@duckmind/dm-darwin-x64 0.66.4 → 0.66.6

package/extensions/dm-lens/dist/clients/project-diagnostics/cache.js

@@ -0,0 +1,91 @@
+import * as fs from "node:fs";
+import * as path from "node:path";
+import { getProjectDataDir } from "../file-utils.js";
+import { writeFileAtomic } from "../atomic-write.js";
+import { readJsonCache } from "../json-cache-read.js";
+import { freshnessFromMtime } from "../freshness.js";
+import { hashDiagnosticContent } from "../lsp/diagnostic-binding.js";
+export const PROJECT_DIAGNOSTICS_CACHE_VERSION = 3;
+const SNAPSHOT_CACHE_FILE = "project-diagnostics.json";
+const DELTA_CACHE_FILE = "project-diagnostics-delta.json";
+function cachePath(cwd, fileName) {
+  return path.join(getProjectDataDir(cwd), "cache", fileName);
+}
+export function loadProjectDiagnosticsSnapshot(cwd) {
+  return readJsonCache(cachePath(cwd, SNAPSHOT_CACHE_FILE), (parsed) => {
+    if (!parsed || typeof parsed !== "object")
+      return;
+    const snapshot = parsed;
+    if (snapshot.version !== PROJECT_DIAGNOSTICS_CACHE_VERSION)
+      return;
+    if (!Array.isArray(snapshot.diagnostics))
+      return;
+    return snapshot;
+  });
+}
+export function saveProjectDiagnosticsSnapshot(cwd, snapshot) {
+  const filePath = cachePath(cwd, SNAPSHOT_CACHE_FILE);
+  fs.mkdirSync(path.dirname(filePath), { recursive: true });
+  writeFileAtomic(filePath, JSON.stringify(snapshot, null, 2));
+}
+export function loadProjectDiagnosticsDeltaReport(cwd) {
+  return readJsonCache(cachePath(cwd, DELTA_CACHE_FILE), (parsed) => {
+    if (!parsed || typeof parsed !== "object")
+      return;
+    const report = parsed;
+    if (report.version !== PROJECT_DIAGNOSTICS_CACHE_VERSION)
+      return;
+    if (!Array.isArray(report.diagnostics))
+      return;
+    return report;
+  });
+}
+export function writeProjectDiagnosticsDeltaReport(cwd, report) {
+  const filePath = cachePath(cwd, DELTA_CACHE_FILE);
+  fs.mkdirSync(path.dirname(filePath), { recursive: true });
+  writeFileAtomic(filePath, JSON.stringify(report, null, 2));
+}
+export function reconcileProjectDiagnosticsSnapshot(snapshot) {
+  const scannedAtMs = Date.parse(snapshot.scannedAt);
+  if (!Number.isFinite(scannedAtMs))
+    return { snapshot, staleDropped: 0 };
+  const staleByFile = new Map;
+  const isStale = (filePath) => {
+    const cached = staleByFile.get(filePath);
+    if (cached !== undefined)
+      return cached;
+    let stale;
+    let stat;
+    try {
+      stat = fs.statSync(filePath);
+    } catch {
+      stat = undefined;
+    }
+    const fingerprint = snapshot.fileFingerprints?.[filePath];
+    if (fingerprint && stat) {
+      stale = true;
+      if (stat.size === fingerprint.sizeBytes) {
+        try {
+          stale = hashDiagnosticContent(fs.readFileSync(filePath, "utf-8")) !== fingerprint.contentHash;
+        } catch {
+          stale = true;
+        }
+      }
+      staleByFile.set(filePath, stale);
+      return stale;
+    }
+    const verdict = freshnessFromMtime({
+      mtimeMs: stat?.mtimeMs,
+      referenceMs: scannedAtMs
+    });
+    stale = verdict.verdict !== "fresh";
+    staleByFile.set(filePath, stale);
+    return stale;
+  };
+  const kept = snapshot.diagnostics.filter((d) => !isStale(d.filePath));
+  if (kept.length === snapshot.diagnostics.length) {
+    return { snapshot, staleDropped: 0 };
+  }
+  const staleDropped = [...staleByFile.values()].filter(Boolean).length;
+  return { snapshot: { ...snapshot, diagnostics: kept }, staleDropped };
+}

package/extensions/dm-lens/dist/clients/project-diagnostics/extractors.js

@@ -0,0 +1,53 @@
+const WARM_TRIGGER = {
+  knip: "runs at session-start",
+  jscpd: "runs at session-start",
+  madge: "runs at session-start",
+  gitleaks: "runs at session-start (config opt-in), or on any git repo via mode=full (#608)",
+  govulncheck: "runs at session-start (Go projects only)",
+  opengrep: "runs at session-start",
+  trivy: "runs at session-start",
+  "dead-code": "runs at session-start (Python projects only)",
+  "test-runner": "fires per-edit at turn_end (only after a source file with a discoverable test companion is edited)"
+};
+function warmTriggerFor(analyzerId) {
+  return WARM_TRIGGER[analyzerId] ?? "runs at session-start";
+}
+export function formatNotRunEntry(analyzerId, coldReasons) {
+  const reason = coldReasons?.[analyzerId];
+  return reason ? `${analyzerId} — not run (${reason})` : `${analyzerId} — not run (${warmTriggerFor(analyzerId)})`;
+}
+export function formatCacheAge(ms) {
+  if (!Number.isFinite(ms))
+    return "age unknown";
+  if (ms < 0)
+    return "0m";
+  const totalMinutes = Math.round(ms / 60000);
+  if (totalMinutes < 1)
+    return "under 1m";
+  if (totalMinutes < 60)
+    return `${totalMinutes}m`;
+  const hours = Math.floor(totalMinutes / 60);
+  const minutes = totalMinutes % 60;
+  return minutes > 0 ? `${hours}h${minutes}m` : `${hours}h`;
+}
+export function formatCacheAgeOld(ms) {
+  const age = formatCacheAge(ms);
+  return Number.isFinite(ms) ? `${age} old` : age;
+}
+export function reasonFromAvailabilityVerdict(tool, verdict) {
+  if (!verdict || verdict.outcome === null)
+    return `${tool} binary unavailable`;
+  const { outcome, cause } = verdict;
+  if (outcome === "transient") {
+    if (cause === "install-retry-exhausted") {
+      return `${tool} install kept timing out and hit its retry ceiling this session (not reported missing)`;
+    }
+    const remainingMs = verdict.retryAtMs - Date.now();
+    const remainingS = remainingMs > 0 ? Math.round(remainingMs / 1000) : 0;
+    return `${tool} availability probe — retry cooldown (${remainingS}s), not a missing install`;
+  }
+  if (outcome === "non-installable") {
+    return `${tool} unavailable on this host (non-installable)`;
+  }
+  return `${tool} binary unavailable`;
+}

package/extensions/dm-lens/dist/clients/project-diagnostics/fresh-fetch.js

@@ -0,0 +1,413 @@
+import * as fs from "node:fs";
+import * as os from "node:os";
+import * as path from "node:path";
+import { applyDispositionsMultiFile } from "../diagnostic-dispositions.js";
+import { parseScannedAtMs } from "../advisory-provenance.js";
+import { getKnipIgnorePatterns } from "../file-utils.js";
+import { isAtOrAboveHomeDir, realpathOrResolve } from "../path-utils.js";
+import { isSameOrWithin } from "../lsp/server.js";
+import { incrementDegradationCount, recordDegradationOnce } from "../degradation-ledger.js";
+import { GitleaksClient } from "../gitleaks-client.js";
+import { GovulncheckClient } from "../govulncheck-client.js";
+import { isToolInstallAllowedByTrust, projectTrustDenialReason } from "../project-trust.js";
+import { TrivyClient } from "../trivy-client.js";
+import { reasonFromAvailabilityVerdict } from "./extractors.js";
+import { deadCodeResultToProjectDiagnostics } from "./runner-adapters/dead-code.js";
+import { gitleaksResultToProjectDiagnostics } from "./runner-adapters/gitleaks.js";
+import { govulncheckResultToProjectDiagnostics } from "./runner-adapters/govulncheck.js";
+import { jscpdResultToProjectDiagnostics } from "./runner-adapters/jscpd.js";
+import { knipIssuesToProjectDiagnostics } from "./runner-adapters/knip.js";
+import { circularDepsToProjectDiagnostics } from "./runner-adapters/madge.js";
+import { opengrepResultToProjectDiagnostics } from "./runner-adapters/opengrep.js";
+import { testRunnerFindingsToProjectDiagnostics } from "./runner-adapters/runner-findings.js";
+import { trivyResultToProjectDiagnostics } from "./runner-adapters/trivy.js";
+export const ANALYZER_IDS = [
+  "knip",
+  "jscpd",
+  "madge",
+  "gitleaks",
+  "govulncheck",
+  "opengrep",
+  "trivy",
+  "dead-code",
+  "test-runner"
+];
+function pushUnique(list, id) {
+  if (!list.includes(id))
+    list.push(id);
+}
+function laneObservedAtMs(scannedAt, startedAtMs) {
+  return parseScannedAtMs(scannedAt) ?? startedAtMs;
+}
+export async function fetchFreshProjectDiagnostics(cacheManager, cwd, clients, signal, options = {}) {
+  const requestedRoot = options.analysisRoot === undefined ? cwd : path.resolve(cwd, options.analysisRoot);
+  let analysisRoot;
+  let analysisRootValidation;
+  if (options.analysisRoot !== undefined) {
+    try {
+      if (!fs.statSync(requestedRoot).isDirectory()) {
+        throw new Error("is not a directory");
+      }
+      analysisRoot = fs.realpathSync(requestedRoot);
+    } catch (error) {
+      const detail = error instanceof Error ? error.message : String(error);
+      const reason = `the explicit analysis root ${requestedRoot} is unavailable or ${detail}`;
+      analysisRootValidation = {
+        state: "undecided",
+        root: requestedRoot,
+        reason
+      };
+      incrementDegradationCount({
+        kind: "lens-diagnostics-analysis-root-rejected",
+        subject: requestedRoot,
+        reason
+      });
+      return {
+        analysisRootValidation,
+        diagnostics: [],
+        runners: [],
+        analyzed: [],
+        authoritativeCoverage: [],
+        cold: [...ANALYZER_IDS],
+        coldReasons: Object.fromEntries(ANALYZER_IDS.map((id) => [id, reason])),
+        failed: [],
+        timings: {},
+        analysisRootError: reason
+      };
+    }
+  } else {
+    analysisRoot = realpathOrResolve(cwd);
+  }
+  const unsafeRootReason = "the analysis root resolves at or above the home directory; heavyweight analyzers refuse to walk from there (#747)";
+  const homeRoot = realpathOrResolve(options.homeDir ?? os.homedir());
+  if (options.analysisRoot !== undefined) {
+    const unsafeExplicitRoot = !isSameOrWithin(homeRoot, analysisRoot) || isSameOrWithin(analysisRoot, homeRoot);
+    analysisRootValidation = unsafeExplicitRoot ? {
+      state: "unsafe",
+      root: analysisRoot,
+      reason: "explicit analysis root must be strictly contained by the canonical home directory"
+    } : { state: "safe", root: analysisRoot };
+  } else if (isAtOrAboveHomeDir(analysisRoot, options.homeDir)) {
+    analysisRootValidation = {
+      state: "unsafe",
+      root: analysisRoot,
+      reason: unsafeRootReason
+    };
+  } else {
+    analysisRootValidation = { state: "safe", root: analysisRoot };
+  }
+  if (analysisRootValidation.state !== "safe") {
+    incrementDegradationCount({
+      kind: "lens-diagnostics-analysis-root-rejected",
+      subject: analysisRoot,
+      reason: analysisRootValidation.reason
+    });
+    return {
+      analysisRootValidation,
+      diagnostics: [],
+      runners: [],
+      analyzed: [],
+      authoritativeCoverage: [],
+      cold: [...ANALYZER_IDS],
+      coldReasons: Object.fromEntries(ANALYZER_IDS.map((id) => [id, unsafeRootReason])),
+      failed: [],
+      timings: {},
+      unsafeRoot: analysisRootValidation.state === "unsafe"
+    };
+  }
+  const diagnostics = [];
+  const runners = [];
+  const analyzed = [];
+  const authoritativeCoverage = [];
+  const cold = [];
+  const coldReasons = {};
+  const partial = [];
+  const partialReasons = {};
+  const failed = [];
+  const timings = {};
+  const cachedAgeMs = {};
+  const settledIds = new Set;
+  let dispositionSuppressed = 0;
+  const dispositionSuppressedByLane = {};
+  function markCold(id, reason) {
+    pushUnique(cold, id);
+    coldReasons[id] = reason;
+  }
+  function markPartial(id, reason) {
+    pushUnique(partial, id);
+    partialReasons[id] = reason;
+  }
+  function record(id, adapted, elapsedMs, analysedRoot, analysis, observedAt) {
+    if (analysedRoot) {
+      pushUnique(analyzed, id);
+      if (analysis?.analyzedFiles !== undefined) {
+        const root = realpathOrResolve(analysisRoot);
+        authoritativeCoverage.push({
+          runnerId: id,
+          root,
+          files: new Set(analysis.analyzedFiles.map((file) => {
+            return realpathOrResolve(file);
+          }))
+        });
+        if (analysis.analyzedFiles.length === 0) {
+          recordDegradationOnce({
+            kind: "runner-coverage-empty",
+            subject: `${id}:${root}`,
+            reason: `${id} analysed this root but declared zero scanned files, so retained ${id} findings are kept rather than retired`
+          });
+        }
+      }
+    }
+    timings[id] = (timings[id] ?? 0) + elapsedMs;
+    const stamped = observedAt === undefined ? adapted : adapted.map((diagnostic) => ({ ...diagnostic, observedAt }));
+    const kept = applyDispositionsMultiFile(stamped, analysisRoot, (d) => d.filePath);
+    const suppressedHere = adapted.length - kept.length;
+    dispositionSuppressed += suppressedHere;
+    if (suppressedHere > 0) {
+      dispositionSuppressedByLane[id] = (dispositionSuppressedByLane[id] ?? 0) + suppressedHere;
+    }
+    if (kept.length > 0) {
+      diagnostics.push(...kept);
+      pushUnique(runners, id);
+    }
+  }
+  function recordFailed(id, result) {
+    failed.push({
+      id,
+      ..."reason" in result && result.reason !== undefined ? { reason: result.reason } : {},
+      summary: "summary" in result && typeof result.summary === "string" ? result.summary : "analyzer reported an unsuccessful run"
+    });
+  }
+  function task(id, run) {
+    return run().finally(() => settledIds.add(id));
+  }
+  const tasks = [
+    task("knip", async () => {
+      const startMs = Date.now();
+      const result = await clients.knipClient.analyze(analysisRoot, getKnipIgnorePatterns());
+      if (!result.success) {
+        recordFailed("knip", result);
+        return;
+      }
+      if (result.analyzed !== true) {
+        markCold("knip", result.summary ?? "knip did not analyse this root");
+        return;
+      }
+      cacheManager.writeCache("knip", result, analysisRoot, {
+        scanDurationMs: Date.now() - startMs
+      });
+      record("knip", knipIssuesToProjectDiagnostics(analysisRoot, result.issues ?? []), Date.now() - startMs, true, result, laneObservedAtMs(result.scannedAt, startMs));
+    }),
+    task("jscpd", async () => {
+      if (!await clients.jscpdClient.ensureAvailable()) {
+        markCold("jscpd", reasonFromAvailabilityVerdict("jscpd", clients.jscpdClient.getAvailabilityVerdict?.()));
+        return;
+      }
+      const isTsProject = fs.existsSync(path.join(analysisRoot, "tsconfig.json"));
+      const scannerKey = isTsProject ? "jscpd-ts" : "jscpd";
+      const startMs = Date.now();
+      const result = await clients.jscpdClient.scan(analysisRoot, undefined, undefined, isTsProject);
+      if (!result.success) {
+        recordFailed("jscpd", result);
+        return;
+      }
+      if (result.analyzed !== true) {
+        markCold("jscpd", "jscpd did not analyse this root (no source files, or the scan produced no report)");
+        return;
+      }
+      cacheManager.writeCache(scannerKey, result, analysisRoot, {
+        scanDurationMs: Date.now() - startMs
+      });
+      record("jscpd", jscpdResultToProjectDiagnostics(analysisRoot, result), Date.now() - startMs, true, result, laneObservedAtMs(result.scannedAt, startMs));
+    }),
+    task("madge", async () => {
+      if (!await clients.depChecker.ensureAvailable()) {
+        markCold("madge", reasonFromAvailabilityVerdict("madge", clients.depChecker.getAvailabilityVerdict?.()));
+        return;
+      }
+      const startMs = Date.now();
+      const result = await clients.depChecker.scanProject(analysisRoot);
+      cacheManager.writeCache("madge", result, analysisRoot, {
+        scanDurationMs: Date.now() - startMs
+      });
+      record("madge", circularDepsToProjectDiagnostics(analysisRoot, result.circular ?? []), Date.now() - startMs, result.analyzed === true, result, laneObservedAtMs(result.scannedAt, startMs));
+    }),
+    task("gitleaks", async () => {
+      if (!GitleaksClient.hasGitRepo(analysisRoot)) {
+        markCold("gitleaks", "not a git repository (no .git found)");
+        return;
+      }
+      if (!await clients.gitleaksClient.ensureAvailable()) {
+        markCold("gitleaks", reasonFromAvailabilityVerdict("gitleaks", clients.gitleaksClient.getAvailabilityVerdict?.()));
+        return;
+      }
+      const startMs = Date.now();
+      const result = await clients.gitleaksClient.scan(analysisRoot, {
+        requireSignal: false
+      });
+      if (!result.success) {
+        recordFailed("gitleaks", result);
+        return;
+      }
+      cacheManager.writeCache("gitleaks", result, analysisRoot, {
+        scanDurationMs: Date.now() - startMs
+      });
+      record("gitleaks", gitleaksResultToProjectDiagnostics(analysisRoot, result), Date.now() - startMs, result.analyzed === true, result, laneObservedAtMs(result.scannedAt, startMs));
+    }),
+    task("govulncheck", async () => {
+      if (!GovulncheckClient.hasGoModule(analysisRoot)) {
+        markCold("govulncheck", "no go.mod found (not a Go module)");
+        return;
+      }
+      if (!await clients.govulncheckClient.ensureAvailable()) {
+        markCold("govulncheck", isToolInstallAllowedByTrust() ? reasonFromAvailabilityVerdict("govulncheck", clients.govulncheckClient.getAvailabilityVerdict?.()) : projectTrustDenialReason() ?? "govulncheck binary unavailable");
+        return;
+      }
+      const startMs = Date.now();
+      const result = await clients.govulncheckClient.analyze(analysisRoot);
+      if (!result.success) {
+        recordFailed("govulncheck", result);
+        return;
+      }
+      cacheManager.writeCache("govulncheck", result, analysisRoot, {
+        scanDurationMs: Date.now() - startMs
+      });
+      record("govulncheck", govulncheckResultToProjectDiagnostics(analysisRoot, result), Date.now() - startMs, result.analyzed === true, result, laneObservedAtMs(result.scannedAt, startMs));
+    }),
+    task("opengrep", async () => {
+      if (!await clients.opengrepClient.ensureAvailable()) {
+        markCold("opengrep", reasonFromAvailabilityVerdict("opengrep", clients.opengrepClient.getAvailabilityVerdict?.()));
+        return;
+      }
+      const startMs = Date.now();
+      const result = await clients.opengrepClient.scan(analysisRoot);
+      if (!result.success) {
+        recordFailed("opengrep", result);
+        return;
+      }
+      if (result.analyzed !== true) {
+        const reason = result.summary ?? result.reason ?? "opengrep did not analyse this root";
+        if (result.partial)
+          markPartial("opengrep", reason);
+        else
+          markCold("opengrep", reason);
+        record("opengrep", opengrepResultToProjectDiagnostics(analysisRoot, result), Date.now() - startMs, false, result, laneObservedAtMs(result.scannedAt, startMs));
+        return;
+      }
+      if (result.partial) {
+        markPartial("opengrep", result.summary ?? result.reason ?? "opengrep scan coverage is incomplete");
+        record("opengrep", opengrepResultToProjectDiagnostics(analysisRoot, result), Date.now() - startMs, true, result, laneObservedAtMs(result.scannedAt, startMs));
+        return;
+      }
+      cacheManager.writeCache("opengrep", result, analysisRoot, {
+        scanDurationMs: Date.now() - startMs
+      });
+      record("opengrep", opengrepResultToProjectDiagnostics(analysisRoot, result), Date.now() - startMs, result.analyzed === true, result, laneObservedAtMs(result.scannedAt, startMs));
+    }),
+    task("trivy", async () => {
+      if (!TrivyClient.shouldScan(analysisRoot)) {
+        markCold("trivy", "not opted in (.dm-lens.json trivy.enabled) or no dependency manifest found");
+        return;
+      }
+      if (!await clients.trivyClient.ensureAvailable()) {
+        markCold("trivy", reasonFromAvailabilityVerdict("trivy", clients.trivyClient.getAvailabilityVerdict?.()));
+        return;
+      }
+      const startMs = Date.now();
+      const result = await clients.trivyClient.scan(analysisRoot);
+      if (!result.success) {
+        recordFailed("trivy", result);
+        return;
+      }
+      cacheManager.writeCache("trivy", result, analysisRoot, {
+        scanDurationMs: Date.now() - startMs
+      });
+      record("trivy", trivyResultToProjectDiagnostics(analysisRoot, result), Date.now() - startMs, result.analyzed === true, result, laneObservedAtMs(result.scannedAt, startMs));
+    }),
+    task("dead-code", async () => {
+      const applicable = clients.deadCodeClients.filter((c) => c.detect(analysisRoot));
+      if (applicable.length === 0) {
+        markCold("dead-code", "no dead-code client detected an applicable language for this project");
+        return;
+      }
+      await Promise.all(applicable.map(async (client) => {
+        const cacheKey = `dead-code-${client.id}`;
+        const startMs = Date.now();
+        const result = await client.analyze(analysisRoot);
+        if (!result.success) {
+          recordFailed("dead-code", result);
+          return;
+        }
+        if (result.analyzed === true) {
+          cacheManager.writeCache(cacheKey, result, analysisRoot, {
+            scanDurationMs: Date.now() - startMs
+          });
+        }
+        const adapted = deadCodeResultToProjectDiagnostics(analysisRoot, result);
+        record("dead-code", adapted, Date.now() - startMs, result.analyzed === true, result, laneObservedAtMs(result.scannedAt, startMs));
+      }));
+    }),
+    task("test-runner", async () => {
+      const startMs = Date.now();
+      const cached = cacheManager.readCache("test-runner-findings", analysisRoot);
+      if (!cached?.data) {
+        markCold("test-runner", "no turn_end test-runner cache entry yet this session");
+        return;
+      }
+      cachedAgeMs["test-runner"] = Date.now() - new Date(cached.meta.timestamp).getTime();
+      record("test-runner", testRunnerFindingsToProjectDiagnostics(cached.data, analysisRoot, options.runtime), Date.now() - startMs, false, undefined, laneObservedAtMs(cached.data.launchedFrom?.revision.capturedAt ?? cached.meta.timestamp, startMs));
+    })
+  ];
+  const allSettled = Promise.all(tasks).then(() => "completed").catch(() => "completed");
+  const outcome = signal ? await Promise.race([
+    allSettled,
+    new Promise((resolve) => {
+      if (signal.aborted) {
+        resolve("aborted");
+        return;
+      }
+      signal.addEventListener("abort", () => resolve("aborted"), {
+        once: true
+      });
+    })
+  ]) : await allSettled;
+  if (outcome === "aborted") {
+    const abortedIds = ANALYZER_IDS.filter((id) => !settledIds.has(id));
+    for (const id of abortedIds)
+      pushUnique(cold, id);
+    return {
+      analysisRootValidation,
+      diagnostics,
+      runners,
+      analyzed,
+      authoritativeCoverage,
+      cold,
+      coldReasons,
+      partial,
+      partialReasons,
+      failed,
+      timings,
+      cachedAgeMs,
+      aborted: true,
+      abortedIds,
+      dispositionSuppressed,
+      dispositionSuppressedByLane
+    };
+  }
+  return {
+    analysisRootValidation,
+    diagnostics,
+    runners,
+    analyzed,
+    authoritativeCoverage,
+    cold,
+    coldReasons,
+    partial,
+    partialReasons,
+    failed,
+    timings,
+    cachedAgeMs,
+    dispositionSuppressed,
+    dispositionSuppressedByLane
+  };
+}

package/extensions/dm-lens/dist/clients/project-diagnostics/runner-adapters/call-graph-impact.js

@@ -0,0 +1,64 @@
+import * as path from "node:path";
+import { parseSymbolKey } from "../../call-graph.js";
+import { isTestRoleCollateral } from "../../collateral-test-role.js";
+function resolveImpactFile(cwd, filePath) {
+  return path.isAbsolute(filePath) ? filePath : path.resolve(cwd, filePath);
+}
+function displayName(key) {
+  return parseSymbolKey(key).symbolName ?? key;
+}
+function severityFor(severity) {
+  if (severity === "WillBreak") {
+    return {
+      severity: "warning",
+      message: "Direct caller of a symbol edited this turn — verify this call site still matches its new signature/behavior."
+    };
+  }
+  if (severity === "MayBreak") {
+    return {
+      severity: "info",
+      message: "Indirect caller (one hop) of a symbol edited this turn — worth a quick check."
+    };
+  }
+  return null;
+}
+const SEVERITY_RANK = {
+  error: 3,
+  warning: 2,
+  info: 1,
+  hint: 0
+};
+export function callGraphImpactToProjectDiagnostics(cwd, findings) {
+  const byKey = new Map;
+  for (const { calleeKey, results } of findings) {
+    const calleeName = displayName(calleeKey);
+    for (const result of results) {
+      const mapped = severityFor(result.severity);
+      if (!mapped)
+        continue;
+      const { filePath } = parseSymbolKey(result.symbolKey);
+      if (!filePath)
+        continue;
+      const resolvedFile = resolveImpactFile(cwd, filePath);
+      if (isTestRoleCollateral(resolvedFile))
+        continue;
+      const dedupeKey = `${resolvedFile}:${result.symbolKey}`;
+      const existing = byKey.get(dedupeKey);
+      if (existing && SEVERITY_RANK[existing.severity] >= SEVERITY_RANK[mapped.severity]) {
+        continue;
+      }
+      const callerName = displayName(result.symbolKey);
+      byKey.set(dedupeKey, {
+        filePath: resolvedFile,
+        severity: mapped.severity,
+        semantic: "warning",
+        tool: "call-graph",
+        runner: "call-graph",
+        rule: `call-graph:${result.severity.toLowerCase()}`,
+        message: `${mapped.message} (${callerName} calls edited symbol '${calleeName}')`,
+        source: "project-scan"
+      });
+    }
+  }
+  return [...byKey.values()];
+}

package/extensions/dm-lens/dist/clients/project-diagnostics/runner-adapters/dead-code.js

@@ -0,0 +1,38 @@
+import * as path from "node:path";
+function deadCodeRunnerId(language) {
+  return `dead-code-${language}`;
+}
+function deadCodeMessage(issue) {
+  if (issue.category === "unlisted")
+    return `Unlisted dependency ${issue.name}`;
+  if (issue.category === "dependency")
+    return `Unused dependency ${issue.name}`;
+  if (issue.category === "file")
+    return `Unused file ${issue.name}`;
+  return `Unused ${issue.kind} ${issue.name}`;
+}
+export function deadCodeIssueToProjectDiagnostic(cwd, issue, language) {
+  const blocking = issue.category === "unlisted";
+  return {
+    filePath: issue.file ? path.isAbsolute(issue.file) ? issue.file : path.resolve(cwd, issue.file) : cwd,
+    line: issue.line,
+    severity: blocking ? "error" : "warning",
+    semantic: blocking ? "blocking" : "warning",
+    tool: "dead-code",
+    runner: deadCodeRunnerId(language),
+    rule: `dead-code:${issue.category}`,
+    message: deadCodeMessage(issue),
+    source: "project-scan"
+  };
+}
+export function deadCodeResultToProjectDiagnostics(cwd, result) {
+  if (!result.success)
+    return [];
+  const issues = [
+    ...result.unusedExports,
+    ...result.unusedFiles,
+    ...result.unusedDeps,
+    ...result.unlistedDeps
+  ];
+  return issues.map((issue) => deadCodeIssueToProjectDiagnostic(cwd, issue, result.language));
+}

package/extensions/dm-lens/dist/clients/project-diagnostics/runner-adapters/gitleaks.js

@@ -0,0 +1,21 @@
+import * as path from "node:path";
+export function gitleaksFindingToProjectDiagnostic(cwd, finding) {
+  const statusSuffix = finding.pathStatus ? ` [git: ${finding.pathStatus}]` : "";
+  const isBlocking = finding.pathStatus !== "scratch" && finding.pathStatus !== "ignored" && finding.pathStatus !== "nested-repository";
+  return {
+    filePath: path.isAbsolute(finding.file) ? finding.file : path.resolve(cwd, finding.file),
+    line: finding.startLine,
+    severity: isBlocking ? "error" : "info",
+    semantic: isBlocking ? "blocking" : "none",
+    tool: "gitleaks",
+    runner: "gitleaks",
+    rule: `gitleaks:${finding.ruleId}`,
+    message: `Potential secret: ${finding.description || finding.ruleId}${statusSuffix}`,
+    source: "project-scan"
+  };
+}
+export function gitleaksResultToProjectDiagnostics(cwd, result) {
+  if (!result.success || result.findings.length === 0)
+    return [];
+  return result.findings.map((finding) => gitleaksFindingToProjectDiagnostic(cwd, finding));
+}