patchwarden 0.4.0 → 0.6.1

package/scripts/tunnel-supervisor-smoke.js

@@ -14,10 +14,19 @@ const root = resolve(fileURLToPath(new URL("..", import.meta.url)));
 const temp = mkdtempSync(join(tmpdir(), "patchwarden-tunnel-smoke-"));
 const mockJs = join(temp, "mock-tunnel-client.js");
 const mockCmd = join(temp, "mock-tunnel-client.cmd");
+const mockConfig = join(temp, "patchwarden.config.json");
 const stateFile = join(temp, "attempt.txt");
 const secretMarker = "smoke-secret-must-not-appear";
 
 try {
+  writeFileSync(mockConfig, JSON.stringify({
+    workspaceRoot: temp,
+    plansDir: ".patchwarden/plans",
+    tasksDir: ".patchwarden/tasks",
+    toolProfile: "chatgpt_core",
+    agents: { smoke: { command: process.execPath, args: [] } },
+    allowedTestCommands: ["npm test"],
+  }, null, 2), "utf-8");
   writeFileSync(mockCmd, `@echo off\r\nnode "%MOCK_TUNNEL_JS%" %*\r\n`, "utf-8");
   writeFileSync(mockJs, `
 const fs=require('fs');
@@ -30,11 +39,12 @@ if(command==='health'){console.log(JSON.stringify({healthz:{ok:true},readyz:{ok:
 if(command==='run'){
   let attempt=0;try{attempt=Number(fs.readFileSync(process.env.MOCK_TUNNEL_STATE,'utf8'))||0}catch{}
   attempt++;fs.writeFileSync(process.env.MOCK_TUNNEL_STATE,String(attempt));
-  if(attempt===1)process.exit(7);
+  console.log('fixture cwd='+process.cwd());
+  if(attempt===1){console.error('fixture first attempt failed');process.exit(7)}
   const urlFile=flag('--health.url-file');const pidFile=flag('--pid.file');
   const server=http.createServer((req,res)=>{res.writeHead(200,{'content-type':'application/json'});res.end(JSON.stringify({ok:true}))});
   server.listen(18888,'127.0.0.1',()=>{fs.writeFileSync(urlFile,'http://127.0.0.1:18888');fs.writeFileSync(pidFile,String(process.pid))});
-  setTimeout(()=>server.close(()=>process.exit(9)),6500);
+  setTimeout(()=>server.close(()=>{for(let i=1;i<=35;i++)console.error('fixture stderr line '+i);console.error('CONTROL_PLANE_API_KEY='+process.env.CONTROL_PLANE_API_KEY);process.exit(9)}),6500);
 }
 `, "utf-8");
 
@@ -50,6 +60,7 @@ if(command==='run'){
     "-NoProfile", "-ExecutionPolicy", "Bypass", "-File", join(root, "scripts", "start-patchwarden-tunnel.ps1"),
     "-TunnelId", "tunnel_smoke_fixture",
     "-TunnelClientExe", mockCmd,
+    "-ConfigPath", mockConfig,
     "-ProxyUrl", "http://127.0.0.1:1",
     "-ReconnectBaseSeconds", "1",
     "-ReconnectMaxSeconds", "1",
@@ -59,6 +70,7 @@ if(command==='run'){
   ], { cwd: root, env, encoding: "utf-8", timeout: 30_000 });
 
   if (result.error) throw result.error;
+  const launcherOutput = `${result.stdout}\n${result.stderr}`;
   if (!existsSync(stateFile) || readFileSync(stateFile, "utf-8").trim() !== "2") {
     throw new Error(`Expected two supervised attempts. stdout=${result.stdout} stderr=${result.stderr}`);
   }
@@ -67,11 +79,31 @@ if(command==='run'){
   if (status.reason_code !== "retry_limit_reached" || status.attempt !== 2) {
     throw new Error(`Unexpected final supervisor status: ${JSON.stringify(status)}`);
   }
+  if (status.last_exit_code !== 9 || !Array.isArray(status.stderr_tail) || status.stderr_tail.length !== 30) {
+    throw new Error(`Supervisor did not preserve the latest exit diagnostics: ${JSON.stringify(status)}\n${launcherOutput}`);
+  }
+  if (!status.stdout_log?.endsWith("tunnel-client.stdout.log") || !status.stderr_log?.endsWith("tunnel-client.stderr.log")) {
+    throw new Error(`Supervisor log paths are missing: ${JSON.stringify(status)}`);
+  }
+  if (!existsSync(status.stdout_log) || !existsSync(status.stderr_log)) {
+    throw new Error(`Supervisor log files were not created: ${JSON.stringify(status)}`);
+  }
+  const stdoutLog = readFileSync(status.stdout_log, "utf-8").replace(/^\uFEFF/, "");
+  const stderrLog = readFileSync(status.stderr_log, "utf-8").replace(/^\uFEFF/, "");
+  if (!stdoutLog.includes(`fixture cwd=${root}`)) {
+    throw new Error(`Tunnel child did not inherit the project working directory: ${stdoutLog}`);
+  }
+  if (!stderrLog.includes("fixture stderr line 35") || !stderrLog.includes("[REDACTED]")) {
+    throw new Error(`Supervisor stderr log was not captured and sanitized: ${stderrLog}`);
+  }
   const serialized = JSON.stringify(status);
-  if (serialized.includes(secretMarker) || serialized.includes("tunnel_smoke_fixture")) {
+  if (serialized.includes(secretMarker) || launcherOutput.includes(secretMarker) || stdoutLog.includes(secretMarker) || stderrLog.includes(secretMarker) || serialized.includes("tunnel_smoke_fixture")) {
     throw new Error("Supervisor status leaked credential or tunnel identifier material");
   }
-  console.log("ok - tunnel supervisor retries, probes readiness, and writes redacted status");
+  if (!launcherOutput.includes("[error] stderr tail:") || !launcherOutput.includes("fixture stderr line 35")) {
+    throw new Error(`Supervisor did not print the stderr tail: ${launcherOutput}`);
+  }
+  console.log("ok - tunnel supervisor captures logs, redacts tails, fixes cwd, retries, and writes structured status");
 } finally {
   rmSync(temp, { recursive: true, force: true });
 }

package/scripts/unit-tests.js

@@ -0,0 +1,36 @@
+#!/usr/bin/env node
+import { existsSync, readdirSync } from "node:fs";
+import { spawnSync } from "node:child_process";
+import { resolve } from "node:path";
+import { fileURLToPath } from "node:url";
+
+const scriptDir = resolve(fileURLToPath(new URL(".", import.meta.url)));
+const root = resolve(scriptDir, "..");
+const unitDir = resolve(root, "dist", "test", "unit");
+
+if (!existsSync(unitDir)) {
+  console.error(`[unit-tests] Missing compiled test directory: ${unitDir}`);
+  console.error("[unit-tests] Run npm run build before npm run test:unit.");
+  process.exit(1);
+}
+
+const testFiles = readdirSync(unitDir)
+  .filter((name) => name.endsWith(".test.js"))
+  .sort()
+  .map((name) => resolve(unitDir, name));
+
+if (testFiles.length === 0) {
+  console.error(`[unit-tests] No compiled unit tests found in ${unitDir}`);
+  process.exit(1);
+}
+
+const result = spawnSync(process.execPath, ["--test", ...testFiles], {
+  stdio: "inherit",
+});
+
+if (result.error) {
+  console.error(`[unit-tests] Failed to run unit tests: ${result.error.message}`);
+  process.exit(1);
+}
+
+process.exit(typeof result.status === "number" ? result.status : 1);

package/scripts/watcher-supervisor-smoke.js

@@ -37,7 +37,7 @@ try {
   });
 
   await runExternalScenario();
-  console.log("ok - watcher supervisor handles exit, stale heartbeat, retry limit, and external ownership");
+  console.log("ok - watcher supervisor isolates environment and handles exit, stale heartbeat, retry limit, and external ownership");
 } finally {
   for (const child of children) {
     if (child.exitCode === null) child.kill("SIGKILL");
@@ -67,6 +67,7 @@ async function runExternalScenario() {
       PATCHWARDEN_CONFIG: fixture.configPath,
       PATCHWARDEN_WATCHER_INSTANCE_ID: "external-fixture",
       PATCHWARDEN_WATCHER_LAUNCHER_PID: "999999",
+      XDG_CONFIG_HOME: join(fixture.localAppData, "patchwarden", "opencode-config"),
     },
     stdio: "ignore",
   });
@@ -95,8 +96,8 @@ function createFixture(name) {
   writeFileSync(join(scripts, "patchwarden-mcp-stdio.cmd"), "@echo off\r\nexit /b 0\r\n", "utf-8");
   const manifestFixture = JSON.stringify({
     ok: true,
-    server_version: "0.4.0",
-    schema_epoch: "2026-06-20-v2",
+    server_version: "0.6.0",
+    schema_epoch: "2026-06-22-v6",
     tool_profile: "chatgpt_core",
     tool_count: 16,
     tool_names: [],
@@ -144,6 +145,7 @@ function runLauncher(fixture, mode, maxRestarts, lifetimeMs) {
     "-TunnelClientExe", fixture.mockCmd,
     "-ProxyUrl", "http://127.0.0.1:1",
     "-MaxReconnectAttempts", "1",
+    "-HealthListenAddr", "127.0.0.1:8080",
     "-WatcherMaxRestartAttempts", String(maxRestarts),
     "-WatcherHealthyResetSeconds", "60",
   ], {
@@ -168,6 +170,7 @@ function fixtureEnv(fixture, mode, lifetimeMs) {
 function watcherFixtureSource(attemptPath) {
   return `
 const fs=require('fs');const path=require('path');
+if(!process.env.XDG_CONFIG_HOME){console.error('watcher did not receive XDG_CONFIG_HOME');process.exit(12)}
 let attempt=0;try{attempt=Number(fs.readFileSync(${JSON.stringify(attemptPath)},'utf8'))||0}catch{}
 attempt++;fs.writeFileSync(${JSON.stringify(attemptPath)},String(attempt));
 const cfg=JSON.parse(fs.readFileSync(process.env.PATCHWARDEN_CONFIG,'utf8'));
@@ -182,11 +185,12 @@ else setInterval(write,250);
 
 function tunnelFixtureSource() {
   return `
-const fs=require('fs');const args=process.argv.slice(2);const command=args[0]||'';
+const fs=require('fs');const path=require('path');const args=process.argv.slice(2);const command=args[0]||'';
 const flag=(name)=>{const i=args.indexOf(name);return i>=0?args[i+1]:''};
-if(command==='init'||command==='doctor'){console.log('{}');process.exit(0)}
+if(command==='init'){const profile=flag('--profile')||'patchwarden';const mcpCommand=flag('--mcp-command')||'';const yamlDir=path.join(process.env.APPDATA,'tunnel-client');const yamlPath=path.join(yamlDir,profile+'.yaml');fs.mkdirSync(yamlDir,{recursive:true});fs.writeFileSync(yamlPath,'mcp:\\n  commands:\\n    - channel: main\\n      command: \"'+mcpCommand.replace(/\\\\/g,'/')+'\"\\n\\nhealth:\\n  listen_addr: \"127.0.0.1:8080\"\\n');console.log('{}');process.exit(0)}
+if(command==='doctor'){console.log('{}');process.exit(0)}
 if(command==='health'){console.log(JSON.stringify({healthz:{ok:true},readyz:{ok:true}}));process.exit(0)}
-if(command==='run'){const url=flag('--health.url-file'),pid=flag('--pid.file');fs.mkdirSync(require('path').dirname(url),{recursive:true});fs.writeFileSync(url,'http://127.0.0.1:18889');fs.writeFileSync(pid,String(process.pid));setTimeout(()=>process.exit(9),Number(process.env.TUNNEL_FIXTURE_LIFETIME_MS)||9000)}
+if(command==='run'){if(process.env.XDG_CONFIG_HOME){console.error('watcher XDG_CONFIG_HOME leaked into tunnel-client');process.exit(21)}const url=flag('--health.url-file'),pid=flag('--pid.file');fs.mkdirSync(path.dirname(url),{recursive:true});fs.writeFileSync(url,'http://127.0.0.1:18889');fs.writeFileSync(pid,String(process.pid));setTimeout(()=>process.exit(9),Number(process.env.TUNNEL_FIXTURE_LIFETIME_MS)||9000)}
 `;
 }
 

package/src/assessments/agentAssessor.ts

@@ -0,0 +1,324 @@
+import { writeFileSync } from "node:fs";
+import { resolve, relative, isAbsolute } from "node:path";
+import { PatchWardenConfig } from "../config.js";
+import { buildAgentInvocation, buildAssessmentPrompt } from "../runner/agentInvocation.js";
+import { runSimpleProcessSync } from "../runner/simpleProcess.js";
+import { captureRepoSnapshot, compareSnapshots, type RepoSnapshot, type ChangedFile } from "../runner/changeCapture.js";
+import type { AgentAssessmentOutput, AgentAssessmentSummary } from "./assessmentStore.js";
+
+const ASSESSMENT_MARKER = "===ASSESSMENT_JSON===";
+
+export interface AgentAssessorInput {
+  assessmentId: string;
+  assessmentDir: string;
+  agentName: string;
+  repoPath: string;
+  workspaceRoot: string;
+  goal: string;
+  planContent: string;
+  timeoutSeconds: number;
+  maxOutputBytes: number;
+  config: PatchWardenConfig;
+}
+
+export function runAgentAssessment(input: AgentAssessorInput): AgentAssessmentSummary {
+  const logPaths: AgentAssessmentSummary["log_paths"] = {
+    stdout: resolve(input.assessmentDir, "agent-assessment-stdout.log"),
+    stderr: resolve(input.assessmentDir, "agent-assessment-stderr.log"),
+    assessment: resolve(input.assessmentDir, "agent-assessment.json"),
+  };
+
+  const emptySummary: AgentAssessmentSummary = {
+    attempted: false,
+    status: "not_run",
+    output: null,
+    merged_risk: "low",
+    merged_decision: "allow",
+    merged_reason_codes: [],
+    timed_out: false,
+    exit_code: null,
+    read_only_violation: false,
+    violation_files: [],
+    stdout_truncated: false,
+    stderr_truncated: false,
+    log_paths: logPaths,
+  };
+
+  // ── 1. Build prompt and write to file for {prompt_file} support ──
+  const assessmentPrompt = buildAssessmentPrompt(input.goal, input.planContent, input.repoPath);
+  const promptFilePath = resolve(input.assessmentDir, "agent-assessment-prompt.md");
+  writeFileSync(promptFilePath, assessmentPrompt, "utf-8");
+  logPaths.prompt = promptFilePath;
+
+  // ── 2. Before snapshot (repo-scoped) ──
+  let repoBefore: RepoSnapshot;
+  try {
+    repoBefore = captureRepoSnapshot(input.repoPath);
+  } catch {
+    // If we can't capture before snapshot, conservatively skip agent assessment
+    emptySummary.status = "spawn_failed";
+    emptySummary.merged_risk = "medium";
+    emptySummary.merged_decision = "needs_confirm";
+    emptySummary.merged_reason_codes = ["agent_assessment_snapshot_failed"];
+    writeSummary(logPaths.assessment, emptySummary);
+    return emptySummary;
+  }
+
+  // ── 3. Build agent invocation ──
+  let invocation;
+  try {
+    invocation = buildAgentInvocation(input.agentName, input.repoPath, assessmentPrompt, input.config, promptFilePath);
+  } catch (error) {
+    emptySummary.status = "spawn_failed";
+    emptySummary.merged_risk = "medium";
+    emptySummary.merged_decision = "needs_confirm";
+    emptySummary.merged_reason_codes = ["agent_assessment_invocation_failed"];
+    writeSummary(logPaths.assessment, emptySummary);
+    return emptySummary;
+  }
+
+  emptySummary.attempted = true;
+
+  // ── 4. Run agent ──
+  const result = runSimpleProcessSync({
+    command: invocation.command,
+    args: invocation.args,
+    cwd: input.repoPath,
+    timeoutMs: input.timeoutSeconds * 1000,
+    maxStdoutBytes: input.maxOutputBytes,
+    maxStderrBytes: Math.max(16384, Math.floor(input.maxOutputBytes / 4)),
+    stdoutPath: logPaths.stdout,
+    stderrPath: logPaths.stderr,
+  });
+
+  // ── 5. After snapshot + read-only violation check ──
+  let readOnlyViolation = false;
+  let violationFiles: string[] = [];
+  try {
+    const repoAfter = captureRepoSnapshot(input.repoPath);
+    const changes = compareSnapshots(repoBefore, repoAfter);
+    if (changes.length > 0) {
+      readOnlyViolation = true;
+      violationFiles = changes.map((c) => c.path);
+    }
+  } catch {
+    // 修复 #4: after snapshot 捕获失败 → 保守变为 high / blocked
+    readOnlyViolation = true;
+    violationFiles = ["(after snapshot capture failed)"];
+  }
+
+  if (readOnlyViolation) {
+    const summary: AgentAssessmentSummary = {
+      attempted: true,
+      status: "read_only_violation",
+      output: null,
+      merged_risk: "high",
+      merged_decision: "blocked",
+      merged_reason_codes: ["agent_read_only_violation"],
+      timed_out: false,
+      exit_code: result.exitCode,
+      read_only_violation: true,
+      violation_files: violationFiles,
+      stdout_truncated: result.stdoutTruncated,
+      stderr_truncated: result.stderrTruncated,
+      log_paths: { ...logPaths, violation: resolve(input.assessmentDir, "agent-assessment-violation.json") },
+    };
+    writeFileSync(summary.log_paths.violation!, JSON.stringify({
+      violation: "read_only_violation",
+      files: violationFiles,
+      exit_code: result.exitCode,
+    }, null, 2), "utf-8");
+    writeSummary(logPaths.assessment, summary);
+    return summary;
+  }
+
+  // ── 6. Handle spawn failure ──
+  if (result.spawnError) {
+    const summary: AgentAssessmentSummary = {
+      ...emptySummary,
+      attempted: true,
+      status: "spawn_failed",
+      merged_risk: "medium",
+      merged_decision: "needs_confirm",
+      merged_reason_codes: ["agent_assessment_spawn_failed"],
+      exit_code: result.exitCode,
+      stdout_truncated: result.stdoutTruncated,
+      stderr_truncated: result.stderrTruncated,
+    };
+    writeSummary(logPaths.assessment, summary);
+    return summary;
+  }
+
+  // ── 7. Handle timeout ──
+  if (result.timedOut) {
+    const summary: AgentAssessmentSummary = {
+      ...emptySummary,
+      attempted: true,
+      status: "timed_out",
+      merged_risk: "medium",
+      merged_decision: "needs_confirm",
+      merged_reason_codes: ["agent_assessment_timed_out"],
+      timed_out: true,
+      exit_code: result.exitCode,
+      stdout_truncated: result.stdoutTruncated,
+      stderr_truncated: result.stderrTruncated,
+    };
+    writeSummary(logPaths.assessment, summary);
+    return summary;
+  }
+
+  // ── 8. Handle non-zero exit ──
+  if (result.exitCode !== 0) {
+    const summary: AgentAssessmentSummary = {
+      ...emptySummary,
+      attempted: true,
+      status: "non_zero_exit",
+      merged_risk: "medium",
+      merged_decision: "needs_confirm",
+      merged_reason_codes: ["agent_assessment_non_zero_exit"],
+      exit_code: result.exitCode,
+      stdout_truncated: result.stdoutTruncated,
+      stderr_truncated: result.stderrTruncated,
+    };
+    writeSummary(logPaths.assessment, summary);
+    return summary;
+  }
+
+  // ── 9. Parse JSON from stdout ──
+  const parsed = parseAssessmentJson(result.stdout, input.repoPath);
+
+  if (!parsed.output) {
+    const summary: AgentAssessmentSummary = {
+      ...emptySummary,
+      attempted: true,
+      status: "parse_failed",
+      merged_risk: "medium",
+      merged_decision: "needs_confirm",
+      merged_reason_codes: ["agent_assessment_parse_failed", ...parsed.sanitized_reasons],
+      exit_code: result.exitCode,
+      stdout_truncated: result.stdoutTruncated,
+      stderr_truncated: result.stderrTruncated,
+    };
+    writeSummary(logPaths.assessment, summary);
+    return summary;
+  }
+
+  // ── 10. Merge risk (agent can only raise, not lower) ──
+  const agentRisk = parsed.output.risk_level;
+  let mergedRisk: "low" | "medium" | "high" = agentRisk === "high" ? "high" : agentRisk === "medium" ? "medium" : "low";
+  let mergedDecision: "allow" | "needs_confirm" | "blocked" =
+    mergedRisk === "high" ? "blocked" : mergedRisk === "medium" ? "needs_confirm" : "allow";
+  const mergedReasonCodes = ["agent_assessment_completed", ...parsed.sanitized_reasons];
+  // 修复 #5: agent requires_user_confirm=true 时至少升级为 medium / needs_confirm
+  if (parsed.output.requires_user_confirm && mergedRisk === "low") {
+    mergedRisk = "medium";
+    mergedDecision = "needs_confirm";
+    mergedReasonCodes.push("agent_requested_confirm");
+  }
+
+  const summary: AgentAssessmentSummary = {
+    attempted: true,
+    status: "completed",
+    output: { ...parsed.output, assessed_at: new Date().toISOString() },
+    merged_risk: mergedRisk,
+    merged_decision: mergedDecision,
+    merged_reason_codes: mergedReasonCodes,
+    timed_out: false,
+    exit_code: result.exitCode,
+    read_only_violation: false,
+    violation_files: [],
+    stdout_truncated: result.stdoutTruncated,
+    stderr_truncated: result.stderrTruncated,
+    log_paths: logPaths,
+  };
+  writeSummary(logPaths.assessment, summary);
+  return summary;
+}
+
+interface ParsedAssessment {
+  output: AgentAssessmentOutput | null;
+  sanitized_reasons: string[];
+}
+
+function parseAssessmentJson(stdout: string, repoPath: string): ParsedAssessment {
+  const sanitized_reasons: string[] = [];
+
+  // Use the LAST marker only
+  const lastMarkerIndex = stdout.lastIndexOf(ASSESSMENT_MARKER);
+  if (lastMarkerIndex < 0) return { output: null, sanitized_reasons };
+
+  const jsonText = stdout.slice(lastMarkerIndex + ASSESSMENT_MARKER.length).trim();
+  // Find the JSON object (from first { to last })
+  const jsonStart = jsonText.indexOf("{");
+  const jsonEnd = jsonText.lastIndexOf("}");
+  if (jsonStart < 0 || jsonEnd < 0 || jsonEnd <= jsonStart) return { output: null, sanitized_reasons };
+
+  let parsed: any;
+  try {
+    parsed = JSON.parse(jsonText.slice(jsonStart, jsonEnd + 1));
+  } catch {
+    return { output: null, sanitized_reasons };
+  }
+
+  // ── Strict validation ──
+  if (parsed.risk_level !== "low" && parsed.risk_level !== "medium" && parsed.risk_level !== "high") {
+    return { output: null, sanitized_reasons };
+  }
+
+  const confidence = Number(parsed.confidence);
+  if (!Number.isFinite(confidence) || confidence < 0 || confidence > 1) {
+    return { output: null, sanitized_reasons };
+  }
+
+  if (!Array.isArray(parsed.reason_codes)) return { output: null, sanitized_reasons };
+  if (parsed.reason_codes.length > 50) return { output: null, sanitized_reasons };
+  const reasonCodes = parsed.reason_codes.filter((r: any) => typeof r === "string" && r.length <= 100);
+  if (reasonCodes.length !== parsed.reason_codes.length) {
+    sanitized_reasons.push("reason_codes_filtered");
+  }
+
+  if (!Array.isArray(parsed.affected_paths)) return { output: null, sanitized_reasons };
+  if (parsed.affected_paths.length > 100) return { output: null, sanitized_reasons };
+  const affectedPaths: string[] = [];
+  let pathsSanitized = false;
+  for (const p of parsed.affected_paths) {
+    if (typeof p !== "string") { pathsSanitized = true; continue; }
+    // Must be relative, not absolute, and within repo
+    if (isAbsolute(p)) { pathsSanitized = true; continue; }
+    const resolved = resolve(repoPath, p);
+    const rel = relative(repoPath, resolved);
+    if (rel.startsWith("..")) { pathsSanitized = true; continue; }
+    affectedPaths.push(p);
+  }
+  if (pathsSanitized) {
+    sanitized_reasons.push("paths_sanitized");
+  }
+
+  if (!Array.isArray(parsed.destructive_actions)) return { output: null, sanitized_reasons };
+  if (parsed.destructive_actions.length > 20) return { output: null, sanitized_reasons };
+  const destructiveActions = parsed.destructive_actions.filter(
+    (d: any) => typeof d === "string" && d.length <= 200
+  );
+
+  if (typeof parsed.requires_user_confirm !== "boolean") return { output: null, sanitized_reasons };
+
+  const notes = typeof parsed.notes === "string" ? parsed.notes.slice(0, 2000) : "";
+
+  return {
+    output: {
+      risk_level: parsed.risk_level,
+      reason_codes: reasonCodes,
+      affected_paths: affectedPaths,
+      destructive_actions: destructiveActions,
+      requires_user_confirm: parsed.requires_user_confirm,
+      confidence,
+      notes,
+      assessed_at: new Date().toISOString(),
+    },
+    sanitized_reasons,
+  };
+}
+
+function writeSummary(path: string, summary: AgentAssessmentSummary): void {
+  writeFileSync(path, JSON.stringify(summary, null, 2), "utf-8");
+}