patchwarden 1.6.1 → 1.6.2

package/src/assessments/assessmentDiagnostics.ts

@@ -0,0 +1,172 @@
+import { existsSync, mkdirSync } from "node:fs";
+import { dirname, join } from "node:path";
+import { getAssessmentsDir, getConfig } from "../config.js";
+import { guardPath } from "../security/pathGuard.js";
+import { atomicWriteJsonFileSync } from "../utils/atomicFile.js";
+import { readJsonObjectFileSync } from "../utils/lockedJsonFile.js";
+import type { AssessmentValidationResult } from "./assessmentStore.js";
+import { ASSESSMENT_SECURITY_SNAPSHOT_VERSION } from "./securitySnapshot.js";
+import { PATCHWARDEN_VERSION, TOOL_SCHEMA_EPOCH } from "../version.js";
+
+const DIAGNOSTIC_VERSION = "assessment-validation-diagnostic-v2";
+const DIAGNOSTIC_FILE = "last-validation-failure.json";
+const VALIDATOR_MODULE_PATH = "dist/assessments/assessmentStore.js";
+const VALIDATOR_BUILD_ID = `patchwarden-${PATCHWARDEN_VERSION}:${TOOL_SCHEMA_EPOCH}:${ASSESSMENT_SECURITY_SNAPSHOT_VERSION}`;
+
+export interface AssessmentValidationFailureDiagnostic {
+  diagnostic_version: string;
+  error_code: string;
+  reason_code: string;
+  assessment_id: string | null;
+  assessment_config_sha256: string | null;
+  current_config_sha256: string | null;
+  assessment_config_hash: string | null;
+  current_config_hash: string | null;
+  snapshot_version: string | null;
+  assessment_fingerprint_version: string | null;
+  current_fingerprint_version: string;
+  assessment_schema_epoch: string | null;
+  current_schema_epoch: string;
+  assessment_created_at: string | null;
+  assessment_expires_at: string | null;
+  config_changed: boolean;
+  changed_field_names: string[];
+  changed_config_sections: string[];
+  validator_module_path: string;
+  validator_build_id: string;
+  watcher_instance_id: string | null;
+  observed_at: string;
+}
+
+export function buildAssessmentValidationFailureDiagnostic(
+  result: AssessmentValidationResult,
+): AssessmentValidationFailureDiagnostic | null {
+  if (result.valid || !result.failure_reason) return null;
+  const reasonCode = safeCode(result.failure_reason);
+  const assessmentHash = safeHash(result.expected_hash);
+  const currentHash = safeHash(result.actual_hash);
+  const changedSections = [...new Set((result.config_change_categories || [])
+    .map((name) => safeCode(name))
+    .filter(Boolean))]
+    .sort()
+    .slice(0, 32);
+  const assessmentVersion = safeText(result.assessment?.assessment_security_snapshot_version, 80);
+  return {
+    diagnostic_version: DIAGNOSTIC_VERSION,
+    error_code: reasonCode,
+    reason_code: reasonCode,
+    assessment_id: safeAssessmentId(result.assessment?.assessment_id),
+    assessment_config_sha256: assessmentHash,
+    current_config_sha256: currentHash,
+    assessment_config_hash: assessmentHash,
+    current_config_hash: currentHash,
+    snapshot_version: assessmentVersion,
+    assessment_fingerprint_version: assessmentVersion,
+    current_fingerprint_version: ASSESSMENT_SECURITY_SNAPSHOT_VERSION,
+    assessment_schema_epoch: safeText(result.assessment?.assessment_schema_epoch, 80),
+    current_schema_epoch: TOOL_SCHEMA_EPOCH,
+    assessment_created_at: safeTimestamp(result.assessment?.created_at),
+    assessment_expires_at: safeTimestamp(result.assessment?.expires_at),
+    config_changed: result.failure_reason === "assessment_stale_config",
+    changed_field_names: changedSections,
+    changed_config_sections: changedSections,
+    validator_module_path: VALIDATOR_MODULE_PATH,
+    validator_build_id: VALIDATOR_BUILD_ID,
+    watcher_instance_id: safeInstanceId(process.env.PATCHWARDEN_WATCHER_INSTANCE_ID),
+    observed_at: new Date().toISOString(),
+  };
+}
+
+/** Persist a bounded value-free failure summary without changing validation behavior. */
+export function recordAssessmentValidationFailure(result: AssessmentValidationResult): boolean {
+  const diagnostic = buildAssessmentValidationFailureDiagnostic(result);
+  if (!diagnostic) return false;
+  try {
+    const config = getConfig();
+    const assessmentsDir = getAssessmentsDir(config);
+    const file = guardPath(
+      join(assessmentsDir, DIAGNOSTIC_FILE),
+      config.workspaceRoot,
+      config.assessmentsDir,
+    );
+    mkdirSync(dirname(file), { recursive: true });
+    atomicWriteJsonFileSync(file, diagnostic);
+    return true;
+  } catch {
+    // Diagnostics must never replace the original fail-closed validation error.
+    return false;
+  }
+}
+
+export function readLastAssessmentValidationFailure(): AssessmentValidationFailureDiagnostic | null {
+  try {
+    const config = getConfig();
+    const file = guardPath(
+      join(getAssessmentsDir(config), DIAGNOSTIC_FILE),
+      config.workspaceRoot,
+      config.assessmentsDir,
+    );
+    if (!existsSync(file)) return null;
+    const raw = readJsonObjectFileSync<Record<string, unknown>>(file);
+    if (raw.diagnostic_version !== DIAGNOSTIC_VERSION) return null;
+    const changedSections = Array.isArray(raw.changed_config_sections)
+      ? [...new Set(raw.changed_config_sections.map(safeCode).filter(Boolean))].sort().slice(0, 32)
+      : [];
+    return {
+      diagnostic_version: DIAGNOSTIC_VERSION,
+      error_code: safeCode(raw.error_code),
+      reason_code: safeCode(raw.reason_code),
+      assessment_id: safeAssessmentId(raw.assessment_id),
+      assessment_config_sha256: safeHash(raw.assessment_config_sha256),
+      current_config_sha256: safeHash(raw.current_config_sha256),
+      assessment_config_hash: safeHash(raw.assessment_config_hash),
+      current_config_hash: safeHash(raw.current_config_hash),
+      snapshot_version: safeText(raw.snapshot_version, 80),
+      assessment_fingerprint_version: safeText(raw.assessment_fingerprint_version, 80),
+      current_fingerprint_version: safeText(raw.current_fingerprint_version, 80) || ASSESSMENT_SECURITY_SNAPSHOT_VERSION,
+      assessment_schema_epoch: safeText(raw.assessment_schema_epoch, 80),
+      current_schema_epoch: safeText(raw.current_schema_epoch, 80) || TOOL_SCHEMA_EPOCH,
+      assessment_created_at: safeTimestamp(raw.assessment_created_at),
+      assessment_expires_at: safeTimestamp(raw.assessment_expires_at),
+      config_changed: raw.config_changed === true,
+      changed_field_names: Array.isArray(raw.changed_field_names)
+        ? [...new Set(raw.changed_field_names.map(safeCode).filter(Boolean))].sort().slice(0, 32)
+        : [],
+      changed_config_sections: changedSections,
+      validator_module_path: safeText(raw.validator_module_path, 120) || VALIDATOR_MODULE_PATH,
+      validator_build_id: safeText(raw.validator_build_id, 160) || VALIDATOR_BUILD_ID,
+      watcher_instance_id: safeInstanceId(raw.watcher_instance_id),
+      observed_at: safeTimestamp(raw.observed_at) || new Date(0).toISOString(),
+    };
+  } catch {
+    return null;
+  }
+}
+
+function safeAssessmentId(value: unknown): string | null {
+  return typeof value === "string" && /^assessment_\d{8}_\d{6}_[0-9a-f]{32}$/.test(value) ? value : null;
+}
+
+function safeInstanceId(value: unknown): string | null {
+  return typeof value === "string" && /^[a-zA-Z0-9_-]{1,100}$/.test(value) ? value : null;
+}
+
+function safeCode(value: unknown): string {
+  return typeof value === "string" && /^[a-z0-9_]{1,80}$/.test(value) ? value : "";
+}
+
+function safeHash(value: unknown): string | null {
+  return typeof value === "string" && /^[0-9a-f]{64}$/.test(value) ? value : null;
+}
+
+function safeText(value: unknown, maxLength: number): string | null {
+  return typeof value === "string" && value.length > 0
+    ? value.replace(/[\r\n]+/g, " ").slice(0, maxLength)
+    : null;
+}
+
+function safeTimestamp(value: unknown): string | null {
+  return typeof value === "string" && Number.isFinite(Date.parse(value))
+    ? new Date(value).toISOString()
+    : null;
+}

package/src/assessments/assessmentStore.ts

@@ -12,10 +12,22 @@ import { redactSensitiveContent } from "../security/contentRedaction.js";
 import { atomicWriteJsonFileSync } from "../utils/atomicFile.js";
 import { withFileLockSync } from "../utils/lockedJsonFile.js";
 import { TOOL_SCHEMA_EPOCH } from "../version.js";
-import { getLastToolCatalogSnapshot } from "../tools/catalog/toolCatalog.js";
+import {
+  buildToolCatalogSnapshot,
+  resolveToolProfile,
+} from "../tools/catalog/toolCatalog.js";
+import { getToolDefs } from "../tools/definitions/toolDefs.js";
 import { captureRepoSnapshot, type RepoSnapshot } from "../runner/changeCapture.js";
 import type { RiskAssessmentResult } from "../security/riskEngine.js";
 import type { TaskTemplateName, ChangePolicy } from "../tools/taskTemplates.js";
+import { getProjectPolicySummary, type ProjectPolicy } from "../policy/projectPolicy.js";
+import {
+  ASSESSMENT_SECURITY_SNAPSHOT_VERSION,
+  buildAssessmentSecuritySnapshot,
+  getAssessmentSecuritySnapshotComponentHashes,
+  hashAssessmentSecuritySnapshot,
+  type SecuritySnapshotCategory,
+} from "./securitySnapshot.js";
 
 const SENSITIVE_PATH_RULES_SIGNATURE = "v1";
 const ARTIFACT_RULES_SIGNATURE = "v1";
@@ -65,6 +77,12 @@ export interface AssessmentRecord {
   plan_id: string | null;
   policy_hash: string;
   tool_manifest_sha256: string;
+  execution_config_hash?: string;
+  execution_config_component_hashes?: Partial<Record<ExecutionConfigChangeCategory, string>>;
+  assessment_security_snapshot_version?: string;
+  assessment_security_snapshot_sha256?: string;
+  assessment_security_snapshot_component_hashes?: Partial<Record<ExecutionConfigChangeCategory, string>>;
+  assessment_schema_epoch?: string;
   workspace_fingerprint: string;
   workspace_snapshot_summary: {
     head: string | null;
@@ -83,10 +101,15 @@ export interface AssessmentRecord {
   agent: string;
   timeout_seconds?: number;
   change_policy?: ChangePolicy;
+  scope?: string[];
+  forbidden?: string[];
+  verification?: string[];
+  done_evidence?: string[];
   requires_confirm: boolean;
   confirmed: boolean;
   confirmed_at: string | null;
   confirm_code: string | null;
+  used_at?: string | null;
   agent_assessment_summary?: AgentAssessmentSummary | null;
 }
 
@@ -107,6 +130,10 @@ export interface AssessmentCreateInput {
   agent: string;
   timeout_seconds?: number;
   change_policy?: ChangePolicy;
+  scope?: string[];
+  forbidden?: string[];
+  verification?: string[];
+  done_evidence?: string[];
   snapshot: RepoSnapshot;
   assessment_id?: string;
   assessment_dir?: string;
@@ -117,8 +144,13 @@ export interface AssessmentValidationResult {
   valid: boolean;
   failure_reason: string | null;
   assessment: AssessmentRecord | null;
+  expected_hash?: string;
+  actual_hash?: string;
+  config_change_categories?: ExecutionConfigChangeCategory[];
 }
 
+export type ExecutionConfigChangeCategory = SecuritySnapshotCategory | "allowed_test_commands" | "execution_config";
+
 export interface AssessmentConfirmationResult {
   assessment_id: string;
   decision: "needs_confirm";
@@ -161,7 +193,7 @@ export function createAssessment(input: AssessmentCreateInput): AssessmentRecord
     ? createHash("sha256").update(input.plan_content).digest("hex")
     : null;
 
-  const toolManifest = getLastToolCatalogSnapshot()?.tool_manifest_sha256 || computeFallbackManifestHash(config);
+  const toolManifest = getCurrentToolManifest(config);
 
   const workspaceFingerprint = computeWorkspaceFingerprint(input.snapshot);
   const snapshotTruncated = input.snapshot.warnings.some((w) => w.includes("snapshot limited"));
@@ -176,6 +208,21 @@ export function createAssessment(input: AssessmentCreateInput): AssessmentRecord
     artifact_rules: ARTIFACT_RULES_SIGNATURE,
     schema_epoch: TOOL_SCHEMA_EPOCH,
   });
+  const executionConfig = computeExecutionConfigFingerprint(config, {
+    agent: input.agent,
+    tool_manifest_sha256: toolManifest,
+    tool_profile: resolveToolProfile(config.toolProfile),
+    repo_path: input.resolved_repo_path,
+    change_policy: input.change_policy || "repo_scoped_changes",
+    template: input.template || null,
+    verify_commands: input.verify_commands || [],
+    test_command: input.test_command || null,
+    task_timeout_seconds: input.timeout_seconds,
+    scope: input.scope,
+    forbidden: input.forbidden,
+    verification: input.verification,
+    done_evidence: input.done_evidence,
+  });
 
   const now = new Date();
   const expiresAt = new Date(now.getTime() + config.assessmentTtlSeconds * 1000).toISOString();
@@ -192,6 +239,12 @@ export function createAssessment(input: AssessmentCreateInput): AssessmentRecord
     plan_id: input.plan_id,
     policy_hash: policyHash,
     tool_manifest_sha256: toolManifest,
+    execution_config_hash: executionConfig.hash,
+    execution_config_component_hashes: executionConfig.components,
+    assessment_security_snapshot_version: ASSESSMENT_SECURITY_SNAPSHOT_VERSION,
+    assessment_security_snapshot_sha256: executionConfig.hash,
+    assessment_security_snapshot_component_hashes: executionConfig.components,
+    assessment_schema_epoch: TOOL_SCHEMA_EPOCH,
     workspace_fingerprint: workspaceFingerprint,
     workspace_snapshot_summary: {
       head: input.snapshot.head,
@@ -210,10 +263,15 @@ export function createAssessment(input: AssessmentCreateInput): AssessmentRecord
     agent: input.agent,
     timeout_seconds: input.timeout_seconds,
     change_policy: input.change_policy || "repo_scoped_changes",
+    scope: input.scope || [],
+    forbidden: input.forbidden || [],
+    verification: input.verification || [],
+    done_evidence: input.done_evidence || [],
     requires_confirm: input.decision === "needs_confirm",
     confirmed: false,
     confirmed_at: null,
     confirm_code: null,
+    used_at: null,
     agent_assessment_summary: input.agent_assessment_summary || null,
   };
 
@@ -223,6 +281,13 @@ export function createAssessment(input: AssessmentCreateInput): AssessmentRecord
 }
 
 export function readAssessment(assessmentId: string): AssessmentRecord {
+  if (!/^assessment_\d{8}_\d{6}_[0-9a-f]{32}$/.test(assessmentId)) {
+    throw new PatchWardenError(
+      "assessment_id_invalid",
+      "A full assessment_id with 32 hexadecimal random characters is required.",
+      "Copy the complete assessment_id from the assess_only response; assessment_short_id is display-only.",
+    );
+  }
   const config = getConfig();
   const assessmentsDir = getAssessmentsDir(config);
   const dir = resolve(assessmentsDir, assessmentId);
@@ -237,7 +302,43 @@ export function readAssessment(assessmentId: string): AssessmentRecord {
       { assessment_id: assessmentId }
     );
   }
-  return JSON.parse(readFileSync(file, "utf-8")) as AssessmentRecord;
+  try {
+    const parsed = JSON.parse(readFileSync(file, "utf-8")) as AssessmentRecord;
+    if (!parsed || typeof parsed !== "object" || parsed.assessment_id !== assessmentId) {
+      throw new Error("record identity mismatch");
+    }
+    return parsed;
+  } catch (error) {
+    throw new PatchWardenError(
+      "assessment_corrupted",
+      `Assessment "${assessmentId}" cannot be read as a valid record.`,
+      "Run create_task with execution_mode=assess_only again.",
+      true,
+      { assessment_id: assessmentId, failure_category: "invalid_assessment_record" },
+    );
+  }
+}
+
+/** Atomically consume an Assessment before creating its one allowed task. */
+export function markAssessmentUsed(assessmentId: string): AssessmentRecord {
+  const config = getConfig();
+  const assessmentFile = resolve(getAssessmentsDir(config), assessmentId, "assessment.json");
+  guardPath(assessmentFile, config.workspaceRoot, config.assessmentsDir);
+  return withFileLockSync(assessmentFile, () => {
+    const assessment = readAssessment(assessmentId);
+    if (assessment.used_at) {
+      throw new PatchWardenError(
+        "assessment_used",
+        `Assessment "${assessmentId}" has already been used.`,
+        "Run create_task with execution_mode=assess_only again to obtain a new assessment_id.",
+        true,
+        { assessment_id: assessmentId, used_at: assessment.used_at },
+      );
+    }
+    const consumed: AssessmentRecord = { ...assessment, used_at: new Date().toISOString() };
+    atomicWriteJsonFileSync(assessmentFile, consumed);
+    return consumed;
+  });
 }
 
 export function validateAssessmentFreshness(
@@ -245,6 +346,9 @@ export function validateAssessmentFreshness(
   currentSnapshot: RepoSnapshot,
   options: AssessmentValidationOptions = {}
 ): AssessmentValidationResult {
+  if (!/^assessment_\d{8}_\d{6}_[0-9a-f]{32}$/.test(assessmentId)) {
+    return { valid: false, failure_reason: "assessment_id_invalid", assessment: null };
+  }
   let assessment: AssessmentRecord;
   try {
     assessment = readAssessment(assessmentId);
@@ -275,11 +379,21 @@ export function validateAssessmentFreshness(
     }
   }
 
+  const config = getConfig();
+  const currentManifest = getCurrentToolManifest(config);
   if (!options.skip_tool_manifest) {
-    const currentManifest = getLastToolCatalogSnapshot()?.tool_manifest_sha256 ||
-      computeFallbackManifestHash(getConfig());
-    if (currentManifest !== assessment.tool_manifest_sha256) {
-      return { valid: false, failure_reason: "assessment_stale_config", assessment };
+    // Legacy records need the standalone manifest check. Versioned security
+    // snapshots compare the manifest together with the source config, so the
+    // diagnostic can report both "tool_manifest" and e.g. "allowed_commands".
+    if (currentManifest !== assessment.tool_manifest_sha256 && !assessment.assessment_security_snapshot_sha256) {
+      return {
+        valid: false,
+        failure_reason: "assessment_stale_config",
+        assessment,
+        expected_hash: assessment.tool_manifest_sha256,
+        actual_hash: currentManifest,
+        config_change_categories: ["tool_manifest"],
+      };
     }
   }
 
@@ -288,7 +402,52 @@ export function validateAssessmentFreshness(
     return { valid: false, failure_reason: "assessment_workspace_changed", assessment };
   }
 
-  const config = getConfig();
+  if (assessment.execution_config_hash) {
+    const currentExecutionConfig = computeExecutionConfigFingerprint(config, {
+      agent: assessment.agent,
+      tool_manifest_sha256: currentManifest,
+      tool_profile: resolveToolProfile(config.toolProfile),
+      repo_path: assessment.resolved_repo_path,
+      change_policy: assessment.change_policy || "repo_scoped_changes",
+      template: assessment.template || null,
+      verify_commands: assessment.verify_commands || [],
+      test_command: assessment.test_command || null,
+      task_timeout_seconds: assessment.timeout_seconds,
+      scope: assessment.scope,
+      forbidden: assessment.forbidden,
+      verification: assessment.verification,
+      done_evidence: assessment.done_evidence,
+    });
+    if (
+      assessment.assessment_security_snapshot_version
+      && assessment.assessment_security_snapshot_version !== ASSESSMENT_SECURITY_SNAPSHOT_VERSION
+    ) {
+      return {
+        valid: false,
+        failure_reason: "assessment_snapshot_version_incompatible",
+        assessment,
+        expected_hash: assessment.execution_config_hash,
+        actual_hash: currentExecutionConfig.hash,
+        config_change_categories: ["schema_epoch"],
+      };
+    }
+    if (currentExecutionConfig.hash !== assessment.execution_config_hash) {
+      const previousComponents = assessment.execution_config_component_hashes;
+      const changedCategories = previousComponents
+        ? (Object.keys(currentExecutionConfig.components) as ExecutionConfigChangeCategory[])
+          .filter((category) => previousComponents[category] !== currentExecutionConfig.components[category])
+        : ["execution_config" as const];
+      return {
+        valid: false,
+        failure_reason: "assessment_stale_config",
+        assessment,
+        expected_hash: assessment.execution_config_hash,
+        actual_hash: currentExecutionConfig.hash,
+        config_change_categories: changedCategories.length > 0 ? changedCategories : ["execution_config"],
+      };
+    }
+  }
+
   const currentPolicyHash = computePolicyHash({
     change_policy: assessment.change_policy || "repo_scoped_changes",
     template: assessment.template || null,
@@ -425,10 +584,76 @@ function getRepoAllowedCommands(config: PatchWardenConfig, repoPath: string): st
   return getRepoAllowedTestCommands(config, repoPath);
 }
 
-function computeFallbackManifestHash(config: PatchWardenConfig): string {
-  return createHash("sha256")
-    .update(`${TOOL_SCHEMA_EPOCH}:${config.toolProfile || "full"}`)
-    .digest("hex");
+function getCurrentToolManifest(config: PatchWardenConfig): string {
+  // The catalog cache is process-local. Rebuild the canonical catalog here so
+  // MCP and the independent Watcher derive the same manifest across processes.
+  const profile = resolveToolProfile(config.toolProfile);
+  return buildToolCatalogSnapshot(getToolDefs(), profile).tool_manifest_sha256;
+}
+
+interface ExecutionConfigHashInput {
+  agent: string;
+  tool_manifest_sha256: string;
+  tool_profile: string;
+  repo_path: string;
+  change_policy?: string | null;
+  template?: string | null;
+  verify_commands?: string[];
+  test_command?: string | null;
+  task_timeout_seconds?: number | null;
+  scope?: string[];
+  forbidden?: string[];
+  verification?: string[];
+  done_evidence?: string[];
+}
+
+export function computeExecutionConfigHash(
+  config: PatchWardenConfig,
+  input: ExecutionConfigHashInput,
+): string {
+  return computeExecutionConfigFingerprint(config, input).hash;
+}
+
+function computeExecutionConfigFingerprint(
+  config: PatchWardenConfig,
+  input: ExecutionConfigHashInput,
+): { hash: string; components: Partial<Record<ExecutionConfigChangeCategory, string>> } {
+  let projectPolicy: ProjectPolicy | null = null;
+  let projectPolicyValid: boolean | null = null;
+  let projectPolicyIssues: Array<{ code: string; severity: string; field: string }> = [];
+  try {
+    const summary = getProjectPolicySummary(input.repo_path);
+    projectPolicy = summary.effective_policy;
+    projectPolicyValid = summary.valid;
+    projectPolicyIssues = summary.issues.map(({ code, severity, field }) => ({ code, severity, field }));
+  } catch {
+    // A workspace-root change can make the old repository inaccessible. The
+    // workspace_root component still fails closed without exposing the path.
+  }
+  const snapshot = buildAssessmentSecuritySnapshot({
+    config,
+    schemaEpoch: TOOL_SCHEMA_EPOCH,
+    toolProfile: input.tool_profile,
+    toolManifestSha256: input.tool_manifest_sha256,
+    agent: input.agent,
+    repoPath: input.repo_path,
+    changePolicy: input.change_policy,
+    template: input.template,
+    verifyCommands: input.verify_commands,
+    testCommand: input.test_command,
+    taskTimeoutSeconds: input.task_timeout_seconds,
+    scope: input.scope,
+    forbidden: input.forbidden,
+    verification: input.verification,
+    doneEvidence: input.done_evidence,
+    projectPolicy,
+    projectPolicyValid,
+    projectPolicyIssues,
+  });
+  return {
+    hash: hashAssessmentSecuritySnapshot(snapshot),
+    components: getAssessmentSecuritySnapshotComponentHashes(snapshot),
+  };
 }
 
 function extractReason(error: unknown): string {