@herbertgao/pi-extensions 2026.8.4 → 2026.8.6

package/node_modules/pi-lens/dist/clients/path-utils.js

@@ -13,14 +13,63 @@
 import { existsSync, realpathSync } from "node:fs";
 import * as os from "node:os";
 import * as path from "node:path";
-import { dirname, win32 } from "node:path";
+import { win32 } from "node:path";
 import { fileURLToPath, pathToFileURL } from "node:url";
 import { minimatch } from "./deps/minimatch.js";
 /**
- * Detect if a path is a Windows path (has drive letter or UNC prefix).
+ * Detect a positively Windows-shaped path, regardless of the host OS.
+ *
+ * A backslash anywhere in a path is not enough: it is a legal character in a
+ * POSIX filename. Only a drive-letter prefix (`X:`), a UNC root (`\\`), or a
+ * rooted backslash at position zero (`\`) selects Windows parsing.
+ */
+export function isWindowsPath(filePath) {
+    return /^[A-Za-z]:/.test(filePath) || filePath.startsWith("\\");
+}
+/**
+ * Canonical backslash→forward-slash fold — the single sanctioned form of the
+ * `p.replace(/\\/g, "/")` idiom otherwise hand-rolled across the codebase
+ * (~138 sites, #1193). PURE separator normalization: it does NOT resolve,
+ * canonicalize, lowercase, or collapse repeated slashes — reach for
+ * `normalizeFilePath`/`normalizeMapKey`/`normalizeEphemeralMapKey` when a
+ * canonical map *key* (case-fold / realpath) is what you need. Consolidating on
+ * this funnels the scattered transform and makes a shape-2 lint/ast-grep rule
+ * possible for the first time: today a bare inline `.replace(/\\/g, "/")` is
+ * byte-identical to the sanctioned use so it can't be ruled (#1158); once
+ * everything routes through `toPosix`, an *un-migrated* inline `.replace`
+ * becomes detectable.
+ */
+export function toPosix(filePath) {
+    return filePath.replace(/\\/g, "/");
+}
+/** Return whether `filePath` is fully qualified under Windows semantics. */
+export function isFullyQualifiedWin32(filePath) {
+    return win32.isAbsolute(filePath) && win32.parse(filePath).root.length > 1;
+}
+/** Return whether `filePath` is fully qualified under POSIX semantics. */
+export function isFullyQualifiedPosix(filePath) {
+    return path.posix.isAbsolute(filePath) && !isWindowsPath(filePath);
+}
+/**
+ * Return whether `filePath` is fully qualified under the host's semantics.
+ *
+ * In particular, `/foo` is rooted-relative under Win32 (ambient-drive
+ * dependent) but fully qualified under POSIX.
+ */
+export function isFullyQualified(filePath) {
+    return process.platform === "win32"
+        ? isFullyQualifiedWin32(filePath)
+        : isFullyQualifiedPosix(filePath);
+}
+/**
+ * Split a path into its non-empty segments on EITHER separator (`\` or `/`),
+ * regardless of the running OS — the shape-safe form of `p.split(path.sep)` /
+ * an inline `p.split(/[\\/]+/)`, which #1161/#1163 showed must not assume the
+ * host separator for a possibly-cross-shaped path. Drops empty segments
+ * (leading slash, drive-root, doubled separators).
  */
-function isWindowsPath(filePath) {
-    return /^[A-Za-z]:/.test(filePath) || filePath.startsWith("\\\\");
+export function splitPathSegments(filePath) {
+    return filePath.split(/[\\/]+/).filter(Boolean);
 }
 /**
  * Normalize a file path for consistent Map key usage.
@@ -87,7 +136,15 @@ function resolveNonExisting(filePath) {
             const base = canonical.replace(/\\/g, "/");
             return base.endsWith("/") ? base + tail : `${base}/${tail}`;
         }
-        const parent = dirname(current);
+        // Use win32.dirname (not the platform-default dirname) so a
+        // Windows-shaped path is parsed with win32 semantics regardless of the
+        // running OS — consistent with the win32.resolve/win32.normalize this
+        // branch already commits to. The platform-default POSIX dirname would
+        // find no separator in a win32-resolved "C:\repo\..." path (its only
+        // separators are backslashes), collapse to ".", stop the upward walk at
+        // cwd, and mangle the key on Linux CI (refs #1150, the #1024
+        // OS-divergence class).
+        const parent = win32.dirname(current);
         if (parent === current) {
             // Reached filesystem root without finding existing dir
             // Fall back to full lowercase
@@ -111,6 +168,29 @@ export function uriToPath(uri) {
         return normalizeFilePath(uri);
     }
 }
+/**
+ * Decode a file:// URI to an on-disk path WITHOUT map-key normalization.
+ *
+ * `uriToPath` runs its result through `normalizeFilePath`, which on win32
+ * lowercases the nonexistent tail of a path (see `resolveNonExisting`) and
+ * canonicalizes an existing path to its real casing. That is correct for Map
+ * keys, but DESTRUCTIVE for a real create/rename target: creating `NewFile.txt`
+ * would write `newfile.txt`, and a legitimate case-only rename would collapse
+ * to a no-op ("source and destination must differ"). Disk mutations must honor
+ * the caller's intended casing, so they resolve their target through this
+ * decode-only path while confinement/validation keep using the normalized
+ * `uriToPath`. Non-win32 is unaffected either way (normalizeFilePath is a
+ * near-identity there).
+ */
+export function uriToDiskPath(uri) {
+    try {
+        return fileURLToPath(uri);
+    }
+    catch {
+        // Not a valid file:// URI — treat as a plain path (matches uriToPath).
+        return uri;
+    }
+}
 /**
  * Convert a path to a file:// URI.
  * Does NOT normalize the path - URIs preserve original casing.
@@ -125,12 +205,28 @@ export function pathToUri(filePath) {
 export function normalizeMapKey(filePath) {
     return normalizeFilePath(filePath);
 }
-/** Human-facing path relative to a project root when the file is inside it. */
+/**
+ * Human-facing path relative to a project root when the file is inside it.
+ *
+ * Parses by path SHAPE, not host OS (refs #1150/#1152, shape-2 class #1163):
+ * a Windows-shaped `filePath` (drive-letter/UNC — e.g. a persisted call-graph
+ * symbol-key path `C:\repo\src\x.ts` rehydrated on a Linux CI run) is split
+ * with `win32.*` regardless of `process.platform`. The host-default
+ * `isAbsolute`/`relative` find no drive-letter anchor in a win32 path on POSIX:
+ * `path.isAbsolute("C:\\repo\\x.ts")` returns FALSE on Linux, short-circuiting
+ * to the raw absolute path instead of ever relativizing it — so a file that IS
+ * under the project root renders as a full absolute path on Linux but the
+ * expected `src/x.ts` on Windows (green-locally / wrong-on-CI, the #1024
+ * divergence class). `win32.*` on a native POSIX path (Windows never sees one;
+ * Linux native paths aren't Windows-shaped) is never selected, so same-OS
+ * native paths are unchanged either way.
+ */
 export function toProjectRelativePath(filePath, projectRoot) {
-    if (!path.isAbsolute(filePath))
+    const p = isWindowsPath(filePath) ? win32 : path;
+    if (!p.isAbsolute(filePath))
         return filePath.replace(/\\/g, "/");
-    const relative = path.relative(path.resolve(projectRoot), filePath);
-    return relative && !relative.startsWith("..") && !path.isAbsolute(relative)
+    const relative = p.relative(p.resolve(projectRoot), filePath);
+    return relative && !relative.startsWith("..") && !p.isAbsolute(relative)
         ? relative.replace(/\\/g, "/")
         : filePath.replace(/\\/g, "/");
 }
@@ -156,6 +252,11 @@ export function toProjectRelativePath(filePath, projectRoot) {
  * real-casing resolution actually matters.
  */
 export function normalizeEphemeralMapKey(filePath) {
+    // Most hot-path keys on POSIX are already canonical slash-separated strings.
+    // Preserve that identity instead of allocating a replacement string for each
+    // file in a large diagnostics reconciliation.
+    if (process.platform !== "win32" && !filePath.includes("\\"))
+        return filePath;
     const slashed = filePath.replace(/\\/g, "/");
     return process.platform === "win32" ? slashed.toLowerCase() : slashed;
 }

package/node_modules/pi-lens/dist/clients/pipeline.js

@@ -19,7 +19,7 @@ import { recordFromCodeQualityDiagnostic, } from "./code-quality-warnings.js";
 import { recordDiagnostics } from "./widget-state.js";
 import { getDiagnosticLogger } from "./diagnostic-logger.js";
 import { getDiagnosticTracker } from "./diagnostic-tracker.js";
-import { computeCascadeForFile, dispatchLintWithResult, } from "./dispatch/integration.js";
+import { loadDispatchIntegration } from "./dispatch/lazy.js";
 import { toRunnerDisplayPath } from "./dispatch/runner-context.js";
 import { createAvailabilityChecker, resolveAvailableOrInstall, resolveCommandArgsWithInstallFallback, resolveToolCommand, resolveToolCommandWithInstallFallback, } from "./dispatch/runners/utils/runner-helpers.js";
 import { findDetektConfig } from "./dispatch/runners/detekt.js";
@@ -29,12 +29,14 @@ import { logLatency } from "./latency-logger.js";
 import { emitLensAnalysisComplete } from "./lens-events.js";
 import { publishFilesTouched } from "./bus-publish.js";
 import { publishDiagnostics, wasPreviouslyReportedDirty, } from "./diagnostics-publish.js";
-import { getLSPService } from "./lsp/index.js";
+import { loadLspService } from "./lsp-lazy.js";
 import { clearGraphCache } from "./review-graph/builder.js";
+import { BoundedLruCache } from "./bounded-cache.js";
 import { RUNTIME_CONFIG } from "./runtime-config.js";
 import { getAmbientAbortSignal, safeSpawnAsync } from "./safe-spawn.js";
 import { combineAbortSignals } from "./deadline-utils.js";
-import { getAutofixPolicyForFile, getPreferredAutofixTools, getRubocopCommand, hasBiomeConfig, hasDetektConfig, hasEslintConfig, hasGolangciConfig, hasKtfmtConfig, hasOxlintConfig, hasRubocopConfig, hasSqlfluffConfig, hasStylelintConfig, } from "./tool-policy.js";
+import { recordDegradationOnce } from "./degradation-ledger.js";
+import { getAutofixPolicyForFile, getPreferredAutofixTools, getRubocopCommand, hasBiomeConfig, hasDetektConfig, hasEslintConfig, hasGolangciConfig, hasKtfmtConfig, hasKtlintConfig, hasOxlintConfig, hasRubocopConfig, hasSqlfluffConfig, hasStylelintConfig, markdownlintConfigArgs, } from "./tool-policy.js";
 const LSP_MAX_FILE_BYTES = RUNTIME_CONFIG.pipeline.lspMaxFileBytes;
 const LSP_MAX_FILE_LINES = RUNTIME_CONFIG.pipeline.lspMaxFileLines;
 const LSP_SPAWN_BUDGET_MS = RUNTIME_CONFIG.pipeline.lspSpawnBudgetMs;
@@ -66,7 +68,10 @@ const SNAPSHOT_YIELD_EVERY = 500;
 async function snapshotDirInto(dir, ignoreMatcher, stack, snapshot, counter) {
     let entries;
     try {
-        entries = nodeFs.readdirSync(dir, { withFileTypes: true });
+        // Async (#1137): a synchronous per-directory read blocks the loop for the
+        // whole stall on a slow cloud-backed (OneDrive) directory; fs.promises
+        // keeps this tool_result-path walk off the event loop.
+        entries = await nodeFs.promises.readdir(dir, { withFileTypes: true });
     }
     catch {
         return;
@@ -85,7 +90,7 @@ async function snapshotDirInto(dir, ignoreMatcher, stack, snapshot, counter) {
         if (ignoreMatcher.isIgnored(fullPath, false))
             continue;
         try {
-            const stat = nodeFs.statSync(fullPath);
+            const stat = await nodeFs.promises.stat(fullPath);
             snapshot.set(path.resolve(fullPath), {
                 mtimeMs: stat.mtimeMs,
                 size: stat.size,
@@ -173,7 +178,7 @@ function createPhaseTracker(toolName, filePath) {
 }
 // --- ESLint autofix helpers ---
 export { hasEslintConfig, hasRubocopConfig, hasSqlfluffConfig, hasStylelintConfig, };
-const _eslintCache = new Map();
+const _eslintCache = new BoundedLruCache(32);
 /**
  * Run eslint --fix on a file. Runs a single spawn and diffs the file before/after,
  * same idiom as the other autofix helpers below. Exit code 1 (unfixable problems
@@ -186,7 +191,9 @@ async function tryEslintFix(filePath, cwd) {
     const userHasConfig = hasEslintConfig(cwd);
     if (!userHasConfig)
         return 0;
-    const cacheKey = path.resolve(cwd);
+    // PATH is part of command resolution; include it so an install or PATH
+    // refresh cannot leave a negative eslint result live for the session.
+    const cacheKey = `${path.resolve(cwd)}|${process.env.PATH ?? ""}`;
     let cached = _eslintCache.get(cacheKey);
     if (!cached) {
         const candidate = resolveToolCommand(cwd, "eslint") ?? "eslint";
@@ -274,8 +281,12 @@ async function tryMarkdownlintFix(filePath, cwd) {
     const cmd = await resolveToolCommandWithInstallFallback(cwd, "markdownlint");
     if (!cmd)
         return 0;
+    // Shared config-args seam (#1247): the lint runner consumes the same
+    // builder, so the bare --fix here can never fall back to markdownlint's
+    // default all-rules-on config again (the whole-file CHANGELOG/AGENTS
+    // reformat + `#946` → `# 946` corruption).
     // markdownlint-cli2 --fix exits non-zero when unfixable violations remain.
-    return detectFileChangedAfterCommand(filePath, cmd, ["--fix", filePath], cwd, [1]);
+    return detectFileChangedAfterCommand(filePath, cmd, [...markdownlintConfigArgs(cwd), "--fix", filePath], cwd, [1]);
 }
 async function tryOxlintFix(filePath, cwd) {
     const cmd = await resolveToolCommandWithInstallFallback(cwd, "oxlint");
@@ -356,6 +367,7 @@ export async function runAutofix(filePath, cwd, getFlag, dbg, deps, getFlagSourc
         hasGolangciConfig: hasGolangciConfig(cwd),
         hasDetektConfig: hasDetektConfig(cwd),
         hasKtfmtConfig: hasKtfmtConfig(cwd),
+        hasKtlintConfig: hasKtlintConfig(cwd),
         hasOxlintConfig: hasOxlintConfig(cwd),
     };
     const autofixPolicy = getAutofixPolicyForFile(filePath, autofixContext);
@@ -396,7 +408,7 @@ export async function runAutofix(filePath, cwd, getFlag, dbg, deps, getFlagSourc
                 dbg(`autofix: ruff unavailable for ${filePath}`);
                 continue;
             }
-            const result = await ruffClient.fixFileAsync(filePath);
+            const result = await ruffClient.fixFileAsync(filePath, cwd);
             if (result.success && result.fixed > 0) {
                 fixedCount += result.fixed;
                 autofixTools.push(`ruff:${result.fixed}`);
@@ -415,7 +427,7 @@ export async function runAutofix(filePath, cwd, getFlag, dbg, deps, getFlagSourc
                 dbg(`autofix: biome unavailable or unsupported for ${filePath}`);
                 continue;
             }
-            const result = await biomeClient.fixFileAsync(filePath);
+            const result = await biomeClient.fixFileAsync(filePath, cwd);
             if (result.success && result.fixed > 0) {
                 fixedCount += result.fixed;
                 autofixTools.push(`biome:${result.fixed}`);
@@ -570,7 +582,6 @@ export async function runAutofix(filePath, cwd, getFlag, dbg, deps, getFlagSourc
                 dbg(`autofix: oxlint --fix fixed ${filePath}`);
                 needsContentRefresh = true;
             }
-            continue;
         }
     }
     if (attemptedTools.length > 0 && autofixTools.length === 0) {
@@ -593,7 +604,7 @@ export async function resyncLspFile(filePath, fileContent, needsContentRefresh,
     if (limitCheck.tooLarge)
         return;
     try {
-        const lspService = getLSPService();
+        const lspService = (await loadLspService()).getLSPService();
         if (lspService.supportsLSP(filePath)) {
             // Push the final post-format/post-fix content through touchFile (not the
             // bare openFile) so it registers in the touch-debounce map via
@@ -704,6 +715,13 @@ export async function runFormatPhase(filePath, getFormatService, dbg) {
         }
         if (!result.allSucceeded) {
             const failures = result.formatters.filter((f) => !f.success);
+            for (const failure of failures) {
+                recordDegradationOnce({
+                    kind: "formatter-failure",
+                    subject: `${failure.name}:${path.basename(filePath)}`,
+                    reason: failure.error ?? "unknown error",
+                });
+            }
             formatFailures.push(...failures.map((f) => `${f.name}: ${f.error ?? "unknown error"}`));
             dbg("autoformat: " +
                 failures
@@ -713,6 +731,11 @@ export async function runFormatPhase(filePath, getFormatService, dbg) {
     }
     catch (err) {
         const message = err instanceof Error ? err.message : String(err);
+        recordDegradationOnce({
+            kind: "formatter-failure",
+            subject: `format-service:${path.basename(filePath)}`,
+            reason: message,
+        });
         formatFailures.push(message);
         dbg(`autoformat error: ${err}`);
     }
@@ -820,7 +843,25 @@ export async function runPipeline(ctx, deps) {
     });
     // --- 3. Auto-fix ---
     phase.start("autofix");
-    const { fixedCount, autofixTools, attemptedTools, changedFiles: autofixChangedFiles, needsContentRefresh: fixRefresh, skipReason: autofixSkipReason, } = await runAutofix(filePath, cwd, getFlag, dbg, deps, getFlagSource);
+    let fixedCount = 0;
+    let autofixTools = [];
+    let attemptedTools = [];
+    let autofixChangedFiles = [];
+    let fixRefresh = false;
+    let autofixSkipReason;
+    if (ctx.autofixMode === "deferred") {
+        autofixSkipReason = "deferred_to_agent_end";
+        dbg(`autofix: deferred until agent_end for ${filePath}`);
+    }
+    else
+        ({
+            fixedCount,
+            autofixTools,
+            attemptedTools,
+            changedFiles: autofixChangedFiles,
+            needsContentRefresh: fixRefresh,
+            skipReason: autofixSkipReason,
+        } = await runAutofix(filePath, cwd, getFlag, dbg, deps, getFlagSource));
     for (const changedFile of autofixChangedFiles) {
         piChangedFiles.add(path.resolve(changedFile));
     }
@@ -871,11 +912,17 @@ export async function runPipeline(ctx, deps) {
     const piApi = {
         getFlag: getFlag,
     };
+    const { dispatchLintWithResult, computeCascadeForFile } = await loadDispatchIntegration();
     const dispatchResult = await dispatchLintWithResult(filePath, cwd, piApi, ctx.modifiedRanges, {
         model: ctx.telemetry?.model ?? "unknown",
         sessionId: ctx.telemetry?.sessionId ?? "unknown",
         turnIndex: ctx.telemetry?.turnIndex ?? 0,
         writeIndex: ctx.telemetry?.writeIndex ?? 0,
+    }, {
+        projectRoot: ctx.projectRoot,
+        writeIndex: ctx.telemetry?.writeIndex,
+        telemetryModel: ctx.telemetry?.modelId,
+        telemetryProvider: ctx.telemetry?.provider,
     });
     recordDiagnostics(filePath, dispatchResult.diagnostics, ctx.telemetry?.writeIndex);
     // #502: emit the write batch's FINAL diagnostic state immediately after
@@ -972,7 +1019,11 @@ export async function runPipeline(ctx, deps) {
         const fileList = changedList.length
             ? "\nModified files:\n" + topFiles + overflow
             : "";
-        output += `\n\n⚠️ **File was modified by auto-format/fix. You MUST re-read modified file(s) before making any further edits — the content on disk has changed (whitespace, indentation, quotes, or code). Editing from memory will produce mismatches.**${fileList}`;
+        const targetHasAuthoritativeAttachment = ctx.autofixMode !== "deferred" &&
+            autofixChangedFiles.some((changedFile) => path.resolve(changedFile) === path.resolve(filePath));
+        output += targetHasAuthoritativeAttachment
+            ? `\n\n⚠️ **The attached full content for ${toRunnerDisplayPath(cwd, filePath)} is authoritative after autofix. You MUST re-read any other modified side-effect files before editing them.**${fileList}`
+            : `\n\n⚠️ **File was modified by auto-format/fix. You MUST re-read modified file(s) before making any further edits — the content on disk has changed (whitespace, indentation, quotes, or code). Editing from memory will produce mismatches.**${fileList}`;
     }
     phase.end("dispatch_lint", {
         hasOutput: !!dispatchResult.output,
@@ -984,6 +1035,11 @@ export async function runPipeline(ctx, deps) {
     // result is never shown inline — settled (bounded) and surfaced at turn_end.
     // The stored promise must never reject: an unhandled rejection is fatal, so a
     // failing compute resolves to an "error" skip-run instead.
+    const cascadeOrigin = {
+        turnSeq: ctx.telemetry?.turnIndex,
+        writeSeq: ctx.telemetry?.writeIndex,
+        projectSeq: ctx.seqState?.projectSeq(),
+    };
     const cascadePromise = getFlag("no-lsp")
         ? undefined
         : computeCascadeForFile(filePath, cwd, {
@@ -995,10 +1051,12 @@ export async function runPipeline(ctx, deps) {
             fileContent,
             wordIndex: ctx.wordIndex,
             onWordIndexUpdated: ctx.onWordIndexUpdated,
-        }).catch((err) => {
+        }).then((run) => ({ ...run, origin: cascadeOrigin }))
+            .catch((err) => {
             dbg(`cascade compute failed for ${filePath}: ${err}`);
             return {
                 filePath,
+                origin: cascadeOrigin,
                 result: undefined,
                 neighborCount: 0,
                 diagnosticCount: 0,
@@ -1054,5 +1112,8 @@ export async function runPipeline(ctx, deps) {
         formattersUsed,
         fixedCount,
         autofixTools,
+        postMutation: ctx.autofixMode !== "deferred" && autofixChangedFiles.some((f) => path.resolve(f) === path.resolve(filePath)) && fileContent !== undefined
+            ? { filePath: path.resolve(filePath), content: fileContent, source: "autofix" }
+            : undefined,
     };
 }

package/node_modules/pi-lens/dist/clients/print-mode.js

@@ -0,0 +1,21 @@
+/**
+ * One-shot invocation detection, shared across the session_start-scheduled
+ * background work that must NOT run — or retain the process — in print mode
+ * (#1154 quick-mode warmup, #1153 orphan-reaper).
+ *
+ * `pi -p` / `pi --print` is a one-shot: the host computes a single turn and
+ * exits. Work scheduled to warm caches / clean up state for a *future* session
+ * in the same process is pure waste in this mode AND — when it arms a
+ * referenced libuv handle (a non-`unref`'d timer, an LSP child, an fs walk)
+ * with no session_shutdown teardown — keeps the already-settled one-shot
+ * process alive. That is the referenced-handle retention class of
+ * #1097/#1110/#1148/#1149 and the located #1122 hypothesis-A concern.
+ *
+ * argv is read live (not captured at module load) so tests can drive it; the
+ * flag never changes within a real process, and there is no hot-path caller,
+ * so recomputing is free. This mirrors the print detection in
+ * `runtime-session.ts`'s `resolveStartupMode` — keep them a single source.
+ */
+export function isPrintMode(argv = process.argv) {
+    return argv.includes("--print") || argv.includes("-p");
+}

package/node_modules/pi-lens/dist/clients/project-changes.js

@@ -44,6 +44,31 @@ export function readProjectChanges(cwd) {
         return [];
     }
 }
+/**
+ * Async twin of `readProjectChanges` (#1162). `fs.promises.readFile` — unlike
+ * the sync `readFileSync` above — YIELDS to the event loop, which is what lets
+ * a caller bound it with a `Promise.race` timeout: a `setTimeout` can never
+ * preempt a synchronous blocking read (the thread doesn't return to the event
+ * loop until the OS does), so a bounded read on the session_start hot path
+ * requires the async form. Same parse/error-swallow semantics as the sync
+ * version — a missing/corrupt log is the normal cold-start case, not a
+ * caller-visible error.
+ */
+export async function readProjectChangesAsync(cwd) {
+    const logPath = getProjectChangeLogPath(cwd);
+    try {
+        const content = await fs.promises.readFile(logPath, "utf-8");
+        return content
+            .split(/\r?\n/)
+            .map((line) => line.trim())
+            .filter(Boolean)
+            .map(parseChangeLine)
+            .filter((entry) => Boolean(entry));
+    }
+    catch {
+        return [];
+    }
+}
 export function readChangesSince(cwd, seq, maxEntries = 200) {
     const limit = Math.max(1, maxEntries);
     return readProjectChanges(cwd)
@@ -134,6 +159,21 @@ export function readLatestProjectSequence(cwd, base) {
     }
     return fullReplay(entries);
 }
+/**
+ * Async twin of `readLatestProjectSequence` (#1162) — same fold logic, but
+ * reads the log via `readProjectChangesAsync` so a caller can bound the wait
+ * with a `Promise.race` timeout (see that function's doc comment for why the
+ * sync form can't be bounded at all).
+ */
+export async function readLatestProjectSequenceAsync(cwd, base) {
+    const entries = await readProjectChangesAsync(cwd);
+    if (base) {
+        const partial = partialReplay(entries, base);
+        if (partial)
+            return partial;
+    }
+    return fullReplay(entries);
+}
 export function appendProjectChange(cwd, entry) {
     const logPath = getProjectChangeLogPath(cwd);
     fs.mkdirSync(path.dirname(logPath), { recursive: true });

package/node_modules/pi-lens/dist/clients/project-diagnostics/cache.js

@@ -1,6 +1,7 @@
 import * as fs from "node:fs";
 import * as path from "node:path";
 import { getProjectDataDir } from "../file-utils.js";
+import { writeFileAtomic } from "../atomic-write.js";
 import { readJsonCache } from "../json-cache-read.js";
 // v2: cheap-tier scan now also runs ast-grep-napi (#308); invalidate older
 // snapshots so a pre-ast-grep cache isn't served as complete via refreshRunners=cached.
@@ -25,7 +26,7 @@ export function loadProjectDiagnosticsSnapshot(cwd) {
 export function saveProjectDiagnosticsSnapshot(cwd, snapshot) {
     const filePath = cachePath(cwd, SNAPSHOT_CACHE_FILE);
     fs.mkdirSync(path.dirname(filePath), { recursive: true });
-    fs.writeFileSync(filePath, JSON.stringify(snapshot, null, 2));
+    writeFileAtomic(filePath, JSON.stringify(snapshot, null, 2));
 }
 export function loadProjectDiagnosticsDeltaReport(cwd) {
     return readJsonCache(cachePath(cwd, DELTA_CACHE_FILE), (parsed) => {
@@ -42,7 +43,7 @@ export function loadProjectDiagnosticsDeltaReport(cwd) {
 export function writeProjectDiagnosticsDeltaReport(cwd, report) {
     const filePath = cachePath(cwd, DELTA_CACHE_FILE);
     fs.mkdirSync(path.dirname(filePath), { recursive: true });
-    fs.writeFileSync(filePath, JSON.stringify(report, null, 2));
+    writeFileAtomic(filePath, JSON.stringify(report, null, 2));
 }
 /**
  * Drop diagnostics whose underlying file changed on disk after the snapshot was

package/node_modules/pi-lens/dist/clients/project-diagnostics/fresh-fetch.js

@@ -383,7 +383,7 @@ export async function fetchFreshProjectDiagnostics(cacheManager, cwd, clients, s
                 cold.push("test-runner");
                 return;
             }
-            record("test-runner", testRunnerFindingsToProjectDiagnostics(cached.data), Date.now() - startMs);
+            record("test-runner", testRunnerFindingsToProjectDiagnostics(cached.data, analysisRoot, options.runtime), Date.now() - startMs);
         }),
     ];
     // Swallow any later rejection so an aborted-and-abandoned task can never

package/node_modules/pi-lens/dist/clients/project-diagnostics/runner-adapters/call-graph-impact.js

@@ -1,5 +1,6 @@
 import * as path from "node:path";
 import { parseSymbolKey, } from "../../call-graph.js";
+import { isTestRoleCollateral } from "../../collateral-test-role.js";
 function resolveImpactFile(cwd, filePath) {
     return path.isAbsolute(filePath) ? filePath : path.resolve(cwd, filePath);
 }
@@ -87,6 +88,13 @@ export function callGraphImpactToProjectDiagnostics(cwd, findings) {
             if (!filePath)
                 continue; // Nothing real to attribute this to.
             const resolvedFile = resolveImpactFile(cwd, filePath);
+            // #1080: the call graph is derived from the tests-free review graph and is
+            // normally tests-free, but this adapter accepts arbitrary caller
+            // symbol keys — an old/fixture/expanded graph could supply a test-file
+            // caller. A KNOWN test-role caller must not be persisted as collateral
+            // call-graph impact. Fail-open: a classifier error retains the finding.
+            if (isTestRoleCollateral(resolvedFile))
+                continue;
             const dedupeKey = `${resolvedFile}:${result.symbolKey}`;
             const existing = byKey.get(dedupeKey);
             if (existing && SEVERITY_RANK[existing.severity] >= SEVERITY_RANK[mapped.severity]) {

package/node_modules/pi-lens/dist/clients/project-diagnostics/runner-adapters/runner-findings.js

@@ -1,3 +1,6 @@
+import * as fs from "node:fs";
+import * as path from "node:path";
+import { advisoryPathKey, validateAdvisoryProvenance, } from "../../advisory-provenance.js";
 function failureMessage(failure) {
     const firstLine = failure.message.split("\n")[0]?.slice(0, 300) ?? "";
     return firstLine ? `${failure.name}: ${firstLine}` : failure.name;
@@ -71,8 +74,26 @@ export function testResultToProjectDiagnostics(result, stale = false) {
         },
     ];
 }
-export function testRunnerFindingsToProjectDiagnostics(cache) {
+export function testRunnerFindingsToProjectDiagnostics(cache, cwd, runtime) {
     if (!cache.results || cache.results.length === 0)
         return [];
-    return cache.results.flatMap((r) => testResultToProjectDiagnostics(r, cache.stale));
+    const validation = cwd
+        ? validateAdvisoryProvenance(cache, cwd, runtime)
+        : { status: "unknown", reasons: ["validation-context-missing"] };
+    const root = cwd ?? process.cwd();
+    const missingKeys = new Set((cache.provenance?.files ?? [])
+        .filter((file) => !fs.existsSync(path.resolve(root, file.path)))
+        .map((file) => advisoryPathKey(file.path, root)));
+    const historical = cache.superseded === true || cache.stale === true || validation.status !== "current";
+    return cache.results
+        .filter((result) => !missingKeys.has(advisoryPathKey(result.file, root)))
+        .flatMap((result) => testResultToProjectDiagnostics(result, historical))
+        .map((diagnostic) => historical ? {
+        ...diagnostic,
+        severity: "info",
+        semantic: "none",
+        message: diagnostic.message.startsWith("[stale")
+            ? diagnostic.message
+            : `[historical — re-run to confirm] ${diagnostic.message}`,
+    } : diagnostic);
 }

package/node_modules/pi-lens/dist/clients/project-diagnostics/scanner.js

@@ -10,7 +10,7 @@ import { isAtOrAboveHomeDir } from "../path-utils.js";
 import { getProjectDiagnosticsScannerMaxFiles } from "../project-scale.js";
 import { captureReviewGraphStructuralIr } from "../review-graph/builder.js";
 import { publishReviewGraphFileIr, reviewGraphIrContentHash, } from "../review-graph/shared-extraction-ir.js";
-import { collectSourceFilesWithBudgetAsync } from "../source-filter.js";
+import { collectSourceFilesWithBudgetAsync, } from "../source-filter.js";
 import { logTreeSitter, logTreeSitterCacheStats, } from "../tree-sitter-logger.js";
 import { queriesForLanguage, queryLoader, } from "../tree-sitter-query-loader.js";
 import { EXT_TO_LANG, getSharedTreeSitterClient, isTreeSitterWasmAborted, } from "../tree-sitter-shared.js";
@@ -322,11 +322,19 @@ export async function scanProjectDiagnostics(options) {
     // trips `maxFiles`. Unlike `unsafeRoot` this is not a refusal: when the
     // budget trips we scan the truncated best-effort list and flag the snapshot
     // so callers don't read the partial result as a complete sweep.
+    // #1107 phase 2: typed as the full `SourceCollectionResult` (not just its
+    // `{files, entryBudgetExceeded}` shape) so the generated-skip counters
+    // below are readable through the ternary — the `options.files` branch
+    // legitimately never walked, so it leaves them `undefined`, same
+    // convention as `entryBudgetExceeded: false` above it.
     const collected = options.files
         ? { files: options.files.slice(0, maxFiles), entryBudgetExceeded: false }
         : await collectSourceFilesWithBudgetAsync(cwd, {
             maxFiles,
             maxScanEntries: options.maxScanEntries,
+            // #1107 phase 2 review: the actionable opt-out generatedSkipNotice
+            // points a user at.
+            includeGenerated: options.includeGenerated === true,
         });
     const files = collected.files;
     // Check cancellation before and during the file-major pass so a full-mode
@@ -361,6 +369,18 @@ export async function scanProjectDiagnostics(options) {
     // byte-identical for the untruncated (normal) case.
     if (collected.entryBudgetExceeded)
         snapshot.scanTruncated = true;
+    // #1107 phase 2: only present when nonzero, same convention as the
+    // truncation flag above — a healthy scan with no generated-name skips
+    // produces a byte-identical snapshot to before this change.
+    if (collected.generatedOrArtifactSkips) {
+        snapshot.generatedFileSkips = collected.generatedOrArtifactSkips;
+    }
+    if (collected.generatedNameOnlySkips) {
+        snapshot.generatedNameOnlySkips = collected.generatedNameOnlySkips;
+    }
+    if (collected.generatedDirSkips) {
+        snapshot.generatedDirSkips = collected.generatedDirSkips;
+    }
     if (wasmAborted) {
         snapshot.scanTruncated = true;
         snapshot.treeSitterStatus = "wasm_aborted_restart_required";