patchwarden 1.5.0 → 1.6.1

package/dist/tools/{auditSession.d.ts → diagnostics/auditSession.d.ts}

@@ -1,4 +1,4 @@
-import { type DirectSessionAuditOutput } from "../direct/directAudit.js";
+import { type DirectSessionAuditOutput } from "../../direct/directAudit.js";
 export interface AuditSessionInput {
     session_id: string;
 }

package/dist/tools/{auditSession.js → diagnostics/auditSession.js}

@@ -1,5 +1,5 @@
-import { auditDirectSession, } from "../direct/directAudit.js";
-import { updateDirectSession } from "../direct/directSessionStore.js";
+import { auditDirectSession, } from "../../direct/directAudit.js";
+import { updateDirectSession } from "../../direct/directSessionStore.js";
 // ── Main function ──────────────────────────────────────────────────
 export function auditSession(input) {
     const { session_id } = input;

package/dist/tools/{auditTask.d.ts → diagnostics/auditTask.d.ts}

@@ -32,97 +32,42 @@ export interface AuditTaskOutput {
     manual_verification_items: string[];
     recommended_next_actions: string[];
 }
+import type { ChangedFile } from "../../runner/changeCapture.js";
 /**
  * Check 1: forbidden_scope_violation (fail level).
  * Returns null when no forbidden patterns are configured (skip).
  * Returns pass when changed files do not match any forbidden pattern.
  * Returns fail when any changed file path (or old_path) matches a forbidden glob.
  */
-export declare function checkForbiddenScope(changedFiles: any, forbidden: any): {
-    name: string;
-    result: string;
-    detail: string;
-} | null;
+export declare function checkForbiddenScope(changedFiles: ChangedFile[], forbidden: string[] | null): AuditCheck | null;
 /**
  * Check 2: done_evidence_missing (warn level).
  * Returns null when no done_evidence list is configured (skip).
  * Returns pass when all listed files exist in the task directory.
  * Returns warn when any listed file is missing.
  */
-export declare function checkDoneEvidenceMissing(taskDir: any, doneEvidence: any): {
-    name: string;
-    result: string;
-    detail: string;
-} | null;
+export declare function checkDoneEvidenceMissing(taskDir: string, doneEvidence: string[] | null): AuditCheck | null;
 /**
  * Check 3: readme_changelog_sync (warn level).
  * Returns null when no code files (by extension) were changed (skip).
  * Returns pass when README.md or CHANGELOG.md (basename, case-insensitive) is also changed.
  * Returns warn when code changed but neither documentation file was updated.
  */
-export declare function checkReadmeChangelogSync(changedFiles: any): {
-    name: string;
-    result: string;
-    detail: string;
-} | null;
+export declare function checkReadmeChangelogSync(changedFiles: ChangedFile[]): AuditCheck | null;
 /**
  * Check 4: package_manifest_consistency (warn level).
  * Returns null when package.json is not among changed files (skip).
  * Returns pass when package.json parses as JSON and has non-empty name and version strings.
  * Returns warn otherwise.
  */
-export declare function checkPackageManifestConsistency(changedFiles: any, repoPathSafe: any): {
-    name: string;
-    result: string;
-    detail: string;
-} | null;
+export declare function checkPackageManifestConsistency(changedFiles: ChangedFile[], repoPathSafe: string): AuditCheck | null;
 /**
  * Check 5: sensitive_path_access (fail level).
  * Returns null when there are no changed files (skip).
  * Returns pass when no changed file path (or old_path) is sensitive.
  * Returns fail when any changed file path is flagged by isSensitivePath.
  */
-export declare function checkSensitivePathAccess(changedFiles: any): {
-    name: string;
-    result: string;
-    detail: string;
-} | null;
-export declare function checkUnrecordedCommandExecution(testLogContent: string | null, resultMdContent: string | null, verifyCommands: string[], testCommand: string | null, repoPath?: string | null): {
-    name: string;
-    result: string;
-    detail: string;
-} | null;
-export declare function auditTask(taskId: any): {
-    task_id: any;
-    verdict: string;
-    acceptance: {
-        verdict: import("../goal/acceptanceEngine.js").AcceptanceVerdict;
-        status: string;
-        reason: string;
-        reasons: string[];
-        required_evidence: string[];
-        next_suggested_task: string;
-        fail_checks: import("../goal/acceptanceEngine.js").AcceptanceCheck[];
-        warn_checks: import("../goal/acceptanceEngine.js").AcceptanceCheck[];
-    };
-    summary: string;
-    checks: {
-        name: string;
-        result: string;
-        detail: string;
-    }[];
-    risks: {
-        severity: string;
-        description: string;
-    }[];
-    confirmed_failures: {
-        name: string;
-        result: string;
-        detail: string;
-    }[];
-    possible_false_positives: any[];
-    manual_verification_required: boolean;
-    manual_verification_items: any[];
-    recommended_next_actions: string[];
-};
+export declare function checkSensitivePathAccess(changedFiles: ChangedFile[]): AuditCheck | null;
+export declare function checkUnrecordedCommandExecution(testLogContent: string | null, resultMdContent: string | null, verifyCommands: string[], testCommand: string | null, repoPath?: string | null): AuditCheck | null;
+export declare function auditTask(taskId: string): AuditTaskOutput;
 export {};

package/dist/tools/{auditTask.js → diagnostics/auditTask.js}

@@ -1,11 +1,13 @@
-// @ts-nocheck
-import { readFileSync, existsSync, writeFileSync, readdirSync, statSync } from "node:fs";
+import { readFileSync, existsSync, opendirSync, statSync } from "node:fs";
 import { join, resolve, relative, basename, sep, isAbsolute } from "node:path";
-import { getTasksDir, getConfig } from "../config.js";
-import { guardReadPath, guardWorkspacePath } from "../security/pathGuard.js";
-import { guardSensitivePath, isSensitivePath } from "../security/sensitiveGuard.js";
-import { evaluateAcceptance } from "../goal/acceptanceEngine.js";
-import { renderAcceptanceMarkdown } from "../goal/acceptanceTemplate.js";
+import { getTasksDir, getConfig } from "../../config.js";
+import { guardReadPath, guardWorkspacePath } from "../../security/pathGuard.js";
+import { guardSensitivePath, isSensitivePath } from "../../security/sensitiveGuard.js";
+import { evaluateAcceptance } from "../../goal/acceptanceEngine.js";
+import { renderAcceptanceMarkdown } from "../../goal/acceptanceTemplate.js";
+import { atomicWriteFileSync } from "../../utils/atomicFile.js";
+import { mutateTaskStatus } from "../../runner/taskStatusStore.js";
+import { readTextFilePrefixSync, readTextFileTailLinesSync, } from "../../utils/boundedFile.js";
 // Release claim patterns — anything that claims remote publish/release/deploy
 const RELEASE_PATTERNS = [
     /npm\s+package\s+version\s+published/i,
@@ -17,6 +19,10 @@ const RELEASE_PATTERNS = [
     /npm\s+publish\s+completed/i,
     /deploy(ed|ment)?\s+(to|on)\s+(npm|registry|github)/i,
 ];
+const MAX_AUDIT_DOC_FILES = 200;
+const MAX_AUDIT_DOC_FILE_BYTES = 512 * 1024;
+const MAX_AUDIT_DOC_TOTAL_BYTES = 4 * 1024 * 1024;
+const MAX_AUDIT_EVIDENCE_BYTES = 1024 * 1024;
 function scanForReleaseClaims(text) {
     const found = [];
     for (const pattern of RELEASE_PATTERNS) {
@@ -26,24 +32,57 @@ function scanForReleaseClaims(text) {
     }
     return found;
 }
-function findMdFiles(dir, maxDepth = 3) {
+function findMdFiles(dir, maxDepth = 3, maxFiles = MAX_AUDIT_DOC_FILES) {
     const results = [];
-    if (!existsSync(dir) || maxDepth <= 0)
-        return results;
-    try {
-        const entries = readdirSync(dir, { withFileTypes: true });
-        for (const e of entries) {
-            const full = join(dir, e.name);
-            if (e.isDirectory() && !e.name.startsWith(".") && e.name !== "node_modules") {
-                results.push(...findMdFiles(full, maxDepth - 1));
+    const pending = [{ path: dir, depth: maxDepth }];
+    const maxDirectories = maxFiles * 4;
+    let visitedDirectories = 0;
+    let truncated = false;
+    while (pending.length > 0 && results.length < maxFiles && visitedDirectories < maxDirectories) {
+        const current = pending.pop();
+        if (!existsSync(current.path) || current.depth <= 0)
+            continue;
+        visitedDirectories += 1;
+        let handle;
+        try {
+            handle = opendirSync(current.path);
+            while (results.length < maxFiles) {
+                const entry = handle.readSync();
+                if (!entry)
+                    break;
+                const full = join(current.path, entry.name);
+                if (entry.isDirectory() && !entry.name.startsWith(".") && entry.name !== "node_modules") {
+                    if (pending.length < maxDirectories)
+                        pending.push({ path: full, depth: current.depth - 1 });
+                    else
+                        truncated = true;
+                }
+                else if (entry.isFile() && entry.name.toLowerCase().endsWith(".md")) {
+                    results.push(full);
+                }
             }
-            else if (e.isFile() && e.name.endsWith(".md")) {
-                results.push(full);
+        }
+        catch { /* skip unreadable dirs */ }
+        finally {
+            try {
+                handle?.closeSync();
             }
+            catch { /* best effort */ }
         }
     }
-    catch { /* skip unreadable dirs */ }
-    return results;
+    truncated ||= pending.length > 0 || results.length >= maxFiles || visitedDirectories >= maxDirectories;
+    return { files: results, truncated };
+}
+function readAuditEvidence(path) {
+    const half = Math.floor(MAX_AUDIT_EVIDENCE_BYTES / 2);
+    const prefix = readTextFilePrefixSync(path, half);
+    if (!prefix.truncated)
+        return { content: prefix.content, truncated: false };
+    const tail = readTextFileTailLinesSync(path, 1000, half);
+    return {
+        content: `${prefix.content}\n[...audit evidence truncated...]\n${tail}`,
+        truncated: true,
+    };
 }
 // ── v0.7.2: New audit checks (exported for testing) ────────────────
 /**
@@ -288,9 +327,10 @@ function readPackageScripts(repoPath) {
     try {
         guardSensitivePath(pkgJsonPath);
         const parsed = JSON.parse(readFileSync(pkgJsonPath, "utf-8"));
-        if (!parsed.scripts || typeof parsed.scripts !== "object" || Array.isArray(parsed.scripts))
+        const scripts = parsed.scripts;
+        if (!scripts || typeof scripts !== "object" || Array.isArray(scripts))
             return {};
-        return Object.fromEntries(Object.entries(parsed.scripts).filter(([, value]) => typeof value === "string"));
+        return Object.fromEntries(Object.entries(scripts).filter(([, value]) => typeof value === "string"));
     }
     catch {
         return {};
@@ -370,8 +410,8 @@ function findHighRiskCommandEvidence(text) {
     return [...new Set(found)];
 }
 export function checkUnrecordedCommandExecution(testLogContent, resultMdContent, verifyCommands, testCommand, repoPath = null) {
-    const hasLog = testLogContent && testLogContent.length > 0;
-    const hasResult = resultMdContent && resultMdContent.length > 0;
+    const hasLog = !!testLogContent && testLogContent.length > 0;
+    const hasResult = !!resultMdContent && resultMdContent.length > 0;
     if (!hasLog && !hasResult)
         return null;
     const combined = `${testLogContent || ""}\n${resultMdContent || ""}`;
@@ -381,9 +421,9 @@ export function checkUnrecordedCommandExecution(testLogContent, resultMdContent,
     }
     const whitelist = buildCommandWhitelist(verifyCommands, testCommand, repoPath);
     const discovered = [];
-    if (hasLog)
+    if (hasLog && testLogContent)
         discovered.push(...extractCommands(testLogContent));
-    if (hasResult)
+    if (hasResult && resultMdContent)
         discovered.push(...extractCommands(resultMdContent));
     const unrecorded = new Set();
     for (const cmd of discovered) {
@@ -606,20 +646,32 @@ export function auditTask(taskId) {
     if (existsSync(readmePath))
         docsToScan.push(readmePath);
     const docsDir = join(repoPathSafe, "docs");
+    let markdownEnumerationTruncated = false;
     if (existsSync(docsDir)) {
-        docsToScan.push(...findMdFiles(docsDir));
+        const markdown = findMdFiles(docsDir);
+        docsToScan.push(...markdown.files);
+        markdownEnumerationTruncated = markdown.truncated;
     }
     // Collect all npm run references from all docs
     const allNpmRunRefs = new Set();
     const allReleaseClaims = [];
+    let remainingDocBytes = MAX_AUDIT_DOC_TOTAL_BYTES;
+    let documentScanTruncated = markdownEnumerationTruncated || docsToScan.length > MAX_AUDIT_DOC_FILES;
     for (const docPath of docsToScan) {
+        if (remainingDocBytes <= 0) {
+            documentScanTruncated = true;
+            break;
+        }
         let content;
         try {
             if (docPath !== resultFile) {
                 guardReadPath(docPath, config.workspaceRoot);
                 guardSensitivePath(docPath);
             }
-            content = readFileSync(docPath, "utf-8");
+            const bounded = readTextFilePrefixSync(docPath, Math.min(MAX_AUDIT_DOC_FILE_BYTES, remainingDocBytes));
+            content = bounded.content;
+            remainingDocBytes -= Buffer.byteLength(content, "utf-8");
+            documentScanTruncated ||= bounded.truncated;
         }
         catch {
             continue;
@@ -636,6 +688,14 @@ export function auditTask(taskId) {
         for (const c of claims)
             allReleaseClaims.push(`[${relative(repoPathSafe, docPath) || docPath}] ${c}`);
     }
+    if (documentScanTruncated) {
+        checks.push({
+            name: "documentation_scan_bounded",
+            result: "warn",
+            detail: `Documentation scan reached its ${MAX_AUDIT_DOC_FILES}-file or ${MAX_AUDIT_DOC_TOTAL_BYTES}-byte safety budget.`,
+        });
+        addManualVerification("Review documentation omitted by the bounded audit scan.");
+    }
     // Cross-check npm run refs against package.json scripts
     for (const scriptName of allNpmRunRefs) {
         if (pkgScripts.length > 0 && !pkgScripts.includes(scriptName)) {
@@ -682,7 +742,10 @@ export function auditTask(taskId) {
     if (hasTestLog) {
         let logContent;
         try {
-            logContent = readFileSync(testLogFile, "utf-8");
+            const evidence = readAuditEvidence(testLogFile);
+            logContent = evidence.content;
+            if (evidence.truncated)
+                addManualVerification("test.log exceeded the audit read budget; inspect the complete local artifact.");
         }
         catch {
             logContent = "";
@@ -720,7 +783,10 @@ export function auditTask(taskId) {
     let resultMdContent = null;
     if (hasResult) {
         try {
-            resultMdContent = readFileSync(resultFile, "utf-8");
+            const evidence = readAuditEvidence(resultFile);
+            resultMdContent = evidence.content;
+            if (evidence.truncated)
+                addManualVerification("result.md exceeded the audit read budget; inspect the complete local artifact.");
         }
         catch {
             resultMdContent = null;
@@ -788,7 +854,7 @@ export function auditTask(taskId) {
         "## Recommended Actions",
         ...actions.map((a) => `- ${a}`),
     ].join("\n");
-    writeFileSync(join(taskDir, "independent-review.md"), reviewMd, "utf-8");
+    atomicWriteFileSync(join(taskDir, "independent-review.md"), reviewMd);
     // ── v0.7.2: 集成 acceptanceEngine ──
     const releaseClaimsUnverified = allReleaseClaims.length > 0;
     const acceptanceEvidence = {
@@ -804,7 +870,11 @@ export function auditTask(taskId) {
                 return null;
             try {
                 const v = JSON.parse(readFileSync(verifyJsonFile, "utf-8"));
-                return v.status === "passed" ? "passed" : v.status === "failed" ? "failed" : "skipped";
+                if (v.status === "passed")
+                    return "passed";
+                if (v.status === "failed")
+                    return "failed";
+                return "skipped";
             }
             catch {
                 return null;
@@ -823,16 +893,20 @@ export function auditTask(taskId) {
     const acceptanceResult = evaluateAcceptance(acceptanceEvidence);
     // 回写 status.json 的 acceptance_status（仅对 done_by_agent 有意义）
     if (taskStatus === "done_by_agent") {
-        const updatedStatus = {
-            ...statusData,
+        const statusPatch = {
             acceptance_status: acceptanceResult.acceptance_status,
-            updated_at: new Date().toISOString(),
         };
-        writeFileSync(statusFile, JSON.stringify(updatedStatus, null, 2), "utf-8");
+        mutateTaskStatus(statusFile, (current) => {
+            if (current.status !== "done_by_agent") {
+                return { result: current };
+            }
+            const next = { ...current, ...statusPatch, updated_at: new Date().toISOString() };
+            return { next, result: next };
+        });
     }
     // 导出 ACCEPTANCE.md
     const acceptanceMd = renderAcceptanceMarkdown(taskId, acceptanceResult, acceptanceEvidence);
-    writeFileSync(join(taskDir, "ACCEPTANCE.md"), acceptanceMd, "utf-8");
+    atomicWriteFileSync(join(taskDir, "ACCEPTANCE.md"), acceptanceMd);
     return {
         task_id: taskId,
         verdict,

package/dist/tools/{healthCheck.d.ts → diagnostics/healthCheck.d.ts}

@@ -1,4 +1,4 @@
-import type { ToolCatalogSnapshot } from "./toolCatalog.js";
+import type { ToolCatalogSnapshot } from "../catalog/toolCatalog.js";
 export interface HealthCheckInput {
     detail?: "standard" | "self_diagnostic";
 }
@@ -14,9 +14,9 @@ export declare function healthCheck(catalog?: ToolCatalogSnapshot, input?: Healt
         recent_tasks_returned: number;
         recent_failures: {
             task_id: string;
-            status: import("./createTask.js").TaskStatus;
-            phase: import("./createTask.js").TaskPhase;
-            pending_reason: import("../watcherStatus.js").PendingReason;
+            status: import("../tasks/createTask.js").TaskStatus;
+            phase: import("../tasks/createTask.js").TaskPhase;
+            pending_reason: import("../../watcherStatus.js").PendingReason;
             error: string | null;
         }[];
     } | undefined;
@@ -37,7 +37,7 @@ export declare function healthCheck(catalog?: ToolCatalogSnapshot, input?: Healt
     };
     watcher: {
         supervisor: Record<string, unknown>;
-        status: import("../watcherStatus.js").WatcherState;
+        status: import("../../watcherStatus.js").WatcherState;
         available: boolean;
         stale_after_seconds: number;
         last_heartbeat_at: string | null;
@@ -65,7 +65,7 @@ export declare function healthCheck(catalog?: ToolCatalogSnapshot, input?: Healt
     tunnel: Record<string, unknown> & {
         last_error: string | null;
     };
-    agents: import("./listAgents.js").AgentAvailability[];
+    agents: import("../workspace/listAgents.js").AgentAvailability[];
     agent_status: {
         [k: string]: string;
     };

package/dist/tools/{healthCheck.js → diagnostics/healthCheck.js}

@@ -1,13 +1,13 @@
 import { accessSync, constants, existsSync, readFileSync } from "node:fs";
 import { homedir } from "node:os";
 import { dirname, join } from "node:path";
-import { getConfig, getTasksDir, getDirectSessionsDir, resolveWorkspaceRoot } from "../config.js";
-import { listAgents } from "./listAgents.js";
-import { redactSensitiveContent, redactSensitiveValue } from "../security/contentRedaction.js";
-import { PATCHWARDEN_VERSION, TOOL_SCHEMA_EPOCH } from "../version.js";
-import { CHATGPT_CORE_TOOL_NAMES, CHATGPT_DIRECT_TOOL_NAMES, CHATGPT_SEARCH_TOOL_NAMES, resolveToolProfile } from "./toolCatalog.js";
-import { readWatcherStatus } from "../watcherStatus.js";
-import { listTasks } from "./listTasks.js";
+import { getConfig, getTasksDir, getDirectSessionsDir, resolveWorkspaceRoot } from "../../config.js";
+import { listAgents } from "../workspace/listAgents.js";
+import { redactSensitiveContent, redactSensitiveValue } from "../../security/contentRedaction.js";
+import { PATCHWARDEN_VERSION, TOOL_SCHEMA_EPOCH } from "../../version.js";
+import { CHATGPT_CORE_TOOL_NAMES, CHATGPT_DIRECT_TOOL_NAMES, CHATGPT_SEARCH_TOOL_NAMES, resolveToolProfile } from "../catalog/toolCatalog.js";
+import { readWatcherStatus } from "../../watcherStatus.js";
+import { listTasks } from "../tasks/listTasks.js";
 const SERVER_STARTED_AT = Date.now();
 export function healthCheck(catalog, input = {}) {
     const config = getConfig();
@@ -185,7 +185,7 @@ function directoryStatus(path, allowCreatable, createRoot) {
                 accessSync(parent, constants.R_OK | constants.W_OK);
                 return { available: true, path, readable: false, writable: true, reason: "Directory will be created on first use." };
             }
-            catch { }
+            catch { } // probe failure handled by return value
         }
         return { available: false, path, readable: false, writable: false, reason: "Directory does not exist." };
     }
@@ -195,12 +195,12 @@ function directoryStatus(path, allowCreatable, createRoot) {
         accessSync(path, constants.R_OK);
         readable = true;
     }
-    catch { }
+    catch { } // probe failure handled by return value
     try {
         accessSync(path, constants.W_OK);
         writable = true;
     }
-    catch { }
+    catch { } // probe failure handled by return value
     return {
         available: readable && writable,
         path,

package/dist/tools/diagnostics/index.d.ts

@@ -0,0 +1,6 @@
+export * from "./auditSession.js";
+export * from "./auditTask.js";
+export * from "./healthCheck.js";
+export * from "./safeStatus.js";
+export * from "./safeViews.js";
+export * from "./schemaDriftCheck.js";

package/dist/tools/diagnostics/index.js

@@ -0,0 +1,6 @@
+export * from "./auditSession.js";
+export * from "./auditTask.js";
+export * from "./healthCheck.js";
+export * from "./safeStatus.js";
+export * from "./safeViews.js";
+export * from "./schemaDriftCheck.js";

package/dist/tools/{safeStatus.d.ts → diagnostics/safeStatus.d.ts}

@@ -1,6 +1,6 @@
-import { type PatchWardenConfig } from "../config.js";
-import type { TaskStatus, TaskPhase, AcceptanceStatus } from "./createTask.js";
-import { type DiagnosisType, type DiagnosisConfidence } from "./diagnoseTask.js";
+import { type PatchWardenConfig } from "../../config.js";
+import type { TaskStatus, TaskPhase, AcceptanceStatus } from "../tasks/createTask.js";
+import { type DiagnosisType, type DiagnosisConfidence } from "../tasks/diagnoseTask.js";
 export interface SafeStatusOutput {
     task_id: string;
     status: TaskStatus | "not_found";

package/dist/tools/{safeStatus.js → diagnostics/safeStatus.js}

@@ -1,11 +1,11 @@
 import { readFileSync, existsSync } from "node:fs";
 import { resolve, join } from "node:path";
-import { getTasksDir, getConfig } from "../config.js";
-import { guardReadPath } from "../security/pathGuard.js";
-import { guardSensitivePath } from "../security/sensitiveGuard.js";
-import { readTaskRuntime } from "../taskRuntime.js";
-import { readWatcherStatus } from "../watcherStatus.js";
-import { diagnoseTask } from "./diagnoseTask.js";
+import { getTasksDir, getConfig } from "../../config.js";
+import { guardReadPath } from "../../security/pathGuard.js";
+import { guardSensitivePath } from "../../security/sensitiveGuard.js";
+import { readTaskRuntime } from "../../runner/taskRuntime.js";
+import { readWatcherStatus } from "../../watcherStatus.js";
+import { diagnoseTask } from "../tasks/diagnoseTask.js";
 export function safeStatus(taskId, config) {
     const cfg = config || getConfig();
     const tasksDir = getTasksDir(cfg);

package/dist/tools/{safeViews.d.ts → diagnostics/safeViews.d.ts}

@@ -2,6 +2,7 @@ export interface SafeViewOptions {
     max_items?: number;
 }
 export declare function safeResult(taskId: string, options?: SafeViewOptions): {
+    schema_version: string;
     task_id: string;
     status: string;
     terminal: boolean;
@@ -32,6 +33,7 @@ export declare function safeResult(taskId: string, options?: SafeViewOptions): {
     redaction_categories: string[];
 };
 export declare function safeTestSummary(taskId: string): {
+    schema_version: string;
     task_id: string;
     status: string;
     command_count: number;
@@ -41,19 +43,20 @@ export declare function safeTestSummary(taskId: string): {
     commands: {
         command: string;
         status: string;
-        exit_code: any;
+        exit_code: {} | null;
         duration_ms: number;
     }[];
     headline: string;
 };
 export declare function safeDiffSummary(taskId: string, options?: SafeViewOptions): {
+    schema_version: string;
     task_id: string;
     changed_files_total: number;
     additions: number;
     deletions: number;
     diff_available: boolean;
     diff_truncated: boolean;
-    patch_mode: any;
+    patch_mode: {} | null;
     files: {
         path: string;
         old_path: string | null;
@@ -62,13 +65,14 @@ export declare function safeDiffSummary(taskId: string, options?: SafeViewOption
         tracked: boolean;
         ignored: boolean;
     }[];
-    artifact_hygiene_counts: Record<string, any>;
+    artifact_hygiene_counts: Record<string, unknown>;
     large_diff_omitted: boolean;
     truncated: boolean;
 };
 export declare function safeAudit(taskId: string, options?: SafeViewOptions): {
+    schema_version: string;
     task_id: string;
-    verdict: "pass" | "warn" | "fail";
+    verdict: "warn" | "pass" | "fail";
     acceptance: {
         verdict: string;
         status: string;
@@ -84,17 +88,17 @@ export declare function safeAudit(taskId: string, options?: SafeViewOptions): {
     };
     checks: {
         name: string;
-        result: "pass" | "warn" | "fail";
+        result: "warn" | "pass" | "fail";
         detail: string;
     }[];
     fail_checks: {
         name: string;
-        result: "pass" | "warn" | "fail";
+        result: "warn" | "pass" | "fail";
         detail: string;
     }[];
     warn_checks: {
         name: string;
-        result: "pass" | "warn" | "fail";
+        result: "warn" | "pass" | "fail";
         detail: string;
     }[];
     possible_false_positives: {
@@ -170,7 +174,7 @@ export declare function safeDirectSummary(sessionId: string, options?: SafeViewO
     large_diff_omitted: boolean;
     truncated: boolean;
 };
-export declare function safeFinalizeDirectSession(sessionId: string, options?: SafeViewOptions): {
+export declare function safeFinalizeDirectSession(sessionId: string, options?: SafeViewOptions): Promise<{
     finalized: boolean;
     next_action: string;
     view: "summary" | "finalize";
@@ -235,10 +239,10 @@ export declare function safeFinalizeDirectSession(sessionId: string, options?: S
     }[];
     large_diff_omitted: boolean;
     truncated: boolean;
-};
+}>;
 export declare function safeAuditDirectSession(sessionId: string, options?: SafeViewOptions): {
     session_id: string;
-    decision: "pass" | "warn" | "fail";
+    decision: "warn" | "pass" | "fail";
     reason_codes: string[];
     blocking_findings: string[];
     warnings: string[];