penthera 1.7.0 → 1.8.0

package/lib/fix/apply.js

@@ -2,12 +2,23 @@
  * applyDiff: the one place fix recipes' diffs get written to disk.
  *
  * Planning never writes. Applying is a separate, explicit step that refuses to
- * write outside the repo, into any .git (any case, any depth), to .gitmodules,
- * through a symlink anywhere in the path, or into a dirty git tree (unless the
- * caller passes allowDirty), and writes nothing unless every hunk applies.
+ * write outside the repo, into any .git (any case, any depth, any NTFS alias),
+ * to a protected file (tests, test config, Penthera's own files, CI, hooks,
+ * lockfiles, .gitmodules: see PROTECTED_FILES), through a symlink anywhere in the path, or into a dirty git
+ * tree (unless the caller passes allowDirty). It refuses added lines carrying
+ * control characters a terminal would act on, and it is all-or-nothing: every
+ * hunk must apply, and if a write fails the files already written are put back.
+ *
+ * Each file is written to a temp file in its directory and moved into place, so
+ * a hard link is replaced rather than written through, and an edit is refused
+ * if the file changed since it was read.
  */
-import { existsSync, readFileSync, mkdirSync, realpathSync, lstatSync, openSync, writeSync, closeSync, constants } from "node:fs";
-import { dirname, isAbsolute, join, relative, resolve, sep } from "node:path";
+import { createHash, randomBytes } from "node:crypto";
+import {
+  existsSync, readFileSync, mkdirSync, realpathSync, lstatSync, fstatSync, openSync, writeSync, closeSync,
+  renameSync, linkSync, unlinkSync, rmdirSync, chmodSync, constants,
+} from "node:fs";
+import { basename, dirname, isAbsolute, join, relative, resolve, sep } from "node:path";
 import { createGit } from "../../src/agent/git.js";
 import { parsePatch, applyHunks } from "./diff.js";
 
@@ -24,8 +35,10 @@ function inside(root, p) {
   return rel === "" || (!rel.startsWith(`..${sep}`) && rel !== ".." && !isAbsolute(rel));
 }
 
-// Code points HFS+ ignores in names, so ".g\u200cit" is ".git" on macOS (CVE-2014-9390).
-const IGNORABLE = /[\u200b-\u200f\u202a-\u202e\u2060-\u2064\u206a-\u206f\ufeff]/g;
+export const sha256 = (buf) => createHash("sha256").update(buf).digest("hex");
+
+// Code points HFS+ ignores in names, so ".g‌it" is ".git" on macOS (CVE-2014-9390).
+const IGNORABLE = /[​-‏‪-‮⁠-⁤-]/g;
 
 /**
  * The name a path segment resolves to on case-insensitive file systems
@@ -42,18 +55,51 @@ export function isGitDirSegment(seg) {
   return c === ".git" || /^git~\d+$/.test(c);
 }
 
-/** Files a fix diff may never touch even though they live in the work tree. */
-const PROTECTED_FILES = new Set([".gitmodules"]);
+const LOCKFILES = new Set([
+  "package-lock.json", "npm-shrinkwrap.json", "yarn.lock", "pnpm-lock.yaml", "bun.lock", "bun.lockb", "deno.lock",
+  "poetry.lock", "pipfile.lock", "uv.lock", "pdm.lock", "cargo.lock", "go.sum", "gemfile.lock", "composer.lock",
+]);
+const TEST_CONFIG = new Set(["package.json", "pytest.ini", "tox.ini", "setup.cfg", "pyproject.toml"]);
+
+/**
+ * Paths a fix diff may never touch even though they live in the work tree: the
+ * judge that verifies a fix (tests, test runner config, Penthera's own policy,
+ * suppressions, baseline and memory), CI, git hooks and lockfiles. A fix may not
+ * pass by editing its own checker. Each entry is [what, test(segments, basename)]
+ * on canonical segments, so case and Windows aliases do not slip past.
+ */
+const PROTECTED_FILES = [
+  ["Windows 8.3 short names (they can alias a protected file)", (s) => s.some((d) => /~\d+(\.[^.]*)?$/.test(d))],
+  [".gitmodules (it can point git at other repositories)", (s, b) => b === ".gitmodules"],
+  ["tests", (s, b) => s.some((d) => d === "test" || d === "tests" || d === "__tests__") || /\.(test|spec)\./.test(b) || b === "conftest.py"],
+  ["test runner config or the test script", (s, b) => /^(vitest|jest|playwright)\./.test(b) || TEST_CONFIG.has(b)],
+  ["Penthera's own policy, suppressions, baseline, lock or memory", (s, b) => b.startsWith("penthera.") || s.includes(".penthera") || s.join("/").endsWith("audit/baseline.json")],
+  ["CI workflows", (s) => s.some((d, i) => d === ".github" && s[i + 1] === "workflows")],
+  ["git hooks", (s, b) => s.includes(".husky") || s.includes(".githooks") || /^(lefthook\.ya?ml|\.pre-commit-config\.ya?ml)$/.test(b)],
+  ["lockfiles", (s, b) => LOCKFILES.has(b)],
+];
+
+/** What protected kind of file `file` (repo-relative) is, or null if a fix may edit it. */
+export function protectedReason(file) {
+  const segs = String(file).split(/[\\/]/).filter((x) => x && x !== ".").map(canonicalSegment);
+  const hit = PROTECTED_FILES.find(([, test]) => test(segs, segs[segs.length - 1] || ""));
+  return hit ? hit[0] : null;
+}
+
+// C0 controls (tab aside), DEL and C1 controls: a terminal acts on them instead of showing them.
+const CONTROL = /[\u0000-\u0008\u000a-\u001f\u007f-\u009f]/;
 
 /**
- * Throws unless no component of `target` below `root` is a symlink. Every
+ * Throws unless no component of `target` below `root` is a symlink, and no
+ * component above the file itself is something other than a directory. Every
  * existing component is lstat-ed, so neither a symlinked directory nor a
  * dangling symlink at the file itself can redirect a write.
  */
 function assertNoSymlinks(root, target, file) {
   let cur = root;
-  for (const seg of relative(root, target).split(sep)) {
-    cur = join(cur, seg);
+  const segs = relative(root, target).split(sep);
+  for (let i = 0; i < segs.length; i++) {
+    cur = join(cur, segs[i]);
     let st;
     try {
       st = lstatSync(cur);
@@ -64,20 +110,26 @@ function assertNoSymlinks(root, target, file) {
     if (st.isSymbolicLink()) {
       throw new FixError(`Refusing to write ${file}: ${relative(root, cur)} is a symlink, and fix diffs never write through symlinks`, "SYMLINK");
     }
+    if (i < segs.length - 1 && !st.isDirectory()) {
+      throw new FixError(`Refusing to write ${file}: ${relative(root, cur)} is not a directory`, "CONFLICT");
+    }
   }
 }
 
 /** Resolve a diff path to an absolute path inside the repo, or throw. */
 function safeTarget(root, file) {
-  if (!file || isAbsolute(file) || file.includes("\0") || /^[a-zA-Z]:/.test(file)) {
+  if (!file || isAbsolute(file) || CONTROL.test(file) || file.includes("\0") || /^[a-zA-Z]:/.test(file)) {
     throw new FixError(`Refusing to write ${JSON.stringify(file)}: paths in a diff must be relative to the repo`, "OUTSIDE_REPO");
   }
   const segs = file.split(/[\\/]/);
   if (segs.includes("..")) throw new FixError(`Refusing to write ${file}: it is outside the repo`, "OUTSIDE_REPO");
+  // NTFS alternate data streams (".git::$INDEX_ALLOCATION") name the same directory or file.
+  if (segs.some((s) => s.includes(":"))) throw new FixError(`Refusing to write ${JSON.stringify(file)}: path segments may not contain ":"`, "OUTSIDE_REPO");
   // Any .git at any depth, in any case: on macOS .GIT/hooks/pre-commit is .git/hooks/pre-commit.
   if (segs.some(isGitDirSegment)) throw new FixError(`Refusing to write ${file}: it is inside .git`, "OUTSIDE_REPO");
-  if (segs.some((s) => PROTECTED_FILES.has(canonicalSegment(s)))) {
-    throw new FixError(`Refusing to write ${file}: fix diffs never edit .gitmodules (it can point git at other repositories)`, "PROTECTED");
+  const why = protectedReason(file);
+  if (why) {
+    throw new FixError(`Refusing to write ${file}: fix diffs never edit ${why}, so the checks that verify a fix stay as they were. If the real fix needs this file changed, make that change by hand and review it.`, "PROTECTED");
   }
   const target = resolve(root, file);
   if (!inside(root, target) || target === root) throw new FixError(`Refusing to write ${file}: it is outside the repo`, "OUTSIDE_REPO");
@@ -89,43 +141,187 @@ function safeTarget(root, file) {
 export function assertCleanTree(repoPath) {
   let status;
   try {
-    // The hardened runner: no fsmonitor, no hooks, no transports (src/agent/git.js).
+    // The hardened runner: no fsmonitor, no hooks, no filters, no transports (src/agent/git.js).
     const git = createGit(repoPath);
     git.run("rev-parse", "--is-inside-work-tree");
-    status = git.run("status", "--porcelain", "--", ".");
+    status = git.run("status", "--porcelain=v1", "-z", "--", ".");
   } catch {
     throw new FixError(`${repoPath} is not a git work tree, so a fix could not be reviewed or reverted. Commit it to git first, or pass --allow-dirty.`, "NOT_GIT");
   }
-  if (status.trim()) {
+  if (status.length) {
     throw new FixError(`${repoPath} has uncommitted changes. Commit or stash them first so the fix is its own reviewable change, or pass --allow-dirty.`, "DIRTY");
   }
 }
 
 const NOFOLLOW = constants.O_NOFOLLOW || 0;
 
-/** Write one file: create exclusively, or overwrite in place, never through a symlink. */
-function writeTarget(root, w) {
-  assertNoSymlinks(root, w.target, w.path); // again, right before writing
-  mkdirSync(dirname(w.target), { recursive: true });
-  assertNoSymlinks(root, w.target, w.path);
-  const flags = constants.O_WRONLY | NOFOLLOW | (w.created ? constants.O_CREAT | constants.O_EXCL : constants.O_TRUNC);
-  const fd = openSync(w.target, flags, 0o644);
+/** Current bytes of a regular file, null if it does not exist; throws on anything else. */
+function readCurrent(target, file) {
+  let st;
   try {
-    const buf = Buffer.from(w.after, "utf-8");
-    let off = 0;
-    while (off < buf.length) off += writeSync(fd, buf, off, buf.length - off);
+    st = lstatSync(target);
+  } catch (e) {
+    if (e.code === "ENOENT") return null;
+    throw e;
+  }
+  if (!st.isFile()) throw new FixError(`Refusing to write ${file}: it is not a regular file`, "CONFLICT");
+  const fd = openSync(target, constants.O_RDONLY | NOFOLLOW);
+  try {
+    return readFileSync(fd);
   } finally {
     closeSync(fd);
   }
 }
 
+function assertDirInside(root, dir, file) {
+  const real = realpathSync(dir);
+  if (!inside(root, real)) throw new FixError(`Refusing to write ${file}: its directory resolves outside the repo`, "OUTSIDE_REPO");
+}
+
+/**
+ * Put `data` at `target`, but only if the file currently holds `expect`
+ * (a Buffer), or does not exist (expect === null). The bytes go to a temp file
+ * in the same directory first, then are moved into place: rename for an edit
+ * (which replaces a hard link instead of writing through it), link for a new
+ * file (which fails if something appeared there meanwhile).
+ *
+ * @returns {{ madeDir: string|undefined }} the first directory mkdir created, if any
+ */
+function replaceFile(root, file, target, data, expect) {
+  assertNoSymlinks(root, target, file);
+  const dir = dirname(target);
+  const madeDir = mkdirSync(dir, { recursive: true });
+  assertNoSymlinks(root, target, file);
+  assertDirInside(root, dir, file);
+
+  const current = readCurrent(target, file);
+  const unchanged = expect === null ? current === null : current !== null && current.equals(expect);
+  if (!unchanged) throw new FixError(`${file} changed on disk since the fix was planned; nothing was written to it`, "CHANGED");
+  const mode = current === null ? 0o644 : lstatSync(target).mode & 0o7777;
+
+  const tmp = join(dir, `.${basename(target)}.penthera-${randomBytes(6).toString("hex")}.tmp`);
+  const fd = openSync(tmp, constants.O_WRONLY | constants.O_CREAT | constants.O_EXCL | NOFOLLOW, 0o600);
+  try {
+    let off = 0;
+    while (off < data.length) off += writeSync(fd, data, off, data.length - off);
+    // The temp file we wrote must be the one at that path, in a directory inside the repo.
+    const a = fstatSync(fd);
+    const b = lstatSync(tmp);
+    if (a.dev !== b.dev || a.ino !== b.ino) throw new FixError(`Refusing to write ${file}: its directory changed while writing`, "RACE");
+  } catch (e) {
+    closeSync(fd);
+    try { unlinkSync(tmp); } catch { /* best effort */ }
+    throw e;
+  }
+  closeSync(fd);
+  try {
+    chmodSync(tmp, mode);
+    assertDirInside(root, dir, file);
+    if (expect === null) {
+      try {
+        linkSync(tmp, target);
+      } catch (e) {
+        if (e.code === "EEXIST") throw new FixError(`${file} appeared on disk while the fix was being written; nothing was written to it`, "CHANGED");
+        // File systems without hard links: exclusive create, never through a symlink.
+        const out = openSync(target, constants.O_WRONLY | constants.O_CREAT | constants.O_EXCL | NOFOLLOW, mode);
+        try {
+          let off = 0;
+          while (off < data.length) off += writeSync(out, data, off, data.length - off);
+        } finally {
+          closeSync(out);
+        }
+      }
+    } else {
+      const again = readCurrent(target, file);
+      if (!again || !again.equals(expect)) throw new FixError(`${file} changed on disk while the fix was being written; nothing was written to it`, "CHANGED");
+      renameSync(tmp, target);
+    }
+  } finally {
+    try { unlinkSync(tmp); } catch { /* already renamed */ }
+  }
+  return { madeDir };
+}
+
+/** Remove the directories a write created (deepest first), as long as they are empty. */
+function removeMadeDirs(target, madeDir) {
+  if (!madeDir) return;
+  for (let d = dirname(target); d.length >= madeDir.length; d = dirname(d)) {
+    try { rmdirSync(d); } catch { return; }
+    if (d === madeDir) return;
+  }
+}
+
+/**
+ * Put files written by applyDiff back the way they were, one by one, never
+ * over somebody else's edit: a file is restored (or, if the fix created it,
+ * removed) only while it still holds exactly what applyDiff wrote. A file that
+ * changed since is left alone and reported as a conflict. Every file is tried
+ * even if an earlier one fails.
+ *
+ * @param {string} repoPath
+ * @param {{ path: string, created: boolean, before: Buffer|null, sha256: string }[]} files - applyDiff's result
+ * @returns {{ restored: string[], conflicts: string[], errors: { path: string, message: string }[] }}
+ */
+export function restoreFiles(repoPath, files) {
+  const root = realpathSync(resolve(repoPath));
+  const out = { restored: [], conflicts: [], errors: [] };
+  for (const f of files) {
+    try {
+      const target = safeTarget(root, f.path);
+      const current = readCurrent(target, f.path);
+      const original = f.created ? null : f.before;
+      if (current === null ? original === null : original !== null && current.equals(original)) {
+        out.restored.push(f.path); // already as it was
+      } else if (current === null || sha256(current) !== f.sha256) {
+        out.conflicts.push(f.path);
+      } else if (original === null) {
+        unlinkSync(target);
+        out.restored.push(f.path);
+      } else {
+        replaceFile(root, f.path, target, original, current);
+        out.restored.push(f.path);
+      }
+    } catch (e) {
+      if (e.code === "CHANGED") out.conflicts.push(f.path);
+      else out.errors.push({ path: f.path, message: e.message });
+    }
+  }
+  return out;
+}
+
+/** Throws if an added line carries a control character (a trailing CR of a CRLF line is fine). */
+function assertPrintable(f) {
+  for (const h of f.hunks) {
+    for (const op of h.ops) {
+      if (op.t !== "+") continue;
+      const line = op.line.replace(/\u0000$/, "").replace(/\r$/, "");
+      if (CONTROL.test(line)) {
+        throw new FixError(`Refusing to write ${f.newPath}: an added line contains a control character (${JSON.stringify(line.match(CONTROL)[0])}), which can hide code in a terminal`, "CONTROL_CHARS");
+      }
+    }
+  }
+}
+
+/** Throws on two entries for one file, or one file that is another's directory. */
+function assertDistinctPaths(parsed) {
+  const keys = parsed.map((f) => String(f.newPath).split(/[\\/]/).map(canonicalSegment).join("/"));
+  for (let i = 0; i < keys.length; i++) {
+    for (let j = 0; j < keys.length; j++) {
+      if (i === j) continue;
+      if (keys[i] === keys[j]) throw new FixError(`Refusing the diff: it changes ${parsed[i].newPath} more than once`, "DUPLICATE");
+      if (keys[j].startsWith(`${keys[i]}/`)) throw new FixError(`Refusing the diff: ${parsed[i].newPath} is both a file and the directory of ${parsed[j].newPath}`, "CONFLICT");
+    }
+  }
+}
+
 /**
  * Apply a unified diff to files under repoPath.
  *
  * @param {string} repoPath
  * @param {string} diff
  * @param {{ dryRun?: boolean, allowDirty?: boolean }} [opts]
- * @returns {{ applied: boolean, files: { path: string, created: boolean }[] }}
+ * @returns {{ applied: boolean, files: { path: string, created: boolean, before: Buffer|null, sha256: string }[] }}
+ *   before is the file's bytes before the write; sha256 is the hash of what was written.
  */
 export function applyDiff(repoPath, diff, opts = {}) {
   const root = realpathSync(resolve(repoPath));
@@ -137,23 +333,46 @@ export function applyDiff(repoPath, diff, opts = {}) {
   for (const f of parsed) {
     if (!f.newPath) throw new FixError(`Refusing to delete ${f.oldPath}: fix diffs never delete files`, "DELETE");
     if (f.oldPath && f.oldPath !== f.newPath) throw new FixError(`Refusing to rename ${f.oldPath}: fix diffs never rename files`, "RENAME");
+    assertPrintable(f);
+  }
+  assertDistinctPaths(parsed);
+  for (const f of parsed) {
     const target = safeTarget(root, f.newPath);
     const exists = existsSync(target);
     if (exists && !lstatSync(target).isFile()) throw new FixError(`Refusing to write ${f.newPath}: it is not a regular file`, "CONFLICT");
     if (!f.oldPath && exists) throw new FixError(`${f.newPath} already exists; the plan expected to create it`, "CONFLICT");
     if (f.oldPath && !exists) throw new FixError(`${f.newPath} does not exist; the plan expected to edit it`, "CONFLICT");
-    const before = exists ? readFileSync(target, "utf-8") : null;
+    const before = exists ? readCurrent(target, f.newPath) : null;
     let after;
     try {
-      after = applyHunks(before, f.hunks);
+      after = Buffer.from(applyHunks(before === null ? null : before.toString("utf-8"), f.hunks), "utf-8");
     } catch (e) {
       throw new FixError(`${f.newPath}: ${e.message}`, "CONFLICT");
     }
-    writes.push({ path: f.newPath, target, after, created: !exists });
+    writes.push({ path: f.newPath, target, before, after, created: !exists });
   }
 
   if (!opts.dryRun) {
-    for (const w of writes) writeTarget(root, w);
+    const done = [];
+    try {
+      for (const w of writes) {
+        const { madeDir } = replaceFile(root, w.path, w.target, w.after, w.before);
+        done.push({ ...w, madeDir });
+      }
+    } catch (e) {
+      // All or nothing: put back what was written, newest first.
+      for (const w of done.reverse()) {
+        try {
+          if (w.created) unlinkSync(w.target);
+          else replaceFile(root, w.path, w.target, w.before, w.after);
+          removeMadeDirs(w.target, w.madeDir);
+        } catch { /* reported through the original error */ }
+      }
+      throw e;
+    }
   }
-  return { applied: !opts.dryRun, files: writes.map((w) => ({ path: w.path, created: w.created })) };
+  return {
+    applied: !opts.dryRun,
+    files: writes.map((w) => ({ path: w.path, created: w.created, before: w.before, sha256: sha256(w.after) })),
+  };
 }

package/lib/fix/index.js

@@ -14,7 +14,7 @@ import cors from "./recipes/cors.js";
 import rateLimit from "./recipes/rate-limit.js";
 import secrets from "./recipes/secrets.js";
 
-export { applyDiff, assertCleanTree, FixError } from "./apply.js";
+export { applyDiff, assertCleanTree, restoreFiles, FixError } from "./apply.js";
 export { createPatch, parsePatch, applyHunks } from "./diff.js";
 export { createModelFixer } from "./model.js";
 
@@ -51,12 +51,14 @@ const brief = (f) => ({ title: f.title, severity: f.severity, category: f.catego
  * @param {string} repoPath
  * @param {object[]} findings
  * @param {{ model?: { plan(repoPath, finding): Promise<object|null> }, recipes?: object[] }} [opts]
- * @returns {Promise<{ plans: object[], unmatched: object[] }>}
+ * @returns {Promise<{ plans: object[], unmatched: object[], refused: { finding: object, reason: string }[] }>}
+ *   refused: findings whose model diff edited a protected file; they are in unmatched too.
  */
 export async function planFixes(repoPath, findings, opts = {}) {
   const recipes = opts.recipes || RECIPES;
   const plans = new Map();
   const unmatched = [];
+  const refused = [];
   const frameworks = new Map();
   const sorted = [...(findings || [])].sort((a, b) => (SEV_ORDER[a.severity] ?? 5) - (SEV_ORDER[b.severity] ?? 5));
 
@@ -103,7 +105,8 @@ export async function planFixes(repoPath, findings, opts = {}) {
       let p = null;
       try {
         p = await opts.model.plan(repoPath, finding);
-      } catch {
+      } catch (e) {
+        if (e?.code === "PROTECTED") refused.push({ finding, reason: e.message });
         p = null;
       }
       if (p?.diff) {
@@ -113,7 +116,7 @@ export async function planFixes(repoPath, findings, opts = {}) {
     }
     unmatched.push(finding);
   }
-  return { plans: [...plans.values()], unmatched };
+  return { plans: [...plans.values()], unmatched, refused };
 }
 
 /** Mask redacted values (hardcoded secrets) so a plan is safe to print or store. */

package/lib/fix/model.js

@@ -6,10 +6,13 @@
  * it anywhere else, redirects are refused, and the URL is checked before every
  * request. Off by default. Its output is always labelled
  * confidence "needs-human-review" and source "local-model", and a diff that
- * does not parse, leaves the repo, or fails to apply is dropped.
+ * does not parse, leaves the repo, or fails to apply is dropped. A diff that
+ * edits a protected file (tests, test config, Penthera's own files: see
+ * lib/fix/apply.js) throws FixError PROTECTED, so the attempt is reported.
  */
-import { existsSync, readFileSync } from "node:fs";
-import { join } from "node:path";
+import { existsSync, readFileSync, realpathSync } from "node:fs";
+import { isAbsolute, join, relative, sep } from "node:path";
+import { readJson } from "../../src/utils/http.js";
 import { applyDiff } from "./apply.js";
 import { parsePatch } from "./diff.js";
 import { detectFramework, walkCodeFiles, findEntryFile } from "./util.js";
@@ -24,7 +27,23 @@ export function assertLocalModelUrl(url) {
   return u;
 }
 
+/** True when `file` (repo-relative) really lives in the repo once symlinks are resolved. */
+function insideRepo(repoPath, file) {
+  try {
+    const rel = relative(realpathSync(repoPath), realpathSync(join(repoPath, file)));
+    return rel !== "" && rel !== ".." && !rel.startsWith(`..${sep}`) && !isAbsolute(rel);
+  } catch {
+    return false;
+  }
+}
+
+/** The one repo file whose source goes into the prompt; never a file outside the repo. */
 function contextFile(repoPath, finding) {
+  const file = pickContextFile(repoPath, finding);
+  return file && insideRepo(repoPath, file) ? file : null;
+}
+
+function pickContextFile(repoPath, finding) {
   const files = walkCodeFiles(repoPath);
   if (finding.url && files.includes(finding.url)) return finding.url;
   const fw = detectFramework(repoPath);
@@ -84,7 +103,7 @@ export function createModelFixer({ model, fetch: fetchImpl = globalThis.fetch, t
         signal: AbortSignal.timeout(timeout),
       });
       if (!res.ok) return null;
-      const data = await res.json();
+      const data = await readJson(res, { maxBytes: 4 * 1024 * 1024, timeout });
       const diff = extractDiff(data?.response);
       if (!diff) return null;
       let files;
@@ -92,7 +111,8 @@ export function createModelFixer({ model, fetch: fetchImpl = globalThis.fetch, t
         files = parsePatch(diff).map((f) => f.newPath);
         // Validates paths stay inside the repo and every hunk applies; writes nothing.
         applyDiff(repoPath, diff, { dryRun: true, allowDirty: true });
-      } catch {
+      } catch (e) {
+        if (e?.code === "PROTECTED") throw e; // an edit to the checker is reported, never quietly dropped
         return null;
       }
       return {

package/lib/fix/util.js

@@ -4,7 +4,7 @@
  * keys off a line the recipe can recognise exactly, and gives up otherwise.
  */
 import { existsSync, readFileSync, readdirSync, statSync } from "node:fs";
-import { join, relative } from "node:path";
+import { isAbsolute, join, normalize, relative, sep } from "node:path";
 import { detectFramework as detectSourceFramework } from "../whitebox/frameworks.js";
 import { createPatch } from "./diff.js";
 
@@ -91,7 +91,11 @@ export function walkCodeFiles(repoPath) {
 export function findEntryFile(repoPath, anchor) {
   const candidates = [...ENTRY_CANDIDATES];
   const main = readPackageJson(repoPath)?.main;
-  if (typeof main === "string") candidates.unshift(main.replace(/^\.\//, ""));
+  // package.json is repo data: a "main" that points out of the repo is ignored.
+  if (typeof main === "string" && main && !isAbsolute(main) && !/^[a-zA-Z]:/.test(main)) {
+    const rel = normalize(main);
+    if (rel !== ".." && !rel.startsWith(`..${sep}`) && !rel.startsWith("../")) candidates.unshift(rel.replace(/\\/g, "/"));
+  }
   for (const rel of candidates) {
     const source = readText(repoPath, rel);
     if (source && anchor.test(source)) return { file: rel, source };

package/lib/fuzzer.js

@@ -17,7 +17,7 @@
  *   validates its input. Nothing runs on the machine running Penthera.
  */
 
-import { request } from "../src/utils/http.js";
+import { request, readBody } from "../src/utils/http.js";
 
 // ── Payload Generators ────────────────────────────────────────────────────
 
@@ -140,7 +140,7 @@ export function generateFuzzedBodies(validBody, opts = {}) {
   const maxPayloads = opts.maxPayloads || 50;
   const variants = [];
 
-  for (const [field, validValue] of Object.entries(validBody)) {
+  for (const field of Object.keys(validBody)) {
     const fuzzValues = fuzzField(field);
 
     // Take a sample if too many
@@ -195,7 +195,7 @@ export async function fuzzEndpoint(baseUrl, path, validBody, opts = {}) {
         redirect: "follow",
       });
 
-      const text = await res.text().catch(() => "");
+      const text = await readBody(res).catch(() => "");
       const result = {
         field: variant.field,
         payload: typeof variant.payload === "object" ? JSON.stringify(variant.payload) : String(variant.payload).slice(0, 100),

package/lib/git.js

@@ -0,0 +1,65 @@
+/**
+ * The one place penthera runs git.
+ *
+ * Every call reads a repository that may not be the user's own (a scanned
+ * archive, a shared folder, a devcontainer), so every call runs with config
+ * overrides that keep that repository's config from running programs: no
+ * hooks, no fsmonitor, no transports, no credential helper, no signing, and
+ * no attributes file. The agent loop's allow-listed runner (src/agent/git.js)
+ * adds its own checks on top of these.
+ */
+import { execFileSync, spawnSync } from "node:child_process";
+import { resolve } from "node:path";
+
+export const NULL_DEVICE = process.platform === "win32" ? "NUL" : "/dev/null";
+
+export const SAFE_CONFIG = Object.freeze([
+  "-c", "protocol.allow=never",
+  "-c", `core.hooksPath=${NULL_DEVICE}`,
+  "-c", "core.fsmonitor=false",
+  "-c", "credential.helper=",
+  "-c", "commit.gpgsign=false",
+  "-c", "tag.gpgsign=false",
+  "-c", "log.showSignature=false",
+  "-c", "gpg.program=false",
+  "-c", "gpg.openpgp.program=false",
+  "-c", "gpg.x509.program=false",
+  "-c", "gpg.ssh.program=false",
+  "-c", "gpg.ssh.defaultKeyCommand=",
+  "-c", `core.attributesFile=${NULL_DEVICE}`,
+]);
+
+/** Environment for every git child: no lazy fetches, no prompts. */
+export const safeEnv = (env = process.env) => ({ ...env, GIT_NO_LAZY_FETCH: "1", GIT_TERMINAL_PROMPT: "0" });
+
+/**
+ * Run git synchronously with the safe config. Returns stdout (utf-8 unless
+ * `encoding` says otherwise); throws like execFileSync.
+ * `raw: true` skips the config overrides, for the few reads that must see the
+ * repo's real config (where its hooks live).
+ * @param {string} cwd
+ * @param {string[]} args
+ * @param {import("node:child_process").ExecFileSyncOptions & { raw?: boolean }} [opts]
+ */
+export function git(cwd, args, { raw = false, ...opts } = {}) {
+  return execFileSync("git", raw ? args : [...SAFE_CONFIG, ...args], {
+    cwd, encoding: "utf-8", stdio: ["ignore", "pipe", "pipe"], maxBuffer: 256 * 1024 * 1024, env: safeEnv(), ...opts,
+  });
+}
+
+/** spawnSync form of git(), for calls that feed stdin; returns the spawnSync result. */
+export function gitSpawn(cwd, args, opts = {}) {
+  return spawnSync("git", [...SAFE_CONFIG, ...args], { cwd, maxBuffer: 1024 * 1024 * 1024, env: safeEnv(), ...opts });
+}
+
+/**
+ * The work tree's toplevel as a native path (git prints D:/a/app on Windows),
+ * or null outside a repo or without git.
+ */
+export function gitToplevel(cwd) {
+  try {
+    return resolve(git(cwd, ["rev-parse", "--show-toplevel"], { stdio: ["ignore", "pipe", "ignore"] }).trim());
+  } catch {
+    return null;
+  }
+}