- runner.ts: cap captured stdout/stderr at 64 KiB per stream via a new
Capture helper, keeping the first 48 KiB and last 16 KiB once a stream
exceeds the cap, joined by "\n...(truncated)...\n". Prevents a runaway
watcher script from ballooning memory or a Telegram message.
- runner.ts runScript: delete TELEGRAM_BOT_TOKEN from the child environment
before spawning, since model-written scripts must never be able to read
and exfiltrate it. Spec section 6.2 updated to describe the exclusion.
- scheduler.test.ts: the "drain() gives up after its timeout" test no longer
calls s.stop() at the end -- no timer is armed after the at job fires, and
its delivery never resolves, so stop()'s 10s grace period would run out
for nothing. Full suite now runs in ~1.5s.
- runner.test.ts: relax the timeout-kill elapsed-time assertion from 3000ms
to 4000ms to reduce flakiness, per the review.
Claude-Session: https://claude.ai/code/session_01JtuZTCMW9TyogEmBgGf8JT
9cf6f7385e