@herbertgao/pi-extensions 2026.9.1 → 2026.9.2

package/node_modules/pi-lens/CHANGELOG.md

@@ -16,6 +16,90 @@ All notable changes to pi-lens will be documented in this file.
 
 ### Security
 
+## [4.1.5] - 2026-09-08
+
+### Added
+
+- **Dogfood knip on pi-lens's own source (closes #2698)** — `knip.jsonc` now resolves the compiled-sibling layout (`clients/*.js` sitting gitignored beside `clients/*.ts` after `npm run build`) that previously made knip report 491 source files "unused"; `npm run knip` (advisory in `lint.yml`, `continue-on-error`) purges those build artifacts before every run, declares the real `mcp/`/`scripts/` entry points, and documents each dependency/binary/file exemption it needed (husky, `@biomejs/biome`, `typescript-language-server`, `markdownlint-cli2`, two parked/dynamically-loaded files) with the reason knip can't see the usage on its own.
+
+- **`PreToolUse` Bash guard hook for the fixer/reviewer non-negotiables (closes #2699)** — `scripts/hooks/guard-bash.mjs`, registered in `.claude/settings.json` on the Bash tool via `${CLAUDE_PROJECT_DIR}`, mechanically denies `git stash` in any form, `git reset --soft origin/<branch>` / `--hard`, a hand-typed `git worktree remove` with two force flags, and an unpinned `node` probe that loads runtime code from `clients/`/`dist/` with no `PI_LENS_HOME` — the same rules a fixer ran afoul of by hand on 2026-09-07 and 2026-09-02. Command text is read by a single region pass that subtracts what bash cannot execute (comments, and heredoc bodies — a PR description, an issue comment, a written file) before anything is tokenized, so a forbidden command *mentioned* in a document is never mistaken for one being run; a heredoc body with an unquoted delimiter still has its `$( )`/backtick substitutions scanned, because bash does expand those. Never blocks the tool on its own failure: malformed or missing stdin degrades to allow.
+
+- **Add per-analyzer `knip.enabled`, `jscpd.enabled`, `madge.enabled`, `gitleaks.enabled`, `govulncheck.enabled`, `deadCode.enabled`, and `complexity.enabled` keys plus `startup.mode` and `startup.scans.enabled` controls (refs #2721)** — project and global configuration can disable startup analyzers or heavyweight startup scans while preserving diagnostics and LSP.
+
+### Changed
+
+- **Nightly tracking-issue updates share one reusable CLI (closes #2683)** — compat-smoke, install-smoke, and clean-signal drift use one exact-title issue seam that fails loudly on a GitHub error and searches beyond the first page; both smoke workflows now auto-close their tracker on a clean run.
+
+- **oxlint advisory tier (categories, plugins, type-aware) and publint on the packed tarball (refs #2700, refs #2697)** — `npm run lint:js` (gating) additionally denies 32 individually-named rules from the `suspicious`/`perf` categories and the `import`/`promise`/`typescript`/`unicorn`/`oxc` plugins that produce zero findings on master today. A new `npm run lint:js:advisory` runs the full intended set — categories `correctness`+`suspicious`+`perf`, plugins `typescript`+`unicorn`+`promise`+`import`+`oxc`, and `--type-aware` (paired `oxlint-tsgolint@7.0.2001` devDependency, per oxlint 1.80.0's own `peerDependencies` pin) — over the whole repo including tests, with eight rules policy-allowed for named reasons (four are overwhelming test-tree noise, four are documented false positives on deliberate patterns: a `void`-ignored promise in a callback, an explicit `.call(bus, …)` this-binding, a side-effect import, and an AbortSignal property poll). It runs as a new `oxlint (advisory)` job in `lint.yml`, classified advisory by the repo's `(advisory)` name-suffix convention (no `continue-on-error`) — the job's own conclusion is green whenever the type-aware sweep actually ran (a rule-count floor guards against a silently-degraded `oxlint-tsgolint` peer) regardless of how many un-triaged findings it reports, and red only on that degradation. A governance test resolves both scripts' real enabled-rule sets via oxlint's own `--print-config` and asserts the gating set stays a subset of the advisory set.
+
+  `ci.yml`'s `prod-install-build` job now packs the built package (`npm pack`) and runs `publint` on the tarball (gating) — the check #2587's manifest regression was missing. `attw` (arethetypeswrong) is not added: the package ships no `.d.ts` at all, so there is nothing for it to grade; `docs/release-qa-baseline.md` records both facts under the `npm-pack` modality.
+
+- **Internal: 295 unused exports, 235 unused exported types and 4 duplicate exports removed, with the 85 declarations that became dead (refs #2708)** — no user-facing behaviour changes; the public entry points, the MCP server and every script keep their exports. Found by knip with tests counted as entry points, so nothing a test imports was touched.
+
+- **knip advisory job green: the last three unused test-support exports are private, the dead `scripts/hooks/**/*.ts` entry pattern is gone, and the path-spawned `jscpd` devDependency is credited (closes #2708)** — `testSourceFiles`, `testsRelative` and `SCAN_INFRASTRUCTURE` in `tests/support/flake-shape-scan.ts` had no importer after #2749; the hooks are `.mjs`, so the `.ts` entry pattern matched nothing.
+
+- **Cleared 51 of the 54 knip rows (23 of the 26 unused test exports; the 3 flake-shape rows stay for #2742) and 28 unused exported test types (refs #2708)** — test-support APIs are now private where their consumers are local, while the packaging workflow's pinned `publint` dependency remains declared and documented to Knip.
+
+- **Advisory CI adds jscpd, yamllint, typos, and taplo (refs #2706)** — pinned tooling jobs make duplication, YAML style, spelling, and TOML checks visible without blocking the merge train.
+
+- **Delegated-worker contract: handoff files for workers without Git authority (refs #2733, #2721)** — `docs/pi-lens-subagent.md` and the AGENTS.md role-contract section now name the `PR_BODY.md` / `COMMIT_MSG.txt` worktree-root handoff the orchestrator commits from, and the sandbox test incantation (`--configLoader runner`, offline grammar prefetch) that plegma codex workers need.
+
+- **Reviewer contract diffs from the merge base** — two reviews this week reported another lane's merge in reverse as a HIGH regression because they diffed two-dot against a newer `origin/master`; the contract now names the three-dot form.
+
+### Fixed
+
+- Keep admission registry ordering checks mutation-sensitive.
+
+- **Turn-end session test doubles use the shared runner-error predicate (closes #2673)** — partial runner errors with `failed === 0` now exercise the same classification as production instead of requiring `passed === 0` in four local `formatResult` doubles.
+
+- **yamllint, ruff, spellcheck, psscriptanalyzer, oxlint, and shellcheck now lint from the project's cwd, not the extension host's (closes #2691)** — six dispatch runners already computed `ctx.cwd` for their availability probe and config-detection helper, then spawned the actual lint/analysis process without passing that same `cwd`. yamllint's config discovery walks upward from the process's cwd, so it could silently pick up the wrong `.yamllint` (or none) when the extension host's own working directory differed from the project being linted; the other five get the same `cwd` for consistency with their probes, and typos additionally resolves any `extend-exclude` patterns against it. A new sweep over every `safeSpawnAsync`/`safeSpawnSync` call site under `clients/dispatch/runners/*.ts` — including spawns routed through a same-file helper, which is checked at the helper's own call sites — fails by file:line on any that omit `cwd`, so the next tool with this shape can't slip through a symbol-only check the way this one did for five runners after #1731 fixed sqlfluff.
+
+- **Call-site sweeps now share the AST-backed `sweep-kit.callSites` seam (refs #2694)** — runner cwd and real-process detectors no longer hand-roll balanced-parenthesis scans, so nested syntax, comments, and strings cannot change a call's boundaries.
+
+- **The sweep-floor meta-sweep now matches floor calls over comment- and string-blanked source (closes #2710)** — the meta-sweep registered a test file as floor-covered whenever `/assertNonEmptyScan\s*\(/` or the `auditRegistry({…minScanned…})` pattern matched its raw source, so a docblock merely quoting the helper name excused a sweep that made no real floor call (AGENTS.md shape 38; the same raw-vs-blanked mismatch #2693 round 2 F1 fixed in the runner-spawn-cwd sweep). Registration now runs through `stripSource`, and fixture tests pin that a prose-only mention is reported uncovered while a real call still registers.
+
+- **PHP LSP (intelephense) now installs (closes #2722)** — the managed installer verified every npm tool by spawning `--version`, and intelephense has no CLI: it prints ~4 MB of bundled source before the "connection input stream is not set" line that proves it is a healthy stdio server, and Node drops everything past 1 MiB of a piped stderr, so that proof never reached pi-lens and the installer deleted the package it had just installed — every time, since 2026-04-17. A managed npm server can now declare that it is verified from the installed tree instead (package manifest + entry module on disk, no spawn at all), which intelephense does; and for every tool still verified by spawning, a probe that ran out of readable output before it could decide now keeps the installation when the installed tree is intact (an incomplete tree is still cleaned up so the next install can repair it) instead of treating "cannot tell" as "broken".
+
+- **Custom LSP servers that never publish diagnostics are navigation-only, not timed out (closes #2765)** — a custom server with no pull-diagnostics provider gets one bounded first-contact push wait per session; silence for the full push budget latches it navigation-only (no wait on later files, a distinct summary bucket, never counted clean), a publish latches it push-capable, concurrent first touches share the one probe, and a hook-deadline cutoff stays unconfirmed instead of latching; a rejected or shutdown-aborted shared probe fails closed for every waiting touch, clears its single-flight entry and is retried without latching.
+
+- **Read-guard exemption globs and the file-utils directory glob no longer backtrack on adjacent wildcards (closes #2622)** — runs of adjacent `*` are collapsed to one before compiling, which is semantically identical for the `*`-only dialect and removes the measured backtracking (a 12-star pattern against a 40-component path took >15 s before the fix and ~2 ms after it); a differential corpus pins both matchers' answers unchanged.
+
+- **The install-time warm-loader log now honors `PI_LENS_HOME` (closes #2628)** — agent-worktree installs no longer write `warm_loader_cache` records to the maintainer's real `~/.pi-lens/install.log` when the worktree home is pinned.
+
+- Require title close keywords to be repeated in the PR body, preventing the four 2026-09-06 incidents including #2610's merge commit from appearing to close issues that GitHub left open.
+
+- **The flake-shape ratchet now sees child processes routed through test support helpers (refs #2653)** — code-channel calls to `gitFixtureSpawnAsync`, `safeSpawnAsync`, and the other support helpers that reach `node:child_process` now join the real-process census.
+
+- **Managed npm refreshes deduplicate shared packages (closes #2666)** — one package update now covers every registered tool id that shares its package, preserving refresh budget slots for other packages.
+
+- **Hold the merge train for unconcluded gating checks (closes #2679)** — Keep approved PRs pending until every non-advisory check reaches a terminal conclusion.
+
+- **`scripts/npm-retry.mjs` annotates `infra: registry unreachable` only for network-shaped failures (closes #2684)** — a deterministic npm failure (`ERESOLVE`, `E404`, `EINTEGRITY`, `ETARGET`) now stops after one attempt with a plain "failed after N attempt(s)" line and the exit code preserved, while timeouts, spawn errors, and the restored shared `NET_PATTERN` plus npm-local transient patterns keep the retry backoff and origin/master's `failed 3 times` infra annotation; network evidence wins over a mixed deterministic code, and unknown non-network failures retain retry behavior.
+
+- **LSP and smoke harness scratch directories use liveness-gated cleanup (closes #2688, closes #2687)** — shared per-run scratch directories record their owner process, preserve live workspaces, remove dead or aged orphaned entries, and announce each scratch home for reliable telemetry discovery.
+
+- **Guard-bash preserves here-string boundaries and classifies heredoc substitutions the way bash expands them (closes #2705, refs #2726)** — `<<<` is consumed as a here-string operator instead of being re-read as a phantom heredoc delimiter; an unclosed `$(` or backtick in an unquoted heredoc body is treated as non-executable while later live commands remain classified; and a valid `$()` or backtick substitution discovered before a later unclosed one stays classified, with substitutions nested inside the malformed span kept inert like bash.
+
+- **Fail the oxlint advisory tier when type-aware support is unavailable (refs #2709)** — `lint:js:advisory` now checks that `oxlint-tsgolint` resolves, exposes its binary, and satisfies oxlint's declared peer range before running.
+
+- **A red `Tool smoke (nightly)` run now notifies through a persistent tracking issue, on the failure path too (closes #2723)** — the workflow's only tracking-issue writer (`Notify on silentOnClean drift`, #529/#594) sat behind the LSP handshake layer step with `continue-on-error: true` but no `if: always()`, so GitHub skipped it — and everything after it — exactly when an earlier step failed: 13 consecutive red nights (2026-08-26 → 2026-09-07) with no automated notice, and that notifier is scoped to unrelated `silentOnClean` telemetry regardless. The three gating steps (Tool layer, LSP handshake layer, Format layer — the only three without `continue-on-error`) now each carry an `id:` and a captured `tee` log, feeding a new, final `if: always()` step that reads all three outcomes into `scripts/notify-tool-smoke-red.mjs`: it upserts a single persistent tracking issue naming the failing layer, the `✗` rows with reason text, and a consecutive-red count, closing it automatically on the first fully green run. Mirrors `install-smoke.yml`'s existing `Notify install drift` step and reuses its four-outcome (`success`/`failure`/`cancelled`/`skipped`) classification and drift-issue title lookup rather than re-deriving them; cross-references #2683's not-yet-landed consolidation of these notifiers.
+
+- **Heredoc bodies no longer leak into Bash command analysis (refs #2726)** — `tokenizeShellCommand` now consumes `<<` and `<<-` bodies, stops delimiter parsing at shell metacharacters, drops quoted body text, and retains substitutions from unquoted bodies so git-guard does not classify prose as an executable command.
+
+- **Turn-end test failures now reach the next model context without a terminal entry (closes #2733)** — settled failures keep their provenance and advisory framing, survive session reset until delivery, then deliver once through the next context build. Rehydration matches the stable session id only, so `--session` quit-and-resume works across activation owners while in-process activation isolation stays in the pending map. Pull diagnostics and MCP turn-end handling remain unchanged.
+
+- **Test ratchets now ignore comment and string laundering when matching source requirements (closes #2736)** — the Git-fixture, NDJSON writer, runner outcome, flake-shape, and LSP double-admission header detectors now use `stripSource`-based evidence, preserving string literals only where they carry the command or import path being checked.
+
+- **Formatters now run from the project root (closes #2756)** — `formatFile` uses the nearest formatter config or `.gitignore`, with a real `.git` fallback capped at `$HOME`, so `.prettierignore`, `.gitignore`, and cwd-discovered configs resolve as at the CLI. Prettier, Biome, and oxfmt are covered.
+
+- **Remove the unused scratch export and declaration, and fix oxfmt violations in two tests (refs #2759).**
+
+- **Nightly tool smoke: the six `--install` steps share one tool tree again (refs #2762, refs #2687)** — #2755 dropped the job-level `PI_LENS_HOME`/`PILENS_DATA_DIR` pin from `tool-smoke.yml` and `parser-smoke.yml`, so the Format layer started from an empty scratch home and seven managed formatters ran against nothing; the pin and its workflow test are restored, per-run scratch isolation stays the local default.
+
+- **Format smoke rows classify typed unavailable outcomes as skips (refs #2767)** — The format smoke harness no longer reports missing formatter executables as formatting failures.
+
+- **Ledger fields no longer read `[object Object]`, and a rejected LSP push-wait no longer surfaces as an unhandled rejection (refs #2700)** — `normalizeForLedger` serialises plain objects and arrays instead of `String()`-ing them (a value with its own throwing `toString` still raises into the ledger's corrupted-input failsafe); the LSP push-wait settle marker attaches on both the resolve and the reject path. Found by the oxlint type-aware pass (`no-base-to-string`, `no-floating-promises`); the same pass's `preserve-caught-error` sites now carry `{ cause }`.
+
 ## [4.1.4] - 2026-09-07
 
 Patch release carrying everything merged since 4.1.3 (152 entries, including 12 under Added and 2 under Deprecated — the additions are extension-internal and CI/test-harness surfaces, no new user-facing commands). Release-QA (`scripts/release-qa.mjs`, #2606) reports SHIP on pi 0.80.10 and pi 0.85.1: 11 of 11 rows witnessed, 0 failed, 0 skipped, git-install row included.

package/node_modules/pi-lens/dist/clients/actionable-warnings-logger.js

@@ -33,10 +33,3 @@ export function logActionableWarningsEvent(entry) {
             : {}),
     });
 }
-export function getActionableWarningsLogPath() {
-    return AW_LOG_FILE;
-}
-/** Resolve once all enqueued actionable-warnings writes are on disk. */
-export function flushActionableWarningsLog() {
-    return writer.flush();
-}

package/node_modules/pi-lens/dist/clients/advisory-provenance.js

@@ -223,7 +223,7 @@ export function validateAdvisoryProvenance(record, cwd, runtime) {
 //     of which any #1461 slice writes yet, so nothing here currently touches
 //     it.
 /** Stat budget: one per unique cited path, sharing the envelope's own cap. */
-export const MAX_FINDING_PATH_STATS = MAX_ADVISORY_AFFECTED_FILES;
+const MAX_FINDING_PATH_STATS = MAX_ADVISORY_AFFECTED_FILES;
 /** How many dead paths a single drop record names before it stops. */
 const MAX_LOGGED_DEAD_PATHS = 3;
 /**

package/node_modules/pi-lens/dist/clients/ast-grep-client.js

@@ -61,7 +61,7 @@ function reportAstGrepRulesHealth(bundledRuleDir) {
  * Exported for tests: they drive it against a registered bridge instead of
  * spawning ast-grep.
  */
-export function recordAstGrepApply(matches) {
+function recordAstGrepApply(matches) {
     const bridge = getMutationBridge();
     if (!bridge || matches.length === 0)
         return;

package/node_modules/pi-lens/dist/clients/ast-grep-tool-logger.js

@@ -115,11 +115,4 @@ export function logAstGrepToolEvent(event) {
     };
     writer.log({ ts: new Date().toISOString(), ...payload });
 }
-export function getAstGrepToolLogPath() {
-    return AG_LOG_FILE;
-}
-/** Resolve once all enqueued ast-grep-tool writes are on disk. */
-export function flushAstGrepToolLog() {
-    return writer.flush();
-}
 export { countLines as _countLinesForTest };

package/node_modules/pi-lens/dist/clients/ast-grep-types.js

@@ -6,3 +6,5 @@
  * - ast-grep-rule-manager.ts
  */
 export {};
+// =============================================================================
+// JSON FORMAT (ast-grep CLI output)

package/node_modules/pi-lens/dist/clients/bash-file-access.js

@@ -29,8 +29,121 @@ function stripQuotes(token) {
     }
     return token;
 }
+function parseHeredocDelimiter(command, start) {
+    let i = start;
+    const stripTabs = command[i] === "-";
+    if (stripTabs)
+        i += 1;
+    while (/\s/.test(command[i] ?? ""))
+        i += 1;
+    let delimiter = "";
+    let quoted = false;
+    while (i < command.length && !/[\s;&|<>]/.test(command[i] ?? "")) {
+        const ch = command[i];
+        if (ch === "'" || ch === '"') {
+            quoted = true;
+            const quote = ch;
+            i += 1;
+            while (i < command.length && command[i] !== quote) {
+                delimiter += command[i++];
+            }
+            if (command[i] !== quote)
+                return undefined;
+            i += 1;
+            continue;
+        }
+        if (ch === "\\") {
+            quoted = true;
+            i += 1;
+            if (i >= command.length)
+                return undefined;
+            delimiter += command[i++];
+            continue;
+        }
+        delimiter += ch;
+        i += 1;
+    }
+    if (!delimiter)
+        return undefined;
+    return { heredoc: { delimiter, stripTabs, quoted }, end: i - 1 };
+}
+function heredocSubstitutionBodies(body) {
+    const substitutions = [];
+    for (let i = 0; i < body.length; i += 1) {
+        if (body.startsWith("$(", i)) {
+            let depth = 1;
+            let quote;
+            for (let end = i + 2; end < body.length; end += 1) {
+                const ch = body[end];
+                if (quote === "single") {
+                    if (ch === "'")
+                        quote = undefined;
+                    continue;
+                }
+                if (quote === "double") {
+                    if (ch === '"' && body[end - 1] !== "\\")
+                        quote = undefined;
+                    continue;
+                }
+                if (ch === "'" || ch === '"') {
+                    quote = ch === "'" ? "single" : "double";
+                }
+                else if (body.startsWith("$(", end)) {
+                    depth += 1;
+                    end += 1;
+                }
+                else if (ch === ")") {
+                    depth -= 1;
+                    if (depth === 0) {
+                        substitutions.push(body.slice(i + 2, end));
+                        i = end;
+                        break;
+                    }
+                }
+            }
+        }
+        else if (body[i] === "`" && body[i - 1] !== "\\") {
+            const end = body.indexOf("`", i + 1);
+            if (end >= 0) {
+                substitutions.push(body.slice(i + 1, end));
+                i = end;
+            }
+        }
+    }
+    return substitutions;
+}
+function consumeHeredocBodies(command, start, heredocs) {
+    let cursor = start;
+    const substitutions = [];
+    for (const heredoc of heredocs) {
+        const bodyStart = cursor;
+        let found = false;
+        while (cursor < command.length) {
+            const lineEnd = command.indexOf("\n", cursor);
+            const end = lineEnd < 0 ? command.length : lineEnd;
+            let line = command.slice(cursor, end);
+            if (heredoc.stripTabs)
+                line = line.replace(/^\t+/, "");
+            if (line.replace(/\r$/, "") === heredoc.delimiter) {
+                if (!heredoc.quoted)
+                    substitutions.push(...heredocSubstitutionBodies(command.slice(bodyStart, cursor)));
+                cursor = lineEnd < 0 ? end : end + 1;
+                found = true;
+                break;
+            }
+            cursor = lineEnd < 0 ? end : end + 1;
+        }
+        if (!found) {
+            if (!heredoc.quoted)
+                substitutions.push(...heredocSubstitutionBodies(command.slice(bodyStart)));
+            return { end: command.length - 1, substitutions };
+        }
+    }
+    return { end: cursor - 1, substitutions };
+}
 export function tokenizeShellCommand(command) {
     const segments = [];
+    const pendingHeredocs = [];
     let tokens = [];
     let word = "";
     let quote;
@@ -114,12 +227,21 @@ export function tokenizeShellCommand(command) {
                 i++;
             continue;
         }
-        if (/\s/.test(ch)) {
+        if (/\s/.test(ch) && ch !== "\n") {
             flushWord();
             continue;
         }
         if (ch === ";" || ch === "\n" || ch === "|" || ch === "&") {
             flushWord();
+            if (ch === "\n" && pendingHeredocs.length > 0) {
+                const heredocs = pendingHeredocs.splice(0);
+                flushSegment();
+                const consumed = consumeHeredocBodies(command, i + 1, heredocs);
+                for (const substitution of consumed.substitutions)
+                    segments.push(...tokenizeShellCommand(substitution));
+                i = consumed.end;
+                continue;
+            }
             let terminator;
             if (ch === "|" && next === "|")
                 i++;
@@ -136,6 +258,16 @@ export function tokenizeShellCommand(command) {
         }
         if (ch === "<" || ch === ">") {
             flushWord();
+            if (ch === "<" &&
+                next === "<" &&
+                command[i - 1] !== "<" &&
+                command[i + 2] !== "<") {
+                const parsed = parseHeredocDelimiter(command, i + 2);
+                if (parsed) {
+                    pendingHeredocs.push(parsed.heredoc);
+                    i = parsed.end;
+                }
+            }
             unsupported = true;
             continue;
         }

package/node_modules/pi-lens/dist/clients/blocker-freshness.js

@@ -167,12 +167,6 @@ async function resolveForwardImportsMemoized(cwd, filePath, resolveForwardImport
     });
     return imports;
 }
-/** Test-only: clear the extractor and import-resolution memos. */
-export function _resetBlockerFreshnessForTests() {
-    extractorCache.clear();
-    importResolutionMemo.clear();
-    importResolutionMemoTurnIndex = undefined;
-}
 /**
  * Production forward-import resolver. Parses `filePath` with its tree-sitter grammar
  * and resolves every extracted import source to in-project files. Degrades to an

package/node_modules/pi-lens/dist/clients/bootstrap.js

@@ -114,7 +114,7 @@ const bootstrapFlight = createSingleFlight();
  * budget — it is the liveness bound AGENTS.md's both-bounds rule requires, so
  * a wedged module evaluation cannot park a `tool_call` handler forever.
  */
-export const BOOTSTRAP_LOAD_TIMEOUT_MS = 10_000;
+const BOOTSTRAP_LOAD_TIMEOUT_MS = 10_000;
 /**
  * How many consecutive failed builds before the seam stops rebuilding.
  *
@@ -129,7 +129,7 @@ export const BOOTSTRAP_LOAD_TIMEOUT_MS = 10_000;
  * the demand fails OPEN immediately, and `session_start` re-arms the latch so
  * a repaired environment is never locked out for the life of the process.
  */
-export const BOOTSTRAP_FAILURE_STRIKE_LIMIT = 3;
+const BOOTSTRAP_FAILURE_STRIKE_LIMIT = 3;
 /**
  * A stand-in for an analysis client whose module failed to load (an unresolved
  * runtime dependency under a package-manager layout the resolver can't traverse
@@ -268,7 +268,7 @@ async function buildBootstrapClients() {
  * {@link requestBootstrapClients} never says which on its own, so the reason
  * travels in the bounded record and the ledger entry instead.
  */
-export const BOOTSTRAP_UNAVAILABLE_REASONS = [
+const BOOTSTRAP_UNAVAILABLE_REASONS = [
     "shutdown",
     "timeout",
     "aborted",
@@ -276,7 +276,7 @@ export const BOOTSTRAP_UNAVAILABLE_REASONS = [
     "latched",
 ];
 /** A demand that could not be served. Carries the discriminating reason. */
-export class BootstrapUnavailableError extends Error {
+class BootstrapUnavailableError extends Error {
     unavailableReason;
     constructor(unavailableReason, message) {
         super(message);

package/node_modules/pi-lens/dist/clients/bounded-pid-file-lock.js

@@ -194,7 +194,7 @@ export function acquireBoundedPidFileLock(lockPath, options) {
                     options.logContention();
                     return null;
                 }
-                throw new Error(options.timeoutMessage);
+                throw new Error(options.timeoutMessage, { cause: error });
             }
             Atomics.wait(waitArray, 0, 0, options.retryMs);
         }

package/node_modules/pi-lens/dist/clients/bounded-telemetry.js

@@ -171,11 +171,6 @@ export const BOUNDED_TELEMETRY_PHASES = [
      */
     "observed_handled_evicted",
 ];
-const REGISTERED_PHASES = new Set(BOUNDED_TELEMETRY_PHASES);
-/** Report whether a phase name is in the registry (used by the sweep). */
-export function isBoundedTelemetryPhase(phase) {
-    return REGISTERED_PHASES.has(phase);
-}
 /**
  * Per-turn admission counters, keyed by turn and phase. Multiple turns remain
  * live because async work can finish T1 after T2 has already emitted. The map

package/node_modules/pi-lens/dist/clients/bus-events-logger.js

@@ -22,8 +22,7 @@
  * This module gives bus events the same durable trace every other pi-lens
  * subsystem already has (latency.log, cascade.log, read-guard.log, ...) —
  * see clients/latency-logger.ts for the house pattern this mirrors exactly:
- * one shared `createNdjsonLogger` writer, `isTestMode()` no-op guard,
- * `getBusEventsLogPath()` for testability.
+ * one shared `createNdjsonLogger` writer, `isTestMode()` no-op guard.
  *
  * Logging volume: `emitted` and `emit_failed` are logged on every call —
  * they're the two outcomes an operator actually needs a per-event trace for.
@@ -104,10 +103,3 @@ export function emitBusEventRollupAtSessionEnd(cwd) {
     }
     resetBusEventRollupCounts();
 }
-export function getBusEventsLogPath() {
-    return BUS_EVENTS_LOG_FILE;
-}
-/** Resolve once all enqueued bus-event writes are on disk (tests/shutdown). */
-export function flushBusEventsLog() {
-    return writer.flush();
-}

package/node_modules/pi-lens/dist/clients/cache-observability.js

@@ -91,7 +91,7 @@ const CHARS_PER_ESTIMATED_TOKEN = 4;
  */
 export const DEFAULT_PROVIDER_CACHE_TTL_MS = 60_000;
 const _providerCacheTtl = lazyEnvNumber("PI_LENS_PROVIDER_CACHE_TTL_MS", DEFAULT_PROVIDER_CACHE_TTL_MS);
-export const getProviderCacheTtlMs = _providerCacheTtl.get;
+const getProviderCacheTtlMs = _providerCacheTtl.get;
 export const _resetProviderCacheTtlForTests = _providerCacheTtl._resetForTests;
 /**
  * A turn counts as "anomalously low" when it reads back less than half of what
@@ -1165,11 +1165,6 @@ export function resetCachePrefixObservation() {
     prefixHashBySession.clear();
     attributionBySession.clear();
 }
-/** #2442 test-only membership reads, bypassing emitCacheUsageSummaryAtSessionEnd's
- *  usageRecords>0 gate and log side effects. */
-export function _attributionKeyForTests(sessionId, sessionRole) {
-    return attributionKey(sessionId, sessionRole);
-}
 export function _attributionBySessionHasForTests(key) {
     return attributionBySession.has(key);
 }

package/node_modules/pi-lens/dist/clients/cargo-manifest.js

@@ -177,7 +177,7 @@ export function parseTomlStringArray(content, key) {
  * true`) never matches either — the literal key is immediately followed by
  * `=`, not `.`.
  */
-export function parseTomlScalarString(content, key) {
+function parseTomlScalarString(content, key) {
     if (content === undefined)
         return undefined;
     const match = content.match(new RegExp(`^[ \\t]*${key}[ \\t]*=[ \\t]*(?:"([^"]*)"|'([^']*)')`, "m"));
@@ -292,7 +292,7 @@ export function readCargoDependencyNames(content) {
  * (`edition.workspace = true`) or the inline-table form
  * (`edition = { workspace = true }`).
  */
-export function isTomlKeyWorkspaceInherited(content, key) {
+function isTomlKeyWorkspaceInherited(content, key) {
     if (content === undefined)
         return false;
     const dotted = new RegExp(`^[ \\t]*${key}\\.workspace[ \\t]*=[ \\t]*true`, "m");

package/node_modules/pi-lens/dist/clients/cascade-logger.js

@@ -29,10 +29,3 @@ export function logCascade(entry) {
         filePath: normalizeLoggedPath(entry.filePath),
     });
 }
-export function getCascadeLogPath() {
-    return CASCADE_LOG_FILE;
-}
-/** Resolve once all enqueued cascade writes are on disk (tests/shutdown). */
-export function flushCascadeLog() {
-    return writer.flush();
-}

package/node_modules/pi-lens/dist/clients/child-unref.js

@@ -2,7 +2,7 @@
  * Shared plumbing for best-effort, fire-and-forget child-process spawns
  * (shape 4 of the recurring-defect catalog in AGENTS.md: "a timer / promise /
  * worker / child that outlives its one-shot settle"). Extracted from the
- * orphan reaper's `unrefReaperChild`/`spawnCollectStdout` (#1153/#1160) into a
+ * orphan reaper's `unrefReaperChild` (#1153/#1160) into a
  * shared, dependency-free module so every one-shot
  * `spawn(..., { stdio: ["ignore","pipe",...] })` call site in the codebase —
  * the reaper's enumeration/kill spawns AND the resource sampler's Windows
@@ -46,24 +46,6 @@ export function unrefChildAndPipes(child) {
     }
 }
 /**
- * Spawn a best-effort, fire-and-forget child, accumulate its full stdout, and
- * resolve with the collected text (empty string on a synchronous spawn
- * failure or an `error` event). Consolidates the spawn → unref →
- * pipe-stdout → `close` plumbing shared by every one-shot OS-process-table
- * query in the codebase — each caller supplies only its command/args/options
- * and does its own output parse. The child + its stdio pipes are `unref`'d
- * here (via `unrefChildAndPipes`) so a settled one-shot `pi --print` process
- * can exit without waiting, and both the unref and the collect plumbing live
- * in exactly ONE place rather than being re-derived at each spawn site.
- * Never rejects — any failure resolves to `""`, which every caller's parse
- * turns into an empty/absent result (the best-effort contract every caller
- * here already has).
- */
-export function spawnCollectStdout(command, args, options) {
-    return spawnCollectStdoutResult(command, args, options).then((result) => result.stdout);
-}
-/**
- * `spawnCollectStdout` plus the reason the output is what it is. Same spawn,
  * unref, collect, settle plumbing; the only additions are an optional hard
  * timeout and a status discriminator. Never rejects.
  */

package/node_modules/pi-lens/dist/clients/config-core/index.js

@@ -31,17 +31,20 @@
  * (`loadPiLensProjectConfig`) are now projections of one resolution. #2416
  * brings the `lsp.servers.<id>` shape the schema currently only reserves.
  */
-export { additionalPropertyPolicy, DEFAULT_MERGE_STRATEGY, DENY_KEY, DENY_POLICIES, denyPolicyOf, isDenyPolicy, isConfigObject, isKnownSchemaType, isMergeStrategy, isPlainObject, isSchemaNode, itemsSchema, keyedField, MERGE_STRATEGY_KEY, mergeStrategyOf, propertySchema, SCHEMA_TYPES, schemaType, STABILITY_TIER_KEY, } from "./schema.js";
-export { compareKeys, isOperatorTier, isRepoTier, provenanceFor, provenanceView, SOURCE_TIERS, TIER_CLASS, TIER_PRECEDENCE, tierPrecedence, } from "./provenance.js";
-export { isUnsafeConfigKey, MAX_CONFIG_DEPTH, safeAssign, UNSAFE_CONFIG_KEYS, UNSAFE_KEY_REASON, } from "./safe-object.js";
-export { denyProvenance, resolveArrayDeny, resolveBooleanDeny, } from "./deny.js";
-export { validate, } from "./normalize.js";
-export { boundedKeyLabel, jsonTypeName, MAX_MIGRATION_RECORDS, MAX_RECORD_KEY_LENGTH, MigrationRecordCollector, migrationSubject, } from "./records.js";
-export { buildProcessSpec, MAX_ARGV_BYTES, MAX_ARGV_ENTRIES, MAX_ENV_BYTES, MAX_ENV_ENTRIES, MAX_TIMEOUT_MS, redactProcessSpec, toSpawnArgs, } from "./process-spec.js";
+export { SOURCE_TIERS } from "./provenance.js";
+// `merge()` itself is NOT re-exported. Its input type only PROMISES a
+// post-`validate()` value; nothing in the language enforces that a caller
+// who imports it directly honors the promise, and `merge()`'s own bounds are
+// a narrow backstop, not a second validator (see `merge.ts`'s module doc).
+// `resolveConfig` (re-exported at the bottom of this file, from `resolve.js`)
+// is the one supported way in: it always validates
+// every source before merging. `merge()` stays exported from `merge.ts`
+// itself — marked `@internal` there — for this module's own use and for
+// tests that probe it directly.
 // `resolveConfig` and its types live in `./resolve.js` (#2426) so a caller can
 // import the front door without also importing this barrel's width — in
 // particular `process-spec.js` -> `project-trust.js`, which closed three
 // import cycles once the config loaders (all downstream of `file-utils.ts`)
 // started resolving through the core. The public surface is unchanged: this is
 // still where the supported entry point is exported from.
-export { resolveConfig, } from "./resolve.js";
+export { resolveConfig } from "./resolve.js";

package/node_modules/pi-lens/dist/clients/config-core/process-spec.js

@@ -36,7 +36,7 @@ import { compareKeys, isRepoTier, } from "./provenance.js";
 /** Longest argv a spec may carry. A command line, not a file list. */
 export const MAX_ARGV_ENTRIES = 128;
 /** Total argv bytes a spec may carry. */
-export const MAX_ARGV_BYTES = 32 * 1024;
+const MAX_ARGV_BYTES = 32 * 1024;
 /** Most env entries a spec may carry. */
 export const MAX_ENV_ENTRIES = 64;
 /** Total env bytes (names plus values) a spec may carry. */

package/node_modules/pi-lens/dist/clients/config-core/provenance.js

@@ -11,7 +11,7 @@
  *
  * Two orderings live here, and they are NOT the same ordering:
  *
- * - `TIER_PRECEDENCE` decides who wins a plain value. Later beats earlier, so a
+ * - `SOURCE_TIERS` decides who wins a plain value. Later beats earlier, so a
  *   CLI flag beats a project file beats a global file beats a built-in default.
  * - `TIER_CLASS` decides who may LIFT a deny. `deny.ts` builds monotonic deny
  *   precedence on this split, and nothing else re-derives it.
@@ -34,13 +34,6 @@ export const SOURCE_TIERS = [
     "cli",
     "host",
 ];
-/**
- * Value precedence, lowest first. A later tier's value replaces an earlier
- * tier's value for the same leaf. `merge()` sorts its sources by this order
- * rather than trusting caller order, so a caller that assembles sources in a
- * different order cannot silently invert precedence.
- */
-export const TIER_PRECEDENCE = SOURCE_TIERS;
 /**
  * Who each tier speaks for. THREE classes, not two (#2440 review finding F3).
  *
@@ -79,7 +72,7 @@ export const TIER_CLASS = {
 };
 /** Numeric precedence of a tier. Higher wins. */
 export function tierPrecedence(tier) {
-    return TIER_PRECEDENCE.indexOf(tier);
+    return SOURCE_TIERS.indexOf(tier);
 }
 /** True for tiers whose content arrives with the checkout. */
 export function isRepoTier(tier) {

package/node_modules/pi-lens/dist/clients/config-core/records.js

@@ -101,7 +101,7 @@ export function jsonTypeName(value) {
  * A list with no records cannot overflow, so this is the floor under an
  * anchorless producer rather than a case production reaches.
  */
-export const UNANCHORED_RECORD_LABEL = "(config resolution)";
+const UNANCHORED_RECORD_LABEL = "(config resolution)";
 /**
  * A bounded collector for one resolution.
  *

package/node_modules/pi-lens/dist/clients/config-core/schema.js

@@ -21,8 +21,6 @@
  *
  * Pure accessors only. Nothing here reads a file, and nothing holds state.
  */
-import { STABILITY_TIER_KEY } from "../config-diagnostic-codes.js";
-export { STABILITY_TIER_KEY };
 /** Narrows to the recursive domain type, not to `unknown`. */
 export function isConfigObject(value) {
     return typeof value === "object" && value !== null && !Array.isArray(value);
@@ -30,7 +28,7 @@ export function isConfigObject(value) {
 // --- x-merge-strategy ---
 /** The annotation key selecting how an array node combines across tiers. */
 export const MERGE_STRATEGY_KEY = "x-merge-strategy";
-export const DEFAULT_MERGE_STRATEGY = "replace";
+const DEFAULT_MERGE_STRATEGY = "replace";
 const KEYED_PREFIX = "keyed:";
 export function isMergeStrategy(value) {
     if (typeof value !== "string")
@@ -71,7 +69,7 @@ export const DENY_KEY = "x-deny";
  * the field someone spelled differently, and silently claims one that merely
  * looks the part. A schema says what it means.
  */
-export const DENY_POLICIES = ["boolean-false", "array-union"];
+const DENY_POLICIES = ["boolean-false", "array-union"];
 export function isDenyPolicy(value) {
     return (typeof value === "string" &&
         DENY_POLICIES.includes(value));
@@ -104,7 +102,7 @@ export function schemaType(node) {
  * field while the merger replaced it whole, so the same schema typo produced
  * two different merge semantics.
  */
-export const SCHEMA_TYPES = [
+const SCHEMA_TYPES = [
     "object",
     "array",
     "string",

package/node_modules/pi-lens/dist/clients/config-diagnostic-codes.js

@@ -34,7 +34,7 @@ export const STABILITY_TIER_KEY = "x-stability";
  * The closed tier vocabulary. `experimental` fields may change or be removed
  * in a minor; `stable` fields are covered by the compatibility guarantee.
  */
-export const STABILITY_TIERS = ["experimental", "stable"];
+const STABILITY_TIERS = ["experimental", "stable"];
 export function isStabilityTier(value) {
     return (typeof value === "string" &&
         STABILITY_TIERS.includes(value));