@herbertgao/pi-extensions 2026.8.5 → 2026.8.7

package/node_modules/pi-lens/dist/clients/runtime-tool-result.js

@@ -1,21 +1,27 @@
 import * as nodeCrypto from "node:crypto";
 import * as nodeFs from "node:fs";
 import * as path from "node:path";
-import { extractReadPathsFromCommand, extractGrepSearchReadsFromOutput, extractWrittenPathsFromCommand, } from "./bash-file-access.js";
+import { noteAuthoritativeContentAttachment } from "./agent-nudge.js";
+import { extractReadPathsFromCommand, extractDeletedPathsFromCommand, extractGrepSearchReadsFromOutput, extractWrittenPathsFromCommand, } from "./bash-file-access.js";
 import { registerSearchReads, } from "./search-read-registration.js";
 import { createFileTime } from "./file-time.js";
 import { publishFormatQueued } from "./format-events-publish.js";
 import { isPathIgnoredByProject } from "./file-utils.js";
 import { getFormatService } from "./format-service.js";
-import { isExternalOrVendorFile, normalizeEphemeralMapKey } from "./path-utils.js";
+import { isExternalOrVendorFile, normalizeEphemeralMapKey, pathsEqual } from "./path-utils.js";
 import { PathKeyedMap } from "./path-keyed-map.js";
 import { resolveLanguageRootForFile } from "./language-profile.js";
 import { logLatency } from "./latency-logger.js";
+import { resolveToolCallCorrelationId } from "./tool-event.js";
 import { boundedIndexesForCount, createReadGuardEditBatchSummary, getReadGuardCorrelationId, logReadGuardEvent, } from "./read-guard-logger.js";
+import { notifyExternalFileChange } from "./lsp/index.js";
 import { runPipeline } from "./pipeline.js";
+import { renderPostAutofixNotice, } from "./post-autofix-notice.js";
 import { appendProjectChange, } from "./project-changes.js";
 import { syncGitGuardRecord } from "./git-guard.js";
 import { scheduleWordIndexPersist } from "./word-index.js";
+import { RUNTIME_CONFIG } from "./runtime-config.js";
+const AUTHORITATIVE_CONTENT_MAX_BYTES = RUNTIME_CONFIG.pipeline.lspMaxFileBytes;
 function parseDiffRanges(diff) {
     const changedLines = [];
     for (const line of diff.split("\n")) {
@@ -201,12 +207,104 @@ export async function handleToolResult(deps) {
     const { event, getFlag, getFlagSource, dbg, runtime, cacheManager, biomeClient, ruffClient, metricsClient, resetLSPService, agentBehaviorRecord, formatBehaviorWarnings, } = deps;
     const rawFilePath = event.input.path;
     const workspaceRoot = runtime.projectRoot || process.cwd();
+    // #1642: a gitignored worktree edit got re-attributed onto a
+    // same-relative-path file in the parent checkout because this handler
+    // used to always resolve a relative path against `workspaceRoot`
+    // (`runtime.projectRoot`), with no idea the call actually ran under a
+    // different cwd/worktree.
+    //
+    // Source-level correction (pi host audit, earendil-works/pi): tool_call's
+    // own resolved path is NOT authoritative for what executed —
+    // `agent-session.ts:914-919`'s extension-handler contract lets a LATER
+    // `tool_call` handler mutate `event.input` in place with no
+    // re-validation, and edit's `prepareArguments` rewrites args before the
+    // event fires at all. `tool_result.input`, by contrast, is populated
+    // from the EXECUTED args (`agent-session.ts:502-516`) — it is the
+    // authoritative path source. So the correlation record's job is narrower
+    // than "the path": it is the RESOLUTION BASIS (the cwd/worktree the call
+    // actually ran under). Every tool_result resolves ITS OWN authoritative
+    // `rawFilePath` against that basis, rather than trusting a call-time path
+    // that a later handler may have superseded.
+    const toolCallId = resolveToolCallCorrelationId(event);
+    const attribution = toolCallId !== undefined
+        ? runtime.takeToolCallAttribution(toolCallId)
+        : undefined;
+    let resolutionBasis;
+    if (attribution) {
+        resolutionBasis = attribution.originCwd;
+    }
+    else if (toolCallId !== undefined && rawFilePath && !path.isAbsolute(rawFilePath)) {
+        // A real correlation id existed (the host DOES support one) but no
+        // attribution was recorded under it — evicted, cleared because the
+        // call was blocked before it could execute, or simply never seen by
+        // `handleToolCall`. A RELATIVE path here is ambiguous: we have no
+        // idea which cwd it is relative to, and guessing `workspaceRoot` is
+        // exactly the #1642 collapse. Fail CLOSED instead of guessing — no
+        // turn state, no deferred work — and log it so a real incident is
+        // countable rather than silently mis-attributed.
+        const guessedPath = path.resolve(workspaceRoot, rawFilePath);
+        // Existence is not execution evidence: a same-named file can exist in
+        // the workspace while the tool ran in another cwd. Without the recorded
+        // call target and origin cwd there is no comparison to make, so retain the
+        // full record and fail closed.
+        dbg(`path_attribution_missing: no recorded resolution basis for toolCallId=${toolCallId}, refusing relative path ${rawFilePath} (would have guessed ${guessedPath})`);
+        logLatency({
+            type: "phase",
+            toolName: event.toolName,
+            filePath: guessedPath,
+            phase: "path_attribution_missing",
+            durationMs: 0,
+            metadata: { toolCallId, rawFilePath, guessedPath },
+        });
+        return;
+    }
+    else {
+        // Either an ABSOLUTE path (bash-synthetic writes always pass one —
+        // unambiguous regardless of any basis, see the bash-write dispatch
+        // below) or a host that supplies NO correlation id at all under any
+        // known field name. The latter cannot be correlated by identity full
+        // stop; this is the SAME exposure every host had before this fix,
+        // not a regression introduced by it.
+        resolutionBasis = workspaceRoot;
+    }
     const filePath = rawFilePath
         ? path.isAbsolute(rawFilePath)
             ? rawFilePath
-            : path.resolve(workspaceRoot, rawFilePath)
+            : path.resolve(resolutionBasis, rawFilePath)
         : rawFilePath;
+    // Purely diagnostic: tool_call's call-time verdict (computed on ITS OWN
+    // resolved path, which may since have been superseded) disagreed with
+    // what actually executed. This does NOT gate anything by itself — the
+    // ignore re-check below, running on the freshly & correctly resolved
+    // `filePath`, is the real decision — but a divergence is exactly the
+    // shape of the reported incident, so it is named legibly.
+    if (attribution?.skipped &&
+        filePath &&
+        attribution.resolvedPath &&
+        !pathsEqual(filePath, attribution.resolvedPath)) {
+        const message = `path_attribution_refused: call target ${attribution.resolvedPath} (originCwd=${attribution.originCwd}) vs tool_result resolved ${filePath}`;
+        dbg(message);
+        logLatency({
+            type: "phase",
+            toolName: event.toolName,
+            filePath,
+            phase: "path_attribution_refused",
+            durationMs: 0,
+            metadata: {
+                callTarget: attribution.resolvedPath,
+                resolvedPath: filePath,
+                originCwd: attribution.originCwd,
+            },
+        });
+    }
     const behaviorWarnings = agentBehaviorRecord(event.toolName, filePath);
+    const syntheticWriteContent = [];
+    // #1590: one shared authoritative-content budget for every path this bash
+    // command wrote. It is handed DOWN to each synthetic call so the single
+    // attachment decision there sees both limits; nothing re-decides out here.
+    const syntheticAttachmentBudget = {
+        remaining: AUTHORITATIVE_CONTENT_MAX_BYTES,
+    };
     // Bash writes (redirects, tee, sed -i, cp/mv, touch, git checkout/restore) —
     // these change file content but never go through the edit tool, so bash
     // early-returns before the dispatch pipeline below. For each in-project file
@@ -224,11 +322,24 @@ export async function handleToolResult(deps) {
         for (const wp of written) {
             if (!getFlag("no-read-guard"))
                 deps.readGuard?.recordWritten(wp);
-            await handleToolResult({
+            const receipt = runtime.recordMutationToolReceipt;
+            const autofixMode = receipt
+                ? receipt.call(runtime, wp, "write").autofixMode
+                : "immediate";
+            const syntheticResult = await handleToolResult({
                 ...deps,
                 event: { ...event, toolName: "write", input: { path: wp } },
                 _bypassDebounce: true,
+                _autofixMode: autofixMode,
+                _attachmentBudget: syntheticAttachmentBudget,
             });
+            if (syntheticResult) {
+                // #1590: forward verbatim. The synthetic call already charged the
+                // shared budget above and phrased its own notice from the decision
+                // it made, so a second verdict out here could only contradict it —
+                // which is exactly the defect this shape produced before.
+                syntheticWriteContent.push(...syntheticResult.content.slice(event.content.length));
+            }
         }
         if (event.isError !== true && !getFlag("no-read-guard")) {
             for (const span of extractReadPathsFromCommand(command, workspaceRoot)) {
@@ -249,6 +360,42 @@ export async function handleToolResult(deps) {
                 });
             }
         }
+        // #1668: bash-deleted files never go through the edit tool, so nothing
+        // else tells an LSP server one of its watched files is gone — the ONLY
+        // existing enqueue site fires on first open and can only emit type 1/2.
+        // Extract the command's likely delete targets, confirm each by existence
+        // (never scan the workspace — only the paths the command named), and only
+        // act on paths pi-lens already knows about (a read or a write this
+        // session) so an `rm` on something pi-lens never touched is not treated
+        // as a signal. Each match is routed to already-active LSP clients as a
+        // type-3 watched-files event through the same #271 coalescing queue a
+        // burst of deletes still flushes as one notification per server.
+        if (event.isError !== true &&
+            !getFlag("no-lsp") &&
+            !getFlag("no-read-guard")) {
+            for (const dp of extractDeletedPathsFromCommand(command, workspaceRoot)) {
+                if (isExternalOrVendorFile(dp, workspaceRoot))
+                    continue;
+                if (isPathIgnoredByProject(dp, workspaceRoot, false))
+                    continue;
+                if (!deps.readGuard || !deps.readGuard.hasKnownPath(dp))
+                    continue;
+                // #1668 review F4: this is the ONLY gate standing between a merely
+                // NAMED path and an actual confirmed delete — extractDeletedPathsFromCommand
+                // only proposes candidates from parsing the command text, so it can't
+                // tell `git rm --cached f` (index-only, file still on disk) from a
+                // real delete, can't see a short-circuited `rm f && false` that never
+                // ran, and can't resolve a relative path run from a `cd`-ed subdirectory
+                // against the wrong cwd. Every one of those is caught here, and only
+                // here — do not remove or reorder this check relative to the loop body.
+                if (nodeFs.existsSync(dp))
+                    continue; // still there — not a real delete
+                deps.readGuard.forgetPath(dp);
+                void notifyExternalFileChange(dp, 3).catch((err) => {
+                    dbg(`tool_result: external-delete notify failed for ${dp}: ${err}`);
+                });
+            }
+        }
     }
     // Search tools reveal specific lines (file:line) the agent then edits — register
     // those shown lines (± context) as reads so the follow-up edit isn't blocked (#169).
@@ -277,7 +424,9 @@ export async function handleToolResult(deps) {
     }
     if (event.toolName !== "write" && event.toolName !== "edit") {
         dbg(`tool_result: skipped turn tracking - toolName="${event.toolName}" (not write/edit)`);
-        return;
+        return syntheticWriteContent.length > 0
+            ? { content: [...event.content, ...syntheticWriteContent] }
+            : undefined;
     }
     if (!filePath) {
         dbg(`tool_result: skipped turn tracking - no filePath for toolName="${event.toolName}"`);
@@ -324,6 +473,16 @@ export async function handleToolResult(deps) {
         });
         return { content: event.content, isError: true };
     }
+    // Must happen before debounce admission: latestDeps intentionally retains only
+    // the latest event, but write -> edit is a sticky turn transition.
+    const receipt = runtime.recordMutationToolReceipt;
+    const autofixMode = deps._bypassDebounce
+        ? (deps._autofixMode ?? (event.toolName === "edit" ? "deferred" : "immediate"))
+        : receipt
+            ? receipt.call(runtime, filePath, event.toolName).autofixMode
+            : event.toolName === "edit"
+                ? "deferred"
+                : "immediate";
     // Coalesce sequential edits to the same file into one pipeline run against
     // the final state. Only the debounce-fired call (with _bypassDebounce=true)
     // proceeds to the pipeline body; in-window callers share its promise.
@@ -332,6 +491,7 @@ export async function handleToolResult(deps) {
         if (debounceMs > 0) {
             return scheduleDebounced(filePath, debounceMs, {
                 ...deps,
+                _autofixMode: autofixMode,
                 _telemetryParticipantIds: [readGuardCorrelationId],
                 _telemetryParticipantTotal: 1,
             });
@@ -402,13 +562,15 @@ export async function handleToolResult(deps) {
     const dispatchCwd = resolveLanguageRootForFile(filePath, workspaceRoot);
     const turnStateCwd = path.resolve(workspaceRoot);
     dbg(`tool_result: resolved dispatch cwd ${dispatchCwd} for ${filePath} (turnState cwd ${turnStateCwd})`);
-    if (event.model || event.provider || event.sessionId || event.session?.id) {
-        runtime.setTelemetryIdentity({
-            model: event.model,
-            provider: event.provider,
-            sessionId: event.sessionId ?? event.session?.id,
-        });
-    }
+    // #1655 item 2: a `setTelemetryIdentity` call used to sit here, gated on
+    // `event.model`/`provider`/`sessionId`/`session.id`. pi sets none of those on
+    // a `tool_result` — `afterToolCall` builds the event with exactly
+    // `type`/`toolName`/`toolCallId`/`input`/`content`/`details`/`isError`/`usage`
+    // (`@earendil-works/pi-coding-agent/dist/core/agent-session.js:243-256`,
+    // source `src/core/agent-session.ts:502-516`), so the gate was always false
+    // against a real host and the branch never ran. Identity for this dispatch
+    // comes from the runtime, which `message_start`/`session_start` populate —
+    // see the `telemetry:` block handed to `runPipeline` below.
     const writeIndex = runtime.nextWriteIndex();
     let modifiedRanges;
     try {
@@ -469,12 +631,15 @@ export async function handleToolResult(deps) {
         cwd: dispatchCwd,
         projectRoot: turnStateCwd,
         toolName: event.toolName,
+        autofixMode,
         modifiedRanges,
         telemetry: {
             model: runtime.telemetryModel,
             sessionId: runtime.telemetrySessionId,
             turnIndex: runtime.turnIndex,
             writeIndex,
+            modelId: runtime.telemetryModelId,
+            provider: runtime.telemetryProviderId,
         },
         getFlag,
         getFlagSource,
@@ -487,6 +652,9 @@ export async function handleToolResult(deps) {
             projectSeq: () => runtime.projectSeq,
             getFilesChangedSince: (seq) => runtime.getFilesChangedSince(seq),
         },
+        // The settle clock is live because the deferred cascade may reach its
+        // budget derivation before or after turn_end starts waiting.
+        turnEndCascadeSettleStart: () => runtime.getTurnEndCascadeSettleStart(),
         // #348 phase 2: live reference so the deferred cascade can update the
         // warm word index in place at the same seam as the graph rebuild.
         // `runtime.wordIndex` is read fresh (not captured) via this closure-free
@@ -638,11 +806,19 @@ export async function handleToolResult(deps) {
             }
         }
     }
+    let autofixNewlyQueued = false;
+    if (!result.isError && autofixMode === "deferred" && nodeFs.existsSync(filePath)) {
+        autofixNewlyQueued =
+            runtime.deferMutation?.call(runtime, filePath, dispatchCwd, event.toolName, turnStateCwd, "autofix", deps.sessionId, resolutionBasis) ?? false;
+        dbg(`tool_result: queued deferred autofix for ${filePath}`);
+    }
+    let formatQueued = false;
     if (!result.isError &&
         !getFlag("no-autoformat", filePath) &&
-        !getFlag("immediate-format") &&
+        (autofixMode === "deferred" || !getFlag("immediate-format")) &&
         nodeFs.existsSync(filePath)) {
-        const isNewlyQueued = runtime.deferFormat(filePath, dispatchCwd, event.toolName, turnStateCwd, deps.sessionId);
+        const isNewlyQueued = runtime.deferFormat(filePath, dispatchCwd, event.toolName, turnStateCwd, deps.sessionId, resolutionBasis);
+        formatQueued = true;
         dbg(`tool_result: queued deferred format for ${filePath}`);
         logLatency({
             type: "phase",
@@ -652,19 +828,21 @@ export async function handleToolResult(deps) {
             durationMs: 0,
             metadata: { cwd: dispatchCwd },
         });
-        // #673: only publish on first queue entry — a re-touch of an already
-        // queued file (a second edit before agent_end) is a structural no-op
-        // for a listener that just wants to know "has this file entered the
-        // queue", so re-emitting would be spam with zero new information.
-        if (isNewlyQueued) {
+        // Publish a file's first queue entry and each newly added kind. A same-kind
+        // re-touch before agent_end carries no new information and stays silent.
+        if (isNewlyQueued || autofixNewlyQueued) {
             publishFormatQueued({
                 filePath,
                 cwd: dispatchCwd,
                 tool: event.toolName,
                 dbg,
+                kinds: autofixMode === "deferred" ? ["autofix", "format"] : ["format"],
             });
         }
     }
+    if (autofixNewlyQueued && !formatQueued) {
+        publishFormatQueued({ filePath, cwd: dispatchCwd, tool: event.toolName, kinds: ["autofix"], dbg });
+    }
     for (const changedFile of result.changedFiles ?? []) {
         const resolvedChanged = path.resolve(changedFile);
         if (!nodeFs.existsSync(resolvedChanged))
@@ -733,7 +911,10 @@ export async function handleToolResult(deps) {
         }
     }
     if (result.inlineBlockerSummary) {
-        runtime.recordInlineBlockers(filePath, result.inlineBlockerSummary);
+        // #1561: stamp the verdict with THIS dispatch's write token — the same
+        // counter `lsp_diagnostics`' reconciliation seam draws from — so a later
+        // confirmed-clean result can be ordered against it instead of racing it.
+        runtime.recordInlineBlockers(filePath, result.inlineBlockerSummary, writeIndex, result.inlineBlockerSources, result.inlineBlockerLines);
     }
     else {
         runtime.clearInlineBlockers(filePath);
@@ -764,9 +945,75 @@ export async function handleToolResult(deps) {
         result: output ? "completed" : "no_output",
     });
     runtime.reportedThisTurn.add(filePath);
-    if (!output)
+    // --- The ONE authoritative-attachment decision (#1590) ---
+    // Everything downstream — the attached block, the telemetry row, the nudge
+    // suppression, and the notice sentence — reads this single verdict. It is
+    // the only place that sees both limits: the per-file cap and the shared
+    // per-command budget a multi-file bash write threads in.
+    const postMutation = result.postMutation;
+    const attachmentText = postMutation
+        ? `pi-lens applied autofix to ${postMutation.filePath}. The following full content is authoritative for subsequent edits:\n\n${postMutation.content}`
+        : "";
+    const contentBytes = postMutation
+        ? Buffer.byteLength(postMutation.content, "utf-8")
+        : 0;
+    const withinPerFileCap = contentBytes <= AUTHORITATIVE_CONTENT_MAX_BYTES;
+    const budget = deps._attachmentBudget;
+    const withinSharedBudget = !budget || Buffer.byteLength(attachmentText, "utf-8") <= budget.remaining;
+    const attachAuthoritativeContent = postMutation !== undefined && withinPerFileCap && withinSharedBudget;
+    const attachmentDecision = !postMutation
+        ? "none"
+        : attachAuthoritativeContent
+            ? "attached"
+            : withinPerFileCap
+                ? "aggregate-budget-degraded"
+                : "size-capped";
+    // #1590: the pipeline hands up the changed-file data and this layer renders
+    // the sentence, so a size-capped write can no longer carry both "attached
+    // content is authoritative" and "too large to attach". The fallback covers
+    // a post-mutation with no notice data, which must still say re-read.
+    const notice = result.postAutofixNotice ??
+        (postMutation
+            ? { targetPath: postMutation.filePath, changedFiles: [] }
+            : undefined);
+    if (postMutation && attachAuthoritativeContent && budget) {
+        budget.remaining -= Buffer.byteLength(attachmentText, "utf-8");
+    }
+    // #1590 review F1: every mutation that produced a notice logs a row,
+    // INCLUDING the `none` decision a format-only change makes. Gating the row
+    // on `postMutation` made a legitimate "nothing was attachable here" verdict
+    // indistinguishable from missing instrumentation, which is the same
+    // empty-vs-errored confusion the read paths already guard against.
+    if (postMutation || notice) {
+        logLatency({
+            type: "phase",
+            phase: "authoritative_content_attachment_decision",
+            filePath: postMutation?.filePath ?? filePath,
+            durationMs: 0,
+            metadata: {
+                path: postMutation?.filePath ?? filePath,
+                bytes: contentBytes,
+                decision: attachmentDecision,
+            },
+        });
+    }
+    if (postMutation) {
+        // #1464: the nudge suppresses exactly the paths this decision
+        // delivered. Same boolean the attachment below reads — the nudge layer
+        // never re-derives the cap or the budget for itself.
+        noteAuthoritativeContentAttachment(postMutation.filePath, attachAuthoritativeContent);
+    }
+    const returnedContent = attachAuthoritativeContent
+        ? [...event.content, { type: "text", text: attachmentText }]
+        : event.content;
+    if (notice) {
+        output = `${output ? `${output}\n\n` : ""}${renderPostAutofixNotice(notice, attachmentDecision)}`;
+    }
+    if (!output && !result.postMutation)
         return;
     return {
-        content: [...event.content, { type: "text", text: output }],
+        content: output
+            ? [...returnedContent, { type: "text", text: output }]
+            : returnedContent,
     };
 }