@duckmind/dm-linux-x64 0.65.5 → 0.65.6

package/extensions/dm-lens/clients/widget-state.js

@@ -1,3 +1,4 @@
+import { readFileSync } from "node:fs";
 import { stat } from "node:fs/promises";
 import * as path from "node:path";
 import { pathToFileURL } from "node:url";
@@ -10,13 +11,25 @@ import { normalizeEphemeralMapKey, normalizeMapKey } from "./path-utils.js";
 import { fitLine } from "./tui-fit.js";
 import { WriteOrderingGuard } from "./write-ordering-guard.js";
 import { collectForwardImportMtimes } from "./blocker-freshness.js";
+import { normalizeMessage } from "./finding-identity.js";
 import { freshnessFromMtime } from "./freshness.js";
 import { PAST_EOF_STALE_MARKER } from "./diagnostic-line-freshness.js";
 import { STALE_LINE_MARKER } from "./stale-marker.js";
+import {
+  anchorsForDiagnostic,
+  applyDispositions,
+  getDisposition,
+  registerWidgetDispositionReconciler,
+  strictAnchorSpan,
+  strictAnchorSpansIn
+} from "./diagnostic-dispositions.js";
+import { recordDegradationOnce } from "./degradation-ledger.js";
 function fileMapKey(filePath) {
   return normalizeEphemeralMapKey(filePath);
 }
 export function isBlocking(d) {
+  if (d.disposition)
+    return false;
   if (d.stale)
     return false;
   if (d.semantic === "blocking")
@@ -31,6 +44,7 @@ let requestRenderFn = null;
 const diagnosticsWriteGuard = new WriteOrderingGuard;
 const runnerWriteGuard = new WriteOrderingGuard;
 const MAX_STORED_DIAGNOSTICS_PER_FILE = 12;
+const MAX_RETAINED_SUPPRESSED_PER_FILE = 12;
 const MAX_INACTIVE_FILE_RECORDS = 1024;
 const ACTIVE_FILE_IDLE_MS = 30 * 60000;
 export const MAX_LSP_SERVER_RECORDS = 128;
@@ -55,6 +69,92 @@ function maybePruneInactiveFileRecords() {
 export function setRenderCallback(fn) {
   requestRenderFn = fn;
 }
+export function reconcileWidgetDisposition(cwd, target, _disposition, content) {
+  const current = getFileDiagnostics(target.filePath);
+  if (!current) {
+    recordDegradationOnce({
+      kind: "widget-disposition-reconcile-fallback",
+      subject: target.filePath,
+      reason: "the marked finding's widget record is absent"
+    });
+    return;
+  }
+  let source = content ?? target.content;
+  if (source === undefined) {
+    try {
+      source = readFileSync(target.filePath, "utf8");
+    } catch {
+      recordDegradationOnce({
+        kind: "widget-disposition-reconcile-fallback",
+        subject: target.filePath,
+        reason: "the disposition anchor content could not be read"
+      });
+      source = "";
+    }
+  }
+  const active = new Set(applyDispositions(current, cwd, target.filePath, source));
+  const normalized = current.flatMap((diagnostic) => {
+    const { strict, weak } = anchorsForDiagnostic(cwd, target.filePath, diagnostic, source);
+    const entry = getDisposition(cwd, strict) ?? getDisposition(cwd, weak);
+    if (!active.has(diagnostic) && (entry?.disposition === "false-positive" || entry?.disposition === "suppress")) {
+      const { anchorSpan: _previousSpan, ...base } = diagnostic;
+      const span = entry.disposition === "false-positive" ? strictAnchorSpan(source, diagnostic.line) : undefined;
+      return [
+        {
+          ...base,
+          disposition: entry.disposition,
+          flagged: false,
+          ...span === undefined ? {} : { anchorSpan: span }
+        }
+      ];
+    }
+    if (diagnostic.suppressedRetained)
+      return [];
+    const {
+      disposition: _disposition,
+      flagged: _flagged,
+      anchorSpan: _anchorSpan,
+      ...baseDiagnostic
+    } = diagnostic;
+    return entry?.disposition === "flagged" ? [{ ...baseDiagnostic, flagged: true }] : [baseDiagnostic];
+  });
+  const rec = getOrCreate(target.filePath);
+  const writeIndex = admitWidgetDiagnosticsWrite(target.filePath);
+  if (!diagnosticsWriteGuard.shouldWrite(fileMapKey(target.filePath), writeIndex))
+    return;
+  commitDiagnostics(rec, target.filePath, normalized, Date.now(), fileMapKey(target.filePath), false);
+}
+export function admitWidgetDiagnosticsWrite(filePath, writeIndex) {
+  const key = fileMapKey(filePath);
+  const token = writeIndex ?? diagnosticsWriteGuard.nextToken(key);
+  diagnosticsWriteGuard.shouldWrite(key, token);
+  runnerWriteGuard.shouldWrite(key, token);
+  return token;
+}
+registerWidgetDispositionReconciler((cwd, target, disposition) => reconcileWidgetDisposition(cwd, target, disposition, target.content));
+export function wireWidgetDispositionSubscriber(args) {
+  args.events?.on?.("dmlens:diagnostic:disposition", (data) => {
+    if (!data || typeof data !== "object")
+      return;
+    const payload = data;
+    if (payload.source !== "dm-lens" || typeof payload.cwd !== "string")
+      return;
+    if (typeof payload.filePath !== "string" || typeof payload.disposition !== "string")
+      return;
+    if (typeof payload.message !== "string")
+      return;
+    if (!["false-positive", "suppress", "defer", "flagged"].includes(payload.disposition))
+      return;
+    reconcileWidgetDisposition(payload.cwd, {
+      cwd: payload.cwd,
+      filePath: payload.filePath,
+      message: typeof payload.message === "string" ? payload.message : "",
+      ...typeof payload.tool === "string" ? { tool: payload.tool } : {},
+      ...typeof payload.rule === "string" ? { rule: payload.rule } : {},
+      ...typeof payload.line === "number" ? { line: payload.line } : {}
+    }, payload.disposition);
+  });
+}
 const renderedDependencyDriftFiles = new Set;
 export function clearWidgetState() {
   files.clear();
@@ -168,11 +268,12 @@ export function widgetDiagnosticUri(filePath, line, column) {
 export function recordDiagnostics(filePath, diagnostics, writeIndex, observedAt) {
   const key = fileMapKey(filePath);
   if (!diagnosticsWriteGuard.shouldWrite(key, writeIndex))
-    return;
+    return false;
   runnerWriteGuard.shouldWrite(key, writeIndex);
   const observedTs = observedAt ?? Date.now();
   const rec = getOrCreate(filePath, key);
   commitDiagnostics(rec, filePath, normalizeDiagnostics(filePath, diagnostics, observedTs), observedTs, key);
+  return true;
 }
 function normalizeDiagnostics(filePath, diagnostics, observedTs) {
   return diagnostics.map((d) => {
@@ -190,7 +291,70 @@ function normalizeDiagnostics(filePath, diagnostics, observedTs) {
     };
   });
 }
-function commitDiagnostics(rec, filePath, normalized, observedAt, key = fileMapKey(filePath)) {
+function retentionIdentity(d) {
+  return JSON.stringify([
+    d.tool ?? "",
+    d.rule ?? "",
+    normalizeMessage(d.message)
+  ]);
+}
+function readContentOrUndefined(filePath) {
+  try {
+    return readFileSync(filePath, "utf8");
+  } catch {
+    recordDegradationOnce({
+      kind: "widget-mark-anchor-unreadable",
+      subject: filePath,
+      reason: "the marked file could not be read, so its suppressed rows fall back to the file-mtime retirement gate and the footer chip may under-count it"
+    });
+    return;
+  }
+}
+function readAnchorSpans(filePath) {
+  const content = readContentOrUndefined(filePath);
+  return content === undefined ? undefined : strictAnchorSpansIn(content);
+}
+function retainSuppressedRows(previous, incoming, filePath) {
+  const tagged = previous.filter((d) => d.disposition !== undefined);
+  if (tagged.length === 0)
+    return incoming;
+  const reported = new Map;
+  for (const d of incoming) {
+    const id = retentionIdentity(d);
+    const bucket = reported.get(id);
+    if (bucket)
+      bucket.push(d);
+    else
+      reported.set(id, [d]);
+  }
+  const content = tagged.some((d) => d.anchorSpan !== undefined && reported.has(retentionIdentity(d))) ? readContentOrUndefined(filePath) : undefined;
+  const spans = content === undefined ? undefined : strictAnchorSpansIn(content);
+  const retained = tagged.filter((d) => {
+    const collisions = reported.get(retentionIdentity(d));
+    if (collisions === undefined)
+      return true;
+    if (d.anchorSpan === undefined || spans === undefined)
+      return false;
+    if (!spans.has(d.anchorSpan))
+      return false;
+    return !collisions.some((i) => strictAnchorSpan(content, i.line) === d.anchorSpan);
+  });
+  if (retained.length > MAX_RETAINED_SUPPRESSED_PER_FILE) {
+    retained.sort((a, b) => (b.observedAt ?? 0) - (a.observedAt ?? 0));
+    recordDegradationOnce({
+      kind: "widget-suppressed-retention-capped",
+      subject: filePath,
+      reason: `${retained.length - MAX_RETAINED_SUPPRESSED_PER_FILE} suppressed row(s) beyond the ${MAX_RETAINED_SUPPRESSED_PER_FILE}-row per-file retention cap are no longer counted by the footer chip`
+    });
+    retained.length = MAX_RETAINED_SUPPRESSED_PER_FILE;
+  }
+  return [
+    ...incoming,
+    ...retained.map((d) => d.suppressedRetained ? d : { ...d, suppressedRetained: true })
+  ];
+}
+function commitDiagnostics(rec, filePath, incoming, observedAt, key = fileMapKey(filePath), retainSuppressed = true) {
+  const normalized = retainSuppressed ? retainSuppressedRows(rec.allDiagnostics, incoming, filePath) : incoming;
   rec.diagnosticCounts = countDiagnostics(normalized);
   rec.diagnostics = capStoredDiagnostics(normalized);
   rec.allDiagnostics = normalized;
@@ -213,6 +377,8 @@ function countDiagnostics(diags) {
   let errors = 0;
   let warnings = 0;
   for (const diagnostic of diags) {
+    if (diagnostic.disposition)
+      continue;
     if (isBlocking(diagnostic))
       blocking++;
     if (diagnostic.stale && (diagnostic.staleReason ?? "past-eof") === "past-eof")
@@ -274,8 +440,8 @@ export function reconcileCascadeNeighborLspErrors(filePath, lspErrorDiagnostics,
 }
 export function reconcileScanDiagnostics(filePath, diagnostics, confirmed, writeIndex, observedAt) {
   if (!confirmed)
-    return;
-  recordDiagnostics(filePath, diagnostics, writeIndex, observedAt);
+    return false;
+  return recordDiagnostics(filePath, diagnostics, writeIndex, observedAt);
 }
 export function reconcileCorrelatedScanDiagnostics(filePath, diagnostics, writeIndex, observedAt) {
   const key = fileMapKey(filePath);
@@ -301,13 +467,12 @@ export async function reconcileStaleWidgetFiles() {
     if (rec.allDiagnostics.length === 0) {
       return freshnessFromMtime({ mtimeMs, referenceMs: rec.touchedAt }).verdict === "stale" ? { mapKey, action: "drop" } : { mapKey, action: "keep" };
     }
-    const survivors = rec.allDiagnostics.filter((d) => {
-      const v = freshnessFromMtime({
-        mtimeMs,
-        referenceMs: d.observedAt ?? rec.touchedAt
-      });
-      return v.verdict !== "stale";
-    });
+    const mtimeStale = (d) => freshnessFromMtime({
+      mtimeMs,
+      referenceMs: d.observedAt ?? rec.touchedAt
+    }).verdict === "stale";
+    const spans = rec.allDiagnostics.some((d) => d.anchorSpan !== undefined && mtimeStale(d)) ? readAnchorSpans(rec.filePath) : undefined;
+    const survivors = rec.allDiagnostics.filter((d) => d.anchorSpan !== undefined && spans !== undefined ? spans.has(d.anchorSpan) : !mtimeStale(d));
     if (survivors.length === rec.allDiagnostics.length) {
       return { mapKey, action: "keep" };
     }
@@ -465,17 +630,28 @@ export function scheduleStaleReconcile() {
 export function getFileDiagnosticSummaries() {
   return [...files.values()].map((rec) => {
     applyPastEofGate(rec);
+    const live = rec.allDiagnostics.filter((d) => d.disposition === undefined);
     return {
       filePath: rec.filePath,
       blocking: rec.diagnosticCounts.blocking,
       errors: rec.diagnosticCounts.errors,
       warnings: rec.diagnosticCounts.warnings,
-      advisories: countAdvisories(rec.allDiagnostics),
+      advisories: countAdvisories(live),
       hasFinalSnapshot: rec.hasFinalDiagnosticsSnapshot,
-      diagnostics: rec.allDiagnostics.map((d) => ({ ...d }))
+      diagnostics: live.map((d) => ({ ...d }))
     };
   });
 }
+export function countRetainedSuppressedRows(filePath) {
+  const rec = files.get(fileMapKey(filePath));
+  if (!rec)
+    return 0;
+  let n = 0;
+  for (const d of rec.allDiagnostics)
+    if (d.suppressedRetained)
+      n += 1;
+  return n;
+}
 export function getFileDiagnostics(filePath) {
   const rec = files.get(fileMapKey(filePath));
   if (!rec)
@@ -521,6 +697,7 @@ export function renderWidget(width, theme) {
   const totalBlocking = countBlockingIn(deduped);
   const totalErrors = countTotalIn("error", deduped);
   const totalWarnings = countTotalIn("warning", deduped);
+  const totalSuppressed = countSuppressedIn(deduped);
   const hasPendingAnalysis = deduped.some(isPendingAnalysis);
   const errorChunk = totalErrors > 0 ? (totalBlocking > 0 ? red : yellow)(`●${totalErrors}E`) : "";
   const warningChunk = totalWarnings > 0 ? yellow(`!${totalWarnings}W`) : "";
@@ -529,6 +706,9 @@ export function renderWidget(width, theme) {
   const lspChip = useHorizontal && spawning.length > 0 ? "  " + dim("LSP↑") : "";
   const header = ` ${cyan("dm-lens")}${langStr ? "  " + dim(langStr) : ""}${lspChip}${summary ? "  " + summary : ""}`;
   lines.push(fitLine(header, w));
+  if (totalSuppressed > 0) {
+    lines.push(fitLine(` ${dim(`suppressed: ${totalSuppressed}`)}`, w));
+  }
   if (useHorizontal) {
     const displayOrder = sortByTierThenRecency(recencySorted);
     const rowLine = packHorizontalRow(displayOrder, w, theme);
@@ -765,6 +945,16 @@ function countTotalIn(severity, recs) {
   }
   return n;
 }
+function countSuppressedIn(recs) {
+  let n = 0;
+  for (const rec of recs) {
+    for (const diagnostic of rec.allDiagnostics) {
+      if (diagnostic.disposition)
+        n++;
+    }
+  }
+  return n;
+}
 function countBlockingIn(recs) {
   let n = 0;
   for (const rec of recs)

package/extensions/dm-lens/clients/word-index-logger.js

@@ -19,9 +19,3 @@ export function logWordIndex(entry) {
     cwd: normalizeFilePath(entry.cwd)
   });
 }
-export function getWordIndexLogPath() {
-  return WORD_INDEX_LOG_FILE;
-}
-export function flushWordIndexLog() {
-  return writer.flush();
-}

package/extensions/dm-lens/clients/word-index-store.js

@@ -84,9 +84,6 @@ export class WordPostingList {
     return list;
   }
 }
-export function estimatePostingListBytes(list) {
-  return list.byteLength + WORD_POSTING_LIST_OVERHEAD_BYTES;
-}
 export function compactPostingsIntoArena(postings) {
   let lanes = 0;
   for (const list of postings.values())
@@ -189,7 +186,7 @@ export class WordForwardEntry {
     return new WordForwardEntry(tokenNames, lineCounts);
   }
 }
-export const WORD_FORWARD_ENTRY_BYTES = 8;
+const WORD_FORWARD_ENTRY_BYTES = 8;
 
 export class WordIndexFileTable {
   idByKey = new Map;

package/extensions/dm-lens/clients/word-index.js

@@ -7,6 +7,7 @@ import {
 } from "./cooperative-budget.js";
 import { incrementDegradationCount } from "./degradation-ledger.js";
 import { KIND_EXTENSIONS } from "./file-kinds.js";
+import { isTestFileName } from "./file-role.js";
 import { PathKeyedMap } from "./path-keyed-map.js";
 import { isAtOrAboveHomeDir, normalizeEphemeralMapKey } from "./path-utils.js";
 import { createSingleFlight } from "./single-flight.js";
@@ -72,14 +73,14 @@ const STOPWORDS = new Set([
   "not",
   "with"
 ]);
-const TEST_VENDOR_RE = /(?:(^|[\\/])(?:tests?|__tests__|spec|specs|__mocks__|vendor|node_modules|examples?|fixtures?|\.git|dist|build|coverage)([\\/]|$))|(?:\.(?:test|spec)\.[a-z]+$)/i;
+const VENDOR_DIR_RE = /(^|[\\/])(?:tests?|__tests__|spec|specs|__mocks__|vendor|node_modules|examples?|fixtures?|\.git|dist|build|coverage)([\\/]|$)/i;
 const DOC_FILE_RE = /\.(?:md|mdx|markdown|json|json5|jsonc|txt|rst|lock|ya?ml|toml|csv)$/i;
 const TEST_VENDOR_PENALTY = 0.3;
 const DOC_FILE_PENALTY = 0.5;
 const BM25_K1 = 1.2;
 const BM25_B = 0.75;
 function isTestOrVendor(file) {
-  return TEST_VENDOR_RE.test(file);
+  return isTestFileName(file) || VENDOR_DIR_RE.test(file);
 }
 function isDocFile(file) {
   return DOC_FILE_RE.test(file);
@@ -505,7 +506,6 @@ async function updateWordIndexDocumentAsyncUnsafe(index, doc, shouldContinue) {
   commitWordIndexDocumentReplacement(index, doc, perTokenHits, docLength, startedAt);
   return true;
 }
-export const WORD_INDEX_MAX_FILES = 6000;
 export const WORD_INDEX_MAX_BYTES = 512 * 1024;
 export async function collectWordIndexDocs(root, shouldContinue = () => true, preflightFiles) {
   const { collectSourceFilesAsync } = await import("./source-filter.js");
@@ -544,7 +544,7 @@ export async function collectWordIndexDocs(root, shouldContinue = () => true, pr
   }
   return docs;
 }
-export const WORD_INDEX_STAT_CONCURRENCY = 8;
+const WORD_INDEX_STAT_CONCURRENCY = 8;
 const WORD_INDEX_INCREMENTAL_CHURN_THRESHOLD = 0.3;
 const WORD_INDEX_DENSE_REFRESH_MIN_DOCUMENTS = 32;
 const WORD_INDEX_FILE_READ_TOKEN_COST = 300;
@@ -702,7 +702,11 @@ export async function refreshWordIndexIncrementally(index, root, shouldContinue
     timings
   };
 }
-export const WORD_INDEX_QUERY_FILTER_KEYS = ["lang", "file", "ext"];
+const WORD_INDEX_QUERY_FILTER_KEYS = [
+  "lang",
+  "file",
+  "ext"
+];
 
 export class WordIndexQueryError extends Error {
   constructor(message) {

package/extensions/dm-lens/clients/workspace-topology.js

@@ -1,7 +1,10 @@
 import * as fs from "node:fs";
 import * as os from "node:os";
 import * as path from "node:path";
-import { PROJECT_CONFIG_BASENAMES } from "./config-locations.js";
+import {
+  PROJECT_CONFIG_BASENAMES,
+  isResolvedGlobalConfigPath
+} from "./config-locations.js";
 import { logLatency } from "./latency-logger.js";
 import {
   isAtOrAboveHomeDir,
@@ -146,13 +149,25 @@ export function getDirectoryMarkers(dir) {
 function walkCacheKey(startDir, markerKey) {
   return `${path.resolve(startDir)}\x00${markerKey}`;
 }
-function walkStillFresh(dirMtimes) {
+export function dirMtimesStillFresh(dirMtimes) {
   return dirMtimes.every(({ dir, mtimeMs }) => safeDirMtimeMs(dir) === mtimeMs);
 }
+export function dirMtimesStillFreshAsync(dirMtimes) {
+  return Promise.all(dirMtimes.map(({ dir }) => dirMtimeMsAsync(dir))).then((current) => dirMtimes.every(({ mtimeMs }, index) => current[index] === mtimeMs));
+}
+function dirMtimeMsAsync(dir) {
+  return fs.promises.stat(dir).then((stats) => stats.mtimeMs, () => -1);
+}
+export function dirMtimeRecordsAsync(dirs) {
+  return Promise.all(dirs.map((dir) => dirMtimeMsAsync(dir).then((mtimeMs) => ({ dir, mtimeMs }))));
+}
+export function unknownDirMtimeRecords(dirs) {
+  return dirs.map((dir) => ({ dir, mtimeMs: Number.NaN }));
+}
 function walkToNearestMatch(startDir, cacheSuffix, matches, capMetadata, homeDir) {
   const key = walkCacheKey(startDir, cacheSuffix);
   const cached = walkCache.get(key);
-  if (cached && walkStillFresh(cached.dirMtimes)) {
+  if (cached && dirMtimesStillFresh(cached.dirMtimes)) {
     touchWalk(key, cached);
     return cached.dir;
   }
@@ -221,6 +236,8 @@ export function findDmLensConfigMarkerInDir(dir) {
   const markers = getDirectoryMarkers(dir);
   if (!markers.piLensConfigPath)
     return;
+  if (isResolvedGlobalConfigPath(markers.piLensConfigPath))
+    return;
   const stat = (() => {
     try {
       return fs.statSync(markers.piLensConfigPath);

package/extensions/dm-lens/clients/write-ordering-guard.js

@@ -9,6 +9,12 @@ export class WriteOrderingGuard {
     this.lastSeen.set(key, token);
     return true;
   }
+  nextToken(key) {
+    const last = this.lastSeen.get(key);
+    const next = (last ?? 0) + 1;
+    this.lastSeen.set(key, next);
+    return next;
+  }
   delete(key) {
     this.lastSeen.delete(key);
   }

package/extensions/dm-lens/clients/zizmor-config.js

@@ -8,7 +8,7 @@ import {
   logAvailabilityDecision,
   startHostStallSampler
 } from "./dispatch/runners/utils/availability-policy.js";
-export const LOCAL_ZIZMOR_CONFIG_NAMES = [
+const LOCAL_ZIZMOR_CONFIG_NAMES = [
   path.join(".github", "zizmor.yml"),
   path.join(".github", "zizmor.yaml"),
   "zizmor.yml",
@@ -66,7 +66,7 @@ function classifyGhTokenFailure(res, hostStallMs) {
     classifiedBy: "caller"
   };
 }
-async function deriveGhCliToken() {
+async function deriveGhCliToken(consumer) {
   const sampler = startHostStallSampler();
   const startedAt = Date.now();
   const res = await safeSpawnAsync("gh", ["auth", "token"], {
@@ -80,7 +80,7 @@ async function deriveGhCliToken() {
     if (token.length > 0) {
       ghTokenLatch.noteAvailable();
       logAvailabilityDecision({
-        tool: "zizmor-gh-token",
+        tool: consumer === "zizmor" ? "zizmor-gh-token" : "github-token",
         verdict: "available",
         outcome: "success",
         cause: "ok",
@@ -92,21 +92,21 @@ async function deriveGhCliToken() {
       });
       return token;
     }
-    return recordGhTokenUnavailable({
+    return recordGhTokenUnavailable(consumer, {
       outcome: "non-installable",
       cause: "empty-result",
       classifiedBy: "caller"
     }, elapsedMs, hostStallMs);
   }
-  return recordGhTokenUnavailable(classifyGhTokenFailure(res, hostStallMs), elapsedMs, hostStallMs);
+  return recordGhTokenUnavailable(consumer, classifyGhTokenFailure(res, hostStallMs), elapsedMs, hostStallMs);
 }
-function recordGhTokenUnavailable({ outcome, cause, classifiedBy }, elapsedMs, hostStallMs) {
+function recordGhTokenUnavailable(consumer, { outcome, cause, classifiedBy }, elapsedMs, hostStallMs) {
   const retryAfterMs = ghTokenLatch.noteUnavailable(outcome, cause);
-  if (outcome === "transient") {
+  if (consumer === "zizmor" && outcome === "transient") {
     recordZizmorOfflineDegradation(`gh auth token probe ${cause}; running offline until the next zizmor start (retry allowed in ${Math.round(retryAfterMs / 1000)}s)`);
   }
   logAvailabilityDecision({
-    tool: "zizmor-gh-token",
+    tool: consumer === "zizmor" ? "zizmor-gh-token" : "github-token",
     verdict: "unavailable",
     outcome,
     cause,
@@ -129,12 +129,16 @@ function recordZizmorOfflineDegradation(reason) {
 export async function resolveZizmorGitHubToken() {
   if (process.env.ZIZMOR_OFFLINE)
     return;
-  const fromEnv = process.env.ZIZMOR_GITHUB_TOKEN || process.env.GH_TOKEN || process.env.GITHUB_TOKEN;
+  return resolveGitHubToken(["ZIZMOR_GITHUB_TOKEN", "GH_TOKEN", "GITHUB_TOKEN"], { consumer: "zizmor" });
+}
+export async function resolveGitHubToken(envKeys = ["GITHUB_TOKEN", "GH_TOKEN"], options = {}) {
+  const consumer = options.consumer ?? "github-api";
+  const fromEnv = envKeys.map((key) => process.env[key]).find(Boolean);
   if (fromEnv)
     return fromEnv;
   const memo = ghTokenLatch.read();
   if (memo !== null) {
-    if (memo === false && ghTokenLatch.getOutcome() === "transient") {
+    if (consumer === "zizmor" && memo === false && ghTokenLatch.getOutcome() === "transient") {
       const cause = ghTokenLatch.getCause();
       if (cause === null) {
         throw new Error("zizmor gh-token latch: transient outcome with no cause (invariant violated)");
@@ -156,6 +160,6 @@ export async function resolveZizmorGitHubToken() {
     }
     return memo ? cachedToken : undefined;
   }
-  cachedToken = await deriveGhCliToken();
+  cachedToken = await deriveGhCliToken(consumer);
   return cachedToken;
 }

package/extensions/dm-lens/config/dependency-cruiser-eager-allowlist.json

@@ -1,6 +1,7 @@
 [
   "./clients/agent-nudge.js",
   "./clients/ast-grep-client.js",
+  "./clients/bash-file-access.js",
   "./clients/bootstrap.js",
   "./clients/bounded-cache.js",
   "./clients/bounded-telemetry.js",
@@ -11,6 +12,7 @@
   "./clients/cache-observability.js",
   "./clients/cascade-format.js",
   "./clients/console-guard-install.js",
+	"./clients/deadline-utils.js",
   "./clients/debug-handles.js",
   "./clients/debug-heap.js",
   "./clients/degradation-ledger.js",
@@ -26,7 +28,7 @@
   "./clients/format-events-publish.js",
   "./clients/format-service.js",
   "./clients/formatters-lazy.js",
-  "./clients/git-guard.js",
+	"./clients/hook-budgets.js",
   "./clients/host-ports.js",
   "./clients/installer/index.js",
   "./clients/instance-reaper.js",
@@ -42,6 +44,7 @@
   "./clients/lsp/cascade-tier.js",
   "./clients/lsp/config.js",
   "./clients/lsp/index.js",
+  "./clients/lsp/session-roots.js",
   "./clients/memory-sampler.js",
   "./clients/message-end-attribution.js",
   "./clients/mutating-tool.js",
@@ -51,7 +54,6 @@
   // deferred drain they bracket.
   "./clients/observed-mutation-sources.js",
   "./clients/observed-mutation.js",
-  "./clients/package-root.js",
   "./clients/path-attribution-telemetry.js",
   "./clients/path-utils.js",
   "./clients/project-lens-config.js",
@@ -75,12 +77,16 @@
   "./clients/session-start-observability.js",
   "./clients/session-state-store.js",
   "./clients/sessionstart-logger.js",
+  "./clients/situational-tool-telemetry.js",
+  "./clients/skills-resolver.js",
   "./clients/smells-rollup.js",
   "./clients/startup-timing.js",
   "./clients/test-runner-delivery.js",
+  "./clients/tool-config.js",
   "./clients/tool-definition.js",
   "./clients/tool-render.js",
   "./clients/tool-set-policy.js",
+  "./clients/turn-context.js",
   "./clients/turn-summary-render.js",
   "./clients/turn-summary.js",
   "./clients/user-notify.js",

package/extensions/dm-lens/dist/clients/actionable-warnings-logger.js

@@ -0,0 +1,24 @@
+import * as path from "node:path";
+import { isTestMode } from "./env-utils.js";
+import { getGlobalDmLensLogDir } from "./probe-home-state.js";
+import { createNdjsonLogger } from "./ndjson-logger.js";
+import { normalizeFilePath } from "./path-utils.js";
+const AW_LOG_DIR = getGlobalDmLensLogDir();
+const AW_LOG_FILE = path.join(AW_LOG_DIR, "actionable-warnings.log");
+const AW_LOG_BACKUP_FILE = path.join(AW_LOG_DIR, "actionable-warnings.log.1");
+const MAX_LOG_BYTES = Math.max(128 * 1024, Number.parseInt(process.env.DM_LENS_AW_LOG_MAX_BYTES ?? "1048576", 10) || 1048576);
+const writer = createNdjsonLogger({
+  filePath: AW_LOG_FILE,
+  maxBytes: MAX_LOG_BYTES,
+  backupPath: AW_LOG_BACKUP_FILE
+});
+export function logActionableWarningsEvent(entry) {
+  if (isTestMode()) {
+    return;
+  }
+  writer.log({
+    ts: new Date().toISOString(),
+    ...entry,
+    ...entry.filePath !== undefined ? { filePath: normalizeFilePath(entry.filePath) } : {}
+  });
+}