@duckmind/dm-darwin-x64 0.66.5 → 0.66.6

package/extensions/dm-lens/dist/clients/trivy-client.js

@@ -0,0 +1,335 @@
+import * as fs from "node:fs";
+import * as path from "node:path";
+import { mkdtempSync } from "node:fs";
+import { loadDmLensProjectConfig } from "./project-lens-config.js";
+import { incrementDegradationCount } from "./degradation-ledger.js";
+import { toPosix } from "./path-utils.js";
+import { scannerReportParentDir } from "./scanner-temp-root.js";
+import { getScratchTreeGlobPatterns, nestedWorktreeOffsets } from "./scratch-tree-policy.js";
+import { safeSpawnAsync } from "./safe-spawn.js";
+import { SecurityScanClient } from "./security-scan-client.js";
+const EMPTY_RESULT = {
+  success: false,
+  findings: [],
+  secrets: [],
+  licenses: []
+};
+const SCAN_TIMEOUT_MS = 180000;
+const DEPENDENCY_MANIFESTS = [
+  "package.json",
+  "package-lock.json",
+  "pnpm-lock.yaml",
+  "yarn.lock",
+  "bun.lockb",
+  "pyproject.toml",
+  "requirements.txt",
+  "poetry.lock",
+  "Pipfile.lock",
+  "pom.xml",
+  "build.gradle",
+  "build.gradle.kts",
+  "gradle.lockfile",
+  "go.mod",
+  "go.sum",
+  "Cargo.toml",
+  "Cargo.lock",
+  "packages.lock.json",
+  "composer.json",
+  "composer.lock",
+  "Gemfile",
+  "Gemfile.lock"
+];
+export function hasAnyDependencyManifest(cwd) {
+  for (const manifest of DEPENDENCY_MANIFESTS) {
+    try {
+      if (fs.existsSync(path.join(cwd, manifest)))
+        return true;
+    } catch {}
+  }
+  return false;
+}
+export function isTrivyEnabled(cwd) {
+  try {
+    const config = loadDmLensProjectConfig(cwd);
+    const trivy = config.raw?.trivy;
+    return trivy?.enabled === true;
+  } catch {
+    return false;
+  }
+}
+export function shouldScanTrivy(cwd) {
+  return isTrivyEnabled(cwd) && hasAnyDependencyManifest(cwd);
+}
+const SEVERITY_RANK = {
+  LOW: 0,
+  MEDIUM: 1,
+  HIGH: 2,
+  CRITICAL: 3
+};
+export function resolveSeverityFloor(cwd) {
+  let raw;
+  try {
+    const config = loadDmLensProjectConfig(cwd);
+    raw = config.raw?.trivy?.minSeverity;
+  } catch {
+    raw = undefined;
+  }
+  const requested = typeof raw === "string" ? SEVERITY_RANK[raw.toUpperCase()] : undefined;
+  const floor = Math.min(requested ?? SEVERITY_RANK.HIGH, SEVERITY_RANK.HIGH);
+  return ["LOW", "MEDIUM", "HIGH", "CRITICAL"].filter((s) => SEVERITY_RANK[s] >= floor);
+}
+export function worktreeSkipDirs(cwd, separator = path.sep, maxArgumentChars = separator === "\\" ? 30000 : Number.POSITIVE_INFINITY) {
+  const unsafe = separator === "\\" ? /[,"*?[\]{}]/ : /[,"*?[\]{}\\]/;
+  const skips = [];
+  let argumentChars = 0;
+  for (const offset of nestedWorktreeOffsets(cwd)) {
+    if (unsafe.test(offset)) {
+      incrementDegradationCount({
+        kind: "scan-worktree-exclusion-skipped",
+        subject: "trivy",
+        reason: `csv-or-glob-char-in-path: ${offset} not skipped under ${cwd}`
+      });
+      continue;
+    }
+    const value = toPosix(offset);
+    const addedChars = "--skip-dirs".length + value.length + 2;
+    if (argumentChars + addedChars > maxArgumentChars) {
+      incrementDegradationCount({
+        kind: "scan-worktree-exclusion-skipped",
+        subject: "trivy",
+        reason: `windows-command-line-cap: ${offset} not skipped under ${cwd}`
+      });
+      continue;
+    }
+    skips.push(value);
+    argumentChars += addedChars;
+  }
+  return skips;
+}
+
+export class TrivyClient extends SecurityScanClient {
+  constructor(verbose = false) {
+    super("trivy", verbose);
+  }
+  static hasAnyDependencyManifest(cwd) {
+    return hasAnyDependencyManifest(cwd);
+  }
+  static shouldScan(cwd) {
+    return shouldScanTrivy(cwd);
+  }
+  doEnsureAvailable() {
+    return this.ensureViaInstaller(["--version"]);
+  }
+  async scan(cwd) {
+    const targetDir = path.resolve(cwd);
+    const scannedAt = new Date().toISOString();
+    if (!shouldScanTrivy(targetDir)) {
+      return {
+        ...EMPTY_RESULT,
+        success: true,
+        scannedAt,
+        summary: hasAnyDependencyManifest(targetDir) ? "trivy not enabled (set trivy.enabled in .dm-lens.json)" : "no dependency manifest at analysis root"
+      };
+    }
+    if (!await this.ensureAvailable()) {
+      return { ...EMPTY_RESULT, scannedAt, summary: "trivy not installed" };
+    }
+    return this.dedupeScan(targetDir, () => this.runScan(targetDir));
+  }
+  async runScan(cwd) {
+    const scannedAt = new Date().toISOString();
+    const bin = this.binaryPath ?? "trivy";
+    const severities = resolveSeverityFloor(cwd);
+    const outDir = mkdtempSync(path.join(scannerReportParentDir(), "dm-lens-trivy-"));
+    const reportPath = path.join(outDir, "trivy-report.json");
+    try {
+      const result = await safeSpawnAsync(bin, [
+        "fs",
+        "--scanners",
+        "vuln,secret,license",
+        "--severity",
+        severities.join(","),
+        "--format",
+        "json",
+        "--output",
+        reportPath,
+        "--quiet",
+        "--no-progress",
+        ...[
+          ...getScratchTreeGlobPatterns(),
+          ...worktreeSkipDirs(cwd)
+        ].flatMap((glob) => ["--skip-dirs", glob]),
+        cwd
+      ], { cwd, timeout: SCAN_TIMEOUT_MS });
+      if (result.error) {
+        this.log(`Scan error: ${result.error.message}`);
+        return {
+          ...EMPTY_RESULT,
+          scannedAt,
+          summary: result.error.message.slice(0, 200)
+        };
+      }
+      if (!fs.existsSync(reportPath)) {
+        return {
+          ...EMPTY_RESULT,
+          success: true,
+          scannedAt,
+          summary: (result.stderr ?? "").trim().split(`
+`)[0] || "no report produced"
+        };
+      }
+      const raw = fs.readFileSync(reportPath, "utf-8");
+      const findings = parseTrivyReport(raw);
+      const secrets = parseTrivySecrets(raw);
+      const licenses = parseTrivyLicenses(raw);
+      return {
+        success: true,
+        analyzed: true,
+        findings,
+        secrets,
+        licenses,
+        scannedAt
+      };
+    } catch (err) {
+      return {
+        ...EMPTY_RESULT,
+        scannedAt,
+        summary: err instanceof Error ? err.message.slice(0, 200) : String(err)
+      };
+    } finally {
+      try {
+        fs.rmSync(outDir, { recursive: true, force: true });
+      } catch {}
+    }
+  }
+}
+function normalizeSeverity(raw) {
+  const s = typeof raw === "string" ? raw.toUpperCase() : "";
+  if (s === "CRITICAL" || s === "HIGH" || s === "MEDIUM" || s === "LOW") {
+    return s;
+  }
+  return "UNKNOWN";
+}
+export function parseTrivyReport(raw) {
+  if (!raw.trim())
+    return [];
+  let parsed;
+  try {
+    parsed = JSON.parse(raw);
+  } catch {
+    return [];
+  }
+  const results = parsed?.Results;
+  if (!Array.isArray(results))
+    return [];
+  const findings = [];
+  for (const resultEntry of results) {
+    if (!resultEntry || typeof resultEntry !== "object")
+      continue;
+    const r = resultEntry;
+    const target = typeof r.Target === "string" ? r.Target : undefined;
+    const vulns = r.Vulnerabilities;
+    if (!Array.isArray(vulns))
+      continue;
+    for (const vulnEntry of vulns) {
+      if (!vulnEntry || typeof vulnEntry !== "object")
+        continue;
+      const v = vulnEntry;
+      const vulnerabilityId = typeof v.VulnerabilityID === "string" ? v.VulnerabilityID : undefined;
+      const pkgName = typeof v.PkgName === "string" ? v.PkgName : undefined;
+      if (!vulnerabilityId || !pkgName)
+        continue;
+      findings.push({
+        vulnerabilityId,
+        pkgName,
+        installedVersion: typeof v.InstalledVersion === "string" ? v.InstalledVersion : undefined,
+        fixedVersion: typeof v.FixedVersion === "string" && v.FixedVersion.trim() ? v.FixedVersion : undefined,
+        severity: normalizeSeverity(v.Severity),
+        title: typeof v.Title === "string" ? v.Title : undefined,
+        primaryUrl: typeof v.PrimaryURL === "string" ? v.PrimaryURL : undefined,
+        target
+      });
+    }
+  }
+  return findings;
+}
+export function parseTrivySecrets(raw) {
+  if (!raw.trim())
+    return [];
+  let parsed;
+  try {
+    parsed = JSON.parse(raw);
+  } catch {
+    return [];
+  }
+  const results = parsed?.Results;
+  if (!Array.isArray(results))
+    return [];
+  const secrets = [];
+  for (const resultEntry of results) {
+    if (!resultEntry || typeof resultEntry !== "object")
+      continue;
+    const r = resultEntry;
+    const target = typeof r.Target === "string" ? r.Target : undefined;
+    const rows = r.Secrets;
+    if (!target || !Array.isArray(rows))
+      continue;
+    for (const row of rows) {
+      if (!row || typeof row !== "object")
+        continue;
+      const s = row;
+      const ruleId = typeof s.RuleID === "string" ? s.RuleID : undefined;
+      const line = typeof s.StartLine === "number" ? s.StartLine : undefined;
+      if (!ruleId || line == null)
+        continue;
+      secrets.push({
+        ruleId,
+        file: target,
+        line,
+        title: typeof s.Title === "string" ? s.Title : undefined
+      });
+    }
+  }
+  return secrets;
+}
+export function parseTrivyLicenses(raw) {
+  if (!raw.trim())
+    return [];
+  let parsed;
+  try {
+    parsed = JSON.parse(raw);
+  } catch {
+    return [];
+  }
+  const results = parsed?.Results;
+  if (!Array.isArray(results))
+    return [];
+  const licenses = [];
+  for (const resultEntry of results) {
+    if (!resultEntry || typeof resultEntry !== "object")
+      continue;
+    const r = resultEntry;
+    const target = typeof r.Target === "string" ? r.Target : undefined;
+    const rows = r.Licenses;
+    if (!Array.isArray(rows))
+      continue;
+    for (const row of rows) {
+      if (!row || typeof row !== "object")
+        continue;
+      const l = row;
+      const license = typeof l.Name === "string" ? l.Name : undefined;
+      if (!license)
+        continue;
+      const filePath = typeof l.FilePath === "string" && l.FilePath ? l.FilePath : target;
+      const pkgName = typeof l.PkgName === "string" && l.PkgName ? l.PkgName : filePath ?? "unknown";
+      licenses.push({
+        license,
+        pkgName,
+        severity: normalizeSeverity(l.Severity),
+        category: typeof l.Category === "string" ? l.Category : undefined,
+        filePath
+      });
+    }
+  }
+  return licenses;
+}

package/extensions/dm-lens/dist/clients/tui-fit.js

@@ -0,0 +1,26 @@
+import { truncateToWidth } from "./deps/dm-tui-compat.js";
+const ELLIPSIS_KIND = { "…": 0, "...": 1, "": 2 };
+let truncateIsNative = null;
+export function fitLine(s, maxWidth, ellipsis = "...") {
+  const w = Math.max(0, maxWidth);
+  const fn = truncateToWidth;
+  if (truncateIsNative === true) {
+    return fn(s, w, ELLIPSIS_KIND[ellipsis] ?? 1, false, 8);
+  }
+  if (truncateIsNative === false) {
+    return fn(s, w, ellipsis);
+  }
+  try {
+    const out = fn(s, w, ellipsis);
+    truncateIsNative = false;
+    return out;
+  } catch {
+    truncateIsNative = true;
+    return fn(s, w, ELLIPSIS_KIND[ellipsis] ?? 1, false, 8);
+  }
+}
+export function fitLines(lines, width) {
+  if (!Number.isFinite(width) || width <= 0)
+    return lines;
+  return lines.map((line) => fitLine(line, width));
+}

package/extensions/dm-lens/dist/clients/turn-context.js

@@ -0,0 +1,48 @@
+import { AsyncLocalStorage } from "node:async_hooks";
+import { getProcessSingleton } from "./process-singletons.js";
+const FAMILY = "turn-context";
+const VERSION = 2;
+function state() {
+  return getProcessSingleton(FAMILY, VERSION, () => ({
+    sessions: new Map,
+    activeSession: new AsyncLocalStorage
+  }));
+}
+function sessionState(sessionId) {
+  const current = state();
+  let session = current.sessions.get(sessionId);
+  if (!session) {
+    session = { turnId: `${sessionId}:0`, turnIndex: 0 };
+    current.sessions.set(sessionId, session);
+  }
+  return session;
+}
+export function resetTurnContext(sessionId) {
+  const current = state();
+  if (sessionId === undefined)
+    return;
+  current.sessions.set(sessionId, { turnId: `${sessionId}:0`, turnIndex: 0 });
+}
+export function setTurnContextSession(sessionId) {
+  const stableSessionId = sessionId?.trim();
+  if (stableSessionId !== undefined && stableSessionId !== "")
+    sessionState(stableSessionId);
+}
+export function beginTurnContext(sessionId) {
+  const session = sessionState(sessionId);
+  session.turnIndex += 1;
+  session.turnId = `${sessionId}:${session.turnIndex}`;
+  return session.turnId;
+}
+export function runWithTurnContext(sessionId, fn) {
+  if (sessionId === undefined)
+    return fn();
+  return state().activeSession.run(sessionId, fn);
+}
+export function getTurnId() {
+  const current = state();
+  const sessionId = current.activeSession.getStore();
+  if (sessionId === undefined)
+    return "turn:0";
+  return sessionState(sessionId).turnId;
+}

package/extensions/dm-lens/dist/clients/turn-end/delivery-holds.js

@@ -0,0 +1,59 @@
+export function planDeliveryHolds(args) {
+  const byPart = new Map;
+  for (const hold of args.holds) {
+    const queue = byPart.get(hold.part);
+    if (queue)
+      queue.push(hold);
+    else
+      byPart.set(hold.part, [hold]);
+  }
+  const settled = [];
+  let start = 0;
+  for (const part of args.parts) {
+    const end = start + part.text.length;
+    const hold = byPart.get(part.raw)?.shift();
+    if (hold) {
+      const whole = end <= args.keptChars;
+      const leadsOversized = start === 0;
+      const reached = whole || leadsOversized;
+      settled.push({
+        hold,
+        reached,
+        keeps: reached || (hold.canHold?.() ?? true)
+      });
+    }
+    start = end + args.separatorLength;
+  }
+  return {
+    heldCount: settled.reduce((n, entry) => n + (entry.reached || !entry.keeps ? 0 : 1), 0),
+    settle: ({ suppressed, isCurrentSession, onFault }) => {
+      let delivered = 0;
+      let held = 0;
+      let dropped = 0;
+      const live = isCurrentSession();
+      for (const { hold, reached, keeps } of settled) {
+        if (reached)
+          delivered += 1;
+        else if (keeps)
+          held += 1;
+        else
+          dropped += 1;
+        if (!live)
+          continue;
+        const run = reached ? suppressed && hold.skipOnSuppressed ? undefined : hold.onDelivered : keeps ? hold.onHeld : hold.onDropped;
+        if (!run)
+          continue;
+        try {
+          run();
+        } catch (cause) {
+          onFault(cause);
+        }
+      }
+      return { delivered, held, dropped };
+    }
+  };
+}
+export function stillReportedParked(parked, current, keyOf, offeredKeys) {
+  const parkedKeys = new Set(parked.map(keyOf));
+  return current.filter((item) => parkedKeys.has(keyOf(item)) && !offeredKeys.has(keyOf(item)));
+}

package/extensions/dm-lens/dist/clients/turn-end/lane.js

@@ -0,0 +1 @@
+export {};

package/extensions/dm-lens/dist/clients/turn-end/lanes/govulncheck.js

@@ -0,0 +1,54 @@
+import { filterFindingsByDisposition } from "../../dispatch/finding-policy.js";
+import { toRunnerDisplayPath } from "../../dispatch/runner-context.js";
+import { govulncheckFindingToProjectDiagnostic } from "../../project-diagnostics/runner-adapters/govulncheck.js";
+import { STALE_LINE_MARKER } from "../../stale-marker.js";
+async function collect(ctx) {
+  const data = (await ctx.readScannerCache("govulncheck"))?.data;
+  return {
+    govulncheck: {
+      findings: data?.findings ?? [],
+      scannedAt: data?.scannedAt,
+      citedPath: (finding) => finding.trace.find((frame) => frame.filename)?.filename,
+      onMissing: "demote"
+    }
+  };
+}
+function gate(gates, ctx) {
+  const stale = new Set(gates.govulncheck.stale);
+  const filtered = filterFindingsByDisposition([...gates.govulncheck.live, ...gates.govulncheck.stale], ctx.cwd, (f) => govulncheckFindingToProjectDiagnostic(ctx.cwd, f));
+  return {
+    findings: filtered.kept,
+    stale,
+    suppressed: filtered.suppressed
+  };
+}
+function render(kept, ctx) {
+  const advisorySections = [];
+  if (kept.findings.length) {
+    const findings = kept.findings.slice(0, 5);
+    let report = `\uD83D\uDEE1️ Go CVEs reachable from this code (govulncheck) — upgrade where possible:
+`;
+    for (const f of findings) {
+      const callSite = f.trace.find((t) => t.filename);
+      const stale = kept.stale.has(f);
+      const where = callSite?.filename ? `${toRunnerDisplayPath(ctx.cwd, callSite.filename)}${!stale && callSite.line ? `:${callSite.line}` : ""}${stale ? ` ${STALE_LINE_MARKER}` : ""}` : f.module ?? f.packageName ?? "(module)";
+      const fix = f.fixedVersion ? ` — upgrade to ${f.fixedVersion} or later` : " — no fix yet, track upstream";
+      report += `  ${f.osv} (${where})${fix}
+`;
+    }
+    if (kept.findings.length > findings.length) {
+      report += `  … and ${kept.findings.length - findings.length} more
+`;
+    }
+    advisorySections.push(report);
+  }
+  return {
+    advisoryParts: advisorySections,
+    dispositionSuppressed: { govulncheck: kept.suppressed }
+  };
+}
+export const govulncheckLane = {
+  collect,
+  gate,
+  render
+};

package/extensions/dm-lens/dist/clients/turn-end/lanes/secrets.js

@@ -0,0 +1,131 @@
+import { recordDegradationOnce } from "../../degradation-ledger.js";
+import { bounded } from "../../deadline-utils.js";
+import { filterFindingsByDisposition } from "../../dispatch/finding-policy.js";
+import { toRunnerDisplayPath } from "../../dispatch/runner-context.js";
+import { classifyAndFilterFindings } from "../../gitleaks-client.js";
+import { HOOK_WALL_BUDGET_MS } from "../../hook-budgets.js";
+import { gitleaksFindingToProjectDiagnostic } from "../../project-diagnostics/runner-adapters/gitleaks.js";
+import { trivySecretFindingToProjectDiagnostic } from "../../project-diagnostics/runner-adapters/trivy.js";
+import { dedupeSecretFindings, fromAstGrepWarnings, fromGitleaks, fromTrivySecrets, isSecretWarning, secretLocationKey } from "../../secret-findings.js";
+import { STALE_LINE_MARKER } from "../../stale-marker.js";
+async function blockingGitleaksFindings(data, ctx) {
+  const classification = await bounded(classifyAndFilterFindings(data?.findings ?? [], ctx.cwd), {
+    ms: HOOK_WALL_BUDGET_MS.turn_end,
+    signal: ctx.signal,
+    hook: "turn_end",
+    label: "classifyAndFilterFindings"
+  });
+  if (classification === undefined) {
+    recordDegradationOnce({
+      kind: "gitleaks_classification_timeout",
+      subject: ctx.cwd,
+      reason: "gitleaks classification exceeded the turn_end budget; retained raw findings to fail open"
+    });
+  }
+  return (classification ?? data?.findings ?? []).filter((finding) => gitleaksFindingToProjectDiagnostic(ctx.cwd, finding).semantic === "blocking");
+}
+async function collect(ctx) {
+  const [gitleaksEntry, trivyEntry] = await Promise.all([
+    ctx.readScannerCache("gitleaks"),
+    ctx.readScannerCache("trivy")
+  ]);
+  const gitleaksData = gitleaksEntry?.data;
+  const trivyData = trivyEntry?.data;
+  return {
+    gitleaks: {
+      findings: await blockingGitleaksFindings(gitleaksData, ctx),
+      citedPath: (finding) => finding.file,
+      scannedAt: gitleaksData?.scannedAt
+    },
+    "trivy-secrets": {
+      findings: trivyData?.secrets ?? [],
+      citedPath: (finding) => finding.file,
+      scannedAt: trivyData?.scannedAt
+    }
+  };
+}
+function gate(gates, ctx) {
+  const gitleaksLive = filterFindingsByDisposition(gates.gitleaks.live, ctx.cwd, (f) => gitleaksFindingToProjectDiagnostic(ctx.cwd, f));
+  const gitleaksStale = filterFindingsByDisposition(gates.gitleaks.stale, ctx.cwd, (f) => gitleaksFindingToProjectDiagnostic(ctx.cwd, f));
+  const trivyLive = filterFindingsByDisposition(gates["trivy-secrets"].live, ctx.cwd, (f) => trivySecretFindingToProjectDiagnostic(ctx.cwd, f));
+  const trivyStale = filterFindingsByDisposition(gates["trivy-secrets"].stale, ctx.cwd, (f) => trivySecretFindingToProjectDiagnostic(ctx.cwd, f));
+  return {
+    gitleaksLive: gitleaksLive.kept,
+    gitleaksStale: gitleaksStale.kept,
+    trivyLive: trivyLive.kept,
+    trivyStale: trivyStale.kept,
+    suppressed: {
+      gitleaks: gitleaksLive.suppressed + gitleaksStale.suppressed,
+      "trivy-secrets": trivyLive.suppressed + trivyStale.suppressed
+    }
+  };
+}
+function render(kept, ctx) {
+  const sessionSecrets = dedupeSecretFindings([
+    ...fromGitleaks(kept.gitleaksLive),
+    ...fromTrivySecrets(kept.trivyLive)
+  ]);
+  const deliveredLocationKeys = new Set(sessionSecrets.map((f) => secretLocationKey(f.file, f.line)));
+  const blockerSections = [];
+  if (sessionSecrets.length) {
+    const enriched = dedupeSecretFindings([
+      ...sessionSecrets,
+      ...fromAstGrepWarnings(ctx.peekActionableWarnings().filter(isSecretWarning)).filter((a) => deliveredLocationKeys.has(secretLocationKey(a.file, a.line)))
+    ]);
+    const shown = enriched.slice(0, 5);
+    let report = `\uD83D\uDD34 STOP — hardcoded secrets detected. Rotate the credentials and remove them from source:
+`;
+    for (const f of shown) {
+      const where = `${toRunnerDisplayPath(ctx.cwd, f.file)}:${f.line}`;
+      report += `  ${where} — ${f.rule} [${f.sources.join(" + ")}]${f.description ? `: ${f.description}` : ""}
+`;
+    }
+    if (enriched.length > shown.length) {
+      report += `  … and ${enriched.length - shown.length} more
+`;
+    }
+    blockerSections.push(report);
+  }
+  const staleSecretEntries = [
+    ...kept.gitleaksStale.map((f) => ({
+      file: toRunnerDisplayPath(ctx.cwd, f.file),
+      rule: f.ruleId,
+      source: "gitleaks"
+    })),
+    ...kept.trivyStale.map((f) => ({
+      file: toRunnerDisplayPath(ctx.cwd, f.file),
+      rule: f.ruleId,
+      source: "trivy"
+    }))
+  ];
+  const staleSecrets = [
+    ...new Map(staleSecretEntries.map((e) => [`${e.file}|${e.rule}|${e.source}`, e])).values()
+  ];
+  const staleSections = [];
+  if (staleSecrets.length) {
+    const shown = staleSecrets.slice(0, 5);
+    let report = `\uD83D\uDD11 ACTION NEEDED — secrets were flagged in files that changed after the scan. ${STALE_LINE_MARKER}
+` + `The cached line numbers are no longer trustworthy, so they are withheld. Re-run a secrets scan to confirm or clear these:
+`;
+    for (const entry of shown) {
+      report += `  ${entry.file} — ${entry.rule} [${entry.source}]
+`;
+    }
+    if (staleSecrets.length > shown.length) {
+      report += `  … and ${staleSecrets.length - shown.length} more
+`;
+    }
+    staleSections.push(report);
+  }
+  return {
+    blockerParts: blockerSections,
+    staleSecretParts: staleSections,
+    dispositionSuppressed: kept.suppressed,
+    deliveredLocationKeys
+  };
+}
+export const secretsLane = {
+  collect,
+  gate,
+  render
+};