@herbertgao/pi-extensions 2026.8.11 → 2026.8.13

package/node_modules/{@herbertgao → @tifan}/pi-preferred-thinking/src/index.ts

@@ -35,12 +35,7 @@ function getModelKey(provider: string, modelId: string): string {
 
 function readSettings(): PiSettings {
   const content = readFileSync(SETTINGS_PATH, "utf8")
-  let settings: unknown
-  try {
-    settings = JSON.parse(content)
-  } catch {
-    return {}
-  }
+  const settings = JSON.parse(content) as unknown
   return settings && typeof settings === "object" && !Array.isArray(settings)
     ? (settings as PiSettings)
     : {}

package/node_modules/{@herbertgao → @tifan}/pi-recap/README.md

@@ -1,6 +1,4 @@
-# @herbertgao/pi-recap
-
-> HerbertGao-maintained fork of [@tifan/pi-recap](https://github.com/tifandotme/pi-extensions/tree/master/packages/pi-recap), distributed under MIT with the original attribution preserved.
+# @tifan/pi-recap
 
 Re-enter a session without rereading the transcript.
 
@@ -11,7 +9,7 @@ Re-enter a session without rereading the transcript.
 ## Install
 
 ```bash
-pi install npm:@herbertgao/pi-recap
+pi install npm:@tifan/pi-recap
 ```
 
 This package requires Pi 0.84.2 or newer.
@@ -56,8 +54,8 @@ You can also edit `~/.config/pi/extensions/pi-recap.json` manually:
 
 ## Release notes
 
-See [CHANGELOG.md](CHANGELOG.md).
+See [CHANGELOG.md](https://github.com/tifandotme/pi-extensions/blob/master/packages/pi-recap/CHANGELOG.md)
 
 ## License
 
-[MIT](LICENSE)
+[MIT](https://github.com/tifandotme/pi-extensions/blob/master/LICENSE)

package/node_modules/@tifan/pi-recap/package.json

@@ -0,0 +1,42 @@
+{
+  "name": "@tifan/pi-recap",
+  "version": "0.4.5",
+  "description": "One-line session recap on demand or after you have been away.",
+  "keywords": [
+    "pi",
+    "pi-extension",
+    "pi-package",
+    "recap",
+    "summary"
+  ],
+  "homepage": "https://github.com/tifandotme/pi-extensions/tree/master/packages/pi-recap#readme",
+  "bugs": "https://github.com/tifandotme/pi-extensions/issues",
+  "license": "MIT",
+  "author": "Tifan Dwi Avianto <hi@tifan.me>",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/tifandotme/pi-extensions.git",
+    "directory": "packages/pi-recap"
+  },
+  "files": [
+    "src/**/*.ts",
+    "README.md",
+    "LICENSE"
+  ],
+  "type": "module",
+  "publishConfig": {
+    "access": "public",
+    "provenance": true
+  },
+  "peerDependencies": {
+    "@earendil-works/pi-coding-agent": ">=0.84.2"
+  },
+  "engines": {
+    "node": ">=20"
+  },
+  "pi": {
+    "extensions": [
+      "./src/index.ts"
+    ]
+  }
+}

package/node_modules/{@herbertgao → @tifan}/pi-recap/src/models.ts

@@ -79,12 +79,7 @@ export function parseModelSpec(
 
 function readConfig(): RecapConfig {
   const content = readFileSync(CONFIG_PATH, "utf-8")
-  let config: unknown
-  try {
-    config = JSON.parse(content)
-  } catch {
-    return {}
-  }
+  const config = JSON.parse(content) as unknown
   return config && typeof config === "object" && !Array.isArray(config)
     ? (config as RecapConfig)
     : {}

package/node_modules/{@herbertgao → @tifan}/pi-rename/README.md

@@ -1,13 +1,11 @@
-# @herbertgao/pi-rename
-
-> HerbertGao-maintained fork of [@tifan/pi-rename](https://github.com/tifandotme/pi-extensions/tree/master/packages/pi-rename), distributed under MIT with the original attribution preserved.
+# @tifan/pi-rename
 
 Generate session names for pi and Herdr.
 
 ## Install
 
 ```bash
-pi install npm:@herbertgao/pi-rename
+pi install npm:@tifan/pi-rename
 ```
 
 This package requires Pi 0.84.2 or newer.
@@ -16,7 +14,7 @@ This package requires Pi 0.84.2 or newer.
 
 Run `/rename` to generate a fresh hyphen-separated session name. The extension applies the name to the pi session and, when pi is running inside Herdr, to the current pane and tab when it is the tab's only pane, or to the current pane in a split tab.
 
-When a named session starts or resumes in Herdr, the extension applies the saved pi session name when the target still has its default label or the temporary `herdr-wrap` label.
+When a named session starts or resumes in Herdr, the extension applies the saved pi session name when the target still has its default or temporary startup label.
 
 `/rename` builds naming context from the first user message plus up to three latest user messages. It ignores assistant replies, tool output, and attachments. Before sending context to the rename model, it redacts common secrets.
 
@@ -53,16 +51,23 @@ Herdr tab renaming requires the `herdr` CLI. If it is unavailable, the extension
 
 The extension uses `HERDR_PANE_ID` to find the current Herdr pane. With one pane in the tab, it renames both the pane and tab. With sibling panes, it renames only the current pane.
 
-On session startup or resume, it does not overwrite custom Herdr labels. It recognizes the temporary label from the Nushell `herdr-wrap` wrapper so saved session names still apply.
+On session startup or resume, it does not overwrite custom Herdr labels. It replaces only Herdr's default or temporary startup labels, so saved session names still apply.
+
+If your launcher gives Pi a temporary Herdr label, it must set `HERDR_TEMPORARY_LABEL` before starting Pi. The value must match the label shown in Herdr. In Bash, pass it to Pi inline:
+
+```bash
+HERDR_TEMPORARY_LABEL="my-project (pi)" pi
+```
 
+If you do not set this variable, `pi-rename` replaces only Herdr's default label.
 On quit, the target keeps the last session name.
 
 If pi is not running inside Herdr, only the pi session name is updated.
 
 ## Release notes
 
-See [CHANGELOG.md](CHANGELOG.md).
+See [CHANGELOG.md](https://github.com/tifandotme/pi-extensions/blob/master/packages/pi-rename/CHANGELOG.md)
 
 ## License
 
-[MIT](LICENSE)
+[MIT](https://github.com/tifandotme/pi-extensions/blob/master/LICENSE)

package/node_modules/@tifan/pi-rename/package.json

@@ -0,0 +1,47 @@
+{
+  "name": "@tifan/pi-rename",
+  "version": "0.5.1",
+  "description": "Generate pi session names and rename the current Herdr tab.",
+  "keywords": [
+    "herdr",
+    "pi",
+    "pi-extension",
+    "pi-package",
+    "rename",
+    "session",
+    "tab"
+  ],
+  "homepage": "https://github.com/tifandotme/pi-extensions/tree/master/packages/pi-rename#readme",
+  "bugs": "https://github.com/tifandotme/pi-extensions/issues",
+  "license": "MIT",
+  "author": "Tifan Dwi Avianto <hi@tifan.me>",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/tifandotme/pi-extensions.git",
+    "directory": "packages/pi-rename"
+  },
+  "files": [
+    "src/**/*.ts",
+    "README.md",
+    "LICENSE"
+  ],
+  "type": "module",
+  "exports": {
+    "./naming": "./src/naming.ts"
+  },
+  "publishConfig": {
+    "access": "public",
+    "provenance": true
+  },
+  "peerDependencies": {
+    "@earendil-works/pi-coding-agent": ">=0.84.2"
+  },
+  "engines": {
+    "node": ">=20"
+  },
+  "pi": {
+    "extensions": [
+      "./src/index.ts"
+    ]
+  }
+}

package/node_modules/@tifan/pi-rename/src/herdr-label.ts

@@ -0,0 +1,4 @@
+export function isTemporaryHerdrLabel(label: string | undefined): boolean {
+  const temporaryLabel = process.env["HERDR_TEMPORARY_LABEL"]?.trim()
+  return Boolean(temporaryLabel) && label?.trim() === temporaryLabel
+}

package/node_modules/{@herbertgao → @tifan}/pi-rename/src/index.ts

@@ -1,5 +1,4 @@
 import { execFile } from "node:child_process"
-import path from "node:path"
 import { promisify } from "node:util"
 import type { AgentMessage } from "@earendil-works/pi-agent-core"
 import {
@@ -23,6 +22,7 @@ import {
   saveModelPreference,
   type RenameModelConfig,
 } from "./models.js"
+import { isTemporaryHerdrLabel } from "./herdr-label.js"
 import { generateRename, getUserMessageContext } from "./naming.js"
 
 const execFileAsync = promisify(execFile)
@@ -78,21 +78,13 @@ interface HerdrTabInfo {
   readonly paneCount?: number
 }
 
-function parseRecord(value: string): Record<string, unknown> | undefined {
-  try {
-    return asRecord(JSON.parse(value) as unknown)
-  } catch {
-    return undefined
-  }
-}
-
 interface HerdrContext {
   readonly pane: HerdrPaneInfo
   readonly tab: HerdrTabInfo
 }
 
 function extractPaneInfo(stdout: string): HerdrPaneInfo | undefined {
-  const parsed = parseRecord(stdout)
+  const parsed = asRecord(JSON.parse(stdout) as unknown)
   const result = asRecord(parsed?.["result"])
   const pane = asRecord(result?.["pane"])
   const paneId = pane?.["pane_id"]
@@ -116,7 +108,7 @@ function extractPaneInfo(stdout: string): HerdrPaneInfo | undefined {
 }
 
 function extractTabInfo(stdout: string): HerdrTabInfo | undefined {
-  const parsed = parseRecord(stdout)
+  const parsed = asRecord(JSON.parse(stdout) as unknown)
   const result = asRecord(parsed?.["result"])
   const tab = asRecord(result?.["tab"])
   const tabId = tab?.["tab_id"]
@@ -163,16 +155,12 @@ function isDefaultHerdrTabLabel(tab: HerdrTabInfo): boolean {
   return typeof tab.number === "number" && label === String(tab.number)
 }
 
-function isPiWrapperLabel(label: string | undefined): boolean {
-  return label?.trim() === `${path.basename(process.cwd())} (pi)`
-}
-
 function canRenameSessionStart(context: HerdrContext): boolean {
   const singlePane = context.tab.paneCount === 1
   const label = singlePane ? context.tab.label : context.pane.label
   return (
     (singlePane ? isDefaultHerdrTabLabel(context.tab) : !label?.trim()) ||
-    isPiWrapperLabel(label)
+    isTemporaryHerdrLabel(label)
   )
 }
 

package/node_modules/{@herbertgao → @tifan}/pi-rename/src/models.ts

@@ -83,12 +83,7 @@ export function parseModelSpec(
 
 function readConfig(): RenameConfig {
   const content = readFileSync(CONFIG_PATH, "utf-8")
-  let config: unknown
-  try {
-    config = JSON.parse(content)
-  } catch {
-    return {}
-  }
+  const config = JSON.parse(content) as unknown
   return config && typeof config === "object" && !Array.isArray(config)
     ? (config as RenameConfig)
     : {}

package/node_modules/{@herbertgao → @tifan}/pi-titlebar-spinner/README.md

@@ -1,6 +1,4 @@
-# @herbertgao/pi-titlebar-spinner
-
-> HerbertGao-maintained fork of [@tifan/pi-titlebar-spinner](https://github.com/tifandotme/pi-extensions/tree/master/packages/pi-titlebar-spinner), distributed under MIT with the original attribution preserved.
+# @tifan/pi-titlebar-spinner
 
 Show a braille spinner in the pi titlebar while the agent runs.
 
@@ -14,7 +12,7 @@ The spinner starts on `agent_start` and stops when the agent settles or the sess
 ## Install
 
 ```bash
-pi install npm:@herbertgao/pi-titlebar-spinner
+pi install npm:@tifan/pi-titlebar-spinner
 ```
 
 ## Release notes

package/node_modules/{@herbertgao → @tifan}/pi-titlebar-spinner/package.json

@@ -1,5 +1,5 @@
 {
-  "name": "@herbertgao/pi-titlebar-spinner",
+  "name": "@tifan/pi-titlebar-spinner",
   "version": "0.1.3",
   "description": "Show a spinner in the pi titlebar while the agent runs.",
   "keywords": [
@@ -9,22 +9,18 @@
     "spinner",
     "titlebar"
   ],
-  "homepage": "https://github.com/HerbertGao/pi-extensions/tree/master/packages/pi-titlebar-spinner#readme",
-  "bugs": "https://github.com/HerbertGao/pi-extensions/issues",
+  "homepage": "https://github.com/tifandotme/pi-extensions/tree/master/packages/pi-titlebar-spinner#readme",
+  "bugs": "https://github.com/tifandotme/pi-extensions/issues",
   "license": "MIT",
-  "author": "Herbert Gao",
-  "contributors": [
-    "Tifan Dwi Avianto <hi@tifan.me>"
-  ],
+  "author": "Tifan Dwi Avianto <hi@tifan.me>",
   "repository": {
     "type": "git",
-    "url": "git+https://github.com/HerbertGao/pi-extensions.git",
+    "url": "git+https://github.com/tifandotme/pi-extensions.git",
     "directory": "packages/pi-titlebar-spinner"
   },
   "files": [
     "src/**/*.ts",
     "README.md",
-    "CHANGELOG.md",
     "LICENSE"
   ],
   "type": "module",
@@ -39,11 +35,5 @@
     "extensions": [
       "./src/index.ts"
     ]
-  },
-  "x-upstream": {
-    "package": "@tifan/pi-titlebar-spinner",
-    "version": "0.1.3",
-    "repository": "https://github.com/tifandotme/pi-extensions",
-    "commit": "460d580"
   }
 }

package/node_modules/pi-lens/CHANGELOG.md

@@ -16,7 +16,7 @@ All notable changes to pi-lens will be documented in this file.
 
 ### Security
 
-## [4.1.1] - 2026-08-21
+## [4.1.2] - 2026-08-24
 
 ### Added
 
@@ -44,6 +44,52 @@ All notable changes to pi-lens will be documented in this file.
 
 - **latency.log now says whether the LSP pool reused a client or spawned one (closes #1934)** — `lsp_client_selected` fired 5601 times in a 20.8h dogfood window carrying only `{serverId, candidateCount}`, so nothing in the log said whether the pool served a warm client or paid for a language-server spawn. This is the most expensive cache in pi-lens: a miss costs a process. The only estimate was a cross-record inference against `lsp_launch_candidate_success`, which counts something else, so a regression that halved pool reuse was invisible. The record now carries an `outcome` field with one of three values on the same record and the same denominator. `warm-reuse` means the pool served an already-connected client. `cold-spawn` means this selection waited on a spawn, whether it started that spawn or joined one already in flight, so a session-start burst where many files wait on the same spawn reads as several cold spawns and deflates the apparent reuse rate for that window. `spawn-failure` means a spawn ran and failed. Reuse rate is `warm-reuse / (warm-reuse + cold-spawn)`. A spawn failure is deliberately distinct from a clean decline: no root, a breaker already open, host trust refused, or a binary absent while installs are disabled. Declines emit no outcome record and keep their existing ones, so `lsp_client_unavailable` and the `outcome` field can both describe the same event and are counted separately. `getWarmClientForFile`, the warm-only lookup the cascade quiet window and read expansion call per file, previously returned `undefined` and emitted nothing; it now emits a bounded `lsp_warm_client_missing` record naming the candidate server and root, rising-edge per candidate set with the exact count in the degradation ledger.
 
+- **Dogfood sessions on pi-lens's own repo now activate the oxlint, spellcheck, yamllint, and taplo runner lanes (refs #1844)** — four new root config files (`.oxlintrc.json`, `typos.toml`, `.yamllint`, `taplo.toml`) opt pi-lens's own repository into linters it already ships for every other project. `.oxlintrc.json` pins `oxlint` as a new exact-version devDependency (1.79.0, matching the runner's tested fixture), makes oxlint this repo's sole preferred JS/TS lint runner (dropping the `biome-check-json` fallback — that IS the dogfood intent), and excludes the fixture directories that carry no config override of their own; oxlint's nested-config discovery still finds the two fixture directories that deliberately escalate severity for the runner's own smoke tests, so those stay as they are. The oxlint runner also now tells a config-excluded file (`number_of_files: 0`) apart from a genuinely clean one, reporting `skipped` instead of a false `succeeded`. `typos.toml` allowlists evidenced false positives (a routine "mis-" prefix, HashiCorp's brand abbreviation, and similar); its presence enables typos-lsp's blocking opt-in, but findings stay advisory in practice since typos-lsp's own default diagnostic severity is warning. `.yamllint` scopes yamllint to hand-authored YAML (GitHub Actions workflows, top-level config), downgrades line-length to a warning rather than raising its threshold, and defuses the `on:` truthy false positive. `taplo.toml` activates both the TOML linter and the `taplo fmt` autofix formatter, and this PR runs that formatter once so activation doesn't start the lane red. Markdown linting was already live via the pre-existing `.markdownlint-cli2.jsonc` (since #1917) — confirmed with a real `markdownlint-cli2` run, no new config needed.
+
+- **Memory-sample observability upgrades (refs #1999)** — The periodic
+  `memory_sample` latency.log line gains three fields. `peakWorkingSetBytes`
+  records the OS high-water working set from `process.resourceUsage().maxRSS`,
+  so an idle-moment rss sample can be told apart from true growth (on Windows
+  libuv backs both counters with one `GetProcessMemoryInfo()` call: rss reads
+  current `WorkingSetSize`, maxRSS reads `PeakWorkingSetSize`). A rising-edge
+  cadence tightens sampling from every 10 turns to every turn while heapUsed
+  grows more than 20% between samples, reverting once growth stabilizes; the
+  state resets at each primary session start. Each sample now also carries
+  session age, session start time, and turn count, so growth-vs-age curves are
+  plottable from logs alone. The `/lens-health` memory line shows peak WS when
+  known.
+
+- **Opaque-write recovery for bash commands (refs #2000 phase 2)** — commands the path extractor does not recognize (python/node/perl/PowerShell internal writes) now get a bounded pre/post stat diff of the project source universe. Recovered files are attributed to the read guard as agent-authored and dispatched through the mutation seam, with explicit coverage-unknown telemetry instead of silent gaps.
+
+- **Collect-later delivery for slow auxiliary LSP servers (closes #2001, refs #2002)** —
+  When an auxiliary scanner such as opengrep misses its aux-grace window,
+  pi-lens now marks the file and server pair in a bounded pending store
+  instead of dropping the scanner's eventual findings. The next turn end
+  probes the auxiliary's client cache through a read-only seam,
+  freshness-gates the result against the mark timestamp, and delivers
+  survivors as a `Late auxiliary diagnostics` advisory. A cited file that was
+  edited or deleted since the mark drops its findings, and both drop arms are
+  counted in the new `late_auxiliary_findings` latency record.
+
+- **Freshness kernel: one comparator, one verdict type for staleness gates (closes #1739)** — `clients/freshness.ts` owns the mtime-vs-reference comparison and shared drift tolerance that six stores had independently reimplemented (three copies carried the identical #1710/#1711 tolerance defect). `freshnessFromMtime` returns an explicit verdict (`fresh` / `stale: modified-after-reference` / `indeterminate: no-mtime-evidence`) so each caller keeps its own no-evidence policy while sharing the comparison. A registered-or-fail sweep fails on any new out-of-kernel mtime-vs-reference comparison in `clients/`.
+
+- **Shared fault-injection test kit (closes #1838)** — `tests/support/fault-injection.ts` promotes the bespoke fault probes reviewers kept rebuilding by hand into four one-call primitives: `spawnWedgedChild` (a real child whose stdin pipe is genuinely full — the #1811 fixture generalized, with its fail-fast-instead-of-hang trap asserted against), `delayInside` (deterministic completion delay inside any mocked async seam), `fireResetAt` (fire a lifecycle hook from inside a seam's implementation at a chosen call — the #1746-R2-F1 shape), and `starveBudget` plus `gatedPromise` (the tiny-budget starvation repro). Every primitive carries its own fidelity test in `fault-injection.test.ts`, so a neutered primitive goes red in CI instead of silently weakening every consumer.
+
+- **Adversarial garbage battery for every CLI lint runner (closes #1839)** — Twenty runners now meet a 12-case battery of hostile outputs (truncated JSON, usage prose on the findings stream, unknown severities, hostile numbers) under format-blind invariants: never crash, never emit malformed diagnostics, never report clean on a nonzero exit carrying bytes. The first pass found 79 violations of that last invariant across 14 runners — all fixed by consolidating their identical tails onto one shared `finishParsedRun` seam. Also fixes htmlhint's `--rules` flag being fed JSON (the tool wants a ruleid list), which left zero rules enabled so every file read clean.
+
+### Changed
+
+- **pi-lens formats its own TypeScript with oxfmt (refs #1844)** — The
+  repository now carries an `.oxfmtrc.json` and an `oxfmt` devDependency, and
+  an advisory `oxfmt --check` job runs in CI. Because `hasOxfmtConfig` gates
+  the oxfmt formatter on exactly that config file, a pi-lens session opened on
+  this repository now dispatches oxfmt as the format runner for edited
+  TypeScript and JavaScript files.
+
+- **Opaque-write recovery goes git-first (refs #2000)** — inside a git worktree the pre side records only a timestamp and `git status --porcelain` plus an mtime window answers what changed, with no file-universe cap: recovery now works on any repo size, including large monorepos where the stat-walk previously degraded every command to coverage-unknown. The bounded stat-diff path remains for small non-git trees.
+
+- **ONE mutation seam: `RuntimeCoordinator.recordProjectMutation` (refs #2000 phase 1)** — the triplicated bump+change-log pairing (runtime-tool-result, runtime-agent-end, lsp-mutation) is consolidated onto one seam that bumps the seq store, appends a bounded attributed receipt ring (`getMutationsSince`, cap 512 with a surfaced dropped-count), and appends the durable change-log entry. Consumers derive touched-files answers from one store instead of three hand-copied pairings; phase 2's opaque-write recovery feeds the same seam.
+
 ### Fixed
 
 - **Search credit ignores pipe truncation (closes #1908)** — `grep -C2 pattern
@@ -106,6 +152,55 @@ All notable changes to pi-lens will be documented in this file.
 
 - **Warmup and workspace-scan walkers gate by file extension before consulting the ignore matcher, cutting a 31.7s stall to sub-second on repos with large ignored file piles (closes #1974, reported by @0xkite)** — `isIgnored` recompiles minimatch patterns per ancestor directory on every call; a runtime-output directory like `wal/` holding tens of thousands of `.log` files, gitignored only by a file-level `*.log` pattern (so the directory itself is never pruned), forced every one of those files through that cost. Six walkers checked `isIgnored` before their own cheap extension gate, paying the expensive check for files the gate would have dropped anyway: `collectSourceFilesForWarmup` (`language-profile.ts`, the reported 31.7s case), `JscpdClient.hasSourceFilesRecursive` (`jscpd-client.ts`), `classifyEntry` (`source-filter.ts`), `makeSourceCountVisitor` (`startup-scan.ts`), `getModuleSourceFiles` (`review-graph/workspace-modules.ts`), and `collectWorkspaceDiagnosticFiles` (`lsp/index.ts`). All six now run their extension (or LSP-server) gate first; output is unchanged, since both gates still have to pass to keep a file — only the order changed. A repo-wide sweep of all 14 files that call `isIgnored` found `tree-sitter-client.ts` and `tools/lsp-diagnostics.ts` already extension-first, and cleared the remaining per-event/no-ext-gate sites by construction; see the PR body for the full per-site table.
 
+- **oxfmt no longer fails on a file its own config ignores (refs #1844)** —
+  pi-lens offers oxfmt for every extension oxfmt supports, so in a project
+  whose oxfmt config carries `ignorePatterns`, oxfmt was selected for files it
+  then refused to touch. It exits 2 with "Expected at least one target file",
+  which the strict exit-code posture read as a formatting failure, so every
+  edit to an ignored file surfaced an error. pi-lens now passes
+  `--no-error-on-unmatched-pattern`, which makes an empty target set a clean
+  no-op. Every other nonzero exit, including an unparseable file, still fails.
+
+- **ESLint warnings are no longer discarded (closes #1954)** — The eslint runner treated every exit 0 as "nothing found". ESLint exits 0 whenever no rule reaches error severity, so a run that produced only warning-severity findings was thrown away silently. The runner now parses stdout unconditionally and surfaces the findings; a clean file still reports clean, and exit 2 stays an unavailable skip.
+
+- **Registered tools now always have descriptions in child/subagent sessions (closes #1988)** — the final registration boundary fills missing, empty, and
+  whitespace-only descriptions for active, lazy, activation, and wrapped tool
+  definitions.
+
+- **mode=full no longer replays stale mid-edit blockers (refs #1993)** — a confirmed, fully-covered LSP sweep is now authoritative for its files: widget-store diagnostics captured from a since-fixed broken intermediate state are retired instead of rendering as current 🔴 blockers beside a clean sweep. Unconfirmed or timed-out sweeps keep the fail-open behavior.
+
+- **Cache-miss attribution stays useful in long sessions (closes #1996)** — classify full model/provider identities and split unexplained or malformed cache evidence by bounded reason, with fail-closed request hashing, activation-owned primary/secondary isolation, sanitized numeric metadata, and a per-session cause summary.
+
+- **Project snapshots no longer rewrite unchanged same-generation bodies (closes #1997)** — Persistence now coalesces concurrent requests and computes semantic identity on its worker before gzip or staging. Same-generation content changes and failed-write repairs still publish.
+
+- **Classify oxlint no-match results as expected skips (closes #1998)**. Oxlint now carries `no-files-matched` through runner telemetry without emitting an extension error or claiming the file is clean. A single fail-closed state machine validates process completion, exit status, stderr, the captured banner, and every JSON summary field's type and range; truncated, malformed, wrong-status, or error-bearing lookalikes retain failure or unconfirmed telemetry.
+
+- **Project-snapshot persistence validates gzip body integrity before skipping (closes #2008)** —
+  The skip decision trusted the meta sidecar and a fingerprint match alone, so a torn or
+  truncated gzip under an intact meta kept winning unchanged-dedupe and stayed canonical until
+  the project sequence advanced. The meta sidecar now records the on-disk gz byte length
+  (`gzBytes`) at every successful persist, and the dedupe baselines compare it against a live
+  stat: a size mismatch, or a legacy meta without the field, withholds the dedupe fingerprints
+  so the pending save republishes and rewrites the body. A skip that would honor evidence
+  failing this gate between dispatch and promotion is refused and rewritten synchronously.
+  Detections emit one `project_snapshot_body_integrity` latency record plus a bounded
+  `snapshot-integrity` degradation-ledger entry per corrupted body path. The baselines read is
+  also now a pure read: its in-process seeding write moved to the single dispatch seam that
+  owns the persist lifecycle.
+
+- **Installer verify loop broken at the root (closes #2015)** — `verifyToolBinary` now spawns through `safeSpawnAsync` (tree-kill on timeout, typed kill-reason) instead of raw spawn whose SIGTERM orphaned grandchild node processes on Windows `.cmd` shims. A killed/inconclusive prober no longer counts as a verdict: the freshly installed binary is KEPT for cheap re-probe instead of deleted, ending the install/verify/reinstall churn (23 SIGTERMs and 4 cleanups observed in one day).
+
+- **Windows `.cmd`/`.bat` spawns no longer fail when System32 is absent from the child PATH (closes #2023)** — The cmd.exe wrapper prefixed every spawn
+  with a bare `chcp 65001 &&`. When the child environment's PATH could not
+  resolve `chcp.com`, the lookup failed and `&&` short-circuited, so the whole
+  spawn exited 1 with empty output. chcp is now invoked via its pinned
+  `%SystemRoot%\System32\chcp.com` absolute path and chained with `&`, so a
+  code-page failure can never suppress the real command.
+
+- **Register remaining agent-facing delivery surfaces (#2028)** — The per-edit 🔴 STOP block now drops blockers whose cited file no longer exists, so a deleted file's stale blocker no longer re-blocks the agent with no remediation. All five previously unregistered surfaces (stop blocker, `lsp_diagnostics` output, git-guard verdicts, read-guard preflight errors, thrashing notices) are registered in the finding-delivery gate registry.
+
+- **Wall-clock budget tests get a quiet serial phase (closes #1920)** — Five test files asserting real elapsed-time budgets ran inside the default project's fork storm, measuring scheduler contention instead of code speed (`startup-overhead` measured 659-2321ms against a 500ms budget under load, green solo every time). They now run in a dedicated fully-serialized `wall-clock-budget` Vitest project that phases dead last on a quiet host. A coverage guard keeps the new include list from silently dropping renamed files.
+
 ## [4.1.0] - 2026-08-20
 
 ### Added

package/node_modules/pi-lens/dist/clients/actionable-warnings-logger.js

@@ -5,7 +5,8 @@ import { createNdjsonLogger } from "./ndjson-logger.js";
 const AW_LOG_DIR = getGlobalPiLensDir();
 const AW_LOG_FILE = path.join(AW_LOG_DIR, "actionable-warnings.log");
 const AW_LOG_BACKUP_FILE = path.join(AW_LOG_DIR, "actionable-warnings.log.1");
-const MAX_LOG_BYTES = Math.max(128 * 1024, Number.parseInt(process.env.PI_LENS_AW_LOG_MAX_BYTES ?? "1048576", 10) || 1048576);
+const MAX_LOG_BYTES = Math.max(128 * 1024, Number.parseInt(process.env.PI_LENS_AW_LOG_MAX_BYTES ?? "1048576", 10) ||
+    1048576);
 const writer = createNdjsonLogger({
     filePath: AW_LOG_FILE,
     maxBytes: MAX_LOG_BYTES,

package/node_modules/pi-lens/dist/clients/actionable-warnings.js

@@ -633,7 +633,12 @@ export async function applyConservativeActionableWarningFixes(args) {
                 }
                 const edit = selected.edit;
                 const applied = await applyWorkspaceEdit(edit, args.cwd, args.mutationContext
-                    ? { mutationContext: { ...args.mutationContext, emitSummary: false } }
+                    ? {
+                        mutationContext: {
+                            ...args.mutationContext,
+                            emitSummary: false,
+                        },
+                    }
                     : undefined);
                 appliedResults.push(applied);
                 for (const changedFile of applied.files)
@@ -642,8 +647,7 @@ export async function applyConservativeActionableWarningFixes(args) {
             }
             catch (err) {
                 failedCount++;
-                const partial = err
-                    .appliedWorkspaceEdit;
+                const partial = err.appliedWorkspaceEdit;
                 if (partial) {
                     appliedResults.push(partial);
                     for (const changedFile of partial.files)
@@ -656,13 +660,18 @@ export async function applyConservativeActionableWarningFixes(args) {
         }
     }
     summary.changedFiles = [...changedFiles];
-    if (args.mutationContext && (summary.considered > 0 || appliedResults.length > 0)) {
+    if (args.mutationContext &&
+        (summary.considered > 0 || appliedResults.length > 0)) {
         recordLspMutationBatch(args.mutationContext, {
             results: appliedResults,
             considered: summary.considered,
             completed: summary.applied,
             failedCount,
-            status: failedCount > 0 ? "failed" : appliedResults.length > 0 ? "success" : "skipped",
+            status: failedCount > 0
+                ? "failed"
+                : appliedResults.length > 0
+                    ? "success"
+                    : "skipped",
             bookkeep: false,
         });
     }

package/node_modules/pi-lens/dist/clients/advisory-provenance.js

@@ -4,7 +4,7 @@ import * as path from "node:path";
 import { logLatency } from "./latency-logger.js";
 import { normalizeMapKey, toProjectRelativePath } from "./path-utils.js";
 import { resolveRunnerPath } from "./dispatch/runner-context.js";
-import { MTIME_DRIFT_TOLERANCE_MS } from "./blocker-freshness.js";
+import { freshnessFromMtime } from "./freshness.js";
 export const MAX_ADVISORY_AFFECTED_FILES = 256;
 export function advisoryPathKey(filePath, cwd) {
     return normalizeMapKey(path.resolve(cwd, filePath));
@@ -68,25 +68,41 @@ function isFiniteNumber(value) {
     return typeof value === "number" && Number.isFinite(value);
 }
 function isCapturedHash(value) {
-    return typeof value === "string" &&
-        (/^[a-f0-9]{64}$/.test(value) || value === "missing" || value.startsWith("unreadable:"));
+    return (typeof value === "string" &&
+        (/^[a-f0-9]{64}$/.test(value) ||
+            value === "missing" ||
+            value.startsWith("unreadable:")));
 }
 function isWellFormed(value) {
     if (!value || typeof value !== "object")
         return false;
     const record = value;
     const revision = record.revision;
-    return !!revision && typeof revision.sessionId === "string" &&
-        isFiniteNumber(revision.projectSeq) && isFiniteNumber(revision.turnIndex) &&
-        isFiniteNumber(revision.generation) && isFiniteNumber(revision.capturedAt) &&
-        Array.isArray(record.files) && record.files.length > 0 && record.files.every((file) => !!file && typeof file.path === "string" &&
-        (file.role === "source" || file.role === "test" || file.role === "affected") &&
-        isFiniteNumber(file.mtimeMs) && isFiniteNumber(file.size) &&
-        isCapturedHash(file.sha256));
+    return (!!revision &&
+        typeof revision.sessionId === "string" &&
+        isFiniteNumber(revision.projectSeq) &&
+        isFiniteNumber(revision.turnIndex) &&
+        isFiniteNumber(revision.generation) &&
+        isFiniteNumber(revision.capturedAt) &&
+        Array.isArray(record.files) &&
+        record.files.length > 0 &&
+        record.files.every((file) => !!file &&
+            typeof file.path === "string" &&
+            (file.role === "source" ||
+                file.role === "test" ||
+                file.role === "affected") &&
+            isFiniteNumber(file.mtimeMs) &&
+            isFiniteNumber(file.size) &&
+            isCapturedHash(file.sha256)));
 }
 export function validateAdvisoryProvenance(record, cwd, runtime) {
     if (!isWellFormed(record.provenance)) {
-        return { status: "unknown", reasons: ["malformed-or-legacy-provenance"], allFilesDeleted: false, changedPathCount: 0 };
+        return {
+            status: "unknown",
+            reasons: ["malformed-or-legacy-provenance"],
+            allFilesDeleted: false,
+            changedPathCount: 0,
+        };
     }
     const provenance = record.provenance;
     const reasons = [];
@@ -149,9 +165,19 @@ export function validateAdvisoryProvenance(record, cwd, runtime) {
     }
     const allFilesDeleted = deletedFiles === provenance.files.length;
     if (unknown)
-        return { status: "unknown", reasons, allFilesDeleted, changedPathCount: changedPaths.size };
+        return {
+            status: "unknown",
+            reasons,
+            allFilesDeleted,
+            changedPathCount: changedPaths.size,
+        };
     return reasons.length > 0
-        ? { status: "superseded", reasons, allFilesDeleted, changedPathCount: changedPaths.size }
+        ? {
+            status: "superseded",
+            reasons,
+            allFilesDeleted,
+            changedPathCount: changedPaths.size,
+        }
         : { status: "current", reasons: [], allFilesDeleted, changedPathCount: 0 };
 }
 // ── Finding-cited path existence (#1461 slice 1) ──────────────────────────────
@@ -224,11 +250,15 @@ const MAX_LOGGED_DEAD_PATHS = 3;
 export function findingPathFreshness(resolvedPath, scannedAtMs) {
     try {
         const stat = fs.statSync(resolvedPath);
-        if (scannedAtMs !== undefined &&
-            stat.mtimeMs > scannedAtMs + MTIME_DRIFT_TOLERANCE_MS) {
-            return "stale";
-        }
-        return "live";
+        // No scan timestamp recorded: the pre-kernel behavior treated the
+        // path as live (no reference to be stale against) - preserved.
+        if (scannedAtMs === undefined)
+            return "live";
+        const verdict = freshnessFromMtime({
+            mtimeMs: stat.mtimeMs,
+            referenceMs: scannedAtMs,
+        });
+        return verdict.verdict === "stale" ? "stale" : "live";
     }
     catch (error) {
         const code = error.code ?? "unknown";

package/node_modules/pi-lens/dist/clients/ast-grep-client.js

@@ -113,9 +113,7 @@ export class AstGrepClient {
                 (fs.existsSync(projectRuleDir)
                     ? projectRuleDir
                     : resolvePackagePath(import.meta.url, "rules"));
-        this.log = verbose
-            ? createSubsystemLogger("ast-grep")
-            : () => { };
+        this.log = verbose ? createSubsystemLogger("ast-grep") : () => { };
         this.ruleManager = new AstGrepRuleManager(this.ruleDir, this.log);
         this.runner = new SgRunner(verbose);
     }