@herbertgao/pi-extensions 2026.8.5 → 2026.8.7

package/node_modules/pi-lens/dist/clients/tree-sitter-shared.js

@@ -30,6 +30,17 @@ export function getSharedTreeSitterClient() {
 export function isTreeSitterWasmAborted() {
     return _wasmAborted;
 }
+/**
+ * Re-arm the singleton's web-tree-sitter load latch for a new session
+ * (#1592 review round 2 F2 — the same shape as #1567/#1575's
+ * `resetAstGrepNapiLoadState()`). A no-op if the singleton hasn't been
+ * created yet, or if the WASM runtime already aborted (that case is
+ * process-lifetime by design, see `markTreeSitterWasmAborted` above — a
+ * session boundary is not a process restart, so it stays poisoned).
+ */
+export function resetTreeSitterClientLoadState() {
+    _shared?.resetLoadStateForSession();
+}
 /** Machine-readable process-wide runtime health for status/reporting surfaces. */
 export function getTreeSitterRuntimeStatus() {
     return {

package/node_modules/pi-lens/dist/clients/tree-sitter-symbol-extractor.js

@@ -448,6 +448,63 @@ const SYMBOL_QUERIES = {
         name: (command_name (word) @callIdent)) @callRef
     `,
     },
+    // #1522: tree-sitter-cue (eonpatapon/tree-sitter-cue, vendored per #1520) has
+    // no `label:`/`value:` field names on `field` — verified directly against the
+    // committed wasm (`value:` fails query compilation with "Bad field name");
+    // only `let_clause`'s `left:`/`right:` and `call_expression`'s `function:`
+    // are real fields. A `#Definition` is not a distinct node kind: `#Service`
+    // parses as a plain (identifier) whose text happens to start with "#", so
+    // definitions are told apart from ordinary struct fields with a `#match?`/
+    // `#not-match?` text predicate rather than a grammar-level distinction —
+    // both predicates must sit INSIDE the pattern's own parens (this repo's
+    // tree-sitter gotcha). `#Definition`s map to `type` (the closest existing
+    // SymbolKind to a reusable CUE schema); plain fields map to `property`;
+    // `let` bindings map to `variable`.
+    //
+    // Two known upstream grammar rough edges (#1522 review round 1, F4;
+    // docs/language-coverage.md's CUE row has the same note, kept in sync):
+    // (1) an aliased field label (`X=name: value`) exposes BOTH identifiers
+    // as untagged siblings under one `label` node — `(label alias:
+    // (identifier) (identifier))` — with no field/structural way to tell the
+    // alias from the real name, so `fieldDef` spuriously captures the alias
+    // too, alongside the correct symbol for `name`. (2) a multi-hash raw
+    // string (`##"..."##`, 2+ `#` delimiters) mis-parses regardless of
+    // content — the field's value becomes a bare `identifier` instead of a
+    // `string`, which can surface as a spurious `#`-prefixed ref via the
+    // `typeIdent` pattern below. Both are grammar bugs, not query bugs — no
+    // query change here can distinguish what the parse tree doesn't.
+    cue: {
+        defs: `
+      (field
+        (label (identifier) @defName)
+        (#match? @defName "^#")) @defDef
+
+      (field
+        (label (identifier) @fieldName)
+        (value (_)) @fieldValue
+        (#not-match? @fieldName "^#")) @fieldDef
+
+      (let_clause
+        left: (identifier) @letName
+        right: (_) @letValue) @letDef
+    `,
+        // `#Service` used as a value (e.g. `#Other: #Service & {...}`) is the same
+        // (identifier) node kind as its own definition label — there is no
+        // separate reference/definition node kind in this grammar, so the
+        // definition's own label also matches this pattern, mirroring the same
+        // self-match already accepted for swift/java's broad `type_identifier`
+        // ref patterns above.
+        refs: `
+      ((identifier) @typeIdent
+        (#match? @typeIdent "^#"))
+
+      (call_expression
+        function: (identifier) @callIdent) @callRef
+
+      (call_expression
+        function: (selector_expression (identifier) (identifier) @callMethod)) @callMethodRef
+    `,
+    },
 };
 // The tsx grammar (downloaded as tree-sitter-tsx.wasm) shares TypeScript's node
 // types — function_declaration, arrow_function, class_declaration,
@@ -601,6 +658,17 @@ const IMPORT_QUERIES = {
         (word) @importSource
         (#match? @_m "^(source|\\.)$"))
     `,
+    // import "strings" / import x "encoding/json" — `import_spec`'s `path:`
+    // field is verified against the committed wasm. Block-form
+    // (`import (\n\t"strings"\n)`) nests each `import_spec` one level deeper,
+    // under `import_spec_list`, rather than as a direct child of
+    // `import_declaration` — a second pattern is needed, not a reshaped first
+    // one (#1522 review round 1, F2: the single-line-only pattern extracted
+    // zero imports from the block form).
+    cue: `
+      (import_declaration (import_spec path: (string) @importSource))
+      (import_declaration (import_spec_list (import_spec path: (string) @importSource)))
+    `,
 };
 // import/export ... from "..." have the same (import_statement source: (string))
 // / (export_statement source: (string)) shape on the javascript grammar
@@ -797,6 +865,28 @@ export class TreeSitterSymbolExtractor {
             kind = "class";
             defNode = captures.moduleDef?.node;
         }
+        else if (captures.defName) {
+            // CUE `#Definition` — the closest existing SymbolKind to a reusable
+            // schema type.
+            name = captures.defName.text;
+            kind = "type";
+            // biome-ignore lint/suspicious/noExplicitAny: Node type
+            defNode = captures.defDef?.node;
+        }
+        else if (captures.fieldName) {
+            // CUE plain struct field.
+            name = captures.fieldName.text;
+            kind = "property";
+            // biome-ignore lint/suspicious/noExplicitAny: Node type
+            defNode = captures.fieldDef?.node;
+        }
+        else if (captures.letName) {
+            // CUE `let` binding — a computed local value.
+            name = captures.letName.text;
+            kind = "variable";
+            // biome-ignore lint/suspicious/noExplicitAny: Node type
+            defNode = captures.letDef?.node;
+        }
         if (!name || !kind || !defNode)
             return null;
         // Check if exported (basic heuristic: has export keyword before it)

package/node_modules/pi-lens/dist/clients/trivy-client.js

@@ -32,13 +32,20 @@
  * secrets (pending dedup vs gitleaks), and license compliance are follow-ups
  * tracked on #131.
  *
- * Refs: #131
+ * Scope note (#1562 class fix): `fs`'s own tree walk is handed
+ * `--skip-dirs` per shared scratch/cache tree (`scratch-tree-policy.ts`,
+ * derived from the same `EXCLUDED_DIRS` gitleaks/opengrep use) so its
+ * `secret` scanner doesn't repeat gitleaks's `.pi/greedysearch-sources/`
+ * false-positive shape.
+ *
+ * Refs: #131, #1562
  */
 import * as fs from "node:fs";
 import * as os from "node:os";
 import * as path from "node:path";
 import { mkdtempSync } from "node:fs";
 import { loadPiLensProjectConfig } from "./project-lens-config.js";
+import { getScratchTreeGlobPatterns } from "./scratch-tree-policy.js";
 import { safeSpawnAsync } from "./safe-spawn.js";
 import { SecurityScanClient } from "./security-scan-client.js";
 const EMPTY_RESULT = {
@@ -220,6 +227,13 @@ export class TrivyClient extends SecurityScanClient {
             // both the vuln and the license results; secret findings are
             // severity-independent (trivy always emits them) and collapsed
             // downstream against gitleaks / ast-grep.
+            //
+            // `--skip-dirs` (#1562 class fix): trivy's `fs` scan walks `cwd`
+            // ITSELF (unlike knip/jscpd, which pi-lens's own `EXCLUDED_DIRS`-aware
+            // walker feeds a pre-filtered file list). Without this, its `secret`
+            // scanner is exactly as exposed to `.pi/greedysearch-sources/`-style
+            // scratch trees as gitleaks was — same doublestar-glob patterns
+            // `scratch-tree-policy.ts` derives from the SAME `EXCLUDED_DIRS` list.
             const result = await safeSpawnAsync(bin, [
                 "fs",
                 "--scanners",
@@ -232,6 +246,10 @@ export class TrivyClient extends SecurityScanClient {
                 reportPath,
                 "--quiet",
                 "--no-progress",
+                ...getScratchTreeGlobPatterns().flatMap((glob) => [
+                    "--skip-dirs",
+                    glob,
+                ]),
                 cwd,
             ], { cwd, timeout: SCAN_TIMEOUT_MS });
             if (result.error) {

package/node_modules/pi-lens/dist/clients/warm-attach.js

@@ -4,6 +4,7 @@ import * as path from "node:path";
 import { readInstanceRegistry, } from "./instance-registry.js";
 import { realIsPidAlive, STALE_HEARTBEAT_MS, } from "./instance-reaper.js";
 import { logLatency } from "./latency-logger.js";
+import { touchCoverageGap } from "./lsp/diagnostic-binding.js";
 import { loadLspService } from "./lsp-lazy.js";
 import { contentHash, createWarmIpcLineReader, diagnosticsIpcPathForCwd, requestWarmCodeActions, requestWarmDiagnostics, WARM_CODE_ACTION_LOOKUP_LIMIT, WARM_DIAGNOSTICS_SCHEMA_VERSION, } from "./mcp/ipc.js";
 import { normalizeFilePath } from "./path-utils.js";
@@ -76,6 +77,11 @@ async function serveRequest(req) {
         source: "warm-attach-incumbent",
     });
     const servedAt = Date.now();
+    // #1470: the coverage gap is read through the shared helper, never re-derived
+    // from `confirmation === "partial"`. The two fields are set together today, so
+    // either test passes — which is exactly the coincidence `touchCoverageGap`'s
+    // own doc comment warns against. One reader, one rule.
+    const coverageGap = touchCoverageGap(touched);
     if (servedAt <= req.deadlineAt && touched !== undefined && !touched.inconclusive) {
         state.servedDiagnosticHashes.set(normalizeFilePath(req.file), req.contentHash);
     }
@@ -100,6 +106,17 @@ async function serveRequest(req) {
             ...(touched?.confirmation === "confirmed"
                 ? { confirmation: "confirmed" }
                 : {}),
+            // #1470: a PARTIAL touch crosses the socket as itself rather than as a
+            // missing key. Omitting it would still fail closed on the far side, but it
+            // would be indistinguishable from an old incumbent that never sent the
+            // field — and the whole point of narrowing is that the reader can tell
+            // which coverage is real.
+            ...(coverageGap.length > 0
+                ? {
+                    confirmation: "partial",
+                    unconfirmedServerIds: [...coverageGap],
+                }
+                : {}),
         },
     };
 }