@duckmind/dm-linux-x64 0.65.8 → 0.66.2

package/extensions/dm-lens/dist/clients/dispatch/runners/trivy-config.js

@@ -1,155 +0,0 @@
-import { formatToolFailure } from "./utils/tool-failure.js";
-import * as fs from "node:fs";
-import * as path from "node:path";
-import { pathsEqual } from "../../path-utils.js";
-import { incrementDegradationCount } from "../../degradation-ledger.js";
-import { safeSpawnAsync } from "../../safe-spawn.js";
-import { resolveRunnerCwd } from "../../tool-cwd.js";
-import { isTrivyEnabled, resolveSeverityFloor } from "../../trivy-client.js";
-import { PRIORITY } from "../priorities.js";
-import { createAvailabilityChecker, resolveAvailableOrInstall } from "./utils/runner-helpers.js";
-const trivy = createAvailabilityChecker("trivy", ".exe");
-export function looksLikeKubernetesManifest(content) {
-  for (const doc of content.split(/^---\s*$/m)) {
-    if (/^apiVersion:\s*\S/m.test(doc) && /^kind:\s*\S/m.test(doc)) {
-      return true;
-    }
-  }
-  return false;
-}
-export function looksLikeCloudFormationTemplate(content) {
-  if (/AWSTemplateFormatVersion/.test(content))
-    return true;
-  if (/Transform:\s*(\[.*)?["']?AWS::Serverless/.test(content))
-    return true;
-  return /Type["']?\s*:\s*["']?(AWS|Custom|Alexa)::/.test(content);
-}
-function normalizeSeverity(raw) {
-  const s = typeof raw === "string" ? raw.toUpperCase() : "";
-  if (s === "CRITICAL" || s === "HIGH" || s === "MEDIUM" || s === "LOW") {
-    return s;
-  }
-  return "UNKNOWN";
-}
-export function parseTrivyConfigOutput(raw, filePath, cwd = process.cwd()) {
-  if (!raw.trim())
-    return [];
-  let parsed;
-  try {
-    parsed = JSON.parse(raw);
-  } catch {
-    return [];
-  }
-  const results = parsed?.Results;
-  if (!Array.isArray(results))
-    return [];
-  const diagnostics = [];
-  const absTarget = path.resolve(cwd, filePath);
-  for (const resultEntry of results) {
-    if (!resultEntry || typeof resultEntry !== "object")
-      continue;
-    const target = resultEntry.Target;
-    if (typeof target !== "string" || !pathsEqual(path.resolve(cwd, target), absTarget))
-      continue;
-    const rows = resultEntry.Misconfigurations;
-    if (!Array.isArray(rows))
-      continue;
-    for (const row of rows) {
-      if (!row || typeof row !== "object")
-        continue;
-      const m = row;
-      const id = typeof m.ID === "string" ? m.ID : undefined;
-      if (!id)
-        continue;
-      const cause = m.CauseMetadata ?? {};
-      const line = typeof cause.StartLine === "number" && cause.StartLine > 0 ? cause.StartLine : 1;
-      const severity = normalizeSeverity(m.Severity);
-      const title = typeof m.Title === "string" ? m.Title : id;
-      const resolution = typeof m.Resolution === "string" && m.Resolution ? ` ${m.Resolution}` : "";
-      diagnostics.push({
-        id: `trivy-config-${id}-${line}`,
-        message: `[${id}] ${title} (${severity}).${resolution}`.trim(),
-        filePath,
-        line,
-        column: 1,
-        severity: severity === "CRITICAL" ? "error" : "warning",
-        semantic: severity === "CRITICAL" ? "blocking" : "warning",
-        defectClass: "safety",
-        tool: "trivy-config",
-        rule: id,
-        fixable: false
-      });
-    }
-  }
-  return diagnostics;
-}
-const trivyConfigRunner = {
-  id: "trivy-config",
-  appliesTo: ["docker", "yaml", "terraform", "json"],
-  priority: PRIORITY.GENERAL_ANALYSIS,
-  skipTestFiles: false,
-  async run(ctx) {
-    const cwd = resolveRunnerCwd(ctx, "trivy-config");
-    if (!isTrivyEnabled(cwd)) {
-      return { status: "skipped", diagnostics: [], semantic: "none" };
-    }
-    const absPath = path.resolve(cwd, ctx.filePath);
-    if (ctx.kind === "yaml" || ctx.kind === "json") {
-      let content = "";
-      try {
-        content = fs.readFileSync(absPath, "utf-8");
-      } catch {
-        return { status: "skipped", diagnostics: [], semantic: "none" };
-      }
-      const isManifest = ctx.kind === "yaml" ? looksLikeKubernetesManifest(content) || looksLikeCloudFormationTemplate(content) : looksLikeCloudFormationTemplate(content);
-      if (!isManifest) {
-        return { status: "skipped", diagnostics: [], semantic: "none" };
-      }
-    }
-    let cmd = null;
-    if (await trivy.isAvailableAsync(cwd)) {
-      cmd = trivy.getCommand(cwd);
-    } else {
-      const managed = await resolveAvailableOrInstall(trivy, "trivy", cwd);
-      if (managed)
-        cmd = managed;
-    }
-    if (!cmd)
-      return { status: "skipped", diagnostics: [], semantic: "none" };
-    const severities = resolveSeverityFloor(cwd).join(",");
-    const result = await safeSpawnAsync(cmd, [
-      "config",
-      "--quiet",
-      "--format",
-      "json",
-      "--severity",
-      severities,
-      absPath
-    ], { cwd, timeout: 60000 });
-    if (result.error || result.status !== 0) {
-      incrementDegradationCount({
-        kind: "runner-empty-result",
-        subject: absPath,
-        reason: formatToolFailure({
-          tool: "trivy config",
-          status: result.status,
-          signal: result.signal,
-          stderr: result.stderr || result.error?.message,
-          stdout: result.stdout
-        })
-      });
-      return { status: "skipped", diagnostics: [], semantic: "none" };
-    }
-    const diagnostics = parseTrivyConfigOutput(result.stdout || "", ctx.filePath, cwd);
-    if (diagnostics.length === 0) {
-      return { status: "succeeded", diagnostics: [], semantic: "none" };
-    }
-    const hasBlocking = diagnostics.some((d) => d.semantic === "blocking");
-    return {
-      status: hasBlocking ? "failed" : "succeeded",
-      diagnostics,
-      semantic: hasBlocking ? "blocking" : "warning"
-    };
-  }
-};
-export default trivyConfigRunner;

package/extensions/dm-lens/dist/clients/dispatch/runners/utils/availability-policy.js

@@ -1,285 +0,0 @@
-import { logLatency } from "../../../latency-logger.js";
-export function describeProbeEvidence(result, command) {
-  const errno = result.error?.code;
-  return {
-    ...command !== undefined && { command },
-    ...result.status !== undefined && { status: result.status },
-    ...result.failure !== undefined && { failure: result.failure },
-    ...result.spawnFailure?.kind !== undefined && {
-      spawnFailureKind: result.spawnFailure.kind
-    },
-    ...errno !== undefined && { errno }
-  };
-}
-export function describeInstallAttempt(attempt, options = {}) {
-  const reason = attempt?.reason?.slice(0, 200);
-  if (options.installedButRejected) {
-    return {
-      install: "succeeded",
-      installReason: reason ?? "installed binary failed validation"
-    };
-  }
-  if (attempt === undefined)
-    return { install: "not-attempted" };
-  switch (attempt.outcome) {
-    case "succeeded":
-      return { install: "succeeded", ...reason && { installReason: reason } };
-    case "failed":
-      return { install: "failed", ...reason && { installReason: reason } };
-    case "unavailable":
-      return {
-        install: "unavailable",
-        ...reason && { installReason: reason }
-      };
-    default:
-      return {
-        install: "not-attempted",
-        ...reason && { installReason: reason }
-      };
-  }
-}
-export const TRANSIENT_BASE_COOLDOWN_MS = 30000;
-export const TRANSIENT_MAX_COOLDOWN_MS = 300000;
-export const HOST_STALL_COOLDOWN_MS = 5000;
-export const HOST_STALL_EVIDENCE_MS = 500;
-export function isLatchingOutcome(outcome) {
-  return outcome !== "transient";
-}
-export function transientRetryDelayMs(attempts, cause, maxCooldownMs = TRANSIENT_MAX_COOLDOWN_MS) {
-  if (cause === "host-stall")
-    return HOST_STALL_COOLDOWN_MS;
-  const exponent = Math.max(0, attempts - 1);
-  return Math.min(maxCooldownMs, TRANSIENT_BASE_COOLDOWN_MS * 2 ** Math.min(exponent, 10));
-}
-export const INSTALL_TRANSIENT_BASE_COOLDOWN_MS = 300000;
-export const INSTALL_TRANSIENT_COOLDOWNS_MS = [
-  INSTALL_TRANSIENT_BASE_COOLDOWN_MS,
-  INSTALL_TRANSIENT_BASE_COOLDOWN_MS * 2
-];
-export const INSTALL_TRANSIENT_MAX_ATTEMPTS = INSTALL_TRANSIENT_COOLDOWNS_MS.length + 1;
-export function installRetryDelayMs(attempts) {
-  return INSTALL_TRANSIENT_COOLDOWNS_MS[Math.max(0, attempts - 1)] ?? 0;
-}
-let installRetryGeneration = 0;
-export function resetInstallRetryLatches() {
-  installRetryGeneration += 1;
-}
-export function classifyProbeFailure(result, options = {}) {
-  const evidence = describeProbeEvidence(result, options.command);
-  const errorCode = result.error?.code;
-  if (result.spawnFailure?.kind === "tool-not-found") {
-    return { outcome: "missing", cause: "not-found", evidence };
-  }
-  if (result.failure === "timeout" || result.failure === "aborted" || result.failure === "signal" || result.spawnFailure?.kind === "killed" || result.spawnFailure?.kind === "timeout" || errorCode === "EAGAIN" || errorCode === "EBUSY") {
-    const stalled = (options.hostStallMs ?? 0) >= HOST_STALL_EVIDENCE_MS;
-    return {
-      outcome: "transient",
-      cause: stalled ? "host-stall" : "probe-timeout",
-      evidence
-    };
-  }
-  const outcome = options.unclassifiedFailureOutcome ?? "non-installable";
-  return {
-    outcome,
-    cause: outcome === "missing" ? "not-found" : "probe-rejected",
-    evidence
-  };
-}
-export function startHostStallSampler(intervalMs = 100) {
-  let stallMs = 0;
-  let last = Date.now();
-  let stopped = false;
-  const timer = setInterval(() => {
-    const now = Date.now();
-    const lateness = now - last - intervalMs;
-    if (lateness > 0)
-      stallMs += lateness;
-    last = now;
-  }, intervalMs);
-  timer?.unref?.();
-  return {
-    stop: () => {
-      if (stopped)
-        return Math.round(stallMs);
-      stopped = true;
-      clearInterval(timer);
-      const tail = Date.now() - last - intervalMs;
-      if (tail > 0)
-        stallMs += tail;
-      return Math.round(stallMs);
-    }
-  };
-}
-export function createAvailabilityLatch(options = {}) {
-  let available = null;
-  let outcome = null;
-  let cause = null;
-  let retryAtMs = 0;
-  let transientAttempts = 0;
-  let installAttempts = 0;
-  let installExhausted = false;
-  let installRetryAtMs = 0;
-  let provisional = false;
-  const maxCooldownMs = options.maxCooldownMs ?? TRANSIENT_MAX_COOLDOWN_MS;
-  let installGeneration = installRetryGeneration;
-  function clearVerdict() {
-    available = null;
-    outcome = null;
-    cause = null;
-    retryAtMs = 0;
-    transientAttempts = 0;
-    installAttempts = 0;
-    installExhausted = false;
-    installRetryAtMs = 0;
-    provisional = false;
-  }
-  function syncInstallGeneration() {
-    if (installGeneration === installRetryGeneration)
-      return;
-    installGeneration = installRetryGeneration;
-    if (installExhausted) {
-      clearVerdict();
-      return;
-    }
-    installAttempts = 0;
-    installRetryAtMs = 0;
-  }
-  function effectiveRetryAtMs() {
-    return Math.max(retryAtMs, installRetryAtMs);
-  }
-  return {
-    read() {
-      syncInstallGeneration();
-      if (available === true) {
-        if (provisional && Date.now() >= effectiveRetryAtMs())
-          return null;
-        return true;
-      }
-      if (available !== false)
-        return available;
-      if (installExhausted)
-        return false;
-      if (outcome !== "transient")
-        return false;
-      return Date.now() >= effectiveRetryAtMs() ? null : false;
-    },
-    noteAvailable(nextCause = "ok") {
-      installGeneration = installRetryGeneration;
-      available = true;
-      outcome = "success";
-      cause = nextCause;
-      retryAtMs = 0;
-      transientAttempts = 0;
-      installAttempts = 0;
-      installExhausted = false;
-      installRetryAtMs = 0;
-      provisional = false;
-    },
-    noteProvisionallyAvailable(transientCause) {
-      syncInstallGeneration();
-      available = true;
-      outcome = "success";
-      cause = transientCause;
-      provisional = true;
-      installAttempts = 0;
-      installExhausted = false;
-      installRetryAtMs = 0;
-      transientAttempts += 1;
-      const delay = transientRetryDelayMs(transientAttempts, transientCause, maxCooldownMs);
-      retryAtMs = Date.now() + delay;
-      return delay;
-    },
-    noteUnavailable(nextOutcome, nextCause, opts) {
-      syncInstallGeneration();
-      available = false;
-      outcome = nextOutcome;
-      cause = nextCause;
-      provisional = false;
-      if (isLatchingOutcome(nextOutcome)) {
-        retryAtMs = 0;
-        installRetryAtMs = 0;
-        return 0;
-      }
-      if (opts?.operationClass === "install") {
-        installAttempts += 1;
-        const installDelay = installRetryDelayMs(installAttempts);
-        if (installDelay === 0) {
-          installExhausted = true;
-          cause = "install-retry-exhausted";
-          retryAtMs = 0;
-          installRetryAtMs = 0;
-          return 0;
-        }
-        installRetryAtMs = Date.now() + installDelay;
-        return installDelay;
-      }
-      transientAttempts += 1;
-      const delay = transientRetryDelayMs(transientAttempts, nextCause, maxCooldownMs);
-      retryAtMs = Date.now() + delay;
-      return delay;
-    },
-    reset() {
-      installGeneration = installRetryGeneration;
-      clearVerdict();
-    },
-    getOutcome: () => outcome,
-    getCause: () => cause,
-    getRetryAtMs: () => effectiveRetryAtMs(),
-    isProvisional: () => provisional,
-    isInstallExhausted: () => {
-      syncInstallGeneration();
-      return installExhausted;
-    }
-  };
-}
-export function isTransientDecision(decision) {
-  return decision?.outcome === "transient";
-}
-export function describeUnavailability(options) {
-  const { tool, installHint } = options;
-  if (options.outcome !== "transient") {
-    return `${tool} not available. Install with: ${installHint}`;
-  }
-  if (options.cause === "install-retry-exhausted") {
-    return `${tool} install kept timing out and reached its retry ceiling (${INSTALL_TRANSIENT_MAX_ATTEMPTS} attempts). ${tool} is not reported missing — the install is not being retried again this session, and recovers at the next session. To install it now: ${installHint}`;
-  }
-  const elapsed = options.elapsedMs ? ` after ${options.elapsedMs}ms` : "";
-  const stalled = options.cause === "host-stall" ? " (the pi host event loop stalled during the probe window, so the budget expired on the host side)" : "";
-  const retry = options.retryAfterMs ? ` Retrying in ${Math.round(options.retryAfterMs / 1000)}s.` : " It will be retried.";
-  return `${tool} availability probe timed out${elapsed}${stalled}. ${tool} is not reported missing — this is a probe timeout, not a missing install.${retry}`;
-}
-export function logAvailabilityDecision(decision, filePath = "<dm-lens>") {
-  logLatency({
-    type: "phase",
-    phase: "availability_decision",
-    filePath,
-    durationMs: Math.round(decision.elapsedMs),
-    metadata: {
-      tool: decision.tool,
-      ...decision.producer !== undefined && {
-        producer: decision.producer
-      },
-      verdict: decision.verdict,
-      outcome: decision.outcome,
-      cause: decision.cause,
-      latched: decision.latched,
-      ...decision.classifiedBy !== undefined && {
-        classifiedBy: decision.classifiedBy
-      },
-      ...decision.evidence !== undefined && { evidence: decision.evidence },
-      ...decision.hostStallMs !== undefined && {
-        hostStallMs: decision.hostStallMs
-      },
-      ...decision.retryAfterMs !== undefined && {
-        retryAfterMs: decision.retryAfterMs
-      },
-      ...decision.budgetMs !== undefined && { budgetMs: decision.budgetMs },
-      ...decision.provisional === true && { provisional: true },
-      ...decision.unreachablePreferred !== undefined && {
-        unreachablePreferred: decision.unreachablePreferred
-      },
-      ...decision.retained === true && { retained: true },
-      ...decision.servedFromCooldown === true && { servedFromCooldown: true }
-    }
-  });
-}

package/extensions/dm-lens/dist/clients/dispatch/runners/utils/candidate-probe.js

@@ -1,61 +0,0 @@
-import * as fs from "node:fs";
-import { probeToolAsync } from "../../../tool-probe.js";
-import { classifyProbeFailure, startHostStallSampler } from "./availability-policy.js";
-export async function probeAvailabilityCandidates(candidates, probeArgs, timeoutMs) {
-  let sawTransient = false;
-  let transientCause = "probe-timeout";
-  let hostStallMs = 0;
-  let evidence;
-  for (const candidate of candidates) {
-    try {
-      if (candidate.includes("\\") || candidate.includes("/")) {
-        if (fs.existsSync(candidate)) {
-          return {
-            foundPath: candidate,
-            sawTransient,
-            transientCause,
-            hostStallMs,
-            evidence
-          };
-        }
-        continue;
-      }
-      const sampler = startHostStallSampler();
-      let result;
-      let stallMs;
-      try {
-        result = await probeToolAsync(candidate, probeArgs, {
-          timeout: timeoutMs
-        });
-      } finally {
-        stallMs = sampler.stop();
-        hostStallMs += stallMs;
-      }
-      if (!result.error && result.status === 0) {
-        return {
-          foundPath: candidate,
-          sawTransient,
-          transientCause,
-          hostStallMs,
-          evidence
-        };
-      }
-      const classified = classifyProbeFailure(result, {
-        hostStallMs: stallMs,
-        command: candidate
-      });
-      evidence = classified.evidence;
-      if (classified.outcome === "transient") {
-        sawTransient = true;
-        transientCause = classified.cause;
-      }
-    } catch {}
-  }
-  return {
-    foundPath: null,
-    sawTransient,
-    transientCause,
-    hostStallMs,
-    evidence
-  };
-}

package/extensions/dm-lens/dist/clients/dispatch/runners/utils/diagnostic-parsers.js

@@ -1,61 +0,0 @@
-import * as path from "node:path";
-import { pathsEqual } from "../../../path-utils.js";
-import { stripAnsi } from "../../../sanitize.js";
-import { getAutofixCapability } from "../../../tool-policy.js";
-function createLineParser(config) {
-  return (raw, filePath, cwd) => {
-    const diagnostics = [];
-    const absTarget = path.resolve(cwd, filePath);
-    const clean = config.stripAnsi !== false ? stripAnsi(raw) : raw;
-    const lines = clean.split(`
-`).filter((l) => l.trim());
-    for (const line of lines) {
-      const match = line.match(config.regex);
-      if (!match)
-        continue;
-      const reported = match[1];
-      if (reported && !pathsEqual(path.resolve(cwd, reported), absTarget))
-        continue;
-      const lineNum = parseInt(match[2], 10);
-      const colNum = parseInt(match[3], 10);
-      const severity = config.getSeverity ? config.getSeverity(line, match) : "warning";
-      const fixable = typeof config.fixable === "function" ? config.fixable(match) : config.fixable ?? false;
-      const autoFixAvailable = typeof config.autoFixAvailable === "function" ? config.autoFixAvailable(match) : config.autoFixAvailable ?? false;
-      const fixKind = typeof config.fixKind === "function" ? config.fixKind(match) : config.fixKind;
-      diagnostics.push({
-        id: config.generateId(match),
-        message: config.extractMessage(match),
-        filePath,
-        line: lineNum,
-        column: colNum,
-        severity,
-        semantic: severity === "error" ? "blocking" : "warning",
-        tool: config.tool,
-        rule: config.extractRule?.(match),
-        defectClass: config.defectClass,
-        fixable,
-        autoFixAvailable,
-        fixKind
-      });
-    }
-    return diagnostics;
-  };
-}
-const ruffAutofix = getAutofixCapability("ruff");
-export const parseRuffOutput = createLineParser({
-  tool: "ruff",
-  regex: /^(.+?):(\d+):(\d+):\s*(\w+)\s*(.+)/,
-  extractMessage: (m) => `${m[4]}: ${m[5]}`,
-  extractRule: (m) => m[4],
-  generateId: (m) => `ruff-${m[4]}`,
-  fixable: true,
-  autoFixAvailable: ruffAutofix?.safePipelineAutofix ?? false,
-  fixKind: ruffAutofix?.fixKind === "none" ? undefined : ruffAutofix?.fixKind
-});
-export const parseGoVetOutput = createLineParser({
-  tool: "go-vet",
-  regex: /^(.+?):(\d+):(\d+):\s*(.+)/,
-  extractMessage: (m) => m[4],
-  generateId: (m) => `go-vet-${m[2]}`,
-  defectClass: "correctness"
-});

package/extensions/dm-lens/dist/clients/dispatch/runners/utils/lazy-installer.js

@@ -1,130 +0,0 @@
-import { safeSpawnAsync } from "../../../safe-spawn.js";
-import { assertInstallAllowed } from "../../../project-trust.js";
-import { logExtension } from "../../../extension-log.js";
-import { classifyProbeFailure, installRetryDelayMs } from "./availability-policy.js";
-const LAZY_INSTALL_SPECS = {
-  rubocop: { command: "gem", args: ["install", "rubocop", "--no-document"] },
-  "rust-clippy": { command: "rustup", args: ["component", "add", "clippy"] },
-  rustfmt: { command: "rustup", args: ["component", "add", "rustfmt"] }
-};
-const LAZY_INSTALL_IGNORES_AMBIENT_SIGNAL = true;
-const LAZY_INSTALL_TIMEOUT_MS = 180000;
-const attempts = new Map;
-function key(cwd, tool) {
-  return `${cwd}:${tool}`;
-}
-export function getLazyInstallAttempt(tool, cwd) {
-  return attempts.get(key(cwd, tool))?.fact;
-}
-export function resetLazyInstallAttempts() {
-  attempts.clear();
-}
-function suppressionFor(state) {
-  if (!state)
-    return null;
-  if (state.fact.outcome === "succeeded")
-    return "succeeded";
-  if (state.retryAtMs === 0)
-    return "held";
-  return Date.now() < state.retryAtMs ? "cooling" : null;
-}
-const inFlight = new Map;
-async function runLazyInstall(tool, cwd, spec) {
-  const k = key(cwd, tool);
-  const running = inFlight.get(k);
-  if (running)
-    return running;
-  const previous = attempts.get(k);
-  const suppressed = suppressionFor(previous);
-  if (suppressed !== null) {
-    logExtension({
-      subsystem: "install",
-      message: `lazy-install ${tool} suppressed (${suppressed})`,
-      metadata: {
-        tool,
-        cwd,
-        suppressed,
-        outcome: previous?.fact.outcome,
-        ...previous?.fact.reason && { reason: previous.fact.reason },
-        ...suppressed === "cooling" && {
-          retryAfterMs: Math.max(0, (previous?.retryAtMs ?? 0) - Date.now())
-        }
-      }
-    });
-    return false;
-  }
-  const started = performInstall(k, tool, cwd, spec);
-  inFlight.set(k, started);
-  try {
-    return await started;
-  } finally {
-    inFlight.delete(k);
-  }
-}
-async function performInstall(k, tool, cwd, spec) {
-  let result;
-  try {
-    result = await safeSpawnAsync(spec.command, spec.args, {
-      timeout: LAZY_INSTALL_TIMEOUT_MS,
-      cwd,
-      ...LAZY_INSTALL_IGNORES_AMBIENT_SIGNAL && { ignoreAmbientSignal: true }
-    });
-  } catch (err) {
-    result = {
-      stdout: "",
-      stderr: err?.message ?? String(err),
-      status: null,
-      error: err,
-      failure: "spawn"
-    };
-  }
-  if (!result.error && result.status === 0) {
-    attempts.set(k, {
-      fact: { outcome: "succeeded" },
-      retryAtMs: 0,
-      transientAttempts: 0
-    });
-    return true;
-  }
-  const classified = classifyProbeFailure(result, {
-    command: spec.command,
-    unclassifiedFailureOutcome: "transient"
-  });
-  const durable = classified.outcome === "missing";
-  const reason = (result.error?.message ?? result.stderr ?? `exit ${result.status}`).trim().slice(0, 200);
-  const settledPrevious = attempts.get(k);
-  const transientAttempts = durable ? 0 : (settledPrevious?.transientAttempts ?? 0) + 1;
-  const cooldownMs = durable ? 0 : installRetryDelayMs(transientAttempts);
-  const retryAtMs = cooldownMs === 0 ? 0 : Date.now() + cooldownMs;
-  attempts.set(k, {
-    fact: { outcome: "failed", reason },
-    retryAtMs,
-    transientAttempts
-  });
-  logExtension({
-    subsystem: "install",
-    message: `lazy-install ${tool} failed: ${reason}`,
-    metadata: {
-      tool,
-      cwd,
-      command: spec.command,
-      cause: classified.cause,
-      durable,
-      transientAttempts,
-      held: retryAtMs === 0,
-      ...retryAtMs > 0 && { retryAfterMs: retryAtMs - Date.now() },
-      evidence: classified.evidence
-    }
-  });
-  return false;
-}
-export async function tryLazyInstall(tool, cwd) {
-  if (!assertInstallAllowed(`runner lazy install: ${tool}`))
-    return false;
-  return runLazyInstall(tool, cwd, LAZY_INSTALL_SPECS[tool]);
-}
-export async function tryLazyInstallForFormatter(tool, cwd) {
-  if (!assertInstallAllowed(`formatter lazy install: ${tool}`))
-    return false;
-  return runLazyInstall(tool, cwd, LAZY_INSTALL_SPECS[tool]);
-}