = join(tempDir, "status.json");
-        writeFileSync(statusFile, JSON.stringify(status, null, 2), "utf-8");
-        const raw = readFileSync(statusFile, "utf-8");
-        const parsed = JSON.parse(raw);
-        assert.equal(parsed.repo_path, chinesePath);
-        assert.equal(parsed.resolved_repo_path, resolve(tempDir, chinesePath));
-    });
-    it("preserves Chinese characters through JSON stringify/parse", () => {
-        const testPaths = [
-            "念念小伴_release",
-            "测试项目",
-            "项目目录/子目录",
-            "日本語プロジェクト",
-            "한국어_프로젝트",
-        ];
-        for (const path of testPaths) {
-            const json = JSON.stringify({ repo_path: path });
-            const parsed = JSON.parse(json);
-            assert.equal(parsed.repo_path, path, `Path "${path}" was corrupted`);
-        }
-    });
-    it("creates and reads directories with Chinese names", () => {
-        const chineseDir = join(tempDir, "念念小伴_release");
-        mkdirSync(chineseDir, { recursive: true });
-        assert.ok(existsSync(chineseDir));
-        const filePath = join(chineseDir, "status.json");
-        const data = { repo_path: "念念小伴_release", status: "running" };
-        writeFileSync(filePath, JSON.stringify(data, null, 2), "utf-8");
-        const raw = readFileSync(filePath, "utf-8");
-        const parsed = JSON.parse(raw);
-        assert.equal(parsed.repo_path, "念念小伴_release");
-    });
-    it("handles Chinese characters in result.md", () => {
-        const resultMd = [
-            "# PatchWarden Task Result",
-            "",
-            "## Status",
-            "done",
-            "",
-            "## Files changed",
-            "- modified: 念念小伴_release/src/main.ts",
-            "- added: 测试项目/config.json",
-            "",
-        ].join("\n");
-        const resultFile = join(tempDir, "result.md");
-        writeFileSync(resultFile, resultMd, "utf-8");
-        const content = readFileSync(resultFile, "utf-8");
-        assert.ok(content.includes("念念小伴_release"));
-        assert.ok(content.includes("测试项目"));
-    });
-    it("handles mixed Chinese and ASCII paths", () => {
-        const mixedPath = "src/组件/Button.tsx";
-        const data = { path: mixedPath };
-        const json = JSON.stringify(data);
-        const parsed = JSON.parse(json);
-        assert.equal(parsed.path, mixedPath);
-    });
-    it("handles Chinese characters in error messages", () => {
-        const errorMsg = 'repo_path "念念小伴_release" is outside workspace';
-        const errorFile = join(tempDir, "error.log");
-        writeFileSync(errorFile, errorMsg, "utf-8");
-        const content = readFileSync(errorFile, "utf-8");
-        assert.ok(content.includes("念念小伴_release"));
-    });
-    it("handles Windows backslash paths with Chinese characters", () => {
-        const winPath = "念念小伴_release\\src\\main.ts";
-        const normalized = winPath.replace(/\\/g, "/");
-        assert.equal(normalized, "念念小伴_release/src/main.ts");
-    });
-});

package/dist/test/unit/command-guard.test.d.ts

@@ -1 +0,0 @@
-export {};

package/dist/test/unit/command-guard.test.js

@@ -1,160 +0,0 @@
-import { describe, it, beforeEach, afterEach } from "node:test";
-import { strict as assert } from "node:assert";
-import { mkdtempSync, rmSync } from "node:fs";
-import { join } from "node:path";
-import { tmpdir } from "node:os";
-import { guardAgentCommand, guardTestCommand, guardDirectCommand, sanitizePromptArg } from "../../security/commandGuard.js";
-import { PatchWardenError } from "../../errors.js";
-function makeConfig(workspaceRoot) {
-    return {
-        workspaceRoot,
-        plansDir: ".patchwarden/plans",
-        tasksDir: ".patchwarden/tasks",
-        assessmentsDir: ".patchwarden/assessments",
-        assessmentTtlSeconds: 3600,
-        agents: {
-            codex: { command: "codex", args: ["exec", "{repo}", "{prompt}"] },
-            opencode: { command: "opencode", args: ["run", "{prompt}"] },
-        },
-        allowedTestCommands: ["npm test", "npm run build", "npm run lint"],
-        repoAllowedTestCommands: {},
-        maxReadFileBytes: 200_000,
-        defaultTaskTimeoutSeconds: 900,
-        maxTaskTimeoutSeconds: 3600,
-        watcherStaleSeconds: 30,
-        directSessionsDir: ".patchwarden/direct-sessions",
-        directSessionTtlSeconds: 3600,
-        directMaxPatchBytes: 200_000,
-        directMaxFileBytes: 500_000,
-        directAllowedCommands: ["npm test", "npm run build"],
-        repoDirectAllowedCommands: {},
-    };
-}
-describe("guardTestCommand", () => {
-    let tempDir;
-    let config;
-    beforeEach(() => {
-        tempDir = mkdtempSync(join(tmpdir(), "pw-cmdguard-"));
-        config = makeConfig(tempDir);
-    });
-    afterEach(() => {
-        rmSync(tempDir, { recursive: true, force: true });
-    });
-    it("allows exact match from allowlist", () => {
-        assert.equal(guardTestCommand("npm test", config), "npm test");
-        assert.equal(guardTestCommand("npm run build", config), "npm run build");
-        assert.equal(guardTestCommand("npm run lint", config), "npm run lint");
-    });
-    it("trims leading spaces and matches", () => {
-        assert.equal(guardTestCommand(" npm test", config), "npm test");
-    });
-    it("trims trailing spaces and matches", () => {
-        assert.equal(guardTestCommand("npm test ", config), "npm test");
-    });
-    it("trims and matches with double spaces in middle (trim only affects ends)", () => {
-        // "npm  test" has double space — trim() only trims ends, so "npm  test" != "npm test"
-        assert.throws(() => guardTestCommand("npm  test", config), PatchWardenError);
-    });
-    it("rejects non-allowlisted commands", () => {
-        assert.throws(() => guardTestCommand("rm -rf /", config), PatchWardenError);
-        assert.throws(() => guardTestCommand("curl http://evil.com", config), PatchWardenError);
-    });
-    it("returns empty string for empty or undefined command", () => {
-        assert.equal(guardTestCommand("", config), "");
-        assert.equal(guardTestCommand(undefined, config), "");
-    });
-    it("returns empty string for whitespace-only command", () => {
-        assert.equal(guardTestCommand("   ", config), "");
-    });
-    it("cannot be bypassed by parameter concatenation", () => {
-        // "npm test && rm -rf /" is not in the allowlist
-        assert.throws(() => guardTestCommand("npm test && rm -rf /", config), PatchWardenError);
-        // "npm test; evil" is not in the allowlist
-        assert.throws(() => guardTestCommand("npm test; evil", config), PatchWardenError);
-    });
-});
-describe("guardAgentCommand", () => {
-    let tempDir;
-    let config;
-    beforeEach(() => {
-        tempDir = mkdtempSync(join(tmpdir(), "pw-agentguard-"));
-        config = makeConfig(tempDir);
-    });
-    afterEach(() => {
-        rmSync(tempDir, { recursive: true, force: true });
-    });
-    it("allows configured agents", () => {
-        const result = guardAgentCommand("codex", config);
-        assert.equal(result.command, "codex");
-        assert.deepEqual(result.args, ["exec", "{repo}", "{prompt}"]);
-        const result2 = guardAgentCommand("opencode", config);
-        assert.equal(result2.command, "opencode");
-    });
-    it("rejects unconfigured agents", () => {
-        assert.throws(() => guardAgentCommand("evil-agent", config), (err) => err instanceof PatchWardenError && err.reason === "agent_not_configured");
-    });
-    it("rejects empty agent name", () => {
-        assert.throws(() => guardAgentCommand("", config), PatchWardenError);
-    });
-});
-describe("guardDirectCommand", () => {
-    let tempDir;
-    let config;
-    beforeEach(() => {
-        tempDir = mkdtempSync(join(tmpdir(), "pw-directcmd-"));
-        config = makeConfig(tempDir);
-    });
-    afterEach(() => {
-        rmSync(tempDir, { recursive: true, force: true });
-    });
-    it("allows commands from direct allowlist", () => {
-        assert.equal(guardDirectCommand("npm test", config), "npm test");
-        assert.equal(guardDirectCommand("npm run build", config), "npm run build");
-    });
-    it("rejects non-allowlisted direct commands", () => {
-        assert.throws(() => guardDirectCommand("rm -rf /", config), PatchWardenError);
-    });
-    it("rejects empty command", () => {
-        assert.throws(() => guardDirectCommand("", config), PatchWardenError);
-    });
-});
-describe("sanitizePromptArg", () => {
-    it("removes null bytes", () => {
-        const input = "hello\x00world";
-        const result = sanitizePromptArg(input);
-        assert.equal(result, "helloworld");
-    });
-    it("removes control characters (except tab and newline)", () => {
-        const input = "hello\x01\x02\x03world";
-        const result = sanitizePromptArg(input);
-        assert.equal(result, "helloworld");
-    });
-    it("preserves tab characters", () => {
-        const input = "hello\tworld";
-        const result = sanitizePromptArg(input);
-        assert.equal(result, "hello\tworld");
-    });
-    it("preserves newline characters", () => {
-        const input = "hello\nworld";
-        const result = sanitizePromptArg(input);
-        assert.equal(result, "hello\nworld");
-    });
-    it("preserves carriage return", () => {
-        const input = "hello\rworld";
-        const result = sanitizePromptArg(input);
-        assert.equal(result, "hello\rworld");
-    });
-    it("preserves normal text", () => {
-        const input = "Fix the bug in main.ts";
-        const result = sanitizePromptArg(input);
-        assert.equal(result, input);
-    });
-    it("removes vertical tab and form feed", () => {
-        const input = "hello\x0B\x0Cworld";
-        const result = sanitizePromptArg(input);
-        assert.equal(result, "helloworld");
-    });
-    it("handles empty string", () => {
-        assert.equal(sanitizePromptArg(""), "");
-    });
-});

package/dist/test/unit/create-task.test.d.ts

@@ -1 +0,0 @@
-export {};