@herbertgao/pi-extensions 2026.10.1 → 2026.10.2

package/node_modules/pi-lens/dist/clients/project-diagnostics/runner-adapters/call-graph-impact.js

@@ -1,118 +0,0 @@
-import * as path from "node:path";
-import { parseSymbolKey, } from "../../call-graph.js";
-import { isTestRoleCollateral } from "../../collateral-test-role.js";
-function resolveImpactFile(cwd, filePath) {
-    return path.isAbsolute(filePath) ? filePath : path.resolve(cwd, filePath);
-}
-/**
- * #883 single-source-of-truth: reuses `parseSymbolKey` (`call-graph.ts`)
- * rather than re-implementing symbol-key parsing here. Note this is stricter
- * than `formatImpact`'s inline `.split(":").pop()`: `parseSymbolKey` splits at
- * the LAST colon (drive-letter-safe on Windows) and understands the `file:`
- * module-level fallback shape, neither of which the `formatImpact` shortcut
- * handles — so this is the canonical parser, not merely a shared copy of it.
- */
-function displayName(key) {
-    return parseSymbolKey(key).symbolName ?? key;
-}
-/**
- * Severity mapping (#533 honesty): `impact()`'s BFS depth is a *heuristic*
- * name-resolution signal, not a verified break — it has no type information,
- * so an edited symbol's direct caller ("WillBreak") is NOT guaranteed to
- * actually break; the edit could be behavior-preserving (a doc fix, an
- * internal-only change). Escalating that to `semantic:"blocking"` (this
- * codebase's hard-stop tier — see `widget-state.ts`'s `isBlocking`) would be
- * exactly the over-confident false-block #533 exists to prevent, so NEITHER
- * tier reaches "blocking" here — both are advisory, differentiated only by
- * how strongly the agent should double-check:
- *   - WillBreak (depth 1, direct caller)  → severity "warning" — a real,
- *     resolved cross-file call site into code that just changed; worth an
- *     active nudge to verify the call site still matches.
- *   - MayBreak  (depth 2, one hop removed) → severity "info" — indirect,
- *     softer signal, purely a "you might want to check this" note.
- * `Review` (depth 3+, `impact()`'s own catch-all transitive tier) is
- * deliberately NOT emitted as individual diagnostics: `formatImpact` itself
- * only ever surfaces it as a bare count ("3 Review callers"), never
- * itemized, because at that BFS depth the fan-out is large and the signal is
- * too diluted to attribute to specific callers without drowning the more
- * actionable WillBreak/MayBreak findings.
- */
-function severityFor(severity) {
-    if (severity === "WillBreak") {
-        return {
-            severity: "warning",
-            message: "Direct caller of a symbol edited this turn — verify this call site still matches its new signature/behavior.",
-        };
-    }
-    if (severity === "MayBreak") {
-        return {
-            severity: "info",
-            message: "Indirect caller (one hop) of a symbol edited this turn — worth a quick check.",
-        };
-    }
-    return null;
-}
-/**
- * Maps call-graph impact findings — WillBreak/MayBreak callers of symbols
- * edited this turn (`impact()`, `clients/call-graph.ts`) — into structured
- * `ProjectDiagnostic`s, attributed to the CALLER's file (the thing that might
- * need updating), one per affected caller symbol.
- *
- * No line number is set: `impact()`'s `ImpactResult` carries only a
- * `symbolKey` (file + symbol name), never a line — the underlying call-graph
- * symbol table itself only ever has a placeholder `line: 1` for graph-derived
- * symbols (`review-graph/builder.ts`'s `extractSymbolsAndRefsFromGraph`), so
- * inventing a line here would be a fake `L1`, not a real one. `line` is
- * left `undefined` (honest omission) rather than reporting a location that
- * doesn't correspond to anything real (#533).
- */
-/** Higher rank = surfaced preferentially when the same caller is deduped. */
-const SEVERITY_RANK = {
-    error: 3,
-    warning: 2,
-    info: 1,
-    hint: 0,
-};
-export function callGraphImpactToProjectDiagnostics(cwd, findings) {
-    // Dedupe: the same caller can be reached via more than one edited symbol
-    // in a turn (multiple callees in the same edited file). Keyed by
-    // resolved-file + caller symbolKey, keeping the highest-severity hit.
-    const byKey = new Map();
-    for (const { calleeKey, results } of findings) {
-        const calleeName = displayName(calleeKey);
-        for (const result of results) {
-            const mapped = severityFor(result.severity);
-            if (!mapped)
-                continue; // Review tier — see severityFor's doc comment.
-            const { filePath } = parseSymbolKey(result.symbolKey);
-            if (!filePath)
-                continue; // Nothing real to attribute this to.
-            const resolvedFile = resolveImpactFile(cwd, filePath);
-            // #1080: the call graph is derived from the tests-free review graph and is
-            // normally tests-free, but this adapter accepts arbitrary caller
-            // symbol keys — an old/fixture/expanded graph could supply a test-file
-            // caller. A KNOWN test-role caller must not be persisted as collateral
-            // call-graph impact. Fail-open: a classifier error retains the finding.
-            if (isTestRoleCollateral(resolvedFile))
-                continue;
-            const dedupeKey = `${resolvedFile}:${result.symbolKey}`;
-            const existing = byKey.get(dedupeKey);
-            if (existing &&
-                SEVERITY_RANK[existing.severity] >= SEVERITY_RANK[mapped.severity]) {
-                continue;
-            }
-            const callerName = displayName(result.symbolKey);
-            byKey.set(dedupeKey, {
-                filePath: resolvedFile,
-                severity: mapped.severity,
-                semantic: "warning",
-                tool: "call-graph",
-                runner: "call-graph",
-                rule: `call-graph:${result.severity.toLowerCase()}`,
-                message: `${mapped.message} (${callerName} calls edited symbol '${calleeName}')`,
-                source: "project-scan",
-            });
-        }
-    }
-    return [...byKey.values()];
-}

package/node_modules/pi-lens/dist/clients/project-diagnostics/runner-adapters/dead-code.js

@@ -1,47 +0,0 @@
-import * as path from "node:path";
-function deadCodeRunnerId(language) {
-    return `dead-code-${language}`;
-}
-function deadCodeMessage(issue) {
-    if (issue.category === "unlisted")
-        return `Unlisted dependency ${issue.name}`;
-    if (issue.category === "dependency")
-        return `Unused dependency ${issue.name}`;
-    if (issue.category === "file")
-        return `Unused file ${issue.name}`;
-    return `Unused ${issue.kind} ${issue.name}`;
-}
-/**
- * A dead-code issue (the non-JS/TS analogue of knip — e.g. Python via vulture)
- * at a concrete `file:line`. An *unlisted* dependency is blocking (a real
- * import gap), matching knip; everything else is an advisory warning.
- */
-export function deadCodeIssueToProjectDiagnostic(cwd, issue, language) {
-    const blocking = issue.category === "unlisted";
-    return {
-        filePath: issue.file
-            ? path.isAbsolute(issue.file)
-                ? issue.file
-                : path.resolve(cwd, issue.file)
-            : cwd,
-        line: issue.line,
-        severity: blocking ? "error" : "warning",
-        semantic: blocking ? "blocking" : "warning",
-        tool: "dead-code",
-        runner: deadCodeRunnerId(language),
-        rule: `dead-code:${issue.category}`,
-        message: deadCodeMessage(issue),
-        source: "project-scan",
-    };
-}
-export function deadCodeResultToProjectDiagnostics(cwd, result) {
-    if (!result.success)
-        return [];
-    const issues = [
-        ...result.unusedExports,
-        ...result.unusedFiles,
-        ...result.unusedDeps,
-        ...result.unlistedDeps,
-    ];
-    return issues.map((issue) => deadCodeIssueToProjectDiagnostic(cwd, issue, result.language));
-}

package/node_modules/pi-lens/dist/clients/project-diagnostics/runner-adapters/gitleaks.js

@@ -1,40 +0,0 @@
-import * as path from "node:path";
-/**
- * A gitleaks finding is a leaked secret at a concrete `file:startLine`. Secrets
- * are treated as **blocking** — a committed credential is not a style nit.
- *
- * Findings in scratch trees, gitignored files, and nested repositories are
- * retained for explicit audit but demoted to `severity: "info"` / `semantic:
- * "none"`. They are outside the current repository's shippable source, so they
- * must never read as blocking leaked-secret alarms. Tracked files and ordinary
- * untracked files remain blocking.
- */
-export function gitleaksFindingToProjectDiagnostic(cwd, finding) {
-    // #1562 observability criterion: surface the git status right in the
-    // finding's message so a triage is a read, not a re-derivation. Omitted
-    // when git itself degraded (`pathStatus` undefined) rather than guessed.
-    const statusSuffix = finding.pathStatus
-        ? ` [git: ${finding.pathStatus}]`
-        : "";
-    const isBlocking = finding.pathStatus !== "scratch" &&
-        finding.pathStatus !== "ignored" &&
-        finding.pathStatus !== "nested-repository";
-    return {
-        filePath: path.isAbsolute(finding.file)
-            ? finding.file
-            : path.resolve(cwd, finding.file),
-        line: finding.startLine,
-        severity: isBlocking ? "error" : "info",
-        semantic: isBlocking ? "blocking" : "none",
-        tool: "gitleaks",
-        runner: "gitleaks",
-        rule: `gitleaks:${finding.ruleId}`,
-        message: `Potential secret: ${finding.description || finding.ruleId}${statusSuffix}`,
-        source: "project-scan",
-    };
-}
-export function gitleaksResultToProjectDiagnostics(cwd, result) {
-    if (!result.success || result.findings.length === 0)
-        return [];
-    return result.findings.map((finding) => gitleaksFindingToProjectDiagnostic(cwd, finding));
-}

package/node_modules/pi-lens/dist/clients/project-diagnostics/runner-adapters/govulncheck.js

@@ -1,34 +0,0 @@
-import * as path from "node:path";
-/**
- * A govulncheck finding is a vulnerable dependency *reachable* from the code via
- * a call trace. Anchor the diagnostic at the first trace frame that has a source
- * position (the reachable call site in the project), falling back to the project
- * root when the trace carries no file. Advisory (warning) — a reachable CVE is
- * worth surfacing but is not a code-blocking error.
- */
-export function govulncheckFindingToProjectDiagnostic(cwd, finding) {
-    const frame = finding.trace?.find((f) => f.filename);
-    const filePath = frame?.filename
-        ? path.isAbsolute(frame.filename)
-            ? frame.filename
-            : path.resolve(cwd, frame.filename)
-        : cwd;
-    const fix = finding.fixedVersion ? ` (fixed in ${finding.fixedVersion})` : "";
-    return {
-        filePath,
-        line: frame?.line,
-        severity: "warning",
-        semantic: "warning",
-        tool: "govulncheck",
-        runner: "govulncheck",
-        rule: `govulncheck:${finding.osv}`,
-        code: finding.packageName ?? finding.module,
-        message: `Vulnerability ${finding.osv}: ${finding.summary ?? "reachable vulnerable dependency"}${fix}`,
-        source: "project-scan",
-    };
-}
-export function govulncheckResultToProjectDiagnostics(cwd, result) {
-    if (!result.success || result.findings.length === 0)
-        return [];
-    return result.findings.map((finding) => govulncheckFindingToProjectDiagnostic(cwd, finding));
-}

package/node_modules/pi-lens/dist/clients/project-diagnostics/runner-adapters/jscpd.js

@@ -1,38 +0,0 @@
-import * as path from "node:path";
-function resolveClonePath(cwd, file) {
-    return path.isAbsolute(file) ? file : path.resolve(cwd, file);
-}
-/**
- * A jscpd clone is a *relationship* between two spans (`fileA:startA` ↔
- * `fileB:startB`), unlike a single-point knip finding. Emit a diagnostic on
- * BOTH ends so the duplication surfaces on whichever file the agent is looking
- * at, each one naming the other end.
- */
-function jscpdCloneToProjectDiagnostics(cwd, clone) {
-    const a = resolveClonePath(cwd, clone.fileA);
-    const b = resolveClonePath(cwd, clone.fileB);
-    const make = (filePath, line, otherFile, otherLine) => ({
-        filePath,
-        line,
-        severity: "warning",
-        semantic: "warning",
-        tool: "jscpd",
-        runner: "jscpd",
-        rule: "jscpd:duplicate",
-        message: `Duplicate code (${clone.lines} lines) — also at ${path.relative(cwd, otherFile)}:${otherLine}`,
-        source: "project-scan",
-    });
-    return [
-        make(a, clone.startA, b, clone.startB),
-        make(b, clone.startB, a, clone.startA),
-    ];
-}
-/**
- * Map a whole jscpd scan into per-file `ProjectDiagnostic`s (two per clone).
- * Empty when the scan failed or found no duplication.
- */
-export function jscpdResultToProjectDiagnostics(cwd, result) {
-    if (!result.success || result.clones.length === 0)
-        return [];
-    return result.clones.flatMap((clone) => jscpdCloneToProjectDiagnostics(cwd, clone));
-}

package/node_modules/pi-lens/dist/clients/project-diagnostics/runner-adapters/knip.js

@@ -1,47 +0,0 @@
-import * as path from "node:path";
-function knipIssueFile(cwd, issue) {
-    if (!issue.file)
-        return cwd;
-    return path.isAbsolute(issue.file)
-        ? issue.file
-        : path.resolve(cwd, issue.file);
-}
-function knipIssueMessage(issue) {
-    if (issue.type === "unlisted") {
-        return `Unlisted dependency ${issue.name}`;
-    }
-    if (issue.type === "bin") {
-        return `Unlisted binary ${issue.name}`;
-    }
-    if (issue.type === "export") {
-        return `Unused export ${issue.name}`;
-    }
-    if (issue.type === "enumMember") {
-        return `Unused enum member ${issue.name}`;
-    }
-    if (issue.type === "file") {
-        return `Unused file ${issue.name}`;
-    }
-    if (issue.type === "dependency" || issue.type === "devDependency") {
-        return `Unused ${issue.type} ${issue.name}`;
-    }
-    return `${issue.type}: ${issue.name}`;
-}
-function knipIssueToProjectDiagnostic(cwd, issue) {
-    const blocking = issue.type === "unlisted" || issue.type === "bin";
-    return {
-        filePath: knipIssueFile(cwd, issue),
-        line: issue.line,
-        severity: blocking ? "error" : "warning",
-        semantic: blocking ? "blocking" : "warning",
-        tool: "knip",
-        runner: "knip",
-        rule: `knip:${issue.type}`,
-        code: issue.package,
-        message: knipIssueMessage(issue),
-        source: "project-scan",
-    };
-}
-export function knipIssuesToProjectDiagnostics(cwd, issues) {
-    return issues.map((issue) => knipIssueToProjectDiagnostic(cwd, issue));
-}

package/node_modules/pi-lens/dist/clients/project-diagnostics/runner-adapters/madge.js

@@ -1,48 +0,0 @@
-import * as path from "node:path";
-import { compareOrdinal } from "../../string-utils.js";
-function resolveCyclePath(cwd, file) {
-    return path.isAbsolute(file) ? file : path.resolve(cwd, file);
-}
-/** The files making up a cycle: prefer the full `path`, fall back to `file`. */
-function cycleMembers(dep) {
-    return dep.path.length > 0 ? dep.path : [dep.file];
-}
-/**
- * A madge circular dependency is a *set* of files (`a → b → c → a`), unlike a
- * single-point knip finding. Emit a diagnostic on EACH file in the cycle so it
- * surfaces wherever the agent is looking, each one rendering the whole cycle.
- */
-function circularDepToProjectDiagnostics(cwd, dep) {
-    const members = cycleMembers(dep);
-    const rendered = `${members.map((f) => path.basename(f)).join(" → ")} → ${path.basename(members[0] ?? "")}`;
-    return members.map((file) => ({
-        filePath: resolveCyclePath(cwd, file),
-        severity: "warning",
-        semantic: "warning",
-        tool: "madge",
-        runner: "madge",
-        rule: "madge:circular",
-        message: `Part of circular dependency: ${rendered}`,
-        source: "project-scan",
-    }));
-}
-/**
- * Map madge's circular-dependency findings into per-file `ProjectDiagnostic`s.
- * Deduplicates cycles reported from different anchor files (same member set), so
- * a cycle is emitted once per participating file, not once per anchor.
- */
-export function circularDepsToProjectDiagnostics(cwd, circular) {
-    const seen = new Set();
-    const out = [];
-    for (const dep of circular) {
-        const key = cycleMembers(dep)
-            .map((f) => resolveCyclePath(cwd, f))
-            .sort(compareOrdinal)
-            .join("|");
-        if (seen.has(key))
-            continue;
-        seen.add(key);
-        out.push(...circularDepToProjectDiagnostics(cwd, dep));
-    }
-    return out;
-}

package/node_modules/pi-lens/dist/clients/project-diagnostics/runner-adapters/opengrep.js

@@ -1,40 +0,0 @@
-import * as path from "node:path";
-/**
- * opengrep's `extra.severity` is semgrep-compatible: `ERROR` / `WARNING` /
- * `INFO` (verified against the real installed 1.25.0 binary's `--json`
- * output). `ERROR` is treated as blocking — the same convention gitleaks
- * secrets and knip's "unlisted dependency" findings use.
- */
-function severityFor(raw) {
-    switch (raw.toUpperCase()) {
-        case "ERROR":
-            return { severity: "error", blocking: true };
-        case "INFO":
-            return { severity: "info", blocking: false };
-        default:
-            return { severity: "warning", blocking: false };
-    }
-}
-function opengrepFindingToProjectDiagnostic(cwd, finding) {
-    const { severity, blocking } = severityFor(finding.severity);
-    const cweSuffix = finding.cwe?.length ? ` (${finding.cwe[0]})` : "";
-    return {
-        filePath: path.isAbsolute(finding.path)
-            ? finding.path
-            : path.resolve(cwd, finding.path),
-        line: finding.startLine,
-        column: finding.startCol,
-        severity,
-        semantic: blocking ? "blocking" : "warning",
-        tool: "opengrep",
-        runner: "opengrep",
-        rule: `opengrep:${finding.checkId}`,
-        message: `${finding.message}${cweSuffix}`,
-        source: "project-scan",
-    };
-}
-export function opengrepResultToProjectDiagnostics(cwd, result) {
-    if (!result.success || result.findings.length === 0)
-        return [];
-    return result.findings.map((finding) => opengrepFindingToProjectDiagnostic(cwd, finding));
-}

package/node_modules/pi-lens/dist/clients/project-diagnostics/runner-adapters/runner-findings.js

@@ -1,127 +0,0 @@
-import { isRunnerErrorResult, } from "../../test-runner-client.js";
-import * as fs from "node:fs";
-import * as path from "node:path";
-import { advisoryPathKey, validateAdvisoryProvenance, } from "../../advisory-provenance.js";
-function failureMessage(failure) {
-    const firstLine = failure.message.split("\n")[0]?.slice(0, 300) ?? "";
-    return firstLine ? `${failure.name}: ${firstLine}` : failure.name;
-}
-/**
- * `TestFailure.location` (`test-runner-client.ts`) is a free-form string that
- * varies by parser: the vitest/jest JSON parser emits a real `"relPath:line"`
- * (line only — its own `test.location.column` is dropped before it reaches
- * this string, so column is never available from that source either), while
- * the pytest text parser abuses the same field for `"file:testName"` (no
- * digits) and the mix/ExUnit parser puts a bare module name in it (no colon
- * at all). Only pull a `line`/`column` out when the trailing segment(s) are
- * actually numeric, so pytest/mix locations are left alone (no line, same as
- * before this change) instead of misparsing part of a name as a line number.
- */
-const LOCATION_LINE_COL_RE = /:(\d+)(?::(\d+))?$/;
-function parseLocation(location) {
-    if (!location)
-        return {};
-    const match = LOCATION_LINE_COL_RE.exec(location);
-    if (!match)
-        return {};
-    return {
-        line: Number.parseInt(match[1], 10),
-        ...(match[2] ? { column: Number.parseInt(match[2], 10) } : {}),
-    };
-}
-/**
- * One diagnostic per test failure, attributed to the test file that reported
- * it (not the source file the agent edited — that's `sourceFile` on
- * `TestResult`, but the failure itself lives in the test file). A result with
- * no individual failures listed (a parser that couldn't extract them, or a
- * runner error) still gets one diagnostic so the file isn't silently blank.
- *
- * `stale` (from the cache's own `stale` flag, set at turn_end when the turn
- * advanced before the test run finished — `runtime-turn.ts`) is surfaced as a
- * message prefix, mirroring the one-shot turn-context-injection message's own
- * stale wording (`consumeTestFindings`'s cached `content`) — a mode=full
- * caller deserves the same "this may already be superseded" honesty the
- * per-edit path already gives.
- */
-function testResultToProjectDiagnostics(result, stale = false) {
-    if (result.failed === 0 && !result.error)
-        return [];
-    const stalePrefix = stale ? "[stale — from a prior turn] " : "";
-    if (result.failures.length > 0) {
-        return result.failures.map((failure) => ({
-            filePath: result.file,
-            ...parseLocation(failure.location),
-            severity: "error",
-            semantic: "blocking",
-            tool: "test-runner",
-            runner: result.runner,
-            rule: `test:${result.runner}`,
-            message: `${stalePrefix}${failureMessage(failure)}`,
-            source: "project-scan",
-        }));
-    }
-    // #2532: a RUNNER error (timeout, missing provider/binary, a config
-    // failure — the suite itself never produced a verdict) is not a finding
-    // the agent introduced, exactly like the turn-end delivery framing
-    // (#2522) already treats it. `isRunnerErrorResult` is the single seam
-    // both surfaces read so the identical `TestResult` cannot classify
-    // differently here than it does in the turn-end message.
-    if (isRunnerErrorResult(result)) {
-        return [
-            {
-                filePath: result.file,
-                severity: "info",
-                semantic: "none",
-                tool: "test-runner",
-                runner: result.runner,
-                rule: `test:${result.runner}`,
-                message: `${stalePrefix}Test run error: ${result.error}`,
-                source: "project-scan",
-            },
-        ];
-    }
-    // #2532 review S3: a counted failure stays blocking even when `error` is
-    // ALSO set (pytest exit 2 "Interrupted" after `2 failed, 1 passed` — see
-    // `isRunnerErrorResult`'s doc). The pre-fix message mentioned `error`
-    // here via a ternary this PR's first version dropped; restored so the
-    // interruption is not silently lost from a still-blocking finding.
-    return [
-        {
-            filePath: result.file,
-            severity: "error",
-            semantic: "blocking",
-            tool: "test-runner",
-            runner: result.runner,
-            rule: `test:${result.runner}`,
-            message: `${stalePrefix}${result.failed} test(s) failed${result.error ? ` (runner also reported: ${result.error})` : ""}`,
-            source: "project-scan",
-        },
-    ];
-}
-export function testRunnerFindingsToProjectDiagnostics(cache, cwd, runtime) {
-    if (!cache.results || cache.results.length === 0)
-        return [];
-    const validation = cwd
-        ? validateAdvisoryProvenance(cache, cwd, runtime)
-        : { status: "unknown", reasons: ["validation-context-missing"] };
-    const root = cwd ?? process.cwd();
-    const missingKeys = new Set((cache.provenance?.files ?? [])
-        .filter((file) => !fs.existsSync(path.resolve(root, file.path)))
-        .map((file) => advisoryPathKey(file.path, root)));
-    const historical = cache.superseded === true ||
-        cache.stale === true ||
-        validation.status !== "current";
-    return cache.results
-        .filter((result) => !missingKeys.has(advisoryPathKey(result.file, root)))
-        .flatMap((result) => testResultToProjectDiagnostics(result, historical))
-        .map((diagnostic) => historical
-        ? {
-            ...diagnostic,
-            severity: "info",
-            semantic: "none",
-            message: diagnostic.message.startsWith("[stale")
-                ? diagnostic.message
-                : `[historical — re-run to confirm] ${diagnostic.message}`,
-        }
-        : diagnostic);
-}

package/node_modules/pi-lens/dist/clients/project-diagnostics/runner-adapters/trivy.js

@@ -1,81 +0,0 @@
-import * as path from "node:path";
-/**
- * A trivy finding is a CVE in a dependency — a *dependency-level* finding, not a
- * source location. Anchor it at the manifest/lockfile it was found in (`target`),
- * with no line. Advisory (warning); the CVE severity is carried in the message.
- */
-export function trivyFindingToProjectDiagnostic(cwd, finding) {
-    const filePath = finding.target
-        ? path.isAbsolute(finding.target)
-            ? finding.target
-            : path.resolve(cwd, finding.target)
-        : cwd;
-    const version = finding.installedVersion
-        ? `@${finding.installedVersion}`
-        : "";
-    const fix = finding.fixedVersion ? ` (fixed in ${finding.fixedVersion})` : "";
-    return {
-        filePath,
-        severity: "warning",
-        semantic: "warning",
-        tool: "trivy",
-        runner: "trivy",
-        rule: `trivy:${finding.vulnerabilityId}`,
-        code: finding.pkgName,
-        message: `${finding.severity} vulnerability ${finding.vulnerabilityId} in ${finding.pkgName}${version}${fix}`,
-        source: "project-scan",
-    };
-}
-/**
- * A trivy *secret* finding (`TrivyResult.secrets`) is a leaked credential at a
- * concrete `file:line` — the trivy-scanned sibling of
- * `gitleaksFindingToProjectDiagnostic`, and treated the same way: **blocking**,
- * since a committed credential is not a style nit.
- *
- * Rule id is namespaced `trivy-secret:<ruleId>`, deliberately distinct from the
- * CVE lane's `trivy:<vulnerabilityId>` (#1628) — trivy's own rule-id spaces for
- * secrets and CVEs are independent, so without this prefix a secret rule id
- * could collide with a vulnerability id and silently share (or steal) that
- * finding's disposition anchor.
- */
-export function trivySecretFindingToProjectDiagnostic(cwd, finding) {
-    return {
-        filePath: path.isAbsolute(finding.file)
-            ? finding.file
-            : path.resolve(cwd, finding.file),
-        line: finding.line,
-        severity: "error",
-        semantic: "blocking",
-        tool: "trivy",
-        runner: "trivy",
-        rule: `trivy-secret:${finding.ruleId}`,
-        message: `Potential secret: ${finding.title || finding.ruleId}`,
-        source: "project-scan",
-    };
-}
-function trivySecretsToProjectDiagnostics(cwd, secrets) {
-    return secrets.map((finding) => trivySecretFindingToProjectDiagnostic(cwd, finding));
-}
-/**
- * Adapts BOTH of trivy's finding kinds from one scan pass — CVEs (`findings`)
- * and secrets (`secrets`, #1628) — into the single `ProjectDiagnostic[]`
- * `lens_diagnostics mode=full` surfaces. Before #1628, `secrets` was silently
- * unread here: a trivy-only secret (no gitleaks/ast-grep corroboration) had no
- * `lens_diagnostics`-visible identity at all for an agent to anchor a mark
- * against, even though `runtime-turn.ts`'s turn_end gate already blocked on it.
- */
-export function trivyResultToProjectDiagnostics(cwd, result) {
-    if (!result.success)
-        return [];
-    return [
-        ...(result.findings ?? []).map((finding) => trivyFindingToProjectDiagnostic(cwd, finding)),
-        // `secrets` defaults to `[]` here rather than assuming the field is
-        // always present: `fetchFreshProjectDiagnostics` swallows a task
-        // rejection into a silent "completed" outcome (its
-        // `.catch(() => "completed")`), so an unguarded `.map` on a missing
-        // field here would drop this lane's CVE diagnostics too, not just the
-        // secrets — a caller-visible regression for a field this adapter
-        // doesn't itself require.
-        ...trivySecretsToProjectDiagnostics(cwd, result.secrets ?? []),
-    ];
-}