@herbertgao/pi-extensions 2026.8.5 → 2026.8.6

package/node_modules/@narumitw/pi-btw/src/menu.ts

@@ -7,6 +7,7 @@ import type { Component, TUI } from "@earendil-works/pi-tui";
 import type { MenuContext, RunMenuResult } from "@narumitw/pi-tui-kit";
 import {
 	type BtwSettings,
+	type BtwSettingsPatch,
 	btwSettingsPath,
 	effectiveRememberThinkingLevelChanges,
 	readBtwSettings,
@@ -35,7 +36,7 @@ export interface ShowBtwCommandMenuOptions {
 	settingsPath?: string;
 	readSettings?: typeof readBtwSettings;
 	updateSettings?: (
-		patch: Partial<Pick<BtwSettings, "thinkingLevel" | "rememberThinkingLevelChanges">>,
+		patch: BtwSettingsPatch,
 		options: UpdateBtwSettingsOptions,
 	) => Promise<BtwSettings>;
 }
@@ -44,6 +45,7 @@ export type BtwCommandMenuResult = "start" | "closed" | { kind: "resume"; thread
 
 type BtwMenuScreen = "main" | "resume" | "settings" | "invalid";
 type BtwMenuAction = "start" | "resume" | "set-thinking" | "set-remember";
+const SAME_AS_MAIN_THREAD = "Same as main thread";
 type BtwCustomOptions = Parameters<ExtensionCommandContext["ui"]["custom"]>[1];
 
 type BtwCustomFactory<T> = (
@@ -79,8 +81,22 @@ export async function showBtwCommandMenu(
 		}
 		return { kind: "valid", settings: loaded.kind === "loaded" ? loaded.settings : {} };
 	};
-	const displayThinkingLevel = (settings: BtwSettings): BtwThinkingLevel =>
-		clampToAvailableThinkingLevel(settings.thinkingLevel ?? options.currentThinkingLevel, levels);
+	const currentMainThinkingLevel = clampToAvailableThinkingLevel(
+		options.currentThinkingLevel,
+		levels,
+	);
+	const displayThinkingLevel = (settings: BtwSettings): string =>
+		settings.thinkingLevel === undefined
+			? SAME_AS_MAIN_THREAD
+			: clampToAvailableThinkingLevel(settings.thinkingLevel, levels);
+	const displayThinkingSummary = (settings: BtwSettings): string =>
+		settings.thinkingLevel === undefined
+			? `${SAME_AS_MAIN_THREAD} (currently ${currentMainThinkingLevel})`
+			: displayThinkingLevel(settings);
+	const displayRememberSummary = (settings: BtwSettings): string => {
+		const value = effectiveRememberThinkingLevelChanges(settings) ? "On" : "Off";
+		return settings.thinkingLevel === undefined ? `${value} (fixed levels only)` : value;
+	};
 
 	const menu = defineMenu<BtwMenuState, BtwMenuScreen, BtwMenuAction, MenuContext>({
 		start: "main",
@@ -89,7 +105,7 @@ export async function showBtwCommandMenu(
 				kind: "actions",
 				title: "Pi BTW",
 				lines: [
-					`Thinking: ${displayThinkingLevel(state.settings)} · Remember changes: ${effectiveRememberThinkingLevelChanges(state.settings) ? "On" : "Off"}`,
+					`Thinking: ${displayThinkingSummary(state.settings)} · Remember changes: ${displayRememberSummary(state.settings)}`,
 				],
 				items: [
 					{
@@ -111,7 +127,7 @@ export async function showBtwCommandMenu(
 					{
 						id: "settings",
 						label: "Settings",
-						description: "Choose pi-btw thinking and whether shortcut changes are remembered",
+						description: "Choose pi-btw thinking level and fixed-level shortcut memory",
 						to: state.kind === "invalid" ? "invalid" : "settings",
 					},
 				],
@@ -138,15 +154,15 @@ export async function showBtwCommandMenu(
 					{
 						id: "thinkingLevel",
 						label: "Thinking level",
-						description: "Set the starting level for future pi-btw side threads.",
+						description: `Set the starting level for future pi-btw side threads. Currently ${currentMainThinkingLevel}.`,
 						currentValue: displayThinkingLevel(state.settings),
-						values: levels,
+						values: [SAME_AS_MAIN_THREAD, ...levels],
 						action: "set-thinking",
 					},
 					{
 						id: "rememberThinkingLevelChanges",
 						label: "Remember thinking level changes",
-						description: "Save side-thread shortcut changes to pi-btw.json for next time.",
+						description: "Save shortcut changes for fixed thinking levels to pi-btw.json.",
 						currentValue: effectiveRememberThinkingLevelChanges(state.settings) ? "On" : "Off",
 						values: ["On", "Off"],
 						action: "set-remember",
@@ -176,12 +192,16 @@ export async function showBtwCommandMenu(
 				return { kind: "close" } as const;
 			},
 			"set-thinking": async ({ value, signal }) => {
-				if (!value || !levels.includes(value as BtwThinkingLevel)) return { kind: "rejected" };
+				if (!value) return { kind: "rejected" };
+				const patch =
+					value === SAME_AS_MAIN_THREAD
+						? ({ thinkingLevel: undefined } satisfies BtwSettingsPatch)
+						: levels.includes(value as BtwThinkingLevel)
+							? ({ thinkingLevel: value as BtwThinkingLevel } satisfies BtwSettingsPatch)
+							: undefined;
+				if (!patch) return { kind: "rejected" };
 				try {
-					await updateSettings(
-						{ thinkingLevel: value as BtwThinkingLevel },
-						{ settingsPath, signal },
-					);
+					await updateSettings(patch, { settingsPath, signal });
 					if (signal.aborted) return { kind: "rejected" };
 					notifySafely(ctx, `Pi BTW thinking level: ${value}.`, "info");
 					return { kind: "stay" };

package/node_modules/@narumitw/pi-btw/src/settings.ts

@@ -20,6 +20,11 @@ export type BtwSettingsLoadResult =
 	| { kind: "invalid"; reason: string }
 	| { kind: "loaded"; settings: BtwSettings };
 
+export interface BtwSettingsPatch {
+	thinkingLevel?: BtwThinkingLevel;
+	rememberThinkingLevelChanges?: boolean;
+}
+
 export interface UpdateBtwSettingsOptions {
 	settingsPath?: string;
 	signal?: AbortSignal;
@@ -77,14 +82,14 @@ export async function readBtwSettings(
 }
 
 export function updateBtwSettings(
-	patch: Partial<Pick<BtwSettings, "thinkingLevel" | "rememberThinkingLevelChanges">>,
+	patch: BtwSettingsPatch,
 	options: UpdateBtwSettingsOptions = {},
 ): Promise<BtwSettings> {
 	const settingsPath = options.settingsPath ?? btwSettingsPath();
 	return enqueueMutation(settingsPath, async () => {
 		options.signal?.throwIfAborted();
 		const current = await readSettingsDocumentForUpdate(settingsPath);
-		const updated: SettingsDocument = { ...current, ...patch };
+		const updated = applyBtwSettingsPatch(current, patch);
 		const settings = normalizeBtwSettings(updated);
 		if (!settings) throw invalidSettingsError(settingsPath, "invalid settings shape");
 		await publishSettings(settingsPath, updated, options.signal, options.beforeRename);
@@ -216,6 +221,21 @@ async function publishSettings(
 	}
 }
 
+function applyBtwSettingsPatch(
+	current: SettingsDocument,
+	patch: BtwSettingsPatch,
+): SettingsDocument {
+	const updated: SettingsDocument = { ...current };
+	if (Object.hasOwn(patch, "thinkingLevel")) {
+		if (patch.thinkingLevel === undefined) delete updated.thinkingLevel;
+		else updated.thinkingLevel = patch.thinkingLevel;
+	}
+	if (Object.hasOwn(patch, "rememberThinkingLevelChanges")) {
+		updated.rememberThinkingLevelChanges = patch.rememberThinkingLevelChanges;
+	}
+	return updated;
+}
+
 function isSettingsDocument(value: unknown): value is SettingsDocument {
 	return typeof value === "object" && value !== null && !Array.isArray(value);
 }

package/node_modules/pi-lens/CHANGELOG.md

@@ -16,6 +16,101 @@ All notable changes to pi-lens will be documented in this file.
 
 ### Security
 
+## [4.0.1] - 2026-08-16
+
+### Added
+
+- **Live native-TS7 diagnostic fixture (refs [#1412](https://github.com/apmantza/pi-lens/issues/1412))** — an opt-in (`PI_LENS_INTEGRATION=1`) integration suite launches the real `tsc --lsp` server against a Vitest-typed fixture, asserting no `Mock`/`mockResolvedValueOnce` false positives after settling while an intentional type-error control still surfaces, and recording the publication/settle sequence.
+
+- **Cascade injection, test-targeting, and cache-effectiveness telemetry (Closes #1446)** — `cascade_injected` (what text and how many neighbors/diagnostics reached `blockerParts` — i.e. were queued for the turn-end advisory, not confirmation of agent delivery, which can still be suppressed later; answering item 1) and `cascade_test_targets` (which tests were suggested for cascade neighbors, including the zero-suggestion case, answering item 2) are new `cascade.log` records. `cascade_result` now also carries `cacheHits`/`recentlyCleanHits`/`coldTouches`/`deferredTouches` (item 5's cache-effectiveness measurement, unblocked now that #1444 has landed) and `neighborBudget`/`budgetTruncated` (item 4's telemetry half). Item 3 (`lsp_diagnostics_timeout` server attribution) was already delivered by #1457. Item 4's budget-vs-settle-time sizing change is re-homed as #1462.
+
+- **Four ast-grep rules for the type-laundering smell family (Closes #1447)** — Add `no-unknown-laundering`, `no-conditional-empty-object-spread` (+ `-js`), `no-reflect-apply` / `no-reflect-get` (+ `-js`), and `no-chained-type-assertions` to the shipped rule catalog, alongside the existing `no-as-any` and `no-any-type`.
+
+- **Attribute worklog and disposition entries to the model/provider that produced them (closes #1448)** — `WorklogEntry` and `DispositionLogEntry` gain optional `model`/`provider` fields, populated at append time from the runtime's telemetry identity (`RuntimeCoordinator.telemetryModelId`/`telemetryProviderId`) and blank when the runtime doesn't know its identity. Provider is the host's explicit value when reported, else a conservative parse of the model id (`clients/model-provider.ts`: a single `/` or `:` separator, or a small known-prefix table; blank on ambiguity — never guessed). `npm run logs:smells` now prints a per-model rollup (rule × model counts, auto-fixed vs. agent-required rates) from `worklog.jsonl`. Old worklog/disposition-log entries stay valid; readers treat both fields as optional.
+
+- **Prefix filters for word-index queries: lang, file, ext (Closes #1450)** — `symbol_search`/`pilens_symbol_search` queries can now mix plain terms with composable `lang:`, `file:`, and `ext:` prefix filters, plus `-` negation, e.g. `lang:jsts file:clients/ -file:test rank`. A hand-rolled tokenizer (`parseWordIndexQuery` in `clients/word-index.ts`) splits filters from terms; `lang:` resolves through `KIND_EXTENSIONS` (`clients/file-kinds.ts`), the single source of truth, so there is no second, hand-maintained language list. Filters apply as a pre-ranking predicate, composing with the existing `paths`/`lang` structured options, before BM25/priors/centrality scoring runs. An unrecognized prefix or `lang:` kind throws a typed `WordIndexQueryError` naming the supported list instead of silently degrading to a literal search term.
+
+- **Live classic-TypeScript repair fixture (refs [#1436](https://github.com/apmantza/pi-lens/issues/1436))** — an opt-in (`PI_LENS_INTEGRATION=1`) integration suite stages a real managed-tools tree in the reported broken shape (TypeScript 7 with no `lib/tsserver.js`, cached by a prior probe) inside an isolated `PI_LENS_HOME`, then drives the production spawn through the real installer: it asserts the version-gated repair fires exactly once, the tree self-heals to the pinned classic compiler, and the classic launch serves diagnostics again. A negative control proves a disallowed-install spawn stays discovery-only and mutates nothing.
+
+### Changed
+
+- **docs: document the per-edit autofix routing (refs #1414)** — `docs/agent-guide.md` and `docs/features.md`/`docs/usage.md` now describe the write-immediate vs. edit-deferred autofix split, the authoritative post-fix content attached to `write` tool results (with its size cap and shared multi-file bash budget), and the coalesced `{autofix, format}` deferred-mutation queue that drains at `agent_end`.
+
+- **Skill docs realigned with shipped behavior and split for token economy (closes #1424, refs #1423)** — `pi-lens-write-ast-grep-rule`'s stale `-js` twins gotcha now reflects the #657 NAPI runner grammar dedup (`ruleLanguageForFile` in `ast-grep-napi.ts`) instead of advising a fix that already shipped; its NAPI-runner-specifics and hard-to-express-pattern gotchas moved verbatim into a new `reference.md` behind a pointer, keeping `SKILL.md` to the minimal template, language list, rule-condition syntax, and the load-bearing `stopBy` warning. `pi-lens-ast-grep`'s Structural-intent parameters table now documents `hasKind`/`hasDescendantKind` per-tool (`ast_grep_search`'s `hasKind` is immediate-child only, with a separate recursive `hasDescendantKind`; `ast_grep_replace` has only the immediate-child `hasKind`) with a cross-tool divergence warning, and its Agent task recipes table is trimmed to entries not already covered by the Patterns table. A new `tests/skills/skill-doc-drift.test.ts` pins param names against real tool schemas, path references against the filesystem and `package.json`'s published files, both rule-writing skills' language lists against their `rule-schema.json` enums, and `<!-- verified: ... -->` claim-comment format.
+
+- **Dead code reports the per-turn delta, not the whole project ([#1477](https://github.com/apmantza/pi-lens/issues/1477), refs [#127](https://github.com/apmantza/pi-lens/issues/127))** — turn_end used to re-inject the entire vulture cache every turn. A fixed list of pre-existing findings burned context, and the one actionable signal — a symbol the current edit just orphaned — never stood out. Dead code now follows knip's contract: a new `owns()` seam re-scans only when the turn touched a file of that language, and the result is diffed against the previous scan and filtered to the edited files. Only that delta is injected. It also feeds `projectDiagnosticsDelta`, and the block moved ahead of the delta-report write, so a dead-code-only turn persists a report `lens_diagnostics` can read. A timed-out or killed scan backs the runner off, and a failed scan never overwrites a good cached one. The project-wide list stays available on demand through `lens_diagnostics`. vulture also gets `--ignore-decorators`, so framework-invoked symbols such as fixtures and route handlers stop appearing as permanent noise.
+
+- **The auto-format nudge names the action, not the process** — a cross-process batch used to read "by another pi-lens instance (e.g. a subagent's)", which sent agents investigating what other instance was running. It now reads "by an automatic run outside your turn". Which process formatted the file is an implementation detail the reading agent cannot act on; the origin split stays exact in the telemetry.
+
+- **Word-index resume stats run through a bounded parallel walk (refs [#1409](https://github.com/apmantza/pi-lens/issues/1409))** — session-start incremental refresh now stats source files with a bounded indexed cursor pool (8 workers over libuv's 4-slot threadpool) instead of serial synchronous calls, while publishing metadata in original walk order so churn classification and rebuild preflight remain deterministic. Per-file stat failures retain the previous absent-file semantics, supersession stops new claims and settles in-flight work, and phase telemetry separates snapshot load, deserialize, source walk, stat walk, refresh reads, and the synchronous snapshot-save span.
+
+### Fixed
+
+- **TypeScript LSP roots follow governing configs (refs [#1412](https://github.com/apmantza/pi-lens/issues/1412))** — TypeScript and JavaScript files now prefer their nearest `tsconfig.json` or `jsconfig.json` (filtered by extension family — a `.ts` file skips a jsconfig-only directory) while preserving package-boundary client isolation, and classic servers emit bounded, read-only project-association telemetry after the first open. Classic-server tool discovery (`typescript-language-server`, `tsserver.js`) now walks up from a nested config root instead of only checking the root itself. Known accepted tradeoff: honoring nested config roots enlarges the population of roots subject to #1373's pre-existing open-order sensitivity.
+
+- **Post-fix decisions are observable (Closes #1432)** — Add bounded decision telemetry for advisory provenance, TypeScript project identity, deferred mutations, authoritative-content attachment, bus context resolution, and time-scoped smell rollups.
+
+- **Native TS7 diagnostic waits stabilize versionless publication bursts (refs [#1412](https://github.com/apmantza/pi-lens/issues/1412))** — TypeScript wait strategy resolution now follows the launched server variant: classic typescript-language-server retains authoritative first-push seeding, while native `tsc --lsp --stdio` debounces provisional pushes until a quiet window or advertised pull provides the settled result. Bounded latency telemetry records publication shape and settle source without diagnostic text.
+
+- **Stale advisories are historical, not current blockers (refs #1413)** — Turn-end and async test caches record immutable capture provenance and SHA-256-confirm every affected file at delivery. Changed, legacy, malformed, unreadable, truncated, and superseded findings remain non-blocking historical context; deleted per-file findings disappear, while unchanged findings retain live blocker framing across turn and project-sequence drift. Monotonic async-test generations prevent older batches from overwriting newer results, and MCP and in-process delivery share one classification without changing acknowledgement, one-shot consumption, or commit-gate state.
+
+- **Per-edit autofix no longer mutates files mid-turn (closes #1414)** — `edit` queues pipeline autofix for the owning `agent_end`, where autofix runs before the stable formatting pass; `write` keeps immediate autofix and returns authoritative post-fix file content, while write-then-edit paths stay demoted for the rest of the turn. Deferred mutation records coalesce both phases, preserve session ownership, deduplicate project-wide Rust/Dart fixers, and merge independently requeued phases.
+
+- **Bus publishers keep activation context ownership (closes #1415)** — Event producers pair each live emitter with its OWN activation's context (no fallback to a process-global "latest ctx", which could belong to an unrelated sibling activation) and guard lens events through the shared stale-session seam with the same occurrence-scoped failure gating every other producer uses. Lens emit failures now count toward the `bus-stale` degradation smell like every other producer's — intentional: a probe-undefined or resolve/emit race on the lens path is a genuine failure that should be visible, not silently excluded.
+
+- **`ast_grep_replace` now matches `ast_grep_search`'s `hasKind`/`hasDescendantKind` surface (closes #1423)** — `ast_grep_replace`'s `hasKind` param description wrongly said "contain a descendant"; it actually restricts to an **immediate child** (ast-grep default `stopBy: neighbor`), same as `ast_grep_search`. The description now matches the real behavior. `ast_grep_replace` also gained the `hasDescendantKind` param `ast_grep_search` already had — the explicit recursive form (`stopBy: end`) for when the target kind is nested below an immediate child; it's mutually exclusive with `hasKind`, surfaced as a clear synthesis error from both tools. `skills/pi-lens-ast-grep/SKILL.md`'s structural-intent table drops the now-obsolete "replace has no `hasDescendantKind`" divergence warning and documents both params as available on both tools.
+
+- **pi's own CLI output is no longer swallowed by the console guard (Closes #1434)** — The guard used to replace every `console.*` method globally and permanently once the extension loaded. pi's one-shot commands print through `console.log`, so `pi list` exited 0 with no output in any project whose directory loaded the extension first. The guard is now a dispatcher: it routes a write to the extension log only while pi-lens owns execution, and passes every other write to the original console method. Windows open around module evaluation, the extension activation, and every callback registered through the host API's `on` and `register*` members. `AsyncLocalStorage` carries the window across `await` boundaries. Terminal safety is unchanged for pi-lens code paths. One cost note for Node 22: an active `AsyncLocalStorage` adds per-`await` overhead process-wide on that runtime. `PI_LENS_CONSOLE_GUARD=0` disables the guard and avoids that cost entirely.
+
+- **Managed TypeScript self-heals the classic LSP fallback (closes [#1436](https://github.com/apmantza/pi-lens/issues/1436))** — Pi Lens now pins its managed classic compiler to TypeScript 5.9 and repairs existing managed TypeScript 7 trees when `tsserver.js` is absent, while leaving project-local TypeScript 7 on the native `tsc --lsp --stdio` path.
+
+- **Deliver late cascade results instead of dropping them (closes #1443)** — A cascade whose compute missed the turn-end settle cap, or whose neighbor diagnostics landed in the quiet window after the turn ended, was carried over and then discarded unread: the turn-end filter rejected every run stamped with an earlier turn, so the carry-over path was dead code (the two measured cases were the highest fan-out cascades of the day). Late runs now merge into the following turn's output, a run superseded by a newer write is dropped with a logged record instead of silently, and the carry is bounded to one turn.
+
+- **Settle native TS7 cascade checks (closes #1444)** — Cascade neighbor checks on native TS7 no longer burn the in-lane wait budget on a publication that only arrives later; the result is collected in the quiet window instead, and a late clean result now also clears the neighbor's stale footer errors. On the classic (full-wait) lane, a neighbor whose diagnostics wait lapsed used to produce no output at all — which read as "clean" — and now renders an explicit inconclusive note; unconfirmed checks are still never cached as clean. `cascade_result` records how many neighbors were deferred, so a fully-deferred cascade is distinguishable from a clean leaf.
+
+- **Cascade no longer blames the review graph for test-file edits (closes #1445)** — A `missing_node` cascade result had two causes that read the same but meant opposite things: a real gap in the graph, and a test file excluded from the graph by design (#260). Test-file edits now get a distinct `excluded_by_role` reason that stays in telemetry but never reaches the agent as a "review graph was unavailable" advisory. A genuinely missing source file still reports `missing_node` and still triggers the advisory.
+
+- **Test-runner results report a real duration and a real skip count (closes #1452)** — Every vitest and jest run logged `(0ms)`: `parseJsonTestOutput` hardcoded `duration: 0` and read `numSkippedTests`, a field neither reporter emits, so a file with skipped tests also always reported 0 skipped. Duration now comes from the per-suite `startTime`/`endTime` the reporters do emit (wall-clock span across suites, falling back to summed per-assertion durations), and skips come from `numPendingTests` + `numTodoTests`. PHPUnit's own `Time:` summary line — both the `00:00.123` clock form and the legacy `1.23 seconds` / `123 ms` forms — is parsed instead of discarded. An unparseable summary reports no duration at all rather than a wrong figure (see #1479 — this sentence read "still reports 0" until that landed, and both entries are still unreleased, so one release's notes would otherwise have contradicted the other).
+
+- **Keep the tool list stable across forks and reloads (closes #1453)** — When a session is forked, reloaded, or resumed, pi tells the model about every pi-lens tool again. Pi-lens now puts the list straight back to what it was, including the situational tools the model had activated, so the tool list the model sees does not change and your cached prompt still applies. Use `--no-lazy-tools` (or `tools.lazy: false`) to keep every tool active from the start instead.
+
+- **Auxiliary LSP scanners reach per-edit diagnostics (closes #1458)** — Auxiliary waits now use each server's declared budget within a 2-second post-primary ceiling, in both the touch push wait and the `getDiagnostics` aggregation lane. Late findings carry into the next unchanged-content read only when their SHA-256 content binding matches. Each touch logs a per-scanner wait outcome (answered, silent, or cut off — decided from evidence of an actual publication, not just promise settlement) with elapsed time and effective budget. Independently diagnosed by @snowyukitty, who reported the same root cause and both affected call sites in #1471.
+
+- **Secret blockers no longer name deleted files (refs #1461)** — Scanner result caches were valid on wall-clock age alone, so a gitleaks finding stayed a 🔴 STOP blocker for the rest of its 30-minute window even after the file it named was deleted. The advisory provenance guard did not catch it: it validates the files the agent edited, not the paths inside the findings. Provenance now also validates finding-cited paths, and gitleaks drops findings whose path is gone rather than demoting them — a deleted file offers no remediation. Findings on files that still exist are delivered unchanged; a finding with no path, an unreadable path, or a path past the stat budget is still delivered. Each drop writes one bounded `finding_dead_path_drop` record to `latency.log` naming the store, the count, and a sample of paths.
+
+- **A slow tool check no longer disables an installed tool for the whole session (closes #1467)** — When the check for knip, madge, govulncheck, or vulture timed out, pi-lens remembered the tool as unavailable until you restarted, and told you to install a tool that was already installed. Knip produced no findings for weeks because of this. A timed-out check is now retried after a short wait, the message says the check timed out instead of naming the wrong cause, a failed run keeps the last good cached findings instead of overwriting them, and each decision is recorded in `latency.log` as an `availability_decision` entry with its cause and timing.
+
+- **A cut-off auxiliary no longer reads as confirmed clean (closes #1470)** — When
+  the aux grace timer cut off a scanner such as opengrep, the touch still reported
+  an unqualified confirmation, so a hung security scanner produced a result that
+  read as a clean bill of health. The confirmation is now narrowed rather than
+  discarded: it names the servers it does not speak for, so `lsp_diagnostics` says
+  which coverage is missing, the cascade no longer wipes a live finding on that
+  evidence, the workspace sweep stops caching a partially covered result, and the
+  per-edit lane stops reporting an empty result as checked — on both the
+  incumbent-touch route and the warm-attach route a per-edit check takes in a
+  live session. A primary that
+  answered stays trustworthy — its findings still reach you. A related gap stays
+  open: a scanner that answers within its budget but publishes nothing still reads
+  as clean (#1493).
+
+- **A slow first probe no longer disables an installed tool (closes #1476)** —
+  biome, ast-grep, Go, cargo and govulncheck now tell a probe timeout apart from
+  a missing install, the way knip and madge already did. Before this, one stalled
+  second at session warm-up latched "tool is not installed" for the life of the
+  process, and biome and ast-grep also paid for an auto-install nobody needed. A
+  transient verdict now expires and the tool comes back without a restart, its
+  cooldown escalates on a host that stays sick, and every verdict is recorded in
+  `latency.log` as `availability_decision` with its cause, timing and retry
+  schedule. A structural coverage test parses `clients/` and fails when a new
+  version probe parks its verdict outside the shared policy; the hand-rolled
+  latches that predate it are listed in the test as named, shrink-only gaps
+  rather than being quietly excluded.
+
+- **The turn-end log no longer prints `(0ms)` for a run it never timed (closes #1479)** — `(0ms)` was the string for a genuinely sub-millisecond run *and* for one nobody measured: a JSON payload with no suite timestamps, a pytest or ExUnit or PHPUnit summary the parser could not read, a runner error, or nothing run at all. A reader could not tell "measured 0" from "unmeasured", which is the confusion #1452 was reported for in the first place. `TestResult.duration` is now absent when the run was not measured — a present `0` means a real reading, because pytest does print `in 0.00s` — and the turn-end line renders `(unmeasured)` for the absent case. The agent-facing `formatResult` string is unchanged.
+
+- **Cargo, dotnet, maven, rspec and minitest runs report a real duration (closes [#1480](https://github.com/apmantza/pi-lens/issues/1480))** — `parseGenericRunnerOutput` read an elapsed time only for go, so the seven runner families behind it reported a hardcoded `0`. Each duration is now parsed from the summary block the runner already prints, and each pattern is applied only to the runner it belongs to, so no runner can be scored by another's output — gradle used to satisfy go's probe and report the whole-build wall clock as test time. Gradle stays unmeasured: its console summary carries no test elapsed time. Multi-module maven runs are scored by the sum of their surefire aggregates rather than by a single module, a runner that exits non-zero can no longer be reported as a pass, and the pytest and ExUnit summaries are rounded to whole milliseconds instead of logging `2009.9999999999998ms`. The "was this measured at all" rule now lives in one module (`clients/run-duration.ts`) that both the turn-end log and the agent-facing summary read, rather than being re-derived at each site.
+
 ## [4.0.0] - 2026-08-14
 
 ### Added

package/node_modules/pi-lens/dist/clients/advisory-provenance.js

@@ -0,0 +1,314 @@
+import { createHash } from "node:crypto";
+import * as fs from "node:fs";
+import * as path from "node:path";
+import { logLatency } from "./latency-logger.js";
+import { normalizeMapKey, toProjectRelativePath } from "./path-utils.js";
+import { resolveRunnerPath } from "./dispatch/runner-context.js";
+export const MAX_ADVISORY_AFFECTED_FILES = 256;
+export function advisoryPathKey(filePath, cwd) {
+    return normalizeMapKey(path.resolve(cwd, filePath));
+}
+/** Shared with git guard: there is one SHA-256 implementation for advisories. */
+export function advisoryFileHash(filePath) {
+    try {
+        return createHash("sha256").update(fs.readFileSync(filePath)).digest("hex");
+    }
+    catch (error) {
+        const code = error.code ?? "unknown";
+        return code === "ENOENT" ? "missing" : `unreadable:${code}`;
+    }
+}
+function snapshotOne(filePath, cwd, role) {
+    const resolved = path.resolve(cwd, filePath);
+    try {
+        const stat = fs.statSync(resolved);
+        return {
+            path: resolved,
+            role,
+            mtimeMs: stat.mtimeMs,
+            size: stat.size,
+            sha256: advisoryFileHash(resolved),
+        };
+    }
+    catch (error) {
+        const code = error.code ?? "unknown";
+        return {
+            path: resolved,
+            role,
+            mtimeMs: -1,
+            size: -1,
+            sha256: code === "ENOENT" ? "missing" : `unreadable:${code}`,
+        };
+    }
+}
+export function snapshotAdvisoryProvenance(args) {
+    const seen = new Set();
+    const files = [];
+    for (const file of args.files) {
+        const key = advisoryPathKey(file.path, args.cwd);
+        if (seen.has(key))
+            continue;
+        seen.add(key);
+        files.push(snapshotOne(file.path, args.cwd, file.role));
+    }
+    return {
+        revision: {
+            sessionId: args.runtime.telemetrySessionId,
+            projectSeq: args.runtime.projectSeq,
+            turnIndex: args.runtime.turnIndex,
+            generation: args.generation,
+            capturedAt: args.capturedAt ?? Date.now(),
+        },
+        files,
+        ...(args.truncated ? { truncated: true } : {}),
+    };
+}
+function isFiniteNumber(value) {
+    return typeof value === "number" && Number.isFinite(value);
+}
+function isCapturedHash(value) {
+    return typeof value === "string" &&
+        (/^[a-f0-9]{64}$/.test(value) || value === "missing" || value.startsWith("unreadable:"));
+}
+function isWellFormed(value) {
+    if (!value || typeof value !== "object")
+        return false;
+    const record = value;
+    const revision = record.revision;
+    return !!revision && typeof revision.sessionId === "string" &&
+        isFiniteNumber(revision.projectSeq) && isFiniteNumber(revision.turnIndex) &&
+        isFiniteNumber(revision.generation) && isFiniteNumber(revision.capturedAt) &&
+        Array.isArray(record.files) && record.files.length > 0 && record.files.every((file) => !!file && typeof file.path === "string" &&
+        (file.role === "source" || file.role === "test" || file.role === "affected") &&
+        isFiniteNumber(file.mtimeMs) && isFiniteNumber(file.size) &&
+        isCapturedHash(file.sha256));
+}
+export function validateAdvisoryProvenance(record, cwd, runtime) {
+    if (!isWellFormed(record.provenance)) {
+        return { status: "unknown", reasons: ["malformed-or-legacy-provenance"], allFilesDeleted: false, changedPathCount: 0 };
+    }
+    const provenance = record.provenance;
+    const reasons = [];
+    let unknown = provenance.truncated === true;
+    if (unknown)
+        reasons.push("truncated-provenance");
+    if (runtime) {
+        if (provenance.revision.sessionId !== runtime.telemetrySessionId)
+            reasons.push("session-mismatch");
+    }
+    let deletedFiles = 0;
+    const changedPaths = new Set();
+    for (const captured of provenance.files) {
+        const resolved = path.resolve(cwd, captured.path);
+        const reasonsBefore = reasons.length;
+        let stat;
+        try {
+            stat = fs.statSync(resolved);
+        }
+        catch (error) {
+            const code = error.code ?? "unknown";
+            if (code === "ENOENT") {
+                if (captured.sha256 !== "missing") {
+                    deletedFiles += 1;
+                    reasons.push(`missing:${advisoryPathKey(resolved, cwd)}`);
+                    changedPaths.add(advisoryPathKey(resolved, cwd));
+                }
+            }
+            else {
+                unknown = true;
+                reasons.push(`unreadable:${advisoryPathKey(resolved, cwd)}:${code}`);
+                changedPaths.add(advisoryPathKey(resolved, cwd));
+            }
+            continue;
+        }
+        if (captured.sha256.startsWith("unreadable:")) {
+            unknown = true;
+            reasons.push(`capture-unreadable:${advisoryPathKey(resolved, cwd)}`);
+            changedPaths.add(advisoryPathKey(resolved, cwd));
+            continue;
+        }
+        if (captured.sha256 === "missing") {
+            reasons.push(`created:${advisoryPathKey(resolved, cwd)}`);
+            changedPaths.add(advisoryPathKey(resolved, cwd));
+            continue;
+        }
+        if (stat.mtimeMs !== captured.mtimeMs || stat.size !== captured.size) {
+            reasons.push(`metadata-changed:${advisoryPathKey(resolved, cwd)}`);
+        }
+        const currentHash = advisoryFileHash(resolved);
+        if (currentHash.startsWith("unreadable:")) {
+            unknown = true;
+            reasons.push(`${currentHash}:${advisoryPathKey(resolved, cwd)}`);
+        }
+        else if (currentHash !== captured.sha256) {
+            reasons.push(`content-changed:${advisoryPathKey(resolved, cwd)}`);
+        }
+        if (reasons.length > reasonsBefore)
+            changedPaths.add(advisoryPathKey(resolved, cwd));
+    }
+    const allFilesDeleted = deletedFiles === provenance.files.length;
+    if (unknown)
+        return { status: "unknown", reasons, allFilesDeleted, changedPathCount: changedPaths.size };
+    return reasons.length > 0
+        ? { status: "superseded", reasons, allFilesDeleted, changedPathCount: changedPaths.size }
+        : { status: "current", reasons: [], allFilesDeleted, changedPathCount: 0 };
+}
+// ── Finding-cited path existence (#1461 slice 1) ──────────────────────────────
+//
+// `validateAdvisoryProvenance` above answers "did the files the agent EDITED
+// change since capture?". A cached scanner finding asks a different question:
+// "does the file this finding NAMES still exist?". #1460's live case is the gap
+// between them — a gitleaks blocker for a directory deleted eleven minutes
+// earlier shipped as `current` seven consecutive times, because the edited
+// files were all intact and the cited path was never in the envelope.
+//
+// CONTRACT (the five remaining #1461 slices reuse this verbatim):
+//   - Input is any finding shape; the caller supplies `citedPath`, so nothing
+//     here knows about gitleaks, trivy, govulncheck, vulture, or delta mode.
+//   - A finding whose cited path is absent (ENOENT/ENOTDIR) is DROPPED, not
+//     demoted. There is no remediation for a file that is gone — the agent
+//     cannot rotate a credential in it or delete a line from it. Content drift
+//     on a SURVIVING file stays `validateAdvisoryProvenance`'s job, and that
+//     one demotes.
+//   - Fail open, never closed: a finding with no cited path, an unreadable
+//     path (EACCES/EPERM/EBUSY), or a path past the stat budget is DELIVERED.
+//     Unreadable is not absent; a missed drop is noise, a wrong drop is a lost
+//     secret.
+//   - Bounded cost: findings are deduped by their RAW cited string first —
+//     zero filesystem work — before anything pays for `resolveRunnerPath`'s
+//     ancestor walk or `normalizeMapKey`'s realpath. A first cut that deduped
+//     by the resolved/canonical key instead still ran that expensive step
+//     once per FINDING, not once per unique path, because the dedup lookup
+//     came after the cost it was meant to avoid: #1461's live 126-finding
+//     record measured 72.7ms in that shape, all of it before the first
+//     `statSync`. Deduping the raw string first drops the same record to a
+//     ~1.6ms median (this repo, Windows, 10-sample bench) — the remaining
+//     cost is one canonicalization + one stat per distinct cited string,
+//     capped at `MAX_FINDING_PATH_STATS`.
+//   - Path identity uses the guard normalizer (`resolveRunnerPath` →
+//     `normalizeMapKey`) for the canonical-key dedup and the shape-aware
+//     `toProjectRelativePath` for display, so Windows spellings of one path
+//     collapse to one stat and one log entry (defect shapes 1 and 2). This
+//     helper has no zero-I/O contract of its own to protect — it stats.
+//     Slice 3 (delta mode) must find and name its OWN seam before reusing
+//     this shape; `formatDeltaMode` (tools/lens-diagnostics.ts) reads only
+//     actionable-warnings, code-quality-warnings, and the delta report, none
+//     of which any #1461 slice writes yet, so nothing here currently touches
+//     it.
+/** Stat budget: one per unique cited path, sharing the envelope's own cap. */
+export const MAX_FINDING_PATH_STATS = MAX_ADVISORY_AFFECTED_FILES;
+/** How many dead paths a single drop record names before it stops. */
+const MAX_LOGGED_DEAD_PATHS = 3;
+export function findingPathExistence(resolvedPath) {
+    try {
+        fs.statSync(resolvedPath);
+        return "live";
+    }
+    catch (error) {
+        const code = error.code ?? "unknown";
+        // ENOTDIR: an ancestor component is no longer a directory — the cited
+        // path cannot exist either, same as ENOENT.
+        return code === "ENOENT" || code === "ENOTDIR" ? "missing" : "unknown";
+    }
+}
+/**
+ * Partition findings into `{live, dropped}` by whether the path each one names
+ * still exists. Pure apart from the `fs.statSync` probe, which is injectable so
+ * the partition rules are unit-testable without a filesystem.
+ */
+export function partitionFindingsByCitedPath(args) {
+    const limit = args.maxUniquePaths ?? MAX_FINDING_PATH_STATS;
+    const probe = args.existence ?? findingPathExistence;
+    // Two dedup layers, cheapest first. `rawVerdicts` collapses findings that
+    // cite the IDENTICAL string with zero filesystem work — the dominant case
+    // (#1460's live record: 126 findings over a handful of distinct `file`
+    // strings). Only a raw string not seen before pays for
+    // `resolveRunnerPath`/`advisoryPathKey`, which folds FS-confirmed spelling
+    // variants (case, separators, ancestor walk-up) into `verdicts`, the
+    // canonical-key map that `statCount` reports. Keying the expensive work by
+    // the RESOLVED path instead of the raw one (the pre-#1461-HIGH-2 shape)
+    // still called it once per finding, since the dedup lookup came after the
+    // cost it was meant to dedupe.
+    const rawVerdicts = new Map();
+    const verdicts = new Map();
+    const live = [];
+    const dropped = [];
+    const deadPaths = [];
+    let truncated = false;
+    for (const finding of args.findings) {
+        const cited = args.citedPath(finding);
+        if (!cited) {
+            live.push(finding);
+            continue;
+        }
+        let verdict = rawVerdicts.get(cited);
+        if (verdict === undefined) {
+            // Ancestor-tolerant, same as `toRunnerDisplayPath`'s resolution in
+            // runtime-turn.ts — a bare `path.resolve` here would decide the drop
+            // against a different root than the one used to render the survivor,
+            // dropping findings the display path would have shown correctly
+            // (#1461 HIGH-1). `resolveRunnerPath` already runs its result through
+            // `normalizeMapKey`, so the resolved path IS the canonical key — a
+            // second `advisoryPathKey` pass would re-pay the same realpath cost.
+            const resolved = resolveRunnerPath(args.cwd, cited);
+            const key = resolved;
+            verdict = verdicts.get(key);
+            if (verdict === undefined) {
+                if (verdicts.size >= limit) {
+                    // Budget spent on paths we have not seen before — deliver rather
+                    // than guess. Already-probed paths keep their cached verdict.
+                    truncated = true;
+                    verdict = "live";
+                }
+                else {
+                    verdict = probe(resolved);
+                    verdicts.set(key, verdict);
+                    if (verdict === "missing")
+                        deadPaths.push(resolved);
+                }
+            }
+            rawVerdicts.set(cited, verdict);
+        }
+        if (verdict === "missing")
+            dropped.push(finding);
+        else
+            live.push(finding);
+    }
+    return { live, dropped, deadPaths, statCount: verdicts.size, truncated };
+}
+/**
+ * Delivery-seam wrapper: partition, then emit one bounded `finding_dead_path_drop`
+ * record when anything was dropped, and return only what is safe to deliver.
+ *
+ * The record is the #1432 Gap 1 principle applied here — an eviction that logs
+ * nothing is only confirmable by the absence of complaints. One record per
+ * store per delivery, with a capped path sample; never one per finding.
+ */
+export function dropFindingsForMissingPaths(args) {
+    const partition = partitionFindingsByCitedPath(args);
+    if (partition.dropped.length === 0)
+        return partition.live;
+    logLatency({
+        type: "phase",
+        phase: "finding_dead_path_drop",
+        filePath: args.cwd,
+        durationMs: 0,
+        metadata: {
+            store: args.store,
+            droppedDeadPaths: partition.dropped.length,
+            deadPathCount: partition.deadPaths.length,
+            deliveredCount: partition.live.length,
+            statCount: partition.statCount,
+            samplePaths: partition.deadPaths
+                .slice(0, MAX_LOGGED_DEAD_PATHS)
+                .map((deadPath) => toProjectRelativePath(deadPath, args.cwd)),
+            ...(partition.truncated ? { truncated: true } : {}),
+        },
+    });
+    return partition.live;
+}
+export function provenanceStamp(provenance) {
+    if (!isWellFormed(provenance))
+        return "session unknown / turn unknown / generation unknown";
+    return `session ${provenance.revision.sessionId} / turn ${provenance.revision.turnIndex} / generation ${provenance.revision.generation}`;
+}

package/node_modules/pi-lens/dist/clients/agent-nudge.js

@@ -169,12 +169,19 @@ export function wireAgentNudgeSubscriber(args) {
  *   - all local         → "after your last turn" (the original #485 wording,
  *                         unchanged — verified by the pre-existing #485
  *                         tests);
- *   - all cross-process → "by another pi-lens instance (e.g. a subagent's)";
- *   - mixed             → "after your last turn (N of them by another
- *                         pi-lens instance)" — the base framing stays local
+ *   - all cross-process → "by an automatic run outside your turn";
+ *   - mixed             → "after your last turn (N of them by an automatic
+ *                         run outside it)" — the base framing stays local
  *                         and the cross-process portion is counted out
- *                         precisely, so no local file is ever misattributed
- *                         to another instance.
+ *                         precisely, so no local file is ever misattributed.
+ *
+ * The cross-process wording names the ACTION, not the process identity. It
+ * used to read "by another pi-lens instance (e.g. a subagent's)", which sent
+ * agents investigating what other instance was running — the exact behavior
+ * this nudge exists to prevent. Which process formatted the file is an
+ * implementation detail the reading agent cannot act on; that it was an
+ * automatic run outside their turn is the whole actionable content. The
+ * origin split stays exact in the telemetry for human debugging.
  *
  * Clears the accumulator ONLY here, on actual injection — never on
  * agent_end/agent_settled/turn_start. Files formatted at the last turn_end of
@@ -222,10 +229,10 @@ export function consumeAgentNudge(dbg) {
         // file to another instance — a mixed batch keeps the local base framing
         // and calls out the cross-process portion by exact count.
         const attribution = localCount === 0
-            ? "by another pi-lens instance (e.g. a subagent's)"
+            ? "by an automatic run outside your turn"
             : crossProcessCount === 0
                 ? "after your last turn"
-                : `after your last turn (${crossProcessCount} of them by another pi-lens instance)`;
+                : `after your last turn (${crossProcessCount} of them by an automatic run outside it)`;
         const message = `pi-lens: ${filesTotal} file(s) were ${verbLabel} ${attribution}: ${nameList} — working-tree changes to these are expected; re-read before editing.`;
         logLatency({
             type: "phase",