@duckmind/dm-darwin-x64 0.66.4 → 0.66.6

package/extensions/dm-lens/mcp/analyze-cli.js

@@ -1,4 +1,7 @@
+import { setProjectTrustState } from "../clients/project-trust.js";
 import * as path from "node:path";
+import { flushExtensionLog, logExtension } from "../clients/extension-log.js";
+import { redactSecrets } from "../clients/redact/secrets.js";
 import {
   recordTurnEndOutcome,
   requestWarmAnalyze,
@@ -134,49 +137,73 @@ function writeStdout(text) {
 `, () => done());
   });
 }
+function writeReport(report, hookMode) {
+  return writeStdout(hookMode ? JSON.stringify({
+    hookSpecificOutput: {
+      hookEventName: "PostToolUse",
+      additionalContext: report
+    }
+  }) : report);
+}
 async function main() {
+  setProjectTrustState("trusted");
+  logExtension({
+    subsystem: "project-trust",
+    level: "debug",
+    message: "analyze-cli: workspace trust belongs to the calling client; pi trust not consulted"
+  });
   const hookMode = process.argv.includes("--hook");
   const withLsp = process.argv.includes("--lsp");
   const fileArg = argVal("file");
   const turnEndFlag = process.argv.includes("--turn-end");
-  const payload = fileArg === undefined && !turnEndFlag ? await readHookPayload() : undefined;
-  const cwd = argVal("cwd") ?? payload?.cwd ?? process.cwd();
-  const event = payload?.hook_event_name;
-  if (turnEndFlag || event === "Stop" || event === "SubagentStop") {
-    return runTurnEndMode(cwd, payload);
-  }
-  const file = fileArg ?? payload?.tool_input?.file_path ?? payload?.tool_input?.path;
-  if (!file)
+  let cwd = argVal("cwd") ?? process.cwd();
+  let hookInvocation = hookMode;
+  let operation = "analyze";
+  try {
+    const payload = fileArg === undefined && !turnEndFlag ? await readHookPayload() : undefined;
+    cwd = argVal("cwd") ?? payload?.cwd ?? cwd;
+    const event = payload?.hook_event_name;
+    const payloadFile = payload?.tool_input?.file_path ?? payload?.tool_input?.path;
+    hookInvocation ||= Boolean(payloadFile);
+    if (turnEndFlag || event === "Stop" || event === "SubagentStop") {
+      hookInvocation = true;
+      operation = "turn-end";
+      await runTurnEndMode(cwd, payload);
+      return;
+    }
+    const file = fileArg ?? payloadFile;
+    if (!file)
+      process.exit(0);
+    let result = await requestWarmAnalyze(cwd, file);
+    if (!result) {
+      const { analyzeFile } = await import("../clients/mcp/analyze.js");
+      result = await analyzeFile(file, cwd, {
+        flags: withLsp ? {} : { "no-lsp": true },
+        record: false,
+        registerTurnState: true
+      });
+    }
+    const { flushProbeCache } = await import("../clients/installer/index.js");
+    await flushProbeCache();
+    if (result.counts.diagnostics === 0)
+      process.exit(0);
+    await writeReport(formatReport(result, cwd), hookMode);
     process.exit(0);
-  let result = await requestWarmAnalyze(cwd, file);
-  if (!result) {
-    const { analyzeFile } = await import("../clients/mcp/analyze.js");
-    result = await analyzeFile(file, cwd, {
-      flags: withLsp ? {} : { "no-lsp": true },
-      record: false,
-      registerTurnState: true
+  } catch (err) {
+    const detail = redactSecrets(stripControlSequences(err instanceof Error ? err.message : String(err))).replace(/\s+/g, " ");
+    const reason = detail.length > 1000 ? `${capCodeUnits(detail, 1000)}… (truncated)` : detail;
+    const message = `dm-lens-analyze failed: ${reason}`;
+    recordTurnEndOutcome(cwd, { failed: true, operation, reason });
+    logExtension({
+      subsystem: "analyze-cli",
+      message: "analyze-cli-failed",
+      metadata: { cwd, operation, reason }
     });
-  }
-  const { flushProbeCache } = await import("../clients/installer/index.js");
-  await flushProbeCache();
-  if (result.counts.diagnostics === 0)
-    process.exit(0);
-  const report = formatReport(result, cwd);
-  if (hookMode) {
-    process.stdout.write(JSON.stringify({
-      hookSpecificOutput: {
-        hookEventName: "PostToolUse",
-        additionalContext: report
-      }
-    }));
-  } else {
-    process.stdout.write(`${report}
+    process.stderr.write(`${message}
 `);
+    await writeReport(message, hookMode && operation === "analyze");
+    await flushExtensionLog();
+    process.exit(hookInvocation ? 0 : 2);
   }
-  process.exit(0);
 }
-main().catch((err) => {
-  process.stderr.write(`dm-lens-analyze failed: ${err.message}
-`);
-  process.exit(0);
-});
+main();

package/extensions/dm-lens/mcp/cli.js

@@ -1,14 +1,19 @@
 process.env.DM_LENS_GRAPH_PERSIST_DEBOUNCE_MS = "3600000";
+import { setProjectTrustState } from "../clients/project-trust.js";
+import { logExtension } from "../clients/extension-log.js";
 import * as fs from "node:fs";
 import * as path from "node:path";
 import { FactStore } from "../clients/dispatch/fact-store.js";
 import {
   buildOrUpdateGraph,
   flushReviewGraphPersist,
+  getGraphBuildInfoForGraph,
   getLastGraphBuildInfo,
   getLastReviewGraphBuildAttempt,
+  graphWasmTrapDetail,
   reviewGraphCachePath
 } from "../clients/review-graph/builder.js";
+import { isTreeSitterWasmAborted } from "../clients/tree-sitter-shared.js";
 function cwdArg() {
   const equals = process.argv.find((arg) => arg.startsWith("--cwd="));
   if (equals)
@@ -60,6 +65,15 @@ async function buildGraph() {
   }
   const durationMs = Date.now() - startedAt;
   const coverage = persisted.coverage;
+  const wasmTrappedFiles = getGraphBuildInfoForGraph(graph).wasmTrappedFiles ?? 0;
+  const wasmAborted = isTreeSitterWasmAborted();
+  if (wasmAborted || wasmTrappedFiles > 0) {
+    const degraded = wasmAborted ? "review graph degraded — tree-sitter disabled for this process until restart" : graphWasmTrapDetail(wasmTrappedFiles);
+    const recovery = wasmAborted ? "" : "those files were skipped and are re-extracted on the next build; ";
+    process.stdout.write(`dm-lens build-graph: ${degraded}; ${recovery}` + (coverage?.partial ? `PARTIAL persist (cap=${coverage.cap} exceeded) ` + `persistedNodes=${coverage.persistedNodes}/${coverage.totalNodes} ` + `persistedEdges=${coverage.persistedEdges}/${coverage.totalEdges} ` : "") + `files=${graph.fileNodes.size} nodes=${graph.nodes.size} ` + `edges=${graph.edges.length} elements=${persisted.elements} ` + `jsonBytes=${persisted.bytes} durationMs=${durationMs}
+`);
+    return;
+  }
   if (coverage?.partial) {
     process.stdout.write(`dm-lens build-graph: PARTIAL persist (cap=${coverage.cap} exceeded) ` + `files=${graph.fileNodes.size} nodes=${graph.nodes.size} ` + `edges=${graph.edges.length} persistedNodes=${coverage.persistedNodes}/${coverage.totalNodes} ` + `persistedEdges=${coverage.persistedEdges}/${coverage.totalEdges} ` + `elements=${persisted.elements} jsonBytes=${persisted.bytes} durationMs=${durationMs}
 `);
@@ -69,6 +83,12 @@ async function buildGraph() {
 `);
 }
 async function main() {
+  setProjectTrustState("trusted");
+  logExtension({
+    subsystem: "project-trust",
+    level: "debug",
+    message: "build-graph: workspace trust belongs to the calling client; pi trust not consulted"
+  });
   const command = process.argv[2];
   if (command !== "build-graph") {
     fail("usage: dm-lens build-graph [--cwd <dir>]");

package/extensions/dm-lens/mcp/server.js

@@ -1,3 +1,4 @@
+import { setProjectTrustState } from "../clients/project-trust.js";
 import * as fs from "node:fs";
 import * as net from "node:net";
 import * as path from "node:path";
@@ -12,6 +13,7 @@ import { AstGrepClient } from "../clients/ast-grep-client.js";
 import { CacheManager } from "../clients/cache-manager.js";
 import {
   getDegradationSummary,
+  incrementDegradationCount,
   recordDegradationOnce,
   renderDegradationLines
 } from "../clients/degradation-ledger.js";
@@ -70,9 +72,15 @@ import {
   observeSituationalToolCall,
   startSituationalToolTelemetrySession
 } from "../clients/situational-tool-telemetry.js";
-import { flushExtensionLog } from "../clients/extension-log.js";
+import { logExtension, flushExtensionLog } from "../clients/extension-log.js";
 import { createLspNavigationTool } from "../tools/lsp-navigation.js";
 import { shouldInitializeSessionRoot } from "../clients/lsp/session-roots.js";
+import {
+  findIgnoredArguments,
+  ignoredArgumentsStructured,
+  refusalResult,
+  withIgnoredArguments
+} from "./tool-arguments.js";
 import {
   computeBuildStamp,
   STALE_SERVED_BY_FRESH,
@@ -329,6 +337,12 @@ function graphStalenessNote(builtAtIso, label) {
     return;
   return `${label} last updated ${formatRelativeAge(ageMs)}; run dmlens_analyze ` + "on recently-changed files, dmlens_session_start, or dmlens_rebuild to refresh it.";
 }
+setProjectTrustState("trusted");
+logExtension({
+  subsystem: "project-trust",
+  level: "debug",
+  message: "mcp: workspace trust belongs to the MCP client; pi trust not consulted"
+});
 const cacheManager = new CacheManager;
 const isLensGuardEnabled = () => Boolean(createMcpHost(undefined, DEFAULT_CWD).getFlag("lens-guard"));
 const lensDiagnosticsTool = createLensDiagnosticsTool(cacheManager, () => DEFAULT_CWD, undefined, undefined, undefined, undefined, () => peekMcpSessionRuntime(), () => isLensGuardEnabled());
@@ -648,7 +662,7 @@ function enabledToolsForCwd(cwd) {
   });
 }
 function formatAnalyze(result, cwd, mode, servedBy) {
-  const lspNote = result.lsp ? ` · lsp ${result.lsp.diagnosticCount} (${result.lsp.status}, ${result.lsp.durationMs}ms)` : "";
+  const lspNote = result.lsp ? ` · lsp ${result.lsp.diagnosticCount} (${result.lsp.status}${result.lsp.failureKind ? `: ${result.lsp.failureKind}` : ""}, ${result.lsp.durationMs}ms)` : "";
   const summary = `${path.relative(cwd, result.filePath) || result.filePath} [${mode}] — ` + `${result.counts.blockers} blocking, ${result.counts.warnings} warning(s), ` + `${result.counts.advisories} advisory(ies), ` + `${result.counts.diagnostics} total` + (result.latency ? ` · ${result.latency.totalDurationMs}ms` : "") + lspNote + (result.counts.fixed > 0 ? ` · ${result.counts.fixed} auto-fixed` : "") + (servedBy ? `
 
 servedBy: ${servedBy}` : "");
@@ -1040,6 +1054,7 @@ ${result.source ?? ""}`
       `Diagnostics this session: ${stats.totalShown} shown · ${stats.totalAutoFixed} auto-fixed · ${stats.totalUnresolved} unresolved`,
       autoSession ? `Auto session_start: ${autoSession.succeeded ? "succeeded" : autoSession.error ? "FAILED" : autoSession.attempted ? "in progress" : "not yet attempted"}${autoSession.firedAt ? ` (fired ${autoSession.firedAt})` : ""}${autoSession.error ? ` — ${autoSession.error}` : ""}` : "Auto session_start: disabled (DM_LENS_MCP_AUTO_SESSION not set)",
       turnEnd ? `Stop-hook turn-end: ${turnEnd.ran} ran · ${turnEnd.skipped} skipped` + `${turnEnd.lastRunAt ? ` (last ran ${turnEnd.lastRunAt})` : ""}` + `${turnEnd.lastSkipReason ? ` — last skip: ${turnEnd.lastSkipReason}${turnEnd.lastSkipAt ? ` at ${turnEnd.lastSkipAt}` : ""}` : ""}` : "Stop-hook turn-end: no activity recorded (hook not installed, or no Stop yet)",
+      turnEnd?.failed ? `Analyzer invocations: ${turnEnd.failed} failed; last ${turnEnd.lastFailureOperation} failure at ${turnEnd.lastFailureAt}: ${turnEnd.lastFailureReason}` : "Analyzer invocations: no failures recorded",
       healthConfigLine(configProvenance),
       footprint ? `Resource footprint: ${footprint.instanceCount} dm-lens instance(s) · ` + `${(footprint.totalRssBytes / 1024 / 1024).toFixed(0)}MB RSS · ` + `${footprint.totalCpuPercent.toFixed(1)}% CPU · ` + `${footprint.totalLspChildCount} LSP child process(es)` : "Resource footprint: unavailable (instance registry unreadable)"
     ];
@@ -1210,11 +1225,17 @@ async function handleRequest(request) {
       return;
     case "tools/call": {
       const name = params?.name;
-      const args = params?.arguments && typeof params.arguments === "object" ? params.arguments : {};
+      const rawArguments = params?.arguments;
+      const argumentsAreObject = typeof rawArguments === "object" && rawArguments !== null && !Array.isArray(rawArguments);
+      const args = argumentsAreObject ? rawArguments : {};
       if (typeof name !== "string") {
         sendError(id ?? null, -32602, "tools/call requires a string 'name'");
         return;
       }
+      if (!argumentsAreObject && rawArguments !== undefined && rawArguments !== null && !(Array.isArray(rawArguments) && rawArguments.length === 0)) {
+        sendError(id ?? null, -32602, "tools/call 'arguments' must be an object");
+        return;
+      }
       const enabledName = name === "dmlens_lsp_diagnostics" ? "dmlens_diagnostics" : name;
       if (name !== "dmlens_ast_grep_dump" && name !== "dmlens_rebuild" && !enabledToolsForCwd(typeof args.cwd === "string" ? args.cwd : DEFAULT_CWD).some((tool) => tool.name === enabledName)) {
         sendResult(id ?? null, stripResultDetails(finalizeToolResult({
@@ -1223,6 +1244,20 @@ async function handleRequest(request) {
         })));
         return;
       }
+      const inputSchema = ALL_TOOLS.find((tool) => tool.name === enabledName)?.inputSchema;
+      const argumentReport = inputSchema ? findIgnoredArguments(inputSchema, args) : undefined;
+      if (argumentReport) {
+        incrementDegradationCount({
+          kind: "mcp-ignored-arguments",
+          subject: name,
+          reason: `ignored argument(s): ${ignoredArgumentsStructured(argumentReport).ignoredArguments.join(", ")}`
+        });
+        const refused = refusalResult(name, argumentReport);
+        if (refused) {
+          sendResult(id ?? null, stripResultDetails(finalizeToolResult(refused)));
+          return;
+        }
+      }
       const entry = toolRegistryEntryForMcp(name);
       if (entry && "situational" in entry && entry.situational) {
         startSituationalToolTelemetrySession("mcp");
@@ -1234,6 +1269,8 @@ async function handleRequest(request) {
         if (WARN_ONLY_STALE_TOOLS.has(name) && !result.isError && isWarmBuildStale()) {
           result = withStaleWarning(result);
         }
+        if (argumentReport)
+          result = withIgnoredArguments(result, name, argumentReport);
         const delivery = finalizeToolResultWithDelivery(result);
         sendResult(id ?? null, stripResultDetails(delivery.result));
       } catch (err) {

package/extensions/dm-lens/mcp/tool-arguments.js

@@ -0,0 +1,134 @@
+export const MAX_REPORTED_KEYS = 8;
+export const MAX_REPORTED_KEY_CHARS = 64;
+function withinOneEdit(a, b) {
+  let i = 0;
+  while (i < a.length && i < b.length && a[i] === b[i])
+    i++;
+  if (a.length === b.length)
+    return a.slice(i + 1) === b.slice(i + 1);
+  return a.length < b.length ? a.slice(i) === b.slice(i + 1) : b.slice(i) === a.slice(i + 1);
+}
+function nearestDeclaredKey(key, declared) {
+  const fold = (value) => value.toLowerCase().replace(/[^a-z0-9]/g, "");
+  const folded = fold(key);
+  let best;
+  for (const candidate of declared) {
+    const other = fold(candidate);
+    const contained = Math.min(folded.length, other.length) >= 3 && (folded.includes(other) || other.includes(folded));
+    if (!contained && !withinOneEdit(folded, other))
+      continue;
+    const score = Math.abs(folded.length - other.length);
+    if (!best || score < best.score)
+      best = { key: candidate, score };
+  }
+  return best?.key;
+}
+function tokensOf(key) {
+  return key.replace(/([a-z0-9])([A-Z])/g, "$1 $2").toLowerCase().split(/[^a-z0-9]+/).map((token) => token.replace(/s$/, "")).filter(Boolean);
+}
+export function refusalMatches(key, declared) {
+  return classifyKey(key, declared).matches;
+}
+const NON_LOCATOR_QUALIFIERS = new Set([
+  "max",
+  "min",
+  "num",
+  "count",
+  "total",
+  "include",
+  "exclude",
+  "out",
+  "output"
+]);
+function classifyKey(key, declared) {
+  const tokens = tokensOf(key);
+  const folded = tokens.join("");
+  const declaredFolds = new Set(declared.map((name) => tokensOf(name).join("")));
+  const equal = [];
+  const suffix = [];
+  const retargeted = [];
+  for (const candidate of declared) {
+    const wanted = tokensOf(candidate);
+    if (wanted.length === 0)
+      continue;
+    if (folded === wanted.join("")) {
+      equal.push(candidate);
+      continue;
+    }
+    if (tokens.slice(-wanted.length).join(" ") !== wanted.join(" "))
+      continue;
+    const qualifier = tokens.slice(0, -wanted.length);
+    const retargets = declaredFolds.has(qualifier.join("")) || qualifier.some((token) => NON_LOCATOR_QUALIFIERS.has(token));
+    (retargets ? retargeted : suffix).push(candidate);
+  }
+  return equal.length > 0 ? { matches: equal, retargeted: [] } : { matches: suffix, retargeted };
+}
+export function findIgnoredArguments(schema, args) {
+  const properties = schema.properties ?? {};
+  const declared = Object.keys(properties);
+  const unsentSuggestions = [];
+  const ignored = Object.keys(args).filter((key) => !Object.hasOwn(properties, key)).map((key) => {
+    const { matches, retargeted } = classifyKey(key, declared);
+    const unsent = matches.some((match) => Object.hasOwn(args, match)) ? undefined : matches[0];
+    if (unsent !== undefined && !unsentSuggestions.some((entry) => entry.suggestion === unsent))
+      unsentSuggestions.push({ key, suggestion: unsent });
+    const suggestion = matches[0] ?? nearestDeclaredKey(key, declared.filter((name) => !retargeted.includes(name)));
+    return suggestion === undefined ? { key } : { key, suggestion };
+  });
+  if (ignored.length === 0)
+    return;
+  const missingRequired = (schema.required ?? []).filter((key) => !Object.hasOwn(args, key));
+  return { ignored, missingRequired, unsentSuggestions };
+}
+function shown(key) {
+  return key.length > MAX_REPORTED_KEY_CHARS ? `${key.slice(0, MAX_REPORTED_KEY_CHARS)}…` : key;
+}
+export function ignoredArgumentsLine(tool, report) {
+  const listed = report.ignored.slice(0, MAX_REPORTED_KEYS).map((entry) => {
+    const hint = entry.suggestion ? ` (did you mean \`${entry.suggestion}\`?)` : "";
+    return `\`${shown(entry.key)}\`${hint}`;
+  });
+  const more = report.ignored.length - listed.length;
+  const tail = more > 0 ? ` and ${more} more` : "";
+  return `Ignored unknown argument(s) for ${tool}: ${listed.join(", ")}${tail}. They had no effect on this call.`;
+}
+export function ignoredArgumentsStructured(report) {
+  return {
+    ignoredArguments: report.ignored.slice(0, MAX_REPORTED_KEYS).map((entry) => shown(entry.key)),
+    ignoredArgumentCount: report.ignored.length
+  };
+}
+export function withIgnoredArguments(result, tool, report) {
+  const line = ignoredArgumentsLine(tool, report);
+  const [first, ...rest] = result.content;
+  return {
+    ...result,
+    content: first ? [{ ...first, text: `${line}
+
+${first.text}` }, ...rest] : [{ type: "text", text: line }],
+    structuredContent: ignoredArgumentsStructured(report)
+  };
+}
+export function refusalResult(tool, report) {
+  const reasons = [];
+  if (report.missingRequired.length > 0)
+    reasons.push(`required argument(s) ${report.missingRequired.map((key) => `\`${key}\``).join(", ")} missing`);
+  for (const { key, suggestion } of report.unsentSuggestions) {
+    if (report.missingRequired.includes(suggestion))
+      continue;
+    reasons.push(`\`${shown(key)}\` looks like a mistyped \`${suggestion}\`, which was not sent`);
+  }
+  if (reasons.length === 0)
+    return;
+  return {
+    content: [
+      {
+        type: "text",
+        text: `${ignoredArgumentsLine(tool, report)}
+Not run: ${reasons.join("; ")}.`
+      }
+    ],
+    isError: true,
+    structuredContent: ignoredArgumentsStructured(report)
+  };
+}

package/extensions/dm-lens/mcp/worker.js

@@ -1,3 +1,5 @@
+import { setProjectTrustState } from "../clients/project-trust.js";
+import { logExtension } from "../clients/extension-log.js";
 import { analyzeFile } from "../clients/mcp/analyze.js";
 function arg(name) {
   const prefix = `--${name}=`;
@@ -5,6 +7,12 @@ function arg(name) {
   return found ? found.slice(prefix.length) : undefined;
 }
 async function main() {
+  setProjectTrustState("trusted");
+  logExtension({
+    subsystem: "project-trust",
+    level: "debug",
+    message: "mcp-worker: workspace trust belongs to the MCP client; pi trust not consulted"
+  });
   const file = arg("file");
   const cwd = arg("cwd") ?? process.cwd();
   if (!file) {

package/extensions/dm-lens/package.json

@@ -1,6 +1,6 @@
 {
   "name": "dm-lens",
-  "version": "4.3.0",
+  "version": "4.4.3",
   "description": "Real-time code feedback for DM \u2014 LSP, linters, formatters, type-checking, and structural analysis.",
   "type": "module",
   "main": "./index.js",

package/extensions/dm-lens/rules/ast-grep-rules/rule-tests/advisory-registry-subset-test.yml

@@ -0,0 +1,41 @@
+id: advisory-registry-subset
+valid:
+  - |
+    // /^(typescript|python|marksman|opengrep):/ is prose, not code.
+    const one = "typescript|python";
+  - |
+    // ["typescript", "python"] is prose, not code.
+    const one = "['typescript', 'python']";
+  - |
+    const one = /^(typescript):/;
+  - |
+    const one = ["typescript"];
+  - |
+    const one = ["typescript", "not-a-server"];
+  - |
+    const one = /^(go|typescript-x):/;
+  - |
+    const one = /^(foo|typescript):/;
+  - |
+    const one = /^(typescript|foo):/;
+  - |
+    const one = /^typescript-python$/;
+invalid:
+  - |
+    const servers = /^(typescript|python|marksman|opengrep):/;
+  - |
+    const servers = ["typescript", "python", "marksman"];
+  - |
+    const servers = ["typescript", "python"];
+  - |
+    const servers = ['typescript', 'python', 'marksman'];
+  - |
+    const servers = ["foo", "typescript", "python"];
+  - |
+    const servers = ["typescript", "foo", "python"];
+  - |
+    const servers = ["foo", "typescript", "bar", "python"];
+  - |
+    const servers = /^(go|rust|ruby):/;
+  - |
+    const servers = /^(foo|typescript|python):/;

package/extensions/dm-lens/rules/ast-grep-rules/rule-tests/no-identity-operator-on-literals-test.yml

@@ -4,11 +4,21 @@ valid:
   - "if x is not None:"
   - "if x is y:"  # both are variables
   - "if obj is SingletonClass.instance:"  # pattern
+  - "if getattr(position, \"closed\", None) is True:"
+  - "if getattr(self.profit_take, \"last_close_was_race_drop\", False) is True:"
+  - "if result is not True:"
+  - "if result is not False:"
 invalid:
   - "if 1 is '1':"
   - "if x is 'literal':"
   - "if 'foo' is x:"
   - "if x is not 42:"
-  - "if x is True:"
-  - "if x is not False:"
+  - "if x is 1:"
+  - "if x is not 1.5:"
+  - "if x is -1:"
+  - "if -1 is x:"
+  - "if x is not -2:"
+  - "if x is -1.5:"
+  - "if -1.5 is x:"
+  - "if x is not -2.0:"
   - "if x is []:"  # list literal

package/extensions/dm-lens/rules/ast-grep-rules/rule-tests/throw-new-error-js-test.yml

@@ -8,3 +8,5 @@ invalid:
   - 'throw TypeError("x")'
   - 'throw RangeError("x")'
   - 'throw SyntaxError("x")'
+  - 'throw URIError("x")'
+  - 'throw EvalError("x")'

package/extensions/dm-lens/rules/ast-grep-rules/rule-tests/throw-new-error-test.yml

@@ -8,3 +8,5 @@ invalid:
   - 'throw TypeError("x")'
   - 'throw RangeError("x")'
   - 'throw SyntaxError("x")'
+  - 'throw URIError("x")'
+  - 'throw EvalError("x")'

package/extensions/dm-lens/rules/ast-grep-rules/rules/advisory-registry-subset.yml

@@ -0,0 +1,50 @@
+id: advisory-registry-subset
+language: TypeScript
+severity: info
+metadata:
+  category: dm-lens-self-scan
+message: "Hand-enumerated registry subset — explain the excluded ids or use the registry"
+ignores:
+  - "**/tests/**"
+note: |
+  Advisory only: `severity: info` self-scan rules are printed by
+  `npm run astgrep:self-scan` and never gate or enter the baseline
+  (scripts/lib/astgrep-self-scan.mjs), and are reported only in files
+  changed against a diff base (`--base <ref>`, CI's GITHUB_BASE_REF), or
+  everywhere with `--all-advisory`. This is a population-screening
+  prompt: two or more LSP server ids from clients/lsp/server.ts in a regex
+  alternation (any branch position) or in a string array (any position,
+  either quote style). The AST matcher does not scan comments or ordinary
+  strings. Tool and language registries remain a follow-up because their
+  larger populations need a separate low-noise rule shape.
+
+  Admission classes (every current hit belongs to one; the reader decides
+  whether a new hit needs a reason in the owning change):
+  - Extension / shell-name regexes (`file-role.ts`, `word-index.ts`,
+    `cache-manager.ts`, `jscpd-client.ts`, `tree-sitter-client.ts`,
+    `git-guard.ts`): file suffixes or shell binaries that share a spelling
+    with a server id; lexical coincidence, not a registry subset.
+  - Language-kind and runner-applicability arrays (`language-registry.ts`,
+    `tree-sitter-shared.ts`, `tree-sitter.ts`, `review-graph/builder.ts`,
+    `fact-rules.ts`, `biome-client.ts`, `ast-grep-napi.ts`,
+    `integration.ts`, `spotbugs.ts`, `test-runner-client.ts`,
+    `trivy-config.ts`): file-kind or language ids, an intentional
+    per-consumer applicability subset.
+  - `clients/file-kinds.ts` CODE_KINDS and NON_CODE_KINDS: derived
+    partitions of one registry, not independent registry choices.
+  - `clients/lsp/server.ts` OPENGREP_KINDS and AST_GREP_KINDS: auxiliary
+    servers attach to a deliberate cross-language subset.
+  - `clients/installer/index.ts` GITHUB_TOOLS: tool names, enforced against
+    the tool registry by tool-registry-consistency.
+rule:
+  any:
+    - kind: regex
+      regex: '^/[^/\n]*\b(?:typescript|deno|python|python-jedi|rust|ruby|php|powershell|csharp|omnisharp|fsharp|java|kotlin|swift|dart|lua|cpp|zig|haskell|elixir|expert|gleam|tinymist|marksman|ocaml|clojure|cue|terraform|nix|bash|fish|cmake|docker|yaml|json|html|toml|prisma|vue|svelte|css|opengrep|ast-grep|zizmor|typos)\b[^/\n]*\|[^/\n]*\b(?:typescript|deno|python|python-jedi|rust|ruby|php|powershell|csharp|omnisharp|fsharp|java|kotlin|swift|dart|lua|cpp|zig|haskell|elixir|expert|gleam|tinymist|marksman|ocaml|clojure|cue|terraform|nix|bash|fish|cmake|docker|yaml|json|html|toml|prisma|vue|svelte|css|opengrep|ast-grep|zizmor|typos)\b[^/\n]*/[dgimsuvy]*$'
+    - kind: array
+      has:
+        kind: string
+        regex: '^["''](typescript|deno|python|python-jedi|go|rust|ruby|php|powershell|csharp|omnisharp|fsharp|java|kotlin|swift|dart|lua|cpp|zig|haskell|elixir|expert|gleam|tinymist|marksman|ocaml|clojure|cue|terraform|nix|bash|fish|cmake|docker|yaml|json|html|toml|prisma|vue|svelte|css|opengrep|ast-grep|zizmor|typos)["'']$'
+        follows:
+          kind: string
+          regex: '^["''](typescript|deno|python|python-jedi|go|rust|ruby|php|powershell|csharp|omnisharp|fsharp|java|kotlin|swift|dart|lua|cpp|zig|haskell|elixir|expert|gleam|tinymist|marksman|ocaml|clojure|cue|terraform|nix|bash|fish|cmake|docker|yaml|json|html|toml|prisma|vue|svelte|css|opengrep|ast-grep|zizmor|typos)["'']$'
+          stopBy: end

package/extensions/dm-lens/rules/ast-grep-rules/rules/no-identity-operator-on-literals.yml

@@ -13,11 +13,13 @@ note: |
   literal-kind check. This ensures we ONLY flag literal-vs-X
   comparisons (not `x == "literal"` which is the correct form).
 
-  Two regex variants cover `is True/False` (where `True`/`False`
-  parse as identifiers, not a `true`/`false` AST kind). Two more
-  cover `is not True/False`. The remaining variants use
+  Identity against the bool singletons is deliberately excluded:
+  `is True`, `is False`, `is not True`, and `is not False` are
+  correct singleton checks in Python, including tri-state and mock-
+  robustness checks. The remaining variants use
   `has: kind: <literal>` as direct children of the
-  comparison_operator.
+  comparison_operator. Negative numeric literals are unary_operator
+  children, so their nested integer/float kinds are covered explicitly.
 
   Direct children only — no `stopBy: end` — so string subscripts
   like `summary["verified"] is True` don't fire (the string is
@@ -29,14 +31,6 @@ metadata:
   sonar: S3403
 rule:
   any:
-    - kind: comparison_operator
-      regex: 'is\s+(True|False|true|false)\b'
-    - kind: comparison_operator
-      regex: '\b(True|False|true|false)\s+is\b'
-    - kind: comparison_operator
-      regex: 'is\s+not\s+(True|False|true|false)\b'
-    - kind: comparison_operator
-      regex: '\b(True|False|true|false)\s+is\s+not\b'
     - all:
         - kind: comparison_operator
           regex: '\bis\b'
@@ -47,11 +41,25 @@ rule:
           regex: '\bis\b'
         - has:
             kind: integer
+    - all:
+        - kind: comparison_operator
+          regex: '\bis\b'
+        - has:
+            kind: unary_operator
+            has:
+              kind: float
     - all:
         - kind: comparison_operator
           regex: '\bis\b'
         - has:
             kind: float
+    - all:
+        - kind: comparison_operator
+          regex: '\bis\b'
+        - has:
+            kind: unary_operator
+            has:
+              kind: integer
     - all:
         - kind: comparison_operator
           regex: '\bis\b'

package/extensions/dm-lens/rules/ast-grep-rules/rules/throw-new-error-js.yml

@@ -1,9 +1,9 @@
 id: throw-new-error-js
 language: JavaScript
-severity: error
+severity: warning
 message: "Use new Error() not Error() — explicit construction is clearer"
 note: |
-  throw Error() works by accident. throw new Error() is the correct pattern.
+  This is a consistency/style rule: Error() is spec-equivalent to new Error().
 rule:
   any:
     - pattern: "throw Error($$$ARGS)"

package/extensions/dm-lens/rules/ast-grep-rules/rules/throw-new-error.yml

@@ -1,9 +1,9 @@
 id: throw-new-error
 language: TypeScript
-severity: error
+severity: warning
 message: "Use new Error() not Error() — explicit construction is clearer"
 note: |
-  throw Error() works by accident. throw new Error() is the correct pattern.
+  This is a consistency/style rule: Error() is spec-equivalent to new Error().
 rule:
   any:
     - pattern: "throw Error($$$ARGS)"