@herbertgao/pi-extensions 2026.8.11 → 2026.8.13

package/node_modules/pi-lens/dist/clients/ndjson-logger.js

@@ -86,14 +86,14 @@ if (isSharedWriterState(existingGlobalState)) {
     ndjsonGlobalState = existingGlobalState;
 }
 else if (existingGlobalState === undefined) {
-    ndjsonGlobalState = (globalStateHost[NDJSON_GLOBAL_STATE_KEY] = {
+    ndjsonGlobalState = globalStateHost[NDJSON_GLOBAL_STATE_KEY] = {
         schema: NDJSON_GLOBAL_STATE_SCHEMA,
         version: NDJSON_GLOBAL_STATE_VERSION,
         writers: new Map(),
         exitFlushers: new Set(),
         exitHandlerRegistered: false,
         registeredLogFiles: new Set(),
-    });
+    };
 }
 else if (isLegacyGlobalState(existingGlobalState)) {
     // Do not mutate or replace this state: its private queues and exit flusher
@@ -363,9 +363,7 @@ async function drainLoop(state) {
             ? state.queue.findIndex((queued) => queued.kind === "truncate")
             : 0;
         const pendingEnd = truncateIndex === -1 ? state.queue.length : truncateIndex;
-        const pending = item.kind === "truncate"
-            ? [item]
-            : state.queue.slice(0, pendingEnd);
+        const pending = item.kind === "truncate" ? [item] : state.queue.slice(0, pendingEnd);
         state.inFlightBatch = pending;
         const writeBatch = async () => {
             if (item.kind === "truncate") {

package/node_modules/pi-lens/dist/clients/opaque-mutation-scan.js

@@ -0,0 +1,220 @@
+/**
+ * Opaque-mutation recovery (#2000 phase 2).
+ *
+ * A bash command whose writes are NOT recognized by
+ * `extractWrittenPathsFromCommand` (python/node/perl/PowerShell internal
+ * writes, restores) previously bypassed dispatch AND read-guard authorship.
+ * This module observes what such a command actually changed.
+ *
+ * GIT-FIRST STRATEGY: inside a git worktree the pre side records only a
+ * TIMESTAMP; the post side asks `git status --porcelain` which files are
+ * dirty and keeps those whose mtime falls inside the command's window.
+ * This has NO file-universe bound — it works identically on a 10-file site
+ * and a 5000-file monorepo, and content-identical rewrites are correctly
+ * NOT reported (a false positive the pure stat-diff design produced).
+ *
+ * NON-GIT FALLBACK: outside git the pre side takes a bounded stat snapshot
+ * (cap enforced, cooperative budget) and the post side diffs it — the
+ * original design, kept honestly scoped to small non-git trees.
+ *
+ * Every failure mode yields an explicit UNKNOWN verdict to the caller —
+ * never a clean claim (issue invariant 3). All path keys use
+ * normalizeMapKey+resolve, joining the mutation-seam's key form.
+ *
+ * KNOWN LIMITATIONS:
+ * - shape 6: stat-diff identity is size+mtimeMs PLUS a budgeted content-hash
+ *   confirm (withHashes captures sha1 up to OPAQUE_HASH_BUDGET_BYTES); a
+ *   same-tick/same-size rewrite is detected when both sides hashed the file,
+ *   and degrades to mtime+size for files past the hash budget. The git path
+ *   detects any content change regardless.
+ * - INVARIANT 4 (per issue): ignored/vendor paths are EXCLUDED. Under the
+ *   git strategy this means writes landing ONLY in .gitignore'd locations
+ *   are never reported - an all-ignored write set reads as an empty (clean)
+ *   recovery BY SPEC, not by oversight. Codegen targeting dist/build-style
+ *   outputs should use explicit redirect destinations so the extractor
+ *   recognizes them.
+ */
+import * as fs from "node:fs";
+import * as path from "node:path";
+import { collectSourceFilesWithBudgetAsync } from "./source-filter.js";
+import { createHash } from "node:crypto";
+import { normalizeMapKey } from "./path-utils.js";
+import { freshnessFromMtime } from "./freshness.js";
+import { safeSpawnAsync } from "./safe-spawn.js";
+/** Stop hashing once this many cumulative bytes were read (per capture). */
+export const OPAQUE_HASH_BUDGET_BYTES = 8 * 1024 * 1024;
+/** Hard cap on scanned files — beyond it the verdict is coverage-unknown. */
+export const OPAQUE_SCAN_MAX_FILES = 2000;
+/** How far before recorded start an earlier write may still be attributed. */
+export const OPAQUE_MTIME_TOLERANCE_MS = 150;
+export async function captureFileStats(root, options = {}) {
+    const budgetMs = options.budgetMs ?? 50;
+    try {
+        const walk = await collectSourceFilesWithBudgetAsync(root, {
+            maxFiles: OPAQUE_SCAN_MAX_FILES + 1,
+            budgetMs,
+        });
+        const files = walk.files;
+        if (walk.entryBudgetExceeded || files.length > OPAQUE_SCAN_MAX_FILES) {
+            // A PARTIAL universe must never read as a confident diff (invariant
+            // 3): writes in the unvisited tail would silently vanish.
+            return {
+                unknownReason: walk.entryBudgetExceeded
+                    ? "entry-budget-exceeded"
+                    : "file-cap-exceeded",
+                scannedCount: files.length,
+            };
+        }
+        const snapshot = new Map();
+        let hashBytesSpent = 0;
+        for (const file of files) {
+            try {
+                const stat = await fs.promises.stat(file);
+                const entry = {
+                    mtimeMs: stat.mtimeMs,
+                    size: stat.size,
+                };
+                if (options.withHashes &&
+                    hashBytesSpent + stat.size <= OPAQUE_HASH_BUDGET_BYTES) {
+                    entry.hash = createHash("sha256")
+                        .update(await fs.promises.readFile(file))
+                        .digest("hex");
+                    hashBytesSpent += stat.size;
+                }
+                snapshot.set(normalizeMapKey(path.resolve(file)), entry);
+            }
+            catch {
+                // Vanished mid-walk: absent from both snapshots = unchanged-by-absence.
+            }
+        }
+        return { snapshot, scannedCount: snapshot.size };
+    }
+    catch {
+        return { unknownReason: "walk-failed", scannedCount: 0 };
+    }
+}
+/** Paths added or whose size/mtime changed. Deletions are NOT reported. */
+export function diffFileStats(before, after) {
+    const changed = [];
+    for (const [key, stat] of after) {
+        const prev = before.get(key);
+        // Content confirm: same mtime tick + same size but different bytes.
+        const contentConfirm = prev?.hash !== undefined &&
+            stat.hash !== undefined &&
+            prev.hash !== stat.hash;
+        if (!prev ||
+            prev.mtimeMs !== stat.mtimeMs ||
+            prev.size !== stat.size ||
+            contentConfirm) {
+            changed.push(key);
+        }
+    }
+    return changed;
+}
+export class OpaqueBaselineStore {
+    byCwd = new Map();
+    evictions = 0;
+    record(cwdKey, baseline) {
+        if (this.byCwd.has(cwdKey))
+            this.evictions += 1;
+        this.byCwd.set(cwdKey, baseline);
+    }
+    take(cwdKey) {
+        const baseline = this.byCwd.get(cwdKey);
+        this.byCwd.delete(cwdKey);
+        return baseline;
+    }
+    get evictionCount() {
+        return this.evictions;
+    }
+    /** Session-boundary clear - unconsumed baselines are unreachable after reset. */
+    takeAllForTest() {
+        this.byCwd.clear();
+    }
+}
+const globalStoreSymbol = Symbol.for("pi-lens:opaque-snapshot-store");
+const globalSlot = globalThis;
+export function getOpaqueBaselineStore() {
+    const existing = globalSlot[globalStoreSymbol]?.store;
+    if (existing)
+        return existing;
+    const created = new OpaqueBaselineStore();
+    globalSlot[globalStoreSymbol] = { store: created };
+    return created;
+}
+const gitRepoMemo = new Map();
+/**
+ * Session-boundary clear (#1635): unconsumed pending baselines are keyed by
+ * cwd:generation, so entries from a finished session are unreachable; and a
+ * directory that was not a worktree last session may be one now. Without this
+ * reset both leak and mis-answer forever.
+ */
+export function resetOpaqueMutationState() {
+    getOpaqueBaselineStore().takeAllForTest();
+    gitRepoMemo.clear();
+}
+/** Cached git-worktree probe (repos don't stop being git mid-session). */
+export async function isGitWorktree(root) {
+    const key = normalizeMapKey(path.resolve(root));
+    const memo = gitRepoMemo.get(key);
+    if (memo !== undefined)
+        return memo;
+    const result = await safeSpawnAsync("git", ["rev-parse", "--is-inside-work-tree"], { cwd: root, timeout: 3000 });
+    const isRepo = !result.error && result.status === 0 && result.stdout?.trim() === "true";
+    gitRepoMemo.set(key, isRepo === true);
+    return isRepo === true;
+}
+export function _resetGitWorktreeMemoForTests() {
+    gitRepoMemo.clear();
+}
+/**
+ * Files dirty in the working tree whose mtime falls inside
+ * [startedAt - tolerance, now]. Porcelain -z parsing handles renames
+ * (the NEW path is reported; the old path token is skipped).
+ */
+export async function recoverOpaqueChangesViaGit(root, startedAt) {
+    const result = await safeSpawnAsync("git", ["status", "--porcelain", "-z", "--untracked-files=all"], { cwd: root, timeout: 5000 });
+    if (result.error || (result.status !== 0 && result.status !== null)) {
+        return {
+            verdict: "unknown",
+            paths: [],
+            unknownReason: "git-failed",
+            scannedCount: 0,
+        };
+    }
+    const floorMs = startedAt - OPAQUE_MTIME_TOLERANCE_MS;
+    const raw = result.stdout ?? "";
+    const tokens = raw.split("\0");
+    const paths = [];
+    let skipNext = false; // rename's OLD path follows its NEW path
+    for (const token of tokens) {
+        if (!token)
+            continue;
+        if (skipNext) {
+            skipNext = false;
+            continue;
+        }
+        // Each entry: two status chars, one space, then the path.
+        if (token.length < 4 || token[2] !== " ")
+            continue;
+        const status = token.slice(0, 2);
+        const relPath = token.slice(3);
+        if (status.includes("R") || status.includes("C"))
+            skipNext = true;
+        const abs = path.resolve(root, relPath);
+        try {
+            const stat = await fs.promises.stat(abs);
+            if (stat.isFile() &&
+                freshnessFromMtime({ mtimeMs: stat.mtimeMs, referenceMs: floorMs })
+                    .verdict === "stale") {
+                // Kernel "stale" = modified AFTER the window floor - exactly the
+                // writes this command may have authored.
+                paths.push(normalizeMapKey(abs));
+            }
+        }
+        catch {
+            // Deleted or vanished: deletions are deliberately unreported.
+        }
+    }
+    return { verdict: "recovered", paths, scannedCount: paths.length };
+}

package/node_modules/pi-lens/dist/clients/package-manager.js

@@ -23,7 +23,12 @@ import { safeSpawnAsync } from "./safe-spawn.js";
  * missing). npm first for maximum compatibility; bun last. A project lockfile
  * always overrides this order.
  */
-const PREFERENCE = ["npm", "pnpm", "yarn", "bun"];
+const PREFERENCE = [
+    "npm",
+    "pnpm",
+    "yarn",
+    "bun",
+];
 function onWindows() {
     return process.platform === "win32";
 }

package/node_modules/pi-lens/dist/clients/pipeline.js

@@ -13,7 +13,7 @@
  */
 import * as nodeFs from "node:fs";
 import * as path from "node:path";
-import { findNearestContaining, normalizeEphemeralMapKey } from "./path-utils.js";
+import { findNearestContaining, normalizeEphemeralMapKey, } from "./path-utils.js";
 import { recordFromDispatchDiagnostic, } from "./actionable-warnings.js";
 import { recordFromCodeQualityDiagnostic, } from "./code-quality-warnings.js";
 import { recordDiagnostics } from "./widget-state.js";
@@ -25,6 +25,7 @@ import { classifyProbeFailure, createAvailabilityChecker, createAvailabilityLatc
 import { findDetektConfig } from "./dispatch/runners/detekt.js";
 import { detectFileKind, getFileKindLabel } from "./file-kinds.js";
 import { detectFileChangedAfterCommand, getProjectIgnoreMatcher, isExcludedDirName, } from "./file-utils.js";
+import { isInSpawnTimeoutCooldown } from "./spawn-timeout-cooldown.js";
 import { logLatency } from "./latency-logger.js";
 import { emitLensAnalysisComplete } from "./lens-events.js";
 import { publishFilesTouched } from "./bus-publish.js";
@@ -36,6 +37,7 @@ import { RUNTIME_CONFIG } from "./runtime-config.js";
 import { getAmbientAbortSignal, safeSpawnAsync } from "./safe-spawn.js";
 import { combineAbortSignals } from "./deadline-utils.js";
 import { recordDegradationOnce } from "./degradation-ledger.js";
+import { dropFindingsForMissingPaths } from "./advisory-provenance.js";
 import { getAutofixPolicyForFile, getPreferredAutofixTools, getRubocopCommand, hasBiomeConfig, hasDetektConfig, hasEslintConfig, hasGolangciConfig, hasKtfmtConfig, hasKtlintConfig, hasOxlintConfig, hasRubocopConfig, hasSqlfluffConfig, hasStylelintConfig, markdownlintConfigArgs, } from "./tool-policy.js";
 const LSP_MAX_FILE_BYTES = RUNTIME_CONFIG.pipeline.lspMaxFileBytes;
 const LSP_MAX_FILE_LINES = RUNTIME_CONFIG.pipeline.lspMaxFileLines;
@@ -336,10 +338,17 @@ async function tryDetektFix(filePath, cwd) {
     const absPath = path.resolve(cwd, filePath);
     return detectFileChangedAfterCommand(filePath, cmd, ["--auto-correct", "--input", absPath, "--config", configPath], cwd, [1, 2]);
 }
-async function tryMarkdownlintFix(filePath, cwd) {
+// Exported for #1995 cooldown wiring tests: the guard on this lane is
+// one of three mutation-proof surfaces.
+export async function tryMarkdownlintFix(filePath, cwd) {
     const cmd = await resolveToolCommandWithInstallFallback(cwd, "markdownlint");
     if (!cmd)
         return 0;
+    // #1995: skip the spawn entirely when the command is cooling down after a
+    // timeout — detectFileChangedAfterCommand also self-guards, but a wedged
+    // command should not even reach a second budget in the hot loop.
+    if (isInSpawnTimeoutCooldown(cmd))
+        return 0;
     // Shared config-args seam (#1247): the lint runner consumes the same
     // builder, so the bare --fix here can never fall back to markdownlint's
     // default all-rules-on config again (the whole-file CHANGELOG/AGENTS
@@ -838,8 +847,10 @@ export async function runFormatPhase(filePath, getFormatService, dbg) {
  *   L4: 'randomInt' is declared but its value is never read.
  *       → const randomInt = Math.floor(result);
  */
-function buildEnrichedBlockerOutput(blockers, fileContent) {
-    const fileLines = fileContent.split("\n");
+function buildEnrichedBlockerOutput(blockers, fileContent = "") {
+    // Empty fileContent (readback failed, e.g. deleted-file race) still
+    // renders the gated blocker list - just without per-line snippets.
+    const fileLines = fileContent ? fileContent.split("\n") : [];
     const MAX_SNIPPET = 120; // chars — keep it tight in context
     let out = `\n\n🔴 STOP — ${blockers.length} issue(s) must be fixed:\n`;
     const shown = blockers.slice(0, 10);
@@ -1065,10 +1076,27 @@ export async function runPipeline(ctx, deps) {
     if (dispatchResult.resolvedCount > 0)
         getDiagnosticTracker().trackAgentFixed(dispatchResult.resolvedCount);
     let output = "";
+    // #2028: the 🔴 STOP block is an agent-facing delivery surface
+    // (finding-delivery-gate.ts's `tool-call:stop-blocker`), so it routes through
+    // the shared deleted-path gate before rendering: a blocker whose cited file
+    // no longer exists has no remediation the agent can perform (the finding IS
+    // the deleted file's content), so it is dropped here rather than re-asserted.
+    // One bounded stat per unique cited path, only when blockers exist — zero
+    // cost on the clean/fast paths.
+    const deliverableBlockers = dispatchResult.hasBlockers
+        ? dropFindingsForMissingPaths({
+            store: "stop-blocker",
+            findings: dispatchResult.blockers,
+            cwd,
+            citedPath: (b) => b.filePath || undefined,
+        })
+        : dispatchResult.blockers;
     if (dispatchResult.hasBlockers && fileContent) {
         // Enrich blocker output with a code snippet so the agent can see the
         // exact line it wrote that caused each violation — no re-read needed.
-        output += buildEnrichedBlockerOutput(dispatchResult.blockers, fileContent);
+        if (deliverableBlockers.length > 0) {
+            output += buildEnrichedBlockerOutput(deliverableBlockers, fileContent);
+        }
         // Append fixed/coverage parts from the original output (slice off the
         // blocker section we're replacing).
         const rest = dispatchResult.output.slice(dispatchResult.blockerOutput.length);
@@ -1076,7 +1104,20 @@ export async function runPipeline(ctx, deps) {
             output += rest;
     }
     else if (dispatchResult.output) {
-        output += `\n\n${dispatchResult.output}`;
+        // #2028 review P3: this path fires when readback FAILED - raw output
+        // still cites possibly-deleted files. Re-render from the gated set
+        // (no snippets without fileContent) and keep the post-blocker slice.
+        if (dispatchResult.hasBlockers &&
+            deliverableBlockers.length !== dispatchResult.blockers.length) {
+            let gatedOut = buildEnrichedBlockerOutput(deliverableBlockers);
+            const rest = dispatchResult.output.slice(dispatchResult.blockerOutput.length);
+            if (rest)
+                gatedOut += rest;
+            output += `\n\n${gatedOut}`;
+        }
+        else {
+            output += `\n\n${dispatchResult.output}`;
+        }
     }
     if (fixedCount > 0) {
         const detail = autofixTools.length > 0 ? ` (${autofixTools.join(", ")})` : "";
@@ -1126,7 +1167,8 @@ export async function runPipeline(ctx, deps) {
             fileContent,
             wordIndex: ctx.wordIndex,
             onWordIndexUpdated: ctx.onWordIndexUpdated,
-        }).then((run) => ({ ...run, origin: cascadeOrigin }))
+        })
+            .then((run) => ({ ...run, origin: cascadeOrigin }))
             .catch((err) => {
             dbg(`cascade compute failed for ${filePath}: ${err}`);
             return {
@@ -1233,8 +1275,14 @@ export async function runPipeline(ctx, deps) {
         fixedCount,
         autofixTools,
         postAutofixNotice,
-        postMutation: ctx.autofixMode !== "deferred" && autofixChangedFiles.some((f) => path.resolve(f) === path.resolve(filePath)) && fileContent !== undefined
-            ? { filePath: path.resolve(filePath), content: fileContent, source: "autofix" }
+        postMutation: ctx.autofixMode !== "deferred" &&
+            autofixChangedFiles.some((f) => path.resolve(f) === path.resolve(filePath)) &&
+            fileContent !== undefined
+            ? {
+                filePath: path.resolve(filePath),
+                content: fileContent,
+                source: "autofix",
+            }
             : undefined,
     };
 }

package/node_modules/pi-lens/dist/clients/project-conventions.js

@@ -72,8 +72,7 @@ function detectNext(cwd, pkg) {
         signals.push("app/");
     if (signals.length === 0)
         return undefined;
-    const confidence = hasDep(pkg, "next") &&
-        signals.some((s) => s.startsWith("next.config."))
+    const confidence = hasDep(pkg, "next") && signals.some((s) => s.startsWith("next.config."))
         ? "high"
         : hasDep(pkg, "next")
             ? "medium"
@@ -152,12 +151,7 @@ export function detectProjectConventions(cwd) {
         return { frameworks: [], testRunners: [], buildTools: [], agentDocs: [] };
     }
     const pkg = readPackageJson(cwd);
-    const detectors = [
-        detectReact,
-        detectNext,
-        detectVite,
-        detectVitest,
-    ];
+    const detectors = [detectReact, detectNext, detectVite, detectVitest];
     const frameworks = [];
     for (const detector of detectors) {
         const detection = detector(cwd, pkg);

package/node_modules/pi-lens/dist/clients/project-diagnostics/cache.js

@@ -3,7 +3,7 @@ import * as path from "node:path";
 import { getProjectDataDir } from "../file-utils.js";
 import { writeFileAtomic } from "../atomic-write.js";
 import { readJsonCache } from "../json-cache-read.js";
-import { MTIME_DRIFT_TOLERANCE_MS } from "../blocker-freshness.js";
+import { freshnessFromMtime } from "../freshness.js";
 // v2: cheap-tier scan now also runs ast-grep-napi (#308); invalidate older
 // snapshots so a pre-ast-grep cache isn't served as complete via refreshRunners=cached.
 export const PROJECT_DIAGNOSTICS_CACHE_VERSION = 2;
@@ -80,16 +80,19 @@ export function reconcileProjectDiagnosticsSnapshot(snapshot) {
         if (cached !== undefined)
             return cached;
         let stale;
+        let mtimeMs;
         try {
-            // MTIME_DRIFT_TOLERANCE_MS: a file scanned at scannedAt, or written
-            // within the tolerance window of the scan timestamp being captured,
-            // has mtime <= scannedAt + MTIME_DRIFT_TOLERANCE_MS.
-            stale =
-                fs.statSync(filePath).mtimeMs > scannedAtMs + MTIME_DRIFT_TOLERANCE_MS;
+            mtimeMs = fs.statSync(filePath).mtimeMs;
         }
         catch {
-            stale = true; // deleted / unreadable → drop
+            mtimeMs = undefined; // deleted / unreadable -> indeterminate -> drop
         }
+        const verdict = freshnessFromMtime({
+            mtimeMs,
+            referenceMs: scannedAtMs,
+        });
+        // Pre-kernel policy: an unreadable/missing file is stale (dropped).
+        stale = verdict.verdict !== "fresh";
         staleByFile.set(filePath, stale);
         return stale;
     };

package/node_modules/pi-lens/dist/clients/project-diagnostics/runner-adapters/call-graph-impact.js

@@ -97,7 +97,8 @@ export function callGraphImpactToProjectDiagnostics(cwd, findings) {
                 continue;
             const dedupeKey = `${resolvedFile}:${result.symbolKey}`;
             const existing = byKey.get(dedupeKey);
-            if (existing && SEVERITY_RANK[existing.severity] >= SEVERITY_RANK[mapped.severity]) {
+            if (existing &&
+                SEVERITY_RANK[existing.severity] >= SEVERITY_RANK[mapped.severity]) {
                 continue;
             }
             const callerName = displayName(result.symbolKey);

package/node_modules/pi-lens/dist/clients/project-diagnostics/runner-adapters/gitleaks.js

@@ -14,7 +14,9 @@ export function gitleaksFindingToProjectDiagnostic(cwd, finding) {
     // #1562 observability criterion: surface the git status right in the
     // finding's message so a triage is a read, not a re-derivation. Omitted
     // when git itself degraded (`pathStatus` undefined) rather than guessed.
-    const statusSuffix = finding.pathStatus ? ` [git: ${finding.pathStatus}]` : "";
+    const statusSuffix = finding.pathStatus
+        ? ` [git: ${finding.pathStatus}]`
+        : "";
     const isScratch = finding.pathStatus === "scratch";
     return {
         filePath: path.isAbsolute(finding.file)

package/node_modules/pi-lens/dist/clients/project-diagnostics/runner-adapters/runner-findings.js

@@ -84,16 +84,20 @@ export function testRunnerFindingsToProjectDiagnostics(cache, cwd, runtime) {
     const missingKeys = new Set((cache.provenance?.files ?? [])
         .filter((file) => !fs.existsSync(path.resolve(root, file.path)))
         .map((file) => advisoryPathKey(file.path, root)));
-    const historical = cache.superseded === true || cache.stale === true || validation.status !== "current";
+    const historical = cache.superseded === true ||
+        cache.stale === true ||
+        validation.status !== "current";
     return cache.results
         .filter((result) => !missingKeys.has(advisoryPathKey(result.file, root)))
         .flatMap((result) => testResultToProjectDiagnostics(result, historical))
-        .map((diagnostic) => historical ? {
-        ...diagnostic,
-        severity: "info",
-        semantic: "none",
-        message: diagnostic.message.startsWith("[stale")
-            ? diagnostic.message
-            : `[historical — re-run to confirm] ${diagnostic.message}`,
-    } : diagnostic);
+        .map((diagnostic) => historical
+        ? {
+            ...diagnostic,
+            severity: "info",
+            semantic: "none",
+            message: diagnostic.message.startsWith("[stale")
+                ? diagnostic.message
+                : `[historical — re-run to confirm] ${diagnostic.message}`,
+        }
+        : diagnostic);
 }

package/node_modules/pi-lens/dist/clients/project-diagnostics/runner-adapters/trivy.js

@@ -10,7 +10,9 @@ export function trivyFindingToProjectDiagnostic(cwd, finding) {
             ? finding.target
             : path.resolve(cwd, finding.target)
         : cwd;
-    const version = finding.installedVersion ? `@${finding.installedVersion}` : "";
+    const version = finding.installedVersion
+        ? `@${finding.installedVersion}`
+        : "";
     const fix = finding.fixedVersion ? ` (fixed in ${finding.fixedVersion})` : "";
     return {
         filePath,

package/node_modules/pi-lens/dist/clients/project-diagnostics/scanner.js

@@ -38,7 +38,7 @@ const FACT_RULE_EXTENSIONS = new Set([
 // The base is the shared per-edit resolver (EXT_TO_LANG — the single
 // ext→grammar-id authority), so c/cpp/csharp/php/css and the .tsx→tsx /
 // .jsx→javascript nuances can never drift from the per-edit path. `.tsx` resolves
-// to the tsx grammar (not typescript: the typescript grammar ERRORs on JSX);
+// to the tsx grammar (not typescript: the typescript grammar ERRORs on JSX); // spellchecker:disable-line
 // typescript RULES still apply because `queriesForLanguage(...)` below merges the
 // typescript rule set onto tsx.
 //
@@ -295,7 +295,10 @@ async function scanFileMajorRules(cwd, files, signal) {
             // so it stays visible SOMEWHERE instead of disappearing when the
             // vacuous `project_diagnostics_ast_grep_scan` cache_stats record
             // (below) was removed.
-            astGrep: { durationMs: astGrepDurationMs, fileCount: astGrepFilesScanned },
+            astGrep: {
+                durationMs: astGrepDurationMs,
+                fileCount: astGrepFilesScanned,
+            },
         });
     });
     // #1935: no `project_diagnostics_ast_grep_scan` cache_stats record here.

package/node_modules/pi-lens/dist/clients/project-lens-config.js

@@ -194,7 +194,11 @@ export function loadPiLensConfigInDir(dir) {
         return cached.config;
     }
     const config = parseConfigFile(info.path);
-    configCache.set(info.path, { mtimeMs: info.mtimeMs, size: info.size, config });
+    configCache.set(info.path, {
+        mtimeMs: info.mtimeMs,
+        size: info.size,
+        config,
+    });
     return config;
 }
 export function findPiLensProjectConfig(startDir) {
@@ -239,7 +243,12 @@ function discoverPiLensProjectConfig(startDir) {
             const stat = safeFileStat(candidate);
             if (stat?.isFile()) {
                 return {
-                    info: { path: candidate, dir, mtimeMs: stat.mtimeMs, size: stat.size },
+                    info: {
+                        path: candidate,
+                        dir,
+                        mtimeMs: stat.mtimeMs,
+                        size: stat.size,
+                    },
                     dirMtimes,
                 };
             }
@@ -351,9 +360,7 @@ function parseConfigFile(configPath) {
             if (entry.threshold !== undefined || entry.disable || entry.select) {
                 rules[ruleId] = entry;
             }
-            else if (!("threshold" in r) &&
-                !("disable" in r) &&
-                !("select" in r)) {
+            else if (!("threshold" in r) && !("disable" in r) && !("select" in r)) {
                 warnInvalidConfigOnce(configPath, `rules.${ruleId} has no recognized setting (threshold, disable, select); ignored`);
             }
         }

package/node_modules/pi-lens/dist/clients/project-snapshot-fingerprint.js

@@ -0,0 +1,48 @@
+import { createHash } from "node:crypto";
+/**
+ * Hash serialized project-snapshot JSON while replacing only the top-level
+ * volatile `generatedAt` value with a stable sentinel. Production calls this
+ * on the persistence worker after stringify. The main-thread caller uses it
+ * only on the explicit synchronous fallback path, where serialization already
+ * happened and no second object walk is added.
+ */
+export function fingerprintProjectSnapshotJson(json, generatedAt) {
+    const marker = `"generatedAt":${JSON.stringify(generatedAt)}`;
+    let markerIndex = -1;
+    let depth = 0;
+    let inString = false;
+    let escaped = false;
+    for (let index = 0; index < json.length; index++) {
+        const char = json[index];
+        if (inString) {
+            if (escaped)
+                escaped = false;
+            else if (char === "\\")
+                escaped = true;
+            else if (char === '"')
+                inString = false;
+            continue;
+        }
+        if (char === '"') {
+            if (depth === 1 && json.startsWith(marker, index)) {
+                markerIndex = index;
+                break;
+            }
+            inString = true;
+        }
+        else if (char === "{")
+            depth++;
+        else if (char === "}")
+            depth--;
+    }
+    const hash = createHash("sha256");
+    if (markerIndex < 0) {
+        hash.update(json);
+    }
+    else {
+        hash.update(json.slice(0, markerIndex));
+        hash.update('"generatedAt":""');
+        hash.update(json.slice(markerIndex + marker.length));
+    }
+    return hash.digest("hex");
+}

package/node_modules/pi-lens/dist/clients/project-snapshot-persist-worker.js

@@ -1,6 +1,20 @@
 import { serveGzipStageWorker, } from "./gzip-stage-write.js";
+import { fingerprintProjectSnapshotJson } from "./project-snapshot-fingerprint.js";
+/**
+ * Hash the serialized body while replacing only the top-level volatile
+ * `generatedAt` value with a stable sentinel. This runs after the worker has
+ * already paid the unavoidable stringify cost. It never walks the snapshot on
+ * the extension host's event loop.
+ */
+function semanticSnapshotFingerprint(request, json) {
+    const generatedAt = request.data.generatedAt;
+    return fingerprintProjectSnapshotJson(json, typeof generatedAt === "string" ? generatedAt : "");
+}
 serveGzipStageWorker((request) => ({
     id: request.id,
     generation: request.generation,
     stagePath: request.stagePath,
-}));
+}), {
+    semanticFingerprint: semanticSnapshotFingerprint,
+    skipIfFingerprints: (request) => request.priorFingerprints,
+});