@duckmind/dm-darwin-x64 0.66.4 → 0.66.6

package/extensions/dm-lens/clients/format-events-publish.js

@@ -10,6 +10,8 @@ export const BUS_FORMAT_QUEUED_EVENT = "dmlens:format:queued";
 export const BUS_FORMAT_QUEUED_VERSION = 1;
 export const BUS_FORMAT_START_EVENT = "dmlens:format:start";
 export const BUS_FORMAT_START_VERSION = 1;
+export const BUS_FORMAT_DONE_EVENT = "dmlens:format:done";
+export const BUS_FORMAT_DONE_VERSION = 1;
 export const BUS_AUTOFIX_START_EVENT = "dmlens:autofix:start";
 export const BUS_AUTOFIX_START_VERSION = 1;
 const liveEmitter = createLiveBusEmitter();
@@ -19,6 +21,9 @@ let hasLoggedQueuedDisabled = false;
 let hasLoggedStartFailure = false;
 let hasLoggedStartUnwired = false;
 let hasLoggedStartDisabled = false;
+let hasLoggedDoneFailure = false;
+let hasLoggedDoneUnwired = false;
+let hasLoggedDoneDisabled = false;
 let hasLoggedAutofixStartFailure = false;
 let hasLoggedAutofixStartUnwired = false;
 let hasLoggedAutofixStartDisabled = false;
@@ -36,6 +41,9 @@ export function _resetFormatEventsPublishForTests() {
   hasLoggedStartFailure = false;
   hasLoggedStartUnwired = false;
   hasLoggedStartDisabled = false;
+  hasLoggedDoneFailure = false;
+  hasLoggedDoneUnwired = false;
+  hasLoggedDoneDisabled = false;
   hasLoggedAutofixStartFailure = false;
   hasLoggedAutofixStartUnwired = false;
   hasLoggedAutofixStartDisabled = false;
@@ -77,7 +85,10 @@ export function publishFormatQueued(args) {
       filePath: normalizeFilePath(args.filePath),
       cwd: normalizeFilePath(args.cwd),
       tool: args.tool,
-      kinds: args.kinds
+      kinds: args.kinds,
+      ...args.ownerSessionId === undefined ? {} : { ownerSessionId: args.ownerSessionId },
+      ...args.turnIndex === undefined ? {} : { turnIndex: args.turnIndex },
+      ...args.batchId === undefined ? {} : { batchId: args.batchId }
     };
     busEmit(BUS_FORMAT_QUEUED_EVENT, payload);
     hasLoggedQueuedFailure = false;
@@ -142,7 +153,10 @@ export function publishFormatStart(args) {
       cwd: normalizeFilePath(args.cwd),
       paths,
       fileCount: paths.length,
-      kinds: args.kinds ?? ["format"]
+      kinds: args.kinds ?? ["format"],
+      ...args.ownerSessionId === undefined ? {} : { ownerSessionId: args.ownerSessionId },
+      ...args.turnIndex === undefined ? {} : { turnIndex: args.turnIndex },
+      ...args.batchId === undefined ? {} : { batchId: args.batchId }
     };
     busEmit(BUS_FORMAT_START_EVENT, payload);
     hasLoggedStartFailure = false;
@@ -167,6 +181,72 @@ export function publishFormatStart(args) {
     }
   }
 }
+export function publishFormatDone(args) {
+  if (!isBusPublishEnabled()) {
+    if (!hasLoggedDoneDisabled) {
+      hasLoggedDoneDisabled = true;
+      logBusEvent({
+        event: BUS_FORMAT_DONE_EVENT,
+        outcome: "skipped_disabled",
+        cwd: normalizeFilePath(args.cwd)
+      });
+    }
+    return;
+  }
+  const resolution = resolveLiveBusEmitter(liveEmitter, () => ({
+    event: BUS_FORMAT_DONE_EVENT,
+    cwd: normalizeFilePath(args.cwd)
+  }));
+  if (resolution.outcome === "stale-session")
+    return;
+  if (resolution.outcome === "unwired") {
+    if (!hasLoggedDoneUnwired) {
+      hasLoggedDoneUnwired = true;
+      logBusEvent({
+        event: BUS_FORMAT_DONE_EVENT,
+        outcome: "skipped_unwired",
+        cwd: normalizeFilePath(args.cwd)
+      });
+    }
+    return;
+  }
+  try {
+    const paths = args.paths.map((p) => normalizeFilePath(p));
+    const payload = {
+      v: BUS_FORMAT_DONE_VERSION,
+      source: "dm-lens",
+      cwd: normalizeFilePath(args.cwd),
+      paths,
+      fileCount: paths.length,
+      kinds: args.kinds ?? ["format"],
+      ...args.ownerSessionId === undefined ? {} : { ownerSessionId: args.ownerSessionId },
+      ...args.turnIndex === undefined ? {} : { turnIndex: args.turnIndex },
+      ...args.batchId === undefined ? {} : { batchId: args.batchId },
+      ...args.settled === undefined ? {} : { settled: args.settled }
+    };
+    resolution.emit(BUS_FORMAT_DONE_EVENT, payload);
+    hasLoggedDoneFailure = false;
+    logBusEvent({
+      event: BUS_FORMAT_DONE_EVENT,
+      outcome: "emitted",
+      cwd: payload.cwd,
+      fileCount: payload.fileCount
+    });
+  } catch (err) {
+    logBusEvent({
+      event: BUS_FORMAT_DONE_EVENT,
+      outcome: "emit_failed",
+      cwd: normalizeFilePath(args.cwd),
+      error: String(err),
+      ctxSource: resolution.ctxSource
+    });
+    if (!hasLoggedDoneFailure) {
+      hasLoggedDoneFailure = true;
+      recordStaleBusFailure(BUS_FORMAT_DONE_EVENT, err);
+      args.dbg?.(`format-events-publish: dmlens:format:done emit failed (further failures suppressed): ${err}`);
+    }
+  }
+}
 export function publishAutofixStart(args) {
   if (args.paths.length === 0)
     return;

package/extensions/dm-lens/clients/format-service.js

@@ -10,7 +10,7 @@ export class FormatService {
   fileTime;
   enabled;
   constructor(sessionID, enabled = true) {
-    this.fileTime = new FileTime(sessionID);
+    this.fileTime = new FileTime(`${sessionID}:format`);
     this.enabled = enabled;
   }
   async formatFile(filePath, options = {}) {
@@ -47,7 +47,8 @@ export class FormatService {
         allSucceeded: true
       };
     }
-    const results = await this.runFormattersWithConcurrency(absolutePath, formatters, DEFAULT_FORMATTER_CONCURRENCY, options.signal, options.budgetMs, options.hook);
+    const abandoned = [];
+    const results = await this.runFormattersWithConcurrency(absolutePath, formatters, DEFAULT_FORMATTER_CONCURRENCY, options.signal, options.budgetMs, options.hook, abandoned, options.writeHold);
     this.fileTime.read(absolutePath);
     for (const [index, result] of results.entries()) {
       recordFormatter(absolutePath, formatters[index]?.name ?? "unknown", result.changed, result.success, result.outcome);
@@ -64,10 +65,11 @@ export class FormatService {
         outcome: r.outcome
       })),
       anyChanged,
-      allSucceeded
+      allSucceeded,
+      ...abandoned.length === 0 ? {} : { abandoned: Promise.allSettled(abandoned).then(() => {}) }
     };
   }
-  async runFormattersWithConcurrency(filePath, formatters, _concurrency = DEFAULT_FORMATTER_CONCURRENCY, signal, budgetMs = 30000, hook = "tool_result_edit") {
+  async runFormattersWithConcurrency(filePath, formatters, _concurrency = DEFAULT_FORMATTER_CONCURRENCY, signal, budgetMs = 30000, hook = "tool_result_edit", abandoned = [], writeHold) {
     const results = [];
     const startedAt = Date.now();
     for (const formatter of formatters) {
@@ -82,7 +84,8 @@ export class FormatService {
         continue;
       }
       try {
-        const result = await bounded(loadFormatters().then(({ formatFile }) => formatFile(filePath, formatter)), {
+        const run = loadFormatters().then(({ formatFile }) => formatFile(filePath, formatter, writeHold && (() => writeHold.enter(run))));
+        const result = await bounded(run, {
           ms: remainingMs,
           signal,
           hook,
@@ -91,8 +94,10 @@ export class FormatService {
         if (result)
           results.push(result);
         else if (signal?.aborted) {
+          abandoned.push(run);
           break;
         } else {
+          abandoned.push(run);
           results.push({
             success: false,
             changed: false,

package/extensions/dm-lens/clients/formatters.js

@@ -27,6 +27,7 @@ import {
 import {
   findGlobalBinary,
   findLocalBinUpwards,
+  localBinPath,
   VENDOR_BIN_DIRS,
   VENV_BIN_DIRS
 } from "./package-manager.js";
@@ -37,6 +38,7 @@ import { probeToolAsync } from "./tool-probe.js";
 import { assertInstallAllowed } from "./project-trust.js";
 import { tryLazyInstallForFormatter } from "./dispatch/runners/utils/lazy-installer.js";
 import { getToolPath } from "./installer/index.js";
+import { getIsolatedNpxSpawnOptions } from "./tool-probe.js";
 import {
   findPSScriptAnalyzerConfigPath,
   getAutoInstallToolIdForFormatter,
@@ -277,19 +279,19 @@ async function resolveGoFmtBinary() {
   return await fileExists(binary) ? binary : null;
 }
 async function findInVenv(binary, cwd) {
-  return findLocalBinUpwards(binary, cwd, {
+  return localBinPath(findLocalBinUpwards(binary, cwd, {
     windowsExt: ".exe",
     binDirs: VENV_BIN_DIRS
-  }) ?? null;
+  })) ?? null;
 }
 async function findInVendorBin(binary, cwd) {
-  return findLocalBinUpwards(binary, cwd, {
+  return localBinPath(findLocalBinUpwards(binary, cwd, {
     windowsExt: ".bat",
     binDirs: VENDOR_BIN_DIRS
-  }) ?? null;
+  })) ?? null;
 }
 async function findInNodeModules(binary, cwd) {
-  return findLocalBinUpwards(binary, cwd) ?? null;
+  return localBinPath(findLocalBinUpwards(binary, cwd)) ?? null;
 }
 async function canUseBundleExec(cwd) {
   if (await which("bundle") === null)
@@ -889,8 +891,8 @@ export const styluaFormatter = {
   name: "stylua",
   command: ["stylua", "$FILE"],
   extensions: [".lua"],
-  resolveCommand: managedFormatterResolver("stylua", [], findLocalBinUpwards),
-  detect: managedToolDetect("stylua", async (cwd) => (await findUp(["stylua.toml", ".stylua.toml"], cwd)).length > 0, async (cwd) => Boolean(findLocalBinUpwards("stylua", cwd) || await which("stylua")))
+  resolveCommand: managedFormatterResolver("stylua", [], (binary, cwd) => localBinPath(findLocalBinUpwards(binary, cwd))),
+  detect: managedToolDetect("stylua", async (cwd) => (await findUp(["stylua.toml", ".stylua.toml"], cwd)).length > 0, async (cwd) => Boolean(localBinPath(findLocalBinUpwards("stylua", cwd)) || await which("stylua")))
 };
 export const ormoluFormatter = {
   name: "ormolu",
@@ -1308,6 +1310,16 @@ export function diagnosticTail(text, maxLines = FORMATTER_ERROR_TAIL_LINES) {
   return lines.slice(-maxLines).join(`
 `);
 }
+async function resolveNpxFallback(formatterName, fallback) {
+  const toolId = getAutoInstallToolIdForFormatter(formatterName);
+  if (!toolId)
+    return fallback;
+  const { ensureTool } = await import("./installer/index.js");
+  const installed = await ensureTool(toolId);
+  if (!installed)
+    return fallback;
+  return [installed, ...fallback.slice(2)];
+}
 async function resolveFormatterCommand(formatter, absolutePath, cwd) {
   const agreement = establishToolAgreement(formatter.name, cwd);
   if (agreement.decision === "decline") {
@@ -1326,17 +1338,19 @@ async function resolveFormatterCommand(formatter, absolutePath, cwd) {
   if (resolved !== null)
     return resolved;
   const fallback = formatter.command.map((c) => c.replace("$FILE", absolutePath));
-  if (fallback[0] === "npx" && !assertInstallAllowed(`formatter npx fallback: ${formatter.name}`)) {
-    return SKIP_FORMATTING;
+  if (fallback[0] === "npx") {
+    if (!assertInstallAllowed(`formatter npx fallback: ${formatter.name}`)) {
+      return SKIP_FORMATTING;
+    }
+    return resolveNpxFallback(formatter.name, fallback);
   }
   return fallback;
 }
-export async function formatFile(filePath, formatter) {
+export async function formatFile(filePath, formatter, enter) {
   try {
     const absolutePath = path.resolve(filePath);
     const cwd = path.dirname(absolutePath);
     const formatterCwd = resolveToolCwd("formatter", formatter.name, absolutePath, { cwd: path.parse(absolutePath).root }).cwd;
-    const contentBefore = await fs.readFile(absolutePath, "utf-8");
     const cmd = await resolveFormatterCommand(formatter, absolutePath, cwd);
     if (cmd === SKIP_FORMATTING) {
       return { success: true, changed: false, outcome: "skipped" };
@@ -1357,9 +1371,12 @@ export async function formatFile(filePath, formatter) {
         error: `${formatter.name}: project tool agreement could not be established`
       };
     }
+    await enter?.();
+    const contentBefore = await fs.readFile(absolutePath, "utf-8");
     const result = await safeSpawnAsync(cmd[0], cmd.slice(1), {
       timeout: 15000,
-      cwd: formatterCwd
+      cwd: formatterCwd,
+      ...cmd[0] === "npx" || cmd[0] === "bunx" ? getIsolatedNpxSpawnOptions() : {}
     });
     if (result.spawnFailure?.kind === "tool-not-found") {
       return {

package/extensions/dm-lens/clients/generation-guard.js

@@ -1,5 +1,7 @@
 import { BoundedFifoMap } from "./bounded-cache.js";
 import { incrementDegradationCount } from "./degradation-ledger.js";
+import { logLatency } from "./latency-logger.js";
+import { getProcessSingleton } from "./process-singletons.js";
 const declaredSources = new Set;
 const MAX_DECLARED_SOURCES = 128;
 function declare(name) {
@@ -13,6 +15,42 @@ function declare(name) {
 export function listDeclaredGenerationSources() {
   return [...declaredSources].sort((a, b) => a.localeCompare(b));
 }
+const FENCE_TALLY_FAMILY = "generation-guard.fence-tally";
+const FENCE_TALLY_VERSION = 1;
+const OTHER_SOURCES = "(other)";
+const MAX_ROLLUP_SOURCES = 16;
+function fenceTallies() {
+  return getProcessSingleton(FENCE_TALLY_FAMILY, FENCE_TALLY_VERSION, () => new Map);
+}
+function tallyFence(sourceName, dropped) {
+  const tallies = fenceTallies();
+  const key = declaredSources.has(sourceName) ? sourceName : OTHER_SOURCES;
+  let tally = tallies.get(key);
+  if (!tally) {
+    tally = { guarded: 0, dropped: 0 };
+    tallies.set(key, tally);
+  }
+  tally.guarded += 1;
+  if (dropped)
+    tally.dropped += 1;
+}
+export function emitFenceRollupAtSessionEnd(cwd) {
+  const tallies = fenceTallies();
+  const rows = [...tallies.entries()].map(([source, tally]) => ({ source, ...tally })).sort((a, b) => b.dropped - a.dropped || b.guarded - a.guarded || a.source.localeCompare(b.source));
+  tallies.clear();
+  logLatency({
+    type: "phase",
+    phase: "session_end_fence_rollup",
+    filePath: cwd,
+    durationMs: 0,
+    metadata: {
+      guardedTotal: rows.reduce((sum, row) => sum + row.guarded, 0),
+      droppedTotal: rows.reduce((sum, row) => sum + row.dropped, 0),
+      sources: rows.slice(0, MAX_ROLLUP_SOURCES),
+      sourcesOmitted: Math.max(0, rows.length - MAX_ROLLUP_SOURCES)
+    }
+  });
+}
 function recordStaleWrite(sourceName, subject, captured, observed) {
   incrementDegradationCount({
     kind: "generation-guard-stale-write",
@@ -20,7 +58,7 @@ function recordStaleWrite(sourceName, subject, captured, observed) {
     reason: `write dropped: captured generation ${captured}, current ${observed}`
   });
 }
-function makeHandle(sourceName, generation, read) {
+function makeHandle(sourceName, generation, read, tallyName) {
   return {
     generation,
     isCurrent() {
@@ -29,25 +67,29 @@ function makeHandle(sourceName, generation, read) {
     guardedWrite(subject, write) {
       const observed = read();
       if (observed !== generation) {
+        tallyFence(tallyName, true);
         recordStaleWrite(sourceName, subject, generation, observed);
         return;
       }
+      tallyFence(tallyName, false);
       return write();
     }
   };
 }
-export function createGenerationSource(name) {
-  let generation = 0;
-  const read = () => generation;
+export function createGenerationSource(name, store) {
+  const local = { generation: 0 };
+  const cell = store ?? (() => local);
+  const read = () => cell().generation;
   return {
     name,
     current: read,
     bump() {
-      generation += 1;
-      return generation;
+      const held = cell();
+      held.generation += 1;
+      return held.generation;
     },
     capture() {
-      return makeHandle(name, generation, read);
+      return makeHandle(name, read(), read, name);
     }
   };
 }
@@ -83,7 +125,7 @@ export function createGenerationMap(name, options = {}) {
         if (invalidations === capturedInvalidations)
           return stamp;
         return read(normalize(key));
-      });
+      }, name);
     },
     forget(key) {
       invalidations += 1;

package/extensions/dm-lens/clients/generation-lock.js

@@ -0,0 +1,184 @@
+import { randomInt } from "node:crypto";
+import * as fs from "node:fs";
+import * as path from "node:path";
+import { BoundedFifoMap } from "./bounded-cache.js";
+import {
+  incrementDegradationCount,
+  recordDegradationOnce
+} from "./degradation-ledger.js";
+const GENERATION = /^lock\.(\d+)(\.released)?$/;
+export function pidFileOwner(file) {
+  try {
+    const pid = Number(fs.readFileSync(file, "utf8").trim().split(/\s+/)[0]);
+    return Number.isInteger(pid) && pid > 0 ? pid : undefined;
+  } catch {
+    return;
+  }
+}
+function isPidAlive(pid) {
+  if (pid === undefined)
+    return false;
+  try {
+    process.kill(pid, 0);
+    return true;
+  } catch (error) {
+    return error?.code !== "ESRCH";
+  }
+}
+export function pidFileIsStale(file, staleMs) {
+  try {
+    const stat = fs.statSync(file);
+    if (Date.now() - stat.mtimeMs > staleMs)
+      return true;
+    const pid = pidFileOwner(file);
+    return pid !== undefined && !isPidAlive(pid);
+  } catch {
+    return false;
+  }
+}
+export function isLockContention(error) {
+  const code = error?.code;
+  return code === "EEXIST" || code === "EPERM" || code === "EBUSY";
+}
+function generationPath(dir, generation) {
+  return path.join(dir, `lock.${generation}`);
+}
+function releasedName(generation) {
+  return `lock.${generation}.released`;
+}
+function topGeneration(entries) {
+  let top = 0;
+  for (const name of entries) {
+    const match = GENERATION.exec(name);
+    if (match && !match[2])
+      top = Math.max(top, Number(match[1]));
+  }
+  return top;
+}
+function removeBelowPredecessor(dir, entries, generation) {
+  for (const name of entries) {
+    const match = GENERATION.exec(name);
+    if (!match || Number(match[1]) + 1 >= generation)
+      continue;
+    try {
+      fs.unlinkSync(path.join(dir, name));
+    } catch {}
+  }
+}
+export function recordGenerationTakeover(hold) {
+  incrementDegradationCount({
+    kind: "generation-lock-stale-takeover",
+    subject: path.resolve(hold.dir),
+    reason: `took over lock generation ${hold.generation - 1} from a dead or aged-out holder`
+  });
+}
+export function recordLegacyLockHeld(legacyPath) {
+  incrementDegradationCount({
+    kind: "generation-lock-legacy-held",
+    subject: path.resolve(legacyPath),
+    reason: `backed off: ${path.basename(legacyPath)} is held by another writer (one from before #3476, or a holder past the generation lease)`
+  });
+}
+export function releaseGeneration(hold) {
+  try {
+    fs.writeFileSync(path.join(hold.dir, releasedName(hold.generation)), "");
+  } catch {}
+}
+export function heartbeatIntervalMs(leaseMs) {
+  return Math.max(1000, Math.floor(leaseMs / 4));
+}
+export function startGenerationHeartbeat(hold, intervalMs) {
+  const file = generationPath(hold.dir, hold.generation);
+  const timer = setInterval(() => {
+    try {
+      const now = new Date;
+      fs.utimesSync(file, now, now);
+    } catch {}
+  }, intervalMs);
+  timer.unref();
+  return { stop: () => clearInterval(timer) };
+}
+export function ownsTopGeneration(hold) {
+  try {
+    const entries = fs.readdirSync(hold.dir);
+    if (entries.includes(releasedName(hold.generation)))
+      return false;
+    return topGeneration(entries) === hold.generation;
+  } catch {
+    return false;
+  }
+}
+export function tryAcquireGeneration(dir, staleMs) {
+  fs.mkdirSync(dir, { recursive: true });
+  const listed = fs.readdirSync(dir);
+  const top = topGeneration(listed);
+  const free = top === 0 || listed.includes(releasedName(top));
+  if (!free && !pidFileIsStale(generationPath(dir, top), staleMs)) {
+    return;
+  }
+  const hold = { dir, generation: top + 1, tookOverStale: !free };
+  try {
+    fs.writeFileSync(generationPath(dir, hold.generation), `${process.pid} ${Date.now()}
+`, { flag: "wx" });
+  } catch (error) {
+    if (isLockContention(error))
+      return;
+    throw error;
+  }
+  let entries;
+  try {
+    entries = fs.readdirSync(dir);
+  } catch (cause) {
+    releaseGeneration(hold);
+    throw cause;
+  }
+  if (topGeneration(entries) > hold.generation) {
+    releaseGeneration(hold);
+    return;
+  }
+  removeBelowPredecessor(dir, entries, hold.generation);
+  return hold;
+}
+const timedOutHolders = new BoundedFifoMap(16);
+export function topGenerationHolder(dir) {
+  try {
+    const top = topGeneration(fs.readdirSync(dir));
+    return `lock.${top} ${fs.readFileSync(generationPath(dir, top), "utf8").trim()}`;
+  } catch {
+    return;
+  }
+}
+export function withGenerationLockSync(dir, timing, op) {
+  const deadline = Date.now() + timing.waitMs;
+  const timedOutHolder = timedOutHolders.get(dir);
+  for (;; ) {
+    let hold;
+    try {
+      hold = tryAcquireGeneration(dir, timing.staleMs);
+    } catch (cause) {
+      return { held: false, cause };
+    }
+    if (hold) {
+      if (hold.tookOverStale)
+        recordGenerationTakeover(hold);
+      try {
+        return { held: true, value: op() };
+      } finally {
+        releaseGeneration(hold);
+      }
+    }
+    if (timedOutHolder !== undefined && topGenerationHolder(dir) === timedOutHolder) {
+      recordDegradationOnce({
+        kind: "generation-lock-wait-skipped",
+        subject: dir,
+        reason: `did not wait: ${timedOutHolder} still holds the lock after an earlier wait ran out`
+      });
+      return { held: false };
+    }
+    if (Date.now() >= deadline) {
+      timedOutHolders.set(dir, topGenerationHolder(dir));
+      return { held: false };
+    }
+    Atomics.wait(new Int32Array(new SharedArrayBuffer(4)), 0, 0, randomInt(5, 26));
+  }
+}

package/extensions/dm-lens/clients/git-guard.js

@@ -2,8 +2,13 @@ import * as nodeFs from "node:fs";
 import * as path from "node:path";
 import { isPathIgnoredByProject } from "./file-utils.js";
 import { tokenizeShellCommand } from "./bash-file-access.js";
+import { incrementDegradationCount } from "./degradation-ledger.js";
+import { absorbSettledRunnerBlockers } from "./deferred-runner-blockers.js";
 import { logLatency } from "./latency-logger.js";
 import { resolveLensToolName } from "./tool-config.js";
+import {
+  canWriteAnalysisRoot
+} from "./analysis-root.js";
 import {
   advisoryFileHash,
   advisoryPathKey,
@@ -538,7 +543,9 @@ export function resyncGitGuardAfterInlinePolicy(args) {
     return;
   args.runtime.updateGitGuardStatus(false, "");
 }
-export function syncGitGuardRecord(runtime, cacheManager, cwd, editedFilePath) {
+export function syncGitGuardRecord(runtime, cacheManager, cwd, editedFilePath, analysisRootMode = "session") {
+  if (!canWriteAnalysisRoot(analysisRootMode))
+    return;
   const entries = (runtime.getInlineBlockersSnapshot?.() ?? []).filter((entry) => !entry.policySuppressed);
   const inspection = cacheManager.inspectCache("turn-end-findings", cwd);
   const existing = cacheRecord(cacheManager, cwd);
@@ -681,6 +688,17 @@ function firstExpiredSuppressionVerdict(runtime) {
 export function evaluateGitGuard(runtime, cacheManager, cwd, host = "pi") {
   const diagnosticsTool = resolveLensToolName("lens_diagnostics", host);
   const inspectLine = diagnosticsTool ? `Run ${diagnosticsTool} mode=all for full details, then commit again.` : "Inspect the full diagnostics, then commit again.";
+  try {
+    const absorbed = absorbSettledRunnerBlockers(runtime, cwd);
+    if (absorbed.recorded > 0)
+      syncGitGuardRecord(runtime, cacheManager, cwd);
+  } catch (failure) {
+    incrementDegradationCount({
+      kind: "deferred-blocker-gate-error",
+      subject: "commit_gate",
+      reason: failure instanceof Error ? failure.message : String(failure)
+    });
+  }
   if (runtime.gitGuardHasBlockers) {
     logDecision(cwd, "blocked", "runtime_blockers", {
       projectSeq: runtime.projectSeq

package/extensions/dm-lens/clients/gitleaks-client.js

@@ -1,5 +1,4 @@
 import * as fs from "node:fs";
-import * as os from "node:os";
 import * as path from "node:path";
 import { mkdtempSync } from "node:fs";
 import {
@@ -8,11 +7,14 @@ import {
 } from "./git-tracked-ignore.js";
 import { normalizeEphemeralMapKey, normalizeMapKey } from "./path-utils.js";
 import { safeSpawnAsync } from "./safe-spawn.js";
+import { scannerReportParentDir } from "./scanner-temp-root.js";
 import { SecurityScanClient } from "./security-scan-client.js";
 import {
   getSecretsLaneAllowlistPaths,
-  isUnderSecretsLaneScratchTree
+  isUnderSecretsLaneScratchTree,
+  nestedWorktreeOffsets
 } from "./scratch-tree-policy.js";
+import { escapeRegExp } from "./string-utils.js";
 const EMPTY_RESULT = {
   success: false,
   findings: []
@@ -39,10 +41,17 @@ export const PLACEHOLDER_SECRET_REGEXES = [
   String.raw`(?i)^x{3,}$`,
   String.raw`(?i)^(changeme|change[-_]me|example|placeholder|dummy|fake|redacted|xxxxxxxx)$`
 ];
+function worktreeAllowlistPath(worktree) {
+  const segments = worktree.split(/[/\\]/).map(escapeRegExp);
+  return `^${segments.join("[/\\\\]")}(?:[/\\\\].*)?$`;
+}
 export function writeScopedGitleaksConfig(outDir, cwd) {
   const localConfig = findLocalGitleaksConfig(cwd);
   const extendLine = localConfig ? `path = ${JSON.stringify(localConfig)}` : "useDefault = true";
-  const pathPatterns = getSecretsLaneAllowlistPaths().map((p) => `    ${JSON.stringify(p)},`).join(`
+  const pathPatterns = [
+    ...getSecretsLaneAllowlistPaths(),
+    ...nestedWorktreeOffsets(cwd).map((offset) => worktreeAllowlistPath(path.join(cwd, offset)))
+  ].map((p) => `    ${JSON.stringify(p)},`).join(`
 `);
   const regexPatterns = PLACEHOLDER_SECRET_REGEXES.map((r) => `    ${JSON.stringify(r)},`).join(`
 `);
@@ -141,7 +150,7 @@ export class GitleaksClient extends SecurityScanClient {
   async runScan(cwd) {
     const scannedAt = new Date().toISOString();
     const bin = this.binaryPath ?? "gitleaks";
-    const outDir = mkdtempSync(path.join(os.tmpdir(), "dm-lens-gitleaks-"));
+    const outDir = mkdtempSync(path.join(scannerReportParentDir(), "dm-lens-gitleaks-"));
     const reportPath = path.join(outDir, "gitleaks-report.json");
     try {
       const configPath = writeScopedGitleaksConfig(outDir, cwd);

package/extensions/dm-lens/clients/grammar-source.js

@@ -16,6 +16,11 @@ export const GRAMMAR_SOURCE_OVERRIDES = {
     package: "@tree-sitter-grammars/tree-sitter-yaml",
     version: "0.7.1",
     url: "https://unpkg.com/@tree-sitter-grammars/tree-sitter-yaml@0.7.1/tree-sitter-yaml.wasm"
+  },
+  "tree-sitter-bash.wasm": {
+    package: "tree-sitter-bash",
+    version: "0.25.1",
+    url: "https://unpkg.com/tree-sitter-bash@0.25.1/tree-sitter-bash.wasm"
   }
 };
 export function grammarSourceUrl(filename) {