@herbertgao/pi-extensions 2026.8.6 → 2026.8.7

package/node_modules/pi-lens/dist/tools/lsp-diagnostics.js

@@ -10,7 +10,7 @@ import { Type } from "../clients/deps/typebox.js";
 import { getProjectIgnoreMatcher, isExcludedDirName, } from "../clients/file-utils.js";
 import { getLSPService, groupFilesByPrimaryServer, runPerServerGroups, } from "../clients/lsp/index.js";
 import { buildScopeKey, createWorkspaceDiagnosticsCacheContext, } from "../clients/lsp/workspace-diagnostics-cache.js";
-import { primaryServerId } from "../clients/lsp/config.js";
+import { getServersForFileWithConfig, primaryServerId, } from "../clients/lsp/config.js";
 import { combineAbortSignals, withDeadline } from "../clients/deadline-utils.js";
 import { applyAuxiliarySuppressions, retagAuxiliaryDiagnostics, } from "../clients/dispatch/auxiliary-lsp.js";
 import { detectFileRole } from "../clients/file-role.js";
@@ -18,7 +18,8 @@ import { hashDiagnosticContent, touchCompletedConfirmationPolicy, touchCoverageG
 import { classifyCascadeWaitTier } from "../clients/lsp/wait-policy/index.js";
 import { attemptTsserverSyncDiagnostics, } from "../clients/lsp/tsserver-sync.js";
 import { convertLspDiagnostics } from "../clients/dispatch/utils/lsp-diagnostics.js";
-import { reconcileScanDiagnostics } from "../clients/widget-state.js";
+import { demoteInferredProjectDiagnostics } from "../clients/lsp/inferred-project.js";
+import { isBlocking, reconcileScanDiagnostics } from "../clients/widget-state.js";
 import { baseName, compactRenderResult } from "./render-compact.js";
 import { makeProgressReporter, scanningSummaryLine } from "./scan-progress.js";
 import { isWarmAttached, tryWarmAttachedDiagnostics, } from "../clients/warm-attach.js";
@@ -239,7 +240,14 @@ export function createLspDiagnosticsTool(
 // confirmed result reconciled into the footer reserves its token when the
 // per-file check starts, so settlement order cannot make an older result look
 // newer. Optional/undefined in tests.
-nextWriteIndex) {
+nextWriteIndex, 
+// #1561: #571 wired this tool's confirmed result into the widget footer and
+// stopped there. The inline-blocker map is a SECOND agent-facing store fed by
+// the same dispatch verdict, and nothing retired it — so pi-lens kept
+// injecting "Unresolved from this turn" for three more turns after answering
+// "confirmed clean" for the same file. index.ts injects
+// `runtime.retireInlineBlockerOnConfirmedClean`. Optional/undefined in tests.
+onConfirmedNoBlockers) {
     return {
         name: "lsp_diagnostics",
         label: "LSP Diagnostics",
@@ -387,6 +395,7 @@ nextWriteIndex) {
                     nextWriteIndex,
                     serverScope,
                     cwd,
+                    onConfirmedNoBlockers,
                 });
             }
             const rawPath = typedParams.path;
@@ -427,9 +436,10 @@ nextWriteIndex) {
                     nextWriteIndex,
                     serverScope,
                     cwd,
+                    onConfirmedNoBlockers,
                 });
             }
-            return runFileDiagnostics(absPath, severity, lspService, waitMs, nextWriteIndex, serverScope, cwd);
+            return runFileDiagnostics(absPath, severity, lspService, waitMs, nextWriteIndex, serverScope, cwd, onConfirmedNoBlockers);
         },
     };
 }
@@ -632,35 +642,66 @@ function canTrustTouchConfirmation(file, serverScope, confirmedByTouch) {
         (serverScope === "primary" || primaryServerId(file) !== "typescript"));
 }
 /**
- * #571: reconcile this tool's fresh LSP result into the footer cache
- * (`widget-state.ts`'s `allDiagnostics`) — same shared choke point
- * `lens_diagnostics` mode=full uses (`clients/widget-state.ts`'s
- * `reconcileScanDiagnostics`). A manual `lsp_diagnostics` check that proves a
- * stale footer error is actually gone (the real-world case that surfaced
- * #571) is exactly the kind of confirmed result that should correct it.
- * Direct `lsp_diagnostics` deliberately does not perform a second disk read at
- * this reconciliation seam: its collecting touch already read the content and
- * supplies the binding verdict. `false` is unconfirmed and is never written;
- * `true` is trusted, while an absent/`unknown` verdict preserves the legacy
- * fail-open policy for servers that cannot bind their diagnostics to content.
+ * #1561 F1: what this check is entitled to speak for.
  *
- * `rawDiags` (pre-severity-filter) is what gets written — the footer records
- * the true known state, independent of this call's display-only severity
- * filter. A non-empty result is definitionally confirmed (the server DID
- * answer with real diagnostics); an empty result is only confirmed when
- * `classifyEmptyResult` (#533) says "clean", not "unconfirmed" (silent
- * push-only server — indistinguishable from still-analyzing/never-asked, so
- * must not overwrite a real prior footer entry).
+ * Inline blockers are raised by the whole dispatch — eslint, biome-check,
+ * actionlint, ast-grep security rules — while this tool only ever consults
+ * language servers. Retiring one therefore needs an explicit coverage claim,
+ * and the honest claim is exactly the servers this check consulted and got an
+ * answer from. `serverScope: "primary"` consults only the primary, so its claim
+ * is `"lsp"` alone; an all-scope check adds each auxiliary server by id, which
+ * is the same vocabulary `retagAuxiliaryDiagnostics` tags their findings with.
  *
- * #692: `retagAuxiliaryDiagnostics` re-tags aux-sourced entries (ast-grep,
- * opengrep, zizmor, typos) with their real tool id + semantic policy before
- * they're written — the same treatment the per-edit dispatch runner gives
- * them — so a scan-reconciled entry no longer keeps tool `"lsp"`. `content`
- * is the file content `collectDiagnosticsForFile`/the cache already read (or
- * undefined for a cache-hit branch, whose `rawDiags` were already suppression-
- * /skipTestFiles-filtered at write time — an empty string here is then a safe
- * no-op re-check, not a behavior gap).
+ * A server named in `unconfirmedServerIds` is dropped: it produced no evidence
+ * for this content, so claiming coverage for it would be the #1470/#1493 lie one
+ * layer up. (Today an aux gap also demotes the whole verdict to "unconfirmed",
+ * so the hook does not fire at all — this stays correct if that ever narrows.)
  */
+function coveredSourcesForCheck(file, serverScope, unconfirmedServerIds) {
+    const unconfirmed = new Set(unconfirmedServerIds);
+    const covered = new Set();
+    let servers = [];
+    try {
+        servers = (getServersForFileWithConfig(file) ?? []);
+    }
+    catch {
+        // A registry we cannot read is not a coverage claim. Returning an empty
+        // set makes every retire fail closed, which is the safe direction for a
+        // commit gate.
+        return [];
+    }
+    for (const server of servers) {
+        const auxiliary = server.role === "auxiliary";
+        if (auxiliary && serverScope === "primary")
+            continue;
+        if (unconfirmed.has(server.id))
+            continue;
+        // The dispatch runner tags the primary language server's findings `lsp`;
+        // auxiliaries keep their own tool id.
+        covered.add(auxiliary ? server.id : "lsp");
+    }
+    return [...covered];
+}
+/**
+ * #1645 review F3: `lsp_diagnostics` writes into the SAME widget store as
+ * `lens_diagnostics mode=full`. Two tools writing one store must apply ONE rule
+ * for "is this file's diagnostics demoted" — otherwise an orphan file blocks or
+ * does not depending purely on which tool ran last, which is the #1633-V1
+ * lesson. Every path in this file that reaches `reconcileWidgetFromLspResult`
+ * or the rendered output routes its raw diagnostics through here first, so the
+ * store, the counts, and the text all agree.
+ *
+ * Applied AFTER the confirmation verdict is computed, never before: confirmation
+ * asks "did the server answer for this content", which the demotion must not
+ * influence.
+ */
+function demoteInferredForFile(file, diagnostics, cwd, lspService) {
+    return demoteInferredProjectDiagnostics(diagnostics, {
+        filePath: file,
+        cwd,
+        service: lspService,
+    });
+}
 function reconcileWidgetFromLspResult(file, rawDiags, confirmation, writeIndex, cwd, content, 
 // #1095: true when the result's content binding demonstrably mismatches disk
 // (boundToCurrentDisk === false). Such a result — even a NON-EMPTY one, which
@@ -678,7 +719,7 @@ boundMismatch = false,
 observedAt) {
     const confirmed = (rawDiags.length > 0 || confirmation !== "unconfirmed") && !boundMismatch;
     if (!confirmed)
-        return;
+        return { confirmed: false, blocking: true };
     try {
         // #692: provenance label ONLY — must never affect `rule`/identity (see
         // `ConvertLspDiagnosticsOptions.scanOrigin`'s doc comment).
@@ -687,9 +728,16 @@ observedAt) {
         });
         const retagged = retagAuxiliaryDiagnostics(diagnostics, rawDiags, content ?? "", { cwd, fileRole: detectFileRole(file, content) });
         reconcileScanDiagnostics(file, retagged, true, writeIndex, observedAt);
+        // #1561: the blocking tally comes from the SAME `isBlocking` predicate the
+        // footer counts with — no second severity rule for the blocker-retire
+        // decision to drift away from.
+        return { confirmed: true, blocking: retagged.some(isBlocking) };
     }
     catch {
         // Never let a footer-reconciliation hiccup fail the diagnostics check.
+        // A verdict we could not compute is NOT evidence of clean: report it as
+        // still-blocking so no caller retires a blocker off a failed reconcile.
+        return { confirmed: false, blocking: true };
     }
 }
 async function collectFileDiagnosticResult(file, severity, lspService, waitMs, nextWriteIndex, serverScope = "all", 
@@ -703,7 +751,11 @@ cacheCtx, scopeKey,
 // `allowBlocking(cwd)` for a scan-reconciled aux finding — defaults to
 // `process.cwd()` for any call site that predates this (there are none
 // today besides the two below, both of which now pass it explicitly).
-cwd = process.cwd()) {
+cwd = process.cwd(), 
+// #1561: see `createLspDiagnosticsTool`'s parameter doc. Called only for a
+// FRESH observation — never on the cache-hit replay below, whose `rawDiags`
+// are an OLD observation (#1093) and therefore no evidence about now.
+onConfirmedNoBlockers) {
     // Reserve the ordering token when this diagnostic operation starts, not when
     // its LSP promise settles. A slower old result must not receive a newer token
     // merely because it completed later (#1198).
@@ -725,8 +777,13 @@ cwd = process.cwd()) {
         // NOT served — fall through to a fresh touch instead of replaying a stale
         // cached result. "unknown"/true bindings serve as before.
         if (cached && cached.binding.boundToCurrentDisk !== false) {
-            const filteredDiags = applySeverityFilter(cached.diagnostics, severity);
             const confirmation = cached.diagnostics.length === 0 ? "clean" : undefined;
+            // #1645 review F3: a cache REPLAY writes the widget store exactly like a
+            // fresh touch does, so it gets the same demotion. Without this, replaying
+            // yesterday's cached blocker would re-cement an orphan file as blocking
+            // after mode=full had demoted it.
+            const cachedDiags = await demoteInferredForFile(file, cached.diagnostics, cwd, lspService);
+            const filteredDiags = applySeverityFilter(cachedDiags, severity);
             // #692: cached.diagnostics were already suppression-/skipTestFiles-
             // filtered at write time (this same code path); no file content was
             // cached alongside them, so `undefined` here is a safe re-check, not
@@ -736,7 +793,7 @@ cwd = process.cwd()) {
             // now(), or a repeat check that only re-serves the cache would keep
             // re-arming the mtime-staleness gate and a resolved finding would render
             // forever (the #1092 defect).
-            reconcileWidgetFromLspResult(file, cached.diagnostics, confirmation, writeIndex, cwd, undefined, 
+            reconcileWidgetFromLspResult(file, cachedDiags, confirmation, writeIndex, cwd, undefined, 
             // This branch only runs when the cache binding is not a mismatch
             // (guarded above), so boundMismatch is false; #1093's observedAt is
             // the cache entry's original scan time.
@@ -789,7 +846,8 @@ cwd = process.cwd()) {
     const boundMismatch = binding?.boundToCurrentDisk === false;
     if (boundMismatch)
         confirmation = "unconfirmed";
-    // #1470: an auxiliary cut off by the aux grace timer contributed no evidence
+    // #1470/#1493: an auxiliary that never reported — cut off by the aux grace timer,
+    // or silent with nothing published for this content — contributed no evidence
     // about this file, so a "clean" verdict computed from the merged result would
     // be claiming coverage this batch does not have. Demote it — that also keeps
     // the entry out of the workspace cache below, which would otherwise replay the
@@ -797,8 +855,18 @@ cwd = process.cwd()) {
     if (unconfirmedServerIds.length > 0 && confirmation === "clean") {
         confirmation = "unconfirmed";
     }
+    // #1645 review F3: one demotion rule for every writer of the widget store.
+    effectiveRawDiags = await demoteInferredForFile(file, effectiveRawDiags, cwd, lspService);
     const filteredDiags = applySeverityFilter(effectiveRawDiags, severity);
-    reconcileWidgetFromLspResult(file, effectiveRawDiags, confirmation, writeIndex, cwd, collectedContent, boundMismatch);
+    const verdict = reconcileWidgetFromLspResult(file, effectiveRawDiags, confirmation, writeIndex, cwd, collectedContent, boundMismatch);
+    if (verdict.confirmed && !verdict.blocking) {
+        onConfirmedNoBlockers?.({
+            filePath: file,
+            writeIndex,
+            coveredSources: coveredSourcesForCheck(file, serverScope, unconfirmedServerIds),
+            cwd,
+        });
+    }
     // #671: only a CONFIRMED outcome ("clean", or a non-empty result — either
     // is definitionally confirmed per this function's own doctrine above) is
     // safe to cache; "unconfirmed" (timeout OR a silent-tier server's
@@ -806,7 +874,10 @@ cwd = process.cwd()) {
     // result — same false-clean bug class `runWorkspaceDiagnostics`'s cache
     // wiring guards against. #1095: the entry carries the content fingerprint so a
     // later lookup can verify it against disk beyond the mtime proxy.
-    if (cacheCtx && scopeKey !== undefined && confirmation !== "unconfirmed") {
+    if (cacheCtx &&
+        scopeKey !== undefined &&
+        confirmation !== "unconfirmed" &&
+        unconfirmedServerIds.length === 0) {
         cacheCtx.record(file, scopeKey, effectiveRawDiags, stat.mtimeMs, collectedContent !== undefined
             ? hashDiagnosticContent(collectedContent)
             : undefined);
@@ -820,7 +891,10 @@ cwd = process.cwd()) {
         primaryServerId: primaryServerId(file),
     };
 }
-async function runFileDiagnostics(absPath, severity, lspService, waitMs, nextWriteIndex, serverScope = "all", cwd = process.cwd()) {
+async function runFileDiagnostics(absPath, severity, lspService, waitMs, nextWriteIndex, serverScope = "all", cwd = process.cwd(), 
+// #1561: see `createLspDiagnosticsTool`'s parameter doc. This is the path the
+// live incident took (`mode: "file"`).
+onConfirmedNoBlockers) {
     // Reserve the token before awaiting this file's LSP result. The direct-file
     // path performs its own confirmation/reconciliation below (#1198).
     const writeIndex = nextWriteIndex?.();
@@ -866,21 +940,36 @@ async function runFileDiagnostics(absPath, severity, lspService, waitMs, nextWri
     const boundMismatch = binding?.boundToCurrentDisk === false;
     if (boundMismatch)
         confirmation = "unconfirmed";
-    // #1470: NARROWED, not collapsed. An auxiliary the aux grace timer cut off makes
-    // the FILE-level verdict unconfirmed — the merged result is missing whatever that
-    // scanner would have said, and this tool is the security lane's read surface. The
+    // #1470/#1493: NARROWED, not collapsed. An auxiliary that never reported — the aux
+    // grace timer cut it off, or it stayed silent with nothing published for this
+    // content — makes the FILE-level verdict unconfirmed. The merged result is missing
+    // whatever that scanner would have said, and this tool is the security lane's read surface. The
     // PRIMARY's own verdict is untouched (`primaryCoverageGapOnly` below), so a
     // TypeScript answer stays "confirmed clean" on its own line while an explicit
     // line names the scanner whose coverage is absent.
     const primaryCoverageGapOnly = unconfirmedServerIds.length > 0 && confirmation === "clean";
     if (primaryCoverageGapOnly)
         confirmation = "unconfirmed";
+    // #1645 review F3: one demotion rule for every writer of the widget store.
+    effectiveRawDiags = await demoteInferredForFile(absPath, effectiveRawDiags, cwd, lspService);
     const filtered = applySeverityFilter(effectiveRawDiags, severity);
     const total = filtered.length;
     const truncated = total > MAX_DIAGNOSTICS;
     const limited = truncated ? filtered.slice(0, MAX_DIAGNOSTICS) : filtered;
     const unconfirmed = confirmation === "unconfirmed";
-    reconcileWidgetFromLspResult(absPath, effectiveRawDiags, confirmation, writeIndex, cwd, collectedContent, boundMismatch);
+    const verdict = reconcileWidgetFromLspResult(absPath, effectiveRawDiags, confirmation, writeIndex, cwd, collectedContent, boundMismatch);
+    // #1561: a confirmed current view with nothing at the blocking tier retires
+    // this file's stale inline blocker — the store #571 corrected the footer for
+    // but never reached, which is how a resolved cross-file finding kept being
+    // injected as "Unresolved from this turn" for the rest of the session.
+    if (verdict.confirmed && !verdict.blocking) {
+        onConfirmedNoBlockers?.({
+            filePath: absPath,
+            writeIndex,
+            coveredSources: coveredSourcesForCheck(absPath, serverScope, unconfirmedServerIds),
+            cwd,
+        });
+    }
     const primaryId = primaryServerId(absPath);
     const primaryDiags = limited.filter((d) => d.source === primaryId);
     const auxiliaryDiags = limited.filter((d) => d.source !== primaryId);
@@ -1078,7 +1167,7 @@ async function collectBatchDiagnostics(files, severity, lspService, options) {
     const cacheCtx = createWorkspaceDiagnosticsCacheContext(resolvedCwd);
     const scopeKey = buildScopeKey(options.serverScope ?? "all");
     const results = await mapWithConcurrency(files, options.concurrency, async (file) => {
-        const work = collectFileDiagnosticResult(file, severity, lspService, options.waitMs, options.nextWriteIndex, options.serverScope, cacheCtx, scopeKey, resolvedCwd);
+        const work = collectFileDiagnosticResult(file, severity, lspService, options.waitMs, options.nextWriteIndex, options.serverScope, cacheCtx, scopeKey, resolvedCwd, options.onConfirmedNoBlockers);
         const bounded = withDeadline(work, {
             ms: batchFileDeadlineMs(),
             onTimeout: "undefined",

package/node_modules/pi-lens/dist/tools/lsp-navigation.js

@@ -9,9 +9,10 @@ import { fileURLToPath, pathToFileURL } from "node:url";
 import { Type } from "../clients/deps/typebox.js";
 import { logLatency } from "../clients/latency-logger.js";
 import { newLspMutationCorrelationId, recordLspMutationOutcome, } from "../clients/lsp-mutation.js";
+import { uriToPath } from "../clients/path-utils.js";
 import { compactRenderResult } from "./render-compact.js";
 import { applyWorkspaceEdit, summarizeWorkspaceEdit, } from "../clients/lsp/edits.js";
-import { getLSPService } from "../clients/lsp/index.js";
+import { getLSPService, } from "../clients/lsp/index.js";
 import { buildLspNavigationEnvelope } from "./lsp-structured-output.js";
 import { SYMBOL_KIND_NAMES } from "../clients/lsp-document-symbols.js";
 const VALID_OPERATIONS = [
@@ -678,6 +679,7 @@ getFlag, mutationDeps) {
             let columnResolution;
             let mutationContext;
             let requestedApply = false;
+            const workspaceScopeAttribution = {};
             const finalize = (payload, meta) => {
                 if (payload.isError &&
                     requestedApply &&
@@ -698,6 +700,9 @@ getFlag, mutationDeps) {
                         supported,
                         diagnosticsMode,
                         columnResolution,
+                        ...(Object.keys(workspaceScopeAttribution).length > 0
+                            ? { workspaceScopeAttribution }
+                            : {}),
                     },
                 });
                 const text = payload.content[0]?.text ?? "";
@@ -821,7 +826,9 @@ getFlag, mutationDeps) {
             }
             const lspService = getLSPService();
             if (operation === "capabilities") {
-                const snapshots = await lspService.getCapabilitySnapshots(rawPath ? filePath : undefined);
+                const snapshots = rawPath
+                    ? await lspService.getCapabilitySnapshots(filePath)
+                    : await lspService.getCapabilitySnapshots(undefined, workspaceScopeAttribution);
                 const output = formatCapabilities(snapshots, rawPath ? filePath : undefined);
                 return finalize({
                     content: [{ type: "text", text: output }],
@@ -838,7 +845,9 @@ getFlag, mutationDeps) {
                 });
             }
             if (operation === "workspaceDiagnostics") {
-                const wsDiagSupport = await lspService.getWorkspaceDiagnosticsSupport(rawPath ? filePath : undefined);
+                const wsDiagSupport = rawPath
+                    ? await lspService.getWorkspaceDiagnosticsSupport(filePath)
+                    : await lspService.getWorkspaceDiagnosticsSupport(undefined, workspaceScopeAttribution);
                 diagnosticsMode = wsDiagSupport?.mode ?? "unknown";
                 if (rawPath && !filePathIsDirectory) {
                     const hasLSP = lspService.supportsLSP(filePath);
@@ -1007,7 +1016,10 @@ getFlag, mutationDeps) {
             const lspEndLine = (endLine ?? line ?? 1) - 1;
             const lspEndChar = (endCharacter ?? resolvedCharacter.character) - 1;
             const runWorkspaceSymbolOperation = async () => {
-                supported = operationSupportStatus(operation, await lspService.getOperationSupport(rawPath ? filePath : undefined));
+                const support = rawPath
+                    ? await lspService.getOperationSupport(filePath)
+                    : await lspService.getOperationSupport(undefined, workspaceScopeAttribution);
+                supported = operationSupportStatus(operation, support);
                 if (supported === false) {
                     throw new Error("__UNSUPPORTED__ Active LSP server does not advertise support for workspaceSymbol");
                 }
@@ -1018,7 +1030,9 @@ getFlag, mutationDeps) {
                     await openFileBestEffort(lspService, filePath);
                 }
                 try {
-                    const raw = await lspService.workspaceSymbol(query ?? "", rawPath ? filePath : undefined);
+                    const raw = rawPath
+                        ? await lspService.workspaceSymbol(query ?? "", filePath)
+                        : await lspService.workspaceSymbol(query ?? "", undefined, workspaceScopeAttribution);
                     const filtered = (Array.isArray(raw) ? raw : [raw]).filter((s) => typeof s === "object" &&
                         s !== null &&
                         (!s.kind || NAVIGABLE_SYMBOL_KINDS.has(s.kind)));
@@ -1127,7 +1141,9 @@ getFlag, mutationDeps) {
                         if (!command || command.trim().length === 0) {
                             throw new Error("__BADINPUT__ command parameter required for executeCommand");
                         }
-                        const advertised = await lspService.getAdvertisedCommands(rawPath ? filePath : undefined);
+                        const advertised = rawPath
+                            ? await lspService.getAdvertisedCommands(filePath)
+                            : await lspService.getAdvertisedCommands(undefined, workspaceScopeAttribution);
                         const isAdvertised = advertised.includes(command);
                         // Dry-run by default: report advertisement status without running.
                         // Mutation only on explicit apply:true (and the client re-checks
@@ -1147,18 +1163,41 @@ getFlag, mutationDeps) {
                         if (!isAdvertised) {
                             throw new Error(`__UNSUPPORTED__ command "${command}" is not advertised by the active LSP server (advertised: ${advertised.join(", ") || "none"})`);
                         }
-                        return lspService.executeCommand(rawPath ? filePath : undefined, command, commandArguments, mutationContext);
+                        return rawPath
+                            ? lspService.executeCommand(filePath, command, commandArguments, mutationContext)
+                            : lspService.executeCommand(undefined, command, commandArguments, mutationContext, workspaceScopeAttribution);
                     }
                     case "incomingCalls": {
                         if (!callHierarchyItem) {
                             throw new Error("__BADINPUT__ callHierarchyItem parameter required for incomingCalls");
                         }
+                        // #1803 fix-round F1: needsFilePath is false for call-hierarchy
+                        // traversal (the operand is callHierarchyItem, not path), so the
+                        // shared needsFilePath pre-check at line ~1319 never runs for
+                        // this operation — LSPService.incomingCalls' own capability gate
+                        // (clients/lsp/index.ts) returns a bare [], which this tool layer
+                        // cannot distinguish from "supported server, zero callers found".
+                        // Pre-check here, keyed off the item's own uri (the file the
+                        // resolved server is scoped to), mirrors
+                        // runWorkspaceSymbolOperation's supported-check above: throwing
+                        // __UNSUPPORTED__ routes through the catch block below into the
+                        // same discriminated isError:true/emptyReason:"unsupported" shape
+                        // every other capability-gated operation already reports.
+                        supported = operationSupportStatus(operation, await lspService.getOperationSupport(uriToPath(callHierarchyItem.uri)));
+                        if (supported === false) {
+                            throw new Error("__UNSUPPORTED__ Active LSP server does not advertise support for incomingCalls");
+                        }
                         return lspService.incomingCalls(callHierarchyItem);
                     }
                     case "outgoingCalls": {
                         if (!callHierarchyItem) {
                             throw new Error("__BADINPUT__ callHierarchyItem parameter required for outgoingCalls");
                         }
+                        // #1803 fix-round F1: same pre-check as incomingCalls above.
+                        supported = operationSupportStatus(operation, await lspService.getOperationSupport(uriToPath(callHierarchyItem.uri)));
+                        if (supported === false) {
+                            throw new Error("__UNSUPPORTED__ Active LSP server does not advertise support for outgoingCalls");
+                        }
                         return lspService.outgoingCalls(callHierarchyItem);
                     }
                     default:

package/node_modules/pi-lens/docs/agent-guide.md

@@ -95,7 +95,7 @@ not clean**:
 | **`unconfirmed`** | A push-only/silent-on-clean LSP server returned empty; emptiness could not be *proven* clean. | Don't report the file as clean. |
 | **`cold` (not applicable / unavailable this run)** | A heavyweight analyzer (knip/jscpd/madge/gitleaks/govulncheck/trivy/dead-code) didn't contribute. | Don't fold its silence into "no issues." |
 | **`partial` / `truncated` / file-cap** | A walk/scan hit a file cap or coverage limit; results are a partial view. | Don't treat as whole-project coverage. |
-| **`stale`** | A cached diagnostic's file changed on disk since the scan. | Don't trust the stale value. |
+| **`stale`** | A cached diagnostic's file changed on disk since the scan. Secrets findings demote to `🔑 ACTION NEEDED` advisory with the line number withheld, never silently dropped; govulncheck keeps the CVE and drops only the cached line. | Don't trust the stale value or its line number. Re-scan to confirm. |
 | **cold-LSP `0` (e.g. MCP `fresh` mode)** | LSP cold-spawned and under-reported; a `0` carries an explicit `lsp` signal. | Don't read the `0` as "clean." |
 | **unsafe root** | cwd resolved at/above `$HOME`, so scanners were skipped. | Re-run from inside the project. |
 
@@ -113,6 +113,11 @@ is blocking when `semantic === "blocking"`, else it falls back to severity):
 
 - **🔴 Blocking** — a hard stop. Secrets, CRITICAL CVEs, unresolved errors, etc.
   **Resolve every blocker before you consider the work complete.**
+- **🔑 ACTION NEEDED** — a third tier, distinct from both: a secrets finding
+  whose cached file changed since the scan. It does not gate commit-guard like
+  a blocker does, but it is not "no action required" like an advisory either —
+  the finding is unverified, not dismissed. Re-run a secrets scan to confirm
+  or clear it.
 - **Advisory** — informational (🟡 warnings, 📜 license notes, style/hygiene).
   Address when relevant; they do not gate completion.