@herbertgao/pi-extensions 2026.8.6 → 2026.8.8

package/node_modules/pi-lens/dist/clients/lsp/server.js

@@ -13,7 +13,7 @@ import path from "node:path";
 import { getGlobalPiLensDir, getProjectIgnoreGlobs, isPathIgnoredByProject, } from "../file-utils.js";
 import { STAGE_TMP_PATTERN } from "../atomic-write-staging.js";
 import { DOTNET_CSHARP_ROOT_MARKERS, DOTNET_FSHARP_ROOT_MARKERS, KIND_EXTENSIONS, } from "../file-kinds.js";
-import { direntsHaveMarkerGlobMatch, isAtOrAboveHomeDir, isFullyQualified, isWindowsPath, } from "../path-utils.js";
+import { direntsHaveMarkerGlobMatch, isAtOrAboveHomeDir, isFullyQualified, isWindowsPath, pathsEqual, } from "../path-utils.js";
 import { ensureTool, getToolEnvironment, getToolPath, } from "../installer/index.js";
 import { resolveOpengrepConfig } from "../opengrep-config.js";
 import { isZizmorAuditTarget, resolveZizmorGitHubToken } from "../zizmor-config.js";
@@ -192,6 +192,15 @@ function canInstall(allowInstall) {
 const DIRECT_LSP_NEGATIVE_TTL_MS = Math.max(30_000, Number.parseInt(process.env.PI_LENS_DIRECT_LSP_NEGATIVE_TTL_MS ?? "600000", 10) || 600_000);
 const directLspCommandUnavailableUntil = new Map();
 const directLspCommandSkipLoggedUntil = new Map();
+/** Re-arm direct-command availability for the next session. */
+export function resetDirectLspCommandAvailability() {
+    directLspCommandUnavailableUntil.clear();
+    directLspCommandSkipLoggedUntil.clear();
+}
+/** Test seam for seeding the real negative-cache path. */
+export function _markDirectLspCommandUnavailableForTests(command) {
+    markDirectLspCommandUnavailable(command);
+}
 function pruneExpiredDirectLspNegativeEntries(now = Date.now()) {
     for (const [command, until] of directLspCommandUnavailableUntil) {
         if (until <= now) {
@@ -712,7 +721,10 @@ async function markerExists(dir, pattern) {
  * NearestRoot(includePatterns, excludePatterns?) → RootFunction
  *
  * - includePatterns: file/dir names that signal the project root (e.g. ["package.json"])
- * - excludePatterns: if any of these exist in a directory, skip it (e.g. ["node_modules"])
+ * - excludePatterns: if any of these exist in a directory, SKIP that directory and
+ *   keep walking up toward stopDir — it does not abort resolution. A directory that
+ *   matches an exclude pattern is simply never returned as a root; the walk still
+ *   continues past it looking for an include-pattern hit higher up (#1671).
  * - stopDir: walk stops here (defaults to filesystem root; set to project cwd for safety)
  *
  * Equivalent to createRootDetector; exported under both names for clarity.
@@ -877,16 +889,28 @@ async function findAncestorFileAmong(startDir, candidateSegmentLists) {
     return undefined;
 }
 /**
- * A failed classic-compiler repair must not repeat. `ensureTool` caches
- * successful installs, so a repair that works short-circuits later calls on
- * its own. A repair that fails leaves nothing behind, and `findTsserverPath`
- * has three call sites (TypeScript, Vue, Svelte). Without this guard an
- * offline or partial install re-runs a 120 s forced reinstall on every spawn.
+ * A failed classic-compiler repair must not repeat within a session.
+ * `ensureTool` caches successful installs, so a repair that works
+ * short-circuits later calls on its own. A repair that fails leaves nothing
+ * behind, and `findTsserverPath` has three call sites (TypeScript, Vue,
+ * Svelte). Without this guard an offline or partial install re-runs a 120 s
+ * forced reinstall on every spawn.
+ *
+ * The guard is a plain module-level flag, so without an explicit re-arm it
+ * would latch for the whole extension-host process — a repair that failed
+ * once (transient registry hiccup) would stay unrepairable for every later
+ * session in that process. `resetClassicTsRepairGuard` re-arms it; callers
+ * wire that into `session_start` alongside the other per-session resets
+ * (#1570).
  */
 let classicTsRepairAttempted = false;
+/** Re-arm the classic-repair guard so a new session gets its own attempt. */
+export function resetClassicTsRepairGuard() {
+    classicTsRepairAttempted = false;
+}
 /** Test hook — clears the per-process classic-repair guard. */
 export function _resetClassicTsRepairForTests() {
-    classicTsRepairAttempted = false;
+    resetClassicTsRepairGuard();
 }
 /**
  * Directories that may hold the TypeScript package next to a resolved `tsc`
@@ -1559,15 +1583,120 @@ export const GoServer = {
         return { ...result, initialization: { ui: { semanticTokens: true } } };
     },
 };
-async function hasWorkspaceSection(cargoPath) {
+async function readTextFileOrUndefined(filePath) {
     try {
-        const { readFile } = await import("node:fs/promises");
-        const content = await readFile(cargoPath, "utf-8");
-        return /^\s*\[workspace\]/m.test(content);
+        return await readFile(filePath, "utf-8");
     }
     catch {
+        return undefined;
+    }
+}
+/**
+ * Slice out ONE top-level TOML table's raw body — from its `[name]` heading
+ * to the next top-level `[...]`/`[[...]]` heading or EOF. `members`/`exclude`
+ * must be read from the `[workspace]` table specifically: `[package]` has its
+ * OWN `exclude` key (the standard cargo-publish exclude list, conventionally
+ * written above `[workspace]` in a virtual-manifest-less root crate), and a
+ * whole-file regex would misread it as workspace membership (#1671 F4).
+ */
+function extractTomlTableSection(content, tableName) {
+    const heading = new RegExp(`^\\[${tableName}\\][ \\t]*(?:#.*)?$`, "m");
+    const match = heading.exec(content);
+    if (!match)
+        return "";
+    const rest = content.slice(match.index + match[0].length);
+    const nextHeading = rest.match(/^\[{1,2}[^\]]+\]{1,2}[ \t]*(?:#.*)?$/m);
+    return nextHeading?.index !== undefined ? rest.slice(0, nextHeading.index) : rest;
+}
+function parseTomlStringArray(content, key) {
+    const match = content.match(new RegExp(`^[ \\t]*${key}[ \\t]*=[ \\t]*\\[([\\s\\S]*?)\\]`, "m"));
+    if (!match)
+        return [];
+    return [...match[1].matchAll(/"([^"]*)"|'([^']*)'/g)].map((m) => (m[1] ?? m[2] ?? "").trim());
+}
+/** Turn one `/`-delimited glob SEGMENT into a regex source: `*` matches any
+ * run of characters within the segment, `?` matches exactly one character,
+ * everything else is escaped and literal. */
+function segmentGlobToRegExpSource(segment) {
+    let out = "";
+    for (const ch of segment) {
+        if (ch === "*")
+            out += "[^/]*";
+        else if (ch === "?")
+            out += "[^/]";
+        else
+            out += ch.replace(/[.+^${}()|[\]\\]/g, "\\$&");
+    }
+    return out;
+}
+/**
+ * A `members`/`exclude` entry names a path exactly, or globs it segment by
+ * segment: `*` and `?` inside a segment work at any depth — one wildcard
+ * segment (`crates/*`), a bare `*`, or several chained together for a
+ * deeper fixed-depth layout — matching cargo's own `glob`-crate semantics
+ * for a fixed number of path components.
+ *
+ * KNOWN LIMITATION (#1671 F6, documented rather than implemented): a
+ * recursive `**` segment (matching a variable number of path components) is
+ * NOT supported and never matches — cargo workspaces that rely on `**` to
+ * pull in an arbitrarily-nested crate tree will under-hoist (the crate stays
+ * independently rooted instead of joining the workspace). This is
+ * deliberately out of #1671's scope: the common, and the issue's fixture,
+ * shape is an explicit fixed-depth `members` list.
+ */
+function matchesCargoWorkspacePattern(pattern, relativePath) {
+    const normalized = pattern.replace(/\/+$/, "");
+    if (normalized.includes("**"))
+        return false;
+    const patternSegments = normalized.split("/");
+    const pathSegments = relativePath.split("/");
+    if (patternSegments.length !== pathSegments.length)
+        return false;
+    return patternSegments.every((segment, i) => new RegExp(`^${segmentGlobToRegExpSource(segment)}$`).test(pathSegments[i]));
+}
+/**
+ * Given an ancestor Cargo.toml's raw contents that already contains a
+ * `[workspace]` table, decide whether it actually claims `childDir` as a
+ * member. Cargo's own default is that a bare `[workspace]` with no `members`
+ * key claims only the manifest's own package — a nested crate is NOT
+ * implicitly swept in just because it sits underneath the workspace root on
+ * disk. Without this check any Cargo.toml with a `[workspace]` table would
+ * hoist every crate below it, including ones the workspace never declared
+ * (#1671) — the same defect shape as an undeclared Maven sibling module.
+ *
+ * KNOWN LIMITATION (#1671 F7, documented rather than implemented): cargo also
+ * treats a crate as an implicit workspace member when the workspace root's
+ * OWN `[package]` has a `path = "..."` dependency on it and no explicit
+ * `members` key is present at all. That dependency-graph inference is not
+ * evaluated here — a workspace relying on it alone (no `members` key) reads
+ * as claiming nothing, so its crates stay independently rooted rather than
+ * being (correctly, per cargo) swept in. An explicit `members` list — the
+ * common case and the one #1671's fixtures exercise — is unaffected.
+ */
+function cargoWorkspaceDeclaresMember(workspaceContent, parentDir, childDir) {
+    const relativePath = path.relative(parentDir, childDir).split(path.sep).join("/");
+    if (relativePath === "" || relativePath.startsWith(".."))
+        return false;
+    const workspaceSection = extractTomlTableSection(workspaceContent, "workspace");
+    const excluded = parseTomlStringArray(workspaceSection, "exclude");
+    if (excluded.some((pattern) => matchesCargoWorkspacePattern(pattern, relativePath))) {
         return false;
     }
+    const members = parseTomlStringArray(workspaceSection, "members");
+    return members.some((pattern) => matchesCargoWorkspacePattern(pattern, relativePath));
+}
+/**
+ * Bound a monorepo-hoist walk-up by the session ceiling: when `file` is inside
+ * the session cwd, the walk must stop AT the cwd rather than climb past it —
+ * matching enforceLspRootCeiling's clamp semantics but avoiding the wasted stat
+ * calls of walking past a boundary we would clamp back down anyway. When
+ * `file` is outside the session (isolated tests, out-of-session API callers),
+ * enforceLspRootCeiling is a no-op, so the walk is left unbounded (`undefined`).
+ */
+function sessionHoistCeiling(sessionCwd, file) {
+    return isSameOrWithin(path.resolve(sessionCwd), path.resolve(file))
+        ? path.resolve(sessionCwd)
+        : undefined;
 }
 function RustWorkspaceRoot() {
     const crateRoot = createRootDetector(["Cargo.toml", "Cargo.lock"]);
@@ -1575,21 +1704,131 @@ function RustWorkspaceRoot() {
         const root = await crateRoot(file);
         if (!root)
             return undefined;
+        const sessionCwd = process.cwd();
+        // The walk-up for an ancestor Cargo.toml with a [workspace] table stays
+        // bounded by the same session ceiling the crate-root lookup above already
+        // enforces (enforceLspRootCeiling) — a monorepo hoist must never cross the
+        // session boundary just because a workspace manifest happens to sit above
+        // it (#1671).
+        const stop = sessionHoistCeiling(sessionCwd, file);
         let current = root;
         const fsRoot = path.parse(current).root;
         while (true) {
+            if (stop !== undefined && current === stop)
+                break;
             const parent = path.dirname(current);
             if (parent === current || parent === fsRoot)
                 break;
-            const parentCargo = path.join(parent, "Cargo.toml");
-            if (await hasWorkspaceSection(parentCargo)) {
-                return parent;
+            const parentCargoPath = path.join(parent, "Cargo.toml");
+            const parentCargoContent = await readTextFileOrUndefined(parentCargoPath);
+            if (parentCargoContent !== undefined && /^\s*\[workspace\]/m.test(parentCargoContent)) {
+                // Test membership against the ORIGINAL crate dir (`root`), never the
+                // walk cursor (`current`, which may already have climbed through
+                // gap directories that have no Cargo.toml of their own) — a
+                // `members = ["crates/foo"]` or `["crates/*"]` entry is relative to
+                // the workspace root, spanning the whole gap in one hop (#1671 F1).
+                if (cargoWorkspaceDeclaresMember(parentCargoContent, parent, root)) {
+                    return enforceLspRootCeiling(parent, sessionCwd, file);
+                }
+                // A workspace root exists here but its `members`/`exclude` tables do
+                // not claim this crate — stop climbing; the crate stays independently
+                // rooted rather than being swept into a workspace it opted out of.
+                break;
             }
             current = parent;
         }
         return root;
     };
 }
+/**
+ * Resolve whether `parentPomPath`'s <modules> block declares `childDir` as one
+ * of its member modules. Maven multi-module hoisting must only chain through
+ * poms that actually declare the child (an undeclared sibling directory that
+ * merely happens to sit next to a parent pom stays independently rooted) —
+ * this is the "Maven module-chain verification" #1671 asks for, as opposed to
+ * rust-analyzer's simpler "any ancestor [workspace] wins" hoist.
+ */
+/**
+ * Strip XML comments to a fixed point rather than in one pass: a single
+ * `.replace()` can leave a residual `<!--` behind on adversarially-nested
+ * input (CodeQL flags this class as "incomplete multi-character
+ * sanitization" — the removal of one comment can expose a delimiter that
+ * was itself inside another). Looping until nothing changes closes that gap.
+ */
+function stripXmlComments(content) {
+    let result = content;
+    let previous;
+    do {
+        previous = result;
+        result = result.replace(/<!--[\s\S]*?-->/g, "");
+    } while (result !== previous);
+    return result;
+}
+async function declaresMavenModule(parentDir, parentPomPath, childDir) {
+    try {
+        const content = stripXmlComments(await readFile(parentPomPath, "utf-8"));
+        const modulesBlock = content.match(/<modules>([\s\S]*?)<\/modules>/);
+        if (!modulesBlock)
+            return false;
+        const resolvedChild = path.resolve(childDir);
+        for (const match of modulesBlock[1].matchAll(/<module>\s*([^<]+?)\s*<\/module>/g)) {
+            // Case-insensitive / realpath-aware compare (#1671 F8): a declared
+            // `<module>Foo</module>` must still match a directory actually named
+            // `foo` on a case-insensitive filesystem, the same class of check the
+            // rest of this codebase does via `pathsEqual` (#1139/#1150).
+            if (pathsEqual(path.resolve(parentDir, match[1]), resolvedChild))
+                return true;
+        }
+        return false;
+    }
+    catch {
+        return false;
+    }
+}
+function JavaWorkspaceRoot() {
+    const moduleRoot = createRootDetector(["pom.xml", "build.gradle", ".classpath"]);
+    return async (file) => {
+        const root = await moduleRoot(file);
+        if (!root)
+            return undefined;
+        // Only a Maven (pom.xml) module chain-hoists here — Gradle/.classpath module
+        // roots are returned as found; multi-module Gradle wiring (settings.gradle)
+        // is a different shape and out of scope for #1671.
+        if (!(await markerExists(root, "pom.xml")))
+            return root;
+        const sessionCwd = process.cwd();
+        const stop = sessionHoistCeiling(sessionCwd, file);
+        // `current` is the walk CURSOR — it climbs over gap directories (ones
+        // with no pom.xml of their own, e.g. a `<module>sub/dir</module>` entry
+        // spanning more than one filesystem level). `lastHop` is the last
+        // CONFIRMED module boundary; it is what the next ancestor pom's
+        // <modules> must declare, and it is what actually gets returned — never
+        // the cursor, which can land on a bare gap directory that is not itself
+        // a valid module root (#1671 F2).
+        let current = root;
+        let lastHop = root;
+        const fsRoot = path.parse(current).root;
+        while (true) {
+            if (stop !== undefined && current === stop)
+                break;
+            const parent = path.dirname(current);
+            if (parent === current || parent === fsRoot)
+                break;
+            if (await markerExists(parent, "pom.xml")) {
+                const parentPom = path.join(parent, "pom.xml");
+                if (!(await declaresMavenModule(parent, parentPom, lastHop)))
+                    break;
+                current = parent;
+                lastHop = parent;
+                continue;
+            }
+            // No pom.xml here — a gap directory, not a module boundary. Keep
+            // climbing without advancing `lastHop`.
+            current = parent;
+        }
+        return enforceLspRootCeiling(lastHop, sessionCwd, file);
+    };
+}
 export const RustServer = {
     id: "rust",
     name: "rust-analyzer",
@@ -1819,7 +2058,7 @@ export const JavaServer = createInteractiveServer({
     id: "java",
     name: "JDT Language Server",
     extensions: KIND_EXTENSIONS["java"],
-    root: RootWithFallback(createRootDetector(["pom.xml", "build.gradle", ".classpath"])),
+    root: RootWithFallback(JavaWorkspaceRoot()),
     language: "java",
     command: () => process.env.JDTLS_PATH || "jdtls",
     args: (root) => createLombokJdtlsArgs(root),
@@ -2024,6 +2263,20 @@ export const ClojureServer = {
         }, options?.allowInstall);
     },
 };
+export const CueServer = {
+    id: "cue",
+    name: "CUE Language Server",
+    extensions: KIND_EXTENSIONS["cue"],
+    root: RootWithFallback(createRootDetector(["cue.mod", ".git"])),
+    async spawn(root, options) {
+        return resolveAndLaunch({
+            candidates: ["cue"],
+            args: ["lsp", "serve"],
+            cwd: root,
+            managedToolId: "cue",
+        }, options?.allowInstall);
+    },
+};
 export const TerraformServer = {
     id: "terraform",
     name: "Terraform LSP",
@@ -2402,6 +2655,13 @@ export const AstGrepServer = {
     // (it falls back to napi when the ast-grep binary is absent — Gate B).
     root: RootWithFallback(createRootDetector(["sgconfig.yml", "sgconfig.yaml"]), RootWithFallback(NearestRoot([".git"]), async () => process.cwd())),
     availabilityKey: "ast-grep",
+    // #1714: the one auxiliary with a measured wedge ceiling. A `lens_diagnostics
+    // mode=full` sweep of 225 files drove this server into an unrecoverable stall
+    // twice in two exposures (writes outstanding 5.9 s and 9.4 s, then a forced
+    // shutdown that timed out both the request and the exit notify). It re-parses
+    // the whole file on every didOpen, so it absorbs a sweep more slowly than the
+    // other scanners — hold it to half the shared default.
+    notifyInflightLimit: 4,
     // First scan of a session compiles the rules.
     initializeTimeoutMs: 15000,
     async spawn(root, options) {
@@ -2564,6 +2824,7 @@ export const LSP_SERVERS = [
     MarksmanServer,
     OCamlServer,
     ClojureServer,
+    CueServer,
     TerraformServer,
     NixServer,
     BashServer,

package/node_modules/pi-lens/dist/clients/lsp/spawn-history.js

@@ -0,0 +1,22 @@
+/** Process-lifetime history of successful LSP spawn plus initialize durations. */
+const MAX_SERVER_HISTORIES = 64;
+const successfulSpawnDurationMs = new Map();
+export function recordSuccessfulLspSpawn(serverId, durationMs) {
+    if (!Number.isFinite(durationMs) || durationMs < 0)
+        return;
+    successfulSpawnDurationMs.delete(serverId);
+    successfulSpawnDurationMs.set(serverId, durationMs);
+    while (successfulSpawnDurationMs.size > MAX_SERVER_HISTORIES) {
+        const oldest = successfulSpawnDurationMs.keys().next().value;
+        if (oldest === undefined)
+            break;
+        successfulSpawnDurationMs.delete(oldest);
+    }
+}
+export function getSuccessfulLspSpawnDurationMs(serverId) {
+    return successfulSpawnDurationMs.get(serverId);
+}
+/** Test-only: isolate process-lifetime history between cases. */
+export function _clearSuccessfulLspSpawnHistoryForTests() {
+    successfulSpawnDurationMs.clear();
+}

package/node_modules/pi-lens/dist/clients/lsp/sync-kind.js

@@ -0,0 +1,43 @@
+/**
+ * LSP `textDocument/didChange` sync-kind negotiation (#1669).
+ *
+ * A server advertises how it wants document changes described via
+ * `ServerCapabilities.textDocumentSync`, either as a bare
+ * `TextDocumentSyncKind` number (the legacy pre-3.0 shape) or as a
+ * `TextDocumentSyncOptions` object whose `change` field carries the kind.
+ * pi-lens always sent a single whole-document `{ text }` change event — valid
+ * for `Full` (1) and harmless for `None` (0, since the server ignores content
+ * changes entirely), but out of spec for `Incremental` (2): an
+ * Incremental-only server expects every change event to carry a `range`.
+ *
+ * This module is the pure negotiation core, mirroring `position-encoding.ts`'s
+ * shape: read the kind from the server's `initialize` reply, defaulting to
+ * `Full` when the server doesn't advertise one — the same shape pi-lens has
+ * always sent, so an unrecognized/absent value never regresses `Full`/`None`
+ * behavior.
+ */
+export const TEXT_DOCUMENT_SYNC_KIND_NONE = 0;
+export const TEXT_DOCUMENT_SYNC_KIND_FULL = 1;
+export const TEXT_DOCUMENT_SYNC_KIND_INCREMENTAL = 2;
+function isSyncKind(value) {
+    return value === 0 || value === 1 || value === 2;
+}
+/**
+ * The `change` sync kind the server negotiated, read from its `initialize`
+ * reply. Defaults to `Full` (pi-lens's historical always-whole-document
+ * behavior) when the server omits `textDocumentSync` entirely, or advertises
+ * a shape/value this function doesn't recognize.
+ */
+export function negotiateSyncKind(serverCapabilities) {
+    const sync = serverCapabilities?.textDocumentSync;
+    // Legacy shape: the whole field IS the kind.
+    if (isSyncKind(sync))
+        return sync;
+    // 3.0+ shape: `TextDocumentSyncOptions.change`.
+    if (sync && typeof sync === "object") {
+        const change = sync.change;
+        if (isSyncKind(change))
+            return change;
+    }
+    return TEXT_DOCUMENT_SYNC_KIND_FULL;
+}

package/node_modules/pi-lens/dist/clients/lsp/tsserver-sync.js

@@ -38,7 +38,40 @@ import { normalizeMapKey } from "../path-utils.js";
 // Constants
 // ---------------------------------------------------------------------------
 export const TSSERVER_REQUEST_COMMAND = "typescript.tsserverRequest";
-function classifyProjectInfo(body) {
+/**
+ * tsserver's synthetic inferred-project name, as its own source builds it:
+ * `"/dev/null/inferredProject" + counter + "*"`. `/dev/null` is a deliberate
+ * sentinel prefix — no real config file can live there — and matching the WHOLE
+ * string against it is the only safe test.
+ *
+ * #1645 review F4: an earlier version also matched an UNANCHORED
+ * `/inferred[-_ ]?project/i` anywhere in the string. That inverted the verdict
+ * for a real project in a directory a human happened to name that way —
+ * `/repo/inferred-project/tsconfig.json` classified as INFERRED, which demoted
+ * its genuine blocking errors. A classifier that gates authority must never key
+ * off user-controlled directory names.
+ *
+ * The optional drive-letter/backslash arm covers a host that normalizes the
+ * sentinel through win32 path handling before it reaches us; the `/dev/null`
+ * prefix is still required.
+ */
+const INFERRED_PROJECT_SENTINEL = /^(?:[A-Za-z]:)?[/\\]dev[/\\]null[/\\]inferredProject\d*\*?$/i;
+/**
+ * Classify one tsserver `projectInfo` response body.
+ *
+ * `configFileName` is tsserver's own answer to "which project owns this file".
+ * A real project answers with a `tsconfig.json`/`jsconfig.json` path; a file
+ * that matches no project's `include`/`files` lands in tsserver's synthetic
+ * inferred project, whose `configFileName` is a `/dev/null/inferredProject1*`
+ * placeholder. The two are the same field, so the placeholder shape is the only
+ * thing that separates "checked against the project's real compiler options"
+ * from "checked against defaults nobody configured" (#1640).
+ *
+ * Exported so the diagnostic-demotion seam (`inferred-project.ts`) and the
+ * #1412 telemetry probe share ONE classifier — a second hand-rolled
+ * configFileName test would be a parallel source of truth for the same verdict.
+ */
+export function classifyProjectInfo(body) {
     if (!body || typeof body !== "object") {
         return { projectKind: "unassociated", association: "unassociated" };
     }
@@ -47,8 +80,7 @@ function classifyProjectInfo(body) {
         ? info.configFileName
         : undefined;
     const inferred = configFile
-        ? /(?:^|[/\\])inferredProject\d*\*?$/i.test(configFile) ||
-            /inferred[-_ ]?project/i.test(configFile)
+        ? INFERRED_PROJECT_SENTINEL.test(configFile)
         : false;
     const projectKind = configFile
         ? inferred
@@ -132,6 +164,50 @@ export async function probeTsserverProjectIdentity(options) {
         // Best-effort telemetry: command errors/timeouts never reach diagnostics.
     }
 }
+/**
+ * #1640: ask tsserver which project owns `file`, on demand, through the same
+ * `typescript.tsserverRequest` escape hatch the sync-diagnostics helpers use.
+ *
+ * Unlike {@link probeTsserverProjectIdentity} — fire-and-forget telemetry
+ * sampled once per didOpen — this is a request/response call a caller awaits
+ * because it needs the answer to decide how to RENDER a diagnostic.
+ *
+ * Routed through `executeReadOnlyCommandOnLiveClient` ONLY, never
+ * `executeCommand` (#1645 review F1/F2). The mutation channel would open the
+ * `workspace/applyEdit` acceptance window, clobber a concurrent command's
+ * `activeMutationContext`, carry the 30s mutation backstop instead of the short
+ * probe one, and spawn a language-server fleet to answer. All four are wrong for
+ * a passive render-path question. A service without the read-only channel is
+ * UNKNOWN, not a reason to fall back.
+ *
+ * Returns `undefined` for every "we do not know" path: no read-only channel, no
+ * live server for the file, the command is not advertised (non-classic server,
+ * older typescript-language-server), the command was not executed, the response
+ * envelope is not `{success:true}`, or the call threw/timed out. `undefined`
+ * must never be treated as "inferred" — an unanswered probe is not a verdict
+ * (AGENTS.md shape 10: an empty result must distinguish clean from unavailable).
+ */
+export async function fetchTsserverProjectIdentity(svc, file) {
+    try {
+        if (typeof svc.executeReadOnlyCommandOnLiveClient !== "function") {
+            return undefined;
+        }
+        // No `getAdvertisedCommands` pre-flight: that helper routes through
+        // `getClientForFile`, which SPAWNS. The read-only channel already enforces
+        // allowlist-by-advertisement server-side and answers `executed:false` for
+        // a server that never advertised the command.
+        const outcome = await svc.executeReadOnlyCommandOnLiveClient(file, TSSERVER_REQUEST_COMMAND, ["projectInfo", { file, needFileNameList: false }]);
+        if (!outcome.executed)
+            return undefined;
+        const response = outcome.result;
+        if (!response || response.success !== true)
+            return undefined;
+        return classifyProjectInfo(response.body);
+    }
+    catch {
+        return undefined;
+    }
+}
 // ---------------------------------------------------------------------------
 // Helpers
 // ---------------------------------------------------------------------------

package/node_modules/pi-lens/dist/clients/lsp/wait-policy/strategies.js

@@ -232,6 +232,49 @@ export const SERVER_DIAGNOSTIC_STRATEGIES = {
         // warm-up attempt and its retry, with zero diagnostics either time).
         silentOnClean: true,
     },
+    // cue lsp serve (#1522, #1519, #1520). Measured directly against the real
+    // v0.17.1 binary (`getWorkspaceDiagnosticsSupport` reports
+    // `mode: "push-only"`; no pull support advertised).
+    //
+    // It reports load/parse (syntax) errors as you type, but leaves
+    // conflicting-value/constraint-failure (evaluation) errors to `cue vet`
+    // — the #1522 cue-vet auxiliary runner covers that gap. So the syntax
+    // diagnostics this strategy governs are a REAL but PARTIAL signal, not
+    // full CUE validation.
+    //
+    // silentOnClean: true — the load-bearing finding. A cold `didOpen` on an
+    // already-CLEAN file publishes NOTHING inside the wait budget (measured:
+    // `touchFile` returns `inconclusive: true, inconclusiveReason:
+    // "diagnostics-wait"` after the full budget, never an affirmative empty
+    // array). This reproduces the #1520 review's original "reports
+    // conclusively clean while still waiting" concern for the clean-cold-open
+    // case specifically. It is NOT silent on every transition, though: once a
+    // document is open and a `didChange` lands, the server DOES publish —
+    // both the error (edit clean→broken: confirmed, ~930ms warm) and an
+    // explicit empty array clearing it (edit broken→clean: confirmed,
+    // ~320ms warm, `contentHash`-bound). That edit-triggered empty publish is
+    // exactly what the shared push-only clean-confirm gate needs
+    // `silentOnClean` for — it only ever governs the "no publish, notify
+    // succeeded" case, never a case that already got a real publish.
+    //
+    // seedFirstPush: true — the one cold-open case that DOES publish (a
+    // file that is already broken) sends the complete single diagnostic on
+    // its first push; there is no observed partial-then-complete sequence to
+    // wait out.
+    //
+    // aggregateWaitMs: 2000 covers the measured warm edit-to-publish latency
+    // (~930ms, syntax reparse) with margin; a cold spawn's first push (~2.1s
+    // end-to-end including process start) is bounded separately by
+    // maxClientWaitMs, not this per-diagnostics budget.
+    cue: {
+        seedFirstPush: true,
+        pullRetryBudgetMs: 0,
+        debounceMs: 150,
+        aggregateWaitMs: 2000,
+        expectSemanticSecondPush: false,
+        reopenOnResync: false,
+        silentOnClean: true,
+    },
 };
 /** Native TS7 can publish multiple versionless partial-program snapshots for a
  * single open. Its first push is therefore provisional; a quiet window, rather