@herbertgao/pi-extensions 2026.9.0 → 2026.9.2

package/node_modules/pi-lens/dist/clients/read-guard.js

@@ -822,6 +822,27 @@ export class ReadGuard {
         return (stored !== undefined &&
             (this.reads.has(stored) || this.writtenThisSession.has(stored)));
     }
+    /**
+     * Every path this guard has a read or a write record for, as normalized keys
+     * (#2430).
+     *
+     * This is the read-guard half of the observational net's TRACKED-FILE SET:
+     * the files pi-lens has actually seen this session, which the `agent_settled`
+     * sweep hash-checks instead of walking the workspace. It reads state already
+     * held in memory and stats nothing; both backing containers are capped
+     * (`READ_GUARD_MAX_UNCONSUMED_FILES`), so the result is bounded by
+     * construction.
+     *
+     * `touchFile` is deliberately NOT called: enumerating is not using, and
+     * refreshing every entry's idle clock on each sweep would make the idle
+     * eviction unreachable.
+     */
+    getTrackedPaths() {
+        const tracked = new Set(this.reads.keys());
+        for (const written of this.writtenThisSession)
+            tracked.add(written);
+        return [...tracked];
+    }
     /**
      * Drop all record of a path pi-lens confirmed no longer exists on disk
      * (#1668, external delete). Without this a later write reusing the same
@@ -1375,8 +1396,11 @@ export class ReadGuard {
             return filePath.endsWith(suffix);
         }
         if (pattern.includes("*")) {
-            // Convert glob to regex
-            const regex = new RegExp(`^${pattern.replace(/\\/g, "\\\\").replace(/\./g, "\\.").replace(/\*/g, ".*")}$`);
+            // Adjacent stars are equivalent to one star in this dialect. Collapse
+            // them before compiling so a non-match cannot backtrack over every
+            // nullable `.*` group (#2622).
+            const collapsedPattern = pattern.replace(/\*+/g, "*");
+            const regex = new RegExp(`^${collapsedPattern.replace(/\\/g, "\\\\").replace(/\./g, "\\.").replace(/\*/g, ".*")}$`);
             return regex.test(filePath);
         }
         return filePath === pattern;

package/node_modules/pi-lens/dist/clients/recent-touches.js

@@ -37,7 +37,7 @@ import { getProjectDataDir } from "./file-utils.js";
 import { normalizeFilePath } from "./path-utils.js";
 export const RECENT_TOUCHES_MAX_ENTRIES = 50;
 /** Freshness window for the CHILD session_start consumer (15 minutes). */
-export const RECENT_TOUCHES_FRESHNESS_MS = 15 * 60 * 1000;
+const RECENT_TOUCHES_FRESHNESS_MS = 15 * 60 * 1000;
 function recentTouchesPath(cwd) {
     return path.join(getProjectDataDir(cwd), "recent-touches.json");
 }
@@ -46,7 +46,7 @@ function recentTouchesPath(cwd) {
 // INTO the same nudge pipeline, so one switch governs the whole path
 // (producer, both consumers) as specified in the issue.
 let _enabledCache;
-export function isRecentTouchesEnabled() {
+function isRecentTouchesEnabled() {
     if (_enabledCache === undefined) {
         _enabledCache = process.env.PI_LENS_AGENT_NUDGE !== "0";
     }

package/node_modules/pi-lens/dist/clients/resource-sampler.js

@@ -25,11 +25,11 @@
  * **synchronously in that detached callback**, which no `try { await pidusage }
  * catch {}` at the call site can catch → uncaughtException → the pi host
  * crashes (#620, #533). pidusage 4.0.1 exposes no option to avoid the gwmi
- * path. So on Windows this module runs its OWN fully guarded
- * `Get-CimInstance Win32_Process` query (see `sampleProcessesWindows`),
- * mirroring `findDescendantPidsWindows`'s guard pattern, and computes CPU%
- * from the same KernelModeTime/UserModeTime delta-over-elapsed formula gwmi
- * uses — so a spawn failure can only ever lose a data point, never throw.
+ * path. So on Windows this module asks the shared, fully guarded process-table
+ * seam (`clients/process-snapshot.ts` over `scripts/lib/process-scan.mjs`,
+ * #2443) for the CPU/RSS columns instead, and computes CPU% from the same
+ * KernelModeTime/UserModeTime delta-over-elapsed formula gwmi uses — so a
+ * spawn failure can only ever lose a data point, never throw.
  *
  * Every export here is best-effort: a sampling failure (pid already exited,
  * `pidusage` throwing, permission denied, etc.) must never throw into the
@@ -43,11 +43,10 @@
  * process/pidusage involvement — mirrors the pure/impure split in
  * clients/instance-reaper.ts (`decideOrphanReaping` vs `sweepOrphans`).
  */
-import * as path from "node:path";
 import pidusage from "pidusage";
-import { spawnCollectStdoutResult } from "./child-unref.js";
 import { recordDegradationOnce } from "./degradation-ledger.js";
 import { terminateScannerChild } from "./instance-reaper.js";
+import { queryProcessTable } from "./process-snapshot.js";
 export const RESOURCE_SAMPLE_QUERY_TIMEOUT_MS = 2_000;
 function recordQueryFailure(subject, status, exitCode) {
     const exitReason = status === "exit-error" ? ` (exit code ${exitCode ?? "unknown"})` : "";
@@ -112,41 +111,31 @@ export function walkDescendantPids(rootPid, pairs) {
 async function findDescendantPidsWindows(rootPid) {
     if (!runningOnWindows() || !Number.isFinite(rootPid) || rootPid <= 0)
         return [];
-    // One WQL query pulls every process's (pid, parentPid) pair; walk the BFS
-    // in JS rather than issuing N queries for N tree levels.
-    const psScript = "Get-CimInstance Win32_Process " +
-        "| Select-Object -Property ProcessId,ParentProcessId " +
-        '| ForEach-Object { "$($_.ProcessId),$($_.ParentProcessId)" }';
-    const powershell = path.join(process.env.SystemRoot ?? String.raw `C:\Windows`, "WindowsPowerShell", "v1.0", "powershell.exe");
-    // Fire-and-forget, per-poll-tick spawn (#1155): `spawnCollectStdout` unrefs
-    // the child AND its piped stdout so this one-shot CIM query can never keep
-    // a settled `pi --print` process alive past its own close — mirrors the
-    // reaper's identical spawn→collect plumbing (#1153/#1160). Sampling still
-    // works normally in an interactive/long-lived session: unref only means
-    // "don't hold the loop open FOR this alone," the collected stdout is still
-    // delivered whenever `close` fires. The result status keeps a failed query
-    // distinct from a successful empty process table.
-    const result = await spawnCollectStdoutResult(powershell, ["-NoProfile", "-NonInteractive", "-Command", psScript], { shell: false, windowsHide: true, stdio: ["ignore", "pipe", "ignore"] }, {
+    // One query pulls every process's (pid, parentPid) pair; walk the BFS in
+    // JS rather than issuing N queries for N tree levels. The listing itself is
+    // the shared seam (#2443), which also supplies the fire-and-forget spawn
+    // rails this call has always needed (#1155): the child AND its piped stdout
+    // are unref'd, so this one-shot query can never keep a settled
+    // `pi --print` process alive past its own close, and a scanner child that
+    // blows the timeout is tree-killed and verified rather than abandoned. The
+    // result status keeps a failed query distinct from a successful empty
+    // process table.
+    const result = await queryProcessTable({ fields: ["pid", "ppid"] }, {
         timeoutMs: RESOURCE_SAMPLE_QUERY_TIMEOUT_MS,
-        onTimeout: (child) => terminateScannerChild(child, {}),
+        onTimeout: (child) => terminateScannerChild(child, {
+            kind: "resource-sampler-scanner-escalated",
+            timeoutMs: RESOURCE_SAMPLE_QUERY_TIMEOUT_MS,
+        }),
     });
     if (result.status !== "ok") {
         recordQueryFailure("windows-descendant-process-table", result.status, result.exitCode);
         return null;
     }
-    const pairs = [];
-    for (const line of result.stdout.split(/\r?\n/)) {
-        const [pidStr, ppidStr] = line.split(",");
-        const pid = Number(pidStr);
-        const ppid = Number(ppidStr);
-        if (Number.isFinite(pid) && Number.isFinite(ppid)) {
-            pairs.push([pid, ppid]);
-        }
-    }
-    return walkDescendantPids(rootPid, pairs);
+    return walkDescendantPids(rootPid, result.rows.map((row) => [row.pid, row.ppid]));
 }
 const windowsCpuHistory = new Map();
 const CPU_HISTORY_MAX_AGE_MS = 60_000;
+const CPU_HISTORY_MAX_ENTRIES = 4_096;
 /**
  * TEST-ONLY: clear the Windows CPU%-history so a test's two-sample CPU%
  * assertion starts from a known-empty state (module-level state otherwise
@@ -155,43 +144,57 @@ const CPU_HISTORY_MAX_AGE_MS = 60_000;
 export function __resetWindowsCpuHistoryForTests() {
     windowsCpuHistory.clear();
 }
+export function __windowsCpuHistorySizeForTests() {
+    return windowsCpuHistory.size;
+}
+export function __windowsCpuHistoryHasForTests(pid, processIdentity) {
+    return windowsCpuHistory.has(`${pid}:${processIdentity}`);
+}
 /**
- * Windows-only CPU%/RSS sampling via a FULLY GUARDED `Get-CimInstance
- * Win32_Process` query (mirrors `findDescendantPidsWindows`): a synchronous
- * throw from `spawn` (the `spawn UNKNOWN` crash vector, #620), a `child`
- * `error` event, or a non-zero/garbage exit all resolve to an errored/absent
- * map — this function can NEVER throw or reject. Deliberately does NOT call
- * `pidusage`, whose unguarded internal `gwmi` spawn is the crash we're fixing.
+ * Windows-only CPU%/RSS sampling through the FULLY GUARDED process-table
+ * seam (mirrors `findDescendantPidsWindows`): a synchronous throw from
+ * `spawn` (the `spawn UNKNOWN` crash vector, #620), a `child` `error` event,
+ * or a non-zero/garbage exit all resolve to an errored/absent map — this
+ * function can NEVER throw or reject. Deliberately does NOT call `pidusage`,
+ * whose unguarded internal `gwmi` spawn is the crash we're fixing.
  *
- * RSS comes from `WorkingSetSize`; CPU% from `KernelModeTime`+`UserModeTime`
- * (both in 100 ns units → ms via `/1e4`) differenced against this pid's prior
- * sample over the elapsed wall time — the same computation pidusage's gwmi
- * path uses. The first time a pid is seen it has no prior sample, so CPU% is
- * reported as 0 for that tick and a real rate lands on the next one.
+ * RSS comes from `WorkingSetSize` (`rssBytes`); CPU% from `KernelModeTime`
+ * plus `UserModeTime` (both in 100 ns units → ms via `/1e4`) differenced
+ * against this pid's prior sample over the elapsed wall time — the same
+ * computation pidusage's gwmi path uses. The first time a pid is seen it has
+ * no prior sample, so CPU% is reported as 0 for that tick and a real rate
+ * lands on the next one. The process creation date (`startedAt`) is the
+ * pid-reuse discriminator: a recycled pid must not inherit the previous
+ * process's CPU baseline.
  */
 async function sampleProcessesWindows(valid) {
     const samples = new Map();
     if (valid.length === 0)
         return samples;
-    // pids are pre-validated finite positive integers, so this WQL filter is
-    // injection-safe. One line per pid: "pid,workingSet,kernel100ns,user100ns".
-    const filter = valid.map((p) => `ProcessId=${p}`).join(" or ");
-    const psScript = `Get-CimInstance Win32_Process -Filter "${filter}" ` +
-        "| Select-Object -Property ProcessId,WorkingSetSize,KernelModeTime,UserModeTime " +
-        '| ForEach-Object { "$($_.ProcessId),$($_.WorkingSetSize),$($_.KernelModeTime),$($_.UserModeTime)" }';
-    const powershell = path.join(process.env.SystemRoot ?? String.raw `C:\Windows`, "WindowsPowerShell", "v1.0", "powershell.exe");
-    // Fire-and-forget, per-poll-tick spawn (#1155): `spawnCollectStdout` unrefs
-    // the child AND its piped stdout so this one-shot CIM query can never keep
-    // a settled `pi --print` process alive past its own close — mirrors the
-    // reaper's identical spawn→collect plumbing (#1153/#1160). It also absorbs
-    // both failure modes this function used to guard inline — a synchronous
-    // `spawn` throw (the `spawn UNKNOWN` crash vector, #620) and an async
-    // `error` event, or a non-zero exit — the result status keeps failure distinct
-    // map. Sampling still works normally in an interactive/long-lived
-    // session: unref only means "don't hold the loop open FOR this alone."
-    const query = await spawnCollectStdoutResult(powershell, ["-NoProfile", "-NonInteractive", "-Command", psScript], { shell: false, windowsHide: true, stdio: ["ignore", "pipe", "ignore"] }, {
+    // pids are pre-validated finite positive integers, and the seam validates
+    // them again before they reach the query text, so the filter is
+    // injection-safe. The seam also supplies the fire-and-forget spawn rails
+    // (#1155: the child and its piped stdout are unref'd, so this one-shot
+    // query cannot keep a settled `pi --print` alive past its own close) and
+    // absorbs every failure mode this function used to guard inline — a
+    // synchronous `spawn` throw (the `spawn UNKNOWN` crash vector, #620), an
+    // async `error` event, a timeout, or a non-zero exit — reporting each
+    // through `status` rather than as an indistinguishable empty table.
+    const query = await queryProcessTable({
+        fields: [
+            "pid",
+            "rssBytes",
+            "cpuKernel100ns",
+            "cpuUser100ns",
+            "startedAt",
+        ],
+        filter: { column: "ProcessId", op: "eq", values: valid },
+    }, {
         timeoutMs: RESOURCE_SAMPLE_QUERY_TIMEOUT_MS,
-        onTimeout: (child) => terminateScannerChild(child, {}),
+        onTimeout: (child) => terminateScannerChild(child, {
+            kind: "resource-sampler-scanner-escalated",
+            timeoutMs: RESOURCE_SAMPLE_QUERY_TIMEOUT_MS,
+        }),
     });
     if (query.status !== "ok") {
         recordQueryFailure("windows-process-table", query.status, query.exitCode);
@@ -200,20 +203,37 @@ async function sampleProcessesWindows(valid) {
     try {
         const now = Date.now();
         const seen = new Set();
-        for (const line of query.stdout.split(/\r?\n/)) {
-            const parts = line.split(",");
-            if (parts.length < 4)
-                continue;
-            const pid = Number(parts[0]);
-            const workingSet = Number(parts[1]);
-            const kernel100ns = Number(parts[2]);
-            const user100ns = Number(parts[3]);
-            if (!Number.isFinite(pid) || pid <= 0)
-                continue;
-            if (!Number.isFinite(workingSet))
+        for (const row of query.rows) {
+            const pid = row.pid;
+            const workingSet = row.rssBytes;
+            const kernel100ns = row.cpuKernel100ns;
+            const user100ns = row.cpuUser100ns;
+            const processIdentity = row.startedAt ?? "";
+            // The seam already rejects a non-integer or negative column as
+            // UNKNOWN (undefined), so an absent value here means the row cannot
+            // be sampled — never that the process used zero.
+            if (workingSet === undefined ||
+                kernel100ns === undefined ||
+                user100ns === undefined ||
+                processIdentity.length === 0)
                 continue;
             const cpuMs = Math.round(kernel100ns / 1e4) + Math.round(user100ns / 1e4);
-            const prev = windowsCpuHistory.get(pid);
+            const historyKey = `${pid}:${processIdentity}`;
+            // A reused PID must start a fresh rate window. Drop every prior identity
+            // for this PID before looking up the current one.
+            for (const [key, prior] of windowsCpuHistory) {
+                if (prior.processIdentity !== processIdentity &&
+                    key.startsWith(`${pid}:`)) {
+                    windowsCpuHistory.delete(key);
+                }
+            }
+            const prev = windowsCpuHistory.get(historyKey);
+            if (prev && cpuMs < prev.cpuMs) {
+                // A counter reset is not a flat sample. Retire the baseline so the
+                // next valid observation starts a new rate window.
+                windowsCpuHistory.delete(historyKey);
+                continue;
+            }
             let cpuPercent = 0;
             if (prev) {
                 const wallMs = now - prev.ts;
@@ -223,16 +243,30 @@ async function sampleProcessesWindows(valid) {
                         cpuPercent = 0;
                 }
             }
-            windowsCpuHistory.set(pid, { cpuMs, ts: now });
+            windowsCpuHistory.set(historyKey, { processIdentity, cpuMs, ts: now });
             seen.add(pid);
             samples.set(pid, { rssBytes: workingSet, cpuPercent });
         }
         // Prune stale history so pids that have gone away don't accumulate.
-        for (const [pid, entry] of windowsCpuHistory) {
+        for (const [key, entry] of windowsCpuHistory) {
+            const pid = Number(key.slice(0, key.indexOf(":")));
             if (!seen.has(pid) && now - entry.ts > CPU_HISTORY_MAX_AGE_MS) {
-                windowsCpuHistory.delete(pid);
+                windowsCpuHistory.delete(key);
             }
         }
+        while (windowsCpuHistory.size > CPU_HISTORY_MAX_ENTRIES) {
+            let oldestKey;
+            let oldestTs = Number.POSITIVE_INFINITY;
+            for (const [key, entry] of windowsCpuHistory) {
+                if (entry.ts < oldestTs) {
+                    oldestKey = key;
+                    oldestTs = entry.ts;
+                }
+            }
+            if (oldestKey === undefined)
+                break;
+            windowsCpuHistory.delete(oldestKey);
+        }
     }
     catch {
         // Parsing must never throw into the caller; best-effort.
@@ -264,6 +298,11 @@ export async function sampleProcesses(pids) {
             const stat = stats[String(pid)];
             if (!stat)
                 continue; // pidusage couldn't resolve this pid — leave absent
+            if (!Number.isFinite(stat.cpu) ||
+                stat.cpu < 0 ||
+                !Number.isFinite(stat.memory) ||
+                stat.memory < 0)
+                continue;
             result.set(pid, {
                 rssBytes: stat.memory,
                 cpuPercent: stat.cpu,
@@ -313,28 +352,88 @@ export class UsageAccumulator {
     }
 }
 /**
- * Brackets one transient spawn with a short-interval poll. Usage:
+ * #2358: sample a live process tree twice across a short window and answer
+ * whether it burned CPU above `floorPercent`.
  *
- *   const sampler = startSpawnUsageSampler(child.pid);
- *   child.on("close", () => {
- *     const usage = sampler.stop(); // null if never got a single sample
- *   });
+ * The notify-stall breaker uses this to tell a BUSY server (burning a core
+ * while it drains a burst) from a genuinely DEAD input path (flat CPU), and
+ * only tears the latter down. It reuses the same platform machinery as
+ * `startSpawnUsageSampler`: on Windows the direct child may be a `cmd`/`.cmd`
+ * shim that does no work itself, so the live descendant tree resolves once per
+ * read and CPU% is summed across it.
  *
- * `intervalMs` defaults to 750ms — inside the issue's suggested 500ms-1s
- * band, cheap enough not to become a new source of measurable overhead for
- * the (usually sub-few-second) analyzer children this brackets. Best-effort:
- * a poll tick that throws (pid already gone, sampling error) is silently
- * skipped — it never stops the timer or the spawn early, and `stop()` is
- * always safe to call even if zero samples ever landed.
- *
- * Windows note: `clients/safe-spawn.ts` spawns with `shell: true` on Windows,
- * so `pid` here is `cmd.exe`'s pid, not the real tool's — sampling it alone
- * would report near-zero usage for the whole invocation. Each Windows tick
- * resolves `pid`'s live descendant tree (`findDescendantPidsWindows`) and
- * sums usage across `pid` + every descendant, so a `node`/`npx`-wrapped tool
- * (or one that re-execs itself) is actually captured. POSIX spawns are
- * unwrapped (`shell: false`), so `pid` there is already the real tool.
+ * Best-effort like every other export here: a failed query loses a data point,
+ * it never throws, and it never blocks for longer than the query timeouts plus
+ * `windowMs`. The target itself must resolve for `measured` to be true;
+ * missing descendants are partial but valid evidence. An unmeasurable target
+ * answers `{ busy: false, measured: false }` for the caller to classify.
  */
+export async function sampleProcessTreeCpuPercent(pid, windowMs = 1200, floorPercent = 10) {
+    if (!Number.isFinite(pid) || pid <= 0) {
+        return { busy: false, measured: false, cpuPercent: null };
+    }
+    const targetPid = pid;
+    const readOnce = async () => {
+        try {
+            const descendants = runningOnWindows()
+                ? await findDescendantPidsWindows(targetPid)
+                : [];
+            if (descendants === null)
+                return null;
+            const pids = runningOnWindows()
+                ? [targetPid, ...descendants]
+                : [targetPid];
+            const usageByPid = await sampleProcesses(pids);
+            if (usageByPid === null)
+                return null;
+            const targetUsage = usageByPid.get(targetPid);
+            if (!targetUsage)
+                return { cpuPercent: 0, measured: false };
+            let cpuPercent = 0;
+            for (const usage of usageByPid.values())
+                cpuPercent += usage.cpuPercent;
+            return { cpuPercent, measured: true };
+        }
+        catch {
+            return null;
+        }
+    };
+    // The FIRST read is a BASELINE, not evidence: it re-anchors this pid's CPU
+    // history (Windows' own map, pidusage's on POSIX) so the second read is a
+    // rate over `windowMs` and nothing else. Both reads must retain the target;
+    // disappearance or query failure is explicitly unmeasured, never flat.
+    const first = await readOnce();
+    const second = await new Promise((resolve) => {
+        const timer = setTimeout(() => {
+            void readOnce().then(resolve);
+        }, windowMs);
+        timer.unref?.();
+    });
+    if (first === null && second === null) {
+        return { busy: false, measured: false, cpuPercent: null };
+    }
+    if (first === null ||
+        second === null ||
+        !first.measured ||
+        !second.measured) {
+        return { busy: false, measured: false, cpuPercent: null };
+    }
+    // #2358 (post-#2382): the verdict is the WINDOW read alone. Whatever the
+    // baseline read reports is a rate since the LAST caller's observation —
+    // clients/quiet-window.ts's heartbeat samples every recorded LSP child once
+    // per tick, and pidusage keeps 60 s of per-pid history — so folding it in
+    // (`Math.max(first, second)`) let CPU the process had already stopped
+    // burning vote "busy". A scanner that drained its burst and then wedged (the
+    // issue's own opengrep evidence) was therefore deferred as progressing and
+    // died at the hard cap, misrecorded as `cap-exceeded`, instead of being torn
+    // down on its budget as `budget-exceeded-cpu-flat`.
+    const observed = second.cpuPercent;
+    return {
+        busy: observed > floorPercent,
+        measured: true,
+        cpuPercent: observed,
+    };
+}
 export function startSpawnUsageSampler(pid, intervalMs = 750) {
     if (!Number.isFinite(pid) || pid <= 0) {
         return { stop: () => null };