patchwarden 1.1.0 → 1.5.1

package/src/runner/simpleProcess.ts

@@ -62,10 +62,10 @@ export function runSimpleProcessSync(options: SimpleProcessOptions): SimpleProce
   );
 
   if (options.stdoutPath && stdout) {
-    try { writeFileSyncAppend(options.stdoutPath, stdout); } catch {}
+    try { writeFileSyncAppend(options.stdoutPath, stdout); } catch {} // best-effort log write; failure doesn't affect result
   }
   if (options.stderrPath && stderr) {
-    try { writeFileSyncAppend(options.stderrPath, stderr); } catch {}
+    try { writeFileSyncAppend(options.stderrPath, stderr); } catch {} // best-effort log write; failure doesn't affect result
   }
 
   return {
@@ -196,7 +196,7 @@ function gracefulKill(child: ChildProcess): void {
   try {
     if (process.platform !== "win32" && child.pid) process.kill(-child.pid, "SIGTERM");
     else child.kill("SIGTERM");
-  } catch {}
+  } catch {} // cleanup failure is safe to ignore
 }
 
 function forceKill(child: ChildProcess): void {
@@ -213,7 +213,7 @@ function forceKill(child: ChildProcess): void {
       process.kill(-child.pid, "SIGKILL");
     }
   } catch {
-    try { child.kill("SIGKILL"); } catch {}
+    try { child.kill("SIGKILL"); } catch {} // cleanup failure is safe to ignore
   }
 }
 

package/src/runner/watch.ts

@@ -25,6 +25,7 @@ import { guardAgentCommand, guardTestCommand } from "../security/commandGuard.js
 import { validateAssessmentFreshness } from "../assessments/assessmentStore.js";
 import { captureRepoSnapshot } from "./changeCapture.js";
 import { runTask } from "./runTask.js";
+import { logger } from "../logging.js";
 
 // ── Bootstrap ─────────────────────────────────────────────────────
 
@@ -42,10 +43,10 @@ const WATCHER_LAUNCHER_PID = Number.isInteger(Number(process.env.PATCHWARDEN_WAT
   : null;
 mkdirSync(dirname(WATCHER_HEARTBEAT_FILE), { recursive: true });
 
-console.error(`[watcher] Workspace: ${wsRoot}`);
-console.error(`[watcher] Tasks:    ${tasksDir}`);
-console.error(`[watcher] Polling every ${POLL_INTERVAL_MS / 1000}s`);
-console.error(`[watcher] Press Ctrl+C to stop`);
+logger.info(`[watcher] Workspace: ${wsRoot}`);
+logger.info(`[watcher] Tasks:    ${tasksDir}`);
+logger.info(`[watcher] Polling every ${POLL_INTERVAL_MS / 1000}s`);
+logger.info(`[watcher] Press Ctrl+C to stop`);
 
 // Track executed tasks to prevent re-execution
 const executedTasks = new Set<string>();
@@ -110,7 +111,7 @@ async function tick() {
 
         // Assessment freshness revalidation
         if (statusData.assessment_id) {
-          const preExecSnapshot = captureRepoSnapshot(resolvedRepoPath);
+          const preExecSnapshot = await captureRepoSnapshot(resolvedRepoPath);
           const validation = validateAssessmentFreshness(String(statusData.assessment_id), preExecSnapshot);
           if (!validation.valid) {
             throw new Error(`assessment validation failed: ${validation.failure_reason}`);
@@ -118,7 +119,7 @@ async function tick() {
         }
       } catch (err) {
         const errMsg = `[watcher] Safety check failed for ${taskId}: ${err instanceof Error ? err.message : String(err)}`;
-        console.error(errMsg);
+        logger.error(errMsg);
 
         // Write error and mark as failed so it doesn't get re-picked
         try {
@@ -128,30 +129,32 @@ async function tick() {
           data.error = errMsg;
           data.updated_at = new Date().toISOString();
           writeFileSync(statusFile, JSON.stringify(data, null, 2), "utf-8");
-        } catch {}
+        } catch (err) {
+          logger.warn("watcher error-log write failed", { error: err instanceof Error ? err.message : String(err) });
+        }
         executedTasks.add(taskId);
         continue;
       }
 
       // ── Execute ──
-      console.error(`[watcher] Executing: ${taskId}`);
+      logger.info(`[watcher] Executing: ${taskId}`);
       executedTasks.add(taskId);
 
       try {
         const result = await runTask(taskId);
-        console.error(`[watcher] ${taskId} → ${result.status}`);
+        logger.info(`[watcher] ${taskId} → ${result.status}`);
       } catch (err) {
-        console.error(`[watcher] ${taskId} → error: ${err instanceof Error ? err.message : String(err)}`);
+        logger.error(`[watcher] ${taskId} → error: ${err instanceof Error ? err.message : String(err)}`);
       }
     }
   } catch (err) {
-    console.error(`[watcher] Tick error: ${err instanceof Error ? err.message : String(err)}`);
+    logger.error(`[watcher] Tick error: ${err instanceof Error ? err.message : String(err)}`);
   }
 }
 
 // ── Start ─────────────────────────────────────────────────────────
 
-console.error("[watcher] Started");
+logger.info("[watcher] Started");
 setInterval(tick, POLL_INTERVAL_MS);
 
 // Run first tick immediately
@@ -159,10 +162,10 @@ tick();
 
 // Graceful shutdown
 process.on("SIGINT", () => {
-  console.error("[watcher] Stopped");
+  logger.info("[watcher] Stopped");
   process.exit(0);
 });
 process.on("SIGTERM", () => {
-  console.error("[watcher] Stopped");
+  logger.info("[watcher] Stopped");
   process.exit(0);
 });

package/src/security/contentRedaction.ts

@@ -12,6 +12,7 @@ export interface StructuredRedactionResult<T> {
 
 interface RedactionRule {
   category: string;
+  reason: string;
   pattern: RegExp;
   replace: string;
 }
@@ -19,31 +20,59 @@ interface RedactionRule {
 const RULES: RedactionRule[] = [
   {
     category: "private_key",
+    reason: "matched private key block",
     pattern: /-----BEGIN [^-\r\n]*PRIVATE KEY-----[\s\S]*?-----END [^-\r\n]*PRIVATE KEY-----/gi,
     replace: "[REDACTED PRIVATE KEY]",
   },
   {
     category: "bearer_token",
+    reason: "matched bearer token",
     pattern: /\bBearer\s+[A-Za-z0-9._~+\/-]{12,}={0,2}/gi,
     replace: "Bearer [REDACTED]",
   },
   {
     category: "npm_token",
+    reason: "matched npm auth token",
     pattern: /(\b_?authToken\s*=\s*)[^\s\r\n]+/gi,
     replace: "$1[REDACTED]",
   },
   {
     category: "credential_assignment",
+    reason: "matched credential assignment",
     pattern: /\b((?:access[_ -]?token|api[_ -]?key|secret|password|credential|token)\s*[:=]\s*)(["']?)([^\s,"'\]}]{8,})(["']?)/gi,
     replace: "$1$2[REDACTED]$4",
   },
   {
     category: "known_token_format",
+    reason: "matched known token format",
     pattern: /\b(?:sk|ghp|github_pat)_[A-Za-z0-9_-]{16,}\b/g,
     replace: "[REDACTED TOKEN]",
   },
 ];
 
+export interface RedactionCategoryCount {
+  category: string;
+  reason: string;
+  count: number;
+}
+
+export function countRedactionsByCategory(input: string): RedactionCategoryCount[] {
+  const counts = new Map<string, number>();
+  for (const rule of RULES) {
+    rule.pattern.lastIndex = 0;
+    const matches = input.match(rule.pattern);
+    if (matches && matches.length > 0) {
+      counts.set(rule.category, (counts.get(rule.category) || 0) + matches.length);
+    }
+  }
+  const result: RedactionCategoryCount[] = [];
+  for (const rule of RULES) {
+    const count = counts.get(rule.category);
+    if (count) result.push({ category: rule.category, reason: rule.reason, count });
+  }
+  return result;
+}
+
 export function redactSensitiveContent(input: string): RedactionResult {
   let content = input;
   const categories: string[] = [];