@herbertgao/pi-extensions 2026.10.1 → 2026.10.3

package/node_modules/pi-lens/dist/clients/trivy-client.js

@@ -1,467 +0,0 @@
-/**
- * Trivy client for pi-lens — dependency CVE detection (Phase 1 of #131).
- *
- * Surfaces known vulnerabilities (CVE / GHSA) in a project's declared
- * dependencies, across every ecosystem Trivy understands (npm, PyPI, Maven,
- * Gradle, Go modules, Cargo, Composer, RubyGems, NuGet, …) from a single
- * filesystem walk. pi-lens has zero dependency-CVE coverage otherwise.
- *
- * Lifecycle (mirrors the gitleaks / govulncheck session-scan clients):
- *   - session_start scan (via the `runTask(setImmediate)` background wrapper)
- *   - turn_end advisory reads the cached result and surfaces top-N findings;
- *     CRITICAL is treated as a blocker, the rest as advisory
- *   - per-edit scope: skipped — CVE data is daily-ish and the scan is whole-tree;
- *     re-running per keystroke is wasteful. Re-scan is driven by the cache layer
- *     (keyed on lockfile mtimes by the caller).
- *
- * Detection gate (explicit opt-in per #131): the project must opt in via
- * `trivy.enabled: true` in `.pi-lens.json` AND declare a scannable dependency
- * surface (any manifest at the analysis root). The opt-in is required because a
- * first scan auto-installs the binary and pulls a 30-200 MB vuln DB — too heavy
- * to enable for every project that merely has a `package.json`. Set
- * `trivy.minSeverity` to widen what surfaces (default HIGH; never hides
- * HIGH/CRITICAL).
- *
- * When the gate trips, the client auto-installs trivy from GitHub releases
- * (installer entry registered in clients/installer/index.ts) and runs
- * `trivy fs --scanners vuln`. The first run downloads Trivy's vuln DB
- * (~30-200 MB); because the scan runs in the background session_start task it
- * never blocks an edit.
- *
- * Scope note: this slice is dependency CVEs only. IaC misconfig (per-edit),
- * secrets (pending dedup vs gitleaks), and license compliance are follow-ups
- * tracked on #131.
- *
- * Scope note (#1562 class fix): `fs`'s own tree walk is handed
- * `--skip-dirs` per shared scratch/cache tree (`scratch-tree-policy.ts`,
- * derived from the same `EXCLUDED_DIRS` gitleaks/opengrep use) so its
- * `secret` scanner doesn't repeat gitleaks's `.pi/greedysearch-sources/`
- * false-positive shape.
- *
- * Refs: #131, #1562
- */
-import * as fs from "node:fs";
-import * as os from "node:os";
-import * as path from "node:path";
-import { mkdtempSync } from "node:fs";
-import { loadPiLensProjectConfig } from "./project-lens-config.js";
-import { getScratchTreeGlobPatterns } from "./scratch-tree-policy.js";
-import { safeSpawnAsync } from "./safe-spawn.js";
-import { SecurityScanClient } from "./security-scan-client.js";
-const EMPTY_RESULT = {
-    success: false,
-    findings: [],
-    secrets: [],
-    licenses: [],
-};
-// Generous: the FIRST run downloads the vuln DB (~30-200 MB). This runs in the
-// background session_start task, so a slow cold start never blocks an edit.
-const SCAN_TIMEOUT_MS = 180_000;
-// --- Detection ---
-/**
- * Dependency manifests / lockfiles whose presence at the analysis root opts the
- * project in to CVE scanning. Mirrors the ecosystem coverage Trivy's SCA walk
- * understands (#131).
- */
-const DEPENDENCY_MANIFESTS = [
-    // JS / TS
-    "package.json",
-    "package-lock.json",
-    "pnpm-lock.yaml",
-    "yarn.lock",
-    "bun.lockb",
-    // Python
-    "pyproject.toml",
-    "requirements.txt",
-    "poetry.lock",
-    "Pipfile.lock",
-    // Java / JVM
-    "pom.xml",
-    "build.gradle",
-    "build.gradle.kts",
-    "gradle.lockfile",
-    // Go
-    "go.mod",
-    "go.sum",
-    // Rust
-    "Cargo.toml",
-    "Cargo.lock",
-    // .NET
-    "packages.lock.json",
-    // PHP
-    "composer.json",
-    "composer.lock",
-    // Ruby
-    "Gemfile",
-    "Gemfile.lock",
-];
-/**
- * Detect whether the analysis root declares any dependencies Trivy can scan.
- * Root-level check (fast, synchronous) — the same shape as `hasGitleaksSignal`.
- * Nested-only manifests in deep monorepo packages are a known follow-up; the
- * gate intentionally errs toward not auto-pulling a 100 MB DB for a project that
- * shows no dependency surface at its root.
- *
- * Exported for tests and gate-before-construct callers.
- */
-export function hasAnyDependencyManifest(cwd) {
-    for (const manifest of DEPENDENCY_MANIFESTS) {
-        try {
-            if (fs.existsSync(path.join(cwd, manifest)))
-                return true;
-        }
-        catch {
-            // non-fatal — keep probing the remaining manifests
-        }
-    }
-    return false;
-}
-/**
- * Explicit opt-in: trivy runs only when the project sets `trivy.enabled: true`
- * in `.pi-lens.json` (the loader walks up, so a `~/.pi-lens.json` enables it
- * globally). Required because the first scan auto-installs the binary and pulls
- * a 30-200 MB vuln DB — too costly to enable implicitly. Default OFF.
- *
- * Exported for tests and gate-before-construct callers.
- */
-export function isTrivyEnabled(cwd) {
-    try {
-        const config = loadPiLensProjectConfig(cwd);
-        const trivy = config.raw
-            ?.trivy;
-        return trivy?.enabled === true;
-    }
-    catch {
-        return false;
-    }
-}
-/**
- * Full session-scan gate: explicit opt-in AND a scannable dependency surface.
- * Both must hold before we auto-install trivy / pull its DB.
- */
-export function shouldScanTrivy(cwd) {
-    return isTrivyEnabled(cwd) && hasAnyDependencyManifest(cwd);
-}
-// --- Severity floor ---
-const SEVERITY_RANK = {
-    LOW: 0,
-    MEDIUM: 1,
-    HIGH: 2,
-    CRITICAL: 3,
-};
-/**
- * Resolve the `--severity` list from the project's `pi-lens.trivy.minSeverity`
- * (default HIGH). The floor can be LOWERED (MEDIUM / LOW = see more) but is
- * clamped so it can never be raised above HIGH — a CRITICAL or HIGH CVE must
- * always surface regardless of config (#131 non-goal: no bypassing criticals).
- */
-export function resolveSeverityFloor(cwd) {
-    let raw;
-    try {
-        const config = loadPiLensProjectConfig(cwd);
-        raw = config.raw
-            ?.trivy?.minSeverity;
-    }
-    catch {
-        raw = undefined;
-    }
-    const requested = typeof raw === "string" ? SEVERITY_RANK[raw.toUpperCase()] : undefined;
-    // Default HIGH; never stricter than HIGH so HIGH/CRITICAL are never hidden.
-    const floor = Math.min(requested ?? SEVERITY_RANK.HIGH, SEVERITY_RANK.HIGH);
-    return ["LOW", "MEDIUM", "HIGH", "CRITICAL"].filter((s) => SEVERITY_RANK[s] >= floor);
-}
-// --- Client ---
-export class TrivyClient extends SecurityScanClient {
-    constructor(verbose = false) {
-        super("trivy", verbose);
-    }
-    /** Static gates so callers can skip before constructing. */
-    static hasAnyDependencyManifest(cwd) {
-        return hasAnyDependencyManifest(cwd);
-    }
-    /** Full opt-in gate (config opt-in AND a dependency manifest). */
-    static shouldScan(cwd) {
-        return shouldScanTrivy(cwd);
-    }
-    /**
-     * Auto-install via the GitHub-release path (registered in
-     * `clients/installer/index.ts`) when trivy isn't already on PATH.
-     */
-    doEnsureAvailable() {
-        return this.ensureViaInstaller(["--version"]);
-    }
-    /**
-     * Scan a directory tree for dependency CVEs.
-     *
-     * Skips early when the opt-in gate isn't satisfied. When trivy is
-     * unavailable, returns an empty (but successful) result rather than failing
-     * the session_start task. Re-entrancy safe: concurrent calls against the
-     * same root share a single process.
-     */
-    async scan(cwd) {
-        const targetDir = path.resolve(cwd);
-        const scannedAt = new Date().toISOString();
-        if (!shouldScanTrivy(targetDir)) {
-            return {
-                ...EMPTY_RESULT,
-                success: true,
-                scannedAt,
-                summary: hasAnyDependencyManifest(targetDir)
-                    ? "trivy not enabled (set trivy.enabled in .pi-lens.json)"
-                    : "no dependency manifest at analysis root",
-            };
-        }
-        if (!(await this.ensureAvailable())) {
-            return { ...EMPTY_RESULT, scannedAt, summary: "trivy not installed" };
-        }
-        return this.dedupeScan(targetDir, () => this.runScan(targetDir));
-    }
-    async runScan(cwd) {
-        const scannedAt = new Date().toISOString();
-        const bin = this.binaryPath ?? "trivy";
-        const severities = resolveSeverityFloor(cwd);
-        const outDir = mkdtempSync(path.join(os.tmpdir(), "pi-lens-trivy-"));
-        const reportPath = path.join(outDir, "trivy-report.json");
-        try {
-            // One filesystem walk covers all three scanners. `--severity` filters
-            // both the vuln and the license results; secret findings are
-            // severity-independent (trivy always emits them) and collapsed
-            // downstream against gitleaks / ast-grep.
-            //
-            // `--skip-dirs` (#1562 class fix): trivy's `fs` scan walks `cwd`
-            // ITSELF (unlike knip/jscpd, which pi-lens's own `EXCLUDED_DIRS`-aware
-            // walker feeds a pre-filtered file list). Without this, its `secret`
-            // scanner is exactly as exposed to `.pi/greedysearch-sources/`-style
-            // scratch trees as gitleaks was — same doublestar-glob patterns
-            // `scratch-tree-policy.ts` derives from the SAME `EXCLUDED_DIRS` list.
-            const result = await safeSpawnAsync(bin, [
-                "fs",
-                "--scanners",
-                "vuln,secret,license",
-                "--severity",
-                severities.join(","),
-                "--format",
-                "json",
-                "--output",
-                reportPath,
-                "--quiet",
-                "--no-progress",
-                ...getScratchTreeGlobPatterns().flatMap((glob) => [
-                    "--skip-dirs",
-                    glob,
-                ]),
-                cwd,
-            ], { cwd, timeout: SCAN_TIMEOUT_MS });
-            if (result.error) {
-                this.log(`Scan error: ${result.error.message}`);
-                return {
-                    ...EMPTY_RESULT,
-                    scannedAt,
-                    summary: result.error.message.slice(0, 200),
-                };
-            }
-            if (!fs.existsSync(reportPath)) {
-                return {
-                    ...EMPTY_RESULT,
-                    success: true,
-                    scannedAt,
-                    summary: (result.stderr ?? "").trim().split("\n")[0] || "no report produced",
-                };
-            }
-            const raw = fs.readFileSync(reportPath, "utf-8");
-            const findings = parseTrivyReport(raw);
-            const secrets = parseTrivySecrets(raw);
-            const licenses = parseTrivyLicenses(raw);
-            // #2154: the one trivy site that parsed a scan of this root.
-            return {
-                success: true,
-                analyzed: true,
-                findings,
-                secrets,
-                licenses,
-                scannedAt,
-            };
-        }
-        catch (err) {
-            return {
-                ...EMPTY_RESULT,
-                scannedAt,
-                summary: err instanceof Error ? err.message.slice(0, 200) : String(err),
-            };
-        }
-        finally {
-            try {
-                fs.rmSync(outDir, { recursive: true, force: true });
-            }
-            catch {
-                // non-fatal
-            }
-        }
-    }
-}
-// --- Parser ---
-function normalizeSeverity(raw) {
-    const s = typeof raw === "string" ? raw.toUpperCase() : "";
-    if (s === "CRITICAL" || s === "HIGH" || s === "MEDIUM" || s === "LOW") {
-        return s;
-    }
-    return "UNKNOWN";
-}
-/**
- * Map Trivy's `fs --format json` report to our `TrivyFinding[]`. The report is
- * `{ Results: [{ Target, Vulnerabilities: [{ VulnerabilityID, PkgName, … }] }] }`;
- * `Results` / `Vulnerabilities` are often `null` when nothing is found.
- *
- * Defensive: malformed / truncated input returns `[]` rather than throwing —
- * the session_start task must never crash the session. Exported for unit tests.
- */
-export function parseTrivyReport(raw) {
-    if (!raw.trim())
-        return [];
-    let parsed;
-    try {
-        parsed = JSON.parse(raw);
-    }
-    catch {
-        return [];
-    }
-    const results = parsed?.Results;
-    if (!Array.isArray(results))
-        return [];
-    const findings = [];
-    for (const resultEntry of results) {
-        if (!resultEntry || typeof resultEntry !== "object")
-            continue;
-        const r = resultEntry;
-        const target = typeof r.Target === "string" ? r.Target : undefined;
-        const vulns = r.Vulnerabilities;
-        if (!Array.isArray(vulns))
-            continue;
-        for (const vulnEntry of vulns) {
-            if (!vulnEntry || typeof vulnEntry !== "object")
-                continue;
-            const v = vulnEntry;
-            const vulnerabilityId = typeof v.VulnerabilityID === "string" ? v.VulnerabilityID : undefined;
-            const pkgName = typeof v.PkgName === "string" ? v.PkgName : undefined;
-            if (!vulnerabilityId || !pkgName)
-                continue;
-            findings.push({
-                vulnerabilityId,
-                pkgName,
-                installedVersion: typeof v.InstalledVersion === "string"
-                    ? v.InstalledVersion
-                    : undefined,
-                fixedVersion: typeof v.FixedVersion === "string" && v.FixedVersion.trim()
-                    ? v.FixedVersion
-                    : undefined,
-                severity: normalizeSeverity(v.Severity),
-                title: typeof v.Title === "string" ? v.Title : undefined,
-                primaryUrl: typeof v.PrimaryURL === "string" ? v.PrimaryURL : undefined,
-                target,
-            });
-        }
-    }
-    return findings;
-}
-/**
- * Map Trivy's `Results[].Secrets[]` rows to normalized secret findings. The
- * file is the result's `Target`; each secret carries a `RuleID`, `StartLine`,
- * and `Title`. Same defensive contract as `parseTrivyReport` — malformed input
- * returns `[]`. These are collapsed against gitleaks / ast-grep downstream
- * (`clients/secret-findings.ts`) so the same secret surfaces once. Exported for
- * unit tests.
- */
-export function parseTrivySecrets(raw) {
-    if (!raw.trim())
-        return [];
-    let parsed;
-    try {
-        parsed = JSON.parse(raw);
-    }
-    catch {
-        return [];
-    }
-    const results = parsed?.Results;
-    if (!Array.isArray(results))
-        return [];
-    const secrets = [];
-    for (const resultEntry of results) {
-        if (!resultEntry || typeof resultEntry !== "object")
-            continue;
-        const r = resultEntry;
-        const target = typeof r.Target === "string" ? r.Target : undefined;
-        const rows = r.Secrets;
-        if (!target || !Array.isArray(rows))
-            continue;
-        for (const row of rows) {
-            if (!row || typeof row !== "object")
-                continue;
-            const s = row;
-            const ruleId = typeof s.RuleID === "string" ? s.RuleID : undefined;
-            const line = typeof s.StartLine === "number" ? s.StartLine : undefined;
-            if (!ruleId || line == null)
-                continue;
-            secrets.push({
-                ruleId,
-                file: target,
-                line,
-                title: typeof s.Title === "string" ? s.Title : undefined,
-            });
-        }
-    }
-    return secrets;
-}
-/**
- * Map Trivy's `Results[].Licenses[]` rows to normalized license-risk findings
- * (#131 Mode 4). Each row carries `Name` (the license id, e.g. "GPL-3.0"),
- * `PkgName`, `Severity`, `Category` (trivy's classification: restricted /
- * reciprocal / forbidden / …), and a `FilePath` for license-file findings.
- * `Severity` is already filtered by the scan's `--severity` floor. Same
- * defensive contract as the sibling parsers. Exported for unit tests.
- */
-export function parseTrivyLicenses(raw) {
-    if (!raw.trim())
-        return [];
-    let parsed;
-    try {
-        parsed = JSON.parse(raw);
-    }
-    catch {
-        return [];
-    }
-    const results = parsed?.Results;
-    if (!Array.isArray(results))
-        return [];
-    const licenses = [];
-    for (const resultEntry of results) {
-        if (!resultEntry || typeof resultEntry !== "object")
-            continue;
-        const r = resultEntry;
-        const target = typeof r.Target === "string" ? r.Target : undefined;
-        const rows = r.Licenses;
-        if (!Array.isArray(rows))
-            continue;
-        for (const row of rows) {
-            if (!row || typeof row !== "object")
-                continue;
-            const l = row;
-            const license = typeof l.Name === "string" ? l.Name : undefined;
-            if (!license)
-                continue;
-            const filePath = typeof l.FilePath === "string" && l.FilePath ? l.FilePath : target;
-            // Package licenses carry PkgName; license-file findings fall back to
-            // the file they were found in.
-            const pkgName = typeof l.PkgName === "string" && l.PkgName
-                ? l.PkgName
-                : (filePath ?? "unknown");
-            licenses.push({
-                license,
-                pkgName,
-                severity: normalizeSeverity(l.Severity),
-                category: typeof l.Category === "string" ? l.Category : undefined,
-                filePath,
-            });
-        }
-    }
-    return licenses;
-}

package/node_modules/pi-lens/dist/clients/tui-fit.js

@@ -1,50 +0,0 @@
-/**
- * Width-safe line fitting for TUI rendering (shared by the footer widget and
- * the turn-summary message renderer). pi-tui's `TUI.doRender` HARD-CRASHES the
- * whole host on any rendered line wider than the terminal ("Rendered line N
- * exceeds terminal width") — every `Component.render(width)` line MUST be
- * truncated to the given width. Seen live 2026-07-11: an untruncated
- * turn-summary one-liner (133 cols vs 120) took down a pi session (#513).
- *
- * Two incompatible truncateToWidth signatures ship under the
- * "@earendil-works/pi-tui" specifier depending on which runtime resolves it:
- *   - pure-JS pi-tui:        (text, maxWidth, ellipsis: string, pad?)
- *   - native @oh-my-pi >=16: (text, maxWidth, ellipsisKind: Ellipsis enum, pad, tabWidth: i32)
- * Passing a string to the native one throws "Failed to convert napi value into
- * enum `Ellipsis`". Probe the string API once; on napi failure, switch to the
- * native enum signature for good. Ellipsis enum: Unicode=0 ("…"), Ascii=1
- * ("..."), Omit=2.
- */
-import { truncateToWidth } from "./deps/pi-tui.js";
-const ELLIPSIS_KIND = { "…": 0, "...": 1, "": 2 };
-let truncateIsNative = null;
-export function fitLine(s, maxWidth, ellipsis = "...") {
-    const w = Math.max(0, maxWidth);
-    const fn = truncateToWidth;
-    if (truncateIsNative === true) {
-        return fn(s, w, ELLIPSIS_KIND[ellipsis] ?? 1, false, 8);
-    }
-    if (truncateIsNative === false) {
-        return fn(s, w, ellipsis);
-    }
-    // first call: try the legacy string API; native binding rejects the string arg.
-    try {
-        const out = fn(s, w, ellipsis);
-        truncateIsNative = false;
-        return out;
-    }
-    catch {
-        truncateIsNative = true;
-        return fn(s, w, ELLIPSIS_KIND[ellipsis] ?? 1, false, 8);
-    }
-}
-/**
- * Fit every line of a `Component.render(width)` result. `width` can arrive as
- * 0/undefined in exotic hosts — treat non-positive as "don't truncate" rather
- * than emitting empty lines.
- */
-export function fitLines(lines, width) {
-    if (!Number.isFinite(width) || width <= 0)
-        return lines;
-    return lines.map((line) => fitLine(line, width));
-}

package/node_modules/pi-lens/dist/clients/turn-context.js

@@ -1,52 +0,0 @@
-import { AsyncLocalStorage } from "node:async_hooks";
-import { getProcessSingleton } from "./process-singletons.js";
-const FAMILY = "turn-context";
-const VERSION = 2;
-function state() {
-    return getProcessSingleton(FAMILY, VERSION, () => ({
-        sessions: new Map(),
-        activeSession: new AsyncLocalStorage(),
-    }));
-}
-function sessionState(sessionId) {
-    const current = state();
-    let session = current.sessions.get(sessionId);
-    if (!session) {
-        session = { turnId: `${sessionId}:0`, turnIndex: 0 };
-        current.sessions.set(sessionId, session);
-    }
-    return session;
-}
-/** Reset the emit identity before a new session can publish rows. */
-export function resetTurnContext(sessionId) {
-    const current = state();
-    if (sessionId === undefined)
-        return;
-    current.sessions.set(sessionId, { turnId: `${sessionId}:0`, turnIndex: 0 });
-}
-/** Ensure a stable host session has a counter without changing detached identity. */
-export function setTurnContextSession(sessionId) {
-    const stableSessionId = sessionId?.trim();
-    if (stableSessionId !== undefined && stableSessionId !== "")
-        sessionState(stableSessionId);
-}
-/** Mint the one id shared by every row emitted during this turn. */
-export function beginTurnContext(sessionId) {
-    const session = sessionState(sessionId);
-    session.turnIndex += 1;
-    session.turnId = `${sessionId}:${session.turnIndex}`;
-    return session.turnId;
-}
-/** Run a host event with the session identity that owns its writes. */
-export function runWithTurnContext(sessionId, fn) {
-    if (sessionId === undefined)
-        return fn();
-    return state().activeSession.run(sessionId, fn);
-}
-export function getTurnId() {
-    const current = state();
-    const sessionId = current.activeSession.getStore();
-    if (sessionId === undefined)
-        return "turn:0";
-    return sessionState(sessionId).turnId;
-}

package/node_modules/pi-lens/dist/clients/turn-end/lane.js

@@ -1,51 +0,0 @@
-/**
- * The ONE interface every turn-end delivery lane implements (#1892).
- *
- * `clients/runtime-turn.ts`'s `handleTurnEnd` grew fourteen delivery lanes
- * inline: each read its own store, applied its own freshness/disposition
- * policy, and formatted its own section into `blockerParts`/`advisoryParts`,
- * so the composer had to know every lane's rules and no lane could be read,
- * tested, or reasoned about on its own. The lanes converged on ONE shape
- * anyway — read a store, gate the rows, render a tier — and that shape is
- * this module. A lane is a deep module: three narrow calls over whatever its
- * store's rules happen to be, and the composer states none of them.
- *
- * ── The three stages, and why they are three ──────────────────────────────
- *
- * 1. `collect(ctx)` — read this lane's stores and declare, per STORE, the
- *    findings plus the freshness policy that store's rows need. It returns
- *    structured rows keyed by store name (the source identity the shared
- *    pass and its bounded records carry), never a rendered string.
- *
- *    It does NOT call the freshness gate. #3264 folded the turn-end scanner
- *    stores into ONE `gateFindingsByPathFreshness` call so a file two stores
- *    cite is stat'd once, spends one stat budget, and writes one bounded
- *    decision record per delivery instead of up to six. A lane that gated
- *    itself would re-split that pass the moment a second lane appeared, so
- *    the pass is the COMPOSER's (it is a cross-lane resource — a filesystem
- *    pass, a budget and a record, not a per-lane rule), and a lane only
- *    DECLARES its sources. `tests/config/turn-end-lane-boundaries.test.ts`
- *    pins that: a lane that calls the gate itself reds.
- *
- * 2. `gate(gates, ctx)` — apply the per-lane policy the shared pass cannot:
- *    dispositions (`filterFindingsByDisposition`, the seam in
- *    `clients/dispatch/finding-policy.ts`), and whatever existence or
- *    lifecycle contract the lane's own store carries. Takes the freshness
- *    partition the composer got for THIS lane's sources and returns the
- *    lane's own kept shape, which no other module reads.
- *
- * 3. `render(kept, ctx)` — format the tiers. A lane returns its sections; it
- *    never pushes into the turn's arrays. The push stays in the composer so
- *    the `@delivery-surface:` seam scan in
- *    `tests/clients/finding-delivery-gate.test.ts` — which reads
- *    `clients/runtime-turn.ts` and `tools/lens-diagnostics.ts` — keeps seeing
- *    every agent-facing render seam. A lane that pushed from its own file
- *    would be invisible to that scan; the boundary test reds on it.
- *
- * The composer still owns everything that is not one lane's rule: the order
- * the tiers are assembled in, the display and message caps, the turn
- * signature dedupe, the `turn-end-findings` cache write, the git-guard
- * record, and the one-per-turn disposition-suppressed notice that every
- * lane's counts fold into.
- */
-export {};