@lumoai/cli 1.59.0 → 1.61.0

package/dist/cli/src/commands/task-status.js

@@ -43,7 +43,11 @@ function formatSecurityAction(a) {
     const where = a.line == null ? a.filePath : `${a.filePath}:${a.line}`;
     const title = (0, sanitize_1.sanitizeField)(a.statement.split(' — ').slice(1).join(' — '));
     const tag = a.blocking ? 'blocks DONE' : 'advisory';
-    return `[${a.severity}] ${a.provenance} ${(0, sanitize_1.sanitizeField)(a.ruleId)} — ${(0, sanitize_1.sanitizeField)(where)} — ${title} (PR #${a.prNumber} · ${tag})`;
+    // LUM-758 follow-up: a downgraded row is still reported on purpose, so the
+    // line has to say WHY it is LOW — otherwise a placeholder the scanner already
+    // recognised reads as an unexplained credential.
+    const note = (0, sanitize_1.sanitizeField)((0, security_scan_1.secretDowngradeNote)(a.secretDowngrade));
+    return `[${a.severity}] ${a.provenance} ${(0, sanitize_1.sanitizeField)(a.ruleId)} — ${(0, sanitize_1.sanitizeField)(where)} — ${title} (PR #${a.prNumber} · ${tag}${note})`;
 }
 const SECURITY_HINT = 'Fix the findings and push (a fixed finding disappears on the next scan), or ask a human to disposition them in the web delivery panel — disposition is human-only, you cannot disposition them yourself, and a blocking finding refuses DONE with 409.';
 /** Render the `[SECURITY]` next-action lines (LUM-737 review): shared by the
@@ -57,40 +61,39 @@ function pushSecurityActions(lines, securityActions) {
 /** Fail-closed security coverage lines (LUM-737): a failed read and every
  *  open PR without a successful scan are stated, never left silent. */
 const EXTERNAL_ERROR_TAIL = 200;
-const SCAN_STAGE_ORDER = [
-    'secrets',
-    'external',
-    'supplyChain',
-    'judge',
-    'hunt',
-];
+const SCAN_STAGE_ORDER = security_scan_1.SCAN_STAGE_KEYS;
 /** LUM-735 — one line per linked PR's latest scan: `PR #945 · scan CLEAN ·
- *  secrets RAN · external RAN (2 external findings) · supplyChain RAN
- *  (1 dependency finding, 1 already on main) · judge RAN · hunt RAN`.
+ *  Secrets: checked · Code scan: checked (2 external findings) ·
+ *  Dependencies: checked (1 dependency finding, 1 already on main) ·
+ *  AI review: checked · Exploit paths: checked`.
  *  Stage segments only for keys present, in
  *  secrets/external/supplyChain/judge/hunt order (LUM-739 added the hunt
- *  layer); the `(N external findings)` count only decorates the external
+ *  layer); the `(N external findings)` count only decorates the Code scan
  *  segment, the dependency count (LUM-738, with its already-on-main share)
- *  only the supplyChain segment, and each only when N > 0. */
+ *  only the Dependencies segment, and each only when N > 0.
+ *  LUM-763: the stage keys are internal — what prints is the display label
+ *  from `shared/src/security-scan.ts`, the same map the GitHub PR summary
+ *  and the web panel render from. */
 function formatScanSummaryLine(s) {
     const segments = [];
     for (const key of SCAN_STAGE_ORDER) {
         const state = s.stages[key];
         if (!state)
             continue;
+        const head = `${(0, security_scan_1.scanStageLabel)(key)}: ${(0, security_scan_1.scanStageStateLabel)(state)}`;
         if (key === 'external' && s.externalFindings > 0) {
             const noun = s.externalFindings === 1 ? 'finding' : 'findings';
-            segments.push(`external ${state} (${s.externalFindings} external ${noun})`);
+            segments.push(`${head} (${s.externalFindings} external ${noun})`);
         }
         else if (key === 'supplyChain' && (s.dependencyFindings ?? 0) > 0) {
             const n = s.dependencyFindings ?? 0;
             const noun = n === 1 ? 'finding' : 'findings';
             const persisting = s.persistingFindings ?? 0;
             const tail = persisting > 0 ? `, ${persisting} already on main` : '';
-            segments.push(`supplyChain ${state} (${n} dependency ${noun}${tail})`);
+            segments.push(`${head} (${n} dependency ${noun}${tail})`);
         }
         else {
-            segments.push(`${key} ${state}`);
+            segments.push(head);
         }
     }
     let line = `  PR #${s.prNumber} · scan ${s.status}`;
@@ -108,6 +111,29 @@ function formatScanSummaryLine(s) {
     }
     return line;
 }
+/**
+ * LUM-762 — the hunt's per-task read-out, one indented line under its scan:
+ * `Exploit paths 2/3 done · t1 idor 41.2s done · t2 injection 72.0s done
+ * (2 attempts) · t3 race skipped`. Headed by the same display label as the
+ * layer's own segment (LUM-763) — the detail line and the line above it
+ * must not name the layer two different ways. This is the only place the stored `huntAudit` surfaces, so
+ * it is what answers "how long does a healthy batch take" and "which ones
+ * never ran" (`skipped`) without paging through deploy logs. Elapsed time is
+ * summed over a task's attempts; a skipped task has none to print.
+ *
+ * LUM-758: a plan may hold two tasks of the same category, so the row is led
+ * by its task id. Pre-task-graph audits carry no id — the row then prints
+ * exactly as it always did.
+ */
+function formatHuntCoverageLine(hunt) {
+    const parts = hunt.categories.map(c => {
+        const attempts = c.attempts > 1 ? ` (${c.attempts} attempts)` : '';
+        const spent = c.stopped === 'skipped' ? '' : `${(c.elapsedMs / 1000).toFixed(1)}s `;
+        const id = c.taskId === undefined ? '' : `${c.taskId} `;
+        return `${id}${c.category} ${spent}${c.stopped}${attempts}`;
+    });
+    return `    ${(0, security_scan_1.scanStageLabel)('hunt')} ${hunt.done}/${hunt.total} done · ${parts.join(' · ')}`;
+}
 function pushSecurityCoverage(lines, data) {
     if (data.securityFindings === undefined)
         return; // older server
@@ -118,6 +144,10 @@ function pushSecurityCoverage(lines, data) {
     // LUM-735: absent `scans` = older server; tolerate silently, no block.
     for (const s of data.securityFindings.scans ?? []) {
         lines.push(formatScanSummaryLine(s));
+        // LUM-762: absent/null = older server or no usable audit — stay silent.
+        if (s.hunt && s.hunt.categories.length > 0) {
+            lines.push(formatHuntCoverageLine(s.hunt));
+        }
     }
     for (const u of data.securityFindings.unconfirmedPrs) {
         const why = u.reason === 'NONE'
@@ -581,15 +611,24 @@ function pushOpenCrossings(lines, extras) {
     const open = result.crossings;
     if (open.length === 0)
         return;
+    // LUM-771: say which rows the server DONE gate actually counts — advisory
+    // rows (and, with the gate off, non-HIGH rows) are awareness, not blockers.
+    const blocking = open.filter(c => c.blocking);
+    const rest = open.filter(c => !c.blocking);
     lines.push('');
-    lines.push(`⚠ Open boundary crossings (${open.length} undispositioned):`);
+    lines.push(`⚠ Open boundary crossings (${open.length} undispositioned: ${blocking.length} blocking DONE, ${rest.length} advisory / non-blocking):`);
     for (const c of open) {
         const detail = oneLineDetail(c.detail);
         const tail = detail ? ` — ${detail}` : '';
-        lines.push(`  • [${c.severity}] ${(0, sanitize_1.sanitizeField)(c.category)}${tail}`);
+        const gate = c.blocking
+            ? ''
+            : c.advisory
+                ? ' (advisory — does not block DONE)'
+                : ' (below the workspace gate — does not block DONE)';
+        lines.push(`  ${c.blocking ? '•' : '◦'} [${c.severity}] ${(0, sanitize_1.sanitizeField)(c.category)}${gate}${tail}`);
         lines.push(`    ${formatAttribution(c.attribution)}`);
     }
-    lines.push('  Disposition is human-only in the web acceptance panel:');
+    lines.push("  Disposition is the user's call: relay each crossing, then `lumo crossing disposition <id> --false-positive | --confirmed` (exit-4 envelope; never self-approve), or the web acceptance panel:");
     if (extras.dispositionUrl) {
         lines.push(`    ${extras.dispositionUrl}`);
     }

package/dist/cli/src/commands/task-update.js

@@ -391,7 +391,7 @@ async function runTaskUpdate(identifier, opts, collected) {
             if (res.status === 409 &&
                 status === 'DONE' &&
                 (0, blocked_error_1.isDoneGateRefusal)(serverMsg)) {
-                const { blockers, unconfirmed } = await (0, blocked_error_1.collectDoneBlockers)({
+                const { blockers, unconfirmed, nonBlocking } = await (0, blocked_error_1.collectDoneBlockers)({
                     base,
                     token: creds.token,
                     identifier,
@@ -401,6 +401,7 @@ async function runTaskUpdate(identifier, opts, collected) {
                     message: serverMsg,
                     blockers,
                     unconfirmed,
+                    nonBlocking,
                     apiUrl,
                     workspaceSlug: creds.workspaceSlug ?? '',
                 }));

package/dist/cli/src/index.js

@@ -66,6 +66,7 @@ const priority_1 = require("./commands/priority");
 const criteria_audit_1 = require("./commands/criteria-audit");
 const verify_1 = require("./commands/verify");
 const crossing_explain_1 = require("./commands/crossing-explain");
+const crossing_disposition_1 = require("./commands/crossing-disposition");
 const outcome_1 = require("./commands/outcome");
 const task_context_1 = require("./commands/task-context");
 const task_create_1 = require("./commands/task-create");
@@ -274,12 +275,23 @@ program
     .action(wrap((task, options) => (0, verify_1.verify)(task, options)));
 const crossing = program
     .command('crossing')
-    .description('Inspect and annotate boundary crossings');
+    .description('Inspect, annotate and (with user approval) disposition boundary crossings');
 crossing
     .command('explain <id>')
     .description('Append an agent self-explanation ("申辩") to a boundary crossing (LUM-542). Append-only and for the human reviewer — it never clears the crossing or unblocks Done (a human dispositions that). Targets a crossing on the session-bound task.')
     .requiredOption('--note <text>', 'The explanation to record (the rationale for the action / why it may be a false positive)')
     .action(wrap((id, options) => (0, crossing_explain_1.crossingExplain)(id, options)));
+crossing
+    .command('disposition <id>')
+    .description("Rule on a boundary crossing from the terminal (LUM-769) through a three-step confirmation handshake the server enforces: (1) no step flag — prints the crossing (severity, detail, agent explanations) as an envelope with a stage-1 read receipt, exit 4, writes nothing; (2) --confirm-read --receipt <r1> after the user confirms they READ it — returns the stage-2 receipt and a second envelope for the ruling, exit 4; (3) --confirm --receipt <r2> after the user approves the ruling — writes. Confirming before the read is acknowledged is refused and told to confirm the read first. Relay each envelope; never supply a step flag yourself. Either ruling clears the crossing's block on DONE and is audited as a CLI-channel disposition. Reverting to OPEN and repository suppression rules stay web-only. Targets a crossing on the session-bound task unless --task is given.")
+    .option('--false-positive', 'Rule the crossing a false positive (not a real issue)')
+    .option('--confirmed', 'Rule the crossing confirmed (a real issue, acknowledged)')
+    .option('--note <text>', 'Optional disposition note recorded with the ruling')
+    .option('--task <identifier>', 'Task the crossing belongs to (defaults to the session-bound task)')
+    .option('--receipt <token>', "Read receipt from the previous step's envelope (its confirmCommand carries it); required with --confirm-read (stage 1 receipt) and --confirm (stage 2 receipt), verified server-side")
+    .option('--confirm-read', 'Step 2: the user confirmed they have read the envelope (never add this on your own initiative). Returns the ruling envelope; writes nothing')
+    .option('--confirm', 'Step 3: the user approved the ruling (never add this on your own initiative). Refused unless the read was confirmed first')
+    .action(wrap((id, options) => (0, crossing_disposition_1.crossingDisposition)(id, options)));
 const outcome = program
     .command('outcome')
     .description('Read the post-hoc outcome well (LUM-598)');
@@ -744,11 +756,10 @@ milestoneCmd
     .action(wrap((identifier, options) => (0, milestone_show_1.milestoneShow)(identifier, options)));
 milestoneCmd
     .command('update <identifier>')
-    .description('Update a milestone. Provide at least one of --name, --description, --status, --start, --target, --token-budget. Use "" to clear nullable fields.')
+    .description('Update a milestone. Provide at least one of --name, --description, --start, --target, --token-budget. Use "" to clear nullable fields. Completion is derived from task completion (LUM-714) — there is no status flag.')
     .option('--project <ref>', 'Project name or slug (when identifier is a name)')
     .option('-n, --name <text>', 'New name')
     .option('-d, --description <text>', 'New description (empty string to clear)')
-    .option('-s, --status <value>', 'New status: planned | active | completed | cancelled (case-insensitive)')
     .option('--start <date>', 'Start date YYYY-MM-DD (empty string to clear)')
     .option('--target <date>', 'Target date YYYY-MM-DD (empty string to clear)')
     .option('--token-budget <tokens>', 'Advisory token budget, positive integer (empty string to clear). Overview shows burn vs budget; over-budget raises a risk-queue alert — never a hard gate.')

package/dist/cli/src/lib/blocked-error.js

@@ -13,10 +13,14 @@ exports.emitBlocked = emitBlocked;
  * The confirmation protocol (confirmation.ts, exit 4) covers mutations the
  * USER can approve. Some refusals are different in kind: the server's DONE
  * gates — an unresolved send-back, an undispositioned boundary crossing, a
- * blocking security finding — are verdicts on the agent's own work, and by
- * design there is no CLI path to clear them (the interested party may not
- * adjudicate itself). Echoing the 409 text and exiting 1 left the agent
- * grepping prose to learn that. Instead the CLI now:
+ * blocking security finding — are verdicts on the agent's own work, and the
+ * agent may not adjudicate itself: nothing on `task update` clears them.
+ * Since LUM-769 a boundary crossing does have a terminal path, but it is the
+ * USER's — `lumo crossing disposition` walks the same exit-4 protocol (the
+ * agent relays the crossing, the user rules, the agent re-runs with the
+ * approval flag); send-backs and security findings stay human-side / web.
+ * Echoing the 409 text and exiting 1 left the agent grepping prose to learn
+ * that. Instead the CLI now:
  *
  *   1. recognises the gate refusal (`isDoneGateRefusal`);
  *   2. re-reads the existing read models — `GET …/status` for send-backs and
@@ -42,6 +46,7 @@ async function collectDoneBlockers(args) {
     const { base, token, identifier } = args;
     const blockers = [];
     const unconfirmed = [];
+    const nonBlocking = [];
     const headers = { Authorization: `Bearer ${token}` };
     // Send-backs + blocking security findings: the acceptance-status read model.
     try {
@@ -87,22 +92,36 @@ async function collectDoneBlockers(args) {
         unconfirmed.push(`boundary-crossings read failed: ${crossings.reason}`);
     }
     else {
+        // LUM-771: mirror the server gate — an open row is a blocker only when
+        // the gate counts it; the rest are surfaced separately, never as blockers.
         for (const c of crossings.crossings) {
-            blockers.push({
-                kind: 'BOUNDARY_CROSSING',
-                id: c.id,
-                severity: c.severity,
-                category: c.category,
-                detail: c.detail,
-            });
+            if (c.blocking) {
+                blockers.push({
+                    kind: 'BOUNDARY_CROSSING',
+                    id: c.id,
+                    severity: c.severity,
+                    category: c.category,
+                    detail: c.detail,
+                });
+            }
+            else {
+                nonBlocking.push({
+                    id: c.id,
+                    severity: c.severity,
+                    category: c.category,
+                    detail: c.detail,
+                    advisory: c.advisory,
+                });
+            }
         }
     }
-    return { blockers, unconfirmed };
+    return { blockers, unconfirmed, nonBlocking };
 }
 /**
- * One line per blocker kind present. Every line names a human-side path or
- * the append-only `crossing explain` — never a flag or command that would let
- * the agent clear its own blocker.
+ * One line per blocker kind present. Every line names a human-side path, the
+ * append-only `crossing explain`, or the user-approved `crossing disposition`
+ * (exit-4 protocol) — never a ready-to-run flag that would let the agent
+ * clear its own blocker on its own initiative.
  */
 function buildRemediation(blockers, unconfirmed, ctx) {
     const kinds = new Set(blockers.map(b => b.kind));
@@ -114,7 +133,7 @@ function buildRemediation(blockers, unconfirmed, ctx) {
         const ids = blockers
             .filter(b => b.kind === 'BOUNDARY_CROSSING')
             .map(b => b.id);
-        lines.push(`BOUNDARY_CROSSING: leave a rationale with \`lumo crossing explain ${ids[0]} --note "…"\` (append-only; it does not clear anything). A human dispositions each crossing (false positive / confirmed) at ${ctx.dispositionUrl}`);
+        lines.push(`BOUNDARY_CROSSING: leave a rationale with \`lumo crossing explain ${ids[0]} --note "…"\` (append-only; it does not clear anything), then relay each crossing to the user. Once they rule, record it with \`lumo crossing disposition ${ids[0]} --false-positive\` or \`--confirmed\` — it prints an exit-4 envelope for the user to approve; never self-approve. The web panel also works: ${ctx.dispositionUrl}`);
     }
     if (kinds.has('SECURITY_FINDING')) {
         lines.push('SECURITY_FINDING: fix and push — a fixed fingerprint disappears from the next scan — or a human marks it false positive / accepted risk in the web delivery panel.');
@@ -133,6 +152,7 @@ function buildBlockedError(args) {
         task: args.identifier,
         message: args.message,
         blockers: args.blockers,
+        nonBlocking: args.nonBlocking ?? [],
         unconfirmed: args.unconfirmed,
         remediation: buildRemediation(args.blockers, args.unconfirmed, {
             identifier: args.identifier,
@@ -161,13 +181,20 @@ function renderBlocked(err, isTTY) {
         '',
         err.blockers.length > 0 ? 'Blockers:' : 'Blockers: (none listed)',
         ...err.blockers.map(b => `  • ${(0, sanitize_1.sanitizeField)(blockerLine(b))}`),
+        ...(err.nonBlocking.length > 0
+            ? [
+                '',
+                'Also open, not blocking DONE (advisory / below the workspace gate):',
+                ...err.nonBlocking.map(c => `  ◦ [${c.severity}${c.advisory ? ' advisory' : ''}] ${(0, sanitize_1.sanitizeField)(c.category)} ${c.id}: ${(0, sanitize_1.sanitizeField)(c.detail)}`),
+            ]
+            : []),
         ...(err.unconfirmed.length > 0
             ? ['', ...err.unconfirmed.map(u => `  ⚠ ${u}`)]
             : []),
         '',
         'What can move it:',
         ...err.remediation.map(r => `  - ${r}`),
-        `  Disposition (human-only): ${err.dispositionUrl}`,
+        `  Web disposition panel: ${err.dispositionUrl}`,
     ];
     return lines.join('\n') + '\n';
 }

package/dist/cli/src/lib/bound-task.js

@@ -0,0 +1,32 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.resolveBoundTask = resolveBoundTask;
+async function resolveBoundTask(args) {
+    const explicit = args.explicit?.trim();
+    if (explicit)
+        return { ok: true, taskIdentifier: explicit };
+    if (!args.sessionId) {
+        return {
+            ok: false,
+            message: 'Error: $CLAUDE_CODE_SESSION_ID is not set — run inside a session bound via `lumo session attach <LUM-N>`, or pass --task <LUM-N>.',
+        };
+    }
+    let bound;
+    try {
+        const res = await fetch(`${args.base}/api/sessions/${encodeURIComponent(args.sessionId)}`, { headers: args.headers });
+        bound = res.ok
+            ? (await res.json())
+            : null;
+    }
+    catch (err) {
+        const msg = err instanceof Error ? err.message : String(err);
+        return { ok: false, message: `Error: could not reach Lumo API (${msg})` };
+    }
+    if (!bound?.taskIdentifier) {
+        return {
+            ok: false,
+            message: 'Error: this session is not bound to a task. Run `lumo session attach <LUM-N>` first, or pass --task <LUM-N>.',
+        };
+    }
+    return { ok: true, taskIdentifier: bound.taskIdentifier };
+}

package/dist/cli/src/lib/confirmation.js

@@ -42,27 +42,54 @@ function shellQuote(arg) {
         return arg;
     return `'${arg.replace(/'/g, `'\\''`)}'`;
 }
+/** Flags that belong to a previous step of a handshake and must not carry
+ *  over into the next step's command: the step flags themselves and a prior
+ *  `--receipt <token>` pair (the next envelope brings its own receipt). */
+const STEP_FLAGS = new Set(['--confirm', '--confirm-read']);
+function stripStepFlags(argv) {
+    const out = [];
+    for (let i = 0; i < argv.length; i++) {
+        const a = argv[i];
+        if (STEP_FLAGS.has(a))
+            continue;
+        if (a === '--receipt') {
+            i++; // drop its value too
+            continue;
+        }
+        if (a.startsWith('--receipt='))
+            continue;
+        out.push(a);
+    }
+    return out;
+}
 /**
- * Rebuild the invocation the user ran, plus `--confirm` (and any
- * `extraFlags`). Flags already present in argv are never duplicated, and
- * `--confirm` always lands last so the command reads as "…, approved".
+ * Rebuild the invocation the user ran, plus the approval flag (default
+ * `--confirm`) and any `extraFlags`. Step flags and a prior `--receipt` from
+ * an earlier handshake step are dropped first, flags already present in argv
+ * are never duplicated, and the approval flag always lands last so the
+ * command reads as "…, approved".
  */
-function buildConfirmCommand(argv = process.argv.slice(2), extraFlags = []) {
-    const kept = argv.filter(a => a !== '--confirm');
+function buildConfirmCommand(argv = process.argv.slice(2), extraFlags = [], confirmFlag = '--confirm') {
+    const kept = stripStepFlags(argv);
     const parts = ['lumo', ...kept.map(shellQuote)];
     for (const flag of extraFlags) {
         if (!kept.includes(flag))
             parts.push(flag);
     }
-    parts.push('--confirm');
+    parts.push(confirmFlag);
     return parts.join(' ');
 }
 function buildEnvelope(input) {
+    const extraFlags = [
+        ...(input.extraFlags ?? []),
+        ...(input.receipt ? ['--receipt', input.receipt.token] : []),
+    ];
     return {
         status: 'confirmation_required',
         command: input.command,
         changes: input.changes,
-        confirmCommand: buildConfirmCommand(input.argv, input.extraFlags),
+        confirmCommand: buildConfirmCommand(input.argv, extraFlags, input.confirmFlag ?? '--confirm'),
+        ...(input.receipt ? { receipt: input.receipt } : {}),
     };
 }
 /** JSON for pipes; the same fields as readable text for a terminal. */
@@ -72,7 +99,10 @@ function renderConfirmation(envelope, isTTY) {
     const lines = [
         `Confirmation required — \`lumo ${envelope.command}\` was not run.`,
         ...envelope.changes.map(c => `  - ${c}`),
-        'Re-run with --confirm once the user has approved:',
+        ...(envelope.receipt
+            ? [`Read receipt issued (valid until ${envelope.receipt.expiresAt}).`]
+            : []),
+        `Re-run with ${envelope.confirmCommand.endsWith('--confirm-read') ? '--confirm-read' : '--confirm'} once the user has approved:`,
         `  ${envelope.confirmCommand}`,
     ];
     return lines.join('\n') + '\n';

package/dist/cli/src/lib/open-crossings.js

@@ -1,8 +1,17 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
+exports.blocksDone = blocksDone;
 exports.fetchOpenCrossings = fetchOpenCrossings;
 exports.dispositionUrl = dispositionUrl;
 const api_1 = require("./api");
+/**
+ * LUM-771: the server's DONE-gate predicate for one open crossing (mirrors
+ * `assertNoUnacknowledgedBoundaryCrossings` and the panel): an advisory row
+ * never blocks; with the workspace gate disabled only HIGH rows block.
+ */
+function blocksDone(c, gateEnabled) {
+    return !c.advisory && (gateEnabled || c.severity === 'HIGH');
+}
 const SEVERITY_RANK = {
     HIGH: 3,
     MEDIUM: 2,
@@ -28,9 +37,9 @@ function normalizeSeverity(s) {
  * first, via the EXISTING LUM-435 read endpoint — `GET …/boundary-crossings`
  * returns every crossing (open and dispositioned); we keep only the
  * undispositioned ones (`disposition == null`). This is the **read/awareness**
- * half of the acceptance loop: there is no new query and, by construction, no
- * way to clear a crossing — disposition stays web + human-only
- * (LUM-426/435/422).
+ * half of the acceptance loop: there is no new query and this helper cannot
+ * clear anything — a ruling goes through `lumo crossing disposition` (exit-4
+ * user approval, LUM-769) or the web panel.
  *
  * Fails *closed*, not open (LUM-480): any transport / non-ok HTTP / parse
  * failure returns `{ status: 'error', reason }` so the caller can say "check
@@ -62,22 +71,33 @@ async function fetchOpenCrossings(apiUrl, token, taskIdentifier) {
         return { status: 'error', reason: 'invalid response body' };
     }
     const rows = Array.isArray(data.crossings) ? data.crossings : [];
+    // LUM-771: only an explicit `false` disables the gate — absent (older server)
+    // or malformed reads as enabled, so a hiccup can never hide a blocker.
+    const gateEnabled = data.gateEnabled !== false;
     const crossings = rows
         .filter(c => c.disposition == null)
-        .map(c => ({
-        id: c.id,
-        category: c.category,
-        severity: normalizeSeverity(c.severity),
-        detail: c.detail,
-        attribution: normalizeAttribution(c.attribution),
-    }))
-        .sort((a, b) => SEVERITY_RANK[b.severity] - SEVERITY_RANK[a.severity]);
-    return { status: 'ok', crossings };
+        .map(c => {
+        const severity = normalizeSeverity(c.severity);
+        const advisory = c.advisory === true;
+        return {
+            id: c.id,
+            category: c.category,
+            severity,
+            detail: c.detail,
+            attribution: normalizeAttribution(c.attribution),
+            advisory,
+            blocking: blocksDone({ advisory, severity }, gateEnabled),
+        };
+    })
+        // Blocking rows first, then by severity — what the human must act on leads.
+        .sort((a, b) => Number(b.blocking) - Number(a.blocking) ||
+        SEVERITY_RANK[b.severity] - SEVERITY_RANK[a.severity]);
+    return { status: 'ok', crossings, gateEnabled };
 }
 /**
- * The web deep link where a HUMAN dispositions crossings. Disposition is
- * web-only and human-only (LUM-426/435/422); the terminal only ever points
- * here, it never clears anything itself. Built from the workspace slug +
+ * The web deep link where a human dispositions crossings in the panel — the
+ * counterpart of `lumo crossing disposition` (LUM-769); the awareness surfaces
+ * (task status, DONE_BLOCKED) point here. Built from the workspace slug +
  * identifier alone (the `/my-tasks/<id>` route needs no project slug), so no
  * extra fetch is required.
  */

package/dist/shared/src/security-scan.js

@@ -1,7 +1,10 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.EXTERNAL_ERROR_PREFIX = void 0;
+exports.SECRET_DOWNGRADE_LABELS = exports.SCAN_STAGE_STATE_LABELS = exports.SCAN_STAGE_LABELS = exports.SCAN_STAGE_STATES = exports.SCAN_STAGE_KEYS = exports.EXTERNAL_ERROR_PREFIX = void 0;
 exports.externalFailureReason = externalFailureReason;
+exports.scanStageLabel = scanStageLabel;
+exports.scanStageStateLabel = scanStageStateLabel;
+exports.secretDowngradeNote = secretDowngradeNote;
 /**
  * PR security scan — the one `PrSecurityScan.error` shape that may be shown
  * as an external-scanner reason (spec P8). Shared by the web panel, the PR
@@ -27,3 +30,96 @@ function externalFailureReason(error) {
     const reason = error.slice(exports.EXTERNAL_ERROR_PREFIX.length);
     return reason.length > 0 ? reason : null;
 }
+/**
+ * LUM-763 — the scan's five layers, as stored.
+ *
+ * These keys are a persisted contract, not a display choice: they sit in
+ * `PrSecurityScan.stages` on every historical row, travel over the
+ * task-status API, and are read by CLIs older than this change. They do not
+ * get renamed; only what a reader is shown does.
+ */
+exports.SCAN_STAGE_KEYS = [
+    'secrets',
+    'external',
+    'supplyChain',
+    'judge',
+    'hunt',
+];
+/** The states a layer can be in. `ScanStageState` in `lib/security-scan/types.ts` derives from this. */
+exports.SCAN_STAGE_STATES = [
+    'RAN',
+    'FAILED',
+    'SKIPPED',
+    'NOT_CONFIGURED',
+    'PENDING',
+    'PARTIAL',
+    'SUPERSEDED',
+];
+/**
+ * What each layer is called where a person reads it — the PR comment and
+ * `lumo task status`, which share this map so the two cannot drift (the web
+ * panel renders the same wording through `securityScan.stage.*` in i18n).
+ *
+ * Named for what the layer checks, never for who runs it or which model it
+ * uses: `external` was accurate only while the scanners were the customer's,
+ * and stopped being true the moment Lumo started running them itself.
+ */
+exports.SCAN_STAGE_LABELS = {
+    secrets: 'Secrets',
+    external: 'Code scan',
+    supplyChain: 'Dependencies',
+    judge: 'AI review',
+    hunt: 'Exploit paths',
+};
+/**
+ * What each state is called. `RAN` deliberately reads as "checked", not as a
+ * tick or "clean": it means the layer completed, and a layer that completed
+ * may well have found something — the findings are counted on their own
+ * lines. Only the states that leave the scan incomplete carry a glyph, so
+ * attention is drawn to "do not trust this line" and never to "this is fine"
+ * (spec P9 — a security signal never claims safety it did not establish).
+ */
+exports.SCAN_STAGE_STATE_LABELS = {
+    RAN: 'checked',
+    FAILED: '✗ failed',
+    SKIPPED: 'skipped',
+    NOT_CONFIGURED: 'off',
+    PENDING: 'scanning',
+    PARTIAL: '⚠ incomplete',
+    SUPERSEDED: '⚠ superseded',
+};
+/** The layer's display name; an unrecognised key renders as itself rather than vanishing. */
+function scanStageLabel(key) {
+    return exports.SCAN_STAGE_LABELS[key] ?? key;
+}
+/** The state's display name; an unrecognised state renders as itself. */
+function scanStageStateLabel(state) {
+    return exports.SCAN_STAGE_STATE_LABELS[state] ?? state;
+}
+/**
+ * LUM-758 follow-up — why a deterministic secret hit was lowered to LOW.
+ *
+ * Downgrading is not suppression: the row is still reported, deliberately, so
+ * that a human decides. But a reported row with no stated cause reads as an
+ * unexplained credential, which is how a test fixture the scanner *already
+ * recognised* as a placeholder ends up looking like an open risk. These say
+ * which rule fired, in the same words on every surface.
+ *
+ * Phrased as a property of the value or the path, never as a verdict: the
+ * scanner knows the string looks like a placeholder, not that it is harmless.
+ */
+exports.SECRET_DOWNGRADE_LABELS = {
+    PLACEHOLDER_VALUE: 'placeholder value',
+    DOWNGRADED_PATH: 'test/fixture/doc path',
+};
+/**
+ * The parenthesised note appended to a rendered finding line, or `''` when the
+ * row carries no downgrade — an unrecognised reason renders as itself rather
+ * than vanishing, so a value added server-side is never silently dropped by an
+ * older CLI.
+ */
+function secretDowngradeNote(reason) {
+    if (!reason)
+        return '';
+    return ` — ${exports.SECRET_DOWNGRADE_LABELS[reason] ?? reason}, downgraded`;
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@lumoai/cli",
-  "version": "1.59.0",
+  "version": "1.61.0",
   "description": "Lumo CLI — manage tasks and sessions from the terminal",
   "license": "MIT",
   "author": "cli@uselumo.ai",