patchwarden 1.5.0 → 1.6.1

package/dist/runner/runTask.js

@@ -1,22 +1,36 @@
 import { spawn, spawnSync } from "node:child_process";
-import { createWriteStream, existsSync, readFileSync, writeFileSync, } from "node:fs";
+import { existsSync, readFileSync, } from "node:fs";
 import { isAbsolute, join, relative, resolve } from "node:path";
 import { getTasksDir, getPlansDir, getConfig, resolveWorkspaceRoot } from "../config.js";
 import { guardPath, guardWorkspacePath } from "../security/pathGuard.js";
 import { guardTestCommand, } from "../security/commandGuard.js";
-import { writeTaskProgress } from "../taskProgress.js";
-import { writeTaskRuntime } from "../taskRuntime.js";
+import { writeTaskProgress } from "./taskProgress.js";
+import { writeTaskRuntime } from "./taskRuntime.js";
+import { claimPendingTask, readTaskStatusFile, updateTaskStatusFile, } from "./taskStatusStore.js";
 import { validateAssessmentFreshness } from "../assessments/assessmentStore.js";
 import { buildAgentInvocation, buildExecutionPrompt } from "./agentInvocation.js";
 import { buildChangeArtifacts, captureRepoSnapshot, compareSnapshots, emptyArtifactHygiene, writeSnapshot, extractExternalDirtyFiles, findNewExternalDirtyFiles, buildArtifactManifest, groupChangedFiles, } from "./changeCapture.js";
 import { errorPayload } from "../errors.js";
-import { diagnoseAndroidBuild } from "../tools/androidDoctor.js";
+import { ARTIFACT_SCHEMA_VERSION } from "../version.js";
+import { diagnoseAndroidBuild } from "../tools/workspace/androidDoctor.js";
 import { runPostTaskCleanup } from "./postTaskCleanup.js";
+import { atomicWriteFileSync, atomicWriteJsonFileSync } from "../utils/atomicFile.js";
+import { allowedEnvironmentValues, buildChildEnvironment, redactProcessOutput, resolvePackageManagerInvocation, resolveTrustedExecutable, SecureProcessLogCapture, } from "./processSecurity.js";
 const HEARTBEAT_INTERVAL_MS = 2000;
 const GRACEFUL_KILL_MS = 2000;
 const MAX_CAPTURE_CHARS = 100_000;
 const ARTIFACT_COLLECTION_TIMEOUT_MS = 60_000;
 export async function runTask(taskId) {
+    const prepared = await prepareTask(taskId);
+    if (!("taskDir" in prepared))
+        return prepared;
+    const ctx = prepared;
+    const state = await executeAgent(ctx);
+    await runVerification(ctx, state);
+    const evidence = await collectArtifacts(ctx, state);
+    return finalizeTask(ctx, state, evidence);
+}
+async function prepareTask(taskId) {
     const config = getConfig();
     const tasksDir = getTasksDir(config);
     const plansDir = getPlansDir(config);
@@ -26,7 +40,24 @@ export async function runTask(taskId) {
     const statusFile = join(taskDir, "status.json");
     if (!existsSync(statusFile))
         throw new Error(`Task not found: "${taskId}"`);
-    const initialStatus = readStatus(statusFile);
+    const startedAtMs = Date.now();
+    const claim = claimPendingTask(statusFile, {
+        status: "running",
+        phase: "preparing",
+        started_at: new Date(startedAtMs).toISOString(),
+        last_heartbeat_at: new Date(startedAtMs).toISOString(),
+        current_command: null,
+        error: null,
+    });
+    if (!claim.claimed) {
+        const currentStatus = String(claim.status.status || "failed");
+        return {
+            task_id: taskId,
+            status: currentStatus,
+            error: `Task is ${currentStatus}; only pending tasks can be claimed for execution.`,
+        };
+    }
+    const initialStatus = claim.status;
     const planId = String(initialStatus.plan_id || "");
     const agentName = String(initialStatus.agent || "");
     const rawRepoPath = String(initialStatus.resolved_repo_path || initialStatus.repo_path || wsRoot);
@@ -40,7 +71,6 @@ export async function runTask(taskId) {
     catch (error) {
         return failBeforeExecution(taskId, taskDir, errorMessage(error), error);
     }
-    const startedAtMs = Date.now();
     const deadlineMs = startedAtMs + timeoutSeconds * 1000;
     let repoPath;
     try {
@@ -57,11 +87,10 @@ export async function runTask(taskId) {
         const message = `verification metadata validation failed: ${errorMessage(error)}`;
         return failBeforeExecution(taskId, taskDir, message, error);
     }
-    // ── Assessment freshness revalidation before execution ──
     const assessmentId = String(initialStatus.assessment_id || "");
     if (assessmentId) {
         try {
-            const preExecSnapshot = captureRepoSnapshot(repoPath);
+            const preExecSnapshot = await captureRepoSnapshot(repoPath);
             const validation = validateAssessmentFreshness(assessmentId, preExecSnapshot);
             if (!validation.valid) {
                 const message = `assessment validation failed: ${validation.failure_reason}. Re-run create_task with execution_mode=assess_only to get a fresh assessment_id.`;
@@ -73,19 +102,7 @@ export async function runTask(taskId) {
             return failBeforeExecution(taskId, taskDir, message, error);
         }
     }
-    updateStatus(taskDir, {
-        status: "running",
-        phase: "preparing",
-        started_at: new Date(startedAtMs).toISOString(),
-        last_heartbeat_at: new Date().toISOString(),
-        timeout_seconds: timeoutSeconds,
-        current_command: null,
-        error: null,
-    });
-    // v0.7.0: record task_started_at and watcher_instance_id so diagnose_task
-    // can detect PID reuse and orphaned tasks. watcher_instance_id comes from
-    // the watcher process env; when run_task MCP tool is used directly, this
-    // field is intentionally left undefined so ownership cannot be falsely claimed.
+    updateStatus(taskDir, { timeout_seconds: timeoutSeconds });
     writeTaskRuntime(taskDir, {
         task_started_at: new Date(startedAtMs).toISOString(),
         watcher_instance_id: process.env.PATCHWARDEN_WATCHER_INSTANCE_ID || undefined,
@@ -95,156 +112,160 @@ export async function runTask(taskId) {
     let beforeWorkspaceSnapshot;
     let externalDirtyBaseline = [];
     try {
-        beforeSnapshot = captureRepoSnapshot(repoPath);
-        beforeWorkspaceSnapshot = repoPath === wsRoot ? beforeSnapshot : captureRepoSnapshot(wsRoot);
+        beforeSnapshot = await captureRepoSnapshot(repoPath);
+        beforeWorkspaceSnapshot = repoPath === wsRoot ? beforeSnapshot : await captureRepoSnapshot(wsRoot);
         writeSnapshot(taskDir, "git-before.json", beforeSnapshot);
         writeSnapshot(taskDir, "workspace-before.json", beforeWorkspaceSnapshot);
-        // Phase 4: Record external dirty files as baseline before task execution
         externalDirtyBaseline = extractExternalDirtyFiles(beforeWorkspaceSnapshot, repoPath, wsRoot);
     }
     catch (error) {
         const message = `Pre-task snapshot failed: ${errorMessage(error)}`;
         return failBeforeExecution(taskId, taskDir, message, error);
     }
-    let agentResult = null;
-    let testResult = skippedTest(testCommand, repoPath, "Agent did not complete successfully.");
-    const verifyResults = [];
-    let finalStatus = "failed";
-    let finalError = null;
-    let lastCaughtError = null;
+    return {
+        taskId, taskDir, statusFile, repoPath, wsRoot, config, plansDir, initialStatus,
+        planId, agentName, testCommand, changePolicy, verifyCommands, timeoutSeconds,
+        startedAtMs, deadlineMs, beforeSnapshot, beforeWorkspaceSnapshot, externalDirtyBaseline,
+    };
+}
+async function executeAgent(ctx) {
+    const state = {
+        agentResult: null,
+        testResult: skippedTest(ctx.testCommand, ctx.repoPath, "Agent did not complete successfully."),
+        verifyResults: [],
+        finalStatus: "failed",
+        finalError: null,
+        lastCaughtError: null,
+    };
     try {
-        const planFile = resolve(plansDir, planId, "plan.md");
+        const planFile = resolve(ctx.plansDir, ctx.planId, "plan.md");
         if (!existsSync(planFile))
-            throw new Error(`Plan not found: "${planId}". Save the plan first.`);
+            throw new Error(`Plan not found: "${ctx.planId}". Save the plan first.`);
         const planContent = readFileSync(planFile, "utf-8");
-        const prompt = buildExecutionPrompt(planContent, repoPath, testCommand);
-        const invocation = buildAgentInvocation(agentName, repoPath, prompt, config);
-        const agentCommandLabel = invocation.commandLabel;
-        setTaskPhase(taskDir, "executing_agent", agentCommandLabel);
-        agentResult = await runManagedProcess({
+        const prompt = buildExecutionPrompt(planContent, ctx.repoPath, ctx.testCommand);
+        const invocation = buildAgentInvocation(ctx.agentName, ctx.repoPath, prompt, ctx.config);
+        setTaskPhase(ctx.taskDir, "executing_agent", invocation.commandLabel);
+        state.agentResult = await runManagedProcess({
             command: invocation.command,
             args: invocation.args,
-            cwd: repoPath,
-            taskDir,
-            statusFile,
+            cwd: ctx.repoPath,
+            taskDir: ctx.taskDir,
+            statusFile: ctx.statusFile,
             phase: "executing_agent",
-            currentCommand: agentCommandLabel,
-            deadlineMs,
-            stdoutPath: join(taskDir, "stdout.log"),
-            stderrPath: join(taskDir, "stderr.log"),
+            currentCommand: invocation.commandLabel,
+            deadlineMs: ctx.deadlineMs,
+            stdoutPath: join(ctx.taskDir, "stdout.log"),
+            stderrPath: join(ctx.taskDir, "stderr.log"),
+            environmentVariableNames: invocation.environmentVariableNames,
+            blockedEnvironmentVariableNames: invocation.blockedEnvironmentVariableNames,
         });
+        const agentResult = state.agentResult;
         if (agentResult.terminationReason === "canceled" || agentResult.terminationReason === "killed") {
-            finalStatus = "canceled";
-            finalError = agentResult.terminationReason === "killed"
+            state.finalStatus = "canceled";
+            state.finalError = agentResult.terminationReason === "killed"
                 ? "Task was terminated by kill_task."
                 : "Task was canceled by user request.";
         }
         else if (agentResult.terminationReason === "timeout") {
-            finalError = `Task timed out after ${timeoutSeconds} seconds during agent execution.`;
+            state.finalError = `Task timed out after ${ctx.timeoutSeconds} seconds during agent execution.`;
         }
         else if (agentResult.spawnError) {
-            finalError = `Agent spawn failed: ${agentResult.spawnError}`;
+            state.finalError = `Agent spawn failed: ${agentResult.spawnError}`;
         }
         else if (agentResult.exitCode !== 0) {
-            finalError = `Agent exited with code ${agentResult.exitCode}.`;
+            state.finalError = `Agent exited with code ${agentResult.exitCode}.`;
         }
-        else if (verifyCommands.length > 0) {
-            for (const command of verifyCommands) {
-                setTaskPhase(taskDir, "running_tests", command);
-                const verification = await runTrustedTestCommand(command, repoPath, taskDir, statusFile, deadlineMs);
-                verifyResults.push(verification);
-                if (verification.terminationReason || Date.now() >= deadlineMs)
+    }
+    catch (error) {
+        state.lastCaughtError = error;
+        state.finalError = errorMessage(error);
+    }
+    return state;
+}
+async function runVerification(ctx, state) {
+    if (state.finalError !== null)
+        return state;
+    try {
+        if (ctx.verifyCommands.length > 0) {
+            for (const command of ctx.verifyCommands) {
+                setTaskPhase(ctx.taskDir, "running_tests", command);
+                const verification = await runTrustedTestCommand(command, ctx.repoPath, ctx.taskDir, ctx.statusFile, ctx.deadlineMs);
+                state.verifyResults.push(verification);
+                if (verification.terminationReason || Date.now() >= ctx.deadlineMs)
                     break;
             }
-            testResult = verifyResults[0] || skippedTest(testCommand, repoPath, "No verification command ran.");
-            const interrupted = verifyResults.find((result) => result.terminationReason);
-            const failedVerification = verifyResults.find((result) => result.spawnError || result.exitCode !== 0);
+            state.testResult = state.verifyResults[0] || skippedTest(ctx.testCommand, ctx.repoPath, "No verification command ran.");
+            const interrupted = state.verifyResults.find((result) => result.terminationReason);
+            const failedVerification = state.verifyResults.find((result) => result.spawnError || result.exitCode !== 0);
             if (interrupted?.terminationReason === "canceled" || interrupted?.terminationReason === "killed") {
-                finalStatus = "canceled";
-                finalError = interrupted.terminationReason === "killed"
+                state.finalStatus = "canceled";
+                state.finalError = interrupted.terminationReason === "killed"
                     ? "Task was terminated by kill_task during verification."
                     : "Task was canceled during verification.";
             }
-            else if (interrupted?.terminationReason === "timeout" || Date.now() >= deadlineMs) {
-                finalError = `Task timed out after ${timeoutSeconds} seconds during verification.`;
+            else if (interrupted?.terminationReason === "timeout" || Date.now() >= ctx.deadlineMs) {
+                state.finalError = `Task timed out after ${ctx.timeoutSeconds} seconds during verification.`;
             }
             else if (failedVerification) {
-                finalStatus = "failed_verification";
-                finalError = failedVerification.spawnError
-                    ? `Verification command \"${failedVerification.command}\" could not start: ${failedVerification.spawnError}`
-                    : `Verification command \"${failedVerification.command}\" exited with code ${failedVerification.exitCode}.`;
+                state.finalStatus = "failed_verification";
+                state.finalError = failedVerification.spawnError
+                    ? `Verification command "${failedVerification.command}" could not start: ${failedVerification.spawnError}`
+                    : `Verification command "${failedVerification.command}" exited with code ${failedVerification.exitCode}.`;
             }
-            else if (verifyResults.length === verifyCommands.length) {
-                finalStatus = "done_by_agent";
+            else if (state.verifyResults.length === ctx.verifyCommands.length) {
+                state.finalStatus = "done_by_agent";
             }
             else {
-                finalError = "Verification did not complete all configured commands.";
+                state.finalError = "Verification did not complete all configured commands.";
             }
         }
         else {
-            testResult = skippedTest(testCommand, repoPath, "No verification command configured.");
-            finalStatus = "done_by_agent";
+            state.testResult = skippedTest(ctx.testCommand, ctx.repoPath, "No verification command configured.");
+            state.finalStatus = "done_by_agent";
         }
     }
     catch (error) {
-        lastCaughtError = error;
-        finalError = errorMessage(error);
+        state.lastCaughtError = error;
+        state.finalError = errorMessage(error);
     }
-    let cleanupReport = {
-        enabled: true,
-        removed: [],
-        skipped: [],
-        source_files_touched: 0,
-    };
-    if (finalStatus !== "canceled") {
+    return state;
+}
+async function collectArtifacts(ctx, state) {
+    let cleanupReport = { enabled: true, removed: [], skipped: [], source_files_touched: 0 };
+    if (state.finalStatus !== "canceled") {
         try {
-            cleanupReport = runPostTaskCleanup(repoPath, taskDir);
-            updateStatus(taskDir, { cleanup: cleanupReport });
+            cleanupReport = runPostTaskCleanup(ctx.repoPath, ctx.taskDir);
+            updateStatus(ctx.taskDir, { cleanup: cleanupReport });
         }
         catch (error) {
             cleanupReport = {
-                enabled: true,
-                removed: [],
+                enabled: true, removed: [],
                 skipped: [{ path: ".", reason: "post_task_cleanup", skip_reason: errorMessage(error) }],
                 source_files_touched: 0,
             };
-            writeFileSync(join(taskDir, "post-task-cleanup.json"), JSON.stringify(cleanupReport, null, 2), "utf-8");
-            updateStatus(taskDir, { cleanup: cleanupReport });
+            atomicWriteJsonFileSync(join(ctx.taskDir, "post-task-cleanup.json"), cleanupReport);
+            updateStatus(ctx.taskDir, { cleanup: cleanupReport });
         }
     }
-    setTaskPhase(taskDir, "collecting_artifacts", null, "Capturing post-task state and writing reports.");
+    setTaskPhase(ctx.taskDir, "collecting_artifacts", null, "Capturing post-task state and writing reports.");
     const artifactCollectionStartedAt = new Date().toISOString();
     let changes;
     let artifactStatus = "collected";
     let artifactCollectionError = null;
     let timeoutHandle;
+    const artifactController = new AbortController();
     try {
-        // Phase 5: Wrap artifact collection with a timeout
-        const collectionResult = await Promise.race([
-            Promise.resolve().then(() => {
-                const afterSnapshot = captureRepoSnapshot(repoPath);
-                writeSnapshot(taskDir, "git-after.json", afterSnapshot);
-                return buildChangeArtifacts(repoPath, beforeSnapshot, afterSnapshot);
-            }),
-            new Promise((_, reject) => {
-                timeoutHandle = setTimeout(() => reject(new Error("Artifact collection timed out")), ARTIFACT_COLLECTION_TIMEOUT_MS);
-            }),
-        ]);
-        if (timeoutHandle)
-            clearTimeout(timeoutHandle);
-        changes = collectionResult;
+        timeoutHandle = setTimeout(() => {
+            artifactController.abort(new Error("Artifact collection timed out"));
+        }, ARTIFACT_COLLECTION_TIMEOUT_MS);
+        const afterSnapshot = await captureRepoSnapshot(ctx.repoPath, artifactController.signal);
+        writeSnapshot(ctx.taskDir, "git-after.json", afterSnapshot);
+        changes = await buildChangeArtifacts(ctx.repoPath, ctx.beforeSnapshot, afterSnapshot, artifactController.signal);
     }
     catch (error) {
-        if (timeoutHandle)
-            clearTimeout(timeoutHandle);
-        lastCaughtError = error;
+        state.lastCaughtError = error;
         artifactCollectionError = errorMessage(error);
-        if (artifactCollectionError.includes("timed out")) {
-            artifactStatus = "timeout";
-        }
-        else {
-            artifactStatus = "failed";
-        }
+        artifactStatus = artifactCollectionError.includes("timed out") ? "timeout" : "failed";
         changes = {
             changed_files: [],
             diff: `(change capture failed: ${artifactCollectionError})\n`,
@@ -254,17 +275,16 @@ export async function runTask(taskId) {
             additions: 0,
             deletions: 0,
             file_stats: [],
-            workspace_dirty_before: beforeSnapshot.workspace_dirty,
-            workspace_dirty_after: beforeSnapshot.workspace_dirty,
+            workspace_dirty_before: ctx.beforeSnapshot.workspace_dirty,
+            workspace_dirty_after: ctx.beforeSnapshot.workspace_dirty,
             patch_mode: "hash_only",
             unavailable_reason: `Change capture failed: ${artifactCollectionError}`,
             artifact_hygiene: emptyArtifactHygiene(),
         };
-        // Phase 5: Write partial_result.md when artifact collection fails
-        writeFileSync(join(taskDir, "partial_result.md"), [
+        atomicWriteFileSync(join(ctx.taskDir, "partial_result.md"), [
             "# PatchWarden Partial Result",
             "",
-            `Task: ${taskId}`,
+            `Task: ${ctx.taskId}`,
             "",
             "## Artifact Collection Status",
             artifactStatus,
@@ -273,108 +293,121 @@ export async function runTask(taskId) {
             artifactCollectionError,
             "",
             "## Agent Status",
-            agentResult ? `Exit code: ${agentResult.exitCode}` : "Agent did not run",
+            state.agentResult ? `Exit code: ${state.agentResult.exitCode}` : "Agent did not run",
             "",
             "## Verification Status",
-            verifyResults.length > 0 ? verifyResults.map((r) => `- ${r.command}: exit ${r.exitCode}`).join("\n") : "No verification ran",
+            state.verifyResults.length > 0 ? state.verifyResults.map((r) => `- ${r.command}: exit ${r.exitCode}`).join("\n") : "No verification ran",
             "",
             "## Note",
             "Artifact collection did not complete. The task result may be incomplete. Review stdout.log, stderr.log, and verify.json for details.",
             "",
-        ].join("\n"), "utf-8");
-        // Don't override test failure with artifact failure
-        if (finalStatus === "done_by_agent") {
-            finalError = `Change capture failed: ${artifactCollectionError}`;
-            finalStatus = "failed";
+        ].join("\n"));
+        if (state.finalStatus === "done_by_agent") {
+            state.finalError = `Change capture failed: ${artifactCollectionError}`;
+            state.finalStatus = "failed";
         }
         else {
-            finalError ||= `Change capture failed: ${artifactCollectionError}`;
+            state.finalError ||= `Change capture failed: ${artifactCollectionError}`;
         }
     }
+    finally {
+        if (timeoutHandle)
+            clearTimeout(timeoutHandle);
+    }
     const artifactCollectionFinishedAt = new Date().toISOString();
     let outOfScopeChanges = [];
-    let preexistingExternalDirty = externalDirtyBaseline;
+    const preexistingExternalDirty = ctx.externalDirtyBaseline;
     let newOutOfScopeChanges = [];
     try {
-        const afterWorkspaceSnapshot = repoPath === wsRoot ? captureRepoSnapshot(repoPath) : captureRepoSnapshot(wsRoot);
-        writeSnapshot(taskDir, "workspace-after.json", afterWorkspaceSnapshot);
-        const allExternalDirty = extractExternalDirtyFiles(afterWorkspaceSnapshot, repoPath, wsRoot);
-        // Phase 4: Only NEW external dirty files (not in baseline) are scope violations
-        newOutOfScopeChanges = findNewExternalDirtyFiles(externalDirtyBaseline, allExternalDirty);
-        outOfScopeChanges = compareSnapshots(beforeWorkspaceSnapshot, afterWorkspaceSnapshot)
-            .filter((file) => !isPathInside(resolve(wsRoot, file.path), repoPath) ||
-            Boolean(file.old_path && !isPathInside(resolve(wsRoot, file.old_path), repoPath)));
+        const afterWorkspaceSnapshot = ctx.repoPath === ctx.wsRoot ? await captureRepoSnapshot(ctx.repoPath) : await captureRepoSnapshot(ctx.wsRoot);
+        writeSnapshot(ctx.taskDir, "workspace-after.json", afterWorkspaceSnapshot);
+        const allExternalDirty = extractExternalDirtyFiles(afterWorkspaceSnapshot, ctx.repoPath, ctx.wsRoot);
+        newOutOfScopeChanges = findNewExternalDirtyFiles(ctx.externalDirtyBaseline, allExternalDirty);
+        outOfScopeChanges = compareSnapshots(ctx.beforeWorkspaceSnapshot, afterWorkspaceSnapshot)
+            .filter((file) => !isPathInside(resolve(ctx.wsRoot, file.path), ctx.repoPath) ||
+            Boolean(file.old_path && !isPathInside(resolve(ctx.wsRoot, file.old_path), ctx.repoPath)));
     }
     catch (error) {
-        finalError ||= `Workspace scope capture failed: ${errorMessage(error)}`;
-        if (finalStatus === "done_by_agent")
-            finalStatus = "failed";
+        state.finalError ||= `Workspace scope capture failed: ${errorMessage(error)}`;
+        if (state.finalStatus === "done_by_agent")
+            state.finalStatus = "failed";
     }
-    // Phase 4: Pre-existing external dirty files are warnings, not failures
     const preexistingWarnings = preexistingExternalDirty.length > 0
         ? [`Pre-existing external dirty files (not caused by this task): ${preexistingExternalDirty.length} file(s)`]
         : [];
+    applyScopeViolationVerdict(ctx, state, changes, newOutOfScopeChanges, preexistingExternalDirty);
+    atomicWriteFileSync(join(ctx.taskDir, "git.diff"), changes.diff);
+    atomicWriteFileSync(join(ctx.taskDir, "diff.patch"), changes.diff);
+    atomicWriteJsonFileSync(join(ctx.taskDir, "changed-files.json"), { schema_version: ARTIFACT_SCHEMA_VERSION, ...changes });
+    const artifactManifest = await buildArtifactManifest(changes.changed_files, ctx.repoPath, ctx.taskId);
+    atomicWriteJsonFileSync(join(ctx.taskDir, "artifact_manifest.json"), artifactManifest);
+    const changedFileGroups = groupChangedFiles(changes.changed_files);
+    atomicWriteJsonFileSync(join(ctx.taskDir, "file-stats.json"), {
+        task_id: ctx.taskId,
+        additions: changes.additions,
+        deletions: changes.deletions,
+        files: changes.file_stats,
+    });
+    return {
+        changes, artifactStatus, artifactCollectionError, artifactCollectionStartedAt, artifactCollectionFinishedAt,
+        outOfScopeChanges, newOutOfScopeChanges, preexistingExternalDirty, preexistingWarnings, cleanupReport,
+        artifactManifest, changedFileGroups,
+    };
+}
+function applyScopeViolationVerdict(ctx, state, changes, newOutOfScopeChanges, preexistingExternalDirty) {
     if (newOutOfScopeChanges.length > 0) {
-        finalStatus = "failed_scope_violation";
-        finalError = `Detected ${newOutOfScopeChanges.length} new change(s) outside resolved_repo_path during task execution.`;
-        writeFileSync(join(taskDir, "rollback-plan.json"), JSON.stringify({
-            task_id: taskId,
+        state.finalStatus = "failed_scope_violation";
+        state.finalError = `Detected ${newOutOfScopeChanges.length} new change(s) outside resolved_repo_path during task execution.`;
+        atomicWriteJsonFileSync(join(ctx.taskDir, "rollback-plan.json"), {
+            task_id: ctx.taskId,
             status: "review_required",
             automatic_rollback_performed: false,
             warning: "Review ownership and concurrent edits before rollback. PatchWarden did not modify or restore these files.",
             out_of_scope_changes: newOutOfScopeChanges,
             preexisting_external_dirty_files: preexistingExternalDirty,
-        }, null, 2), "utf-8");
-        writeFileSync(join(taskDir, "rollback_scope_violation_plan.md"), [
+        });
+        atomicWriteFileSync(join(ctx.taskDir, "rollback_scope_violation_plan.md"), [
             "# Scope Violation Rollback Plan",
             "",
-            `Task: ${taskId}`,
+            `Task: ${ctx.taskId}`,
             "",
             "PatchWarden did not automatically roll back any file. Review concurrent or user-owned edits before acting.",
             "",
             "## New out-of-scope files (caused by this task)",
             ...newOutOfScopeChanges.map((file) => `- ${file.change}: ${file.path}`),
             "",
-        ].join("\n"), "utf-8");
+        ].join("\n"));
     }
-    else if (changePolicy === "no_changes" && changes.changed_files.length > 0) {
-        finalStatus = "failed_policy_violation";
-        finalError = `Task policy requires no repository changes, but detected ${changes.changed_files.length} change(s).`;
+    else if (changes.diff_redacted) {
+        state.finalStatus = "failed_policy_violation";
+        state.finalError = "Credential-like content was detected in the task diff. PatchWarden redacted the evidence; remove the sensitive content before retrying.";
     }
-    writeFileSync(join(taskDir, "git.diff"), changes.diff, "utf-8");
-    writeFileSync(join(taskDir, "diff.patch"), changes.diff, "utf-8");
-    writeFileSync(join(taskDir, "changed-files.json"), JSON.stringify(changes, null, 2), "utf-8");
-    // Phase 6: Generate artifact_manifest.json and group changed files
-    const artifactManifest = buildArtifactManifest(changes.changed_files, repoPath, taskId);
-    writeFileSync(join(taskDir, "artifact_manifest.json"), JSON.stringify(artifactManifest, null, 2), "utf-8");
-    const changedFileGroups = groupChangedFiles(changes.changed_files);
-    writeFileSync(join(taskDir, "file-stats.json"), JSON.stringify({
-        task_id: taskId,
-        additions: changes.additions,
-        deletions: changes.deletions,
-        files: changes.file_stats,
-    }, null, 2), "utf-8");
-    writeFileSync(join(taskDir, "test.log"), buildTestLog(testResult), "utf-8");
-    const verifyJson = buildVerifyJson(verifyCommands, verifyResults, repoPath);
-    // Phase 4: Use newOutOfScopeChanges (not outOfScopeChanges) for verify_status
-    // to stay consistent with finalStatus. Pre-existing external dirty files
-    // that didn't change during the task should NOT cause verify_status to fail.
+    else if (ctx.changePolicy === "no_changes" && changes.changed_files.length > 0) {
+        state.finalStatus = "failed_policy_violation";
+        state.finalError = `Task policy requires no repository changes, but detected ${changes.changed_files.length} change(s).`;
+    }
+}
+function finalizeTask(ctx, state, evidence) {
+    const { changes, artifactStatus, artifactCollectionError, artifactCollectionStartedAt, artifactCollectionFinishedAt, outOfScopeChanges, newOutOfScopeChanges, preexistingExternalDirty, preexistingWarnings, cleanupReport, artifactManifest, changedFileGroups } = evidence;
+    atomicWriteFileSync(join(ctx.taskDir, "test.log"), buildTestLog(state.testResult));
+    const verifyJson = buildVerifyJson(ctx.verifyCommands, state.verifyResults, ctx.repoPath);
     if (newOutOfScopeChanges.length > 0) {
         verifyJson.status = "failed";
         verifyJson.failure_reason = "scope_violation";
     }
-    else if (finalStatus === "failed_policy_violation") {
+    else if (state.finalStatus === "failed_policy_violation") {
         verifyJson.status = "failed";
-        verifyJson.failure_reason = "change_policy_violation";
+        verifyJson.failure_reason = changes.diff_redacted
+            ? "sensitive_content_violation"
+            : "change_policy_violation";
     }
-    writeFileSync(join(taskDir, "verify.json"), JSON.stringify(verifyJson, null, 2), "utf-8");
-    writeFileSync(join(taskDir, "verify.log"), buildVerifyLog(verifyJson.commands), "utf-8");
-    if (!["canceled", "done_by_agent", "failed_verification", "failed_scope_violation", "failed_policy_violation"].includes(finalStatus))
-        finalStatus = "failed";
-    const finalPhase = finalStatus === "done_by_agent" ? "done_by_agent" : finalStatus;
-    const followup = buildFailureFollowup(finalStatus, finalError, verifyJson.commands);
-    // Phase 7: Run Android build environment diagnostics if android_app exists
-    const androidDiagnostic = diagnoseAndroidBuild(repoPath);
+    atomicWriteJsonFileSync(join(ctx.taskDir, "verify.json"), verifyJson);
+    atomicWriteFileSync(join(ctx.taskDir, "verify.log"), buildVerifyLog(verifyJson.commands));
+    if (!["canceled", "done_by_agent", "failed_verification", "failed_scope_violation", "failed_policy_violation"].includes(state.finalStatus))
+        state.finalStatus = "failed";
+    const finalPhase = state.finalStatus === "done_by_agent" ? "done_by_agent" : state.finalStatus;
+    const followup = buildFailureFollowup(state.finalStatus, state.finalError, verifyJson.commands);
+    const androidDiagnostic = diagnoseAndroidBuild(ctx.repoPath);
     let androidWarning = null;
     if (androidDiagnostic.status !== "skip") {
         if (androidDiagnostic.status === "fail") {
@@ -388,13 +421,13 @@ export async function runTask(taskId) {
         }
     }
     const resultMd = buildResultMarkdown({
-        taskId,
-        planId,
-        agent: agentName,
-        status: finalStatus,
-        error: finalError,
-        agentResult,
-        testResult,
+        taskId: ctx.taskId,
+        planId: ctx.planId,
+        agent: ctx.agentName,
+        status: state.finalStatus,
+        error: state.finalError,
+        agentResult: state.agentResult,
+        testResult: state.testResult,
         verify: verifyJson,
         changes,
         outOfScopeChanges,
@@ -405,18 +438,75 @@ export async function runTask(taskId) {
         androidWarning,
         preexistingWarnings,
     });
-    writeFileSync(join(taskDir, "result.md"), resultMd, "utf-8");
-    writeFileSync(join(taskDir, "result.json"), JSON.stringify({
-        task_id: taskId,
-        status: finalStatus,
-        agent: agentName,
-        workspace_root: wsRoot,
-        repo_path: initialStatus.repo_path,
-        resolved_repo_path: repoPath,
-        plan_source: initialStatus.plan_source || "saved",
-        template: initialStatus.template || null,
-        change_policy: changePolicy,
-        summary: finalError || "Agent execution and configured verification completed successfully.",
+    atomicWriteFileSync(join(ctx.taskDir, "result.md"), resultMd);
+    const resultJson = buildResultJson({
+        ctx, state, evidence, verifyJson, followup, androidDiagnostic, androidWarning,
+    });
+    atomicWriteJsonFileSync(join(ctx.taskDir, "result.json"), resultJson);
+    if (state.finalError) {
+        const structuredError = errorPayload(state.lastCaughtError);
+        atomicWriteJsonFileSync(join(ctx.taskDir, "error.log"), {
+            summary: state.finalError,
+            ...structuredError,
+        });
+    }
+    const finishedAt = new Date().toISOString();
+    updateStatus(ctx.taskDir, {
+        status: state.finalStatus,
+        phase: finalPhase,
+        current_command: null,
+        last_heartbeat_at: finishedAt,
+        finished_at: finishedAt,
+        error: state.finalError,
+        changed_files: changes.changed_files.map(({ path, change }) => ({ path, change })),
+        artifact_hygiene_counts: changes.artifact_hygiene.counts,
+        artifact_status: artifactStatus,
+        artifact_collection_error: artifactCollectionError,
+        artifact_collection_started_at: artifactCollectionStartedAt,
+        artifact_collection_finished_at: artifactCollectionFinishedAt,
+        cleanup: cleanupReport,
+        out_of_scope_changes: outOfScopeChanges,
+        new_out_of_scope_changes: newOutOfScopeChanges,
+        preexisting_external_dirty_files: preexistingExternalDirty,
+        verify_status: verifyJson.status,
+        verify_commands: ctx.verifyCommands,
+        diff_available: changes.diff_available,
+        diff_truncated: changes.diff_truncated,
+        diff_redacted: changes.diff_redacted === true,
+        diff_redaction_categories: changes.diff_redaction_categories ?? [],
+        workspace_dirty_before: changes.workspace_dirty_before,
+        workspace_dirty_after: changes.workspace_dirty_after,
+        workspace_dirty: changes.workspace_dirty_after,
+        acceptance_status: state.finalStatus === "done_by_agent" ? "pending" : null,
+    });
+    writeTaskRuntime(ctx.taskDir, {
+        phase: finalPhase,
+        current_command: null,
+        last_heartbeat_at: finishedAt,
+        runner_pid: process.pid,
+        child_pid: undefined,
+    });
+    writeTaskProgress(ctx.taskDir, finalPhase, {
+        heartbeatAt: finishedAt,
+        note: state.finalError || `Task finished with status ${state.finalStatus}.`,
+    });
+    return { task_id: ctx.taskId, status: state.finalStatus, error: state.finalError };
+}
+function buildResultJson(input) {
+    const { ctx, state, evidence, verifyJson, followup, androidDiagnostic, androidWarning } = input;
+    const { changes, artifactStatus, artifactCollectionError, artifactCollectionStartedAt, artifactCollectionFinishedAt, outOfScopeChanges, newOutOfScopeChanges, preexistingExternalDirty, cleanupReport, artifactManifest, changedFileGroups } = evidence;
+    return {
+        schema_version: ARTIFACT_SCHEMA_VERSION,
+        task_id: ctx.taskId,
+        status: state.finalStatus,
+        agent: ctx.agentName,
+        workspace_root: ctx.wsRoot,
+        repo_path: ctx.initialStatus.repo_path,
+        resolved_repo_path: ctx.repoPath,
+        plan_source: ctx.initialStatus.plan_source || "saved",
+        template: ctx.initialStatus.template || null,
+        change_policy: ctx.changePolicy,
+        summary: state.finalError || "Agent execution and configured verification completed successfully.",
         changed_files: changes.changed_files,
         changed_file_groups: {
             source_changes: changedFileGroups.source_changes.length,
@@ -454,68 +544,24 @@ export async function runTask(taskId) {
             ...(artifactStatus !== "collected" ? ["partial_result.md"] : []),
         ],
         warnings: [
-            ...beforeSnapshot.warnings,
+            ...ctx.beforeSnapshot.warnings,
             ...(changes.diff_truncated ? ["diff.patch was truncated; changed-files.json retains file evidence."] : []),
-            ...preexistingWarnings,
+            ...(changes.diff_redacted ? [
+                `Credential-like diff content was redacted (${(changes.diff_redaction_categories ?? []).join(", ") || "sensitive_content"}).`,
+            ] : []),
+            ...evidence.preexistingWarnings,
             ...(androidWarning ? [androidWarning] : []),
         ],
-        errors: finalError ? [finalError] : [],
-        known_issues: finalError ? [finalError] : [],
+        errors: state.finalError ? [state.finalError] : [],
+        known_issues: state.finalError ? [state.finalError] : [],
         failure_reason: followup.failure_reason,
         failed_command: followup.failed_command,
         suggested_next_action: followup.suggested_next_action,
         safe_followup_prompt: followup.safe_followup_prompt,
-        next_steps: finalStatus === "done_by_agent"
+        next_steps: state.finalStatus === "done_by_agent"
             ? ["Review get_task_summary and audit_task before accepting the work."]
             : ["Resolve the reported failure before accepting the work."],
-    }, null, 2), "utf-8");
-    if (finalError) {
-        // Phase 9: Preserve PatchWardenError structured info in error.log
-        const structuredError = errorPayload(lastCaughtError);
-        writeFileSync(join(taskDir, "error.log"), JSON.stringify({
-            summary: finalError,
-            ...structuredError,
-        }, null, 2), "utf-8");
-    }
-    const finishedAt = new Date().toISOString();
-    updateStatus(taskDir, {
-        status: finalStatus,
-        phase: finalPhase,
-        current_command: null,
-        last_heartbeat_at: finishedAt,
-        finished_at: finishedAt,
-        error: finalError,
-        changed_files: changes.changed_files.map(({ path, change }) => ({ path, change })),
-        artifact_hygiene_counts: changes.artifact_hygiene.counts,
-        artifact_status: artifactStatus,
-        artifact_collection_error: artifactCollectionError,
-        artifact_collection_started_at: artifactCollectionStartedAt,
-        artifact_collection_finished_at: artifactCollectionFinishedAt,
-        cleanup: cleanupReport,
-        out_of_scope_changes: outOfScopeChanges,
-        new_out_of_scope_changes: newOutOfScopeChanges,
-        preexisting_external_dirty_files: preexistingExternalDirty,
-        verify_status: verifyJson.status,
-        verify_commands: verifyCommands,
-        diff_available: changes.diff_available,
-        diff_truncated: changes.diff_truncated,
-        workspace_dirty_before: changes.workspace_dirty_before,
-        workspace_dirty_after: changes.workspace_dirty_after,
-        workspace_dirty: changes.workspace_dirty_after,
-        acceptance_status: finalStatus === "done_by_agent" ? "pending" : null,
-    });
-    writeTaskRuntime(taskDir, {
-        phase: finalPhase,
-        current_command: null,
-        last_heartbeat_at: finishedAt,
-        runner_pid: process.pid,
-        child_pid: undefined,
-    });
-    writeTaskProgress(taskDir, finalPhase, {
-        heartbeatAt: finishedAt,
-        note: finalError || `Task finished with status ${finalStatus}.`,
-    });
-    return { task_id: taskId, status: finalStatus, error: finalError };
+    };
 }
 function buildFailureFollowup(status, error, commands) {
     const failed = commands.find((command) => command.status !== "passed");
@@ -570,13 +616,22 @@ async function runManagedProcess(options) {
     if (Date.now() >= options.deadlineMs) {
         return { exitCode: null, stdout: "", stderr: "", spawnError: null, terminationReason: "timeout" };
     }
+    const exactRedactionValues = allowedEnvironmentValues(options.environmentVariableNames);
+    const logCapture = new SecureProcessLogCapture([options.stdoutPath, options.stderrPath], options.maxLogBytes);
     let child;
     try {
-        child = spawn(options.command, options.args, {
+        const env = buildChildEnvironment({
+            cwd: options.cwd,
+            allowedNames: options.environmentVariableNames,
+            blockedNames: options.blockedEnvironmentVariableNames,
+        });
+        const command = resolveTrustedExecutable(options.command, options.cwd, { pathValue: env.PATH });
+        child = spawn(command, options.args, {
             cwd: options.cwd,
             stdio: ["ignore", "pipe", "pipe"],
             detached: process.platform !== "win32",
             windowsHide: true,
+            env,
         });
     }
     catch (error) {
@@ -588,8 +643,6 @@ async function runManagedProcess(options) {
         child_pid: child.pid,
         child_started_at: new Date().toISOString(),
     });
-    const stdoutStream = openStream(options.stdoutPath);
-    const stderrStream = openStream(options.stderrPath);
     let stdout = "";
     let stderr = "";
     let spawnError = null;
@@ -643,11 +696,11 @@ async function runManagedProcess(options) {
             try {
                 forceKill(child);
             }
-            catch { }
+            catch { } // cleanup failure is safe to ignore
             try {
                 child.kill("SIGKILL");
             }
-            catch { }
+            catch { } // cleanup failure is safe to ignore
             // Resolve the exit promise via the shared finish handle
             if (childExitFinish)
                 childExitFinish(null);
@@ -656,12 +709,12 @@ async function runManagedProcess(options) {
     child.stdout?.on("data", (chunk) => {
         const text = chunk.toString("utf-8");
         stdout = appendBounded(stdout, text);
-        stdoutStream?.write(text);
+        logCapture.append(options.stdoutPath, chunk);
     });
     child.stderr?.on("data", (chunk) => {
         const text = chunk.toString("utf-8");
         stderr = appendBounded(stderr, text);
-        stderrStream?.write(text);
+        logCapture.append(options.stderrPath, chunk);
     });
     heartbeat();
     const heartbeatTimer = setInterval(heartbeat, HEARTBEAT_INTERVAL_MS);
@@ -678,12 +731,6 @@ async function runManagedProcess(options) {
         };
         childExitFinish = finish;
         child.once("close", (code) => finish(code));
-        child.once("exit", (code) => {
-            // On Windows, "close" can lag behind "exit" when stdio pipes drain
-            // after taskkill. Resolve on exit to avoid hanging the runner, but
-            // still let "close" fire if it arrives first.
-            finish(code);
-        });
         child.once("error", (error) => {
             spawnError = error.message;
             finish(null);
@@ -692,8 +739,7 @@ async function runManagedProcess(options) {
     clearInterval(heartbeatTimer);
     if (forceTimer)
         clearTimeout(forceTimer);
-    stdoutStream?.destroy();
-    stderrStream?.destroy();
+    logCapture.flush(exactRedactionValues);
     writeTaskRuntime(options.taskDir, {
         phase: options.phase,
         last_heartbeat_at: new Date().toISOString(),
@@ -701,7 +747,15 @@ async function runManagedProcess(options) {
         runner_pid: process.pid,
         child_pid: undefined,
     });
-    return { exitCode, stdout, stderr, spawnError, terminationReason };
+    const safeStdout = redactProcessOutput(stdout, exactRedactionValues);
+    const safeStderr = redactProcessOutput(stderr, exactRedactionValues);
+    return {
+        exitCode,
+        stdout: safeStdout.length > MAX_CAPTURE_CHARS ? safeStdout.slice(-MAX_CAPTURE_CHARS) : safeStdout,
+        stderr: safeStderr.length > MAX_CAPTURE_CHARS ? safeStderr.slice(-MAX_CAPTURE_CHARS) : safeStderr,
+        spawnError,
+        terminationReason,
+    };
 }
 async function runTrustedTestCommand(testCommand, repoPath, taskDir, statusFile, deadlineMs) {
     const config = getConfig();
@@ -712,9 +766,9 @@ async function runTrustedTestCommand(testCommand, repoPath, taskDir, statusFile,
     let command = parts[0];
     let args = parts.slice(1);
     if (process.platform === "win32" && /^(npm|npm\.cmd|pnpm|pnpm\.cmd)$/i.test(command)) {
-        const shim = /^pnpm/i.test(command) ? "pnpm.cmd" : "npm.cmd";
-        command = process.env.ComSpec || "cmd.exe";
-        args = ["/d", "/s", "/c", shim, ...args];
+        const packageManager = resolvePackageManagerInvocation(command, repoPath);
+        command = packageManager.command;
+        args = [...packageManager.argsPrefix, ...args];
     }
     const result = await runManagedProcess({
         command,
@@ -939,10 +993,10 @@ function normalizeTimeout(value, config) {
 function failBeforeExecution(taskId, taskDir, message, caughtError) {
     // Phase 9: Preserve PatchWardenError structured info in error.log
     const structuredError = caughtError ? errorPayload(caughtError) : { error: message };
-    writeFileSync(join(taskDir, "error.log"), JSON.stringify({
+    atomicWriteJsonFileSync(join(taskDir, "error.log"), {
         summary: message,
         ...structuredError,
-    }, null, 2), "utf-8");
+    });
     const current = readStatus(join(taskDir, "status.json"));
     const now = new Date().toISOString();
     const verify = {
@@ -950,17 +1004,17 @@ function failBeforeExecution(taskId, taskDir, message, caughtError) {
         requested_commands: Array.isArray(current.verify_commands) ? current.verify_commands : [],
         commands: [],
     };
-    writeFileSync(join(taskDir, "verify.json"), JSON.stringify(verify, null, 2), "utf-8");
-    writeFileSync(join(taskDir, "verify.log"), `Verification did not run: ${message}\n`, "utf-8");
-    writeFileSync(join(taskDir, "test.log"), `(not run)\nExit code: not run\n${message}\n`, "utf-8");
-    writeFileSync(join(taskDir, "git.diff"), "(task failed before change capture)\n", "utf-8");
-    writeFileSync(join(taskDir, "diff.patch"), "(task failed before change capture)\n", "utf-8");
-    writeFileSync(join(taskDir, "file-stats.json"), JSON.stringify({
+    atomicWriteJsonFileSync(join(taskDir, "verify.json"), verify);
+    atomicWriteFileSync(join(taskDir, "verify.log"), `Verification did not run: ${message}\n`);
+    atomicWriteFileSync(join(taskDir, "test.log"), `(not run)\nExit code: not run\n${message}\n`);
+    atomicWriteFileSync(join(taskDir, "git.diff"), "(task failed before change capture)\n");
+    atomicWriteFileSync(join(taskDir, "diff.patch"), "(task failed before change capture)\n");
+    atomicWriteJsonFileSync(join(taskDir, "file-stats.json"), {
         task_id: taskId,
         additions: 0,
         deletions: 0,
         files: [],
-    }, null, 2), "utf-8");
+    });
     const result = {
         task_id: taskId,
         status: "failed",
@@ -986,8 +1040,8 @@ function failBeforeExecution(taskId, taskDir, message, caughtError) {
         safe_followup_prompt: "Inspect result.json and error.log, correct the task metadata or configuration, and retry without widening repository scope.",
         next_steps: ["Fix task metadata or configuration and retry the task."],
     };
-    writeFileSync(join(taskDir, "result.json"), JSON.stringify(result, null, 2), "utf-8");
-    writeFileSync(join(taskDir, "result.md"), `# PatchWarden Task Result\n\n## Status\nfailed\n\n## Summary\n${message}\n`, "utf-8");
+    atomicWriteJsonFileSync(join(taskDir, "result.json"), result);
+    atomicWriteFileSync(join(taskDir, "result.md"), `# PatchWarden Task Result\n\n## Status\nfailed\n\n## Summary\n${message}\n`);
     updateStatus(taskDir, {
         status: "failed",
         phase: "failed",
@@ -1013,12 +1067,10 @@ function setTaskPhase(taskDir, phase, currentCommand, note) {
 }
 function updateStatus(taskDir, patch) {
     const statusFile = join(taskDir, "status.json");
-    const current = readStatus(statusFile);
-    const next = { ...current, ...patch, updated_at: new Date().toISOString() };
-    writeFileSync(statusFile, JSON.stringify(next, null, 2), "utf-8");
+    updateTaskStatusFile(statusFile, patch);
 }
 function readStatus(statusFile) {
-    return JSON.parse(readFileSync(statusFile, "utf-8"));
+    return readTaskStatusFile(statusFile);
 }
 function gracefulKill(child) {
     try {
@@ -1027,17 +1079,20 @@ function gracefulKill(child) {
         else
             child.kill("SIGTERM");
     }
-    catch { }
+    catch { } // cleanup failure is safe to ignore
 }
 function forceKill(child) {
     if (!child.pid)
         return;
     try {
         if (process.platform === "win32") {
-            const result = spawnSync("taskkill.exe", ["/PID", String(child.pid), "/T", "/F"], {
+            const systemRoot = process.env.SystemRoot || process.env.WINDIR || "C:\\Windows";
+            const taskkill = resolveTrustedExecutable(`${systemRoot}\\System32\\taskkill.exe`, process.cwd());
+            const result = spawnSync(taskkill, ["/PID", String(child.pid), "/T", "/F"], {
                 stdio: "ignore",
                 timeout: 5000,
                 windowsHide: true,
+                env: buildChildEnvironment({ cwd: process.cwd() }),
             });
             if (result.status !== 0)
                 child.kill("SIGKILL");
@@ -1050,12 +1105,9 @@ function forceKill(child) {
         try {
             child.kill("SIGKILL");
         }
-        catch { }
+        catch { } // cleanup failure is safe to ignore
     }
 }
-function openStream(path) {
-    return path ? createWriteStream(path, { flags: "a" }) : null;
-}
 function appendBounded(current, next) {
     const combined = current + next;
     return combined.length <= MAX_CAPTURE_CHARS