@herbertgao/pi-extensions 2026.10.1 → 2026.10.3

package/node_modules/pi-lens/dist/chunk-D65GOCJB.js

@@ -0,0 +1,289 @@
+import { createRequire as __pilensCreateRequire } from "node:module"; const require = __pilensCreateRequire(import.meta.url);
+import {
+  getScratchTreeDirNames
+} from "./chunk-J3FZR3YY.js";
+import {
+  SecurityScanClient
+} from "./chunk-5JHXUETW.js";
+import "./chunk-IMSQR4WO.js";
+import {
+  resolveOpengrepConfig
+} from "./chunk-U52SAGRM.js";
+import "./chunk-CMU4RMJB.js";
+import "./chunk-O7HZX7CA.js";
+import {
+  safeSpawnAsync
+} from "./chunk-T54VJRAD.js";
+import "./chunk-BW5KFIQC.js";
+import "./chunk-N2IRDBZI.js";
+import "./chunk-Z6BB4JLQ.js";
+import "./chunk-2EECBNC5.js";
+import {
+  recordDegradationOnce
+} from "./chunk-7ELY2CSM.js";
+import "./chunk-34OCDWOS.js";
+import "./chunk-3PNFWVHT.js";
+import "./chunk-VSMJK3ZJ.js";
+import "./chunk-LJDODBBZ.js";
+import "./chunk-ABBOA7UD.js";
+import {
+  realpathOrResolve
+} from "./chunk-G3RLJYA2.js";
+import "./chunk-NXL4FFQQ.js";
+
+// dist/clients/opengrep-client.js
+import * as fs from "node:fs";
+import * as os from "node:os";
+import * as path from "node:path";
+import { mkdtempSync } from "node:fs";
+var EMPTY_RESULT = {
+  success: false,
+  findings: []
+};
+var SCAN_TIMEOUT_MS = 18e4;
+var OpengrepClient = class _OpengrepClient extends SecurityScanClient {
+  constructor(verbose = false) {
+    super("opengrep", verbose);
+  }
+  /**
+   * Structurally always-on (mirrors `opengrepInitialization` in
+   * `clients/lsp/server.ts`) — `resolveOpengrepConfig(cwd, { enabled: true })`
+   * only resolves WHICH rules to run, not whether opengrep runs at all.
+   * Exported as a static so callers can gate/log without constructing.
+   */
+  static resolveConfig(cwd) {
+    return resolveOpengrepConfig(cwd, { enabled: true });
+  }
+  /**
+   * opengrep's top-level `--version` (no `scan` subcommand) — matches the
+   * installer's `checkArgs: ["--version"]` entry (`installer/index.ts`).
+   */
+  doEnsureAvailable() {
+    return this.ensureViaInstaller(["--version"]);
+  }
+  /**
+   * Scan a directory tree with opengrep's rule set (local config or `auto`).
+   * Re-entrancy safe: concurrent calls against the same root share a single
+   * opengrep process (mirrors `GitleaksClient`/`JscpdClient`).
+   */
+  async scan(cwd) {
+    const targetDir = realpathOrResolve(cwd);
+    const scannedAt = (/* @__PURE__ */ new Date()).toISOString();
+    if (!await this.ensureAvailable()) {
+      return {
+        ...EMPTY_RESULT,
+        scannedAt,
+        reason: "not-installed",
+        summary: "opengrep not installed"
+      };
+    }
+    return this.dedupeScan(targetDir, () => this.runScan(targetDir));
+  }
+  async runScan(cwd) {
+    const scannedAt = (/* @__PURE__ */ new Date()).toISOString();
+    const bin = this.binaryPath ?? "opengrep";
+    const resolved = _OpengrepClient.resolveConfig(cwd);
+    const outDir = mkdtempSync(path.join(os.tmpdir(), "pi-lens-opengrep-"));
+    const reportPath = path.join(outDir, "opengrep-report.json");
+    try {
+      const result = await safeSpawnAsync(bin, [
+        "scan",
+        "--config",
+        resolved.configArg ?? "auto",
+        "--json",
+        "--json-output",
+        reportPath,
+        // Never fail the scan on findings — this is a read, not a gate
+        // (matches gitleaks's `--exit-code 0` intent).
+        "--no-error",
+        "--quiet",
+        "--disable-version-check",
+        // #1562 class fix: opengrep's own `.gitignore` respect covers the
+        // common case (scratch trees are usually gitignored), but not a
+        // scratch/cache tree that ISN'T (e.g. an un-gitignored worktree
+        // cache) — `--exclude` is semgrep-compatible, so a slash-free
+        // pattern matches that directory name anywhere in the tree,
+        // independent of gitignore. Same `EXCLUDED_DIRS`-derived list
+        // gitleaks/trivy use, so the three scanners can't drift apart.
+        // Opengrep's git-mode walk already omits nested linked checkouts.
+        // Do not turn each registration into a wcmatch pattern: hundreds of
+        // patterns make the matcher quadratic and can hit its pattern limit.
+        ...getScratchTreeDirNames().flatMap((pattern) => [
+          "--exclude",
+          pattern
+        ]),
+        cwd
+      ], { cwd, timeout: SCAN_TIMEOUT_MS });
+      if (result.error) {
+        this.log(`Scan error: ${result.error.message}`);
+        const reason = `${result.failure ?? "spawn-failed"}: ${result.error.message}`;
+        this.recordRefusal(cwd, reason, result.status);
+        return {
+          ...EMPTY_RESULT,
+          scannedAt,
+          reason: "spawn-failed",
+          summary: reason.slice(0, 200)
+        };
+      }
+      if (!fs.existsSync(reportPath)) {
+        const reason = (result.stderr ?? "").trim().split("\n")[0] || "no report produced";
+        this.recordRefusal(cwd, reason, result.status);
+        return {
+          ...EMPTY_RESULT,
+          scannedAt,
+          reason: "no-report",
+          summary: reason
+        };
+      }
+      const raw = fs.readFileSync(reportPath, "utf-8");
+      const report = readOpengrepReport(raw);
+      if (report.verdict === "refused" || result.status !== 0) {
+        const reason = report.verdict === "refused" ? report.reason : `opengrep exited with status ${result.status}`;
+        this.recordRefusal(cwd, reason, result.status);
+        return {
+          ...EMPTY_RESULT,
+          scannedAt,
+          reason: "refused",
+          summary: reason.slice(0, 200)
+        };
+      }
+      if (report.partial) {
+        recordDegradationOnce({
+          kind: "opengrep-partial-scan",
+          subject: cwd,
+          reason: report.partial.reason,
+          metadata: { status: result.status }
+        });
+      }
+      return {
+        success: true,
+        // A warning-level partial report with no scanned paths proves that
+        // the producer went cold. A complete empty report still proves a
+        // genuine scan, so it is still "analysed" for the render layer's
+        // analysed-and-found-nothing state (#2970) — but it carries no
+        // FILE-level authority, which `analyzedFiles: []` below is what
+        // says.
+        analyzed: !report.partial || report.scanned.length > 0,
+        // #2962: the set is ALWAYS carried, empty included. "This producer
+        // declared its coverage and it was zero files" and "this producer
+        // declares no coverage at all" are different facts; dropping the
+        // empty array collapses them into the second, and the second is
+        // what hands a zero-file scan whole-root retirement authority
+        // downstream (`runnerRetirementDecision`, tools/lens-diagnostics.ts).
+        analyzedFiles: report.scanned.map((file) => realpathOrResolve(path.resolve(cwd, file))),
+        ...report.partial ? { partial: true } : {},
+        ...report.partial ? { summary: report.partial.reason } : {},
+        ...report.partial && report.scanned.length === 0 ? { reason: "partial-no-paths" } : {},
+        findings: report.findings,
+        scannedAt
+      };
+    } catch (err) {
+      const reason = err instanceof Error ? err.message : String(err);
+      this.recordRefusal(cwd, reason, void 0);
+      return {
+        ...EMPTY_RESULT,
+        scannedAt,
+        reason: "crashed",
+        summary: reason.slice(0, 200)
+      };
+    } finally {
+      try {
+        fs.rmSync(outDir, { recursive: true, force: true });
+      } catch {
+      }
+    }
+  }
+  recordRefusal(cwd, reason, status) {
+    recordDegradationOnce({
+      kind: "opengrep-scan-refused",
+      subject: cwd,
+      reason,
+      metadata: { status }
+    });
+  }
+};
+function readOpengrepReport(raw) {
+  let parsed;
+  try {
+    parsed = JSON.parse(raw);
+  } catch {
+    return { verdict: "refused", reason: "unparseable opengrep report" };
+  }
+  if (!parsed || typeof parsed !== "object")
+    return { verdict: "refused", reason: "unparseable opengrep report" };
+  const report = parsed;
+  if (!Array.isArray(report.results) && !Array.isArray(report.errors))
+    return { verdict: "refused", reason: "unparseable opengrep report" };
+  const errors = (Array.isArray(report.errors) ? report.errors : []).map((error) => {
+    if (typeof error === "string")
+      return { message: error };
+    if (!error || typeof error !== "object")
+      return { message: "unrecognised opengrep error entry" };
+    const entry = error;
+    const level = typeof entry.level === "string" ? entry.level : void 0;
+    const message = typeof entry.message === "string" ? entry.message : void 0;
+    return {
+      ...level ? { level } : {},
+      message: message ?? level ?? "unrecognised opengrep error entry"
+    };
+  });
+  const refusal = errors.find((error) => error.level !== "warn");
+  if (refusal)
+    return { verdict: "refused", reason: refusal.message };
+  const scanned = Array.isArray(report.paths?.scanned) ? report.paths.scanned.filter((file) => typeof file === "string") : [];
+  return {
+    verdict: "usable",
+    ...errors[0] ? { partial: { reason: errors[0].message } } : {},
+    findings: parseOpengrepReport(parsed),
+    scanned
+  };
+}
+function parseOpengrepReport(rawOrParsed) {
+  if (typeof rawOrParsed === "string" && !rawOrParsed.trim())
+    return [];
+  let parsed = rawOrParsed;
+  if (typeof rawOrParsed === "string") {
+    try {
+      parsed = JSON.parse(rawOrParsed);
+    } catch {
+      return [];
+    }
+  }
+  if (!parsed || typeof parsed !== "object")
+    return [];
+  const results = parsed.results;
+  if (!Array.isArray(results))
+    return [];
+  const findings = [];
+  for (const entry of results) {
+    if (!entry || typeof entry !== "object")
+      continue;
+    const e = entry;
+    const checkId = typeof e.check_id === "string" ? e.check_id : void 0;
+    const filePath = typeof e.path === "string" ? e.path : void 0;
+    const start = e.start;
+    const end = e.end;
+    const startLine = typeof start?.line === "number" ? start.line : void 0;
+    if (!checkId || !filePath || !Number.isFinite(startLine))
+      continue;
+    const extra = e.extra ?? {};
+    const metadata = extra.metadata ?? {};
+    const cwe = Array.isArray(metadata.cwe) ? metadata.cwe.filter((c) => typeof c === "string") : void 0;
+    findings.push({
+      checkId,
+      path: filePath,
+      startLine,
+      startCol: typeof start?.col === "number" ? start.col : 1,
+      endLine: typeof end?.line === "number" ? end.line : startLine,
+      endCol: typeof end?.col === "number" ? end.col : 1,
+      message: typeof extra.message === "string" ? extra.message : "opengrep finding",
+      severity: typeof extra.severity === "string" ? extra.severity : "WARNING",
+      cwe
+    });
+  }
+  return findings;
+}
+export {
+  OpengrepClient,
+  parseOpengrepReport
+};

package/node_modules/pi-lens/dist/chunk-D6YF5HKX.js

@@ -0,0 +1,59 @@
+import { createRequire as __pilensCreateRequire } from "node:module"; const require = __pilensCreateRequire(import.meta.url);
+import {
+  recordDegradation
+} from "./chunk-7ELY2CSM.js";
+import {
+  logExtension
+} from "./chunk-34OCDWOS.js";
+
+// dist/clients/project-trust.js
+var trustState = "unknown";
+var installRefusalWarnings = /* @__PURE__ */ new Set();
+var INSTALL_REFUSAL_WARNING_CAP = 200;
+var trustGeneration = 0;
+function getProjectTrustGeneration() {
+  return trustGeneration;
+}
+function getProjectTrustState() {
+  return trustState;
+}
+function isToolInstallAllowedByTrust() {
+  return trustState !== "untrusted";
+}
+function assertInstallAllowed(context) {
+  if (isToolInstallAllowedByTrust())
+    return true;
+  recordDegradation({
+    kind: "trust-refusal",
+    subject: context,
+    reason: projectTrustDenialReason() ?? "project trust denied"
+  });
+  if (!installRefusalWarnings.has(context)) {
+    if (installRefusalWarnings.size >= INSTALL_REFUSAL_WARNING_CAP) {
+      installRefusalWarnings.clear();
+    }
+    installRefusalWarnings.add(context);
+    logExtension({
+      subsystem: "project-trust",
+      level: "warn",
+      message: `install/materialization blocked: ${context}`,
+      metadata: { context, trustState }
+    });
+  }
+  return false;
+}
+function isLspSpawnAllowedByTrust() {
+  return trustState !== "untrusted";
+}
+function projectTrustDenialReason() {
+  return trustState === "untrusted" ? "project is not trusted (host isProjectTrusted() === false)" : void 0;
+}
+
+export {
+  getProjectTrustGeneration,
+  getProjectTrustState,
+  isToolInstallAllowedByTrust,
+  assertInstallAllowed,
+  isLspSpawnAllowedByTrust,
+  projectTrustDenialReason
+};

package/node_modules/pi-lens/dist/chunk-DMS52BEP.js

@@ -0,0 +1,342 @@
+import { createRequire as __pilensCreateRequire } from "node:module"; const require = __pilensCreateRequire(import.meta.url);
+import {
+  getSecretsLaneAllowlistPaths,
+  isUnderSecretsLaneScratchTree,
+  nestedWorktreeOffsets
+} from "./chunk-J3FZR3YY.js";
+import {
+  SecurityScanClient
+} from "./chunk-5JHXUETW.js";
+import {
+  collectTrackedFiles,
+  collectUntrackedIgnoredIds,
+  safeSpawnAsync
+} from "./chunk-T54VJRAD.js";
+import {
+  escapeRegExp
+} from "./chunk-7ELY2CSM.js";
+import {
+  normalizeEphemeralMapKey,
+  normalizeMapKey
+} from "./chunk-G3RLJYA2.js";
+
+// dist/clients/gitleaks-client.js
+import * as fs from "node:fs";
+import * as os from "node:os";
+import * as path from "node:path";
+import { mkdtempSync } from "node:fs";
+var EMPTY_RESULT = {
+  success: false,
+  findings: []
+};
+var SCAN_TIMEOUT_MS = 12e4;
+var LOCAL_GITLEAKS_CONFIG_NAMES = [
+  ".gitleaks.toml",
+  ".gitleaks.yaml",
+  ".gitleaks.yml"
+];
+function findLocalGitleaksConfig(cwd) {
+  for (const name of LOCAL_GITLEAKS_CONFIG_NAMES) {
+    const candidate = path.join(cwd, name);
+    try {
+      if (fs.existsSync(candidate))
+        return candidate;
+    } catch {
+    }
+  }
+  return void 0;
+}
+var PLACEHOLDER_SECRET_REGEXES = [
+  String.raw`(?i)^(your|my|insert|replace|enter|add)[-_ ]?(the[-_ ]?)?(api[-_ ]?)?(key|token|secret|password|credential)s?$`,
+  String.raw`(?i)^<[^<>]*(api[-_ ]?key|token|secret|password|credential|key)[^<>]*>$`,
+  String.raw`(?i)^x{3,}$`,
+  String.raw`(?i)^(changeme|change[-_]me|example|placeholder|dummy|fake|redacted|xxxxxxxx)$`
+];
+function worktreeAllowlistPath(worktree) {
+  const segments = worktree.split(/[/\\]/).map(escapeRegExp);
+  return `^${segments.join("[/\\\\]")}(?:[/\\\\].*)?$`;
+}
+function writeScopedGitleaksConfig(outDir, cwd) {
+  const localConfig = findLocalGitleaksConfig(cwd);
+  const extendLine = localConfig ? `path = ${JSON.stringify(localConfig)}` : "useDefault = true";
+  const pathPatterns = [
+    ...getSecretsLaneAllowlistPaths(),
+    ...nestedWorktreeOffsets(cwd).map((offset) => worktreeAllowlistPath(path.join(cwd, offset)))
+  ].map((p) => `    ${JSON.stringify(p)},`).join("\n");
+  const regexPatterns = PLACEHOLDER_SECRET_REGEXES.map((r) => `    ${JSON.stringify(r)},`).join("\n");
+  const toml = `[extend]
+${extendLine}
+
+[allowlist]
+paths = [
+${pathPatterns}
+]
+regexes = [
+${regexPatterns}
+]
+`;
+  const configPath = path.join(outDir, "gitleaks-scoped-config.toml");
+  fs.writeFileSync(configPath, toml, "utf-8");
+  return configPath;
+}
+function hasGitleaksSignal(cwd) {
+  const candidates = [...LOCAL_GITLEAKS_CONFIG_NAMES, ".gitleaksignore"];
+  for (const candidate of candidates) {
+    try {
+      if (fs.existsSync(path.join(cwd, candidate)))
+        return true;
+    } catch {
+    }
+  }
+  const pkgJsonPath = path.join(cwd, "package.json");
+  try {
+    if (fs.existsSync(pkgJsonPath)) {
+      const pkg = JSON.parse(fs.readFileSync(pkgJsonPath, "utf-8"));
+      const deps = { ...pkg.dependencies, ...pkg.devDependencies };
+      for (const name of Object.keys(deps)) {
+        if (name.toLowerCase().includes("gitleaks"))
+          return true;
+      }
+    }
+  } catch {
+  }
+  const hookCandidates = [
+    path.join(cwd, ".husky", "pre-commit"),
+    path.join(cwd, ".husky", "_", "pre-commit"),
+    path.join(cwd, ".git", "hooks", "pre-commit")
+  ];
+  for (const hook of hookCandidates) {
+    try {
+      if (!fs.existsSync(hook))
+        continue;
+      const content = fs.readFileSync(hook, "utf-8");
+      if (content.includes("gitleaks"))
+        return true;
+    } catch {
+    }
+  }
+  return false;
+}
+function hasGitRepo(cwd) {
+  try {
+    return fs.existsSync(path.join(cwd, ".git"));
+  } catch {
+    return false;
+  }
+}
+var GitleaksClient = class _GitleaksClient extends SecurityScanClient {
+  constructor(verbose = false) {
+    super("gitleaks", verbose);
+  }
+  /**
+   * Static detection helper so callers can gate before constructing
+   * (matches `GovulncheckClient.hasGoModule` shape).
+   */
+  static hasGitleaksSignal(cwd) {
+    return hasGitleaksSignal(cwd);
+  }
+  /** Smart-default tier (#130) — see {@link hasGitRepo}'s doc comment. */
+  static hasGitRepo(cwd) {
+    return hasGitRepo(cwd);
+  }
+  /**
+   * Auto-install via the GitHub-release path (registered in
+   * `clients/installer/index.ts`) when gitleaks isn't already on PATH.
+   * gitleaks uses `version` (no leading dashes) as its CLI verb.
+   */
+  doEnsureAvailable() {
+    return this.ensureViaInstaller(["version"]);
+  }
+  /**
+   * Scan a directory tree for secrets.
+   *
+   * Skips early when the directory shows no gitleaks opt-in signal — unless
+   * `requireSignal: false` (the `mode=full` fresh-fetch path uses this to
+   * apply the looser #130 "smart-default" gate, {@link hasGitRepo}, instead;
+   * session_start and per-edit dispatch never pass this, so their behavior
+   * is unchanged). When gitleaks is unavailable, returns an empty result
+   * with an explanatory summary rather than failing the session_start task.
+   *
+   * Re-entrancy safe: concurrent calls against the same root share a
+   * single gitleaks process (mirrors `KnipClient` / `JscpdClient` /
+   * `GovulncheckClient`).
+   */
+  async scan(cwd, options) {
+    const targetDir = path.resolve(cwd);
+    const scannedAt = (/* @__PURE__ */ new Date()).toISOString();
+    const requireSignal = options?.requireSignal ?? true;
+    if (requireSignal && !_GitleaksClient.hasGitleaksSignal(targetDir)) {
+      return {
+        ...EMPTY_RESULT,
+        success: true,
+        scannedAt,
+        summary: "no gitleaks opt-in signal at project root"
+      };
+    }
+    if (!await this.ensureAvailable()) {
+      return {
+        ...EMPTY_RESULT,
+        scannedAt,
+        summary: "gitleaks not installed"
+      };
+    }
+    return this.dedupeScan(targetDir, () => this.runScan(targetDir));
+  }
+  async runScan(cwd) {
+    const scannedAt = (/* @__PURE__ */ new Date()).toISOString();
+    const bin = this.binaryPath ?? "gitleaks";
+    const outDir = mkdtempSync(path.join(os.tmpdir(), "pi-lens-gitleaks-"));
+    const reportPath = path.join(outDir, "gitleaks-report.json");
+    try {
+      const configPath = writeScopedGitleaksConfig(outDir, cwd);
+      const result = await safeSpawnAsync(bin, [
+        "detect",
+        "--no-git",
+        "--source",
+        cwd,
+        "--config",
+        configPath,
+        "--report-format",
+        "json",
+        "--report-path",
+        reportPath,
+        "--exit-code",
+        "0",
+        "--no-banner"
+      ], { cwd, timeout: SCAN_TIMEOUT_MS });
+      if (result.error) {
+        this.log(`Scan error: ${result.error.message}`);
+        return {
+          ...EMPTY_RESULT,
+          scannedAt,
+          summary: result.error.message.slice(0, 200)
+        };
+      }
+      if (!fs.existsSync(reportPath)) {
+        return {
+          ...EMPTY_RESULT,
+          success: true,
+          scannedAt,
+          summary: (result.stderr ?? "").trim().split("\n")[0] || "no report produced"
+        };
+      }
+      const rawFindings = parseGitleaksReport(fs.readFileSync(reportPath, "utf-8"));
+      const findings = await classifyAndFilterFindings(rawFindings, cwd);
+      return {
+        success: true,
+        analyzed: true,
+        findings,
+        scannedAt
+      };
+    } catch (err) {
+      return {
+        ...EMPTY_RESULT,
+        scannedAt,
+        summary: err instanceof Error ? err.message.slice(0, 200) : String(err)
+      };
+    } finally {
+      try {
+        fs.rmSync(outDir, { recursive: true, force: true });
+      } catch {
+      }
+    }
+  }
+};
+function isInsideNestedGitRepository(file, cwd) {
+  const root = path.resolve(cwd);
+  const absoluteFile = path.isAbsolute(file) ? path.resolve(file) : path.resolve(root, file);
+  const relative2 = path.relative(root, absoluteFile);
+  if (relative2 === ".." || relative2.startsWith(`..${path.sep}`) || path.isAbsolute(relative2))
+    return false;
+  let directory = path.dirname(absoluteFile);
+  while (directory !== root) {
+    try {
+      if (fs.existsSync(path.join(directory, ".git")))
+        return true;
+    } catch {
+      return false;
+    }
+    const parent = path.dirname(directory);
+    if (parent === directory)
+      return false;
+    directory = parent;
+  }
+  return false;
+}
+async function classifyAndFilterFindings(findings, cwd) {
+  if (findings.length === 0)
+    return findings;
+  const [trackedIds, untrackedIgnoredIds] = await Promise.all([
+    collectTrackedFiles(cwd),
+    collectUntrackedIgnoredIds(cwd)
+  ]);
+  const classified = [];
+  for (const finding of findings) {
+    if (isUnderSecretsLaneScratchTree(finding.file)) {
+      classified.push({ ...finding, pathStatus: "scratch" });
+      continue;
+    }
+    const absPath = path.isAbsolute(finding.file) ? finding.file : path.resolve(cwd, finding.file);
+    if (isInsideNestedGitRepository(absPath, cwd)) {
+      classified.push({ ...finding, pathStatus: "nested-repository" });
+      continue;
+    }
+    let pathStatus;
+    if (trackedIds?.has(normalizeEphemeralMapKey(absPath))) {
+      pathStatus = "tracked";
+    } else if (untrackedIgnoredIds?.has(normalizeMapKey(absPath))) {
+      pathStatus = "ignored";
+    } else if (trackedIds !== void 0 || untrackedIgnoredIds !== void 0) {
+      pathStatus = "untracked";
+    }
+    classified.push(pathStatus ? { ...finding, pathStatus } : finding);
+  }
+  return classified;
+}
+function parseGitleaksReport(raw) {
+  if (!raw.trim())
+    return [];
+  let parsed;
+  try {
+    parsed = JSON.parse(raw);
+  } catch {
+    return [];
+  }
+  if (!Array.isArray(parsed))
+    return [];
+  const findings = [];
+  for (const entry of parsed) {
+    if (!entry || typeof entry !== "object")
+      continue;
+    const e = entry;
+    const ruleId = typeof e.RuleID === "string" ? e.RuleID : void 0;
+    const file = typeof e.File === "string" ? e.File : void 0;
+    const startLine = typeof e.StartLine === "number" ? e.StartLine : Number.parseInt(String(e.StartLine ?? ""), 10);
+    if (!ruleId || !file || !Number.isFinite(startLine))
+      continue;
+    findings.push({
+      ruleId,
+      description: typeof e.Description === "string" ? e.Description : void 0,
+      file,
+      startLine,
+      endLine: typeof e.EndLine === "number" ? e.EndLine : Number.isFinite(Number(e.EndLine)) ? Number(e.EndLine) : void 0,
+      match: typeof e.Match === "string" ? e.Match : void 0,
+      secret: typeof e.Secret === "string" ? e.Secret : void 0,
+      tags: Array.isArray(e.Tags) ? e.Tags.filter((t) => typeof t === "string") : void 0,
+      commit: typeof e.Commit === "string" ? e.Commit : void 0,
+      author: typeof e.Author === "string" ? e.Author : void 0,
+      date: typeof e.Date === "string" ? e.Date : void 0
+    });
+  }
+  return findings;
+}
+
+export {
+  PLACEHOLDER_SECRET_REGEXES,
+  writeScopedGitleaksConfig,
+  hasGitleaksSignal,
+  hasGitRepo,
+  GitleaksClient,
+  classifyAndFilterFindings,
+  parseGitleaksReport
+};