@lumoai/cli 1.66.0 → 1.68.0

package/dist/cli/src/commands/task-criteria-confirm.js

@@ -0,0 +1,99 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.taskCriteriaConfirm = taskCriteriaConfirm;
+const config_1 = require("../lib/config");
+const api_1 = require("../lib/api");
+const sanitize_1 = require("../lib/sanitize");
+const confirmation_1 = require("../lib/confirmation");
+/**
+ * `lumo task criteria confirm <task> [--confirm]`
+ *
+ * 记录人对验收合同的一次性确认（LUM-789）。这是 gated mutation：不带
+ * `--confirm` 时打确认信封并 exit 4，**写入为零**；agent 把 changes 逐条念给
+ * 用户，用户批准后才跑信封里的 confirmCommand。`--confirm` 的含义是「用户已
+ * 确认」，agent 不得自行添加。
+ */
+async function taskCriteriaConfirm(identifier, options) {
+    if (!identifier) {
+        console.error('Error: missing <task>. Usage: lumo task criteria confirm <LUM-42>');
+        return 1;
+    }
+    const creds = (0, config_1.readCredentials)();
+    if (!creds) {
+        console.error('Error: not logged in. Run `lumo auth login` first.');
+        return 1;
+    }
+    const base = (0, api_1.trimTrailingSlash)((0, api_1.resolveAuthedApiUrl)(creds.apiUrl));
+    const headers = { Authorization: `Bearer ${creds.token}` };
+    let listRes;
+    try {
+        listRes = await fetch(`${base}/api/tasks/${encodeURIComponent(identifier)}/criteria`, { headers });
+    }
+    catch (err) {
+        const msg = err instanceof Error ? err.message : String(err);
+        console.error(`Error: could not reach Lumo API at ${base} (${msg})`);
+        return 1;
+    }
+    if (listRes.status === 401) {
+        console.error('Error: API key invalid or revoked. Run `lumo auth login`.');
+        return 1;
+    }
+    if (listRes.status === 404) {
+        console.error(`Error: task ${identifier} not found in workspace ${creds.workspaceSlug}`);
+        return 1;
+    }
+    if (!listRes.ok) {
+        console.error(`Error: could not read the contract (HTTP ${listRes.status})`);
+        return 1;
+    }
+    const { criteria, status } = (await listRes.json());
+    if (criteria.length === 0) {
+        console.error(`Error: ${identifier} has no acceptance criteria — nothing to confirm.`);
+        return 1;
+    }
+    // N-5: pre-check DONE before printing the exit-4 envelope — without this,
+    // the envelope promises a write ("Will record YOUR confirmation…") that
+    // `confirmContract`'s own DONE guard (Finding 5, first review) always
+    // refuses with 409, so a DONE task only ever discovered that on the
+    // SECOND call, after the user had already approved a write that was never
+    // going to happen. Same terminal-lock framing as `criteria set --human`'s
+    // DONE 409 and the server's own message.
+    if (status === 'DONE') {
+        console.error(`Error: ${identifier} is DONE — the acceptance contract is locked. Reopen it (status → in_progress) to confirm the contract.`);
+        return 1;
+    }
+    if (!(0, confirmation_1.isConfirmed)(options)) {
+        const pending = criteria.filter(c => c.confirmedAt == null);
+        return (0, confirmation_1.emitConfirmation)({
+            command: 'task criteria confirm',
+            changes: [
+                `Will record YOUR confirmation of the acceptance contract on ${identifier}`,
+                `${pending.length} of ${criteria.length} criteria are not yet confirmed`,
+                ...criteria.map(c => `  [${c.verifierType}] ${(0, sanitize_1.sanitizeField)(c.statement)}${c.confirmedAt ? ' (already confirmed)' : ''}`),
+                'Confirming does NOT close the task and never blocks DONE — it records that a human agreed to what "done" means here',
+                'To change the contract instead, run `lumo task criteria set <task> --file <criteria.json> --human`',
+            ],
+        });
+    }
+    let res;
+    try {
+        res = await fetch(`${base}/api/tasks/${encodeURIComponent(identifier)}/criteria/confirm`, { method: 'POST', headers });
+    }
+    catch (err) {
+        const msg = err instanceof Error ? err.message : String(err);
+        console.error(`Error: could not reach Lumo API at ${base} (${msg})`);
+        return 1;
+    }
+    if (res.status === 401) {
+        console.error('Error: API key invalid or revoked. Run `lumo auth login`.');
+        return 1;
+    }
+    if (res.status !== 201) {
+        const body = (await res.json().catch(() => null));
+        const detail = typeof body?.error === 'string' ? (0, sanitize_1.sanitizeField)(body.error) : '';
+        console.error(`Error: confirm failed (HTTP ${res.status})${detail ? ` — ${detail}` : ''}`);
+        return 1;
+    }
+    const { confirmedCount } = (await res.json());
+    process.stdout.write(`Confirmed the acceptance contract on ${identifier} (${confirmedCount} criteri${confirmedCount === 1 ? 'on' : 'a'} newly confirmed)\n`);
+}

package/dist/cli/src/commands/task-status.js

@@ -7,8 +7,16 @@ const api_1 = require("../lib/api");
 const resolve_bound_task_1 = require("../lib/resolve-bound-task");
 const sanitize_1 = require("../lib/sanitize");
 const security_scan_1 = require("../../../shared/src/security-scan");
+const scan_format_1 = require("../lib/scan-format");
 const open_crossings_1 = require("../lib/open-crossings");
 const evidence_display_1 = require("../lib/evidence-display");
+// LUM-789 whole-branch review (Findings 1/2): the CLI must not run a second,
+// disagreeing "is this criterion unmet" rule against the server's nextActions
+// split — both derive from the same isUnmetForDisplay so a tacit-pass HUMAN
+// row reads as settled everywhere in one report, never "0 unmet" in the
+// header and an open circle in the body. Zero-import — safe to pull into the
+// CLI package the same way client components pull it into the web bundle.
+const unmet_display_1 = require("../../../lib/acceptance/unmet-display");
 /** One-line a possibly-multiline crossing detail and cap it so the safety block
  *  stays a glance, never a wall (it must not overshadow the criteria). */
 const CROSSING_DETAIL_CAP = 160;
@@ -58,89 +66,23 @@ function pushSecurityActions(lines, securityActions) {
         lines.push(`  • [SECURITY] ${formatSecurityAction(a)}`);
     }
 }
-/** Fail-closed security coverage lines (LUM-737): a failed read and every
- *  open PR without a successful scan are stated, never left silent. */
-const EXTERNAL_ERROR_TAIL = 200;
-const SCAN_STAGE_ORDER = security_scan_1.SCAN_STAGE_KEYS;
 /** LUM-735 — one line per linked PR's latest scan: `PR #945 · scan CLEAN ·
- *  Secrets: checked · Code scan: checked (2 external findings) ·
- *  Dependencies: checked (1 dependency finding, 1 already on main) ·
- *  AI review: checked · Exploit paths: checked`, plus, on a merged / closed
- *  PR, ` · 3 left the queue (2 resolved on main, 1 merged unreviewed)`
- *  (LUM-775).
- *  Stage segments only for keys present, in
- *  secrets/external/supplyChain/judge/hunt order (LUM-739 added the hunt
- *  layer); the `(N external findings)` count only decorates the Code scan
- *  segment, the dependency count (LUM-738, with its already-on-main share)
- *  only the Dependencies segment, and each only when N > 0.
- *  LUM-763: the stage keys are internal — what prints is the display label
- *  from `shared/src/security-scan.ts`, the same map the GitHub PR summary
- *  and the web panel render from. */
+ *  Secrets: checked · Code scan: checked (2 external findings) · …` — the
+ *  layer grammar lives in `cli/src/lib/scan-format.ts`, shared with
+ *  `lumo pr scan` (LUM-788) so the two surfaces cannot drift.
+ *  LUM-756 (P8): `error` has two writers — only the prefixed, scrubbed
+ *  scanner reason may be printed, and only when the layer FAILED. */
 function formatScanSummaryLine(s) {
-    const segments = [];
-    for (const key of SCAN_STAGE_ORDER) {
-        const state = s.stages[key];
-        if (!state)
-            continue;
-        const head = `${(0, security_scan_1.scanStageLabel)(key)}: ${(0, security_scan_1.scanStageStateLabel)(state)}`;
-        if (key === 'external' && s.externalFindings > 0) {
-            const noun = s.externalFindings === 1 ? 'finding' : 'findings';
-            segments.push(`${head} (${s.externalFindings} external ${noun})`);
-        }
-        else if (key === 'supplyChain' && (s.dependencyFindings ?? 0) > 0) {
-            const n = s.dependencyFindings ?? 0;
-            const noun = n === 1 ? 'finding' : 'findings';
-            const persisting = s.persistingFindings ?? 0;
-            const tail = persisting > 0 ? `, ${persisting} already on main` : '';
-            segments.push(`${head} (${n} dependency ${noun}${tail})`);
-        }
-        else {
-            segments.push(head);
-        }
-    }
-    let line = `  PR #${s.prNumber} · scan ${s.status}`;
-    if (segments.length > 0)
-        line += ` · ${segments.join(' · ')}`;
-    if (s.partial)
-        line += ' · partial';
-    // LUM-775: what left the queue because the PR merged / closed, and why —
-    // so a merged PR's line explains where its findings went instead of
-    // silently listing fewer next actions than the scan found.
-    const exits = (0, security_scan_1.formatQueueExits)(s.queueExits);
-    if (exits)
-        line += ` · ${exits}`;
-    // LUM-756 (P8): `error` has two writers — only the prefixed, scrubbed
-    // scanner reason may be printed, and only the text after the prefix. Stage
-    // A's raw crash text carries no prefix and is never shown here (same rule
-    // as the web panel and the PR summary).
-    const reason = s.stages.external === 'FAILED' ? (0, security_scan_1.externalFailureReason)(s.error) : null;
-    if (reason) {
-        line += ` — ${(0, sanitize_1.sanitizeField)(tail(reason, EXTERNAL_ERROR_TAIL))}`;
-    }
-    return line;
-}
-/**
- * LUM-762 — the hunt's per-task read-out, one indented line under its scan:
- * `Exploit paths 2/3 done · t1 idor 41.2s done · t2 injection 72.0s done
- * (2 attempts) · t3 race skipped`. Headed by the same display label as the
- * layer's own segment (LUM-763) — the detail line and the line above it
- * must not name the layer two different ways. This is the only place the stored `huntAudit` surfaces, so
- * it is what answers "how long does a healthy batch take" and "which ones
- * never ran" (`skipped`) without paging through deploy logs. Elapsed time is
- * summed over a task's attempts; a skipped task has none to print.
- *
- * LUM-758: a plan may hold two tasks of the same category, so the row is led
- * by its task id. Pre-task-graph audits carry no id — the row then prints
- * exactly as it always did.
- */
-function formatHuntCoverageLine(hunt) {
-    const parts = hunt.categories.map(c => {
-        const attempts = c.attempts > 1 ? ` (${c.attempts} attempts)` : '';
-        const spent = c.stopped === 'skipped' ? '' : `${(c.elapsedMs / 1000).toFixed(1)}s `;
-        const id = c.taskId === undefined ? '' : `${c.taskId} `;
-        return `${id}${c.category} ${spent}${c.stopped}${attempts}`;
-    });
-    return `    ${(0, security_scan_1.scanStageLabel)('hunt')} ${hunt.done}/${hunt.total} done · ${parts.join(' · ')}`;
+    return (`  PR #${s.prNumber} · scan ${s.status}` +
+        (0, scan_format_1.formatScanLayerTail)({
+            stages: s.stages,
+            partial: s.partial,
+            externalFindings: s.externalFindings,
+            dependencyFindings: s.dependencyFindings,
+            persistingFindings: s.persistingFindings,
+            queueExits: s.queueExits,
+            externalFailureReason: s.stages.external === 'FAILED' ? (0, security_scan_1.externalFailureReason)(s.error) : null,
+        }));
 }
 function pushSecurityCoverage(lines, data) {
     if (data.securityFindings === undefined)
@@ -154,7 +96,7 @@ function pushSecurityCoverage(lines, data) {
         lines.push(formatScanSummaryLine(s));
         // LUM-762: absent/null = older server or no usable audit — stay silent.
         if (s.hunt && s.hunt.categories.length > 0) {
-            lines.push(formatHuntCoverageLine(s.hunt));
+            lines.push(`    ${(0, scan_format_1.formatHuntCoverageLine)(s.hunt)}`);
         }
     }
     for (const u of data.securityFindings.unconfirmedPrs) {
@@ -166,11 +108,34 @@ function pushSecurityCoverage(lines, data) {
         lines.push(`⚠ PR #${u.number}: ${why} — could not confirm it is clean.`);
     }
 }
+/**
+ * Finding 2: the closing line for a fully-settled contract (no unmet
+ * criteria, no open security findings). Mirrors the web's three-way split
+ * (AcceptanceTab.tsx's humanNoneJudged / humanSomeJudged /
+ * humanAllExplicitlyJudged, from commit 749bdbf2) instead of unconditionally
+ * claiming "awaiting human adjudication" — which is false the moment even one
+ * HUMAN criterion settled as a tacit pass rather than an actual verdict.
+ */
+function contractSettledLine(criteria) {
+    const humanCriteria = criteria.filter(c => c.verifierType === 'HUMAN');
+    if (humanCriteria.length === 0) {
+        return 'All criteria met by their latest verdicts.';
+    }
+    const judgedCount = humanCriteria.filter(c => c.latestVerdict != null).length;
+    if (judgedCount === humanCriteria.length) {
+        return 'All criteria met by their latest verdicts — human-judged.';
+    }
+    if (judgedCount === 0) {
+        return 'All criteria met — no objection raised on the HUMAN criteria; not individually judged.';
+    }
+    return `All criteria met — ${judgedCount}/${humanCriteria.length} HUMAN criteria explicitly judged, the rest accepted as drafted.`;
+}
 /**
  * Render the acceptance status as prose. Same row grammar as
  * `criteria list` (`<id>  [TYPE]  SOURCE@rN  statement`) with a verdict
- * glyph in front — ✓ pass, ✗ fail, ○ no verdict yet — so REVIEW_ADDED
- * provenance stays explicitly visible in every row.
+ * glyph in front — ✓ pass, ✗ fail, ○ no verdict yet, ~ tacit pass (settled,
+ * un-adjudicated HUMAN criterion) — so REVIEW_ADDED provenance stays
+ * explicitly visible in every row.
  */
 function formatTaskStatus(data, extras = {}) {
     const lines = [];
@@ -180,6 +145,16 @@ function formatTaskStatus(data, extras = {}) {
         ? 'no verification rounds yet'
         : `verification round ${data.currentRound}/${data.maxRounds}`;
     lines.push(`Status: ${t.status} · ${roundLabel}`);
+    // LUM-789: 追认入口。出现在用户本来就要打开这个任务的时刻,永不拦 DONE。
+    // Finding 5: the migration is backfill-free, so every pre-LUM-789 contract
+    // reads unconfirmed forever — without the DONE guard this nudge would sit
+    // on every historical and every closed task forever, inviting exactly the
+    // after-delivery "confirm" that defeats the point of moving the touchpoint
+    // earlier. Mirrors AcceptanceTab.tsx's `contractUnconfirmed` guard.
+    const unconfirmed = t.status === 'DONE' ? [] : data.criteria.filter(c => c.confirmedAt == null);
+    if (unconfirmed.length > 0) {
+        lines.push(`Contract unconfirmed (${unconfirmed.length} criteri${unconfirmed.length === 1 ? 'on' : 'a'}) — lumo task criteria confirm ${t.identifier}`);
+    }
     if (data.escalated) {
         lines.push('⚠ Escalated: the machine loop is exhausted — a human has been paged. Stop retrying lumo verify.');
     }
@@ -213,8 +188,17 @@ function formatTaskStatus(data, extras = {}) {
     lines.push('');
     lines.push(`Criteria (${data.criteria.length} total, ${unmetCriteria.length} unmet):`);
     for (const c of data.criteria) {
+        // Finding 1: derive from the same isUnmetForDisplay the header's
+        // `unmet` count and the server's nextActions already use. A HUMAN
+        // criterion with no verdict is a tacit pass (settled, nobody objected) —
+        // it must not render as an open circle awaiting something, but it also
+        // didn't get an actual verdict, so it stays visually distinct from a
+        // real ✓ pass (LUM-789's "keep the judged-vs-tacit distinction honest").
+        const unmet = (0, unmet_display_1.isUnmetForDisplay)(c, c.latestVerdict ?? undefined);
         const glyph = c.latestVerdict == null
-            ? '○'
+            ? unmet
+                ? '○' // MACHINE, no verdict — genuinely still open
+                : '~' // HUMAN, no verdict — tacit pass, settled but unjudged
             : c.latestVerdict.verdict === 'FAIL'
                 ? '✗'
                 : '✓';
@@ -235,7 +219,9 @@ function formatTaskStatus(data, extras = {}) {
         }
         const v = c.latestVerdict;
         if (v == null) {
-            lines.push('      (no verdict yet)');
+            lines.push(unmet
+                ? '      (no verdict yet)'
+                : '      (tacit pass — no objection raised, not individually judged)');
         }
         else if (v.verdict === 'FAIL') {
             const why = v.rejectionReason
@@ -314,7 +300,7 @@ function formatTaskStatus(data, extras = {}) {
         : ` · ${securityActions.length} security finding${securityActions.length === 1 ? '' : 's'}`;
     if (unmetCriteria.length === 0 && securityActions.length === 0) {
         lines.push(data.currentRound > 0
-            ? 'All criteria met by their latest verdicts — awaiting human adjudication.'
+            ? contractSettledLine(data.criteria)
             : 'Nothing unmet — but no verification has run; run `lumo verify` to judge the contract.');
     }
     else {
@@ -338,7 +324,9 @@ function formatTaskStatus(data, extras = {}) {
             const left = data.maxRounds - data.currentRound;
             lines.push(hasMachine
                 ? `Fix the unmet criteria, then run \`lumo verify\` (${left} round${left === 1 ? '' : 's'} left).`
-                : 'Remaining criteria are HUMAN-only — finish the work and hand off for human review.');
+                : // LUM-789: 未裁定的 HUMAN 项已按 tacit pass 处理，不会走到这里。
+                    // 剩下的 HUMAN 项只可能是被明确送回的 —— 说送回，不说交接。
+                    'The remaining criteria were sent back by a human — address the reasons above, then run `lumo verify`.');
         }
         if (securityActions.length > 0)
             lines.push(SECURITY_HINT);
@@ -410,8 +398,15 @@ function pushVerificationRollup(lines, unmetCriteriaCount, data) {
     }
     // LUM-737 (whole-branch review): `unmetCriteriaCount` excludes SECURITY_FINDING
     // next actions — met/unmet counts criteria only, never security findings.
+    //
+    // Relocation six (whole-branch review, third pass): `unmetCriteriaCount` is
+    // now isUnmetForDisplay-filtered (Findings 1/2) — a tacit-pass HUMAN
+    // criterion (no verdict, never adjudicated) counts as met here too. "met by
+    // their latest verdict" asserted a verdict that row doesn't have; dropped
+    // the claim rather than the count, so this line agrees with the `~` row
+    // and the closing line instead of contradicting them.
     const met = data.criteria.length - unmetCriteriaCount;
-    lines.push(`  ${met} of ${data.criteria.length} criteria met by their latest verdict`);
+    lines.push(`  ${met} of ${data.criteria.length} criteria met`);
 }
 /**
  * Append the honest "Cost" section (LUM-560) — 规律 1: surface the costs a human

package/dist/cli/src/commands/verify.js

@@ -157,7 +157,10 @@ async function verify(identifier, options = {}) {
     }
     if (machine.length === 0) {
         process.stdout.write(`${taskId} has no MACHINE criteria — nothing for the machine loop to run.\n` +
-            `The contract is HUMAN-only; finish your work and hand off for human review (lumo task update ${taskId} --status in_review).\n`);
+            // LUM-789: 未裁定的 HUMAN 项按 tacit pass 处理，除非被人明确送回，
+            // 否则不构成"必须交接给人 review"的义务 —— 别再说 hand off。
+            `HUMAN criteria pass tacitly unless one is explicitly sent back by a human; ` +
+            `no hand-off is required. Move on with \`lumo task update ${taskId} --status in_review\`.\n`);
         return;
     }
     // ── Optional self-report (LUM-733) ───────────────────────────────────────

package/dist/cli/src/index.js

@@ -92,6 +92,7 @@ const memory_fold_1 = require("./commands/memory-fold");
 const task_artifact_add_1 = require("./commands/task-artifact-add");
 const task_criteria_set_1 = require("./commands/task-criteria-set");
 const task_criteria_list_1 = require("./commands/task-criteria-list");
+const task_criteria_confirm_1 = require("./commands/task-criteria-confirm");
 const task_artifact_list_1 = require("./commands/task-artifact-list");
 const task_artifact_show_1 = require("./commands/task-artifact-show");
 const task_artifact_rm_1 = require("./commands/task-artifact-rm");
@@ -102,6 +103,7 @@ const task_figma_context_1 = require("./commands/task-figma-context");
 const task_comment_list_1 = require("./commands/task-comment-list");
 const task_deps_1 = require("./commands/task-deps");
 const task_pr_show_1 = require("./commands/task-pr-show");
+const pr_scan_1 = require("./commands/pr-scan");
 const task_lineage_1 = require("./commands/task-lineage");
 const project_list_1 = require("./commands/project-list");
 const milestone_list_1 = require("./commands/milestone-list");
@@ -434,6 +436,16 @@ priorityCmd
     .command('list')
     .description('Print the team priority append history, newest-first (the current declaration is marked with *).')
     .action(wrap(() => (0, priority_1.priorityList)()));
+const pr = program
+    .command('pr')
+    .description('Inspect pull requests by number — linked to a task or not');
+pr.command('scan <number>')
+    .description('Security scans of one PR in the workspace, by PR number (LUM-788): the latest head by default — layer states (same labels as task status / the GitHub summary), every finding incl. dispositioned ones with disposition + source, and the hunt coverage line. Read-only; disposition is web-only.')
+    .option('--repo <owner/repo>', 'Narrow to one repo when the same PR number exists in several (the error lists the candidates)')
+    .option('--all', "Every pushed head's scan, newest first, instead of the latest only")
+    .option('--full', 'Append the per-task hunt detail: commands (with gate refusals), step trace, stop arithmetic, wrap-up, sites, model, diff sizing')
+    .option('--json', 'Emit the versioned machine-readable payload ({ pullRequest, scans[].stages / findings[] / hunt.tasks[] })')
+    .action(wrap((number, options) => (0, pr_scan_1.prScan)(number, options)));
 const criteria = program
     .command('criteria')
     .description('Workspace-level acceptance-criteria analytics');
@@ -625,6 +637,12 @@ taskCriteria
     .command('list <task>')
     .description('List a task\u2019s acceptance criteria (id, type, provenance, checkpointer)')
     .action(wrap((taskId) => (0, task_criteria_list_1.taskCriteriaList)(taskId)));
+taskCriteria
+    .command('confirm <task>')
+    .description('Record the USER\u2019s confirmation of the acceptance contract (LUM-789). Gated: without --confirm it prints a confirmation envelope listing every criterion and exits 4, writing nothing. Confirming never blocks DONE \u2014 an unconfirmed contract still closes normally.')
+    .option('--confirm', 'The user has approved this contract')
+    .option('--yes', 'Legacy alias of --confirm')
+    .action(wrap((taskId, options) => (0, task_criteria_confirm_1.taskCriteriaConfirm)(taskId, options)));
 const taskArtifact = task
     .command('artifact')
     .description('Record spec-engineering artifacts (spec / plan / design …) on a task');

package/dist/cli/src/lib/scan-format.js

@@ -0,0 +1,84 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.formatScanLayerTail = formatScanLayerTail;
+exports.formatHuntCoverageLine = formatHuntCoverageLine;
+const sanitize_1 = require("./sanitize");
+const security_scan_1 = require("../../../shared/src/security-scan");
+const EXTERNAL_ERROR_TAIL = 200;
+function tail(s, max) {
+    return s.length > max ? `…${s.slice(-max)}` : s;
+}
+/**
+ * ` · Secrets: checked · Code scan: checked (2 external findings) ·
+ * Dependencies: checked (1 dependency finding, 1 already on main) ·
+ * AI review: checked · Exploit paths: checked · partial · 3 left the queue
+ * (2 resolved on main, 1 merged unreviewed) — <scrubbed reason>`, or `''`
+ * when the scan carries no stage at all. The caller prefixes its own head
+ * (`  PR #945 · scan CLEAN` / `Scan abc1234 · FINDINGS`).
+ *
+ * Stage segments only for keys present, in secrets/external/supplyChain/
+ * judge/hunt order; the `(N external findings)` count only decorates the
+ * Code scan segment, the dependency count (with its already-on-main share)
+ * only the Dependencies segment, and each only when N > 0.
+ */
+function formatScanLayerTail(s) {
+    const segments = [];
+    for (const key of security_scan_1.SCAN_STAGE_KEYS) {
+        const state = s.stages[key];
+        if (!state)
+            continue;
+        const head = `${(0, security_scan_1.scanStageLabel)(key)}: ${(0, security_scan_1.scanStageStateLabel)(state)}`;
+        if (key === 'external' && s.externalFindings > 0) {
+            const noun = s.externalFindings === 1 ? 'finding' : 'findings';
+            segments.push(`${head} (${s.externalFindings} external ${noun})`);
+        }
+        else if (key === 'supplyChain' && (s.dependencyFindings ?? 0) > 0) {
+            const n = s.dependencyFindings ?? 0;
+            const noun = n === 1 ? 'finding' : 'findings';
+            const persisting = s.persistingFindings ?? 0;
+            const tail = persisting > 0 ? `, ${persisting} already on main` : '';
+            segments.push(`${head} (${n} dependency ${noun}${tail})`);
+        }
+        else {
+            segments.push(head);
+        }
+    }
+    let line = '';
+    if (segments.length > 0)
+        line += ` · ${segments.join(' · ')}`;
+    if (s.partial)
+        line += ' · partial';
+    // LUM-775: what left the queue because the PR merged / closed, and why —
+    // so a merged PR's line explains where its findings went instead of
+    // silently listing fewer open rows than the scan found.
+    const exits = (0, security_scan_1.formatQueueExits)(s.queueExits);
+    if (exits)
+        line += ` · ${exits}`;
+    // LUM-756 (P8): only the prefixed, scrubbed scanner reason is printed, and
+    // only the text after the prefix (the caller has already applied the rule).
+    if (s.externalFailureReason) {
+        line += ` — ${(0, sanitize_1.sanitizeField)(tail(s.externalFailureReason, EXTERNAL_ERROR_TAIL))}`;
+    }
+    return line;
+}
+/**
+ * LUM-762 — the hunt's per-task read-out, one line under its scan:
+ * `Exploit paths 2/3 done · t1 idor 41.2s done · t2 injection 72.0s done
+ * (2 attempts) · t3 race skipped`. Headed by the same display label as the
+ * layer's own segment (LUM-763) — the detail line and the line above it
+ * must not name the layer two different ways. Elapsed time is summed over a
+ * task's attempts; a skipped task has none to print.
+ *
+ * LUM-758: a plan may hold two tasks of the same category, so the row is led
+ * by its task id. Pre-task-graph audits carry no id — the row then prints
+ * exactly as it always did.
+ */
+function formatHuntCoverageLine(hunt) {
+    const parts = hunt.categories.map(c => {
+        const attempts = c.attempts > 1 ? ` (${c.attempts} attempts)` : '';
+        const spent = c.stopped === 'skipped' ? '' : `${(c.elapsedMs / 1000).toFixed(1)}s `;
+        const id = c.taskId === undefined ? '' : `${(0, sanitize_1.sanitizeField)(c.taskId)} `;
+        return `${id}${(0, sanitize_1.sanitizeField)(c.category)} ${spent}${(0, sanitize_1.sanitizeField)(c.stopped)}${attempts}`;
+    });
+    return `${(0, security_scan_1.scanStageLabel)('hunt')} ${hunt.done}/${hunt.total} done · ${parts.join(' · ')}`;
+}

package/dist/lib/acceptance/unmet-display.js

@@ -0,0 +1,28 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.isUnmetForDisplay = isUnmetForDisplay;
+/** PASS 与 PASS_WITH_FOLLOWUP 都算通过（与 verification-run 仓库的
+ *  isPassVerdict 同义；这里本地实现以保持本模块零依赖）。 */
+function isPass(verdict) {
+    return verdict === 'PASS' || verdict === 'PASS_WITH_FOLLOWUP';
+}
+/**
+ * LUM-789 渲染口径：一条 criterion 是否该呈现为「未满足」。
+ *
+ * 未裁定的 HUMAN 项是 **tacit pass** —— 没人送回就是默认通过，与 DONE 闸
+ * 早已采用的口径一致（task-state.service.ts 的 assertNoUnresolvedSendBack
+ * 只对明确 FAIL 返回 409）。把它呈现成待办是纯摩擦：一个总会通过的闸产出
+ * 的不是信号，是伪装成信号的噪音。
+ *
+ * ⚠️ 这是 **渲染** 口径，不是裁决口径。裁决用的是
+ * task-human-verdict.service.ts 的 `allMet`（every criterion isPassVerdict），
+ * 它必须保持「未裁定 ≠ 通过」，否则在 web 上点一条 PASS 会把整个任务推成
+ * DONE。两者不得合并。
+ */
+function isUnmetForDisplay(criterion, latest) {
+    if (isPass(latest?.verdict))
+        return false;
+    if (latest === undefined && criterion.verifierType === 'HUMAN')
+        return false;
+    return true;
+}

package/dist/shared/src/hunt-audit.js

@@ -0,0 +1,83 @@
+"use strict";
+/**
+ * LUM-788 — the per-task hunt read-out, shared by the CLI (`lumo pr scan
+ * --full`) and the lum739 analysis script. One implementation: the CLI is a
+ * separate package that cannot import `lib/` or `scripts/`, and a second copy
+ * of this printer is exactly how the audit lost four fields to "computed,
+ * carried, never read" before LUM-758.
+ *
+ * Pure formatting over the raw `PrSecurityScan.huntAudit.tasks[]` rows. Every
+ * field is optional by construction: the column is Json written by past
+ * versions of the workflow, and a row written before a field existed prints
+ * exactly as it always did — nothing is guessed, nothing is thrown over.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.formatHuntTaskDetail = formatHuntTaskDetail;
+exports.formatShellDetail = formatShellDetail;
+/** One line of prose, flattened, for a fixed-width read-out. */
+function oneLine(text, max) {
+    const flat = text.replace(/\s+/g, ' ').trim();
+    return flat.length > max ? `${flat.slice(0, max)}…` : flat;
+}
+/**
+ * The per-task listing for EVERY task handed in, idle ones included — the
+ * `lumo pr scan --full` shape. A task that never asked the shell for anything
+ * still has a stop line, a model and the sites it was briefed on, and "this
+ * task ran two steps and submitted nothing" is a fact the reader came for.
+ *
+ * Lines per task: a header (`t1 done · <model> · 3 sites · 2 cmds (gate
+ * refused …)`), one line per command (`✗` = the gate refused it, with its
+ * reason), one line per trace step, then the stop arithmetic and the
+ * wrap-up outcome — each only when the row carries it.
+ */
+function formatHuntTaskDetail(tasks, maxTasks) {
+    const out = [];
+    for (const t of tasks.slice(0, maxTasks)) {
+        const sh = t.shell;
+        // LUM-787 — the model and the sites print only when the row carries them;
+        // the clip count likewise: an older row, and a row from a search that
+        // never hit the ceiling, read as before.
+        const cmds = sh?.calls
+            ? `${sh.calls} cmds (gate refused ${sh.refused ?? 0}, sandbox failed ${sh.failed ?? 0}, not found ${sh.notFound ?? 0}, empty ${sh.empty ?? 0}${sh.stepClipped ? `, step-clipped ${sh.stepClipped}` : ''})`
+            : 'no shell commands';
+        out.push(`${String(t.taskId)} ${String(t.stopped)}${t.model ? ` · ${t.model}` : ''}${typeof t.sites === 'number' ? ` · ${t.sites} sites` : ''} · ${cmds}`);
+        for (const c of sh?.commands ?? []) {
+            const cost = typeof c.chars === 'number'
+                ? `  [${c.chars} chars${c.compressed ? ', compressed' : ''}${c.clipped ? ', clipped' : ''}]`
+                : '';
+            out.push(`    ${c.denied ? '✗' : ' '} ${c.cmd ?? ''}${cost}${c.reason ? `   ← ${c.reason}` : ''}`);
+        }
+        // LUM-781 — the model's side, step by step, then how it ended. Only when
+        // the row carries them: an older row prints exactly as before.
+        for (const st of t.trace ?? []) {
+            out.push(`    #${st.i ?? '?'} tool=${st.tool ?? '(none)'} in=${st.inputTokens ?? '?'} out=${st.outputTokens ?? '?'}${st.reasoningTokens ? ` reasoning=${st.reasoningTokens}` : ''}${st.elidedChars ? ` elided=${st.elidedChars}` : ''}${st.finishReason ? ` finish=${st.finishReason}` : ''}${st.text ? ` "${oneLine(st.text, 160)}"` : ''}`);
+        }
+        if (t.stop) {
+            const s = t.stop;
+            out.push(`    stop: ${s.by ?? '?'} · spent ${s.spent ?? '?'}/${s.budget ?? '?'} · reserve ${s.reserve ?? 0} · last step ${s.lastStep ?? '?'}${typeof s.next === 'number' ? ` · next ${s.next}` : ''} · ${s.steps ?? '?'} steps`);
+        }
+        if (t.wrapUp) {
+            const w = t.wrapUp;
+            out.push(w.ran
+                ? `    wrap-up: ran · submitted ${w.submitted ?? 0} · ${w.tokens ?? '?'} tokens${w.finishReason ? ` · finish=${w.finishReason}` : ''}${w.text ? ` · "${oneLine(w.text, 200)}"` : ''}`
+                : w.error
+                    ? `    wrap-up: attempted, failed — ${oneLine(w.error, 160)}`
+                    : `    wrap-up: not made (${w.skipped ?? 'unknown'})`);
+        }
+    }
+    return out;
+}
+/**
+ * The per-task, command-by-command listing of the lum739 audit report —
+ * only tasks that actually asked the shell for something.
+ *
+ * The run-level `shell:` line says HOW MUCH; only this says WHAT — and telling
+ * "mapped the repo and ran out" from "the gate rejected everything" from
+ * "looked and found nothing" is the entire reason the field exists. Extracted
+ * as a pure function so it can be tested: a read-out nothing exercises is the
+ * same "computed, carried, never read" shape this layer has already lost four
+ * fields to.
+ */
+function formatShellDetail(tasks, maxTasks) {
+    return formatHuntTaskDetail(tasks.filter(x => x.shell?.calls), maxTasks);
+}