@herbertgao/pi-extensions 2026.8.13 → 2026.8.15

package/node_modules/pi-lens/dist/clients/lsp/jvm-runtime.js

@@ -186,6 +186,9 @@ function probeJavaOnPath() {
                 latched: false,
                 retryAfterMs: Math.max(0, javaAvailabilityLatch.getRetryAtMs() - Date.now()),
                 budgetMs: JAVA_PROBE_TIMEOUT_MS,
+                // No probe ran here: the latch's own remembered cause is replayed
+                // as-is, so the call site is the one asserting it (#2209).
+                classifiedBy: "caller",
             });
             return Promise.resolve(undefined);
         }
@@ -226,6 +229,7 @@ async function runJavaProbe() {
             latched: true,
             hostStallMs,
             budgetMs: JAVA_PROBE_TIMEOUT_MS,
+            classifiedBy: "probe",
         });
         return true;
     }
@@ -247,6 +251,7 @@ async function runJavaProbe() {
         hostStallMs,
         ...(retryAfterMs > 0 && { retryAfterMs }),
         budgetMs: JAVA_PROBE_TIMEOUT_MS,
+        classifiedBy: "probe",
     });
     return outcome === "transient" ? undefined : false;
 }

package/node_modules/pi-lens/dist/clients/lsp/launch.js

@@ -89,22 +89,42 @@ export function combinePathValuesForPlatform(values, platform = process.platform
 function resolvePathValue(env) {
     return combinePathValuesForPlatform([env.PATH, env.Path, env.path]);
 }
-/** Read live system+user PATH from Windows registry (bypasses stale process.env.PATH). */
-function readWindowsRegistryPath() {
+/**
+ * Run an `execFileSync` probe with the #2095 stderr guard applied, returning
+ * `""` on any failure. Exported as a small test seam: production always calls
+ * it with the fixed `powershell.exe` command/args below, but a test can pass
+ * a command guaranteed to fail with real stderr output (no real Windows or
+ * powershell.exe required) to prove the guard is actually reached and not
+ * vacuous.
+ */
+export function runStderrGuardedProbe(command, args) {
     try {
         const { execFileSync } = require("node:child_process");
-        const out = execFileSync("powershell.exe", [
-            "-NoProfile",
-            "-NonInteractive",
-            "-Command",
-            "[System.Environment]::GetEnvironmentVariable('Path','Machine') + ';' + [System.Environment]::GetEnvironmentVariable('Path','User')",
-        ], { timeout: 3000, encoding: "utf8" });
+        const out = execFileSync(command, args, {
+            timeout: 3000,
+            encoding: "utf8",
+            // #2095 sibling: execFileSync inherits stderr to the parent by
+            // default (only stdout is captured into `out`), so a failed
+            // powershell.exe launch would print raw diagnostics into the pi
+            // TUI even though the surrounding catch already returns "" (read as
+            // "unknown" PATH by every caller). Pipe stderr instead of inheriting it.
+            stdio: ["ignore", "pipe", "ignore"],
+        });
         return out.trim();
     }
     catch {
         return "";
     }
 }
+/** Read live system+user PATH from Windows registry (bypasses stale process.env.PATH). */
+function readWindowsRegistryPath() {
+    return runStderrGuardedProbe("powershell.exe", [
+        "-NoProfile",
+        "-NonInteractive",
+        "-Command",
+        "[System.Environment]::GetEnvironmentVariable('Path','Machine') + ';' + [System.Environment]::GetEnvironmentVariable('Path','User')",
+    ]);
+}
 let _liveWindowsPath = null;
 function getLiveWindowsPath() {
     if (_liveWindowsPath === null) {
@@ -234,6 +254,14 @@ function findBinaryOnPath(command, env) {
             encoding: "utf-8",
             stdio: ["ignore", "pipe", "ignore"],
             env,
+            // #1980 population sweep: this was the one synchronous
+            // child-process site in the repo with no bound at all. It runs on
+            // the LSP server spawn path, so an unresponsive `where`/`which` — a
+            // stale network PATH entry is the classic cause — parked the event
+            // loop with no ceiling, and read as ordinary compute in
+            // `loop_block`. 5s matches `isCommandAvailable`/`findCommand` in
+            // clients/safe-spawn.ts, which run these same two binaries.
+            timeout: 5000,
         })
             .split(/\r?\n/)
             .map((line) => line.trim())

package/node_modules/pi-lens/dist/clients/lsp/pending-aux-coverage.js

@@ -36,6 +36,21 @@
  * index whose keys are produced by this same process's touch path, so the
  * cheap ephemeral normalizer is the lifetime-appropriate choice per the
  * PathKeyedMap guidance — no realpath walk on the per-edit path.
+ *
+ * #2324 F3/R2-A: this module ALSO hands off in the other direction, for
+ * ast-grep specifically. Gate B's napi runner is a second producer of
+ * coverage for the same (file, "ast-grep") pair — when it runs as the
+ * fallback and actually evaluates rules, it calls
+ * {@link recordNapiFallbackCoverage}. The PRODUCER above reads that record
+ * (via {@link napiFallbackCoveredSince}) before deciding whether to mark a
+ * pair, because napi's Gate-B check settles synchronously while the aux-grace
+ * wait's own decision takes up to its full grace budget — by the time the
+ * wait is ready to mark, THIS touch's napi run (if any) has already finished,
+ * so the wait can reliably see it; a clear issued from napi's side cannot,
+ * because the mark it would be racing has not been written yet.
+ * {@link clearPendingAuxiliaryCoverage} is still used, but only to drop a
+ * LEFTOVER pair from an EARLIER touch once napi has fresh evaluated findings
+ * to supersede it.
  */
 import { normalizeEphemeralMapKey } from "../path-utils.js";
 /** Maximum pending (filePath, serverId) pairs; oldest evicted beyond this. */
@@ -47,6 +62,7 @@ export const MAX_PENDING_AUX_ENTRIES = 50;
  * forever. Overridable via `PI_LENS_LATE_AUX_REARM_TTL_MS`.
  */
 export const DEFAULT_LATE_AUX_REARM_TTL_MS = 5 * 60_000;
+export const MAX_LATE_AUX_REARMS = 8;
 /**
  * Read the `PI_LENS_LATE_AUX_REARM_TTL_MS` env override at call time (not
  * module load time) so tests and users can tune without a rebuild — same
@@ -73,6 +89,14 @@ export function isPendingAuxiliaryPastRearmTtl(pair, nowMs = Date.now()) {
     return nowMs - anchor >= readLateAuxRearmTtlMs();
 }
 const pending = new Map();
+/**
+ * #2168: pairs evicted at the cap have no other retirement record — the
+ * drain-time reconciliation in `runtime-turn.ts` never sees them because
+ * they are gone before a drain can observe them. Counted here so the
+ * consumer can fold them into its per-turn `pairCreated`/retirement sum
+ * instead of the pair vanishing uncounted.
+ */
+let capEvictedCount = 0;
 function pairKey(filePath, serverId) {
     return `${normalizeEphemeralMapKey(filePath)}\u0000${serverId}`;
 }
@@ -89,7 +113,7 @@ function pairKey(filePath, serverId) {
  * `rearmedAtMs`) marks a NEWER revision, so it resets any prior re-arm stamp
  * along with the baseline — the new pair's TTL starts from its own mark.
  */
-export function markPendingAuxiliaryCoverage(filePath, serverIds, markedAtMs = Date.now(), rearmedAtMs) {
+export function markPendingAuxiliaryCoverage(filePath, serverIds, markedAtMs = Date.now(), rearmedAtMs, rearmCount) {
     for (const serverId of serverIds) {
         const key = pairKey(filePath, serverId);
         const existing = pending.get(key);
@@ -107,20 +131,45 @@ export function markPendingAuxiliaryCoverage(filePath, serverIds, markedAtMs = D
                     serverId,
                     markedAtMs: existing.markedAtMs,
                     lastRearmedAtMs: rearmedAtMs,
+                    rearmCount: rearmCount ?? (existing.rearmCount ?? 0) + 1,
                 });
             continue;
         }
         pending.set(key, rearmedAtMs === undefined
             ? { filePath, serverId, markedAtMs }
-            : { filePath, serverId, markedAtMs, lastRearmedAtMs: rearmedAtMs });
+            : {
+                filePath,
+                serverId,
+                markedAtMs,
+                lastRearmedAtMs: rearmedAtMs,
+                rearmCount: rearmCount ?? 1,
+            });
         while (pending.size > MAX_PENDING_AUX_ENTRIES) {
             const oldest = pending.keys().next().value;
             if (oldest === undefined)
                 break;
             pending.delete(oldest);
+            capEvictedCount += 1;
         }
     }
 }
+/** Re-arm a drained pair while carrying its ceiling count across the drain. */
+export function rearmPendingAuxiliaryCoverage(pair, rearmedAtMs = Date.now(), refreshBaseline = false) {
+    const nextCount = (pair.rearmCount ?? 0) + 1;
+    markPendingAuxiliaryCoverage(pair.filePath, [pair.serverId], refreshBaseline ? rearmedAtMs : pair.markedAtMs, rearmedAtMs, nextCount);
+}
+/**
+ * Read-only check: is this (file, server) pair currently pending late
+ * delivery? #2324 F2: Gate B's "has this server EVER published for this
+ * file" answer goes stale the moment a later touch's aux-grace wait finds
+ * the server silent for the CURRENT content — a pending pair is exactly
+ * that signal, so a caller deciding whether to skip a fallback runner can
+ * tell "published, still current" from "published once, silent now" without
+ * draining or mutating the store.
+ */
+export function hasPendingAuxiliaryCoverage(filePath, serverId) {
+    return pending.has(pairKey(filePath, serverId));
+}
 /**
  * Remove one pair after its findings were delivered, or whenever the caller
  * knows it is resolved. Unknown pairs are a no-op.
@@ -139,14 +188,77 @@ export function drainPendingAuxiliaryCoverage() {
     pending.clear();
     return drained;
 }
-/** Test-only: current pending pair count. */
-export function pendingAuxiliaryCoverageSizeForTests() {
+/** Current pending pair count for bounded reconciliation telemetry. */
+export function pendingAuxiliaryCoverageSize() {
     return pending.size;
 }
+/** Test-only alias for the store-size assertion seam. */
+export const pendingAuxiliaryCoverageSizeForTests = pendingAuxiliaryCoverageSize;
+/**
+ * Drain (read and reset) the cap-eviction count accumulated since the last
+ * drain. Mirrors {@link drainPendingAuxiliaryCoverage}'s consume-once shape
+ * so the turn-end consumer can fold evictions that happened between two
+ * turn ends into its reconciliation sum exactly once, never accumulating
+ * across turns.
+ */
+export function drainPendingAuxCapEvictedCount() {
+    const count = capEvictedCount;
+    capEvictedCount = 0;
+    return count;
+}
+/**
+ * #2324 R2-A: (file) -> the timestamp of the LAST time the ast-grep napi
+ * fallback actually evaluated rules for it, as Gate B's runner
+ * (`clients/dispatch/runners/ast-grep-napi.ts`). This is the cross-module
+ * hand-off the aux-grace wait (`clients/lsp/index.ts`) needs to avoid
+ * marking a pending late-auxiliary pair for a file napi ALREADY delivered
+ * for on THIS touch.
+ *
+ * Ordering is why a synchronous clear-on-napi-run cannot do this job: the
+ * wait that decides whether to mark a pair runs for up to ~1800ms (its own
+ * grace budget) AFTER napi's Gate-B check, which is a single map lookup.
+ * Clearing at napi's run start (or end) races the mark and reliably loses —
+ * the mark, if any, has not been written yet. The wait itself is the only
+ * place that knows the outcome, so it is the one that must consult this
+ * store and skip marking, not the runner that must guess at the wait's
+ * future decision.
+ *
+ * Bounded like the pending-pair store itself; oldest evicted first.
+ */
+const napiFallbackCoverage = new Map();
+export const MAX_NAPI_COVERAGE_ENTRIES = 50;
+/** Record that napi actually evaluated rules for `filePath` at `atMs`. */
+export function recordNapiFallbackCoverage(filePath, atMs = Date.now()) {
+    const key = normalizeEphemeralMapKey(filePath);
+    napiFallbackCoverage.delete(key);
+    napiFallbackCoverage.set(key, atMs);
+    while (napiFallbackCoverage.size > MAX_NAPI_COVERAGE_ENTRIES) {
+        const oldest = napiFallbackCoverage.keys().next().value;
+        if (oldest === undefined)
+            break;
+        napiFallbackCoverage.delete(oldest);
+    }
+}
+/**
+ * Did napi cover `filePath` at or after `sinceMs`? The aux-grace wait passes
+ * its own `waitStartedAt` baseline so a STALE coverage record from an
+ * earlier touch (napi ran for a PREVIOUS revision) cannot suppress marking a
+ * pair this touch's silent server genuinely needs delivered later.
+ */
+export function napiFallbackCoveredSince(filePath, sinceMs) {
+    const ts = napiFallbackCoverage.get(normalizeEphemeralMapKey(filePath));
+    return ts !== undefined && ts >= sinceMs;
+}
+/** Test-only reset for the napi-coverage hand-off. */
+export function resetNapiFallbackCoverageForTests() {
+    napiFallbackCoverage.clear();
+}
 /**
  * Session-boundary clear (#1635): pending baselines are unreachable after
  * reset (the generation-stamped keys no longer match any active session).
  */
 export function resetPendingAuxiliaryCoverage() {
     pending.clear();
+    capEvictedCount = 0;
+    napiFallbackCoverage.clear();
 }

package/node_modules/pi-lens/dist/clients/lsp/server.js

@@ -6,7 +6,7 @@
  * - Auto-installation strategies
  * - Platform-specific handling
  */
-import { existsSync, mkdirSync } from "node:fs";
+import { existsSync, mkdirSync, statSync } from "node:fs";
 import { access, readFile, readdir, stat } from "node:fs/promises";
 import os from "node:os";
 import path from "node:path";
@@ -14,7 +14,7 @@ import { getGlobalPiLensDir, getProjectIgnoreGlobs, isPathIgnoredByProject, } fr
 import { STAGE_TMP_PATTERN } from "../atomic-write-staging.js";
 import { DOTNET_CSHARP_ROOT_MARKERS, DOTNET_FSHARP_ROOT_MARKERS, KIND_EXTENSIONS, } from "../file-kinds.js";
 import { direntsHaveMarkerGlobMatch, isAtOrAboveHomeDir, isFullyQualified, isWindowsPath, pathsEqual, } from "../path-utils.js";
-import { ensureTool, getToolEnvironment, getToolPath, } from "../installer/index.js";
+import { ensureTool, findManagedToolBinary, getToolEnvironment, getToolPath, } from "../installer/index.js";
 import { resolveOpengrepConfig } from "../opengrep-config.js";
 import { isZizmorAuditTarget, resolveZizmorGitHubToken, } from "../zizmor-config.js";
 import { logLatency } from "../latency-logger.js";
@@ -29,6 +29,7 @@ import { createLombokJdtlsArgs } from "./lombok.js";
 import { resolveJavaRuntimeEnv } from "./jvm-runtime.js";
 import { normalizeMapKey } from "./path-utils.js";
 import { getRubyVersionDirNamesSync } from "./ruby-drive-dirs.js";
+import { getProcessSingleton } from "../process-singletons.js";
 const FIXTURE_ROOT_SEGMENTS = new Set(["__fixtures__", "testdata"]);
 const FALLBACK_PROJECT_MARKERS = [
     ".git",
@@ -77,10 +78,69 @@ const PROJECT_BOUNDARY_MARKERS = [
 // process (not once per session). Keep the root-boundary marker below aligned
 // with FALLBACK_PROJECT_MARKERS, the shared fallback root-policy marker set.
 const loggedRootCeilingClamps = new Set();
-function isSameOrWithin(ancestor, candidate) {
+const posixCaseInsensitiveByPath = new Map();
+function posixFilesystemIsCaseInsensitive(root) {
+    const resolved = path.resolve(root);
+    const cached = posixCaseInsensitiveByPath.get(resolved);
+    if (cached !== undefined)
+        return cached;
+    if (!existsSync(resolved)) {
+        return false;
+    }
+    const name = path.basename(resolved);
+    const alternate = name.toLowerCase() === name ? name.toUpperCase() : name.toLowerCase();
+    let insensitive = false;
+    const alternatePath = path.join(path.dirname(resolved), alternate);
+    if (alternate !== name && existsSync(alternatePath)) {
+        try {
+            const actual = statSync(resolved);
+            const alternateStat = statSync(alternatePath);
+            insensitive =
+                actual.dev === alternateStat.dev && actual.ino === alternateStat.ino;
+        }
+        catch {
+            insensitive = false;
+        }
+    }
+    posixCaseInsensitiveByPath.set(resolved, insensitive);
+    return insensitive;
+}
+export function resetLSPCaseSensitivityState() {
+    posixCaseInsensitiveByPath.clear();
+}
+export function _getPosixCaseSensitivityCacheSizeForTests() {
+    return posixCaseInsensitiveByPath.size;
+}
+/**
+ * Path-shape-aware containment test: is `candidate` the same path as
+ * `ancestor`, or inside it?
+ *
+ * Exported so the session-cwd registry (`clients/lsp/config.ts`) and the
+ * foreign-root decline gate (`clients/lsp/index.ts`) test containment with the
+ * SAME comparator the root ceiling uses. A second hand-rolled `path.relative`
+ * helper alongside this one is how the two drift apart on Windows-shaped
+ * paths (shape 2 / #1150): `path.isAbsolute("C:\\repo")` is false on POSIX, so
+ * a host-default comparator silently mis-answers a win32 path on Linux CI.
+ */
+export function isSameOrWithin(ancestor, candidate, deps = {}) {
     const windowsShaped = isWindowsPath(ancestor) || isWindowsPath(candidate);
     const pathApi = windowsShaped ? path.win32 : path;
-    const relative = pathApi.relative(pathApi.resolve(ancestor), pathApi.resolve(candidate));
+    const resolvedAncestor = pathApi.resolve(ancestor);
+    const resolvedCandidate = pathApi.resolve(candidate);
+    let caseInsensitive = false;
+    if (!windowsShaped) {
+        if (deps.caseInsensitiveProbe) {
+            const cached = posixCaseInsensitiveByPath.get(resolvedAncestor);
+            caseInsensitive = cached ?? deps.caseInsensitiveProbe(resolvedAncestor);
+            if (cached === undefined) {
+                posixCaseInsensitiveByPath.set(resolvedAncestor, caseInsensitive);
+            }
+        }
+        else {
+            caseInsensitive = posixFilesystemIsCaseInsensitive(resolvedAncestor);
+        }
+    }
+    const relative = pathApi.relative(caseInsensitive ? resolvedAncestor.toLowerCase() : resolvedAncestor, caseInsensitive ? resolvedCandidate.toLowerCase() : resolvedCandidate);
     return (relative === "" ||
         (!relative.startsWith("..") && !pathApi.isAbsolute(relative)));
 }
@@ -251,6 +311,24 @@ export async function resolveAndLaunch(spec, allowInstall) {
             lastRuntimeFailure = err instanceof Error ? err : new Error(message);
         }
     };
+    // #2140: consult the release-managed binary directory (~/.pi-lens/bin)
+    // BEFORE the bare-PATH candidates below. A bare `candidates: ["opengrep"]`
+    // entry only ever resolves through the OS's own PATH lookup — never that
+    // directory — so a github/maven/archive-strategy tool installed there with
+    // no PATH entry ENOENTs every direct candidate first, only to have the
+    // managed-install step further down find the very same binary a few
+    // hundred ms later. `findManagedToolBinary` does a bare `fs.access`, no
+    // spawn, so this costs at most a few stat calls per server launch attempt
+    // (not per file/dispatch — launches are session-scoped). Mirrors
+    // `findManagedNodeToolBinary`'s npm-managed fast path (runner-helpers.ts)
+    // and `SecurityScanClient.probeVersion`'s equivalent fix for the CLI-scan
+    // half of this same issue (#2140, landed in PR #2148/#2137).
+    const managedCandidate = spec.managedToolId
+        ? await findManagedToolBinary(spec.managedToolId)
+        : undefined;
+    const candidates = managedCandidate && !spec.candidates.includes(managedCandidate)
+        ? [managedCandidate, ...spec.candidates]
+        : spec.candidates;
     // A candidate that fails while a LATER candidate (or managed install)
     // succeeds is just fallback, not a failure — logging each immediately floods
     // the logs with scary "candidate failed / npm shim failed / Run npm install"
@@ -258,7 +336,7 @@ export async function resolveAndLaunch(spec, allowInstall) {
     // surface only if ALL direct candidates fail.
     const candidateFailures = [];
     // Step 1 & 2 — try all explicit candidates (includes bare command = PATH lookup)
-    for (const [index, command] of spec.candidates.entries()) {
+    for (const [index, command] of candidates.entries()) {
         logLatency({
             type: "phase",
             phase: "lsp_launch_candidate_attempt",
@@ -268,11 +346,11 @@ export async function resolveAndLaunch(spec, allowInstall) {
                 tool: toolLabel,
                 command,
                 index,
-                totalCandidates: spec.candidates.length,
+                totalCandidates: candidates.length,
                 allowInstall: canInstall(allowInstall),
             },
         });
-        logSessionStart(`lsp launch candidate attempt tool=${toolLabel} idx=${index}/${spec.candidates.length - 1} command=${command} cwd=${spec.cwd}`);
+        logSessionStart(`lsp launch candidate attempt tool=${toolLabel} idx=${index}/${candidates.length - 1} command=${command} cwd=${spec.cwd}`);
         try {
             const proc = await launchLSP(command, spec.args, {
                 cwd: spec.cwd,
@@ -896,19 +974,23 @@ async function findAncestorFileAmong(startDir, candidateSegmentLists) {
  * Svelte). Without this guard an offline or partial install re-runs a 120 s
  * forced reinstall on every spawn.
  *
- * The guard is a plain module-level flag, so without an explicit re-arm it
+ * The guard is process-singleton state, so without an explicit re-arm it
  * would latch for the whole extension-host process — a repair that failed
  * once (transient registry hiccup) would stay unrepairable for every later
  * session in that process. `resetClassicTsRepairGuard` re-arms it; callers
  * wire that into `session_start` alongside the other per-session resets
  * (#1570).
  */
-let classicTsRepairAttempted = false;
+const CLASSIC_TS_REPAIR_FAMILY = "lsp.classic-ts-repair-guard";
+const CLASSIC_TS_REPAIR_VERSION = 1;
+function classicTsRepairState() {
+    return getProcessSingleton(CLASSIC_TS_REPAIR_FAMILY, CLASSIC_TS_REPAIR_VERSION, () => ({ attempted: false }));
+}
 /** Re-arm the classic-repair guard so a new session gets its own attempt. */
 export function resetClassicTsRepairGuard() {
-    classicTsRepairAttempted = false;
+    classicTsRepairState().attempted = false;
 }
-/** Test hook — clears the per-process classic-repair guard. */
+/** Test hook — clears the process-singleton classic-repair guard. */
 export function _resetClassicTsRepairForTests() {
     resetClassicTsRepairGuard();
 }
@@ -1008,7 +1090,7 @@ async function findTsserverPath(root, allowInstall) {
     if (discoveredTsserver ||
         !discoveredTsc ||
         !installAllowed ||
-        classicTsRepairAttempted) {
+        classicTsRepairState().attempted) {
         return discoveredTsserver;
     }
     // Repair only a compiler we can prove is TypeScript 7+. TypeScript 7 dropped
@@ -1021,7 +1103,7 @@ async function findTsserverPath(root, allowInstall) {
     // An older managed tree took `latest` before the registry pinned the classic
     // compiler. Reinstall the pinned version once so that tree self-heals,
     // without deleting user or project-local TypeScript installations.
-    classicTsRepairAttempted = true;
+    classicTsRepairState().attempted = true;
     logSessionStart(`lsp typescript: managed compiler resolved to TypeScript ${discoveredVersion.version}, which ships no tsserver.js; reinstalling pinned classic fallback`);
     const repairedTsc = await ensureTool("typescript", {
         allowInstall: true,
@@ -2316,6 +2398,19 @@ export const BashServer = {
     name: "Bash Language Server",
     extensions: [".bash", ".sh", ".zsh"],
     root: FileDirRoot,
+    // #2194 bounded the installer's own verification at 20s; the dispatch
+    // touch's client-wait floor stayed at the shared 5s default, so a cold
+    // spawn could still race that budget and read as unavailable even after
+    // installer verification cleared it. Match the installer bound (#2169).
+    // `initializeTimeoutMs` matches it too: the measured cold start
+    // (9,667ms, #2194) has headroom under the unraised 15s default, but
+    // leaving the two fields mismatched is the same latent shape that made
+    // the Prisma/Vue raise a no-op (fix-round F1, #2233) — a slower host
+    // than the one measured would still hit the 15s inner kill despite the
+    // caller being willing to wait 20s. Equalizing costs nothing on the
+    // success path and removes the mismatch outright.
+    clientWaitTimeoutMs: 20_000,
+    initializeTimeoutMs: 20_000,
     spawn(root, options) {
         return resolveAndLaunch({
             candidates: nodeBinCandidates(root, "bash-language-server"),
@@ -2402,6 +2497,13 @@ export const JsonServer = {
         ["package.json", "tsconfig.json", "jsconfig.json"],
         [".git"],
     ])),
+    // See BashServer above: the installer's 20s verification bound (#2194)
+    // does not, on its own, raise the dispatch touch's cold-spawn wait floor.
+    // Mirror it here so a cold spawn cannot lose that race either (#2169).
+    // `initializeTimeoutMs` matches it for the same reason as BashServer
+    // above (fix-round F1, #2233).
+    clientWaitTimeoutMs: 20_000,
+    initializeTimeoutMs: 20_000,
     spawn(root, options) {
         return resolveAndLaunch({
             candidates: ["vscode-json-language-server"],
@@ -2444,6 +2546,17 @@ export const PrismaServer = {
     name: "Prisma Language Server",
     extensions: KIND_EXTENSIONS["prisma"],
     root: RootWithFallback(createRootDetector(["prisma/schema.prisma", "schema.prisma"])),
+    // Matches the installer's 40s verification bound above (#2169): the
+    // dispatch touch's cold-spawn wait floor defaults to 5s and would
+    // otherwise time the client out well before the binary answers.
+    // `initializeTimeoutMs` MUST be set alongside it (RubyServer's own
+    // precedent below): unset, it falls back to the 15s
+    // `INITIALIZE_TIMEOUT_MS` default in `clients/lsp/client.ts`, which
+    // hard-kills the child mid-handshake — a real cold Prisma run measured
+    // up to 27.3s, so the spawn would die there before this wait ever gets
+    // a chance to matter (fix-round F1, #2233).
+    clientWaitTimeoutMs: 40_000,
+    initializeTimeoutMs: 40_000,
     spawn(root, options) {
         return resolveAndLaunch({
             candidates: nodeBinCandidates(root, "prisma-language-server"),
@@ -2466,6 +2579,15 @@ export const VueServer = {
         "pnpm-lock.yaml",
         "yarn.lock",
     ]))),
+    // Vue's launcher loads the full language-service bundle before answering,
+    // matching the installer's 30s verification bound (#2176). The dispatch
+    // touch's cold-spawn wait floor defaults to 5s and needs the same raise so
+    // a cold spawn cannot time out there instead. `initializeTimeoutMs` MUST
+    // match: unset, it falls back to the 15s default in `clients/lsp/client.ts`
+    // and hard-kills a cold spawn (measured up to 22.6s in #2188, 16.2s here)
+    // mid-handshake before this wait can matter (fix-round F1, #2233).
+    clientWaitTimeoutMs: 30_000,
+    initializeTimeoutMs: 30_000,
     async spawn(root, options) {
         const tsserverPath = await findTsserverPath(root, options?.allowInstall);
         // Vue Language Server needs Vue dependencies installed to resolve types.
@@ -2505,6 +2627,13 @@ export const SvelteServer = {
         "pnpm-lock.yaml",
         "yarn.lock",
     ]))),
+    // Matches the installer's 20s verification bound above (#2169): the
+    // dispatch touch's cold-spawn wait floor defaults to 5s and would
+    // otherwise time the client out well before the binary answers.
+    // `initializeTimeoutMs` matches it for the same reason as BashServer
+    // above (fix-round F1, #2233).
+    clientWaitTimeoutMs: 20_000,
+    initializeTimeoutMs: 20_000,
     async spawn(root, options) {
         const tsserverPath = await findTsserverPath(root, options?.allowInstall);
         const proc = await resolveAndLaunch({

package/node_modules/pi-lens/dist/clients/lsp/session-roots.js

@@ -0,0 +1,99 @@
+/**
+ * The session-root registry: which project roots does this process serve?
+ *
+ * #2052. A file is IN-SESSION when it lies within any initialized session cwd.
+ * `initLSPConfig` (`clients/lsp/config.ts`) is the single writer, and every
+ * entry point funnels through it — `ensureLSPConfigInitialized` (`index.ts`),
+ * `ensureReady` (`mcp/server.ts`), `clients/runtime-session.ts`, and
+ * `clients/lens-engine.ts` — so registration needs no second call site.
+ *
+ * WHY THIS IS ITS OWN MODULE, not a helper inside `config.ts`: `clients/lsp/
+ * index.ts`'s import surface from `config.js` is mirrored by an explicit
+ * `vi.mock` factory in ~58 test files. Importing a new symbol from `config.js`
+ * breaks every one of them with "No export is defined on the mock", which is a
+ * standing tax on any future export. The registry is also a different concern
+ * from `workspaceConfigs`: that map stores per-root CONFIG PAYLOAD and is
+ * LRU-capped at 32, whereas this set answers "is this root served" and must
+ * not silently evict a live root and start declining its files.
+ *
+ * WHY IT IS NOT A LATCH. The first attempt at #2052 used a single
+ * last-writer-wins session cwd that fell back to `process.cwd()`. Two bugs
+ * followed directly from that shape, and this module's contract excludes both:
+ *
+ *  - MULTI-ROOT. A process that initializes projA and then projB serves BOTH.
+ *    A latch silently made projA's files foreign the moment projB registered.
+ *  - FAIL-OPEN ON EMPTY. An empty registry declines NOTHING. Declining is a
+ *    hard refusal to answer, so it must rest on positive evidence that a
+ *    session exists AND that the file sits outside it — never on the absence
+ *    of evidence. Callers that never declared a session (isolated tests, API
+ *    consumers, a request racing initialization) therefore keep the pre-#2052
+ *    clamp behavior instead of having `process.cwd()` gate a refusal.
+ *
+ * This is also the seam #2053 needs: an explicit `analysisRoot` registers here.
+ */
+import { isSameOrWithin } from "./server.js";
+import path from "node:path";
+/**
+ * Insertion-ordered, so eviction drops the OLDEST root. Matches
+ * `LSP_CONFIG_CWD_CAP` in `index.ts`, the cap on the set of cwds that
+ * `ensureLSPConfigInitialized` will initialize at all — a root this process
+ * cannot re-initialize must not still be considered served.
+ */
+const sessionRoots = new Set();
+const SESSION_ROOT_CAP = 128;
+/** Record a session cwd as served. Idempotent; re-registering refreshes nothing. */
+export function registerSessionRoot(cwd) {
+    sessionRoots.add(path.resolve(cwd));
+    while (sessionRoots.size > SESSION_ROOT_CAP) {
+        const oldest = sessionRoots.values().next().value;
+        if (oldest === undefined)
+            break;
+        sessionRoots.delete(oldest);
+    }
+}
+/** Return whether this exact root is still served after cap eviction. */
+export function isSessionRootRegistered(cwd) {
+    return sessionRoots.has(path.resolve(cwd));
+}
+/** True when a readiness memo must run initialization for this root. */
+export function shouldInitializeSessionRoot(cwd, readyRoots) {
+    const normalized = path.resolve(cwd);
+    return !readyRoots.has(normalized) || !isSessionRootRegistered(normalized);
+}
+/**
+ * Is `filePath` outside EVERY registered session root?
+ *
+ * Returns false (serve it) when the registry is empty — see the fail-open rule
+ * in this module's header. Containment uses `isSameOrWithin`, the same
+ * comparator the LSP root ceiling uses, which selects `path.win32` by path
+ * SHAPE rather than by `process.platform` (shape 2 / #1150).
+ */
+export function isOutsideAllSessionRoots(filePath) {
+    if (sessionRoots.size === 0)
+        return false;
+    const resolved = path.resolve(filePath);
+    for (const root of sessionRoots) {
+        if (isSameOrWithin(root, resolved))
+            return false;
+    }
+    return true;
+}
+/**
+ * The registered roots, for the decline telemetry record. Sorted with a
+ * code-unit comparator so the emitted string is deterministic across locales
+ * (#1883), and capped because the record is BOUNDED — a process with many
+ * roots must not emit an unbounded path list.
+ */
+export function getSessionRootsForTelemetry(limit = 4) {
+    return [...sessionRoots]
+        .sort((a, b) => Number(a > b) - Number(a < b))
+        .slice(0, limit);
+}
+/**
+ * Clear the registry. Called by `resetLSPConfigStateForTests` so the registry
+ * and the config store reset together and cannot disagree about which roots
+ * exist.
+ */
+export function resetSessionRootsForTests() {
+    sessionRoots.clear();
+}