patchwarden 1.5.0 → 1.6.1

package/dist/tools/tasks/evidencePack.js

@@ -0,0 +1,387 @@
+import { execFileSync } from "node:child_process";
+import { existsSync, mkdirSync, readdirSync, readFileSync } from "node:fs";
+import { join, resolve } from "node:path";
+import { getConfig } from "../../config.js";
+import { guardReadPath, guardWorkspacePath } from "../../security/pathGuard.js";
+import { countRedactionsByCategory, redactSensitiveValue } from "../../security/contentRedaction.js";
+import { getProjectPolicySummary } from "../../policy/projectPolicy.js";
+import { getTaskLineage } from "./taskLineage.js";
+import { getLastToolCatalogSnapshot } from "../catalog/toolCatalog.js";
+import { PATCHWARDEN_VERSION, TOOL_SCHEMA_EPOCH } from "../../version.js";
+import { PatchWardenError } from "../../errors.js";
+import { buildGitEnvironment, resolveTrustedExecutable } from "../../runner/processSecurity.js";
+import { atomicWriteFileSync, atomicWriteJsonFileSync } from "../../utils/atomicFile.js";
+export function exportTaskEvidencePack(input) {
+    const lineageId = normalizeLineageId(input.lineage_id);
+    const maxItems = normalizeMaxItems(input.max_items);
+    const config = getConfig();
+    const lineage = getTaskLineage(lineageId, { max_items: maxItems });
+    const packDir = resolve(config.workspaceRoot, ".patchwarden", "evidence-packs", lineageId);
+    guardWorkspacePath(packDir, config.workspaceRoot);
+    mkdirSync(packDir, { recursive: true });
+    const policySummary = readPolicySummary(lineage.repo_path);
+    const catalog = safeCatalog();
+    const generatedAt = new Date().toISOString();
+    const filePaths = {
+        json: join(packDir, "evidence.json"),
+        markdown: join(packDir, "EVIDENCE.md"),
+        risk: join(packDir, "risk.json"),
+        verify: join(packDir, "verify.json"),
+        diffstat: join(packDir, "diffstat.json"),
+        lineage: join(packDir, "lineage.json"),
+        attestation: join(packDir, "attestation.json"),
+        redactions: join(packDir, "redactions.json"),
+    };
+    // Build v2 structured artifact contents (raw, before redaction).
+    const riskContent = buildRiskContent(lineage);
+    const verifyContent = buildVerifyContent(lineage);
+    const diffstatContent = buildDiffstatContent(lineage, config);
+    const lineageSummary = buildLineageSummary(lineage);
+    const attestationContent = buildAttestation(catalog, generatedAt, lineage.repo_path, config.workspaceRoot);
+    // Count redactions across all v2 raw contents for the audit trail.
+    const v2RawPayloads = [
+        riskContent,
+        verifyContent,
+        diffstatContent,
+        lineageSummary,
+        attestationContent,
+    ].map((value) => JSON.stringify(value));
+    const aggregated = new Map();
+    for (const raw of v2RawPayloads) {
+        for (const entry of countRedactionsByCategory(raw)) {
+            const existing = aggregated.get(entry.category);
+            if (existing)
+                existing.count += entry.count;
+            else
+                aggregated.set(entry.category, { category: entry.category, reason: entry.reason, count: entry.count });
+        }
+    }
+    const redactionsList = [...aggregated.values()];
+    const redactionsContent = {
+        redactions: redactionsList,
+        total_redacted: redactionsList.reduce((sum, entry) => sum + entry.count, 0),
+        bounded: true,
+        note: "Only categories and counts are recorded; original secret values are never persisted.",
+    };
+    // Redact and write each v2 file.
+    atomicWriteJsonFileSync(filePaths.risk, redactSensitiveValue(riskContent).value);
+    atomicWriteJsonFileSync(filePaths.verify, redactSensitiveValue(verifyContent).value);
+    atomicWriteJsonFileSync(filePaths.diffstat, redactSensitiveValue(diffstatContent).value);
+    atomicWriteJsonFileSync(filePaths.lineage, redactSensitiveValue(lineageSummary).value);
+    atomicWriteJsonFileSync(filePaths.attestation, redactSensitiveValue(attestationContent).value);
+    atomicWriteJsonFileSync(filePaths.redactions, redactSensitiveValue(redactionsContent).value);
+    const safePack = redactSensitiveValue({
+        evidence_pack_id: `evidence_${lineageId}`,
+        lineage_id: lineageId,
+        generated_at: generatedAt,
+        path: packDir,
+        files: filePaths,
+        lineage,
+        policy: {
+            valid: policySummary.valid,
+            issue_count: policySummary.issues.length,
+            release_readiness: policySummary.release_readiness,
+        },
+        catalog,
+        omitted: [
+            "stdout",
+            "stderr",
+            "diff",
+            "verification command logs",
+            "full artifact markdown",
+            "sensitive file contents",
+            "raw secret values (redactions.json stores only categories and counts)",
+            "full diff content (diffstat.json stores only file-level line counts)",
+        ],
+        next_action: buildNextAction(lineage),
+        bounded: true,
+    }).value;
+    atomicWriteJsonFileSync(safePack.files.json, safePack);
+    atomicWriteFileSync(safePack.files.markdown, buildEvidenceMarkdown(safePack));
+    return safePack;
+}
+export function listEvidencePacks(options = {}) {
+    const maxItems = normalizeMaxItems(options.max_items);
+    const config = getConfig();
+    const root = resolve(config.workspaceRoot, ".patchwarden", "evidence-packs");
+    guardWorkspacePath(root, config.workspaceRoot);
+    if (!existsSync(root))
+        return { evidence_packs: [], total: 0, truncated: false };
+    const packs = readdirSync(root, { withFileTypes: true })
+        .filter((entry) => entry.isDirectory())
+        .map((entry) => readEvidencePack(entry.name))
+        .filter((entry) => entry !== null)
+        .sort((a, b) => b.generated_at.localeCompare(a.generated_at));
+    return {
+        evidence_packs: packs.slice(0, maxItems),
+        total: packs.length,
+        truncated: packs.length > maxItems,
+    };
+}
+export function readEvidencePack(lineageId) {
+    const safeLineageId = normalizeLineageId(lineageId);
+    const config = getConfig();
+    const filePath = resolve(config.workspaceRoot, ".patchwarden", "evidence-packs", safeLineageId, "evidence.json");
+    guardReadPath(filePath, config.workspaceRoot, ".patchwarden/evidence-packs");
+    if (!existsSync(filePath))
+        return null;
+    const raw = readFileSync(filePath, "utf-8").replace(/^\uFEFF/, "");
+    return redactSensitiveValue(JSON.parse(raw)).value;
+}
+function normalizeLineageId(value) {
+    const lineageId = String(value || "").trim();
+    if (!/^[A-Za-z0-9_-]+$/.test(lineageId)) {
+        throw new PatchWardenError("invalid_lineage_id", "lineage_id may contain only letters, numbers, underscores, and hyphens.", "Pass a lineage_id returned by run_task_loop.", true, { lineage_id: lineageId });
+    }
+    return lineageId;
+}
+function normalizeMaxItems(value) {
+    if (value === undefined)
+        return 12;
+    if (!Number.isInteger(value) || value < 1 || value > 50) {
+        throw new Error("max_items must be an integer from 1 to 50.");
+    }
+    return value;
+}
+function readPolicySummary(repoPath) {
+    try {
+        const policy = getProjectPolicySummary(repoPath || ".");
+        return {
+            valid: Boolean(policy.valid),
+            issues: Array.isArray(policy.issues) ? policy.issues : [],
+            release_readiness: policy.release_readiness || null,
+        };
+    }
+    catch (err) {
+        return {
+            valid: false,
+            issues: [{ code: "policy_unavailable", message: err instanceof Error ? err.message : String(err) }],
+            release_readiness: null,
+        };
+    }
+}
+function safeCatalog() {
+    try {
+        const catalog = getLastToolCatalogSnapshot();
+        if (!catalog)
+            throw new Error("catalog snapshot unavailable");
+        return {
+            server_version: catalog.server_version,
+            schema_epoch: catalog.schema_epoch,
+            tool_profile: catalog.tool_profile,
+            tool_count: catalog.tool_count,
+            tool_manifest_sha256: catalog.tool_manifest_sha256,
+        };
+    }
+    catch {
+        return {
+            server_version: PATCHWARDEN_VERSION,
+            schema_epoch: TOOL_SCHEMA_EPOCH,
+            tool_profile: null,
+            tool_count: null,
+            tool_manifest_sha256: null,
+        };
+    }
+}
+function buildNextAction(lineage) {
+    if (lineage.stop_reason === "success")
+        return "Use this evidence pack for review or release readiness.";
+    return lineage.next_action || "Review lineage before exporting release evidence.";
+}
+function buildRiskContent(lineage) {
+    const risks = [];
+    for (const round of lineage.rounds) {
+        for (const check of round.fail_checks) {
+            risks.push({ source: "round", task_id: round.task_id, severity: "high", category: "fail_check", detail: check });
+        }
+        for (const check of round.warn_checks) {
+            risks.push({ source: "round", task_id: round.task_id, severity: "medium", category: "warn_check", detail: check });
+        }
+    }
+    for (const warning of lineage.warnings) {
+        risks.push({ source: "lineage", severity: "low", category: "warning", detail: warning });
+    }
+    const by_severity = {
+        high: risks.filter((risk) => risk.severity === "high").length,
+        medium: risks.filter((risk) => risk.severity === "medium").length,
+        low: risks.filter((risk) => risk.severity === "low").length,
+    };
+    return { risks, count: risks.length, by_severity };
+}
+function buildVerifyContent(lineage) {
+    const records = [];
+    for (const round of lineage.rounds) {
+        records.push({
+            source: "round",
+            task_id: round.task_id,
+            role: round.role,
+            verification_status: round.verification_status,
+            audit_verdict: round.audit_verdict,
+            passed: round.verification_status === "passed",
+        });
+    }
+    for (const session of lineage.tasks.direct_sessions) {
+        records.push({
+            source: "direct_session",
+            session_id: session.session_id,
+            verification_status: session.status || "unknown",
+            audit_verdict: session.audit_decision || "not_run",
+            passed: session.status === "passed",
+            command_count: session.command_count,
+            passed_commands: session.passed_commands,
+            failed_commands: session.failed_commands,
+        });
+    }
+    const passed = records.filter((record) => record.passed).length;
+    return {
+        records,
+        count: records.length,
+        summary: { total: records.length, passed, failed: records.length - passed },
+        latest_status: lineage.verification.latest_status,
+        overall_passed: lineage.verification.passed,
+    };
+}
+function buildDiffstatContent(lineage, config) {
+    const taskIds = [
+        lineage.tasks.main,
+        ...lineage.tasks.fix,
+        ...lineage.tasks.cleanup,
+    ].filter((id) => Boolean(id));
+    const files = [];
+    let totalAdditions = 0;
+    let totalDeletions = 0;
+    for (const taskId of taskIds) {
+        if (!/^[A-Za-z0-9_-]+$/.test(taskId))
+            continue;
+        const statsPath = resolve(config.workspaceRoot, config.tasksDir, taskId, "file-stats.json");
+        try {
+            guardWorkspacePath(statsPath, config.workspaceRoot);
+            if (!existsSync(statsPath))
+                continue;
+            const raw = readFileSync(statsPath, "utf-8").replace(/^\uFEFF/, "");
+            const stats = JSON.parse(raw);
+            if (!Array.isArray(stats.files))
+                continue;
+            for (const file of stats.files) {
+                const additions = Number(file.additions) || 0;
+                const deletions = Number(file.deletions) || 0;
+                files.push({
+                    path: String(file.path || ""),
+                    status: String(file.status || "unknown"),
+                    additions,
+                    deletions,
+                    task_id: taskId,
+                });
+                totalAdditions += additions;
+                totalDeletions += deletions;
+            }
+        }
+        catch {
+            // Skip unreadable or malformed file-stats.json entries.
+        }
+    }
+    return {
+        files,
+        count: files.length,
+        totals: { additions: totalAdditions, deletions: totalDeletions },
+    };
+}
+function buildLineageSummary(lineage) {
+    return {
+        lineage_id: lineage.lineage_id,
+        goal: lineage.goal,
+        final_status: lineage.final_status,
+        stop_reason: lineage.stop_reason,
+        iterations_count: lineage.rounds.length,
+        task_counts: {
+            main: lineage.tasks.main ? 1 : 0,
+            fix: lineage.tasks.fix.length,
+            cleanup: lineage.tasks.cleanup.length,
+            direct_sessions: lineage.tasks.direct_sessions.length,
+        },
+        verification: lineage.verification,
+        worktree: {
+            isolation_mode: lineage.worktree.isolation_mode,
+            status: lineage.worktree.status,
+        },
+        agent_routing: lineage.agent_routing ? { selected_agent: lineage.agent_routing.selected_agent } : null,
+        warnings_count: lineage.warnings.length,
+        errors_count: lineage.errors.length,
+        truncated: lineage.truncated,
+    };
+}
+function readGitCommitShort(repoPath, workspaceRoot) {
+    try {
+        const cwd = guardWorkspacePath(repoPath || ".", workspaceRoot);
+        const env = buildGitEnvironment(cwd);
+        const git = resolveTrustedExecutable("git", cwd, { pathValue: env.PATH });
+        return execFileSync(git, ["rev-parse", "--short", "HEAD"], {
+            cwd,
+            encoding: "utf-8",
+            env,
+            stdio: ["ignore", "pipe", "ignore"],
+            timeout: 5000,
+            windowsHide: true,
+        }).trim();
+    }
+    catch {
+        return "unknown";
+    }
+}
+function buildAttestation(catalog, generatedAt, repoPath, workspaceRoot) {
+    return {
+        patchwarden_version: PATCHWARDEN_VERSION,
+        package_version: PATCHWARDEN_VERSION,
+        commit: readGitCommitShort(repoPath, workspaceRoot),
+        node_version: process.version,
+        os: { platform: process.platform, arch: process.arch },
+        tool_profile: catalog.tool_profile,
+        schema_epoch: catalog.schema_epoch,
+        generated_at: generatedAt,
+    };
+}
+function buildEvidenceMarkdown(pack) {
+    const direct = pack.lineage.tasks.direct_sessions
+        .map((entry) => `- ${entry.session_id}: status=${entry.status || "unknown"}, audit=${entry.audit_decision || "unknown"}`)
+        .join("\n");
+    const rounds = pack.lineage.rounds
+        .map((round) => `- ${round.role} ${round.task_id}: status=${round.status}, verification=${round.verification_status}, audit=${round.audit_verdict}`)
+        .join("\n");
+    return [
+        "# PatchWarden Evidence Pack",
+        "",
+        `- Evidence pack: ${pack.evidence_pack_id}`,
+        `- Lineage: ${pack.lineage_id}`,
+        `- Generated: ${pack.generated_at}`,
+        `- Final status: ${pack.lineage.final_status}`,
+        `- Stop reason: ${pack.lineage.stop_reason}`,
+        `- Worktree: ${pack.lineage.worktree.isolation_mode} (${pack.lineage.worktree.status})`,
+        `- Tool manifest: ${pack.catalog.tool_manifest_sha256 || "unavailable"}`,
+        "",
+        "## Verification Rounds",
+        rounds || "- None.",
+        "",
+        "## Direct Evidence",
+        direct || "- None.",
+        "",
+        "## Policy And Release",
+        `- Policy valid: ${pack.policy.valid}`,
+        `- Policy issue count: ${pack.policy.issue_count}`,
+        "",
+        "## Evidence Pack v2 Files",
+        "- `evidence.json` — full bounded evidence pack (machine-readable).",
+        "- `EVIDENCE.md` — human-readable evidence summary.",
+        "- `risk.json` — aggregated risk items with severity (high/medium/low).",
+        "- `verify.json` — structured verification records per round and direct session.",
+        "- `diffstat.json` — file-level additions/deletions without full diff content.",
+        "- `lineage.json` — bounded lineage summary (goal, status, task counts).",
+        "- `attestation.json` — version, commit, Node/OS, tool profile, schema epoch.",
+        "- `redactions.json` — redaction categories and counts (no original secret values).",
+        "",
+        "## Omitted",
+        ...pack.omitted.map((item) => `- ${item}`),
+        "",
+        `Next action: ${pack.next_action}`,
+        "",
+    ].join("\n");
+}

package/dist/tools/{getTaskFile.js → tasks/getTaskFile.js}

@@ -1,9 +1,9 @@
 import { readFileSync, existsSync, statSync } from "node:fs";
 import { resolve, join } from "node:path";
-import { getTasksDir, getConfig } from "../config.js";
-import { guardPath } from "../security/pathGuard.js";
-import { guardSensitivePath } from "../security/sensitiveGuard.js";
-import { redactSensitiveContent } from "../security/contentRedaction.js";
+import { getTasksDir, getConfig } from "../../config.js";
+import { guardPath } from "../../security/pathGuard.js";
+import { guardSensitivePath } from "../../security/sensitiveGuard.js";
+import { redactSensitiveContent } from "../../security/contentRedaction.js";
 import { getTaskStatus } from "./getTaskStatus.js";
 export const TASK_READ_ONLY_FILES = [
     "result.md",

package/dist/tools/{getTaskStatus.d.ts → tasks/getTaskStatus.d.ts}

@@ -1,6 +1,6 @@
 import type { TaskStatus } from "./createTask.js";
 import type { TaskPhase } from "./createTask.js";
-import { type PendingReason, type WatcherStatusSnapshot } from "../watcherStatus.js";
+import { type PendingReason, type WatcherStatusSnapshot } from "../../watcherStatus.js";
 export interface GetTaskStatusOutput {
     task_id: string;
     plan_id: string;
@@ -28,6 +28,11 @@ export interface GetTaskStatusOutput {
         path: string;
         change: string;
     }>;
+    new_out_of_scope_changes?: Array<{
+        path: string;
+        change: string;
+    }>;
+    artifact_hygiene_counts?: Record<string, unknown>;
     verify_status?: "passed" | "failed" | "skipped";
     verify_commands?: string[];
     diff_available?: boolean;

package/dist/tools/{getTaskStatus.js → tasks/getTaskStatus.js}

@@ -1,10 +1,10 @@
 import { readFileSync, existsSync } from "node:fs";
 import { resolve, join } from "node:path";
-import { getTasksDir, getConfig } from "../config.js";
-import { guardReadPath } from "../security/pathGuard.js";
-import { guardSensitivePath } from "../security/sensitiveGuard.js";
-import { readTaskRuntime } from "../taskRuntime.js";
-import { derivePendingReason, readWatcherStatus, } from "../watcherStatus.js";
+import { getTasksDir, getConfig } from "../../config.js";
+import { guardReadPath } from "../../security/pathGuard.js";
+import { guardSensitivePath } from "../../security/sensitiveGuard.js";
+import { readTaskRuntime } from "../../runner/taskRuntime.js";
+import { derivePendingReason, readWatcherStatus, } from "../../watcherStatus.js";
 export function getTaskStatus(taskId) {
     const config = getConfig();
     const tasksDir = getTasksDir(config);

package/dist/tools/{getTaskStdoutTail.js → tasks/getTaskStdoutTail.js}

@@ -1,8 +1,9 @@
-import { readFileSync, existsSync } from "node:fs";
+import { existsSync } from "node:fs";
 import { join } from "node:path";
-import { getTasksDir, getConfig } from "../config.js";
-import { guardReadPath } from "../security/pathGuard.js";
-import { redactSensitiveContent } from "../security/contentRedaction.js";
+import { getTasksDir, getConfig } from "../../config.js";
+import { guardReadPath } from "../../security/pathGuard.js";
+import { redactSensitiveContent } from "../../security/contentRedaction.js";
+import { readTextFilePrefixSync, readTextFileTailLinesSync } from "../../utils/boundedFile.js";
 export function getTaskStdoutTail(taskId, lines = 80) {
     const config = getConfig();
     const tasksDir = getTasksDir(config);
@@ -16,29 +17,30 @@ export function getTaskStdoutTail(taskId, lines = 80) {
     const stdoutLog = join(taskDir, "stdout.log");
     const stderrLog = join(taskDir, "stderr.log");
     const resultFile = join(taskDir, "result.md");
-    const maxLines = Math.min(lines, 200);
+    const maxLines = Number.isFinite(lines)
+        ? Math.max(1, Math.min(200, Math.trunc(lines)))
+        : 80;
+    const stderrLines = Math.min(maxLines, 40);
     let stdoutTail = "";
     let stderrTail = "";
     let source = "none";
     // All log files are optional — don't throw if missing
     if (existsSync(stdoutLog)) {
-        const raw = readFileSync(stdoutLog, "utf-8");
-        stdoutTail = raw.split("\n").slice(-maxLines).join("\n");
+        stdoutTail = readTextFileTailLinesSync(stdoutLog, maxLines, config.maxReadFileBytes);
         source = "stdout.log";
     }
     if (existsSync(stderrLog)) {
-        const raw = readFileSync(stderrLog, "utf-8");
-        stderrTail = raw.split("\n").slice(-Math.min(maxLines, 40)).join("\n");
+        stderrTail = readTextFileTailLinesSync(stderrLog, stderrLines, config.maxReadFileBytes);
     }
     // Fallback to result.md
     if (!stdoutTail && existsSync(resultFile)) {
-        const raw = readFileSync(resultFile, "utf-8");
+        const raw = readTextFilePrefixSync(resultFile, config.maxReadFileBytes).content;
         const stdoutMatch = raw.match(/## Agent stdout\s*\n+```\s*([\s\S]*?)```/i);
         const stderrMatch = raw.match(/## Agent stderr\s*\n+```\s*([\s\S]*?)```/i);
         if (stdoutMatch)
             stdoutTail = stdoutMatch[1].split("\n").slice(-maxLines).join("\n");
         if (stderrMatch && !stderrTail)
-            stderrTail = stderrMatch[1].split("\n").slice(-Math.min(maxLines, 40)).join("\n");
+            stderrTail = stderrMatch[1].split("\n").slice(-stderrLines).join("\n");
         if (source === "none")
             source = "result.md";
     }

package/dist/tools/{getTaskSummary.js → tasks/getTaskSummary.js}

@@ -1,9 +1,10 @@
-import { existsSync, readFileSync } from "node:fs";
+import { existsSync } from "node:fs";
 import { join, resolve } from "node:path";
-import { getConfig, getTasksDir } from "../config.js";
-import { guardReadPath } from "../security/pathGuard.js";
+import { getConfig, getTasksDir } from "../../config.js";
+import { guardReadPath } from "../../security/pathGuard.js";
 import { getTaskStatus } from "./getTaskStatus.js";
-import { redactSensitiveValue } from "../security/contentRedaction.js";
+import { redactSensitiveValue } from "../../security/contentRedaction.js";
+import { readTextFilePrefixSync, readTextFileTailLinesSync, } from "../../utils/boundedFile.js";
 const TERMINAL_STATUSES = new Set([
     "done",
     "done_by_agent",
@@ -30,7 +31,8 @@ export function getTaskSummary(taskId, options = {}) {
         ?? status.new_out_of_scope_changes
         ?? result.out_of_scope_changes
         ?? status.out_of_scope_changes);
-    const verifyStatus = String(verify.status ?? result.verify_status ?? result.verify?.status ?? status.verify_status ?? "not_available");
+    const resultVerify = asRecord(result.verify);
+    const verifyStatus = String(verify.status ?? result.verify_status ?? resultVerify.status ?? status.verify_status ?? "not_available");
     const errors = [status.error, ...asArray(result.errors), ...asArray(result.known_issues)]
         .filter((value) => typeof value === "string" && value.trim() !== "");
     const warnings = asArray(result.warnings).filter((value) => typeof value === "string");
@@ -61,16 +63,16 @@ export function getTaskSummary(taskId, options = {}) {
     const acceptanceFile = join(taskDir, "acceptance.json");
     if (existsSync(acceptanceFile)) {
         try {
-            const acceptance = JSON.parse(readFileSync(acceptanceFile, "utf-8"));
+            const acceptance = asRecord(JSON.parse(readTextFilePrefixSync(acceptanceFile, 1024 * 1024).content));
             if (acceptance.status === "accepted") {
                 acceptanceStatus = "ready_for_review";
-                acceptanceReviewedAt = acceptance.reviewed_at || null;
-                acceptanceReviewer = acceptance.reviewer || null;
+                acceptanceReviewedAt = typeof acceptance.reviewed_at === "string" ? acceptance.reviewed_at : null;
+                acceptanceReviewer = typeof acceptance.reviewer === "string" ? acceptance.reviewer : null;
             }
             else if (acceptance.status === "rejected") {
                 acceptanceStatus = "failed";
-                acceptanceReviewedAt = acceptance.reviewed_at || null;
-                acceptanceReviewer = acceptance.reviewer || null;
+                acceptanceReviewedAt = typeof acceptance.reviewed_at === "string" ? acceptance.reviewed_at : null;
+                acceptanceReviewer = typeof acceptance.reviewer === "string" ? acceptance.reviewer : null;
                 if (acceptance.notes) {
                     warnings.push(`Task was rejected by ${acceptance.reviewer || "human"} at ${acceptance.reviewed_at || "unknown time"}: ${acceptance.notes}`);
                 }
@@ -102,11 +104,13 @@ export function getTaskSummary(taskId, options = {}) {
     const artifactHygiene = asRecord(result.artifact_hygiene ?? changedFilesRead.data.artifact_hygiene ?? {
         counts: status.artifact_hygiene_counts || {},
     });
-    const verifyCommands = asArray(verify.commands ?? result.verify_commands ?? result.verify?.commands);
+    const verifyCommands = asArray(verify.commands ?? result.verify_commands ?? resultVerify.commands);
     const testLogSummary = summarizeTestLog(join(taskDir, "test.log"));
     const verificationSummary = buildVerificationSummary(verifyStatus, verifyCommands, testLogSummary);
     // Extract failed command detail from verify records
-    const failedVerify = verifyCommands.find((cmd) => ["failed", "timed_out", "canceled"].includes(cmd?.status));
+    const failedVerify = verifyCommands
+        .map(asRecord)
+        .find((command) => ["failed", "timed_out", "canceled"].includes(String(command.status || "")));
     const failedCommandDetail = failedVerify ? {
         command: String(failedVerify.command || ""),
         exit_code: failedVerify.exit_code ?? null,
@@ -145,7 +149,7 @@ export function getTaskSummary(taskId, options = {}) {
         test_summary: verificationSummary.headline,
         diff_available: Boolean((status.diff_available ?? (changedFiles.length > 0)) &&
             (artifacts["diff.patch"] || artifacts["git.diff"])),
-        diff_truncated: Boolean(status.diff_truncated || result.warnings?.some?.((warning) => warning.includes("diff.patch was truncated"))),
+        diff_truncated: Boolean(status.diff_truncated || asArray(result.warnings).some((warning) => typeof warning === "string" && warning.includes("diff.patch was truncated"))),
         result_available: artifacts["result.md"],
         result_json_available: artifacts["result.json"],
         verify_available: artifacts["verify.json"],
@@ -194,7 +198,9 @@ function buildCompactSummary(output, maxItems) {
     const manifestRead = tryReadJson(join(taskDir, "artifact_manifest.json"));
     const manifest = asRecord(manifestRead.data);
     const releaseArtifacts = asArray(manifest.artifacts);
-    const releaseArtifactPaths = releaseArtifacts.map((a) => String(a.path || "")).slice(0, maxItems);
+    const releaseArtifactPaths = releaseArtifacts
+        .map((artifact) => String(asRecord(artifact).path || ""))
+        .slice(0, maxItems);
     const compact = {
         view: "compact",
         task_id: String(output.task_id),
@@ -243,7 +249,7 @@ function tryReadJson(path) {
     if (!existsSync(path))
         return { data: {} };
     try {
-        return { data: JSON.parse(readFileSync(path, "utf-8")) };
+        return { data: asRecord(JSON.parse(readTextFilePrefixSync(path, 2 * 1024 * 1024).content)) };
     }
     catch (error) {
         return { data: {}, error: error instanceof Error ? error.message : String(error) };
@@ -253,27 +259,30 @@ function asArray(value) {
     return Array.isArray(value) ? value : [];
 }
 function asRecord(value) {
-    return value && typeof value === "object" && !Array.isArray(value) ? value : {};
+    return value && typeof value === "object" && !Array.isArray(value)
+        ? value
+        : {};
 }
 function summarizeTestLog(path) {
     if (!existsSync(path))
         return "test.log missing";
-    const text = readFileSync(path, "utf-8");
+    const text = readTextFileTailLinesSync(path, 200, 512 * 1024);
     const exit = text.match(/Exit\s*code:\s*([^\r\n]+)/i)?.[1]?.trim();
     return exit ? `Exit code: ${exit}` : text.trim().slice(0, 500) || "test.log empty";
 }
 function readResultFallback(path) {
     if (!existsSync(path))
         return "";
-    const text = readFileSync(path, "utf-8");
+    const text = readTextFilePrefixSync(path, 1024 * 1024).content;
     return text.match(/## Summary\s+([\s\S]*?)(?:\n## |\n---|$)/i)?.[1]?.trim().slice(0, 1000) || "";
 }
 function buildVerificationSummary(status, commands, testLogSummary) {
-    const passed = commands.filter((command) => command?.status === "passed").length;
-    const failed = commands.filter((command) => ["failed", "timed_out", "canceled"].includes(command?.status)).length;
-    const skipped = commands.filter((command) => command?.status === "skipped").length;
+    const commandRecords = commands.map(asRecord);
+    const passed = commandRecords.filter((command) => command.status === "passed").length;
+    const failed = commandRecords.filter((command) => ["failed", "timed_out", "canceled"].includes(String(command.status || ""))).length;
+    const skipped = commandRecords.filter((command) => command.status === "skipped").length;
     const evidenceText = [
-        ...commands.flatMap((command) => [command?.stdout_tail, command?.stderr_tail]),
+        ...commandRecords.flatMap((command) => [command.stdout_tail, command.stderr_tail]),
         testLogSummary,
     ].filter((value) => typeof value === "string").join("\n");
     const headline = extractTestHeadline(evidenceText)
@@ -304,10 +313,8 @@ function readLogTail(path, lines) {
     if (!existsSync(path))
         return "(file not found)";
     try {
-        const raw = readFileSync(path, "utf-8");
-        if (raw.length === 0)
-            return "(empty)";
-        return raw.split("\n").slice(-lines).join("\n");
+        const tail = readTextFileTailLinesSync(path, lines);
+        return tail || "(empty)";
     }
     catch {
         return "(unreadable)";

package/dist/tools/tasks/index.d.ts

@@ -0,0 +1,18 @@
+export * from "./cancelTask.js";
+export * from "./createTask.js";
+export * from "./diagnoseTask.js";
+export * from "./evidencePack.js";
+export * from "./getTaskFile.js";
+export * from "./getTaskProgress.js";
+export * from "./getTaskStatus.js";
+export * from "./getTaskStdoutTail.js";
+export * from "./getTaskSummary.js";
+export * from "./killTask.js";
+export * from "./listTasks.js";
+export * from "./reconcileTasks.js";
+export * from "./retryTask.js";
+export * from "./runTaskLoop.js";
+export * from "./runVerification.js";
+export * from "./taskLineage.js";
+export * from "./taskOutputs.js";
+export * from "./waitForTask.js";