@duckmind/dm-linux-x64 0.65.5 → 0.65.6

package/extensions/dm-lens/clients/runtime-agent-end.js

@@ -12,6 +12,8 @@ import {
 import { logLatency } from "./latency-logger.js";
 import { isPathIgnoredByProject } from "./file-utils.js";
 import { admitBounded, emitBounded } from "./bounded-telemetry.js";
+import { bounded } from "./deadline-utils.js";
+import { HOOK_WALL_BUDGET_MS } from "./hook-budgets.js";
 import {
   newLspMutationCorrelationId
 } from "./lsp-mutation.js";
@@ -33,7 +35,7 @@ import {
   hasSqlfluffConfig,
   hasStylelintConfig
 } from "./tool-policy.js";
-export const DEFERRED_FORMAT_STALE_AFTER_MS = 10 * 60000;
+const DEFERRED_FORMAT_STALE_AFTER_MS = 10 * 60000;
 const DEFERRED_FORMAT_CONCURRENCY = 3;
 function recordProjectChange(args) {
   args.runtime.recordProjectMutation?.({
@@ -44,6 +46,7 @@ function recordProjectChange(args) {
   });
 }
 export async function handleAgentEnd({
+  signal,
   ctxCwd,
   getFlag,
   getFlagSource,
@@ -60,6 +63,7 @@ export async function handleAgentEnd({
 }) {
   const { claimed, staleClaimed, deferredToOwner, droppedOrphans } = runtime.claimDeferredMutations(currentSessionId, Date.now(), staleAfterMs, ctxCwd ?? runtime.projectRoot);
   const records = [...claimed, ...staleClaimed];
+  const scheduledTurnId = records[0]?.queuedTurnId;
   const requeuedKinds = new Set;
   const requeue = (pending, reason) => {
     if (pending.length === 0)
@@ -79,6 +83,7 @@ export async function handleAgentEnd({
       toolName: "agent_end",
       filePath: ctxCwd ?? runtime.projectRoot,
       phase: "agent_end_deferred_mutation_requeue",
+      turnId: pending[0]?.queuedTurnId,
       durationMs: 0,
       metadata: {
         reason,
@@ -136,6 +141,7 @@ export async function handleAgentEnd({
       toolName: "agent_end",
       filePath: ctxCwd ?? runtime.projectRoot,
       phase: "agent_end_deferred_format_stale_claim",
+      turnId: scheduledTurnId,
       durationMs: 0,
       metadata: {
         fileCount: staleClaimed.length,
@@ -161,7 +167,7 @@ export async function handleAgentEnd({
   const deferredFormatFixes = [];
   const deferredAutofixFixes = [];
   const deferredAutofixChanged = new Set;
-  const ambientSignal = getAmbientAbortSignal();
+  const ambientSignal = signal ?? getAmbientAbortSignal();
   const executedAutofixScopes = new Set;
   const autofixRecords = records.filter((candidate) => candidate.kinds.has("autofix"));
   if (autofixRecords.length > 0 && (!biomeClient || !ruffClient) && getAutofixClients) {
@@ -263,6 +269,7 @@ export async function handleAgentEnd({
     toolName: "agent_end",
     filePath: ctxCwd ?? runtime.projectRoot,
     phase: "agent_end_deferred_format_start",
+    turnId: scheduledTurnId,
     durationMs: 0,
     metadata: {
       fileCount: records.length,
@@ -311,7 +318,13 @@ export async function handleAgentEnd({
         const filePath = path.resolve(record.filePath);
         started.add(index);
         if (!nodeFs.existsSync(filePath)) {
-          work[index] = { record, filePath, fileStart, missing: true };
+          work[index] = {
+            record,
+            filePath,
+            fileStart,
+            result: undefined,
+            missing: true
+          };
           continue;
         }
         try {
@@ -319,13 +332,19 @@ export async function handleAgentEnd({
             record,
             filePath,
             fileStart,
-            result: await runFormatPhase(filePath, getFormatService, dbg)
+            result: await bounded(runFormatPhase(filePath, getFormatService, dbg, ambientSignal, 30000, "agent_settled"), {
+              ms: HOOK_WALL_BUDGET_MS.agent_settled,
+              signal: ambientSignal,
+              hook: "agent_settled",
+              label: "deferred-format"
+            })
           };
         } catch (err) {
           work[index] = {
             record,
             filePath,
             fileStart,
+            result: undefined,
             error: err instanceof Error ? err.message : String(err)
           };
         }
@@ -364,8 +383,20 @@ export async function handleAgentEnd({
         continue;
       }
       const result = entry.result;
-      if (!result)
+      if (!result) {
+        if (ambientSignal?.aborted)
+          continue;
+        const reason = entry.error ?? "deferred formatter exceeded agent_settled budget";
+        summary.failed.push({ filePath, errors: [reason] });
+        requeue([
+          {
+            ...record,
+            kinds: new Set(["format"]),
+            toolNames: new Set(record.toolNames)
+          }
+        ], "format-failed");
         continue;
+      }
       summary.formatted++;
       if (result.formatFailures.length > 0) {
         summary.failed.push({ filePath, errors: result.formatFailures });
@@ -426,6 +457,7 @@ export async function handleAgentEnd({
         toolName: "agent_end",
         filePath,
         phase: "deferred_format_file",
+        turnId: record.queuedTurnId,
         durationMs: Date.now() - fileStart,
         metadata: {
           changed: result.formatChanged,
@@ -540,6 +572,7 @@ export async function handleAgentEnd({
           toolName: "agent_end",
           filePath: ctxCwd ?? runtime.projectRoot,
           phase: "actionable_warnings_autofix",
+          turnId: scheduledTurnId,
           durationMs: Date.now() - fixStart,
           metadata: {
             considered: fixSummary.considered,
@@ -561,6 +594,7 @@ export async function handleAgentEnd({
     toolName: "agent_end",
     filePath: ctxCwd ?? runtime.projectRoot,
     phase: "agent_end_deferred_mutation_drain",
+    turnId: scheduledTurnId,
     durationMs: Date.now() - startedAt,
     metadata: {
       autofixRecords: autofixRecords.length,
@@ -575,6 +609,7 @@ export async function handleAgentEnd({
     filePath: ctxCwd ?? runtime.projectRoot,
     durationMs: Date.now() - startedAt,
     result: "deferred_format_complete",
+    turnId: scheduledTurnId,
     metadata: {
       queued: summary.queued,
       formatted: summary.formatted,
@@ -589,6 +624,7 @@ export async function handleAgentEnd({
     toolName: "agent_end",
     filePath: ctxCwd ?? runtime.projectRoot,
     phase: "agent_end_deferred_format_done",
+    turnId: scheduledTurnId,
     durationMs: Date.now() - startedAt,
     metadata: {
       formatted: summary.formatted,

package/extensions/dm-lens/clients/runtime-context.js

@@ -3,6 +3,9 @@ import {
   validateAdvisoryProvenance
 } from "./advisory-provenance.js";
 import { logLatency } from "./latency-logger.js";
+import {
+  translateGuidanceToolNames
+} from "./tool-config.js";
 export const AUTOMATION_FRAMING = "[dm-lens automated check — not a user request] ";
 const MAX_LOGGED_REASONS = 8;
 function boundedReasons(reasons) {
@@ -139,7 +142,7 @@ export function acknowledgeTestFindings(cacheManager, cwd) {
     return;
   retireTestFindings(cacheManager, cwd);
 }
-export function consumeSessionStartGuidance(cacheManager, cwd) {
+export function consumeSessionStartGuidance(cacheManager, cwd, host = "pi") {
   const guidance = cacheManager.readCache("session-start-guidance", cwd);
   if (!guidance?.data?.content)
     return;
@@ -150,7 +153,7 @@ export function consumeSessionStartGuidance(cacheManager, cwd) {
         role: "user",
         content: `[dm-lens automated context — not a user request]
 
-${guidance.data.content}`
+${translateGuidanceToolNames(guidance.data.content, host)}`
       }
     ]
   };

package/extensions/dm-lens/clients/runtime-coordinator.js

@@ -13,6 +13,9 @@ import { ReadGuard } from "./read-guard.js";
 import { RUNTIME_CONFIG } from "./runtime-config.js";
 import { TurnSummaryCollector } from "./turn-summary.js";
 import { deriveProviderFromModelId } from "./model-provider.js";
+import { beginTurnContext, setTurnContextSession } from "./turn-context.js";
+import { recordDegradationOnce } from "./degradation-ledger.js";
+export const MAX_PENDING_CASCADE_RUNS = 32;
 const MAX_MUTATION_RECEIPTS = 512;
 const TOOL_CALL_ATTRIBUTION_CAPACITY = 256;
 const TOOL_CALL_ATTRIBUTION_TTL_MS = 5 * 60000;
@@ -130,15 +133,28 @@ export class RuntimeCoordinator {
     this._cascadeSessionStats.diagnosticsSurfaced += diagnosticsSurfaced;
     this._cascadeSessionStats.coldSnapshotTouches += coldSnapshotTouches;
   }
+  applyInlineBlockerPolicyVerdicts(suppressedFilePaths) {
+    const suppressed = new Set(suppressedFilePaths.map((filePath) => path.resolve(filePath)));
+    let changed = 0;
+    for (const [key, entry] of this._pendingInlineBlockers.entries()) {
+      const policySuppressed = suppressed.has(path.resolve(entry.filePath));
+      if (!!entry.policySuppressed === policySuppressed)
+        continue;
+      this._pendingInlineBlockers.set(key, { ...entry, policySuppressed });
+      changed += 1;
+    }
+    return changed;
+  }
   updateGitGuardStatus(hasBlockers, output) {
-    this._gitGuardHasBlockers = hasBlockers || this.getInlineBlockersSnapshot().length > 0;
+    const blocking = this.getInlineBlockersSnapshot().filter((entry) => !entry.policySuppressed);
+    this._gitGuardHasBlockers = hasBlockers || blocking.length > 0;
     if (!this._gitGuardHasBlockers) {
       this._gitGuardSummary = "";
       return;
     }
     const firstLine = output.split(`
 `).map((line) => line.trim()).find((line) => line.length > 0);
-    const summaries = this.getInlineBlockersSnapshot().map((entry) => entry.summary.trim()).filter(Boolean);
+    const summaries = blocking.map((entry) => entry.summary.trim()).filter(Boolean);
     this._gitGuardSummary = (summaries[0] ?? firstLine ?? "Unresolved blockers detected").slice(0, 160);
   }
   get gitGuardHasBlockers() {
@@ -175,6 +191,7 @@ export class RuntimeCoordinator {
     this._codeQualityWarningsThisTurn.clear();
     this._turnStartProjectSeq = this._projectSeq;
     this._turnIndex += 1;
+    beginTurnContext(this._telemetrySessionId);
     this._writeIndex = 0;
     this._reportedThisTurn.clear();
     this._writtenThisTurn.clear();
@@ -241,6 +258,7 @@ export class RuntimeCoordinator {
   setTelemetryIdentity(identity) {
     if (identity.sessionId && identity.sessionId.trim()) {
       this._telemetrySessionId = identity.sessionId.trim();
+      setTurnContextSession(this._telemetrySessionId);
     }
     const model = identity.model?.trim();
     const provider = identity.provider?.trim();
@@ -383,7 +401,16 @@ export class RuntimeCoordinator {
     this._cascadeRuns.push(run);
   }
   appendCascadePromise(p) {
-    this._pendingCascadeRuns.push(p);
+    if (this._pendingCascadeRuns.length < MAX_PENDING_CASCADE_RUNS) {
+      this._pendingCascadeRuns.push(p);
+      return;
+    }
+    recordDegradationOnce({
+      kind: "cascade-pending-cap",
+      subject: "runtime-coordinator",
+      reason: `deferred cascade admission capped at ${MAX_PENDING_CASCADE_RUNS}`
+    });
+    p.then((run) => this.appendCascadeRun(run)).catch(() => {});
   }
   getTurnEndCascadeSettleStart() {
     let latest;
@@ -443,16 +470,23 @@ export class RuntimeCoordinator {
   hasCascadeRuns() {
     return this._cascadeRuns.length > 0;
   }
-  recordInlineBlockers(filePath, summary, writeIndex, sources, lines) {
+  recordInlineBlockers(filePath, summary, writeIndex, sources, lines, contentBaseline, diagnostics) {
+    const recordedAtMs = Date.now();
     this._pendingInlineBlockers.set(path.resolve(filePath), {
       filePath,
       summary,
       writeIndex,
       sources,
       lines,
-      recordedAtMs: Date.now(),
-      stale: false
+      diagnostics,
+      recordedAtMs,
+      stale: false,
+      ...contentBaseline ? {
+        recordedSize: contentBaseline.size,
+        recordedHash: contentBaseline.sha256
+      } : {}
     });
+    return recordedAtMs;
   }
   clearInlineBlockers(filePath) {
     this._pendingInlineBlockers.delete(path.resolve(filePath));
@@ -486,6 +520,24 @@ export class RuntimeCoordinator {
     });
     return true;
   }
+  setInlineBlockerSelfDriftStale(filePath, isSelfDrift) {
+    const key = path.resolve(filePath);
+    const existing = this._pendingInlineBlockers.get(key);
+    if (!existing)
+      return false;
+    if (existing.stale && existing.staleReason !== "self-drift")
+      return false;
+    const currentlySelfDrift = !!existing.stale && existing.staleReason === "self-drift";
+    if (currentlySelfDrift === isSelfDrift)
+      return false;
+    const { staleReason: _cleared, ...rest } = existing;
+    this._pendingInlineBlockers.set(key, {
+      ...rest,
+      stale: isSelfDrift,
+      ...isSelfDrift ? { staleReason: "self-drift" } : {}
+    });
+    return true;
+  }
   retireDemotedPastEofBlocker(filePath, deadLines) {
     if (deadLines.length === 0)
       return false;
@@ -645,6 +697,7 @@ export class RuntimeCoordinator {
       existing.toolNames.add(toolName);
       existing.kinds.add(kind);
       existing.queuedTurnIndex = this._turnIndex;
+      existing.queuedTurnId = `${this._telemetrySessionId}:${this._turnIndex}`;
       existing.ownerSessionId = ownerSessionId;
       existing.originCwd = resolvedOriginCwd;
       return addedKind;
@@ -658,6 +711,7 @@ export class RuntimeCoordinator {
       toolNames: new Set([toolName]),
       kinds: new Set([kind]),
       queuedTurnIndex: this._turnIndex,
+      queuedTurnId: `${this._telemetrySessionId}:${this._turnIndex}`,
       ownerSessionId,
       originCwd: resolvedOriginCwd
     });

package/extensions/dm-lens/clients/runtime-session.js

@@ -7,6 +7,7 @@ import { deadCodeIssueCount } from "./dead-code-client.js";
 import { logDeadCodeScan } from "./dead-code-logger.js";
 import {
   incrementDegradationCount,
+  recordDegradationOnce,
   resetDegradationLedger
 } from "./degradation-ledger.js";
 import { getDiagnosticTracker } from "./diagnostic-tracker.js";
@@ -18,9 +19,11 @@ import { resetObservedRunnerLatency } from "./dispatch/collect-later-tier.js";
 import { resetPendingRunnerFindings } from "./dispatch/pending-runner-findings.js";
 import { clearAllSessions as clearFileTimeSessions } from "./file-time.js";
 import {
+  drainProjectDataDirMigrations,
   getGlobalDmLensDir,
   getKnipIgnorePatterns,
-  getProjectDataDir
+  getProjectDataDir,
+  resetProjectDataDirSessionState
 } from "./file-utils.js";
 import { GitleaksClient } from "./gitleaks-client.js";
 import { resetGoAvailability } from "./go-client.js";
@@ -82,6 +85,7 @@ import {
   formatSmellsSessionStartLine,
   resetSmellsSessionState
 } from "./smells-rollup.js";
+import { resetSituationalToolTelemetry } from "./situational-tool-telemetry.js";
 import {
   findNearestProjectRoot,
   getStartupScanMaxEntries,
@@ -210,11 +214,14 @@ function logProjectSnapshotProbe(args) {
     args.dbg(`project_snapshot: miss reason=${args.missReason}`);
   }
 }
-function resolveStartupMode() {
+function resolveStartupMode(projectConfig, globalConfig) {
   const envMode = (process.env.DM_LENS_STARTUP_MODE ?? "").trim().toLowerCase();
   if (envMode === "full" || envMode === "minimal" || envMode === "quick") {
     return envMode;
   }
+  const configMode = projectConfig?.startup?.mode ?? globalConfig?.startup?.mode;
+  if (configMode)
+    return configMode;
   if (isPrintMode()) {
     return "quick";
   }
@@ -610,6 +617,15 @@ function scheduleStartupScansWithClients(deps, runtime, sessionGeneration, analy
     astGrepClient,
     depChecker
   } = deps;
+  const analyzerEnabled = (flag) => !deps.getFlag(flag);
+  if (!analyzerEnabled("no-complexity")) {
+    dbg("session_start complexity: skipped (disabled by config)");
+    recordDegradationOnce({
+      kind: "startup-analyzer-disabled",
+      subject: "complexity",
+      reason: "skipped (disabled by config)"
+    });
+  }
   const taskDeferMsByName = {
     "call-graph": 5000,
     "codebase-model": 5200,
@@ -666,6 +682,16 @@ function scheduleStartupScansWithClients(deps, runtime, sessionGeneration, analy
   const isSubagent = isSubagentSession();
   const skipHeavyweightScans = isSlowFs(analysisRoot) || isSubagent;
   const runHeavyweightTask = (name, task) => {
+    const flag = `no-${name}`;
+    if (name !== "opengrep" && name !== "trivy" && !analyzerEnabled(flag)) {
+      dbg(`session_start ${name}: skipped (disabled by config)`);
+      recordDegradationOnce({
+        kind: "startup-analyzer-disabled",
+        subject: name,
+        reason: "skipped (disabled by config)"
+      });
+      return;
+    }
     if (skipHeavyweightScans)
       return;
     runTask(name, task);
@@ -1032,14 +1058,14 @@ function scheduleDeferredToolProbesWithClients(deps, languageProfile, startupDef
 export const SESSION_START_GUIDANCE = [
   `\uD83D\uDCCC dm-lens active — automated checks run on every edit/write; blocking errors (including pre-existing) show inline and must be fixed.
 ` + `Key tools (see each tool's own description for args):
-` + `• lens_diagnostics — session-wide diagnostic state; mode=all resurfaces stale blocking errors that dropped from turn context.
+` + `• lens_diagnostics — source=session reads cache; empty cache ≠ clean; use source=lsp scope=paths for changed files with absent or stale findings (aggregate hosts: lens(action=diagnostics)).
 ` + `• symbol_search → module_report → read_symbol/read_enclosing — ranked identifier search, then navigable outline/callback handles + exact body reads; cheaper than reading a whole file before editing.
-` + `• lsp_diagnostics — probe LSP for errors in a file/folder/workspace.
-` + "• Situational (activate via dm_lens_activate_tools): lsp_navigation, ast_grep_search, ast_grep_replace, ast_grep_dump."
+` + "• Situational (activate via dm_lens_activate_tools): lsp_navigation, ast_grep_search, ast_grep_replace. Use ast_grep_search with dump=true to inspect AST nodes."
 ];
 export async function handleSessionStart(deps) {
   resetDegradationLedger();
   resetAnalyzerBootstrapSessionState();
+  resetProjectDataDirSessionState();
   resetTestRunnerDelivery();
   resetLspMutationNoBridgeDbgLatch();
   resetBoundedTelemetry();
@@ -1057,10 +1083,10 @@ export async function handleSessionStart(deps) {
       metadata: { reason: deps.sessionReason }
     });
   }
-  let startupMode = resolveStartupMode();
+  let startupMode = resolveStartupMode(deps.projectConfig, deps.globalConfig);
   const processGlobals = globalThis;
   const isFirstSessionOfProcess = !processGlobals.__piLensFirstSessionDone;
-  if (isFirstSessionOfProcess && process.env.DM_LENS_COLD_START_QUICK !== "0" && !process.env.DM_LENS_STARTUP_MODE) {
+  if (isFirstSessionOfProcess && process.env.DM_LENS_COLD_START_QUICK !== "0" && !process.env.DM_LENS_STARTUP_MODE && !deps.projectConfig?.startup?.mode && !deps.globalConfig?.startup?.mode) {
     startupMode = deps.startupModeOverride ?? "quick";
   }
   processGlobals.__piLensFirstSessionDone = true;
@@ -1240,6 +1266,7 @@ export async function handleSessionStart(deps) {
   _resetPackageManagerCache();
   resetManagedToolRefreshSession();
   resetSmellsSessionState();
+  resetSituationalToolTelemetry();
   resetWorkspaceDiagnosticsCacheSession(sessionStartMs);
   deps.bootstrap.peek()?.knipClient.resetSessionState?.();
   resetCascadeTierSessionState();
@@ -1285,6 +1312,15 @@ export async function handleSessionStart(deps) {
   const hasWorkspaceCwd = typeof ctxCwd === "string" && ctxCwd.length > 0;
   const cwd = ctxCwd ?? process.cwd();
   const projectDataDir = getProjectDataDir(cwd);
+  for (const migration of drainProjectDataDirMigrations()) {
+    const targetName = path.basename(migration.to);
+    const hash = targetName.match(/([0-9a-f]{8})$/)?.[1] ?? "unknown";
+    recordDegradationOnce({
+      kind: "data_dir_migrated",
+      subject: hash,
+      reason: migration.outcome === "renamed" ? "using hashed directory after renaming legacy directory" : migration.outcome === "coexisting" ? "using hashed directory because legacy and hashed directories both exist" : migration.outcome === "rename-failed" ? "using legacy directory after hashed-directory rename failure" : "using resolved directory after realpath fallback"
+    });
+  }
   const globalDir = getGlobalDmLensDir();
   sweepAtomicWriteStages([
     projectDataDir,
@@ -1585,7 +1621,8 @@ export async function handleSessionStart(deps) {
   } else {
     dbg("session_start: no language defaults selected for pre-install");
   }
-  const startupScansWillRun = allowBootstrapTasks && startupScan.canWarmCaches;
+  const startupScansEnabled = deps.projectConfig?.startup?.scans?.enabled ?? deps.globalConfig?.startup?.scans?.enabled ?? true;
+  const startupScansWillRun = allowBootstrapTasks && startupScan.canWarmCaches && startupScansEnabled;
   const jstsHeavyScansWillRun = startupScansWillRun && canRunStartupHeavyScans(languageProfile, "jsts");
   if (allowBootstrapTasks) {
     scheduleDeferredToolProbes(deps, languageProfile, startupDefaults, jstsHeavyScansWillRun, dbg);
@@ -1630,6 +1667,13 @@ export async function handleSessionStart(deps) {
 `) }, analysisRoot);
   if (!allowBootstrapTasks) {
     dbg("session_start: skipping startup background scans (startup mode)");
+  } else if (!startupScansEnabled) {
+    dbg("session_start: skipping startup background scans (disabled by config)");
+    recordDegradationOnce({
+      kind: "startup-analyzer-disabled",
+      subject: "startup-scans",
+      reason: "skipped (disabled by config)"
+    });
   } else if (!startupScan.canWarmCaches) {
     dbg(`session_start: skipping heavy scans (${startupScan.reason ?? "unknown"})`);
     dbg(`session_start: skipping TODO scan (${startupScan.reason ?? "unknown"})`);

package/extensions/dm-lens/clients/runtime-tool-call.js

@@ -1,7 +1,6 @@
 import * as nodeFs from "node:fs";
 import * as path from "node:path";
 import { loadBootstrapClients, requestBootstrapClients } from "./bootstrap.js";
-import { getAmbientAbortSignal } from "./safe-spawn.js";
 import { recordDegradationOnce } from "./degradation-ledger.js";
 import { detectFileKind } from "./file-kinds.js";
 import { isPathIgnoredByProject } from "./file-utils.js";
@@ -9,7 +8,7 @@ import { evaluateGitGuard, isGitCommitOrPushAttempt } from "./git-guard.js";
 import { dropHashlineAnchorMemo } from "./hashline-anchor.js";
 import { evaluateSharedCheckoutGuard } from "./shared-checkout-guard.js";
 import { logLatency } from "./latency-logger.js";
-import { normalizeMapKey } from "./path-utils.js";
+import { normalizeMapKey, toPosix } from "./path-utils.js";
 import {
   captureFileStats,
   getOpaqueBaselineStore,
@@ -127,7 +126,7 @@ function isLspCapableFile(filePath) {
   return LANGUAGE_POLICY[kind]?.lspCapable !== false;
 }
 function shouldSkipLspAutoTouch(filePath, projectRoot) {
-  const normalized = path.resolve(filePath).replace(/\\/g, "/").toLowerCase();
+  const normalized = toPosix(path.resolve(filePath)).toLowerCase();
   const base = path.basename(filePath).toLowerCase();
   if (normalized.includes("/.dm-lens/"))
     return true;
@@ -328,7 +327,7 @@ async function handleToolCallImpl(deps) {
     }
   }
   if (getFlag("lens-guard") && isGitCommitOrPushAttempt(toolName, event.input)) {
-    const guard = evaluateGitGuard(runtime, cacheManager, ctx.cwd ?? runtime.projectRoot);
+    const guard = evaluateGitGuard(runtime, cacheManager, ctx.cwd ?? runtime.projectRoot, ctx.host ?? "pi");
     if (guard.block) {
       return {
         block: true,
@@ -446,7 +445,6 @@ async function handleToolCallImpl(deps) {
   const requestedReadLimit = readInput?.limit;
   let effectiveReadOffset = requestedReadOffset;
   let effectiveReadLimit = getEffectiveReadLimit(filePath, readInput);
-  let expandedByLsp = false;
   let enclosingSymbol;
   const readExpansionClient = toolName === "read" && !getFlag("no-lsp") && !isExternalOrVendor && filePath && readInput && requestedReadLimit != null && requestedReadLimit <= EXPANSION_LIMIT_LINES ? getTreeSitterClient() : null;
   if (readExpansionClient && filePath && readInput && requestedReadLimit != null) {
@@ -458,7 +456,6 @@ async function handleToolCallImpl(deps) {
         readInput.limit = expansion.newLimit;
         effectiveReadOffset = expansion.newOffset;
         effectiveReadLimit = expansion.newLimit;
-        expandedByLsp = true;
         let enriched = false;
         let enrichedAncestry = expansion.ancestry;
         const lspSymbols = await getOpenDocumentSymbols(filePath);
@@ -523,7 +520,7 @@ async function handleToolCallImpl(deps) {
         isPartial: requestedReadLimit != null && requestedReadLimit < totalLines,
         fileKind: detectFileKind(filePath) ?? "unknown",
         fractionRead: totalLines > 0 ? Math.round(deliveredLimit / totalLines * 100) / 100 : 1,
-        expandedByTs: expandedByLsp
+        expandedByTs: enclosingSymbol !== undefined
       }
     });
     runtime.readGuard.recordRead({
@@ -532,18 +529,22 @@ async function handleToolCallImpl(deps) {
       requestedLimit: requestedReadLimit ?? deliveredLimit,
       effectiveOffset: effectiveReadOffset,
       effectiveLimit: deliveredLimit,
-      expandedByLsp,
-      enclosingSymbol,
+      expandedByLsp: enclosingSymbol !== undefined,
+      ...enclosingSymbol !== undefined && { enclosingSymbol },
       turnIndex: runtime.turnIndex,
       writeIndex: runtime.peekWriteIndex(),
-      timestamp: Date.now()
+      timestamp: Date.now(),
+      provisional: true,
+      ...resolveToolCallCorrelationId(event) !== undefined && {
+        source: `native-read:${resolveToolCallCorrelationId(event)}:provisional`
+      }
     });
   }
-  if (!isExternalOrVendor && filePath && !runtime.complexityBaselines.has(filePath) && isComplexitySupportedFile(filePath)) {
+  if (!getFlag("no-complexity") && !isExternalOrVendor && filePath && !runtime.complexityBaselines.has(filePath) && isComplexitySupportedFile(filePath)) {
     const complexityClient = (await requestBootstrapClients({
       reason: "tool-call-complexity-baseline",
       hook: "tool_call",
-      signal: getAmbientAbortSignal()
+      signal: deps.ctx.signal
     }))?.complexityClient;
     const baseline = await complexityClient?.analyzeFile(filePath);
     if (baseline) {
@@ -558,10 +559,16 @@ async function handleToolCallImpl(deps) {
         entropy: baseline.codeEntropy
       });
     }
+  } else if (getFlag("no-complexity") && filePath && isComplexitySupportedFile(filePath)) {
+    recordDegradationOnce({
+      kind: "startup-analyzer-disabled",
+      subject: "complexity",
+      reason: "skipped (disabled by config)"
+    });
   }
   const isEditOnly = mutation?.kind === "edit";
   const isWriteOrEdit = mutation !== undefined;
-  if (!isEditOnly && isWriteOrEdit && filePath && !getFlag("no-read-guard")) {
+  if (!isEditOnly && isWriteOrEdit && event.toolName !== "bash" && filePath && !getFlag("no-read-guard")) {
     runtime.readGuard.noteCreatedFile(filePath, runtime.turnIndex, runtime.peekWriteIndex());
   }
   if (isEditOnly && filePath) {
@@ -683,7 +690,11 @@ async function handleToolCallImpl(deps) {
     for (const entry of correctedOldTexts) {
       if (entry.indentationOnly && entry.currentMatchCount === 0 && entry.correctedMatchCount === 1) {
         entry.apply(entry.corrected);
-        const correctedNewText = entry.newText ? retargetReplacementIndentation(entry.newText, entry.value, entry.corrected) : undefined;
+        const matchedRange = matchNormalizedContent !== undefined ? findUniqueMatchLineRange(matchNormalizedContent, entry.corrected) : undefined;
+        const correctedNewText = entry.newText ? retargetReplacementIndentation(entry.newText, entry.value, entry.corrected, matchNormalizedContent !== undefined && matchedRange ? {
+          content: matchNormalizedContent,
+          startLine: matchedRange.startLine
+        } : undefined) : undefined;
         if (correctedNewText !== undefined) {
           entry.applyNewText(correctedNewText);
         }
@@ -699,7 +710,7 @@ async function handleToolCallImpl(deps) {
           }
         });
         if (matchNormalizedContent !== undefined && runtime.readGuard) {
-          const range = findUniqueMatchLineRange(matchNormalizedContent, entry.corrected);
+          const range = matchedRange;
           if (range) {
             runtime.readGuard.recordRead({
               filePath,
@@ -748,6 +759,7 @@ async function handleToolCallImpl(deps) {
                   agentBehaviorClient
                 } = await loadBootstrapClients();
                 const result = await handleToolResult({
+                  signal: deps.ctx.signal,
                   event: {
                     toolName: "write",
                     input: { path: filePath },