@lumoai/cli 1.61.0 → 1.62.0

package/assets/skill/references/verify.md

@@ -145,6 +145,7 @@ what's unmet and why (the exact failure tails), and how many rounds are left.
 - **Next actions** — the unmet criteria (latest verdict is not a pass: failed or never verified, HUMAN ones included) followed by any **undispositioned PR security findings** (LUM-737) as `• [SECURITY] [SEVERITY] PROVENANCE ruleId — file:line — title (PR #n · blocks DONE | advisory[ — <cause>, downgraded])`. The trailing **downgrade cause** appears only on deterministic `secret:*` rows the scanner lowered to LOW — `placeholder value` (the matched string looks like `…EXAMPLE`, `YOUR_…`, `CHANGEME`…) or `test/fixture/doc path`. Downgrading is **not** suppression: the row is still reported so a human decides, and the cause is what lets you tell a recognised test fixture from a real leak without opening the file. Absent on rows scanned before the cause was recorded, and on any row that was not downgraded — silence means "not downgraded", never "cause unknown". This list IS the plan — recomputed from the event log + the latest scan per linked PR on every read, never maintained separately. The header counts them separately: `Next actions (N unmet · M security findings)`. A finding is **not** a criterion: fix it and push (a fixed fingerprint disappears from the next scan) or a human dispositions it in the web delivery panel — there is no CLI path to clear one, and a `blocks DONE` finding refuses DONE with 409. Empty + rounds recorded = awaiting human adjudication.
   - **Per-PR scan status** (LUM-735): before the unconfirmed-PR lines, one line per linked PR that has a latest scan (open or closed alike): `PR #945 · scan CLEAN · Secrets: checked · Code scan: checked (2 external findings) · Dependencies: checked (1 dependency finding, 1 already on main) · AI review: checked · Exploit paths: ⚠ incomplete` — stage segments only for keys present, in secrets/external/supplyChain/judge/hunt order. **The stage keys are internal; what prints is their display label** (LUM-763, `shared/src/security-scan.ts`, shared with the GitHub PR summary so the two cannot drift): `secrets`→Secrets, `external`→Code scan, `supplyChain`→Dependencies, `judge`→AI review, `hunt`→Exploit paths; states render as `RAN`→checked, `SKIPPED`→skipped, `NOT_CONFIGURED`→off, `PENDING`→scanning, `PARTIAL`→⚠ incomplete, `SUPERSEDED`→⚠ superseded, `FAILED`→✗ failed. "checked" means the layer completed, **not** that it found nothing — findings are counted in their own segments and in the next-actions list (`hunt` = the L3 vulnerability hunt, LUM-739: absent when `LUMO_SECURITY_HUNT=off`, `SKIPPED` when no trigger fired, `PENDING` while the workflow runs, `RAN` / `PARTIAL` (budget hit, a planned task that never finished, or more surviving candidates than the falsifier cap) / `FAILED`; its findings are `LLM_JUDGE` advisory, never `blocks DONE`); `(N external findings)` (singular at 1) decorates only the Code scan segment, and only when N > 0; `(N dependency findings[, M already on main])` (LUM-738; singular at 1) decorates only the Dependencies segment, only when N > 0, and prints bare `Dependencies: <state>` against an older server without the counts; ` · partial` appended when the scan is partial; and, when `stages.external === 'FAILED'` and a **scrubbed scanner reason** was recorded (the `error` column carries the `external: ` provenance prefix), an appended ` — <reason without the prefix, tail 200 chars>` — an unprefixed `error` (stage A's own raw crash text) is never printed here, same P8 rule as the web panel and the PR summary (LUM-756). Fed by the additive `securityFindings.scans` array; omitted entirely (no lines) against an older server that doesn't send it.
   - **Hunt coverage line** (LUM-762): indented under its scan line whenever the server sends the L3 hunt's per-category audit — `Exploit paths 2/3 done · t1 idor 41.2s done · t2 injection 72.0s done (2 attempts) · t3 race skipped`. `<n>/N done` is how many planned tasks finished (where N is the number of tasks the planning step selected for this scan, typically 0–3). Rows persisted before LUM-758 lack a planned-task count and fall back to the historical 6-category denominator (reading as `/6` instead). Each segment is `[taskId ]<category> <elapsed>s <stop>` — the `taskId` prefix (`t1`, `t2`, …) appears only on current rows where the task graph is present (post-LUM-758), and is omitted on pre-task-graph audit rows, so they render exactly as they always did. Elapsed is summed over the task's attempts; `(N attempts)` when the workflow retried it; no elapsed for a `skipped` task (the scan's budget ran out before its turn). Stop values: `done` · `steps` · `budget` · `timeout` · `error` · `skipped`. Headed by the same display label as the layer's own segment (LUM-763), so the detail line and the line above it never name the layer two different ways. This is the only surface that reads `huntAudit`, so it is where you answer "how long does a healthy task take" and "which tasks never ran" without paging through deploy logs. Absent on an older server and on scans with no usable audit (pre-LUM-739 rows, or a hunt that failed before its first batch) — no line, never a guess.
+  - **Queue exit** (LUM-775): a merged / closed PR's line ends with ` · N left the queue (a resolved on main, b merged unreviewed, c PR closed)` when any undispositioned row has left the queue — derived at read time, never stored. `resolved on main` = an external-tool finding whose fingerprint is absent from a default-branch baseline that can testify (landed, whole, requested after the merge, ran that tool); `merged unreviewed` = an advisory row whose PR merged without a decision (a policy-blocking row never exits this way — it stays a next action and keeps blocking DONE until a human decides, or until a fresh baseline shows it gone); `PR closed` = closed without merging, nothing landed (reopening the PR puts the rows back). Exited rows are not next actions, are not counted in `openFindings`, and show muted with the reason in the web panel. Absent on an older server. The workspace-wide read-out with per-row reasons is `scripts/analysis/lum775-finding-queue/report.ts`.
   - **Persisting findings** (LUM-738): a finding whose fingerprint is already on the repository's default-branch baseline (`persisting`) is not this PR's — it never appears as a next action, is not counted in `openFindings`, and shows muted (_already on the default branch_) in the web panel. Dependency findings (`kind=DEPENDENCY`, from osv-scanner) are advisory: they never block DONE.
   - **Fails closed:** `⚠ Security-scan check failed — could not confirm …` when the scan read errored, and one `⚠ PR #n: … — could not confirm it is clean.` line per open PR whose latest scan is missing / FAILED / still running. Silence means a successful read with nothing open, never a failed check.
 - **Open boundary crossings** — a trailing safety block when the task has ≥1 OPEN (undispositioned) forbidden-action crossing: a count split the way the server DONE gate counts it — `(N undispositioned: B blocking DONE, A advisory / non-blocking)` (LUM-771) — then one line per crossing, blocking rows first as `• [SEVERITY] CATEGORY — <clipped detail>` (highest-severity first) and non-blocking rows as `◦ [SEVERITY] CATEGORY (advisory — does not block DONE)` / `(below the workspace gate — does not block DONE)`; only the `•` rows need a ruling before DONE, each followed by a read-only **attribution** line `↳ by model=<m> · agent=<type>[/branch] · session=<8-char prefix>` (who/what crossed; any dimension that couldn't be resolved server-side prints `unknown`, never a fabricated value), then a pointer to `lumo crossing disposition` and the web acceptance panel. Silent when there are none, so it never overshadows the criteria.

package/dist/cli/src/commands/task-status.js

@@ -65,7 +65,9 @@ const SCAN_STAGE_ORDER = security_scan_1.SCAN_STAGE_KEYS;
 /** LUM-735 — one line per linked PR's latest scan: `PR #945 · scan CLEAN ·
  *  Secrets: checked · Code scan: checked (2 external findings) ·
  *  Dependencies: checked (1 dependency finding, 1 already on main) ·
- *  AI review: checked · Exploit paths: checked`.
+ *  AI review: checked · Exploit paths: checked`, plus, on a merged / closed
+ *  PR, ` · 3 left the queue (2 resolved on main, 1 merged unreviewed)`
+ *  (LUM-775).
  *  Stage segments only for keys present, in
  *  secrets/external/supplyChain/judge/hunt order (LUM-739 added the hunt
  *  layer); the `(N external findings)` count only decorates the Code scan
@@ -101,6 +103,12 @@ function formatScanSummaryLine(s) {
         line += ` · ${segments.join(' · ')}`;
     if (s.partial)
         line += ' · partial';
+    // LUM-775: what left the queue because the PR merged / closed, and why —
+    // so a merged PR's line explains where its findings went instead of
+    // silently listing fewer next actions than the scan found.
+    const exits = (0, security_scan_1.formatQueueExits)(s.queueExits);
+    if (exits)
+        line += ` · ${exits}`;
     // LUM-756 (P8): `error` has two writers — only the prefixed, scrubbed
     // scanner reason may be printed, and only the text after the prefix. Stage
     // A's raw crash text carries no prefix and is never shown here (same rule

package/dist/cli/src/lib/git-deleted-test-files.js

@@ -0,0 +1,99 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.collectDeletedTestFiles = collectDeletedTestFiles;
+exports.looksLikeDeleteCommand = looksLikeDeleteCommand;
+const child_process_1 = require("child_process");
+const test_file_path_1 = require("../../../shared/src/test-file-path");
+/**
+ * LUM-779 — the local half of the TEST_FILE_DELETED net-deletion verdict.
+ *
+ * The server's matcher only sees command TEXT, and text lies: a restore from
+ * HEAD, a `cp` back from a .bak, or an `rm` of a scratch probe the agent wrote
+ * seconds earlier all look like "deleted a test file" and none of them did.
+ * What settles it is repo state — is a tracked test file missing now — and
+ * only the hook, running on the agent's machine, can ask git that question.
+ *
+ * `collectDeletedTestFiles` answers with the tracked test files that are gone:
+ *   - working tree + index vs HEAD (`git diff HEAD --diff-filter=D`) — a plain
+ *     `rm` or a `git rm` of a tracked file, not yet committed
+ *   - commits on top of the base branch (`git log --diff-filter=D base..HEAD`)
+ *     — an `rm … && git commit` chained in one command would otherwise be
+ *     invisible to the first probe
+ * Filtered by the shared test-path pattern, sorted, de-duplicated.
+ *
+ * `null` means the probe could not answer (not a repository, git missing, a
+ * timeout) — the caller omits the field and the server keeps its fail-closed
+ * blocking behaviour. `[]` is a verdict: the probe ran and nothing is missing.
+ */
+/** Base-branch candidates, in order. The first that resolves wins. */
+const BASE_REF_CANDIDATES = [
+    'refs/remotes/origin/HEAD',
+    'refs/remotes/origin/main',
+    'refs/remotes/origin/master',
+    'refs/remotes/origin/develop',
+];
+const GIT_TIMEOUT_MS = 2000;
+function runGit(args, cwd) {
+    try {
+        const r = (0, child_process_1.spawnSync)('git', args, {
+            cwd,
+            encoding: 'utf8',
+            timeout: GIT_TIMEOUT_MS,
+            stdio: ['ignore', 'pipe', 'ignore'],
+        });
+        if (r.error || r.status !== 0)
+            return { ok: false, stdout: '' };
+        return { ok: true, stdout: r.stdout ?? '' };
+    }
+    catch {
+        return { ok: false, stdout: '' };
+    }
+}
+/** NUL-separated path list → paths (empty entries dropped). */
+function splitPaths(stdoutZ) {
+    return stdoutZ.split('\0').filter(p => p.length > 0);
+}
+function resolveBaseRef(cwd) {
+    for (const ref of BASE_REF_CANDIDATES) {
+        if (runGit(['rev-parse', '--verify', '-q', ref], cwd).ok)
+            return ref;
+    }
+    return null;
+}
+function collectDeletedTestFiles(cwd) {
+    // Working tree + index vs HEAD. Also the "is this a repo with a HEAD"
+    // probe: a non-repository, or git itself missing, fails here → null.
+    const uncommitted = runGit(['diff', 'HEAD', '--diff-filter=D', '--name-only', '-z'], cwd);
+    if (!uncommitted.ok)
+        return null;
+    const missing = new Set(splitPaths(uncommitted.stdout));
+    // Deletions already committed on top of the base branch. Best-effort: no
+    // resolvable base (a repo with no remote) just skips this half.
+    const base = resolveBaseRef(cwd);
+    if (base) {
+        const committed = runGit([
+            'log',
+            '--diff-filter=D',
+            '--name-only',
+            '--format=',
+            '-z',
+            `${base}..HEAD`,
+        ], cwd);
+        if (committed.ok) {
+            for (const p of splitPaths(committed.stdout))
+                missing.add(p);
+        }
+    }
+    return [...missing].filter(test_file_path_1.isTestFilePath).sort();
+}
+/**
+ * Cheap pre-filter deciding whether the probe is worth running at all: an
+ * `rm` / `git rm` token anywhere in the command, including inside a `bash -c`
+ * wrapper string. Deliberately a SUPERSET of the server's matcher — a probe
+ * that runs for an `rm` of a non-test file costs two git calls and nothing
+ * else, whereas a probe that is skipped for a command the server does flag
+ * leaves the server fail-closed on a possible false positive.
+ */
+function looksLikeDeleteCommand(command) {
+    return /(?:^|[\s(;&|"'`])(?:rm|git\s+rm)\b/.test(command);
+}

package/dist/cli/src/lib/hook-runner.js

@@ -4,6 +4,7 @@ exports.formatHookStdoutLines = formatHookStdoutLines;
 exports.formatSuggestLine = formatSuggestLine;
 exports.resolveSessionStartStdout = resolveSessionStartStdout;
 exports.augmentBodyWithUsage = augmentBodyWithUsage;
+exports.augmentBodyWithDeletedTestFiles = augmentBodyWithDeletedTestFiles;
 exports.runHook = runHook;
 exports.runHookWithBody = runHookWithBody;
 const config_1 = require("./config");
@@ -16,6 +17,7 @@ const transcript_usage_1 = require("./transcript-usage");
 const resolve_project_1 = require("./resolve-project");
 const resolve_bound_task_1 = require("./resolve-bound-task");
 const memory_auto_1 = require("./memory-auto");
+const git_deleted_test_files_1 = require("./git-deleted-test-files");
 /**
  * Hard timeout for the hook POST. On timeout the request is aborted,
  * logged, and `runHook` exits 0 — Claude Code is never blocked beyond
@@ -261,6 +263,54 @@ function augmentBodyWithUsage(path, body) {
         _lumo_usage: { ...usage.total, byModel: usage.byModel },
     });
 }
+/**
+ * LUM-779: for a post-tool-use Bash event whose command carries an `rm` /
+ * `git rm`, ask local git which tracked test files are actually missing now
+ * and fold the answer into the body under `_lumo_deleted_test_files`. The
+ * server judges TEST_FILE_DELETED by this list — not by the command text —
+ * so a restore or an `rm` of an untracked scratch probe is recorded advisory
+ * while a real deletion of a tracked test still blocks.
+ *
+ * The three wire states matter: a non-empty list (blocking), an EMPTY list
+ * (probe ran, nothing missing → advisory), and NO field (probe skipped or
+ * git could not answer → the server fails closed). So the field is only ever
+ * attached when the probe returned an array, and a probe that throws leaves
+ * the body untouched. Never blocks or fails the hook.
+ */
+function augmentBodyWithDeletedTestFiles(path, body, probe = git_deleted_test_files_1.collectDeletedTestFiles) {
+    if (path !== 'post-tool-use')
+        return body;
+    let parsed;
+    try {
+        parsed = JSON.parse(body || '{}');
+    }
+    catch {
+        return body;
+    }
+    if (!parsed || typeof parsed !== 'object')
+        return body;
+    if (parsed['tool_name'] !== 'Bash')
+        return body;
+    const input = parsed['tool_input'];
+    const command = input && typeof input === 'object'
+        ? input['command']
+        : undefined;
+    if (typeof command !== 'string' || !(0, git_deleted_test_files_1.looksLikeDeleteCommand)(command))
+        return body;
+    const cwd = typeof parsed['cwd'] === 'string' && parsed['cwd']
+        ? parsed['cwd']
+        : process.cwd();
+    let deleted;
+    try {
+        deleted = probe(cwd);
+    }
+    catch {
+        return body;
+    }
+    if (deleted === null)
+        return body;
+    return JSON.stringify({ ...parsed, _lumo_deleted_test_files: deleted });
+}
 /**
  * POST the hook body to /api/hooks/<path> with a short timeout. All errors
  * — credential missing, network failure, timeout, non-2xx — are routed to
@@ -309,7 +359,8 @@ async function runHookWithBody(path, body, agentToken) {
         const agentEnum = agentToken ? (0, agent_1.normalizeAgent)(agentToken) : null;
         if (agentEnum)
             headers['X-Lumo-Agent'] = agentEnum;
-        const outgoingBody = augmentBodyWithUsage(path, body) || '{}';
+        const outgoingBody = augmentBodyWithDeletedTestFiles(path, augmentBodyWithUsage(path, body)) ||
+            '{}';
         try {
             const res = await fetch(url, {
                 method: 'POST',

package/dist/shared/src/security-scan.js

@@ -1,10 +1,11 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.SECRET_DOWNGRADE_LABELS = exports.SCAN_STAGE_STATE_LABELS = exports.SCAN_STAGE_LABELS = exports.SCAN_STAGE_STATES = exports.SCAN_STAGE_KEYS = exports.EXTERNAL_ERROR_PREFIX = void 0;
+exports.QUEUE_EXIT_LABELS = exports.QUEUE_EXIT_REASONS = exports.SECRET_DOWNGRADE_LABELS = exports.SCAN_STAGE_STATE_LABELS = exports.SCAN_STAGE_LABELS = exports.SCAN_STAGE_STATES = exports.SCAN_STAGE_KEYS = exports.EXTERNAL_ERROR_PREFIX = void 0;
 exports.externalFailureReason = externalFailureReason;
 exports.scanStageLabel = scanStageLabel;
 exports.scanStageStateLabel = scanStageStateLabel;
 exports.secretDowngradeNote = secretDowngradeNote;
+exports.formatQueueExits = formatQueueExits;
 /**
  * PR security scan — the one `PrSecurityScan.error` shape that may be shown
  * as an external-scanner reason (spec P8). Shared by the web panel, the PR
@@ -123,3 +124,57 @@ function secretDowngradeNote(reason) {
         return '';
     return ` — ${exports.SECRET_DOWNGRADE_LABELS[reason] ?? reason}, downgraded`;
 }
+/**
+ * LUM-775 — why an undispositioned finding is no longer in the queue.
+ *
+ * A PR finding's review window is the PR. Once the PR is merged or closed
+ * the question changes from "what did this change introduce" to "what is on
+ * main now", and only the default-branch baseline (LUM-738) may answer that.
+ * The exit is DERIVED at read time from PR state × baseline × policy — never
+ * written to the row, so `disposition` stays a human-only column.
+ *
+ * - `RESOLVED_ON_MAIN`: an external-tool finding whose fingerprint is absent
+ *   from a baseline that can testify (landed, whole, requested after the
+ *   merge, ran that tool). The one exit with evidence.
+ * - `MERGED_UNREVIEWED`: the window closed without a decision. Advisory rows
+ *   only — a policy-blocking row stays until a human decides.
+ * - `PR_CLOSED`: closed without merging; nothing landed. Reopening the PR
+ *   puts the row straight back (derived, not stored).
+ */
+exports.QUEUE_EXIT_REASONS = [
+    'RESOLVED_ON_MAIN',
+    'MERGED_UNREVIEWED',
+    'PR_CLOSED',
+];
+/** One wording per exit on every surface (CLI scan line, analysis report). */
+exports.QUEUE_EXIT_LABELS = {
+    RESOLVED_ON_MAIN: 'resolved on main',
+    MERGED_UNREVIEWED: 'merged unreviewed',
+    PR_CLOSED: 'PR closed',
+};
+/**
+ * `3 left the queue (2 resolved on main, 1 merged unreviewed)`, or null when
+ * nothing left — the caller omits the segment rather than printing a zero.
+ * Reasons print in the declared order; an unknown key (a newer server) is
+ * counted in the total and printed as itself, never dropped.
+ */
+function formatQueueExits(counts) {
+    if (!counts)
+        return null;
+    const parts = [];
+    let total = 0;
+    const keys = [
+        ...exports.QUEUE_EXIT_REASONS.filter(k => k in counts),
+        ...Object.keys(counts).filter(k => !exports.QUEUE_EXIT_REASONS.includes(k)),
+    ];
+    for (const key of keys) {
+        const n = counts[key] ?? 0;
+        if (n <= 0)
+            continue;
+        total += n;
+        parts.push(`${n} ${exports.QUEUE_EXIT_LABELS[key] ?? key}`);
+    }
+    if (total === 0)
+        return null;
+    return `${total} left the queue (${parts.join(', ')})`;
+}

package/dist/shared/src/test-file-path.js

@@ -0,0 +1,18 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.TEST_FILE_TARGET = void 0;
+exports.isTestFilePath = isTestFilePath;
+/**
+ * What counts as a test file / test tree for the TEST_FILE_DELETED session
+ * guard (LUM-736): `*.test.*`, `*.spec.*`, or anything under a `__tests__/`
+ * segment. Single-sourced here (LUM-779) because two sides must agree on it:
+ * the server's command matcher (lib/services/boundary-detector.service.ts)
+ * and the CLI's local-git probe (cli/src/lib/git-deleted-test-files.ts) that
+ * reports which tracked test files are actually missing. A pattern that
+ * drifted between the two would let a real deletion slip through as "nothing
+ * missing" — so there is exactly one pattern.
+ */
+exports.TEST_FILE_TARGET = /(?:\.(?:test|spec)\.|(?:^|\/)__tests__(?:\/|$))/;
+function isTestFilePath(path) {
+    return exports.TEST_FILE_TARGET.test(path);
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@lumoai/cli",
-  "version": "1.61.0",
+  "version": "1.62.0",
   "description": "Lumo CLI — manage tasks and sessions from the terminal",
   "license": "MIT",
   "author": "cli@uselumo.ai",