patchwarden 1.1.0 → 1.5.1

package/dist/runner/simpleProcess.js

@@ -37,13 +37,13 @@ export function runSimpleProcessSync(options) {
         try {
             writeFileSyncAppend(options.stdoutPath, stdout);
         }
-        catch { }
+        catch { } // best-effort log write; failure doesn't affect result
     }
     if (options.stderrPath && stderr) {
         try {
             writeFileSyncAppend(options.stderrPath, stderr);
         }
-        catch { }
+        catch { } // best-effort log write; failure doesn't affect result
     }
     return {
         exitCode: result.status,
@@ -174,7 +174,7 @@ function gracefulKill(child) {
         else
             child.kill("SIGTERM");
     }
-    catch { }
+    catch { } // cleanup failure is safe to ignore
 }
 function forceKill(child) {
     if (!child.pid)
@@ -197,7 +197,7 @@ function forceKill(child) {
         try {
             child.kill("SIGKILL");
         }
-        catch { }
+        catch { } // cleanup failure is safe to ignore
     }
 }
 function writeFileSyncAppend(path, content) {

package/dist/runner/watch.js

@@ -24,6 +24,7 @@ import { guardAgentCommand, guardTestCommand } from "../security/commandGuard.js
 import { validateAssessmentFreshness } from "../assessments/assessmentStore.js";
 import { captureRepoSnapshot } from "./changeCapture.js";
 import { runTask } from "./runTask.js";
+import { logger } from "../logging.js";
 // ── Bootstrap ─────────────────────────────────────────────────────
 loadConfig();
 const config = getConfig();
@@ -37,10 +38,10 @@ const WATCHER_LAUNCHER_PID = Number.isInteger(Number(process.env.PATCHWARDEN_WAT
     ? Number(process.env.PATCHWARDEN_WATCHER_LAUNCHER_PID)
     : null;
 mkdirSync(dirname(WATCHER_HEARTBEAT_FILE), { recursive: true });
-console.error(`[watcher] Workspace: ${wsRoot}`);
-console.error(`[watcher] Tasks:    ${tasksDir}`);
-console.error(`[watcher] Polling every ${POLL_INTERVAL_MS / 1000}s`);
-console.error(`[watcher] Press Ctrl+C to stop`);
+logger.info(`[watcher] Workspace: ${wsRoot}`);
+logger.info(`[watcher] Tasks:    ${tasksDir}`);
+logger.info(`[watcher] Polling every ${POLL_INTERVAL_MS / 1000}s`);
+logger.info(`[watcher] Press Ctrl+C to stop`);
 // Track executed tasks to prevent re-execution
 const executedTasks = new Set();
 // ── Main loop ─────────────────────────────────────────────────────
@@ -96,7 +97,7 @@ async function tick() {
                 }
                 // Assessment freshness revalidation
                 if (statusData.assessment_id) {
-                    const preExecSnapshot = captureRepoSnapshot(resolvedRepoPath);
+                    const preExecSnapshot = await captureRepoSnapshot(resolvedRepoPath);
                     const validation = validateAssessmentFreshness(String(statusData.assessment_id), preExecSnapshot);
                     if (!validation.valid) {
                         throw new Error(`assessment validation failed: ${validation.failure_reason}`);
@@ -105,7 +106,7 @@ async function tick() {
             }
             catch (err) {
                 const errMsg = `[watcher] Safety check failed for ${taskId}: ${err instanceof Error ? err.message : String(err)}`;
-                console.error(errMsg);
+                logger.error(errMsg);
                 // Write error and mark as failed so it doesn't get re-picked
                 try {
                     writeFileSync(join(taskDir, "error.log"), errMsg, "utf-8");
@@ -115,37 +116,39 @@ async function tick() {
                     data.updated_at = new Date().toISOString();
                     writeFileSync(statusFile, JSON.stringify(data, null, 2), "utf-8");
                 }
-                catch { }
+                catch (err) {
+                    logger.warn("watcher error-log write failed", { error: err instanceof Error ? err.message : String(err) });
+                }
                 executedTasks.add(taskId);
                 continue;
             }
             // ── Execute ──
-            console.error(`[watcher] Executing: ${taskId}`);
+            logger.info(`[watcher] Executing: ${taskId}`);
             executedTasks.add(taskId);
             try {
                 const result = await runTask(taskId);
-                console.error(`[watcher] ${taskId} → ${result.status}`);
+                logger.info(`[watcher] ${taskId} → ${result.status}`);
             }
             catch (err) {
-                console.error(`[watcher] ${taskId} → error: ${err instanceof Error ? err.message : String(err)}`);
+                logger.error(`[watcher] ${taskId} → error: ${err instanceof Error ? err.message : String(err)}`);
             }
         }
     }
     catch (err) {
-        console.error(`[watcher] Tick error: ${err instanceof Error ? err.message : String(err)}`);
+        logger.error(`[watcher] Tick error: ${err instanceof Error ? err.message : String(err)}`);
     }
 }
 // ── Start ─────────────────────────────────────────────────────────
-console.error("[watcher] Started");
+logger.info("[watcher] Started");
 setInterval(tick, POLL_INTERVAL_MS);
 // Run first tick immediately
 tick();
 // Graceful shutdown
 process.on("SIGINT", () => {
-    console.error("[watcher] Stopped");
+    logger.info("[watcher] Stopped");
     process.exit(0);
 });
 process.on("SIGTERM", () => {
-    console.error("[watcher] Stopped");
+    logger.info("[watcher] Stopped");
     process.exit(0);
 });

package/dist/security/contentRedaction.d.ts

@@ -8,5 +8,11 @@ export interface StructuredRedactionResult<T> {
     redacted: boolean;
     redaction_categories: string[];
 }
+export interface RedactionCategoryCount {
+    category: string;
+    reason: string;
+    count: number;
+}
+export declare function countRedactionsByCategory(input: string): RedactionCategoryCount[];
 export declare function redactSensitiveContent(input: string): RedactionResult;
 export declare function redactSensitiveValue<T>(input: T): StructuredRedactionResult<T>;

package/dist/security/contentRedaction.js

@@ -1,30 +1,52 @@
 const RULES = [
     {
         category: "private_key",
+        reason: "matched private key block",
         pattern: /-----BEGIN [^-\r\n]*PRIVATE KEY-----[\s\S]*?-----END [^-\r\n]*PRIVATE KEY-----/gi,
         replace: "[REDACTED PRIVATE KEY]",
     },
     {
         category: "bearer_token",
+        reason: "matched bearer token",
         pattern: /\bBearer\s+[A-Za-z0-9._~+\/-]{12,}={0,2}/gi,
         replace: "Bearer [REDACTED]",
     },
     {
         category: "npm_token",
+        reason: "matched npm auth token",
         pattern: /(\b_?authToken\s*=\s*)[^\s\r\n]+/gi,
         replace: "$1[REDACTED]",
     },
     {
         category: "credential_assignment",
+        reason: "matched credential assignment",
         pattern: /\b((?:access[_ -]?token|api[_ -]?key|secret|password|credential|token)\s*[:=]\s*)(["']?)([^\s,"'\]}]{8,})(["']?)/gi,
         replace: "$1$2[REDACTED]$4",
     },
     {
         category: "known_token_format",
+        reason: "matched known token format",
         pattern: /\b(?:sk|ghp|github_pat)_[A-Za-z0-9_-]{16,}\b/g,
         replace: "[REDACTED TOKEN]",
     },
 ];
+export function countRedactionsByCategory(input) {
+    const counts = new Map();
+    for (const rule of RULES) {
+        rule.pattern.lastIndex = 0;
+        const matches = input.match(rule.pattern);
+        if (matches && matches.length > 0) {
+            counts.set(rule.category, (counts.get(rule.category) || 0) + matches.length);
+        }
+    }
+    const result = [];
+    for (const rule of RULES) {
+        const count = counts.get(rule.category);
+        if (count)
+            result.push({ category: rule.category, reason: rule.reason, count });
+    }
+    return result;
+}
 export function redactSensitiveContent(input) {
     let content = input;
     const categories = [];