@duckmind/dm-darwin-x64 0.66.4 → 0.66.6

package/extensions/dm-lens/clients/actionable-warnings.js

@@ -6,8 +6,12 @@ import {
   normalizeMessage,
   stableFindingId
 } from "./finding-identity.js";
-import { applyWorkspaceEdit } from "./lsp/edits.js";
-import { getLSPService } from "./lsp/index.js";
+import {
+  applyWorkspaceEdit,
+  StaleWorkspaceEditContentError,
+  workspaceEditDiskPaths
+} from "./lsp/edits.js";
+import { getLSPService } from "./lsp/capabilities.js";
 import { isUnderDir, normalizeMapKey } from "./path-utils.js";
 import {
   bounded,
@@ -612,6 +616,8 @@ function assembleReport(cwd, args, records, stamps) {
     displayPath: toRunnerDisplayPath(cwd, filePath),
     fileSeq: args.fileSeqByPath?.get(normalizeMapKey(filePath)),
     generatedAt: stamps?.observedAtByPath.get(normalizeMapKey(filePath)) ?? stamps?.fallbackObservedAt ?? generatedAt,
+    branchEpoch: args.branchEpoch,
+    branchScope: args.branchScope,
     warnings
   }));
   const summary = summarizeReportFiles(files);
@@ -693,6 +699,8 @@ export function mergeActionableWarningsReports(args) {
       ...incumbent,
       fileSeq: incumbent.fileSeq ?? entry.fileSeq,
       generatedAt: olderStamp(incumbent.generatedAt ?? newerReport?.generatedAt, entry.generatedAt ?? olderReport?.generatedAt),
+      branchEpoch: olderBranchEpoch(incumbent.branchEpoch, entry.branchEpoch),
+      branchScope: incumbent.branchScope === entry.branchScope ? incumbent.branchScope : undefined,
       warnings: mergeWarnings([...incumbent.warnings, ...entry.warnings])
     } : { ...entry };
     if (deferredPublish) {
@@ -744,11 +752,12 @@ export function publishActionableWarningsReport(cacheManager, cwd, report, opts
     opts.dbg?.(`actionable_warnings: ${origin} publish merged ${merged.mergedFiles} persisted file entry/entries`);
   }
   if (origin === "in-band" && merged.droppedFiles.length > 0) {
-    const cause = merged.droppedForSessionMismatch ? "the publish crossed a session boundary (a different session's write, or a resumed process) before this turn's in-band publish could keep them" : "changed before this turn's in-band publish could keep them";
+    const cause = merged.droppedForSessionMismatch ? "the publish crossed a session boundary" : "changed before this turn's in-band publish could keep them";
+    const reason = `${merged.droppedFiles.length} carried-forward entries: findings are LOST on this channel; ${cause} (files: ${merged.droppedFiles.slice(0, 3).join(", ")}${merged.droppedFiles.length > 3 ? ", ..." : ""})`;
     incrementDegradationCount({
       kind: "actionable-warnings-inband-superseded",
       subject: `${path.resolve(cwd)}:inband-carry-superseded`,
-      reason: `${merged.droppedFiles.length} carried-forward deferred file entry/entries ${cause} (${merged.droppedFiles.slice(0, 3).join(", ")}${merged.droppedFiles.length > 3 ? ", ..." : ""}); their earlier findings are LOST on this channel rather than published against content that has since moved`
+      reason
     });
     opts.dbg?.(`actionable_warnings: in-band publish dropped ${merged.droppedFiles.length} superseded carried-forward file entry/entries (${merged.droppedFiles.slice(0, 3).join(", ")}${merged.droppedFiles.length > 3 ? ", ..." : ""})`);
   }
@@ -775,6 +784,23 @@ function newerStamp(a, b) {
     return a;
   return older === a ? b : a;
 }
+function olderBranchEpoch(a, b) {
+  if (typeof a !== "number" || typeof b !== "number")
+    return;
+  return Math.min(a, b);
+}
+export function quickFixCreditEpoch(files, liveScope) {
+  let oldest;
+  for (const { branchEpoch, branchScope } of files) {
+    if (branchScope !== liveScope || !isBranchEpoch(branchEpoch))
+      return;
+    oldest = oldest === undefined ? branchEpoch : Math.min(oldest, branchEpoch);
+  }
+  return oldest;
+}
+function isBranchEpoch(value) {
+  return Number.isInteger(value) && value >= 0;
+}
 function minDefined(a, b) {
   if (typeof a !== "number")
     return b;
@@ -795,7 +821,7 @@ export function writeDeferredActionableWarningsReport(args) {
     incrementDegradationCount({
       kind: "actionable-warnings-deferred-superseded",
       subject: `${path.resolve(args.cwd)}:deferred-file-superseded`,
-      reason: `${droppedFiles.length} file(s) changed while the deferred LSP pull was reading them (${droppedFiles.slice(0, 3).join(", ")}${droppedFiles.length > 3 ? ", ..." : ""}); their warnings are LOST on this channel rather than published against content that has since moved. Every file that did NOT change was merged into the persisted report`
+      reason: `${droppedFiles.length} changed file(s): warnings are LOST; unchanged files were merged into the persisted report (files: ${droppedFiles.slice(0, 3).join(", ")}${droppedFiles.length > 3 ? ", ..." : ""})`
     });
     args.dbg?.(`turn_end: deferred actionable-warnings dropped ${droppedFiles.length} superseded file entry/entries`);
   }
@@ -808,6 +834,8 @@ export function getActionableWarningsHistoryPath(cwd) {
 export function appendActionableWarningsHistory(cwd, report) {
   const entries = [];
   for (const file of report.files) {
+    if (file.reVerifyIncomplete)
+      continue;
     for (const warning of file.warnings) {
       entries.push({
         timestamp: report.generatedAt,
@@ -959,18 +987,42 @@ export async function applyConservativeActionableWarningFixes(args) {
           });
           continue;
         }
+        if (args.mutationContext?.session && args.mutationContext.session.guardedWrite(warning.filePath, () => true) === undefined) {
+          summary.skipped.push({ id: warning.id, reason: "session_replaced" });
+          continue;
+        }
         const edit = selected.edit;
-        const applied = await applyWorkspaceEdit(edit, args.cwd, args.mutationContext ? {
-          mutationContext: {
-            ...args.mutationContext,
-            emitSummary: false
-          }
-        } : undefined);
+        if (edit.documentChanges?.some((change) => typeof change === "object" && change !== null && ("kind" in change))) {
+          summary.skipped.push({
+            id: warning.id,
+            reason: "resource_operation"
+          });
+          continue;
+        }
+        const target = fs.realpathSync.native(warning.filePath);
+        const writesOtherFile = workspaceEditDiskPaths(edit).some((diskPath) => fs.realpathSync.native(diskPath) !== target);
+        if (writesOtherFile) {
+          summary.skipped.push({ id: warning.id, reason: "multi_file_edit" });
+          continue;
+        }
+        const applied = await applyWorkspaceEdit(edit, args.cwd, {
+          expectedContent: new Map([[target, content ?? ""]]),
+          ...args.mutationContext ? {
+            mutationContext: {
+              ...args.mutationContext,
+              emitSummary: false
+            }
+          } : {}
+        });
         appliedResults.push(applied);
         for (const changedFile of applied.files)
           changedFiles.add(changedFile);
         summary.applied++;
       } catch (err) {
+        if (err instanceof StaleWorkspaceEditContentError) {
+          summary.skipped.push({ id: warning.id, reason: "stale_content" });
+          continue;
+        }
         failedCount++;
         const partial = err.appliedWorkspaceEdit;
         if (partial) {

package/extensions/dm-lens/clients/advisory-provenance.js

@@ -309,9 +309,11 @@ export function gateFindingsByPathFreshness(args) {
   }
   merged.statCount = memo.facts.size;
   merged.truncated = memo.starved.size > 0;
-  emitDeadPathDropRecord(args.cwd, merged, dropped);
-  emitStaleLineDemoteRecord(args.cwd, scannedAtByStore, merged, demoted);
-  emitStatBudgetRecord(args.cwd, memo);
+  if (args.quiet !== true) {
+    emitDeadPathDropRecord(args.cwd, merged, dropped);
+    emitStaleLineDemoteRecord(args.cwd, scannedAtByStore, merged, demoted);
+    emitStatBudgetRecord(args.cwd, memo);
+  }
   return gates;
 }
 function emitDeadPathDropRecord(cwd, partition, byStore) {

package/extensions/dm-lens/clients/agent-nudge.js

@@ -1,12 +1,88 @@
+import { incrementDegradationCount } from "./degradation-ledger.js";
+import { hashText } from "./finding-identity.js";
 import { logLatency } from "./latency-logger.js";
 import { normalizeMapKey } from "./path-utils.js";
+import {
+  defineSessionStore
+} from "./session-scope.js";
 const BUS_FILES_TOUCHED_EVENT = "dmlens:files:touched";
 const MAX_NAMES_SHOWN = 5;
 const _touched = new Map;
 let _relevanceFilteredCount = 0;
+let _queueEpoch = 0;
+const MAX_QUEUED_ADVISORIES = 8;
+const _advisories = [];
+function countDroppedAdvisory(why, scopeId) {
+  incrementDegradationCount({
+    kind: "agent-advisory-dropped",
+    subject: `${why}:${scopeId}`,
+    reason: why === "cap" ? `an agent advisory of scope ${scopeId} was dropped: ${MAX_QUEUED_ADVISORIES} were already queued` : `an agent advisory of scope ${scopeId} was dropped: its session scope retired before its next context call`
+  });
+}
+function pruneRetiredAdvisories() {
+  const live = [];
+  for (const entry of _advisories) {
+    if (entry.scope.isCurrent())
+      live.push(entry);
+    else
+      countDroppedAdvisory("scope-retired", entry.scope.scopeId);
+  }
+  _advisories.splice(0, _advisories.length, ...live);
+}
+export function queueAgentAdvisory(text, scope) {
+  pruneRetiredAdvisories();
+  if (_advisories.length >= MAX_QUEUED_ADVISORIES) {
+    countDroppedAdvisory("cap", scope.scopeId);
+    return;
+  }
+  _advisories.push({ scope, text });
+}
+export const agentAdvisoryStore = defineSessionStore({
+  name: "agent-advisories",
+  policy: {
+    startup: "none",
+    new: "none",
+    resume: "none",
+    fork: "none",
+    reload: "adopt"
+  },
+  snapshot: (scope) => {
+    const texts = [];
+    for (const entry of _advisories)
+      if (entry.scope.scopeId === scope.scopeId)
+        texts.push(entry.text);
+    return texts;
+  },
+  restore: (scope, payload, ctx) => {
+    if (ctx.source !== "slot" || !Array.isArray(payload))
+      return { itemsIn: 0, itemsKept: 0 };
+    const handle = scope.capture();
+    const ownCount = () => {
+      let count = 0;
+      for (const entry of _advisories)
+        if (entry.scope.scopeId === scope.scopeId)
+          count += 1;
+      return count;
+    };
+    const before = ownCount();
+    for (const text of payload) {
+      if (typeof text !== "string")
+        continue;
+      const at = _advisories.findIndex((entry) => !entry.scope.isCurrent() && entry.text === text);
+      if (at === -1)
+        queueAgentAdvisory(text, handle);
+      else
+        _advisories[at] = { scope: handle, text };
+    }
+    return { itemsIn: payload.length, itemsKept: ownCount() - before };
+  },
+  reason: "the advisories a session queued and has not seen; a reload keeps the conversation, so they reach its next context call"
+});
 export function _resetAgentNudgeForTests() {
+  _advisories.length = 0;
   _touched.clear();
   _relevanceFilteredCount = 0;
+  _queueEpoch = 0;
   _enabledCache = undefined;
 }
 let _enabledCache;
@@ -40,6 +116,7 @@ function recordTouchedEvent(payload, getReadGuard) {
       existing.contentDelivered = false;
     } else {
       _touched.set(mapKey, {
+        key: mapKey,
         displayPath: rawPath,
         reasons: new Set([payload.reason]),
         origin: "local",
@@ -59,7 +136,11 @@ export function recordCrossProcessTouches(entries) {
       existing.contentDelivered = false;
     } else {
       _touched.set(mapKey, {
+        key: mapKey,
         displayPath: entry.path,
+        ...entry.sessionId !== undefined && {
+          originSessionId: entry.sessionId
+        },
         reasons: new Set([entry.reason]),
         origin: "cross-process",
         contentDelivered: false
@@ -92,7 +173,23 @@ export function wireAgentNudgeSubscriber(args) {
     dbg?.(`agent-nudge: subscribe failed (older pi host?): ${err}`);
   }
 }
-export function consumeAgentNudge(dbg) {
+export function consumeAgentNudge(dbg, scope) {
+  const touched = consumeTouchedNudge(dbg, scope?.scopeId);
+  pruneRetiredAdvisories();
+  const own = [];
+  const others = [];
+  for (const entry of _advisories) {
+    (scope && entry.scope.scopeId === scope.scopeId ? own : others).push(entry);
+  }
+  _advisories.splice(0, _advisories.length, ...others);
+  const advisories = own.map((entry) => ({
+    role: "user",
+    content: `[dm-lens automated context — not a user request] ${entry.text}`
+  }));
+  const messages = [...touched?.messages ?? [], ...advisories];
+  return messages.length > 0 ? { messages } : undefined;
+}
+function consumeTouchedNudge(dbg, scopeId) {
   const drained = Array.from(_touched.values());
   _touched.clear();
   const filesFiltered = _relevanceFilteredCount;
@@ -101,6 +198,7 @@ export function consumeAgentNudge(dbg) {
     return;
   if (drained.length === 0)
     return;
+  _queueEpoch += 1;
   try {
     const entries = drained.filter((e) => !e.contentDelivered);
     const filesContentDelivered = drained.length - entries.length;
@@ -129,7 +227,13 @@ export function consumeAgentNudge(dbg) {
         filesContentDelivered,
         reasonMix: Array.from(allReasons),
         originLocal: localCount,
-        originCrossProcess: crossProcessCount
+        originCrossProcess: crossProcessCount,
+        fileKeys: entries.slice(0, 8).map((e) => hashText(e.key, 8)),
+        originSessionIds: [
+          ...new Set(entries.flatMap((e) => e.originSessionId === undefined ? [] : [e.originSessionId]))
+        ].slice(0, 4),
+        scopeId,
+        queueEpoch: _queueEpoch
       }
     });
     if (filesTotal === 0)

package/extensions/dm-lens/clients/analysis-root.js

@@ -0,0 +1,103 @@
+import * as fs from "node:fs";
+import * as os from "node:os";
+import * as nodePath from "node:path";
+import { isAtOrAboveHomeDir, isUnderDir, isVendorPath } from "./path-utils.js";
+import { isDmLensInternalPath } from "./file-utils.js";
+import {
+  resolveGitCheckout,
+  resolveLinkedWorktreeOwner
+} from "./review-graph/git-identity.js";
+const PROJECT_MARKERS = [
+  ".git",
+  "package.json",
+  "pyproject.toml",
+  "Cargo.toml",
+  "go.mod",
+  "pom.xml",
+  "build.gradle",
+  "Gemfile",
+  "mix.exs",
+  "composer.json"
+];
+function hasProjectMarker(dir) {
+  return PROJECT_MARKERS.some((marker) => {
+    try {
+      const stat = fs.statSync(nodePath.join(dir, marker));
+      return stat.isFile() || marker === ".git";
+    } catch {
+      return false;
+    }
+  });
+}
+function nearestProjectRoot(filePath) {
+  let dir = nodePath.dirname(nodePath.resolve(filePath));
+  const filesystemRoot = nodePath.parse(dir).root;
+  while (dir !== filesystemRoot) {
+    if (hasProjectMarker(dir))
+      return dir;
+    dir = nodePath.dirname(dir);
+  }
+  return hasProjectMarker(filesystemRoot) ? filesystemRoot : undefined;
+}
+function realPathOrResolved(filePath) {
+  const resolved = nodePath.resolve(filePath);
+  let current = resolved;
+  const missing = [];
+  while (true) {
+    try {
+      const real = fs.realpathSync.native(current);
+      return nodePath.join(real, ...missing.reverse());
+    } catch {
+      const parent = nodePath.dirname(current);
+      if (parent === current)
+        return resolved;
+      missing.push(nodePath.basename(current));
+      current = parent;
+    }
+  }
+}
+export function resolveAnalysisRootPath(filePath, sessionRoot, homeDirOverride) {
+  const resolved = realPathOrResolved(filePath);
+  const session = realPathOrResolved(sessionRoot);
+  const tmp = realPathOrResolved(os.tmpdir());
+  const data = process.env.DM_LENS_HOME ? realPathOrResolved(process.env.DM_LENS_HOME) : undefined;
+  if (isVendorPath(resolved))
+    return;
+  if (resolved === tmp || resolved === session || isUnderDir(session, resolved) || !isUnderDir(resolved, session) && (isDmLensInternalPath(resolved, session) || data !== undefined && (resolved === data || isUnderDir(resolved, data))))
+    return;
+  if (isUnderDir(resolved, session))
+    return session;
+  const checkout = resolveGitCheckout(session);
+  const linked = checkout && resolveLinkedWorktreeOwner(checkout, resolved);
+  if (linked && !isVendorPath(resolved))
+    return linked.root;
+  const candidate = nearestProjectRoot(resolved);
+  if (!candidate || candidate === nodePath.parse(candidate).root)
+    return;
+  const home = realPathOrResolved(homeDirOverride ?? os.homedir());
+  if (isAtOrAboveHomeDir(candidate, home))
+    return;
+  if (candidate === tmp || isUnderDir(session, candidate))
+    return;
+  if (isVendorPath(candidate))
+    return;
+  return candidate;
+}
+export function resolveAnalysisRoot(filePath, sessionRoot, homeDirOverride) {
+  const resolved = realPathOrResolved(filePath);
+  if (isVendorPath(resolved))
+    return "none";
+  const checkout = resolveGitCheckout(sessionRoot);
+  if (checkout && resolveLinkedWorktreeOwner(checkout, resolved)) {
+    return "linked-worktree";
+  }
+  const root = resolveAnalysisRootPath(filePath, sessionRoot, homeDirOverride);
+  if (!root)
+    return "none";
+  if (root === nodePath.resolve(sessionRoot))
+    return "session";
+  return "adopted";
+}
+export function canWriteAnalysisRoot(mode) {
+  return mode === "session" || mode === "linked-worktree";
+}

package/extensions/dm-lens/clients/ast-grep-client.js

@@ -6,11 +6,14 @@ import {
   AstGrepRuleManager,
   checkAstGrepRulesHealth
 } from "./ast-grep-rule-manager.js";
+import { getUserRuleRoot } from "./custom-rule-locations.js";
 import { reportBundledResourceDirHealth } from "./bundled-resource-health.js";
 import { getDegradationLedgerGeneration } from "./degradation-ledger.js";
 import { logLatency } from "./latency-logger.js";
 import { getMutationBridge } from "./mutation-bridge.js";
+import { normalizeFilePath } from "./path-utils.js";
 import { resolvePackagePath } from "./package-root.js";
+import { getAstGrepRuleFingerprint } from "./sgconfig.js";
 import { truncatedByOutputCap } from "./spawn-output-cap.js";
 import {
   SgRunner
@@ -29,7 +32,7 @@ function reportAstGrepRulesHealth(bundledRuleDir) {
   });
   reportBundledResourceDirHealth("ast-grep-rules-dir-missing", bundledRuleDir, health, "ast-grep rule descriptions");
 }
-function recordAstGrepApply(matches) {
+function recordAstGrepApply(matches, lineage, toolCallId) {
   const bridge = getMutationBridge();
   if (!bridge || matches.length === 0)
     return;
@@ -45,10 +48,13 @@ function recordAstGrepApply(matches) {
   }
   for (const [filePath, editRanges] of rangesByFile) {
     bridge.recordMutation({
-      filePath,
+      filePath: normalizeFilePath(path.resolve(process.cwd(), filePath)),
       kind: "edit",
       editRanges,
-      consumer: "ast_grep_replace"
+      consumer: "ast_grep_replace",
+      provenance: "observed",
+      ...lineage && { lineage },
+      ...toolCallId !== undefined && { toolCallId }
     });
   }
 }
@@ -139,6 +145,9 @@ function validateInputShape(value, maxChars, label) {
   }
   return;
 }
+export function extractRuleLanguage(ruleYaml) {
+  return /^[^\S\n\r\u2028\u2029]*language:\s*([^\s#]+)/im.exec(ruleYaml)?.[1];
+}
 function stderrHasError(stderr) {
   return stderr.split(/\r?\n/).some((line) => /^\s*(error|Error):/.test(line));
 }
@@ -173,7 +182,7 @@ export class AstGrepClient {
     this.ruleDir = ruleDir || (hasProjectRuleDir ? projectRuleDir : resolvePackagePath(import.meta.url, "rules"));
     this.log = verbose ? createSubsystemLogger("ast-grep") : () => {};
     this.ensureRulesHealthReported();
-    this.ruleManager = new AstGrepRuleManager(this.ruleDir, this.log);
+    this.ruleManager = new AstGrepRuleManager(ruleDir ? this.ruleDir : [projectRuleDir, getUserRuleRoot(), this.ruleDir], this.log, () => getAstGrepRuleFingerprint(process.cwd()));
     this.runner = new SgRunner(verbose);
   }
   ensureRulesHealthReported() {
@@ -189,7 +198,7 @@ export class AstGrepClient {
     this.ensureRulesHealthReported();
     return this.runner.ensureAvailable();
   }
-  async replaceWithRule(ruleYaml, paths, apply) {
+  async replaceWithRule(ruleYaml, paths, apply, options) {
     const allMatches = [];
     for (const scanPath of paths) {
       if (apply) {
@@ -222,6 +231,8 @@ export class AstGrepClient {
       }
       allMatches.push(...result.matches);
     }
+    if (apply)
+      recordAstGrepApply(allMatches, options?.lineage, options?.toolCallId);
     return {
       matches: allMatches,
       totalMatches: allMatches.length,
@@ -334,7 +345,7 @@ export class AstGrepClient {
     const shapeError = validateInputShape(ruleYaml, MAX_VALIDATE_RULE_CHARS, "rule");
     if (shapeError)
       return { valid: false, error: shapeError };
-    const language = /^\s*language:\s*([^\s#]+)/im.exec(ruleYaml)?.[1] ?? "typescript";
+    const language = extractRuleLanguage(ruleYaml) ?? "typescript";
     const snippet = validationSnippetFor(language);
     const tmpDir = fs.mkdtempSync(path.join(os.tmpdir(), "dm-lens-sg-rule-"));
     try {
@@ -465,7 +476,7 @@ export class AstGrepClient {
         error: applyResult.error
       };
     }
-    recordAstGrepApply(preCheck.matches);
+    recordAstGrepApply(preCheck.matches, options?.lineage, options?.toolCallId);
     return {
       matches: preCheck.matches,
       totalMatches: preCheck.totalMatches,

package/extensions/dm-lens/clients/ast-grep-rule-manager.js

@@ -1,5 +1,6 @@
 import * as fs from "node:fs";
 import * as path from "node:path";
+import { getAstGrepRuleFingerprint } from "./sgconfig.js";
 export function candidateAstGrepRulesPaths(ruleDir) {
   return [
     path.join(ruleDir, "ast-grep-rules", "rules"),
@@ -40,37 +41,59 @@ export function checkAstGrepRulesHealth(ruleDir) {
 export class AstGrepRuleManager {
   ruleDir;
   log;
+  fingerprint;
   ruleDescriptions = null;
-  constructor(ruleDir, log) {
+  ruleFingerprint = null;
+  constructor(ruleDir, log, fingerprint = () => getAstGrepRuleFingerprint()) {
     this.ruleDir = ruleDir;
     this.log = log;
+    this.fingerprint = fingerprint;
   }
   loadRuleDescriptions() {
-    if (this.ruleDescriptions !== null)
+    const fingerprint = this.fingerprint();
+    if (this.ruleDescriptions !== null && this.ruleFingerprint === fingerprint)
       return this.ruleDescriptions;
     const descriptions = new Map;
-    const possiblePaths = candidateAstGrepRulesPaths(this.ruleDir);
-    const rulesPath = possiblePaths.find((p) => fs.existsSync(p));
+    const roots = Array.isArray(this.ruleDir) ? this.ruleDir : [this.ruleDir];
+    const possiblePaths = roots.flatMap(candidateAstGrepRulesPaths);
+    const rulesPaths = [];
+    if (Array.isArray(this.ruleDir)) {
+      for (const candidate of possiblePaths) {
+        if (fs.existsSync(candidate))
+          rulesPaths.push(candidate);
+      }
+    } else {
+      for (const candidate of possiblePaths) {
+        if (!fs.existsSync(candidate))
+          continue;
+        rulesPaths.push(candidate);
+        break;
+      }
+    }
+    const rulesPath = rulesPaths[0];
     if (!rulesPath) {
       this.log(`Rule descriptions: no rules directory found in ${possiblePaths.join(", ")}`);
       this.ruleDescriptions = descriptions;
+      this.ruleFingerprint = fingerprint;
       return descriptions;
     }
     try {
-      const files = fs.readdirSync(rulesPath).filter((f) => f.endsWith(".yml"));
-      this.log(`Loaded ${files.length} rule descriptions from ${rulesPath}`);
-      for (const file of files) {
-        const filePath = path.join(rulesPath, file);
-        const content = fs.readFileSync(filePath, "utf-8");
-        const rule = this.parseRuleYaml(content);
-        if (rule) {
-          descriptions.set(rule.id, rule);
+      for (const resolvedPath of rulesPaths) {
+        const files = fs.readdirSync(resolvedPath).filter((f) => f.endsWith(".yml"));
+        this.log(`Loaded ${files.length} rule descriptions from ${resolvedPath}`);
+        for (const file of files) {
+          const filePath = path.join(resolvedPath, file);
+          const content = fs.readFileSync(filePath, "utf-8");
+          const rule = this.parseRuleYaml(content);
+          if (rule && !descriptions.has(rule.id))
+            descriptions.set(rule.id, rule);
         }
       }
     } catch (err) {
       this.log(`Failed to load rule descriptions: ${err.message}`);
     }
     this.ruleDescriptions = descriptions;
+    this.ruleFingerprint = fingerprint;
     return descriptions;
   }
   parseRuleYaml(content) {

package/extensions/dm-lens/clients/biome-client.js

@@ -3,9 +3,13 @@ import * as fs from "node:fs";
 import * as path from "node:path";
 import { isFileKind } from "./file-kinds.js";
 import { getGlobalDmLensDir } from "./file-utils.js";
-import { findGlobalBinary } from "./package-manager.js";
+import {
+  findGlobalBinary,
+  findLocalBinAt,
+  localBinPath
+} from "./package-manager.js";
 import { safeSpawnAsync } from "./safe-spawn.js";
-import { probeToolAsync } from "./tool-probe.js";
+import { getIsolatedNpxSpawnOptions, probeToolAsync } from "./tool-probe.js";
 import { createSingleFlight } from "./single-flight.js";
 import { biomeConfigArgs } from "./tool-policy.js";
 import { resolveToolCwd } from "./tool-cwd.js";
@@ -41,15 +45,13 @@ export class BiomeClient {
       return { cmd: cached, args: [] };
     const isWin = process.platform === "win32";
     const piLensBin = path.join(getGlobalDmLensDir(), "tools", "node_modules", ".bin");
-    const candidates = isWin ? [
-      path.join(resolveCwd, "node_modules", ".bin", "biome.cmd"),
-      path.join(resolveCwd, "node_modules", ".bin", "biome")
-    ] : [path.join(resolveCwd, "node_modules", ".bin", "biome")];
-    for (const p of candidates) {
-      if (fs.existsSync(p)) {
-        this.localBinaryByCwd.set(resolveCwd, p);
-        return { cmd: p, args: [] };
-      }
+    const localBiome = localBinPath(findLocalBinAt("biome", resolveCwd, {
+      windowsExt: ".cmd",
+      isWindows: isWin
+    }));
+    if (localBiome) {
+      this.localBinaryByCwd.set(resolveCwd, localBiome);
+      return { cmd: localBiome, args: [] };
     }
     if (this.autoInstalledBinaryPath) {
       return { cmd: this.autoInstalledBinaryPath, args: [] };
@@ -70,7 +72,11 @@ export class BiomeClient {
   }
   async spawnBiomeAsync(args, timeout = 15000, cwd) {
     const { cmd, args: prefix } = await this.getBiomeBinary(cwd);
-    return safeSpawnAsync(cmd, [...prefix, ...args], { timeout, cwd });
+    return safeSpawnAsync(cmd, [...prefix, ...args], {
+      timeout,
+      cwd,
+      ...cmd === "npx" || cmd === "bunx" ? getIsolatedNpxSpawnOptions() : {}
+    });
   }
   async ensureAvailable() {
     const memo = this.availabilityLatch.read();

package/extensions/dm-lens/clients/blocker-freshness.js

@@ -81,7 +81,7 @@ export async function extractForwardImportPaths(cwd, filePath) {
   } catch {
     return [];
   }
-  const outcome = await client.withParsedTree(filePath, languageId, content, (tree) => extractor.extract(tree, filePath, content).imports);
+  const outcome = await client.withParsedTree(filePath, languageId, content, (tree) => extractor.extract(tree, filePath, content).imports, "blocker-freshness");
   if (!outcome.parsed)
     return [];
   const resolved = new Set;
@@ -122,12 +122,6 @@ async function detectSelfDrift(args) {
     return { verdict: "unverifiable", unverifiableReason: "missing-baseline" };
   if (stat.size !== args.recordedSize)
     return { verdict: "drift" };
-  const freshness = freshnessFromMtime({
-    mtimeMs: stat.mtimeMs,
-    referenceMs: args.recordedAtMs
-  });
-  if (!args.forceContent && freshness.verdict !== "stale")
-    return { verdict: "unchanged" };
   if (args.recordedHash === undefined)
     return { verdict: "unverifiable", unverifiableReason: "missing-baseline" };
   if (stat.size > args.budget.bytesLeft) {
@@ -288,10 +282,8 @@ export async function sweepInlineBlockerFreshness(runtime, cwd, options) {
         const hashBudgetWasExhausted = hashBudget.exhausted;
         const selfDrift = await bounded(detectSelfDrift({
           filePath: entry.filePath,
-          recordedAtMs: entry.recordedAtMs,
           recordedSize: entry.recordedSize,
           recordedHash: entry.recordedHash,
-          forceContent: isLspSourced && entry.recordedSize !== undefined && entry.recordedHash !== undefined,
           signal: options?.signal,
           budget: hashBudget
         }), {