patchwarden 1.5.1 → 1.6.2

package/dist/test/unit/safe-status.test.js

@@ -1,165 +0,0 @@
-import { describe, it, beforeEach, afterEach } from "node:test";
-import { strict as assert } from "node:assert";
-import { mkdtempSync, rmSync, mkdirSync, writeFileSync } from "node:fs";
-import { join } from "node:path";
-import { tmpdir } from "node:os";
-import { safeStatus } from "../../tools/safeStatus.js";
-function makeConfig(workspaceRoot) {
-    return {
-        workspaceRoot,
-        plansDir: ".patchwarden/plans",
-        tasksDir: ".patchwarden/tasks",
-        assessmentsDir: ".patchwarden/assessments",
-        assessmentTtlSeconds: 3600,
-        agents: { codex: { command: "codex", args: ["exec", "{prompt}"] } },
-        allowedTestCommands: ["npm test"],
-        repoAllowedTestCommands: {},
-        maxReadFileBytes: 200_000,
-        defaultTaskTimeoutSeconds: 900,
-        maxTaskTimeoutSeconds: 3600,
-        watcherStaleSeconds: 30,
-        directSessionsDir: ".patchwarden/direct-sessions",
-        directSessionTtlSeconds: 3600,
-        directMaxPatchBytes: 200_000,
-        directMaxFileBytes: 500_000,
-    };
-}
-describe("safeStatus", () => {
-    let tempDir;
-    let config;
-    let tasksDir;
-    beforeEach(() => {
-        tempDir = mkdtempSync(join(tmpdir(), "pw-safestatus-"));
-        config = makeConfig(tempDir);
-        tasksDir = join(tempDir, ".patchwarden", "tasks");
-        mkdirSync(tasksDir, { recursive: true });
-    });
-    afterEach(() => {
-        rmSync(tempDir, { recursive: true, force: true });
-    });
-    function writeTaskStatus(taskId, status) {
-        const taskDir = join(tasksDir, taskId);
-        mkdirSync(taskDir, { recursive: true });
-        writeFileSync(join(taskDir, "status.json"), JSON.stringify(status, null, 2), "utf-8");
-        return taskDir;
-    }
-    function writeTaskRuntime(taskDir, runtime) {
-        writeFileSync(join(taskDir, "runtime.json"), JSON.stringify(runtime, null, 2), "utf-8");
-    }
-    it("returns not_found for non-existent task", () => {
-        const result = safeStatus("non-existent-task", config);
-        assert.equal(result.task_id, "non-existent-task");
-        assert.equal(result.status, "not_found");
-        assert.equal(result.phase, null);
-        assert.equal(result.error_code, null);
-        assert.equal(result.error_summary, null);
-    });
-    it("returns correct status for pending task", () => {
-        writeTaskStatus("task-pending-001", {
-            task_id: "task-pending-001",
-            status: "pending",
-            phase: "queued",
-            created_at: "2026-06-24T10:00:00Z",
-            updated_at: "2026-06-24T10:00:01Z",
-        });
-        const result = safeStatus("task-pending-001", config);
-        assert.equal(result.task_id, "task-pending-001");
-        assert.equal(result.status, "pending");
-        assert.equal(result.created_at, "2026-06-24T10:00:00Z");
-        assert.equal(result.error_code, null);
-        assert.equal(result.error_summary, null);
-    });
-    it("returns correct status for running task", () => {
-        const taskDir = writeTaskStatus("task-running-001", {
-            task_id: "task-running-001",
-            status: "running",
-            phase: "executing_agent",
-            created_at: "2026-06-24T10:00:00Z",
-            started_at: "2026-06-24T10:00:05Z",
-            updated_at: "2026-06-24T10:00:10Z",
-        });
-        writeTaskRuntime(taskDir, {
-            phase: "executing_agent",
-            last_heartbeat_at: "2026-06-24T10:00:12Z",
-            current_command: "codex exec",
-        });
-        const result = safeStatus("task-running-001", config);
-        assert.equal(result.status, "running");
-        assert.equal(result.phase, "executing_agent");
-        assert.equal(result.current_command, "codex exec");
-        assert.equal(result.last_heartbeat_at, "2026-06-24T10:00:12Z");
-        assert.equal(result.started_at, "2026-06-24T10:00:05Z");
-    });
-    it("returns correct status for done task", () => {
-        writeTaskStatus("task-done-001", {
-            task_id: "task-done-001",
-            status: "done",
-            phase: "completed",
-            created_at: "2026-06-24T10:00:00Z",
-            started_at: "2026-06-24T10:00:05Z",
-            finished_at: "2026-06-24T10:05:00Z",
-            verify_status: "passed",
-        });
-        const result = safeStatus("task-done-001", config);
-        assert.equal(result.status, "done");
-        assert.equal(result.phase, "completed");
-        assert.equal(result.finished_at, "2026-06-24T10:05:00Z");
-        assert.equal(result.verify_status, "passed");
-        assert.equal(result.error_code, null);
-    });
-    it("returns correct status for failed task", () => {
-        writeTaskStatus("task-failed-001", {
-            task_id: "task-failed-001",
-            status: "failed_verification",
-            phase: "failed_verification",
-            created_at: "2026-06-24T10:00:00Z",
-            started_at: "2026-06-24T10:00:05Z",
-            finished_at: "2026-06-24T10:05:00Z",
-            error: 'Verification command "npm test" exited with code 1.',
-            verify_status: "failed",
-        });
-        const result = safeStatus("task-failed-001", config);
-        assert.equal(result.status, "failed_verification");
-        assert.equal(result.error_code, "failed_verification");
-        assert.ok(result.error_summary);
-        assert.ok(result.error_summary.includes("npm test"));
-    });
-    it("does not return diff or file content", () => {
-        const taskDir = writeTaskStatus("task-safe-001", {
-            task_id: "task-safe-001",
-            status: "done",
-            phase: "completed",
-            created_at: "2026-06-24T10:00:00Z",
-        });
-        writeFileSync(join(taskDir, "result.md"), "# Secret result content", "utf-8");
-        writeFileSync(join(taskDir, "git.diff"), "secret diff content", "utf-8");
-        writeFileSync(join(taskDir, "test.log"), "secret test log", "utf-8");
-        const result = safeStatus("task-safe-001", config);
-        const resultStr = JSON.stringify(result);
-        assert.ok(!resultStr.includes("Secret result content"));
-        assert.ok(!resultStr.includes("secret diff content"));
-        assert.ok(!resultStr.includes("secret test log"));
-    });
-    it("truncates long error messages", () => {
-        const longError = "x".repeat(300);
-        writeTaskStatus("task-longerror-001", {
-            task_id: "task-longerror-001",
-            status: "failed",
-            phase: "failed",
-            error: longError,
-        });
-        const result = safeStatus("task-longerror-001", config);
-        assert.ok(result.error_summary.length < 300);
-        assert.ok(result.error_summary.endsWith("..."));
-    });
-    it("returns artifact_status when present", () => {
-        writeTaskStatus("task-artifact-001", {
-            task_id: "task-artifact-001",
-            status: "done",
-            phase: "completed",
-            artifact_status: "collected",
-        });
-        const result = safeStatus("task-artifact-001", config);
-        assert.equal(result.artifact_status, "collected");
-    });
-});

package/dist/test/unit/safe-views.test.d.ts

@@ -1 +0,0 @@
-export {};

package/dist/test/unit/safe-views.test.js

@@ -1,171 +0,0 @@
-import { describe, it, beforeEach, afterEach } from "node:test";
-import { strict as assert } from "node:assert";
-import { mkdtempSync, rmSync, mkdirSync, writeFileSync } from "node:fs";
-import { join } from "node:path";
-import { tmpdir } from "node:os";
-import { reloadConfig } from "../../config.js";
-import { safeDirectSummary, safeAuditDirectSession, safeDiffSummary, safeResult, safeTestSummary } from "../../tools/safeViews.js";
-let tempDir;
-let prevConfigEnv;
-function writeConfig() {
-    const configPath = join(tempDir, "patchwarden.config.json");
-    writeFileSync(configPath, JSON.stringify({
-        workspaceRoot: tempDir,
-        tasksDir: ".patchwarden/tasks",
-        plansDir: ".patchwarden/plans",
-        assessmentsDir: ".patchwarden/assessments",
-        directSessionsDir: ".patchwarden/direct-sessions",
-        agents: {},
-        allowedTestCommands: ["npm test"],
-        directAllowedCommands: ["npm test"],
-        enableDirectProfile: true,
-    }), "utf-8");
-    prevConfigEnv = process.env.PATCHWARDEN_CONFIG;
-    process.env.PATCHWARDEN_CONFIG = configPath;
-    reloadConfig();
-}
-describe("safeViews", () => {
-    beforeEach(() => {
-        tempDir = mkdtempSync(join(tmpdir(), "pw-safeviews-"));
-        writeConfig();
-    });
-    afterEach(() => {
-        if (prevConfigEnv === undefined)
-            delete process.env.PATCHWARDEN_CONFIG;
-        else
-            process.env.PATCHWARDEN_CONFIG = prevConfigEnv;
-        reloadConfig();
-        rmSync(tempDir, { recursive: true, force: true });
-    });
-    it("returns bounded task summaries without log or diff content", () => {
-        const taskId = "task-safe-001";
-        const taskDir = join(tempDir, ".patchwarden", "tasks", taskId);
-        mkdirSync(taskDir, { recursive: true });
-        writeFileSync(join(taskDir, "status.json"), JSON.stringify({
-            task_id: taskId,
-            status: "done_by_agent",
-            phase: "done_by_agent",
-            repo_path: "repo",
-            resolved_repo_path: join(tempDir, "repo"),
-            verify_status: "passed",
-        }), "utf-8");
-        writeFileSync(join(taskDir, "result.json"), JSON.stringify({
-            task_id: taskId,
-            status: "done_by_agent",
-            summary: "Finished safely",
-            changed_files: [{ path: "src/index.ts", change: "modified" }],
-            verify_status: "passed",
-            warnings: [],
-        }), "utf-8");
-        writeFileSync(join(taskDir, "verify.json"), JSON.stringify({
-            status: "passed",
-            commands: [{ command: "npm test", status: "passed", exit_code: 0, stdout_tail: "SECRET_STDOUT", stderr_tail: "SECRET_STDERR" }],
-        }), "utf-8");
-        writeFileSync(join(taskDir, "changed-files.json"), JSON.stringify({
-            changed_files: [{ path: "src/index.ts", change: "modified", tracked: true, ignored: false, kind: "source" }],
-            additions: 1,
-            deletions: 0,
-            diff_available: true,
-            diff_truncated: false,
-            patch_mode: "textual",
-            artifact_hygiene: { counts: { source_changes: 1 }, source_changes: [], tracked_build_artifacts: [], ignored_untracked_artifacts: [], runtime_generated_files: [], suspicious_changes: [] },
-        }), "utf-8");
-        writeFileSync(join(taskDir, "git.diff"), "SECRET_DIFF", "utf-8");
-        writeFileSync(join(taskDir, "test.log"), "SECRET_TEST_LOG", "utf-8");
-        const payload = JSON.stringify({
-            result: safeResult(taskId),
-            tests: safeTestSummary(taskId),
-            diff: safeDiffSummary(taskId),
-        });
-        assert.ok(!payload.includes("SECRET_STDOUT"));
-        assert.ok(!payload.includes("SECRET_STDERR"));
-        assert.ok(!payload.includes("SECRET_DIFF"));
-        assert.ok(!payload.includes("SECRET_TEST_LOG"));
-        assert.ok(payload.includes("src/index.ts"));
-    });
-    it("treats corrupted safe-view JSON artifacts as empty summaries", () => {
-        const taskId = "task-safe-corrupt";
-        const taskDir = join(tempDir, ".patchwarden", "tasks", taskId);
-        mkdirSync(taskDir, { recursive: true });
-        writeFileSync(join(taskDir, "status.json"), JSON.stringify({
-            task_id: taskId,
-            status: "done_by_agent",
-            phase: "done_by_agent",
-            repo_path: "repo",
-            resolved_repo_path: join(tempDir, "repo"),
-            verify_status: "passed",
-        }), "utf-8");
-        writeFileSync(join(taskDir, "result.json"), JSON.stringify({
-            task_id: taskId,
-            status: "done_by_agent",
-            summary: "Finished safely",
-            changed_files: [],
-            verify_status: "passed",
-            warnings: [],
-        }), "utf-8");
-        writeFileSync(join(taskDir, "verify.json"), "\uFEFF{not json", "utf-8");
-        writeFileSync(join(taskDir, "changed-files.json"), "{not json", "utf-8");
-        const tests = safeTestSummary(taskId);
-        const diff = safeDiffSummary(taskId);
-        assert.equal(tests.command_count, 0);
-        assert.equal(diff.changed_files_total, 0);
-    });
-    it("returns Direct safe summaries without verification tails", () => {
-        const sessionId = "direct-safe-001";
-        const sessionDir = join(tempDir, ".patchwarden", "direct-sessions", sessionId);
-        mkdirSync(sessionDir, { recursive: true });
-        const session = {
-            session_id: sessionId,
-            title: "safe direct",
-            repo_path: "repo",
-            resolved_repo_path: join(tempDir, "repo"),
-            created_at: new Date().toISOString(),
-            expires_at: new Date(Date.now() + 60_000).toISOString(),
-            server_version: "1.0.0",
-            schema_epoch: "test",
-            tool_manifest_sha256: "x".repeat(64),
-            workspace_snapshot_before: { head: null, status: "", files: {}, workspace_dirty: false, warnings: [], is_git: false },
-            workspace_fingerprint_before: "fingerprint",
-            allowed_commands: ["npm test"],
-            operations: [],
-            verification_runs: [{
-                    command: "npm test",
-                    exit_code: 0,
-                    passed: true,
-                    timed_out: false,
-                    stdout_tail: "SECRET_DIRECT_STDOUT",
-                    stderr_tail: "SECRET_DIRECT_STDERR",
-                    started_at: new Date().toISOString(),
-                    finished_at: new Date().toISOString(),
-                    log_path: join(sessionDir, "verification.log"),
-                }],
-            finalized: true,
-            finalized_at: new Date().toISOString(),
-            audited: false,
-            change_artifacts: {
-                changed_files: [],
-                diff: "SECRET_DIRECT_DIFF",
-                diff_available: true,
-                diff_truncated: false,
-                diff_size_bytes: 18,
-                additions: 0,
-                deletions: 0,
-                file_stats: [],
-                workspace_dirty_before: false,
-                workspace_dirty_after: false,
-                patch_mode: "no_changes",
-                unavailable_reason: null,
-                artifact_hygiene: { counts: { source_changes: 0, tracked_build_artifacts: 0, ignored_untracked_artifacts: 0, runtime_generated_files: 0, suspicious_changes: 0 }, source_changes: [], tracked_build_artifacts: [], ignored_untracked_artifacts: [], runtime_generated_files: [], suspicious_changes: [] },
-            },
-        };
-        writeFileSync(join(sessionDir, "session.json"), JSON.stringify(session, null, 2), "utf-8");
-        const payload = JSON.stringify({
-            summary: safeDirectSummary(sessionId),
-            audit: safeAuditDirectSession(sessionId),
-        });
-        assert.ok(!payload.includes("SECRET_DIRECT_STDOUT"));
-        assert.ok(!payload.includes("SECRET_DIRECT_STDERR"));
-        assert.ok(!payload.includes("SECRET_DIRECT_DIFF"));
-        assert.ok(payload.includes("npm test"));
-    });
-});

package/dist/test/unit/schema-drift-check.test.d.ts

@@ -1 +0,0 @@
-export {};

package/dist/test/unit/schema-drift-check.test.js

@@ -1,176 +0,0 @@
-import { describe, it } from "node:test";
-import { strict as assert } from "node:assert";
-import { computeSchemaDigest } from "../../tools/toolRegistry.js";
-import { CHATGPT_CORE_TOOL_NAMES } from "../../tools/toolCatalog.js";
-import { checkRegistrySchemaDigest, checkChatgptCoreManifestStable, checkNewToolsProfileAppend, runAllSchemaDriftChecks, } from "../../tools/schemaDriftCheck.js";
-// ── 测试夹具构造工具 ─────────────────────────────────────────────
-const SAMPLE_SCHEMA = {
-    type: "object",
-    properties: {
-        task_id: { type: "string", description: "Task ID" },
-    },
-    required: ["task_id"],
-};
-const OTHER_SCHEMA = {
-    type: "object",
-    properties: {
-        plan_id: { type: "string", description: "Plan ID" },
-    },
-    required: ["plan_id"],
-};
-const CORE_COUNT = CHATGPT_CORE_TOOL_NAMES.length;
-/** 构造一个满足 PatchWardenToolMeta 接口的元数据对象。 */
-function makeMeta(opts) {
-    const schema = opts.inputSchema ?? SAMPLE_SCHEMA;
-    return {
-        name: opts.name,
-        title: `Tool ${opts.name}`,
-        summary: `summary for ${opts.name}`,
-        description: `description for ${opts.name}`,
-        profiles: opts.profiles ?? ["full"],
-        modes: ["diagnostic"],
-        tags: [],
-        aliases: [],
-        risk: "readonly",
-        requiresConfirmation: false,
-        inputSchemaDigest: opts.inputSchemaDigest ?? computeSchemaDigest(schema),
-    };
-}
-/** 构造 toolDefs Map。 */
-function makeToolDefs(entries) {
-    const map = new Map();
-    for (const e of entries) {
-        map.set(e.name, {
-            inputSchema: e.inputSchema ?? SAMPLE_SCHEMA,
-        });
-    }
-    return map;
-}
-/** 构造包含全部 21 个 chatgpt_core 工具（顺序一致）的 toolDefs Map。 */
-function makeCoreToolDefs() {
-    return makeToolDefs([...CHATGPT_CORE_TOOL_NAMES].map((name) => ({ name })));
-}
-/** 构造一个 registry：所有工具都属于 chatgpt_core profile。 */
-function makeCoreRegistry(count) {
-    const names = [...CHATGPT_CORE_TOOL_NAMES].slice(0, count);
-    return names.map((name) => makeMeta({ name, profiles: ["chatgpt_core"] }));
-}
-// ── 1. checkRegistrySchemaDigest ─────────────────────────────────
-describe("checkRegistrySchemaDigest", () => {
-    it("digest 一致时 ok=true，warnings 为空", () => {
-        const schema = { type: "object", properties: { a: { type: "string" } } };
-        const registry = [makeMeta({ name: "tool_a", inputSchema: schema })];
-        const toolDefs = makeToolDefs([{ name: "tool_a", inputSchema: schema }]);
-        const result = checkRegistrySchemaDigest(registry, toolDefs);
-        assert.equal(result.ok, true);
-        assert.deepEqual(result.warnings, []);
-    });
-    it("digest 不一致时 ok=false，warnings 包含工具名和两个 digest", () => {
-        const registrySchema = SAMPLE_SCHEMA;
-        const actualSchema = OTHER_SCHEMA;
-        // registry 记录的是 registrySchema 的 digest，但实际 toolDef 用的是 actualSchema
-        const registry = [
-            makeMeta({ name: "tool_drift", inputSchema: registrySchema }),
-        ];
-        const toolDefs = makeToolDefs([{ name: "tool_drift", inputSchema: actualSchema }]);
-        const result = checkRegistrySchemaDigest(registry, toolDefs);
-        assert.equal(result.ok, false);
-        assert.equal(result.warnings.length, 1);
-        const warning = result.warnings[0];
-        const expectedRegistryDigest = computeSchemaDigest(registrySchema);
-        const expectedActualDigest = computeSchemaDigest(actualSchema);
-        assert.ok(warning.includes("tool_drift"), "warning 应包含工具名");
-        assert.ok(warning.includes(expectedRegistryDigest), "warning 应包含 registry digest");
-        assert.ok(warning.includes(expectedActualDigest), "warning 应包含 actual digest");
-    });
-    it("toolDefs 中找不到工具时跳过（不报 drift）", () => {
-        const registry = [makeMeta({ name: "missing_tool" })];
-        const toolDefs = makeToolDefs([]); // 空映射
-        const result = checkRegistrySchemaDigest(registry, toolDefs);
-        assert.equal(result.ok, true);
-        assert.deepEqual(result.warnings, []);
-    });
-});
-// ── 2. checkChatgptCoreManifestStable ────────────────────────────
-describe("checkChatgptCoreManifestStable", () => {
-    it("21 工具全部存在时 ok=true", () => {
-        const toolDefs = makeCoreToolDefs();
-        const result = checkChatgptCoreManifestStable(toolDefs);
-        assert.equal(result.ok, true);
-        assert.deepEqual(result.warnings, []);
-    });
-    it("缺少工具时 ok=false", () => {
-        // 移除最后一个工具，使 chatgpt_core 工具数为 20
-        const names = [...CHATGPT_CORE_TOOL_NAMES].slice(0, CORE_COUNT - 1);
-        const toolDefs = makeToolDefs(names.map((name) => ({ name })));
-        const result = checkChatgptCoreManifestStable(toolDefs);
-        assert.equal(result.ok, false);
-        assert.equal(result.warnings.length, 1);
-        assert.ok(result.warnings[0].includes("missing tools"), "warning 应包含 missing tools");
-        assert.ok(result.warnings[0].includes(CHATGPT_CORE_TOOL_NAMES[CORE_COUNT - 1]), "warning 应包含缺失的工具名");
-    });
-});
-// ── 3. checkNewToolsProfileAppend ────────────────────────────────
-describe("checkNewToolsProfileAppend", () => {
-    it("chatgpt_core 21 工具时 ok=true", () => {
-        const registry = makeCoreRegistry(CORE_COUNT);
-        const result = checkNewToolsProfileAppend(registry);
-        assert.equal(result.ok, true);
-        assert.deepEqual(result.warnings, []);
-    });
-    it("chatgpt_core 工具数不为 21 时 ok=false", () => {
-        // 22 个 chatgpt_core 工具：21 个标准工具 + 1 个重复名（模拟新工具追加）
-        const registry = makeCoreRegistry(CORE_COUNT);
-        registry.push(makeMeta({ name: "extra_tool", profiles: ["chatgpt_core"] }));
-        const result = checkNewToolsProfileAppend(registry);
-        assert.equal(result.ok, false);
-        assert.equal(result.warnings.length, 1);
-        assert.ok(result.warnings[0].includes(`expected ${CORE_COUNT}`), "warning 应包含预期数量 21");
-        assert.ok(result.warnings[0].includes(`got ${CORE_COUNT + 1}`), "warning 应包含实际数量 22");
-    });
-});
-// ── 4. runAllSchemaDriftChecks ───────────────────────────────────
-describe("runAllSchemaDriftChecks", () => {
-    it("无 drift 时 ok=true", () => {
-        // registry 与 toolDefs 完全一致，且 chatgpt_core 工具数为 21
-        const registry = makeCoreRegistry(CORE_COUNT);
-        const toolDefs = makeCoreToolDefs();
-        const result = runAllSchemaDriftChecks(registry, toolDefs);
-        assert.equal(result.ok, true);
-        assert.deepEqual(result.warnings, []);
-    });
-    it("有 drift 时 ok=false，warnings 合并正确", () => {
-        // 构造同时触发三个检查的 drift：
-        // - check 1: 一个工具 digest 不一致
-        // - check 2: toolDefs 缺少一个 chatgpt_core 工具（数量 16）
-        // - check 3: registry 有 22 个 chatgpt_core 工具
-        const driftedSchema = OTHER_SCHEMA;
-        const registry = makeCoreRegistry(CORE_COUNT);
-        // 第一个工具的 digest 指向 SAMPLE_SCHEMA，但 toolDefs 中该工具用 driftedSchema
-        registry[0] = makeMeta({
-            name: CHATGPT_CORE_TOOL_NAMES[0],
-            inputSchema: SAMPLE_SCHEMA,
-            profiles: ["chatgpt_core"],
-        });
-        // 追加一个额外的 chatgpt_core 工具，使 profile 工具数变为 22
-        registry.push(makeMeta({ name: "extra_tool", profiles: ["chatgpt_core"] }));
-        // toolDefs：第一个工具用 driftedSchema（触发 check 1），且移除最后一个核心工具（触发 check 2）
-        const coreNames = [...CHATGPT_CORE_TOOL_NAMES];
-        const toolDefEntries = coreNames.slice(0, CORE_COUNT - 1).map((name) => ({
-            name,
-            inputSchema: name === CHATGPT_CORE_TOOL_NAMES[0] ? driftedSchema : SAMPLE_SCHEMA,
-        }));
-        const toolDefs = makeToolDefs(toolDefEntries);
-        const result = runAllSchemaDriftChecks(registry, toolDefs);
-        assert.equal(result.ok, false);
-        // 至少包含来自三个检查的警告
-        assert.ok(result.warnings.length >= 3, `应有至少 3 条警告，实际 ${result.warnings.length}`);
-        // 验证三类警告都存在
-        const hasDigestDrift = result.warnings.some((w) => w.startsWith("Schema drift for tool"));
-        const hasManifestMissing = result.warnings.some((w) => w.includes("missing tools"));
-        const hasProfileCount = result.warnings.some((w) => w.includes("profile tool count changed"));
-        assert.ok(hasDigestDrift, "应包含 registry digest drift 警告");
-        assert.ok(hasManifestMissing, "应包含 manifest 缺失工具警告");
-        assert.ok(hasProfileCount, "应包含 profile 数量变化警告");
-    });
-});

package/dist/test/unit/sensitive-guard.test.d.ts

@@ -1 +0,0 @@
-export {};

package/dist/test/unit/sensitive-guard.test.js

@@ -1,104 +0,0 @@
-import { describe, it } from "node:test";
-import { strict as assert } from "node:assert";
-import { isSensitivePath, guardSensitivePath } from "../../security/sensitiveGuard.js";
-import { PatchWardenError } from "../../errors.js";
-describe("isSensitivePath", () => {
-    it("blocks .env files", () => {
-        assert.equal(isSensitivePath(".env"), true);
-        assert.equal(isSensitivePath("path/to/.env"), true);
-        assert.equal(isSensitivePath(".env.production"), true);
-        assert.equal(isSensitivePath(".env.local"), true);
-    });
-    it("blocks .ENV case insensitive", () => {
-        assert.equal(isSensitivePath(".ENV"), true);
-        assert.equal(isSensitivePath("path/to/.ENV"), true);
-        assert.equal(isSensitivePath(".Env.Production"), true);
-    });
-    it("blocks config.json case insensitive", () => {
-        assert.equal(isSensitivePath("config.json"), true);
-        assert.equal(isSensitivePath("Config.json"), true);
-        assert.equal(isSensitivePath("CONFIG.JSON"), true);
-        assert.equal(isSensitivePath("path/to/Config.json"), true);
-    });
-    it("blocks SSH keys", () => {
-        assert.equal(isSensitivePath("id_rsa"), true);
-        assert.equal(isSensitivePath("id_ed25519"), true);
-        assert.equal(isSensitivePath("id_ecdsa"), true);
-        assert.equal(isSensitivePath("path/to/id_rsa"), true);
-        assert.equal(isSensitivePath(".ssh/id_rsa"), true);
-    });
-    it("blocks credentials and tokens", () => {
-        assert.equal(isSensitivePath("credentials"), true);
-        assert.equal(isSensitivePath("path/to/credentials.json"), true);
-        assert.equal(isSensitivePath("token.txt"), true);
-        // access_token does NOT match because the pattern requires token at start or after /
-        assert.equal(isSensitivePath("access_token"), false);
-        assert.equal(isSensitivePath("path/to/token"), true);
-        assert.equal(isSensitivePath(".netrc"), true);
-        assert.equal(isSensitivePath(".npmrc"), true);
-        assert.equal(isSensitivePath(".pypirc"), true);
-    });
-    it("blocks private key files", () => {
-        assert.equal(isSensitivePath("server.pem"), true);
-        assert.equal(isSensitivePath("private.key"), true);
-        assert.equal(isSensitivePath("cert.pfx"), true);
-        assert.equal(isSensitivePath("cert.p12"), true);
-    });
-    it("blocks browser data files", () => {
-        assert.equal(isSensitivePath("cookies"), true);
-        assert.equal(isSensitivePath("cookies.db"), true);
-        assert.equal(isSensitivePath("Web Data"), true);
-        assert.equal(isSensitivePath("Login Data"), true);
-        assert.equal(isSensitivePath("Local State"), true);
-    });
-    it("blocks .git-credentials", () => {
-        assert.equal(isSensitivePath(".git-credentials"), true);
-        assert.equal(isSensitivePath("path/to/.git-credentials"), true);
-    });
-    it("blocks docker and kube config", () => {
-        assert.equal(isSensitivePath(".docker/config.json"), true);
-        assert.equal(isSensitivePath(".kube/config"), true);
-    });
-    it("allows .patchwarden safe prefix", () => {
-        assert.equal(isSensitivePath(".patchwarden/tasks/task-001/status.json"), false);
-        assert.equal(isSensitivePath(".patchwarden/config.json"), false);
-        assert.equal(isSensitivePath(".patchwarden"), false);
-    });
-    it("allows non-sensitive files", () => {
-        assert.equal(isSensitivePath("src/main.ts"), false);
-        assert.equal(isSensitivePath("README.md"), false);
-        assert.equal(isSensitivePath("package.json"), false);
-        assert.equal(isSensitivePath("docs/guide.md"), false);
-    });
-    it("handles Windows backslash paths", () => {
-        assert.equal(isSensitivePath("path\\to\\.env"), true);
-        assert.equal(isSensitivePath("path\\to\\config.json"), true);
-        assert.equal(isSensitivePath(".patchwarden\\tasks\\status.json"), false);
-    });
-    it("handles null byte in path", () => {
-        // config.json with null byte appended — the $ anchor means this won't match
-        // because the string doesn't end with "config.json"
-        const nullPath = "config.json\x00.txt";
-        assert.equal(isSensitivePath(nullPath), false);
-        // But plain config.json still matches
-        assert.equal(isSensitivePath("config.json"), true);
-    });
-    it("handles Unicode lookalike characters", () => {
-        // Full-width dot (U+FF0E) should not match .env pattern
-        // This is expected behavior — Unicode lookalikes are NOT matched
-        const fullWidthPath = "\uFF0Eenv";
-        assert.equal(isSensitivePath(fullWidthPath), false);
-    });
-});
-describe("guardSensitivePath", () => {
-    it("throws PatchWardenError for sensitive paths", () => {
-        assert.throws(() => guardSensitivePath(".env"), (err) => err instanceof PatchWardenError && err.reason === "sensitive_path_blocked");
-    });
-    it("does not throw for non-sensitive paths", () => {
-        assert.doesNotThrow(() => guardSensitivePath("src/main.ts"));
-        assert.doesNotThrow(() => guardSensitivePath("README.md"));
-    });
-    it("does not throw for .patchwarden paths", () => {
-        assert.doesNotThrow(() => guardSensitivePath(".patchwarden/tasks/status.json"));
-    });
-});

package/dist/test/unit/spec-kit-import.test.d.ts

@@ -1 +0,0 @@
-export {};