@herbertgao/pi-extensions 2026.9.15 → 2026.9.16

package/node_modules/pi-lens/dist/clients/tree-sitter-client.js

@@ -25,7 +25,8 @@ import { loadWebTreeSitter } from "./deps/web-tree-sitter.js";
 import { transientRetryDelayMs } from "./dispatch/runners/utils/availability-policy.js";
 import { getProjectIgnoreMatcher, isExcludedDirName } from "./file-utils.js";
 import { downloadGrammarDetailed, fileHasWasmMagic, grammarBlockReason, grammarFileSha256, isVendoredGrammar, LANGUAGE_TO_GRAMMAR, pinnedGrammarHash, vendoredGrammarRefusal, vendoredGrammarsDir, } from "./grammar-source.js";
-import { resolvePackagePath } from "./package-root.js";
+import { getPackageRoot, resolvePackagePath } from "./package-root.js";
+import { resolveWebTreeSitterPackageDir } from "../scripts/lib/web-tree-sitter-dir.mjs";
 import { assertInstallAllowed, getProjectTrustGeneration, } from "./project-trust.js";
 import { escapeRegExp } from "./string-utils.js";
 import { logTreeSitterDiagnostic } from "./tree-sitter-logger.js";
@@ -73,6 +74,27 @@ function createParserCounters() {
         parserFailures: 0,
     };
 }
+/**
+ * The errno that blocks writing into `dir`, or undefined when a write can be
+ * attempted (#3409). The directory itself need not exist yet — the lazy fetch
+ * creates it — so the nearest EXISTING ancestor is what gets probed.
+ */
+function grammarWriteBlockedReason(dir) {
+    let probe = dir;
+    while (!fs.existsSync(probe)) {
+        const parent = path.dirname(probe);
+        if (parent === probe)
+            return "ENOENT";
+        probe = parent;
+    }
+    try {
+        fs.accessSync(probe, fs.constants.W_OK);
+        return undefined;
+    }
+    catch (err) {
+        return err?.code ?? "EACCES";
+    }
+}
 /**
  * `size:mtimeMs` identity for a grammar candidate, or undefined when the path
  * is absent or not a regular file. Doubles as the existence check on the
@@ -347,6 +369,7 @@ export class TreeSitterClient {
         this.grammarDirResolutionDeps = grammarDirResolutionDeps ?? {
             resolveAsset: (asset) => this.resolveWebTreeSitterAsset(asset),
             resolvePackage: (specifier) => _require.resolve(specifier),
+            packageRoot: () => getPackageRoot(import.meta.url),
             cwd: () => process.cwd(),
         };
         this.grammarsDir = this.findGrammarsDir();
@@ -469,38 +492,42 @@ export class TreeSitterClient {
         }
     }
     /**
-     * Resolve a web-tree-sitter asset path using multiple strategies:
-     * 1. Node module resolution via createRequire (handles hoisted installs — issue #20)
-     * 2. Package-root walk from import.meta.url (handles on-the-fly TS compilation by pi)
-     * 3. process.cwd() fallback
+     * web-tree-sitter's installed package directory, through the one shared
+     * ladder in `scripts/lib/web-tree-sitter-dir.mjs` (#3409). Routed through
+     * `grammarDirResolutionDeps` so the resolver context — the thing that
+     * differs on a compiled host — stays the injected seam (#2112/#2136).
+     */
+    webTreeSitterPackageDir() {
+        return resolveWebTreeSitterPackageDir({
+            resolve: (specifier) => this.grammarDirResolutionDeps.resolvePackage(specifier),
+            packageRoot: () => this.grammarDirResolutionDeps.packageRoot(),
+            cwd: () => this.grammarDirResolutionDeps.cwd(),
+        });
+    }
+    /**
+     * Resolve a web-tree-sitter asset path:
+     * 1. the asset's own subpath, authoritative when the package `exports` it
+     *    (`tree-sitter.wasm` is exported; `grammars` is NOT in 0.25.10, so this
+     *    rung is dead for the grammars dir — #3409's second symptom);
+     * 2. the asset inside the package directory the shared ladder resolves. That
+     *    ladder's own last two rungs are the package-root walk (#20, for pi's
+     *    temp-dir compile) and the cwd fallback this method used to spell out.
      */
     resolveWebTreeSitterAsset(asset) {
-        // Strategy 1: Node module resolution (hoisted installs, pnpm workspaces)
         try {
-            const resolved = _require.resolve(`web-tree-sitter/${asset}`);
+            const resolved = this.grammarDirResolutionDeps.resolvePackage(`web-tree-sitter/${asset}`);
             if (fs.existsSync(resolved))
                 return resolved;
         }
         catch {
             /* fall through */
         }
-        // Strategy 2: Walk up from this module to find package.json, then into node_modules.
-        // This is required when pi compiles TS on-the-fly to a temp directory —
-        // createRequire(import.meta.url) resolves from the temp dir and can't find
-        // web-tree-sitter, but the package root (where package.json lives) still has
-        // the correct node_modules layout.
-        try {
-            const candidate = resolvePackagePath(import.meta.url, "node_modules", "web-tree-sitter", asset);
+        const pkgDir = this.webTreeSitterPackageDir();
+        if (pkgDir) {
+            const candidate = path.join(pkgDir, asset);
             if (fs.existsSync(candidate))
                 return candidate;
         }
-        catch {
-            /* fall through */
-        }
-        // Strategy 3: cwd fallback
-        const cwdCandidate = path.join(process.cwd(), "node_modules", "web-tree-sitter", asset);
-        if (fs.existsSync(cwdCandidate))
-            return cwdCandidate;
         return undefined;
     }
     /**
@@ -764,22 +791,16 @@ export class TreeSitterClient {
      * whether or not it exists yet — so we can create + populate it when the
      * postinstall download was skipped (pnpm/bun). Returns undefined if
      * web-tree-sitter itself can't be located.
+     *
+     * #3409: this used to resolve the BARE `web-tree-sitter` specifier and
+     * nothing else, which throws MODULE_NOT_FOUND inside the `bun
+     * build --compile` binary pi ships — so on every such host it returned
+     * undefined and NO non-core grammar could ever be fetched. It now shares the
+     * read path's ladder, whose first rung is a subpath that does resolve there.
      */
     grammarsWriteDir() {
-        try {
-            let dir = path.dirname(_require.resolve("web-tree-sitter"));
-            while (path.basename(dir) !== "web-tree-sitter" &&
-                dir !== path.dirname(dir)) {
-                dir = path.dirname(dir);
-            }
-            if (path.basename(dir) === "web-tree-sitter") {
-                return path.join(dir, "grammars");
-            }
-        }
-        catch {
-            /* fall through */
-        }
-        return undefined;
+        const pkgDir = this.webTreeSitterPackageDir();
+        return pkgDir ? path.join(pkgDir, "grammars") : undefined;
     }
     /**
      * Ensure a single grammar wasm is on disk, fetching it at runtime if the
@@ -847,7 +868,7 @@ export class TreeSitterClient {
                 // refactor that lets an exception out cannot regress to it.
                 const message = err instanceof Error ? err.message : String(err);
                 this.recordGrammarFailure(grammarFile, `The runtime grammar fetch threw an unexpected error (${message}).`, 
-                /* retryable */ true);
+                /* retryable */ true, "download-failed");
                 return false;
             }
         })();
@@ -899,15 +920,31 @@ export class TreeSitterClient {
             ? this.grammarsDir
             : this.grammarsWriteDir();
         if (!dir) {
-            // No writable grammars directory could be located (e.g. pi compiled
-            // this module to a temp dir and web-tree-sitter isn't resolvable
-            // from there yet). This is an environment condition, not a CDN
-            // verdict — #1536 review F2: it must get the same cooldown +
-            // notification treatment as a download failure, not a silent
-            // unmemoized `false` that re-does the same failing resolution
-            // sweep on every single demand.
-            this.recordGrammarFailure(grammarFile, "No writable grammars directory could be located for the runtime fetch.", 
-            /* retryable */ true);
+            // Nothing to write into: web-tree-sitter is not locatable by ANY rung
+            // of the shared ladder (this runtime's resolver, pi-lens's own package
+            // root, the working directory), so the package is missing from this
+            // install. Still an environment condition, not a CDN verdict — #1536
+            // review F2: it gets the same cooldown + notification treatment as a
+            // download failure rather than a silent unmemoized `false` that re-does
+            // the same failing resolution sweep on every demand.
+            //
+            // #3409: before the shared ladder, this arm ALSO caught every host
+            // whose runtime cannot resolve a bare specifier — where the package was
+            // present and the wasm downloadable — and told the user to approve
+            // build scripts or restore network access. Hence the cause.
+            this.recordGrammarFailure(grammarFile, "No grammars directory could be resolved for the runtime fetch: the web-tree-sitter package is not locatable from this runtime, from pi-lens's own package root, or from the working directory.", 
+            /* retryable */ true, "write-dir-unresolvable");
+            return false;
+        }
+        // A destination that cannot be written to is not a download problem
+        // either (#3409): a root-owned `node_modules` under a global install
+        // reaches `downloadGrammarDetailed`'s catch-all, which reports no reason
+        // at all, so the user was sent to inspect their package manager and
+        // network for an EACCES.
+        const writeBlock = grammarWriteBlockedReason(dir);
+        if (writeBlock) {
+            this.recordGrammarFailure(grammarFile, `The grammars directory ${dir} cannot be written to (${writeBlock}), so the runtime fetch has nowhere to land.`, 
+            /* retryable */ true, "write-dir-unwritable");
             return false;
         }
         // Reuse the shared single-file downloader (same CDN/source as the
@@ -940,7 +977,7 @@ export class TreeSitterClient {
             // and one that sends the user to inspect their package manager while a
             // captive portal is the real cause.
             this.recordGrammarFailure(grammarFile, reason ??
-                "The package manager skipped install scripts and the runtime download failed.", retryable);
+                "The package manager skipped install scripts and the runtime download failed.", retryable, "download-failed");
         }
         return ok;
     }
@@ -951,8 +988,14 @@ export class TreeSitterClient {
      * by the "no writable directory" and "download failed" arms of
      * `ensureGrammar` — both are failures of the SAME ensure attempt, just
      * with a different point of failure.
+     *
+     * `cause` is that point of failure (#3409). It picks the REMEDY the user is
+     * told and lands in the durable record, so `~/.pi-lens` forensics can tell
+     * "this host has nowhere to write" from "this download failed" — the two
+     * were one string, and the one it carried named build scripts and the
+     * network for a cause that is neither.
      */
-    recordGrammarFailure(grammarFile, detail, retryable) {
+    recordGrammarFailure(grammarFile, detail, retryable, cause) {
         const attempts = (this.grammarFailureAttempts.get(grammarFile) ?? 0) + 1;
         this.grammarFailureAttempts.set(grammarFile, attempts);
         // A durable verdict (404/410) never expires -- matches the issue's "a
@@ -964,17 +1007,29 @@ export class TreeSitterClient {
         this.grammarRetryAtMs.set(grammarFile, retryDelayMs === undefined
             ? Number.POSITIVE_INFINITY
             : Date.now() + retryDelayMs);
-        const unavailable = retryable
-            ? `tree-sitter grammar '${grammarFile}' is unavailable — symbol search, ` +
-                `module reports and structural rules for this language will be degraded. ` +
-                `${detail} pi-lens will retry automatically in ${Math.round(retryDelayMs / 1000)}s; ` +
-                `if the problem persists, allow the package manager's build scripts ` +
-                `(pnpm approve-builds / bun trustedDependencies) or restore network access.`
-            : `tree-sitter grammar '${grammarFile}' is unavailable — symbol search, ` +
-                `module reports and structural rules for this language will be degraded. ` +
-                `${detail} The grammar source reports it does not exist (not a network problem), so this will not ` +
-                `resolve on retry. Fix: reinstall with a manager that runs postinstall, allow its build scripts ` +
-                `(pnpm approve-builds / bun trustedDependencies), or restore network access.`;
+        // The remedy the user is given, keyed to WHERE the attempt failed. The
+        // last two arms are the pre-existing strings, byte for byte; the first
+        // two exist because sending someone to `pnpm approve-builds` and their
+        // network for a resolution or permission fault is the #3409 complaint.
+        const remedy = cause === "write-dir-unresolvable"
+            ? `This is a packaging/module-resolution fault, not a download problem: reinstall pi-lens so its ` +
+                `web-tree-sitter dependency is present, or drop the wasm into pi-lens's own grammars/ directory.`
+            : cause === "write-dir-unwritable"
+                ? `This is a filesystem-permission fault, not a download problem: make that directory writable ` +
+                    `for the user pi-lens runs as, or reinstall pi-lens as that user.`
+                : retryable
+                    ? `if the problem persists, allow the package manager's build scripts ` +
+                        `(pnpm approve-builds / bun trustedDependencies) or restore network access.`
+                    : `Fix: reinstall with a manager that runs postinstall, allow its build scripts ` +
+                        `(pnpm approve-builds / bun trustedDependencies), or restore network access.`;
+        const unavailable = `tree-sitter grammar '${grammarFile}' is unavailable — symbol search, ` +
+            `module reports and structural rules for this language will be degraded. ` +
+            `${detail} ` +
+            (retryable
+                ? `pi-lens will retry automatically in ${Math.round(retryDelayMs / 1000)}s; `
+                : `The grammar source reports it does not exist (not a network problem), so this will not ` +
+                    `resolve on retry. `) +
+            remedy;
         logTreeSitterDiagnostic({
             subsystem: "tree-sitter-client",
             message: unavailable,
@@ -984,6 +1039,12 @@ export class TreeSitterClient {
                 retryable,
                 retryDelayMs,
                 attempts,
+                // Omitted, not defaulted, for the arms that are neither a fetch
+                // destination nor a download verdict (a vendored grammar is never
+                // downloaded; a decode failure happened AFTER a successful one), so
+                // those records keep their pre-#3409 shape rather than carrying a
+                // cause that is not true of them.
+                ...(cause ? { cause } : {}),
             },
         });
         // #1536 review F1: incrementDegradationCount keeps ONE ring-buffer slot

package/node_modules/pi-lens/dist/clients/turn-end/lane.js

@@ -0,0 +1,51 @@
+/**
+ * The ONE interface every turn-end delivery lane implements (#1892).
+ *
+ * `clients/runtime-turn.ts`'s `handleTurnEnd` grew fourteen delivery lanes
+ * inline: each read its own store, applied its own freshness/disposition
+ * policy, and formatted its own section into `blockerParts`/`advisoryParts`,
+ * so the composer had to know every lane's rules and no lane could be read,
+ * tested, or reasoned about on its own. The lanes converged on ONE shape
+ * anyway — read a store, gate the rows, render a tier — and that shape is
+ * this module. A lane is a deep module: three narrow calls over whatever its
+ * store's rules happen to be, and the composer states none of them.
+ *
+ * ── The three stages, and why they are three ──────────────────────────────
+ *
+ * 1. `collect(ctx)` — read this lane's stores and declare, per STORE, the
+ *    findings plus the freshness policy that store's rows need. It returns
+ *    structured rows keyed by store name (the source identity the shared
+ *    pass and its bounded records carry), never a rendered string.
+ *
+ *    It does NOT call the freshness gate. #3264 folded the turn-end scanner
+ *    stores into ONE `gateFindingsByPathFreshness` call so a file two stores
+ *    cite is stat'd once, spends one stat budget, and writes one bounded
+ *    decision record per delivery instead of up to six. A lane that gated
+ *    itself would re-split that pass the moment a second lane appeared, so
+ *    the pass is the COMPOSER's (it is a cross-lane resource — a filesystem
+ *    pass, a budget and a record, not a per-lane rule), and a lane only
+ *    DECLARES its sources. `tests/config/turn-end-lane-boundaries.test.ts`
+ *    pins that: a lane that calls the gate itself reds.
+ *
+ * 2. `gate(gates, ctx)` — apply the per-lane policy the shared pass cannot:
+ *    dispositions (`filterFindingsByDisposition`, the seam in
+ *    `clients/dispatch/finding-policy.ts`), and whatever existence or
+ *    lifecycle contract the lane's own store carries. Takes the freshness
+ *    partition the composer got for THIS lane's sources and returns the
+ *    lane's own kept shape, which no other module reads.
+ *
+ * 3. `render(kept, ctx)` — format the tiers. A lane returns its sections; it
+ *    never pushes into the turn's arrays. The push stays in the composer so
+ *    the `@delivery-surface:` seam scan in
+ *    `tests/clients/finding-delivery-gate.test.ts` — which reads
+ *    `clients/runtime-turn.ts` and `tools/lens-diagnostics.ts` — keeps seeing
+ *    every agent-facing render seam. A lane that pushed from its own file
+ *    would be invisible to that scan; the boundary test reds on it.
+ *
+ * The composer still owns everything that is not one lane's rule: the order
+ * the tiers are assembled in, the display and message caps, the turn
+ * signature dedupe, the `turn-end-findings` cache write, the git-guard
+ * record, and the one-per-turn disposition-suppressed notice that every
+ * lane's counts fold into.
+ */
+export {};

package/node_modules/pi-lens/dist/clients/turn-end/lanes/govulncheck.js

@@ -0,0 +1,112 @@
+/**
+ * The turn-end GOVULNCHECK lane (#1892): the session_start-cached Go CVE
+ * store, rendered as ONE advisory tier.
+ *
+ * One lane, one store, one tier — the straight second extraction against the
+ * `TurnEndLane` interface, and the first lane that renders an ADVISORY
+ * section (see `TurnEndLaneParts.advisoryParts` and ADR 0008's amendment for
+ * why that field arrives with this lane rather than with the interface).
+ *
+ * Registered surface (`clients/finding-delivery-gate.ts`):
+ * `runtime-turn:govulncheck-advisory` — mode `gated`, evidence
+ * `scannerGates.govulncheck` (the composer's own binding of the shared pass's
+ * result, unchanged by this extraction).
+ *
+ * History this file must not lose (each line below is a shipped defect or a
+ * review finding):
+ *
+ * - #1622 sibling sweep: govulncheck renders a call site as `file:line` off a
+ *   session_start snapshot — the same stale-line shape as gitleaks, one tier
+ *   lower. A file edited after the scan keeps its CVE and loses its line,
+ *   plus the `STALE_LINE_MARKER`.
+ * - #1622 review H1: a CVE is pinned by `go.mod`, NOT by the call site, so a
+ *   DELETED traced file may not drop it — `onMissing: "demote"` routes a
+ *   vanished path into the same arm as an edited one. The first cut dropped
+ *   it, and `citedPath` reads only the FIRST filename frame, so one deleted
+ *   file in a long trace silently killed a CVE go.mod still pins.
+ * - #1694 F1: these findings pass through `filterFindingsByDisposition` with
+ *   the SAME `ProjectDiagnostic` identity `lens_diagnostics mode=full`
+ *   surfaces, over BOTH freshness arms — a mark made against what the agent
+ *   was SHOWN is honoured here too.
+ * - #1627 + #1625 review: the post-gate row guard and the post-disposition
+ *   row guard are the SAME guard — `render` tests the list it is about to
+ *   print, never the raw cache length, or the header prints with zero rows
+ *   beneath it whenever either filter empties the list.
+ */
+import { filterFindingsByDisposition } from "../../dispatch/finding-policy.js";
+import { toRunnerDisplayPath } from "../../dispatch/runner-context.js";
+import { govulncheckFindingToProjectDiagnostic } from "../../project-diagnostics/runner-adapters/govulncheck.js";
+import { STALE_LINE_MARKER } from "../../stale-marker.js";
+/**
+ * #1622 H1: `onMissing: "demote"`, not the default `"drop"`. A Go CVE is
+ * pinned by `go.mod`; the traced call site is only where it is reachable
+ * FROM, so a deleted trace file means "the line is unusable", never "the
+ * vulnerability is gone". `citedPath` reads the first filename frame, which
+ * is also the frame `render` prints — the path the verdict is about is the
+ * path the agent is shown.
+ */
+async function collect(ctx) {
+    const data = (await ctx.readScannerCache("govulncheck"))
+        ?.data;
+    return {
+        govulncheck: {
+            findings: data?.findings ?? [],
+            scannedAt: data?.scannedAt,
+            citedPath: (finding) => finding.trace.find((frame) => frame.filename)?.filename,
+            onMissing: "demote",
+        },
+    };
+}
+/**
+ * #1694 F1/#1625 review round: the freshness gate runs FIRST, so the
+ * disposition anchor is derived from each finding's post-demotion identity —
+ * this list is already the gate's live+stale partition, never the raw
+ * pre-gate cache.
+ */
+function gate(gates, ctx) {
+    const stale = new Set(gates.govulncheck.stale);
+    const filtered = filterFindingsByDisposition([...gates.govulncheck.live, ...gates.govulncheck.stale], ctx.cwd, (f) => govulncheckFindingToProjectDiagnostic(ctx.cwd, f));
+    return {
+        findings: filtered.kept,
+        stale,
+        suppressed: filtered.suppressed,
+    };
+}
+function render(kept, ctx) {
+    // Lane-local accumulator, deliberately NOT named after the turn's tier:
+    // `advisoryParts` is the composer's array, and a lane that pushed into one
+    // would be a render seam the `@delivery-surface:` tag scan cannot see
+    // (`tests/config/turn-end-lane-boundaries.test.ts`).
+    const advisorySections = [];
+    // #1627/#1625: guard the list that is about to be printed, never the raw
+    // cache length — the header must not print with zero rows beneath it.
+    if (kept.findings.length) {
+        const findings = kept.findings.slice(0, 5);
+        let report = "🛡️ Go CVEs reachable from this code (govulncheck) — upgrade where possible:\n";
+        for (const f of findings) {
+            const callSite = f.trace.find((t) => t.filename);
+            const stale = kept.stale.has(f);
+            const where = callSite?.filename
+                ? `${toRunnerDisplayPath(ctx.cwd, callSite.filename)}${!stale && callSite.line ? `:${callSite.line}` : ""}${stale ? ` ${STALE_LINE_MARKER}` : ""}`
+                : (f.module ?? f.packageName ?? "(module)");
+            const fix = f.fixedVersion
+                ? ` — upgrade to ${f.fixedVersion} or later`
+                : " — no fix yet, track upstream";
+            report += `  ${f.osv} (${where})${fix}\n`;
+        }
+        if (kept.findings.length > findings.length) {
+            report += `  … and ${kept.findings.length - findings.length} more\n`;
+        }
+        advisorySections.push(report);
+    }
+    return {
+        advisoryParts: advisorySections,
+        dispositionSuppressed: { govulncheck: kept.suppressed },
+    };
+}
+/** The lane. Stateless — one object, no per-turn state to reset. */
+export const govulncheckLane = {
+    collect,
+    gate,
+    render,
+};

package/node_modules/pi-lens/dist/clients/turn-end/lanes/secrets.js

@@ -0,0 +1,204 @@
+/**
+ * The turn-end SECRETS lane (#1892): the gitleaks and trivy-secrets stores,
+ * their live 🔴 blocker tier and their demoted 🔑 tier.
+ *
+ * One lane, two stores, on purpose. The two secret scanners do not have a
+ * section each: #131 Mode 3 collapses them (and ast-grep's hardcoded-secret
+ * rules) BY LOCATION into one report with combined provenance, because a
+ * credential flagged by two tools needs rotating once, not twice — and the
+ * demoted tier merges the same two stores for the same reason. So "gitleaks"
+ * is not a separable delivery lane: splitting it out would leave every
+ * rendering rule (the dedupe, the ast-grep enrichment, the cap, both
+ * preambles) in the composer, which is the opposite of the extraction. The
+ * lane is the delivery contract; the stores are its sources.
+ *
+ * Registered surfaces (`clients/finding-delivery-gate.ts`):
+ * `runtime-turn:secrets-gitleaks`, `runtime-turn:secrets-trivy`,
+ * `runtime-turn:stale-secrets-tier`.
+ *
+ * History this file must not lose (each line below is a shipped defect):
+ *
+ * - #1617: these findings never passed through `applyDispositions`, so an
+ *   agent-marked false-positive re-reported as a 🔴 STOP blocker every turn.
+ * - #1625 review: the disposition filter runs AFTER the freshness gate, over
+ *   BOTH arms — an fp-marked finding that later goes stale must not reappear
+ *   in the demoted tier.
+ * - #1622 review M1: a demoted secret keeps its rule id and source; only the
+ *   line is withheld. An agent triages `aws-access-token` differently from a
+ *   low-confidence `generic-api-key`, and cannot do that from a bare path.
+ * - #1622 review M2: the demoted tier is its OWN tier, never `advisoryParts`
+ *   ("no action required this turn" directly above copy telling the agent to
+ *   re-scan).
+ */
+import { recordDegradationOnce } from "../../degradation-ledger.js";
+import { bounded } from "../../deadline-utils.js";
+import { filterFindingsByDisposition } from "../../dispatch/finding-policy.js";
+import { toRunnerDisplayPath } from "../../dispatch/runner-context.js";
+import { classifyAndFilterFindings, } from "../../gitleaks-client.js";
+import { HOOK_WALL_BUDGET_MS } from "../../hook-budgets.js";
+import { gitleaksFindingToProjectDiagnostic } from "../../project-diagnostics/runner-adapters/gitleaks.js";
+import { trivySecretFindingToProjectDiagnostic } from "../../project-diagnostics/runner-adapters/trivy.js";
+import { dedupeSecretFindings, fromAstGrepWarnings, fromGitleaks, fromTrivySecrets, isSecretWarning, secretLocationKey, } from "../../secret-findings.js";
+import { STALE_LINE_MARKER } from "../../stale-marker.js";
+/**
+ * Gitleaks deliberately scans gitignored local files and nested repositories
+ * so an explicit security audit can still inspect them. The adapter is the
+ * source of truth for whether a finding belongs in a blocking delivery lane;
+ * filter here before freshness handling so demoted findings cannot leak into
+ * either the blocker or the stale-secret turn context.
+ */
+async function blockingGitleaksFindings(data, ctx) {
+    const classification = await bounded(classifyAndFilterFindings(data?.findings ?? [], ctx.cwd), {
+        ms: HOOK_WALL_BUDGET_MS.turn_end,
+        signal: ctx.signal,
+        hook: "turn_end",
+        label: "classifyAndFilterFindings",
+    });
+    if (classification === undefined) {
+        recordDegradationOnce({
+            kind: "gitleaks_classification_timeout",
+            subject: ctx.cwd,
+            reason: "gitleaks classification exceeded the turn_end budget; retained raw findings to fail open",
+        });
+    }
+    return (classification ?? data?.findings ?? []).filter((finding) => gitleaksFindingToProjectDiagnostic(ctx.cwd, finding).semantic ===
+        "blocking");
+}
+/**
+ * #1460/#1622: the gitleaks cache is TTL-only, so a finding for a file deleted
+ * after the scan was served as a 🔴 blocker for the rest of the 30-minute
+ * window — 119 of 126 findings in pi-lens's own cache. This lane is the single
+ * agent-facing consumer of that store (session_start's read only decides
+ * whether to re-scan; the project-diagnostics path re-scans fresh and
+ * reconciles at load), so the drop belongs here, before the findings enter the
+ * shared secret pipeline. A cited file EDITED after the scan keeps its finding
+ * but loses its line number: the credential may still be there, just not where
+ * the snapshot says. Dropping instead would let any edit — malicious or
+ * accidental — mute a real secret. Both stores take the default
+ * `onMissing: "drop"`: the finding IS the deleted file's content.
+ */
+async function collect(ctx) {
+    // One await for both stores: the two reads are independent, and the memo
+    // hands each of them the same promise the composer's own trivy read shares.
+    const [gitleaksEntry, trivyEntry] = await Promise.all([
+        ctx.readScannerCache("gitleaks"),
+        ctx.readScannerCache("trivy"),
+    ]);
+    const gitleaksData = gitleaksEntry?.data;
+    const trivyData = trivyEntry?.data;
+    return {
+        gitleaks: {
+            findings: await blockingGitleaksFindings(gitleaksData, ctx),
+            citedPath: (finding) => finding.file,
+            scannedAt: gitleaksData?.scannedAt,
+        },
+        "trivy-secrets": {
+            findings: trivyData?.secrets ?? [],
+            citedPath: (finding) => finding.file,
+            scannedAt: trivyData?.scannedAt,
+        },
+    };
+}
+/**
+ * #1617/#1625/#1628: filter through the SAME `ProjectDiagnostic` identity
+ * `lens_diagnostics mode=full` surfaces (tool="gitleaks",
+ * rule="gitleaks:<ruleId>" / tool="trivy", rule="trivy-secret:<ruleId>"), so a
+ * mark made against what the agent was SHOWN is honored here too — and over
+ * both arms, never live-only.
+ *
+ * ast-grep secret findings need no filtering here: they already went through
+ * dispatch's `applyDispositions` before reaching `peekActionableWarnings()`.
+ */
+function gate(gates, ctx) {
+    const gitleaksLive = filterFindingsByDisposition(gates.gitleaks.live, ctx.cwd, (f) => gitleaksFindingToProjectDiagnostic(ctx.cwd, f));
+    const gitleaksStale = filterFindingsByDisposition(gates.gitleaks.stale, ctx.cwd, (f) => gitleaksFindingToProjectDiagnostic(ctx.cwd, f));
+    const trivyLive = filterFindingsByDisposition(gates["trivy-secrets"].live, ctx.cwd, (f) => trivySecretFindingToProjectDiagnostic(ctx.cwd, f));
+    const trivyStale = filterFindingsByDisposition(gates["trivy-secrets"].stale, ctx.cwd, (f) => trivySecretFindingToProjectDiagnostic(ctx.cwd, f));
+    return {
+        gitleaksLive: gitleaksLive.kept,
+        gitleaksStale: gitleaksStale.kept,
+        trivyLive: trivyLive.kept,
+        trivyStale: trivyStale.kept,
+        suppressed: {
+            gitleaks: gitleaksLive.suppressed + gitleaksStale.suppressed,
+            "trivy-secrets": trivyLive.suppressed + trivyStale.suppressed,
+        },
+    };
+}
+function render(kept, ctx) {
+    const sessionSecrets = dedupeSecretFindings([
+        ...fromGitleaks(kept.gitleaksLive),
+        ...fromTrivySecrets(kept.trivyLive),
+    ]);
+    // Locations already surfaced as session-scan secret blockers — used to
+    // enrich provenance where ast-grep agrees, and handed back so the
+    // actionable-warnings advisory can suppress its duplicate ast-grep copy.
+    const deliveredLocationKeys = new Set(sessionSecrets.map((f) => secretLocationKey(f.file, f.line)));
+    // Lane-local accumulators, deliberately NOT named after the turn's tiers:
+    // `blockerParts`/`staleSecretParts` are the composer's arrays, and a lane
+    // that pushed into one would be a render seam the `@delivery-surface:` tag
+    // scan cannot see (`tests/config/turn-end-lane-boundaries.test.ts`).
+    const blockerSections = [];
+    if (sessionSecrets.length) {
+        // Fold in ast-grep provenance ONLY where it coincides with a session
+        // secret — don't promote ast-grep-only findings out of their advisory
+        // tier.
+        const enriched = dedupeSecretFindings([
+            ...sessionSecrets,
+            ...fromAstGrepWarnings(ctx.peekActionableWarnings().filter(isSecretWarning)).filter((a) => deliveredLocationKeys.has(secretLocationKey(a.file, a.line))),
+        ]);
+        const shown = enriched.slice(0, 5);
+        let report = "🔴 STOP — hardcoded secrets detected. Rotate the credentials and remove them from source:\n";
+        for (const f of shown) {
+            const where = `${toRunnerDisplayPath(ctx.cwd, f.file)}:${f.line}`;
+            report += `  ${where} — ${f.rule} [${f.sources.join(" + ")}]${f.description ? `: ${f.description}` : ""}\n`;
+        }
+        if (enriched.length > shown.length) {
+            report += `  … and ${enriched.length - shown.length} more\n`;
+        }
+        blockerSections.push(report);
+    }
+    // Demoted secrets are addressed by FILE, never by line — the line is the one
+    // field the edit invalidated. Deduped on file+rule+source so a file with
+    // twenty stale hits of one rule is named once.
+    const staleSecretEntries = [
+        ...kept.gitleaksStale.map((f) => ({
+            file: toRunnerDisplayPath(ctx.cwd, f.file),
+            rule: f.ruleId,
+            source: "gitleaks",
+        })),
+        ...kept.trivyStale.map((f) => ({
+            file: toRunnerDisplayPath(ctx.cwd, f.file),
+            rule: f.ruleId,
+            source: "trivy",
+        })),
+    ];
+    const staleSecrets = [
+        ...new Map(staleSecretEntries.map((e) => [`${e.file}|${e.rule}|${e.source}`, e])).values(),
+    ];
+    const staleSections = [];
+    if (staleSecrets.length) {
+        const shown = staleSecrets.slice(0, 5);
+        let report = `🔑 ACTION NEEDED — secrets were flagged in files that changed after the scan. ${STALE_LINE_MARKER}\n` +
+            "The cached line numbers are no longer trustworthy, so they are withheld. Re-run a secrets scan to confirm or clear these:\n";
+        for (const entry of shown) {
+            report += `  ${entry.file} — ${entry.rule} [${entry.source}]\n`;
+        }
+        if (staleSecrets.length > shown.length) {
+            report += `  … and ${staleSecrets.length - shown.length} more\n`;
+        }
+        staleSections.push(report);
+    }
+    return {
+        blockerParts: blockerSections,
+        staleSecretParts: staleSections,
+        dispositionSuppressed: kept.suppressed,
+        deliveredLocationKeys,
+    };
+}
+/** The lane. Stateless — one object, no per-turn state to reset. */
+export const secretsLane = {
+    collect,
+    gate,
+    render,
+};