@herbertgao/pi-extensions 2026.10.2 → 2026.10.3

package/node_modules/pi-lens/dist/mcp/server.js

@@ -7,33 +7,32 @@ import {
   deadCodeIssues,
   formatDeadCodeDelta,
   stableFindingKey
-} from "../chunk-TT22N74J.js";
+} from "../chunk-HSIRMK2D.js";
 import {
   clearFormatterCache
-} from "../chunk-F3AU2TMM.js";
+} from "../chunk-ZETYB3XG.js";
 import {
   findNearestProjectRoot,
-  getStartupScanMaxEntries,
   isStartupScanVerdictFresh,
   resolveStartupScanContext
-} from "../chunk-5RXBNSW2.js";
+} from "../chunk-6P54TMWL.js";
 import {
   loadCallGraph
-} from "../chunk-NKOUFPQF.js";
+} from "../chunk-WW5BLB74.js";
 import {
   RUNNERS,
   formatRunDurationMs,
   isExcludedTestTarget,
   isRunnerErrorResult
-} from "../chunk-IVP5KAB7.js";
+} from "../chunk-3P4PF2BX.js";
 import {
   GovulncheckClient
-} from "../chunk-NXPS2L6U.js";
+} from "../chunk-N7YNJE5R.js";
 import {
   GitleaksClient,
   classifyAndFilterFindings
-} from "../chunk-BRJKOBZP.js";
-import "../chunk-6P62QVEA.js";
+} from "../chunk-DMS52BEP.js";
+import "../chunk-2UMYMRI3.js";
 import {
   isHardFailureSummary
 } from "../chunk-7U2IDNXN.js";
@@ -54,7 +53,7 @@ import {
   peekTurnEndFindings,
   snapshotAdvisoryProvenance,
   validateAdvisoryProvenance
-} from "../chunk-Y4T27COV.js";
+} from "../chunk-J6DFZDFA.js";
 import {
   CacheManager,
   DELTA_UNUSED_PROMOTION_NOTE,
@@ -99,56 +98,56 @@ import {
   resetPendingRunnerFindings,
   resetPsScriptAnalyzerAvailability,
   runProviders
-} from "../chunk-TLGFBM3F.js";
+} from "../chunk-ZZUFZUQZ.js";
 import {
   resetLazyInstallAttempts
-} from "../chunk-C2AUYXQH.js";
+} from "../chunk-ZOEYVXSV.js";
 import {
   isTestRoleCollateral
-} from "../chunk-I3R7GKDR.js";
+} from "../chunk-KJN4IOEJ.js";
 import "../chunk-FC4RP4I2.js";
 import {
   TrivyClient
-} from "../chunk-DFVMIKMQ.js";
-import "../chunk-TO6WL3GM.js";
-import "../chunk-7F72PXY2.js";
+} from "../chunk-YLN4K6WD.js";
+import "../chunk-J3FZR3YY.js";
+import "../chunk-5JHXUETW.js";
 import {
   resetRustAvailability
-} from "../chunk-RPD5K5NC.js";
+} from "../chunk-3MRXIJ6I.js";
 import {
   findingsResult,
   hasUsableResult
-} from "../chunk-ZMOL6RQC.js";
-import "../chunk-I7SPGOWI.js";
-import "../chunk-AS44CFQ4.js";
+} from "../chunk-TA5L5KWQ.js";
+import "../chunk-FGALODG3.js";
+import "../chunk-OC7LYAU5.js";
 import {
   getSgCommand,
   resetDispatchAvailabilityState,
   resolveManagedToolClient
-} from "../chunk-7FBF7NPR.js";
-import "../chunk-HHYAELLJ.js";
-import "../chunk-V5PXFSZK.js";
-import "../chunk-YLF3PPT5.js";
-import "../chunk-JOLITGCC.js";
-import "../chunk-E2WFBRHM.js";
+} from "../chunk-NFXP47RV.js";
+import "../chunk-MGIWSROG.js";
+import "../chunk-WSEWKCXU.js";
+import "../chunk-MQA2YBAH.js";
+import "../chunk-TQFBZVCG.js";
+import "../chunk-WATC3IQR.js";
 import {
   resetGoAvailability
-} from "../chunk-6VCD4VKZ.js";
-import "../chunk-F3P7VQ7H.js";
+} from "../chunk-OYOB3ZFG.js";
+import "../chunk-XHSCVSOL.js";
 import {
   SYMBOL_KIND_NAMES,
   captureReviewGraphStructuralIr,
   formatReviewGraphRevisionDriftNote,
   publishReviewGraphFileIr,
   reviewGraphIrContentHash
-} from "../chunk-LSMJ6KBE.js";
+} from "../chunk-V5MEBST3.js";
 import {
   buildSymbolId
 } from "../chunk-3MED75HT.js";
 import {
   resolveGitCheckout,
   resolveLinkedWorktreeOwner
-} from "../chunk-3I5QFT3N.js";
+} from "../chunk-IMSQR4WO.js";
 import {
   DEPENDENCY_DRIFT_MAX_DELIVERIES,
   MAX_LATE_AUX_REARMS,
@@ -244,18 +243,18 @@ import {
   widgetDiagnosticUri,
   workspaceEditTextPaths,
   writeOrderToken
-} from "../chunk-TVN5N6GY.js";
+} from "../chunk-MTDRLSI7.js";
 import {
   emitBounded,
   resetBoundedTelemetry
-} from "../chunk-ARFCXG7S.js";
+} from "../chunk-OZJINN4O.js";
 import {
   hashText,
   normalizeMessage,
   primePersistedMutationAttribution,
   resetMutationAttribution,
   stableFindingId
-} from "../chunk-OAXNDZJ7.js";
+} from "../chunk-3JSEWUWI.js";
 import {
   mapWithConcurrency
 } from "../chunk-XIMYZ3JA.js";
@@ -264,8 +263,10 @@ import {
   customServerSpecsOf,
   describeRootFallback,
   explainServersForFile,
+  getAstGrepRuleFingerprint,
   getServersForFileWithConfig,
   initLSPConfig,
+  isAuxiliary,
   isSameOrWithin,
   loadLSPConfig,
   lspConfigOf,
@@ -275,11 +276,11 @@ import {
   resetLSPCaseSensitivityState,
   resolveLspCwdForFile,
   shouldInitializeSessionRoot
-} from "../chunk-B3I2UUT4.js";
+} from "../chunk-IQZXOZ7S.js";
 import {
   hasAmbientPythonEnvironment
-} from "../chunk-DIULIWKU.js";
-import "../chunk-VDBPVIKD.js";
+} from "../chunk-LNOMA3MP.js";
+import "../chunk-U52SAGRM.js";
 import "../chunk-5W3R6LFT.js";
 import {
   EXT_TO_LANG,
@@ -293,26 +294,27 @@ import {
   queryLoader,
   reportBundledResourceDirHealth,
   resolveTreeSitterLanguage
-} from "../chunk-LW6XKDZQ.js";
+} from "../chunk-UEAHAMEI.js";
 import "../chunk-Z54ZSOBZ.js";
 import {
   SCAN_LANGUAGE_PRIORITY,
   extensionsForLanguage,
   extensionsForLanguageToken,
+  getUserRuleRoot,
   resolveLanguage
-} from "../chunk-TGPXLY2J.js";
+} from "../chunk-KJCWXUUS.js";
 import {
   dump,
   resolvePackagePath
 } from "../chunk-QOZXJ4NA.js";
-import "../chunk-V7R425XG.js";
-import "../chunk-PAK6IDME.js";
+import "../chunk-6XX5HCLK.js";
+import "../chunk-S6AMWKPC.js";
 import {
   HOOK_WALL_BUDGET_MS,
   bounded,
   combineAbortSignals,
   withDeadline
-} from "../chunk-GUOGVTCQ.js";
+} from "../chunk-F5VLZHUW.js";
 import {
   PROJECT_SNAPSHOT_VERSION,
   getProjectSnapshotLegacyPath,
@@ -327,17 +329,17 @@ import {
   readJsonCache,
   readProjectSnapshotMeta,
   saveRuntimeProjectSnapshot
-} from "../chunk-AJVLWNFN.js";
+} from "../chunk-AXKPQ6ZI.js";
 import {
   centralityFromReverseDeps,
   getWordIndexBuildStatus,
   logWordIndex,
   searchWordIndex,
   triggerBackgroundWordIndexBuild
-} from "../chunk-YGVYKNSN.js";
+} from "../chunk-7BX5DWSA.js";
 import {
   getProjectDiagnosticsScannerMaxFiles
-} from "../chunk-LNAKEO63.js";
+} from "../chunk-IUKPRZER.js";
 import {
   PathKeyedMap
 } from "../chunk-Z3CCVDUB.js";
@@ -350,30 +352,30 @@ import {
   readTurnEndStatus,
   resolveRunnerPath,
   toRunnerDisplayPath
-} from "../chunk-PWFHBTSF.js";
+} from "../chunk-XGUL4SLQ.js";
 import "../chunk-2BEMIWEW.js";
 import {
   commitDurableStore,
   resetResolvedPathCache,
   resetZizmorTokenAvailability
-} from "../chunk-OQGFCZJ4.js";
+} from "../chunk-LD7WFTRX.js";
 import {
   resolveToolCwd
-} from "../chunk-RUOG5D2C.js";
+} from "../chunk-IUR76K6A.js";
 import {
   _resetPackageManagerCache,
   findGlobalBinary,
   pmBinary,
   resolveNodePackageManager,
   runScriptArgs
-} from "../chunk-U3VGR4VU.js";
+} from "../chunk-T4QZ6FEH.js";
 import {
   isToolInstallAllowedByTrust,
   projectTrustDenialReason
-} from "../chunk-NTUJEGDZ.js";
+} from "../chunk-D6YF5HKX.js";
 import {
   probeToolAsync
-} from "../chunk-EOKRQ3SA.js";
+} from "../chunk-CMU4RMJB.js";
 import {
   classifyProbeFailure,
   createAvailabilityLatch,
@@ -381,20 +383,20 @@ import {
   logAvailabilityDecision,
   resetInstallRetryLatches,
   startHostStallSampler
-} from "../chunk-WONERJTP.js";
+} from "../chunk-O7HZX7CA.js";
 import {
   canRunStartupHeavyScans,
   detectProjectLanguageProfile,
   getDefaultStartupTools
-} from "../chunk-22AVIGXS.js";
-import "../chunk-GVXA6CCE.js";
+} from "../chunk-VYKKMYVT.js";
+import "../chunk-BNKLYOOO.js";
 import {
   collectSourceFilesWithBudgetAsync,
   getSlowFsVerdict,
   isSlowFs,
   slowFsDegradationNotice
-} from "../chunk-6QIUX4EP.js";
-import "../chunk-VHQLPIRJ.js";
+} from "../chunk-USHG4DLH.js";
+import "../chunk-H5EV3VMF.js";
 import {
   displayProjectDataPath,
   drainProjectDataDirMigrations,
@@ -421,7 +423,7 @@ import {
   sweepDeadEphemeralDataDirs,
   updateHeartbeat,
   withGenerationLockSync
-} from "../chunk-VN2AXLEX.js";
+} from "../chunk-T54VJRAD.js";
 import {
   createSingleFlight
 } from "../chunk-BW5KFIQC.js";
@@ -431,7 +433,7 @@ import {
 } from "../chunk-QYF5S6P6.js";
 import {
   detectFileKind
-} from "../chunk-5ZEJHV35.js";
+} from "../chunk-64LU2OVH.js";
 import {
   compareKeys,
   detectFileRole,
@@ -441,12 +443,12 @@ import {
   provenanceView,
   resolvePiLensConfig,
   summarizeConfigResolution
-} from "../chunk-DQ2NZ7C4.js";
+} from "../chunk-N2IRDBZI.js";
 import {
   LSP_NAMESPACE_KEY,
   getPiLensGlobalConfigPath,
   resetWorkspaceTopology
-} from "../chunk-VNMT7C64.js";
+} from "../chunk-Z6BB4JLQ.js";
 import {
   DEFAULT_MAX_OUTPUT_BYTES,
   createBoundedOutputSink,
@@ -467,28 +469,29 @@ import {
   resolveLensToolEnabled,
   resolveLensToolName,
   toolRegistryEntryForMcp
-} from "../chunk-N3YQJI6O.js";
+} from "../chunk-7ELY2CSM.js";
 import {
   createSubsystemLogger,
   flushExtensionLog,
   logExtension
-} from "../chunk-O6TQT6RI.js";
+} from "../chunk-34OCDWOS.js";
 import {
   claimPhaseOncePerSession,
   logLatency
-} from "../chunk-5THXD6X5.js";
+} from "../chunk-3PNFWVHT.js";
 import {
   beginTurnContext,
   createNdjsonLogger,
   getGlobalPiLensLogDir,
+  getProcessSingleton,
   isTestMode,
   runLogCleanup,
   setTurnContextSession
-} from "../chunk-UK3CMEAL.js";
+} from "../chunk-VSMJK3ZJ.js";
 import "../chunk-LJDODBBZ.js";
 import {
   FactStore
-} from "../chunk-NMABWBZN.js";
+} from "../chunk-UGSMCQ4D.js";
 import {
   BoundedFifoMap,
   BoundedLruCache
@@ -505,7 +508,7 @@ import {
   realpathOrResolve,
   toProjectRelativePath,
   uriToPath
-} from "../chunk-Q5U6FMDI.js";
+} from "../chunk-G3RLJYA2.js";
 import "../chunk-NXL4FFQQ.js";
 
 // dist/mcp/server.js
@@ -821,37 +824,59 @@ function checkAstGrepRulesHealth(ruleDir) {
 var AstGrepRuleManager = class {
   ruleDir;
   log;
+  fingerprint;
   ruleDescriptions = null;
-  constructor(ruleDir, log) {
+  ruleFingerprint = null;
+  constructor(ruleDir, log, fingerprint = () => getAstGrepRuleFingerprint()) {
     this.ruleDir = ruleDir;
     this.log = log;
+    this.fingerprint = fingerprint;
   }
   loadRuleDescriptions() {
-    if (this.ruleDescriptions !== null)
+    const fingerprint = this.fingerprint();
+    if (this.ruleDescriptions !== null && this.ruleFingerprint === fingerprint)
       return this.ruleDescriptions;
     const descriptions = /* @__PURE__ */ new Map();
-    const possiblePaths = candidateAstGrepRulesPaths(this.ruleDir);
-    const rulesPath = possiblePaths.find((p) => fs2.existsSync(p));
+    const roots = Array.isArray(this.ruleDir) ? this.ruleDir : [this.ruleDir];
+    const possiblePaths = roots.flatMap(candidateAstGrepRulesPaths);
+    const rulesPaths = [];
+    if (Array.isArray(this.ruleDir)) {
+      for (const candidate of possiblePaths) {
+        if (fs2.existsSync(candidate))
+          rulesPaths.push(candidate);
+      }
+    } else {
+      for (const candidate of possiblePaths) {
+        if (!fs2.existsSync(candidate))
+          continue;
+        rulesPaths.push(candidate);
+        break;
+      }
+    }
+    const rulesPath = rulesPaths[0];
     if (!rulesPath) {
       this.log(`Rule descriptions: no rules directory found in ${possiblePaths.join(", ")}`);
       this.ruleDescriptions = descriptions;
+      this.ruleFingerprint = fingerprint;
       return descriptions;
     }
     try {
-      const files = fs2.readdirSync(rulesPath).filter((f) => f.endsWith(".yml"));
-      this.log(`Loaded ${files.length} rule descriptions from ${rulesPath}`);
-      for (const file of files) {
-        const filePath = path2.join(rulesPath, file);
-        const content = fs2.readFileSync(filePath, "utf-8");
-        const rule = this.parseRuleYaml(content);
-        if (rule) {
-          descriptions.set(rule.id, rule);
+      for (const resolvedPath of rulesPaths) {
+        const files = fs2.readdirSync(resolvedPath).filter((f) => f.endsWith(".yml"));
+        this.log(`Loaded ${files.length} rule descriptions from ${resolvedPath}`);
+        for (const file of files) {
+          const filePath = path2.join(resolvedPath, file);
+          const content = fs2.readFileSync(filePath, "utf-8");
+          const rule = this.parseRuleYaml(content);
+          if (rule && !descriptions.has(rule.id))
+            descriptions.set(rule.id, rule);
         }
       }
     } catch (err) {
       this.log(`Failed to load rule descriptions: ${err.message}`);
     }
     this.ruleDescriptions = descriptions;
+    this.ruleFingerprint = fingerprint;
     return descriptions;
   }
   parseRuleYaml(content) {
@@ -1641,7 +1666,7 @@ function reportAstGrepRulesHealth(bundledRuleDir) {
   });
   reportBundledResourceDirHealth("ast-grep-rules-dir-missing", bundledRuleDir, health, "ast-grep rule descriptions");
 }
-function recordAstGrepApply(matches, lineage) {
+function recordAstGrepApply(matches, lineage, toolCallId) {
   const bridge = getMutationBridge();
   if (!bridge || matches.length === 0)
     return;
@@ -1657,13 +1682,22 @@ function recordAstGrepApply(matches, lineage) {
   }
   for (const [filePath, editRanges] of rangesByFile) {
     bridge.recordMutation({
-      filePath,
+      // ast-grep echoes the spelling passed to its CLI. Resolve that
+      // tool-relative spelling at the producer boundary, then use the
+      // existing canonical path seam before recordability is checked (#4140).
+      filePath: normalizeFilePath(path4.resolve(process.cwd(), filePath)),
       kind: "edit",
       editRanges,
       consumer: "ast_grep_replace",
+      provenance: "observed",
       // #3763: the call's session, so an apply that lands after `/new`
       // writes none of the next session's state.
-      ...lineage && { lineage }
+      ...lineage && { lineage },
+      // #4187 R4-1: the apply rewrites every matched file, which an
+      // `ast_grep_replace` call names only when its `paths` are files. The
+      // call's own id lets the guard advance exactly the paths that call
+      // checked, and end the authorship of every other file it rewrote.
+      ...toolCallId !== void 0 && { toolCallId }
     });
   }
 }
@@ -1732,6 +1766,9 @@ function validateInputShape(value, maxChars, label) {
   }
   return void 0;
 }
+function extractRuleLanguage(ruleYaml) {
+  return /^[^\S\n\r\u2028\u2029]*language:\s*([^\s#]+)/im.exec(ruleYaml)?.[1];
+}
 function stderrHasError(stderr) {
   return stderr.split(/\r?\n/).some((line) => /^\s*(error|Error):/.test(line));
 }
@@ -1766,7 +1803,7 @@ var AstGrepClient = class {
     this.log = verbose ? createSubsystemLogger("ast-grep") : () => {
     };
     this.ensureRulesHealthReported();
-    this.ruleManager = new AstGrepRuleManager(this.ruleDir, this.log);
+    this.ruleManager = new AstGrepRuleManager(ruleDir ? this.ruleDir : [projectRuleDir, getUserRuleRoot(), this.ruleDir], this.log, () => getAstGrepRuleFingerprint(process.cwd()));
     this.runner = new SgRunner(verbose);
   }
   /**
@@ -1810,7 +1847,7 @@ var AstGrepClient = class {
    * Replace using a raw YAML rule that includes a `fix:` field (Phase 3/4 of #125).
    * Dry-run returns matches for preview; apply writes fixes to disk.
    */
-  async replaceWithRule(ruleYaml, paths, apply) {
+  async replaceWithRule(ruleYaml, paths, apply, options) {
     const allMatches = [];
     for (const scanPath of paths) {
       if (apply) {
@@ -1843,6 +1880,8 @@ var AstGrepClient = class {
       }
       allMatches.push(...result.matches);
     }
+    if (apply)
+      recordAstGrepApply(allMatches, options?.lineage, options?.toolCallId);
     return {
       matches: allMatches,
       totalMatches: allMatches.length,
@@ -1964,7 +2003,7 @@ var AstGrepClient = class {
     const shapeError = validateInputShape(ruleYaml, MAX_VALIDATE_RULE_CHARS, "rule");
     if (shapeError)
       return { valid: false, error: shapeError };
-    const language = /^\s*language:\s*([^\s#]+)/im.exec(ruleYaml)?.[1] ?? "typescript";
+    const language = extractRuleLanguage(ruleYaml) ?? "typescript";
     const snippet = validationSnippetFor(language);
     const tmpDir = fs4.mkdtempSync(path4.join(os2.tmpdir(), "pi-lens-sg-rule-"));
     try {
@@ -2109,7 +2148,7 @@ var AstGrepClient = class {
         error: applyResult.error
       };
     }
-    recordAstGrepApply(preCheck.matches, options?.lineage);
+    recordAstGrepApply(preCheck.matches, options?.lineage, options?.toolCallId);
     return {
       matches: preCheck.matches,
       totalMatches: preCheck.totalMatches,
@@ -2686,7 +2725,7 @@ function resolveRebuildScript(serverFilePath) {
   return serverFilePath.replace(/\\/g, "/").includes("/dist/") ? "build:dist" : "build";
 }
 function analyzeFileFresh(workerPath, file, cwd, options = {}, timeoutMs = 12e4) {
-  return new Promise((resolve30) => {
+  return new Promise((resolve31) => {
     const args = [workerPath, `--file=${file}`, `--cwd=${cwd}`];
     if (options.flags)
       args.push(`--flags=${JSON.stringify(options.flags)}`);
@@ -2696,7 +2735,7 @@ function analyzeFileFresh(workerPath, file, cwd, options = {}, timeoutMs = 12e4)
         stdio: ["ignore", "pipe", "pipe"]
       });
     } catch (err) {
-      resolve30({
+      resolve31({
         error: `failed to fork worker: ${err instanceof Error ? err.message : String(err)}`
       });
       return;
@@ -2709,7 +2748,7 @@ function analyzeFileFresh(workerPath, file, cwd, options = {}, timeoutMs = 12e4)
         return;
       settled = true;
       clearTimeout(timer);
-      resolve30(outcome);
+      resolve31(outcome);
     };
     const timer = setTimeout(() => {
       child.kill();
@@ -2874,29 +2913,29 @@ async function buildBootstrapClients() {
     }
   }
   const [ruffClient, biomeClient, knipClient, todoScanner, jscpdClient, depChecker, testRunnerClient, metricsClient, complexityClient, goClient, govulncheckClient, gitleaksClient, trivyClient, opengrepClient, rustClient, agentBehaviorClient2, deadCodeClients] = await Promise.all([
-    load("ruff", async () => new (await import("../chunk-52H5B5TC.js")).RuffClient()),
-    load("biome", async () => new (await import("../chunk-4RERDEXR.js")).BiomeClient()),
-    load("knip", async () => new (await import("../chunk-AJ3QXTRQ.js")).KnipClient()),
-    load("todo", async () => new (await import("../chunk-NL5GLMFI.js")).TodoScanner()),
-    load("jscpd", async () => new (await import("../chunk-HVUZXSWK.js")).JscpdClient()),
-    load("dependency-checker", async () => new (await import("../chunk-T6D4Q4AQ.js")).DependencyChecker()),
-    load("test-runner", async () => new (await import("../chunk-AHDW3GPE.js")).TestRunnerClient()),
-    load("metrics", async () => new (await import("../chunk-27BBHSZC.js")).MetricsClient()),
-    load("complexity", async () => new (await import("../chunk-OS32RNR2.js")).ComplexityClient()),
+    load("ruff", async () => new (await import("../chunk-JONGANYH.js")).RuffClient()),
+    load("biome", async () => new (await import("../chunk-OEX24ECI.js")).BiomeClient()),
+    load("knip", async () => new (await import("../chunk-AFZYMAIV.js")).KnipClient()),
+    load("todo", async () => new (await import("../chunk-ELVWJYRV.js")).TodoScanner()),
+    load("jscpd", async () => new (await import("../chunk-H2W2AXD3.js")).JscpdClient()),
+    load("dependency-checker", async () => new (await import("../chunk-WPE5FPGR.js")).DependencyChecker()),
+    load("test-runner", async () => new (await import("../chunk-N77WFUL7.js")).TestRunnerClient()),
+    load("metrics", async () => new (await import("../chunk-HREZQCT3.js")).MetricsClient()),
+    load("complexity", async () => new (await import("../chunk-VZHJS6DR.js")).ComplexityClient()),
     // The process-wide singleton, NOT a fresh instance (#2455 fix round 4,
     // F2). `handleSessionStart` reads this object for its "Active tools"
     // line while `resetGoAvailability` re-arms the singleton's latch; a
     // second instance here meant the reset never reached the surface a
     // user actually sees.
-    load("go", async () => (await import("../chunk-NTHH2J74.js")).goClient),
-    load("govulncheck", async () => new (await import("../chunk-54B42YRX.js")).GovulncheckClient()),
-    load("gitleaks", async () => new (await import("../chunk-RIISMHKN.js")).GitleaksClient()),
-    load("trivy", async () => new (await import("../chunk-IIXOAGHR.js")).TrivyClient()),
-    load("opengrep", async () => new (await import("../chunk-ORTMY4Q4.js")).OpengrepClient()),
+    load("go", async () => (await import("../chunk-Z7QQA2KT.js")).goClient),
+    load("govulncheck", async () => new (await import("../chunk-RTQNRM5X.js")).GovulncheckClient()),
+    load("gitleaks", async () => new (await import("../chunk-IR6XFA5P.js")).GitleaksClient()),
+    load("trivy", async () => new (await import("../chunk-OYTMZXRF.js")).TrivyClient()),
+    load("opengrep", async () => new (await import("../chunk-D65GOCJB.js")).OpengrepClient()),
     // The process-wide singleton, for the same reason as "go" above.
-    load("rust", async () => (await import("../chunk-4W2PLC4J.js")).rustClient),
-    load("agent-behavior", async () => (await import("../chunk-IXEBJSUE.js")).agentBehaviorClient),
-    loadList("dead-code", async () => (await import("../chunk-UY752QSN.js")).getDeadCodeClients())
+    load("rust", async () => (await import("../chunk-EUT3B22Y.js")).rustClient),
+    load("agent-behavior", async () => (await import("../chunk-BJF25SUG.js")).agentBehaviorClient),
+    loadList("dead-code", async () => (await import("../chunk-NJF2X5XF.js")).getDeadCodeClients())
   ]);
   if (failures.length > 0)
     await logBootstrapFailures(failures);
@@ -2983,7 +3022,7 @@ function resetAnalyzerBootstrapSessionState() {
 }
 
 // dist/clients/formatters-lazy.js
-var lazyFormatters = createLazyImport(() => import("../chunk-XK4CIILI.js"));
+var lazyFormatters = createLazyImport(() => import("../chunk-3FERWMCH.js"));
 function warmFormatters() {
   return lazyFormatters.get();
 }
@@ -3332,6 +3371,13 @@ function deriveProviderFromModelId(modelId) {
 
 // dist/clients/runtime-coordinator.js
 var MAX_PENDING_CASCADE_RUNS = 32;
+function nextTelemetrySessionId() {
+  const state = getProcessSingleton("runtime-coordinator-telemetry", 1, () => ({
+    processId: randomBytes(6).toString("hex"),
+    nextGeneration: 0
+  }));
+  return `lens-${state.processId}-${++state.nextGeneration}`;
+}
 var MAX_CUT_ADVISORY_LANES = 16;
 var MAX_MUTATION_RECEIPTS = 512;
 function recordViewIncomplete(cwd, cause) {
@@ -3403,7 +3449,8 @@ var RuntimeCoordinator = class {
     rules: [],
     hasCustomRules: false
   };
-  _telemetrySessionId = `lens-${Date.now().toString(36)}`;
+  /** Process-unique and monotonic across coordinator reloads (#4213). */
+  _telemetrySessionId = nextTelemetrySessionId();
   _lifecycleReason;
   _hasStableSessionId = false;
   _telemetryModel = "unknown";
@@ -3472,9 +3519,10 @@ var RuntimeCoordinator = class {
   /** tool_call → tool_result path-attribution correlation (#1642). */
   _toolCallAttributions = new BoundedLruCache(TOOL_CALL_ATTRIBUTION_CAPACITY);
   /**
-   * #3555: reads carry no {@link ToolCallAttribution} (it is recorded for
-   * mutations, and its origin cwd would change how a read's path resolves),
-   * so a widening rides its own correlation, with the same bound.
+   * #3555: a widening rides its own correlation, with the same bound. Since
+   * #4138 a read also carries a {@link ToolCallAttribution} (its origin cwd
+   * is what a relative read path resolves against at tool_result); the
+   * widening stays separate because it outlives a blocked call's attribution.
    */
   _readWidenings = new BoundedLruCache(TOOL_CALL_ATTRIBUTION_CAPACITY);
   _lspReadWarmState = /* @__PURE__ */ new Map();
@@ -3543,7 +3591,7 @@ var RuntimeCoordinator = class {
     this._droppedMutationReceipts = 0;
     this._actionableWarningsThisTurn.clear(this._telemetrySessionId);
     this._codeQualityWarningsThisTurn.clear(this._telemetrySessionId);
-    this._telemetrySessionId = `lens-${Date.now().toString(36)}-${randomBytes(4).toString("hex")}`;
+    this._telemetrySessionId = nextTelemetrySessionId();
     this._hasStableSessionId = false;
     this._telemetryModel = "unknown";
     this._telemetryModelId = "";
@@ -4075,8 +4123,8 @@ var RuntimeCoordinator = class {
         });
         return entry;
       });
-      const timeout = new Promise((resolve30) => {
-        setTimeout(resolve30, maxWaitMs).unref?.();
+      const timeout = new Promise((resolve31) => {
+        setTimeout(resolve31, maxWaitMs).unref?.();
       });
       await Promise.race([
         Promise.allSettled(tracked.map((t) => t.promise)),
@@ -4820,6 +4868,17 @@ var RuntimeCoordinator = class {
   deferFormat(filePath, cwd, toolName, turnStateCwd, ownerSessionId, originCwd) {
     return this.deferMutation(filePath, cwd, toolName, turnStateCwd, "format", ownerSessionId, originCwd);
   }
+  /** Return the ownership identity of a queued format record for bus events. */
+  deferredFormatIdentity(filePath) {
+    const record = this._pendingDeferredMutations.get(path8.resolve(filePath));
+    if (!record || !record.kinds.has("format"))
+      return void 0;
+    return {
+      ownerSessionId: record.ownerSessionId,
+      turnIndex: record.queuedTurnIndex,
+      batchId: record.queuedTurnId
+    };
+  }
   get pendingDeferredFormatCount() {
     return this._pendingDeferredMutations.size;
   }
@@ -5231,6 +5290,30 @@ function resetTestRunnerDelivery() {
 }
 
 // dist/clients/runtime-session.js
+function notifyStartupWarmSkip(args) {
+  if (!args.runtime.isCurrentSession(args.sessionGeneration))
+    return;
+  const reason = args.scan.reason;
+  if (reason !== "too-many-source-files" && reason !== "too-many-entries") {
+    return;
+  }
+  const bound = reason === "too-many-entries" ? {
+    name: "maxScanEntries",
+    value: args.scan.maxScanEntries,
+    hint: `set PI_LENS_STARTUP_SCAN_MAX_ENTRIES=<n> to override the ${args.scan.maxScanEntries}-entry cap`
+  } : {
+    name: "maxProjectFiles",
+    value: args.scan.maxProjectFiles,
+    hint: `set maxProjectFiles in .pi-lens.json to override the ${args.scan.maxProjectFiles}-source-file cap`
+  };
+  recordDegradationOnce({
+    kind: "startup-warm-skipped",
+    subject: args.analysisRoot,
+    reason: `${reason}; ${bound.name}=${bound.value}`,
+    metadata: { reason, [bound.name]: bound.value }
+  });
+  args.notify(`\u{1F4E6} Project-size limits disabled background warm scans (heavy scans, TODO scan, LSP pre-warm) (${bound.hint}).`, "warning");
+}
 async function demandBootstrapDeps(deps, reason) {
   const clients = await deps.bootstrap.request(reason);
   if (!clients)
@@ -5359,8 +5442,8 @@ async function readSequenceWithBudget(args) {
   const { snapshotRoot, base, cwd, runtime, sessionGeneration, dbg, onDeferredSequenceResolved } = args;
   const readPromise = readLatestProjectSequenceAsync(snapshotRoot, base);
   let timeoutHandle;
-  const timeoutPromise = new Promise((resolve30) => {
-    timeoutHandle = setTimeout(() => resolve30({ timedOut: true }), sequenceReadBudgetMs());
+  const timeoutPromise = new Promise((resolve31) => {
+    timeoutHandle = setTimeout(() => resolve31({ timedOut: true }), sequenceReadBudgetMs());
     timeoutHandle.unref();
   });
   const raced = await Promise.race([
@@ -5460,8 +5543,8 @@ async function igniteDominantLanguageWarm(cwd, runtime, sessionGeneration, dbg)
     if (!runtime.isCurrentSession(sessionGeneration))
       return;
     const lspService = (await loadLspService()).getLSPService();
-    const { collectSourceFilesAsync } = await import("../chunk-E4MAEDPM.js");
-    const { CODE_KINDS, detectFileKind: detectFileKind2 } = await import("../chunk-O5WILGMI.js");
+    const { collectSourceFilesAsync } = await import("../chunk-J7WJZ6W7.js");
+    const { CODE_KINDS, detectFileKind: detectFileKind2 } = await import("../chunk-CFYISHUW.js");
     const files = await collectSourceFilesAsync(cwd, {
       inspectGeneratedHeaders: false
     });
@@ -5527,7 +5610,7 @@ function scheduleManagedToolRefresh(dbg) {
   const timer = setTimeout(() => {
     void (async () => {
       try {
-        const refresh = await import("../chunk-T4ERT73Y.js");
+        const refresh = await import("../chunk-CBD2B5CP.js");
         const outcome = await refresh.runManagedToolRefresh();
         if (outcome.skipped) {
           dbg(`session_start tool-refresh: skipped (${outcome.skipped})`);
@@ -5574,7 +5657,7 @@ function scanOneTodoFile(scanner, filePath, items) {
 async function collectTodoBaselineItems(scanner, analysisRoot, stillCurrent) {
   const items = [];
   try {
-    const { getSourceFilesAsync } = await import("../chunk-RPD4ZSB7.js");
+    const { getSourceFilesAsync } = await import("../chunk-KMGPUKFD.js");
     const files = await getSourceFilesAsync(analysisRoot, true);
     if (!stillCurrent())
       return items;
@@ -5603,7 +5686,7 @@ async function buildOrRefreshWordIndex(args) {
   const snapshot = loadProjectSnapshot(snapshotRoot);
   const snapshotLoadMs = Date.now() - snapshotLoadStartMs;
   if (snapshot?.wordIndex) {
-    const { deserializeWordIndex, refreshWordIndexIncrementally, countWordIndexPostingEntries: countWordIndexPostingEntries2, estimateWordIndexResidentBytes: estimateWordIndexResidentBytes2 } = await import("../chunk-XECLWQZN.js");
+    const { deserializeWordIndex, refreshWordIndexIncrementally, countWordIndexPostingEntries: countWordIndexPostingEntries2, estimateWordIndexResidentBytes: estimateWordIndexResidentBytes2 } = await import("../chunk-ZMOMPX2Z.js");
     const deserializeStartMs = Date.now();
     const index = deserializeWordIndex(snapshot.wordIndex);
     const deserializeMs = Date.now() - deserializeStartMs;
@@ -5675,7 +5758,7 @@ async function buildOrRefreshWordIndex(args) {
       }
     }
   }
-  const { buildWordIndexAsync, collectWordIndexDocs, countWordIndexPostingEntries, estimateWordIndexResidentBytes } = await import("../chunk-XECLWQZN.js");
+  const { buildWordIndexAsync, collectWordIndexDocs, countWordIndexPostingEntries, estimateWordIndexResidentBytes } = await import("../chunk-ZMOMPX2Z.js");
   const docs = await collectWordIndexDocs(analysisRoot, () => runtime.isCurrentSession(sessionGeneration), rebuildPreflightFiles);
   if (!runtime.isCurrentSession(sessionGeneration))
     return;
@@ -5745,7 +5828,7 @@ function scheduleStartupScansWithClients(deps, runtime, sessionGeneration, analy
     const queuedAt = Date.now();
     dbg(`session_start task ${name}: scheduled`);
     runtime.markStartupScanInFlight(name, sessionGeneration);
-    const completion = new Promise((resolve30) => {
+    const completion = new Promise((resolve31) => {
       const fire = () => {
         const startedAt = Date.now();
         dbg(`session_start task ${name}: start queuedMs=${startedAt - queuedAt}`);
@@ -5757,7 +5840,7 @@ function scheduleStartupScansWithClients(deps, runtime, sessionGeneration, analy
         }).finally(() => {
           runtime.clearStartupScanInFlight(name, sessionGeneration);
           dbg(`session_start task ${name}: end`);
-          resolve30();
+          resolve31();
         });
       };
       const delay = taskDeferMsByName[name] ?? 0;
@@ -6040,9 +6123,9 @@ function scheduleStartupScansWithClients(deps, runtime, sessionGeneration, analy
   });
   let callGraphIdentity;
   const callGraphTask = runTask("call-graph", async () => {
-    const { FactStore: FactStore2 } = await import("../chunk-YSNFMJKN.js");
-    const { buildOrUpdateGraph, extractSymbolsAndRefsFromGraph, getReviewGraphCacheIdentity } = await import("../chunk-VD4JQCQC.js");
-    const { buildCallGraph, saveCallGraph, loadCallGraph: loadCallGraph2 } = await import("../chunk-FJNKANOS.js");
+    const { FactStore: FactStore2 } = await import("../chunk-CULQYFLU.js");
+    const { buildOrUpdateGraph, extractSymbolsAndRefsFromGraph, getReviewGraphCacheIdentity } = await import("../chunk-3TTPKMEF.js");
+    const { buildCallGraph, saveCallGraph, loadCallGraph: loadCallGraph2 } = await import("../chunk-GAYGGICG.js");
     if (!runtime.isCurrentSession(sessionGeneration))
       return;
     const startMs = Date.now();
@@ -6083,7 +6166,7 @@ function scheduleStartupScansWithClients(deps, runtime, sessionGeneration, analy
       return;
     if (!runtime.callGraph)
       return;
-    const { buildCodebaseModel, saveCodebaseModel, DEFAULT_CODEBASE_MODEL_TOKEN_BUDGET } = await import("../chunk-K6VYLB2U.js");
+    const { buildCodebaseModel, saveCodebaseModel, DEFAULT_CODEBASE_MODEL_TOKEN_BUDGET } = await import("../chunk-6UYA642J.js");
     if (!callGraphIdentity)
       return;
     const model = buildCodebaseModel(runtime.callGraph, analysisRoot, DEFAULT_CODEBASE_MODEL_TOKEN_BUDGET, callGraphIdentity);
@@ -6161,6 +6244,7 @@ var SESSION_START_GUIDANCE = [
 ];
 async function handleSessionStart(deps) {
   resetDegradationLedger();
+  let sessionGenerationAtStart = deps.runtime.sessionGeneration;
   resetAnalyzerBootstrapSessionState();
   resetProjectDataDirSessionState();
   resetTestRunnerDelivery();
@@ -6199,8 +6283,8 @@ async function handleSessionStart(deps) {
         try {
           warmupDbg("warmup: starting background warmup");
           const scanContextStartedAt = Date.now();
-          const startupScanModule = await import("../chunk-ODEEOXPH.js");
-          const languageProfileModule = await import("../chunk-AWE5TMPO.js");
+          const startupScanModule = await import("../chunk-6B5I6ICN.js");
+          const languageProfileModule = await import("../chunk-7M4T5N3V.js");
           const warmupSnapshotRoot = resolveSnapshotRoot(warmupCwd);
           const cachedSnapshot = loadProjectSnapshot(warmupSnapshotRoot);
           warmupOwnSnapshotRead = cachedSnapshot ? {
@@ -6241,6 +6325,13 @@ async function handleSessionStart(deps) {
           });
           if (!scan.canWarmCaches) {
             warmupDbg(`warmup: skipping language-profile (canWarm=false, reason=${scan.reason ?? "unknown"})`);
+            notifyStartupWarmSkip({
+              scan,
+              analysisRoot: scan.projectRoot ?? warmupCwd,
+              notify: deps.notify,
+              runtime: deps.runtime,
+              sessionGeneration: sessionGenerationAtStart
+            });
             return;
           }
           const languageRoot = scan.projectRoot ?? warmupCwd;
@@ -6356,6 +6447,7 @@ async function handleSessionStart(deps) {
   deps.bootstrap.peek()?.knipClient.resetSessionState?.();
   resetCascadeTierSessionState();
   runtime.resetForSession(sessionStartMs);
+  sessionGenerationAtStart = runtime.sessionGeneration;
   logLatency({
     type: "phase",
     phase: "session_start_runtime_reset",
@@ -6792,10 +6884,13 @@ async function handleSessionStart(deps) {
   } else if (!startupScan.canWarmCaches) {
     dbg(`session_start: skipping heavy scans (${startupScan.reason ?? "unknown"})`);
     dbg(`session_start: skipping TODO scan (${startupScan.reason ?? "unknown"})`);
-    if (startupScan.reason === "too-many-source-files" || startupScan.reason === "too-many-entries") {
-      const overrideHint = startupScan.reason === "too-many-entries" ? ` (set PI_LENS_STARTUP_SCAN_MAX_ENTRIES=<n> to override the ${getStartupScanMaxEntries()}-entry cap)` : "";
-      notify(`\u{1F4E6} Project-size limits disabled background warm scans (heavy scans, TODO scan, LSP pre-warm)${overrideHint}.`, "warning");
-    }
+    notifyStartupWarmSkip({
+      scan: startupScan,
+      analysisRoot,
+      notify,
+      runtime,
+      sessionGeneration
+    });
   } else {
     scheduleStartupScans(deps, runtime, sessionGeneration, analysisRoot, snapshotRoot, languageProfile, dbg);
   }
@@ -7235,7 +7330,7 @@ async function buildActionableWarningsReport(args) {
           }
         };
         const deferredWork = (async () => {
-          await new Promise((resolve30) => setTimeout(resolve30, 0));
+          await new Promise((resolve31) => setTimeout(resolve31, 0));
           const deferredRecords = [...carried];
           const deferredDeadline = Date.now() + ACTIONABLE_WARNINGS_DEFERRED_BUDGET_MS;
           deferredDeps.deadlineAt = deferredDeadline;
@@ -8610,7 +8705,7 @@ function stillReportedParked(parked, current, keyOf, offeredKeys) {
 }
 
 // dist/clients/knip-scan-roots.js
-import { resolve as resolve11 } from "node:path";
+import { resolve as resolve12 } from "node:path";
 var MAX_KNIP_ROOTS_PER_TURN = 3;
 function resolveKnipScanRoots(sessionCwd, modifiedFiles) {
   const session = resolveGitCheckout(sessionCwd);
@@ -8620,7 +8715,7 @@ function resolveKnipScanRoots(sessionCwd, modifiedFiles) {
   let sessionOwnsEdit = false;
   const linked = [];
   for (const file of modifiedFiles) {
-    const owner = resolveLinkedWorktreeOwner(session, resolve11(sessionCwd, file));
+    const owner = resolveLinkedWorktreeOwner(session, resolve12(sessionCwd, file));
     if (owner === null) {
       sessionOwnsEdit = true;
     } else if (!linked.some((known) => pathsEqual(known.root, owner.root))) {
@@ -9249,7 +9344,7 @@ async function runTestTargetsBounded(args) {
   });
   void pool.catch(() => {
   });
-  await new Promise((resolve30) => {
+  await new Promise((resolve31) => {
     let settled = false;
     const finish = (reason) => {
       if (settled)
@@ -9261,7 +9356,7 @@ async function runTestTargetsBounded(args) {
       batchAbort.abort();
       clearTimeout(timer);
       args.signal?.removeEventListener("abort", onAbort);
-      resolve30();
+      resolve31();
     };
     const onAbort = () => finish("abort");
     const timer = setTimeout(() => finish("budget"), budgetMs);
@@ -11236,8 +11331,8 @@ ${suffix}`;
     } else {
       const callGraphStart = Date.now();
       try {
-        const { impact, formatImpact, parseSymbolKey } = await import("../chunk-FJNKANOS.js");
-        const { callGraphImpactToProjectDiagnostics } = await import("../chunk-47D2BO4S.js");
+        const { impact, formatImpact, parseSymbolKey } = await import("../chunk-GAYGGICG.js");
+        const { callGraphImpactToProjectDiagnostics } = await import("../chunk-VPWKF3GN.js");
         const impactLines = [];
         let callGraphDispositionSuppressed = 0;
         const impactFindings = [];
@@ -12186,10 +12281,10 @@ var TurnEndQueue = class {
     if (this.pending.length >= 1) {
       return Promise.reject(new Error("turn_end queue is busy"));
     }
-    return new Promise((resolve30, reject) => {
+    return new Promise((resolve31, reject) => {
       const item = {
         work,
-        resolve: resolve30,
+        resolve: resolve31,
         reject,
         timer: setTimeout(() => {
           const index = this.pending.indexOf(item);
@@ -12926,7 +13021,7 @@ function blastReadArgs(graph, normalizedFile) {
   return { path: normalizedFile, offset: 1, limit };
 }
 async function computeBlastRadius(graph, normalizedPath, projectRoot, maxDepth) {
-  const { computeTransitiveImpact } = await import("../chunk-34U7PLGE.js");
+  const { computeTransitiveImpact } = await import("../chunk-PCHDGUKT.js");
   const result = computeTransitiveImpact(graph, normalizedPath, { maxDepth });
   const byFile = /* @__PURE__ */ new Map();
   for (const hit of result.hits) {
@@ -13543,7 +13638,7 @@ async function moduleReport(file, cwd, options) {
   let callGraphIdentity;
   let revisionDriftNote;
   try {
-    const { getCachedReviewGraph, getReviewGraphCacheIdentity, getReviewGraphSizeSkipVerdict, getReviewGraphRevisionDrift, formatReviewGraphRevisionDriftNote: formatReviewGraphRevisionDriftNote2 } = await import("../chunk-VD4JQCQC.js");
+    const { getCachedReviewGraph, getReviewGraphCacheIdentity, getReviewGraphSizeSkipVerdict, getReviewGraphRevisionDrift, formatReviewGraphRevisionDriftNote: formatReviewGraphRevisionDriftNote2 } = await import("../chunk-3TTPKMEF.js");
     graph = getCachedReviewGraph(cwd);
     graphFileCap = getReviewGraphSizeSkipVerdict(cwd)?.maxFileCount;
     const drift = graph ? getReviewGraphRevisionDrift(cwd) : void 0;
@@ -14327,7 +14422,7 @@ function roleFor(graph, filePath) {
   return top.length > 0 ? top.map((s) => s.name).join(", ") : void 0;
 }
 async function computeHubs(graph, degrees, cwd, limit, focusTerms) {
-  const { computeTransitiveImpact } = await import("../chunk-34U7PLGE.js");
+  const { computeTransitiveImpact } = await import("../chunk-PCHDGUKT.js");
   const ranked = [...graph.fileNodes.entries()].map(([filePath, fileNodeId]) => ({
     filePath,
     fileNodeId,
@@ -14579,7 +14674,7 @@ async function projectReport(cwd, options) {
   const limit = clampLimit(options?.limit);
   const focusTerms = normalizeFocus2(options?.focus);
   const view = options?.view;
-  const { getCachedReviewGraph, getReviewGraphSizeSkipVerdict, getLastReviewGraphBuildAttempt, buildOrUpdateGraph, isGraphBuildInFlight, getReviewGraphRevisionDrift } = await import("../chunk-VD4JQCQC.js");
+  const { getCachedReviewGraph, getReviewGraphSizeSkipVerdict, getLastReviewGraphBuildAttempt, buildOrUpdateGraph, isGraphBuildInFlight, getReviewGraphRevisionDrift } = await import("../chunk-3TTPKMEF.js");
   let graph;
   try {
     graph = getCachedReviewGraph(cwd);
@@ -14603,7 +14698,7 @@ async function projectReport(cwd, options) {
       };
     }
     const previousAttempt = getLastReviewGraphBuildAttempt(cwd);
-    const { FactStore: FactStore2 } = await import("../chunk-YSNFMJKN.js");
+    const { FactStore: FactStore2 } = await import("../chunk-CULQYFLU.js");
     const trigger = triggerBackgroundGraphBuild(cwd, {
       buildOrUpdateGraph,
       isGraphBuildInFlight,
@@ -15022,7 +15117,7 @@ async function symbolSearch(query, cwd, limit = 20, options = {}) {
     warmLease.release();
   }
   const hits = results.map(toSymbolSearchHit);
-  const { getCachedReviewGraph } = await import("../chunk-VD4JQCQC.js");
+  const { getCachedReviewGraph } = await import("../chunk-3TTPKMEF.js");
   const graph = getCachedReviewGraph(cwd);
   if (graph)
     annotateSymbolSearchHitsWithGraph(hits, centrality, graph);
@@ -15388,7 +15483,7 @@ function createAstGrepReplaceTool(astGrepClient2, captureLineage) {
             details: {}
           };
         }
-        const ruleResult = await astGrepClient2.replaceWithRule(ruleYaml, searchPaths, applyFlag);
+        const ruleResult = await astGrepClient2.replaceWithRule(ruleYaml, searchPaths, applyFlag, { lineage, toolCallId: _toolCallId });
         if (ruleResult.stalePreview) {
           logOutcome("error", { errorRaw: "stale_preview" });
           return {
@@ -15427,7 +15522,7 @@ function createAstGrepReplaceTool(astGrepClient2, captureLineage) {
           }
         };
       }
-      const result = await astGrepClient2.replace(pattern, rewrite, lang, searchPaths, applyFlag, { strictness, lineage });
+      const result = await astGrepClient2.replace(pattern, rewrite, lang, searchPaths, applyFlag, { strictness, lineage, toolCallId: _toolCallId });
       if (result.stalePreview) {
         logOutcome("error", { errorRaw: "stale_preview" });
         return {
@@ -16824,12 +16919,12 @@ async function fetchFreshProjectDiagnostics(cacheManager2, cwd, clients, signal,
   const allSettled = Promise.all(tasks).then(() => "completed").catch(() => "completed");
   const outcome = signal ? await Promise.race([
     allSettled,
-    new Promise((resolve30) => {
+    new Promise((resolve31) => {
       if (signal.aborted) {
-        resolve30("aborted");
+        resolve31("aborted");
         return;
       }
-      signal.addEventListener("abort", () => resolve30("aborted"), {
+      signal.addEventListener("abort", () => resolve31("aborted"), {
         once: true
       });
     })
@@ -17272,7 +17367,7 @@ function coveredSourcesForCheck(file, serverScope, unconfirmedServerIds) {
     return [];
   }
   for (const server of servers) {
-    const auxiliary = server.role === "auxiliary";
+    const auxiliary = isAuxiliary(server);
     if (auxiliary && serverScope === "primary")
       continue;
     if (unconfirmed.has(server.id))
@@ -17748,12 +17843,12 @@ async function collectBatchDiagnostics(files, severity, lspService, options) {
       });
       const result = options.signal ? await Promise.race([
         bounded2,
-        new Promise((resolve30) => {
+        new Promise((resolve31) => {
           if (options.signal?.aborted) {
-            resolve30(void 0);
+            resolve31(void 0);
             return;
           }
-          options.signal?.addEventListener("abort", () => resolve30(void 0), {
+          options.signal?.addEventListener("abort", () => resolve31(void 0), {
             once: true
           });
         })
@@ -18170,7 +18265,7 @@ async function findFullScanBindingMismatches(results) {
     sinceYield += 1;
     if (sinceYield >= FULL_SCAN_BINDING_YIELD_EVERY) {
       sinceYield = 0;
-      await new Promise((resolve30) => setImmediate(resolve30));
+      await new Promise((resolve31) => setImmediate(resolve31));
     }
   }
   return mismatched;
@@ -20724,6 +20819,10 @@ function createLspNavigationTool(getFlag, mutationDeps) {
         mutationContext = {
           cwd,
           correlationId: newLspMutationCorrelationId(_toolCallId),
+          // #4187 R4-1: the call whose `tool_call` licensed the paths it
+          // named; the workspace edit's other files (a rename's importers)
+          // are unlicensed, so they end an authorship instead of advancing it.
+          toolCallId: _toolCallId,
           tool: `lsp_navigation:${operation}`,
           source: mutationSource,
           ...mutationDeps,
@@ -20977,7 +21076,7 @@ ${JSON.stringify(result2)}`
           const msg = err instanceof Error ? err.message : String(err);
           if (rawPath && /No Project/i.test(msg)) {
             await openFileBestEffort(lspService, filePath);
-            await new Promise((resolve30) => setTimeout(resolve30, 120));
+            await new Promise((resolve31) => setTimeout(resolve31, 120));
             const retryRaw = await lspService.workspaceSymbol(query ?? "", filePath);
             const retrySymbols = (Array.isArray(retryRaw) ? retryRaw : [retryRaw]).filter((s) => typeof s === "object" && s !== null);
             return dedupeWorkspaceSymbols(retrySymbols);