@duckmind/dm-darwin-x64 0.66.4 → 0.66.6

package/extensions/dm-lens/clients/probe-home-state.js

@@ -15,6 +15,11 @@ export function getGlobalDmLensLogDir() {
     return path.resolve(override);
   return resolveProbeHomeDir() ?? path.join(os.homedir(), ".dm-lens");
 }
+export function isTestProcessTargetingRealHome(file) {
+  if (!process.env.VITEST)
+    return false;
+  return isUnderRealDir(path.dirname(path.resolve(file)), path.join(os.homedir(), ".dm-lens"));
+}
 function resolveProbeHomeDir() {
   const slot = globalThis;
   const cached = slot[RESOLUTION_SLOT];
@@ -24,7 +29,7 @@ function resolveProbeHomeDir() {
   const probeHome = computeProbeHomeDir(cwd);
   slot[RESOLUTION_SLOT] = {
     probeHome,
-    event: probeHome ? { probeHome, cwd } : undefined
+    event: probeHome ? { probeHome } : undefined
   };
   return probeHome;
 }

package/extensions/dm-lens/clients/process-bridge.js

@@ -1,3 +1,4 @@
+import { getProcessSingleton } from "./process-singletons.js";
 export function registerProcessBridge(key, build) {
   if (key in globalThis)
     return;
@@ -18,3 +19,30 @@ export function getProcessBridge(key, version) {
     return;
   return candidate;
 }
+function isScopedBridgeActivation(activation) {
+  if (typeof activation !== "object" || activation === null)
+    return false;
+  const candidate = activation;
+  return (candidate.role === "primary" || candidate.role === "secondary") && typeof candidate.scopeId === "number" && typeof candidate.isLive === "function";
+}
+function isPreSessionActivation(activation) {
+  return typeof activation === "object" && activation !== null && activation.role === "pre-session";
+}
+export function rebindableProcessBridgeDeps(family, version, activation, deps) {
+  const cell = getProcessSingleton(family, version, () => ({
+    activation,
+    deps
+  }));
+  const current = isScopedBridgeActivation(cell.activation) ? cell.activation : undefined;
+  const accepts = !isScopedBridgeActivation(activation) ? isPreSessionActivation(activation) ? current === undefined : cell.activation !== activation : activation.role === "primary" && activation.isLive() && (current === undefined || current.role === "primary" && activation.scopeId > current.scopeId);
+  if (accepts) {
+    cell.activation = activation;
+    cell.deps = deps;
+  }
+  return () => {
+    const owner = cell.activation;
+    if (isScopedBridgeActivation(owner) && !owner.isLive())
+      return;
+    return cell.deps;
+  };
+}

package/extensions/dm-lens/clients/process-snapshot.js

@@ -2,8 +2,13 @@ import {
   spawnCollectStdoutResult
 } from "./child-unref.js";
 import {
+  buildEnvironmentQuery,
   buildProcessQuery,
-  parseProcessTable
+  parseEnvironmentVariable,
+  parseProcessTable,
+  readLinuxPidNamespace,
+  readLinuxProcessEnvironmentVariable,
+  readLinuxProcessStart
 } from "../scripts/lib/process-scan.mjs";
 export { windowsExe } from "../scripts/lib/process-scan.mjs";
 export async function queryProcessTable(request, options) {
@@ -16,7 +21,12 @@ export async function queryProcessTable(request, options) {
   } catch {
     return { rows: [], status: "spawn-error", serverSideFiltered: false };
   }
-  const result = await spawnCollectStdoutResult(query.command, query.args, { shell: false, windowsHide: true, stdio: ["ignore", "pipe", "ignore"] }, { timeoutMs: options.timeoutMs, onTimeout: options.onTimeout });
+  const result = await spawnCollectStdoutResult(query.command, query.args, {
+    shell: false,
+    windowsHide: true,
+    stdio: ["ignore", "pipe", "ignore"],
+    env: query.env
+  }, { timeoutMs: options.timeoutMs, onTimeout: options.onTimeout });
   return {
     rows: parseProcessTable(result.stdout, query.tabSeparated, query.fields),
     status: result.status,
@@ -25,3 +35,106 @@ export async function queryProcessTable(request, options) {
     serverSideFiltered: query.serverSideFiltered
   };
 }
+function validPids(pids) {
+  return [...new Set(pids.filter((p) => Number.isInteger(p) && p > 0))];
+}
+export async function queryProcessIdentities(pids, options) {
+  const valid = validPids(pids);
+  const identities = new Map;
+  if (valid.length === 0)
+    return { identities, status: "ok" };
+  const linux = process.platform === "linux";
+  const result = await queryProcessTable({
+    fields: linux ? ["pid", "command"] : ["pid", "startedAt", "command"],
+    filter: { column: "ProcessId", op: "eq", values: valid }
+  }, options);
+  for (const row of result.rows) {
+    const start = linux ? readLinuxProcessStart(row.pid) : row.startedAt;
+    identities.set(row.pid, {
+      command: row.command,
+      start: start ? start : undefined
+    });
+  }
+  return { identities, status: result.status };
+}
+export const OWNER_TAG_ENV = "DM_LENS_OWNER";
+export function formatOwnerTag(tag) {
+  return `${tag.pid}:${tag.start}`;
+}
+export function parseOwnerTag(value) {
+  const match = /^(\d+):(\d+@[0-9a-f-]{36}|\d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2}(?:\.\d+)?Z)$/.exec(value ?? "");
+  if (!match)
+    return;
+  const [, pidText = "", start = ""] = match;
+  const pid = Number(pidText);
+  return pid > 0 ? { pid, start } : undefined;
+}
+export async function ownerTagForChildren(options) {
+  if (process.platform === "win32")
+    return;
+  const start = await ownProcessStart(options);
+  return start === undefined ? undefined : formatOwnerTag({ pid: process.pid, start });
+}
+export async function readOwnerTags(pids, options) {
+  const tags = new Map;
+  const valid = validPids(pids);
+  if (valid.length === 0 || process.platform === "win32")
+    return { tags, status: "ok" };
+  if (process.platform === "linux") {
+    const own = ownPidNamespace();
+    for (const pid of valid) {
+      const namespace = readLinuxPidNamespace(pid);
+      if (namespace === undefined || namespace !== own)
+        continue;
+      const tag = parseOwnerTag(readLinuxProcessEnvironmentVariable(pid, OWNER_TAG_ENV));
+      if (tag)
+        tags.set(pid, tag);
+    }
+    return { tags, status: "ok" };
+  }
+  const query = buildEnvironmentQuery(valid);
+  const result = await spawnCollectStdoutResult(query.command, query.args, { shell: false, windowsHide: true, stdio: ["ignore", "pipe", "ignore"] }, options);
+  for (const [pid, value] of parseEnvironmentVariable(result.stdout, OWNER_TAG_ENV)) {
+    const tag = parseOwnerTag(value);
+    if (tag)
+      tags.set(pid, tag);
+  }
+  return {
+    tags,
+    status: result.status === "exit-error" ? "ok" : result.status
+  };
+}
+export function isInPidNamespace(entry, namespace) {
+  return entry.pidNamespace === undefined || entry.pidNamespace === namespace;
+}
+export function ownPidNamespace() {
+  return process.platform === "linux" ? readLinuxPidNamespace(process.pid) : undefined;
+}
+let ownStart = null;
+export function ownProcessStart(options) {
+  if (process.platform === "linux")
+    return Promise.resolve(readLinuxProcessStart(process.pid));
+  if (ownStart)
+    return ownStart.promise;
+  const cell = {
+    promise: readProcessStart(process.pid, options).then((start) => {
+      if (start === undefined)
+        ownStart = null;
+      else
+        cell.value = start;
+      return start;
+    })
+  };
+  ownStart = cell;
+  return cell.promise;
+}
+export async function readProcessStart(pid, options) {
+  if (process.platform === "linux")
+    return readLinuxProcessStart(pid);
+  return (await queryProcessIdentities([pid], options)).identities.get(pid)?.start;
+}
+export function ownProcessStartIfKnown() {
+  if (process.platform === "linux")
+    return readLinuxProcessStart(process.pid);
+  return ownStart?.value;
+}

package/extensions/dm-lens/clients/project-changes.js

@@ -1,6 +1,9 @@
 import * as fs from "node:fs";
 import * as path from "node:path";
+import { BoundedFifoMap } from "./bounded-cache.js";
+import { incrementDegradationCount } from "./degradation-ledger.js";
 import { getProjectDataDir } from "./file-utils.js";
+import { withGenerationLockSync } from "./generation-lock.js";
 import { normalizeMapKey } from "./path-utils.js";
 export function getProjectChangeLogPath(cwd) {
   return path.join(getProjectDataDir(cwd), "change-log.jsonl");
@@ -19,17 +22,28 @@ function parseChangeLine(line) {
       source: parsed.source,
       filePath: parsed.filePath,
       fileSeq: parsed.fileSeq,
-      changedRange: parsed.changedRange
+      changedRange: parsed.changedRange,
+      ...parsed.unlocked === true ? { unlocked: true } : {}
     };
   } catch {
     return;
   }
 }
+const changeLogCursors = new BoundedFifoMap(16);
+function parseChangeLog(logPath, content) {
+  const entries = content.split(/\r?\n/).map((line) => line.trim()).filter(Boolean).map(parseChangeLine).filter((entry) => Boolean(entry));
+  const bytes = Buffer.byteLength(content.slice(0, content.lastIndexOf(`
+`) + 1));
+  let maxSeq = 0;
+  for (const entry of entries)
+    maxSeq = Math.max(maxSeq, entry.seq);
+  changeLogCursors.set(logPath, { bytes, maxSeq });
+  return entries;
+}
 export function readProjectChanges(cwd) {
   const logPath = getProjectChangeLogPath(cwd);
   try {
-    const content = fs.readFileSync(logPath, "utf-8");
-    return content.split(/\r?\n/).map((line) => line.trim()).filter(Boolean).map(parseChangeLine).filter((entry) => Boolean(entry));
+    return parseChangeLog(logPath, fs.readFileSync(logPath, "utf-8"));
   } catch {
     return [];
   }
@@ -37,8 +51,7 @@ export function readProjectChanges(cwd) {
 async function readProjectChangesAsync(cwd) {
   const logPath = getProjectChangeLogPath(cwd);
   try {
-    const content = await fs.promises.readFile(logPath, "utf-8");
-    return content.split(/\r?\n/).map((line) => line.trim()).filter(Boolean).map(parseChangeLine).filter((entry) => Boolean(entry));
+    return parseChangeLog(logPath, await fs.promises.readFile(logPath, "utf-8"));
   } catch {
     return [];
   }
@@ -87,22 +100,19 @@ function partialReplay(entries, base) {
   return { projectSeq, fileSeqByPath };
 }
 export function readLatestProjectSequence(cwd, base) {
-  const entries = readProjectChanges(cwd);
-  if (base) {
-    const partial = partialReplay(entries, base);
-    if (partial)
-      return partial;
-  }
-  return fullReplay(entries);
+  return replay(readProjectChanges(cwd), base);
+}
+function replay(entries, base) {
+  let unlockedThrough = 0;
+  entries.forEach((entry, index) => {
+    if (entry.unlocked)
+      unlockedThrough = index + 1;
+  });
+  const index = base && unlockedThrough <= (base.logEntries ?? 0) && partialReplay(entries, base) || fullReplay(entries);
+  return { ...index, logEntries: entries.length, unlockedThrough };
 }
 export async function readLatestProjectSequenceAsync(cwd, base) {
-  const entries = await readProjectChangesAsync(cwd);
-  if (base) {
-    const partial = partialReplay(entries, base);
-    if (partial)
-      return partial;
-  }
-  return fullReplay(entries);
+  return replay(await readProjectChangesAsync(cwd), base);
 }
 export function appendProjectChange(cwd, entry) {
   const logPath = getProjectChangeLogPath(cwd);
@@ -110,3 +120,55 @@ export function appendProjectChange(cwd, entry) {
   fs.appendFileSync(logPath, `${JSON.stringify(entry)}
 `, "utf-8");
 }
+function readChangeLogMaxSeq(logPath) {
+  let fd;
+  try {
+    fd = fs.openSync(logPath, "r");
+  } catch (err) {
+    if (err.code === "ENOENT")
+      return 0;
+    throw err;
+  }
+  try {
+    const cursor = changeLogCursors.get(logPath) ?? { bytes: 0, maxSeq: 0 };
+    const size = fs.fstatSync(fd).size;
+    if (size > cursor.bytes) {
+      const tail = Buffer.alloc(size - cursor.bytes);
+      const read = fs.readSync(fd, tail, 0, tail.length, cursor.bytes);
+      const complete = tail.subarray(0, read).lastIndexOf(10) + 1;
+      for (const line of tail.subarray(0, complete).toString("utf-8").split(`
+`)) {
+        const entry = line.trim() ? parseChangeLine(line) : undefined;
+        if (entry && entry.seq > cursor.maxSeq)
+          cursor.maxSeq = entry.seq;
+      }
+      cursor.bytes += complete;
+    }
+    changeLogCursors.set(logPath, cursor);
+    return cursor.maxSeq;
+  } finally {
+    fs.closeSync(fd);
+  }
+}
+const CHANGE_LOG_LOCK = { staleMs: 5000, waitMs: 500 };
+export function appendProjectChangeAllocated(cwd, build) {
+  const logPath = getProjectChangeLogPath(cwd);
+  fs.mkdirSync(path.dirname(logPath), { recursive: true });
+  readChangeLogMaxSeq(logPath);
+  const append = (locked) => {
+    const entry = build(readChangeLogMaxSeq(logPath));
+    const line = locked ? entry : { ...entry, unlocked: true };
+    fs.appendFileSync(logPath, `${JSON.stringify(line)}
+`, "utf-8");
+  };
+  const result = withGenerationLockSync(`${logPath}.locks`, CHANGE_LOG_LOCK, () => append(true));
+  if (result.held)
+    return;
+  const code = result.cause?.code;
+  incrementDegradationCount({
+    kind: "change-log-lock-unavailable",
+    subject: logPath,
+    reason: `appended unlocked: ${code ? `lock failed (${code})` : "lock wait ran out"}`
+  });
+  append(false);
+}

package/extensions/dm-lens/clients/project-diagnostics/fresh-fetch.js

@@ -2,6 +2,7 @@ import * as fs from "node:fs";
 import * as os from "node:os";
 import * as path from "node:path";
 import { applyDispositionsMultiFile } from "../diagnostic-dispositions.js";
+import { parseScannedAtMs } from "../advisory-provenance.js";
 import { getKnipIgnorePatterns } from "../file-utils.js";
 import { isAtOrAboveHomeDir, realpathOrResolve } from "../path-utils.js";
 import { isSameOrWithin } from "../lsp/server.js";
@@ -41,6 +42,9 @@ function pushUnique(list, id) {
   if (!list.includes(id))
     list.push(id);
 }
+function laneObservedAtMs(scannedAt, startedAtMs) {
+  return parseScannedAtMs(scannedAt) ?? startedAtMs;
+}
 export async function fetchFreshProjectDiagnostics(cacheManager, cwd, clients, signal, options = {}) {
   const requestedRoot = options.analysisRoot === undefined ? cwd : path.resolve(cwd, options.analysisRoot);
   let analysisRoot;
@@ -139,7 +143,7 @@ export async function fetchFreshProjectDiagnostics(cacheManager, cwd, clients, s
     pushUnique(partial, id);
     partialReasons[id] = reason;
   }
-  function record(id, adapted, elapsedMs, analysedRoot, analysis) {
+  function record(id, adapted, elapsedMs, analysedRoot, analysis, observedAt) {
     if (analysedRoot) {
       pushUnique(analyzed, id);
       if (analysis?.analyzedFiles !== undefined) {
@@ -161,7 +165,8 @@ export async function fetchFreshProjectDiagnostics(cacheManager, cwd, clients, s
       }
     }
     timings[id] = (timings[id] ?? 0) + elapsedMs;
-    const kept = applyDispositionsMultiFile(adapted, analysisRoot, (d) => d.filePath);
+    const stamped = observedAt === undefined ? adapted : adapted.map((diagnostic) => ({ ...diagnostic, observedAt }));
+    const kept = applyDispositionsMultiFile(stamped, analysisRoot, (d) => d.filePath);
     const suppressedHere = adapted.length - kept.length;
     dispositionSuppressed += suppressedHere;
     if (suppressedHere > 0) {
@@ -197,7 +202,7 @@ export async function fetchFreshProjectDiagnostics(cacheManager, cwd, clients, s
       cacheManager.writeCache("knip", result, analysisRoot, {
         scanDurationMs: Date.now() - startMs
       });
-      record("knip", knipIssuesToProjectDiagnostics(analysisRoot, result.issues ?? []), Date.now() - startMs, true, result);
+      record("knip", knipIssuesToProjectDiagnostics(analysisRoot, result.issues ?? []), Date.now() - startMs, true, result, laneObservedAtMs(result.scannedAt, startMs));
     }),
     task("jscpd", async () => {
       if (!await clients.jscpdClient.ensureAvailable()) {
@@ -219,7 +224,7 @@ export async function fetchFreshProjectDiagnostics(cacheManager, cwd, clients, s
       cacheManager.writeCache(scannerKey, result, analysisRoot, {
         scanDurationMs: Date.now() - startMs
       });
-      record("jscpd", jscpdResultToProjectDiagnostics(analysisRoot, result), Date.now() - startMs, true, result);
+      record("jscpd", jscpdResultToProjectDiagnostics(analysisRoot, result), Date.now() - startMs, true, result, laneObservedAtMs(result.scannedAt, startMs));
     }),
     task("madge", async () => {
       if (!await clients.depChecker.ensureAvailable()) {
@@ -231,7 +236,7 @@ export async function fetchFreshProjectDiagnostics(cacheManager, cwd, clients, s
       cacheManager.writeCache("madge", result, analysisRoot, {
         scanDurationMs: Date.now() - startMs
       });
-      record("madge", circularDepsToProjectDiagnostics(analysisRoot, result.circular ?? []), Date.now() - startMs, result.analyzed === true, result);
+      record("madge", circularDepsToProjectDiagnostics(analysisRoot, result.circular ?? []), Date.now() - startMs, result.analyzed === true, result, laneObservedAtMs(result.scannedAt, startMs));
     }),
     task("gitleaks", async () => {
       if (!GitleaksClient.hasGitRepo(analysisRoot)) {
@@ -253,7 +258,7 @@ export async function fetchFreshProjectDiagnostics(cacheManager, cwd, clients, s
       cacheManager.writeCache("gitleaks", result, analysisRoot, {
         scanDurationMs: Date.now() - startMs
       });
-      record("gitleaks", gitleaksResultToProjectDiagnostics(analysisRoot, result), Date.now() - startMs, result.analyzed === true, result);
+      record("gitleaks", gitleaksResultToProjectDiagnostics(analysisRoot, result), Date.now() - startMs, result.analyzed === true, result, laneObservedAtMs(result.scannedAt, startMs));
     }),
     task("govulncheck", async () => {
       if (!GovulncheckClient.hasGoModule(analysisRoot)) {
@@ -273,7 +278,7 @@ export async function fetchFreshProjectDiagnostics(cacheManager, cwd, clients, s
       cacheManager.writeCache("govulncheck", result, analysisRoot, {
         scanDurationMs: Date.now() - startMs
       });
-      record("govulncheck", govulncheckResultToProjectDiagnostics(analysisRoot, result), Date.now() - startMs, result.analyzed === true, result);
+      record("govulncheck", govulncheckResultToProjectDiagnostics(analysisRoot, result), Date.now() - startMs, result.analyzed === true, result, laneObservedAtMs(result.scannedAt, startMs));
     }),
     task("opengrep", async () => {
       if (!await clients.opengrepClient.ensureAvailable()) {
@@ -292,18 +297,18 @@ export async function fetchFreshProjectDiagnostics(cacheManager, cwd, clients, s
           markPartial("opengrep", reason);
         else
           markCold("opengrep", reason);
-        record("opengrep", opengrepResultToProjectDiagnostics(analysisRoot, result), Date.now() - startMs, false, result);
+        record("opengrep", opengrepResultToProjectDiagnostics(analysisRoot, result), Date.now() - startMs, false, result, laneObservedAtMs(result.scannedAt, startMs));
         return;
       }
       if (result.partial) {
         markPartial("opengrep", result.summary ?? result.reason ?? "opengrep scan coverage is incomplete");
-        record("opengrep", opengrepResultToProjectDiagnostics(analysisRoot, result), Date.now() - startMs, true, result);
+        record("opengrep", opengrepResultToProjectDiagnostics(analysisRoot, result), Date.now() - startMs, true, result, laneObservedAtMs(result.scannedAt, startMs));
         return;
       }
       cacheManager.writeCache("opengrep", result, analysisRoot, {
         scanDurationMs: Date.now() - startMs
       });
-      record("opengrep", opengrepResultToProjectDiagnostics(analysisRoot, result), Date.now() - startMs, result.analyzed === true, result);
+      record("opengrep", opengrepResultToProjectDiagnostics(analysisRoot, result), Date.now() - startMs, result.analyzed === true, result, laneObservedAtMs(result.scannedAt, startMs));
     }),
     task("trivy", async () => {
       if (!TrivyClient.shouldScan(analysisRoot)) {
@@ -323,7 +328,7 @@ export async function fetchFreshProjectDiagnostics(cacheManager, cwd, clients, s
       cacheManager.writeCache("trivy", result, analysisRoot, {
         scanDurationMs: Date.now() - startMs
       });
-      record("trivy", trivyResultToProjectDiagnostics(analysisRoot, result), Date.now() - startMs, result.analyzed === true, result);
+      record("trivy", trivyResultToProjectDiagnostics(analysisRoot, result), Date.now() - startMs, result.analyzed === true, result, laneObservedAtMs(result.scannedAt, startMs));
     }),
     task("dead-code", async () => {
       const applicable = clients.deadCodeClients.filter((c) => c.detect(analysisRoot));
@@ -345,7 +350,7 @@ export async function fetchFreshProjectDiagnostics(cacheManager, cwd, clients, s
           });
         }
         const adapted = deadCodeResultToProjectDiagnostics(analysisRoot, result);
-        record("dead-code", adapted, Date.now() - startMs, result.analyzed === true, result);
+        record("dead-code", adapted, Date.now() - startMs, result.analyzed === true, result, laneObservedAtMs(result.scannedAt, startMs));
       }));
     }),
     task("test-runner", async () => {
@@ -356,7 +361,7 @@ export async function fetchFreshProjectDiagnostics(cacheManager, cwd, clients, s
         return;
       }
       cachedAgeMs["test-runner"] = Date.now() - new Date(cached.meta.timestamp).getTime();
-      record("test-runner", testRunnerFindingsToProjectDiagnostics(cached.data, analysisRoot, options.runtime), Date.now() - startMs, false);
+      record("test-runner", testRunnerFindingsToProjectDiagnostics(cached.data, analysisRoot, options.runtime), Date.now() - startMs, false, undefined, laneObservedAtMs(cached.data.launchedFrom?.revision.capturedAt ?? cached.meta.timestamp, startMs));
     })
   ];
   const allSettled = Promise.all(tasks).then(() => "completed").catch(() => "completed");

package/extensions/dm-lens/clients/project-lens-config.js

@@ -288,6 +288,18 @@ function parseRulePolicyList(note, ruleId, key, value) {
   }
   return { list, invalid: false };
 }
+function parseRulePathList(note, ruleId, value) {
+  if (!Array.isArray(value)) {
+    note(`rules.${ruleId}.ignorePaths must be an array of strings`);
+    return;
+  }
+  const paths = value.filter((entry) => typeof entry === "string" && entry.trim().length > 0).map((entry) => entry.trim());
+  if (value.length > 0 && paths.length === 0) {
+    note(`rules.${ruleId}.ignorePaths must contain a non-empty string`);
+    return;
+  }
+  return paths;
+}
 const NO_RECORDS = [];
 function parseConfigFile(configPath) {
   const { note, records: ignoredRecords } = ignoredRecordCollector(configPath, "project");
@@ -322,7 +334,11 @@ function parseConfigFile(configPath) {
     value: outcome.value
   });
   const raw = resolved.value;
-  const obj = resolved.value;
+  const rawProject = outcome.value;
+  const obj = {
+    ...resolved.value,
+    ...rawProject.rules !== undefined ? { rules: rawProject.rules } : {}
+  };
   const ignore = Array.isArray(obj.ignore) ? obj.ignore.filter((p) => typeof p === "string") : [];
   const mutations = {};
   for (const spec of PROJECT_SCOPED_LENS_FLAGS) {
@@ -354,9 +370,14 @@ function parseConfigFile(configPath) {
         if (!parsed.invalid && parsed.list.length > 0)
           entry.select = parsed.list;
       }
-      if (entry.threshold !== undefined || entry.disable || entry.select) {
+      if ("ignorePaths" in r) {
+        const paths = parseRulePathList(note, ruleId, r.ignorePaths);
+        if (paths && paths.length > 0)
+          entry.ignorePaths = paths;
+      }
+      if (entry.threshold !== undefined || entry.disable || entry.select || entry.ignorePaths) {
         rules[ruleId] = entry;
-      } else if (!("threshold" in r) && !("disable" in r) && !("select" in r)) {
+      } else if (!("threshold" in r) && !("disable" in r) && !("select" in r) && !("ignorePaths" in r)) {
         note(`rules.${ruleId} has no recognized setting (threshold, disable, select); ignored`);
       }
     }
@@ -428,7 +449,13 @@ function parseConfigFile(configPath) {
   ];
   const globalConfigLabel = homeRelativePath(getDmLensGlobalConfigPath(), os.homedir());
   const warnUnhonoredKey = (label, globalOnly) => {
-    note(globalOnly ? `"${label}" is a global-only dm-lens setting and is not honored in a project .dm-lens.json (set it in ${globalConfigLabel} or pass the matching CLI flag); ignored` : `unknown key "${label}" is not a recognized dm-lens setting (check for a typo); ignored`);
+    if (!globalOnly) {
+      note(`unknown key "${label}" is not a recognized dm-lens setting (check for a typo); ignored`);
+      return;
+    }
+    const hasCliFlag = LENS_FLAGS.some(({ configKey }) => configKey === label || configKey.startsWith(`${label}.`));
+    const cliClause = hasCliFlag ? " or pass the matching CLI flag" : "";
+    note(`"${label}" is a global-only dm-lens setting and is not honored in a project .dm-lens.json (set it in ${globalConfigLabel}${cliClause}); ignored`);
   };
   for (const key of Object.keys(obj)) {
     if (knownProjectKeys.has(key))
@@ -469,7 +496,7 @@ function parseConfigFile(configPath) {
       raw,
       configPath
     },
-    records: resolved.records,
+    records: resolved.records.filter((record) => !record.key.startsWith("/rules/")),
     ignored: ignoredRecords()
   };
 }

package/extensions/dm-lens/clients/project-scale.js

@@ -17,7 +17,7 @@ export function getProjectScaleBase(cwd) {
 export const PROJECT_SCALE_RATIOS = {
   projectDiagnosticsScanner: 0.25,
   reviewGraph: 0.5,
-  startupScan: 1,
+  startupScan: 1.25,
   jscpd: 3,
   wordIndex: 3
 };

package/extensions/dm-lens/clients/project-snapshot-fingerprint.js

@@ -1,39 +1,44 @@
 import { createHash } from "node:crypto";
+const QUOTE = 34;
+const BACKSLASH = 92;
+const OPEN_BRACE = 123;
+const CLOSE_BRACE = 125;
 export function fingerprintProjectSnapshotJson(json, generatedAt) {
-  const marker = `"generatedAt":${JSON.stringify(generatedAt)}`;
+  const bytes = typeof json === "string" ? Buffer.from(json) : Buffer.from(json.buffer, json.byteOffset, json.byteLength);
+  const marker = Buffer.from(`"generatedAt":${JSON.stringify(generatedAt)}`);
   let markerIndex = -1;
   let depth = 0;
   let inString = false;
   let escaped = false;
-  for (let index = 0;index < json.length; index++) {
-    const char = json[index];
+  for (let index = 0;index < bytes.length; index++) {
+    const byte = bytes[index];
     if (inString) {
       if (escaped)
         escaped = false;
-      else if (char === "\\")
+      else if (byte === BACKSLASH)
         escaped = true;
-      else if (char === '"')
+      else if (byte === QUOTE)
         inString = false;
       continue;
     }
-    if (char === '"') {
-      if (depth === 1 && json.startsWith(marker, index)) {
+    if (byte === QUOTE) {
+      if (depth === 1 && index + marker.length <= bytes.length && bytes.compare(marker, 0, marker.length, index, index + marker.length) === 0) {
         markerIndex = index;
         break;
       }
       inString = true;
-    } else if (char === "{")
+    } else if (byte === OPEN_BRACE)
       depth++;
-    else if (char === "}")
+    else if (byte === CLOSE_BRACE)
       depth--;
   }
   const hash = createHash("sha256");
   if (markerIndex < 0) {
-    hash.update(json);
+    hash.update(bytes);
   } else {
-    hash.update(json.slice(0, markerIndex));
+    hash.update(bytes.subarray(0, markerIndex));
     hash.update('"generatedAt":""');
-    hash.update(json.slice(markerIndex + marker.length));
+    hash.update(bytes.subarray(markerIndex + marker.length));
   }
   return hash.digest("hex");
 }

package/extensions/dm-lens/clients/project-snapshot-persist-worker.js

@@ -2,9 +2,8 @@ import {
   serveGzipStageWorker
 } from "./gzip-stage-write.js";
 import { fingerprintProjectSnapshotJson } from "./project-snapshot-fingerprint.js";
-function semanticSnapshotFingerprint(request, json) {
-  const generatedAt = request.data.generatedAt;
-  return fingerprintProjectSnapshotJson(json, typeof generatedAt === "string" ? generatedAt : "");
+function semanticSnapshotFingerprint(request, body) {
+  return fingerprintProjectSnapshotJson(body, request.generatedAt);
 }
 serveGzipStageWorker((request) => ({
   id: request.id,