@team-agent/installer 0.5.91 → 0.5.94

package/crates/team-agent/src/cli/models.rs

@@ -902,6 +902,7 @@ mod tests {
 
     #[cfg(unix)]
     #[test]
+    #[serial_test::serial(env)]
     fn command_boundary_connects_runner_parser_search_and_contract() {
         let path = fixture(
             "printf 'provider model\\nopenai-codex gpt-5.6-sol\\nopenai-codex gpt-5.6-luna\\n'",

package/crates/team-agent/src/cli/tests/shutdown_kill_plan.rs

@@ -1,7 +1,7 @@
 //! E12 (P0) · `sessions_to_kill` 纯决策单测(kill 决策下沉)。
 //!
 //! spare = state 锚 session(anchor_sessions) ∪ `team-agent-leader-` 命名前缀(并集,锚优先)。
-//! 独享 socket(无 spare)才允许整 server 拆;共享/leader 在 → 逐 session kill。
+//! Cleanup is always per-session and ownership-gated; a socket is never sufficient authority for kill-server.
 //! 集成面由 tests/b5_leader_terminal_kill_red.rs 的真 tmux 契约覆盖,此处锁纯决策 + 4 反向 case。
 
 use crate::cli::lifecycle_port::{sessions_to_kill, KillDecision};
@@ -23,12 +23,15 @@ fn anchors(raw: &[&str]) -> BTreeSet<String> {
     raw.iter().map(|s| s.to_string()).collect()
 }
 
-// RC-4(独享 socket):仅目标 session(无 spare)→ 整 server 拆。
+// RC-4: even an apparently exclusive socket uses per-session cleanup.
 #[test]
-fn rc4_exclusive_socket_kills_server() {
+fn rc4_exclusive_socket_is_fail_closed() {
     assert_eq!(
         sessions_to_kill(&names(&["team-x", "team-y"]), &BTreeSet::new()),
-        KillDecision::KillServerExclusive
+        KillDecision::KillIndividually {
+            to_kill: names(&["team-x", "team-y"]),
+            spared: vec![]
+        }
     );
     // 空 session 集 → 逐 kill(no-op),不整 server 拆(没东西可拆)。
     assert_eq!(
@@ -87,10 +90,13 @@ fn rc2_no_anchor_falls_back_to_naming() {
         &BTreeSet::new(),
     );
     assert!(matches!(with_leader, KillDecision::KillIndividually { .. }));
-    // 无锚 + 无前缀(真损坏且 in_tmux 无前缀)→ 无 spare → 独享拆(退化兜底,与历史一致)。
+    // 无锚 + 无前缀仍只能逐 session 返回，实际 shutdown 会因 marker 缺失拒绝杀灭。
     assert_eq!(
         sessions_to_kill(&names(&["team-x"]), &BTreeSet::new()),
-        KillDecision::KillServerExclusive
+        KillDecision::KillIndividually {
+            to_kill: names(&["team-x"]),
+            spared: vec![]
+        }
     );
 }
 
@@ -169,6 +175,8 @@ fn owned_empty_endpoint_cleanup_removes_socket_file_before_reporting_ok() {
         &ws,
         &json!({
             "session_name": "team-owned-clean",
+            "team_key": "team-owned-clean",
+            "generation": "team-owned-clean",
             "tmux_endpoint": socket.to_string_lossy(),
             "tmux_socket": socket.to_string_lossy(),
             "tmux_socket_source": "workspace",
@@ -177,7 +185,12 @@ fn owned_empty_endpoint_cleanup_removes_socket_file_before_reporting_ok() {
         }),
     )
     .unwrap();
-    let transport = CleanShutdownTransport::new();
+    let transport = CleanShutdownTransport::new().with_owned_session(
+        &ws,
+        "team-owned-clean",
+        "team-owned-clean",
+        "team-owned-clean",
+    );
 
     let out = crate::cli::lifecycle_port::shutdown_with_transport(&ws, true, None, &transport)
         .expect("shutdown should complete");
@@ -186,12 +199,12 @@ fn owned_empty_endpoint_cleanup_removes_socket_file_before_reporting_ok() {
     assert_eq!(out["status"], json!("ok"));
     assert_eq!(out["residuals"]["owned_files"], json!([]));
     assert!(
-        !socket.exists(),
-        "owned empty endpoint socket file must be removed"
+        socket.exists(),
+        "fail-closed endpoint cleanup must preserve the socket file"
     );
     assert!(
-        transport.kill_server_called(),
-        "owned empty endpoint should be torn down after session cleanup"
+        !transport.kill_server_called(),
+        "endpoint ownership must not authorize server teardown"
     );
 }
 
@@ -235,6 +248,8 @@ fn owned_file_residual_makes_shutdown_failed_not_partial() {
         &ws,
         &json!({
             "session_name": "team-owned-residual",
+            "team_key": "team-owned-residual",
+            "generation": "team-owned-residual",
             "tmux_endpoint": socket_dir.to_string_lossy(),
             "tmux_socket": socket_dir.to_string_lossy(),
             "tmux_socket_source": "workspace",
@@ -243,18 +258,22 @@ fn owned_file_residual_makes_shutdown_failed_not_partial() {
         }),
     )
     .unwrap();
-    let transport = CleanShutdownTransport::new();
+    let transport = CleanShutdownTransport::new().with_owned_session(
+        &ws,
+        "team-owned-residual",
+        "team-owned-residual",
+        "team-owned-residual",
+    );
 
     let out = crate::cli::lifecycle_port::shutdown_with_transport(&ws, true, None, &transport)
         .expect("shutdown should complete");
 
-    assert_eq!(out["ok"], json!(false));
-    assert_eq!(out["status"], json!("failed"));
+    assert_eq!(out["ok"], json!(true));
+    assert_eq!(out["status"], json!("ok"));
     assert_eq!(out["phase"], json!(null));
-    assert_eq!(
-        out["residuals"]["owned_files"],
-        json!([{ "path": socket_dir.display().to_string() }])
-    );
+    assert_eq!(out["residuals"]["owned_files"], json!([]));
+    assert!(socket_dir.exists(), "fail-closed cleanup preserves residual files");
+    assert!(!transport.kill_server_called());
 }
 
 #[test]
@@ -340,6 +359,7 @@ fn scoped_clean_shutdown_persists_team_shutdown_status_after_disk_roundtrip() {
             "schema_version": 1,
             "active_team_key": "current",
             "team_key": "current",
+            "generation": "current",
             "session_name": "team-current",
             "team_dir": ws.display().to_string(),
             "workspace": ws.display().to_string(),
@@ -354,6 +374,7 @@ fn scoped_clean_shutdown_persists_team_shutdown_status_after_disk_roundtrip() {
             "teams": {
                 "current": {
                     "team_key": "current",
+                    "generation": "current",
                     "session_name": "team-current",
                     "team_dir": ws.display().to_string(),
                     "workspace": ws.display().to_string(),
@@ -375,7 +396,12 @@ fn scoped_clean_shutdown_persists_team_shutdown_status_after_disk_roundtrip() {
         &ws,
         true,
         Some("current"),
-        &CleanShutdownTransport::new(),
+        &CleanShutdownTransport::new().with_owned_session(
+            &ws,
+            "team-current",
+            "current",
+            "current",
+        ),
     )
     .expect("shutdown should complete");
 
@@ -414,6 +440,7 @@ fn scoped_degraded_shutdown_does_not_persist_team_shutdown_status() {
             "schema_version": 1,
             "active_team_key": "current",
             "team_key": "current",
+            "generation": "current",
             "session_name": "team-current",
             "agents": {
                 "adminweb": {
@@ -426,6 +453,7 @@ fn scoped_degraded_shutdown_does_not_persist_team_shutdown_status() {
             "teams": {
                 "current": {
                     "team_key": "current",
+                    "generation": "current",
                     "session_name": "team-current",
                     "agents": {
                         "adminweb": {
@@ -445,7 +473,9 @@ fn scoped_degraded_shutdown_does_not_persist_team_shutdown_status() {
         &ws,
         true,
         Some("current"),
-        &CleanShutdownTransport::new().with_probe_timeout("ps_table"),
+        &CleanShutdownTransport::new()
+            .with_owned_session(&ws, "team-current", "current", "current")
+            .with_probe_timeout("ps_table"),
     )
     .expect("shutdown should complete");
 
@@ -519,6 +549,8 @@ fn repeated_owned_endpoint_shutdowns_leave_no_socket_file_growth() {
             &ws,
             &json!({
                 "session_name": "team-owned-loop",
+                "team_key": "team-owned-loop",
+                "generation": "team-owned-loop",
                 "tmux_endpoint": socket.to_string_lossy(),
                 "tmux_socket": socket.to_string_lossy(),
                 "tmux_socket_source": "workspace",
@@ -535,7 +567,12 @@ fn repeated_owned_endpoint_shutdowns_leave_no_socket_file_growth() {
             &ws,
             true,
             None,
-            &CleanShutdownTransport::new(),
+            &CleanShutdownTransport::new().with_owned_session(
+                &ws,
+                "team-owned-loop",
+                "team-owned-loop",
+                "team-owned-loop",
+            ),
         );
         let out = match &result {
             Ok(out) if !shutdown_result_is_degraded(out) => out,
@@ -573,8 +610,9 @@ fn repeated_owned_endpoint_shutdowns_leave_no_socket_file_growth() {
     }
     let ending = sockets.iter().filter(|path| path.exists()).count();
     assert_eq!(
-        ending, starting,
-        "owned socket files must not grow across loops"
+        ending,
+        starting + sockets.len(),
+        "fail-closed endpoint cleanup must not remove unverified socket files"
     );
     #[cfg(unix)]
     if expected_probe_failure {
@@ -793,6 +831,7 @@ struct CleanShutdownTransport {
     probe_timeout_kind: Option<&'static str>,
     targets_persist_after_kill: bool,
     kill_session_error: Option<String>,
+    owner: Option<crate::transport::SessionOwner>,
     // E49 (0.3.24 P0, shutdown kills leader CLI): record per-pane / per-window /
     // per-session kill targets so RED contracts can assert (a) the leader pane is
     // never killed and (b) worker panes ARE killed via the new per-pane path.
@@ -810,6 +849,7 @@ impl CleanShutdownTransport {
             probe_timeout_kind: None,
             targets_persist_after_kill: false,
             kill_session_error: None,
+            owner: None,
             killed_panes: Mutex::new(Vec::new()),
             killed_window_targets: Mutex::new(Vec::new()),
             killed_sessions: Mutex::new(Vec::new()),
@@ -821,6 +861,46 @@ impl CleanShutdownTransport {
         self
     }
 
+    fn with_owned_session(
+        mut self,
+        workspace: &Path,
+        session: &str,
+        team: &str,
+        generation: &str,
+    ) -> Self {
+        self.owner = Some(crate::transport::SessionOwner {
+            workspace: workspace
+                .canonicalize()
+                .unwrap_or_else(|_| workspace.to_path_buf())
+                .to_string_lossy()
+                .into_owned(),
+            team: team.to_string(),
+            generation: generation.to_string(),
+        });
+        if self.targets.is_empty() {
+            self.targets.push(PaneInfo {
+                pane_id: PaneId::new("%owned"),
+                session: SessionName::new(session),
+                window_index: Some(0),
+                window_name: Some(WindowName::new("owned")),
+                pane_index: Some(0),
+                tty: None,
+                current_command: Some("codex".to_string()),
+                current_path: Some(workspace.to_path_buf()),
+                active: true,
+                pane_pid: None,
+                leader_env: BTreeMap::new(),
+            });
+        } else {
+            for target in &mut self.targets {
+                if target.current_path.is_none() {
+                    target.current_path = Some(workspace.to_path_buf());
+                }
+            }
+        }
+        self
+    }
+
     fn kill_server_called(&self) -> bool {
         *self.kill_server_called.lock().unwrap()
     }
@@ -931,6 +1011,13 @@ impl Transport for CleanShutdownTransport {
         Ok(*self.session_present.lock().unwrap())
     }
 
+    fn session_owner(
+        &self,
+        _session: &SessionName,
+    ) -> Result<Option<crate::transport::SessionOwner>, TransportError> {
+        Ok(self.owner.clone())
+    }
+
     fn list_windows(&self, _session: &SessionName) -> Result<Vec<WindowName>, TransportError> {
         Ok(Vec::new())
     }
@@ -1001,6 +1088,8 @@ fn lsof_cwd_timeout_is_diagnostic_not_shutdown_partial() {
         &ws,
         &json!({
             "session_name": "team-lsof-cwd-timeout",
+            "team_key": "team-lsof-cwd-timeout",
+            "generation": "team-lsof-cwd-timeout",
             "is_external_leader": true,
             "agents": {
                 "fake_impl": {
@@ -1017,7 +1106,14 @@ fn lsof_cwd_timeout_is_diagnostic_not_shutdown_partial() {
         &ws,
         true,
         None,
-        &CleanShutdownTransport::new().with_probe_timeout("lsof_cwd"),
+        &CleanShutdownTransport::new()
+            .with_owned_session(
+                &ws,
+                "team-lsof-cwd-timeout",
+                "team-lsof-cwd-timeout",
+                "team-lsof-cwd-timeout",
+            )
+            .with_probe_timeout("lsof_cwd"),
     )
     .expect("shutdown should complete");
 
@@ -1051,6 +1147,8 @@ fn ps_table_timeout_still_degrades_shutdown_truth() {
         &ws,
         &json!({
             "session_name": "team-ps-table-timeout",
+            "team_key": "team-ps-table-timeout",
+            "generation": "team-ps-table-timeout",
             "agents": {
                 "fake_impl": {
                     "status": "running",
@@ -1066,7 +1164,14 @@ fn ps_table_timeout_still_degrades_shutdown_truth() {
         &ws,
         true,
         None,
-        &CleanShutdownTransport::new().with_probe_timeout("ps_table"),
+        &CleanShutdownTransport::new()
+            .with_owned_session(
+                &ws,
+                "team-ps-table-timeout",
+                "team-ps-table-timeout",
+                "team-ps-table-timeout",
+            )
+            .with_probe_timeout("ps_table"),
     )
     .expect("shutdown should complete");
 
@@ -1169,6 +1274,9 @@ fn leader_env_tmux_socket_never_kills_server_even_when_sessions_look_exclusive()
         &ws,
         &json!({
             "is_external_leader": true,
+            "team_key": "team-layout",
+            "generation": "team-layout",
+            "session_name": "team-layout",
             "tmux_socket_source": "leader_env",
             "agents": {
                 "fake_impl": {
@@ -1193,6 +1301,7 @@ fn leader_env_tmux_socket_never_kills_server_even_when_sessions_look_exclusive()
         pane_pid: None,
         leader_env: BTreeMap::new(),
     }]);
+    let transport = transport.with_owned_session(&ws, "team-layout", "team-layout", "team-layout");
 
     let out = crate::cli::lifecycle_port::shutdown_with_transport(&ws, true, None, &transport)
         .expect("shutdown should complete");
@@ -1239,6 +1348,8 @@ fn e49_managed_leader_shutdown_spares_leader_session_and_kills_workers_per_pane(
         &ws,
         &json!({
             "session_name": "team-current",
+            "team_key": "current",
+            "generation": "current",
             "is_external_leader": false,
             "leader_receiver": {"pane_id": "%leader"},
             "team_owner": {"pane_id": "%leader"},
@@ -1294,7 +1405,8 @@ fn e49_managed_leader_shutdown_spares_leader_session_and_kills_workers_per_pane(
                 leader_env: BTreeMap::new(),
             },
         ])
-        .with_targets_persist_after_kill();
+        .with_targets_persist_after_kill()
+        .with_owned_session(&ws, "team-current", "current", "current");
 
     let out = crate::cli::lifecycle_port::shutdown_with_transport(&ws, true, None, &transport)
         .expect("shutdown should complete");
@@ -1381,6 +1493,8 @@ fn e49_external_leader_shutdown_still_kills_team_session_unconditionally() {
         &ws,
         &json!({
             "session_name": "team-external",
+            "team_key": "team-external",
+            "generation": "team-external",
             "is_external_leader": true,
             "leader_receiver": {"pane_id": "%leaderelsewhere"},
             "agents": {
@@ -1420,7 +1534,8 @@ fn e49_external_leader_shutdown_still_kills_team_session_unconditionally() {
                 leader_env: BTreeMap::new(),
             },
         ])
-        .with_targets_persist_after_kill();
+        .with_targets_persist_after_kill()
+        .with_owned_session(&ws, "team-external", "team-external", "team-external");
 
     let event_log = crate::event_log::EventLog::new(&ws);
     let event_start = event_log.tail(0).expect("events before shutdown").len();
@@ -1455,6 +1570,8 @@ fn e49_external_leader_non_clean_diagnostic_is_bounded_and_still_kills() {
         &ws,
         &json!({
             "session_name": "team-external",
+            "team_key": "team-external",
+            "generation": "team-external",
             "is_external_leader": true,
             "leader_receiver": {"pane_id": "%leaderelsewhere"},
             "agents": {
@@ -1477,7 +1594,8 @@ fn e49_external_leader_non_clean_diagnostic_is_bounded_and_still_kills() {
             pane_pid: None,
             leader_env: BTreeMap::new(),
         }])
-        .with_kill_session_error("deterministic E49 kill-session failure");
+        .with_kill_session_error("deterministic E49 kill-session failure")
+        .with_owned_session(&ws, "team-external", "team-external", "team-external");
 
     let event_log = crate::event_log::EventLog::new(&ws);
     let event_start = event_log.tail(0).expect("events before shutdown").len();
@@ -1537,6 +1655,8 @@ fn e49_managed_leader_without_anchor_in_session_still_kills_session() {
         &ws,
         &json!({
             "session_name": "team-orphan",
+            "team_key": "team-orphan",
+            "generation": "team-orphan",
             "is_external_leader": false,
             "agents": {
                 "w1": {"status": "running", "provider": "codex", "window": "w1", "pane_id": "%w1"}
@@ -1558,7 +1678,8 @@ fn e49_managed_leader_without_anchor_in_session_still_kills_session() {
             pane_pid: None,
             leader_env: BTreeMap::new(),
         }])
-        .with_targets_persist_after_kill();
+        .with_targets_persist_after_kill()
+        .with_owned_session(&ws, "team-orphan", "team-orphan", "team-orphan");
 
     let out = crate::cli::lifecycle_port::shutdown_with_transport(&ws, true, None, &transport)
         .expect("shutdown should complete");
@@ -1580,6 +1701,8 @@ fn shutdown_missing_topology_marker_defaults_to_managed_cleanup() {
         &ws,
         &json!({
             "session_name": "team-current",
+            "team_key": "team-current",
+            "generation": "team-current",
             "agents": {}
         }),
     )
@@ -1598,7 +1721,8 @@ fn shutdown_missing_topology_marker_defaults_to_managed_cleanup() {
             pane_pid: None,
             leader_env: BTreeMap::new(),
         }])
-        .with_targets_persist_after_kill();
+        .with_targets_persist_after_kill()
+        .with_owned_session(&ws, "team-current", "team-current", "team-current");
 
     let out = crate::cli::lifecycle_port::shutdown_with_transport(&ws, true, None, &transport)
         .expect("shutdown should complete");

package/crates/team-agent/src/cli/triage.rs

@@ -0,0 +1,183 @@
+//! Command-specific human triage projections for `doctor` and `diagnose`.
+//!
+//! The JSON report remains the source of truth. This renderer only projects its
+//! stable issue and repair entries; it does not perform I/O or recompute health.
+
+use serde_json::Value;
+
+use super::{CmdOutput, CmdResult};
+
+const LINE_LIMIT_BYTES: usize = 160;
+
+pub(crate) fn report(value: Value, as_json: bool, command: &str) -> CmdResult {
+    let result = CmdResult::from_json(value, as_json);
+    if as_json {
+        result
+    } else {
+        human_result(result, command)
+    }
+}
+
+pub(crate) fn human_result(result: CmdResult, command: &str) -> CmdResult {
+    let text = match &result.output {
+        CmdOutput::Json(report) => render(command, report),
+        CmdOutput::Human(text) => text.clone(),
+        CmdOutput::None => String::new(),
+    };
+    CmdResult {
+        output: CmdOutput::Human(text),
+        ..result
+    }
+}
+
+pub(crate) fn render(command: &str, report: &Value) -> String {
+    // Keep the renderer downstream of the external redaction boundary. The
+    // generic emitter redacts again for defense in depth.
+    let report = crate::redaction::redact_external_value(report);
+    let ok = report.get("ok").and_then(Value::as_bool).unwrap_or(false);
+    let mut lines = vec![bounded(format!(
+        "{command}: {}",
+        if ok { "ok" } else { "needs attention" }
+    ))];
+
+    if command == "doctor" {
+        for finding in array_items(
+            report
+                .get("secret_scan")
+                .and_then(|scan| scan.get("findings")),
+        ) {
+            let Some(object) = finding.as_object() else {
+                continue;
+            };
+            let (Some(rule), Some(path), Some(line)) = (
+                object.get("rule").and_then(Value::as_str),
+                object.get("path").and_then(Value::as_str),
+                object.get("line").and_then(Value::as_u64),
+            ) else {
+                continue;
+            };
+            lines.push(bounded(format!("warn: {rule} in {path}:{line}")));
+        }
+    }
+
+    for issue in array_items(report.get("issues")) {
+        lines.push(bounded(format!("issue: {}", summarize(issue, false))));
+    }
+    for repair in array_items(report.get("suggested_repairs")) {
+        lines.push(bounded(format!("repair: {}", summarize(repair, true))));
+    }
+    if let Some(error) = report.get("error").filter(|value| !value.is_null()) {
+        lines.push(bounded(format!("detail: {}", summarize(error, false))));
+    }
+    if lines.len() == 1 {
+        lines.push(bounded("detail: no issues detected".to_string()));
+    }
+    lines.join("\n")
+}
+
+fn array_items(value: Option<&Value>) -> &[Value] {
+    value.and_then(Value::as_array).map(Vec::as_slice).unwrap_or(&[])
+}
+
+fn summarize(value: &Value, repair: bool) -> String {
+    match value {
+        Value::String(value) => value.clone(),
+        Value::Null => "null".to_string(),
+        Value::Bool(value) => value.to_string(),
+        Value::Number(value) => value.to_string(),
+        Value::Array(values) => format!("{} entries", values.len()),
+        Value::Object(object) => {
+            let keys = if repair {
+                ["action", "hint_action", "next_action", "issue", "code", "reason"]
+                    .as_slice()
+            } else {
+                ["code", "issue", "id", "type", "status", "reason", "message"]
+                    .as_slice()
+            };
+            let mut parts = Vec::new();
+            for key in keys {
+                if let Some(value) = object.get(*key).and_then(Value::as_str) {
+                    parts.push(format!("{key}={value}"));
+                }
+            }
+            if parts.is_empty() {
+                let mut names = object.keys().cloned().collect::<Vec<_>>();
+                names.sort_unstable();
+                format!("fields={}", names.join(","))
+            } else {
+                parts.join("; ")
+            }
+        }
+    }
+}
+
+fn bounded(line: String) -> String {
+    let clean = line
+        .chars()
+        .map(|ch| if ch.is_control() { ' ' } else { ch })
+        .collect::<String>();
+    if clean.len() <= LINE_LIMIT_BYTES {
+        return clean;
+    }
+    let budget = LINE_LIMIT_BYTES.saturating_sub('…'.len_utf8());
+    let mut end = 0;
+    for (index, ch) in clean.char_indices() {
+        let next = index + ch.len_utf8();
+        if next > budget {
+            break;
+        }
+        end = next;
+    }
+    format!("{}…", &clean[..end.min(budget)])
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+    use serde_json::json;
+
+    #[test]
+    fn renderer_projects_each_issue_and_repair_without_dumping_runtime() {
+        let report = json!({
+            "ok": false,
+            "issues": ["short_issue", {"code": "object_issue", "message": "detail"}],
+            "suggested_repairs": [{"issue": "object_issue", "action": "run repair"}],
+            "providers": {"claude": {"version": "secret"}},
+            "runtime": {"workspace": "/tmp/secret"}
+        });
+        let output = render("diagnose", &report);
+        assert!(output.contains("issue: short_issue"));
+        assert!(output.contains("issue: code=object_issue"));
+        assert!(output.contains("repair: action=run repair"));
+        assert!(!output.contains("providers:"));
+        assert!(!output.contains("runtime:"));
+    }
+
+    #[test]
+    fn renderer_sanitizes_and_bounds_utf8_lines() {
+        let report = json!({"ok": false, "issues": ["问题\n".to_string() + &"x".repeat(200)]});
+        for line in render("doctor", &report).lines() {
+            assert!(line.len() <= LINE_LIMIT_BYTES);
+            assert!(!line.chars().any(char::is_control));
+        }
+    }
+
+    #[test]
+    fn renderer_projects_secret_findings_without_values() {
+        let report = json!({
+            "ok": false,
+            "secret_scan": {
+                "findings": [{
+                    "rule": "api_key_assignment",
+                    "path": "leaky-role.md",
+                    "line": 7,
+                    "match_excerpt": "OPENAI_API_KEY=secret"
+                }]
+            }
+        });
+        let output = render("doctor", &report);
+        assert!(output.contains("warn: api_key_assignment in leaky-role.md:7"));
+        assert!(!output.contains("match_excerpt"));
+        assert!(!output.contains("OPENAI_API_KEY=secret"));
+    }
+}