@vellumai/assistant 0.8.11 → 0.8.12-staging.2

package/src/runtime/routes/plugins-routes.ts

@@ -25,6 +25,10 @@
 
 import { z } from "zod";
 
+import {
+  inspectPlugin,
+  PluginInspectNotFoundError,
+} from "../../cli/lib/inspect-plugin.js";
 import {
   DEFAULT_PLUGIN_REF,
   installPlugin,
@@ -53,6 +57,10 @@ import {
   PluginNotInstalledError,
   uninstallPlugin,
 } from "../../cli/lib/uninstall-plugin.js";
+import {
+  PluginNotUpgradableError,
+  upgradePlugin,
+} from "../../cli/lib/upgrade-plugin.js";
 import { ACTOR_PRINCIPALS } from "../auth/route-policy.js";
 import {
   BadRequestError,
@@ -191,6 +199,27 @@ const pluginDetailsResponseSchema = z.object({
   ref: z
     .string()
     .describe("Git ref the catalog metadata / README were resolved at."),
+  artifact: z
+    .object({
+      url: z
+        .string()
+        .describe("HTTPS URL the prebuilt client artifact is downloaded from."),
+      sha256: z
+        .string()
+        .describe(
+          "Lowercase 64-char hex SHA-256 the download is verified against.",
+        ),
+      label: z
+        .string()
+        .optional()
+        .describe(
+          'Optional human label for the download (e.g. "Download for macOS"); absent when the plugin doesn\'t name it.',
+        ),
+    })
+    .nullable()
+    .describe(
+      "Prebuilt client artifact from `package.json` `vellum.artifact`, or null when the plugin ships none or its descriptor is incomplete (e.g. a placeholder sha256).",
+    ),
 });
 
 const pluginInstallRequestSchema = z.object({
@@ -215,6 +244,197 @@ const pluginInstallResponseSchema = z.object({
   ref: z.string().describe("Git ref the plugin was fetched from."),
 });
 
+const fingerprintComparisonSchema = z
+  .object({
+    modified: z
+      .array(z.string())
+      .describe("Tracked files whose content changed since install."),
+    added: z
+      .array(z.string())
+      .describe("Files present on disk but absent from the install baseline."),
+    removed: z
+      .array(z.string())
+      .describe("Files recorded at install but missing from the on-disk copy."),
+    clean: z
+      .boolean()
+      .describe("True when no files were added, removed, or modified."),
+  })
+  .describe(
+    "Local-edit comparison of the on-disk tree against the install-time fingerprint.",
+  );
+
+const installMetaSourceSchema = z
+  .object({
+    kind: z.string().describe("Source kind. Only `github` is written today."),
+    owner: z.string(),
+    repo: z.string(),
+    path: z
+      .string()
+      .optional()
+      .describe(
+        "Repo-relative directory holding the plugin root; absent = repo root.",
+      ),
+    ref: z
+      .string()
+      .describe(
+        "Ref the install resolved through (the pinned commit SHA for marketplace installs).",
+      ),
+  })
+  .describe(
+    "Source coordinates recorded in the install-time provenance sidecar.",
+  );
+
+const pluginLocalInfoSchema = z
+  .object({
+    target: z
+      .string()
+      .describe("Absolute path to the installed plugin directory."),
+    commit: z
+      .string()
+      .nullable()
+      .describe(
+        "Resolved commit the copy was installed at; null when no provenance was recorded.",
+      ),
+    version: z
+      .string()
+      .nullable()
+      .describe("Installed `package.json#version`."),
+    description: z
+      .string()
+      .nullable()
+      .describe("Installed `package.json#description`."),
+    installedAt: z
+      .string()
+      .nullable()
+      .describe(
+        "ISO-8601 install timestamp from the sidecar; null when absent.",
+      ),
+    source: installMetaSourceSchema
+      .nullable()
+      .describe(
+        "Source recorded at install time; null when no sidecar exists.",
+      ),
+    localChanges: fingerprintComparisonSchema
+      .nullable()
+      .describe(
+        "Local-edit state vs the install-time fingerprint; null when no baseline was recorded (older/manual install).",
+      ),
+    issues: z
+      .array(z.string())
+      .describe(
+        "Non-fatal issues with the installed copy (e.g. malformed `package.json`).",
+      ),
+  })
+  .describe("The locally installed copy of the plugin.");
+
+const pluginRemoteInfoSchema = z
+  .object({
+    repo: z
+      .string()
+      .describe("`owner/repo` of the external plugin repository."),
+    path: z
+      .string()
+      .describe(
+        'Repo-relative directory holding the plugin root; `""` = repo root.',
+      ),
+    commit: z
+      .string()
+      .describe(
+        "Pinned commit SHA the marketplace currently resolves installs to.",
+      ),
+    description: z.string().nullable(),
+    homepage: z.string().nullable(),
+    license: z.string().nullable(),
+    category: z.string().nullable(),
+    marketplaceRef: z
+      .string()
+      .describe(
+        "Ref of the canonical repo the marketplace manifest was read from.",
+      ),
+  })
+  .describe("The marketplace's current pin and advertised metadata.");
+
+const pluginInspectResponseSchema = z.object({
+  name: z
+    .string()
+    .describe("Install name. Matches `assistant plugins install <name>`."),
+  installed: z
+    .boolean()
+    .describe(
+      "Whether a copy is materialized under `<workspaceDir>/plugins/`.",
+    ),
+  status: z
+    .enum([
+      "up-to-date",
+      "update-available",
+      "not-installed",
+      "not-in-marketplace",
+      "unknown-provenance",
+      "remote-unavailable",
+    ])
+    .describe(
+      "Drift classification between the installed copy and the marketplace pin.",
+    ),
+  local: pluginLocalInfoSchema
+    .nullable()
+    .describe("Locally installed copy; null when the plugin is not installed."),
+  remote: pluginRemoteInfoSchema
+    .nullable()
+    .describe(
+      "Marketplace pin + metadata; null when no entry claims the name or it was unreachable.",
+    ),
+  remoteError: z
+    .string()
+    .nullable()
+    .describe(
+      "Marketplace fetch error message, when the catalog could not be read.",
+    ),
+});
+
+const pluginUpgradeRequestSchema = z.object({
+  dryRun: z
+    .boolean()
+    .optional()
+    .describe(
+      "Report what would change without modifying the install. Defaults to false.",
+    ),
+});
+
+const pluginUpgradeResponseSchema = z.object({
+  name: z.string().describe("Install name that was (or would be) upgraded."),
+  outcome: z
+    .enum(["upgraded", "already-up-to-date", "would-upgrade"])
+    .describe(
+      "`upgraded` moved the install to the pin; `already-up-to-date` was a no-op; `would-upgrade` is a dry-run that found drift.",
+    ),
+  fromCommit: z
+    .string()
+    .nullable()
+    .describe(
+      "Installed commit before the upgrade; null when no provenance was recorded.",
+    ),
+  toCommit: z
+    .string()
+    .describe(
+      "Marketplace-pinned commit the install was (or would be) moved to.",
+    ),
+  target: z
+    .string()
+    .describe("Absolute path to the installed plugin directory on the host."),
+  fileCount: z
+    .number()
+    .nullable()
+    .describe(
+      "Files materialized by the upgrade; null for a no-op or dry run.",
+    ),
+  dryRun: z.boolean().describe("Whether this was a dry run (no changes made)."),
+  provenanceWasUnknown: z
+    .boolean()
+    .describe(
+      "Whether the install lacked resolvable provenance before the upgrade; such installs are re-pinned to record it going forward.",
+    ),
+});
+
 // ---------------------------------------------------------------------------
 // Helpers
 // ---------------------------------------------------------------------------
@@ -468,6 +688,91 @@ async function handleInstallPlugin({ body = {} }: RouteHandlerArgs) {
   }
 }
 
+// ---------------------------------------------------------------------------
+// Handler — inspect (drift)
+// ---------------------------------------------------------------------------
+
+async function handleInspectPlugin({ pathParams = {} }: RouteHandlerArgs) {
+  const rawName = pathParams.name ?? "";
+
+  try {
+    // `inspectPlugin` never throws for an unreachable marketplace when a local
+    // copy exists — it reports `status: "remote-unavailable"` and captures the
+    // message in `remoteError`. It only throws when there is nothing to show.
+    return await inspectPlugin(
+      { name: rawName },
+      { fetch: globalThis.fetch.bind(globalThis) },
+    );
+  } catch (err) {
+    if (err instanceof InvalidPluginNameError) {
+      throw new BadRequestError(err.message);
+    }
+    if (err instanceof PluginInspectNotFoundError) {
+      throw new NotFoundError(err.message);
+    }
+    throw new InternalError(
+      err instanceof Error ? err.message : "plugin inspect failed",
+    );
+  }
+}
+
+// ---------------------------------------------------------------------------
+// Handler — upgrade
+// ---------------------------------------------------------------------------
+
+async function handleUpgradePlugin({
+  pathParams = {},
+  body = {},
+}: RouteHandlerArgs) {
+  const rawName = pathParams.name ?? "";
+  const dryRun = typeof body.dryRun === "boolean" ? body.dryRun : undefined;
+
+  // Like install, the upgrade target ref is the curated marketplace pin
+  // (resolved inside `upgradePlugin` via `inspectPlugin`), never a
+  // caller-supplied ref — a `settings.write` principal cannot redirect the
+  // upgrade at an unreviewed revision.
+  try {
+    const result = await upgradePlugin(
+      { name: rawName, dryRun },
+      { fetch: globalThis.fetch.bind(globalThis) },
+    );
+    return {
+      name: result.name,
+      outcome: result.outcome,
+      fromCommit: result.fromCommit,
+      toCommit: result.toCommit,
+      target: result.target,
+      fileCount: result.fileCount,
+      dryRun: result.dryRun,
+      provenanceWasUnknown: result.provenanceWasUnknown,
+    };
+  } catch (err) {
+    if (err instanceof InvalidPluginNameError) {
+      throw new BadRequestError(err.message);
+    }
+    if (err instanceof PluginNotInstalledError) {
+      throw new NotFoundError(err.message);
+    }
+    if (err instanceof PluginNotFoundError) {
+      throw new NotFoundError(err.message);
+    }
+    // The install exists but has no marketplace entry to advance to — a
+    // permanent state the caller cannot resolve by retrying. 409 marks the
+    // request as well-formed but not actionable in the current state.
+    if (err instanceof PluginNotUpgradableError) {
+      throw new ConflictError(err.message);
+    }
+    // A rate-limited or temporarily-down source (the plugin repo or the
+    // marketplace catalog) is a retryable outage, not a conflict — 503.
+    if (err instanceof PluginSourceUnavailableError) {
+      throw new ServiceUnavailableError(err.message);
+    }
+    throw new InternalError(
+      err instanceof Error ? err.message : "plugin upgrade failed",
+    );
+  }
+}
+
 // ---------------------------------------------------------------------------
 // Route definitions
 // ---------------------------------------------------------------------------
@@ -628,4 +933,79 @@ export const ROUTES: RouteDefinition[] = [
     },
     handler: handleUninstallPlugin,
   },
+  {
+    operationId: "plugins_inspect",
+    endpoint: "plugins/:name/inspect",
+    method: "GET",
+    policy: {
+      requiredScopes: ["settings.read"],
+      allowedPrincipalTypes: ACTOR_PRINCIPALS,
+    },
+    summary: "Inspect a plugin's install drift",
+    description:
+      "Compare the locally installed copy of a plugin against the marketplace's current pinned commit and report whether an upgrade is available. Returns a six-way `status` (`up-to-date`, `update-available`, `not-installed`, `not-in-marketplace`, `unknown-provenance`, `remote-unavailable`) plus the local provenance (installed commit, version, source, and any local edits vs the install-time fingerprint) and the remote pin. An unreachable marketplace for an installed plugin is not fatal — it returns 200 with `status: \"remote-unavailable\"`. A name that is neither installed nor in the catalog returns 404. Powers the web upgrade affordance; mirrors the CLI's `assistant plugins inspect <name>` and `GET /v1/skills/:id/inspect`.",
+    tags: ["plugins"],
+    pathParams: [
+      {
+        name: "name",
+        type: "string",
+        description:
+          "Install name. Must match the kebab-case name accepted by `assistant plugins install`.",
+      },
+    ],
+    responseBody: pluginInspectResponseSchema,
+    additionalResponses: {
+      "400": {
+        description:
+          "The plugin name failed sanitization (e.g. contained slashes, dots, or uppercase letters).",
+      },
+      "404": {
+        description:
+          "No installed copy and no catalog entry claims the given name.",
+      },
+    },
+    handler: handleInspectPlugin,
+  },
+  {
+    operationId: "plugins_upgrade",
+    endpoint: "plugins/:name/upgrade",
+    method: "POST",
+    policy: {
+      requiredScopes: ["settings.write"],
+      allowedPrincipalTypes: ACTOR_PRINCIPALS,
+    },
+    summary: "Upgrade a plugin to the marketplace pin",
+    description:
+      'Move an installed plugin to the marketplace\'s current pinned commit, re-materializing it under `<workspaceDir>/plugins/<name>/`. Always resolves against the curated marketplace pin (no caller-supplied ref), mirroring `plugins install`\'s curation boundary. A no-op (`outcome: "already-up-to-date"`) when the installed commit already equals the pin; pass `dryRun` to preview the move (`outcome: "would-upgrade"`) without touching the install. Installs lacking provenance are re-pinned to the current SHA. The assistant must be restarted to load the upgraded code. This does not gate on local edits — callers should consult `GET /v1/plugins/:name/inspect` (`local.localChanges`) first and confirm before overwriting. Mirrors the CLI\'s `assistant plugins upgrade <name>`.',
+    tags: ["plugins"],
+    pathParams: [
+      {
+        name: "name",
+        type: "string",
+        description:
+          "Install name. Must match the kebab-case name accepted by `assistant plugins install`.",
+      },
+    ],
+    requestBody: pluginUpgradeRequestSchema,
+    responseBody: pluginUpgradeResponseSchema,
+    additionalResponses: {
+      "400": {
+        description:
+          "The plugin name failed sanitization (e.g. contained slashes, dots, or uppercase letters).",
+      },
+      "404": {
+        description:
+          "No copy of the plugin is installed, or its source resolves to nothing.",
+      },
+      "409": {
+        description:
+          "The install exists but has no marketplace entry to advance to.",
+      },
+      "503": {
+        description:
+          "The plugin source (GitHub) was temporarily unavailable; the upgrade is retryable.",
+      },
+    },
+    handler: handleUpgradePlugin,
+  },
 ];

package/src/runtime/routes/redact-staged-export.ts

@@ -0,0 +1,259 @@
+/**
+ * Export-time secret sweep for the log export staging directory.
+ *
+ * `POST /v1/export` stages audit DB rows, daemon logs, a sanitized config
+ * snapshot, and allowlisted workspace files before archiving them. The
+ * structural sanitizers (write-time audit-input redaction, config snapshot
+ * env scrubbing) only protect data written after they shipped — legacy audit
+ * rows already persisted with plaintext inputs, and free-form workspace
+ * conversation logs, can still carry raw secrets. This module is the final
+ * belt: a pattern-based `redactSecrets()` pass over staged files immediately
+ * before the tar.gz is created.
+ *
+ * Coverage: every staged file that sniffs as text (no NUL byte in its first
+ * 8 KiB) is swept; files that sniff as binary are left untouched. That
+ * single check covers everything the export stages as text today —
+ * `audit-data.json`, `messages.json`, `config-snapshot.json`, daemon `.log`
+ * files, `conversation-filtered.jsonl`, workspace copies
+ * (`conversations/**\/messages.jsonl`, `.tool-results/*.txt`) — plus
+ * conversation `attachments/` with arbitrary user extensions (`.env`,
+ * `.csv`, extensionless). Serialized-JSON formats (`.json`, `.jsonl`) are
+ * redacted via a parse → redact-string-leaves → re-stringify path so the
+ * quoted redaction marker cannot corrupt them. Files above the size cap are
+ * NOT shipped unswept: their content is replaced with a short omission note
+ * (fail closed). Likewise, a file whose redacted content cannot be written
+ * back is replaced with a note rather than shipped with its original bytes.
+ */
+
+import type { Dirent } from "node:fs";
+import {
+  chmodSync,
+  closeSync,
+  openSync,
+  readdirSync,
+  readFileSync,
+  readSync,
+  rmSync,
+  statSync,
+  writeFileSync,
+} from "node:fs";
+import { extname, join } from "node:path";
+
+import { redactJsonStringLeaves } from "../../security/redact-json.js";
+import { redactSecrets } from "../../security/secret-scanner.js";
+import { getLogger } from "../../util/logger.js";
+
+const log = getLogger("redact-staged-export");
+
+/**
+ * Files larger than this are not read into memory — the sweep reads each
+ * file fully to redact it. Every staged section is bounded at the source
+ * (row-capped DB dumps, the daemon-log payload cap, workspace copy caps), so
+ * staged files sit well below this. Oversized sweep-eligible files fail
+ * closed: their content is replaced with `OVERSIZED_FILE_NOTE` so legacy
+ * plaintext secrets can never ship unswept.
+ */
+export const MAX_SWEEP_FILE_BYTES = 32 * 1024 * 1024;
+
+/** Replacement content for files that exceed `MAX_SWEEP_FILE_BYTES`. */
+export const OVERSIZED_FILE_NOTE = `[content omitted from export: file exceeded the ${
+  MAX_SWEEP_FILE_BYTES / (1024 * 1024)
+} MiB secret-redaction cap]\n`;
+
+/**
+ * Replacement content for files where redaction detected a secret but the
+ * redacted content could not be written back in place.
+ */
+const UNWRITABLE_FILE_NOTE =
+  "[content omitted from export: redaction detected a secret but could not rewrite this staged file]\n";
+
+/**
+ * Replace a staged file's content with a short omission note. Removal +
+ * recreation is a directory-level operation, so it succeeds regardless of
+ * the file's own mode bits (the staging dir is daemon-created and writable).
+ * Throws if the replacement fails — callers rely on that to fail closed
+ * rather than letting the tar step ship the original content.
+ */
+function replaceFileWithNote(filePath: string, note: string): void {
+  rmSync(filePath, { force: true });
+  writeFileSync(filePath, note, { encoding: "utf-8", mode: 0o600 });
+}
+
+/**
+ * Bytes read from the head of each staged file to classify it as text
+ * (sweep it) or binary (leave it untouched).
+ */
+const TEXT_SNIFF_BYTES = 8 * 1024;
+
+/**
+ * Heuristic text check: a file is treated as text when its first
+ * `TEXT_SNIFF_BYTES` contain no NUL byte. Binary formats (images, archives,
+ * SQLite, …) virtually always carry a NUL early; redacting them as text
+ * would corrupt them for no benefit.
+ */
+function sniffsAsText(filePath: string): boolean {
+  const fd = openSync(filePath, "r");
+  try {
+    const buffer = Buffer.alloc(TEXT_SNIFF_BYTES);
+    const bytesRead = readSync(fd, buffer, 0, buffer.length, 0);
+    return !buffer.subarray(0, bytesRead).includes(0);
+  } finally {
+    closeSync(fd);
+  }
+}
+
+/**
+ * Redact a serialized-JSON document while preserving its validity: parse,
+ * redact every string leaf, and re-stringify with `indent` (unchanged text
+ * is returned byte-identical). A leading UTF-8 BOM — common in user
+ * attachments — would make `JSON.parse` throw, so it is stripped for parsing
+ * and re-prepended on changed output to keep the content faithful. Falls
+ * back to plain-text redaction when the text isn't valid JSON — it is
+ * already malformed, so there is no validity to preserve.
+ */
+function redactSerializedJson(text: string, indent?: number): string {
+  const bom = text.startsWith("\uFEFF") ? "\uFEFF" : "";
+  let parsed: unknown;
+  try {
+    parsed = JSON.parse(bom ? text.slice(1) : text);
+  } catch {
+    return redactSecrets(text);
+  }
+  const { value, changed } = redactJsonStringLeaves(parsed);
+  return changed ? bom + JSON.stringify(value, null, indent) : text;
+}
+
+/**
+ * Redact a `.jsonl` file's content line by line, preserving each line's
+ * JSON validity (compact re-stringify, no pretty-printing). Unchanged lines
+ * map to themselves, so split/join leaves clean content byte-identical.
+ */
+function redactJsonlContent(content: string): string {
+  return content
+    .split("\n")
+    .map((line) => (line.trim() === "" ? line : redactSerializedJson(line)))
+    .join("\n");
+}
+
+function redactContent(content: string, ext: string): string {
+  if (ext === ".json") return redactSerializedJson(content, 2);
+  if (ext === ".jsonl") return redactJsonlContent(content);
+  return redactSecrets(content);
+}
+
+/**
+ * Run a secret-redaction sweep over every staged text file under
+ * `stagingDir`, rewriting in place any file where `redactSecrets()` found a
+ * match. Unchanged files are left byte-identical (no gratuitous rewrites).
+ *
+ * Per-file failures *before* anything sweep-worthy is detected (unreadable
+ * or unstattable files) are logged and skipped — they leak nothing the
+ * sweep would have changed, and a single bad file must never fail the
+ * export (degraded mode beats no archive at all). Once a file is known to
+ * need rewriting (a secret was detected, or it is oversized), failures fail
+ * closed instead: the file's content is replaced with an omission note, and
+ * if even that fails the error propagates and the export fails rather than
+ * shipping the original content.
+ *
+ * `filesOmitted` counts files whose content was replaced with an omission
+ * note: oversized files (never read, so not counted as scanned) and files
+ * whose redacted content could not be written back (scanned, but not
+ * counted as redacted — the redaction never landed).
+ */
+export function redactStagedExportFiles(stagingDir: string): {
+  filesScanned: number;
+  filesRedacted: number;
+  filesOmitted: number;
+} {
+  let filesScanned = 0;
+  let filesRedacted = 0;
+  let filesOmitted = 0;
+
+  const stack: string[] = [stagingDir];
+  while (stack.length > 0) {
+    const dir = stack.pop()!;
+    let entries: Dirent[];
+    try {
+      entries = readdirSync(dir, { withFileTypes: true });
+    } catch (err) {
+      log.warn(
+        { err, dir },
+        "Failed to read staged export directory during secret sweep; skipping",
+      );
+      continue;
+    }
+    for (const entry of entries) {
+      const filePath = join(dir, entry.name);
+      if (entry.isDirectory()) {
+        stack.push(filePath);
+        continue;
+      }
+      // Dirent type checks use lstat semantics, so symlinks are neither
+      // files nor directories here — they are skipped, never followed.
+      if (!entry.isFile()) continue;
+      const ext = extname(entry.name).toLowerCase();
+
+      // Phase 1 — classify and scan. Failures here mean the file's content
+      // was never read into the sweep, so skipping it leaks nothing.
+      let size = 0;
+      let content = "";
+      let redacted = "";
+      try {
+        if (!sniffsAsText(filePath)) continue;
+        size = statSync(filePath).size;
+        if (size <= MAX_SWEEP_FILE_BYTES) {
+          content = readFileSync(filePath, "utf-8");
+          filesScanned++;
+          redacted = redactContent(content, ext);
+        }
+      } catch (err) {
+        log.warn(
+          { err, file: filePath },
+          "Failed to sweep staged export file for secrets; continuing",
+        );
+        continue;
+      }
+
+      // Phase 2 — rewrite. From here the file is known to need new content,
+      // so failures must not fall through to the tar step with the original
+      // bytes. `replaceFileWithNote` throws on failure, failing the export.
+      if (size > MAX_SWEEP_FILE_BYTES) {
+        // Fail closed: an oversized sweep-eligible file must not ship
+        // unswept — it may carry legacy plaintext secrets the sweep exists
+        // to catch. Normally unreachable now that every staged section is
+        // bounded at the source; retained as the final belt so assumption
+        // drift (a future unbounded section) can't silently ship unswept
+        // secrets.
+        log.warn(
+          { file: filePath, size },
+          "Staged export file exceeds secret sweep size cap; replacing content with omission note",
+        );
+        replaceFileWithNote(filePath, OVERSIZED_FILE_NOTE);
+        filesOmitted++;
+        continue;
+      }
+      if (redacted === content) continue;
+      try {
+        // Staged copies inherit source mode bits (`cpSync` preserves them),
+        // so a read-only workspace attachment arrives read-only and the
+        // rewrite below would throw. Loosening the mode on the export copy
+        // is an accepted tradeoff: the staging dir is daemon-private, and a
+        // mode-bit change in the tar is far better than a leaked secret.
+        // Clean files are never chmod'd, keeping them byte- and
+        // mode-identical.
+        chmodSync(filePath, 0o600);
+        writeFileSync(filePath, redacted, "utf-8");
+        filesRedacted++;
+      } catch (err) {
+        log.warn(
+          { err, file: filePath },
+          "Failed to write redacted content back to staged export file; replacing content with omission note",
+        );
+        replaceFileWithNote(filePath, UNWRITABLE_FILE_NOTE);
+        filesOmitted++;
+      }
+    }
+  }
+
+  return { filesScanned, filesRedacted, filesOmitted };
+}