@herbertgao/pi-extensions 2026.8.6 → 2026.8.8

package/node_modules/pi-lens/dist/clients/lsp/workspace-sweep-hold.js

@@ -0,0 +1,175 @@
+/**
+ * #1618: a full workspace sweep (`LSPService.runWorkspaceDiagnostics`, the
+ * engine behind `lens_diagnostics mode=full`) grants itself a wall-clock
+ * ceiling (`FULL_SCAN_WALL_CLOCK_MS`, see {@link getFullScanWallClockMs})
+ * that can outlive the detached LSP idle-reset timer armed by
+ * `clients/runtime-turn.ts`'s `handleTurnEnd` on a file-less turn. Nothing
+ * previously stopped that timer from firing mid-sweep and destroying the
+ * very service the sweep was actively touching — every file the sweep had
+ * not yet reached then failed with zero trace and got mislabeled as budget
+ * exhaustion.
+ *
+ * This module is the shared hold: `runWorkspaceDiagnostics` acquires it for
+ * its own lifetime (try/finally, so a throw or an aborted sweep still
+ * releases it) and the idle-reset timer consults it before firing. Holds are
+ * tracked as TOKENS (acquire-time-stamped), not a bare counter — two
+ * overlapping `lens_diagnostics mode=full` calls (or a sweep started while
+ * another is still finishing) must each be free to release independently
+ * without the other's hold being dropped early.
+ *
+ * A leaked hold that never re-arms idle reset is the inverse defect (state
+ * that must re-arm cannot hide behind a stuck guard), so this module screens
+ * against it on TWO axes, matching the repo's own session-boundary +
+ * bounded-lifetime conventions:
+ *   1. `clearWorkspaceSweepHoldForSessionStart` — `resetLSPService({reason:
+ *      "session_start"})` clears every held token unconditionally. A session
+ *      boundary means no in-flight sweep from a PRIOR generation is still
+ *      meaningful to wait on.
+ *   2. `reapStaleHolds` (internal, called from every liveness check) —
+ *      force-releases any token older than {@link getWorkspaceSweepMaxHoldAgeMs},
+ *      derived from the sweep's own wall-clock ceiling plus a safety margin.
+ *      A real sweep is either done or self-aborted well within that window
+ *      (`tools/lens-diagnostics.ts` races `FULL_SCAN_WALL_CLOCK_MS`), so a
+ *      token still held past it can only be a bug — never a legitimate long
+ *      sweep — and gets force-released with its own distinct log record.
+ *
+ * `getFullScanWallClockMs` also lives here (rather than duplicated between
+ * `tools/lens-diagnostics.ts` and `clients/runtime-turn.ts`) so the idle-reset
+ * delay on every path (base AND the subagent/budget-shortened paths) can be
+ * DERIVED from the sweep's own ceiling instead of the constants drifting
+ * apart again (#1618 acceptance criterion 6).
+ */
+import { logLatency } from "../latency-logger.js";
+/** Extra headroom beyond the sweep's own wall-clock ceiling before an
+ *  idle-reset delay (or the max-hold-age failsafe) trusts that a real sweep
+ *  must be done. Single source for both derivations below AND for every
+ *  idle-reset path `clients/runtime-turn.ts` derives (base, subagent, and
+ *  budget-shortened) — never a second independently-tunable literal. */
+export const SWEEP_IDLE_SAFETY_MARGIN_MS = 60_000;
+let holds = new Map(); // holdId -> acquiredAt (Date.now())
+let nextHoldId = 1;
+let idleWaiters = [];
+function flushIdleWaitersIfEmpty() {
+    if (holds.size > 0)
+        return;
+    if (idleWaiters.length === 0)
+        return;
+    const waiters = idleWaiters;
+    idleWaiters = [];
+    for (const waiter of waiters) {
+        try {
+            waiter();
+        }
+        catch {
+            // Best-effort — a waiter failure must never propagate into the
+            // releasing/reaping call stack.
+        }
+    }
+}
+/**
+ * A held token past this age can only be a bug (leaked release, a sweep that
+ * hung outside its own abort signal, …) — a legitimate sweep is done or
+ * self-aborted well before it. Derived, not a separate literal, so it can't
+ * drift out of sync with `getFullScanWallClockMs` the way the idle-reset
+ * timer and the sweep's own ceiling once did.
+ */
+export function getWorkspaceSweepMaxHoldAgeMs() {
+    return getFullScanWallClockMs() + SWEEP_IDLE_SAFETY_MARGIN_MS;
+}
+function reapStaleHolds() {
+    if (holds.size === 0)
+        return;
+    const maxAgeMs = getWorkspaceSweepMaxHoldAgeMs();
+    const now = Date.now();
+    for (const [holdId, acquiredAt] of holds) {
+        const ageMs = now - acquiredAt;
+        if (ageMs <= maxAgeMs)
+            continue;
+        holds.delete(holdId);
+        logLatency({
+            type: "phase",
+            phase: "lsp_workspace_sweep_hold_force_released",
+            filePath: "",
+            durationMs: ageMs,
+            metadata: { holdId, maxHoldAgeMs: maxAgeMs },
+        });
+    }
+    flushIdleWaitersIfEmpty();
+}
+/**
+ * Acquire the hold for one `runWorkspaceDiagnostics` call. Returns a release
+ * function; callers MUST call it from a `finally` block so an overlapping or
+ * throwing sweep still releases its hold. Idempotent — calling the returned
+ * function more than once past the first call, or after the hold was already
+ * force-released (session reset / max-age reap), is a no-op.
+ */
+export function acquireWorkspaceSweepHold() {
+    const holdId = nextHoldId++;
+    holds.set(holdId, Date.now());
+    return () => {
+        if (!holds.delete(holdId))
+            return;
+        flushIdleWaitersIfEmpty();
+    };
+}
+/** True while at least one `runWorkspaceDiagnostics` sweep is in flight.
+ *  Reaps stale holds first, so a leaked/hung hold can't permanently read as
+ *  "active" past its own max age. */
+export function isWorkspaceSweepActive() {
+    reapStaleHolds();
+    return holds.size > 0;
+}
+/**
+ * Run `cb` once the hold count next returns to zero. Runs synchronously and
+ * immediately when no sweep is active right now — the common case, and the
+ * one every non-sweep idle-reset arm/fire takes.
+ */
+export function runWhenWorkspaceSweepIdle(cb) {
+    reapStaleHolds();
+    if (holds.size === 0) {
+        cb();
+        return;
+    }
+    idleWaiters.push(cb);
+}
+/**
+ * `resetLSPService({reason: "session_start"})` calls this: a session
+ * boundary means no hold from a PRIOR generation is still meaningful to wait
+ * on, so every held token is cleared unconditionally (state that must
+ * re-arm at session_start cannot hide behind a leaked/stuck guard from the
+ * generation before it). Only logs when there was actually something to
+ * clear — the common case (no sweep in flight at session boundary) stays
+ * silent.
+ */
+export function clearWorkspaceSweepHoldForSessionStart() {
+    if (holds.size === 0)
+        return;
+    logLatency({
+        type: "phase",
+        phase: "lsp_workspace_sweep_hold_session_reset",
+        filePath: "",
+        durationMs: 0,
+        metadata: { clearedHolds: holds.size },
+    });
+    holds.clear();
+    flushIdleWaitersIfEmpty();
+}
+/** Test-only: reset the module-scope hold state between tests. */
+export function _resetWorkspaceSweepHoldForTests() {
+    holds = new Map();
+    idleWaiters = [];
+    nextHoldId = 1;
+}
+/**
+ * Wall-clock ceiling for one `lens_diagnostics mode=full` scan
+ * (`runWorkspaceDiagnostics` plus its concurrent project-runner/analyzer
+ * work). Single source for `tools/lens-diagnostics.ts` (the sweep caller),
+ * `clients/runtime-turn.ts` (every idle-reset path, whose delay must outlive
+ * it), and this module's own max-hold-age failsafe — lazy env read, never
+ * memoized, matching this codebase's house style so a test can flip the
+ * override mid-run.
+ */
+export function getFullScanWallClockMs() {
+    const raw = Number(process.env.PI_LENS_LENS_DIAGNOSTICS_FULL_TIMEOUT_MS);
+    return Number.isFinite(raw) && raw > 0 ? raw : 300_000; // 5 min default
+}

package/node_modules/pi-lens/dist/clients/lsp-lazy.js

@@ -1,7 +1,8 @@
 /** Shared lazy LSP service seam (#1394). */
-let lspPromise;
+import { createLazyImport } from "./lazy-import.js";
+const lazyLsp = createLazyImport(() => import("./lsp/index.js"));
 export function warmLspService() {
-    return (lspPromise ??= import("./lsp/index.js"));
+    return lazyLsp.get();
 }
 export function loadLspService() {
     return warmLspService();

package/node_modules/pi-lens/dist/clients/mcp/session.js

@@ -32,7 +32,12 @@ import { handleTurnEnd } from "../runtime-turn.js";
 import { createMcpHost } from "./host-shim.js";
 let contextPromise;
 let resolvedRuntime;
-/** Lazily build (once) the persistent session context shared across MCP calls. */
+/**
+ * Lazily build (once) the persistent session context shared across MCP
+ * calls. A rejected build (e.g. `loadBootstrapClients` hitting a transient
+ * fs error) must not poison every later MCP call for the rest of the
+ * process — evict the memo on rejection so the next call retries (#1570).
+ */
 export function getMcpSessionContext() {
     contextPromise ??= (async () => {
         const context = {
@@ -43,7 +48,10 @@ export function getMcpSessionContext() {
         };
         resolvedRuntime = context.runtime;
         return context;
-    })();
+    })().catch((err) => {
+        contextPromise = undefined;
+        throw err;
+    });
     return contextPromise;
 }
 /** Synchronous peek at the session runtime, for construction sites that cannot

package/node_modules/pi-lens/dist/clients/module-report.js

@@ -162,6 +162,14 @@ async function extractFile(absPath, languageId, content) {
             let callbacks = [];
             let callbackError;
             try {
+                // SAFETY: `ModuleReportNode` is this module's own structural
+                // subset of a tree-sitter node: `type`, `text`, `children`,
+                // `parent`, `isNamed`, and the two positions. A real node
+                // implements all of it, but the two types are declared in
+                // unrelated packages so TypeScript sees no relation. The cast
+                // asserts only that structural subset; widen
+                // `ModuleReportNode` past what tree-sitter nodes provide and
+                // it stops holding.
                 callbacks = extractCallbacks(tree.rootNode, owners, languageId, warnings);
             }
             catch (error) {
@@ -1330,10 +1338,19 @@ export async function moduleReport(file, cwd, options) {
     let graph;
     let graphFileCap;
     let callGraphIdentity;
+    // #1961 review F4: the blind read now serves a snapshot stamped at a
+    // different commit. project_report says so in its trust notes; this report
+    // reads through the SAME accessor, so without this it would present the
+    // other branch's importers and call edges as current, under a builtAt that
+    // looks fresh. Computed per call, never cached.
+    let revisionDriftNote;
     try {
-        const { getCachedReviewGraph, getReviewGraphCacheIdentity, getReviewGraphSizeSkipVerdict, } = await import("./review-graph/builder.js");
+        const { getCachedReviewGraph, getReviewGraphCacheIdentity, getReviewGraphSizeSkipVerdict, getReviewGraphRevisionDrift, formatReviewGraphRevisionDriftNote, } = await import("./review-graph/builder.js");
         graph = getCachedReviewGraph(cwd);
         graphFileCap = getReviewGraphSizeSkipVerdict(cwd)?.maxFileCount;
+        const drift = graph ? getReviewGraphRevisionDrift(cwd) : undefined;
+        if (drift)
+            revisionDriftNote = formatReviewGraphRevisionDriftNote(drift);
         callGraphIdentity = graph
             ? (() => {
                 const identity = getReviewGraphCacheIdentity(cwd, graph);
@@ -1366,6 +1383,10 @@ export async function moduleReport(file, cwd, options) {
     const api = topLevel.filter((entry) => entry.exported);
     const internal = topLevel.filter((entry) => !entry.exported);
     const warnings = [...(extractionWarnings ?? [])];
+    // Every graph-derived section below (who-uses-this, blast radius, call
+    // edges) came from the served snapshot, so the caveat belongs with them.
+    if (revisionDriftNote)
+        warnings.push(revisionDriftNote);
     if (callbackError) {
         warnings.push(`Failed to extract callbacks: ${callbackError}`);
         logLatency({

package/node_modules/pi-lens/dist/clients/ndjson-logger.js

@@ -131,6 +131,35 @@ export function getRegisteredLogFiles() {
 export function _resetRegisteredLogFilesForTest() {
     registeredLogFiles.clear();
 }
+/**
+ * Snapshot of unrecovered write losses, one entry per sink that has any
+ * (#1970). Pure in-memory read — no I/O, so a caller (`degradation-ledger.ts`)
+ * can fold this into a durable ledger entry without this module ever writing
+ * a record about its own failure through the sink that is failing. See
+ * `NdjsonWriterState.writeFailures` for the recursion-hazard rationale.
+ */
+export function getSinkWriteFailures() {
+    if (!ndjsonGlobalState)
+        return [];
+    const result = [];
+    for (const state of ndjsonGlobalState.writers.values()) {
+        if (state.writeFailures > 0) {
+            result.push({ file: state.file, droppedCount: state.writeFailures });
+        }
+    }
+    return result;
+}
+/**
+ * Session-boundary reset (catalog shape 17: a process-lifetime latch must
+ * re-arm at session_start). Wired into `resetDegradationLedger()` so both
+ * reset together; also used directly by tests.
+ */
+export function resetSinkWriteFailures() {
+    if (!ndjsonGlobalState)
+        return;
+    for (const state of ndjsonGlobalState.writers.values())
+        state.writeFailures = 0;
+}
 function requireCurrentGlobalState() {
     if (ndjsonGlobalState)
         return ndjsonGlobalState;
@@ -159,17 +188,46 @@ function assertCompatibleWriterOptions(existing, maxBytes, backupPath) {
     throw new Error(`createNdjsonLogger: incompatible options for shared path ${existing.file}; ` +
         `the first writer's maxBytes/backupPath must be reused`);
 }
+function writeQueueItemSync(state, item) {
+    if (item.kind === "truncate") {
+        fs.writeFileSync(state.file, "");
+    }
+    else {
+        rotateIfNeeded(state);
+        fs.appendFileSync(state.file, item.line);
+    }
+}
+/**
+ * The pi-analyze #15 shape (#1970): a write that throws — including the
+ * `ERR_STREAM_DESTROYED` a torn-down sink produces — gets one reopen-and-
+ * retry before it counts as a loss. There is no persistent handle to close
+ * here (every write already opens, writes, and closes in one call), so
+ * "reopen" means dropping the cached `ensuredDir` assumption and
+ * re-verifying the parent directory before the retry — the one piece of
+ * cross-write state this module holds that a destroyed sink could have
+ * invalidated. An unrecovered write is counted, never thrown or retried a
+ * second time (`applyQueueItemSync`, `applyQueueItemAsync`, and the batched
+ * write in `drainLoop` skip DIFFERENT amounts of work per queue item, so
+ * each keeps its own copy of this two-step shape rather than sharing one
+ * generic retry wrapper across sync/async).
+ */
 function applyQueueItemSync(state, item) {
     ensureDirSync(state);
-    runBestEffort(() => {
-        if (item.kind === "truncate") {
-            fs.writeFileSync(state.file, "");
-        }
-        else {
-            rotateIfNeeded(state);
-            fs.appendFileSync(state.file, item.line);
-        }
-    });
+    try {
+        writeQueueItemSync(state, item);
+        return;
+    }
+    catch {
+        // fall through to the one reopen-and-retry
+    }
+    state.ensuredDir = false;
+    ensureDirSync(state);
+    try {
+        writeQueueItemSync(state, item);
+    }
+    catch {
+        state.writeFailures += 1;
+    }
 }
 function flushStateSync(state) {
     // Drain the in-memory queue synchronously — safe at process exit.
@@ -208,6 +266,9 @@ function createWriterState(file, maxBytes, backupPath) {
         assertCompatibleWriterOptions(existing, maxBytes, backupPath);
         if (!exitFlushers.has(existing.exitFlusher))
             registerWriter(existing);
+        // A state adopted from a pre-#1970 module graph predates this field.
+        if (typeof existing.writeFailures !== "number")
+            existing.writeFailures = 0;
         return existing;
     }
     const state = {};
@@ -220,6 +281,7 @@ function createWriterState(file, maxBytes, backupPath) {
     state.syncRepairItems = null;
     state.ensuredDir = false;
     state.exitFlusher = () => flushStateSync(state);
+    state.writeFailures = 0;
     globalState.writers.set(file, state);
     registerWriter(state);
     return state;
@@ -258,23 +320,36 @@ function rotateIfNeeded(state) {
         // no file yet, or rename raced — nothing to rotate
     }
 }
+async function writeQueueItemAsync(state, item) {
+    if (item.kind === "truncate") {
+        await fs.promises.writeFile(state.file, "");
+    }
+    else {
+        // Rotation is deliberately synchronous here. This function is only
+        // reached from the already-deferred drain, and keeping stat/rm/rename
+        // in one synchronous section prevents flushSync from racing a late
+        // async rename after it has written new data.
+        rotateIfNeeded(state);
+        await fs.promises.appendFile(state.file, item.line);
+    }
+}
+/** See `applyQueueItemSync`'s doc comment for the reopen-and-retry-once shape. */
 async function applyQueueItemAsync(state, item) {
     await ensureDirAsync(state);
     try {
-        if (item.kind === "truncate") {
-            await fs.promises.writeFile(state.file, "");
-        }
-        else {
-            // Rotation is deliberately synchronous here. This function is only
-            // reached from the already-deferred drain, and keeping stat/rm/rename
-            // in one synchronous section prevents flushSync from racing a late
-            // async rename after it has written new data.
-            rotateIfNeeded(state);
-            await fs.promises.appendFile(state.file, item.line);
-        }
+        await writeQueueItemAsync(state, item);
+        return;
     }
     catch {
-        // telemetry is best-effort
+        // fall through to the one reopen-and-retry
+    }
+    state.ensuredDir = false;
+    await ensureDirAsync(state);
+    try {
+        await writeQueueItemAsync(state, item);
+    }
+    catch {
+        state.writeFailures += 1;
     }
 }
 async function drainLoop(state) {
@@ -292,7 +367,7 @@ async function drainLoop(state) {
             ? [item]
             : state.queue.slice(0, pendingEnd);
         state.inFlightBatch = pending;
-        try {
+        const writeBatch = async () => {
             if (item.kind === "truncate") {
                 await fs.promises.writeFile(state.file, "");
             }
@@ -305,9 +380,25 @@ async function drainLoop(state) {
                     .map((queued) => queued.line)
                     .join(""));
             }
+        };
+        try {
+            await writeBatch();
         }
         catch {
-            // telemetry is best-effort
+            // Reopen-and-retry once (#1970, pi-analyze #15 shape): a destroyed
+            // sink (ERR_STREAM_DESTROYED) or a directory that vanished mid-session
+            // gets exactly one recovery attempt before the batch counts as a loss.
+            state.ensuredDir = false;
+            await ensureDirAsync(state);
+            try {
+                await writeBatch();
+            }
+            catch {
+                // Unrecovered: count every line in this batch as dropped. Purely
+                // in-memory — see `writeFailures`'s doc comment for why this must
+                // never itself attempt a durable write through this same sink.
+                state.writeFailures += pending.length;
+            }
         }
         for (const written of pending) {
             // flushSync may have drained this prefix while the append is in

package/node_modules/pi-lens/dist/clients/opengrep-client.js

@@ -42,13 +42,19 @@
  * So `opengrepResultToProjectDiagnostics` deliberately applies NO suppression
  * filtering of its own — doing so would be redundant at best.
  *
- * Refs: #584, #111 (opengrep adoption), #387 (workspace-sweep serialization)
+ * Scope note (#1562 class fix): the CLI scan is handed `--exclude` per shared
+ * scratch/cache tree (`scratch-tree-policy.ts`) so a directory that isn't
+ * gitignored (opengrep's own default exclusion) still doesn't reach the
+ * agent as a finding — same `EXCLUDED_DIRS`-derived list gitleaks/trivy use.
+ *
+ * Refs: #584, #111 (opengrep adoption), #387 (workspace-sweep serialization), #1562
  */
 import * as fs from "node:fs";
 import * as os from "node:os";
 import * as path from "node:path";
 import { mkdtempSync } from "node:fs";
 import { resolveOpengrepConfig } from "./opengrep-config.js";
+import { getScratchTreeDirNames } from "./scratch-tree-policy.js";
 import { safeSpawnAsync } from "./safe-spawn.js";
 import { SecurityScanClient } from "./security-scan-client.js";
 const EMPTY_RESULT = {
@@ -116,6 +122,14 @@ export class OpengrepClient extends SecurityScanClient {
                 "--no-error",
                 "--quiet",
                 "--disable-version-check",
+                // #1562 class fix: opengrep's own `.gitignore` respect covers the
+                // common case (scratch trees are usually gitignored), but not a
+                // scratch/cache tree that ISN'T (e.g. an un-gitignored worktree
+                // cache) — `--exclude` is semgrep-compatible, so a slash-free
+                // pattern matches that directory name anywhere in the tree,
+                // independent of gitignore. Same `EXCLUDED_DIRS`-derived list
+                // gitleaks/trivy use, so the three scanners can't drift apart.
+                ...getScratchTreeDirNames().flatMap((name) => ["--exclude", name]),
                 cwd,
             ], { cwd, timeout: SCAN_TIMEOUT_MS });
             if (result.error) {