@herbertgao/pi-extensions 2026.9.1 → 2026.9.3

package/node_modules/pi-lens/dist/clients/mutation-attribution.js

@@ -45,7 +45,7 @@ import { BoundedFifoMap } from "./bounded-cache.js";
 import { getProjectDataDir } from "./file-utils.js";
 import { getProcessSingleton } from "./process-singletons.js";
 /** Persisted-file schema version. A file of any other version is ignored. */
-export const MUTATION_ATTRIBUTION_FILE_VERSION = 1;
+const MUTATION_ATTRIBUTION_FILE_VERSION = 1;
 /** File under `getProjectDataDir(cwd)` holding the learned attributions. */
 export const MUTATION_ATTRIBUTION_FILE = "observed-mutating-tools.json";
 /**
@@ -55,7 +55,7 @@ export const MUTATION_ATTRIBUTION_FILE = "observed-mutating-tools.json";
  * co-occurrence — an unrelated tool call that happened to overlap a background
  * write — cannot durably mislabel a tool for every future session.
  */
-export const PERSIST_AFTER_OBSERVATIONS = 2;
+const PERSIST_AFTER_OBSERVATIONS = 2;
 /**
  * Consecutive clean observations after which an UNATTRIBUTED tool stops being
  * armed for the session. Two, not one: a mutating tool whose FIRST call
@@ -88,7 +88,7 @@ export const CLEAN_OBSERVATION_ARM_LIMIT = 2;
  */
 export const DEATTRIBUTE_AFTER_CLEAN_OBSERVATIONS = 3;
 /** Bound on distinct tool names remembered, in-memory and on disk. */
-export const MUTATION_ATTRIBUTION_MAX_TOOLS = 64;
+const MUTATION_ATTRIBUTION_MAX_TOOLS = 64;
 const ATTRIBUTION_FAMILY = "mutation-attribution";
 /**
  * Bumped to 2 (#2449 review round 5, F3): `session` changed shape from a

package/node_modules/pi-lens/dist/clients/ndjson-logger.js

@@ -127,10 +127,6 @@ export function _exitFlushersForTest() {
 export function getRegisteredLogFiles() {
     return registeredLogFiles;
 }
-/** Test-only reset — each test file gets a clean registry (see ndjson-logger.test.ts). */
-export function _resetRegisteredLogFilesForTest() {
-    registeredLogFiles.clear();
-}
 /**
  * Snapshot of unrecovered write losses, one entry per sink that has any
  * (#1970). Pure in-memory read — no I/O, so a caller (`degradation-ledger.ts`)

package/node_modules/pi-lens/dist/clients/observed-mutation.js

@@ -119,7 +119,7 @@ import { lineContentHash } from "./read-guard.js";
  * must not turn every first observation into a timeout, which is the least
  * useful possible outcome.
  */
-export const OBSERVED_CAPTURE_BUDGET_MS = 200;
+const OBSERVED_CAPTURE_BUDGET_MS = 200;
 /**
  * Cumulative ceiling for every ARMED capture in one turn. A turn that calls
  * twenty unclassified tools pays this once, not twenty times. The SETTLE does
@@ -141,7 +141,7 @@ export const OBSERVED_TURN_BUDGET_MS = 600;
  * holds regardless of the clock. What it CAN cut is a directory target's tail,
  * and that is reported as `stoppedEarly` rather than scored as clean.
  */
-export const OBSERVED_SETTLE_DEADLINE_MS = 50;
+const OBSERVED_SETTLE_DEADLINE_MS = 50;
 /**
  * Entries taken from a DIRECTORY-shaped target path, non-recursively.
  *
@@ -175,7 +175,7 @@ export const OBSERVED_TRACKED_MAX_FILES = 400;
  * closes it as soon as anything moves the size or the tick, and the armed
  * observation (which hashes the target unconditionally) never depended on it.
  */
-export const OBSERVED_LEDGER_SETTLE_MS = 150;
+const OBSERVED_LEDGER_SETTLE_MS = 150;
 /**
  * Path keys the "pi-lens already recorded this" set may hold.
  *
@@ -198,19 +198,19 @@ export const OBSERVED_HANDLED_MAX = 1000;
  */
 export const OBSERVED_SWEEP_STAT_WINDOW = 128;
 /** Cumulative content-hash budget for ONE capture. */
-export const OBSERVED_HASH_BUDGET_BYTES = 2 * 1024 * 1024;
+const OBSERVED_HASH_BUDGET_BYTES = 2 * 1024 * 1024;
 /** Cumulative bytes ONE settled sweep may read to seed or verify a hash. */
 export const OBSERVED_SWEEP_HASH_BUDGET_BYTES = 2 * 1024 * 1024;
 /** Cumulative bytes ONE settled sweep may read to derive edit RANGES. */
-export const OBSERVED_SWEEP_RANGE_BUDGET_BYTES = 1024 * 1024;
+const OBSERVED_SWEEP_RANGE_BUDGET_BYTES = 1024 * 1024;
 /** Largest file whose per-line hashes are captured for range derivation. */
-export const OBSERVED_LINE_HASH_MAX_BYTES = 512 * 1024;
+const OBSERVED_LINE_HASH_MAX_BYTES = 512 * 1024;
 /** Ranges reported per file before they collapse to one bounding box. */
-export const OBSERVED_MAX_EDIT_RANGES = 32;
+const OBSERVED_MAX_EDIT_RANGES = 32;
 /** Pending baselines held between `tool_call` and `tool_result`. */
-export const OBSERVED_PENDING_MAX = 32;
+const OBSERVED_PENDING_MAX = 32;
 /** Files remembered by the settled-sweep content ledger. */
-export const OBSERVED_LEDGER_MAX = 1000;
+const OBSERVED_LEDGER_MAX = 1000;
 const OBSERVED_FAMILY = "observed-mutation-net";
 const OBSERVED_VERSION = 3;
 function state() {

package/node_modules/pi-lens/dist/clients/opaque-mutation-scan.js

@@ -43,11 +43,11 @@ import { freshnessFromMtime } from "./freshness.js";
 import { safeSpawnAsync } from "./safe-spawn.js";
 import { truncatedByOutputCap } from "./spawn-output-cap.js";
 /** Stop hashing once this many cumulative bytes were read (per capture). */
-export const OPAQUE_HASH_BUDGET_BYTES = 8 * 1024 * 1024;
+const OPAQUE_HASH_BUDGET_BYTES = 8 * 1024 * 1024;
 /** Hard cap on scanned files — beyond it the verdict is coverage-unknown. */
 export const OPAQUE_SCAN_MAX_FILES = 2000;
 /** How far before recorded start an earlier write may still be attributed. */
-export const OPAQUE_MTIME_TOLERANCE_MS = 150;
+const OPAQUE_MTIME_TOLERANCE_MS = 150;
 // `--untracked-files=all` lists untracked files individually instead of
 // collapsing them per directory (it does NOT add ignored paths — that needs
 // `--ignored`), so the worst realistic case is a working tree with a large
@@ -220,10 +220,6 @@ export async function isGitWorktree(root) {
     gitRepoMemo.set(key, isRepo === true);
     return isRepo === true;
 }
-export function _resetGitWorktreeMemoForTests() {
-    gitRepoMemo.clear();
-    gitToplevelMemo.clear();
-}
 const gitToplevelMemo = new Map();
 /**
  * The root of the working tree `root` belongs to, or `undefined` when it is

package/node_modules/pi-lens/dist/clients/opengrep-client.js

@@ -148,8 +148,10 @@ export class OpengrepClient extends SecurityScanClient {
                 };
             }
             const findings = parseOpengrepReport(fs.readFileSync(reportPath, "utf-8"));
+            // #2154: the one opengrep site that parsed a scan of this root.
             return {
                 success: true,
+                analyzed: true,
                 findings,
                 scannedAt,
             };

package/node_modules/pi-lens/dist/clients/opengrep-config.js

@@ -3,7 +3,7 @@ import { findLocalToolConfig } from "./path-utils.js";
 // Opengrep is a fork of Semgrep and natively consumes the same rule format, so
 // we discover both `.opengrep.*` (preferred) and the de-facto `.semgrep.*` rule
 // files an existing repo may already carry.
-export const LOCAL_OPENGREP_CONFIG_NAMES = [
+const LOCAL_OPENGREP_CONFIG_NAMES = [
     ".opengrep.yml",
     ".opengrep.yaml",
     "opengrep.yml",

package/node_modules/pi-lens/dist/clients/package-manager.js

@@ -18,6 +18,7 @@ import * as os from "node:os";
 import * as path from "node:path";
 import { classifyProbeFailure, createAvailabilityLatch, isTransientDecision, logAvailabilityDecision, startHostStallSampler, } from "./dispatch/runners/utils/availability-policy.js";
 import { safeSpawnAsync } from "./safe-spawn.js";
+import { probeToolAsync } from "./tool-probe.js";
 import { createAvailabilityProbeFlight } from "./availability-probe-flight.js";
 import { createGenerationSource, } from "./generation-guard.js";
 import { isAtOrAboveHomeDir, walkUpDirs } from "./path-utils.js";
@@ -114,7 +115,7 @@ async function probeAvailability(pm) {
     let result;
     let hostStallMs;
     try {
-        result = await safeSpawnAsync(finder, [pm], { timeout: PROBE_TIMEOUT_MS });
+        result = await probeToolAsync(finder, [pm], { timeout: PROBE_TIMEOUT_MS });
     }
     finally {
         hostStallMs = sampler.stop();

package/node_modules/pi-lens/dist/clients/path-utils.js

@@ -10,7 +10,7 @@
  * - On non-Windows: return path as-is (case-sensitive filesystem)
  * - Always convert backslashes to forward slashes for Map key consistency
  */
-import { existsSync, realpathSync } from "node:fs";
+import { existsSync, readFileSync, realpathSync, statSync, } from "node:fs";
 import * as os from "node:os";
 import * as path from "node:path";
 import { win32 } from "node:path";
@@ -413,6 +413,25 @@ export function findLocalToolConfig(startDir, names, options = {}) {
     }
     return undefined;
 }
+/**
+ * Accept only a real Git repository marker: a directory with HEAD, or a
+ * worktree/submodule marker file whose first line starts with `gitdir:`.
+ */
+export function isRealGitMarker(markerPath) {
+    try {
+        const marker = statSync(markerPath);
+        if (marker.isDirectory())
+            return existsSync(path.join(markerPath, "HEAD"));
+        if (!marker.isFile())
+            return false;
+        return readFileSync(markerPath, "utf8")
+            .split(/\r?\n/, 1)[0]
+            .startsWith("gitdir:");
+    }
+    catch {
+        return false;
+    }
+}
 /**
  * Walk up from `startDir` looking for a directory containing any of
  * `markers`, the same containment-aware climb `knip-client.ts` and
@@ -438,11 +457,13 @@ export function findLocalToolConfig(startDir, names, options = {}) {
 export function findNearestMarkerRoot(startDir, markers, options = {}) {
     const boundaries = options.boundaries ?? [];
     const homeDir = path.resolve(options.homeDir ?? os.homedir());
+    const markerPredicate = options.markerPredicate ?? (() => true);
     let current = path.resolve(startDir);
     for (let depth = 0; depth < 64; depth++) {
         if (isAtOrAboveHomeDir(current, homeDir))
             return null;
-        if (markers.some((m) => existsSync(path.join(current, m))))
+        if (markers.some((m) => existsSync(path.join(current, m)) &&
+            markerPredicate(path.join(current, m))))
             return current;
         if (boundaries.some((m) => existsSync(path.join(current, m))))
             return null;

package/node_modules/pi-lens/dist/clients/performance-report.js

@@ -2,8 +2,8 @@ import * as fs from "node:fs";
 import * as readline from "node:readline";
 import { flushLatencyLog, getLatencyLogPath, } from "./latency-logger.js";
 import { getMaxLogSizeMB } from "./log-cleanup.js";
-export const DEFAULT_PERF_TOP_N = 5;
-export const MAX_PERF_TOP_N = 50;
+const DEFAULT_PERF_TOP_N = 5;
+const MAX_PERF_TOP_N = 50;
 export const MAX_PERF_PHASE_SAMPLES = 20_000;
 const PARSE_YIELD_EVERY = 500;
 // The window follows the same threshold that rotates the log out from under it.

package/node_modules/pi-lens/dist/clients/php-cs-fixer-config.js

@@ -91,14 +91,15 @@
  * gate says "config exists" while the carriage says "not found", silently
  * dropping the `--config` argv this module exists to carry.
  */
+import { existsSync } from "node:fs";
 import * as path from "node:path";
-import { findLocalToolConfig } from "./path-utils.js";
+import { resolveToolCwd } from "./tool-cwd.js";
 /**
  * In `computeConfigFiles()`'s own precedence order — `.php-cs-fixer.php`
  * before `.php-cs-fixer.dist.php` — so a same-directory precedence check can
  * just take the first existing name.
  */
-export const PHP_CS_FIXER_CONFIG_NAMES = [
+const PHP_CS_FIXER_CONFIG_NAMES = [
     ".php-cs-fixer.php",
     ".php-cs-fixer.dist.php",
 ];
@@ -109,6 +110,10 @@ export const PHP_CS_FIXER_CONFIG_NAMES = [
  * agreeing with this tool's own (unceilinged) detection gates.
  */
 export function resolvePhpCsFixerConfig(filePath) {
-    const startDir = path.dirname(path.resolve(filePath));
-    return findLocalToolConfig(startDir, PHP_CS_FIXER_CONFIG_NAMES);
+    const absolute = path.resolve(filePath);
+    const startDir = resolveToolCwd("formatter", "php-cs-fixer", absolute, {
+        cwd: path.parse(absolute).root,
+        allowHomeMarker: true,
+    });
+    return PHP_CS_FIXER_CONFIG_NAMES.map((name) => path.join(startDir, name)).find(existsSync);
 }

package/node_modules/pi-lens/dist/clients/pipeline.js

@@ -34,6 +34,7 @@ import { clearGraphCache } from "./review-graph/builder.js";
 import { BoundedLruCache } from "./bounded-cache.js";
 import { RUNTIME_CONFIG } from "./runtime-config.js";
 import { getAmbientAbortSignal, safeSpawnAsync } from "./safe-spawn.js";
+import { probeToolAsync } from "./tool-probe.js";
 import { bounded } from "./deadline-utils.js";
 import { enabledAuxiliaryLspServerIds } from "./dispatch/auxiliary-lsp.js";
 import { recordDegradationOnce } from "./degradation-ledger.js";
@@ -179,7 +180,7 @@ function createPhaseTracker(toolName, filePath) {
     };
 }
 // --- ESLint autofix helpers ---
-export { hasEslintConfig, hasRubocopConfig, hasSqlfluffConfig, hasStylelintConfig, };
+export { hasEslintConfig, hasSqlfluffConfig, hasStylelintConfig };
 /**
  * eslint autofix availability, per cwd + PATH. The verdict is owned by the
  * shared availability latch (#1494): a `missing` / `non-installable` outcome
@@ -338,7 +339,7 @@ async function tryDetektFix(filePath, cwd) {
     const absPath = path.resolve(cwd, filePath);
     return detectFileChangedAfterCommand(filePath, cmd, ["--auto-correct", "--input", absPath, "--config", configPath], cwd, [1, 2]);
 }
-export async function tryMarkdownlintFix(filePath, cwd) {
+async function tryMarkdownlintFix(filePath, cwd) {
     const cmd = await resolveToolCommandWithInstallFallback(cwd, "markdownlint");
     if (!cmd)
         return 0;
@@ -356,7 +357,7 @@ async function tryOxlintFix(filePath, cwd) {
     return detectFileChangedAfterCommand(filePath, cmd, ["--fix", filePath], cwd, [1]);
 }
 async function tryRustClippyFix(filePath) {
-    const check = await safeSpawnAsync("cargo", ["--version"], { timeout: 5000 });
+    const check = await probeToolAsync("cargo", ["--version"], { timeout: 5000 });
     if (check.error || check.status !== 0)
         return [];
     const cargoDir = findNearestContaining(path.dirname(path.resolve(filePath)), [
@@ -371,7 +372,7 @@ async function tryRustClippyFix(filePath) {
     return diffProjectSnapshot(cargoDir, before);
 }
 async function tryDartFix(filePath) {
-    const check = await safeSpawnAsync("dart", ["--version"], { timeout: 5000 });
+    const check = await probeToolAsync("dart", ["--version"], { timeout: 5000 });
     if (check.error || check.status !== 0)
         return [];
     const pubspecDir = findNearestContaining(path.dirname(path.resolve(filePath)), ["pubspec.yaml"]);

package/node_modules/pi-lens/dist/clients/project-changes.js

@@ -54,7 +54,7 @@ export function readProjectChanges(cwd) {
  * version — a missing/corrupt log is the normal cold-start case, not a
  * caller-visible error.
  */
-export async function readProjectChangesAsync(cwd) {
+async function readProjectChangesAsync(cwd) {
     const logPath = getProjectChangeLogPath(cwd);
     try {
         const content = await fs.promises.readFile(logPath, "utf-8");

package/node_modules/pi-lens/dist/clients/project-diagnostics/extractors.js

@@ -15,7 +15,7 @@ const WARM_TRIGGER = {
     "dead-code": "runs at session-start (Python projects only)",
     "test-runner": "fires per-edit at turn_end (only after a source file with a discoverable test companion is edited)",
 };
-export function warmTriggerFor(analyzerId) {
+function warmTriggerFor(analyzerId) {
     return WARM_TRIGGER[analyzerId] ?? "runs at session-start";
 }
 /**

package/node_modules/pi-lens/dist/clients/project-diagnostics/fresh-fetch.js

@@ -149,6 +149,7 @@ export async function fetchFreshProjectDiagnostics(cacheManager, cwd, clients, s
         return {
             diagnostics: [],
             runners: [],
+            analyzed: [],
             cold: [...ANALYZER_IDS],
             coldReasons: Object.fromEntries(ANALYZER_IDS.map((id) => [id, unsafeRootReason])),
             failed: [],
@@ -158,6 +159,7 @@ export async function fetchFreshProjectDiagnostics(cacheManager, cwd, clients, s
     }
     const diagnostics = [];
     const runners = [];
+    const analyzed = [];
     const cold = [];
     // #1623: the specific reason each `cold` id was skipped, captured at the
     // gate that decided it — see FreshProjectDiagnosticsResult.coldReasons.
@@ -188,7 +190,17 @@ export async function fetchFreshProjectDiagnostics(cacheManager, cwd, clients, s
         pushUnique(cold, id);
         coldReasons[id] = reason;
     }
-    function record(id, adapted, elapsedMs) {
+    /**
+     * `analysedRoot` is the client's own opt-in `AnalysedRootSignal` (#2154),
+     * never a property of reaching this function: `success: true` is also what
+     * a skipped, crashed-before-reporting or memoised run returns, and only the
+     * client knows which of those it is. Findings are recorded either way — an
+     * id that did not analyse the root simply carries no authority to retire a
+     * retained finding.
+     */
+    function record(id, adapted, elapsedMs, analysedRoot) {
+        if (analysedRoot)
+            pushUnique(analyzed, id);
         timings[id] = (timings[id] ?? 0) + elapsedMs;
         const kept = applyDispositionsMultiFile(adapted, analysisRoot, (d) => d.filePath);
         const suppressedHere = adapted.length - kept.length;
@@ -223,10 +235,17 @@ export async function fetchFreshProjectDiagnostics(cacheManager, cwd, clients, s
                 recordFailed("knip", result);
                 return;
             }
+            // knip reports `success: true` for a run that never happened (no
+            // project root, a memo hit, an unparseable exit-0). Those belong in
+            // the honest `cold` channel, not in "fetched fresh this call".
+            if (result.analyzed !== true) {
+                markCold("knip", result.summary ?? "knip did not analyse this root");
+                return;
+            }
             cacheManager.writeCache("knip", result, analysisRoot, {
                 scanDurationMs: Date.now() - startMs,
             });
-            record("knip", knipIssuesToProjectDiagnostics(analysisRoot, result.issues ?? []), Date.now() - startMs);
+            record("knip", knipIssuesToProjectDiagnostics(analysisRoot, result.issues ?? []), Date.now() - startMs, true);
         }),
         // jscpd — duplicate code detection. Cache key varies with TS-project
         // detection, exactly mirroring session_start's own logic.
@@ -243,10 +262,14 @@ export async function fetchFreshProjectDiagnostics(cacheManager, cwd, clients, s
                 recordFailed("jscpd", result);
                 return;
             }
+            if (result.analyzed !== true) {
+                markCold("jscpd", "jscpd did not analyse this root (no source files, or the scan produced no report)");
+                return;
+            }
             cacheManager.writeCache(scannerKey, result, analysisRoot, {
                 scanDurationMs: Date.now() - startMs,
             });
-            record("jscpd", jscpdResultToProjectDiagnostics(analysisRoot, result), Date.now() - startMs);
+            record("jscpd", jscpdResultToProjectDiagnostics(analysisRoot, result), Date.now() - startMs, true);
         }),
         // madge — circular-dependency detection.
         task("madge", async () => {
@@ -259,7 +282,7 @@ export async function fetchFreshProjectDiagnostics(cacheManager, cwd, clients, s
             cacheManager.writeCache("madge", result, analysisRoot, {
                 scanDurationMs: Date.now() - startMs,
             });
-            record("madge", circularDepsToProjectDiagnostics(analysisRoot, result.circular ?? []), Date.now() - startMs);
+            record("madge", circularDepsToProjectDiagnostics(analysisRoot, result.circular ?? []), Date.now() - startMs, result.analyzed === true);
         }),
         // gitleaks — committed-secrets detection. session_start/per-edit stay
         // config-gated per #130's strict default (GitleaksClient.hasGitleaksSignal),
@@ -290,7 +313,7 @@ export async function fetchFreshProjectDiagnostics(cacheManager, cwd, clients, s
             cacheManager.writeCache("gitleaks", result, analysisRoot, {
                 scanDurationMs: Date.now() - startMs,
             });
-            record("gitleaks", gitleaksResultToProjectDiagnostics(analysisRoot, result), Date.now() - startMs);
+            record("gitleaks", gitleaksResultToProjectDiagnostics(analysisRoot, result), Date.now() - startMs, result.analyzed === true);
         }),
         // govulncheck — Go module CVE detection. Go-module-gated per #132.
         task("govulncheck", async () => {
@@ -322,7 +345,7 @@ export async function fetchFreshProjectDiagnostics(cacheManager, cwd, clients, s
             cacheManager.writeCache("govulncheck", result, analysisRoot, {
                 scanDurationMs: Date.now() - startMs,
             });
-            record("govulncheck", govulncheckResultToProjectDiagnostics(analysisRoot, result), Date.now() - startMs);
+            record("govulncheck", govulncheckResultToProjectDiagnostics(analysisRoot, result), Date.now() - startMs, result.analyzed === true);
         }),
         // opengrep — full-workspace semgrep-grade security/quality findings via a
         // single project-wide CLI scan (#584). Structurally always-on: mirrors
@@ -352,7 +375,7 @@ export async function fetchFreshProjectDiagnostics(cacheManager, cwd, clients, s
             cacheManager.writeCache("opengrep", result, analysisRoot, {
                 scanDurationMs: Date.now() - startMs,
             });
-            record("opengrep", opengrepResultToProjectDiagnostics(analysisRoot, result), Date.now() - startMs);
+            record("opengrep", opengrepResultToProjectDiagnostics(analysisRoot, result), Date.now() - startMs, result.analyzed === true);
         }),
         // trivy — dependency CVE detection. Explicit opt-in per #131.
         task("trivy", async () => {
@@ -373,7 +396,7 @@ export async function fetchFreshProjectDiagnostics(cacheManager, cwd, clients, s
             cacheManager.writeCache("trivy", result, analysisRoot, {
                 scanDurationMs: Date.now() - startMs,
             });
-            record("trivy", trivyResultToProjectDiagnostics(analysisRoot, result), Date.now() - startMs);
+            record("trivy", trivyResultToProjectDiagnostics(analysisRoot, result), Date.now() - startMs, result.analyzed === true);
         }),
         // dead-code — cross-file dead-code for non-JS/TS languages (#127).
         // Each client self-gates via detect(); only matching-language projects
@@ -395,7 +418,7 @@ export async function fetchFreshProjectDiagnostics(cacheManager, cwd, clients, s
                 cacheManager.writeCache(cacheKey, result, analysisRoot, {
                     scanDurationMs: Date.now() - startMs,
                 });
-                record("dead-code", deadCodeResultToProjectDiagnostics(analysisRoot, result), Date.now() - startMs);
+                record("dead-code", deadCodeResultToProjectDiagnostics(analysisRoot, result), Date.now() - startMs, result.analyzed === true);
             }));
         }),
         // test-runner — CACHE-READ only, unlike every task above (#1004). Its
@@ -440,7 +463,10 @@ export async function fetchFreshProjectDiagnostics(cacheManager, cwd, clients, s
             // looking indistinguishable from a lane that just executed.
             cachedAgeMs["test-runner"] =
                 Date.now() - new Date(cached.meta.timestamp).getTime();
-            record("test-runner", testRunnerFindingsToProjectDiagnostics(cached.data, analysisRoot, options.runtime), Date.now() - startMs);
+            record("test-runner", testRunnerFindingsToProjectDiagnostics(cached.data, analysisRoot, options.runtime), Date.now() - startMs, 
+            // Never authoritative: this lane reads the cache turn_end wrote,
+            // it never runs a suite over the root this call (#2154).
+            false);
         }),
     ];
     // Swallow any later rejection so an aborted-and-abandoned task can never
@@ -470,6 +496,7 @@ export async function fetchFreshProjectDiagnostics(cacheManager, cwd, clients, s
         return {
             diagnostics,
             runners,
+            analyzed,
             cold,
             coldReasons,
             failed,
@@ -484,6 +511,7 @@ export async function fetchFreshProjectDiagnostics(cacheManager, cwd, clients, s
     return {
         diagnostics,
         runners,
+        analyzed,
         cold,
         coldReasons,
         failed,

package/node_modules/pi-lens/dist/clients/project-diagnostics/runner-adapters/gitleaks.js

@@ -3,12 +3,11 @@ import * as path from "node:path";
  * A gitleaks finding is a leaked secret at a concrete `file:startLine`. Secrets
  * are treated as **blocking** — a committed credential is not a style nit.
  *
- * Exception: `pathStatus: "scratch"` (#1562 review-round F2) — a finding
- * `classifyAndFilterFindings` demoted rather than dropped, so the observability
- * criterion ("record carries tracked/ignored/scratch status") stays honest
- * about a fourth REACHABLE value instead of silently deleting it. Demoted to
- * `severity: "info"`/`semantic: "none"` so it can never read as a blocking
- * "leaked secret" alarm, while remaining visible for an audit read.
+ * Findings in scratch trees, gitignored files, and nested repositories are
+ * retained for explicit audit but demoted to `severity: "info"` / `semantic:
+ * "none"`. They are outside the current repository's shippable source, so they
+ * must never read as blocking leaked-secret alarms. Tracked files and ordinary
+ * untracked files remain blocking.
  */
 export function gitleaksFindingToProjectDiagnostic(cwd, finding) {
     // #1562 observability criterion: surface the git status right in the
@@ -17,14 +16,16 @@ export function gitleaksFindingToProjectDiagnostic(cwd, finding) {
     const statusSuffix = finding.pathStatus
         ? ` [git: ${finding.pathStatus}]`
         : "";
-    const isScratch = finding.pathStatus === "scratch";
+    const isBlocking = finding.pathStatus !== "scratch" &&
+        finding.pathStatus !== "ignored" &&
+        finding.pathStatus !== "nested-repository";
     return {
         filePath: path.isAbsolute(finding.file)
             ? finding.file
             : path.resolve(cwd, finding.file),
         line: finding.startLine,
-        severity: isScratch ? "info" : "error",
-        semantic: isScratch ? "none" : "blocking",
+        severity: isBlocking ? "error" : "info",
+        semantic: isBlocking ? "blocking" : "none",
         tool: "gitleaks",
         runner: "gitleaks",
         rule: `gitleaks:${finding.ruleId}`,

package/node_modules/pi-lens/dist/clients/project-diagnostics/runner-adapters/jscpd.js

@@ -8,7 +8,7 @@ function resolveClonePath(cwd, file) {
  * BOTH ends so the duplication surfaces on whichever file the agent is looking
  * at, each one naming the other end.
  */
-export function jscpdCloneToProjectDiagnostics(cwd, clone) {
+function jscpdCloneToProjectDiagnostics(cwd, clone) {
     const a = resolveClonePath(cwd, clone.fileA);
     const b = resolveClonePath(cwd, clone.fileB);
     const make = (filePath, line, otherFile, otherLine) => ({

package/node_modules/pi-lens/dist/clients/project-diagnostics/runner-adapters/knip.js

@@ -27,7 +27,7 @@ function knipIssueMessage(issue) {
     }
     return `${issue.type}: ${issue.name}`;
 }
-export function knipIssueToProjectDiagnostic(cwd, issue) {
+function knipIssueToProjectDiagnostic(cwd, issue) {
     const blocking = issue.type === "unlisted" || issue.type === "bin";
     return {
         filePath: knipIssueFile(cwd, issue),

package/node_modules/pi-lens/dist/clients/project-diagnostics/runner-adapters/madge.js

@@ -12,7 +12,7 @@ function cycleMembers(dep) {
  * single-point knip finding. Emit a diagnostic on EACH file in the cycle so it
  * surfaces wherever the agent is looking, each one rendering the whole cycle.
  */
-export function circularDepToProjectDiagnostics(cwd, dep) {
+function circularDepToProjectDiagnostics(cwd, dep) {
     const members = cycleMembers(dep);
     const rendered = `${members.map((f) => path.basename(f)).join(" → ")} → ${path.basename(members[0] ?? "")}`;
     return members.map((file) => ({

package/node_modules/pi-lens/dist/clients/project-diagnostics/runner-adapters/opengrep.js

@@ -15,7 +15,7 @@ function severityFor(raw) {
             return { severity: "warning", blocking: false };
     }
 }
-export function opengrepFindingToProjectDiagnostic(cwd, finding) {
+function opengrepFindingToProjectDiagnostic(cwd, finding) {
     const { severity, blocking } = severityFor(finding.severity);
     const cweSuffix = finding.cwe?.length ? ` (${finding.cwe[0]})` : "";
     return {

package/node_modules/pi-lens/dist/clients/project-diagnostics/runner-adapters/runner-findings.js

@@ -43,7 +43,7 @@ function parseLocation(location) {
  * caller deserves the same "this may already be superseded" honesty the
  * per-edit path already gives.
  */
-export function testResultToProjectDiagnostics(result, stale = false) {
+function testResultToProjectDiagnostics(result, stale = false) {
     if (result.failed === 0 && !result.error)
         return [];
     const stalePrefix = stale ? "[stale — from a prior turn] " : "";

package/node_modules/pi-lens/dist/clients/project-lens-config.js

@@ -69,6 +69,7 @@ import { deprecationRecords, ignoredRecordCollector, projectLocationFor, readCon
 import { finalizeRecords, } from "./config-core/records.js";
 import { homeRelativePath, isAtOrAboveHomeDir, walkUpDirs, } from "./path-utils.js";
 import { findPiLensConfigMarkerInDir } from "./workspace-topology.js";
+import { readToolConfig } from "./tool-config.js";
 /**
  * Project config basenames, in DESCENDING precedence (first match wins), for
  * this loader's own discovery.
@@ -162,8 +163,15 @@ export function loadPiLensProjectConfig(startDir, preloadedInfo) {
     // a pi-lens-owned file were then produced by nobody at all. The pi-lens
     // loader now enumerates those documents itself, for records only: nothing
     // here is merged, and which file supplies a VALUE is unchanged.
-    reportPiLensConfigRecords(entry.legacyRecords);
     const configInfo = preloadedInfo ?? freshInfoFor(entry);
+    // The selected legacy document is resolved below and its bounded migration
+    // records are cached with that projection. Reporting the discovery copy as
+    // well would produce two suppression records with different totals, because
+    // the discovery walk and the single-document resolution see different
+    // record populations. Keep discovery-only documents here; the selected file
+    // is reported by `loadCachedConfigFile`.
+    const selectedLegacyPath = configInfo?.path;
+    reportPiLensConfigRecords(entry.legacyRecords.filter((record) => record.file !== selectedLegacyPath));
     if (!configInfo)
         return EMPTY_PROJECT_CONFIG;
     return loadCachedConfigFile(configInfo);
@@ -556,6 +564,7 @@ function parseConfigFile(configPath) {
     for (const spec of PROJECT_SCOPED_LENS_FLAGS) {
         assignFlagConfigSection(obj, mutations, spec.configKey, note);
     }
+    const toolConfig = readToolConfig(obj, note);
     const rules = {};
     if (obj.rules && typeof obj.rules === "object" && !Array.isArray(obj.rules)) {
         const rawRules = obj.rules;
@@ -634,6 +643,43 @@ function parseConfigFile(configPath) {
             }
         }
     }
+    let startup;
+    if (obj.startup !== undefined) {
+        if (!obj.startup ||
+            typeof obj.startup !== "object" ||
+            Array.isArray(obj.startup)) {
+            note("startup must be an object");
+        }
+        else {
+            const section = obj.startup;
+            if (section.mode === "quick" ||
+                section.mode === "full" ||
+                section.mode === "minimal") {
+                startup = { mode: section.mode };
+            }
+            else if ("mode" in section) {
+                note('startup.mode must be "quick", "full", or "minimal"');
+            }
+            if (section.scans !== undefined) {
+                if (!section.scans ||
+                    typeof section.scans !== "object" ||
+                    Array.isArray(section.scans)) {
+                    note("startup.scans must be an object");
+                }
+                else if (typeof section.scans.enabled ===
+                    "boolean") {
+                    startup ??= {};
+                    startup.scans = {
+                        enabled: section.scans
+                            .enabled,
+                    };
+                }
+                else if ("enabled" in section.scans) {
+                    note("startup.scans.enabled must be a boolean");
+                }
+            }
+        }
+    }
     // #533 hygiene: mirror the global loader's unknown-key warn so a typo in a
     // shared `.pi-lens.json` (e.g. `maxProjectFile`, `lps`) produces a signal
     // instead of silently doing nothing. The recognized set is single-sourced
@@ -694,6 +740,8 @@ function parseConfigFile(configPath) {
     }
     return {
         config: {
+            ...(toolConfig === undefined ? {} : { tools: toolConfig }),
+            ...(startup === undefined ? {} : { startup }),
             ignore,
             rules,
             ...mutations,