@duckmind/dm-linux-x64 0.65.5 → 0.65.7

package/extensions/dm-lens/clients/git-guard.js

@@ -3,6 +3,7 @@ import * as path from "node:path";
 import { isPathIgnoredByProject } from "./file-utils.js";
 import { tokenizeShellCommand } from "./bash-file-access.js";
 import { logLatency } from "./latency-logger.js";
+import { resolveLensToolName } from "./tool-config.js";
 import {
   advisoryFileHash,
   advisoryPathKey,
@@ -33,29 +34,47 @@ function capAffectedFiles(files, cwd) {
     truncated: unique.length > MAX_ADVISORY_AFFECTED_FILES
   };
 }
-function hasCompleteBlockingProvenance(blockerContent, blockingFiles, cwd) {
+const TURN_END_BLOCKER_SECTION = /^Unresolved from this turn — ([^\s].*?)(?: \(suppressed by disposition: \d+ finding\(s\)\))?:$/;
+function blockerSectionFile(line) {
+  const turnEndSection = TURN_END_BLOCKER_SECTION.exec(line);
+  if (turnEndSection)
+    return turnEndSection[1];
+  if (/^\s/.test(line))
+    return;
+  const separator = line.indexOf(": ");
+  if (separator <= 0)
+    return;
+  return line.slice(0, separator);
+}
+function blockingProvenance(blockerContent, blockingFiles, cwd) {
   if (typeof blockerContent !== "string" || blockerContent.length === 0)
-    return false;
-  if (!Array.isArray(blockingFiles) || blockingFiles.length === 0)
-    return false;
+    return;
+  if (!Array.isArray(blockingFiles))
+    return;
   if (blockingFiles.some((file) => typeof file !== "string" || file.trim().length === 0)) {
-    return false;
+    return;
   }
   const provenanceKeys = blockingFiles.map((file) => guardPathKey(file, cwd));
-  if (new Set(provenanceKeys).size !== provenanceKeys.length)
-    return false;
-  const blockerKeys = blockerContent.split(`
-`).map((line) => {
-    const separator = line.indexOf(": ");
-    if (separator <= 0)
-      return;
-    const file = line.slice(0, separator).trim();
-    return file.length > 0 ? guardPathKey(file, cwd) : undefined;
-  });
-  if (blockerKeys.some((key) => key === undefined))
-    return false;
-  const uniqueBlockerKeys = new Set(blockerKeys);
-  return uniqueBlockerKeys.size === blockerKeys.length && uniqueBlockerKeys.size === provenanceKeys.length && [...uniqueBlockerKeys].every((key) => provenanceKeys.includes(key));
+  const sectionKeys = [];
+  let inSection = false;
+  for (const line of blockerContent.split(`
+`)) {
+    if (line.length === 0) {
+      inSection = false;
+      continue;
+    }
+    const file = blockerSectionFile(line);
+    if (file === undefined) {
+      if (!inSection)
+        return;
+      continue;
+    }
+    sectionKeys.push(guardPathKey(file, cwd));
+    inSection = true;
+  }
+  if (sectionKeys.length === 0)
+    return;
+  return sectionKeys.every((key) => provenanceKeys.includes(key)) ? sectionKeys : undefined;
 }
 function getShellCommand(input) {
   if (!input || typeof input !== "object")
@@ -133,6 +152,12 @@ function canonicalizeGuardCommand(command) {
   let pendingSpace = false;
   quote = undefined;
   for (const ch of result) {
+    if (!quote && ch === `
+`) {
+      collapsed += ch;
+      pendingSpace = false;
+      continue;
+    }
     if (!quote && /\s/.test(ch)) {
       pendingSpace = collapsed.length > 0;
       continue;
@@ -507,8 +532,14 @@ export function retireInlineBlockerAndResyncGuard(args) {
   }
   return true;
 }
+export function resyncGitGuardAfterInlinePolicy(args) {
+  const changed = args.runtime.applyInlineBlockerPolicyVerdicts(args.suppressedFilePaths);
+  if (args.suppressedFilePaths.length === 0 && changed === 0)
+    return;
+  args.runtime.updateGitGuardStatus(false, "");
+}
 export function syncGitGuardRecord(runtime, cacheManager, cwd, editedFilePath) {
-  const entries = runtime.getInlineBlockersSnapshot?.() ?? [];
+  const entries = (runtime.getInlineBlockersSnapshot?.() ?? []).filter((entry) => !entry.policySuppressed);
   const inspection = cacheManager.inspectCache("turn-end-findings", cwd);
   const existing = cacheRecord(cacheManager, cwd);
   if (existing && existing.sessionId !== runtime.telemetrySessionId && entries.length === 0) {
@@ -525,8 +556,8 @@ export function syncGitGuardRecord(runtime, cacheManager, cwd, editedFilePath) {
   }
   const inlineFiles = entries.map((entry) => resolveGuardPath(entry.filePath, cwd));
   const existingBlockingFiles = existing?.blockingFiles ?? [];
-  const provenanceComplete = existing?.blockerContent ? hasCompleteBlockingProvenance(existing.blockerContent, existingBlockingFiles, cwd) : true;
-  if (existing?.blockerContent && !provenanceComplete) {
+  const blockerSections = existing?.blockerContent ? blockingProvenance(existing.blockerContent, existingBlockingFiles, cwd) : undefined;
+  if (existing?.blockerContent && !blockerSections) {
     markCacheUnknown(runtime, "blocking_provenance_untrusted");
     return;
   }
@@ -541,7 +572,7 @@ export function syncGitGuardRecord(runtime, cacheManager, cwd, editedFilePath) {
       affectedFiles = affectedFiles.filter((file) => guardPathKey(file, cwd) !== editedKey);
     }
   }
-  const clearedLastKnownBlocker = !entries.length && !!editedKey && provenanceComplete && existingBlockingFiles.length > 0 && remainingBlockingFiles.length === 0;
+  const clearedLastKnownBlocker = !entries.length && !!editedKey && !!blockerSections && blockerSections.every((key) => key === editedKey);
   const blockerContent = entries.length > 0 ? entries.map((entry) => `${entry.filePath}: ${entry.summary}`).join(`
 `) : clearedLastKnownBlocker ? undefined : existing?.blockerContent;
   const hasTestFailures = existing?.testFailures === true;
@@ -554,6 +585,7 @@ export function syncGitGuardRecord(runtime, cacheManager, cwd, editedFilePath) {
 `);
   if (!hasBlockers && !content) {
     cacheManager.clearCache("turn-end-findings", cwd);
+    runtime.clearGitGuardCacheUnknown();
     return;
   }
   writeGitGuardRecord(cacheManager, runtime, cwd, {
@@ -633,7 +665,22 @@ export function clearGitGuardTestFailure(cacheManager, cwd, runtime, passedFiles
     fileContentHashes: {}
   });
 }
-export function evaluateGitGuard(runtime, cacheManager, cwd) {
+function firstExpiredSuppressionVerdict(runtime) {
+  for (const entry of runtime.getInlineBlockersSnapshot?.() ?? []) {
+    if (!entry.policySuppressed)
+      continue;
+    if (entry.recordedHash === undefined) {
+      return { filePath: entry.filePath, tier: "no_baseline" };
+    }
+    if (fileFingerprint(entry.filePath) !== entry.recordedHash) {
+      return { filePath: entry.filePath, tier: "content" };
+    }
+  }
+  return;
+}
+export function evaluateGitGuard(runtime, cacheManager, cwd, host = "pi") {
+  const diagnosticsTool = resolveLensToolName("lens_diagnostics", host);
+  const inspectLine = diagnosticsTool ? `Run ${diagnosticsTool} mode=all for full details, then commit again.` : "Inspect the full diagnostics, then commit again.";
   if (runtime.gitGuardHasBlockers) {
     logDecision(cwd, "blocked", "runtime_blockers", {
       projectSeq: runtime.projectSeq
@@ -643,9 +690,16 @@ ${runtime.gitGuardSummary}` : "";
     return {
       block: true,
       reason: `\uD83D\uDD34 COMMIT BLOCKED (--lens-guard): unresolved blockers must be fixed before commit/push.${detail}
-Run lens_diagnostics mode=all for full details, then commit again.`
+${inspectLine}`
     };
   }
+  const expired = firstExpiredSuppressionVerdict(runtime);
+  if (expired) {
+    return unknown(cwd, "inline_policy_stale", {
+      file: expired.filePath,
+      tier: expired.tier
+    });
+  }
   if (runtime.gitGuardCacheUnknownReason) {
     return unknown(cwd, runtime.gitGuardCacheUnknownReason);
   }
@@ -716,6 +770,6 @@ Run lens_diagnostics mode=all for full details, then commit again.`
   return {
     block: true,
     reason: `\uD83D\uDD34 COMMIT BLOCKED (--lens-guard): unresolved blockers must be fixed before commit/push.
-Run lens_diagnostics mode=all for full details, then commit again.`
+${inspectLine}`
   };
 }

package/extensions/dm-lens/clients/gitleaks-client.js

@@ -181,6 +181,7 @@ export class GitleaksClient extends SecurityScanClient {
       const findings = await classifyAndFilterFindings(rawFindings, cwd);
       return {
         success: true,
+        analyzed: true,
         findings,
         scannedAt
       };
@@ -197,6 +198,27 @@ export class GitleaksClient extends SecurityScanClient {
     }
   }
 }
+function isInsideNestedGitRepository(file, cwd) {
+  const root = path.resolve(cwd);
+  const absoluteFile = path.isAbsolute(file) ? path.resolve(file) : path.resolve(root, file);
+  const relative = path.relative(root, absoluteFile);
+  if (relative === ".." || relative.startsWith(`..${path.sep}`) || path.isAbsolute(relative))
+    return false;
+  let directory = path.dirname(absoluteFile);
+  while (directory !== root) {
+    try {
+      if (fs.existsSync(path.join(directory, ".git")))
+        return true;
+    } catch {
+      return false;
+    }
+    const parent = path.dirname(directory);
+    if (parent === directory)
+      return false;
+    directory = parent;
+  }
+  return false;
+}
 export async function classifyAndFilterFindings(findings, cwd) {
   if (findings.length === 0)
     return findings;
@@ -211,6 +233,10 @@ export async function classifyAndFilterFindings(findings, cwd) {
       continue;
     }
     const absPath = path.isAbsolute(finding.file) ? finding.file : path.resolve(cwd, finding.file);
+    if (isInsideNestedGitRepository(absPath, cwd)) {
+      classified.push({ ...finding, pathStatus: "nested-repository" });
+      continue;
+    }
     let pathStatus;
     if (trackedIds?.has(normalizeEphemeralMapKey(absPath))) {
       pathStatus = "tracked";

package/extensions/dm-lens/clients/govulncheck-client.js

@@ -2,6 +2,11 @@ import * as fs from "node:fs";
 import * as os from "node:os";
 import * as path from "node:path";
 import { safeSpawnAsync } from "./safe-spawn.js";
+import { probeToolAsync } from "./tool-probe.js";
+import {
+  firstOutputLine,
+  spawnFailedWithNoOutput
+} from "./dispatch/runners/utils/spawn-outcome.js";
 import { assertInstallAllowed } from "./project-trust.js";
 import { SecurityScanClient } from "./security-scan-client.js";
 import {
@@ -47,7 +52,7 @@ export class GovulncheckClient extends SecurityScanClient {
     let goOnPath;
     let goHostStallMs;
     try {
-      goOnPath = await safeSpawnAsync("go", ["version"], {
+      goOnPath = await probeToolAsync("go", ["version"], {
         timeout: 5000
       });
     } finally {
@@ -141,7 +146,7 @@ export class GovulncheckClient extends SecurityScanClient {
     let reprobe;
     let reprobeHostStallMs;
     try {
-      reprobe = await safeSpawnAsync("govulncheck", ["-version"], {
+      reprobe = await probeToolAsync("govulncheck", ["-version"], {
         timeout: 5000
       });
     } finally {
@@ -252,19 +257,42 @@ export class GovulncheckClient extends SecurityScanClient {
     const bin = this.binaryPath ?? "govulncheck";
     try {
       const result = await safeSpawnAsync(bin, ["-mode=source", "-format=json", "./..."], { cwd, timeout: SCAN_TIMEOUT_MS });
+      if (result.error) {
+        this.log(`Scan error: ${result.error.message}`);
+        return {
+          ...EMPTY_RESULT,
+          scannedAt,
+          summary: result.error.message.slice(0, 200)
+        };
+      }
       const rawStdout = result.stdout ?? "";
-      if (!rawStdout.trim() && result.status !== 0 && result.status !== 3) {
-        this.log(`Scan failed: ${(result.stderr ?? "").slice(0, 200)}`);
+      if (result.status !== 0 && result.status !== 3) {
+        return {
+          ...EMPTY_RESULT,
+          scannedAt,
+          summary: firstOutputLine(result.stderr) || "scan failed"
+        };
+      }
+      if (!rawStdout.trim()) {
+        if (spawnFailedWithNoOutput(result, rawStdout)) {
+          this.log(`Scan failed: ${(result.stderr ?? "").slice(0, 200)}`);
+          return {
+            ...EMPTY_RESULT,
+            scannedAt,
+            summary: firstOutputLine(result.stderr) || "scan failed"
+          };
+        }
         return {
           ...EMPTY_RESULT,
+          success: true,
           scannedAt,
-          summary: (result.stderr ?? "").trim().split(`
-`)[0] || "scan failed"
+          summary: "govulncheck produced no output; nothing parsed"
         };
       }
       const findings = parseGovulncheckJson(rawStdout);
       return {
         success: true,
+        analyzed: true,
         findings,
         scannedAt
       };

package/extensions/dm-lens/clients/gradle-ktfmt-style.js

@@ -1,6 +1,8 @@
 import * as os from "node:os";
 import * as path from "node:path";
 import { readTextFileOrUndefined } from "./cargo-manifest.js";
+import { incrementDegradationCount } from "./degradation-ledger.js";
+import { logExtension } from "./extension-log.js";
 import { findNearestMarkerRoot } from "./path-utils.js";
 import {
   gradleBlockRanges,
@@ -13,6 +15,7 @@ const KTFMT_GRADLE_ROOT_FILES = [
   "settings.gradle"
 ];
 const MAX_GRADLE_ANCESTOR_HOPS = 16;
+const MAX_SPOTLESS_KTFMT_CALL_CHARS = 4096;
 const KTFMT_STYLE_CLI_FLAG = {
   google: "--google-style",
   kotlinlang: "--kotlinlang-style"
@@ -33,35 +36,97 @@ function styleFromKtfmtBlockBody(body) {
   }
   return style;
 }
+function findBalancedCallEnd(source, openingParen) {
+  let depth = 0;
+  const limit = Math.min(source.length, openingParen + MAX_SPOTLESS_KTFMT_CALL_CHARS);
+  for (let index = openingParen;index < limit; index += 1) {
+    if (source[index] === "(")
+      depth += 1;
+    if (source[index] !== ")")
+      continue;
+    depth -= 1;
+    if (depth === 0)
+      return index + 1;
+  }
+  return;
+}
+function styleFromSpotlessKotlinBody(body) {
+  let style;
+  for (const call of body.matchAll(/\bktfmt\s*(?=\()/g)) {
+    const callOpenParen = call.index + call[0].length;
+    const closeParen = findBalancedCallEnd(body, callOpenParen);
+    if (closeParen === undefined)
+      continue;
+    const chain = /^\s*((?:\.\s*(?:googleStyle|kotlinlangStyle|dropboxStyle)\s*\(\s*\)\s*)+)/.exec(body.slice(closeParen));
+    if (!chain)
+      continue;
+    const chainBody = chain[1];
+    if (!chainBody)
+      continue;
+    for (const method of chainBody.matchAll(/\.\s*(googleStyle|kotlinlangStyle|dropboxStyle)\s*\(\s*\)/g)) {
+      if (method[1] === "googleStyle")
+        style = "google";
+      if (method[1] === "kotlinlangStyle")
+        style = "kotlinlang";
+      if (method[1] === "dropboxStyle")
+        style = "spotless-dropbox-unsupported";
+    }
+  }
+  return style;
+}
 const SCOPE_BY_ENCLOSING_BLOCK = {
   subprojects: "descendants",
   allprojects: "both"
 };
-function scopeOfKtfmtBlock(range, blocks) {
-  const enclosing = blocks.filter((outer) => outer.start < range.start && outer.end >= range.end);
+function scopeOfGradleStyleBlock(range, ranges) {
+  const enclosing = ranges.filter((outer) => outer.start < range.start && outer.end >= range.end);
   if (enclosing.length === 0)
     return "own";
   if (enclosing.length > 1)
     return;
   return SCOPE_BY_ENCLOSING_BLOCK[enclosing[0].name];
 }
+function styleSelectionForGradleBlock(block, source, allBlockRanges, nonSpotlessRanges) {
+  if (block.name === "ktfmt") {
+    const scope = scopeOfGradleStyleBlock(block, allBlockRanges);
+    if (!scope)
+      return;
+    const style = styleFromKtfmtBlockBody(source.slice(block.start, block.end));
+    return style ? { scope, style } : undefined;
+  }
+  if (block.name !== "kotlin")
+    return;
+  const enclosingSpotless = [];
+  for (const outer of allBlockRanges) {
+    if (outer.name === "spotless" && outer.start < block.start && outer.end >= block.end) {
+      enclosingSpotless.push(outer);
+    }
+  }
+  if (enclosingSpotless.length !== 1)
+    return;
+  const scope = scopeOfGradleStyleBlock(block, nonSpotlessRanges);
+  if (!scope)
+    return;
+  const style = styleFromSpotlessKotlinBody(source.slice(block.start, block.end));
+  return style ? { scope, style } : undefined;
+}
 function stylesFromGradleContent(content) {
   const stripped = stripGradleCommentsAndStrings(content);
   const blocks = gradleBlockRanges(stripped);
+  const scopeRanges = [];
+  for (const range of blocks) {
+    if (range.name !== "spotless")
+      scopeRanges.push(range);
+  }
   const styles = {};
   for (const range of blocks) {
-    if (range.name !== "ktfmt")
-      continue;
-    const scope = scopeOfKtfmtBlock(range, blocks);
-    if (!scope)
-      continue;
-    const style = styleFromKtfmtBlockBody(stripped.slice(range.start, range.end));
-    if (!style)
+    const selection = styleSelectionForGradleBlock(range, stripped, blocks, scopeRanges);
+    if (!selection)
       continue;
-    if (scope !== "descendants")
-      styles.own = style;
-    if (scope !== "own")
-      styles.descendants = style;
+    if (selection.scope !== "descendants")
+      styles.own = selection.style;
+    if (selection.scope !== "own")
+      styles.descendants = selection.style;
   }
   return styles;
 }
@@ -86,6 +151,24 @@ export async function resolveKtfmtGradleStyle(filePath, homeDir = os.homedir())
       return;
     const styles = await stylesForGradleDir(gradleDir);
     const style = hop === 0 ? styles.own : styles.descendants;
+    if (style === "spotless-dropbox-unsupported") {
+      const reason = "Spotless ktfmt dropboxStyle(): dm-lens standalone CLI cannot express " + "the style; falling back to bare ktfmt";
+      const firstOccurrence = incrementDegradationCount({
+        kind: "formatter-skip",
+        subject: "ktfmt:spotless-dropbox",
+        reason,
+        metadata: { filePath, gradleDir }
+      });
+      if (firstOccurrence) {
+        logExtension({
+          subsystem: "format",
+          level: "debug",
+          message: reason,
+          metadata: { filePath, gradleDir }
+        });
+      }
+      return;
+    }
     if (style)
       return KTFMT_STYLE_CLI_FLAG[style];
     const parent = path.dirname(gradleDir);

package/extensions/dm-lens/clients/grammar-source.js

@@ -5,7 +5,7 @@ import { writeFileAtomic } from "./atomic-write.js";
 import { recordDegradationOnce } from "./degradation-ledger.js";
 import { getPackageRoot } from "./package-root.js";
 export const TREE_SITTER_WASMS_VERSION = "0.1.13";
-export const GRAMMAR_CDN_BASE = `https://unpkg.com/tree-sitter-wasms@${TREE_SITTER_WASMS_VERSION}/out`;
+const GRAMMAR_CDN_BASE = `https://unpkg.com/tree-sitter-wasms@${TREE_SITTER_WASMS_VERSION}/out`;
 export const GRAMMAR_SOURCE_OVERRIDES = {
   "tree-sitter-lua.wasm": {
     package: "@tree-sitter-grammars/tree-sitter-lua",
@@ -80,7 +80,7 @@ export const BLOCKED_GRAMMARS = {
     reason: "tree-sitter-swift crashes the runtime on Node >= 24 (V8 Turboshaft WASM OOM, #423/#432); skipped so the process degrades gracefully instead of aborting."
   }
 };
-export function currentGrammarRuntime() {
+function currentGrammarRuntime() {
   const m = /^v?(\d+)/.exec(process.versions?.node ?? "");
   return {
     nodeMajor: m ? Number(m[1]) : 0,
@@ -94,7 +94,7 @@ export function grammarBlockReason(filename, rt = currentGrammarRuntime()) {
   const block = BLOCKED_GRAMMARS[filename];
   return block?.blocked(rt) ? block.reason : null;
 }
-export const WASM_MAGIC = [0, 97, 115, 109];
+const WASM_MAGIC = [0, 97, 115, 109];
 export function hasWasmMagic(bytes) {
   if (bytes.length < WASM_MAGIC.length)
     return false;

package/extensions/dm-lens/clients/host-edit-normalize.js

@@ -1,4 +1,4 @@
-export const HOST_EDIT_DIFF_SDK_FLOOR = "0.79.9";
+export const HOST_EDIT_DIFF_SDK_FLOOR = "0.85.1";
 export const HOST_SMART_SINGLE_QUOTES = [8216, 8217, 8218, 8219];
 export const HOST_SMART_DOUBLE_QUOTES = [8220, 8221, 8222, 8223];
 export const HOST_UNICODE_DASHES = [

package/extensions/dm-lens/clients/indent-retarget.js

@@ -1,4 +1,27 @@
-export function retargetReplacementIndentation(newText, oldText, correctedOldText) {
+import {
+  blockCommentInteriorMask,
+  templateLiteralInteriorMask
+} from "./dispatch/indent-detect.js";
+function computeInteriorMasks(oldLines, fileContext) {
+  if (fileContext) {
+    const fileLines = fileContext.content.replace(/\r\n/g, `
+`).split(`
+`);
+    const start = fileContext.startLine - 1;
+    const end = start + oldLines.length;
+    if (start >= 0 && end <= fileLines.length) {
+      return {
+        commentInterior: blockCommentInteriorMask(fileLines).slice(start, end),
+        templateInterior: templateLiteralInteriorMask(fileLines).slice(start, end)
+      };
+    }
+  }
+  return {
+    commentInterior: blockCommentInteriorMask(oldLines),
+    templateInterior: templateLiteralInteriorMask(oldLines)
+  };
+}
+export function retargetReplacementIndentation(newText, oldText, correctedOldText, fileContext) {
   const newline = newText.includes(`\r
 `) ? `\r
 ` : `
@@ -11,21 +34,28 @@ export function retargetReplacementIndentation(newText, oldText, correctedOldTex
 `);
   if (oldLines.length !== correctedLines.length)
     return;
+  const { commentInterior, templateInterior } = computeInteriorMasks(oldLines, fileContext);
   const indentMap = new Map;
+  const structuralIndents = new Set;
   const ambiguousIndents = new Set;
-  for (let i = 0;i < oldLines.length; i += 1) {
-    const oldIndent = oldLines[i].match(/^[\t ]*/)?.[0] ?? "";
-    const correctedIndent = correctedLines[i].match(/^[\t ]*/)?.[0] ?? "";
+  for (const [i, oldLine] of oldLines.entries()) {
+    const correctedLine = correctedLines[i] ?? "";
+    const oldIndent = oldLine.match(/^[\t ]*/)?.[0] ?? "";
+    const correctedIndent = correctedLine.match(/^[\t ]*/)?.[0] ?? "";
     if (oldIndent === correctedIndent)
       continue;
     const previous = indentMap.get(oldIndent);
     if (previous !== undefined && previous !== correctedIndent) {
       indentMap.delete(oldIndent);
+      structuralIndents.delete(oldIndent);
       ambiguousIndents.add(oldIndent);
       continue;
     }
     if (!ambiguousIndents.has(oldIndent)) {
       indentMap.set(oldIndent, correctedIndent);
+      if (!commentInterior[i] && !templateInterior[i]) {
+        structuralIndents.add(oldIndent);
+      }
     }
   }
   if (indentMap.size === 0)
@@ -33,7 +63,7 @@ export function retargetReplacementIndentation(newText, oldText, correctedOldTex
   let baseFrom = "";
   let baseTo = "";
   for (const [from, to] of indentMap) {
-    if (from.length > 0 && (baseFrom === "" || from.length < baseFrom.length)) {
+    if (from.length > 0 && structuralIndents.has(from) && (baseFrom === "" || from.length < baseFrom.length)) {
       baseFrom = from;
       baseTo = to;
     }

package/extensions/dm-lens/clients/inline-blocker-dispositions.js

@@ -0,0 +1,107 @@
+import * as fs from "node:fs";
+import * as path from "node:path";
+import { recordDegradationOnce } from "./degradation-ledger.js";
+import { hasAnyDispositionMarks } from "./diagnostic-dispositions.js";
+import {
+  applyFindingPolicy,
+  inlineBlockerIdentities,
+  loadProjectRulePolicyMap
+} from "./dispatch/finding-policy.js";
+import { toRunnerDisplayPath } from "./dispatch/runner-context.js";
+import { formatDiagnostics } from "./dispatch/utils/format-utils.js";
+function readCurrentContent(filePath) {
+  try {
+    return fs.readFileSync(filePath, "utf-8");
+  } catch {
+    return "";
+  }
+}
+export function applyInlineBlockerPolicy(record, cwd) {
+  const diagnostics = record.diagnostics;
+  if (!diagnostics || diagnostics.length === 0) {
+    if (hasAnyDispositionMarks(cwd)) {
+      recordDegradationOnce({
+        kind: "inline-blocker-unstructured",
+        subject: `inline-blocker:${toRunnerDisplayPath(cwd, record.filePath)}`,
+        reason: "record carries no structured diagnostics; disposition marks cannot be applied to its rendered summary"
+      });
+    }
+    return {
+      body: record.summary,
+      candidates: 0,
+      kept: 0,
+      suppressed: 0,
+      unstructured: true
+    };
+  }
+  const byFile = new Map;
+  for (const diagnostic of diagnostics) {
+    const owner = path.resolve(cwd, diagnostic.filePath);
+    const group = byFile.get(owner);
+    if (group)
+      group.push(diagnostic);
+    else
+      byFile.set(owner, [diagnostic]);
+  }
+  const policyMap = loadProjectRulePolicyMap(cwd);
+  const dropped = new Set;
+  for (const [filePath, group] of byFile) {
+    const { kept } = applyFindingPolicy(group, {
+      cwd,
+      filePath,
+      content: readCurrentContent(filePath),
+      policyMap,
+      identities: inlineBlockerIdentities
+    });
+    const survivors = new Set(kept);
+    for (const diagnostic of group) {
+      if (!survivors.has(diagnostic))
+        dropped.add(diagnostic);
+    }
+  }
+  const kept = dropped.size === 0 ? [...diagnostics] : diagnostics.filter((diagnostic) => !dropped.has(diagnostic));
+  return {
+    body: kept.length === 0 ? undefined : formatDiagnostics(kept, "blocking").trim(),
+    candidates: diagnostics.length,
+    kept: kept.length,
+    suppressed: dropped.size,
+    unstructured: false
+  };
+}
+const IDENTITY_CAP = 10;
+export function summarizeInlineBlockerPolicy(entries) {
+  const files = [];
+  const tools = new Set;
+  let stale = 0;
+  let candidates = 0;
+  let kept = 0;
+  let suppressed = 0;
+  let unstructured = 0;
+  for (const entry of entries) {
+    for (const tool of entry.sources ?? [])
+      tools.add(tool);
+    if (entry.stale)
+      stale += 1;
+    const outcome = entry.outcome;
+    if (outcome === undefined)
+      continue;
+    candidates += outcome.candidates;
+    kept += outcome.kept;
+    suppressed += outcome.suppressed;
+    if (outcome.unstructured)
+      unstructured += 1;
+    if (outcome.suppressed > 0 && files.length < IDENTITY_CAP) {
+      files.push(entry.displayPath);
+    }
+  }
+  return {
+    records: entries.length,
+    stale,
+    candidates,
+    kept,
+    dispositionSuppressed: suppressed,
+    unstructured,
+    files,
+    tools: [...tools].slice(0, IDENTITY_CAP)
+  };
+}