@duckmind/dm-linux-x64 0.65.4 → 0.65.6

package/extensions/dm-lens/clients/cache-manager.js

@@ -3,7 +3,7 @@ import * as fs from "node:fs";
 import * as path from "node:path";
 import { getProjectDataDir } from "./file-utils.js";
 import { writeFileAtomic } from "./atomic-write.js";
-import { readJsonCache } from "./json-cache-read.js";
+import { readJsonCache, readJsonCacheAsync } from "./json-cache-read.js";
 import { isUnderDir, normalizeMapKey } from "./path-utils.js";
 const DEFAULT_MAX_AGE_MS = 30 * 60 * 1000;
 const DEFAULT_TURN_STATE = {
@@ -51,6 +51,32 @@ export class CacheManager {
     const key = this.toTurnStateKey(filePath, cwd);
     return state.files[key];
   }
+  freshAgeMs(scanner, meta, maxAgeMs) {
+    const age = Date.now() - new Date(meta.timestamp).getTime();
+    if (age > maxAgeMs) {
+      this.log(`Cache stale: ${scanner} (age: ${Math.round(age / 1000)}s, max: ${maxAgeMs / 1000}s)`);
+      return null;
+    }
+    return age;
+  }
+  async readCacheAsync(scanner, cwd, maxAgeMs = DEFAULT_MAX_AGE_MS) {
+    const cachePath = path.join(getCacheDir(cwd), `${scanner}.json`);
+    const metaPath = path.join(getCacheDir(cwd), `${scanner}.meta.json`);
+    const onReadError = (err) => {
+      this.log(`Cache miss: ${scanner} — ${err}`);
+    };
+    const meta = await readJsonCacheAsync(metaPath, (parsed) => parsed, onReadError);
+    if (meta === undefined)
+      return null;
+    const age = this.freshAgeMs(scanner, meta, maxAgeMs);
+    if (age === null)
+      return null;
+    const data = await readJsonCacheAsync(cachePath, (parsed) => parsed, onReadError);
+    if (data === undefined)
+      return null;
+    this.log(`Cache hit: ${scanner} (age: ${Math.round(age / 1000)}s)`);
+    return { data, meta };
+  }
   readCache(scanner, cwd, maxAgeMs = DEFAULT_MAX_AGE_MS) {
     const cachePath = path.join(getCacheDir(cwd), `${scanner}.json`);
     const metaPath = path.join(getCacheDir(cwd), `${scanner}.meta.json`);
@@ -65,11 +91,9 @@ export class CacheManager {
       const meta = readJsonCache(metaPath, (parsed) => parsed, onReadError);
       if (meta === undefined)
         return null;
-      const age = Date.now() - new Date(meta.timestamp).getTime();
-      if (age > maxAgeMs) {
-        this.log(`Cache stale: ${scanner} (age: ${Math.round(age / 1000)}s, max: ${maxAgeMs / 1000}s)`);
+      const age = this.freshAgeMs(scanner, meta, maxAgeMs);
+      if (age === null)
         return null;
-      }
       const data = readJsonCache(cachePath, (parsed) => parsed, onReadError);
       if (data === undefined)
         return null;

package/extensions/dm-lens/clients/cache-observability.js

@@ -14,7 +14,7 @@ let contextObservationCounter = 0;
 const CHARS_PER_ESTIMATED_TOKEN = 4;
 export const DEFAULT_PROVIDER_CACHE_TTL_MS = 60000;
 const _providerCacheTtl = lazyEnvNumber("DM_LENS_PROVIDER_CACHE_TTL_MS", DEFAULT_PROVIDER_CACHE_TTL_MS);
-export const getProviderCacheTtlMs = _providerCacheTtl.get;
+const getProviderCacheTtlMs = _providerCacheTtl.get;
 export const _resetProviderCacheTtlForTests = _providerCacheTtl._resetForTests;
 const LOW_CACHE_READ_RATIO = 0.5;
 const PARTIAL_EVICTION_INPUT_FACTOR = 4;
@@ -64,9 +64,47 @@ function newAttributionState() {
     injectedCharsSinceLastUsage: 0,
     newTranscriptCharsSinceLastUsage: 0,
     attributionCharsCapped: false,
+    injectedBytes: emptyInjectedBytes(),
+    injectedFindingsRepeated: 0,
+    findingIdentities: new Set,
+    findingIdentityCapRecorded: false,
+    turnEndAdvisoryBytes: 0,
+    toolResultBytes: 0,
+    toolResultsTruncated: 0,
     summary: newCacheUsageSummary()
   };
 }
+const MAX_FINDING_IDENTITIES = 2000;
+function emptyInjectedBytes() {
+  return {
+    sessionGuidance: 0,
+    turnFindings: 0,
+    testFindings: 0,
+    agentNudge: 0,
+    turnEndAdvisory: 0,
+    other: 0
+  };
+}
+function sourceKey(source) {
+  return {
+    "session-guidance": "sessionGuidance",
+    "turn-findings": "turnFindings",
+    "test-findings": "testFindings",
+    "agent-nudge": "agentNudge"
+  }[source];
+}
+function findingIdentities(text) {
+  const out = [];
+  for (const line of text.split(/\r?\n/)) {
+    const location = line.match(/(?:^|\s)([^\s:]+):(\d+)(?::\d+)?/);
+    if (!location)
+      continue;
+    const rule = line.match(/(?:rule|code)\s*[:=]\s*([\w./-]+)/i)?.[1] ?? line.match(/\(([\w./-]+)\)\s*$/)?.[1] ?? line.match(/:\d+(?::\d+)?\s+([\w./-]+)/)?.[1];
+    if (rule)
+      out.push(`${location[1]}:${location[2]}:${rule}`);
+  }
+  return out;
+}
 function attributionFor(key) {
   const existing = attributionBySession.get(key);
   const state = existing ?? newAttributionState();
@@ -433,9 +471,36 @@ export function observeCacheContext(args) {
         countsCapped: sliceSize.capped
       };
     });
+    const state = attributionFor(attributionKey(args.sessionId, args.sessionRole));
+    for (const slice of injectionSlices) {
+      const key = sourceKey(slice.source);
+      const bytes = measureInjectedMessages(slice.messages).bytes;
+      state.injectedBytes[key] += bytes;
+      for (const message of slice.messages) {
+        for (const identity of findingIdentities(typeof message.content === "string" ? message.content : "")) {
+          if (state.findingIdentities.has(identity)) {
+            state.injectedFindingsRepeated += 1;
+            continue;
+          }
+          if (state.findingIdentities.size >= MAX_FINDING_IDENTITIES) {
+            if (!state.findingIdentityCapRecorded) {
+              state.findingIdentityCapRecorded = true;
+              logLatency({
+                type: "phase",
+                filePath: "<dm-lens>",
+                phase: "injected_finding_identity_cap",
+                durationMs: 0,
+                metadata: { cap: MAX_FINDING_IDENTITIES }
+              });
+            }
+            continue;
+          }
+          state.findingIdentities.add(identity);
+        }
+      }
+    }
     const messageCountCapped = existingMessages.length > MAX_REPORTED_MESSAGES || resultMessages.length > MAX_REPORTED_MESSAGES;
     recordContextAttribution(attributionKey(args.sessionId, args.sessionRole), existingMessages, sizes);
-    const state = attributionFor(attributionKey(args.sessionId, args.sessionRole));
     state.sequenceHashTruncatedSinceLastUsage ||= beforeSequence.truncated || beforeSequence.contentTruncated || afterSequence.truncated || afterSequence.contentTruncated;
     state.requestEvidenceIncompleteSinceLastUsage ||= beforeSequence.incomplete || afterSequence.incomplete;
     logLatency({
@@ -458,6 +523,10 @@ export function observeCacheContext(args) {
         injectedMessageCountCapped: injectedMessages.length > MAX_REPORTED_MESSAGES,
         injectedChars: sizes.chars,
         injectedBytes: sizes.bytes,
+        injectedBytesBySource: Object.fromEntries(sourceBreakdown.map((entry) => [
+          sourceKey(entry.source),
+          entry.bytes
+        ])),
         injectedEstimatedTokens: estimateTokens(sizes.chars),
         injectedTokenBasis: "chars-per-token-4-estimate-not-provider-measured",
         injectedCountsCapped: sizes.capped,
@@ -565,6 +634,13 @@ export function logCacheUsage(message, dbg, context) {
     const injectedCharsSinceLastTurn = state.injectedCharsSinceLastUsage;
     const newTranscriptCharsSinceLastTurn = state.newTranscriptCharsSinceLastUsage;
     const attributionCharsCapped = state.attributionCharsCapped;
+    const injectedBytes = {
+      ...state.injectedBytes,
+      turnEndAdvisory: state.turnEndAdvisoryBytes + state.injectedBytes.turnEndAdvisory
+    };
+    const injectedFindingsRepeated = state.injectedFindingsRepeated;
+    const toolResultBytes = state.toolResultBytes;
+    const toolResultsTruncated = state.toolResultsTruncated;
     state.lastUsageAtMs = nowMs;
     state.lastCacheRead = cacheRead;
     state.lastProviderIdentityHash = currentProvider.hash;
@@ -576,6 +652,11 @@ export function logCacheUsage(message, dbg, context) {
     state.injectedCharsSinceLastUsage = 0;
     state.newTranscriptCharsSinceLastUsage = 0;
     state.attributionCharsCapped = false;
+    state.injectedBytes = emptyInjectedBytes();
+    state.injectedFindingsRepeated = 0;
+    state.turnEndAdvisoryBytes = 0;
+    state.toolResultBytes = 0;
+    state.toolResultsTruncated = 0;
     state.lastContextAtMs = undefined;
     logLatency({
       type: "phase",
@@ -608,6 +689,10 @@ export function logCacheUsage(message, dbg, context) {
         injectedCharsSinceLastTurn,
         newTranscriptCharsSinceLastTurn,
         attributionCharsCapped,
+        injectedBytes,
+        injectedFindingsRepeated,
+        toolResultBytes,
+        toolResultsTruncated,
         ...context ? {
           sessionId: sessionKey(context.sessionId),
           ...context.sessionRole === "concurrent-secondary" ? { turnScope: SECONDARY_TURN_SCOPE } : {
@@ -698,6 +783,17 @@ export function clearCachePrefixSession(sessionId, sessionRole) {
   prefixHashBySession.delete(key);
   attributionBySession.delete(key);
 }
+export function recordTurnEndAdvisoryBytes(sessionId, bytes, sessionRole = "primary") {
+  const state = attributionFor(attributionKey(sessionId, sessionRole));
+  state.turnEndAdvisoryBytes = Math.min(MAX_INJECTED_BYTES, state.turnEndAdvisoryBytes + Math.max(0, bytes));
+}
+export function recordToolResultDelivery(args) {
+  const state = attributionFor(attributionKey(args.sessionId, args.sessionRole));
+  const bytes = Number.isFinite(args.bytes) ? Math.max(0, Math.floor(args.bytes)) : 0;
+  state.toolResultBytes = Math.min(MAX_ATTRIBUTION_BYTES, state.toolResultBytes + bytes);
+  if (args.truncated === true)
+    state.toolResultsTruncated += 1;
+}
 export function emitCacheUsageSummaryAtSessionEnd(sessionId, sessionRole) {
   const key = attributionKey(sessionId, sessionRole);
   const state = attributionBySession.get(key);
@@ -727,8 +823,12 @@ export function resetCachePrefixObservation() {
   prefixHashBySession.clear();
   attributionBySession.clear();
 }
-export function _attributionKeyForTests(sessionId, sessionRole) {
-  return attributionKey(sessionId, sessionRole);
+export function resetCacheFindingIdentitiesSession(sessionId, sessionRole) {
+  const state = attributionBySession.get(attributionKey(sessionId, sessionRole));
+  if (!state)
+    return;
+  state.findingIdentities.clear();
+  state.findingIdentityCapRecorded = false;
 }
 export function _attributionBySessionHasForTests(key) {
   return attributionBySession.has(key);

package/extensions/dm-lens/clients/cargo-manifest.js

@@ -53,7 +53,7 @@ export function parseTomlStringArray(content, key) {
     return [];
   return [...match[1].matchAll(/"([^"]*)"|'([^']*)'/g)].map((m) => (m[1] ?? m[2] ?? "").trim());
 }
-export function parseTomlScalarString(content, key) {
+function parseTomlScalarString(content, key) {
   if (content === undefined)
     return;
   const match = content.match(new RegExp(`^[ \\t]*${key}[ \\t]*=[ \\t]*(?:"([^"]*)"|'([^']*)')`, "m"));
@@ -62,7 +62,10 @@ export function parseTomlScalarString(content, key) {
   return match[1] ?? match[2];
 }
 export function hasCargoWorkspaceTable(content) {
-  return extractTomlTableSection(content, "workspace") !== undefined;
+  return hasTomlTable(content, "workspace");
+}
+export function hasTomlTable(content, tableName) {
+  return extractTomlTableSection(content, tableName) !== undefined;
 }
 export function readCargoPackageName(content) {
   const packageSection = extractTomlTableSection(content, "package");
@@ -87,7 +90,7 @@ export function readCargoDependencyNames(content) {
   }
   return names;
 }
-export function isTomlKeyWorkspaceInherited(content, key) {
+function isTomlKeyWorkspaceInherited(content, key) {
   if (content === undefined)
     return false;
   const dotted = new RegExp(`^[ \\t]*${key}\\.workspace[ \\t]*=[ \\t]*true`, "m");

package/extensions/dm-lens/clients/cascade-format.js

@@ -1,3 +1,13 @@
+import * as fs from "node:fs";
+import { retagAuxiliaryDiagnostics } from "./dispatch/auxiliary-lsp.js";
+import {
+  applyFindingPolicy,
+  loadProjectRulePolicyMap,
+  renderedRuleIdentities
+} from "./dispatch/finding-policy.js";
+import { detectFileRole } from "./file-role.js";
+import { logLatency } from "./latency-logger.js";
+import { formatCacheAgeLabel } from "./finding-delivery-gate.js";
 import { convertLspDiagnostics } from "./dispatch/utils/lsp-diagnostics.js";
 import { toRunnerDisplayPath } from "./dispatch/runner-context.js";
 export function formatCascadeNeighborDiagnostics(cwd, neighbors, options = {}) {
@@ -50,17 +60,32 @@ export function formatCascadeNeighborDiagnostics(cwd, neighbors, options = {}) {
 }
 export function buildResolvedFoundCascadeRun(cwd, neighbor) {
   const { filePath } = neighbor;
-  const diagnostics = convertLspDiagnostics(neighbor.diagnostics.filter((d) => d.severity === 1), filePath, { tool: "lsp" });
-  if (diagnostics.length === 0)
+  const errors = neighbor.diagnostics.filter((d) => d.severity === 1);
+  if (errors.length === 0)
     return;
+  const policyStart = Date.now();
+  const { diagnostics, suppressed, auxSuppressed, total } = applyCascadeDisplayPolicy(errors, {
+    cwd,
+    policyRoot: cwd,
+    filePath
+  });
+  recordCascadeFindingPolicy({
+    filePath,
+    durationMs: Date.now() - policyStart,
+    suppressed,
+    total,
+    auxSuppressed
+  });
   const neighbors = [
     { filePath, reason: "references", diagnostics, lspTouched: true }
   ];
-  const formatted = formatCascadeNeighborDiagnostics(cwd, neighbors, {
+  const rendered = formatCascadeNeighborDiagnostics(cwd, neighbors, {
     noun: "cold neighbor"
   });
-  if (!formatted)
+  if (!rendered)
     return;
+  const formatted = suppressed > 0 ? `${rendered}
+suppressed by disposition: ${suppressed} finding(s) (marked false-positive or won't-fix).` : rendered;
   return {
     filePath,
     result: {
@@ -77,6 +102,63 @@ export function buildResolvedFoundCascadeRun(cwd, neighbor) {
       formatted
     },
     neighborCount: 1,
-    diagnosticCount: diagnostics.length
+    diagnosticCount: diagnostics.length,
+    ...neighbor.publishedAt !== undefined ? { observedAt: neighbor.publishedAt } : {}
+  };
+}
+export function applyCascadeDisplayPolicy(errors, options) {
+  if (errors.length === 0) {
+    return { diagnostics: [], suppressed: 0, auxSuppressed: 0, total: 0 };
+  }
+  const { cwd, policyRoot, filePath } = options;
+  const content = options.content ?? readNeighborContent(filePath);
+  const converted = convertLspDiagnostics(errors, filePath);
+  const retained = retagAuxiliaryDiagnostics(converted, errors, content ?? "", {
+    cwd,
+    fileRole: detectFileRole(filePath, content)
+  });
+  const { kept } = applyFindingPolicy(retained, {
+    cwd: policyRoot,
+    filePath,
+    content: content ?? "",
+    policyMap: loadProjectRulePolicyMap(policyRoot),
+    identities: renderedRuleIdentities
+  });
+  return {
+    diagnostics: options.displayCap === undefined ? kept : kept.slice(0, options.displayCap),
+    suppressed: retained.length - kept.length,
+    auxSuppressed: converted.length - retained.length,
+    total: converted.length
   };
 }
+export function recordCascadeFindingPolicy(entry) {
+  const inputTruncated = entry.inputTruncated ?? 0;
+  if (entry.suppressed === 0 && entry.auxSuppressed === 0 && inputTruncated === 0)
+    return;
+  logLatency({
+    type: "phase",
+    toolName: "cascade",
+    filePath: entry.filePath,
+    phase: "cascade_finding_policy",
+    durationMs: entry.durationMs,
+    metadata: {
+      suppressed: entry.suppressed,
+      total: entry.total,
+      auxSuppressed: entry.auxSuppressed,
+      ...inputTruncated > 0 && { inputTruncated }
+    }
+  });
+}
+function readNeighborContent(filePath) {
+  try {
+    return fs.readFileSync(filePath, "utf-8");
+  } catch {
+    return;
+  }
+}
+export function cascadeCarrySuffix(carriedTurns, observedAt) {
+  if (carriedTurns === undefined || carriedTurns < 1)
+    return;
+  const noun = carriedTurns === 1 ? "turn" : "turns";
+  return `(carried ${carriedTurns} ${noun} · ${formatCacheAgeLabel(observedAt)})`;
+}

package/extensions/dm-lens/clients/cascade-logger.js

@@ -20,9 +20,3 @@ export function logCascade(entry) {
     filePath: normalizeLoggedPath(entry.filePath)
   });
 }
-export function getCascadeLogPath() {
-  return CASCADE_LOG_FILE;
-}
-export function flushCascadeLog() {
-  return writer.flush();
-}

package/extensions/dm-lens/clients/child-unref.js

@@ -1,4 +1,5 @@
 import { spawn as nodeSpawn } from "node:child_process";
+import { createBoundedOutputSink } from "./spawn-output-cap.js";
 export function unrefChildAndPipes(child) {
   try {
     child.unref();
@@ -7,9 +8,6 @@ export function unrefChildAndPipes(child) {
     }
   } catch {}
 }
-export function spawnCollectStdout(command, args, options) {
-  return spawnCollectStdoutResult(command, args, options).then((result) => result.stdout);
-}
 export function spawnCollectStdoutResult(command, args, options, collectOptions = {}) {
   return new Promise((resolve) => {
     let settled = false;
@@ -25,12 +23,10 @@ export function spawnCollectStdoutResult(command, args, options, collectOptions
     try {
       const child = nodeSpawn(command, args, options);
       unrefChildAndPipes(child);
-      let out = "";
-      child.stdout?.on("data", (chunk) => {
-        out += chunk.toString();
-      });
+      const out = createBoundedOutputSink();
+      child.stdout?.on("data", (chunk) => out.append(chunk));
       child.once("error", (error) => settle({ stdout: "", status: "spawn-error", error }));
-      child.once("close", (code, signal) => settle(code === 0 && signal === null ? { stdout: out, status: "ok" } : {
+      child.once("close", (code, signal) => settle(code === 0 && signal === null ? { stdout: out.text, status: "ok" } : {
         stdout: "",
         status: "exit-error",
         exitCode: code,
@@ -39,7 +35,7 @@ export function spawnCollectStdoutResult(command, args, options, collectOptions
       const timeoutMs = collectOptions.timeoutMs;
       if (typeof timeoutMs === "number" && timeoutMs > 0) {
         timer = setTimeout(() => {
-          terminateTimedOutChild(child, collectOptions.onTimeout).then((timeoutKill) => settle({ stdout: out, status: "timeout", timeoutKill }));
+          terminateTimedOutChild(child, collectOptions.onTimeout).then((timeoutKill) => settle({ stdout: out.text, status: "timeout", timeoutKill }));
         }, timeoutMs);
         timer.unref();
       }

package/extensions/dm-lens/clients/code-quality-warnings.js

@@ -4,6 +4,7 @@ import { toRunnerDisplayPath } from "./dispatch/runner-context.js";
 import { displayProjectDataPath, getProjectDataDir } from "./file-utils.js";
 import { normalizeMessage, stableFindingId } from "./finding-identity.js";
 import { normalizeMapKey } from "./path-utils.js";
+import { resolveLensToolName } from "./tool-config.js";
 const TIER_BUDGET_ORDER = [
   "warning",
   "info",
@@ -168,7 +169,7 @@ export function appendCodeQualityWarningsHistory(cwd, report) {
 `, "utf8");
   } catch {}
 }
-export function formatCodeQualityWarningsAdvisory(report, cwd) {
+export function formatCodeQualityWarningsAdvisory(report, cwd, host = "pi") {
   if (report.summary.warnings === 0)
     return;
   const topRules = report.summary.topRules.slice(0, 3).map((entry) => `${entry.rule}×${entry.count}`).join(", ");
@@ -178,11 +179,12 @@ export function formatCodeQualityWarningsAdvisory(report, cwd) {
     byTier.info ? `${byTier.info} info` : undefined,
     byTier.hint ? `${byTier.hint} hint` : undefined
   ].filter(Boolean).join(", ") : "";
+  const diagnosticsTool = resolveLensToolName("lens_diagnostics", host);
   return [
     `Code-quality warnings introduced/touched this turn: ${report.summary.warnings} across ${report.summary.files} file(s).`,
     tiers ? `By tier: ${tiers}. Hint and info are style opinions, not defects.` : undefined,
     topRules ? `Top rules: ${topRules}` : undefined,
-    "Use lens_diagnostics with mode=delta to inspect these warnings.",
+    diagnosticsTool ? `Use ${diagnosticsTool} with mode=delta to inspect these warnings.` : undefined,
     "No action required unless you are already refactoring these areas.",
     `Raw report (only if you need the JSON): ${displayProjectDataPath(cwd, "cache", "code-quality-warnings.json")}`
   ].filter(Boolean).join(`

package/extensions/dm-lens/clients/complexity-client.js

@@ -1,6 +1,7 @@
 import { createSubsystemLogger } from "./extension-log.js";
 import * as fs from "node:fs";
 import * as path from "node:path";
+import { calcCyclomaticComplexity } from "./dispatch/facts/function-facts.js";
 import {
   firstChildOfType,
   withTreeSitterRoot,
@@ -176,6 +177,8 @@ function isLogicalOp(node, nodes) {
   return false;
 }
 function subtreeCyclomatic(root, nodes) {
+  if (nodes === JSTS)
+    return calcCyclomaticComplexity(root) - 1;
   let cc = 0;
   walk(root, (n) => {
     if (nodes.decision.has(n.type))
@@ -381,7 +384,8 @@ export class ComplexityClient {
       maxParamsInFunction: calculateMaxParams(functions),
       aiCommentPatterns: countAICommentPatterns(content),
       singleUseFunctions: countSingleUseFunctions(functions),
-      tryCatchCount: countTryCatch(root, nodes)
+      tryCatchCount: countTryCatch(root, nodes),
+      functions
     };
   }
   aggregateFunctionStats(functions) {

package/extensions/dm-lens/clients/config-core/index.js

@@ -1,68 +1,2 @@
-export {
-  additionalPropertyPolicy,
-  DEFAULT_MERGE_STRATEGY,
-  DENY_KEY,
-  DENY_POLICIES,
-  denyPolicyOf,
-  isDenyPolicy,
-  isConfigObject,
-  isKnownSchemaType,
-  isMergeStrategy,
-  isPlainObject,
-  isSchemaNode,
-  itemsSchema,
-  keyedField,
-  MERGE_STRATEGY_KEY,
-  mergeStrategyOf,
-  propertySchema,
-  SCHEMA_TYPES,
-  schemaType,
-  STABILITY_TIER_KEY
-} from "./schema.js";
-export {
-  compareKeys,
-  isOperatorTier,
-  isRepoTier,
-  provenanceFor,
-  provenanceView,
-  SOURCE_TIERS,
-  TIER_CLASS,
-  TIER_PRECEDENCE,
-  tierPrecedence
-} from "./provenance.js";
-export {
-  isUnsafeConfigKey,
-  MAX_CONFIG_DEPTH,
-  safeAssign,
-  UNSAFE_CONFIG_KEYS,
-  UNSAFE_KEY_REASON
-} from "./safe-object.js";
-export {
-  denyProvenance,
-  resolveArrayDeny,
-  resolveBooleanDeny
-} from "./deny.js";
-export {
-  validate
-} from "./normalize.js";
-export {
-  boundedKeyLabel,
-  jsonTypeName,
-  MAX_MIGRATION_RECORDS,
-  MAX_RECORD_KEY_LENGTH,
-  MigrationRecordCollector,
-  migrationSubject
-} from "./records.js";
-export {
-  buildProcessSpec,
-  MAX_ARGV_BYTES,
-  MAX_ARGV_ENTRIES,
-  MAX_ENV_BYTES,
-  MAX_ENV_ENTRIES,
-  MAX_TIMEOUT_MS,
-  redactProcessSpec,
-  toSpawnArgs
-} from "./process-spec.js";
-export {
-  resolveConfig
-} from "./resolve.js";
+export { SOURCE_TIERS } from "./provenance.js";
+export { resolveConfig } from "./resolve.js";

package/extensions/dm-lens/clients/config-core/process-spec.js

@@ -9,7 +9,7 @@ import {
   isRepoTier
 } from "./provenance.js";
 export const MAX_ARGV_ENTRIES = 128;
-export const MAX_ARGV_BYTES = 32 * 1024;
+const MAX_ARGV_BYTES = 32 * 1024;
 export const MAX_ENV_ENTRIES = 64;
 export const MAX_ENV_BYTES = 16 * 1024;
 export const MAX_TIMEOUT_MS = 10 * 60 * 1000;

package/extensions/dm-lens/clients/config-core/provenance.js

@@ -8,7 +8,6 @@ export const SOURCE_TIERS = [
   "cli",
   "host"
 ];
-export const TIER_PRECEDENCE = SOURCE_TIERS;
 export const TIER_CLASS = {
   builtin: "default",
   global: "operator",
@@ -19,7 +18,7 @@ export const TIER_CLASS = {
   host: "operator"
 };
 export function tierPrecedence(tier) {
-  return TIER_PRECEDENCE.indexOf(tier);
+  return SOURCE_TIERS.indexOf(tier);
 }
 export function isRepoTier(tier) {
   return TIER_CLASS[tier] === "repo";

package/extensions/dm-lens/clients/config-core/records.js

@@ -27,7 +27,7 @@ export function jsonTypeName(value) {
     return "array";
   return typeof value;
 }
-export const UNANCHORED_RECORD_LABEL = "(config resolution)";
+const UNANCHORED_RECORD_LABEL = "(config resolution)";
 
 export class MigrationRecordCollector {
   kept = [];

package/extensions/dm-lens/clients/config-core/schema.js

@@ -1,11 +1,8 @@
-import { STABILITY_TIER_KEY } from "../config-diagnostic-codes.js";
-
-export { STABILITY_TIER_KEY };
 export function isConfigObject(value) {
   return typeof value === "object" && value !== null && !Array.isArray(value);
 }
 export const MERGE_STRATEGY_KEY = "x-merge-strategy";
-export const DEFAULT_MERGE_STRATEGY = "replace";
+const DEFAULT_MERGE_STRATEGY = "replace";
 const KEYED_PREFIX = "keyed:";
 export function isMergeStrategy(value) {
   if (typeof value !== "string")
@@ -22,7 +19,7 @@ export function keyedField(strategy) {
   return strategy.startsWith(KEYED_PREFIX) ? strategy.slice(KEYED_PREFIX.length) : undefined;
 }
 export const DENY_KEY = "x-deny";
-export const DENY_POLICIES = ["boolean-false", "array-union"];
+const DENY_POLICIES = ["boolean-false", "array-union"];
 export function isDenyPolicy(value) {
   return typeof value === "string" && DENY_POLICIES.includes(value);
 }
@@ -40,7 +37,7 @@ export function schemaType(node) {
   const declared = node?.type;
   return typeof declared === "string" ? declared : undefined;
 }
-export const SCHEMA_TYPES = [
+const SCHEMA_TYPES = [
   "object",
   "array",
   "string",

package/extensions/dm-lens/clients/config-diagnostic-codes.js

@@ -1,5 +1,5 @@
 export const STABILITY_TIER_KEY = "x-stability";
-export const STABILITY_TIERS = ["experimental", "stable"];
+const STABILITY_TIERS = ["experimental", "stable"];
 export function isStabilityTier(value) {
   return typeof value === "string" && STABILITY_TIERS.includes(value);
 }
@@ -13,7 +13,9 @@ export const CONFIG_DIAGNOSTIC_CODES = {
   PILENS_CFG_0005: "config field value rejected by schema; ignored",
   PILENS_CFG_0006: "config key would modify the object prototype; ignored",
   PILENS_CFG_0007: "further config notices suppressed by the per-resolution bound",
-  PILENS_CFG_0008: "config resolution failed; whole configuration ignored"
+  PILENS_CFG_0008: "config resolution failed; whole configuration ignored",
+  PILENS_CFG_0009: "unknown or non-disableable tool config key ignored",
+  PILENS_CFG_0010: "lower-precedence global config file shadowed"
 };
 export const CONFIG_DIAGNOSTIC_CODE_PATTERN = /^PILENS_CFG_\d{4}$/;
 export function isConfigDiagnosticCode(value) {
@@ -31,7 +33,7 @@ export function withConfigDiagnosticCode(message, code) {
 }
 export const CONFIG_DIAGNOSTIC_MARKER_PATTERN = /\[(PILENS_CFG_\d{4})\]/;
 const LSP_DEPRECATION_WINDOW = {
-  deprecatedSince: "4.2.0",
+  deprecatedSince: "4.1.4",
   removeNotBefore: "5.0.0"
 };
 const LEGACY_KEY = {