patchwarden 1.5.1 → 1.6.2

package/dist/runner/changeCapture.js

@@ -1,30 +1,36 @@
 import { createHash } from "node:crypto";
-import { createReadStream, lstatSync, readFileSync, readdirSync, writeFileSync, } from "node:fs";
+import { createReadStream, lstatSync, readFileSync, readdirSync, } from "node:fs";
 import { join, relative, resolve, isAbsolute } from "node:path";
 import { execFile } from "node:child_process";
+import { redactSensitiveContent } from "../security/contentRedaction.js";
 import { isSensitivePath } from "../security/sensitiveGuard.js";
+import { nullDevice } from "../utils/platform.js";
+import { buildGitEnvironment, resolveTrustedExecutable } from "./processSecurity.js";
+import { atomicWriteJsonFileSync } from "../utils/atomicFile.js";
 const MAX_HASH_BYTES = 5 * 1024 * 1024;
 const MAX_SNAPSHOT_FILES = 5000;
 const MAX_DIFF_BYTES = 20 * 1024 * 1024;
+const DIFF_TRUNCATION_MARKER = "\n[PATCHWARDEN DIFF TRUNCATED]\n";
 const SKIP_DIRECTORIES = new Set([".git", ".patchwarden", "node_modules"]);
-export async function captureRepoSnapshot(repoPath) {
+export async function captureRepoSnapshot(repoPath, signal) {
+    throwIfAborted(signal);
     const warnings = [];
-    const isGitResult = await runGit(repoPath, ["rev-parse", "--is-inside-work-tree"]);
+    const isGitResult = await runGit(repoPath, ["rev-parse", "--is-inside-work-tree"], signal);
     const isGit = isGitResult.stdout.trim() === "true";
     let head = null;
     let status = "";
     let paths = [];
-    const trackedPaths = new Set();
-    const ignoredPaths = new Set();
+    const trackedPaths = new Map();
+    const ignoredPaths = new Map();
     const dirtyPaths = new Set();
     if (isGit) {
         // The following five git calls are independent of each other and can run in parallel.
         const [headResult, statusResult, trackedResult, ignoredResult, listedResult] = await Promise.all([
-            runGit(repoPath, ["rev-parse", "HEAD"]),
-            runGit(repoPath, ["status", "--porcelain=v1", "-uall"]),
-            runGit(repoPath, ["ls-files", "-z"]),
-            runGit(repoPath, ["ls-files", "-o", "-i", "--exclude-standard", "-z"]),
-            runGit(repoPath, ["ls-files", "-co", "--exclude-standard", "-z"]),
+            runGit(repoPath, ["rev-parse", "HEAD"], signal),
+            runGit(repoPath, ["status", "--porcelain=v1", "-uall"], signal),
+            runGit(repoPath, ["ls-files", "-z"], signal),
+            runGit(repoPath, ["ls-files", "-o", "-i", "--exclude-standard", "-z"], signal),
+            runGit(repoPath, ["ls-files", "-co", "--exclude-standard", "-z"], signal),
         ]);
         if (headResult.status === 0)
             head = headResult.stdout.trim() || null;
@@ -55,11 +61,11 @@ export async function captureRepoSnapshot(repoPath) {
         }
         if (trackedResult.status === 0) {
             for (const path of trackedResult.stdout.split("\0").filter(Boolean))
-                trackedPaths.add(normalizePath(path));
+                addSnapshotPath(trackedPaths, path);
         }
         if (ignoredResult.status === 0) {
             for (const path of ignoredResult.stdout.split("\0").filter(Boolean))
-                ignoredPaths.add(normalizePath(path));
+                addSnapshotPath(ignoredPaths, path);
         }
         else {
             warnings.push("git ignored-file discovery failed; ignored classification may be incomplete");
@@ -67,17 +73,17 @@ export async function captureRepoSnapshot(repoPath) {
         if (listedResult.status === 0) {
             paths = [...new Set([
                     ...listedResult.stdout.split("\0").filter(Boolean),
-                    ...walkWorkspace(repoPath),
+                    ...walkWorkspace(repoPath, signal),
                 ])];
         }
         else {
             warnings.push("git ls-files failed; using bounded filesystem scan");
-            paths = walkWorkspace(repoPath);
+            paths = walkWorkspace(repoPath, signal);
         }
     }
     else {
         warnings.push("repository is not a Git worktree; diff will contain file-change evidence only");
-        paths = walkWorkspace(repoPath);
+        paths = walkWorkspace(repoPath, signal);
     }
     if (paths.length > MAX_SNAPSHOT_FILES) {
         warnings.push(`snapshot limited to ${MAX_SNAPSHOT_FILES} files`);
@@ -85,6 +91,7 @@ export async function captureRepoSnapshot(repoPath) {
     }
     const files = {};
     for (const inputPath of paths.sort()) {
+        throwIfAborted(signal);
         const normalized = normalizePath(inputPath);
         if (!normalized || normalized.startsWith(".patchwarden/") || isSensitivePath(normalized))
             continue;
@@ -99,8 +106,8 @@ export async function captureRepoSnapshot(repoPath) {
             files[normalized] = {
                 size: stat.size,
                 sha256,
-                tracked: trackedPaths.has(normalized),
-                ignored: !trackedPaths.has(normalized) && ignoredPaths.has(normalized),
+                tracked: hasSnapshotPath(trackedPaths, normalized),
+                ignored: !hasSnapshotPath(trackedPaths, normalized) && hasSnapshotPath(ignoredPaths, normalized),
             };
         }
         catch {
@@ -119,32 +126,14 @@ export async function captureRepoSnapshot(repoPath) {
     };
 }
 export function writeSnapshot(taskDir, filename, snapshot) {
-    writeFileSync(join(taskDir, filename), JSON.stringify(snapshot, null, 2), "utf-8");
+    atomicWriteJsonFileSync(join(taskDir, filename), snapshot);
 }
-export async function buildChangeArtifacts(repoPath, before, after) {
+export async function buildChangeArtifacts(repoPath, before, after, signal) {
+    throwIfAborted(signal);
     const changedFiles = compareSnapshots(before, after);
     const artifactHygiene = classifyArtifactHygiene(changedFiles);
     const sections = [];
     const scopedPaths = [...new Set(changedFiles.flatMap((file) => file.old_path ? [file.old_path, file.path] : [file.path]))];
-    if (before.is_git && after.is_git && scopedPaths.length > 0) {
-        if (before.head && after.head && before.head !== after.head) {
-            const committed = await runGit(repoPath, ["diff", "--no-color", "--binary", before.head, after.head, "--", ...scopedPaths]);
-            if (committed.stdout.trim())
-                sections.push("# Changes committed during task\n", committed.stdout.trimEnd());
-        }
-        const base = after.head || "HEAD";
-        const working = await runGit(repoPath, ["diff", "--no-color", "--binary", base, "--", ...scopedPaths]);
-        if (working.stdout.trim())
-            sections.push("# Staged and unstaged changes\n", working.stdout.trimEnd());
-        for (const file of changedFiles.filter((item) => item.change === "added").slice(0, 100)) {
-            const tracked = await runGit(repoPath, ["ls-files", "--error-unmatch", "--", file.path]);
-            if (tracked.status === 0)
-                continue;
-            const untracked = await runGit(repoPath, ["diff", "--no-index", "--no-color", "--binary", "--", "/dev/null", file.path]);
-            if (untracked.stdout.trim())
-                sections.push("# Untracked file\n", untracked.stdout.trimEnd());
-        }
-    }
     const evidence = [
         "# PatchWarden change evidence",
         `# changed_files: ${changedFiles.length}`,
@@ -152,16 +141,70 @@ export async function buildChangeArtifacts(repoPath, before, after) {
         `# workspace_dirty_after: ${after.workspace_dirty}`,
         ...changedFiles.map((file) => `# ${file.change}: ${file.path}`),
     ].join("\n");
-    const body = sections.join("\n\n");
-    const fullDiff = `${evidence}\n\n${body || (changedFiles.length ? "(textual patch unavailable; see changed-files.json for hash evidence)" : "(no task file changes detected)")}\n`;
+    let retainedSectionBytes = 0;
+    let diffTruncated = Buffer.byteLength(evidence, "utf-8") > MAX_DIFF_BYTES;
+    const sectionBudget = Math.max(0, MAX_DIFF_BYTES
+        - Math.min(Buffer.byteLength(evidence, "utf-8"), MAX_DIFF_BYTES)
+        - Buffer.byteLength(DIFF_TRUNCATION_MARKER, "utf-8")
+        - 2);
+    const appendSection = (label, content, commandTruncated = false) => {
+        if (!content.trim()) {
+            if (commandTruncated)
+                diffTruncated = true;
+            return;
+        }
+        const block = `${sections.length > 0 ? "\n\n" : ""}${label}\n\n${content.trimEnd()}`;
+        const remaining = Math.max(0, sectionBudget - retainedSectionBytes);
+        const bounded = utf8Prefix(block, remaining);
+        if (bounded) {
+            sections.push(bounded);
+            retainedSectionBytes += Buffer.byteLength(bounded, "utf-8");
+        }
+        if (commandTruncated || Buffer.byteLength(bounded, "utf-8") < Buffer.byteLength(block, "utf-8")) {
+            diffTruncated = true;
+        }
+    };
+    if (before.is_git && after.is_git && scopedPaths.length > 0) {
+        if (before.head && after.head && before.head !== after.head) {
+            const committed = await runGit(repoPath, ["diff", "--no-ext-diff", "--no-textconv", "--no-color", "--binary", before.head, after.head, "--", ...scopedPaths], signal);
+            appendSection("# Changes committed during task", committed.stdout, committed.truncated);
+        }
+        if (retainedSectionBytes < sectionBudget) {
+            const base = after.head || "HEAD";
+            const working = await runGit(repoPath, ["diff", "--no-ext-diff", "--no-textconv", "--no-color", "--binary", base, "--", ...scopedPaths], signal);
+            appendSection("# Staged and unstaged changes", working.stdout, working.truncated);
+        }
+        else {
+            diffTruncated = true;
+        }
+        for (const file of changedFiles.filter((item) => item.change === "added").slice(0, 100)) {
+            throwIfAborted(signal);
+            if (retainedSectionBytes >= sectionBudget) {
+                diffTruncated = true;
+                break;
+            }
+            const tracked = await runGit(repoPath, ["ls-files", "--error-unmatch", "--", file.path], signal);
+            if (tracked.status === 0)
+                continue;
+            const untracked = await runGit(repoPath, ["diff", "--no-ext-diff", "--no-textconv", "--no-index", "--no-color", "--binary", "--", nullDevice, file.path], signal);
+            appendSection("# Untracked file", untracked.stdout, untracked.truncated);
+        }
+    }
+    const body = sections.join("");
+    const rawDiff = `${evidence}\n\n${body || (changedFiles.length ? "(textual patch unavailable; see changed-files.json for hash evidence)" : "(no task file changes detected)")}\n`;
+    const sanitized = sanitizeDiffEvidence(rawDiff, MAX_DIFF_BYTES);
+    const fullDiff = sanitized.content;
+    diffTruncated ||= sanitized.truncated;
     const additions = fullDiff.split(/\r?\n/).filter((line) => line.startsWith("+") && !line.startsWith("+++")).length;
     const deletions = fullDiff.split(/\r?\n/).filter((line) => line.startsWith("-") && !line.startsWith("---")).length;
-    const fileStats = await buildFileStats(repoPath, before, after, changedFiles);
+    const fileStats = await buildFileStats(repoPath, before, after, changedFiles, signal);
     return {
         changed_files: changedFiles,
         diff: fullDiff,
         diff_available: changedFiles.length > 0,
-        diff_truncated: false,
+        diff_truncated: diffTruncated,
+        diff_redacted: sanitized.redacted,
+        diff_redaction_categories: sanitized.redaction_categories,
         diff_size_bytes: Buffer.byteLength(fullDiff, "utf-8"),
         additions,
         deletions,
@@ -177,8 +220,32 @@ export async function buildChangeArtifacts(repoPath, before, after) {
         artifact_hygiene: artifactHygiene,
     };
 }
-async function buildFileStats(repoPath, before, after, changedFiles) {
+export function sanitizeDiffEvidence(input, maxBytes = MAX_DIFF_BYTES) {
+    if (!Number.isInteger(maxBytes) || maxBytes <= 0) {
+        throw new Error("maxBytes must be a positive integer");
+    }
+    const redaction = redactSensitiveContent(input);
+    const encodedBytes = Buffer.byteLength(redaction.content, "utf-8");
+    if (encodedBytes <= maxBytes) {
+        return {
+            content: redaction.content,
+            truncated: false,
+            redacted: redaction.redacted,
+            redaction_categories: redaction.redaction_categories,
+        };
+    }
+    const marker = utf8Prefix(DIFF_TRUNCATION_MARKER, maxBytes);
+    const markerBytes = Buffer.byteLength(marker, "utf-8");
+    return {
+        content: utf8Prefix(redaction.content, Math.max(0, maxBytes - markerBytes)) + marker,
+        truncated: true,
+        redacted: redaction.redacted,
+        redaction_categories: redaction.redaction_categories,
+    };
+}
+async function buildFileStats(repoPath, before, after, changedFiles, signal) {
     const results = await Promise.all(changedFiles.map(async (file) => {
+        throwIfAborted(signal);
         let additions = 0;
         let deletions = 0;
         const paths = file.old_path ? [file.old_path, file.path] : [file.path];
@@ -188,7 +255,7 @@ async function buildFileStats(repoPath, before, after, changedFiles) {
                 ranges.push([before.head, after.head]);
             }
             ranges.push([after.head || "HEAD"]);
-            const rangeResults = await Promise.all(ranges.map((range) => runGit(repoPath, ["diff", "--numstat", ...range, "--", ...paths])));
+            const rangeResults = await Promise.all(ranges.map((range) => runGit(repoPath, ["diff", "--no-ext-diff", "--no-textconv", "--numstat", ...range, "--", ...paths], signal)));
             for (const result of rangeResults) {
                 for (const line of result.stdout.split(/\r?\n/).filter(Boolean)) {
                     const [added, removed] = line.split(/\s+/);
@@ -215,19 +282,30 @@ function countLines(content) {
         return 0;
     return content.split(/\r?\n/).length - (content.endsWith("\n") ? 1 : 0);
 }
-export function compareSnapshots(before, after) {
-    const paths = [...new Set([...Object.keys(before.files), ...Object.keys(after.files)])].sort();
+export function compareSnapshots(before, after, platform = process.platform) {
     const changed = [];
-    for (const path of paths) {
-        const left = before.files[path];
-        const right = after.files[path];
+    for (const { path, leftPath, rightPath, left, right } of pairSnapshotFiles(before.files, after.files, platform)) {
         if (!left && right) {
             changed.push(classifyChangedFile(path, "added", null, right));
         }
         else if (left && !right) {
             changed.push(classifyChangedFile(path, "deleted", left, null));
         }
-        else if (left.sha256 !== right.sha256) {
+        else if (left && right && left.sha256 === right.sha256 && leftPath !== rightPath) {
+            // Windows lookup is case-insensitive, but a case-only Git rename is still
+            // auditable work and must not disappear from the evidence set.
+            changed.push({
+                path: rightPath,
+                old_path: leftPath,
+                change: "renamed",
+                before_sha256: left.sha256,
+                after_sha256: right.sha256,
+                tracked: left.tracked || right.tracked,
+                ignored: right.ignored,
+                kind: classifyPathKind(rightPath),
+            });
+        }
+        else if (left && right && left.sha256 !== right.sha256) {
             changed.push(classifyChangedFile(path, "modified", left, right));
         }
     }
@@ -280,9 +358,11 @@ export function emptyArtifactHygiene() {
  * Extract files that are dirty in the workspace but outside the target repo.
  * Used to establish a baseline before task execution.
  */
-export function extractExternalDirtyFiles(workspaceSnapshot, repoPath, workspaceRoot) {
+export function extractExternalDirtyFiles(workspaceSnapshot, repoPath, workspaceRoot, platform = process.platform) {
     const dirtyFiles = [];
-    const dirtyPathSet = new Set(workspaceSnapshot.dirty_paths);
+    const dirtyPathSet = new Map();
+    for (const path of workspaceSnapshot.dirty_paths)
+        addSnapshotPath(dirtyPathSet, path, platform);
     for (const [path, fingerprint] of Object.entries(workspaceSnapshot.files)) {
         const absolutePath = resolve(workspaceRoot, path);
         const rel = relative(repoPath, absolutePath);
@@ -292,7 +372,7 @@ export function extractExternalDirtyFiles(workspaceSnapshot, repoPath, workspace
             // 1. Git reports it as dirty (modified/added/deleted/untracked) via dirty_paths, OR
             // 2. It's not tracked by git (untracked file), OR
             // 3. It's explicitly ignored
-            const isDirty = dirtyPathSet.has(path);
+            const isDirty = hasSnapshotPath(dirtyPathSet, path, platform);
             const isUntracked = !fingerprint.tracked;
             const isIgnored = fingerprint.ignored;
             if (isDirty || isUntracked || isIgnored) {
@@ -312,10 +392,17 @@ export function extractExternalDirtyFiles(workspaceSnapshot, repoPath, workspace
  * Returns files that are NEW (not present in baseline) or CHANGED
  * (same path but different sha256, meaning the task modified them).
  */
-export function findNewExternalDirtyFiles(baseline, current) {
-    const baselineMap = new Map(baseline.map((f) => [f.path, f]));
+export function findNewExternalDirtyFiles(baseline, current, platform = process.platform) {
+    const baselineMap = new Map();
+    for (const file of baseline) {
+        const key = comparableSnapshotPath(file.path, platform);
+        baselineMap.set(key, [...(baselineMap.get(key) ?? []), file]);
+    }
     return current.filter((f) => {
-        const baselineFile = baselineMap.get(f.path);
+        const candidates = baselineMap.get(comparableSnapshotPath(f.path, platform)) ?? [];
+        const baselineFile = candidates.length <= 1
+            ? candidates[0]
+            : candidates.find((candidate) => normalizePath(candidate.path) === normalizePath(f.path));
         if (!baselineFile)
             return true; // New path — definitely new
         // Same path but content changed during task execution
@@ -481,9 +568,72 @@ function classificationReason(change) {
 function normalizePath(value) {
     return value.replace(/\\/g, "/");
 }
-function walkWorkspace(root) {
+function comparableSnapshotPath(value, platform = process.platform) {
+    const normalized = normalizePath(value);
+    return platform === "win32" ? normalized.toLowerCase() : normalized;
+}
+function addSnapshotPath(index, value, platform = process.platform) {
+    const normalized = normalizePath(value);
+    const key = comparableSnapshotPath(normalized, platform);
+    const exactPaths = index.get(key) ?? new Set();
+    exactPaths.add(normalized);
+    index.set(key, exactPaths);
+}
+function hasSnapshotPath(index, value, platform = process.platform) {
+    const normalized = normalizePath(value);
+    const exactPaths = index.get(comparableSnapshotPath(normalized, platform));
+    if (!exactPaths)
+        return false;
+    return platform !== "win32" || exactPaths.size <= 1 || exactPaths.has(normalized);
+}
+function pairSnapshotFiles(before, after, platform) {
+    const beforeGroups = groupSnapshotFiles(before, platform);
+    const afterGroups = groupSnapshotFiles(after, platform);
+    const pairs = [];
+    const comparablePaths = [...new Set([...beforeGroups.keys(), ...afterGroups.keys()])].sort();
+    for (const comparablePath of comparablePaths) {
+        const beforeEntries = beforeGroups.get(comparablePath) ?? [];
+        const afterEntries = afterGroups.get(comparablePath) ?? [];
+        if (platform !== "win32" || (beforeEntries.length <= 1 && afterEntries.length <= 1)) {
+            pairs.push({
+                path: afterEntries[0]?.path ?? beforeEntries[0].path,
+                leftPath: beforeEntries[0]?.path,
+                rightPath: afterEntries[0]?.path,
+                left: beforeEntries[0]?.fingerprint,
+                right: afterEntries[0]?.fingerprint,
+            });
+            continue;
+        }
+        // NTFS can opt individual directories into case-sensitive mode. If either
+        // snapshot contains a case collision, preserve every exact path instead of
+        // silently dropping one entry from the evidence.
+        const beforeExact = new Map(beforeEntries.map((entry) => [normalizePath(entry.path), entry]));
+        const afterExact = new Map(afterEntries.map((entry) => [normalizePath(entry.path), entry]));
+        const exactPaths = [...new Set([...beforeExact.keys(), ...afterExact.keys()])].sort();
+        for (const exactPath of exactPaths) {
+            pairs.push({
+                path: afterExact.get(exactPath)?.path ?? beforeExact.get(exactPath).path,
+                leftPath: beforeExact.get(exactPath)?.path,
+                rightPath: afterExact.get(exactPath)?.path,
+                left: beforeExact.get(exactPath)?.fingerprint,
+                right: afterExact.get(exactPath)?.fingerprint,
+            });
+        }
+    }
+    return pairs;
+}
+function groupSnapshotFiles(files, platform) {
+    const grouped = new Map();
+    for (const [path, fingerprint] of Object.entries(files)) {
+        const key = comparableSnapshotPath(path, platform);
+        grouped.set(key, [...(grouped.get(key) ?? []), { path, fingerprint }]);
+    }
+    return grouped;
+}
+function walkWorkspace(root, signal) {
     const result = [];
     const visit = (directory) => {
+        throwIfAborted(signal);
         if (result.length >= MAX_SNAPSHOT_FILES)
             return;
         let entries;
@@ -494,6 +644,7 @@ function walkWorkspace(root) {
             return;
         }
         for (const entry of entries) {
+            throwIfAborted(signal);
             if (result.length >= MAX_SNAPSHOT_FILES)
                 break;
             if (entry.isDirectory() && SKIP_DIRECTORIES.has(entry.name))
@@ -508,14 +659,24 @@ function walkWorkspace(root) {
     visit(root);
     return result;
 }
-function runGit(repoPath, args) {
-    return new Promise((resolve) => {
-        execFile("git", args, {
+function runGit(repoPath, args, signal) {
+    throwIfAborted(signal);
+    return new Promise((resolve, reject) => {
+        const env = buildGitEnvironment(repoPath);
+        const git = resolveTrustedExecutable("git", repoPath, { pathValue: env.PATH });
+        execFile(git, args, {
             cwd: repoPath,
             encoding: "utf-8",
             timeout: 30_000,
             maxBuffer: MAX_DIFF_BYTES,
+            windowsHide: true,
+            env,
+            signal,
         }, (err, stdout, stderr) => {
+            if (signal?.aborted) {
+                reject(abortReason(signal));
+                return;
+            }
             let status;
             if (err) {
                 // err.code is the exit code (number) when the process exited with a non-zero status;
@@ -525,10 +686,31 @@ function runGit(repoPath, args) {
             else {
                 status = 0;
             }
-            resolve({ status, stdout: stdout || "", stderr: stderr || "" });
+            const truncated = Boolean(err
+                && typeof err.code === "string"
+                && err.code.includes("MAXBUFFER"));
+            resolve({ status, stdout: stdout || "", stderr: stderr || "", truncated });
         });
     });
 }
+function throwIfAborted(signal) {
+    if (signal?.aborted)
+        throw abortReason(signal);
+}
+function abortReason(signal) {
+    return signal.reason instanceof Error ? signal.reason : new Error("Operation aborted");
+}
+function utf8Prefix(value, maxBytes) {
+    if (maxBytes <= 0)
+        return "";
+    const encoded = Buffer.from(value, "utf-8");
+    if (encoded.length <= maxBytes)
+        return value;
+    let prefix = encoded.subarray(0, maxBytes).toString("utf-8").replace(/\uFFFD$/u, "");
+    while (Buffer.byteLength(prefix, "utf-8") > maxBytes)
+        prefix = prefix.slice(0, -1);
+    return prefix;
+}
 function hashFileAsync(filePath) {
     return new Promise((resolve, reject) => {
         const hash = createHash("sha256");

package/dist/runner/postTaskCleanup.js

@@ -1,29 +1,50 @@
 import { execFileSync } from "node:child_process";
-import { existsSync, readdirSync, rmSync, statSync, writeFileSync } from "node:fs";
+import { chmodSync, existsSync, lstatSync, readdirSync, rmSync } from "node:fs";
 import { basename, isAbsolute, join, relative, resolve, sep } from "node:path";
 import { platform } from "node:os";
+import { buildGitEnvironment, resolveTrustedExecutable } from "./processSecurity.js";
+import { atomicWriteJsonFileSync } from "../utils/atomicFile.js";
 const isWindows = platform() === "win32";
 /**
  * Remove a file or directory, working around Node.js fs.rmSync issues on Windows
  * where recursive directory deletion silently fails (Node v22+).
- * Falls back to `rmdir /s /q` on Windows if rmSync doesn't remove the path.
+ * On Windows, clears read-only attributes before one bounded native retry.
  */
 function safeRemoveSync(targetPath) {
     rmSync(targetPath, { recursive: true, force: true, maxRetries: 3, retryDelay: 100 });
     if (isWindows && existsSync(targetPath)) {
-        try {
-            const stat = statSync(targetPath);
-            if (stat.isDirectory()) {
-                execFileSync("cmd", ["/c", "rmdir", "/s", "/q", targetPath], { windowsHide: true });
-            }
-            else {
-                execFileSync("cmd", ["/c", "del", "/f", "/q", targetPath], { windowsHide: true });
-            }
-        }
-        catch {
-            // Best effort — caller will verify via existsSync if needed
-        }
+        makeWritableSync(targetPath);
+        rmSync(targetPath, { recursive: true, force: true, maxRetries: 5, retryDelay: 150 });
+    }
+    if (existsSync(targetPath)) {
+        throw new Error(`Cleanup path still exists after bounded retries: ${targetPath}`);
+    }
+}
+function makeWritableSync(targetPath) {
+    let stat;
+    try {
+        stat = lstatSync(targetPath);
+    }
+    catch {
+        return;
+    }
+    if (stat.isSymbolicLink())
+        return;
+    try {
+        chmodSync(targetPath, stat.isDirectory() ? 0o700 : 0o600);
+    }
+    catch { /* best effort */ }
+    if (!stat.isDirectory())
+        return;
+    let entries;
+    try {
+        entries = readdirSync(targetPath);
+    }
+    catch {
+        return;
     }
+    for (const entry of entries)
+        makeWritableSync(join(targetPath, entry));
 }
 const EXCLUDED_DIRS = new Set([".git", ".patchwarden", ".venv", "node_modules", "samples", "docs"]);
 const CLEANUP_DIRS = new Set(["__pycache__", "dist", "release_packages", "temp_files"]);
@@ -63,7 +84,7 @@ export function runPostTaskCleanup(repoPath, taskDir) {
             });
         }
     }
-    writeFileSync(join(taskDir, "post-task-cleanup.json"), JSON.stringify(report, null, 2), "utf-8");
+    atomicWriteJsonFileSync(join(taskDir, "post-task-cleanup.json"), report);
     return report;
 }
 function collectCandidates(root) {
@@ -109,10 +130,12 @@ function hasTrackedGitContent(root, rel) {
     if (!isGitWorktree(root))
         return false;
     try {
-        const output = execFileSync("git", ["ls-files", "--", rel], {
+        const env = buildGitEnvironment(root);
+        const output = execFileSync(resolveTrustedExecutable("git", root, { pathValue: env.PATH }), ["ls-files", "--", rel], {
             cwd: root,
             encoding: "utf-8",
             windowsHide: true,
+            env,
         });
         return output.trim().length > 0;
     }
@@ -123,20 +146,24 @@ function hasTrackedGitContent(root, rel) {
 function isIgnoredOrUntracked(root, rel) {
     if (!isGitWorktree(root))
         return true;
+    const env = buildGitEnvironment(root);
+    const git = resolveTrustedExecutable("git", root, { pathValue: env.PATH });
     try {
-        execFileSync("git", ["check-ignore", "-q", "--", rel], {
+        execFileSync(git, ["check-ignore", "-q", "--", rel], {
             cwd: root,
             stdio: "ignore",
             windowsHide: true,
+            env,
         });
         return true;
     }
     catch {
         try {
-            const output = execFileSync("git", ["ls-files", "--others", "--exclude-standard", "--", rel], {
+            const output = execFileSync(git, ["ls-files", "--others", "--exclude-standard", "--", rel], {
                 cwd: root,
                 encoding: "utf-8",
                 windowsHide: true,
+                env,
             });
             return output.trim().length > 0 || !existsSync(resolve(root, rel));
         }
@@ -147,10 +174,12 @@ function isIgnoredOrUntracked(root, rel) {
 }
 function isGitWorktree(root) {
     try {
-        return execFileSync("git", ["rev-parse", "--is-inside-work-tree"], {
+        const env = buildGitEnvironment(root);
+        return execFileSync(resolveTrustedExecutable("git", root, { pathValue: env.PATH }), ["rev-parse", "--is-inside-work-tree"], {
             cwd: root,
             encoding: "utf-8",
             windowsHide: true,
+            env,
         }).trim() === "true";
     }
     catch {

package/dist/runner/processSecurity.d.ts

@@ -0,0 +1,56 @@
+export declare const DEFAULT_MAX_PROCESS_LOG_BYTES: number;
+export interface ChildEnvironmentOptions {
+    cwd: string;
+    allowedNames?: readonly string[];
+    blockedNames?: readonly string[];
+    sourceEnvironment?: NodeJS.ProcessEnv;
+    platform?: NodeJS.Platform;
+}
+export interface ExecutableResolutionOptions {
+    platform?: NodeJS.Platform;
+    pathValue?: string;
+    pathExtValue?: string;
+    fileExists?: (path: string) => boolean;
+}
+export interface ResolvedProcessCommand {
+    command: string;
+    argsPrefix: string[];
+}
+export interface PreparedProcessCommand {
+    command: string;
+    args: string[];
+}
+/**
+ * Build the environment for a task-owned child. Provider credentials are not
+ * ambient capability: an agent receives them only when their variable names
+ * are explicitly allow-listed in trusted local configuration.
+ */
+export declare function buildChildEnvironment(options: ChildEnvironmentOptions): NodeJS.ProcessEnv;
+/** Build a non-interactive Git environment that disables repo-defined hooks and fsmonitor. */
+export declare function buildGitEnvironment(cwd: string): NodeJS.ProcessEnv;
+/** Resolve a Windows bare command before spawn so CreateProcess never searches cwd. */
+export declare function resolveTrustedExecutable(command: string, cwd: string, options?: ExecutableResolutionOptions): string;
+/**
+ * Resolve Windows package-manager shims to their JavaScript CLI entry point.
+ * This keeps npm/npx/pnpm execution shell-free while still supporting their
+ * normal .cmd installations.
+ */
+export declare function resolvePackageManagerInvocation(managerCommand: string, cwd: string, options?: ExecutableResolutionOptions): ResolvedProcessCommand;
+/** Replace the one supported Windows cmd wrapper with a native Node CLI. */
+export declare function prepareShellFreeCommand(command: string, args: readonly string[], cwd: string, options?: ExecutableResolutionOptions): PreparedProcessCommand;
+/** Parse the intentionally simple allow-listed command grammar without a shell. */
+export declare function resolveTrustedCommandLine(commandLine: string, cwd: string, options?: ExecutableResolutionOptions): ResolvedProcessCommand;
+export declare function sanitizeTrustedPath(pathValue: string, cwd: string, platform?: NodeJS.Platform): string;
+export declare function allowedEnvironmentValues(names: readonly string[] | undefined, sourceEnvironment?: NodeJS.ProcessEnv, platform?: NodeJS.Platform): string[];
+export declare function redactProcessOutput(input: string, exactValues?: readonly string[]): string;
+/** Captures complete process logs up to one auditable, redacted byte budget. */
+export declare class SecureProcessLogCapture {
+    private readonly chunks;
+    private readonly maxBytes;
+    private readonly existingBytes;
+    private capturedBytes;
+    private truncatedPath;
+    constructor(paths: Array<string | undefined>, maxBytes?: number);
+    append(path: string | undefined, chunk: Buffer | string): void;
+    flush(exactValues?: readonly string[]): void;
+}