@herbertgao/pi-extensions 2026.8.11 → 2026.8.13

package/node_modules/pi-lens/dist/mcp/server.js

@@ -1257,7 +1257,9 @@ async function callTool(name, args) {
             `LSP: ${aliveClients} alive client(s)`,
             ...servers.flatMap((server) => [
                 `  ${server.connected ? "✓" : "✗"} ${server.serverId} (${server.root})`,
-                ...server.pullFailureHistory.slice(-1).map((failure) => `    ⚠ diagnostics pull failed: ${failure.method}${failure.code !== undefined ? ` (${failure.code})` : ""} — ${failure.message.length > 200 ? `${failure.message.slice(0, 200)}…` : failure.message}`),
+                ...server.pullFailureHistory
+                    .slice(-1)
+                    .map((failure) => `    ⚠ diagnostics pull failed: ${failure.method}${failure.code !== undefined ? ` (${failure.code})` : ""} — ${failure.message.length > 200 ? `${failure.message.slice(0, 200)}…` : failure.message}`),
             ]),
             ...renderLspBrokenStatusLines(brokenServers),
             ...renderDegradationLines(degradations),

package/node_modules/pi-lens/dist/tools/ast-grep-replace.js

@@ -5,7 +5,7 @@
  */
 import { Type } from "../clients/deps/typebox.js";
 import { astGrepRemediationHint, classifyAstGrepError, logAstGrepToolEvent, } from "../clients/ast-grep-tool-logger.js";
-import { hasStructuralIntent, synthesizeReplaceRule } from "../clients/ast-grep-yaml-synth.js";
+import { hasStructuralIntent, synthesizeReplaceRule, } from "../clients/ast-grep-yaml-synth.js";
 import { compactRenderResult } from "./render-compact.js";
 /**
  * Build the agent-facing error text, appending a remediation hint derived from
@@ -66,15 +66,21 @@ export function createAstGrepReplaceTool(astGrepClient) {
                 description: "Target language",
             }),
             paths: Type.Optional(Type.Array(Type.String(), { description: "Specific files/folders" })),
-            insideKind: Type.Optional(Type.String({ description: "Restrict matches to nodes inside an ancestor of this AST node kind. Synthesizes a YAML rule." })),
+            insideKind: Type.Optional(Type.String({
+                description: "Restrict matches to nodes inside an ancestor of this AST node kind. Synthesizes a YAML rule.",
+            })),
             hasKind: Type.Optional(Type.String({
                 description: 'Restrict matches to nodes whose immediate child has this AST node kind (ast-grep default stopBy: neighbor). Example: `hasKind: "await_expression"`.',
             })),
             hasDescendantKind: Type.Optional(Type.String({
                 description: "Restrict matches to nodes containing this AST node kind anywhere in their descendants. Explicit recursive form (`stopBy: end`); use this instead of `hasKind` when nesting is not immediate.",
             })),
-            follows: Type.Optional(Type.String({ description: "Restrict matches to nodes that immediately follow a sibling matching this pattern." })),
-            precedes: Type.Optional(Type.String({ description: "Restrict matches to nodes that immediately precede a sibling matching this pattern." })),
+            follows: Type.Optional(Type.String({
+                description: "Restrict matches to nodes that immediately follow a sibling matching this pattern.",
+            })),
+            precedes: Type.Optional(Type.String({
+                description: "Restrict matches to nodes that immediately precede a sibling matching this pattern.",
+            })),
             apply: Type.Optional(Type.Boolean({ description: "Apply changes (default: false)" })),
             strictness: Type.Optional(Type.String({
                 enum: ["smart", "relaxed", "ast", "cst", "signature", "template"],
@@ -83,7 +89,7 @@ export function createAstGrepReplaceTool(astGrepClient) {
         }),
         async execute(_toolCallId, params, _signal, _onUpdate, ctx) {
             const startedAt = Date.now();
-            const { pattern, rewrite, paths, apply, strictness, insideKind, hasKind, hasDescendantKind, follows, precedes } = params;
+            const { pattern, rewrite, paths, apply, strictness, insideKind, hasKind, hasDescendantKind, follows, precedes, } = params;
             const lang = (params.lang ?? "").replace(/^"|"$/g, "");
             const pathsCount = paths?.length ?? 1;
             const applyFlag = apply ?? false;
@@ -127,27 +133,77 @@ export function createAstGrepReplaceTool(astGrepClient) {
             }
             const searchPaths = paths?.length ? paths : [ctx.cwd || "."];
             // Phase 3: structural-intent params → synthesize YAML with fix: field
-            if (hasStructuralIntent({ insideKind, hasKind, hasDescendantKind, follows, precedes })) {
+            if (hasStructuralIntent({
+                insideKind,
+                hasKind,
+                hasDescendantKind,
+                follows,
+                precedes,
+            })) {
                 let ruleYaml;
                 try {
-                    ruleYaml = synthesizeReplaceRule({ pattern, lang, rewrite, insideKind, hasKind, hasDescendantKind, follows, precedes });
+                    ruleYaml = synthesizeReplaceRule({
+                        pattern,
+                        lang,
+                        rewrite,
+                        insideKind,
+                        hasKind,
+                        hasDescendantKind,
+                        follows,
+                        precedes,
+                    });
                 }
                 catch (err) {
                     logOutcome("error", { errorRaw: String(err) });
-                    return { content: [{ type: "text", text: `Error synthesizing rule: ${err}` }], isError: true, details: {} };
+                    return {
+                        content: [
+                            {
+                                type: "text",
+                                text: `Error synthesizing rule: ${err}`,
+                            },
+                        ],
+                        isError: true,
+                        details: {},
+                    };
                 }
                 const ruleResult = await astGrepClient.replaceWithRule(ruleYaml, searchPaths, applyFlag);
                 if (ruleResult.stalePreview) {
                     logOutcome("error", { errorRaw: "stale_preview" });
-                    return { content: [{ type: "text", text: "Stale preview — pattern no longer matches. Re-run with apply: false." }], isError: true, details: { stalePreview: true } };
+                    return {
+                        content: [
+                            {
+                                type: "text",
+                                text: "Stale preview — pattern no longer matches. Re-run with apply: false.",
+                            },
+                        ],
+                        isError: true,
+                        details: { stalePreview: true },
+                    };
                 }
                 if (ruleResult.error) {
                     logOutcome("error", { errorRaw: ruleResult.error });
-                    return { content: [{ type: "text", text: errorTextWithHint(ruleResult.error) }], isError: true, details: {} };
+                    return {
+                        content: [
+                            {
+                                type: "text",
+                                text: errorTextWithHint(ruleResult.error),
+                            },
+                        ],
+                        isError: true,
+                        details: {},
+                    };
                 }
                 const output = astGrepClient.formatMatches(ruleResult.matches, !applyFlag, true);
-                logOutcome(ruleResult.matches.length === 0 ? "no_matches" : "success", { matchCount: ruleResult.matches.length });
-                return { content: [{ type: "text", text: output }], details: { matchCount: ruleResult.matches.length, applied: applyFlag } };
+                logOutcome(ruleResult.matches.length === 0 ? "no_matches" : "success", {
+                    matchCount: ruleResult.matches.length,
+                });
+                return {
+                    content: [{ type: "text", text: output }],
+                    details: {
+                        matchCount: ruleResult.matches.length,
+                        applied: applyFlag,
+                    },
+                };
             }
             const result = await astGrepClient.replace(pattern, rewrite, lang, searchPaths, applyFlag, { strictness });
             if (result.stalePreview) {

package/node_modules/pi-lens/dist/tools/lens-diagnostic-mark.js

@@ -45,8 +45,13 @@ import * as path from "node:path";
 import { Type } from "../clients/deps/typebox.js";
 import { markDisposition, normalizeMessage, } from "../clients/diagnostic-dispositions.js";
 import { insertSuppressComment } from "../clients/dispatch/suppress-writer.js";
-import { getFileDiagnostics } from "../clients/widget-state.js";
-const DISPOSITIONS = ["false-positive", "suppress", "defer", "flagged"];
+import { getFileDiagnostics, } from "../clients/widget-state.js";
+const DISPOSITIONS = [
+    "false-positive",
+    "suppress",
+    "defer",
+    "flagged",
+];
 // How far ± the caller's line the fuzzy fallback searches for a plausible
 // (non-blank) line when there's no widget-state match to reanchor from.
 const FUZZY_SEARCH_RADIUS = 5;
@@ -84,7 +89,9 @@ function widgetCrossCheck(absPath, tool, rule, message, callerLine) {
         return undefined;
     if (matches.length === 1)
         return { line: matches[0].line, ambiguous: false };
-    const closest = matches.reduce((best, d) => (Math.abs(d.line - callerLine) < Math.abs(best.line - callerLine) ? d : best), matches[0]);
+    const closest = matches.reduce((best, d) => Math.abs(d.line - callerLine) < Math.abs(best.line - callerLine)
+        ? d
+        : best, matches[0]);
     return { line: closest.line, ambiguous: true };
 }
 /**
@@ -135,7 +142,9 @@ function verifyLine(content, absPath, tool, rule, message, callerLine) {
             reanchored,
             note: reanchored
                 ? `reanchored from line ${callerLine} to ${widgetResult.line}` +
-                    (widgetResult.ambiguous ? " (multiple live matches, chose nearest)" : "") +
+                    (widgetResult.ambiguous
+                        ? " (multiple live matches, chose nearest)"
+                        : "") +
                     " against current diagnostics"
                 : undefined,
         };
@@ -193,12 +202,16 @@ getIdentity) {
             rule: Type.Optional(Type.String({
                 description: "The diagnostic's rule id, if it has one (shown in lens_diagnostics as [rule]). Required for disposition=suppress.",
             })),
-            tool: Type.Optional(Type.String({ description: "The tool that produced the diagnostic, if known." })),
+            tool: Type.Optional(Type.String({
+                description: "The tool that produced the diagnostic, if known.",
+            })),
             disposition: Type.String({
                 enum: DISPOSITIONS,
                 description: "false-positive = the rule misfired. suppress = real finding, won't fix (writes an inline ignore comment). defer = fix later, this session only. flagged = mark for you to fix.",
             }),
-            reason: Type.Optional(Type.String({ description: "Optional short reason, kept alongside the disposition." })),
+            reason: Type.Optional(Type.String({
+                description: "Optional short reason, kept alongside the disposition.",
+            })),
         }),
         async execute(_toolCallId, params, _signal, _onUpdate, ctx) {
             const cwd = ctx.cwd ?? getCwd();
@@ -304,8 +317,9 @@ getIdentity) {
             if (disposition === "suppress") {
                 let updated;
                 try {
+                    updated = insertSuppressComment(content, absPath, verifiedLine, 
                     // biome-ignore lint/style/noNonNullAssertion: validated above
-                    updated = insertSuppressComment(content, absPath, verifiedLine, rule);
+                    rule);
                 }
                 catch (err) {
                     return {

package/node_modules/pi-lens/dist/tools/lens-diagnostics.js

@@ -12,16 +12,17 @@ import { promises as fs } from "node:fs";
 import * as fsSync from "node:fs";
 import * as path from "node:path";
 import { Type } from "../clients/deps/typebox.js";
-import { anchorsForDiagnostic, applyDispositions, applyWeakDispositions, getDisposition, } from "../clients/diagnostic-dispositions.js";
+import { anchorsForDiagnostic, applyDispositions, applyWeakDispositions, hasAnyDispositionMarks, hasStrictDispositionMarks, getDisposition, } from "../clients/diagnostic-dispositions.js";
+import { freshnessFromMtime } from "../clients/freshness.js";
 import { applyInlineSuppressions } from "../clients/dispatch/inline-suppressions.js";
 import { gateFindingsByPathFreshness } from "../clients/advisory-provenance.js";
 import { normalizeRuleId } from "../clients/dispatch/rule-id-normalize.js";
-import { applyRulePolicy, rulePolicyMapFromConfig } from "../clients/dispatch/rule-policy.js";
+import { applyRulePolicy, rulePolicyMapFromConfig, } from "../clients/dispatch/rule-policy.js";
 import { loadPiLensProjectConfig } from "../clients/project-lens-config.js";
 import { compactRenderResult } from "./render-compact.js";
 import { combineAbortSignals } from "../clients/deadline-utils.js";
 import { getProjectIgnoreMatcher } from "../clients/file-utils.js";
-import { isAtOrAboveHomeDir, normalizeFilePath, } from "../clients/path-utils.js";
+import { isAtOrAboveHomeDir, normalizeEphemeralMapKey, normalizeFilePath, } from "../clients/path-utils.js";
 import { getLSPService } from "../clients/lsp/index.js";
 import { primaryServerId } from "../clients/lsp/config.js";
 import { getFullScanWallClockMs } from "../clients/lsp/workspace-sweep-hold.js";
@@ -243,7 +244,7 @@ captureLspStatusRepaint, getRuntime) {
                 description: `Restrict any mode to an explicit file/directory list (max ${MAX_PATHS_ENTRIES} entries; ` +
                     "more errors instead of silently truncating). Entries may be relative " +
                     "(resolved against cwd) or absolute, and a directory entry matches all " +
-                    "files under it (e.g. \"src/\"). mode=delta/all are a pure post-filter " +
+                    'files under it (e.g. "src/"). mode=delta/all are a pure post-filter ' +
                     "of cached/session state — they can only show findings for files pi-lens " +
                     "has already dispatched, so an unseen file shows nothing (use mode=full " +
                     "for an active scan). mode=full actively scans exactly these paths (LSP " +
@@ -407,12 +408,108 @@ function appendProjectDiagnosticsDeltaLines(lines, cwd, report, severity, includ
     }
     return diagnostics.length;
 }
+/**
+ * Bounded content memo for {@link applyCachedDispositions}' strict-immediate
+ * path: one read per (file revision), not per query. Keyed through
+ * `normalizeEphemeralMapKey` (cheap slash-fold + win32-lowercase — these keys
+ * are produced and consumed inside this process only) and validated against a
+ * fresh stat's mtimeMs+size on every hit, so an edit invalidates without a
+ * TTL. Insertion-ordered LRU cap bounds resident source bytes; repeated
+ * queries and multi-file reports that cite the same file reuse one read.
+ */
+const CACHED_CONTENT_MEMO_CAP = 64;
+const cachedContentMemo = new Map();
+function readContentForAnchors(filePath, stat) {
+    const key = normalizeEphemeralMapKey(filePath);
+    const hit = cachedContentMemo.get(key);
+    if (hit && hit.mtimeMs === stat.mtimeMs && hit.size === stat.size) {
+        // Refresh LRU position.
+        cachedContentMemo.delete(key);
+        cachedContentMemo.set(key, hit);
+        return hit.content;
+    }
+    let content;
+    try {
+        content = fsSync.readFileSync(filePath, "utf-8");
+    }
+    catch {
+        return undefined;
+    }
+    if (cachedContentMemo.size >= CACHED_CONTENT_MEMO_CAP) {
+        const oldest = cachedContentMemo.keys().next().value;
+        if (oldest !== undefined)
+            cachedContentMemo.delete(oldest);
+    }
+    cachedContentMemo.set(key, {
+        mtimeMs: stat.mtimeMs,
+        size: stat.size,
+        content,
+    });
+    return content;
+}
+/**
+ * ONE disposition seam for every cache-only lens_diagnostics surface —
+ * mode=all summaries, mode=delta's actionable/quality warnings, the delta
+ * project-diagnostics report, and the empty-delta carried-over note. Cached
+ * findings predate any lens_diagnostic_mark, so each surface must re-apply
+ * dispositions at query time; before this seam each site hand-picked its own
+ * variant and three of them served stale STRICT false-positive marks via the
+ * weak-only filter (a weak filter can never drop a strict-anchored mark, nor
+ * any blocking finding — #1625 F1).
+ *
+ * Strict-immediate path: stat the file once, then compare its mtime against
+ * the newest cached diagnostic's own observation stamp through the freshness
+ * kernel (`freshnessFromMtime`). Fresh or stamp-less means the current bytes
+ * still describe what these findings were observed against, so the content is
+ * read (memoized per revision above) and the FULL applyDispositions filter
+ * runs — a fresh false-positive mark converges immediately, including on
+ * blocking findings.
+ *
+ * Weak fallback (zero further I/O): a file that is gone/unreadable, or whose
+ * mtime moved AFTER these diagnostics were observed. Stale-content edge: the
+ * cached findings describe a superseded revision, so their line numbers may no
+ * longer align with the lines a mark hashed; deriving strict anchors from the
+ * new content could match a DIFFERENT occurrence that merely shares the line
+ * number and identical text, so the mark waits for the next real dispatch to
+ * re-derive both sides against matching revisions. Weak suppress/defer marks
+ * are intent-level and never look at content, so they keep applying here.
+ */
+function applyCachedDispositions(cachedDiagnostics, cwd, filePath) {
+    // Zero-I/O fast paths (#1625 F2 precedent): with no marks at all there is
+    // nothing to filter; with only weak suppress/defer marks a strict anchor
+    // can never match, so the weak filter serves them without any stat/read.
+    if (!hasAnyDispositionMarks(cwd))
+        return cachedDiagnostics;
+    if (!hasStrictDispositionMarks(cwd)) {
+        return applyWeakDispositions(cachedDiagnostics, cwd, filePath);
+    }
+    let stat;
+    try {
+        stat = fsSync.statSync(filePath);
+    }
+    catch {
+        return applyWeakDispositions(cachedDiagnostics, cwd, filePath);
+    }
+    const referenceMs = cachedDiagnostics.reduce((latest, d) => Math.max(latest, d.observedAt ?? 0), 0);
+    if (referenceMs > 0 &&
+        freshnessFromMtime({ mtimeMs: stat.mtimeMs, referenceMs }).verdict ===
+            "stale") {
+        return applyWeakDispositions(cachedDiagnostics, cwd, filePath);
+    }
+    const content = readContentForAnchors(filePath, stat);
+    if (content === undefined) {
+        return applyWeakDispositions(cachedDiagnostics, cwd, filePath);
+    }
+    return applyDispositions(cachedDiagnostics, cwd, filePath, content);
+}
 /**
  * #755: drop project-diagnostics-delta findings disposed suppress/defer before
  * delta mode re-serves them. Anchored via `projectDiagnosticToWidget` so the
  * (tool, rule) an agent's mark binds to matches mode=full's own project-runner
  * filter (`applyInlineSuppressionsToSummaries`), keeping the two paths in
- * agreement. Weak-anchored → no file read. Also applies the project's
+ * agreement. Goes through the shared {@link applyCachedDispositions} seam so
+ * strict false-positive anchors apply immediately, like every other cache-only
+ * surface. Also applies the project's
  * `.pi-lens.json` `rules.<id>.disable`/`select` policy so a project's policy
  * overlays the same delta report cache; the cache is otherwise insensitive to
  * a project-config edit (the per-edit path picks it up immediately, but a
@@ -421,8 +518,7 @@ function appendProjectDiagnosticsDeltaLines(lines, cwd, report, severity, includ
 function filterDeltaReportDispositions(report, cwd, policyMap) {
     if (!report?.diagnostics.length)
         return report;
-    const kept = report.diagnostics.filter((d) => applyWeakDispositions([projectDiagnosticToWidget(d, d.filePath)], cwd, d.filePath)
-        .length === 1);
+    const kept = report.diagnostics.filter((d) => applyCachedDispositions([projectDiagnosticToWidget(d, d.filePath)], cwd, d.filePath).length === 1);
     const policyKept = applyRulePolicy(kept, policyMap);
     if (policyKept.length === report.diagnostics.length)
         return report;
@@ -508,14 +604,14 @@ function formatDeltaMode(cacheManager, cwd, severity, pathsScope) {
     const includeFile = (filePath) => ignoreFile(filePath) && (!pathsScope || pathsScope.includeFile(filePath));
     // #755: delta re-serves the actionable/quality caches verbatim, but those
     // were filtered at DISPATCH time — before any lens_diagnostic_mark. Re-apply
-    // the weak disposition filter (suppress/defer) here so a mark converges
-    // immediately, not only on the next edit. Weak-anchored → zero file I/O, so
-    // this stays "instant" (see applyWeakDispositions).
+    // dispositions here so a mark converges immediately, not only on the next
+    // edit — through the shared {@link applyCachedDispositions} seam, so strict
+    // false-positive marks land as fast as suppress/defer.
     const visibleWarningFiles = (files) => (files ?? [])
         .filter((file) => includeFile(file.filePath))
         .map((file) => ({
         filePath: file.filePath,
-        warnings: applyRulePolicy(applyWeakDispositions(file.warnings ?? [], cwd, file.filePath), policyMap),
+        warnings: applyRulePolicy(applyCachedDispositions(file.warnings ?? [], cwd, file.filePath), policyMap),
     }))
         .filter((file) => file.warnings.length > 0);
     const actionableFiles = applyDeltaFreshnessGate(visibleWarningFiles(actionable?.files), cwd, actionable?.generatedAt);
@@ -556,7 +652,7 @@ function formatDeltaMode(cacheManager, cwd, severity, pathsScope) {
             .filter((f) => includeFile(f.filePath))
             .map((f) => ({
             ...f,
-            diagnostics: applyRulePolicy(applyWeakDispositions(f.diagnostics, cwd, f.filePath), policyMap),
+            diagnostics: applyRulePolicy(applyCachedDispositions(f.diagnostics, cwd, f.filePath), policyMap),
         }))
             .filter((f) => f.diagnostics.length > 0);
         const carriedIssues = carried.reduce((n, f) => n + f.diagnostics.length, 0);
@@ -699,7 +795,10 @@ function filterProjectDiagnosticsDeltaReport(report, includeFile) {
 function applyProjectRulePolicy(value, policyMap) {
     if (!value)
         return undefined;
-    return { ...value, diagnostics: applyRulePolicy(value.diagnostics, policyMap) };
+    return {
+        ...value,
+        diagnostics: applyRulePolicy(value.diagnostics, policyMap),
+    };
 }
 /** A diagnostic counts as error-like when it blocks or has error severity.
  * A `stale` (#1641 past-EOF) entry is excluded — its cited line no longer
@@ -971,11 +1070,29 @@ function tallyLspPrimaryVsAuxiliary(results) {
     }
     return { primary, auxiliary };
 }
-function mergeDiagnosticsWithWidgetSummaries(widgetSummaries, lspResults, projectSnapshot, projectDelta) {
+export function mergeDiagnosticsWithWidgetSummaries(widgetSummaries, lspResults, projectSnapshot, projectDelta, 
+/**
+ * #1993: resolved paths covered by a CONFIRMED, fully-covered LSP result
+ * in `lspResults`. The fresh sweep is AUTHORITATIVE for these files - any
+ * widget-store diagnostics seeded for them predate the sweep and must not
+ * survive it (an additive-only merge let mid-edit stale 🔴 entries render
+ * forever beside a clean sweep). Files absent from this set keep today's
+ * additive behavior (fail-open: unconfirmed/timed-out sweeps never retire
+ * widget state they did not actually re-check).
+ */
+authoritativeLspFiles) {
     const byFile = new Map();
     const seen = new Set();
     for (const summary of widgetSummaries) {
         const filePath = path.resolve(summary.filePath);
+        // NOTE (#1993 review): dispositions recorded against a CACHED copy's
+        // message text may not match this file's fresh sweep copy (weak
+        // anchors key on message). Both copies derive from the same LSP
+        // diagnostic via convertLspDiagnostics, so identity is stable in
+        // practice; inline pi-lens-ignore comments are the primary
+        // suppression mechanism.
+        if (authoritativeLspFiles?.has(filePath))
+            continue;
         const diagnostics = (summary.diagnostics ?? []).map((d) => ({ ...d }));
         byFile.set(filePath, { ...summary, filePath, diagnostics });
         for (const diagnostic of diagnostics) {
@@ -1167,7 +1284,9 @@ async function formatFullMode(cwd, severity, lspService, cacheManager, options =
     // signal from the same starting point instead of stacking.
     const projectRunnersRequested = shouldIncludeProjectRunners(options.refreshRunners);
     const analyzersPromise = projectRunnersRequested
-        ? loadBootstrapClients().then((clients) => fetchFreshProjectDiagnostics(cacheManager, cwd, clients, signal, { runtime: options.runtime }))
+        ? loadBootstrapClients().then((clients) => fetchFreshProjectDiagnostics(cacheManager, cwd, clients, signal, {
+            runtime: options.runtime,
+        }))
         : Promise.resolve({
             diagnostics: [],
             runners: [],
@@ -1225,14 +1344,10 @@ async function formatFullMode(cwd, severity, lspService, cacheManager, options =
     // the unfiltered `lspResults` in, so a timed-out file's placeholder `[]`
     // read as "0 diagnostics" — false-clean — in the rendered/`details`
     // output (#630).
-    const confirmedLspResults = lspResults.filter((result) => !result.timedOut &&
-        !result.error &&
-        !mismatchedLspResults.has(result));
+    const confirmedLspResults = lspResults.filter((result) => !result.timedOut && !result.error && !mismatchedLspResults.has(result));
     const fullyCoveredLspResults = confirmedLspResults.filter((result) => (result.unconfirmedServerIds?.length ?? 0) === 0);
     const partiallyCoveredLspResults = confirmedLspResults.filter((result) => (result.unconfirmedServerIds?.length ?? 0) > 0);
-    const unconfirmedLspResults = lspResults.filter((result) => result.timedOut ||
-        result.error ||
-        mismatchedLspResults.has(result));
+    const unconfirmedLspResults = lspResults.filter((result) => result.timedOut || result.error || mismatchedLspResults.has(result));
     // #571: reconcile this scan's fresh, CONFIRMED per-file results into the
     // footer cache. A footer write is never allowed to fail the tool call, so
     // any unexpected throw is swallowed.
@@ -1301,7 +1416,25 @@ async function formatFullMode(cwd, severity, lspService, cacheManager, options =
     // read as "0 issues, clean" via its LSP contribution. It can still
     // legitimately show diagnostics from widgetSummaries/project-runner state
     // below if those independently have entries for it.
-    const summaries = await applyInlineSuppressionsToSummaries(mergeDiagnosticsWithWidgetSummaries(getFileDiagnosticSummaries().filter((summary) => includeFile(summary.filePath)), confirmedLspResults, projectSnapshot, projectDelta), cwd, policyMap);
+    // #1993: files with a CONFIRMED, fully-covered LSP result are authoritative
+    // - the fresh sweep replaces their widget-store state instead of merging
+    // additively beside it.
+    const authoritativeLspFiles = new Set(fullyCoveredLspResults.map((result) => path.resolve(result.filePath)));
+    // #1993 review: retirement must be observable - if a future regression
+    // makes the set falsely authoritative, findings would vanish silently.
+    const authoritativeRetiredCount = getFileDiagnosticSummaries().filter((summary) => includeFile(summary.filePath) &&
+        authoritativeLspFiles.has(path.resolve(summary.filePath)) &&
+        (summary.diagnostics?.length ?? 0) > 0).length;
+    if (authoritativeRetiredCount > 0) {
+        logLatency({
+            type: "phase",
+            phase: "lsp_authoritative_widget_retire",
+            filePath: "",
+            durationMs: 0,
+            metadata: { files: authoritativeRetiredCount },
+        });
+    }
+    const summaries = await applyInlineSuppressionsToSummaries(mergeDiagnosticsWithWidgetSummaries(getFileDiagnosticSummaries().filter((summary) => includeFile(summary.filePath)), confirmedLspResults, projectSnapshot, projectDelta, authoritativeLspFiles), cwd, policyMap);
     // #1888: the full-mode summary above is the first seam where every
     // producing lane is correlated. The earlier footer loop intentionally writes
     // only CONFIRMED LSP results, so an ast-grep backpressure failure left
@@ -1520,7 +1653,8 @@ async function formatFullMode(cwd, severity, lspService, cacheManager, options =
     const cheapScanStatusNote = !projectRunnersRequested
         ? `\n\ncheap project scan (tree-sitter/fact-rules/ast-grep): not run this call (${NOT_REQUESTED_REASON}).`
         : options.refreshRunners === "cached"
-            ? cheapScanScannedAtMs !== undefined && Number.isFinite(cheapScanScannedAtMs)
+            ? cheapScanScannedAtMs !== undefined &&
+                Number.isFinite(cheapScanScannedAtMs)
                 ? `\n\ncheap project scan (tree-sitter/fact-rules/ast-grep): served from cache, ${formatCacheAgeOld(Date.now() - cheapScanScannedAtMs)} — not re-run this call.`
                 : `\n\ncheap project scan (tree-sitter/fact-rules/ast-grep): not run (no cached scan; refresh with refreshRunners=cheap/all to populate).`
             : "";
@@ -1716,24 +1850,19 @@ function formatAllMode(cwd, severity, summaries = getFileDiagnosticSummaries(),
     const isFullMode = detailOverrides.mode === "full";
     const ignoreFile = createCurrentIgnoreFilter(cwd);
     const includeFile = (filePath) => ignoreFile(filePath) && (!pathsScope || pathsScope.includeFile(filePath));
-    // #755: mode=full already ran the full disposition + inline-suppression
-    // filter (applyInlineSuppressionsToSummaries, file content in hand); mode=all
-    // re-serves the widget summaries verbatim from dispatch time, so a
-    // post-dispatch lens_diagnostic_mark (suppress/defer) would otherwise still
-    // show here. Re-apply the weak filter (zero I/O) for the cache-only path and
-    // re-summarize so blocking/error/warning counts reflect the drop.
-    // Same project rule policy (`.pi-lens.json` `rules.<id>.disable`/`select`)
-    // overlays both modes: mode=full re-applies it after inline suppression /
-    // disposition (zero I/O), mode=all applies it here on the cache-only path.
-    // The full path's policyMover is loaded below in `applyInlineSuppressionsToSummaries`.
+    // Cached summaries predate marks. Every cache-only surface re-applies
+    // dispositions through the shared applyCachedDispositions seam — strict
+    // false-positive anchors against current content when the file is
+    // unchanged since observation, weak-only fallback otherwise.
     const policyMap = loadProjectRulePolicyMap(cwd);
     const dispositioned = isFullMode
         ? summaries
         : summaries.map((s) => {
-            const kept = applyWeakDispositions(s.diagnostics ?? [], cwd, s.filePath);
+            const diagnostics = s.diagnostics ?? [];
+            const kept = applyCachedDispositions(diagnostics, cwd, s.filePath);
             const policyKept = applyRulePolicy(kept, policyMap);
             if (policyKept.length === kept.length &&
-                kept.length === (s.diagnostics?.length ?? 0))
+                kept.length === diagnostics.length)
                 return s;
             return summarizeDiagnostics(s.filePath, policyKept, s.hasFinalSnapshot);
         });

package/node_modules/pi-lens/dist/tools/lsp-diagnostics.js

@@ -11,15 +11,15 @@ import { getProjectIgnoreMatcher, isExcludedDirName, } from "../clients/file-uti
 import { getLSPService, groupFilesByPrimaryServer, runPerServerGroups, } from "../clients/lsp/index.js";
 import { buildScopeKey, createWorkspaceDiagnosticsCacheContext, } from "../clients/lsp/workspace-diagnostics-cache.js";
 import { getServersForFileWithConfig, primaryServerId, } from "../clients/lsp/config.js";
-import { combineAbortSignals, withDeadline } from "../clients/deadline-utils.js";
+import { combineAbortSignals, withDeadline, } from "../clients/deadline-utils.js";
 import { applyAuxiliarySuppressions, retagAuxiliaryDiagnostics, } from "../clients/dispatch/auxiliary-lsp.js";
 import { detectFileRole } from "../clients/file-role.js";
 import { hashDiagnosticContent, touchCompletedConfirmationPolicy, touchCoverageGap, } from "../clients/lsp/diagnostic-binding.js";
 import { classifyCascadeWaitTier } from "../clients/lsp/wait-policy/index.js";
-import { attemptTsserverSyncDiagnostics, } from "../clients/lsp/tsserver-sync.js";
+import { attemptTsserverSyncDiagnostics } from "../clients/lsp/tsserver-sync.js";
 import { convertLspDiagnostics } from "../clients/dispatch/utils/lsp-diagnostics.js";
 import { demoteInferredProjectDiagnostics } from "../clients/lsp/inferred-project.js";
-import { isBlocking, reconcileScanDiagnostics } from "../clients/widget-state.js";
+import { isBlocking, reconcileScanDiagnostics, } from "../clients/widget-state.js";
 import { baseName, compactRenderResult } from "./render-compact.js";
 import { makeProgressReporter, scanningSummaryLine } from "./scan-progress.js";
 import { isWarmAttached, tryWarmAttachedDiagnostics, } from "../clients/warm-attach.js";
@@ -367,10 +367,12 @@ onConfirmedNoBlockers) {
             if (Array.isArray(typedParams.paths) && typedParams.paths.length > 0) {
                 if (typedParams.paths.length > MAX_BATCH_FILES) {
                     return {
-                        content: [{
+                        content: [
+                            {
                                 type: "text",
                                 text: `paths accepts at most ${MAX_BATCH_FILES} files; received ${typedParams.paths.length}.`,
-                            }],
+                            },
+                        ],
                         isError: true,
                         details: { mode: "batch", filesChecked: 0 },
                     };
@@ -378,7 +380,12 @@ onConfirmedNoBlockers) {
                 const rawPaths = typedParams.paths.filter((entry) => typeof entry === "string" && entry.trim().length > 0);
                 if (rawPaths.length !== typedParams.paths.length) {
                     return {
-                        content: [{ type: "text", text: "paths must contain non-empty file paths." }],
+                        content: [
+                            {
+                                type: "text",
+                                text: "paths must contain non-empty file paths.",
+                            },
+                        ],
                         isError: true,
                         details: { mode: "batch", filesChecked: 0 },
                     };
@@ -1206,7 +1213,17 @@ async function collectBatchDiagnostics(files, severity, lspService, options) {
     for (const result of results) {
         result.outcome = classifyBatchFileOutcome(result);
     }
-    const outcomeCounts = Object.fromEntries(["clean", "findings", "unsupported", "unavailable", "failed", "inconclusive"].map((outcome) => [outcome, results.filter((result) => result.outcome === outcome).length]));
+    const outcomeCounts = Object.fromEntries([
+        "clean",
+        "findings",
+        "unsupported",
+        "unavailable",
+        "failed",
+        "inconclusive",
+    ].map((outcome) => [
+        outcome,
+        results.filter((result) => result.outcome === outcome).length,
+    ]));
     // Per-file primary-server lookup so a flattened multi-file `display` list
     // can still be split into "primary findings" vs "auxiliary findings" —
     // `clean`/`unconfirmed` above already reflect ONLY the primary server's

package/node_modules/pi-lens/dist/tools/lsp-navigation.js

@@ -1098,7 +1098,9 @@ getFlag, mutationDeps) {
                                 edit,
                             };
                         }
-                        const applied = await applyWorkspaceEdit(edit, ctx.cwd || ".", { mutationContext });
+                        const applied = await applyWorkspaceEdit(edit, ctx.cwd || ".", {
+                            mutationContext,
+                        });
                         for (const touchedFile of applied.files) {
                             try {
                                 await openFileBestEffort(lspService, touchedFile, false);

package/node_modules/pi-lens/dist/tools/module-report.js

@@ -29,7 +29,7 @@ export function createModuleReportTool(getProjectRoot) {
         description: "Structured, navigable overview of a source module — a token-efficient substitute for reading the whole file. Returns each symbol's name/kind/signature/line-range (plus a first-line `doc` summary when a doc comment is attached), important inline callbacks/closures/lambdas with stable handles, plus who-uses-this, risk flags, and ranked recommendedReads. To read a symbol's body: call read/read_symbol with offset=startLine, limit=endLine-startLine+1 on THIS report's `path` — those aren't repeated per symbol. Prefer this before a full read; then use read_symbol (or read) for the exact body you need.\n" +
             "Single mode: language-uniform tree-sitter outline + review-graph who-uses-this + inline executable extraction; degrades to outline-only when no cached graph is available. `semantic.source` reports whether graph data was used.\n" +
             'Pass `blastRadius: true` to also get the cross-file blast radius — the transitive dependents of this module aggregated to ranked file `read` args ("if you change this, verify these files"). Read-only over the cached graph; omitted on a cold cache. Supersedes the standalone impact query.\n' +
-            'Pass `callGraph: true` to include bounded derived callers/callees from the cached FunctionCallGraph; unavailable cache state is explicit and never reported as zero calls.\n' +
+            "Pass `callGraph: true` to include bounded derived callers/callees from the cached FunctionCallGraph; unavailable cache state is explicit and never reported as zero calls.\n" +
             '`view: "compact"` returns a line-oriented text rendering (one line per symbol/callback, cheapest option) instead of JSON — same data, roughly a quarter of the token cost; use it for a quick skim. Default view returns JSON. An outline shows shape, not bodies — it does NOT count as having read a symbol\'s body for editing; use read_symbol for that.',
         promptSnippet: "Navigable file outline — a cheap substitute for reading a whole file",
         renderResult: compactRenderResult(({ details, args, isError }) => {

package/node_modules/pi-lens/dist/tools/project-report.js

@@ -40,7 +40,7 @@ export function createProjectReportTool(getProjectRoot) {
             })),
             view: Type.Optional(Type.String({
                 enum: ["default", "compact"],
-                description: 'Payload tier. compact (cheapest) returns a line-oriented TEXT rendering instead of JSON. Default returns JSON.',
+                description: "Payload tier. compact (cheapest) returns a line-oriented TEXT rendering instead of JSON. Default returns JSON.",
             })),
         }),
         async execute(_toolCallId, params, _signal, _onUpdate, ctx) {