Fix the five resilience review findings

internal/cli/config_input.go

@@ -212,7 +212,7 @@ func selectedReportDir(cfg config.Config, outputPath string) (string, error) {
 	if !cfg.Reporting.Enabled {
 		return "", nil
 	}
-	if strings.TrimSpace(outputPath) != "" {
+	if outputPath != "" {
 		return filepath.Dir(outputPath), nil
 	}
 	if strings.TrimSpace(cfg.Reporting.StdoutDir) == "" {

internal/cli/process.go

@@ -10,6 +10,7 @@ import (
 	"io"
 	"path/filepath"
 	"strings"
+	"sync"
 	"time"
 
 	"gitea.maximumdirect.net/eric/audita/internal/core/chunking"
@@ -18,6 +19,7 @@ import (
 	coreio "gitea.maximumdirect.net/eric/audita/internal/core/io"
 	"gitea.maximumdirect.net/eric/audita/internal/core/normalization"
 	"gitea.maximumdirect.net/eric/audita/internal/core/outputschema"
+	"gitea.maximumdirect.net/eric/audita/internal/core/redaction"
 	"gitea.maximumdirect.net/eric/audita/internal/core/reporting"
 	"gitea.maximumdirect.net/eric/audita/internal/core/schema"
 	"gitea.maximumdirect.net/eric/audita/internal/framework/contracts"
@@ -131,6 +133,7 @@ type processState struct {
 	session        *diagnostics.OutputSession
 	debugDir       *diagnostics.RunDirectory
 	debugWarnings  []string
+	debugMu        sync.Mutex
 	runOutput      *runner.RunOutput
 }
 
@@ -183,7 +186,7 @@ func (s *processState) debugWrite(label string, write func(*diagnostics.RunDirec
 		return
 	}
 	if err := write(s.debugDir); err != nil {
-		s.debugWarnings = append(s.debugWarnings, "debug "+label+": "+llm.RedactError(err, s.cfg))
+		s.reportDiagnosticError(fmt.Errorf("%s: %w", label, err))
 	}
 }
 
@@ -193,7 +196,7 @@ func (s *processState) startDebug() {
 	}
 	dir, err := diagnostics.NewRunDirectory(s.cfg.Diagnostics.WorkDir, s.runID, llm.ConfiguredSecrets(&s.cfg)...)
 	if err != nil {
-		s.debugWarnings = append(s.debugWarnings, "debug directory: "+llm.RedactError(err, s.cfg))
+		s.reportDiagnosticError(fmt.Errorf("directory: %w", err))
 		return
 	}
 	s.debugDir = dir
@@ -209,17 +212,21 @@ func (s *processState) startDebug() {
 	if err := s.selected.Result.WriteEffective(&effective); err == nil {
 		s.debugWrite("effective settings", func(d *diagnostics.RunDirectory) error { return d.WriteEffectiveConfig(effective.Bytes()) })
 	} else {
-		s.debugWarnings = append(s.debugWarnings, "debug effective settings: "+llm.RedactError(err, s.cfg))
+		s.reportDiagnosticError(fmt.Errorf("effective settings: %w", err))
 	}
 	if origins, err := llm.ExplanationYAML(s.selected.Result); err == nil {
 		s.debugWrite("configuration origins", func(d *diagnostics.RunDirectory) error {
 			return d.WriteYAMLArtifact(diagnostics.ArtifactConfigOrigins, origins)
 		})
+	} else {
+		s.reportDiagnosticError(fmt.Errorf("configuration origins: %w", err))
 	}
 	if profiles, err := s.runtime.SelectedProfilesYAML(); err == nil {
 		s.debugWrite("selected profiles", func(d *diagnostics.RunDirectory) error {
 			return d.WriteYAMLArtifact(diagnostics.ArtifactSelectedProfiles, profiles)
 		})
+	} else {
+		s.reportDiagnosticError(fmt.Errorf("selected profiles: %w", err))
 	}
 }
 
@@ -272,7 +279,8 @@ func (s *processState) execute() int {
 		Config: &s.cfg, Transcript: normalized, Glossary: glossary, ModuleSpecs: s.specs,
 		ProposalLLMClient: proposalClient, ProposalDiagnosticsDir: s.debugPath(),
 		ValidationLLMClient: validationClient, ValidationDiagnosticsDir: s.debugPath(),
-		CaptureCandidates: s.debugDir != nil,
+		CaptureCandidates:     s.debugDir != nil,
+		ReportDiagnosticError: s.reportDiagnosticError,
 	})
 	result.Observations = observations.Snapshot()
 	result.ObservationsAvailable = true
@@ -362,7 +370,7 @@ func (s *processState) fail(phase string, reason outcomes.ReasonCode, cause erro
 	s.printFailures(writeFailures)
 	s.printDebugWarnings()
 	if s.debugDir != nil {
-		fmt.Fprintf(s.stderr, "audita process: diagnostics: %s\n", s.debugDir.Path())
+		fmt.Fprintf(s.stderr, "audita process: diagnostics: %s\n", s.safePath(s.debugDir.Path()))
 	}
 	return 1
 }
@@ -374,7 +382,7 @@ func (s *processState) finish(outputBytes []byte) int {
 	if err != nil {
 		return s.fail("report_write", outcomes.ReasonInternalFailure, err)
 	}
-	if s.outputPath == "" {
+	if s.session.TranscriptPath() == "" {
 		if _, err := s.stdout.Write(outputBytes); err != nil {
 			return s.fail("transcript_write", outcomes.ReasonInternalFailure, err)
 		}
@@ -391,16 +399,16 @@ func (s *processState) finish(outputBytes []byte) int {
 		s.printFailures(writeFailures)
 		s.printDebugWarnings()
 		if s.debugDir != nil {
-			fmt.Fprintf(s.stderr, "audita process: diagnostics: %s\n", s.debugDir.Path())
+			fmt.Fprintf(s.stderr, "audita process: diagnostics: %s\n", s.safePath(s.debugDir.Path()))
 		}
 		return 1
 	}
 	fmt.Fprintln(s.stderr, reporting.CompletionLine(snapshot))
 	for _, path := range s.session.ReportPaths() {
-		fmt.Fprintf(s.stderr, "Report: %s\n", path)
+		fmt.Fprintf(s.stderr, "Report: %s\n", s.safePath(path))
 	}
 	if s.debugDir != nil {
-		fmt.Fprintf(s.stderr, "Debug: %s\n", s.debugDir.Path())
+		fmt.Fprintf(s.stderr, "Debug: %s\n", s.safePath(s.debugDir.Path()))
 	}
 	s.printDebugWarnings()
 	return 0
@@ -425,7 +433,24 @@ func (s *processState) printFailures(failures []diagnostics.FileFailure) {
 }
 
 func (s *processState) printDebugWarnings() {
+	s.debugMu.Lock()
+	defer s.debugMu.Unlock()
 	for _, warning := range s.debugWarnings {
 		fmt.Fprintf(s.stderr, "audita process: %s\n", warning)
 	}
 }
+
+// safePath sanitizes presentation only; filesystem destinations remain literal.
+func (s *processState) safePath(path string) string {
+	return redaction.New(llm.ConfiguredSecrets(&s.cfg)).String(path)
+}
+
+func (s *processState) reportDiagnosticError(err error) {
+	if err == nil {
+		return
+	}
+	message := "debug " + llm.RedactError(err, s.cfg)
+	s.debugMu.Lock()
+	defer s.debugMu.Unlock()
+	s.debugWarnings = append(s.debugWarnings, message)
+}