patchwarden 1.1.0 → 1.5.1

package/dist/index.js

@@ -11,14 +11,17 @@ import { StdioServerTransport } from "@modelcontextprotocol/sdk/server/stdio.js"
 import { loadConfig } from "./config.js";
 import { registerTools } from "./tools/registry.js";
 import { PATCHWARDEN_VERSION } from "./version.js";
+import { logger } from "./logging.js";
 const config = loadConfig();
-console.error(`[patchwarden] Workspace: ${config.workspaceRoot}`);
-console.error(`[patchwarden] Transport: stdio`);
+logger.info(`[patchwarden] Workspace: ${config.workspaceRoot}`);
+logger.info("[patchwarden] Transport: stdio");
 const server = new Server({ name: "patchwarden", version: PATCHWARDEN_VERSION }, { capabilities: { tools: {} } });
 registerTools(server);
 const transport = new StdioServerTransport();
 server.connect(transport).catch((err) => {
-    console.error("[patchwarden] Fatal:", err);
+    logger.fatal("[patchwarden] Fatal", {
+        error: err instanceof Error ? err.message : String(err),
+    });
     process.exit(1);
 });
-console.error("[patchwarden] MCP server ready on stdio");
+logger.info("[patchwarden] MCP server ready on stdio");

package/dist/logging.d.ts

@@ -1,4 +1,4 @@
-export type LogLevel = "info" | "warn" | "error" | "audit";
+export type LogLevel = "info" | "warn" | "error" | "fatal" | "audit";
 export interface LogEntry {
     timestamp: string;
     level: LogLevel;
@@ -39,6 +39,12 @@ export declare class Logger {
     info(message: string, context?: Record<string, unknown>): void;
     warn(message: string, context?: Record<string, unknown>): void;
     error(message: string, context?: Record<string, unknown>): void;
+    /**
+     * Emit a fatal-level log entry. Use this immediately before a process
+     * exits with a non-zero status, to record the unrecoverable condition.
+     * Level is higher than `error`.
+     */
+    fatal(message: string, context?: Record<string, unknown>): void;
     /**
      * Emit a tool-call audit log entry.
      *

package/dist/logging.js

@@ -51,6 +51,14 @@ export class Logger {
     error(message, context) {
         emit({ timestamp: new Date().toISOString(), level: "error", message, ...context });
     }
+    /**
+     * Emit a fatal-level log entry. Use this immediately before a process
+     * exits with a non-zero status, to record the unrecoverable condition.
+     * Level is higher than `error`.
+     */
+    fatal(message, context) {
+        emit({ timestamp: new Date().toISOString(), level: "fatal", message, ...context });
+    }
     /**
      * Emit a tool-call audit log entry.
      *

package/dist/policy/projectPolicy.d.ts

@@ -0,0 +1,55 @@
+export interface ProjectPolicy {
+    allowed_commands: string[];
+    auto_cleanup: {
+        enabled: boolean;
+        patterns: string[];
+        exclude: string[];
+    };
+    high_risk_commands: string[];
+    protected_paths: string[];
+    release_mode: {
+        version_source: string;
+        required_commands: string[];
+    };
+}
+export interface ProjectPolicyIssue {
+    code: string;
+    severity: "error" | "warn";
+    field: string;
+    message: string;
+}
+export interface ReleaseReadinessSummary {
+    version_source: string;
+    version: string | null;
+    package_json_version: string | null;
+    package_name: string | null;
+    version_consistent: boolean | null;
+    required_commands: Array<{
+        command: string;
+        allowed: boolean;
+        reason: string | null;
+    }>;
+}
+export interface ProjectPolicySummary {
+    repo_path: string;
+    resolved_repo_path: string;
+    policy_path: string;
+    exists: boolean;
+    valid: boolean;
+    effective_policy: ProjectPolicy;
+    issues: ProjectPolicyIssue[];
+    release_readiness: ReleaseReadinessSummary;
+}
+export declare function getProjectPolicySummary(repoPathInput: string): ProjectPolicySummary;
+export declare function getDefaultProjectPolicy(): ProjectPolicy;
+export declare function commandAllowedByProjectPolicy(command: string, summary: ProjectPolicySummary): {
+    allowed: boolean;
+    reason: string | null;
+};
+export declare function isProtectedByProjectPolicy(relPath: string, policy: ProjectPolicy): boolean;
+export declare function resolveVersionFromPolicy(repoPath: string, policy: ProjectPolicy): string | null;
+export declare function readPackageJson(repoPath: string): {
+    name: string | null;
+    version: string | null;
+    githubRepo: string | null;
+};

package/dist/policy/projectPolicy.js

@@ -0,0 +1,286 @@
+import { existsSync, readFileSync, statSync } from "node:fs";
+import { dirname, isAbsolute, join, relative, resolve, sep } from "node:path";
+import { getConfig, } from "../config.js";
+import { guardTestCommand } from "../security/commandGuard.js";
+import { guardWorkspacePath } from "../security/pathGuard.js";
+import { isSensitivePath } from "../security/sensitiveGuard.js";
+const DEFAULT_POLICY = {
+    allowed_commands: [],
+    auto_cleanup: {
+        enabled: true,
+        patterns: ["release-artifact-manifest.json", "frontend/dist", "release_packages"],
+        exclude: [".git", ".patchwarden", "node_modules", "docs", "samples"],
+    },
+    high_risk_commands: ["npm publish", "git push", "git tag", "gh release create"],
+    protected_paths: [".env", ".env.*", ".ssh", ".npmrc", ".pypirc", "patchwarden.config.json"],
+    release_mode: {
+        version_source: "package.json",
+        required_commands: ["npm run build", "npm test"],
+    },
+};
+const DANGEROUS_COMMAND_RE = /\b(?:publish|push|tag|release\s+create|deploy)\b/i;
+const DANGEROUS_PATTERN_RE = /(^|[\\/])(?:\.git|node_modules)([\\/]|$)|^\*\*$|^\/|^[A-Za-z]:[\\/]/i;
+export function getProjectPolicySummary(repoPathInput) {
+    const config = getConfig();
+    const repoPath = guardWorkspacePath(repoPathInput, config.workspaceRoot);
+    const policyPath = join(repoPath, ".patchwarden", "project-policy.json");
+    const issues = [];
+    let rawPolicy = {};
+    let exists = false;
+    if (existsSync(policyPath)) {
+        exists = true;
+        try {
+            const raw = readFileSync(policyPath, "utf-8").replace(/^\uFEFF/, "");
+            rawPolicy = JSON.parse(raw);
+        }
+        catch (err) {
+            issues.push({
+                code: "policy_json_invalid",
+                severity: "error",
+                field: ".patchwarden/project-policy.json",
+                message: `Project policy is not valid JSON: ${err instanceof Error ? err.message : String(err)}`,
+            });
+        }
+    }
+    const effective = normalizePolicy(rawPolicy, issues);
+    validateProjectPolicy(repoPath, effective, issues, config);
+    return {
+        repo_path: repoPathInput,
+        resolved_repo_path: repoPath,
+        policy_path: ".patchwarden/project-policy.json",
+        exists,
+        valid: !issues.some((issue) => issue.severity === "error"),
+        effective_policy: effective,
+        issues,
+        release_readiness: buildReleaseReadiness(repoPath, effective, config),
+    };
+}
+export function getDefaultProjectPolicy() {
+    return clonePolicy(DEFAULT_POLICY);
+}
+export function commandAllowedByProjectPolicy(command, summary) {
+    const trimmed = command.trim();
+    if (!trimmed)
+        return { allowed: false, reason: "empty_command" };
+    if (summary.effective_policy.high_risk_commands.includes(trimmed) || DANGEROUS_COMMAND_RE.test(trimmed)) {
+        return { allowed: false, reason: "high_risk_command" };
+    }
+    if (summary.effective_policy.allowed_commands.length > 0 &&
+        !summary.effective_policy.allowed_commands.includes(trimmed)) {
+        return { allowed: false, reason: "not_in_project_policy_allowed_commands" };
+    }
+    const readiness = summary.release_readiness.required_commands.find((entry) => entry.command === trimmed);
+    if (readiness && !readiness.allowed) {
+        return { allowed: false, reason: readiness.reason || "not_allowlisted_by_patchwarden_config" };
+    }
+    return { allowed: true, reason: null };
+}
+export function isProtectedByProjectPolicy(relPath, policy) {
+    const normalized = normalizeRelPath(relPath);
+    if (!normalized)
+        return true;
+    if (isSensitivePath(normalized))
+        return true;
+    return policy.protected_paths.some((pattern) => pathMatchesPattern(normalized, pattern));
+}
+export function resolveVersionFromPolicy(repoPath, policy) {
+    const source = policy.release_mode.version_source || "package.json";
+    if (source === "package.json")
+        return readPackageJson(repoPath).version;
+    if (source === "src/version.ts") {
+        const versionFile = safeRepoFile(repoPath, "src/version.ts");
+        if (!versionFile)
+            return null;
+        const text = readFileSync(versionFile, "utf-8");
+        const match = text.match(/PATCHWARDEN_VERSION\s*=\s*["']([^"']+)["']/);
+        return match ? match[1] : null;
+    }
+    const file = safeRepoFile(repoPath, source);
+    if (!file)
+        return null;
+    const text = readFileSync(file, "utf-8").replace(/^\uFEFF/, "").trim();
+    return text.split(/\r?\n/)[0]?.trim() || null;
+}
+export function readPackageJson(repoPath) {
+    const packagePath = join(repoPath, "package.json");
+    if (!existsSync(packagePath))
+        return { name: null, version: null, githubRepo: null };
+    try {
+        const data = JSON.parse(readFileSync(packagePath, "utf-8").replace(/^\uFEFF/, ""));
+        return {
+            name: typeof data.name === "string" ? data.name : null,
+            version: typeof data.version === "string" ? data.version : null,
+            githubRepo: parseGithubRepo(data.repository),
+        };
+    }
+    catch {
+        return { name: null, version: null, githubRepo: null };
+    }
+}
+function normalizePolicy(raw, issues) {
+    const policy = clonePolicy(DEFAULT_POLICY);
+    const object = raw && typeof raw === "object" && !Array.isArray(raw) ? raw : {};
+    policy.allowed_commands = stringArrayOrDefault(object.allowed_commands, policy.allowed_commands, "allowed_commands", issues);
+    policy.high_risk_commands = stringArrayOrDefault(object.high_risk_commands, policy.high_risk_commands, "high_risk_commands", issues);
+    policy.protected_paths = stringArrayOrDefault(object.protected_paths, policy.protected_paths, "protected_paths", issues);
+    if (object.auto_cleanup && typeof object.auto_cleanup === "object" && !Array.isArray(object.auto_cleanup)) {
+        const cleanup = object.auto_cleanup;
+        if (cleanup.enabled !== undefined && typeof cleanup.enabled !== "boolean") {
+            issues.push({ code: "invalid_type", severity: "error", field: "auto_cleanup.enabled", message: "auto_cleanup.enabled must be a boolean." });
+        }
+        else if (cleanup.enabled !== undefined) {
+            policy.auto_cleanup.enabled = cleanup.enabled;
+        }
+        policy.auto_cleanup.patterns = stringArrayOrDefault(cleanup.patterns, policy.auto_cleanup.patterns, "auto_cleanup.patterns", issues);
+        policy.auto_cleanup.exclude = stringArrayOrDefault(cleanup.exclude, policy.auto_cleanup.exclude, "auto_cleanup.exclude", issues);
+    }
+    if (object.release_mode && typeof object.release_mode === "object" && !Array.isArray(object.release_mode)) {
+        const releaseMode = object.release_mode;
+        if (releaseMode.version_source !== undefined && typeof releaseMode.version_source !== "string") {
+            issues.push({ code: "invalid_type", severity: "error", field: "release_mode.version_source", message: "release_mode.version_source must be a string." });
+        }
+        else if (releaseMode.version_source) {
+            policy.release_mode.version_source = releaseMode.version_source.trim();
+        }
+        policy.release_mode.required_commands = stringArrayOrDefault(releaseMode.required_commands, policy.release_mode.required_commands, "release_mode.required_commands", issues);
+    }
+    return policy;
+}
+function validateProjectPolicy(repoPath, policy, issues, config) {
+    for (const [field, commands] of [
+        ["allowed_commands", policy.allowed_commands],
+        ["high_risk_commands", policy.high_risk_commands],
+        ["release_mode.required_commands", policy.release_mode.required_commands],
+    ]) {
+        for (const command of commands) {
+            if (field !== "high_risk_commands" && DANGEROUS_COMMAND_RE.test(command)) {
+                issues.push({ code: "high_risk_command", severity: "error", field, message: `Command is release/destructive risk and cannot be auto-executed: ${command}` });
+            }
+            if (field !== "high_risk_commands") {
+                try {
+                    guardTestCommand(command, config, repoPath);
+                }
+                catch {
+                    issues.push({ code: "command_not_allowlisted", severity: "warn", field, message: `Command is not allowed by existing PatchWarden config: ${command}` });
+                }
+            }
+        }
+    }
+    for (const field of ["auto_cleanup.patterns", "auto_cleanup.exclude", "protected_paths"]) {
+        const values = field === "auto_cleanup.patterns"
+            ? policy.auto_cleanup.patterns
+            : field === "auto_cleanup.exclude"
+                ? policy.auto_cleanup.exclude
+                : policy.protected_paths;
+        for (const value of values) {
+            if (!value.trim()) {
+                issues.push({ code: "empty_path_pattern", severity: "error", field, message: "Path patterns must be non-empty." });
+                continue;
+            }
+            const blocksCriticalDirectory = field === "auto_cleanup.patterns" && DANGEROUS_PATTERN_RE.test(value);
+            if (value.includes("\0") || value.includes("..") || isAbsolute(value) || blocksCriticalDirectory) {
+                issues.push({ code: "unsafe_path_pattern", severity: "error", field, message: `Unsafe path pattern rejected: ${value}` });
+            }
+        }
+    }
+    const versionSource = policy.release_mode.version_source;
+    if (versionSource && versionSource !== "package.json" && versionSource !== "src/version.ts") {
+        const resolved = safeRepoFile(repoPath, versionSource);
+        if (!resolved) {
+            issues.push({ code: "version_source_invalid", severity: "error", field: "release_mode.version_source", message: `Version source is outside repo, sensitive, or missing: ${versionSource}` });
+        }
+    }
+}
+function buildReleaseReadiness(repoPath, policy, config) {
+    const packageJson = readPackageJson(repoPath);
+    let version = null;
+    try {
+        version = resolveVersionFromPolicy(repoPath, policy);
+    }
+    catch {
+        version = null;
+    }
+    return {
+        version_source: policy.release_mode.version_source,
+        version,
+        package_json_version: packageJson.version,
+        package_name: packageJson.name,
+        version_consistent: version && packageJson.version ? version === packageJson.version : null,
+        required_commands: policy.release_mode.required_commands.map((command) => {
+            try {
+                guardTestCommand(command, config, repoPath);
+                return { command, allowed: true, reason: null };
+            }
+            catch (err) {
+                return { command, allowed: false, reason: err instanceof Error ? err.message : String(err) };
+            }
+        }),
+    };
+}
+function safeRepoFile(repoPath, relPath) {
+    const normalized = normalizeRelPath(relPath);
+    if (!normalized || isSensitivePath(normalized))
+        return null;
+    const candidate = resolve(repoPath, normalized);
+    const rel = relative(repoPath, candidate);
+    if (isAbsolute(rel) || rel === ".." || rel.startsWith(`..${sep}`))
+        return null;
+    if (!existsSync(candidate) || !statSync(candidate).isFile())
+        return null;
+    const parent = dirname(candidate);
+    const parentRel = relative(repoPath, parent);
+    if (parentRel === ".." || parentRel.startsWith(`..${sep}`))
+        return null;
+    return candidate;
+}
+function stringArrayOrDefault(value, fallback, field, issues) {
+    if (value === undefined)
+        return [...fallback];
+    if (!Array.isArray(value) || value.some((entry) => typeof entry !== "string")) {
+        issues.push({ code: "invalid_type", severity: "error", field, message: `${field} must be an array of strings.` });
+        return [...fallback];
+    }
+    return [...new Set(value.map((entry) => entry.trim()).filter(Boolean))];
+}
+function clonePolicy(policy) {
+    return {
+        allowed_commands: [...policy.allowed_commands],
+        auto_cleanup: {
+            enabled: policy.auto_cleanup.enabled,
+            patterns: [...policy.auto_cleanup.patterns],
+            exclude: [...policy.auto_cleanup.exclude],
+        },
+        high_risk_commands: [...policy.high_risk_commands],
+        protected_paths: [...policy.protected_paths],
+        release_mode: {
+            version_source: policy.release_mode.version_source,
+            required_commands: [...policy.release_mode.required_commands],
+        },
+    };
+}
+function normalizeRelPath(value) {
+    return value.trim().replace(/\\/g, "/").replace(/^\.\//, "").replace(/\/+$/, "");
+}
+function pathMatchesPattern(relPath, pattern) {
+    const normalizedPattern = normalizeRelPath(pattern);
+    if (!normalizedPattern)
+        return false;
+    if (normalizedPattern.includes("*")) {
+        const escaped = normalizedPattern
+            .split("*")
+            .map((part) => part.replace(/[.+?^${}()|[\]\\]/g, "\\$&"))
+            .join("[^/]*");
+        return new RegExp(`^${escaped}$`, "i").test(relPath);
+    }
+    return relPath.toLowerCase() === normalizedPattern.toLowerCase() ||
+        relPath.toLowerCase().startsWith(`${normalizedPattern.toLowerCase()}/`);
+}
+function parseGithubRepo(repository) {
+    const raw = typeof repository === "string"
+        ? repository
+        : repository && typeof repository === "object" && typeof repository.url === "string"
+            ? repository.url
+            : "";
+    const match = raw.match(/github\.com[:/](.+?\/.+?)(?:\.git)?(?:[#?].*)?$/i);
+    return match ? match[1] : null;
+}

package/dist/runner/changeCapture.d.ts

@@ -66,9 +66,9 @@ export interface ChangeArtifacts {
     unavailable_reason: string | null;
     artifact_hygiene: ArtifactHygiene;
 }
-export declare function captureRepoSnapshot(repoPath: string): RepoSnapshot;
+export declare function captureRepoSnapshot(repoPath: string): Promise<RepoSnapshot>;
 export declare function writeSnapshot(taskDir: string, filename: string, snapshot: RepoSnapshot): void;
-export declare function buildChangeArtifacts(repoPath: string, before: RepoSnapshot, after: RepoSnapshot): ChangeArtifacts;
+export declare function buildChangeArtifacts(repoPath: string, before: RepoSnapshot, after: RepoSnapshot): Promise<ChangeArtifacts>;
 export declare function compareSnapshots(before: RepoSnapshot, after: RepoSnapshot): ChangedFile[];
 export declare function emptyArtifactHygiene(): ArtifactHygiene;
 export interface ExternalDirtyFile {
@@ -101,7 +101,7 @@ export interface ArtifactManifest {
     generated_at: string;
     artifacts: ArtifactManifestEntry[];
 }
-export declare function buildArtifactManifest(changedFiles: ChangedFile[], repoPath: string, taskId?: string): ArtifactManifest;
+export declare function buildArtifactManifest(changedFiles: ChangedFile[], repoPath: string, taskId?: string): Promise<ArtifactManifest>;
 export interface ChangedFileGroups {
     source_changes: ChangedFile[];
     docs_changes: ChangedFile[];

package/dist/runner/changeCapture.js

@@ -1,15 +1,16 @@
 import { createHash } from "node:crypto";
-import { lstatSync, readFileSync, readdirSync, writeFileSync, } from "node:fs";
+import { createReadStream, lstatSync, readFileSync, readdirSync, writeFileSync, } from "node:fs";
 import { join, relative, resolve, isAbsolute } from "node:path";
-import { spawnSync } from "node:child_process";
+import { execFile } from "node:child_process";
 import { isSensitivePath } from "../security/sensitiveGuard.js";
 const MAX_HASH_BYTES = 5 * 1024 * 1024;
 const MAX_SNAPSHOT_FILES = 5000;
 const MAX_DIFF_BYTES = 20 * 1024 * 1024;
 const SKIP_DIRECTORIES = new Set([".git", ".patchwarden", "node_modules"]);
-export function captureRepoSnapshot(repoPath) {
+export async function captureRepoSnapshot(repoPath) {
     const warnings = [];
-    const isGit = runGit(repoPath, ["rev-parse", "--is-inside-work-tree"]).stdout.trim() === "true";
+    const isGitResult = await runGit(repoPath, ["rev-parse", "--is-inside-work-tree"]);
+    const isGit = isGitResult.stdout.trim() === "true";
     let head = null;
     let status = "";
     let paths = [];
@@ -17,10 +18,17 @@ export function captureRepoSnapshot(repoPath) {
     const ignoredPaths = new Set();
     const dirtyPaths = new Set();
     if (isGit) {
-        const headResult = runGit(repoPath, ["rev-parse", "HEAD"]);
+        // The following five git calls are independent of each other and can run in parallel.
+        const [headResult, statusResult, trackedResult, ignoredResult, listedResult] = await Promise.all([
+            runGit(repoPath, ["rev-parse", "HEAD"]),
+            runGit(repoPath, ["status", "--porcelain=v1", "-uall"]),
+            runGit(repoPath, ["ls-files", "-z"]),
+            runGit(repoPath, ["ls-files", "-o", "-i", "--exclude-standard", "-z"]),
+            runGit(repoPath, ["ls-files", "-co", "--exclude-standard", "-z"]),
+        ]);
         if (headResult.status === 0)
             head = headResult.stdout.trim() || null;
-        status = runGit(repoPath, ["status", "--porcelain=v1", "-uall"]).stdout.trimEnd();
+        status = statusResult.stdout.trimEnd();
         // Parse git status --porcelain to collect all dirty paths
         for (const line of status.split("\n")) {
             if (line.length < 4)
@@ -45,23 +53,20 @@ export function captureRepoSnapshot(repoPath) {
                 }
             }
         }
-        const tracked = runGit(repoPath, ["ls-files", "-z"]);
-        if (tracked.status === 0) {
-            for (const path of tracked.stdout.split("\0").filter(Boolean))
+        if (trackedResult.status === 0) {
+            for (const path of trackedResult.stdout.split("\0").filter(Boolean))
                 trackedPaths.add(normalizePath(path));
         }
-        const ignored = runGit(repoPath, ["ls-files", "-o", "-i", "--exclude-standard", "-z"]);
-        if (ignored.status === 0) {
-            for (const path of ignored.stdout.split("\0").filter(Boolean))
+        if (ignoredResult.status === 0) {
+            for (const path of ignoredResult.stdout.split("\0").filter(Boolean))
                 ignoredPaths.add(normalizePath(path));
         }
         else {
             warnings.push("git ignored-file discovery failed; ignored classification may be incomplete");
         }
-        const listed = runGit(repoPath, ["ls-files", "-co", "--exclude-standard", "-z"]);
-        if (listed.status === 0) {
+        if (listedResult.status === 0) {
             paths = [...new Set([
-                    ...listed.stdout.split("\0").filter(Boolean),
+                    ...listedResult.stdout.split("\0").filter(Boolean),
                     ...walkWorkspace(repoPath),
                 ])];
         }
@@ -116,26 +121,26 @@ export function captureRepoSnapshot(repoPath) {
 export function writeSnapshot(taskDir, filename, snapshot) {
     writeFileSync(join(taskDir, filename), JSON.stringify(snapshot, null, 2), "utf-8");
 }
-export function buildChangeArtifacts(repoPath, before, after) {
+export async function buildChangeArtifacts(repoPath, before, after) {
     const changedFiles = compareSnapshots(before, after);
     const artifactHygiene = classifyArtifactHygiene(changedFiles);
     const sections = [];
     const scopedPaths = [...new Set(changedFiles.flatMap((file) => file.old_path ? [file.old_path, file.path] : [file.path]))];
     if (before.is_git && after.is_git && scopedPaths.length > 0) {
         if (before.head && after.head && before.head !== after.head) {
-            const committed = runGit(repoPath, ["diff", "--no-color", "--binary", before.head, after.head, "--", ...scopedPaths]);
+            const committed = await runGit(repoPath, ["diff", "--no-color", "--binary", before.head, after.head, "--", ...scopedPaths]);
             if (committed.stdout.trim())
                 sections.push("# Changes committed during task\n", committed.stdout.trimEnd());
         }
         const base = after.head || "HEAD";
-        const working = runGit(repoPath, ["diff", "--no-color", "--binary", base, "--", ...scopedPaths]);
+        const working = await runGit(repoPath, ["diff", "--no-color", "--binary", base, "--", ...scopedPaths]);
         if (working.stdout.trim())
             sections.push("# Staged and unstaged changes\n", working.stdout.trimEnd());
         for (const file of changedFiles.filter((item) => item.change === "added").slice(0, 100)) {
-            const tracked = runGit(repoPath, ["ls-files", "--error-unmatch", "--", file.path]);
+            const tracked = await runGit(repoPath, ["ls-files", "--error-unmatch", "--", file.path]);
             if (tracked.status === 0)
                 continue;
-            const untracked = runGit(repoPath, ["diff", "--no-index", "--no-color", "--binary", "--", "/dev/null", file.path]);
+            const untracked = await runGit(repoPath, ["diff", "--no-index", "--no-color", "--binary", "--", "/dev/null", file.path]);
             if (untracked.stdout.trim())
                 sections.push("# Untracked file\n", untracked.stdout.trimEnd());
         }
@@ -151,7 +156,7 @@ export function buildChangeArtifacts(repoPath, before, after) {
     const fullDiff = `${evidence}\n\n${body || (changedFiles.length ? "(textual patch unavailable; see changed-files.json for hash evidence)" : "(no task file changes detected)")}\n`;
     const additions = fullDiff.split(/\r?\n/).filter((line) => line.startsWith("+") && !line.startsWith("+++")).length;
     const deletions = fullDiff.split(/\r?\n/).filter((line) => line.startsWith("-") && !line.startsWith("---")).length;
-    const fileStats = buildFileStats(repoPath, before, after, changedFiles);
+    const fileStats = await buildFileStats(repoPath, before, after, changedFiles);
     return {
         changed_files: changedFiles,
         diff: fullDiff,
@@ -172,8 +177,8 @@ export function buildChangeArtifacts(repoPath, before, after) {
         artifact_hygiene: artifactHygiene,
     };
 }
-function buildFileStats(repoPath, before, after, changedFiles) {
-    return changedFiles.map((file) => {
+async function buildFileStats(repoPath, before, after, changedFiles) {
+    const results = await Promise.all(changedFiles.map(async (file) => {
         let additions = 0;
         let deletions = 0;
         const paths = file.old_path ? [file.old_path, file.path] : [file.path];
@@ -183,8 +188,8 @@ function buildFileStats(repoPath, before, after, changedFiles) {
                 ranges.push([before.head, after.head]);
             }
             ranges.push([after.head || "HEAD"]);
-            for (const range of ranges) {
-                const result = runGit(repoPath, ["diff", "--numstat", ...range, "--", ...paths]);
+            const rangeResults = await Promise.all(ranges.map((range) => runGit(repoPath, ["diff", "--numstat", ...range, "--", ...paths])));
+            for (const result of rangeResults) {
                 for (const line of result.stdout.split(/\r?\n/).filter(Boolean)) {
                     const [added, removed] = line.split(/\s+/);
                     if (/^\d+$/.test(added))
@@ -199,10 +204,11 @@ function buildFileStats(repoPath, before, after, changedFiles) {
                 const content = readFileSync(resolve(repoPath, file.path), "utf-8");
                 additions = countLines(content);
             }
-            catch { }
+            catch { } // probe failure handled by return value (additions stays 0)
         }
         return { path: file.path, status: file.change, additions, deletions };
-    });
+    }));
+    return results;
 }
 function countLines(content) {
     if (content.length === 0)
@@ -318,7 +324,7 @@ export function findNewExternalDirtyFiles(baseline, current) {
         return false;
     });
 }
-export function buildArtifactManifest(changedFiles, repoPath, taskId) {
+export async function buildArtifactManifest(changedFiles, repoPath, taskId) {
     const entries = [];
     for (const file of changedFiles) {
         if (file.kind !== "build_artifact")
@@ -331,7 +337,7 @@ export function buildArtifactManifest(changedFiles, repoPath, taskId) {
             if (stat.isFile()) {
                 size = stat.size;
                 if (size <= MAX_HASH_BYTES) {
-                    sha256 = createHash("sha256").update(readFileSync(absolutePath)).digest("hex");
+                    sha256 = await hashFileAsync(absolutePath);
                 }
             }
         }
@@ -503,15 +509,33 @@ function walkWorkspace(root) {
     return result;
 }
 function runGit(repoPath, args) {
-    const result = spawnSync("git", args, {
-        cwd: repoPath,
-        encoding: "utf-8",
-        timeout: 30_000,
-        maxBuffer: MAX_DIFF_BYTES,
+    return new Promise((resolve) => {
+        execFile("git", args, {
+            cwd: repoPath,
+            encoding: "utf-8",
+            timeout: 30_000,
+            maxBuffer: MAX_DIFF_BYTES,
+        }, (err, stdout, stderr) => {
+            let status;
+            if (err) {
+                // err.code is the exit code (number) when the process exited with a non-zero status;
+                // it is a string (e.g. "ENOENT") when spawning failed or the buffer limit was hit.
+                status = typeof err.code === "number" ? err.code : null;
+            }
+            else {
+                status = 0;
+            }
+            resolve({ status, stdout: stdout || "", stderr: stderr || "" });
+        });
+    });
+}
+function hashFileAsync(filePath) {
+    return new Promise((resolve, reject) => {
+        const hash = createHash("sha256");
+        const stream = createReadStream(filePath);
+        stream.on("error", reject);
+        hash.on("error", reject);
+        hash.on("finish", () => resolve(hash.digest("hex")));
+        stream.pipe(hash);
     });
-    return {
-        status: result.status,
-        stdout: result.stdout || "",
-        stderr: result.stderr || "",
-    };
 }

package/dist/runner/cli.js

@@ -8,19 +8,20 @@
  */
 import { runTask } from "./runTask.js";
 import { loadConfig } from "../config.js";
+import { logger } from "../logging.js";
 // Load config early
 loadConfig();
 const taskId = process.argv[2] || process.env.PATCHWARDEN_TASK_ID;
 if (!taskId) {
-    console.error("Usage: node dist/runner/cli.js <task_id>");
-    console.error("   or: npm run runner -- <task_id>");
+    logger.info("Usage: node dist/runner/cli.js <task_id>");
+    logger.info("   or: npm run runner -- <task_id>");
     process.exit(1);
 }
-console.error(`[runner] Starting task: ${taskId}`);
+logger.info(`[runner] Starting task: ${taskId}`);
 const result = await runTask(taskId);
-console.error(`[runner] Task ${result.task_id}: ${result.status}`);
+logger.info(`[runner] Task ${result.task_id}: ${result.status}`);
 if (result.error) {
-    console.error(`[runner] Error: ${result.error}`);
+    logger.fatal(`[runner] Error: ${result.error}`);
     process.exit(1);
 }
-console.error("[runner] Done.");
+logger.info("[runner] Done.");