@herbertgao/pi-extensions 2026.8.5 → 2026.8.7

package/node_modules/pi-lens/dist/clients/project-diagnostics/fresh-fetch.js

@@ -82,11 +82,14 @@
  */
 import * as fs from "node:fs";
 import * as path from "node:path";
+import { applyDispositionsMultiFile } from "../diagnostic-dispositions.js";
 import { getKnipIgnorePatterns } from "../file-utils.js";
 import { isAtOrAboveHomeDir } from "../path-utils.js";
 import { GitleaksClient } from "../gitleaks-client.js";
 import { GovulncheckClient } from "../govulncheck-client.js";
+import { isToolInstallAllowedByTrust, projectTrustDenialReason, } from "../project-trust.js";
 import { TrivyClient } from "../trivy-client.js";
+import { reasonFromAvailabilityVerdict } from "./extractors.js";
 import { deadCodeResultToProjectDiagnostics } from "./runner-adapters/dead-code.js";
 import { gitleaksResultToProjectDiagnostics } from "./runner-adapters/gitleaks.js";
 import { govulncheckResultToProjectDiagnostics } from "./runner-adapters/govulncheck.js";
@@ -141,11 +144,13 @@ export async function fetchFreshProjectDiagnostics(cacheManager, cwd, clients, s
     // / review-graph's buildOrUpdateGraph; like the latter, there is no safe
     // substitute root to fall back to — the caller's `paths` scope only filters
     // REPORTED results, it never narrows what these analyzers walk.
+    const unsafeRootReason = "the working directory resolves at or above the home directory; heavyweight analyzers refuse to walk from there (#747)";
     if (isAtOrAboveHomeDir(analysisRoot, options.homeDir)) {
         return {
             diagnostics: [],
             runners: [],
             cold: [...ANALYZER_IDS],
+            coldReasons: Object.fromEntries(ANALYZER_IDS.map((id) => [id, unsafeRootReason])),
             failed: [],
             timings: {},
             unsafeRoot: true,
@@ -154,13 +159,46 @@ export async function fetchFreshProjectDiagnostics(cacheManager, cwd, clients, s
     const diagnostics = [];
     const runners = [];
     const cold = [];
+    // #1623: the specific reason each `cold` id was skipped, captured at the
+    // gate that decided it — see FreshProjectDiagnosticsResult.coldReasons.
+    const coldReasons = {};
     const failed = [];
     const timings = {};
+    // #1623: ms-old each id's data was when this call read it, for lanes that
+    // are cache-reads by design (currently only test-runner — see its task
+    // below) rather than a fresh execution this call. Absent for every other
+    // key: this module's other lanes always trigger-or-join a genuine run
+    // when attempted (see the module header), so there is nothing to date.
+    const cachedAgeMs = {};
     const settledIds = new Set();
+    let dispositionSuppressed = 0;
+    const dispositionSuppressedByLane = {};
+    // #1617: this is the ONE choke point every analyzer's findings pass
+    // through on the way into `diagnostics`, so applying the agent/user
+    // disposition filter HERE covers the whole mode=full class (knip/jscpd/
+    // madge/gitleaks/govulncheck/opengrep/trivy/dead-code) in one place — the
+    // same anchor derivation `dispatcher.ts:924` uses, via
+    // `applyDispositionsMultiFile` (`diagnostic-dispositions.ts`), not a
+    // second cloned filter. Unlike the dispatch path's one-file-at-a-time
+    // shape, a project-wide scan's findings span many files, so this groups by
+    // each diagnostic's own `filePath` and reads each file's current content
+    // once — see that function's doc for the fail-open contract when a file
+    // can't be read.
+    function markCold(id, reason) {
+        pushUnique(cold, id);
+        coldReasons[id] = reason;
+    }
     function record(id, adapted, elapsedMs) {
         timings[id] = (timings[id] ?? 0) + elapsedMs;
-        if (adapted.length > 0) {
-            diagnostics.push(...adapted);
+        const kept = applyDispositionsMultiFile(adapted, analysisRoot, (d) => d.filePath);
+        const suppressedHere = adapted.length - kept.length;
+        dispositionSuppressed += suppressedHere;
+        if (suppressedHere > 0) {
+            dispositionSuppressedByLane[id] =
+                (dispositionSuppressedByLane[id] ?? 0) + suppressedHere;
+        }
+        if (kept.length > 0) {
+            diagnostics.push(...kept);
             pushUnique(runners, id);
         }
     }
@@ -194,7 +232,7 @@ export async function fetchFreshProjectDiagnostics(cacheManager, cwd, clients, s
         // detection, exactly mirroring session_start's own logic.
         task("jscpd", async () => {
             if (!(await clients.jscpdClient.ensureAvailable())) {
-                cold.push("jscpd");
+                markCold("jscpd", reasonFromAvailabilityVerdict("jscpd", clients.jscpdClient.getAvailabilityVerdict?.()));
                 return;
             }
             const isTsProject = fs.existsSync(path.join(analysisRoot, "tsconfig.json"));
@@ -213,7 +251,7 @@ export async function fetchFreshProjectDiagnostics(cacheManager, cwd, clients, s
         // madge — circular-dependency detection.
         task("madge", async () => {
             if (!(await clients.depChecker.ensureAvailable())) {
-                cold.push("madge");
+                markCold("madge", reasonFromAvailabilityVerdict("madge", clients.depChecker.getAvailabilityVerdict?.()));
                 return;
             }
             const startMs = Date.now();
@@ -234,11 +272,11 @@ export async function fetchFreshProjectDiagnostics(cacheManager, cwd, clients, s
         // "cold" on a project with no explicit gitleaks config.
         task("gitleaks", async () => {
             if (!GitleaksClient.hasGitRepo(analysisRoot)) {
-                cold.push("gitleaks");
+                markCold("gitleaks", "not a git repository (no .git found)");
                 return;
             }
             if (!(await clients.gitleaksClient.ensureAvailable())) {
-                cold.push("gitleaks");
+                markCold("gitleaks", reasonFromAvailabilityVerdict("gitleaks", clients.gitleaksClient.getAvailabilityVerdict?.()));
                 return;
             }
             const startMs = Date.now();
@@ -257,11 +295,22 @@ export async function fetchFreshProjectDiagnostics(cacheManager, cwd, clients, s
         // govulncheck — Go module CVE detection. Go-module-gated per #132.
         task("govulncheck", async () => {
             if (!GovulncheckClient.hasGoModule(analysisRoot)) {
-                cold.push("govulncheck");
+                markCold("govulncheck", "no go.mod found (not a Go module)");
                 return;
             }
             if (!(await clients.govulncheckClient.ensureAvailable())) {
-                cold.push("govulncheck");
+                // #1623 fix-round F1: `GovulncheckClient.doEnsureAvailable` has a
+                // branch (`assertInstallAllowed`, govulncheck-client.ts) that returns
+                // false WITHOUT ever touching its availability latch — a
+                // project-trust install denial, deliberately not latched so a later
+                // trust grant can retry (see that file's own comment). The latch's
+                // verdict is genuinely absent in that case, not merely unread, so
+                // check trust denial FIRST via the same taxonomy project-trust.ts
+                // already exposes, and only fall back to the probe-based verdict
+                // (a real timeout/absence) when trust isn't the reason.
+                markCold("govulncheck", isToolInstallAllowedByTrust()
+                    ? reasonFromAvailabilityVerdict("govulncheck", clients.govulncheckClient.getAvailabilityVerdict?.())
+                    : (projectTrustDenialReason() ?? "govulncheck binary unavailable"));
                 return;
             }
             const startMs = Date.now();
@@ -291,7 +340,7 @@ export async function fetchFreshProjectDiagnostics(cacheManager, cwd, clients, s
         // `lens_diagnostics mode=full` — the honesty gap (#533) this task closes.
         task("opengrep", async () => {
             if (!(await clients.opengrepClient.ensureAvailable())) {
-                cold.push("opengrep");
+                markCold("opengrep", reasonFromAvailabilityVerdict("opengrep", clients.opengrepClient.getAvailabilityVerdict?.()));
                 return;
             }
             const startMs = Date.now();
@@ -308,11 +357,11 @@ export async function fetchFreshProjectDiagnostics(cacheManager, cwd, clients, s
         // trivy — dependency CVE detection. Explicit opt-in per #131.
         task("trivy", async () => {
             if (!TrivyClient.shouldScan(analysisRoot)) {
-                cold.push("trivy");
+                markCold("trivy", "not opted in (.pi-lens.json trivy.enabled) or no dependency manifest found");
                 return;
             }
             if (!(await clients.trivyClient.ensureAvailable())) {
-                cold.push("trivy");
+                markCold("trivy", reasonFromAvailabilityVerdict("trivy", clients.trivyClient.getAvailabilityVerdict?.()));
                 return;
             }
             const startMs = Date.now();
@@ -332,7 +381,7 @@ export async function fetchFreshProjectDiagnostics(cacheManager, cwd, clients, s
         task("dead-code", async () => {
             const applicable = clients.deadCodeClients.filter((c) => c.detect(analysisRoot));
             if (applicable.length === 0) {
-                cold.push("dead-code");
+                markCold("dead-code", "no dead-code client detected an applicable language for this project");
                 return;
             }
             await Promise.all(applicable.map(async (client) => {
@@ -380,10 +429,17 @@ export async function fetchFreshProjectDiagnostics(cacheManager, cwd, clients, s
             const startMs = Date.now();
             const cached = cacheManager.readCache("test-runner-findings", analysisRoot);
             if (!cached?.data) {
-                cold.push("test-runner");
+                markCold("test-runner", "no turn_end test-runner cache entry yet this session");
                 return;
             }
-            record("test-runner", testRunnerFindingsToProjectDiagnostics(cached.data), Date.now() - startMs);
+            // #1623: unlike every other lane in this module, test-runner is a
+            // cache-read BY DESIGN (see the task's own header comment above) — it
+            // never performs a fresh run this call, so its age must be surfaced
+            // the same way a genuinely-stale cache read would be, rather than
+            // looking indistinguishable from a lane that just executed.
+            cachedAgeMs["test-runner"] =
+                Date.now() - new Date(cached.meta.timestamp).getTime();
+            record("test-runner", testRunnerFindingsToProjectDiagnostics(cached.data, analysisRoot, options.runtime), Date.now() - startMs);
         }),
     ];
     // Swallow any later rejection so an aborted-and-abandoned task can never
@@ -414,11 +470,25 @@ export async function fetchFreshProjectDiagnostics(cacheManager, cwd, clients, s
             diagnostics,
             runners,
             cold,
+            coldReasons,
             failed,
             timings,
+            cachedAgeMs,
             aborted: true,
             abortedIds,
+            dispositionSuppressed,
+            dispositionSuppressedByLane,
         };
     }
-    return { diagnostics, runners, cold, failed, timings };
+    return {
+        diagnostics,
+        runners,
+        cold,
+        coldReasons,
+        failed,
+        timings,
+        cachedAgeMs,
+        dispositionSuppressed,
+        dispositionSuppressedByLane,
+    };
 }

package/node_modules/pi-lens/dist/clients/project-diagnostics/runner-adapters/gitleaks.js

@@ -2,19 +2,31 @@ import * as path from "node:path";
 /**
  * A gitleaks finding is a leaked secret at a concrete `file:startLine`. Secrets
  * are treated as **blocking** — a committed credential is not a style nit.
+ *
+ * Exception: `pathStatus: "scratch"` (#1562 review-round F2) — a finding
+ * `classifyAndFilterFindings` demoted rather than dropped, so the observability
+ * criterion ("record carries tracked/ignored/scratch status") stays honest
+ * about a fourth REACHABLE value instead of silently deleting it. Demoted to
+ * `severity: "info"`/`semantic: "none"` so it can never read as a blocking
+ * "leaked secret" alarm, while remaining visible for an audit read.
  */
 export function gitleaksFindingToProjectDiagnostic(cwd, finding) {
+    // #1562 observability criterion: surface the git status right in the
+    // finding's message so a triage is a read, not a re-derivation. Omitted
+    // when git itself degraded (`pathStatus` undefined) rather than guessed.
+    const statusSuffix = finding.pathStatus ? ` [git: ${finding.pathStatus}]` : "";
+    const isScratch = finding.pathStatus === "scratch";
     return {
         filePath: path.isAbsolute(finding.file)
             ? finding.file
             : path.resolve(cwd, finding.file),
         line: finding.startLine,
-        severity: "error",
-        semantic: "blocking",
+        severity: isScratch ? "info" : "error",
+        semantic: isScratch ? "none" : "blocking",
         tool: "gitleaks",
         runner: "gitleaks",
         rule: `gitleaks:${finding.ruleId}`,
-        message: `Potential secret: ${finding.description || finding.ruleId}`,
+        message: `Potential secret: ${finding.description || finding.ruleId}${statusSuffix}`,
         source: "project-scan",
     };
 }

package/node_modules/pi-lens/dist/clients/project-diagnostics/runner-adapters/runner-findings.js

@@ -1,3 +1,6 @@
+import * as fs from "node:fs";
+import * as path from "node:path";
+import { advisoryPathKey, validateAdvisoryProvenance, } from "../../advisory-provenance.js";
 function failureMessage(failure) {
     const firstLine = failure.message.split("\n")[0]?.slice(0, 300) ?? "";
     return firstLine ? `${failure.name}: ${firstLine}` : failure.name;
@@ -71,8 +74,26 @@ export function testResultToProjectDiagnostics(result, stale = false) {
         },
     ];
 }
-export function testRunnerFindingsToProjectDiagnostics(cache) {
+export function testRunnerFindingsToProjectDiagnostics(cache, cwd, runtime) {
     if (!cache.results || cache.results.length === 0)
         return [];
-    return cache.results.flatMap((r) => testResultToProjectDiagnostics(r, cache.stale));
+    const validation = cwd
+        ? validateAdvisoryProvenance(cache, cwd, runtime)
+        : { status: "unknown", reasons: ["validation-context-missing"] };
+    const root = cwd ?? process.cwd();
+    const missingKeys = new Set((cache.provenance?.files ?? [])
+        .filter((file) => !fs.existsSync(path.resolve(root, file.path)))
+        .map((file) => advisoryPathKey(file.path, root)));
+    const historical = cache.superseded === true || cache.stale === true || validation.status !== "current";
+    return cache.results
+        .filter((result) => !missingKeys.has(advisoryPathKey(result.file, root)))
+        .flatMap((result) => testResultToProjectDiagnostics(result, historical))
+        .map((diagnostic) => historical ? {
+        ...diagnostic,
+        severity: "info",
+        semantic: "none",
+        message: diagnostic.message.startsWith("[stale")
+            ? diagnostic.message
+            : `[historical — re-run to confirm] ${diagnostic.message}`,
+    } : diagnostic);
 }

package/node_modules/pi-lens/dist/clients/project-diagnostics/runner-adapters/trivy.js

@@ -24,8 +24,56 @@ export function trivyFindingToProjectDiagnostic(cwd, finding) {
         source: "project-scan",
     };
 }
+/**
+ * A trivy *secret* finding (`TrivyResult.secrets`) is a leaked credential at a
+ * concrete `file:line` — the trivy-scanned sibling of
+ * `gitleaksFindingToProjectDiagnostic`, and treated the same way: **blocking**,
+ * since a committed credential is not a style nit.
+ *
+ * Rule id is namespaced `trivy-secret:<ruleId>`, deliberately distinct from the
+ * CVE lane's `trivy:<vulnerabilityId>` (#1628) — trivy's own rule-id spaces for
+ * secrets and CVEs are independent, so without this prefix a secret rule id
+ * could collide with a vulnerability id and silently share (or steal) that
+ * finding's disposition anchor.
+ */
+export function trivySecretFindingToProjectDiagnostic(cwd, finding) {
+    return {
+        filePath: path.isAbsolute(finding.file)
+            ? finding.file
+            : path.resolve(cwd, finding.file),
+        line: finding.line,
+        severity: "error",
+        semantic: "blocking",
+        tool: "trivy",
+        runner: "trivy",
+        rule: `trivy-secret:${finding.ruleId}`,
+        message: `Potential secret: ${finding.title || finding.ruleId}`,
+        source: "project-scan",
+    };
+}
+function trivySecretsToProjectDiagnostics(cwd, secrets) {
+    return secrets.map((finding) => trivySecretFindingToProjectDiagnostic(cwd, finding));
+}
+/**
+ * Adapts BOTH of trivy's finding kinds from one scan pass — CVEs (`findings`)
+ * and secrets (`secrets`, #1628) — into the single `ProjectDiagnostic[]`
+ * `lens_diagnostics mode=full` surfaces. Before #1628, `secrets` was silently
+ * unread here: a trivy-only secret (no gitleaks/ast-grep corroboration) had no
+ * `lens_diagnostics`-visible identity at all for an agent to anchor a mark
+ * against, even though `runtime-turn.ts`'s turn_end gate already blocked on it.
+ */
 export function trivyResultToProjectDiagnostics(cwd, result) {
-    if (!result.success || result.findings.length === 0)
+    if (!result.success)
         return [];
-    return result.findings.map((finding) => trivyFindingToProjectDiagnostic(cwd, finding));
+    return [
+        ...(result.findings ?? []).map((finding) => trivyFindingToProjectDiagnostic(cwd, finding)),
+        // `secrets` defaults to `[]` here rather than assuming the field is
+        // always present: `fetchFreshProjectDiagnostics` swallows a task
+        // rejection into a silent "completed" outcome (its
+        // `.catch(() => "completed")`), so an unguarded `.map` on a missing
+        // field here would drop this lane's CVE diagnostics too, not just the
+        // secrets — a caller-visible regression for a field this adapter
+        // doesn't itself require.
+        ...trivySecretsToProjectDiagnostics(cwd, result.secrets ?? []),
+    ];
 }

package/node_modules/pi-lens/dist/clients/project-diagnostics/scanner.js

@@ -89,6 +89,11 @@ function fromDispatchDiagnostic(diagnostic, runner) {
  */
 async function scanFileMajorRules(cwd, files, signal) {
     const client = getSharedTreeSitterClient();
+    // #1715: grow the tree cache to span this scan's working set BEFORE
+    // parsing starts, so a project bigger than the interactive default (50
+    // entries) still gets cross-scan reuse instead of every file re-parsing
+    // on every scan.
+    client?.ensureTreeCacheCapacity(files.length);
     const treeSitterReady = !!client && client.isAvailable() && (await client.init());
     // Same singleton the dispatch runner uses (tree-sitter.ts:444) — memoized
     // per root, so repeated scans stop re-reading the ~180 query YAMLs.

package/node_modules/pi-lens/dist/clients/project-lens-config.js

@@ -84,6 +84,9 @@ const PROJECT_OWN_CONFIG_KEYS = [
     "maxProjectFiles",
     "reviewGraph",
     "trivy",
+    // `helm.renderValidation.enabled` — the opt-in for rendered-manifest
+    // validation, read via `.raw` in the helm-render runner (#1283).
+    "helm",
 ];
 /** Clamp bounds for `reviewGraph.maxFiles` — see the field's doc comment above. */
 const REVIEW_GRAPH_MAX_FILES_MIN = 100;