@herbertgao/pi-extensions 2026.10.1 → 2026.10.3

package/node_modules/pi-lens/dist/clients/diagnostics-publish.js

@@ -1,230 +0,0 @@
-/**
- * Publishes `pilens:diagnostics` on pi's shared `pi.events` bus (#502).
- *
- * Sibling to `clients/bus-publish.ts` (the #482 `pilens:files:touched`
- * producer) rather than a new export crammed into that file: the two events
- * share the emit plumbing (`wireBusEmitter`) and the `PI_LENS_BUS_PUBLISH`
- * kill switch, but this producer owns its OWN piece of module state (the
- * previously-reported-paths set for clean-transition tracking, the seq
- * counter) that has nothing to do with files-touched.
- *
- * ## CONSUMER CONTRACT — staleness / replace semantics (2026-07-11 design, #502)
- *
- * Diagnostics are STATE; bus events are point-in-time snapshots of a slice of
- * that state. To guarantee a consumer can always reconstruct the latest
- * known picture from the event stream alone, this producer follows LSP
- * `publishDiagnostics` semantics:
- *
- * 1. **Full-replace per file, never a delta.** Every event carries the
- *    COMPLETE current diagnostic set for each file it mentions. An event
- *    mentioning path P replaces everything a consumer previously held for P
- *    — never merge/append across events for the same path.
- * 2. **Empty array = explicitly clean.** When a previously-reported file's
- *    diagnostics clear, this producer emits `{path, diagnostics: []}` for it
- *    exactly once, on the transition. Silence never means clean (the #240
- *    doctrine, applied here on the producer side) — a consumer that stops
- *    hearing about a path has learned NOTHING about its current state.
- * 3. **Monotonic `seq` + `ts` per emission.** `seq` increments once per
- *    `publishDiagnostics` call (module-level counter, process-lifetime
- *    monotonic — never reset except in tests). Out-of-order receipt resolves
- *    deterministically: higher `seq` always wins, lower is discarded.
- * 4. **`pilens:files:touched` (#482) is an INVALIDATION HINT, not new data.**
- *    Between an edit landing (a files:touched event) and the next
- *    diagnostics batch for that path, a consumer's previously-held
- *    diagnostics for that path are PROVISIONAL — the file has changed on
- *    disk but pi-lens hasn't re-analyzed it yet. Consumers that want to
- *    avoid rendering stale annotations across that window should treat a
- *    files:touched path as "diagnostics pending" until the next
- *    pilens:diagnostics event mentions it (at any seq).
- *
- * Late-joiners are a non-problem in-process: extensions activate at
- * `session_start`, before any turn emits, so v1 is push-only (no
- * request/replay). #478's future `pilens:rpc:diagnostics` pull API reuses
- * this exact `PilensDiagnosticsPayload` shape verbatim — push and pull are
- * two deliveries of the same schema over the same lens-engine seam; #478
- * stays separately gated on #449 registry dogfooding.
- *
- * ## Emission seam
- *
- * `publishDiagnostics` is called once per write batch immediately after
- * `recordDiagnostics` (clients/widget-state.ts) commits the FINAL per-file
- * diagnostic set for that batch — i.e. after format, autofix, and dispatch
- * have all run (see pipeline.ts's phase order). This guarantees the emitted
- * event reflects post-batch latest state, not an intermediate runner result:
- * widget-state's `allDiagnostics` store is exactly what `recordDiagnostics`
- * just wrote, so reading it back at the same call site can't race a later
- * write in the same batch.
- *
- * Versioning policy: frozen-additive, same discipline as #482. New optional
- * fields may be added under `v: 1`; a breaking change to an existing field's
- * meaning must bump `v`.
- */
-import { logBusEvent } from "./bus-events-logger.js";
-import { normalizeFilePath } from "./path-utils.js";
-import { createLiveBusEmitter, recordStaleBusFailure, resolveLiveBusEmitter, } from "./live-bus-emitter.js";
-import { isBusPublishEnabled } from "./bus-publish.js";
-export const BUS_DIAGNOSTICS_EVENT = "pilens:diagnostics";
-export const BUS_DIAGNOSTICS_VERSION = 1;
-/** Max diagnostics carried per file per event — aligned with the widget's own per-file storage cap (`MAX_STORED_DIAGNOSTICS_PER_FILE`, clients/widget-state.ts). */
-export const MAX_DIAGNOSTICS_PER_FILE_EVENT = 12;
-const liveEmitter = createLiveBusEmitter();
-let hasLoggedFailure = false;
-let hasLoggedUnwired = false;
-let hasLoggedDisabled = false;
-let seqCounter = 0;
-/** Paths this producer has reported with at least one non-empty diagnostics array, so we know when to fire the one-time clean-transition event. */
-const reportedDirtyPaths = new Set();
-/**
- * Wire the emit function from pi's `pi.events` bus. Called once at extension
- * factory time from index.ts, same call as `wireBusEmitter` (#482) — both
- * producers share the identical `pi.events.emit` binding.
- */
-export function wireDiagnosticsBusEmitter(emitFn) {
-    liveEmitter.wire(emitFn);
-}
-export function wireDiagnosticsBusEmitterGetter(getter) {
-    liveEmitter.wireGetter(getter);
-}
-/** Test-only: reset module state between test files. */
-export function _resetDiagnosticsPublishForTests() {
-    liveEmitter.reset();
-    hasLoggedFailure = false;
-    hasLoggedUnwired = false;
-    hasLoggedDisabled = false;
-    seqCounter = 0;
-    reportedDirtyPaths.clear();
-}
-function capDiagnostics(diagnostics) {
-    if (diagnostics.length <= MAX_DIAGNOSTICS_PER_FILE_EVENT) {
-        return { capped: diagnostics, truncated: false };
-    }
-    // Prioritize errors first (same "blockers first" spirit as the widget cap).
-    const errors = diagnostics.filter((d) => d.severity === "error");
-    const rest = diagnostics.filter((d) => d.severity !== "error");
-    if (errors.length >= MAX_DIAGNOSTICS_PER_FILE_EVENT) {
-        return {
-            capped: errors.slice(0, MAX_DIAGNOSTICS_PER_FILE_EVENT),
-            truncated: true,
-        };
-    }
-    return {
-        capped: [
-            ...errors,
-            ...rest.slice(0, MAX_DIAGNOSTICS_PER_FILE_EVENT - errors.length),
-        ],
-        truncated: true,
-    };
-}
-/**
- * Publish one `pilens:diagnostics` event for a write batch's final
- * per-file diagnostic state. Fire-and-forget: never throws, never awaited.
- *
- * Full-replace semantics (see module doc): each `files` entry here is
- * treated as the COMPLETE current set for that path. Additionally, for
- * every path in `reportedDirtyPaths` that is NOT present in this call's
- * `files` list but has gone clean via a prior call in THIS same invocation,
- * callers must pass an explicit `{path, diagnostics: []}` entry — this
- * function does not infer clean transitions for paths it isn't told about.
- * The one caller (the pipeline write-batch seam) always passes the
- * single file it just analyzed, so the common clean-transition path is:
- * dispatch returns zero diagnostics for a file this producer previously
- * reported dirty -> caller passes `{path, diagnostics: []}` -> emitted once,
- * `reportedDirtyPaths` drops the path so a SECOND clean run of the same file
- * does not re-emit (still clean -> silence is fine once the transition
- * itself has been announced).
- */
-export function publishDiagnostics(args) {
-    if (args.origin === "bus")
-        return;
-    if (args.files.length === 0)
-        return;
-    if (!isBusPublishEnabled()) {
-        if (!hasLoggedDisabled) {
-            hasLoggedDisabled = true;
-            logBusEvent({
-                event: BUS_DIAGNOSTICS_EVENT,
-                outcome: "skipped_disabled",
-                cwd: normalizeFilePath(args.cwd),
-            });
-        }
-        return;
-    }
-    const resolution = resolveLiveBusEmitter(liveEmitter, () => ({
-        event: BUS_DIAGNOSTICS_EVENT,
-        cwd: normalizeFilePath(args.cwd),
-    }));
-    if (resolution.outcome === "stale-session")
-        return;
-    if (resolution.outcome === "unwired") {
-        if (!hasLoggedUnwired) {
-            hasLoggedUnwired = true;
-            logBusEvent({
-                event: BUS_DIAGNOSTICS_EVENT,
-                outcome: "skipped_unwired",
-                cwd: normalizeFilePath(args.cwd),
-            });
-        }
-        return;
-    }
-    const busEmit = resolution.emit;
-    try {
-        const fileEntries = args.files.map((f) => {
-            const normPath = normalizeFilePath(f.path);
-            const { capped, truncated } = capDiagnostics(f.diagnostics);
-            if (capped.length > 0) {
-                reportedDirtyPaths.add(normPath);
-            }
-            else {
-                reportedDirtyPaths.delete(normPath);
-            }
-            const entry = {
-                path: normPath,
-                diagnostics: capped,
-            };
-            if (truncated)
-                entry.truncated = true;
-            return entry;
-        });
-        seqCounter += 1;
-        const payload = {
-            v: BUS_DIAGNOSTICS_VERSION,
-            source: "pi-lens",
-            cwd: normalizeFilePath(args.cwd),
-            seq: seqCounter,
-            ts: Date.now(),
-            files: fileEntries,
-        };
-        busEmit(BUS_DIAGNOSTICS_EVENT, payload);
-        hasLoggedFailure = false;
-        logBusEvent({
-            event: BUS_DIAGNOSTICS_EVENT,
-            outcome: "emitted",
-            cwd: payload.cwd,
-            fileCount: payload.files.length,
-            seq: payload.seq,
-        });
-    }
-    catch (err) {
-        logBusEvent({
-            event: BUS_DIAGNOSTICS_EVENT,
-            outcome: "emit_failed",
-            cwd: normalizeFilePath(args.cwd),
-            error: String(err),
-            ctxSource: resolution.ctxSource,
-        });
-        if (!hasLoggedFailure) {
-            hasLoggedFailure = true;
-            recordStaleBusFailure(BUS_DIAGNOSTICS_EVENT, err);
-            args.dbg?.(`diagnostics-publish: pilens:diagnostics emit failed (further failures suppressed): ${err}`);
-        }
-    }
-}
-/**
- * Whether `path` was last reported with a non-empty diagnostic set (i.e. a
- * clean run for it now would be a transition worth emitting `[]` for).
- * Exposed for the pipeline call site to decide whether to include a
- * currently-clean file in the batch it passes to `publishDiagnostics`.
- */
-export function wasPreviouslyReportedDirty(path) {
-    return reportedDirtyPaths.has(normalizeFilePath(path));
-}

package/node_modules/pi-lens/dist/clients/dispatch/ast-grep-catalog.js

@@ -1,65 +0,0 @@
-/**
- * The effective ast-grep rule catalog for a workspace root (#3053).
- *
- * Before this module, `clients/dispatch/runners/ast-grep-napi.ts` (the NAPI
- * runner) and `clients/dispatch/rule-ignores.ts` (the LSP-seam matcher, #3041)
- * each walked `getAstGrepRuleSources(root)` and resolved rule-id precedence
- * independently — two implementations of the same derivation. They had
- * already drifted once by the time #3053 was filed: #3046 round 2 found the
- * LSP seam claiming an id only when the winning document declared `ignores`,
- * so a project rule that redefines a bundled id with NO `ignores` fired
- * per-edit (the runner) but stayed carved out over LSP (the seam) — the same
- * defect the whole PR existed to remove, just inverted. This module is the
- * one place that walk and that precedence rule now live.
- *
- * Precedence: sources are walked in `getAstGrepRuleSources`'s order (project
- * primary, project secondary, bundled primary, bundled secondary), each
- * loaded with the same loader the runner always used (`loadYamlRulesFresh`
- * for mutable project trees, `loadYamlRules`'s mtime-cached path for
- * immutable bundled catalogs). The FIRST rule sighted for an id — scanning
- * sources in order, and each source's own rules in file order — claims it;
- * no later document for the same id is ever consulted.
- *
- * Deliberately does NOT special-case an id that recurs WITHIN one source's
- * own rule list. That is `duplicateRuleIds` in ast-grep-napi.ts, a
- * runner-only concern layered on top of this catalog's plain result: the
- * runner drops such an id entirely (one Duplicate-rule-id diagnostic, no
- * rule fires for it), but `materializeMergedRuleDir` (clients/sgconfig.ts) —
- * what ast-grep's own LSP binary actually runs — keeps every document an
- * EARLIER source hasn't already claimed, so both copies of a within-source
- * duplicate still survive into what ast-grep publishes over LSP. Baking the
- * runner's drop into this catalog would leave those published findings with
- * no registered `ignores` at all, silently unsuppressed — reopening #3041 for
- * that id (#3046 round 2 F7). So the catalog resolves a within-source
- * duplicate to its first-sighted document like any other collision, and it
- * is each consumer's job to decide what a within-source duplicate means for
- * it — the runner still computes `duplicateRuleIds` itself and skips those
- * ids before ever consulting this catalog's answer for them.
- */
-import { getAstGrepRuleSources } from "../sgconfig.js";
-import { loadYamlRules, loadYamlRulesFresh, } from "./runners/yaml-rule-parser.js";
-/**
- * Build the effective ast-grep catalog for `root`. See the module docstring
- * for the precedence rule and the within-source-duplicate decision.
- *
- * No try/catch around either loader: every I/O path inside them already
- * swallows its own failure (missing dir, unreadable readdir, unreadable file
- * all yield an empty list — `yaml-rule-parser.ts`'s `findYamlRuleFiles` and
- * `loadYamlRuleFiles`), so a catch here would be a guard no mutation can red.
- */
-export function buildEffectiveAstGrepCatalog(root) {
-    const sources = [];
-    const effectiveRules = new Map();
-    for (const source of getAstGrepRuleSources(root)) {
-        const rules = source.origin === "project"
-            ? loadYamlRulesFresh(source.dir)
-            : loadYamlRules(source.dir);
-        sources.push({ source, rules });
-        for (const rule of rules) {
-            if (effectiveRules.has(rule.id))
-                continue;
-            effectiveRules.set(rule.id, { rule, source });
-        }
-    }
-    return { sources, effectiveRules };
-}

package/node_modules/pi-lens/dist/clients/dispatch/auxiliary-lsp.js

@@ -1,343 +0,0 @@
-/**
- * Auxiliary-diagnostic-LSP capability.
- *
- * Some LSP servers aren't a file's *language* server — they're cross-cutting,
- * diagnostic-only scanners that attach across many languages and run ALONGSIDE
- * the primary (security, spelling, secrets, …). Running them as warm LSP servers
- * compiles their rules/dictionaries once per session instead of paying a
- * cold-start on every file (see #111 — Opengrep's ~8s CLI-per-file → ~1.3s warm).
- *
- * This module is the registry that maps such a server to:
- *   - its enablement gate (default-on with an optional kill-switch flag), and
- *   - how to turn its raw LSP diagnostics into pi-lens diagnostics (tool name +
- *     semantic policy + defect class), since the LSP `source` differs from our
- *     tool id and most auxiliaries should be advisory, not blocking.
- *
- * Adding a new cross-cutting tool = register an `LSPServerInfo` with
- * `role:"auxiliary"` (clients/lsp/server.ts) + one profile entry here.
- */
-import { shouldDegradeAuxiliaryLsp } from "../lsp-budget.js";
-import { isSubagentSession } from "../subagent-mode.js";
-import { findLocalOpengrepConfig } from "../opengrep-config.js";
-import { findLocalTyposConfig } from "../typos-config.js";
-import { findLocalZizmorConfig } from "../zizmor-config.js";
-import { classifyDefect } from "./diagnostic-taxonomy.js";
-import { isRuleIgnoredForPath, loadRuleIgnorePatterns, } from "./rule-ignores.js";
-/**
- * Semgrep/opengrep `# nosemgrep` / `# nosemgrep: <rule-id>[,<rule-id>]` inline
- * suppression (#441). A bare `# nosemgrep` drops every finding on its line; the
- * `: <ids>` form drops only the listed rule ids. `d.code` is the semgrep rule id.
- * Also accepts the `//` comment form.
- *
- * Matches Semgrep placement: honored on the finding's OWN line (inline or not),
- * and on the line ABOVE only when that line is a STANDALONE comment (no code before
- * it) — so `a()  # nosemgrep` suppresses a finding on `a()` but not the next line.
- */
-const NOSEMGREP_RE = /(?:#|\/\/)\s*nosemgrep(?::\s*(.+))?/i;
-const NOSEMGREP_STANDALONE_RE = /^\s*(?:#|\/\/)\s*nosemgrep(?::\s*(.+))?\s*$/i;
-export function isNosemgrepSuppressed(d, content) {
-    const startLine = d.range?.start?.line; // 0-based
-    if (startLine == null)
-        return false;
-    const lines = content.split("\n");
-    const ruleId = String(d.code ?? "");
-    const checkLine = (text, standaloneOnly) => {
-        if (!text)
-            return false;
-        const m = (standaloneOnly ? NOSEMGREP_STANDALONE_RE : NOSEMGREP_RE).exec(text);
-        if (!m)
-            return false;
-        if (m[1] === undefined)
-            return true; // bare nosemgrep → suppress the line
-        return m[1]
-            .split(",")
-            .map((s) => s.trim())
-            .filter(Boolean)
-            .includes(ruleId);
-    };
-    // The finding's own line (inline OK), then the line above (standalone comment only).
-    return (checkLine(lines[startLine], false) || checkLine(lines[startLine - 1], true));
-}
-/**
- * zizmor's own native inline suppression: `# zizmor: ignore[audit-id[,audit-id]]`
- * on the finding's own line (https://docs.zizmor.sh/usage/#ignoring-results —
- * zizmor calls this "inline ignores"). Honoring it here mirrors
- * `isNosemgrepSuppressed` for Opengrep — a per-finding suppression path a repo
- * can reach for even without its own `zizmor.yml` (#971): e.g. a `# zizmor:
- * ignore[artipacked]` on a checkout-only job's `actions/checkout` step, or
- * `# zizmor: ignore[adhoc-packages]` on a `npm pack` tarball's local install
- * line, both cases the audit has no way to tell "checkout-only, no artifact
- * upload" or "this is testing our own just-built tarball" apart from a
- * remote-package install without this local, human-authored signal.
- */
-const ZIZMOR_IGNORE_RE = /#\s*zizmor:\s*ignore\[([^\]]+)\]/i;
-export function isZizmorIgnoreSuppressed(d, content) {
-    const startLine = d.range?.start?.line; // 0-based
-    if (startLine == null)
-        return false;
-    const line = content.split("\n")[startLine];
-    if (!line)
-        return false;
-    const match = ZIZMOR_IGNORE_RE.exec(line);
-    if (!match)
-        return false;
-    const ruleId = String(d.code ?? "").toLowerCase();
-    return match[1]
-        .split(",")
-        .map((s) => s.trim().toLowerCase())
-        .includes(ruleId);
-}
-// #277 R7: every profile below used this exact same rule (ERROR-severity
-// findings block only when the workspace opted into curated/authored rules;
-// everything else stays advisory) — shared here instead of copy-pasted per
-// profile so a future policy change (e.g. a WARNING-blocking tier) is one edit.
-const blockOnErrorWhenAllowed = (d, { blockingAllowed }) => blockingAllowed && d.severity === 1 ? "blocking" : "warning";
-export const AUXILIARY_LSP_PROFILES = [
-    {
-        serverId: "opengrep",
-        tool: "opengrep",
-        // Opengrep is a Semgrep fork and tags LSP diagnostics `source: "Semgrep"`.
-        sourceMatch: /opengrep|semgrep/i,
-        killSwitchFlag: "no-opengrep",
-        enabledByDefault: true,
-        // The LSP diagnostic carries severity + rule id but NOT confidence (the
-        // CLI's metadata.confidence is stripped). Opengrep's login-free `auto`
-        // Community set is uniformly ERROR/LOW-confidence audit-tier, so blocking on
-        // it would be a firehose. We honor ERROR→blocking ONLY when the repo
-        // supplies its own curated rules (the author's deliberate severity); the
-        // auto set is advisory. Either way, findings surface via lens_diagnostics.
-        allowBlocking: (cwd) => Boolean(findLocalOpengrepConfig(cwd)),
-        semantic: blockOnErrorWhenAllowed,
-        defectClass: (d) => classifyDefect(String(d.code ?? ""), "opengrep", d.message ?? ""),
-        // Honor the canonical Semgrep suppression the user already knows (#441).
-        isSuppressed: isNosemgrepSuppressed,
-    },
-    {
-        serverId: "ast-grep",
-        tool: "ast-grep",
-        // ast-grep tags its LSP diagnostics `source: "ast-grep"`.
-        sourceMatch: /ast[-_]?grep/i,
-        killSwitchFlag: "no-ast-grep",
-        enabledByDefault: true,
-        // Matches the in-process ast-grep-napi runner's own `skipTestFiles: true`
-        // (#687) — that flag stops applying the moment the ast-grep binary is
-        // present, since the napi runner then skips entirely in favor of this
-        // LSP surface, which had no test-file gating of its own.
-        skipTestFiles: true,
-        // The ast-grep LSP runs either the repo's own sgconfig (when present) or
-        // pi-lens's shipped baseline sgconfig. In both cases the rule severity is
-        // deliberate, so preserve ast-grep's severity semantics: ERROR can block,
-        // WARNING/INFO stay advisory.
-        allowBlocking: () => true,
-        semantic: blockOnErrorWhenAllowed,
-        defectClass: (d) => classifyDefect(String(d.code ?? ""), "ast-grep", d.message ?? ""),
-    },
-    {
-        serverId: "zizmor",
-        tool: "zizmor",
-        // zizmor tags its LSP diagnostics `source: "zizmor"`.
-        sourceMatch: /zizmor/i,
-        killSwitchFlag: "no-zizmor",
-        enabledByDefault: true,
-        // zizmor's default ("regular") persona is a curated, low-false-positive
-        // audit set, but as an always-on advisory we only let it BLOCK when the repo
-        // opts in with its own `zizmor.yml` (the author's deliberate severities /
-        // ignores). Advisory otherwise — findings still surface via lens_diagnostics.
-        // zizmor maps High→ERROR(1), Medium/Low→WARNING(2), Informational→INFO(3).
-        allowBlocking: (cwd) => Boolean(findLocalZizmorConfig(cwd)),
-        semantic: blockOnErrorWhenAllowed,
-        defectClass: (d) => classifyDefect(String(d.code ?? ""), "zizmor", d.message ?? ""),
-        // Honor zizmor's own native per-finding suppression (#971) — a documented
-        // escape hatch for a workflow-context judgment call the audit itself has no
-        // way to make (checkout-only vs. artifact-uploading job; a locally-built
-        // tarball install vs. an arbitrary remote package).
-        isSuppressed: isZizmorIgnoreSuppressed,
-    },
-    {
-        serverId: "typos",
-        tool: "typos",
-        // typos-lsp tags its LSP diagnostics `source: "typos"`.
-        sourceMatch: /typos/i,
-        killSwitchFlag: "no-typos",
-        enabledByDefault: true,
-        // typos is allow-list based (only KNOWN misspellings with a known
-        // correction), but as an always-on advisory we only let it BLOCK when the
-        // repo opts in with its own `typos.toml`/`_typos.toml`/`.typos.toml` (the
-        // team's curated dictionary + chosen severity). Advisory otherwise —
-        // findings still surface via lens_diagnostics. Note typos-lsp's default
-        // severity is WARNING, so even with a config it stays advisory unless the
-        // repo raises `diagnostic-severity` to Error.
-        allowBlocking: (cwd) => Boolean(findLocalTyposConfig(cwd)),
-        semantic: blockOnErrorWhenAllowed,
-        // A misspelling is a documentation/quality defect — not security or
-        // correctness. "style" is the closest taxonomy class.
-        defectClass: () => "style",
-    },
-];
-/** The auxiliary server ids enabled for this turn (the lsp runner passes these
- *  to `touchFile` since it — not the LSP service — owns flag access).
- *
- * #449 slice 2 (prototype): when this process decided at `session_start` that
- * the machine-wide LSP budget is exceeded (`clients/lsp-budget.ts`), auxiliary
- * servers are skipped entirely for the rest of the session — the primary
- * language server per file is unaffected. This is a per-SESSION degrade, not
- * per-file: once over budget, this session never spawns its auxiliary fleet,
- * rather than flip-flopping file to file. */
-export function enabledAuxiliaryLspServerIds(getFlag) {
-    // #449 slice 2 (budget): skip auxiliaries when machine-wide LSP budget is
-    // exceeded. #713 (subagent light mode): reuse the same seam — a subagent
-    // session also skips auxiliaries; the parent session already runs them on
-    // the same cwd. PI_LENS_SUBAGENT_FULL=1 restores full behavior via
-    // isSubagentSession() returning false.
-    if (shouldDegradeAuxiliaryLsp() || isSubagentSession())
-        return [];
-    return AUXILIARY_LSP_PROFILES.flatMap((p) => p.enabledByDefault &&
-        !(p.killSwitchFlag && getFlag(p.killSwitchFlag) === true)
-        ? [p.serverId]
-        : []);
-}
-// #277 R7: `findAuxiliaryProfileForSource` is called once per diagnostic, and a
-// file's diagnostics are typically dominated by a handful of distinct `source`
-// strings (one per tool that fired). Memoizing by exact `source` turns an
-// O(profiles) regex scan per diagnostic into one scan per distinct source seen
-// — safe because `AUXILIARY_LSP_PROFILES` is a fixed module-level const, never
-// mutated at runtime, so a source's matching profile never changes.
-const profileForSourceCache = new Map();
-/** Find the profile whose server emitted a diagnostic with this `source`. */
-export function findAuxiliaryProfileForSource(source) {
-    if (!source)
-        return undefined;
-    const cached = profileForSourceCache.get(source);
-    if (cached !== undefined || profileForSourceCache.has(source))
-        return cached;
-    const found = AUXILIARY_LSP_PROFILES.find((p) => p.sourceMatch.test(source));
-    profileForSourceCache.set(source, found);
-    return found;
-}
-/**
- * Single-diagnostic suppression check (#586): look up the diagnostic's
- * auxiliary profile by `source` and, if that profile declares an
- * `isSuppressed` callback (currently only opengrep's `# nosemgrep`, #441),
- * apply it. Returns false for diagnostics with no matching profile or whose
- * profile has no native suppression syntax — the common case for plain
- * language-server diagnostics.
- *
- * This is the ONE lookup+apply implementation; every call site that decides
- * whether to drop a diagnostic for its tool's own inline suppression comment
- * should go through this (or `applyAuxiliarySuppressions` below) rather than
- * re-deriving the profile lookup.
- */
-export function isAuxiliaryDiagnosticSuppressed(d, content) {
-    const profile = findAuxiliaryProfileForSource(d.source);
-    return Boolean(profile?.isSuppressed?.(d, content));
-}
-/**
- * Filter a diagnostic list down to the ones NOT suppressed by their
- * auxiliary profile's native inline-comment syntax (#586). This is the
- * shared helper `tools/lsp-diagnostics.ts` and `clients/lsp/index.ts`'s
- * `runWorkspaceDiagnostics` use so a `// nosemgrep` (or any future profile's
- * equivalent) suppresses a finding identically whether it's seen via the
- * per-edit dispatch runner or a standalone diagnostics query — previously
- * only the former honored it (#586).
- *
- * #692: `opts.fileRole` additionally drops a diagnostic whose auxiliary
- * profile declares `skipTestFiles` (e.g. ast-grep, #687) when the file is a
- * test file — the per-edit dispatch runner (`clients/dispatch/runners/lsp.ts`)
- * has applied this gate since #687/#688 via its own inline check; the
- * `runWorkspaceDiagnostics` workspace sweep (`clients/lsp/index.ts`) called
- * this function WITHOUT ever passing a fileRole, so ast-grep findings on test
- * files that are suppressed per-edit reappeared wholesale in every
- * `mode=full` sweep. Omitting `opts` (or `opts.fileRole`) keeps every existing
- * 2-arg call site's behavior byte-for-byte unchanged.
- *
- * #3041: `opts.filePath` + `opts.scanRoot` additionally apply each rule's own
- * `ignores` path carve-out (#965) — the THIRD member of the same defect class
- * as #586 and #692 above. `ast-grep scan` applies `ignores` during its own
- * project walk, but `ast-grep lsp` publishes per-document diagnostics WITHOUT
- * applying them (measured against ast-grep 0.45.3), so a rule the NAPI runner
- * correctly skips on `scripts/**` came back over LSP on every `source=lsp`
- * query and every `mode=full` sweep. Both routes reach this function, so the
- * carve-out belongs here rather than in either route's own output merge.
- */
-export function applyAuxiliarySuppressions(diagnostics, content, opts) {
-    // One catalog read per call, not per diagnostic. Both rule loaders behind it
-    // are cached (~0.09 ms per call on pi-lens's own catalog), so a per-file call
-    // from a sweep costs the same order as the NAPI runner's own per-file load.
-    const { filePath, scanRoot } = opts ?? {};
-    const ruleIgnores = filePath && scanRoot ? loadRuleIgnorePatterns(scanRoot) : undefined;
-    return diagnostics.filter((d) => {
-        if (isAuxiliaryDiagnosticSuppressed(d, content))
-            return false;
-        if (opts?.fileRole === "test") {
-            const profile = findAuxiliaryProfileForSource(d.source);
-            if (profile?.skipTestFiles)
-                return false;
-        }
-        // Keyed by the diagnostic's own rule id — ast-grep's LSP reports the bare
-        // catalog id as `code`. Gated on the producing tool as well: the map is
-        // built from the AST-GREP catalog, so without the gate any auxiliary whose
-        // own rule id happened to collide with a catalog id (several are generic —
-        // `no-raw-types`, `no-string-concat-in-loop`) would be silently dropped on
-        // a path an unrelated rule carved out. Losing a finding silently is the
-        // harm this whole change exists to stop, so the collision is gated, not
-        // accepted (#3041 r2 F4).
-        if (ruleIgnores !== undefined &&
-            findAuxiliaryProfileForSource(d.source)?.tool === "ast-grep" &&
-            isRuleIgnoredForPath(filePath, scanRoot, ruleIgnores.get(String(d.code)))) {
-            return false;
-        }
-        return true;
-    });
-}
-/**
- * #692: shared aux re-tag implementation — extracted from the per-edit
- * dispatch runner (`clients/dispatch/runners/lsp.ts`) so a scan/sweep path
- * that reconciles LSP diagnostics into widget state (`lens_diagnostics
- * mode=full`, `lsp_diagnostics`) gives its auxiliary-sourced findings
- * (ast-grep, opengrep, zizmor, typos) the SAME tool re-tag, semantic policy,
- * and defect-class classification the per-edit path always has — previously
- * only the per-edit runner ran this loop, so a scan-reconciled aux finding
- * kept `tool: "lsp"` and lost its curated-repo-rules `blockingAllowed`
- * context entirely (#692).
- *
- * `diagnostics` and `rawLspDiags` must be the SAME length and index-aligned —
- * `convertLspDiagnostics` maps its input 1:1, so this holds for every caller
- * that passes it the same array it just converted. Mutates and returns the
- * SURVIVING subset of `diagnostics` (native-inline-suppressed and
- * `skipTestFiles`-dropped entries removed), mirroring the per-edit runner's
- * prior inline behavior exactly.
- */
-export function retagAuxiliaryDiagnostics(diagnostics, rawLspDiags, content, ctx) {
-    const blockingAllowedByProfile = new Map();
-    const suppressedIndices = new Set();
-    for (let i = 0; i < diagnostics.length; i++) {
-        const profile = findAuxiliaryProfileForSource(rawLspDiags[i]?.source);
-        if (!profile)
-            continue;
-        if (profile.skipTestFiles && ctx.fileRole === "test") {
-            suppressedIndices.add(i);
-            continue;
-        }
-        if (isAuxiliaryDiagnosticSuppressed(rawLspDiags[i], content)) {
-            suppressedIndices.add(i);
-            continue;
-        }
-        let blockingAllowed = blockingAllowedByProfile.get(profile);
-        if (blockingAllowed === undefined) {
-            blockingAllowed = profile.allowBlocking?.(ctx.cwd) ?? false;
-            blockingAllowedByProfile.set(profile, blockingAllowed);
-        }
-        const d = diagnostics[i];
-        d.tool = profile.tool;
-        d.semantic = profile.semantic(rawLspDiags[i], { blockingAllowed });
-        if (d.semantic !== "blocking" && d.severity === "error") {
-            d.severity = "warning";
-        }
-        const defectClass = profile.defectClass?.(rawLspDiags[i]);
-        if (defectClass)
-            d.defectClass = defectClass;
-    }
-    return suppressedIndices.size
-        ? diagnostics.filter((_, i) => !suppressedIndices.has(i))
-        : diagnostics;
-}

package/node_modules/pi-lens/dist/clients/dispatch/collect-later-tier.js

@@ -1,35 +0,0 @@
-/** Observed-latency classification shared by dispatch and LSP tier seams. */
-import { normalizeMapKey } from "../path-utils.js";
-/** A runner gets this much time before the next run moves off the write path. */
-export const COLLECT_LATER_THRESHOLD_MS = 5_000;
-const slowRunners = new Map();
-function key(projectRoot, runnerId) {
-    return `${normalizeMapKey(projectRoot)}\u0000${runnerId}`;
-}
-/** Read the current observed tier. Missing observations stay inline. */
-export function classifyObservedRunner(projectRoot, runnerId) {
-    return slowRunners.has(key(projectRoot, runnerId))
-        ? "collect-later"
-        : "inline";
-}
-/** Record one completed latency observation and return the resulting tier. */
-export function observeRunnerLatency(options) {
-    const normalizedProjectRoot = normalizeMapKey(options.projectRoot);
-    const runnerKey = key(normalizedProjectRoot, options.runnerId);
-    if (options.timedOut === true ||
-        options.durationMs > COLLECT_LATER_THRESHOLD_MS) {
-        slowRunners.set(runnerKey, {
-            projectRoot: normalizedProjectRoot,
-            runnerId: options.runnerId,
-        });
-        return "collect-later";
-    }
-    // A fast completed run is affirmative recovery, not merely absence of a
-    // failure. This deliberately prevents a process-lifetime latch.
-    slowRunners.delete(runnerKey);
-    return "inline";
-}
-/** Session boundary reset. */
-export function resetObservedRunnerLatency() {
-    slowRunners.clear();
-}