monomind 2.7.7 → 2.7.8

package/packages/@monomind/cli/dist/src/commands/org.js

@@ -1,5 +1,5 @@
 // packages/@monomind/cli/src/commands/org.ts
-import { readFileSync, existsSync, unlinkSync, rmSync, readdirSync } from 'node:fs';
+import { readFileSync, writeFileSync, existsSync, unlinkSync, rmSync, readdirSync, mkdirSync } from 'node:fs';
 import { join, resolve } from 'node:path';
 import { output } from '../output.js';
 import { OrgDaemon } from '../orgrt/daemon.js';
@@ -162,9 +162,35 @@ const stopAction = async (ctx) => {
         log(output.error(`Org not found: ${name}`));
         return { success: false, message: 'org not found' };
     }
-    const { writeFileSync, mkdirSync } = await import('node:fs');
+    // The stopfile is only meaningful to a process that polls it (`org run` and, since
+    // this fix, `org serve`). Writing it for an org that nothing is running was a silent
+    // no-op that still reported "daemon exits within 2s" — say what's actually true.
+    let rt;
+    try {
+        rt = JSON.parse(readFileSync(join(ctx.cwd, ORG_DIR, name, 'runtime.json'), 'utf8'));
+    }
+    catch { /* never run */ }
+    if (rt?.status !== 'running') {
+        log(output.warning(`Org "${name}" is not running (runtime state: ${rt?.status ?? 'never run'}) — nothing to stop.`));
+        return { success: false, message: 'org not running' };
+    }
+    if (rt.pid) {
+        let alive = true;
+        try {
+            process.kill(rt.pid, 0);
+        }
+        catch {
+            alive = false;
+        }
+        if (!alive) {
+            log(output.warning(`Org "${name}" is not running — runtime.json says running but pid ${rt.pid} is gone (crashed daemon).`));
+            log(output.info(`Clear the stale record with: monomind org mark-complete ${name}`));
+            return { success: false, message: 'org crashed — use mark-complete' };
+        }
+    }
     mkdirSync(join(ctx.cwd, ORG_DIR, name), { recursive: true });
     writeFileSync(join(ctx.cwd, ORG_DIR, name, 'stop'), new Date().toISOString());
+    log(output.info(`Stop requested for "${name}" (pid ${rt.pid}) — the daemon picks it up within ~2s.`));
     return { success: true, message: `stop requested for ${name} (daemon exits within 2s)` };
 };
 const statusAction = async (ctx) => {
@@ -198,12 +224,26 @@ const statusAction = async (ctx) => {
         }
         // A "running" record whose pid is gone means the daemon died without its
         // stopOrg cleanup — surface that instead of reporting it as still running.
-        if (state.status === 'running' && state.pid) {
-            try {
-                process.kill(state.pid, 0);
-            }
-            catch {
-                log(output.warning(`${t}: crashed (runtime.json says running but pid ${state.pid} is gone)${state.run ? ` — run ${state.run}` : ''} — close it out with "monomind org mark-complete ${t}"`));
+        if ((state.status === 'running' || state.status === 'crashed') && state.pid) {
+            const pidGone = state.status === 'crashed' || (() => {
+                try {
+                    process.kill(state.pid, 0);
+                    return false;
+                }
+                catch {
+                    return true;
+                }
+            })();
+            if (pidGone) {
+                let heartbeatHint = '';
+                try {
+                    const hb = JSON.parse(readFileSync(join(ctx.cwd, '.monomind', 'serve-heartbeat.json'), 'utf8'));
+                    heartbeatHint = ` (last heartbeat: ${hb.updatedAt})`;
+                }
+                catch { /* no heartbeat file — daemon predates this change or was already cleaned up */ }
+                const closedBy = state.closedBy;
+                const label = closedBy === 'crash-handler' ? 'crashed (caught by crash handler)' : `crashed (runtime.json says ${state.status} but pid ${state.pid} is gone)`;
+                log(output.warning(`${t}: ${label}${heartbeatHint}${state.run ? ` — run ${state.run}` : ''} — close it out with "monomind org mark-complete ${t}"`));
                 continue;
             }
         }
@@ -211,6 +251,34 @@ const statusAction = async (ctx) => {
     }
     return { success: true };
 };
+/** One pass of the `org serve` stopfile poll.
+ *
+ * `monomind org stop <name>` writes `.monomind/orgs/<name>/stop`. `org run` has always
+ * polled that file; `org serve` did not — so against a serve daemon `org stop` was a
+ * silent no-op that still printed "daemon exits within 2s" and exited 0 while the org
+ * kept running. Stops every running org whose stopfile is present, then clears the
+ * stopfile so the next scheduled iteration isn't killed on sight.
+ *
+ * Returns the names it stopped (awaited), so callers/tests don't have to guess. */
+export const pollStopfiles = async (cwd, daemon) => {
+    const stopped = [];
+    for (const name of daemon.listRunning()) {
+        if (!existsSync(join(cwd, ORG_DIR, name, 'stop')))
+            continue;
+        log(output.info(`org ${name}: stop requested — shutting it down`));
+        try {
+            await daemon.stopOrg(name);
+            stopped.push(name);
+        }
+        catch (err) {
+            console.error(`org ${name}: stop failed:`, err);
+        }
+        finally {
+            clearStopfile(cwd, name);
+        }
+    }
+    return stopped;
+};
 const serveAction = async (ctx) => {
     const crossProcess = ctx.flags['crossProcess'] !== false;
     const daemon = new OrgDaemon(ctx.cwd, { crossProcess });
@@ -219,6 +287,24 @@ const serveAction = async (ctx) => {
         srv = await startOrgServer(daemon, 0);
         daemon.setInboxUrl(`http://127.0.0.1:${srv.port}`);
     }
+    // Crash handlers: log the reason and persist crashed state so `org status`
+    // shows what happened instead of a silent "pid is gone".
+    const crashExit = (label, err) => {
+        try {
+            console.error(`[org serve] ${label}:`, err);
+        }
+        catch { /* stderr gone */ }
+        daemon.persistCrashStateAll();
+        daemon.clearHeartbeat();
+        process.exitCode = 1;
+    };
+    process.on('uncaughtException', (err) => { crashExit('uncaughtException', err); process.exit(1); });
+    process.on('unhandledRejection', (err) => { crashExit('unhandledRejection', err); process.exit(1); });
+    // Heartbeat: write every 30s so `org status` can tell "alive but busy" from
+    // "daemon gone" without relying on pid liveness alone.
+    daemon.writeHeartbeat();
+    const heartbeatInterval = setInterval(() => { daemon.writeHeartbeat(); }, 30_000);
+    heartbeatInterval.unref?.();
     log(output.info('org daemon serving — Ctrl-C to stop'));
     // schedule orgs whose definition declares an interval (e.g. "15m", "2h")
     const { OrgScheduler, parseSchedule } = await import('../orgrt/scheduler.js');
@@ -270,9 +356,14 @@ const serveAction = async (ctx) => {
             }
         }
     }
+    const stopPoll = setInterval(() => { void pollStopfiles(ctx.cwd, daemon); }, 2000);
+    stopPoll.unref?.();
     await new Promise(r => { process.once('SIGINT', () => r()); process.once('SIGTERM', () => r()); });
+    clearInterval(stopPoll);
+    clearInterval(heartbeatInterval);
     sched.stop();
     await daemon.stopAll();
+    daemon.clearHeartbeat();
     srv?.close();
     return { success: true };
 };
@@ -393,6 +484,36 @@ const deleteAction = async (ctx) => {
     log(output.success(`Org "${orgName}" deleted (${removed} file(s) removed).`));
     return { success: true };
 };
+/** Clear a stale `running` record from runtime.json. This is the state `org status`
+ *  reads, so mark-complete MUST touch it — the dashboard's run:complete event alone
+ *  left `org status` reporting the same "crashed" line it had just told the user to
+ *  fix with this exact command. Refuses when the recorded pid is still alive: a live
+ *  daemon would just rewrite the file, and `org stop` is the right command there. */
+const clearStaleRuntime = (cwd, name) => {
+    const rtPath = join(cwd, ORG_DIR, name, 'runtime.json');
+    if (!existsSync(rtPath))
+        return { cleared: false, reason: 'absent' };
+    let rt;
+    try {
+        rt = JSON.parse(readFileSync(rtPath, 'utf8'));
+    }
+    catch (err) {
+        return { cleared: false, reason: 'unreadable', detail: err instanceof Error ? err.message : String(err) };
+    }
+    if (rt.status !== 'running' && rt.status !== 'crashed')
+        return { cleared: false, reason: 'not-running' };
+    if (rt.status === 'running' && rt.pid) {
+        try {
+            process.kill(rt.pid, 0);
+            return { cleared: false, reason: 'alive', detail: String(rt.pid) };
+        }
+        catch { /* pid is gone — this is exactly the stale case mark-complete exists for */ }
+    }
+    // Same shape stopOrg's persistState() writes, so every reader (org status,
+    // isOrgRunning, the mastermind-org* skills' jq checks) sees a stopped org.
+    writeFileSync(rtPath, JSON.stringify({ status: 'stopped', run: rt.run, pid: rt.pid, updated: new Date().toISOString(), closedBy: 'mark-complete' }, null, 2));
+    return { cleared: true, run: rt.run };
+};
 const markCompleteAction = async (ctx) => {
     const orgName = ctx.args[0];
     if (!orgName || !ORG_NAME_RE.test(orgName)) {
@@ -400,6 +521,30 @@ const markCompleteAction = async (ctx) => {
         return { success: false, message: 'valid org name required' };
     }
     const cwd = resolve(ctx.cwd || process.cwd());
+    // Reject an org that does not exist, using the same check as runAction. Without
+    // it `org mark-complete nosuchorg` printed "local state was cleared" and exited
+    // 0 — a typo looked like a successful cleanup.
+    const orgsDir = join(cwd, ORG_DIR);
+    if (!existsSync(join(orgsDir, `${orgName}.json`))) {
+        const known = existsSync(orgsDir) ? listOrgConfigFiles(orgsDir).map(f => f.replace(/\.json$/, '')) : [];
+        log(output.error(`Org not found: ${orgName}${known.length ? ` — available: ${known.join(', ')}` : ''}`));
+        return { success: false, message: 'org not found' };
+    }
+    // 1) Local runtime.json — the state `org status` actually reads. Done first and
+    //    independently of the dashboard so the recommended remedy works with no server.
+    const local = clearStaleRuntime(cwd, orgName);
+    if (!local.cleared && local.reason === 'alive') {
+        log(output.error(`Org "${orgName}" is still running (pid ${local.detail}) — stop it with "monomind org stop ${orgName}" instead.`));
+        return { success: false, message: 'org is running' };
+    }
+    if (local.cleared)
+        log(output.success(`Cleared stale runtime state for "${orgName}"${local.run ? ` (run ${local.run})` : ''}.`));
+    else if (local.reason === 'unreadable')
+        log(output.warning(`runtime.json for "${orgName}" is unreadable (${local.detail}) — left untouched.`));
+    else
+        log(output.info(`No stale runtime state for "${orgName}" (runtime.json ${local.reason === 'absent' ? 'absent' : 'already not running'}).`));
+    // 2) Dashboard run:complete event — best effort. A missing/unauthorized dashboard
+    //    must not make the command fail after the local state was already cleared.
     let ctrlUrl = 'http://localhost:4242';
     try {
         const ctl = JSON.parse(readFileSync(join(cwd, '.monomind', 'control.json'), 'utf8'));
@@ -420,17 +565,19 @@ const markCompleteAction = async (ctx) => {
         });
         const body = await res.json().catch(() => ({}));
         if (!res.ok) {
-            log(output.error(`mark-complete failed (${res.status}): ${body.error || 'unknown error'}`));
-            return { success: false, message: 'server rejected mark-complete' };
+            log(output.warning(`Dashboard not updated (${res.status}: ${body.error || 'unknown error'}) — ${local.cleared ? 'local state was cleared' : 'there was no local state to clear'}.`));
+        }
+        else {
+            const runId = body.runId;
+            log(output.success(`Dashboard run marked complete for "${orgName}"${runId ? ` (run ${runId})` : ''}.`));
         }
-        const runId = body.runId;
-        log(output.success(`Run marked complete for org "${orgName}"${runId ? ` (run ${runId})` : ''}.`));
-        return { success: true };
     }
     catch (err) {
-        log(output.error(`Dashboard server unreachable at ${ctrlUrl} — is it running? (${err instanceof Error ? err.message : 'error'})`));
-        return { success: false, message: 'server unreachable' };
+        log(output.warning(`Dashboard unreachable at ${ctrlUrl} (${err instanceof Error ? err.message : 'error'}) — ${local.cleared ? 'local state was cleared' : 'there was no local state to clear'}.`));
     }
+    return local.cleared
+        ? { success: true, message: `run marked complete for ${orgName}` }
+        : { success: true, message: `nothing to clear for ${orgName}` };
 };
 const migrateAction = async (ctx) => {
     const validated = validateOrgName(ctx.args[0]);

package/packages/@monomind/cli/dist/src/commands/security-scan.d.ts

@@ -12,7 +12,36 @@ export type SecretFinding = {
     location: string;
     description: string;
 };
-export declare function findSecretsInDir(dir: string, depthLimit: number, baseDir: string, findings: SecretFinding[]): void;
+/**
+ * Records what the scanner could NOT look at.
+ *
+ * Without this the scanner swallowed unreadable directories and stopped at its
+ * depth limit, then printed "No secrets found." — an error presented as a clean
+ * result. Callers must consult `scanWasIncomplete()` before reporting a clean
+ * bill of health.
+ */
+export interface ScanCoverage {
+    /** Directories that could not be listed (permissions, I/O). Real failures. */
+    unreadableDirs: string[];
+    /** Files that could not be read or stat'd. Real failures. */
+    unreadableFiles: string[];
+    /** Directories not descended into because the depth limit was reached. */
+    depthTruncatedDirs: string[];
+    /** Files skipped because they exceed the 1MB per-file cap. */
+    oversizedFiles: string[];
+    /** Files actually opened and pattern-matched. */
+    filesScanned: number;
+    /** Directories actually listed. */
+    dirsScanned: number;
+}
+export declare function createScanCoverage(): ScanCoverage;
+/** True when some part of the tree was not examined, for any reason. */
+export declare function scanWasIncomplete(c: ScanCoverage): boolean;
+/** True when the scanner hit a hard failure (not merely a configured limit). */
+export declare function scanHadErrors(c: ScanCoverage): boolean;
+/** Human-readable lines describing every gap in coverage. Empty when complete. */
+export declare function describeScanGaps(c: ScanCoverage): string[];
+export declare function findSecretsInDir(dir: string, depthLimit: number, baseDir: string, findings: SecretFinding[], coverage?: ScanCoverage): void;
 export declare const scanCommand: Command;
 export declare const secretsCommand: Command;
 //# sourceMappingURL=security-scan.d.ts.map

package/packages/@monomind/cli/dist/src/commands/security-scan.js

@@ -12,45 +12,97 @@ export const SECRET_PATTERNS = [
     { pattern: /['"]xox[baprs]-[a-zA-Z0-9-]+['"]/g, type: 'Slack Token' },
     { pattern: /password\s*[:=]\s*['"][^'"]{8,}['"]/gi, type: 'Hardcoded Password' },
 ];
-export function findSecretsInDir(dir, depthLimit, baseDir, findings) {
-    if (depthLimit <= 0)
+export function createScanCoverage() {
+    return {
+        unreadableDirs: [],
+        unreadableFiles: [],
+        depthTruncatedDirs: [],
+        oversizedFiles: [],
+        filesScanned: 0,
+        dirsScanned: 0,
+    };
+}
+/** True when some part of the tree was not examined, for any reason. */
+export function scanWasIncomplete(c) {
+    return (c.unreadableDirs.length > 0 ||
+        c.unreadableFiles.length > 0 ||
+        c.depthTruncatedDirs.length > 0 ||
+        c.oversizedFiles.length > 0);
+}
+/** True when the scanner hit a hard failure (not merely a configured limit). */
+export function scanHadErrors(c) {
+    return c.unreadableDirs.length > 0 || c.unreadableFiles.length > 0;
+}
+/** Human-readable lines describing every gap in coverage. Empty when complete. */
+export function describeScanGaps(c) {
+    const lines = [];
+    if (c.unreadableDirs.length > 0) {
+        lines.push(`${c.unreadableDirs.length} directory(ies) could not be read (e.g. ${c.unreadableDirs[0]})`);
+    }
+    if (c.unreadableFiles.length > 0) {
+        lines.push(`${c.unreadableFiles.length} file(s) could not be read (e.g. ${c.unreadableFiles[0]})`);
+    }
+    if (c.depthTruncatedDirs.length > 0) {
+        lines.push(`${c.depthTruncatedDirs.length} directory(ies) not scanned — depth limit reached (use --depth deep)`);
+    }
+    if (c.oversizedFiles.length > 0) {
+        lines.push(`${c.oversizedFiles.length} file(s) skipped — larger than 1MB`);
+    }
+    return lines;
+}
+export function findSecretsInDir(dir, depthLimit, baseDir, findings, coverage = createScanCoverage()) {
+    if (depthLimit <= 0) {
+        coverage.depthTruncatedDirs.push(relative(baseDir, dir) || dir);
         return;
+    }
+    let entries;
     try {
-        const entries = readdirSync(dir, { withFileTypes: true });
-        for (const entry of entries) {
-            const isDotEnv = /^\.env(\..+)?$/.test(entry.name);
-            if ((entry.name.startsWith('.') && !isDotEnv) || entry.name === 'node_modules' || entry.name === 'dist')
+        entries = readdirSync(dir, { withFileTypes: true });
+    }
+    catch {
+        coverage.unreadableDirs.push(relative(baseDir, dir) || dir);
+        return;
+    }
+    coverage.dirsScanned++;
+    for (const entry of entries) {
+        const isDotEnv = /^\.env(\..+)?$/.test(entry.name);
+        if ((entry.name.startsWith('.') && !isDotEnv) || entry.name === 'node_modules' || entry.name === 'dist')
+            continue;
+        const fullPath = join(dir, entry.name);
+        if (entry.isDirectory()) {
+            findSecretsInDir(fullPath, depthLimit - 1, baseDir, findings, coverage);
+        }
+        else if (entry.isFile() && (/\.(ts|js|json|yml|yaml)$/.test(entry.name) || isDotEnv) && !entry.name.endsWith('.d.ts')) {
+            let content;
+            try {
+                if (statSync(fullPath).size > 1024 * 1024) {
+                    coverage.oversizedFiles.push(relative(baseDir, fullPath));
+                    continue;
+                }
+                content = readFileSync(fullPath, 'utf-8');
+            }
+            catch {
+                coverage.unreadableFiles.push(relative(baseDir, fullPath));
                 continue;
-            const fullPath = join(dir, entry.name);
-            if (entry.isDirectory()) {
-                findSecretsInDir(fullPath, depthLimit - 1, baseDir, findings);
             }
-            else if (entry.isFile() && (/\.(ts|js|json|yml|yaml)$/.test(entry.name) || isDotEnv) && !entry.name.endsWith('.d.ts')) {
-                try {
-                    if (statSync(fullPath).size > 1024 * 1024)
-                        continue;
-                    const content = readFileSync(fullPath, 'utf-8');
-                    const lines = content.split('\n');
-                    for (let i = 0; i < lines.length; i++) {
-                        for (const { pattern, type } of SECRET_PATTERNS) {
-                            pattern.lastIndex = 0;
-                            let m;
-                            while ((m = pattern.exec(lines[i])) !== null) {
-                                findings.push({
-                                    severity: output.warning('HIGH'),
-                                    type: 'Hardcoded Secret',
-                                    location: `${relative(baseDir, fullPath)}:${i + 1}`,
-                                    description: type,
-                                });
-                            }
-                        }
+            coverage.filesScanned++;
+            const lines = content.split('\n');
+            for (let i = 0; i < lines.length; i++) {
+                for (const { pattern, type } of SECRET_PATTERNS) {
+                    pattern.lastIndex = 0;
+                    let m;
+                    while ((m = pattern.exec(lines[i])) !== null) {
+                        findings.push({
+                            severity: output.warning('HIGH'),
+                            type: 'Hardcoded Secret',
+                            location: `${relative(baseDir, fullPath)}:${i + 1}`,
+                            description: type,
+                        });
                     }
                 }
-                catch { /* file read error */ }
             }
         }
     }
-    catch { /* dir read error */ }
 }
 // ─── scan subcommand ─────────────────────────────────────────────────────────
 export const scanCommand = {
@@ -92,6 +144,7 @@ export const scanCommand = {
         const spinner = output.createSpinner({ text: `Scanning ${target}...`, spinner: 'dots' });
         spinner.start();
         const findings = [];
+        const coverage = createScanCoverage();
         let criticalCount = 0, highCount = 0, mediumCount = 0, lowCount = 0;
         try {
             const fs = await import('fs');
@@ -156,7 +209,7 @@ export const scanCommand = {
                 spinner.setText('Scanning for hardcoded secrets...');
                 const scanDepth = depth === 'deep' ? 10 : depth === 'standard' ? 5 : 3;
                 const prevCount = findings.length;
-                findSecretsInDir(path.resolve(target), scanDepth, path.resolve(target), findings);
+                findSecretsInDir(path.resolve(target), scanDepth, path.resolve(target), findings, coverage);
                 highCount += findings.length - prevCount;
             }
             if ((scanType === 'all' || scanType === 'code') && depth !== 'quick') {
@@ -168,53 +221,74 @@ export const scanCommand = {
                     { pattern: /child_process.*exec[^S]/g, type: 'Command Injection', severity: 'high', desc: 'Possible command injection' },
                     { pattern: /\$\{.*\}.*sql|sql.*\$\{/gi, type: 'SQL Injection', severity: 'high', desc: 'Possible SQL injection' },
                 ];
+                // Same coverage accounting as findSecretsInDir: gaps are recorded, never
+                // swallowed, so an unreadable tree cannot masquerade as a clean one.
+                const codeBase = path.resolve(target);
                 const scanCodeDir = (dir, depthLimit) => {
-                    if (depthLimit <= 0)
+                    if (depthLimit <= 0) {
+                        coverage.depthTruncatedDirs.push(path.relative(codeBase, dir) || dir);
                         return;
+                    }
+                    let entries;
                     try {
-                        const entries = fs.readdirSync(dir, { withFileTypes: true });
-                        for (const entry of entries) {
-                            if (entry.name.startsWith('.') || entry.name === 'node_modules' || entry.name === 'dist')
+                        entries = fs.readdirSync(dir, { withFileTypes: true });
+                    }
+                    catch {
+                        coverage.unreadableDirs.push(path.relative(codeBase, dir) || dir);
+                        return;
+                    }
+                    for (const entry of entries) {
+                        if (entry.name.startsWith('.') || entry.name === 'node_modules' || entry.name === 'dist')
+                            continue;
+                        const fullPath = path.join(dir, entry.name);
+                        if (entry.isDirectory()) {
+                            scanCodeDir(fullPath, depthLimit - 1);
+                        }
+                        else if (entry.isFile() && /\.(ts|js|tsx|jsx)$/.test(entry.name) && !entry.name.endsWith('.d.ts')) {
+                            let content;
+                            try {
+                                if (fs.statSync(fullPath).size > 1024 * 1024) {
+                                    coverage.oversizedFiles.push(path.relative(codeBase, fullPath));
+                                    continue;
+                                }
+                                content = fs.readFileSync(fullPath, 'utf-8');
+                            }
+                            catch {
+                                coverage.unreadableFiles.push(path.relative(codeBase, fullPath));
                                 continue;
-                            const fullPath = path.join(dir, entry.name);
-                            if (entry.isDirectory()) {
-                                scanCodeDir(fullPath, depthLimit - 1);
                             }
-                            else if (entry.isFile() && /\.(ts|js|tsx|jsx)$/.test(entry.name) && !entry.name.endsWith('.d.ts')) {
-                                try {
-                                    if (fs.statSync(fullPath).size > 1024 * 1024)
-                                        continue;
-                                    const content = fs.readFileSync(fullPath, 'utf-8');
-                                    const lines = content.split('\n');
-                                    for (let i = 0; i < lines.length; i++) {
-                                        for (const { pattern, type, severity, desc } of codePatterns) {
-                                            pattern.lastIndex = 0;
-                                            let m;
-                                            while ((m = pattern.exec(lines[i])) !== null) {
-                                                if (severity === 'high')
-                                                    highCount++;
-                                                else
-                                                    mediumCount++;
-                                                findings.push({
-                                                    severity: severity === 'high' ? output.warning('HIGH') : output.warning('MEDIUM'),
-                                                    type,
-                                                    location: `${path.relative(target, fullPath)}:${i + 1}`,
-                                                    description: desc,
-                                                });
-                                            }
-                                        }
+                            const lines = content.split('\n');
+                            for (let i = 0; i < lines.length; i++) {
+                                for (const { pattern, type, severity, desc } of codePatterns) {
+                                    pattern.lastIndex = 0;
+                                    let m;
+                                    while ((m = pattern.exec(lines[i])) !== null) {
+                                        if (severity === 'high')
+                                            highCount++;
+                                        else
+                                            mediumCount++;
+                                        findings.push({
+                                            severity: severity === 'high' ? output.warning('HIGH') : output.warning('MEDIUM'),
+                                            type,
+                                            location: `${path.relative(target, fullPath)}:${i + 1}`,
+                                            description: desc,
+                                        });
                                     }
                                 }
-                                catch { /* file read error */ }
                             }
                         }
                     }
-                    catch { /* dir read error */ }
                 };
                 const scanDepth = depth === 'deep' ? 10 : 5;
                 scanCodeDir(path.resolve(target), scanDepth);
             }
-            spinner.succeed('Scan complete');
+            const gaps = describeScanGaps(coverage);
+            if (gaps.length > 0) {
+                spinner.stop(output.warning('Scan finished with INCOMPLETE coverage'));
+            }
+            else {
+                spinner.succeed('Scan complete');
+            }
             output.writeln();
             if (findings.length > 0) {
                 output.printTable({
@@ -229,9 +303,19 @@ export const scanCommand = {
                 if (findings.length > 20)
                     output.writeln(output.dim(`... and ${findings.length - 20} more issues`));
             }
+            else if (gaps.length > 0) {
+                // Never present an incomplete scan as a clean bill of health.
+                output.writeln(output.warning('No security issues found in the parts that could be scanned — coverage was INCOMPLETE (see below).'));
+            }
             else {
                 output.writeln(output.success('No security issues found!'));
             }
+            if (gaps.length > 0) {
+                output.writeln();
+                output.writeln(output.warning('Incomplete coverage:'));
+                for (const g of gaps)
+                    output.writeln(output.warning(`  - ${g}`));
+            }
             output.writeln();
             output.printBox([
                 `Target: ${target}`,
@@ -240,6 +324,9 @@ export const scanCommand = {
                 ``,
                 `Critical: ${criticalCount}  High: ${highCount}  Medium: ${mediumCount}  Low: ${lowCount}`,
                 `Total Issues: ${findings.length}`,
+                ``,
+                `Coverage: ${coverage.filesScanned} file(s) in ${coverage.dirsScanned} dir(s) scanned`,
+                `Coverage status: ${gaps.length === 0 ? 'complete' : `INCOMPLETE (${gaps.length} gap type(s))`}`,
             ].join('\n'), 'Scan Summary');
             if (fix && criticalCount + highCount > 0) {
                 const resolvedTarget = realpathSync(path.resolve(target));
@@ -263,6 +350,11 @@ export const scanCommand = {
                     fixSpinner.fail('Some fixes could not be applied automatically');
                 }
             }
+            // A scan that hit real read errors cannot certify anything — fail loudly.
+            // Depth truncation is a configured limit, not an error, so it is reported
+            // above but does not by itself flip the exit status.
+            if (scanHadErrors(coverage))
+                return { success: false };
             return { success: findings.length === 0 || (criticalCount === 0 && highCount === 0) };
         }
         catch (error) {
@@ -307,11 +399,21 @@ export const secretsCommand = {
         const spinner = output.createSpinner({ text: `Scanning ${targetPath}...`, spinner: 'dots' });
         spinner.start();
         const findings = [];
+        const coverage = createScanCoverage();
         const scanDepth = depth === 'deep' ? 10 : depth === 'standard' ? 5 : 3;
-        findSecretsInDir(resolve(targetPath), scanDepth, resolve(targetPath), findings);
-        spinner.succeed('Scan complete');
+        findSecretsInDir(resolve(targetPath), scanDepth, resolve(targetPath), findings, coverage);
+        const gaps = describeScanGaps(coverage);
+        if (gaps.length > 0) {
+            spinner.stop(output.warning('Scan finished with INCOMPLETE coverage'));
+        }
+        else {
+            spinner.succeed('Scan complete');
+        }
         output.writeln();
-        if (findings.length === 0) {
+        if (findings.length === 0 && gaps.length > 0) {
+            output.writeln(output.warning('No secrets found in the parts that could be scanned — coverage was INCOMPLETE.'));
+        }
+        else if (findings.length === 0) {
             output.writeln(output.success('No secrets found.'));
         }
         else {
@@ -326,9 +428,20 @@ export const secretsCommand = {
             if (findings.length > 20)
                 output.writeln(output.dim(`... and ${findings.length - 20} more`));
         }
+        if (gaps.length > 0) {
+            output.writeln();
+            output.writeln(output.warning('Incomplete coverage:'));
+            for (const g of gaps)
+                output.writeln(output.warning(`  - ${g}`));
+        }
         output.writeln();
-        output.writeln(output.bold('Summary: ') + `${findings.length} secret(s) found in ${targetPath}`);
-        return { success: findings.length === 0 };
+        output.writeln(output.bold('Summary: ') +
+            `${findings.length} secret(s) found in ${targetPath} ` +
+            `(${coverage.filesScanned} file(s) in ${coverage.dirsScanned} dir(s) scanned, ` +
+            `coverage ${gaps.length === 0 ? 'complete' : 'INCOMPLETE'})`);
+        // Read errors mean the tree was not fully examined — "no secrets" is not
+        // a result we can stand behind, so do not exit 0 on it.
+        return { success: findings.length === 0 && !scanHadErrors(coverage) };
     },
 };
 //# sourceMappingURL=security-scan.js.map