@herbertgao/pi-extensions 2026.8.13 → 2026.8.15

package/node_modules/pi-lens/dist/clients/file-utils.js

@@ -4,11 +4,11 @@
 import * as fs from "node:fs";
 import * as os from "node:os";
 import * as path from "node:path";
-import { minimatch } from "./deps/minimatch.js";
+import { Minimatch } from "./deps/minimatch.js";
 import { isInSpawnTimeoutCooldown, noteSpawnTimeout, } from "./spawn-timeout-cooldown.js";
 import { collectTrackedFiles, getTrackedFilesSnapshot, } from "./git-tracked-ignore.js";
 import { getGlobalIgnorePatterns, getPiLensGlobalConfigPath, } from "./lens-config.js";
-import { normalizeEphemeralMapKey, normalizeFilePath } from "./path-utils.js";
+import { isUnderDir, normalizeEphemeralMapKey, normalizeFilePath, } from "./path-utils.js";
 import { findPiLensConfigInDir, findPiLensProjectConfig, loadPiLensConfigInDir, loadPiLensProjectConfig, } from "./project-lens-config.js";
 import { safeSpawnAsync } from "./safe-spawn.js";
 /**
@@ -213,19 +213,18 @@ function expandGitignorePattern(pattern) {
         return [body];
     return [body, `**/${body}`];
 }
-function matchesGitignorePattern(pattern, relativePath, isDirectory) {
+function matchesGitignorePattern(pattern, relativePath, isDirectory, matchExpanded) {
     const candidate = stripLeadingSlashes(normalizeIgnorePath(relativePath));
     if (!candidate)
         return false;
     const candidates = isDirectory ? [candidate, `${candidate}/`] : [candidate];
-    const options = { dot: true, nocase: process.platform === "win32" };
     return expandGitignorePattern(pattern).some((expanded) => {
         if (isDirectory && expanded.endsWith("/**")) {
             const prefix = expanded.slice(0, -3);
             if (candidate === prefix || candidate.startsWith(`${prefix}/`))
                 return true;
         }
-        return candidates.some((value) => minimatch(value, expanded, options));
+        return candidates.some((value) => matchExpanded(value, expanded));
     });
 }
 export function readGitignorePatterns(rootDir, layer = "gitignore") {
@@ -252,6 +251,14 @@ function ancestorDirsBetween(rootDir, targetDir) {
     return dirs;
 }
 function buildProjectIgnoreMatcher(resolvedRoot, patterns) {
+    const consumedIgnoreSources = new Map();
+    // `signature` lets a caller that already statted the file reuse that one
+    // stat (#2016's class on this seam: never re-derive a value you just
+    // computed). Callers with no signature in hand still pay their own stat.
+    const rememberIgnoreSource = (filePath, signature = fileFreshnessSignature(filePath)) => {
+        consumedIgnoreSources.set(filePath, { path: filePath, ...signature });
+    };
+    rememberIgnoreSource(path.join(resolvedRoot, ".gitignore"));
     const nestedCache = new Map();
     // #783: layer a NESTED `.pi-lens.json`'s `ignore` field the same way a
     // nested `.gitignore` is already layered — each ancestor directory between
@@ -266,7 +273,26 @@ function buildProjectIgnoreMatcher(resolvedRoot, patterns) {
     const patternsForDir = (dir) => {
         if (dir === resolvedRoot)
             return patterns;
+        const cached = nestedCache.get(dir);
+        const now = Date.now();
+        // #2071: inside the cadence window this directory's rules are frozen, so
+        // no stat runs and every verdict already memoized under `dir` stays
+        // derivable from exactly these patterns. Before this gate the freshness
+        // check ran per call while `patternMemo` did not, which is what let a
+        // fresh path and a memoized path in the same directory return opposite
+        // verdicts for the same rule. Externally edited nested sources are
+        // therefore picked up within PROJECT_IGNORE_FRESHNESS_CADENCE_MS, the
+        // same bound #2159 already accepted for the root sources.
+        // pi-authored `.gitignore` writes keep their instant path through
+        // `invalidateProjectIgnoreMatcherForPath`.
+        if (cached !== undefined &&
+            now - cached.checkedAtMs < PROJECT_IGNORE_FRESHNESS_CADENCE_MS) {
+            return cached.patterns;
+        }
         const gitignoreSig = gitignoreSignature(dir);
+        // One stat, two consumers. `rememberIgnoreSource` used to stat the same
+        // file a second time on the line below this one.
+        rememberIgnoreSource(path.join(dir, ".gitignore"), gitignoreSig);
         // #1105: gate on size too. `findPiLensConfigInDir` returns `size` alongside
         // `mtimeMs` (both from one stat), and `gitignoreSignature` reads both for
         // the nested `.gitignore`, so an mtime-preserving, length-changing edit to
@@ -274,11 +300,13 @@ function buildProjectIgnoreMatcher(resolvedRoot, patterns) {
         const pilensInfo = findPiLensConfigInDir(dir);
         const pilensMtime = pilensInfo?.mtimeMs ?? -1;
         const pilensSize = pilensInfo?.size ?? -1;
-        const cached = nestedCache.get(dir);
         if (cached?.gitignoreMtimeMs === gitignoreSig.mtimeMs &&
             cached?.gitignoreSize === gitignoreSig.size &&
             cached?.pilensMtimeMs === pilensMtime &&
             cached?.pilensSize === pilensSize) {
+            // Unchanged: re-arm the shared clock so the next window is measured
+            // from this check, not from the build that first populated the entry.
+            cached.checkedAtMs = now;
             return cached.patterns;
         }
         const nestedConfig = loadPiLensConfigInDir(dir);
@@ -287,12 +315,19 @@ function buildProjectIgnoreMatcher(resolvedRoot, patterns) {
             ...parseGitignoreContent(nestedConfig.ignore.join("\n"), "pilens"),
         ];
         nestedCache.set(dir, {
+            checkedAtMs: now,
             gitignoreMtimeMs: gitignoreSig.mtimeMs,
             gitignoreSize: gitignoreSig.size,
             pilensMtimeMs: pilensMtime,
             pilensSize: pilensSize,
             patterns: nextPatterns,
         });
+        // #2071: drift is the SINGLE trigger. The rules under `dir` just changed,
+        // so every verdict computed under the superseded rules dies in the same
+        // step that supersedes them. `cached === undefined` is a first build, not
+        // a change, and has no verdicts to drop.
+        if (cached !== undefined)
+            dropVerdictsUnder(dir);
         return nextPatterns;
     };
     // Per-matcher path → pattern-verdict memo. The matcher itself is cached by
@@ -317,6 +352,44 @@ function buildProjectIgnoreMatcher(resolvedRoot, patterns) {
     // already flagged as ignored, so it doesn't reintroduce the per-file cost
     // this memo exists to avoid for the common (not-ignored) case.
     const patternMemo = new Map();
+    /**
+     * Drop every memoized verdict at or below `subtree`, leaving `nestedCache`
+     * alone. `patternsForDir` calls this the moment it rebuilds a directory's
+     * patterns, which is why it must NOT evict the entry that rebuild just
+     * wrote. `invalidateSubtree` layers the eviction on top for the write-hook
+     * path, where the caller knows the source changed but has not re-read it.
+     */
+    function dropVerdictsUnder(subtree) {
+        const resolvedSubtree = path.resolve(subtree);
+        for (const key of patternMemo.keys()) {
+            const memoPath = key.slice(2);
+            const relative = path.relative(resolvedSubtree, memoPath);
+            if (!relative ||
+                (!relative.startsWith("..") && !path.isAbsolute(relative))) {
+                patternMemo.delete(key);
+            }
+        }
+    }
+    const invalidateSubtree = (subtree) => {
+        dropVerdictsUnder(subtree);
+        nestedCache.delete(path.resolve(subtree));
+    };
+    // Compile expanded gitignore globs once per matcher instance. Relative-path
+    // resolution remains outside this cache, so nested ignore scopes cannot leak
+    // verdicts between sibling trees. The instance lifetime bounds this map.
+    const gitignoreGlobOptions = {
+        dot: true,
+        nocase: process.platform === "win32",
+    };
+    const compiledGlobs = new Map();
+    const matchExpanded = (value, expanded) => {
+        let compiled = compiledGlobs.get(expanded);
+        if (compiled === undefined) {
+            compiled = new Minimatch(expanded, gitignoreGlobOptions);
+            compiledGlobs.set(expanded, compiled);
+        }
+        return compiled.match(value);
+    };
     // #703 perf follow-up: `normalizeEphemeralMapKey` (cheap slash-fold +
     // Windows-lowercase, zero fs I/O), NOT `normalizeMapKey` (realpath-backed).
     // This runs on every `isIgnored` call that reaches this branch — walks
@@ -343,6 +416,13 @@ function buildProjectIgnoreMatcher(resolvedRoot, patterns) {
     return {
         rootDir: resolvedRoot,
         patterns,
+        getConsumedIgnoreSources: () => [...consumedIgnoreSources.values()],
+        refreshConsumedIgnoreSource(filePath) {
+            // The freshness sweep refreshes this baseline after invalidation.
+            if (consumedIgnoreSources.has(filePath))
+                rememberIgnoreSource(filePath);
+        },
+        invalidateSubtree,
         ensureTrackedIndex() {
             return collectTrackedFiles(resolvedRoot).then(() => undefined);
         },
@@ -370,7 +450,7 @@ function buildProjectIgnoreMatcher(resolvedRoot, patterns) {
                         const relative = path.relative(dir, resolved);
                         const normalized = normalizeIgnorePath(relative);
                         for (const pattern of dirPatterns) {
-                            if (!matchesGitignorePattern(pattern, normalized, isDirectory))
+                            if (!matchesGitignorePattern(pattern, normalized, isDirectory, matchExpanded))
                                 continue;
                             ignored = !pattern.negated;
                             layer = pattern.layer;
@@ -413,6 +493,8 @@ export function createProjectIgnoreMatcher(rootDir, extraPatterns = [], globalPa
     return buildProjectIgnoreMatcher(resolvedRoot, patterns);
 }
 const projectIgnoreMatcherCache = new Map();
+/** Nested ignore sources are checked at most once per root per cadence window. */
+export const PROJECT_IGNORE_FRESHNESS_CADENCE_MS = 2_000;
 function fileFreshnessSignature(filePath) {
     try {
         const stat = fs.statSync(filePath);
@@ -428,6 +510,12 @@ function globalConfigSignature() {
 function gitignoreSignature(rootDir) {
     return fileFreshnessSignature(path.join(rootDir, ".gitignore"));
 }
+function hasIgnoreSourceDrift(sources) {
+    return sources.some((source) => {
+        const current = fileFreshnessSignature(source.path);
+        return current.mtimeMs !== source.mtimeMs || current.size !== source.size;
+    });
+}
 /**
  * The project config file found by the same upward walk as the loader. Cache
  * invalidation must track the actual file found, not only a file directly under
@@ -446,6 +534,44 @@ export function getProjectIgnoreMatcher(rootDir) {
     const lensConfig = lensConfigInfo(resolvedRoot);
     const globalSig = globalConfigSignature();
     const cached = projectIgnoreMatcherCache.get(resolvedRoot);
+    // A path can be discovered during the previous matcher lookup. Publish only
+    // previously unseen sources so a walk cannot replace a pre-edit baseline.
+    //
+    // This runs BEFORE the sweep below, and the order is load-bearing. A nested
+    // source can only be published on a call AFTER the one that consumed it.
+    // With the publish second, the sweep never saw a source during the window in
+    // which it was discovered, yet still reset `lastIgnoreFreshnessCheckMs`, so
+    // the first sweep that could see it ran a FULL cadence later. Pickup was up
+    // to 2x cadence, not 1x: measured stale at 2 s and 3 s, fresh at 4 s. The
+    // baseline is protected by the `known` set, not by the ordering, so moving
+    // the publish earlier cannot let a walk overwrite a pre-edit baseline.
+    if (cached) {
+        const known = new Set(cached.ignoreSources.map((source) => source.path));
+        for (const source of cached.matcher.getConsumedIgnoreSources()) {
+            if (!known.has(source.path))
+                cached.ignoreSources.push(source);
+        }
+    }
+    if (cached &&
+        Date.now() - cached.lastIgnoreFreshnessCheckMs >=
+            PROJECT_IGNORE_FRESHNESS_CADENCE_MS) {
+        cached.lastIgnoreFreshnessCheckMs = Date.now();
+        if (hasIgnoreSourceDrift(cached.ignoreSources)) {
+            for (const source of cached.ignoreSources) {
+                if (hasIgnoreSourceDrift([source])) {
+                    const sourceIndex = cached.ignoreSources.findIndex((cachedSource) => cachedSource.path === source.path);
+                    invalidateProjectIgnoreMatcherForPath(source.path);
+                    cached.matcher.refreshConsumedIgnoreSource(source.path);
+                    const refreshedSource = cached.matcher
+                        .getConsumedIgnoreSources()
+                        .find((current) => current.path === source.path);
+                    if (sourceIndex !== -1 && refreshedSource !== undefined) {
+                        cached.ignoreSources.splice(sourceIndex, 1, refreshedSource);
+                    }
+                }
+            }
+        }
+    }
     if (cached?.gitignoreMtimeMs === gitignoreSig.mtimeMs &&
         cached?.gitignoreSize === gitignoreSig.size &&
         cached?.lensConfigPath === lensConfig.path &&
@@ -463,6 +589,8 @@ export function getProjectIgnoreMatcher(rootDir) {
     const projectConfig = loadPiLensProjectConfig(resolvedRoot, lensConfig.info);
     const matcher = createProjectIgnoreMatcher(resolvedRoot, projectConfig.ignore, getGlobalIgnorePatterns());
     projectIgnoreMatcherCache.set(resolvedRoot, {
+        ignoreSources: [...matcher.getConsumedIgnoreSources()],
+        lastIgnoreFreshnessCheckMs: Date.now(),
         gitignoreMtimeMs: gitignoreSig.mtimeMs,
         gitignoreSize: gitignoreSig.size,
         lensConfigPath: lensConfig.path,
@@ -474,6 +602,28 @@ export function getProjectIgnoreMatcher(rootDir) {
     });
     return matcher;
 }
+/**
+ * Invalidate the cached matcher state affected by a written `.gitignore`.
+ *
+ * Root changes discard the whole matcher because they change its base pattern
+ * set. Nested changes evict only verdicts in that directory's subtree; the
+ * matcher and compiled-glob memo remain reusable for unrelated trees.
+ */
+export function invalidateProjectIgnoreMatcherForPath(filePath) {
+    const resolvedPath = path.resolve(filePath);
+    if (path.basename(resolvedPath).toLowerCase() !== ".gitignore")
+        return;
+    for (const [cachedRoot, cached] of projectIgnoreMatcherCache) {
+        if (!isUnderDir(resolvedPath, cachedRoot))
+            continue;
+        if (normalizeFilePath(resolvedPath) ===
+            normalizeFilePath(path.join(cachedRoot, ".gitignore"))) {
+            projectIgnoreMatcherCache.delete(cachedRoot);
+            continue;
+        }
+        cached.matcher.invalidateSubtree(path.dirname(resolvedPath));
+    }
+}
 export function isPathIgnoredByProject(filePath, rootDir, isDirectory = false) {
     return getProjectIgnoreMatcher(rootDir).isIgnored(filePath, isDirectory);
 }

package/node_modules/pi-lens/dist/clients/finding-delivery-gate.js

@@ -240,6 +240,7 @@ export const DELIVERY_SURFACES = {
     // `late_auxiliary_findings` latency record rather than silenced.
     "runtime-turn:late-auxiliary-findings": gated(RUNTIME_TURN_FILE, "Turn-end late-auxiliary LSP findings (collect-later probe of aux " +
         "client caches whose grace window expired).", ["gateFindingsByPathFreshness"], ['store: "late-auxiliary-findings"']),
+    "runtime-turn:late-runner-findings": gated(RUNTIME_TURN_FILE, "Turn-end CLI runner findings collected after the post-write path.", ["gateFindingsByPathFreshness"], ['store: "late-runner-findings"'], { evidenceMin: 2 }),
     "runtime-turn:cascade-blocker": labeled(RUNTIME_TURN_FILE, "Turn-end 🧪 cascade neighbor blocker.", "Cascade results settle synchronously this turn where possible " +
         "(`settleCascadeRuns`), but an unsettled compute can carry over to a " +
         "later turn (bounded by a carry cap) — this round does not freshness-" +
@@ -319,6 +320,10 @@ export const DELIVERY_SURFACES = {
     "git-guard:commit-blocked": labeled("clients/git-guard.ts", "Git-guard commit/push 🔴 COMMIT BLOCKED verdict (--lens-guard).", "Synchronous preflight rejection returned inline with the failed git " +
         "command — no stored state is delivered, so nothing can go stale between " +
         "detection and delivery.", "live"),
+    "shared-checkout-guard:worktree-mutation-blocked": labeled("clients/shared-checkout-guard.ts", "Shared-checkout 🔴 WORKING-TREE CHANGE BLOCKED verdict (--lens-checkout-guard).", "Synchronous preflight rejection returned inline with the failed git " +
+        "command. Both inputs are read at decision time — the instance registry " +
+        "and `git status` — so no stored finding is replayed and nothing can go " +
+        "stale between detection and delivery.", "live"),
     "read-guard-tool-lines:preflight-errors": labeled("clients/read-guard-tool-lines.ts", "Read-guard hashline BLOCKED / RE-READ REQUIRED preflight errors.", "Computed fresh per edit attempt and returned as that attempt's rejection — " +
         "no cached findings are replayed, so there is no staleness window.", "live"),
     "tool-call:duplicate-export-blocker": labeled("clients/runtime-tool-call.ts", "Duplicate-export STOP rejection returned inline with the failed edit.", "Synchronous preflight rejection computed per edit attempt; no stored state.", "live"),

package/node_modules/pi-lens/dist/clients/formatters.js

@@ -17,6 +17,7 @@ import { normalizeMapKey } from "./path-utils.js";
 import { TERRAGRUNT_FILENAMES } from "./file-kinds.js";
 import { detectIndentation, hasDetectableIndentation, } from "./dispatch/indent-detect.js";
 import { logLatency } from "./latency-logger.js";
+import { compareOrdinal } from "./string-utils.js";
 import { classifyProbeFailure, createAvailabilityLatch, logAvailabilityDecision, startHostStallSampler, } from "./dispatch/runners/utils/availability-policy.js";
 import { findGlobalBinary, findLocalBinUpwards } from "./package-manager.js";
 import { safeSpawnAsync } from "./safe-spawn.js";
@@ -224,6 +225,9 @@ function noteCooldownServedVerdict(command, latch) {
         retryAfterMs: Math.max(1, retryAtMs - Date.now()),
         budgetMs: WHICH_BUDGET_MS,
         servedFromCooldown: true,
+        // No probe ran here: the latch's own remembered cause is replayed
+        // as-is, so the call site is the one asserting it (#2209).
+        classifiedBy: "caller",
     });
 }
 async function which(command) {
@@ -261,6 +265,7 @@ async function which(command) {
             latched: true,
             hostStallMs,
             budgetMs: WHICH_BUDGET_MS,
+            classifiedBy: "probe",
         });
         return resolved;
     }
@@ -281,9 +286,15 @@ async function which(command) {
         ...(proberRan && { unclassifiedFailureOutcome: "missing" }),
     });
     let { outcome, cause } = classified;
+    // This call site OVERRIDES classifyProbeFailure's own answer below, so a
+    // row it forced is a caller assertion, not a probe classification — the
+    // scrutiny availability-policy.ts:253-258 reserves for "caller" rows must
+    // not be laundered away by mislabeling this one "probe" (#2226 review F1).
+    let outcomeForced = false;
     if (!proberRan && outcome !== "transient") {
         outcome = "transient";
         cause = "probe-rejected";
+        outcomeForced = true;
     }
     const retryAfterMs = entry.latch.noteUnavailable(outcome, cause);
     if (outcome === "transient")
@@ -303,6 +314,7 @@ async function which(command) {
         hostStallMs,
         ...(retryAfterMs > 0 && { retryAfterMs }),
         budgetMs: WHICH_BUDGET_MS,
+        classifiedBy: outcomeForced ? "caller" : "probe",
     });
     return null;
 }
@@ -1413,9 +1425,7 @@ const FORMATTER_CONFIG_FILES = [
 ];
 async function formatterConfigSignature(cwd) {
     const paths = await findUp(FORMATTER_CONFIG_FILES, cwd);
-    const parts = await Promise.all(paths
-        .sort((a, b) => a.localeCompare(b))
-        .map(async (filePath) => {
+    const parts = await Promise.all(paths.sort(compareOrdinal).map(async (filePath) => {
         try {
             const stat = await fs.stat(filePath);
             return `${filePath}:${stat.mtimeMs}:${stat.size}`;
@@ -1459,6 +1469,20 @@ export async function getFormattersForFile(filePath, cwd) {
     }
     if (cached.entries.has(cacheKey)) {
         const enabledNames = cached.entries.get(cacheKey);
+        const selectedFormatterName = enabledNames && enabledNames.length > 0 ? enabledNames[0] : null;
+        logLatency({
+            type: "phase",
+            phase: "formatter_selected",
+            filePath: filePath,
+            durationMs: 0,
+            metadata: {
+                formatter: selectedFormatterName,
+                reason: "cache",
+                cached: true,
+                outcome: "hit",
+                cwd,
+            },
+        });
         if (!enabledNames || enabledNames.length === 0)
             return [];
         // Return cached formatters by name (preserves priority order)
@@ -1601,6 +1625,7 @@ export async function getFormattersForFile(filePath, cwd) {
         metadata: {
             formatter: selected?.name ?? null,
             reason: selectionReason,
+            outcome: "miss",
             cwd,
             ...(provisional && {
                 cached: false,