@herbertgao/pi-extensions 2026.9.1 → 2026.9.3

package/node_modules/pi-lens/dist/clients/biome-client.js

@@ -14,8 +14,10 @@ import { isFileKind } from "./file-kinds.js";
 import { getGlobalPiLensDir } from "./file-utils.js";
 import { findGlobalBinary } from "./package-manager.js";
 import { safeSpawnAsync } from "./safe-spawn.js";
+import { probeToolAsync } from "./tool-probe.js";
 import { createSingleFlight } from "./single-flight.js";
 import { biomeConfigArgs } from "./tool-policy.js";
+import { resolveToolCwd } from "./tool-cwd.js";
 import { resolveManagedToolClient, } from "./dispatch/runners/utils/runner-helpers.js";
 import { classifyProbeFailure, describeInstallAttempt, createAvailabilityLatch, logAvailabilityDecision, startHostStallSampler, } from "./dispatch/runners/utils/availability-policy.js";
 // --- Client ---
@@ -169,7 +171,14 @@ export class BiomeClient {
         let result;
         let hostStallMs;
         try {
-            result = await this.spawnBiomeAsync(["--version"], PROBE_TIMEOUT_MS);
+            // The presence probe asks whether biome answers at all, so it goes
+            // through the probe seam (no cwd) rather than through
+            // `spawnBiomeAsync`, whose optional `cwd` exists for the analysis
+            // spawns that DO resolve a project config (#2894).
+            const { cmd, args: prefix } = await this.getBiomeBinary();
+            result = await probeToolAsync(cmd, [...prefix, "--version"], {
+                timeout: PROBE_TIMEOUT_MS,
+            });
         }
         finally {
             hostStallMs = sampler.stop();
@@ -314,7 +323,9 @@ export class BiomeClient {
         }
         try {
             const before = await fs.promises.readFile(absolutePath, "utf-8");
-            const configCwd = cwd ?? path.dirname(absolutePath);
+            const configCwd = resolveToolCwd("runner", "biome", absolutePath, {
+                ...(cwd !== undefined && { cwd }),
+            });
             // Shared config-args seam (#1247): the lint runner consumes the same
             // builder, so `lint --write` can never drift to biome's default
             // config when a user config or the package fallback exists.

package/node_modules/pi-lens/dist/clients/blocker-freshness.js

@@ -167,12 +167,6 @@ async function resolveForwardImportsMemoized(cwd, filePath, resolveForwardImport
     });
     return imports;
 }
-/** Test-only: clear the extractor and import-resolution memos. */
-export function _resetBlockerFreshnessForTests() {
-    extractorCache.clear();
-    importResolutionMemo.clear();
-    importResolutionMemoTurnIndex = undefined;
-}
 /**
  * Production forward-import resolver. Parses `filePath` with its tree-sitter grammar
  * and resolves every extracted import source to in-project files. Degrades to an

package/node_modules/pi-lens/dist/clients/bootstrap.js

@@ -114,7 +114,7 @@ const bootstrapFlight = createSingleFlight();
  * budget — it is the liveness bound AGENTS.md's both-bounds rule requires, so
  * a wedged module evaluation cannot park a `tool_call` handler forever.
  */
-export const BOOTSTRAP_LOAD_TIMEOUT_MS = 10_000;
+const BOOTSTRAP_LOAD_TIMEOUT_MS = 10_000;
 /**
  * How many consecutive failed builds before the seam stops rebuilding.
  *
@@ -129,7 +129,7 @@ export const BOOTSTRAP_LOAD_TIMEOUT_MS = 10_000;
  * the demand fails OPEN immediately, and `session_start` re-arms the latch so
  * a repaired environment is never locked out for the life of the process.
  */
-export const BOOTSTRAP_FAILURE_STRIKE_LIMIT = 3;
+const BOOTSTRAP_FAILURE_STRIKE_LIMIT = 3;
 /**
  * A stand-in for an analysis client whose module failed to load (an unresolved
  * runtime dependency under a package-manager layout the resolver can't traverse
@@ -268,7 +268,7 @@ async function buildBootstrapClients() {
  * {@link requestBootstrapClients} never says which on its own, so the reason
  * travels in the bounded record and the ledger entry instead.
  */
-export const BOOTSTRAP_UNAVAILABLE_REASONS = [
+const BOOTSTRAP_UNAVAILABLE_REASONS = [
     "shutdown",
     "timeout",
     "aborted",
@@ -276,7 +276,7 @@ export const BOOTSTRAP_UNAVAILABLE_REASONS = [
     "latched",
 ];
 /** A demand that could not be served. Carries the discriminating reason. */
-export class BootstrapUnavailableError extends Error {
+class BootstrapUnavailableError extends Error {
     unavailableReason;
     constructor(unavailableReason, message) {
         super(message);

package/node_modules/pi-lens/dist/clients/bounded-pid-file-lock.js

@@ -194,7 +194,7 @@ export function acquireBoundedPidFileLock(lockPath, options) {
                     options.logContention();
                     return null;
                 }
-                throw new Error(options.timeoutMessage);
+                throw new Error(options.timeoutMessage, { cause: error });
             }
             Atomics.wait(waitArray, 0, 0, options.retryMs);
         }

package/node_modules/pi-lens/dist/clients/bounded-telemetry.js

@@ -50,6 +50,8 @@ import { logLatency } from "./latency-logger.js";
  * must not also be written by a raw `logLatency` call somewhere else.
  */
 export const BOUNDED_TELEMETRY_PHASES = [
+    /** #2890: a duplicate pi RPC session_start was admitted but suppressed. */
+    "session_start_duplicate_suppressed",
     /**
      * #2467: a demand for the analyzer bootstrap clients was not served and
      * the caller proceeded without them. Rising-edge per demand reason, with
@@ -171,11 +173,6 @@ export const BOUNDED_TELEMETRY_PHASES = [
      */
     "observed_handled_evicted",
 ];
-const REGISTERED_PHASES = new Set(BOUNDED_TELEMETRY_PHASES);
-/** Report whether a phase name is in the registry (used by the sweep). */
-export function isBoundedTelemetryPhase(phase) {
-    return REGISTERED_PHASES.has(phase);
-}
 /**
  * Per-turn admission counters, keyed by turn and phase. Multiple turns remain
  * live because async work can finish T1 after T2 has already emitted. The map

package/node_modules/pi-lens/dist/clients/bus-events-logger.js

@@ -22,8 +22,7 @@
  * This module gives bus events the same durable trace every other pi-lens
  * subsystem already has (latency.log, cascade.log, read-guard.log, ...) —
  * see clients/latency-logger.ts for the house pattern this mirrors exactly:
- * one shared `createNdjsonLogger` writer, `isTestMode()` no-op guard,
- * `getBusEventsLogPath()` for testability.
+ * one shared `createNdjsonLogger` writer, `isTestMode()` no-op guard.
  *
  * Logging volume: `emitted` and `emit_failed` are logged on every call —
  * they're the two outcomes an operator actually needs a per-event trace for.
@@ -104,10 +103,3 @@ export function emitBusEventRollupAtSessionEnd(cwd) {
     }
     resetBusEventRollupCounts();
 }
-export function getBusEventsLogPath() {
-    return BUS_EVENTS_LOG_FILE;
-}
-/** Resolve once all enqueued bus-event writes are on disk (tests/shutdown). */
-export function flushBusEventsLog() {
-    return writer.flush();
-}

package/node_modules/pi-lens/dist/clients/cache-observability.js

@@ -91,7 +91,7 @@ const CHARS_PER_ESTIMATED_TOKEN = 4;
  */
 export const DEFAULT_PROVIDER_CACHE_TTL_MS = 60_000;
 const _providerCacheTtl = lazyEnvNumber("PI_LENS_PROVIDER_CACHE_TTL_MS", DEFAULT_PROVIDER_CACHE_TTL_MS);
-export const getProviderCacheTtlMs = _providerCacheTtl.get;
+const getProviderCacheTtlMs = _providerCacheTtl.get;
 export const _resetProviderCacheTtlForTests = _providerCacheTtl._resetForTests;
 /**
  * A turn counts as "anomalously low" when it reads back less than half of what
@@ -176,9 +176,50 @@ function newAttributionState() {
         injectedCharsSinceLastUsage: 0,
         newTranscriptCharsSinceLastUsage: 0,
         attributionCharsCapped: false,
+        injectedBytes: emptyInjectedBytes(),
+        injectedFindingsRepeated: 0,
+        findingIdentities: new Set(),
+        findingIdentityCapRecorded: false,
+        turnEndAdvisoryBytes: 0,
+        toolResultBytes: 0,
+        toolResultsTruncated: 0,
         summary: newCacheUsageSummary(),
     };
 }
+const MAX_FINDING_IDENTITIES = 2_000;
+function emptyInjectedBytes() {
+    return {
+        sessionGuidance: 0,
+        turnFindings: 0,
+        testFindings: 0,
+        agentNudge: 0,
+        turnEndAdvisory: 0,
+        other: 0,
+    };
+}
+function sourceKey(source) {
+    return {
+        "session-guidance": "sessionGuidance",
+        "turn-findings": "turnFindings",
+        "test-findings": "testFindings",
+        "agent-nudge": "agentNudge",
+    }[source];
+}
+/** Best-effort, language-neutral identity extraction from rendered findings. */
+function findingIdentities(text) {
+    const out = [];
+    for (const line of text.split(/\r?\n/)) {
+        const location = line.match(/(?:^|\s)([^\s:]+):(\d+)(?::\d+)?/);
+        if (!location)
+            continue;
+        const rule = line.match(/(?:rule|code)\s*[:=]\s*([\w./-]+)/i)?.[1] ??
+            line.match(/\(([\w./-]+)\)\s*$/)?.[1] ??
+            line.match(/:\d+(?::\d+)?\s+([\w./-]+)/)?.[1];
+        if (rule)
+            out.push(`${location[1]}:${location[2]}:${rule}`);
+    }
+    return out;
+}
 /**
  * Fetch (creating if absent) one session's attribution state, refreshing LRU
  * recency and evicting the oldest entries past the cap — same bounding as
@@ -688,10 +729,37 @@ export function observeCacheContext(args) {
                 countsCapped: sliceSize.capped,
             };
         });
+        const state = attributionFor(attributionKey(args.sessionId, args.sessionRole));
+        for (const slice of injectionSlices) {
+            const key = sourceKey(slice.source);
+            const bytes = measureInjectedMessages(slice.messages).bytes;
+            state.injectedBytes[key] += bytes;
+            for (const message of slice.messages) {
+                for (const identity of findingIdentities(typeof message.content === "string" ? message.content : "")) {
+                    if (state.findingIdentities.has(identity)) {
+                        state.injectedFindingsRepeated += 1;
+                        continue;
+                    }
+                    if (state.findingIdentities.size >= MAX_FINDING_IDENTITIES) {
+                        if (!state.findingIdentityCapRecorded) {
+                            state.findingIdentityCapRecorded = true;
+                            logLatency({
+                                type: "phase",
+                                filePath: "<pi-lens>",
+                                phase: "injected_finding_identity_cap",
+                                durationMs: 0,
+                                metadata: { cap: MAX_FINDING_IDENTITIES },
+                            });
+                        }
+                        continue;
+                    }
+                    state.findingIdentities.add(identity);
+                }
+            }
+        }
         const messageCountCapped = existingMessages.length > MAX_REPORTED_MESSAGES ||
             resultMessages.length > MAX_REPORTED_MESSAGES;
         recordContextAttribution(attributionKey(args.sessionId, args.sessionRole), existingMessages, sizes);
-        const state = attributionFor(attributionKey(args.sessionId, args.sessionRole));
         state.sequenceHashTruncatedSinceLastUsage ||=
             beforeSequence.truncated ||
                 beforeSequence.contentTruncated ||
@@ -721,6 +789,10 @@ export function observeCacheContext(args) {
                 injectedMessageCountCapped: injectedMessages.length > MAX_REPORTED_MESSAGES,
                 injectedChars: sizes.chars,
                 injectedBytes: sizes.bytes,
+                injectedBytesBySource: Object.fromEntries(sourceBreakdown.map((entry) => [
+                    sourceKey(entry.source),
+                    entry.bytes,
+                ])),
                 injectedEstimatedTokens: estimateTokens(sizes.chars),
                 injectedTokenBasis: "chars-per-token-4-estimate-not-provider-measured",
                 injectedCountsCapped: sizes.capped,
@@ -881,6 +953,13 @@ export function logCacheUsage(message, dbg, context) {
         const injectedCharsSinceLastTurn = state.injectedCharsSinceLastUsage;
         const newTranscriptCharsSinceLastTurn = state.newTranscriptCharsSinceLastUsage;
         const attributionCharsCapped = state.attributionCharsCapped;
+        const injectedBytes = {
+            ...state.injectedBytes,
+            turnEndAdvisory: state.turnEndAdvisoryBytes + state.injectedBytes.turnEndAdvisory,
+        };
+        const injectedFindingsRepeated = state.injectedFindingsRepeated;
+        const toolResultBytes = state.toolResultBytes;
+        const toolResultsTruncated = state.toolResultsTruncated;
         // This record is the turn boundary: reset the per-turn accumulators and
         // re-arm the prefix-break flag so the next verdict describes the NEXT gap.
         state.lastUsageAtMs = nowMs;
@@ -898,6 +977,11 @@ export function logCacheUsage(message, dbg, context) {
         state.injectedCharsSinceLastUsage = 0;
         state.newTranscriptCharsSinceLastUsage = 0;
         state.attributionCharsCapped = false;
+        state.injectedBytes = emptyInjectedBytes();
+        state.injectedFindingsRepeated = 0;
+        state.turnEndAdvisoryBytes = 0;
+        state.toolResultBytes = 0;
+        state.toolResultsTruncated = 0;
         // Clear the request stamp too: the next turn measures from ITS request, and
         // a turn whose `context` call pi-lens never saw must fall back rather than
         // reuse this one.
@@ -939,6 +1023,13 @@ export function logCacheUsage(message, dbg, context) {
                 injectedCharsSinceLastTurn,
                 newTranscriptCharsSinceLastTurn,
                 attributionCharsCapped,
+                injectedBytes,
+                injectedFindingsRepeated,
+                // Delivered tool-result aggregation over the turn (#2800 item 7):
+                // the sum of each delivered footer's bytes= figure and the count
+                // of results whose bound fired.
+                toolResultBytes,
+                toolResultsTruncated,
                 ...(context
                     ? {
                         // MessageEndEvent has no request/context id in the host API. These
@@ -1126,6 +1217,29 @@ export function clearCachePrefixSession(sessionId, sessionRole) {
     // a stale gap baseline and a stale prefix-break flag.
     attributionBySession.delete(key);
 }
+/** Record the exact quiet-window summary content handed to pi.sendMessage. */
+export function recordTurnEndAdvisoryBytes(sessionId, bytes, sessionRole = "primary") {
+    const state = attributionFor(attributionKey(sessionId, sessionRole));
+    state.turnEndAdvisoryBytes = Math.min(MAX_INJECTED_BYTES, state.turnEndAdvisoryBytes + Math.max(0, bytes));
+}
+/**
+ * Fold one delivered tool result into the per-turn aggregation the
+ * `cache_usage` row reports as `toolResultBytes` / `toolResultsTruncated`
+ * (#2800 item 7). `bytes` is the delivered payload's UTF-8 byte count as
+ * stamped in the result's own footer, and `truncated` is the footer's
+ * truncated flag. Called from each host adapter's delivery seam; the row is
+ * emitted by `logCacheUsage`, which resets both figures at the turn boundary.
+ * The byte sum saturates at the attribution bound so the row stays bounded.
+ */
+export function recordToolResultDelivery(args) {
+    const state = attributionFor(attributionKey(args.sessionId, args.sessionRole));
+    const bytes = Number.isFinite(args.bytes)
+        ? Math.max(0, Math.floor(args.bytes))
+        : 0;
+    state.toolResultBytes = Math.min(MAX_ATTRIBUTION_BYTES, state.toolResultBytes + bytes);
+    if (args.truncated === true)
+        state.toolResultsTruncated += 1;
+}
 /**
  * Emit one bounded session summary and retire its attribution state. The
  * summary contains fixed-key counters only; it never serializes transcript or
@@ -1165,10 +1279,12 @@ export function resetCachePrefixObservation() {
     prefixHashBySession.clear();
     attributionBySession.clear();
 }
-/** #2442 test-only membership reads, bypassing emitCacheUsageSummaryAtSessionEnd's
- *  usageRecords>0 gate and log side effects. */
-export function _attributionKeyForTests(sessionId, sessionRole) {
-    return attributionKey(sessionId, sessionRole);
+export function resetCacheFindingIdentitiesSession(sessionId, sessionRole) {
+    const state = attributionBySession.get(attributionKey(sessionId, sessionRole));
+    if (!state)
+        return;
+    state.findingIdentities.clear();
+    state.findingIdentityCapRecorded = false;
 }
 export function _attributionBySessionHasForTests(key) {
     return attributionBySession.has(key);

package/node_modules/pi-lens/dist/clients/cargo-manifest.js

@@ -177,7 +177,7 @@ export function parseTomlStringArray(content, key) {
  * true`) never matches either — the literal key is immediately followed by
  * `=`, not `.`.
  */
-export function parseTomlScalarString(content, key) {
+function parseTomlScalarString(content, key) {
     if (content === undefined)
         return undefined;
     const match = content.match(new RegExp(`^[ \\t]*${key}[ \\t]*=[ \\t]*(?:"([^"]*)"|'([^']*)')`, "m"));
@@ -292,7 +292,7 @@ export function readCargoDependencyNames(content) {
  * (`edition.workspace = true`) or the inline-table form
  * (`edition = { workspace = true }`).
  */
-export function isTomlKeyWorkspaceInherited(content, key) {
+function isTomlKeyWorkspaceInherited(content, key) {
     if (content === undefined)
         return false;
     const dotted = new RegExp(`^[ \\t]*${key}\\.workspace[ \\t]*=[ \\t]*true`, "m");

package/node_modules/pi-lens/dist/clients/cascade-logger.js

@@ -29,10 +29,3 @@ export function logCascade(entry) {
         filePath: normalizeLoggedPath(entry.filePath),
     });
 }
-export function getCascadeLogPath() {
-    return CASCADE_LOG_FILE;
-}
-/** Resolve once all enqueued cascade writes are on disk (tests/shutdown). */
-export function flushCascadeLog() {
-    return writer.flush();
-}

package/node_modules/pi-lens/dist/clients/child-unref.js

@@ -2,7 +2,7 @@
  * Shared plumbing for best-effort, fire-and-forget child-process spawns
  * (shape 4 of the recurring-defect catalog in AGENTS.md: "a timer / promise /
  * worker / child that outlives its one-shot settle"). Extracted from the
- * orphan reaper's `unrefReaperChild`/`spawnCollectStdout` (#1153/#1160) into a
+ * orphan reaper's `unrefReaperChild` (#1153/#1160) into a
  * shared, dependency-free module so every one-shot
  * `spawn(..., { stdio: ["ignore","pipe",...] })` call site in the codebase —
  * the reaper's enumeration/kill spawns AND the resource sampler's Windows
@@ -46,24 +46,6 @@ export function unrefChildAndPipes(child) {
     }
 }
 /**
- * Spawn a best-effort, fire-and-forget child, accumulate its full stdout, and
- * resolve with the collected text (empty string on a synchronous spawn
- * failure or an `error` event). Consolidates the spawn → unref →
- * pipe-stdout → `close` plumbing shared by every one-shot OS-process-table
- * query in the codebase — each caller supplies only its command/args/options
- * and does its own output parse. The child + its stdio pipes are `unref`'d
- * here (via `unrefChildAndPipes`) so a settled one-shot `pi --print` process
- * can exit without waiting, and both the unref and the collect plumbing live
- * in exactly ONE place rather than being re-derived at each spawn site.
- * Never rejects — any failure resolves to `""`, which every caller's parse
- * turns into an empty/absent result (the best-effort contract every caller
- * here already has).
- */
-export function spawnCollectStdout(command, args, options) {
-    return spawnCollectStdoutResult(command, args, options).then((result) => result.stdout);
-}
-/**
- * `spawnCollectStdout` plus the reason the output is what it is. Same spawn,
  * unref, collect, settle plumbing; the only additions are an optional hard
  * timeout and a status discriminator. Never rejects.
  */

package/node_modules/pi-lens/dist/clients/complexity-client.js

@@ -13,6 +13,7 @@
 import { createSubsystemLogger } from "./extension-log.js";
 import * as fs from "node:fs";
 import * as path from "node:path";
+import { calcCyclomaticComplexity } from "./dispatch/facts/function-facts.js";
 import { firstChildOfType, withTreeSitterRoot, isComplexityLanguageId, isComplexitySupportedFile, resolveTreeSitterLanguage, walk, } from "./tree-sitter-shared.js";
 // JS/TS/JSX share one grammar shape.
 const JSTS = {
@@ -190,6 +191,9 @@ function isLogicalOp(node, nodes) {
 }
 /** Cyclomatic contribution of a subtree: decision points + logical operators. */
 function subtreeCyclomatic(root, nodes) {
+    // Dispatch uses 1-based McCabe; this client exposes 0-based contributions (#2697).
+    if (nodes === JSTS)
+        return calcCyclomaticComplexity(root) - 1;
     let cc = 0;
     walk(root, (n) => {
         if (nodes.decision.has(n.type))
@@ -438,6 +442,7 @@ export class ComplexityClient {
             aiCommentPatterns: countAICommentPatterns(content),
             singleUseFunctions: countSingleUseFunctions(functions),
             tryCatchCount: countTryCatch(root, nodes),
+            functions,
         };
     }
     aggregateFunctionStats(functions) {

package/node_modules/pi-lens/dist/clients/config-core/index.js

@@ -31,17 +31,20 @@
  * (`loadPiLensProjectConfig`) are now projections of one resolution. #2416
  * brings the `lsp.servers.<id>` shape the schema currently only reserves.
  */
-export { additionalPropertyPolicy, DEFAULT_MERGE_STRATEGY, DENY_KEY, DENY_POLICIES, denyPolicyOf, isDenyPolicy, isConfigObject, isKnownSchemaType, isMergeStrategy, isPlainObject, isSchemaNode, itemsSchema, keyedField, MERGE_STRATEGY_KEY, mergeStrategyOf, propertySchema, SCHEMA_TYPES, schemaType, STABILITY_TIER_KEY, } from "./schema.js";
-export { compareKeys, isOperatorTier, isRepoTier, provenanceFor, provenanceView, SOURCE_TIERS, TIER_CLASS, TIER_PRECEDENCE, tierPrecedence, } from "./provenance.js";
-export { isUnsafeConfigKey, MAX_CONFIG_DEPTH, safeAssign, UNSAFE_CONFIG_KEYS, UNSAFE_KEY_REASON, } from "./safe-object.js";
-export { denyProvenance, resolveArrayDeny, resolveBooleanDeny, } from "./deny.js";
-export { validate, } from "./normalize.js";
-export { boundedKeyLabel, jsonTypeName, MAX_MIGRATION_RECORDS, MAX_RECORD_KEY_LENGTH, MigrationRecordCollector, migrationSubject, } from "./records.js";
-export { buildProcessSpec, MAX_ARGV_BYTES, MAX_ARGV_ENTRIES, MAX_ENV_BYTES, MAX_ENV_ENTRIES, MAX_TIMEOUT_MS, redactProcessSpec, toSpawnArgs, } from "./process-spec.js";
+export { SOURCE_TIERS } from "./provenance.js";
+// `merge()` itself is NOT re-exported. Its input type only PROMISES a
+// post-`validate()` value; nothing in the language enforces that a caller
+// who imports it directly honors the promise, and `merge()`'s own bounds are
+// a narrow backstop, not a second validator (see `merge.ts`'s module doc).
+// `resolveConfig` (re-exported at the bottom of this file, from `resolve.js`)
+// is the one supported way in: it always validates
+// every source before merging. `merge()` stays exported from `merge.ts`
+// itself — marked `@internal` there — for this module's own use and for
+// tests that probe it directly.
 // `resolveConfig` and its types live in `./resolve.js` (#2426) so a caller can
 // import the front door without also importing this barrel's width — in
 // particular `process-spec.js` -> `project-trust.js`, which closed three
 // import cycles once the config loaders (all downstream of `file-utils.ts`)
 // started resolving through the core. The public surface is unchanged: this is
 // still where the supported entry point is exported from.
-export { resolveConfig, } from "./resolve.js";
+export { resolveConfig } from "./resolve.js";

package/node_modules/pi-lens/dist/clients/config-core/process-spec.js

@@ -36,7 +36,7 @@ import { compareKeys, isRepoTier, } from "./provenance.js";
 /** Longest argv a spec may carry. A command line, not a file list. */
 export const MAX_ARGV_ENTRIES = 128;
 /** Total argv bytes a spec may carry. */
-export const MAX_ARGV_BYTES = 32 * 1024;
+const MAX_ARGV_BYTES = 32 * 1024;
 /** Most env entries a spec may carry. */
 export const MAX_ENV_ENTRIES = 64;
 /** Total env bytes (names plus values) a spec may carry. */

package/node_modules/pi-lens/dist/clients/config-core/provenance.js

@@ -11,7 +11,7 @@
  *
  * Two orderings live here, and they are NOT the same ordering:
  *
- * - `TIER_PRECEDENCE` decides who wins a plain value. Later beats earlier, so a
+ * - `SOURCE_TIERS` decides who wins a plain value. Later beats earlier, so a
  *   CLI flag beats a project file beats a global file beats a built-in default.
  * - `TIER_CLASS` decides who may LIFT a deny. `deny.ts` builds monotonic deny
  *   precedence on this split, and nothing else re-derives it.
@@ -34,13 +34,6 @@ export const SOURCE_TIERS = [
     "cli",
     "host",
 ];
-/**
- * Value precedence, lowest first. A later tier's value replaces an earlier
- * tier's value for the same leaf. `merge()` sorts its sources by this order
- * rather than trusting caller order, so a caller that assembles sources in a
- * different order cannot silently invert precedence.
- */
-export const TIER_PRECEDENCE = SOURCE_TIERS;
 /**
  * Who each tier speaks for. THREE classes, not two (#2440 review finding F3).
  *
@@ -79,7 +72,7 @@ export const TIER_CLASS = {
 };
 /** Numeric precedence of a tier. Higher wins. */
 export function tierPrecedence(tier) {
-    return TIER_PRECEDENCE.indexOf(tier);
+    return SOURCE_TIERS.indexOf(tier);
 }
 /** True for tiers whose content arrives with the checkout. */
 export function isRepoTier(tier) {

package/node_modules/pi-lens/dist/clients/config-core/records.js

@@ -101,7 +101,7 @@ export function jsonTypeName(value) {
  * A list with no records cannot overflow, so this is the floor under an
  * anchorless producer rather than a case production reaches.
  */
-export const UNANCHORED_RECORD_LABEL = "(config resolution)";
+const UNANCHORED_RECORD_LABEL = "(config resolution)";
 /**
  * A bounded collector for one resolution.
  *

package/node_modules/pi-lens/dist/clients/config-core/schema.js

@@ -21,8 +21,6 @@
  *
  * Pure accessors only. Nothing here reads a file, and nothing holds state.
  */
-import { STABILITY_TIER_KEY } from "../config-diagnostic-codes.js";
-export { STABILITY_TIER_KEY };
 /** Narrows to the recursive domain type, not to `unknown`. */
 export function isConfigObject(value) {
     return typeof value === "object" && value !== null && !Array.isArray(value);
@@ -30,7 +28,7 @@ export function isConfigObject(value) {
 // --- x-merge-strategy ---
 /** The annotation key selecting how an array node combines across tiers. */
 export const MERGE_STRATEGY_KEY = "x-merge-strategy";
-export const DEFAULT_MERGE_STRATEGY = "replace";
+const DEFAULT_MERGE_STRATEGY = "replace";
 const KEYED_PREFIX = "keyed:";
 export function isMergeStrategy(value) {
     if (typeof value !== "string")
@@ -71,7 +69,7 @@ export const DENY_KEY = "x-deny";
  * the field someone spelled differently, and silently claims one that merely
  * looks the part. A schema says what it means.
  */
-export const DENY_POLICIES = ["boolean-false", "array-union"];
+const DENY_POLICIES = ["boolean-false", "array-union"];
 export function isDenyPolicy(value) {
     return (typeof value === "string" &&
         DENY_POLICIES.includes(value));
@@ -104,7 +102,7 @@ export function schemaType(node) {
  * field while the merger replaced it whole, so the same schema typo produced
  * two different merge semantics.
  */
-export const SCHEMA_TYPES = [
+const SCHEMA_TYPES = [
     "object",
     "array",
     "string",

package/node_modules/pi-lens/dist/clients/config-diagnostic-codes.js

@@ -34,7 +34,7 @@ export const STABILITY_TIER_KEY = "x-stability";
  * The closed tier vocabulary. `experimental` fields may change or be removed
  * in a minor; `stable` fields are covered by the compatibility guarantee.
  */
-export const STABILITY_TIERS = ["experimental", "stable"];
+const STABILITY_TIERS = ["experimental", "stable"];
 export function isStabilityTier(value) {
     return (typeof value === "string" &&
         STABILITY_TIERS.includes(value));
@@ -171,6 +171,8 @@ export const CONFIG_DIAGNOSTIC_CODES = {
      * suppressed" about a configuration that applied nothing at all.
      */
     PILENS_CFG_0008: "config resolution failed; whole configuration ignored",
+    /** A tool key is unknown or names a required, non-disableable tool. */
+    PILENS_CFG_0009: "unknown or non-disableable tool config key ignored",
 };
 /** The shape every code in the namespace must match. */
 export const CONFIG_DIAGNOSTIC_CODE_PATTERN = /^PILENS_CFG_\d{4}$/;

package/node_modules/pi-lens/dist/clients/config-resolve.js

@@ -12,7 +12,7 @@
  *
  *   builtin -> global -> project root -> nested-project -> env -> cli -> host
  *
- * It is `config-core`'s own `TIER_PRECEDENCE`, not a second ordering: this
+ * It is `config-core`'s own `SOURCE_TIERS`, not a second ordering: this
  * module places files into tiers and the core sorts them. `docs/configuration.md`
  * documents the same order once, and `tests/clients/config-resolve.test.ts`
  * walks it.
@@ -151,7 +151,7 @@ function collectDocuments(dir, locations, tier, onReadError) {
  * is `nested-project`, which is what makes "nearest wins, per field" fall out
  * of the core's tier precedence instead of being re-implemented here.
  */
-export function collectPiLensConfigDocuments(options) {
+function collectPiLensConfigDocuments(options) {
     const documents = [];
     const { globalDir, onReadError } = options;
     const globalConfigPath = canonicalGlobalFile(options);
@@ -408,7 +408,7 @@ function assignRaw(target, key, value) {
  * half-migrated the file it was written in is the defect this whole change
  * exists to remove.
  */
-export function configSources(documents) {
+function configSources(documents) {
     const sources = [];
     for (const document of documents) {
         const value = document.value;
@@ -576,7 +576,7 @@ function record(input) {
  * duplicate notice about a config that failed to load is noise, while silence
  * about it is the failure mode this module exists to prevent.
  */
-export function configRecordOwner(record) {
+function configRecordOwner(record) {
     const key = record.canonicalKey ?? record.key;
     if (key.length === 0)
         return undefined;
@@ -740,8 +740,8 @@ export function reportPiLensConfigRecords(records) {
  */
 export function ignoredRecordCollector(configPath, tier) {
     const noted = [];
-    const note = (reason) => {
-        noted.push({
+    const note = (reason, code = "PILENS_CFG_0001") => {
+        let notedRecord = {
             code: "PILENS_CFG_0001",
             file: configPath,
             key: "",
@@ -752,7 +752,10 @@ export function ignoredRecordCollector(configPath, tier) {
                     sourceText: reason.sourceText,
                 }),
             tier,
-        });
+        };
+        if (code !== "PILENS_CFG_0001")
+            notedRecord.code = code;
+        noted.push(notedRecord);
     };
     return {
         note,