@duckmind/dm-linux-x64 0.65.5 → 0.65.7

package/extensions/dm-lens/clients/safe-spawn.js

@@ -4,12 +4,17 @@ import {
 } from "node:child_process";
 import * as fs from "node:fs";
 import * as path from "node:path";
-import { BoundedFifoMap } from "./bounded-cache.js";
+import { BoundedFifoMap, BoundedSet } from "./bounded-cache.js";
 import { logLatency } from "./latency-logger.js";
-import { recordDegradation } from "./degradation-ledger.js";
+import {
+  incrementDegradationCount,
+  recordDegradation,
+  recordDegradationOnce
+} from "./degradation-ledger.js";
 import { logExtension } from "./extension-log.js";
 import { isFullyQualifiedWin32 } from "./path-utils.js";
 import { startSpawnUsageSampler } from "./resource-sampler.js";
+import { DEFAULT_MAX_OUTPUT_BYTES } from "./spawn-output-cap.js";
 import { compareOrdinal } from "./string-utils.js";
 
 export class SpawnFailureError extends Error {
@@ -146,6 +151,87 @@ const lifetimeState = processWithLifetimeState[lifetimeStateKey] ?? (processWith
   pids: new Set,
   installed: false
 });
+const PROC_PPID_READABLE = (() => {
+  if (process.platform !== "linux")
+    return false;
+  try {
+    return /^PPid:\s*\d+$/m.test(fs.readFileSync("/proc/self/status", "utf8"));
+  } catch {
+    return false;
+  }
+})();
+export const VERIFIED_OWN_PID_CAP = 512;
+const verifiedOwnPids = new BoundedFifoMap(VERIFIED_OWN_PID_CAP);
+const HELD_OWN_PID_SWEEP_AT = 256;
+const heldOwnPids = new BoundedSet(HELD_OWN_PID_SWEEP_AT);
+function groupIsGone(pid) {
+  try {
+    process.kill(-pid, 0);
+    return false;
+  } catch (error) {
+    return errorCode(error) === "ESRCH";
+  }
+}
+function sweepHeldOwnPids() {
+  if (heldOwnPids.size < HELD_OWN_PID_SWEEP_AT)
+    return;
+  for (const pid of heldOwnPids) {
+    if (groupIsGone(pid))
+      heldOwnPids.delete(pid);
+  }
+}
+export function holdOwnChildPid(pid, site) {
+  const owned = isOwnLiveChild(pid, site);
+  if (!owned || !PROC_PPID_READABLE || typeof pid !== "number")
+    return owned;
+  verifiedOwnPids.delete(pid);
+  sweepHeldOwnPids();
+  heldOwnPids.add(pid);
+  return true;
+}
+export function releaseOwnChildPid(pid) {
+  if (typeof pid === "number")
+    heldOwnPids.delete(pid);
+}
+function recordProcUnavailable(site) {
+  if (process.platform !== "linux")
+    return;
+  recordDegradationOnce({
+    kind: "kill-ownership-unverifiable",
+    subject: site,
+    reason: "/proc/self/status is unreadable on this Linux host; kill-by-pid ownership falls back to best-effort"
+  });
+}
+export function isOwnLiveChild(pid, site, handle) {
+  if (typeof pid !== "number" || !Number.isInteger(pid) || pid <= 0)
+    return false;
+  if (!PROC_PPID_READABLE) {
+    if (handle && (handle.exitCode != null || handle.signalCode != null))
+      return false;
+    recordProcUnavailable(site);
+    return true;
+  }
+  let status;
+  try {
+    status = fs.readFileSync(`/proc/${pid}/status`, "utf8");
+  } catch {
+    return heldOwnPids.has(pid) || verifiedOwnPids.has(pid);
+  }
+  const parent = /^PPid:\s*(\d+)$/m.exec(status);
+  if (!parent)
+    return true;
+  if (Number(parent[1]) === process.pid) {
+    if (!heldOwnPids.has(pid))
+      verifiedOwnPids.set(pid, true);
+    return true;
+  }
+  incrementDegradationCount({
+    kind: "kill-foreign-pid-refused",
+    subject: site,
+    reason: `pid ${pid} has parent ${parent[1]}, not this process — signal refused`
+  });
+  return false;
+}
 function killPidTreeSync(pid) {
   if (process.platform === "win32") {
     try {
@@ -178,7 +264,34 @@ function installLifetimeCleanup() {
     process.once(signal, () => {
       for (const pid of lifetimeState.pids)
         killPidTreeSync(pid);
-      process.kill(process.pid, signal);
+      if (process.platform === "win32" && signal === "SIGHUP") {
+        recordDegradationOnce({
+          kind: "safe-spawn-signal-reraise-unsupported",
+          subject: `${process.platform}:${signal}`,
+          reason: `${process.platform} ${signal}: self signal re-raise is unsupported by the Windows libuv signal capability`,
+          metadata: {
+            platform: process.platform,
+            signal,
+            reason: "unsupported"
+          }
+        });
+        return;
+      }
+      try {
+        process.kill(process.pid, signal);
+      } catch (error) {
+        recordDegradationOnce({
+          kind: "safe-spawn-signal-reraise-unsupported",
+          subject: `${process.platform}:${signal}`,
+          reason: `${process.platform} ${signal}: self signal re-raise was refused (${error.code ?? error.message})`,
+          metadata: {
+            platform: process.platform,
+            signal,
+            reason: "refused",
+            code: error.code ?? null
+          }
+        });
+      }
     });
   }
 }
@@ -435,6 +548,7 @@ export function resetUtf8ConsoleCodePageStateForTests() {
 }
 const EXIT_PIPE_IDLE_GRACE_MS = 100;
 const EXIT_PIPE_IDLE_MAX_WAIT_MS = 2000;
+const SPAWN_SAMPLER_TEARDOWN_GRACE_MS = 5000;
 export async function safeSpawnAsync(command, args, options) {
   const configuredTimeout = options?.timeout !== undefined && Number.isFinite(options.timeout) && options.timeout >= 0 ? options.timeout : 30000;
   const deadlineRemaining = options?.deadlineAt !== undefined && Number.isFinite(options.deadlineAt) ? options.deadlineAt - Date.now() : Number.POSITIVE_INFINITY;
@@ -472,6 +586,9 @@ export async function safeSpawnAsync(command, args, options) {
     let killed = false;
     let outputTruncated = false;
     let killedForOutputCap = false;
+    let observedOutputBytes = 0;
+    let retainedOutputBytes = 0;
+    let outputHandlerFailed = false;
     let streamingMatch = false;
     let resolved = false;
     let pendingSpawnError;
@@ -480,7 +597,9 @@ export async function safeSpawnAsync(command, args, options) {
     let teardownEscalated = false;
     let closed = false;
     let rearmIdleGrace;
-    const maxOutputBytes = options?.maxOutputBytes !== undefined && Number.isFinite(options.maxOutputBytes) && options.maxOutputBytes > 0 ? Math.floor(options.maxOutputBytes) : undefined;
+    const callerCap = options?.maxOutputBytes;
+    const capFromCaller = callerCap !== undefined && Number.isFinite(callerCap) && callerCap > 0;
+    const maxOutputBytes = capFromCaller ? Math.floor(callerCap) : DEFAULT_MAX_OUTPUT_BYTES;
     const outputTruncationMarker = `
 ...[output truncated]...
 `;
@@ -530,17 +649,16 @@ export async function safeSpawnAsync(command, args, options) {
     };
     const appendOutput = (stream, current, chunk) => {
       const text = typeof chunk === "string" ? chunk : chunk.toString();
-      if (maxOutputBytes === undefined || outputTruncated) {
-        if (maxOutputBytes === undefined)
-          return current + text;
+      if (outputTruncated) {
         appendTail({ stream, text }, retainedTailLimit);
         truncationStream = stream;
         return renderOutput(stream);
       }
-      const used = Buffer.byteLength(stdout) + Buffer.byteLength(stderr);
       const bytes = Buffer.byteLength(text);
-      if (used + bytes <= maxOutputBytes)
+      if (retainedOutputBytes + bytes <= maxOutputBytes) {
+        retainedOutputBytes += bytes;
         return current + text;
+      }
       outputTruncated = true;
       truncationStream = stream;
       const available = Math.max(0, maxOutputBytes - Buffer.byteLength(outputTruncationMarker));
@@ -655,18 +773,39 @@ export async function safeSpawnAsync(command, args, options) {
       child.stdin?.on("error", () => {});
       child.stdin?.end(options.input);
     }
-    if (child.pid && (posixProcessGroup || options?.lifetimeCoupled)) {
+    const ownsChildPid = isOwnLiveChild(child.pid, "safe-spawn-register");
+    if (ownsChildPid && (posixProcessGroup || options?.lifetimeCoupled)) {
       installLifetimeCleanup();
       lifetimeState.pids.add(child.pid);
     }
     let usageSampler;
     try {
-      usageSampler = startSpawnUsageSampler(child.pid);
+      usageSampler = startSpawnUsageSampler(child.pid, undefined, timeout + SPAWN_SAMPLER_TEARDOWN_GRACE_MS);
     } catch {
       usageSampler = { stop: () => null };
     }
     const resourceLabel = options?.resourceLabel ?? command;
-    const killTree = async () => {
+    let killFailed = false;
+    const trySend = (send) => {
+      try {
+        send();
+        return true;
+      } catch {
+        return false;
+      }
+    };
+    const noteKillFailure = (phase) => {
+      if (killFailed)
+        return;
+      killFailed = true;
+      incrementDegradationCount({
+        kind: "spawn-kill-failed",
+        subject: resourceLabel,
+        reason: `every signal available for the ${phase} teardown was refused; the child may still be running`,
+        metadata: { phase, pid: child.pid }
+      });
+    };
+    const killTree = async (phase) => {
       if (isWindows && child.pid && child.pid > 0) {
         const taskkill = `${process.env.SystemRoot ?? "C:\\Windows"}\\System32\\taskkill.exe`;
         try {
@@ -678,48 +817,53 @@ export async function safeSpawnAsync(command, args, options) {
             });
             killer.once("close", () => done());
             killer.once("error", () => {
-              child.kill("SIGKILL");
+              if (!trySend(() => child.kill("SIGKILL")))
+                noteKillFailure(phase);
               done();
             });
           });
         } catch {
-          child.kill("SIGKILL");
+          if (!trySend(() => child.kill("SIGKILL")))
+            noteKillFailure(phase);
         }
-      } else if (posixProcessGroup && child.pid && child.pid > 0) {
+      } else if (posixProcessGroup && ownsChildPid) {
         const pgid = -child.pid;
-        try {
-          process.kill(pgid, "SIGTERM");
-        } catch {
-          child.kill("SIGTERM");
+        if (!trySend(() => process.kill(pgid, "SIGTERM"))) {
+          if (!trySend(() => child.kill("SIGTERM")))
+            noteKillFailure(phase);
         }
         escalationTimer = setTimeout(() => {
-          let groupAlive = true;
-          try {
-            process.kill(pgid, 0);
-          } catch {
-            groupAlive = false;
-          }
-          if (!groupAlive)
-            return;
-          teardownEscalated = true;
-          logLatency({
-            type: "phase",
-            phase: "spawn_group_kill_escalation",
-            filePath: "",
-            durationMs: 0,
-            metadata: { pgid: child.pid }
+          const escalated = trySend(() => {
+            let groupAlive = true;
+            try {
+              process.kill(pgid, 0);
+            } catch {
+              groupAlive = false;
+            }
+            if (!groupAlive)
+              return;
+            teardownEscalated = true;
+            logLatency({
+              type: "phase",
+              phase: "spawn_group_kill_escalation",
+              filePath: "",
+              durationMs: 0,
+              metadata: { pgid: child.pid }
+            });
+            trySend(() => process.kill(pgid, "SIGKILL"));
           });
-          try {
-            process.kill(pgid, "SIGKILL");
-          } catch {}
+          if (!escalated)
+            noteKillFailure(phase);
         }, 1000);
       } else {
-        child.kill("SIGTERM");
+        if (!trySend(() => child.kill("SIGTERM")))
+          noteKillFailure(phase);
         escalationTimer = setTimeout(() => {
-          if (!closed) {
-            teardownEscalated = true;
-            child.kill("SIGKILL");
-          }
+          if (closed)
+            return;
+          teardownEscalated = true;
+          if (!trySend(() => child.kill("SIGKILL")))
+            noteKillFailure(phase);
         }, 1000);
       }
     };
@@ -727,7 +871,7 @@ export async function safeSpawnAsync(command, args, options) {
       aborted = true;
       if (!killed && !child.killed) {
         killed = true;
-        killTree();
+        killTree("abort");
       }
     };
     abortSignal?.addEventListener("abort", onAbort, { once: true });
@@ -737,27 +881,67 @@ export async function safeSpawnAsync(command, args, options) {
       if (outputTruncated && !waitingForStreamingMatch && !killed && !child.killed) {
         killedForOutputCap = true;
         killed = true;
-        killPromise = killTree();
+        killPromise = killTree("output-cap");
+      }
+    };
+    const recordOutputCapTrip = () => {
+      incrementDegradationCount({
+        kind: "spawn-output-cap-truncated",
+        subject: resourceLabel,
+        reason: `retained output reached the ${maxOutputBytes}-byte ${capFromCaller ? "caller" : "default"} cap after ${observedOutputBytes} bytes; child ${killedForOutputCap ? "terminated" : "left running"}`,
+        metadata: {
+          capBytes: maxOutputBytes,
+          capSource: capFromCaller ? "caller" : "default",
+          observedBytes: observedOutputBytes,
+          killed: killedForOutputCap
+        }
+      });
+    };
+    const failOutputHandler = (stream, error) => {
+      outputHandlerFailed = true;
+      outputTruncated = true;
+      incrementDegradationCount({
+        kind: "spawn-output-handler-fault",
+        subject: resourceLabel,
+        reason: `${stream} chunk handling threw ${error.name} after ${observedOutputBytes} bytes; retention stopped and the child was terminated`,
+        metadata: {
+          stream,
+          error: error.name,
+          capBytes: maxOutputBytes,
+          observedBytes: observedOutputBytes
+        }
+      });
+      if (!killed && !child.killed) {
+        killedForOutputCap = true;
+        killed = true;
+        killPromise = killTree("handler-fault");
       }
     };
     child.stdout?.setEncoding("utf-8");
     child.stderr?.setEncoding("utf-8");
-    child.stdout?.on("data", (data) => {
-      matchStreamingChunk("stdout", data);
-      stdout = appendOutput("stdout", stdout, data);
-      if (outputTruncated)
-        refreshRetainedOutputs();
-      stopForOutputLimit();
-      rearmIdleGrace?.();
-    });
-    child.stderr?.on("data", (data) => {
-      matchStreamingChunk("stderr", data);
-      stderr = appendOutput("stderr", stderr, data);
-      if (outputTruncated)
-        refreshRetainedOutputs();
-      stopForOutputLimit();
-      rearmIdleGrace?.();
-    });
+    const onOutputChunk = (stream, data) => {
+      if (outputHandlerFailed)
+        return;
+      try {
+        observedOutputBytes += Buffer.byteLength(data);
+        const wasTruncated = outputTruncated;
+        matchStreamingChunk(stream, data);
+        if (stream === "stdout")
+          stdout = appendOutput(stream, stdout, data);
+        else
+          stderr = appendOutput(stream, stderr, data);
+        if (outputTruncated)
+          refreshRetainedOutputs();
+        stopForOutputLimit();
+        if (!wasTruncated && outputTruncated)
+          recordOutputCapTrip();
+        rearmIdleGrace?.();
+      } catch (error) {
+        failOutputHandler(stream, toError(error));
+      }
+    };
+    child.stdout?.on("data", (data) => onOutputChunk("stdout", data));
+    child.stderr?.on("data", (data) => onOutputChunk("stderr", data));
     let closeSeen = false;
     let closedAtMs;
     child.on("close", () => {
@@ -769,7 +953,7 @@ export async function safeSpawnAsync(command, args, options) {
       if (!killed && !child.killed) {
         killed = true;
         teardownStartedAtMs = Date.now();
-        killPromise = killTree();
+        killPromise = killTree("timeout");
       }
     }, timeout);
     const finishResourceUsage = () => {
@@ -845,7 +1029,8 @@ export async function safeSpawnAsync(command, args, options) {
       const resourceUsage = finishResourceUsage();
       const outputInfo = {
         ...outputTruncated ? { outputTruncated: true } : {},
-        ...killedForOutputCap ? { killedForOutputCap: true } : {}
+        ...killedForOutputCap ? { killedForOutputCap: true } : {},
+        ...killFailed ? { killFailed: true } : {}
       };
       const streamingMatchInfo = streamingMatch ? { streamingMatch: true } : {};
       const signalInfo = signal ? { signal } : {};
@@ -956,6 +1141,7 @@ export async function safeSpawnAsync(command, args, options) {
         spawnFailure,
         ...outputTruncated ? { outputTruncated: true } : {},
         ...killedForOutputCap ? { killedForOutputCap: true } : {},
+        ...killFailed ? { killFailed: true } : {},
         ...streamingMatch ? { streamingMatch: true } : {},
         resourceUsage
       });

package/extensions/dm-lens/clients/sanitize.js

@@ -23,10 +23,6 @@ const DETAIL_PATTERNS = [
 export function stripAnsi(text) {
   return text.replace(ANSI_ESCAPE, "").replace(ANSI_ESCAPE_EXTENDED, "");
 }
-export function normalizeWhitespace(text) {
-  return text.split(/\r?\n/).map((line) => line.replace(/\s+/g, " ").trim()).filter((line) => line.length > 0).join(`
-`);
-}
 function isErrorLine(line) {
   const cleanLine = stripAnsi(line).trim();
   return ERROR_INDICATORS.some((pattern) => pattern.test(cleanLine));

package/extensions/dm-lens/clients/scan-utils.js

@@ -1,45 +1,7 @@
-import { isExcludedDirName, isTestFile } from "./file-utils.js";
 import {
   collectSourceFiles,
-  collectSourceFilesAsync,
-  isBuildArtifact
+  collectSourceFilesAsync
 } from "./source-filter.js";
-export function parseAstGrepJson(raw) {
-  if (!raw)
-    return [];
-  const trimmed = raw.trim();
-  if (trimmed.startsWith("[")) {
-    try {
-      return JSON.parse(trimmed);
-    } catch {
-      return [];
-    }
-  }
-  return trimmed.split(`
-`).flatMap((l) => {
-    try {
-      return [JSON.parse(l)];
-    } catch {
-      return [];
-    }
-  });
-}
-export function shouldIgnoreFile(filePath, isTsProject) {
-  const relPath = filePath.replace(/\\/g, "/");
-  if (isTsProject && isBuildArtifact(filePath))
-    return true;
-  const isJs = relPath.endsWith(".js") || relPath.endsWith(".mjs") || relPath.endsWith(".cjs");
-  if (isTsProject && isJs)
-    return true;
-  if (isTestFile(filePath))
-    return true;
-  const pathParts = relPath.split("/").filter(Boolean);
-  for (const segment of pathParts.slice(0, -1)) {
-    if (isExcludedDirName(segment))
-      return true;
-  }
-  return false;
-}
 export function getSourceFiles(dir, _isTsProject) {
   return collectSourceFiles(dir);
 }

package/extensions/dm-lens/clients/scratch-tree-policy.js

@@ -1,13 +1,11 @@
 import { EXCLUDED_DIRS, getExcludedDirGlobs } from "./file-utils.js";
+import { escapeRegExp } from "./string-utils.js";
 function literalExcludedDirNames() {
   return EXCLUDED_DIRS.filter((name) => !name.includes("*") && !name.includes("?"));
 }
 export function getScratchTreeGlobPatterns() {
   return getExcludedDirGlobs();
 }
-function escapeRegExp(literal) {
-  return literal.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
-}
 export function getScratchTreeDirNames() {
   return literalExcludedDirNames();
 }
@@ -16,6 +14,7 @@ export function getScratchTreeFnmatchPatterns() {
 }
 export const SECRETS_LANE_SCRATCH_DIR_NAMES = [
   ".pi",
+  ".omp",
   ".dm-lens",
   ".claude",
   ".codex",

package/extensions/dm-lens/clients/security-scan-client.js

@@ -1,6 +1,6 @@
 import * as path from "node:path";
 import { createSubsystemLogger } from "./extension-log.js";
-import { safeSpawnAsync } from "./safe-spawn.js";
+import { probeToolAsync } from "./tool-probe.js";
 import {
   classifyProbeFailure,
   createAvailabilityLatch,
@@ -74,7 +74,7 @@ export class SecurityScanClient {
         const { findManagedToolBinary } = await import("./installer/index.js");
         const managed = await findManagedToolBinary(this.toolName);
         return {
-          probe: await safeSpawnAsync(managed ?? this.toolName, versionArgs, {
+          probe: await probeToolAsync(managed ?? this.toolName, versionArgs, {
             timeout: 5000
           }),
           binaryPath: managed ?? null

package/extensions/dm-lens/clients/session-event-guard.js

@@ -1,5 +1,21 @@
 import { emitBounded } from "./bounded-telemetry.js";
+import { recordDegradationOnce } from "./degradation-ledger.js";
+import { bounded } from "./deadline-utils.js";
+import { HOOK_WALL_BUDGET_MS } from "./hook-budgets.js";
 import { probeCtxActive } from "./session-lifecycle.js";
+import { runWithTurnContext } from "./turn-context.js";
+function stableSessionId(ctx) {
+  try {
+    return ctx?.sessionManager?.getSessionId?.();
+  } catch {
+    recordDegradationOnce({
+      kind: "turn-context-identity-fallback",
+      subject: "session-event-guard",
+      reason: "stable session identity resolution failed; using detached turn context"
+    });
+    return;
+  }
+}
 export function isStaleExtensionCtxError(err) {
   return err instanceof Error && err.message.includes("stale after session replacement or reload");
 }
@@ -13,10 +29,30 @@ function recordStaleSkip(eventName, detectedAt) {
     reason: `${eventName} skipped: extension ctx is stale (${detectedAt})`
   });
 }
+export function surfaceHandlerCrash(handler, err, options = {}) {
+  try {
+    options.dbg?.(`${handler} crashed: ${err}`);
+    options.dbg?.(`${handler} crash stack: ${err?.stack}`);
+  } catch {}
+  recordDegradationOnce({
+    kind: "hook-handler-crash",
+    subject: handler,
+    reason: `${handler} handler crashed and was swallowed: ${String(err)}`
+  });
+  if (process.env.VITEST && options.rethrow !== false)
+    throw err;
+}
 function isThenable(value) {
   return typeof value?.then === "function";
 }
 function guardSessionEvent(eventName, handler, onStaleResult, options) {
+  const defaultBudgetKey = (eventName) => {
+    if (eventName === "tool_result")
+      return "tool_result_edit";
+    if (eventName === "session_start" || eventName === "turn_end" || eventName === "agent_end" || eventName === "agent_settled")
+      return eventName;
+    return;
+  };
   const skip = (event, detectedAt) => {
     recordStaleSkip(eventName, detectedAt);
     try {
@@ -28,13 +64,34 @@ function guardSessionEvent(eventName, handler, onStaleResult, options) {
     if (probeCtxActive(ctx) === false)
       return skip(event, "pre-dispatch");
     try {
-      const result = handler(event, ctx);
+      let signal;
+      try {
+        signal = ctx?.signal;
+      } catch (err) {
+        if (isStaleExtensionCtxError(err))
+          return Promise.resolve(skip(event, "mid-handler"));
+        const crashOptions = {};
+        if (options.dbg !== undefined)
+          crashOptions.dbg = options.dbg;
+        surfaceHandlerCrash(eventName, err, crashOptions);
+        return Promise.resolve(onStaleResult(event));
+      }
+      const result = runWithTurnContext(stableSessionId(ctx), () => handler(event, ctx));
       if (isThenable(result)) {
-        return Promise.resolve(result).catch((err) => {
+        const recovered = Promise.resolve(result).catch((err) => {
           if (isStaleExtensionCtxError(err))
             return skip(event, "mid-handler");
           throw err;
         });
+        const budget = typeof options.budgetKey === "function" ? options.budgetKey(event, ctx) : options.budgetKey ?? defaultBudgetKey(eventName);
+        if (budget === undefined)
+          return recovered;
+        return bounded(recovered, {
+          ms: HOOK_WALL_BUDGET_MS[budget],
+          signal: budget === "agent_settled" ? undefined : signal,
+          hook: budget,
+          label: "registered-handler"
+        });
       }
       return result;
     } catch (err) {

package/extensions/dm-lens/clients/session-summary.js

@@ -1,28 +1,3 @@
-export function formatSessionSummary(stats) {
-  if (stats.totalShown === 0)
-    return "";
-  const lines = [
-    "## Diagnostic Summary",
-    "",
-    `Shown to agent: ${stats.totalShown}`,
-    `Auto-fixed: ${stats.totalAutoFixed} (${pct(stats.totalAutoFixed, stats.totalShown)}%)`,
-    `Fixed by agent: ${stats.totalAgentFixed} (${pct(stats.totalAgentFixed, stats.totalShown)}%)`,
-    ""
-  ];
-  if (stats.topViolations.length > 0) {
-    lines.push("Top violations:");
-    for (const { ruleId, count } of stats.topViolations.slice(0, 5)) {
-      lines.push(`  - ${ruleId} (${count}x)`);
-    }
-  }
-  return lines.join(`
-`);
-}
-function pct(part, total) {
-  if (total === 0)
-    return "0";
-  return Math.round(part / total * 100).toString();
-}
 export function formatSlopScoreSummary(summary) {
   if (summary.totalRuleDiagnostics === 0 || summary.totalKlocWritten <= 0) {
     return "";