refac

main.py

@@ -125,9 +125,22 @@ def narrow_permissions_to_services(
     }
 
 
-def _restore_stdout():
+def _restore_stdout() -> None:
     """Restore the real stdout and replay any captured output to stderr."""
-    captured = sys.stdout.getvalue()
+    captured_stdout = sys.stdout
+
+    # Idempotent: if already restored, nothing to do.
+    if captured_stdout is _original_stdout:
+        return
+
+    required_stringio_methods = ("getvalue", "write", "flush")
+    if not all(
+        callable(getattr(captured_stdout, method_name, None))
+        for method_name in required_stringio_methods
+    ):
+        return
+
+    captured = captured_stdout.getvalue()
     sys.stdout = _original_stdout
     if captured:
         print(captured, end="", file=sys.stderr)