patchwarden 1.5.0 → 1.6.1

package/dist/runner/changeCapture.js

@@ -1,26 +1,40 @@
 import { createHash } from "node:crypto";
-import { lstatSync, readFileSync, readdirSync, writeFileSync, } from "node:fs";
+import { createReadStream, lstatSync, readFileSync, readdirSync, } from "node:fs";
 import { join, relative, resolve, isAbsolute } from "node:path";
-import { spawnSync } from "node:child_process";
+import { execFile } from "node:child_process";
+import { redactSensitiveContent } from "../security/contentRedaction.js";
 import { isSensitivePath } from "../security/sensitiveGuard.js";
+import { nullDevice } from "../utils/platform.js";
+import { buildGitEnvironment, resolveTrustedExecutable } from "./processSecurity.js";
+import { atomicWriteJsonFileSync } from "../utils/atomicFile.js";
 const MAX_HASH_BYTES = 5 * 1024 * 1024;
 const MAX_SNAPSHOT_FILES = 5000;
 const MAX_DIFF_BYTES = 20 * 1024 * 1024;
+const DIFF_TRUNCATION_MARKER = "\n[PATCHWARDEN DIFF TRUNCATED]\n";
 const SKIP_DIRECTORIES = new Set([".git", ".patchwarden", "node_modules"]);
-export function captureRepoSnapshot(repoPath) {
+export async function captureRepoSnapshot(repoPath, signal) {
+    throwIfAborted(signal);
     const warnings = [];
-    const isGit = runGit(repoPath, ["rev-parse", "--is-inside-work-tree"]).stdout.trim() === "true";
+    const isGitResult = await runGit(repoPath, ["rev-parse", "--is-inside-work-tree"], signal);
+    const isGit = isGitResult.stdout.trim() === "true";
     let head = null;
     let status = "";
     let paths = [];
-    const trackedPaths = new Set();
-    const ignoredPaths = new Set();
+    const trackedPaths = new Map();
+    const ignoredPaths = new Map();
     const dirtyPaths = new Set();
     if (isGit) {
-        const headResult = runGit(repoPath, ["rev-parse", "HEAD"]);
+        // The following five git calls are independent of each other and can run in parallel.
+        const [headResult, statusResult, trackedResult, ignoredResult, listedResult] = await Promise.all([
+            runGit(repoPath, ["rev-parse", "HEAD"], signal),
+            runGit(repoPath, ["status", "--porcelain=v1", "-uall"], signal),
+            runGit(repoPath, ["ls-files", "-z"], signal),
+            runGit(repoPath, ["ls-files", "-o", "-i", "--exclude-standard", "-z"], signal),
+            runGit(repoPath, ["ls-files", "-co", "--exclude-standard", "-z"], signal),
+        ]);
         if (headResult.status === 0)
             head = headResult.stdout.trim() || null;
-        status = runGit(repoPath, ["status", "--porcelain=v1", "-uall"]).stdout.trimEnd();
+        status = statusResult.stdout.trimEnd();
         // Parse git status --porcelain to collect all dirty paths
         for (const line of status.split("\n")) {
             if (line.length < 4)
@@ -45,34 +59,31 @@ export function captureRepoSnapshot(repoPath) {
                 }
             }
         }
-        const tracked = runGit(repoPath, ["ls-files", "-z"]);
-        if (tracked.status === 0) {
-            for (const path of tracked.stdout.split("\0").filter(Boolean))
-                trackedPaths.add(normalizePath(path));
+        if (trackedResult.status === 0) {
+            for (const path of trackedResult.stdout.split("\0").filter(Boolean))
+                addSnapshotPath(trackedPaths, path);
         }
-        const ignored = runGit(repoPath, ["ls-files", "-o", "-i", "--exclude-standard", "-z"]);
-        if (ignored.status === 0) {
-            for (const path of ignored.stdout.split("\0").filter(Boolean))
-                ignoredPaths.add(normalizePath(path));
+        if (ignoredResult.status === 0) {
+            for (const path of ignoredResult.stdout.split("\0").filter(Boolean))
+                addSnapshotPath(ignoredPaths, path);
         }
         else {
             warnings.push("git ignored-file discovery failed; ignored classification may be incomplete");
         }
-        const listed = runGit(repoPath, ["ls-files", "-co", "--exclude-standard", "-z"]);
-        if (listed.status === 0) {
+        if (listedResult.status === 0) {
             paths = [...new Set([
-                    ...listed.stdout.split("\0").filter(Boolean),
-                    ...walkWorkspace(repoPath),
+                    ...listedResult.stdout.split("\0").filter(Boolean),
+                    ...walkWorkspace(repoPath, signal),
                 ])];
         }
         else {
             warnings.push("git ls-files failed; using bounded filesystem scan");
-            paths = walkWorkspace(repoPath);
+            paths = walkWorkspace(repoPath, signal);
         }
     }
     else {
         warnings.push("repository is not a Git worktree; diff will contain file-change evidence only");
-        paths = walkWorkspace(repoPath);
+        paths = walkWorkspace(repoPath, signal);
     }
     if (paths.length > MAX_SNAPSHOT_FILES) {
         warnings.push(`snapshot limited to ${MAX_SNAPSHOT_FILES} files`);
@@ -80,6 +91,7 @@ export function captureRepoSnapshot(repoPath) {
     }
     const files = {};
     for (const inputPath of paths.sort()) {
+        throwIfAborted(signal);
         const normalized = normalizePath(inputPath);
         if (!normalized || normalized.startsWith(".patchwarden/") || isSensitivePath(normalized))
             continue;
@@ -94,8 +106,8 @@ export function captureRepoSnapshot(repoPath) {
             files[normalized] = {
                 size: stat.size,
                 sha256,
-                tracked: trackedPaths.has(normalized),
-                ignored: !trackedPaths.has(normalized) && ignoredPaths.has(normalized),
+                tracked: hasSnapshotPath(trackedPaths, normalized),
+                ignored: !hasSnapshotPath(trackedPaths, normalized) && hasSnapshotPath(ignoredPaths, normalized),
             };
         }
         catch {
@@ -114,32 +126,14 @@ export function captureRepoSnapshot(repoPath) {
     };
 }
 export function writeSnapshot(taskDir, filename, snapshot) {
-    writeFileSync(join(taskDir, filename), JSON.stringify(snapshot, null, 2), "utf-8");
+    atomicWriteJsonFileSync(join(taskDir, filename), snapshot);
 }
-export function buildChangeArtifacts(repoPath, before, after) {
+export async function buildChangeArtifacts(repoPath, before, after, signal) {
+    throwIfAborted(signal);
     const changedFiles = compareSnapshots(before, after);
     const artifactHygiene = classifyArtifactHygiene(changedFiles);
     const sections = [];
     const scopedPaths = [...new Set(changedFiles.flatMap((file) => file.old_path ? [file.old_path, file.path] : [file.path]))];
-    if (before.is_git && after.is_git && scopedPaths.length > 0) {
-        if (before.head && after.head && before.head !== after.head) {
-            const committed = runGit(repoPath, ["diff", "--no-color", "--binary", before.head, after.head, "--", ...scopedPaths]);
-            if (committed.stdout.trim())
-                sections.push("# Changes committed during task\n", committed.stdout.trimEnd());
-        }
-        const base = after.head || "HEAD";
-        const working = runGit(repoPath, ["diff", "--no-color", "--binary", base, "--", ...scopedPaths]);
-        if (working.stdout.trim())
-            sections.push("# Staged and unstaged changes\n", working.stdout.trimEnd());
-        for (const file of changedFiles.filter((item) => item.change === "added").slice(0, 100)) {
-            const tracked = runGit(repoPath, ["ls-files", "--error-unmatch", "--", file.path]);
-            if (tracked.status === 0)
-                continue;
-            const untracked = runGit(repoPath, ["diff", "--no-index", "--no-color", "--binary", "--", "/dev/null", file.path]);
-            if (untracked.stdout.trim())
-                sections.push("# Untracked file\n", untracked.stdout.trimEnd());
-        }
-    }
     const evidence = [
         "# PatchWarden change evidence",
         `# changed_files: ${changedFiles.length}`,
@@ -147,16 +141,70 @@ export function buildChangeArtifacts(repoPath, before, after) {
         `# workspace_dirty_after: ${after.workspace_dirty}`,
         ...changedFiles.map((file) => `# ${file.change}: ${file.path}`),
     ].join("\n");
-    const body = sections.join("\n\n");
-    const fullDiff = `${evidence}\n\n${body || (changedFiles.length ? "(textual patch unavailable; see changed-files.json for hash evidence)" : "(no task file changes detected)")}\n`;
+    let retainedSectionBytes = 0;
+    let diffTruncated = Buffer.byteLength(evidence, "utf-8") > MAX_DIFF_BYTES;
+    const sectionBudget = Math.max(0, MAX_DIFF_BYTES
+        - Math.min(Buffer.byteLength(evidence, "utf-8"), MAX_DIFF_BYTES)
+        - Buffer.byteLength(DIFF_TRUNCATION_MARKER, "utf-8")
+        - 2);
+    const appendSection = (label, content, commandTruncated = false) => {
+        if (!content.trim()) {
+            if (commandTruncated)
+                diffTruncated = true;
+            return;
+        }
+        const block = `${sections.length > 0 ? "\n\n" : ""}${label}\n\n${content.trimEnd()}`;
+        const remaining = Math.max(0, sectionBudget - retainedSectionBytes);
+        const bounded = utf8Prefix(block, remaining);
+        if (bounded) {
+            sections.push(bounded);
+            retainedSectionBytes += Buffer.byteLength(bounded, "utf-8");
+        }
+        if (commandTruncated || Buffer.byteLength(bounded, "utf-8") < Buffer.byteLength(block, "utf-8")) {
+            diffTruncated = true;
+        }
+    };
+    if (before.is_git && after.is_git && scopedPaths.length > 0) {
+        if (before.head && after.head && before.head !== after.head) {
+            const committed = await runGit(repoPath, ["diff", "--no-ext-diff", "--no-textconv", "--no-color", "--binary", before.head, after.head, "--", ...scopedPaths], signal);
+            appendSection("# Changes committed during task", committed.stdout, committed.truncated);
+        }
+        if (retainedSectionBytes < sectionBudget) {
+            const base = after.head || "HEAD";
+            const working = await runGit(repoPath, ["diff", "--no-ext-diff", "--no-textconv", "--no-color", "--binary", base, "--", ...scopedPaths], signal);
+            appendSection("# Staged and unstaged changes", working.stdout, working.truncated);
+        }
+        else {
+            diffTruncated = true;
+        }
+        for (const file of changedFiles.filter((item) => item.change === "added").slice(0, 100)) {
+            throwIfAborted(signal);
+            if (retainedSectionBytes >= sectionBudget) {
+                diffTruncated = true;
+                break;
+            }
+            const tracked = await runGit(repoPath, ["ls-files", "--error-unmatch", "--", file.path], signal);
+            if (tracked.status === 0)
+                continue;
+            const untracked = await runGit(repoPath, ["diff", "--no-ext-diff", "--no-textconv", "--no-index", "--no-color", "--binary", "--", nullDevice, file.path], signal);
+            appendSection("# Untracked file", untracked.stdout, untracked.truncated);
+        }
+    }
+    const body = sections.join("");
+    const rawDiff = `${evidence}\n\n${body || (changedFiles.length ? "(textual patch unavailable; see changed-files.json for hash evidence)" : "(no task file changes detected)")}\n`;
+    const sanitized = sanitizeDiffEvidence(rawDiff, MAX_DIFF_BYTES);
+    const fullDiff = sanitized.content;
+    diffTruncated ||= sanitized.truncated;
     const additions = fullDiff.split(/\r?\n/).filter((line) => line.startsWith("+") && !line.startsWith("+++")).length;
     const deletions = fullDiff.split(/\r?\n/).filter((line) => line.startsWith("-") && !line.startsWith("---")).length;
-    const fileStats = buildFileStats(repoPath, before, after, changedFiles);
+    const fileStats = await buildFileStats(repoPath, before, after, changedFiles, signal);
     return {
         changed_files: changedFiles,
         diff: fullDiff,
         diff_available: changedFiles.length > 0,
-        diff_truncated: false,
+        diff_truncated: diffTruncated,
+        diff_redacted: sanitized.redacted,
+        diff_redaction_categories: sanitized.redaction_categories,
         diff_size_bytes: Buffer.byteLength(fullDiff, "utf-8"),
         additions,
         deletions,
@@ -172,8 +220,32 @@ export function buildChangeArtifacts(repoPath, before, after) {
         artifact_hygiene: artifactHygiene,
     };
 }
-function buildFileStats(repoPath, before, after, changedFiles) {
-    return changedFiles.map((file) => {
+export function sanitizeDiffEvidence(input, maxBytes = MAX_DIFF_BYTES) {
+    if (!Number.isInteger(maxBytes) || maxBytes <= 0) {
+        throw new Error("maxBytes must be a positive integer");
+    }
+    const redaction = redactSensitiveContent(input);
+    const encodedBytes = Buffer.byteLength(redaction.content, "utf-8");
+    if (encodedBytes <= maxBytes) {
+        return {
+            content: redaction.content,
+            truncated: false,
+            redacted: redaction.redacted,
+            redaction_categories: redaction.redaction_categories,
+        };
+    }
+    const marker = utf8Prefix(DIFF_TRUNCATION_MARKER, maxBytes);
+    const markerBytes = Buffer.byteLength(marker, "utf-8");
+    return {
+        content: utf8Prefix(redaction.content, Math.max(0, maxBytes - markerBytes)) + marker,
+        truncated: true,
+        redacted: redaction.redacted,
+        redaction_categories: redaction.redaction_categories,
+    };
+}
+async function buildFileStats(repoPath, before, after, changedFiles, signal) {
+    const results = await Promise.all(changedFiles.map(async (file) => {
+        throwIfAborted(signal);
         let additions = 0;
         let deletions = 0;
         const paths = file.old_path ? [file.old_path, file.path] : [file.path];
@@ -183,8 +255,8 @@ function buildFileStats(repoPath, before, after, changedFiles) {
                 ranges.push([before.head, after.head]);
             }
             ranges.push([after.head || "HEAD"]);
-            for (const range of ranges) {
-                const result = runGit(repoPath, ["diff", "--numstat", ...range, "--", ...paths]);
+            const rangeResults = await Promise.all(ranges.map((range) => runGit(repoPath, ["diff", "--no-ext-diff", "--no-textconv", "--numstat", ...range, "--", ...paths], signal)));
+            for (const result of rangeResults) {
                 for (const line of result.stdout.split(/\r?\n/).filter(Boolean)) {
                     const [added, removed] = line.split(/\s+/);
                     if (/^\d+$/.test(added))
@@ -199,29 +271,41 @@ function buildFileStats(repoPath, before, after, changedFiles) {
                 const content = readFileSync(resolve(repoPath, file.path), "utf-8");
                 additions = countLines(content);
             }
-            catch { }
+            catch { } // probe failure handled by return value (additions stays 0)
         }
         return { path: file.path, status: file.change, additions, deletions };
-    });
+    }));
+    return results;
 }
 function countLines(content) {
     if (content.length === 0)
         return 0;
     return content.split(/\r?\n/).length - (content.endsWith("\n") ? 1 : 0);
 }
-export function compareSnapshots(before, after) {
-    const paths = [...new Set([...Object.keys(before.files), ...Object.keys(after.files)])].sort();
+export function compareSnapshots(before, after, platform = process.platform) {
     const changed = [];
-    for (const path of paths) {
-        const left = before.files[path];
-        const right = after.files[path];
+    for (const { path, leftPath, rightPath, left, right } of pairSnapshotFiles(before.files, after.files, platform)) {
         if (!left && right) {
             changed.push(classifyChangedFile(path, "added", null, right));
         }
         else if (left && !right) {
             changed.push(classifyChangedFile(path, "deleted", left, null));
         }
-        else if (left.sha256 !== right.sha256) {
+        else if (left && right && left.sha256 === right.sha256 && leftPath !== rightPath) {
+            // Windows lookup is case-insensitive, but a case-only Git rename is still
+            // auditable work and must not disappear from the evidence set.
+            changed.push({
+                path: rightPath,
+                old_path: leftPath,
+                change: "renamed",
+                before_sha256: left.sha256,
+                after_sha256: right.sha256,
+                tracked: left.tracked || right.tracked,
+                ignored: right.ignored,
+                kind: classifyPathKind(rightPath),
+            });
+        }
+        else if (left && right && left.sha256 !== right.sha256) {
             changed.push(classifyChangedFile(path, "modified", left, right));
         }
     }
@@ -274,9 +358,11 @@ export function emptyArtifactHygiene() {
  * Extract files that are dirty in the workspace but outside the target repo.
  * Used to establish a baseline before task execution.
  */
-export function extractExternalDirtyFiles(workspaceSnapshot, repoPath, workspaceRoot) {
+export function extractExternalDirtyFiles(workspaceSnapshot, repoPath, workspaceRoot, platform = process.platform) {
     const dirtyFiles = [];
-    const dirtyPathSet = new Set(workspaceSnapshot.dirty_paths);
+    const dirtyPathSet = new Map();
+    for (const path of workspaceSnapshot.dirty_paths)
+        addSnapshotPath(dirtyPathSet, path, platform);
     for (const [path, fingerprint] of Object.entries(workspaceSnapshot.files)) {
         const absolutePath = resolve(workspaceRoot, path);
         const rel = relative(repoPath, absolutePath);
@@ -286,7 +372,7 @@ export function extractExternalDirtyFiles(workspaceSnapshot, repoPath, workspace
             // 1. Git reports it as dirty (modified/added/deleted/untracked) via dirty_paths, OR
             // 2. It's not tracked by git (untracked file), OR
             // 3. It's explicitly ignored
-            const isDirty = dirtyPathSet.has(path);
+            const isDirty = hasSnapshotPath(dirtyPathSet, path, platform);
             const isUntracked = !fingerprint.tracked;
             const isIgnored = fingerprint.ignored;
             if (isDirty || isUntracked || isIgnored) {
@@ -306,10 +392,17 @@ export function extractExternalDirtyFiles(workspaceSnapshot, repoPath, workspace
  * Returns files that are NEW (not present in baseline) or CHANGED
  * (same path but different sha256, meaning the task modified them).
  */
-export function findNewExternalDirtyFiles(baseline, current) {
-    const baselineMap = new Map(baseline.map((f) => [f.path, f]));
+export function findNewExternalDirtyFiles(baseline, current, platform = process.platform) {
+    const baselineMap = new Map();
+    for (const file of baseline) {
+        const key = comparableSnapshotPath(file.path, platform);
+        baselineMap.set(key, [...(baselineMap.get(key) ?? []), file]);
+    }
     return current.filter((f) => {
-        const baselineFile = baselineMap.get(f.path);
+        const candidates = baselineMap.get(comparableSnapshotPath(f.path, platform)) ?? [];
+        const baselineFile = candidates.length <= 1
+            ? candidates[0]
+            : candidates.find((candidate) => normalizePath(candidate.path) === normalizePath(f.path));
         if (!baselineFile)
             return true; // New path — definitely new
         // Same path but content changed during task execution
@@ -318,7 +411,7 @@ export function findNewExternalDirtyFiles(baseline, current) {
         return false;
     });
 }
-export function buildArtifactManifest(changedFiles, repoPath, taskId) {
+export async function buildArtifactManifest(changedFiles, repoPath, taskId) {
     const entries = [];
     for (const file of changedFiles) {
         if (file.kind !== "build_artifact")
@@ -331,7 +424,7 @@ export function buildArtifactManifest(changedFiles, repoPath, taskId) {
             if (stat.isFile()) {
                 size = stat.size;
                 if (size <= MAX_HASH_BYTES) {
-                    sha256 = createHash("sha256").update(readFileSync(absolutePath)).digest("hex");
+                    sha256 = await hashFileAsync(absolutePath);
                 }
             }
         }
@@ -475,9 +568,72 @@ function classificationReason(change) {
 function normalizePath(value) {
     return value.replace(/\\/g, "/");
 }
-function walkWorkspace(root) {
+function comparableSnapshotPath(value, platform = process.platform) {
+    const normalized = normalizePath(value);
+    return platform === "win32" ? normalized.toLowerCase() : normalized;
+}
+function addSnapshotPath(index, value, platform = process.platform) {
+    const normalized = normalizePath(value);
+    const key = comparableSnapshotPath(normalized, platform);
+    const exactPaths = index.get(key) ?? new Set();
+    exactPaths.add(normalized);
+    index.set(key, exactPaths);
+}
+function hasSnapshotPath(index, value, platform = process.platform) {
+    const normalized = normalizePath(value);
+    const exactPaths = index.get(comparableSnapshotPath(normalized, platform));
+    if (!exactPaths)
+        return false;
+    return platform !== "win32" || exactPaths.size <= 1 || exactPaths.has(normalized);
+}
+function pairSnapshotFiles(before, after, platform) {
+    const beforeGroups = groupSnapshotFiles(before, platform);
+    const afterGroups = groupSnapshotFiles(after, platform);
+    const pairs = [];
+    const comparablePaths = [...new Set([...beforeGroups.keys(), ...afterGroups.keys()])].sort();
+    for (const comparablePath of comparablePaths) {
+        const beforeEntries = beforeGroups.get(comparablePath) ?? [];
+        const afterEntries = afterGroups.get(comparablePath) ?? [];
+        if (platform !== "win32" || (beforeEntries.length <= 1 && afterEntries.length <= 1)) {
+            pairs.push({
+                path: afterEntries[0]?.path ?? beforeEntries[0].path,
+                leftPath: beforeEntries[0]?.path,
+                rightPath: afterEntries[0]?.path,
+                left: beforeEntries[0]?.fingerprint,
+                right: afterEntries[0]?.fingerprint,
+            });
+            continue;
+        }
+        // NTFS can opt individual directories into case-sensitive mode. If either
+        // snapshot contains a case collision, preserve every exact path instead of
+        // silently dropping one entry from the evidence.
+        const beforeExact = new Map(beforeEntries.map((entry) => [normalizePath(entry.path), entry]));
+        const afterExact = new Map(afterEntries.map((entry) => [normalizePath(entry.path), entry]));
+        const exactPaths = [...new Set([...beforeExact.keys(), ...afterExact.keys()])].sort();
+        for (const exactPath of exactPaths) {
+            pairs.push({
+                path: afterExact.get(exactPath)?.path ?? beforeExact.get(exactPath).path,
+                leftPath: beforeExact.get(exactPath)?.path,
+                rightPath: afterExact.get(exactPath)?.path,
+                left: beforeExact.get(exactPath)?.fingerprint,
+                right: afterExact.get(exactPath)?.fingerprint,
+            });
+        }
+    }
+    return pairs;
+}
+function groupSnapshotFiles(files, platform) {
+    const grouped = new Map();
+    for (const [path, fingerprint] of Object.entries(files)) {
+        const key = comparableSnapshotPath(path, platform);
+        grouped.set(key, [...(grouped.get(key) ?? []), { path, fingerprint }]);
+    }
+    return grouped;
+}
+function walkWorkspace(root, signal) {
     const result = [];
     const visit = (directory) => {
+        throwIfAborted(signal);
         if (result.length >= MAX_SNAPSHOT_FILES)
             return;
         let entries;
@@ -488,6 +644,7 @@ function walkWorkspace(root) {
             return;
         }
         for (const entry of entries) {
+            throwIfAborted(signal);
             if (result.length >= MAX_SNAPSHOT_FILES)
                 break;
             if (entry.isDirectory() && SKIP_DIRECTORIES.has(entry.name))
@@ -502,16 +659,65 @@ function walkWorkspace(root) {
     visit(root);
     return result;
 }
-function runGit(repoPath, args) {
-    const result = spawnSync("git", args, {
-        cwd: repoPath,
-        encoding: "utf-8",
-        timeout: 30_000,
-        maxBuffer: MAX_DIFF_BYTES,
+function runGit(repoPath, args, signal) {
+    throwIfAborted(signal);
+    return new Promise((resolve, reject) => {
+        const env = buildGitEnvironment(repoPath);
+        const git = resolveTrustedExecutable("git", repoPath, { pathValue: env.PATH });
+        execFile(git, args, {
+            cwd: repoPath,
+            encoding: "utf-8",
+            timeout: 30_000,
+            maxBuffer: MAX_DIFF_BYTES,
+            windowsHide: true,
+            env,
+            signal,
+        }, (err, stdout, stderr) => {
+            if (signal?.aborted) {
+                reject(abortReason(signal));
+                return;
+            }
+            let status;
+            if (err) {
+                // err.code is the exit code (number) when the process exited with a non-zero status;
+                // it is a string (e.g. "ENOENT") when spawning failed or the buffer limit was hit.
+                status = typeof err.code === "number" ? err.code : null;
+            }
+            else {
+                status = 0;
+            }
+            const truncated = Boolean(err
+                && typeof err.code === "string"
+                && err.code.includes("MAXBUFFER"));
+            resolve({ status, stdout: stdout || "", stderr: stderr || "", truncated });
+        });
+    });
+}
+function throwIfAborted(signal) {
+    if (signal?.aborted)
+        throw abortReason(signal);
+}
+function abortReason(signal) {
+    return signal.reason instanceof Error ? signal.reason : new Error("Operation aborted");
+}
+function utf8Prefix(value, maxBytes) {
+    if (maxBytes <= 0)
+        return "";
+    const encoded = Buffer.from(value, "utf-8");
+    if (encoded.length <= maxBytes)
+        return value;
+    let prefix = encoded.subarray(0, maxBytes).toString("utf-8").replace(/\uFFFD$/u, "");
+    while (Buffer.byteLength(prefix, "utf-8") > maxBytes)
+        prefix = prefix.slice(0, -1);
+    return prefix;
+}
+function hashFileAsync(filePath) {
+    return new Promise((resolve, reject) => {
+        const hash = createHash("sha256");
+        const stream = createReadStream(filePath);
+        stream.on("error", reject);
+        hash.on("error", reject);
+        hash.on("finish", () => resolve(hash.digest("hex")));
+        stream.pipe(hash);
     });
-    return {
-        status: result.status,
-        stdout: result.stdout || "",
-        stderr: result.stderr || "",
-    };
 }

package/dist/runner/cli.js

@@ -8,19 +8,20 @@
  */
 import { runTask } from "./runTask.js";
 import { loadConfig } from "../config.js";
+import { logger } from "../logging.js";
 // Load config early
 loadConfig();
 const taskId = process.argv[2] || process.env.PATCHWARDEN_TASK_ID;
 if (!taskId) {
-    console.error("Usage: node dist/runner/cli.js <task_id>");
-    console.error("   or: npm run runner -- <task_id>");
+    logger.info("Usage: node dist/runner/cli.js <task_id>");
+    logger.info("   or: npm run runner -- <task_id>");
     process.exit(1);
 }
-console.error(`[runner] Starting task: ${taskId}`);
+logger.info(`[runner] Starting task: ${taskId}`);
 const result = await runTask(taskId);
-console.error(`[runner] Task ${result.task_id}: ${result.status}`);
+logger.info(`[runner] Task ${result.task_id}: ${result.status}`);
 if (result.error) {
-    console.error(`[runner] Error: ${result.error}`);
+    logger.fatal(`[runner] Error: ${result.error}`);
     process.exit(1);
 }
-console.error("[runner] Done.");
+logger.info("[runner] Done.");