patchwarden 1.5.1 → 1.6.2

package/dist/tools/{evidencePack.js → tasks/evidencePack.js}

@@ -1,14 +1,16 @@
-import { execSync } from "node:child_process";
-import { existsSync, mkdirSync, readdirSync, readFileSync, writeFileSync } from "node:fs";
+import { execFileSync } from "node:child_process";
+import { existsSync, mkdirSync, readdirSync, readFileSync } from "node:fs";
 import { join, resolve } from "node:path";
-import { getConfig } from "../config.js";
-import { guardReadPath, guardWorkspacePath } from "../security/pathGuard.js";
-import { countRedactionsByCategory, redactSensitiveValue } from "../security/contentRedaction.js";
-import { getProjectPolicySummary } from "../policy/projectPolicy.js";
+import { getConfig } from "../../config.js";
+import { guardReadPath, guardWorkspacePath } from "../../security/pathGuard.js";
+import { countRedactionsByCategory, redactSensitiveValue } from "../../security/contentRedaction.js";
+import { getProjectPolicySummary } from "../../policy/projectPolicy.js";
 import { getTaskLineage } from "./taskLineage.js";
-import { getLastToolCatalogSnapshot } from "./toolCatalog.js";
-import { PATCHWARDEN_VERSION, TOOL_SCHEMA_EPOCH } from "../version.js";
-import { PatchWardenError } from "../errors.js";
+import { getLastToolCatalogSnapshot } from "../catalog/toolCatalog.js";
+import { PATCHWARDEN_VERSION, TOOL_SCHEMA_EPOCH } from "../../version.js";
+import { PatchWardenError } from "../../errors.js";
+import { buildGitEnvironment, resolveTrustedExecutable } from "../../runner/processSecurity.js";
+import { atomicWriteFileSync, atomicWriteJsonFileSync } from "../../utils/atomicFile.js";
 export function exportTaskEvidencePack(input) {
     const lineageId = normalizeLineageId(input.lineage_id);
     const maxItems = normalizeMaxItems(input.max_items);
@@ -35,7 +37,7 @@ export function exportTaskEvidencePack(input) {
     const verifyContent = buildVerifyContent(lineage);
     const diffstatContent = buildDiffstatContent(lineage, config);
     const lineageSummary = buildLineageSummary(lineage);
-    const attestationContent = buildAttestation(catalog, generatedAt);
+    const attestationContent = buildAttestation(catalog, generatedAt, lineage.repo_path, config.workspaceRoot);
     // Count redactions across all v2 raw contents for the audit trail.
     const v2RawPayloads = [
         riskContent,
@@ -62,12 +64,12 @@ export function exportTaskEvidencePack(input) {
         note: "Only categories and counts are recorded; original secret values are never persisted.",
     };
     // Redact and write each v2 file.
-    writeFileSync(filePaths.risk, JSON.stringify(redactSensitiveValue(riskContent).value, null, 2) + "\n", "utf-8");
-    writeFileSync(filePaths.verify, JSON.stringify(redactSensitiveValue(verifyContent).value, null, 2) + "\n", "utf-8");
-    writeFileSync(filePaths.diffstat, JSON.stringify(redactSensitiveValue(diffstatContent).value, null, 2) + "\n", "utf-8");
-    writeFileSync(filePaths.lineage, JSON.stringify(redactSensitiveValue(lineageSummary).value, null, 2) + "\n", "utf-8");
-    writeFileSync(filePaths.attestation, JSON.stringify(redactSensitiveValue(attestationContent).value, null, 2) + "\n", "utf-8");
-    writeFileSync(filePaths.redactions, JSON.stringify(redactSensitiveValue(redactionsContent).value, null, 2) + "\n", "utf-8");
+    atomicWriteJsonFileSync(filePaths.risk, redactSensitiveValue(riskContent).value);
+    atomicWriteJsonFileSync(filePaths.verify, redactSensitiveValue(verifyContent).value);
+    atomicWriteJsonFileSync(filePaths.diffstat, redactSensitiveValue(diffstatContent).value);
+    atomicWriteJsonFileSync(filePaths.lineage, redactSensitiveValue(lineageSummary).value);
+    atomicWriteJsonFileSync(filePaths.attestation, redactSensitiveValue(attestationContent).value);
+    atomicWriteJsonFileSync(filePaths.redactions, redactSensitiveValue(redactionsContent).value);
     const safePack = redactSensitiveValue({
         evidence_pack_id: `evidence_${lineageId}`,
         lineage_id: lineageId,
@@ -94,8 +96,8 @@ export function exportTaskEvidencePack(input) {
         next_action: buildNextAction(lineage),
         bounded: true,
     }).value;
-    writeFileSync(safePack.files.json, JSON.stringify(safePack, null, 2) + "\n", "utf-8");
-    writeFileSync(safePack.files.markdown, buildEvidenceMarkdown(safePack), "utf-8");
+    atomicWriteJsonFileSync(safePack.files.json, safePack);
+    atomicWriteFileSync(safePack.files.markdown, buildEvidenceMarkdown(safePack));
     return safePack;
 }
 export function listEvidencePacks(options = {}) {
@@ -308,19 +310,29 @@ function buildLineageSummary(lineage) {
         truncated: lineage.truncated,
     };
 }
-function readGitCommitShort() {
+function readGitCommitShort(repoPath, workspaceRoot) {
     try {
-        return execSync("git rev-parse --short HEAD", { encoding: "utf-8", timeout: 5000 }).trim();
+        const cwd = guardWorkspacePath(repoPath || ".", workspaceRoot);
+        const env = buildGitEnvironment(cwd);
+        const git = resolveTrustedExecutable("git", cwd, { pathValue: env.PATH });
+        return execFileSync(git, ["rev-parse", "--short", "HEAD"], {
+            cwd,
+            encoding: "utf-8",
+            env,
+            stdio: ["ignore", "pipe", "ignore"],
+            timeout: 5000,
+            windowsHide: true,
+        }).trim();
     }
     catch {
         return "unknown";
     }
 }
-function buildAttestation(catalog, generatedAt) {
+function buildAttestation(catalog, generatedAt, repoPath, workspaceRoot) {
     return {
         patchwarden_version: PATCHWARDEN_VERSION,
         package_version: PATCHWARDEN_VERSION,
-        commit: readGitCommitShort(),
+        commit: readGitCommitShort(repoPath, workspaceRoot),
         node_version: process.version,
         os: { platform: process.platform, arch: process.arch },
         tool_profile: catalog.tool_profile,

package/dist/tools/{getTaskFile.js → tasks/getTaskFile.js}

@@ -1,9 +1,9 @@
 import { readFileSync, existsSync, statSync } from "node:fs";
 import { resolve, join } from "node:path";
-import { getTasksDir, getConfig } from "../config.js";
-import { guardPath } from "../security/pathGuard.js";
-import { guardSensitivePath } from "../security/sensitiveGuard.js";
-import { redactSensitiveContent } from "../security/contentRedaction.js";
+import { getTasksDir, getConfig } from "../../config.js";
+import { guardPath } from "../../security/pathGuard.js";
+import { guardSensitivePath } from "../../security/sensitiveGuard.js";
+import { redactSensitiveContent } from "../../security/contentRedaction.js";
 import { getTaskStatus } from "./getTaskStatus.js";
 export const TASK_READ_ONLY_FILES = [
     "result.md",

package/dist/tools/{getTaskStatus.d.ts → tasks/getTaskStatus.d.ts}

@@ -1,6 +1,6 @@
 import type { TaskStatus } from "./createTask.js";
 import type { TaskPhase } from "./createTask.js";
-import { type PendingReason, type WatcherStatusSnapshot } from "../watcherStatus.js";
+import { type PendingReason, type WatcherStatusSnapshot } from "../../watcherStatus.js";
 export interface GetTaskStatusOutput {
     task_id: string;
     plan_id: string;
@@ -28,6 +28,11 @@ export interface GetTaskStatusOutput {
         path: string;
         change: string;
     }>;
+    new_out_of_scope_changes?: Array<{
+        path: string;
+        change: string;
+    }>;
+    artifact_hygiene_counts?: Record<string, unknown>;
     verify_status?: "passed" | "failed" | "skipped";
     verify_commands?: string[];
     diff_available?: boolean;

package/dist/tools/{getTaskStatus.js → tasks/getTaskStatus.js}

@@ -1,10 +1,11 @@
 import { readFileSync, existsSync } from "node:fs";
 import { resolve, join } from "node:path";
-import { getTasksDir, getConfig } from "../config.js";
-import { guardReadPath } from "../security/pathGuard.js";
-import { guardSensitivePath } from "../security/sensitiveGuard.js";
-import { readTaskRuntime } from "../taskRuntime.js";
-import { derivePendingReason, readWatcherStatus, } from "../watcherStatus.js";
+import { getTasksDir, getConfig } from "../../config.js";
+import { guardReadPath } from "../../security/pathGuard.js";
+import { guardSensitivePath } from "../../security/sensitiveGuard.js";
+import { readTaskRuntime } from "../../runner/taskRuntime.js";
+import { derivePendingReason, readWatcherStatus, } from "../../watcherStatus.js";
+import { isTerminalTaskStatus } from "./taskStates.js";
 export function getTaskStatus(taskId) {
     const config = getConfig();
     const tasksDir = getTasksDir(config);
@@ -18,7 +19,11 @@ export function getTaskStatus(taskId) {
     const raw = readFileSync(statusFile, "utf-8");
     const status = JSON.parse(raw);
     const runtime = readTaskRuntime(taskDir);
-    const phase = runtime.phase || status.phase || "queued";
+    // A terminal status is authoritative. A stale runtime phase from a crashed
+    // Runner must never make a reconciled task look active again.
+    const phase = isTerminalTaskStatus(String(status.status))
+        ? status.phase || "queued"
+        : runtime.phase || status.phase || "queued";
     const watcher = readWatcherStatus(config);
     const pendingReason = derivePendingReason({ status: status.status, phase }, watcher);
     return {

package/dist/tools/{getTaskStdoutTail.js → tasks/getTaskStdoutTail.js}

@@ -1,8 +1,9 @@
-import { readFileSync, existsSync } from "node:fs";
+import { existsSync } from "node:fs";
 import { join } from "node:path";
-import { getTasksDir, getConfig } from "../config.js";
-import { guardReadPath } from "../security/pathGuard.js";
-import { redactSensitiveContent } from "../security/contentRedaction.js";
+import { getTasksDir, getConfig } from "../../config.js";
+import { guardReadPath } from "../../security/pathGuard.js";
+import { redactSensitiveContent } from "../../security/contentRedaction.js";
+import { readTextFilePrefixSync, readTextFileTailLinesSync } from "../../utils/boundedFile.js";
 export function getTaskStdoutTail(taskId, lines = 80) {
     const config = getConfig();
     const tasksDir = getTasksDir(config);
@@ -16,29 +17,30 @@ export function getTaskStdoutTail(taskId, lines = 80) {
     const stdoutLog = join(taskDir, "stdout.log");
     const stderrLog = join(taskDir, "stderr.log");
     const resultFile = join(taskDir, "result.md");
-    const maxLines = Math.min(lines, 200);
+    const maxLines = Number.isFinite(lines)
+        ? Math.max(1, Math.min(200, Math.trunc(lines)))
+        : 80;
+    const stderrLines = Math.min(maxLines, 40);
     let stdoutTail = "";
     let stderrTail = "";
     let source = "none";
     // All log files are optional — don't throw if missing
     if (existsSync(stdoutLog)) {
-        const raw = readFileSync(stdoutLog, "utf-8");
-        stdoutTail = raw.split("\n").slice(-maxLines).join("\n");
+        stdoutTail = readTextFileTailLinesSync(stdoutLog, maxLines, config.maxReadFileBytes);
         source = "stdout.log";
     }
     if (existsSync(stderrLog)) {
-        const raw = readFileSync(stderrLog, "utf-8");
-        stderrTail = raw.split("\n").slice(-Math.min(maxLines, 40)).join("\n");
+        stderrTail = readTextFileTailLinesSync(stderrLog, stderrLines, config.maxReadFileBytes);
     }
     // Fallback to result.md
     if (!stdoutTail && existsSync(resultFile)) {
-        const raw = readFileSync(resultFile, "utf-8");
+        const raw = readTextFilePrefixSync(resultFile, config.maxReadFileBytes).content;
         const stdoutMatch = raw.match(/## Agent stdout\s*\n+```\s*([\s\S]*?)```/i);
         const stderrMatch = raw.match(/## Agent stderr\s*\n+```\s*([\s\S]*?)```/i);
         if (stdoutMatch)
             stdoutTail = stdoutMatch[1].split("\n").slice(-maxLines).join("\n");
         if (stderrMatch && !stderrTail)
-            stderrTail = stderrMatch[1].split("\n").slice(-Math.min(maxLines, 40)).join("\n");
+            stderrTail = stderrMatch[1].split("\n").slice(-stderrLines).join("\n");
         if (source === "none")
             source = "result.md";
     }

package/dist/tools/{getTaskSummary.js → tasks/getTaskSummary.js}

@@ -1,18 +1,11 @@
-import { existsSync, readFileSync } from "node:fs";
+import { existsSync } from "node:fs";
 import { join, resolve } from "node:path";
-import { getConfig, getTasksDir } from "../config.js";
-import { guardReadPath } from "../security/pathGuard.js";
+import { getConfig, getTasksDir } from "../../config.js";
+import { guardReadPath } from "../../security/pathGuard.js";
 import { getTaskStatus } from "./getTaskStatus.js";
-import { redactSensitiveValue } from "../security/contentRedaction.js";
-const TERMINAL_STATUSES = new Set([
-    "done",
-    "done_by_agent",
-    "failed",
-    "failed_verification",
-    "failed_scope_violation",
-    "failed_policy_violation",
-    "canceled",
-]);
+import { redactSensitiveValue } from "../../security/contentRedaction.js";
+import { readTextFilePrefixSync, readTextFileTailLinesSync, } from "../../utils/boundedFile.js";
+import { isTerminalTaskStatus } from "./taskStates.js";
 export function getTaskSummary(taskId, options = {}) {
     const config = getConfig();
     const taskDir = resolve(getTasksDir(config), taskId);
@@ -23,14 +16,15 @@ export function getTaskSummary(taskId, options = {}) {
     const verifyRead = tryReadJson(join(taskDir, "verify.json"));
     const result = resultRead.data;
     const verify = verifyRead.data;
-    const terminal = TERMINAL_STATUSES.has(String(status.status));
+    const terminal = isTerminalTaskStatus(String(status.status));
     // Phase 4: Use new_out_of_scope_changes (task-caused) for acceptance status.
     // Pre-existing external dirty files that didn't change should NOT fail acceptance.
     const outOfScope = asArray(result.new_out_of_scope_changes
         ?? status.new_out_of_scope_changes
         ?? result.out_of_scope_changes
         ?? status.out_of_scope_changes);
-    const verifyStatus = String(verify.status ?? result.verify_status ?? result.verify?.status ?? status.verify_status ?? "not_available");
+    const resultVerify = asRecord(result.verify);
+    const verifyStatus = String(verify.status ?? result.verify_status ?? resultVerify.status ?? status.verify_status ?? "not_available");
     const errors = [status.error, ...asArray(result.errors), ...asArray(result.known_issues)]
         .filter((value) => typeof value === "string" && value.trim() !== "");
     const warnings = asArray(result.warnings).filter((value) => typeof value === "string");
@@ -61,16 +55,16 @@ export function getTaskSummary(taskId, options = {}) {
     const acceptanceFile = join(taskDir, "acceptance.json");
     if (existsSync(acceptanceFile)) {
         try {
-            const acceptance = JSON.parse(readFileSync(acceptanceFile, "utf-8"));
+            const acceptance = asRecord(JSON.parse(readTextFilePrefixSync(acceptanceFile, 1024 * 1024).content));
             if (acceptance.status === "accepted") {
                 acceptanceStatus = "ready_for_review";
-                acceptanceReviewedAt = acceptance.reviewed_at || null;
-                acceptanceReviewer = acceptance.reviewer || null;
+                acceptanceReviewedAt = typeof acceptance.reviewed_at === "string" ? acceptance.reviewed_at : null;
+                acceptanceReviewer = typeof acceptance.reviewer === "string" ? acceptance.reviewer : null;
             }
             else if (acceptance.status === "rejected") {
                 acceptanceStatus = "failed";
-                acceptanceReviewedAt = acceptance.reviewed_at || null;
-                acceptanceReviewer = acceptance.reviewer || null;
+                acceptanceReviewedAt = typeof acceptance.reviewed_at === "string" ? acceptance.reviewed_at : null;
+                acceptanceReviewer = typeof acceptance.reviewer === "string" ? acceptance.reviewer : null;
                 if (acceptance.notes) {
                     warnings.push(`Task was rejected by ${acceptance.reviewer || "human"} at ${acceptance.reviewed_at || "unknown time"}: ${acceptance.notes}`);
                 }
@@ -102,11 +96,13 @@ export function getTaskSummary(taskId, options = {}) {
     const artifactHygiene = asRecord(result.artifact_hygiene ?? changedFilesRead.data.artifact_hygiene ?? {
         counts: status.artifact_hygiene_counts || {},
     });
-    const verifyCommands = asArray(verify.commands ?? result.verify_commands ?? result.verify?.commands);
+    const verifyCommands = asArray(verify.commands ?? result.verify_commands ?? resultVerify.commands);
     const testLogSummary = summarizeTestLog(join(taskDir, "test.log"));
     const verificationSummary = buildVerificationSummary(verifyStatus, verifyCommands, testLogSummary);
     // Extract failed command detail from verify records
-    const failedVerify = verifyCommands.find((cmd) => ["failed", "timed_out", "canceled"].includes(cmd?.status));
+    const failedVerify = verifyCommands
+        .map(asRecord)
+        .find((command) => ["failed", "timed_out", "canceled"].includes(String(command.status || "")));
     const failedCommandDetail = failedVerify ? {
         command: String(failedVerify.command || ""),
         exit_code: failedVerify.exit_code ?? null,
@@ -145,7 +141,7 @@ export function getTaskSummary(taskId, options = {}) {
         test_summary: verificationSummary.headline,
         diff_available: Boolean((status.diff_available ?? (changedFiles.length > 0)) &&
             (artifacts["diff.patch"] || artifacts["git.diff"])),
-        diff_truncated: Boolean(status.diff_truncated || result.warnings?.some?.((warning) => warning.includes("diff.patch was truncated"))),
+        diff_truncated: Boolean(status.diff_truncated || asArray(result.warnings).some((warning) => typeof warning === "string" && warning.includes("diff.patch was truncated"))),
         result_available: artifacts["result.md"],
         result_json_available: artifacts["result.json"],
         verify_available: artifacts["verify.json"],
@@ -194,7 +190,9 @@ function buildCompactSummary(output, maxItems) {
     const manifestRead = tryReadJson(join(taskDir, "artifact_manifest.json"));
     const manifest = asRecord(manifestRead.data);
     const releaseArtifacts = asArray(manifest.artifacts);
-    const releaseArtifactPaths = releaseArtifacts.map((a) => String(a.path || "")).slice(0, maxItems);
+    const releaseArtifactPaths = releaseArtifacts
+        .map((artifact) => String(asRecord(artifact).path || ""))
+        .slice(0, maxItems);
     const compact = {
         view: "compact",
         task_id: String(output.task_id),
@@ -243,7 +241,7 @@ function tryReadJson(path) {
     if (!existsSync(path))
         return { data: {} };
     try {
-        return { data: JSON.parse(readFileSync(path, "utf-8")) };
+        return { data: asRecord(JSON.parse(readTextFilePrefixSync(path, 2 * 1024 * 1024).content)) };
     }
     catch (error) {
         return { data: {}, error: error instanceof Error ? error.message : String(error) };
@@ -253,27 +251,30 @@ function asArray(value) {
     return Array.isArray(value) ? value : [];
 }
 function asRecord(value) {
-    return value && typeof value === "object" && !Array.isArray(value) ? value : {};
+    return value && typeof value === "object" && !Array.isArray(value)
+        ? value
+        : {};
 }
 function summarizeTestLog(path) {
     if (!existsSync(path))
         return "test.log missing";
-    const text = readFileSync(path, "utf-8");
+    const text = readTextFileTailLinesSync(path, 200, 512 * 1024);
     const exit = text.match(/Exit\s*code:\s*([^\r\n]+)/i)?.[1]?.trim();
     return exit ? `Exit code: ${exit}` : text.trim().slice(0, 500) || "test.log empty";
 }
 function readResultFallback(path) {
     if (!existsSync(path))
         return "";
-    const text = readFileSync(path, "utf-8");
+    const text = readTextFilePrefixSync(path, 1024 * 1024).content;
     return text.match(/## Summary\s+([\s\S]*?)(?:\n## |\n---|$)/i)?.[1]?.trim().slice(0, 1000) || "";
 }
 function buildVerificationSummary(status, commands, testLogSummary) {
-    const passed = commands.filter((command) => command?.status === "passed").length;
-    const failed = commands.filter((command) => ["failed", "timed_out", "canceled"].includes(command?.status)).length;
-    const skipped = commands.filter((command) => command?.status === "skipped").length;
+    const commandRecords = commands.map(asRecord);
+    const passed = commandRecords.filter((command) => command.status === "passed").length;
+    const failed = commandRecords.filter((command) => ["failed", "timed_out", "canceled"].includes(String(command.status || ""))).length;
+    const skipped = commandRecords.filter((command) => command.status === "skipped").length;
     const evidenceText = [
-        ...commands.flatMap((command) => [command?.stdout_tail, command?.stderr_tail]),
+        ...commandRecords.flatMap((command) => [command.stdout_tail, command.stderr_tail]),
         testLogSummary,
     ].filter((value) => typeof value === "string").join("\n");
     const headline = extractTestHeadline(evidenceText)
@@ -304,10 +305,8 @@ function readLogTail(path, lines) {
     if (!existsSync(path))
         return "(file not found)";
     try {
-        const raw = readFileSync(path, "utf-8");
-        if (raw.length === 0)
-            return "(empty)";
-        return raw.split("\n").slice(-lines).join("\n");
+        const tail = readTextFileTailLinesSync(path, lines);
+        return tail || "(empty)";
     }
     catch {
         return "(unreadable)";

package/dist/tools/tasks/index.d.ts

@@ -0,0 +1,18 @@
+export * from "./cancelTask.js";
+export * from "./createTask.js";
+export * from "./diagnoseTask.js";
+export * from "./evidencePack.js";
+export * from "./getTaskFile.js";
+export * from "./getTaskProgress.js";
+export * from "./getTaskStatus.js";
+export * from "./getTaskStdoutTail.js";
+export * from "./getTaskSummary.js";
+export * from "./killTask.js";
+export * from "./listTasks.js";
+export * from "./reconcileTasks.js";
+export * from "./retryTask.js";
+export * from "./runTaskLoop.js";
+export * from "./runVerification.js";
+export * from "./taskLineage.js";
+export * from "./taskOutputs.js";
+export * from "./waitForTask.js";

package/dist/tools/tasks/index.js

@@ -0,0 +1,18 @@
+export * from "./cancelTask.js";
+export * from "./createTask.js";
+export * from "./diagnoseTask.js";
+export * from "./evidencePack.js";
+export * from "./getTaskFile.js";
+export * from "./getTaskProgress.js";
+export * from "./getTaskStatus.js";
+export * from "./getTaskStdoutTail.js";
+export * from "./getTaskSummary.js";
+export * from "./killTask.js";
+export * from "./listTasks.js";
+export * from "./reconcileTasks.js";
+export * from "./retryTask.js";
+export * from "./runTaskLoop.js";
+export * from "./runVerification.js";
+export * from "./taskLineage.js";
+export * from "./taskOutputs.js";
+export * from "./waitForTask.js";

package/dist/tools/tasks/killTask.d.ts

@@ -0,0 +1 @@
+export declare function killTask(taskId: string): import("./cancelTask.js").TaskTerminationResponse;

package/dist/tools/{listTasks.d.ts → tasks/listTasks.d.ts}

@@ -1,5 +1,5 @@
 import type { TaskPhase, TaskStatus, AcceptanceStatus } from "./createTask.js";
-import { type PendingReason, type WatcherState, type WatcherStatusSnapshot } from "../watcherStatus.js";
+import { type PendingReason, type WatcherState, type WatcherStatusSnapshot } from "../../watcherStatus.js";
 export interface TaskEntry {
     task_id: string;
     plan_id: string;

package/dist/tools/{listTasks.js → tasks/listTasks.js}

@@ -1,8 +1,9 @@
 import { readdirSync, readFileSync, existsSync, statSync } from "node:fs";
 import { join } from "node:path";
-import { getTasksDir, getPlansDir, getConfig } from "../config.js";
-import { readTaskRuntime } from "../taskRuntime.js";
-import { derivePendingReason, readWatcherStatus, } from "../watcherStatus.js";
+import { getTasksDir, getPlansDir, getConfig } from "../../config.js";
+import { readTaskRuntime } from "../../runner/taskRuntime.js";
+import { derivePendingReason, readWatcherStatus, } from "../../watcherStatus.js";
+import { isActiveTaskStatus } from "./taskStates.js";
 export function listTasks(input) {
     const config = getConfig();
     const tasksDir = getTasksDir(config);
@@ -48,7 +49,7 @@ export function listTasks(input) {
                 if (taskAcceptance !== filterAcceptance)
                     continue;
             }
-            if (input?.active_only && !["pending", "running", "collecting_artifacts"].includes(String(data.status)))
+            if (input?.active_only && !isActiveTaskStatus(String(data.status)))
                 continue;
             const normalizedRepo = String(data.repo_path || ".").replace(/\\/g, "/");
             const normalizedResolvedRepo = String(data.resolved_repo_path || "").replace(/\\/g, "/");

package/dist/tools/{reconcileTasks.d.ts → tasks/reconcileTasks.d.ts}

@@ -1,10 +1,11 @@
-import { type PatchWardenConfig } from "../config.js";
+import { type PatchWardenConfig } from "../../config.js";
 import { type DiagnosisType, type DiagnosisConfidence, type SafeAction } from "./diagnoseTask.js";
 export type ReconcileMode = "report_only" | "safe_fix";
 export interface ReconcileTasksInput {
     max_age_minutes?: number;
     mode?: ReconcileMode;
     include_done_candidates?: boolean;
+    task_ids?: string[];
 }
 export interface ReconcileTaskReport {
     task_id: string;
@@ -15,7 +16,7 @@ export interface ReconcileTaskReport {
     reasons: string[];
     safe_actions: SafeAction[];
     age_seconds: number | null;
-    action_taken: "left_unchanged" | "marked_failed_stale" | "marked_orphaned" | "marked_done_by_agent";
+    action_taken: "left_unchanged" | "marked_failed_stale" | "marked_orphaned" | "marked_done_by_agent" | "marked_canceled" | "marked_timed_out";
     previous_status: string | null;
     new_status: string | null;
     applied_at: string | null;