Report approved command launch failures accurately by morgaesis · Pull Request #157 · morgaesis/guard

1 error, 1 warn, 0 info

review incomplete · 1 advisory finding open

1 suppressed

Release registered ownership when spawn fails at src/server/runtime.rs:780: cites a line the named construct does not sit on; severity warn, confidence 0.94. prepare registers a state whose pending_launch flag remains true until adopt runs. If the subsequent spawn fails, the state is still held by the cleanup worker, cleanup_tick never considers it complete, and any secret_files lease remains retained indefinitely. Make failed launch handling clear the pending state and release the lease, or unregister the state before propagating the spawn error.