@duckmind/dm-linux-x64 0.65.4 → 0.65.6

package/extensions/dm-lens/rules/ast-grep-rules/rules/go-no-fmt-println.yml

@@ -26,8 +26,8 @@ constraints:
 ignores:
   - "**/*_test.go"
   - "**/examples/**"
-  - "tests/fixtures/**"
-  - "cases/**"
+  - "**/tests/fixtures/**"
+  - "**/cases/**"
 tags:
   - go
   - idiom

package/extensions/dm-lens/rules/ast-grep-rules/rules/no-assert-tuple.yml

@@ -1,24 +1,34 @@
 id: no-assert-tuple
 language: Python
 message: "Assert should not be called on a tuple literal"
-severity: error
+severity: warning
 note: |
   Port of SonarCloud python:S5905.
 
   `assert (a, b)` is always truthy because the tuple `(a, b)` is a
-  non-empty object. This is almost always a bug — the developer
-  probably meant `assert a, b` (two separate arguments) or
-  `assert (a == b)`.
+  non-empty object. The developer probably meant `assert a, b` (an
+  assertion with a message) or `assert (a == b)`.
 
-  The rule matches `assert` followed by a tuple literal. In Python
-  AST, `assert (1, 2)` parses as `assert_statement` whose test
-  is a `tuple` node (not parenthesized — the parens are just
-  grouping).
+  Bind the assertion's condition separately from its optional message,
+  then require that condition to be a tuple or a parentheses-only chain
+  ending in a tuple. Comparisons, calls, comprehensions, containers, and
+  tuple-valued assertion messages remain valid. The rule remains a
+  warning pending the multi-corpus false-positive audit required for
+  error severity.
 metadata:
   sonar: S5905
 rule:
-  all:
-    - kind: assert_statement
-    - has:
-        kind: tuple
-        stopBy: end
+  pattern: assert $COND
+constraints:
+  COND:
+    any:
+      - kind: tuple
+      - all:
+          - kind: parenthesized_expression
+          - has:
+              kind: tuple
+              stopBy:
+                not:
+                  any:
+                    - kind: parenthesized_expression
+                    - kind: tuple

package/extensions/dm-lens/rules/ast-grep-rules/rules/no-boolean-in-except.yml

@@ -11,8 +11,12 @@ note: |
   developer meant `except (ValueError, KeyError):` (a tuple of
   exception types).
 
-  Matches an `except_clause` whose direct children contain a
-  `boolean_operator` (and/or) node.
+  Matches an `except_clause` whose search for a `boolean_operator`
+  (and/or) descendant stops at the handler's own `block` — the
+  clause's condition, not anything inside the handler's body (a
+  `return x or y` or an `x = a or b` in the body is not a false
+  target; a nested `try`'s own `except` clause is checked on its
+  own merits when the walk reaches it).
 metadata:
   sonar: S5714
 rule:
@@ -20,4 +24,4 @@ rule:
     - kind: except_clause
     - has:
         kind: boolean_operator
-        stopBy: end
+        stopBy: { kind: block }

package/extensions/dm-lens/rules/ast-grep-rules/rules/no-console-except-error-js.yml

@@ -11,8 +11,8 @@ note: |
   just trains users to ignore the rule; `ignores` below carves those paths
   out while application/library code elsewhere still gets flagged (#965).
 ignores:
-  - "scripts/**"
-  - "bin/**"
+  - "**/scripts/**"
+  - "**/bin/**"
   - "**/logger.ts"
   - "**/logger.js"
   - "**/logger.mjs"

package/extensions/dm-lens/rules/ast-grep-rules/rules/no-console-except-error.yml

@@ -11,8 +11,8 @@ note: |
   just trains users to ignore the rule; `ignores` below carves those paths
   out while application/library code elsewhere still gets flagged (#965).
 ignores:
-  - "scripts/**"
-  - "bin/**"
+  - "**/scripts/**"
+  - "**/bin/**"
   - "**/logger.ts"
   - "**/logger.js"
   - "**/logger.mjs"

package/extensions/dm-lens/rules/ast-grep-rules/rules/no-http-headers-bracket-access.yml

@@ -9,14 +9,19 @@ note: |
   missing. Use `request.headers.get("X-Foo")` (returns None) or
   `request.headers["X-Foo"]` after a guard check.
 
-  Matches bracket-style subscript on a `headers` attribute. The
-  call shape `request.headers[...]` and `response.headers[...]`
-  are the most common cases.
+  Matches bracket-style subscript READS on a `headers` attribute
+  (`$REQ.headers[$KEY]` already subsumes the `request.`/`response.`-
+  named forms). A write through the same bracket syntax —
+  `resp.headers["X"] = v`, `resp.headers["X"] += v`, or
+  `del resp.headers["X"]` — sets or removes the header and can never
+  raise KeyError, so those are excluded.
 metadata:
   sonar: S8371
 rule:
-  any:
+  all:
     - pattern: "$REQ.headers[$KEY]"
-    - pattern: "$RES.headers[$KEY]"
-    - pattern: "request.headers[$KEY]"
-    - pattern: "response.headers[$KEY]"
+    - not:
+        any:
+          - inside: { kind: assignment, field: left }
+          - inside: { kind: augmented_assignment, field: left }
+          - inside: { kind: delete_statement }

package/extensions/dm-lens/rules/ast-grep-rules/rules/unchecked-numeric-parse-python.yml

@@ -0,0 +1,44 @@
+id: unchecked-numeric-parse-python
+language: Python
+severity: warning
+message: "int()/float() without try/except — raises ValueError on non-numeric input"
+note: |
+  Split out of `unchecked-throwing-call-python` (#3211): `int()`/`float()`
+  raise `ValueError` on non-numeric strings, but whether a given call CAN
+  raise depends on the argument's runtime type — often undecidable from
+  syntax alone — so this ships at `warning`, separate from the
+  syntactically-certain `error`-level calls (open/json/os/shutil).
+
+  Excluded as already-safe by construction: a numeric literal argument
+  (`int(3.7)`), and an argument that is itself a call to `int()`/
+  `float()`/`Decimal()` (already-converted, or a `Decimal` — which raises
+  `decimal.InvalidOperation`, not `ValueError`, and is out of scope here).
+
+  Residual, undecidable false positive: a call whose argument is a typed
+  parameter already known to be numeric, e.g.
+
+    def f(valor: Decimal):
+        return float(valor)  # valor is a Decimal, not a raw string
+
+  The rule cannot see the parameter's declared type from the call site.
+  Suppress that shape explicitly:
+
+    return float(valor)  # dm-lens-ignore: unchecked-numeric-parse-python
+rule:
+  any:
+    - pattern: int($EXPR)
+    - pattern: float($EXPR)
+  not:
+    any:
+      - inside:
+          stopBy: end
+          kind: try_statement
+      - has:
+          field: arguments
+          has:
+            any:
+              - kind: integer
+              - kind: float
+              - pattern: Decimal($$$)
+              - pattern: int($$$)
+              - pattern: float($$$)

package/extensions/dm-lens/rules/ast-grep-rules/rules/unchecked-throwing-call-python.yml

@@ -9,7 +9,11 @@ note: |
   json.loads(): raises json.JSONDecodeError on malformed JSON
   os.stat():    raises FileNotFoundError, PermissionError
   os.remove():  raises FileNotFoundError, PermissionError
-  int()/float():raises ValueError on non-numeric strings
+
+  `int()`/`float()` are a separate rule, `unchecked-numeric-parse-python`
+  (#3211): whether they can raise depends on the argument's runtime type,
+  which is often undecidable from syntax alone (a typed parameter, a prior
+  guard), so they ship at `warning` instead of `error` here.
 
   ✅ WRAP IN TRY/EXCEPT:
     try:
@@ -40,8 +44,6 @@ rule:
     - pattern: shutil.copy($$$)
     - pattern: shutil.move($$$)
     - pattern: shutil.rmtree($$$)
-    - pattern: int($EXPR)
-    - pattern: float($EXPR)
   not:
     inside:
       stopBy: end

package/extensions/dm-lens/rules/tree-sitter-queries/python/python-cross-language-method.yml

@@ -9,7 +9,7 @@ defect_class: hallucination
 inline_tier: warning
 language: python
 
-message: "'{METHOD}' is not a Python method — likely a {LANG} idiom leaking in"
+message: "'{{METHOD}}' is not a Python method — likely a cross-language idiom leaking in"
 
 description: |
   A method name from another language is being called on a Python object.
@@ -27,7 +27,7 @@ query: |
     function: (attribute
       object: (_) @OBJ
       attribute: (identifier) @METHOD)
-    (#match? @METHOD "^(push|forEach|indexOf|charAt|substring|hasOwnProperty|unshift|flatMap|padStart|padEnd|trimStart|trimEnd|equals|isEmpty|println|printf|getClass|hashCode|toCharArray|getBytes|compareTo|equalsIgnoreCase|startsWith|endsWith|each|collect|select|reject|detect|inject|chomp|chop|gsub|upcase|downcase|present|blank|Add|Contains|ToLower|ToUpper|Trim|Substring|WriteLine|ReadLine|TryParse|forEach|includes|assign|freeze|splice|unshift|shift|flatMap)$"))
+    (#match? @METHOD "^(push|forEach|indexOf|charAt|substring|hasOwnProperty|unshift|flatMap|padStart|padEnd|trimStart|trimEnd|equals|isEmpty|println|printf|getClass|hashCode|toCharArray|getBytes|compareTo|equalsIgnoreCase|startsWith|endsWith|each|collect|reject|detect|inject|chomp|chop|gsub|upcase|downcase|present|blank|Add|Contains|ToLower|ToUpper|Trim|Substring|WriteLine|ReadLine|TryParse|forEach|includes|assign|freeze|splice|unshift|shift|flatMap)$"))
 
 metavars:
   - OBJ
@@ -35,7 +35,7 @@ metavars:
 
 post_filter: match_captures
 post_filter_params:
-  METHOD: "^(push|forEach|indexOf|charAt|substring|hasOwnProperty|unshift|flatMap|padStart|padEnd|trimStart|trimEnd|equals|isEmpty|println|printf|getClass|hashCode|toCharArray|getBytes|compareTo|equalsIgnoreCase|startsWith|endsWith|each|collect|select|reject|detect|inject|chomp|chop|gsub|upcase|downcase|present|blank|Add|Contains|ToLower|ToUpper|Trim|Substring|WriteLine|ReadLine|TryParse|forEach|includes|assign|freeze|splice|unshift|shift|flatMap)$"
+  METHOD: "^(push|forEach|indexOf|charAt|substring|hasOwnProperty|unshift|flatMap|padStart|padEnd|trimStart|trimEnd|equals|isEmpty|println|printf|getClass|hashCode|toCharArray|getBytes|compareTo|equalsIgnoreCase|startsWith|endsWith|each|collect|reject|detect|inject|chomp|chop|gsub|upcase|downcase|present|blank|Add|Contains|ToLower|ToUpper|Trim|Substring|WriteLine|ReadLine|TryParse|forEach|includes|assign|freeze|splice|unshift|shift|flatMap)$"
 
 has_fix: false
 

package/extensions/dm-lens/rules/tree-sitter-queries/python/python-hallucinated-import.yml

@@ -9,7 +9,7 @@ defect_class: hallucination
 inline_tier: blocking
 language: python
 
-message: "Hallucinated import — '{NAME}' does not exist in '{MODULE}'"
+message: "Hallucinated import — '{{NAME}}' does not exist in '{{MODULE}}'"
 
 description: |
   This import is from the wrong package. A name from one framework is being
@@ -32,7 +32,7 @@ metavars:
 
 post_filter: match_captures
 post_filter_params:
-  MODULE: "^(requests|flask|django|typing|collections|asyncio|json|unittest|pytest|urllib|sqlalchemy)$"
+  MODULE: "^(requests|flask|django|typing|collections|asyncio|json|unittest|pytest|urllib)$"
   NAME: "^(JSONResponse|HTMLResponse|RedirectResponse|StreamingResponse|Depends|Query|Path|Body|Header|Cookie|Form|File|UploadFile|FastAPI|APIRouter|HTTPException|BackgroundTasks|dataclass|fields|BaseModel|Field|validator|aiohttp|parse|stringify|fixture|TestCase|get|post|put|delete|Model|Session|Column|Integer|String)$"
 
 has_fix: false

package/extensions/dm-lens/rules/tree-sitter-queries/python/python-sql-injection.yml

@@ -18,8 +18,18 @@ description: |
   
   Suppressed:
   - cursor.execute(query, params) — parameterized query (safe)
-  - session.execute(select(...)) — SQLAlchemy ORM (safe by construction)
-  - cursor.execute(f"...") — f-string with literal-only interpolation (rare false positive)
+  - session.execute(...) — receiver conventionally named for a SQLAlchemy session
+  - x.execute(select(...)) — statement builder in argument position (safe by
+    construction)
+  - db.query(...) / db.execute(stmt) where `db: Session` and `Session` is proven
+    from a same-file `sqlalchemy.orm` / `sqlalchemy.ext.asyncio` import, and
+    `stmt` is bound exactly once to a builder call
+  - cursor.execute(sql.SQL("...").format(sql.Identifier(...))) where `sql` is
+    an unshadowed same-file psycopg or psycopg2 import and every format argument
+    is an Identifier
+
+  Other raw, dynamic, or ambiguous SQL remains diagnostic so this rule fails
+  closed when it cannot prove the safe API provenance.
   
   ✅ FIX: use placeholders and parameter binding instead of string composition.
 

package/extensions/dm-lens/rules/tree-sitter-queries/typescript/console-statement.yml

@@ -29,8 +29,8 @@ post_filter: not_in_test_block  # skip test blocks — no-console-in-tests handl
 # trains users to ignore the rule (#965). Application/library code outside
 # these paths still gets flagged.
 ignore_paths:
-  - "scripts/**"
-  - "bin/**"
+  - "**/scripts/**"
+  - "**/bin/**"
   - "**/logger.ts"
   - "**/logger.js"
   - "**/logger.mjs"

package/extensions/dm-lens/rules/tree-sitter-queries/typescript/sql-injection.yml

@@ -1,5 +1,7 @@
 # SQL Injection Detection
-# Detects unsafe interpolation in SQL-like template literals
+# Detects unsafe interpolation in SQL-like template literals.
+# The structural query keeps the common callee set, while the TypeScript-aware
+# post-filter requires a receiver bound to a known DB client or a SQL-leading template.
 id: sql-injection
 name: SQL Injection Risk
 severity: error
@@ -26,18 +28,32 @@ description: |
 
 query: |
   (call_expression
-    function: [
-      (identifier) @SQL_FUNC
-      (member_expression property: (property_identifier) @SQL_FUNC)
-    ]
+    function: (identifier) @SQL_FUNC
     arguments: (arguments
-      (template_string (template_substitution) @INTERPOLATION))
-    (#match? @SQL_FUNC "^(query|execute|exec|run)$"))
+      (template_string (template_substitution) @INTERPOLATION) @TEMPLATE)
+    (#match? @SQL_FUNC "^(query|execute|exec|run|\\$queryRaw|\\$executeRaw|\\$queryRawUnsafe|\\$executeRawUnsafe|raw|prepare)$"))
+  (call_expression
+    function: (member_expression
+      object: (_) @OBJ
+      property: (property_identifier) @SQL_FUNC)
+    arguments: (arguments
+      (template_string (template_substitution) @INTERPOLATION) @TEMPLATE)
+    (#match? @SQL_FUNC "^(query|execute|exec|run|\\$queryRaw|\\$executeRaw|\\$queryRawUnsafe|\\$executeRawUnsafe|raw|prepare)$"))
+  (call_expression
+    function: (member_expression
+      object: (_) @OBJ
+      property: (property_identifier) @SQL_FUNC)
+    arguments: (template_string (template_substitution) @INTERPOLATION) @TEMPLATE
+    (#match? @SQL_FUNC "^(query|execute|exec|run|\\$queryRaw|\\$executeRaw|\\$queryRawUnsafe|\\$executeRawUnsafe|raw|prepare)$"))
 
 metavars:
   - SQL_FUNC
+  - OBJ
+  - TEMPLATE
   - INTERPOLATION
 
+post_filter: ts_sql_injection_sink
+
 has_fix: false
 
 tags:

package/extensions/dm-lens/rules/typos/_typos.toml

@@ -13,5 +13,7 @@
 # dictionary here; every entry must have a provenance comment.
 
 [default.extend-identifiers]
-dito = "dito"               # #967 — real model/vendor namespace (provider-failover normalization prefix), not a misspelling of "ditto"
-unparseable = "unparseable" # #967 — valid English spelling ("un-parseable"), not a typo of "unparsable"
+# #967 — real model/vendor namespace (provider-failover normalization prefix), not a misspelling of "ditto"
+dito = "dito"
+# #967 — valid English spelling ("un-parseable"), not a typo of "unparsable"
+unparseable = "unparseable"

package/extensions/dm-lens/scripts/lib/process-scan.mjs

@@ -4,7 +4,7 @@ import path from "node:path";
 function runningOnWindows() {
   return process.platform === "win32";
 }
-export const DEFAULT_SNAPSHOT_TIMEOUT_MS = 4000;
+const DEFAULT_SNAPSHOT_TIMEOUT_MS = 4000;
 const FIELD_COLUMNS = Object.freeze({
   pid: { wmi: "ProcessId", ps: "pid", token: "int" },
   ppid: { wmi: "ParentProcessId", ps: "ppid", token: "int" },

package/extensions/dm-lens/scripts/lib/skills-predicate.mjs

@@ -0,0 +1,53 @@
+import * as fs from "node:fs";
+import * as path from "node:path";
+function resolvedEntryKind(fullPath, entry) {
+  if (entry.isSymbolicLink()) {
+    try {
+      const stats = fs.statSync(fullPath);
+      if (stats.isDirectory())
+        return "dir";
+      if (stats.isFile())
+        return "file";
+      return "other";
+    } catch {
+      return "other";
+    }
+  }
+  if (entry.isDirectory())
+    return "dir";
+  if (entry.isFile())
+    return "file";
+  return "other";
+}
+export function scanEntriesForSkills(dir, entries, isRoot) {
+  for (const entry of entries) {
+    if (entry.name === "SKILL.md" && resolvedEntryKind(path.join(dir, entry.name), entry) === "file") {
+      return [path.join(dir, entry.name)];
+    }
+  }
+  const found = [];
+  for (const entry of entries) {
+    if (entry.name.startsWith(".") || entry.name === "node_modules") {
+      continue;
+    }
+    const fullPath = path.join(dir, entry.name);
+    const kind = resolvedEntryKind(fullPath, entry);
+    if (kind === "dir") {
+      found.push(...collectSkillEntryPaths(fullPath, false));
+      continue;
+    }
+    if (isRoot && kind === "file" && entry.name.endsWith(".md")) {
+      found.push(fullPath);
+    }
+  }
+  return found;
+}
+export function collectSkillEntryPaths(dir, isRoot = true) {
+  let entries;
+  try {
+    entries = fs.readdirSync(dir, { withFileTypes: true });
+  } catch {
+    return [];
+  }
+  return scanEntriesForSkills(dir, entries, isRoot);
+}

package/extensions/dm-lens/scripts/lib/web-tree-sitter-dir.mjs

@@ -0,0 +1,45 @@
+import * as fs from "node:fs";
+import * as path from "node:path";
+const WEB_TREE_SITTER = "web-tree-sitter";
+const RUNTIME_WASM = "tree-sitter.wasm";
+export function isWebTreeSitterPackageDir(dir) {
+  try {
+    if (!fs.existsSync(path.join(dir, RUNTIME_WASM)))
+      return false;
+    const manifest = JSON.parse(fs.readFileSync(path.join(dir, "package.json"), "utf8"));
+    return manifest?.name === WEB_TREE_SITTER;
+  } catch {
+    return false;
+  }
+}
+function packageDirOf(resolvedFile) {
+  let dir = path.dirname(resolvedFile);
+  for (;; ) {
+    if (isWebTreeSitterPackageDir(dir))
+      return dir;
+    const parent = path.dirname(dir);
+    if (parent === dir)
+      return;
+    dir = parent;
+  }
+}
+export function resolveWebTreeSitterPackageDir(deps) {
+  for (const specifier of [
+    `${WEB_TREE_SITTER}/${RUNTIME_WASM}`,
+    WEB_TREE_SITTER
+  ]) {
+    try {
+      const dir = packageDirOf(deps.resolve(specifier));
+      if (dir)
+        return dir;
+    } catch {}
+  }
+  for (const base of [deps.packageRoot, deps.cwd]) {
+    try {
+      const candidate = path.join(base(), "node_modules", WEB_TREE_SITTER);
+      if (isWebTreeSitterPackageDir(candidate))
+        return candidate;
+    } catch {}
+  }
+  return;
+}

package/extensions/dm-lens/skills/pi-lens-ast-grep/SKILL.md

@@ -7,7 +7,22 @@ description: Use when searching or replacing code patterns - use ast-grep instea
 
 Use `ast_grep_search` and `ast_grep_replace` for semantic code search/replace. ast-grep understands code structure, not just text.
 
-These tools (plus `ast_grep_outline`, `ast_grep_dump`, `lsp_navigation`) are registered but inactive by default on hosts that support pi's dynamic tooling. If a call to one of them isn't recognized, activate it first: `dm_lens_activate_tools tools=["ast_grep_search", "ast_grep_replace"]`.
+These tools (plus `ast_grep_outline`, `lsp_navigation`) are registered but inactive by default on hosts that support pi's dynamic tooling. If a call to one of them isn't recognized, activate it first: `dm_lens_activate_tools tools=["ast_grep_search", "ast_grep_replace"]`.
+
+On hosts that aggregate dm-lens behind a single `lens` tool, the `ast_grep_*` tools and `dm_lens_activate_tools` may not be registered at all. There, fall back to the `ast-grep` CLI (alias `sg`) — patterns, metavariables, and YAML rules are identical:
+
+```bash
+# search (≈ ast_grep_search)
+ast-grep run -p 'fetchMetrics($$$ARGS)' -l ts src/
+
+# rewrite (≈ ast_grep_replace; -U applies all)
+ast-grep run -p 'var $X' -r 'let $X' -l js src/ -U
+
+# full YAML rule (≈ the rule: parameter)
+ast-grep scan --rule my-rule.yml src/
+```
+
+Structural-intent parameters map to YAML constraints: `insideKind` → `inside: { kind: ..., stopBy: end }`, `hasKind`/`hasDescendantKind` → `has: { kind: ... }`, `follows` → `follows: { pattern: ... }`, `precedes` → `precedes: { pattern: ... }`.
 
 ## When to Use
 
@@ -88,15 +103,15 @@ rule:
     stopBy: end" lang="typescript"
 ```
 
-### Debugging unknown node kinds — `ast_grep_dump`
+### Debugging unknown node kinds — `ast_grep_search` dump mode
 
-When a pattern returns zero matches and you don't know the correct node kind or field name, use `ast_grep_dump` to inspect a SMALL representative snippet:
+When a pattern returns zero matches and you don't know the correct node kind or field name, use `ast_grep_search` with `dump=true` to inspect a SMALL representative snippet:
 
 ```
-ast_grep_dump source="function foo() { return 1; }" lang="typescript"
+ast_grep_search dump=true pattern="function foo() { return 1; }" lang="typescript"
 ```
 
-Returns the full indented AST with node kinds and positions. Then use the correct kind in your pattern or `insideKind`. `ast_grep_dump` is registered but inactive by default — call `dm_lens_activate_tools` with `tools: ["ast_grep_dump"]` first if it isn't already active.
+Returns the full indented AST with node kinds and positions. Then use the correct kind in your pattern or `insideKind`.
 
 ### Composite (has/inside) in raw YAML
 
@@ -146,8 +161,10 @@ kind: arrow_function
 
 **No matches?**
 
+For `nodeKind`, do not also pass `pattern` or `rule`; those forms are mutually exclusive. For `rule`, provide YAML containing both `id` and `language` fields. Use `strictness: relaxed` when unnamed punctuation is the only mismatch.
+
 1. Try `strictness: relaxed` — ignores unnamed punctuation (trailing commas, semicolons) that `smart` mode requires
-2. Use `ast_grep_dump` on a sample snippet to verify the correct node kind
+2. Use `ast_grep_search dump=true` on a sample snippet to verify the correct node kind
 3. Simplify the pattern and retry once
 4. Fall back to `grep` or `lsp_navigation`
 

package/extensions/dm-lens/skills/pi-lens-lsp-navigation/SKILL.md

@@ -5,22 +5,35 @@ description: Navigate code with IDE features and run proactive LSP diagnostics o
 
 # LSP Navigation and Diagnostics
 
-Use `lsp_navigation` as **PRIMARY** for code intelligence. Use `lsp_diagnostics` as **PRIMARY** for proactive type/error checks. Do NOT use grep/glob/ast-grep first for code intelligence.
+Use `lsp_navigation` as **PRIMARY** for code intelligence. Use `lens_diagnostics` with `source=lsp` as **PRIMARY** for proactive type/error checks. Do NOT use grep/glob/ast-grep first for code intelligence.
+
+## Aggregate-tool hosts
+
+Some hosts expose dm-lens through a single aggregate tool — `lens(action=...)` — instead of registering the standalone names below. On those hosts:
+
+- Proactive checks: `lens({ action: "lsp_diagnostics", ... })` — same parameters as the table below; the cached-report entry point maps to `lens({ action: "diagnostics", ... })`.
+- If `lsp_navigation` is not among the aggregate's actions, do not call the standalone name: use the host's structural search funnel (`symbol_search` → `module_report` → `read_symbol`) or the `ast-grep` CLI for navigation instead.
 
 ## Diagnostics
 
-Use `lsp_diagnostics` before builds/tests or after touching several files:
+Use `lens_diagnostics` with `source=lsp` before builds/tests or after touching several files:
 
 | Need | Tool call |
 |---|---|
-| Check one file | `lsp_diagnostics({ path: "src/file.ts" })` |
-| Check a folder | `lsp_diagnostics({ path: "src/", severity: "error" })` |
-| Check exact touched files | `lsp_diagnostics({ paths: ["src/a.ts", "src/b.ts"], concurrency: 8 })` |
-| Slow server (Rust, Java) | `lsp_diagnostics({ paths: files, waitMs: 2000 })` |
-| Include warnings | `lsp_diagnostics({ paths: files, severity: "all" })` |
+| Check one file | `lens_diagnostics({ source: "lsp", scope: "paths", paths: ["src/file.ts"] })` |
+| Check a folder | `lens_diagnostics({ source: "lsp", scope: "workspace", path: "src/", severity: "error" })` |
+| Check exact touched files | `lens_diagnostics({ source: "lsp", scope: "paths", paths: ["src/a.ts", "src/b.ts"] })` |
+| Slow server (Rust, Java) | `lens_diagnostics({ source: "lsp", scope: "paths", paths: files, waitMs: 2000 })` |
+| Include warnings | `lens_diagnostics({ source: "lsp", scope: "paths", paths: files, severity: "all" })` |
 
 Prefer explicit `paths` batches after multi-file edits — bounded concurrency, no unrelated directory noise.
 
+### Parameter reference
+
+`lens_diagnostics` accepts `source: "session" | "lsp"` and `scope: "paths" | "workspace"`. Use `mode: "delta"` for the current turn, `"all"` for the cache-only session view, or `"full"` for an active scan. `path` selects one file or directory; `paths` filters a batch. `severity` is `"error"`, `"warning"`, or `"all"`; `serverScope` is `"primary"` or `"all"`.
+
+For `mode: "full"`, `refreshRunners: "cached" | "cheap" | "all" | "none"` (or `false`/`true`) controls project analyzers. The first three string modes can launch a fresh heavyweight analyzer pass, bounded by the slowest runner's roughly 180-second ceiling; `none` disables it. `maxProjectFiles` limits cheap project runners, `maxLspFiles` limits the LSP sweep, and `includeGenerated: true` includes generated-name paths. These three limits apply to full scans. `concurrency` and `waitMs` tune LSP batches.
+
 ## Navigation (Code Intelligence)
 
 | Question | Operation | Parameters |
@@ -41,6 +54,10 @@ Prefer explicit `paths` batches after multi-file edits — bounded concurrency,
 | What commands does the server offer? | `capabilities` | (optional path) — lists advertised commands |
 | Run a server command (e.g. organize imports) | `executeCommand` | command (+ commandArguments); dry-run unless `apply:true` |
 
+The `operation` values are `definition`, `typeDefinition`, `declaration`, `references`, `hover`, `signatureHelp`, `documentSymbol`, `findSymbol`, `workspaceSymbol`, `codeAction`, `rename`, `rename_file`, `implementation`, `prepareCallHierarchy`, `incomingCalls`, `outgoingCalls`, `executeCommand`, `workspaceDiagnostics`, and `capabilities`.
+
+For `findSymbol`, pass `query`; optionally narrow with `kinds`, `exactMatch`, `topLevelOnly`, and `maxResults`. `rename_file` uses `newFilePath`. `symbol` resolves a character automatically; `character: -1` requests automatic resolution, and `symbol#N` selects a numbered symbol when the result lists one. `callHierarchyItem` is the object returned by `prepareCallHierarchy` and is required by the incoming/outgoing follow-up calls.
+
 ## Call Hierarchy Pattern
 
 ```
@@ -59,7 +76,7 @@ lsp_navigation(operation="outgoingCalls", callHierarchyItem=<item from step 1>)
 - **`workspaceSymbol` empty?** Always pass `path`. Unscoped queries are best-effort and frequently return nothing. If TypeScript returns "No Project", open the scoped file first.
 - **`references`** — query from the *definition site* for full cross-file coverage; usage-site queries can be partial.
 - **`signatureHelp`** — only valid at call-site argument positions; declaration positions return empty.
-- **`workspaceDiagnostics`** — tracked push snapshot only, not an active check. Use `lsp_diagnostics` when you need fresh results.
+- **`workspaceDiagnostics`** — tracked push snapshot only, not an active check. Use `lens_diagnostics` with `source=lsp` when you need fresh results.
 - **`codeAction`** — distinguish `quickfix` from generic refactors ("Move to new file"). Generic refactors are not error fixes.
 - **`prepareCallHierarchy`** — server-capability dependent; if unsupported, skip incoming/outgoing calls.
 
@@ -74,4 +91,4 @@ lsp_navigation(operation="outgoingCalls", callHierarchyItem=<item from step 1>)
 
 ## Golden Rule
 
-**Code intelligence → `lsp_navigation` first. Type/error validation → `lsp_diagnostics` first. Text/pattern search → grep/ast-grep.**
+**Code intelligence → `lsp_navigation` first. Type/error validation → `lens_diagnostics source=lsp` first. Text/pattern search → grep/ast-grep.**

package/extensions/dm-lens/tools/activate-tools.js

@@ -2,22 +2,25 @@ import { Type } from "../clients/deps/typebox.js";
 export function createActivateToolsTool(pi, lazyTools, options = {}) {
   const lazyNames = lazyTools.map((t) => t.name);
   const lazyNameSet = new Set(lazyNames);
-  const catalog = lazyTools.map((t) => `${t.name} — ${t.summary}`).join(`
-`);
   return {
     name: "dm_lens_activate_tools",
     label: "Activate dm-lens Tools",
-    description: "Activate one or more situational dm-lens tools that stay registered but inactive by default, so the default tool list stays lean. " + "Call this ONCE with the tools you need before using them — they become callable starting the NEXT turn. " + `Available:
-${catalog}`,
-    promptSnippet: "Activate situational ast-grep / lsp_navigation tools before using them",
+    description: 'Activate registered situational tools for the next turn. Example: `{tools: ["lsp_navigation"]}`.',
+    promptSnippet: "Activate a situational tool",
     parameters: Type.Object({
       tools: Type.Array(Type.String({ enum: lazyNames }), {
         minItems: 1,
-        description: "Names of situational tools to activate (see this tool's description for the catalog)."
+        description: "Names of situational tools to activate, e.g. `lsp_navigation`."
       })
     }),
     async execute(_toolCallId, params, _signal, _onUpdate, ctx) {
       const requested = Array.isArray(params.tools) ? params.tools.filter((t) => typeof t === "string" && lazyNameSet.has(t)) : [];
+      if (Array.isArray(params.tools)) {
+        for (const name of params.tools) {
+          if (typeof name === "string" && !lazyNameSet.has(name))
+            options.onRejected?.(name);
+        }
+      }
       if (requested.length === 0) {
         return {
           content: [
@@ -30,7 +33,7 @@ ${catalog}`,
           details: { matches: [], added: [] }
         };
       }
-      options.onActivated?.(requested);
+      options.onActivated?.(requested, ctx);
       const active = typeof pi.getActiveTools === "function" ? pi.getActiveTools() : [];
       const activeSet = new Set(active);
       const added = requested.filter((name) => !activeSet.has(name));

package/extensions/dm-lens/tools/ast-grep-outline.js

@@ -25,12 +25,8 @@ export function createAstGrepOutlineTool(astGrepClient) {
   return {
     name: "ast_grep_outline",
     label: "AST-Grep Outline",
-    description: "Syntax-only code structure (symbols, imports, exports, and members) via " + "`ast-grep outline`. Fast, local, no index/LSP/cross-file semantics — useful " + "for languages or structures where dm-lens's own extractor is weak, or for a " + `raw second opinion.
-
-` + "Prefer module_report for dm-lens-aware navigation (who-uses-this, " + "complexity/fanout, recommendedReads, blast radius, callback handles). Use " + "ast_grep_outline when you want the syntax tree's own view of a file or a " + `whole directory.
-
-` + "Returns JSON: per file, `items[]` with name/symbolType/signature/range, " + "`isExported`/`isImport`, nested `members[]` (with `isPublic`), and ready " + "`read` args on every entry. NOTE: structure only — an outline is NOT a read " + "of a symbol's body (use read_symbol/read_enclosing for that).",
-    promptSnippet: "Syntax-only code outline via ast-grep (no index/LSP); module_report is the richer default",
+    description: "Return syntax-only symbols, imports, exports, and members with ast-grep. An outline shows structure, not a symbol body, and does not satisfy read-before-edit; use read_symbol or read_enclosing for body coverage. Example: outline `src/` before choosing a symbol to read.",
+    promptSnippet: "Inspect syntax without index or LSP",
     renderResult: compactRenderResult(({ details, isError, text }) => {
       if (isError) {
         return `ast_grep_outline — ${text.split(`