@duckmind/dm-linux-x64 0.65.5 → 0.65.6

package/extensions/dm-lens/clients/tree-sitter-query-loader.js

@@ -1,7 +1,31 @@
 import { logTreeSitterDiagnostic } from "./tree-sitter-logger.js";
 import * as fs from "node:fs";
 import * as path from "node:path";
+import {
+  classifyBundledResourceDir,
+  reportBundledResourceDirHealth
+} from "./bundled-resource-health.js";
+import {
+  getDegradationLedgerGeneration,
+  recordDegradationOnce
+} from "./degradation-ledger.js";
+import yaml from "./deps/js-yaml.js";
 import { resolvePackagePath } from "./package-root.js";
+export const BUNDLED_QUERIES_ROOT = resolvePackagePath(import.meta.url, "rules", "tree-sitter-queries");
+let cachedBundledQueriesRootHealth;
+let cachedBundledQueriesRootHealthGeneration;
+export function getBundledQueriesRootHealth() {
+  const generation = getDegradationLedgerGeneration();
+  if (cachedBundledQueriesRootHealth === undefined || cachedBundledQueriesRootHealthGeneration !== generation) {
+    cachedBundledQueriesRootHealthGeneration = generation;
+    cachedBundledQueriesRootHealth = classifyBundledResourceDir(BUNDLED_QUERIES_ROOT);
+  }
+  return cachedBundledQueriesRootHealth;
+}
+export function _resetBundledQueriesRootHealthForTests() {
+  cachedBundledQueriesRootHealth = undefined;
+  cachedBundledQueriesRootHealthGeneration = undefined;
+}
 export function isDisabledQueryDirectoryName(name) {
   return name.endsWith("-disabled");
 }
@@ -18,7 +42,7 @@ export function ruleFilesForLanguage(languageId, rootDir = process.cwd()) {
   for (const lang of ruleSourceLanguages(languageId)) {
     for (const dir of [
       path.join(resolvedRoot, "rules", "tree-sitter-queries", lang),
-      resolvePackagePath(import.meta.url, "rules", "tree-sitter-queries", lang)
+      path.join(BUNDLED_QUERIES_ROOT, lang)
     ]) {
       if (!fs.existsSync(dir))
         continue;
@@ -28,16 +52,20 @@ export function ruleFilesForLanguage(languageId, rootDir = process.cwd()) {
       }
     }
   }
+  if (files.size === 0) {
+    const health = getBundledQueriesRootHealth();
+    if (health.status !== "healthy") {
+      reportBundledResourceDirHealth("tree-sitter-queries-dir-missing", BUNDLED_QUERIES_ROOT, health, "bundled tree-sitter query rules");
+    }
+  }
   return [...files];
 }
 export function queriesForLanguage(queries, languageId) {
   const enabled = (langId) => (queries.get(langId) ?? []).filter((q) => !isDisabledQueryFilePath(q.filePath));
   return ruleSourceLanguages(languageId).flatMap((langId) => enabled(langId));
 }
-function stripInlineComment(value) {
-  if (value.startsWith('"') || value.startsWith("'"))
-    return value;
-  return value.replace(/\s+#.*$/, "").trim();
+function str(value) {
+  return typeof value === "string" || typeof value === "number" || typeof value === "boolean" ? String(value) : undefined;
 }
 export function isDisabledQueryFilePath(filePath) {
   const normalized = filePath.replaceAll("\\", "/");
@@ -51,6 +79,8 @@ export class TreeSitterQueryLoader {
   loaded = false;
   loadedRoot = null;
   verbose;
+  parseFailures = new Map;
+  parseFailuresReplayedGeneration;
   constructor(verbose = false) {
     this.verbose = verbose;
   }
@@ -63,12 +93,35 @@ export class TreeSitterQueryLoader {
       });
     }
   }
+  recordQueryParseFailure(filePath, reason) {
+    this.parseFailures.set(filePath, reason);
+    recordDegradationOnce({
+      kind: "tree-sitter-query-parse-failed",
+      subject: filePath,
+      reason
+    });
+  }
+  replayQueryParseFailures() {
+    const generation = getDegradationLedgerGeneration();
+    if (this.parseFailuresReplayedGeneration === generation)
+      return;
+    this.parseFailuresReplayedGeneration = generation;
+    for (const [filePath, reason] of this.parseFailures) {
+      recordDegradationOnce({
+        kind: "tree-sitter-query-parse-failed",
+        subject: filePath,
+        reason
+      });
+    }
+  }
   async loadQueries(rootDir = process.cwd(), options = {}) {
     const resolvedRoot = path.resolve(rootDir);
     if (!options.force && this.loaded && this.loadedRoot === resolvedRoot) {
+      this.replayQueryParseFailures();
       return this.queries;
     }
     this.queries.clear();
+    this.parseFailures.clear();
     this.loaded = false;
     const queryDirs = [
       ...new Set([
@@ -102,30 +155,34 @@ export class TreeSitterQueryLoader {
     }
     this.loaded = true;
     this.loadedRoot = resolvedRoot;
+    this.parseFailuresReplayedGeneration = getDegradationLedgerGeneration();
     return this.queries;
   }
   parseQueryFile(filePath, language) {
     try {
       const content = fs.readFileSync(filePath, "utf-8");
       const parsed = this.parseYaml(content);
-      if (!parsed.id || !parsed.query) {
+      const id = str(parsed.id);
+      const query = typeof parsed.query === "string" ? parsed.query : undefined;
+      if (!id || !query) {
         this.dbg(`Invalid query file: ${filePath}`);
+        this.recordQueryParseFailure(filePath, !id ? `'id' is missing or not a scalar (got ${typeof parsed.id})` : `'query' is missing or not a string (got ${typeof parsed.query})`);
         return null;
       }
       return {
-        id: String(parsed.id),
-        name: String(parsed.name || parsed.id),
+        id,
+        name: str(parsed.name) || id,
         severity: this.parseSeverity(parsed.severity),
-        category: String(parsed.category || "general"),
-        language: String(parsed.language || language),
-        message: String(parsed.message || `Pattern: ${parsed.id}`),
-        description: parsed.description ? String(parsed.description) : undefined,
-        query: this.extractMultilineValue(content, "query") || String(parsed.query),
-        metavars: Array.isArray(parsed.metavars) ? parsed.metavars.map(String) : this.extractMetavars(String(parsed.query)),
-        post_filter: parsed.post_filter ? String(parsed.post_filter) : undefined,
+        category: str(parsed.category) || "general",
+        language: str(parsed.language) || language,
+        message: str(parsed.message) || `Pattern: ${id}`,
+        description: str(parsed.description) || undefined,
+        query,
+        metavars: Array.isArray(parsed.metavars) ? parsed.metavars.map(String) : this.extractMetavars(query),
+        post_filter: str(parsed.post_filter) || undefined,
         post_filter_params: parsed.post_filter_params,
-        defect_class: parsed.defect_class ? String(parsed.defect_class) : undefined,
-        inline_tier: parsed.inline_tier ? String(parsed.inline_tier) : undefined,
+        defect_class: str(parsed.defect_class) || undefined,
+        inline_tier: str(parsed.inline_tier) || undefined,
         skip_test_files: parsed.skip_test_files === true,
         ignore_paths: Array.isArray(parsed.ignore_paths) ? parsed.ignore_paths.map(String) : undefined,
         predicates: Array.isArray(parsed.predicates) ? parsed.predicates.map((p) => ({
@@ -136,128 +193,19 @@ export class TreeSitterQueryLoader {
         tags: Array.isArray(parsed.tags) ? parsed.tags.map(String) : undefined,
         cwe: Array.isArray(parsed.cwe) ? parsed.cwe.map(String) : undefined,
         owasp: Array.isArray(parsed.owasp) ? parsed.owasp.map(String) : undefined,
-        confidence: parsed.confidence ? String(parsed.confidence) : undefined,
+        confidence: str(parsed.confidence) || undefined,
         has_fix: parsed.has_fix === true || parsed.has_fix === "true",
-        fix_action: parsed.fix_action ? String(parsed.fix_action) : undefined,
+        fix_action: str(parsed.fix_action) || undefined,
         filePath
       };
     } catch (err) {
       this.dbg(`Failed to parse ${filePath}: ${err}`);
+      this.recordQueryParseFailure(filePath, err instanceof Error ? err.message : String(err));
       return null;
     }
   }
   parseYaml(content) {
-    const result = {};
-    const lines = content.split(`
-`);
-    for (let i = 0;i < lines.length; i++) {
-      const line = lines[i];
-      const match = line.match(/^([a-z_]+):\s*(.*)$/);
-      if (match) {
-        const key = match[1];
-        let value = stripInlineComment(match[2].trim());
-        if (value.startsWith("[") && value.endsWith("]")) {
-          value = value.slice(1, -1).split(",").map((s) => s.trim().replace(/^["']|["']$/g, ""));
-        } else if (value === "") {
-          const arrayItems = [];
-          const nestedObj = {};
-          const baseIndent = line.match(/^(\s*)/)?.[0].length || 0;
-          for (let j = i + 1;j < lines.length; j++) {
-            const nextLine = lines[j];
-            const nextIndent = nextLine.match(/^(\s*)/)?.[0].length || 0;
-            if (nextIndent <= baseIndent && nextLine.trim() !== "" && nextLine.match(/^\S/)) {
-              break;
-            }
-            const itemMatch = nextLine.match(/^\s+-\s*(.+)$/);
-            if (itemMatch) {
-              const item = itemMatch[1].trim().replace(/\s*#.*$/, "");
-              if (item)
-                arrayItems.push(item);
-              continue;
-            }
-            const nestedMatch = nextLine.match(/^\s+(\w+):\s*(.+)$/);
-            if (nestedMatch) {
-              let nv = nestedMatch[2].trim();
-              if (nv.startsWith('"') && nv.endsWith('"') || nv.startsWith("'") && nv.endsWith("'")) {
-                nv = nv.slice(1, -1);
-              }
-              nestedObj[nestedMatch[1]] = nv;
-            }
-          }
-          if (arrayItems.length > 0) {
-            value = arrayItems;
-          } else if (Object.keys(nestedObj).length > 0) {
-            result[key] = nestedObj;
-            continue;
-          }
-        } else if (value === "true")
-          value = true;
-        else if (value === "false")
-          value = false;
-        else if (value.startsWith('"') && value.endsWith('"')) {
-          value = value.slice(1, -1);
-        }
-        result[key] = value;
-      }
-    }
-    return result;
-  }
-  extractMultilineValue(content, key) {
-    const lines = content.split(`
-`);
-    let startLine = -1;
-    let startIndent = 0;
-    const keyPrefix = `${key}:`;
-    for (let i = 0;i < lines.length; i++) {
-      const trimmed = lines[i].trimStart();
-      if (trimmed.startsWith(keyPrefix)) {
-        startLine = i;
-        startIndent = lines[i].length - trimmed.length;
-        const afterKey = trimmed.slice(keyPrefix.length).trim();
-        if (afterKey && afterKey !== "|")
-          return afterKey;
-        break;
-      }
-    }
-    if (startLine === -1)
-      return null;
-    const valueLines = [];
-    for (let i = startLine + 1;i < lines.length; i++) {
-      const line = lines[i];
-      if (!line.trim()) {
-        valueLines.push("");
-        continue;
-      }
-      const indentMatch = line.match(/^(\s*)/);
-      const indent = indentMatch ? indentMatch[1].length : 0;
-      const trimmed = line.trim();
-      if (indent <= startIndent && trimmed.match(/^[a-z_]+:/)) {
-        break;
-      }
-      if (trimmed.startsWith("#") && indent <= startIndent) {
-        break;
-      }
-      if (trimmed.startsWith("#") && key !== "query")
-        continue;
-      valueLines.push(line);
-    }
-    const nonEmpty = valueLines.filter((l) => l.trim().length > 0);
-    if (nonEmpty.length > 0) {
-      const minExtraIndent = Math.min(...nonEmpty.map((l) => {
-        const m = l.match(/^(\s*)/);
-        return (m?.[1].length ?? 0) - startIndent;
-      }));
-      for (let i = 0;i < valueLines.length; i++) {
-        if (valueLines[i].trim().length === 0)
-          continue;
-        valueLines[i] = valueLines[i].slice(startIndent + Math.max(0, minExtraIndent));
-      }
-    }
-    while (valueLines.length > 0 && !valueLines[valueLines.length - 1].trim()) {
-      valueLines.pop();
-    }
-    return valueLines.length > 0 ? valueLines.join(`
-`) : null;
+    return yaml.load(content);
   }
   parseSeverity(value) {
     if (value === "error")

package/extensions/dm-lens/clients/trivy-client.js

@@ -152,7 +152,14 @@ export class TrivyClient extends SecurityScanClient {
       const findings = parseTrivyReport(raw);
       const secrets = parseTrivySecrets(raw);
       const licenses = parseTrivyLicenses(raw);
-      return { success: true, findings, secrets, licenses, scannedAt };
+      return {
+        success: true,
+        analyzed: true,
+        findings,
+        secrets,
+        licenses,
+        scannedAt
+      };
     } catch (err) {
       return {
         ...EMPTY_RESULT,

package/extensions/dm-lens/clients/tui-fit.js

@@ -1,9 +1,6 @@
 import { truncateToWidth } from "./deps/dm-tui-compat.js";
 const ELLIPSIS_KIND = { "…": 0, "...": 1, "": 2 };
 let truncateIsNative = null;
-export function _resetTruncateProbeForTests() {
-  truncateIsNative = null;
-}
 export function fitLine(s, maxWidth, ellipsis = "...") {
   const w = Math.max(0, maxWidth);
   const fn = truncateToWidth;

package/extensions/dm-lens/clients/turn-context.js

@@ -0,0 +1,48 @@
+import { AsyncLocalStorage } from "node:async_hooks";
+import { getProcessSingleton } from "./process-singletons.js";
+const FAMILY = "turn-context";
+const VERSION = 2;
+function state() {
+  return getProcessSingleton(FAMILY, VERSION, () => ({
+    sessions: new Map,
+    activeSession: new AsyncLocalStorage
+  }));
+}
+function sessionState(sessionId) {
+  const current = state();
+  let session = current.sessions.get(sessionId);
+  if (!session) {
+    session = { turnId: `${sessionId}:0`, turnIndex: 0 };
+    current.sessions.set(sessionId, session);
+  }
+  return session;
+}
+export function resetTurnContext(sessionId) {
+  const current = state();
+  if (sessionId === undefined)
+    return;
+  current.sessions.set(sessionId, { turnId: `${sessionId}:0`, turnIndex: 0 });
+}
+export function setTurnContextSession(sessionId) {
+  const stableSessionId = sessionId?.trim();
+  if (stableSessionId !== undefined && stableSessionId !== "")
+    sessionState(stableSessionId);
+}
+export function beginTurnContext(sessionId) {
+  const session = sessionState(sessionId);
+  session.turnIndex += 1;
+  session.turnId = `${sessionId}:${session.turnIndex}`;
+  return session.turnId;
+}
+export function runWithTurnContext(sessionId, fn) {
+  if (sessionId === undefined)
+    return fn();
+  return state().activeSession.run(sessionId, fn);
+}
+export function getTurnId() {
+  const current = state();
+  const sessionId = current.activeSession.getStore();
+  if (sessionId === undefined)
+    return "turn:0";
+  return sessionState(sessionId).turnId;
+}

package/extensions/dm-lens/clients/turn-end/lanes/govulncheck.js

@@ -0,0 +1,54 @@
+import { filterFindingsByDisposition } from "../../dispatch/finding-policy.js";
+import { toRunnerDisplayPath } from "../../dispatch/runner-context.js";
+import { govulncheckFindingToProjectDiagnostic } from "../../project-diagnostics/runner-adapters/govulncheck.js";
+import { STALE_LINE_MARKER } from "../../stale-marker.js";
+async function collect(ctx) {
+  const data = (await ctx.readScannerCache("govulncheck"))?.data;
+  return {
+    govulncheck: {
+      findings: data?.findings ?? [],
+      scannedAt: data?.scannedAt,
+      citedPath: (finding) => finding.trace.find((frame) => frame.filename)?.filename,
+      onMissing: "demote"
+    }
+  };
+}
+function gate(gates, ctx) {
+  const stale = new Set(gates.govulncheck.stale);
+  const filtered = filterFindingsByDisposition([...gates.govulncheck.live, ...gates.govulncheck.stale], ctx.cwd, (f) => govulncheckFindingToProjectDiagnostic(ctx.cwd, f));
+  return {
+    findings: filtered.kept,
+    stale,
+    suppressed: filtered.suppressed
+  };
+}
+function render(kept, ctx) {
+  const advisorySections = [];
+  if (kept.findings.length) {
+    const findings = kept.findings.slice(0, 5);
+    let report = `\uD83D\uDEE1️ Go CVEs reachable from this code (govulncheck) — upgrade where possible:
+`;
+    for (const f of findings) {
+      const callSite = f.trace.find((t) => t.filename);
+      const stale = kept.stale.has(f);
+      const where = callSite?.filename ? `${toRunnerDisplayPath(ctx.cwd, callSite.filename)}${!stale && callSite.line ? `:${callSite.line}` : ""}${stale ? ` ${STALE_LINE_MARKER}` : ""}` : f.module ?? f.packageName ?? "(module)";
+      const fix = f.fixedVersion ? ` — upgrade to ${f.fixedVersion} or later` : " — no fix yet, track upstream";
+      report += `  ${f.osv} (${where})${fix}
+`;
+    }
+    if (kept.findings.length > findings.length) {
+      report += `  … and ${kept.findings.length - findings.length} more
+`;
+    }
+    advisorySections.push(report);
+  }
+  return {
+    advisoryParts: advisorySections,
+    dispositionSuppressed: { govulncheck: kept.suppressed }
+  };
+}
+export const govulncheckLane = {
+  collect,
+  gate,
+  render
+};

package/extensions/dm-lens/clients/turn-end/lanes/secrets.js

@@ -0,0 +1,140 @@
+import { recordDegradationOnce } from "../../degradation-ledger.js";
+import { bounded } from "../../deadline-utils.js";
+import { filterFindingsByDisposition } from "../../dispatch/finding-policy.js";
+import { toRunnerDisplayPath } from "../../dispatch/runner-context.js";
+import {
+  classifyAndFilterFindings
+} from "../../gitleaks-client.js";
+import { HOOK_WALL_BUDGET_MS } from "../../hook-budgets.js";
+import { gitleaksFindingToProjectDiagnostic } from "../../project-diagnostics/runner-adapters/gitleaks.js";
+import { trivySecretFindingToProjectDiagnostic } from "../../project-diagnostics/runner-adapters/trivy.js";
+import {
+  dedupeSecretFindings,
+  fromAstGrepWarnings,
+  fromGitleaks,
+  fromTrivySecrets,
+  isSecretWarning,
+  secretLocationKey
+} from "../../secret-findings.js";
+import { STALE_LINE_MARKER } from "../../stale-marker.js";
+async function blockingGitleaksFindings(data, ctx) {
+  const classification = await bounded(classifyAndFilterFindings(data?.findings ?? [], ctx.cwd), {
+    ms: HOOK_WALL_BUDGET_MS.turn_end,
+    signal: ctx.signal,
+    hook: "turn_end",
+    label: "classifyAndFilterFindings"
+  });
+  if (classification === undefined) {
+    recordDegradationOnce({
+      kind: "gitleaks_classification_timeout",
+      subject: ctx.cwd,
+      reason: "gitleaks classification exceeded the turn_end budget; retained raw findings to fail open"
+    });
+  }
+  return (classification ?? data?.findings ?? []).filter((finding) => gitleaksFindingToProjectDiagnostic(ctx.cwd, finding).semantic === "blocking");
+}
+async function collect(ctx) {
+  const [gitleaksEntry, trivyEntry] = await Promise.all([
+    ctx.readScannerCache("gitleaks"),
+    ctx.readScannerCache("trivy")
+  ]);
+  const gitleaksData = gitleaksEntry?.data;
+  const trivyData = trivyEntry?.data;
+  return {
+    gitleaks: {
+      findings: await blockingGitleaksFindings(gitleaksData, ctx),
+      citedPath: (finding) => finding.file,
+      scannedAt: gitleaksData?.scannedAt
+    },
+    "trivy-secrets": {
+      findings: trivyData?.secrets ?? [],
+      citedPath: (finding) => finding.file,
+      scannedAt: trivyData?.scannedAt
+    }
+  };
+}
+function gate(gates, ctx) {
+  const gitleaksLive = filterFindingsByDisposition(gates.gitleaks.live, ctx.cwd, (f) => gitleaksFindingToProjectDiagnostic(ctx.cwd, f));
+  const gitleaksStale = filterFindingsByDisposition(gates.gitleaks.stale, ctx.cwd, (f) => gitleaksFindingToProjectDiagnostic(ctx.cwd, f));
+  const trivyLive = filterFindingsByDisposition(gates["trivy-secrets"].live, ctx.cwd, (f) => trivySecretFindingToProjectDiagnostic(ctx.cwd, f));
+  const trivyStale = filterFindingsByDisposition(gates["trivy-secrets"].stale, ctx.cwd, (f) => trivySecretFindingToProjectDiagnostic(ctx.cwd, f));
+  return {
+    gitleaksLive: gitleaksLive.kept,
+    gitleaksStale: gitleaksStale.kept,
+    trivyLive: trivyLive.kept,
+    trivyStale: trivyStale.kept,
+    suppressed: {
+      gitleaks: gitleaksLive.suppressed + gitleaksStale.suppressed,
+      "trivy-secrets": trivyLive.suppressed + trivyStale.suppressed
+    }
+  };
+}
+function render(kept, ctx) {
+  const sessionSecrets = dedupeSecretFindings([
+    ...fromGitleaks(kept.gitleaksLive),
+    ...fromTrivySecrets(kept.trivyLive)
+  ]);
+  const deliveredLocationKeys = new Set(sessionSecrets.map((f) => secretLocationKey(f.file, f.line)));
+  const blockerSections = [];
+  if (sessionSecrets.length) {
+    const enriched = dedupeSecretFindings([
+      ...sessionSecrets,
+      ...fromAstGrepWarnings(ctx.peekActionableWarnings().filter(isSecretWarning)).filter((a) => deliveredLocationKeys.has(secretLocationKey(a.file, a.line)))
+    ]);
+    const shown = enriched.slice(0, 5);
+    let report = `\uD83D\uDD34 STOP — hardcoded secrets detected. Rotate the credentials and remove them from source:
+`;
+    for (const f of shown) {
+      const where = `${toRunnerDisplayPath(ctx.cwd, f.file)}:${f.line}`;
+      report += `  ${where} — ${f.rule} [${f.sources.join(" + ")}]${f.description ? `: ${f.description}` : ""}
+`;
+    }
+    if (enriched.length > shown.length) {
+      report += `  … and ${enriched.length - shown.length} more
+`;
+    }
+    blockerSections.push(report);
+  }
+  const staleSecretEntries = [
+    ...kept.gitleaksStale.map((f) => ({
+      file: toRunnerDisplayPath(ctx.cwd, f.file),
+      rule: f.ruleId,
+      source: "gitleaks"
+    })),
+    ...kept.trivyStale.map((f) => ({
+      file: toRunnerDisplayPath(ctx.cwd, f.file),
+      rule: f.ruleId,
+      source: "trivy"
+    }))
+  ];
+  const staleSecrets = [
+    ...new Map(staleSecretEntries.map((e) => [`${e.file}|${e.rule}|${e.source}`, e])).values()
+  ];
+  const staleSections = [];
+  if (staleSecrets.length) {
+    const shown = staleSecrets.slice(0, 5);
+    let report = `\uD83D\uDD11 ACTION NEEDED — secrets were flagged in files that changed after the scan. ${STALE_LINE_MARKER}
+` + `The cached line numbers are no longer trustworthy, so they are withheld. Re-run a secrets scan to confirm or clear these:
+`;
+    for (const entry of shown) {
+      report += `  ${entry.file} — ${entry.rule} [${entry.source}]
+`;
+    }
+    if (staleSecrets.length > shown.length) {
+      report += `  … and ${staleSecrets.length - shown.length} more
+`;
+    }
+    staleSections.push(report);
+  }
+  return {
+    blockerParts: blockerSections,
+    staleSecretParts: staleSections,
+    dispositionSuppressed: kept.suppressed,
+    deliveredLocationKeys
+  };
+}
+export const secretsLane = {
+  collect,
+  gate,
+  render
+};

package/extensions/dm-lens/clients/user-notify.js

@@ -8,9 +8,6 @@ export function wireUserNotifier(portsOrGetter) {
 export function resetUserNotifier() {
   notifierGetter = undefined;
 }
-export function hasUserNotifier() {
-  return notifierGetter !== undefined;
-}
 export function notifyUserDegradation(message, level = "warning", options) {
   try {
     const notify = notifierGetter?.();

package/extensions/dm-lens/clients/warm-attach.js

@@ -18,6 +18,10 @@ import {
   WARM_CODE_ACTION_LOOKUP_LIMIT,
   WARM_DIAGNOSTICS_SCHEMA_VERSION
 } from "./mcp/ipc.js";
+import {
+  incrementDegradationCount,
+  recordDegradationOnce
+} from "./degradation-ledger.js";
 import { normalizeFilePath } from "./path-utils.js";
 const state = { local: true, servedDiagnosticHashes: new Map };
 function record(event, cwd, reason, pid, source) {
@@ -106,6 +110,13 @@ function startServer(cwd) {
   }
   const server = net.createServer((socket) => {
     socket.setEncoding("utf8");
+    socket.on("error", (failure) => {
+      incrementDegradationCount({
+        kind: "warm-attach-socket-error",
+        subject: failure.code,
+        reason: String(failure)
+      });
+    });
     socket.on("data", createWarmIpcLineReader((line) => {
       (async () => {
         try {
@@ -117,6 +128,10 @@ function startServer(cwd) {
 `);
         }
       })();
+    }, {
+      label: "warm-attach-server",
+      onOverflow: () => socket.end(`${JSON.stringify({ error: "warm request line exceeded the framing limit" })}
+`)
     }));
   });
   server.on("error", (error) => {
@@ -155,6 +170,13 @@ export async function tryWarmAttachedDiagnostics(file, content, timeoutMs, sourc
   }
   const result = await requestWarmDiagnostics(state.cwd, state.incumbentPid, file, content, timeoutMs);
   if (!result.available) {
+    if (result.reason === "no-listener") {
+      recordDegradationOnce({
+        kind: "warm-ipc-endpoint-missing",
+        subject: diagnosticsIpcPathForCwd(state.cwd, state.incumbentPid),
+        reason: "the registry confirms this incumbent is alive but nothing is listening on its derived endpoint — if dm-lens was upgraded while it was running, restart it"
+      });
+    }
     promoteToLocal(result.reason);
   } else {
     record("diagnostics-served", file, undefined, state.incumbentPid, source);
@@ -191,6 +213,9 @@ export function _resetWarmAttachForTests() {
   state.local = true;
   state.servedDiagnosticHashes.clear();
 }
+export function _warmAttachServerForTests() {
+  return state.server;
+}
 export function _setWarmAttachForTests(cwd, incumbentPid) {
   state.cwd = path.resolve(cwd);
   state.incumbentPid = incumbentPid;