@herbertgao/pi-extensions 2026.8.13 → 2026.8.15

package/node_modules/pi-lens/dist/clients/review-graph/tsconfig-paths.js

@@ -2,9 +2,13 @@ import * as fs from "node:fs";
 import * as os from "node:os";
 import { BoundedLruCache } from "../bounded-cache.js";
 import * as path from "node:path";
-import { findGoverningTsconfigDir, getDirectoryMarkers, } from "../workspace-topology.js";
+import { findGoverningTsconfigDir, getDirectoryMarkers, registerWorkspaceTopologyReset, } from "../workspace-topology.js";
 const cache = new BoundedLruCache(64);
 const referencesCache = new BoundedLruCache(64);
+registerWorkspaceTopologyReset(() => {
+    cache.clear();
+    referencesCache.clear();
+});
 /** Strip JSONC comments and trailing commas without touching string contents. */
 function parseJsonc(content) {
     let output = "";

package/node_modules/pi-lens/dist/clients/review-graph-logger.js

@@ -2,6 +2,7 @@ import * as path from "node:path";
 import { isTestMode } from "./env-utils.js";
 import { getGlobalPiLensDir } from "./file-utils.js";
 import { createNdjsonLogger } from "./ndjson-logger.js";
+import { normalizeFilePath } from "./path-utils.js";
 const REVIEW_GRAPH_LOG_DIR = getGlobalPiLensDir();
 const REVIEW_GRAPH_LOG_FILE = path.join(REVIEW_GRAPH_LOG_DIR, "review-graph.log");
 const writer = createNdjsonLogger({ filePath: REVIEW_GRAPH_LOG_FILE });
@@ -27,6 +28,9 @@ export function makeReviewGraphBuildMetadata(graph, options = {}) {
             graph.persistCoverage?.sourceFilesTruncated
             ? { sourceFilesTruncated: true }
             : {}),
+        ...(options.pathNormalizeCalls === undefined
+            ? {}
+            : { pathNormalizeCalls: options.pathNormalizeCalls }),
         nodes: graph.nodes.size,
         edges: graph.edges.length,
         ...(graph.persistCoverage
@@ -34,11 +38,27 @@ export function makeReviewGraphBuildMetadata(graph, options = {}) {
             : {}),
     };
 }
+/**
+ * #2141: call sites feed this a mix of raw `cwd` params and already-normalized
+ * cache keys (`normalizeMapKey(path.resolve(cwd))`), so the same project root
+ * showed up in the log as both `C:\...\pi-free` and `C:/.../pi-free`. Rather
+ * than auditing every call site, normalize once here — the single emit
+ * seam — matching the form `normalizeFilePath` already produces for every
+ * other structured log's `cwd` field (bus-publish, disposition-publish,
+ * diagnostics-publish, format-events-publish all normalize at their publish
+ * call sites; this pulls the same conversion in-house so no future call site
+ * can regress it).
+ */
 export function logReviewGraph(entry) {
     if (isTestMode()) {
         return;
     }
-    writer.log({ ts: new Date().toISOString(), ...entry, pid: process.pid });
+    writer.log({
+        ts: new Date().toISOString(),
+        ...entry,
+        cwd: normalizeFilePath(entry.cwd),
+        pid: process.pid,
+    });
 }
 export function getReviewGraphLogPath() {
     return REVIEW_GRAPH_LOG_FILE;

package/node_modules/pi-lens/dist/clients/runtime-coordinator.js

@@ -734,6 +734,74 @@ export class RuntimeCoordinator {
         this._pendingInlineBlockers.delete(key);
         return true;
     }
+    /**
+     * #1950 fix-round F1: read the current delivery count WITHOUT committing
+     * an increment. `runtime-turn.ts` needs the count a delivery would reach
+     * BEFORE it knows whether that delivery will actually reach the agent —
+     * the turn-end signature dedupe (`turn-end-findings-last`) can suppress a
+     * turn whose rendered content is identical to the last one, and a
+     * suppressed turn must not advance the counter (the agent never saw it).
+     * The caller peeks, renders the tentative body, and only calls
+     * {@link incrementInlineBlockerStaleDelivery} once it knows the turn's
+     * content is NOT being suppressed.
+     */
+    peekInlineBlockerStaleDeliveryCount(filePath) {
+        const key = path.resolve(filePath);
+        return this._pendingInlineBlockers.get(key)?.staleDeliveryCount ?? 0;
+    }
+    /**
+     * #1950: commit one more turn end that re-served this record while
+     * `stale`. The caller (`runtime-turn.ts`) only calls this for a
+     * `"dependency-drift"` demotion — a `"past-eof"` demotion retires after
+     * its own single delivery (#1944, `retireDemotedPastEofBlocker`) and
+     * never accumulates a count — and only AFTER confirming the turn's
+     * content will not be suppressed by the signature dedupe (see
+     * {@link peekInlineBlockerStaleDeliveryCount}), so this counts ACTUAL
+     * deliveries the agent saw, not turn-end loop iterations. Returns the new
+     * count, or 0 when there is no entry to count against (already retired,
+     * or never recorded).
+     */
+    incrementInlineBlockerStaleDelivery(filePath) {
+        const key = path.resolve(filePath);
+        const existing = this._pendingInlineBlockers.get(key);
+        if (!existing)
+            return 0;
+        const next = (existing.staleDeliveryCount ?? 0) + 1;
+        this._pendingInlineBlockers.set(key, {
+            ...existing,
+            staleDeliveryCount: next,
+        });
+        return next;
+    }
+    /**
+     * #1950: retire a dependency-drift demotion once it has been delivered
+     * `DEPENDENCY_DRIFT_MAX_DELIVERIES` times with no re-run confirming or
+     * clearing it. Unlike {@link retireDemotedPastEofBlocker}, the record is
+     * NOT provably unrecoverable — its coordinates are still in bounds, and a
+     * fresh dispatch of the file could still confirm or clear it. This is a
+     * bounded-noise cap, not a "this can never resolve" verdict, and the
+     * caller's ledger reason must say so (`demoted-finding-retired`'s "capped,
+     * re-run can still confirm" vs. past-EOF's "retired, unrecoverable").
+     *
+     * Only ever touches this gate's OWN demotion (`staleReason ===
+     * "dependency-drift"`) — a past-EOF demotion on the same file is that
+     * gate's own record to retire, not this one's.
+     *
+     * @returns true when an entry was retired — the caller records it, so the
+     * suppression is never silent (#1432 Gap 1).
+     */
+    retireDemotedDependencyDriftBlocker(filePath) {
+        const key = path.resolve(filePath);
+        const existing = this._pendingInlineBlockers.get(key);
+        if (!existing)
+            return false;
+        if (!existing.stale)
+            return false;
+        if (existing.staleReason !== "dependency-drift")
+            return false;
+        this._pendingInlineBlockers.delete(key);
+        return true;
+    }
     /**
      * Retire a file's inline blocker because a FRESH, content-bound diagnostic
      * verdict proved it gone (#1561).

package/node_modules/pi-lens/dist/clients/runtime-session.js

@@ -1,6 +1,7 @@
 import * as nodeFs from "node:fs";
 import * as path from "node:path";
 import { resetBoundedTelemetry } from "./bounded-telemetry.js";
+import { rotateMessageEndAttribution } from "./message-end-attribution.js";
 import { createDeadline, yieldIfOverBudget } from "./cooperative-budget.js";
 import { deadCodeIssueCount } from "./dead-code-client.js";
 import { logDeadCodeScan } from "./dead-code-logger.js";
@@ -10,6 +11,8 @@ import { resetPsScriptAnalyzerAvailability } from "./dispatch/runners/psscriptan
 import { resetInstallRetryLatches } from "./dispatch/runners/utils/availability-policy.js";
 import { resetLazyInstallAttempts } from "./dispatch/runners/utils/lazy-installer.js";
 import { resetDispatchAvailabilityState } from "./dispatch/runners/utils/runner-helpers.js";
+import { resetObservedRunnerLatency } from "./dispatch/collect-later-tier.js";
+import { resetPendingRunnerFindings } from "./dispatch/pending-runner-findings.js";
 import { clearAllSessions as clearFileTimeSessions } from "./file-time.js";
 import { getGlobalPiLensDir, getKnipIgnorePatterns, getProjectDataDir, } from "./file-utils.js";
 import { GitleaksClient } from "./gitleaks-client.js";
@@ -22,7 +25,7 @@ import { runLogCleanup } from "./log-cleanup.js";
 import { resetCascadeTierSessionState } from "./lsp/cascade-tier.js";
 import { initLSPConfig, loadLSPConfig } from "./lsp/config.js";
 import { resetWorkspaceDiagnosticsCacheSession } from "./lsp/workspace-diagnostics-session.js";
-import { resetDirectLspCommandAvailability } from "./lsp/server.js";
+import { resetDirectLspCommandAvailability, resetLSPCaseSensitivityState, } from "./lsp/server.js";
 import { loadLspService } from "./lsp-lazy.js";
 import { resetManagedToolRefreshSession } from "./installer/managed-tool-refresh-session.js";
 import { resetResolvedPathCache } from "./installer/index.js";
@@ -32,7 +35,6 @@ import { isAtOrAboveHomeDir } from "./path-utils.js";
 import { isPrintMode } from "./print-mode.js";
 import { readLatestProjectSequence, readLatestProjectSequenceAsync, } from "./project-changes.js";
 import { getProjectSnapshotPath, getProjectSnapshotLegacyPath, hydrateRuntimeFromProjectSnapshot, hydrateRuntimeFromProjectSnapshotIfIdle, isProjectSnapshotFresh, isProjectSnapshotMetaStale, loadProjectSnapshot, loadProjectSnapshotExportsAndRules, PROJECT_SNAPSHOT_VERSION, readProjectSnapshotMeta, saveRuntimeProjectSnapshot, } from "./project-snapshot.js";
-import { clearTsconfigPathsCache } from "./review-graph/tsconfig-paths.js";
 import { scanProjectRules } from "./rules-scanner.js";
 import { resetSafeSpawnWindowsCommandCache } from "./safe-spawn.js";
 import { getSlowFsVerdict, isSlowFs, slowFsDegradationNotice, } from "./slow-fs.js";
@@ -623,7 +625,7 @@ async function buildOrRefreshWordIndex(args) {
     const snapshot = loadProjectSnapshot(snapshotRoot);
     const snapshotLoadMs = Date.now() - snapshotLoadStartMs;
     if (snapshot?.wordIndex) {
-        const { deserializeWordIndex, refreshWordIndexIncrementally } = await import("./word-index.js");
+        const { deserializeWordIndex, refreshWordIndexIncrementally, countWordIndexPostingEntries, estimateWordIndexResidentBytes, } = await import("./word-index.js");
         const deserializeStartMs = Date.now();
         const index = deserializeWordIndex(snapshot.wordIndex);
         const deserializeMs = Date.now() - deserializeStartMs;
@@ -675,6 +677,8 @@ async function buildOrRefreshWordIndex(args) {
                         durationMs: Date.now() - startMs,
                         indexedFileCount: index.docCount,
                         tokens: index.postings.size,
+                        postingEntries: countWordIndexPostingEntries(index),
+                        residentBytes: estimateWordIndexResidentBytes(index),
                         truncated: index.truncated,
                         phaseDurationsMs: {
                             snapshotLoadMs,
@@ -714,7 +718,7 @@ async function buildOrRefreshWordIndex(args) {
     // implementation backs this task, the quick-mode warmup call below, AND the
     // stateless cold-query background trigger in word-index.ts — a bound/skip
     // -rule change lands once, not in three copies.
-    const { buildWordIndexAsync, collectWordIndexDocs } = await import("./word-index.js");
+    const { buildWordIndexAsync, collectWordIndexDocs, countWordIndexPostingEntries, estimateWordIndexResidentBytes, } = await import("./word-index.js");
     const docs = await collectWordIndexDocs(analysisRoot, () => runtime.isCurrentSession(sessionGeneration), rebuildPreflightFiles);
     if (!runtime.isCurrentSession(sessionGeneration))
         return;
@@ -751,6 +755,8 @@ async function buildOrRefreshWordIndex(args) {
         durationMs: Date.now() - startMs,
         indexedFileCount: runtime.wordIndex.docCount,
         tokens: runtime.wordIndex.postings.size,
+        postingEntries: countWordIndexPostingEntries(runtime.wordIndex),
+        residentBytes: estimateWordIndexResidentBytes(runtime.wordIndex),
         truncated: runtime.wordIndex.truncated,
         skipped: docs.skipped,
     });
@@ -1150,7 +1156,12 @@ function scheduleStartupScans(deps, runtime, sessionGeneration, analysisRoot, sn
         // Build (or hydrate) the canonical review graph first. The call graph is a
         // derived projection of that graph, so its freshness is the review graph's
         // version/signature—not a second source walk and mtime policy.
-        const sessionFacts = new FactStore();
+        // Subject labels this store's capacity-eviction telemetry distinctly
+        // from the other five production FactStore instances (#2243 review
+        // round 3, F1) — this session-start walk runs BEFORE any dispatch and
+        // can visit every file in the project, so a shared subject would let
+        // it consume the dispatch store's once-per-session ledger slot first.
+        const sessionFacts = new FactStore("runtime-session-call-graph");
         const graph = await buildOrUpdateGraph(analysisRoot, [], sessionFacts);
         if (!runtime.isCurrentSession(sessionGeneration))
             return;
@@ -1294,6 +1305,10 @@ export async function handleSessionStart(deps) {
     // numbering at 0, so without this a stale count could survive a session
     // boundary that happened to land on the same index.
     resetBoundedTelemetry();
+    // #1956 R3: stale message_end events drain after replacement. Rotate the
+    // live anchor into one bounded previous slot so the queued event keeps the
+    // replaced session's attribution until a newer live message_end is seen.
+    rotateMessageEndAttribution();
     const handlerEnteredAt = Date.now();
     const sessionStartMs = deps.sessionStartFiredAt ?? handlerEnteredAt;
     const cwdForTelemetry = deps.ctxCwd ?? process.cwd();
@@ -1603,14 +1618,10 @@ export async function handleSessionStart(deps) {
     clearFileTimeSessions();
     runtime.complexityBaselines.clear();
     resetDispatchBaselines(ctxCwd);
-    // #806: drop the shared per-directory marker index (and any consumer
-    // cache layered on top, e.g. tsconfig-paths' matcher cache) so a
-    // `.pi-lens.json`/`tsconfig.json`/workspace-manifest edit made between
-    // sessions is picked up fresh instead of only on process restart — this
-    // also fixes #805's mid-session tsconfig staleness (the matcher cache was
-    // previously session-lived with no reset hook at all).
+    // #806: clear the shared per-directory marker index and registered
+    // topology-derived caches only at session start. Mid-session edits are NOT
+    // detected; #805's tsconfig matcher cache follows the same registry reset.
     resetWorkspaceTopology();
-    clearTsconfigPathsCache();
     // #2000: opaque-recovery baselines are keyed cwd:generation (unreachable
     // after reset) and the git-worktree memo must re-probe after a session
     // that may have seen a non-git dir become one.
@@ -1630,6 +1641,10 @@ export async function handleSessionStart(deps) {
     // the tool for the rest of the process lifetime. Clear it here, same
     // boundary as the other per-session caches on this line.
     resetDispatchAvailabilityState();
+    // Runner collect-later observations and their late findings are session
+    // scoped. A new session must re-probe rather than inherit a process latch.
+    resetObservedRunnerLatency();
+    resetPendingRunnerFindings();
     // #1995: a command that TIMED OUT (not merely failed a probe) cools down
     // for the rest of the session so a hot loop of edits cannot hand the same
     // wedged .cmd shim a second budget. A new session may retry: the executable
@@ -1670,6 +1685,9 @@ export async function handleSessionStart(deps) {
     // #1897: direct-LSP negative availability and bare installer paths are
     // session facts. A command or PATH entry can appear between sessions.
     resetDirectLspCommandAvailability();
+    // #2052: a root may not exist when the case-sensitivity probe first sees it.
+    // Re-probe it at the next session boundary after the workspace is created.
+    resetLSPCaseSensitivityState();
     resetResolvedPathCache();
     // #1653: pnpm/yarn/bun/npm's availability latches (package-manager.ts) are
     // module-local, same #1490/#1535 shape as the two lines above — the

package/node_modules/pi-lens/dist/clients/runtime-tool-call.js

@@ -5,6 +5,7 @@ import { recordDegradationOnce } from "./degradation-ledger.js";
 import { detectFileKind } from "./file-kinds.js";
 import { isPathIgnoredByProject } from "./file-utils.js";
 import { evaluateGitGuard, isGitCommitOrPushAttempt } from "./git-guard.js";
+import { evaluateSharedCheckoutGuard } from "./shared-checkout-guard.js";
 import { logLatency } from "./latency-logger.js";
 import { normalizeMapKey } from "./path-utils.js";
 import { captureFileStats, getOpaqueBaselineStore, isGitWorktree, } from "./opaque-mutation-scan.js";
@@ -383,6 +384,20 @@ async function handleToolCallImpl(deps) {
             };
         }
     }
+    // #2007: a sibling session's branch switch destroys uncommitted work in a
+    // shared checkout. Independent of `lens-guard`: that gate is about blocker
+    // hygiene before a commit, this one is about not deleting a peer's WIP.
+    // The evaluator short-circuits on a pure string classification, so a
+    // non-git bash command pays no I/O here.
+    if (getFlag("lens-checkout-guard")) {
+        const sharedCheckout = await evaluateSharedCheckoutGuard(toolName, event.input, ctx.cwd ?? runtime.projectRoot ?? process.cwd());
+        if (sharedCheckout.block) {
+            return {
+                block: true,
+                reason: sharedCheckout.reason,
+            };
+        }
+    }
     const rawFilePath = getToolCallRawFilePath(toolName, event);
     const pathResolution = resolveToolCallFilePath(rawFilePath, ctx.cwd, runtime.projectRoot);
     filePath = pathResolution?.path;

package/node_modules/pi-lens/dist/clients/runtime-tool-result.js

@@ -4,11 +4,11 @@ import * as path from "node:path";
 import { noteAuthoritativeContentAttachment } from "./agent-nudge.js";
 import { captureFileStats, diffFileStats, getOpaqueBaselineStore, recoverOpaqueChangesViaGit, } from "./opaque-mutation-scan.js";
 import { normalizeMapKey } from "./path-utils.js";
-import { extractReadPathsFromCommand, extractDeletedPathsFromCommand, extractGrepSearchReadsFromOutput, extractWrittenPathsFromCommand, } from "./bash-file-access.js";
+import { extractReadPathsFromCommand, extractDeletedPathsFromCommand, extractGrepSearchReadsFromOutput, extractWrittenPathsFromCommand, tokenizeShellCommand, } from "./bash-file-access.js";
 import { registerSearchReads, } from "./search-read-registration.js";
 import { createFileTime } from "./file-time.js";
 import { publishFormatQueued } from "./format-events-publish.js";
-import { isPathIgnoredByProject } from "./file-utils.js";
+import { invalidateProjectIgnoreMatcherForPath, isPathIgnoredByProject, } from "./file-utils.js";
 import { getFormatService } from "./format-service.js";
 import { isExternalOrVendorFile, normalizeEphemeralMapKey, pathsEqual, } from "./path-utils.js";
 import { PathKeyedMap } from "./path-keyed-map.js";
@@ -22,7 +22,72 @@ import { renderPostAutofixNotice, } from "./post-autofix-notice.js";
 import { syncGitGuardRecord } from "./git-guard.js";
 import { scheduleWordIndexPersist } from "./word-index.js";
 import { RUNTIME_CONFIG } from "./runtime-config.js";
+import { getActiveSessionId } from "./session-lifecycle.js";
 const AUTHORITATIVE_CONTENT_MAX_BYTES = RUNTIME_CONFIG.pipeline.lspMaxFileBytes;
+/**
+ * Git subcommands that import ANOTHER commit's content into the index. The
+ * whole family, with a verdict for each (#2060):
+ * - merge, rebase, cherry-pick, pull, revert, am: IN. Each stages the other
+ *   side's clean files beside the unmerged ones. `pull` is fetch+merge and
+ *   `am --3way` reaches the same unmerged state, both probed on git 2.55.
+ * - stash pop / stash apply: OUT. A conflicted pop leaves `M ` entries too,
+ *   but that content is the agent's OWN stashed work. Excluding it would
+ *   destroy exactly what opaque recovery exists to capture.
+ * - checkout -m: OUT. Its "incoming" side is the agent's local modifications
+ *   carried across the switch, so the same reasoning applies.
+ * - apply -3 / --3way: OUT. The patch is normally one the agent wrote, and
+ *   `apply` is far more often used without conflicts, so the narrower default
+ *   is to keep capturing.
+ * Membership only ARMS the filter; it still needs a real unmerged entry to do
+ * anything, so a non-integration use of a listed subcommand is inert.
+ */
+const GIT_INTEGRATION_SUBCOMMANDS = new Set([
+    "merge",
+    "rebase",
+    "cherry-pick",
+    "pull",
+    "revert",
+    "am",
+]);
+const GIT_GLOBAL_OPTIONS_WITH_VALUE = new Set([
+    "-C",
+    "-c",
+    "--config-env",
+    "--git-dir",
+    "--namespace",
+    "--work-tree",
+]);
+/**
+ * Failed integration commands are the one opaque-recovery case where Git's
+ * index contains changes made by the other branch rather than the agent.
+ * Keep this narrow: ordinary scripts and successful Git operations retain the
+ * normal recovery contract.
+ */
+export function isFailedGitIntegrationCommand(command, isError) {
+    if (isError !== true)
+        return false;
+    return tokenizeShellCommand(command).some(({ tokens, unsupported }) => {
+        if (unsupported)
+            return false;
+        const executable = path.win32
+            .basename(tokens[0] ?? "")
+            .toLowerCase()
+            .replace(/\.(?:cmd|exe)$/, "");
+        if (executable !== "git")
+            return false;
+        for (let index = 1; index < tokens.length; index += 1) {
+            const token = tokens[index] ?? "";
+            if (GIT_GLOBAL_OPTIONS_WITH_VALUE.has(token)) {
+                index += 1;
+                continue;
+            }
+            if (token.startsWith("-"))
+                continue;
+            return GIT_INTEGRATION_SUBCOMMANDS.has(token);
+        }
+        return false;
+    });
+}
 function parseDiffRanges(diff) {
     const changedLines = [];
     for (const line of diff.split("\n")) {
@@ -269,6 +334,8 @@ export async function handleToolResult(deps) {
             ? rawFilePath
             : path.resolve(resolutionBasis, rawFilePath)
         : rawFilePath;
+    if (filePath)
+        invalidateProjectIgnoreMatcherForPath(filePath);
     // Purely diagnostic: tool_call's call-time verdict (computed on ITS OWN
     // resolved path, which may since have been superseded) disagreed with
     // what actually executed. This does NOT gate anything by itself — the
@@ -351,16 +418,41 @@ export async function handleToolResult(deps) {
             }
             else if (pending.strategy === "git") {
                 // Git-first: no universe cap - works on any repo size.
-                const recovery = await recoverOpaqueChangesViaGit(scanRoot, pending.startedAt);
+                const recovery = await recoverOpaqueChangesViaGit(scanRoot, pending.startedAt, {
+                    excludeIndexOnlyWhenUnmerged: isFailedGitIntegrationCommand(command, event.isError),
+                });
                 if (recovery.verdict === "recovered") {
                     opaquePaths = recovery.paths.filter((p) => !isExternalOrVendorFile(p, scanRoot) &&
                         !isPathIgnoredByProject(p, scanRoot, false));
                 }
-                else if (recovery.verdict === "unknown" && recognized.length > 0) {
-                    // Git hiccup on a partially-recognized command: the
-                    // remainder's coverage is unknown, never clean-by-default.
+                else if (recovery.verdict === "unknown") {
+                    // #2060: deliberately WIDER than the old `recognized.length > 0`
+                    // guard. A fully opaque command whose probe failed is the shape
+                    // whose coverage is least knowable, and it used to record
+                    // nothing at all.
                     unknownReason = recovery.unknownReason;
                 }
+                // #2060: both counts are bounded (one record per tool_result, no
+                // per-path logging) and exist because filtering is invisible in
+                // production otherwise - the dropped paths simply never appear.
+                if ((recovery.excludedIncomingCount ?? 0) > 0) {
+                    logLatency({
+                        type: "phase",
+                        phase: "opaque_mutation_incoming_excluded",
+                        filePath: command.slice(0, 80),
+                        durationMs: Date.now() - started,
+                        result: `excluded:${recovery.excludedIncomingCount}`,
+                    });
+                }
+                if ((recovery.unknownStatusCount ?? 0) > 0) {
+                    logLatency({
+                        type: "phase",
+                        phase: "opaque_mutation_status_pair_unknown",
+                        filePath: command.slice(0, 80),
+                        durationMs: Date.now() - started,
+                        result: `kept:${recovery.unknownStatusCount}`,
+                    });
+                }
             }
             else if (pending.stats) {
                 const outcome = await captureFileStats(scanRoot, {
@@ -831,7 +923,14 @@ export async function handleToolResult(deps) {
             },
         });
         dbg(`runPipeline crash stack: ${pipelineErr.stack}`);
-        if (!getFlag("no-lsp")) {
+        // The LSP fleet is process-wide, but a pipeline crash belongs to one
+        // evaluation. A registered primary owns the fleet; a known secondary
+        // must not tear it down. Keep the historical reset when no registration
+        // exists because synthetic callers and early startup have no role evidence.
+        const activePrimarySessionId = getActiveSessionId();
+        const crashBelongsToPrimary = activePrimarySessionId === undefined ||
+            activePrimarySessionId === runtime.telemetrySessionId;
+        if (!getFlag("no-lsp") && crashBelongsToPrimary) {
             resetLSPService({ fast: true, reason: "pipeline_crash" });
         }
         logLatency({