patchwarden 1.5.1 → 1.6.2

package/src/tools/{evidencePack.ts → tasks/evidencePack.ts}

@@ -1,14 +1,16 @@
-import { execSync } from "node:child_process";
-import { existsSync, mkdirSync, readdirSync, readFileSync, writeFileSync } from "node:fs";
+import { execFileSync } from "node:child_process";
+import { existsSync, mkdirSync, readdirSync, readFileSync } from "node:fs";
 import { join, resolve } from "node:path";
-import { getConfig } from "../config.js";
-import { guardReadPath, guardWorkspacePath } from "../security/pathGuard.js";
-import { countRedactionsByCategory, redactSensitiveValue } from "../security/contentRedaction.js";
-import { getProjectPolicySummary } from "../policy/projectPolicy.js";
+import { getConfig } from "../../config.js";
+import { guardReadPath, guardWorkspacePath } from "../../security/pathGuard.js";
+import { countRedactionsByCategory, redactSensitiveValue } from "../../security/contentRedaction.js";
+import { getProjectPolicySummary } from "../../policy/projectPolicy.js";
 import { getTaskLineage, type SafeTaskLineage } from "./taskLineage.js";
-import { getLastToolCatalogSnapshot } from "./toolCatalog.js";
-import { PATCHWARDEN_VERSION, TOOL_SCHEMA_EPOCH } from "../version.js";
-import { PatchWardenError } from "../errors.js";
+import { getLastToolCatalogSnapshot } from "../catalog/toolCatalog.js";
+import { PATCHWARDEN_VERSION, TOOL_SCHEMA_EPOCH } from "../../version.js";
+import { PatchWardenError } from "../../errors.js";
+import { buildGitEnvironment, resolveTrustedExecutable } from "../../runner/processSecurity.js";
+import { atomicWriteFileSync, atomicWriteJsonFileSync } from "../../utils/atomicFile.js";
 
 export interface SafeEvidencePack {
   evidence_pack_id: string;
@@ -72,7 +74,7 @@ export function exportTaskEvidencePack(input: { lineage_id: string; max_items?:
   const verifyContent = buildVerifyContent(lineage);
   const diffstatContent = buildDiffstatContent(lineage, config);
   const lineageSummary = buildLineageSummary(lineage);
-  const attestationContent = buildAttestation(catalog, generatedAt);
+  const attestationContent = buildAttestation(catalog, generatedAt, lineage.repo_path, config.workspaceRoot);
 
   // Count redactions across all v2 raw contents for the audit trail.
   const v2RawPayloads = [
@@ -99,12 +101,12 @@ export function exportTaskEvidencePack(input: { lineage_id: string; max_items?:
   };
 
   // Redact and write each v2 file.
-  writeFileSync(filePaths.risk, JSON.stringify(redactSensitiveValue(riskContent).value, null, 2) + "\n", "utf-8");
-  writeFileSync(filePaths.verify, JSON.stringify(redactSensitiveValue(verifyContent).value, null, 2) + "\n", "utf-8");
-  writeFileSync(filePaths.diffstat, JSON.stringify(redactSensitiveValue(diffstatContent).value, null, 2) + "\n", "utf-8");
-  writeFileSync(filePaths.lineage, JSON.stringify(redactSensitiveValue(lineageSummary).value, null, 2) + "\n", "utf-8");
-  writeFileSync(filePaths.attestation, JSON.stringify(redactSensitiveValue(attestationContent).value, null, 2) + "\n", "utf-8");
-  writeFileSync(filePaths.redactions, JSON.stringify(redactSensitiveValue(redactionsContent).value, null, 2) + "\n", "utf-8");
+  atomicWriteJsonFileSync(filePaths.risk, redactSensitiveValue(riskContent).value);
+  atomicWriteJsonFileSync(filePaths.verify, redactSensitiveValue(verifyContent).value);
+  atomicWriteJsonFileSync(filePaths.diffstat, redactSensitiveValue(diffstatContent).value);
+  atomicWriteJsonFileSync(filePaths.lineage, redactSensitiveValue(lineageSummary).value);
+  atomicWriteJsonFileSync(filePaths.attestation, redactSensitiveValue(attestationContent).value);
+  atomicWriteJsonFileSync(filePaths.redactions, redactSensitiveValue(redactionsContent).value);
 
   const safePack = redactSensitiveValue({
     evidence_pack_id: `evidence_${lineageId}`,
@@ -133,8 +135,8 @@ export function exportTaskEvidencePack(input: { lineage_id: string; max_items?:
     bounded: true,
   }).value as SafeEvidencePack;
 
-  writeFileSync(safePack.files.json, JSON.stringify(safePack, null, 2) + "\n", "utf-8");
-  writeFileSync(safePack.files.markdown, buildEvidenceMarkdown(safePack), "utf-8");
+  atomicWriteJsonFileSync(safePack.files.json, safePack);
+  atomicWriteFileSync(safePack.files.markdown, buildEvidenceMarkdown(safePack));
   return safePack;
 }
 
@@ -410,9 +412,19 @@ function buildLineageSummary(lineage: SafeTaskLineage): {
   };
 }
 
-function readGitCommitShort(): string {
+function readGitCommitShort(repoPath: string, workspaceRoot: string): string {
   try {
-    return execSync("git rev-parse --short HEAD", { encoding: "utf-8", timeout: 5000 }).trim();
+    const cwd = guardWorkspacePath(repoPath || ".", workspaceRoot);
+    const env = buildGitEnvironment(cwd);
+    const git = resolveTrustedExecutable("git", cwd, { pathValue: env.PATH });
+    return execFileSync(git, ["rev-parse", "--short", "HEAD"], {
+      cwd,
+      encoding: "utf-8",
+      env,
+      stdio: ["ignore", "pipe", "ignore"],
+      timeout: 5000,
+      windowsHide: true,
+    }).trim();
   } catch {
     return "unknown";
   }
@@ -420,7 +432,9 @@ function readGitCommitShort(): string {
 
 function buildAttestation(
   catalog: SafeEvidencePack["catalog"],
-  generatedAt: string
+  generatedAt: string,
+  repoPath: string,
+  workspaceRoot: string,
 ): {
   patchwarden_version: string;
   package_version: string;
@@ -434,7 +448,7 @@ function buildAttestation(
   return {
     patchwarden_version: PATCHWARDEN_VERSION,
     package_version: PATCHWARDEN_VERSION,
-    commit: readGitCommitShort(),
+    commit: readGitCommitShort(repoPath, workspaceRoot),
     node_version: process.version,
     os: { platform: process.platform, arch: process.arch },
     tool_profile: catalog.tool_profile,

package/src/tools/{getTaskFile.ts → tasks/getTaskFile.ts}

@@ -1,9 +1,9 @@
 import { readFileSync, existsSync, statSync } from "node:fs";
 import { resolve, join } from "node:path";
-import { getTasksDir, getConfig } from "../config.js";
-import { guardPath } from "../security/pathGuard.js";
-import { guardSensitivePath } from "../security/sensitiveGuard.js";
-import { redactSensitiveContent } from "../security/contentRedaction.js";
+import { getTasksDir, getConfig } from "../../config.js";
+import { guardPath } from "../../security/pathGuard.js";
+import { guardSensitivePath } from "../../security/sensitiveGuard.js";
+import { redactSensitiveContent } from "../../security/contentRedaction.js";
 import { getTaskStatus } from "./getTaskStatus.js";
 
 export interface GetTaskFileOutput {

package/src/tools/{getTaskStatus.ts → tasks/getTaskStatus.ts}

@@ -1,17 +1,18 @@
 import { readFileSync, existsSync } from "node:fs";
 import { resolve, join } from "node:path";
-import { getTasksDir, getConfig } from "../config.js";
-import { guardReadPath } from "../security/pathGuard.js";
-import { guardSensitivePath } from "../security/sensitiveGuard.js";
+import { getTasksDir, getConfig } from "../../config.js";
+import { guardReadPath } from "../../security/pathGuard.js";
+import { guardSensitivePath } from "../../security/sensitiveGuard.js";
 import type { TaskStatus } from "./createTask.js";
 import type { TaskPhase } from "./createTask.js";
-import { readTaskRuntime } from "../taskRuntime.js";
+import { readTaskRuntime } from "../../runner/taskRuntime.js";
 import {
   derivePendingReason,
   readWatcherStatus,
   type PendingReason,
   type WatcherStatusSnapshot,
-} from "../watcherStatus.js";
+} from "../../watcherStatus.js";
+import { isTerminalTaskStatus } from "./taskStates.js";
 
 export interface GetTaskStatusOutput {
   task_id: string;
@@ -34,6 +35,8 @@ export interface GetTaskStatusOutput {
   finished_at?: string;
   changed_files?: Array<{ path: string; change: string }>;
   out_of_scope_changes?: Array<{ path: string; change: string }>;
+  new_out_of_scope_changes?: Array<{ path: string; change: string }>;
+  artifact_hygiene_counts?: Record<string, unknown>;
   verify_status?: "passed" | "failed" | "skipped";
   verify_commands?: string[];
   diff_available?: boolean;
@@ -67,7 +70,11 @@ export function getTaskStatus(taskId: string): GetTaskStatusOutput {
   const raw = readFileSync(statusFile, "utf-8");
   const status = JSON.parse(raw) as GetTaskStatusOutput;
   const runtime = readTaskRuntime(taskDir);
-  const phase = runtime.phase || status.phase || "queued";
+  // A terminal status is authoritative. A stale runtime phase from a crashed
+  // Runner must never make a reconciled task look active again.
+  const phase = isTerminalTaskStatus(String(status.status))
+    ? status.phase || "queued"
+    : runtime.phase || status.phase || "queued";
   const watcher = readWatcherStatus(config);
   const pendingReason = derivePendingReason({ status: status.status, phase }, watcher);
   return {

package/src/tools/{getTaskStdoutTail.ts → tasks/getTaskStdoutTail.ts}

@@ -1,8 +1,9 @@
-import { readFileSync, existsSync } from "node:fs";
+import { existsSync } from "node:fs";
 import { join } from "node:path";
-import { getTasksDir, getConfig } from "../config.js";
-import { guardReadPath } from "../security/pathGuard.js";
-import { redactSensitiveContent } from "../security/contentRedaction.js";
+import { getTasksDir, getConfig } from "../../config.js";
+import { guardReadPath } from "../../security/pathGuard.js";
+import { redactSensitiveContent } from "../../security/contentRedaction.js";
+import { readTextFilePrefixSync, readTextFileTailLinesSync } from "../../utils/boundedFile.js";
 
 export function getTaskStdoutTail(taskId: string, lines = 80) {
   const config = getConfig();
@@ -19,7 +20,10 @@ export function getTaskStdoutTail(taskId: string, lines = 80) {
   const stdoutLog = join(taskDir, "stdout.log");
   const stderrLog = join(taskDir, "stderr.log");
   const resultFile = join(taskDir, "result.md");
-  const maxLines = Math.min(lines, 200);
+  const maxLines = Number.isFinite(lines)
+    ? Math.max(1, Math.min(200, Math.trunc(lines)))
+    : 80;
+  const stderrLines = Math.min(maxLines, 40);
 
   let stdoutTail = "";
   let stderrTail = "";
@@ -27,22 +31,20 @@ export function getTaskStdoutTail(taskId: string, lines = 80) {
 
   // All log files are optional — don't throw if missing
   if (existsSync(stdoutLog)) {
-    const raw = readFileSync(stdoutLog, "utf-8");
-    stdoutTail = raw.split("\n").slice(-maxLines).join("\n");
+    stdoutTail = readTextFileTailLinesSync(stdoutLog, maxLines, config.maxReadFileBytes);
     source = "stdout.log";
   }
   if (existsSync(stderrLog)) {
-    const raw = readFileSync(stderrLog, "utf-8");
-    stderrTail = raw.split("\n").slice(-Math.min(maxLines, 40)).join("\n");
+    stderrTail = readTextFileTailLinesSync(stderrLog, stderrLines, config.maxReadFileBytes);
   }
 
   // Fallback to result.md
   if (!stdoutTail && existsSync(resultFile)) {
-    const raw = readFileSync(resultFile, "utf-8");
+    const raw = readTextFilePrefixSync(resultFile, config.maxReadFileBytes).content;
     const stdoutMatch = raw.match(/## Agent stdout\s*\n+```\s*([\s\S]*?)```/i);
     const stderrMatch = raw.match(/## Agent stderr\s*\n+```\s*([\s\S]*?)```/i);
     if (stdoutMatch) stdoutTail = stdoutMatch[1].split("\n").slice(-maxLines).join("\n");
-    if (stderrMatch && !stderrTail) stderrTail = stderrMatch[1].split("\n").slice(-Math.min(maxLines, 40)).join("\n");
+    if (stderrMatch && !stderrTail) stderrTail = stderrMatch[1].split("\n").slice(-stderrLines).join("\n");
     if (source === "none") source = "result.md";
   }
 

package/src/tools/{getTaskSummary.ts → tasks/getTaskSummary.ts}

@@ -1,19 +1,14 @@
-import { existsSync, readFileSync } from "node:fs";
+import { existsSync } from "node:fs";
 import { join, resolve } from "node:path";
-import { getConfig, getTasksDir } from "../config.js";
-import { guardReadPath } from "../security/pathGuard.js";
+import { getConfig, getTasksDir } from "../../config.js";
+import { guardReadPath } from "../../security/pathGuard.js";
 import { getTaskStatus } from "./getTaskStatus.js";
-import { redactSensitiveValue } from "../security/contentRedaction.js";
-
-const TERMINAL_STATUSES = new Set([
-  "done",
-  "done_by_agent",
-  "failed",
-  "failed_verification",
-  "failed_scope_violation",
-  "failed_policy_violation",
-  "canceled",
-]);
+import { redactSensitiveValue } from "../../security/contentRedaction.js";
+import {
+  readTextFilePrefixSync,
+  readTextFileTailLinesSync,
+} from "../../utils/boundedFile.js";
+import { isTerminalTaskStatus } from "./taskStates.js";
 
 export interface TaskSummaryOutput {
   task_id: string;
@@ -134,12 +129,12 @@ export function getTaskSummary(taskId: string, options: GetTaskSummaryOptions =
   const taskDir = resolve(getTasksDir(config), taskId);
   const statusFile = join(taskDir, "status.json");
   guardReadPath(statusFile, config.workspaceRoot, config.tasksDir);
-  const status = getTaskStatus(taskId) as any;
+  const status = getTaskStatus(taskId);
   const resultRead = tryReadJson(join(taskDir, "result.json"));
   const verifyRead = tryReadJson(join(taskDir, "verify.json"));
   const result = resultRead.data;
   const verify = verifyRead.data;
-  const terminal = TERMINAL_STATUSES.has(String(status.status));
+  const terminal = isTerminalTaskStatus(String(status.status));
   // Phase 4: Use new_out_of_scope_changes (task-caused) for acceptance status.
   // Pre-existing external dirty files that didn't change should NOT fail acceptance.
   const outOfScope = asArray(
@@ -148,7 +143,8 @@ export function getTaskSummary(taskId: string, options: GetTaskSummaryOptions =
     ?? result.out_of_scope_changes
     ?? status.out_of_scope_changes
   );
-  const verifyStatus = String(verify.status ?? result.verify_status ?? result.verify?.status ?? status.verify_status ?? "not_available");
+  const resultVerify = asRecord(result.verify);
+  const verifyStatus = String(verify.status ?? result.verify_status ?? resultVerify.status ?? status.verify_status ?? "not_available");
   const errors = [status.error, ...asArray(result.errors), ...asArray(result.known_issues)]
     .filter((value): value is string => typeof value === "string" && value.trim() !== "");
   const warnings = asArray(result.warnings).filter((value): value is string => typeof value === "string");
@@ -179,15 +175,15 @@ export function getTaskSummary(taskId: string, options: GetTaskSummaryOptions =
   const acceptanceFile = join(taskDir, "acceptance.json");
   if (existsSync(acceptanceFile)) {
     try {
-      const acceptance = JSON.parse(readFileSync(acceptanceFile, "utf-8"));
+      const acceptance = asRecord(JSON.parse(readTextFilePrefixSync(acceptanceFile, 1024 * 1024).content));
       if (acceptance.status === "accepted") {
         acceptanceStatus = "ready_for_review";
-        acceptanceReviewedAt = acceptance.reviewed_at || null;
-        acceptanceReviewer = acceptance.reviewer || null;
+        acceptanceReviewedAt = typeof acceptance.reviewed_at === "string" ? acceptance.reviewed_at : null;
+        acceptanceReviewer = typeof acceptance.reviewer === "string" ? acceptance.reviewer : null;
       } else if (acceptance.status === "rejected") {
         acceptanceStatus = "failed";
-        acceptanceReviewedAt = acceptance.reviewed_at || null;
-        acceptanceReviewer = acceptance.reviewer || null;
+        acceptanceReviewedAt = typeof acceptance.reviewed_at === "string" ? acceptance.reviewed_at : null;
+        acceptanceReviewer = typeof acceptance.reviewer === "string" ? acceptance.reviewer : null;
         if (acceptance.notes) {
           warnings.push(`Task was rejected by ${acceptance.reviewer || "human"} at ${acceptance.reviewed_at || "unknown time"}: ${acceptance.notes}`);
         }
@@ -216,14 +212,14 @@ export function getTaskSummary(taskId: string, options: GetTaskSummaryOptions =
   const artifactHygiene = asRecord(result.artifact_hygiene ?? changedFilesRead.data.artifact_hygiene ?? {
     counts: status.artifact_hygiene_counts || {},
   });
-  const verifyCommands = asArray(verify.commands ?? result.verify_commands ?? result.verify?.commands);
+  const verifyCommands = asArray(verify.commands ?? result.verify_commands ?? resultVerify.commands);
   const testLogSummary = summarizeTestLog(join(taskDir, "test.log"));
   const verificationSummary = buildVerificationSummary(verifyStatus, verifyCommands, testLogSummary);
 
   // Extract failed command detail from verify records
-  const failedVerify = (verifyCommands as any[]).find((cmd: any) =>
-    ["failed", "timed_out", "canceled"].includes(cmd?.status)
-  );
+  const failedVerify = verifyCommands
+    .map(asRecord)
+    .find((command) => ["failed", "timed_out", "canceled"].includes(String(command.status || "")));
   const failedCommandDetail = failedVerify ? {
     command: String(failedVerify.command || ""),
     exit_code: failedVerify.exit_code ?? null,
@@ -266,7 +262,9 @@ export function getTaskSummary(taskId: string, options: GetTaskSummaryOptions =
       (status.diff_available ?? (changedFiles.length > 0)) &&
       (artifacts["diff.patch"] || artifacts["git.diff"])
     ),
-    diff_truncated: Boolean(status.diff_truncated || result.warnings?.some?.((warning: string) => warning.includes("diff.patch was truncated"))),
+    diff_truncated: Boolean(status.diff_truncated || asArray(result.warnings).some(
+      (warning) => typeof warning === "string" && warning.includes("diff.patch was truncated"),
+    )),
     result_available: artifacts["result.md"],
     result_json_available: artifacts["result.json"],
     verify_available: artifacts["verify.json"],
@@ -300,7 +298,7 @@ export function getTaskSummary(taskId: string, options: GetTaskSummaryOptions =
   } as TaskSummaryOutput;
 }
 
-function buildCompactSummary(output: Record<string, any>, maxItems: number): CompactTaskSummaryOutput {
+function buildCompactSummary(output: Record<string, unknown>, maxItems: number): CompactTaskSummaryOutput {
   const hygiene = asRecord(output.artifact_hygiene);
   const groupNames = [
     "source_changes",
@@ -317,7 +315,9 @@ function buildCompactSummary(output: Record<string, any>, maxItems: number): Com
   const manifestRead = tryReadJson(join(taskDir, "artifact_manifest.json"));
   const manifest = asRecord(manifestRead.data);
   const releaseArtifacts = asArray(manifest.artifacts);
-  const releaseArtifactPaths = releaseArtifacts.map((a: any) => String(a.path || "")).slice(0, maxItems);
+  const releaseArtifactPaths = releaseArtifacts
+    .map((artifact) => String(asRecord(artifact).path || ""))
+    .slice(0, maxItems);
 
   const compact = {
     view: "compact" as const,
@@ -364,42 +364,45 @@ function normalizeMaxItems(value: number | undefined): number {
   return value;
 }
 
-function tryReadJson(path: string): { data: Record<string, any>; error?: string } {
+function tryReadJson(path: string): { data: Record<string, unknown>; error?: string } {
   if (!existsSync(path)) return { data: {} };
   try {
-    return { data: JSON.parse(readFileSync(path, "utf-8")) };
+    return { data: asRecord(JSON.parse(readTextFilePrefixSync(path, 2 * 1024 * 1024).content)) };
   } catch (error) {
     return { data: {}, error: error instanceof Error ? error.message : String(error) };
   }
 }
 
-function asArray(value: unknown): any[] {
+function asArray(value: unknown): unknown[] {
   return Array.isArray(value) ? value : [];
 }
 
-function asRecord(value: unknown): Record<string, any> {
-  return value && typeof value === "object" && !Array.isArray(value) ? value as Record<string, any> : {};
+function asRecord(value: unknown): Record<string, unknown> {
+  return value && typeof value === "object" && !Array.isArray(value)
+    ? value as Record<string, unknown>
+    : {};
 }
 
 function summarizeTestLog(path: string): string {
   if (!existsSync(path)) return "test.log missing";
-  const text = readFileSync(path, "utf-8");
+  const text = readTextFileTailLinesSync(path, 200, 512 * 1024);
   const exit = text.match(/Exit\s*code:\s*([^\r\n]+)/i)?.[1]?.trim();
   return exit ? `Exit code: ${exit}` : text.trim().slice(0, 500) || "test.log empty";
 }
 
 function readResultFallback(path: string): string {
   if (!existsSync(path)) return "";
-  const text = readFileSync(path, "utf-8");
+  const text = readTextFilePrefixSync(path, 1024 * 1024).content;
   return text.match(/## Summary\s+([\s\S]*?)(?:\n## |\n---|$)/i)?.[1]?.trim().slice(0, 1000) || "";
 }
 
-function buildVerificationSummary(status: string, commands: any[], testLogSummary: string) {
-  const passed = commands.filter((command) => command?.status === "passed").length;
-  const failed = commands.filter((command) => ["failed", "timed_out", "canceled"].includes(command?.status)).length;
-  const skipped = commands.filter((command) => command?.status === "skipped").length;
+function buildVerificationSummary(status: string, commands: unknown[], testLogSummary: string) {
+  const commandRecords = commands.map(asRecord);
+  const passed = commandRecords.filter((command) => command.status === "passed").length;
+  const failed = commandRecords.filter((command) => ["failed", "timed_out", "canceled"].includes(String(command.status || ""))).length;
+  const skipped = commandRecords.filter((command) => command.status === "skipped").length;
   const evidenceText = [
-    ...commands.flatMap((command) => [command?.stdout_tail, command?.stderr_tail]),
+    ...commandRecords.flatMap((command) => [command.stdout_tail, command.stderr_tail]),
     testLogSummary,
   ].filter((value): value is string => typeof value === "string").join("\n");
   const headline = extractTestHeadline(evidenceText)
@@ -430,9 +433,8 @@ function extractTestHeadline(text: string): string {
 function readLogTail(path: string, lines: number): string {
   if (!existsSync(path)) return "(file not found)";
   try {
-    const raw = readFileSync(path, "utf-8");
-    if (raw.length === 0) return "(empty)";
-    return raw.split("\n").slice(-lines).join("\n");
+    const tail = readTextFileTailLinesSync(path, lines);
+    return tail || "(empty)";
   } catch {
     return "(unreadable)";
   }

package/src/tools/tasks/index.ts

@@ -0,0 +1,18 @@
+export * from "./cancelTask.js";
+export * from "./createTask.js";
+export * from "./diagnoseTask.js";
+export * from "./evidencePack.js";
+export * from "./getTaskFile.js";
+export * from "./getTaskProgress.js";
+export * from "./getTaskStatus.js";
+export * from "./getTaskStdoutTail.js";
+export * from "./getTaskSummary.js";
+export * from "./killTask.js";
+export * from "./listTasks.js";
+export * from "./reconcileTasks.js";
+export * from "./retryTask.js";
+export * from "./runTaskLoop.js";
+export * from "./runVerification.js";
+export * from "./taskLineage.js";
+export * from "./taskOutputs.js";
+export * from "./waitForTask.js";

package/src/tools/{listTasks.ts → tasks/listTasks.ts}

@@ -1,8 +1,8 @@
 import { readdirSync, readFileSync, existsSync, statSync } from "node:fs";
 import { resolve, join } from "node:path";
-import { getTasksDir, getPlansDir, getConfig } from "../config.js";
-import { guardPath } from "../security/pathGuard.js";
-import { readTaskRuntime } from "../taskRuntime.js";
+import { getTasksDir, getPlansDir, getConfig } from "../../config.js";
+import { guardPath } from "../../security/pathGuard.js";
+import { readTaskRuntime } from "../../runner/taskRuntime.js";
 import type { TaskPhase, TaskStatus, AcceptanceStatus } from "./createTask.js";
 import {
   derivePendingReason,
@@ -10,7 +10,8 @@ import {
   type PendingReason,
   type WatcherState,
   type WatcherStatusSnapshot,
-} from "../watcherStatus.js";
+} from "../../watcherStatus.js";
+import { isActiveTaskStatus } from "./taskStates.js";
 
 export interface TaskEntry {
   task_id: string;
@@ -97,7 +98,7 @@ export function listTasks(input?: ListTasksInput): ListTasksOutput {
           : null;
         if (taskAcceptance !== filterAcceptance) continue;
       }
-      if (input?.active_only && !["pending", "running", "collecting_artifacts"].includes(String(data.status))) continue;
+      if (input?.active_only && !isActiveTaskStatus(String(data.status))) continue;
       const normalizedRepo = String(data.repo_path || ".").replace(/\\/g, "/");
       const normalizedResolvedRepo = String(data.resolved_repo_path || "").replace(/\\/g, "/");
       if (filterRepo && normalizedRepo !== filterRepo && normalizedResolvedRepo !== filterRepo) continue;