@duckmind/dm-linux-x64 0.65.5 → 0.65.6

package/extensions/dm-lens/clients/project-diagnostics/fresh-fetch.js

@@ -1,8 +1,14 @@
 import * as fs from "node:fs";
+import * as os from "node:os";
 import * as path from "node:path";
 import { applyDispositionsMultiFile } from "../diagnostic-dispositions.js";
 import { getKnipIgnorePatterns } from "../file-utils.js";
-import { isAtOrAboveHomeDir } from "../path-utils.js";
+import { isAtOrAboveHomeDir, realpathOrResolve } from "../path-utils.js";
+import { isSameOrWithin } from "../lsp/server.js";
+import {
+  incrementDegradationCount,
+  recordDegradationOnce
+} from "../degradation-ledger.js";
 import { GitleaksClient } from "../gitleaks-client.js";
 import { GovulncheckClient } from "../govulncheck-client.js";
 import {
@@ -36,23 +42,89 @@ function pushUnique(list, id) {
     list.push(id);
 }
 export async function fetchFreshProjectDiagnostics(cacheManager, cwd, clients, signal, options = {}) {
-  const analysisRoot = path.resolve(cwd);
-  const unsafeRootReason = "the working directory resolves at or above the home directory; heavyweight analyzers refuse to walk from there (#747)";
-  if (isAtOrAboveHomeDir(analysisRoot, options.homeDir)) {
+  const requestedRoot = options.analysisRoot === undefined ? cwd : path.resolve(cwd, options.analysisRoot);
+  let analysisRoot;
+  let analysisRootValidation;
+  if (options.analysisRoot !== undefined) {
+    try {
+      if (!fs.statSync(requestedRoot).isDirectory()) {
+        throw new Error("is not a directory");
+      }
+      analysisRoot = fs.realpathSync(requestedRoot);
+    } catch (error) {
+      const detail = error instanceof Error ? error.message : String(error);
+      const reason = `the explicit analysis root ${requestedRoot} is unavailable or ${detail}`;
+      analysisRootValidation = {
+        state: "undecided",
+        root: requestedRoot,
+        reason
+      };
+      incrementDegradationCount({
+        kind: "lens-diagnostics-analysis-root-rejected",
+        subject: requestedRoot,
+        reason
+      });
+      return {
+        analysisRootValidation,
+        diagnostics: [],
+        runners: [],
+        analyzed: [],
+        authoritativeCoverage: [],
+        cold: [...ANALYZER_IDS],
+        coldReasons: Object.fromEntries(ANALYZER_IDS.map((id) => [id, reason])),
+        failed: [],
+        timings: {},
+        analysisRootError: reason
+      };
+    }
+  } else {
+    analysisRoot = realpathOrResolve(cwd);
+  }
+  const unsafeRootReason = "the analysis root resolves at or above the home directory; heavyweight analyzers refuse to walk from there (#747)";
+  const homeRoot = realpathOrResolve(options.homeDir ?? os.homedir());
+  if (options.analysisRoot !== undefined) {
+    const unsafeExplicitRoot = !isSameOrWithin(homeRoot, analysisRoot) || isSameOrWithin(analysisRoot, homeRoot);
+    analysisRootValidation = unsafeExplicitRoot ? {
+      state: "unsafe",
+      root: analysisRoot,
+      reason: "explicit analysis root must be strictly contained by the canonical home directory"
+    } : { state: "safe", root: analysisRoot };
+  } else if (isAtOrAboveHomeDir(analysisRoot, options.homeDir)) {
+    analysisRootValidation = {
+      state: "unsafe",
+      root: analysisRoot,
+      reason: unsafeRootReason
+    };
+  } else {
+    analysisRootValidation = { state: "safe", root: analysisRoot };
+  }
+  if (analysisRootValidation.state !== "safe") {
+    incrementDegradationCount({
+      kind: "lens-diagnostics-analysis-root-rejected",
+      subject: analysisRoot,
+      reason: analysisRootValidation.reason
+    });
     return {
+      analysisRootValidation,
       diagnostics: [],
       runners: [],
+      analyzed: [],
+      authoritativeCoverage: [],
       cold: [...ANALYZER_IDS],
       coldReasons: Object.fromEntries(ANALYZER_IDS.map((id) => [id, unsafeRootReason])),
       failed: [],
       timings: {},
-      unsafeRoot: true
+      unsafeRoot: analysisRootValidation.state === "unsafe"
     };
   }
   const diagnostics = [];
   const runners = [];
+  const analyzed = [];
+  const authoritativeCoverage = [];
   const cold = [];
   const coldReasons = {};
+  const partial = [];
+  const partialReasons = {};
   const failed = [];
   const timings = {};
   const cachedAgeMs = {};
@@ -63,7 +135,31 @@ export async function fetchFreshProjectDiagnostics(cacheManager, cwd, clients, s
     pushUnique(cold, id);
     coldReasons[id] = reason;
   }
-  function record(id, adapted, elapsedMs) {
+  function markPartial(id, reason) {
+    pushUnique(partial, id);
+    partialReasons[id] = reason;
+  }
+  function record(id, adapted, elapsedMs, analysedRoot, analysis) {
+    if (analysedRoot) {
+      pushUnique(analyzed, id);
+      if (analysis?.analyzedFiles !== undefined) {
+        const root = realpathOrResolve(analysisRoot);
+        authoritativeCoverage.push({
+          runnerId: id,
+          root,
+          files: new Set(analysis.analyzedFiles.map((file) => {
+            return realpathOrResolve(file);
+          }))
+        });
+        if (analysis.analyzedFiles.length === 0) {
+          recordDegradationOnce({
+            kind: "runner-coverage-empty",
+            subject: `${id}:${root}`,
+            reason: `${id} analysed this root but declared zero scanned files, so retained ${id} findings are kept rather than retired`
+          });
+        }
+      }
+    }
     timings[id] = (timings[id] ?? 0) + elapsedMs;
     const kept = applyDispositionsMultiFile(adapted, analysisRoot, (d) => d.filePath);
     const suppressedHere = adapted.length - kept.length;
@@ -79,6 +175,7 @@ export async function fetchFreshProjectDiagnostics(cacheManager, cwd, clients, s
   function recordFailed(id, result) {
     failed.push({
       id,
+      ..."reason" in result && result.reason !== undefined ? { reason: result.reason } : {},
       summary: "summary" in result && typeof result.summary === "string" ? result.summary : "analyzer reported an unsuccessful run"
     });
   }
@@ -93,10 +190,14 @@ export async function fetchFreshProjectDiagnostics(cacheManager, cwd, clients, s
         recordFailed("knip", result);
         return;
       }
+      if (result.analyzed !== true) {
+        markCold("knip", result.summary ?? "knip did not analyse this root");
+        return;
+      }
       cacheManager.writeCache("knip", result, analysisRoot, {
         scanDurationMs: Date.now() - startMs
       });
-      record("knip", knipIssuesToProjectDiagnostics(analysisRoot, result.issues ?? []), Date.now() - startMs);
+      record("knip", knipIssuesToProjectDiagnostics(analysisRoot, result.issues ?? []), Date.now() - startMs, true, result);
     }),
     task("jscpd", async () => {
       if (!await clients.jscpdClient.ensureAvailable()) {
@@ -111,10 +212,14 @@ export async function fetchFreshProjectDiagnostics(cacheManager, cwd, clients, s
         recordFailed("jscpd", result);
         return;
       }
+      if (result.analyzed !== true) {
+        markCold("jscpd", "jscpd did not analyse this root (no source files, or the scan produced no report)");
+        return;
+      }
       cacheManager.writeCache(scannerKey, result, analysisRoot, {
         scanDurationMs: Date.now() - startMs
       });
-      record("jscpd", jscpdResultToProjectDiagnostics(analysisRoot, result), Date.now() - startMs);
+      record("jscpd", jscpdResultToProjectDiagnostics(analysisRoot, result), Date.now() - startMs, true, result);
     }),
     task("madge", async () => {
       if (!await clients.depChecker.ensureAvailable()) {
@@ -126,7 +231,7 @@ export async function fetchFreshProjectDiagnostics(cacheManager, cwd, clients, s
       cacheManager.writeCache("madge", result, analysisRoot, {
         scanDurationMs: Date.now() - startMs
       });
-      record("madge", circularDepsToProjectDiagnostics(analysisRoot, result.circular ?? []), Date.now() - startMs);
+      record("madge", circularDepsToProjectDiagnostics(analysisRoot, result.circular ?? []), Date.now() - startMs, result.analyzed === true, result);
     }),
     task("gitleaks", async () => {
       if (!GitleaksClient.hasGitRepo(analysisRoot)) {
@@ -148,7 +253,7 @@ export async function fetchFreshProjectDiagnostics(cacheManager, cwd, clients, s
       cacheManager.writeCache("gitleaks", result, analysisRoot, {
         scanDurationMs: Date.now() - startMs
       });
-      record("gitleaks", gitleaksResultToProjectDiagnostics(analysisRoot, result), Date.now() - startMs);
+      record("gitleaks", gitleaksResultToProjectDiagnostics(analysisRoot, result), Date.now() - startMs, result.analyzed === true, result);
     }),
     task("govulncheck", async () => {
       if (!GovulncheckClient.hasGoModule(analysisRoot)) {
@@ -168,7 +273,7 @@ export async function fetchFreshProjectDiagnostics(cacheManager, cwd, clients, s
       cacheManager.writeCache("govulncheck", result, analysisRoot, {
         scanDurationMs: Date.now() - startMs
       });
-      record("govulncheck", govulncheckResultToProjectDiagnostics(analysisRoot, result), Date.now() - startMs);
+      record("govulncheck", govulncheckResultToProjectDiagnostics(analysisRoot, result), Date.now() - startMs, result.analyzed === true, result);
     }),
     task("opengrep", async () => {
       if (!await clients.opengrepClient.ensureAvailable()) {
@@ -181,10 +286,24 @@ export async function fetchFreshProjectDiagnostics(cacheManager, cwd, clients, s
         recordFailed("opengrep", result);
         return;
       }
+      if (result.analyzed !== true) {
+        const reason = result.summary ?? result.reason ?? "opengrep did not analyse this root";
+        if (result.partial)
+          markPartial("opengrep", reason);
+        else
+          markCold("opengrep", reason);
+        record("opengrep", opengrepResultToProjectDiagnostics(analysisRoot, result), Date.now() - startMs, false, result);
+        return;
+      }
+      if (result.partial) {
+        markPartial("opengrep", result.summary ?? result.reason ?? "opengrep scan coverage is incomplete");
+        record("opengrep", opengrepResultToProjectDiagnostics(analysisRoot, result), Date.now() - startMs, true, result);
+        return;
+      }
       cacheManager.writeCache("opengrep", result, analysisRoot, {
         scanDurationMs: Date.now() - startMs
       });
-      record("opengrep", opengrepResultToProjectDiagnostics(analysisRoot, result), Date.now() - startMs);
+      record("opengrep", opengrepResultToProjectDiagnostics(analysisRoot, result), Date.now() - startMs, result.analyzed === true, result);
     }),
     task("trivy", async () => {
       if (!TrivyClient.shouldScan(analysisRoot)) {
@@ -204,7 +323,7 @@ export async function fetchFreshProjectDiagnostics(cacheManager, cwd, clients, s
       cacheManager.writeCache("trivy", result, analysisRoot, {
         scanDurationMs: Date.now() - startMs
       });
-      record("trivy", trivyResultToProjectDiagnostics(analysisRoot, result), Date.now() - startMs);
+      record("trivy", trivyResultToProjectDiagnostics(analysisRoot, result), Date.now() - startMs, result.analyzed === true, result);
     }),
     task("dead-code", async () => {
       const applicable = clients.deadCodeClients.filter((c) => c.detect(analysisRoot));
@@ -220,10 +339,13 @@ export async function fetchFreshProjectDiagnostics(cacheManager, cwd, clients, s
           recordFailed("dead-code", result);
           return;
         }
-        cacheManager.writeCache(cacheKey, result, analysisRoot, {
-          scanDurationMs: Date.now() - startMs
-        });
-        record("dead-code", deadCodeResultToProjectDiagnostics(analysisRoot, result), Date.now() - startMs);
+        if (result.analyzed === true) {
+          cacheManager.writeCache(cacheKey, result, analysisRoot, {
+            scanDurationMs: Date.now() - startMs
+          });
+        }
+        const adapted = deadCodeResultToProjectDiagnostics(analysisRoot, result);
+        record("dead-code", adapted, Date.now() - startMs, result.analyzed === true, result);
       }));
     }),
     task("test-runner", async () => {
@@ -234,7 +356,7 @@ export async function fetchFreshProjectDiagnostics(cacheManager, cwd, clients, s
         return;
       }
       cachedAgeMs["test-runner"] = Date.now() - new Date(cached.meta.timestamp).getTime();
-      record("test-runner", testRunnerFindingsToProjectDiagnostics(cached.data, analysisRoot, options.runtime), Date.now() - startMs);
+      record("test-runner", testRunnerFindingsToProjectDiagnostics(cached.data, analysisRoot, options.runtime), Date.now() - startMs, false);
     })
   ];
   const allSettled = Promise.all(tasks).then(() => "completed").catch(() => "completed");
@@ -255,10 +377,15 @@ export async function fetchFreshProjectDiagnostics(cacheManager, cwd, clients, s
     for (const id of abortedIds)
       pushUnique(cold, id);
     return {
+      analysisRootValidation,
       diagnostics,
       runners,
+      analyzed,
+      authoritativeCoverage,
       cold,
       coldReasons,
+      partial,
+      partialReasons,
       failed,
       timings,
       cachedAgeMs,
@@ -269,10 +396,15 @@ export async function fetchFreshProjectDiagnostics(cacheManager, cwd, clients, s
     };
   }
   return {
+    analysisRootValidation,
     diagnostics,
     runners,
+    analyzed,
+    authoritativeCoverage,
     cold,
     coldReasons,
+    partial,
+    partialReasons,
     failed,
     timings,
     cachedAgeMs,

package/extensions/dm-lens/clients/project-diagnostics/runner-adapters/dead-code.js

@@ -1,4 +1,7 @@
 import * as path from "node:path";
+function deadCodeRunnerId(language) {
+  return `dead-code-${language}`;
+}
 function deadCodeMessage(issue) {
   if (issue.category === "unlisted")
     return `Unlisted dependency ${issue.name}`;
@@ -16,7 +19,7 @@ export function deadCodeIssueToProjectDiagnostic(cwd, issue, language) {
     severity: blocking ? "error" : "warning",
     semantic: blocking ? "blocking" : "warning",
     tool: "dead-code",
-    runner: `dead-code-${language}`,
+    runner: deadCodeRunnerId(language),
     rule: `dead-code:${issue.category}`,
     message: deadCodeMessage(issue),
     source: "project-scan"

package/extensions/dm-lens/clients/project-diagnostics/runner-adapters/gitleaks.js

@@ -1,12 +1,12 @@
 import * as path from "node:path";
 export function gitleaksFindingToProjectDiagnostic(cwd, finding) {
   const statusSuffix = finding.pathStatus ? ` [git: ${finding.pathStatus}]` : "";
-  const isScratch = finding.pathStatus === "scratch";
+  const isBlocking = finding.pathStatus !== "scratch" && finding.pathStatus !== "ignored" && finding.pathStatus !== "nested-repository";
   return {
     filePath: path.isAbsolute(finding.file) ? finding.file : path.resolve(cwd, finding.file),
     line: finding.startLine,
-    severity: isScratch ? "info" : "error",
-    semantic: isScratch ? "none" : "blocking",
+    severity: isBlocking ? "error" : "info",
+    semantic: isBlocking ? "blocking" : "none",
     tool: "gitleaks",
     runner: "gitleaks",
     rule: `gitleaks:${finding.ruleId}`,

package/extensions/dm-lens/clients/project-diagnostics/runner-adapters/jscpd.js

@@ -2,7 +2,7 @@ import * as path from "node:path";
 function resolveClonePath(cwd, file) {
   return path.isAbsolute(file) ? file : path.resolve(cwd, file);
 }
-export function jscpdCloneToProjectDiagnostics(cwd, clone) {
+function jscpdCloneToProjectDiagnostics(cwd, clone) {
   const a = resolveClonePath(cwd, clone.fileA);
   const b = resolveClonePath(cwd, clone.fileB);
   const make = (filePath, line, otherFile, otherLine) => ({

package/extensions/dm-lens/clients/project-diagnostics/runner-adapters/knip.js

@@ -25,7 +25,7 @@ function knipIssueMessage(issue) {
   }
   return `${issue.type}: ${issue.name}`;
 }
-export function knipIssueToProjectDiagnostic(cwd, issue) {
+function knipIssueToProjectDiagnostic(cwd, issue) {
   const blocking = issue.type === "unlisted" || issue.type === "bin";
   return {
     filePath: knipIssueFile(cwd, issue),

package/extensions/dm-lens/clients/project-diagnostics/runner-adapters/madge.js

@@ -6,7 +6,7 @@ function resolveCyclePath(cwd, file) {
 function cycleMembers(dep) {
   return dep.path.length > 0 ? dep.path : [dep.file];
 }
-export function circularDepToProjectDiagnostics(cwd, dep) {
+function circularDepToProjectDiagnostics(cwd, dep) {
   const members = cycleMembers(dep);
   const rendered = `${members.map((f) => path.basename(f)).join(" → ")} → ${path.basename(members[0] ?? "")}`;
   return members.map((file) => ({

package/extensions/dm-lens/clients/project-diagnostics/runner-adapters/opengrep.js

@@ -9,7 +9,7 @@ function severityFor(raw) {
       return { severity: "warning", blocking: false };
   }
 }
-export function opengrepFindingToProjectDiagnostic(cwd, finding) {
+function opengrepFindingToProjectDiagnostic(cwd, finding) {
   const { severity, blocking } = severityFor(finding.severity);
   const cweSuffix = finding.cwe?.length ? ` (${finding.cwe[0]})` : "";
   return {

package/extensions/dm-lens/clients/project-diagnostics/runner-adapters/runner-findings.js

@@ -1,3 +1,6 @@
+import {
+  isRunnerErrorResult
+} from "../../test-runner-client.js";
 import * as fs from "node:fs";
 import * as path from "node:path";
 import {
@@ -21,7 +24,7 @@ function parseLocation(location) {
     ...match[2] ? { column: Number.parseInt(match[2], 10) } : {}
   };
 }
-export function testResultToProjectDiagnostics(result, stale = false) {
+function testResultToProjectDiagnostics(result, stale = false) {
   if (result.failed === 0 && !result.error)
     return [];
   const stalePrefix = stale ? "[stale — from a prior turn] " : "";
@@ -38,6 +41,20 @@ export function testResultToProjectDiagnostics(result, stale = false) {
       source: "project-scan"
     }));
   }
+  if (isRunnerErrorResult(result)) {
+    return [
+      {
+        filePath: result.file,
+        severity: "info",
+        semantic: "none",
+        tool: "test-runner",
+        runner: result.runner,
+        rule: `test:${result.runner}`,
+        message: `${stalePrefix}Test run error: ${result.error}`,
+        source: "project-scan"
+      }
+    ];
+  }
   return [
     {
       filePath: result.file,
@@ -46,7 +63,7 @@ export function testResultToProjectDiagnostics(result, stale = false) {
       tool: "test-runner",
       runner: result.runner,
       rule: `test:${result.runner}`,
-      message: `${stalePrefix}${result.error ? `Test run error: ${result.error}` : `${result.failed} test(s) failed`}`,
+      message: `${stalePrefix}${result.failed} test(s) failed${result.error ? ` (runner also reported: ${result.error})` : ""}`,
       source: "project-scan"
     }
   ];

package/extensions/dm-lens/clients/project-diagnostics/scanner.js

@@ -39,6 +39,7 @@ import {
   PROJECT_DIAGNOSTICS_CACHE_VERSION,
   saveProjectDiagnosticsSnapshot
 } from "./cache.js";
+import { hashDiagnosticContent } from "../lsp/diagnostic-binding.js";
 import"../dispatch/integration.js";
 const AST_GREP_MAX_FILE_BYTES = 1024 * 1024;
 const AST_GREP_SCAN_MAX_MATCHES_PER_RULE = 25;
@@ -92,6 +93,7 @@ async function scanFileMajorRules(cwd, files, signal) {
   const treeSitter = [];
   const factRules = [];
   const astGrep = [];
+  const fingerprints = {};
   const sgModule = await loadSg();
   let phaseOneFilesScanned = 0;
   let astGrepFilesScanned = 0;
@@ -185,11 +187,16 @@ async function scanFileMajorRules(cwd, files, signal) {
       if (langId || factEligible)
         phaseOneFilesScanned++;
       let content;
+      let contentBytes;
       try {
-        content = fs.readFileSync(filePath, "utf-8");
+        const buf = fs.readFileSync(filePath);
+        contentBytes = buf.length;
+        content = buf.toString("utf-8");
       } catch {
         content = null;
+        contentBytes = undefined;
       }
+      const rowsBeforeFile = treeSitter.length + factRules.length + astGrep.length;
       try {
         await scanTreeSitterFile(filePath, langId, content);
         if (isTreeSitterWasmAborted()) {
@@ -231,6 +238,12 @@ async function scanFileMajorRules(cwd, files, signal) {
             ...graphIr
           });
         }
+        if (content !== null && contentBytes !== undefined && treeSitter.length + factRules.length + astGrep.length > rowsBeforeFile) {
+          fingerprints[filePath] = {
+            sizeBytes: contentBytes,
+            contentHash: hashDiagnosticContent(content)
+          };
+        }
         filesScanned++;
       } finally {
         facts.dropFileFacts(filePath);
@@ -242,7 +255,14 @@ async function scanFileMajorRules(cwd, files, signal) {
   };
   if (!client) {
     await scan();
-    return { treeSitter, factRules, astGrep, filesScanned, wasmAborted };
+    return {
+      treeSitter,
+      factRules,
+      astGrep,
+      filesScanned,
+      wasmAborted,
+      fingerprints
+    };
   }
   const startedAt = Date.now();
   await client.withParseCacheMeasurement(scan, (stats) => {
@@ -258,7 +278,14 @@ async function scanFileMajorRules(cwd, files, signal) {
       }
     });
   });
-  return { treeSitter, factRules, astGrep, filesScanned, wasmAborted };
+  return {
+    treeSitter,
+    factRules,
+    astGrep,
+    filesScanned,
+    wasmAborted,
+    fingerprints
+  };
 }
 export async function scanProjectDiagnostics(options) {
   const cwd = path.resolve(options.cwd);
@@ -284,6 +311,7 @@ export async function scanProjectDiagnostics(options) {
   const files = collected.files;
   const runners = [];
   const diagnostics = [];
+  let fileFingerprints = {};
   let wasmAborted = false;
   let filesScanned = files.length;
   if (!signal?.aborted) {
@@ -297,6 +325,8 @@ export async function scanProjectDiagnostics(options) {
       diagnostics.push(...scanned.astGrep);
       runners.push("ast-grep-napi");
     }
+    const rowFiles = new Set(diagnostics.map((d) => d.filePath));
+    fileFingerprints = Object.fromEntries(Object.entries(scanned.fingerprints).filter(([file]) => rowFiles.has(file)));
   }
   const snapshot = {
     version: PROJECT_DIAGNOSTICS_CACHE_VERSION,
@@ -305,7 +335,8 @@ export async function scanProjectDiagnostics(options) {
     scannedAt: new Date().toISOString(),
     diagnostics,
     filesScanned,
-    runners
+    runners,
+    fileFingerprints
   };
   if (collected.entryBudgetExceeded)
     snapshot.scanTruncated = true;

package/extensions/dm-lens/clients/project-lens-config.js

@@ -11,6 +11,8 @@ import {
   assignFlagConfigSection,
   flagConfigSectionKeys,
   GLOBAL_NON_FLAG_CONFIG_SECTIONS,
+  GLOBAL_ONLY_NON_FLAG_KEYS,
+  hasFlagConfigPath,
   LENS_FLAGS,
   PROJECT_FOREIGN_CONFIG_NAMESPACES,
   PROJECT_FOREIGN_NAMESPACE_HONORED_KEYS,
@@ -21,6 +23,7 @@ import {
 import {
   configSearchDirs,
   getDmLensGlobalConfigPath,
+  isResolvedGlobalConfigPath,
   PROJECT_CONFIG_BASENAMES,
   PROJECT_CONFIG_LOCATIONS
 } from "./config-locations.js";
@@ -41,7 +44,11 @@ import {
   isAtOrAboveHomeDir,
   walkUpDirs
 } from "./path-utils.js";
-import { findDmLensConfigMarkerInDir } from "./workspace-topology.js";
+import {
+  dirMtimesStillFresh,
+  findDmLensConfigMarkerInDir
+} from "./workspace-topology.js";
+import { readToolConfig } from "./tool-config.js";
 export { PROJECT_CONFIG_BASENAMES } from "./config-locations.js";
 const REVIEW_GRAPH_MAX_FILES_MIN = 100;
 const REVIEW_GRAPH_MAX_FILES_MAX = 20000;
@@ -86,8 +93,9 @@ function replayConfigNotices(entry) {
 }
 export function loadDmLensProjectConfig(startDir, preloadedInfo) {
   const entry = discoveryEntryFor(startDir);
-  reportDmLensConfigRecords(entry.legacyRecords);
   const configInfo = preloadedInfo ?? freshInfoFor(entry);
+  const selectedLegacyPath = configInfo?.path;
+  reportDmLensConfigRecords(entry.legacyRecords.filter((record) => record.file !== selectedLegacyPath));
   if (!configInfo)
     return EMPTY_PROJECT_CONFIG;
   return loadCachedConfigFile(configInfo);
@@ -167,7 +175,7 @@ function safeDirMtimeMs(dir) {
   }
 }
 function discoveryCacheStillFresh(entry) {
-  if (!entry.dirMtimes.every((cached) => safeDirMtimeMs(cached.dir) === cached.mtimeMs)) {
+  if (!dirMtimesStillFresh(entry.dirMtimes)) {
     return false;
   }
   if (entry.info === undefined && Date.now() - entry.checkedAtMs >= FRESHNESS_CADENCE_MS) {
@@ -189,6 +197,8 @@ function discoverDmLensProjectConfig(startDir) {
     if (!info) {
       for (const name of PROJECT_CONFIG_BASENAMES) {
         const candidate = path.join(dir, name);
+        if (isResolvedGlobalConfigPath(candidate))
+          continue;
         const stat = safeFileStat(candidate);
         if (stat?.isFile()) {
           info = {
@@ -203,6 +213,8 @@ function discoverDmLensProjectConfig(startDir) {
     }
     for (const location of LEGACY_PROJECT_LOCATIONS) {
       const file = path.join(dir, location.relativePath);
+      if (isResolvedGlobalConfigPath(file))
+        continue;
       const stat = safeFileStat(file);
       if (!stat?.isFile())
         continue;
@@ -316,6 +328,7 @@ function parseConfigFile(configPath) {
   for (const spec of PROJECT_SCOPED_LENS_FLAGS) {
     assignFlagConfigSection(obj, mutations, spec.configKey, note);
   }
+  const toolConfig = readToolConfig(obj, note);
   const rules = {};
   if (obj.rules && typeof obj.rules === "object" && !Array.isArray(obj.rules)) {
     const rawRules = obj.rules;
@@ -373,6 +386,31 @@ function parseConfigFile(configPath) {
       }
     }
   }
+  let startup;
+  if (obj.startup !== undefined) {
+    if (!obj.startup || typeof obj.startup !== "object" || Array.isArray(obj.startup)) {
+      note("startup must be an object");
+    } else {
+      const section = obj.startup;
+      if (section.mode === "quick" || section.mode === "full" || section.mode === "minimal") {
+        startup = { mode: section.mode };
+      } else if ("mode" in section) {
+        note('startup.mode must be "quick", "full", or "minimal"');
+      }
+      if (section.scans !== undefined) {
+        if (!section.scans || typeof section.scans !== "object" || Array.isArray(section.scans)) {
+          note("startup.scans must be an object");
+        } else if (typeof section.scans.enabled === "boolean") {
+          startup ??= {};
+          startup.scans = {
+            enabled: section.scans.enabled
+          };
+        } else if ("enabled" in section.scans) {
+          note("startup.scans.enabled must be a boolean");
+        }
+      }
+    }
+  }
   const knownProjectKeys = new Set([
     ...PROJECT_NON_FLAG_CONFIG_SECTIONS,
     ...flagConfigSectionKeys(PROJECT_SCOPED_LENS_FLAGS),
@@ -384,6 +422,10 @@ function parseConfigFile(configPath) {
   ].filter((key) => !knownProjectKeys.has(key)));
   const projectScoped = new Set(PROJECT_SCOPED_LENS_FLAGS.map((spec) => spec.configKey));
   const globalScopeOnlyFlagKeys = LENS_FLAGS.map((spec) => spec.configKey).filter((configKey) => !projectScoped.has(configKey));
+  const globalScopeOnlyDottedKeys = [
+    ...globalScopeOnlyFlagKeys,
+    ...GLOBAL_ONLY_NON_FLAG_KEYS
+  ];
   const globalConfigLabel = homeRelativePath(getDmLensGlobalConfigPath(), os.homedir());
   const warnUnhonoredKey = (label, globalOnly) => {
     note(globalOnly ? `"${label}" is a global-only dm-lens setting and is not honored in a project .dm-lens.json (set it in ${globalConfigLabel} or pass the matching CLI flag); ignored` : `unknown key "${label}" is not a recognized dm-lens setting (check for a typo); ignored`);
@@ -402,11 +444,23 @@ function parseConfigFile(configPath) {
       if (honored.includes(key))
         continue;
       const dotted = `${namespace}.${key}`;
-      warnUnhonoredKey(dotted, globalScopeOnlyFlagKeys.some((configKey) => configKey === dotted || configKey.startsWith(`${dotted}.`)));
+      warnUnhonoredKey(dotted, globalScopeOnlyDottedKeys.some((configKey) => configKey === dotted || configKey.startsWith(`${dotted}.`)));
     }
   }
+  for (const configKey of globalScopeOnlyDottedKeys) {
+    const dotIndex = configKey.indexOf(".");
+    if (dotIndex < 0)
+      continue;
+    if (!knownProjectKeys.has(configKey.slice(0, dotIndex)))
+      continue;
+    if (!hasFlagConfigPath(obj, configKey))
+      continue;
+    warnUnhonoredKey(configKey, true);
+  }
   return {
     config: {
+      ...toolConfig === undefined ? {} : { tools: toolConfig },
+      ...startup === undefined ? {} : { startup },
       ignore,
       rules,
       ...mutations,