@herbertgao/pi-extensions 2026.9.15 → 2026.9.16

package/node_modules/pi-lens/dist/clients/config-diagnostic-codes.js

@@ -173,6 +173,8 @@ export const CONFIG_DIAGNOSTIC_CODES = {
     PILENS_CFG_0008: "config resolution failed; whole configuration ignored",
     /** A tool key is unknown or names a required, non-disableable tool. */
     PILENS_CFG_0009: "unknown or non-disableable tool config key ignored",
+    /** A lower-precedence supported global config file was shadowed by the winner. */
+    PILENS_CFG_0010: "lower-precedence global config file shadowed",
 };
 /** The shape every code in the namespace must match. */
 export const CONFIG_DIAGNOSTIC_CODE_PATTERN = /^PILENS_CFG_\d{4}$/;

package/node_modules/pi-lens/dist/clients/config-locations.js

@@ -22,12 +22,17 @@
  * exactly the registry's `kind: "file"` rows. Registry owns WHICH surfaces are
  * deprecated; this module owns only their precedence.
  *
- * Pure data plus one walk. No file reads, no caching, no state.
+ * Pure data, one walk, and — as of the global-config-location PR (refs #2457,
+ * #2426) — the ONE existence probe and memoized resolution that decide which
+ * file supplies the global tier. The probe is a single `statSync` under the
+ * resolution memo; no other file reads, no state beyond that one memo.
  */
+import * as fs from "node:fs";
 import * as os from "node:os";
 import * as path from "node:path";
 import { DEPRECATED_CONFIG_SURFACES } from "./config-diagnostic-codes.js";
-import { isAtOrAboveHomeDir, walkUpDirs } from "./path-utils.js";
+import { errorClassName } from "./error-class.js";
+import { isAtOrAboveHomeDir, isWindowsPath, normalizeFilePath, realpathOrResolve, walkUpDirs, } from "./path-utils.js";
 /** The one canonical PROJECT config file. Never deprecated. */
 export const CANONICAL_PROJECT_CONFIG_FILE = ".pi-lens.json";
 /** Basename of the one canonical GLOBAL config file inside `~/.pi-lens/`. */
@@ -139,9 +144,167 @@ export function configSearchDirs(startDir, homeDir = os.homedir()) {
     }
     return dirs;
 }
+function defaultGlobalConfigExists(file) {
+    try {
+        return fs.statSync(file).isFile();
+    }
+    catch (error) {
+        // ENOENT is the ordinary ABSENT answer the tier walk consumes. Any other
+        // stat failure (ENOTDIR when a file sits where a directory belongs,
+        // EACCES, ELOOP) propagates: the discriminated probe in
+        // `resolveGlobalConfigLocation` retains the errored tier instead of
+        // silently switching config sources (#3251 review H2, defect shape 48),
+        // and the load's read of the retained path is reported by the existing
+        // `PILENS_CFG_0001` seam.
+        if (error.code === "ENOENT")
+            return false;
+        throw error;
+    }
+}
 /**
- * The absolute path of the canonical GLOBAL config — `~/.pi-lens/config.json`,
- * or `PI_LENS_CONFIG_PATH` when it overrides that.
+ * The agent-dir config path for one `PI_CODING_AGENT_DIR` value, shared by the
+ * resolution and the recognized-location set so the two can never spell the
+ * same location differently.
+ *
+ * Shape-aware joining (defect shape 2): a Windows-shaped agent dir is joined
+ * with `path.win32` regardless of host — the host-default `path.resolve` on
+ * POSIX treats a drive-letter path as RELATIVE and mangles it, which made a
+ * case-folded Windows spelling unmatchable (#3251 review M1).
+ */
+function agentConfigPathFor(agentDir) {
+    return isWindowsPath(agentDir)
+        ? path.win32.join(path.win32.resolve(agentDir), "extensions", "pi-lens.json")
+        : path.join(path.resolve(agentDir), "extensions", "pi-lens.json");
+}
+/**
+ * Resolve which file supplies the global config tier (see
+ * `GlobalConfigLocationSource` for the order).
+ *
+ * Lives here rather than in `lens-config.ts` (#2426 review round 3, S1):
+ * this module is the one that already states "WHERE pi-lens config lives",
+ * and BOTH discovery seams that must refuse the resolved global path
+ * (`project-lens-config.ts`, `workspace-topology.ts`) already import from
+ * here — importing the resolver from `lens-config.ts` would close a cycle
+ * (`lens-config.ts` itself imports from `project-lens-config.ts`).
+ * `lens-config.ts` re-exports the accessors so its own, pre-existing import
+ * sites are unaffected.
+ */
+export function resolveGlobalConfigLocation(options) {
+    // An options object means the caller OWNS the resolution context (a test
+    // or explicitly-scoped caller): the ambient host env must not leak into it,
+    // or a test that resolves-then-writes "under its own home" lands in the
+    // maintainer's real config (dogfooded live: ambient PI_CODING_AGENT_DIR
+    // redirected a suite's writeConfig into ~/.config/pi/agent/extensions/
+    // pi-lens.json). Owned contexts therefore ignore PI_CODING_AGENT_DIR
+    // entirely; only the production resolution (no options) walks the
+    // host-relative tier. PI_LENS_HOME does not participate in this resolution
+    // at all — the canonical default keeps its released homedir spelling, and
+    // the #2457 split-brain (which concerns the machine root, not the config
+    // file) stays a separate issue.
+    const owned = options !== undefined;
+    const homeDir = options?.homeDir ?? os.homedir();
+    const legacyDefault = path.join(homeDir, ".pi-lens", CANONICAL_GLOBAL_CONFIG_FILE);
+    // Byte-compatible with the released override: any non-empty value wins,
+    // untrimmed, exactly as before.
+    const override = process.env.PI_LENS_CONFIG_PATH;
+    if (override) {
+        return { path: path.resolve(override), source: "pi-lens-config-path" };
+    }
+    // The probe is DISCRIMINATED (#3251 review H2, defect shape 48): "error"
+    // (ENOTDIR when a file sits where a directory belongs, EACCES, ELOOP) is
+    // NOT absent — the errored tier is RETAINED, so the load's read of that
+    // same path fails and the existing `reportConfigReadFailure` seam
+    // (`PILENS_CFG_0001`) reports it. Absorbing the error as ABSENT would
+    // silently select a lower tier: different user settings applying with no
+    // diagnostic, and the read seam would only ever see the finally-read path,
+    // never the probe that failed.
+    let probeError;
+    const probe = (file) => {
+        try {
+            return (options?.exists ?? defaultGlobalConfigExists)(file)
+                ? "present"
+                : "absent";
+        }
+        catch (error) {
+            // The caught error is carried to the retained tier's resolution so
+            // the loader's retention record can name the error CLASS (never
+            // the message, per the #2431/#2451 rule).
+            probeError = error;
+            return "error";
+        }
+    };
+    const agentDir = owned ? undefined : process.env.PI_CODING_AGENT_DIR?.trim();
+    const agentPath = agentDir ? agentConfigPathFor(agentDir) : undefined;
+    const legacyProbe = probe(legacyDefault);
+    if (legacyProbe === "present") {
+        if (agentPath !== undefined && probe(agentPath) === "present") {
+            return {
+                path: legacyDefault,
+                source: "legacy-default-existing",
+                shadowedPath: agentPath,
+            };
+        }
+        return { path: legacyDefault, source: "legacy-default-existing" };
+    }
+    if (legacyProbe === "error") {
+        // Fail closed at the location the probe could not evaluate: the file
+        // might exist, and switching sources would silently swap the user's
+        // settings. The subsequent read reports the failure (`PILENS_CFG_0001`),
+        // and the loader emits the probe-failed retention record.
+        return {
+            path: legacyDefault,
+            source: "legacy-default-unprobed",
+            existsProbeFailed: {
+                path: legacyDefault,
+                errorClassName: errorClassName(probeError),
+            },
+        };
+    }
+    if (agentPath !== undefined) {
+        const agentProbe = probe(agentPath);
+        if (agentProbe === "present") {
+            return { path: agentPath, source: "pi-coding-agent-dir" };
+        }
+        if (agentProbe === "error") {
+            // Same rule one tier down: the agent-dir identity is retained, and
+            // the read of it reports the failure rather than the resolution
+            // silently falling to the canonical default.
+            return {
+                path: agentPath,
+                source: "pi-coding-agent-dir-unprobed",
+                existsProbeFailed: {
+                    path: agentPath,
+                    errorClassName: errorClassName(probeError),
+                },
+            };
+        }
+    }
+    return { path: legacyDefault, source: "canonical-default" };
+}
+let memoizedGlobalConfigResolution;
+function globalConfigEnvFingerprint() {
+    return JSON.stringify([
+        process.env.PI_LENS_CONFIG_PATH,
+        process.env.PI_CODING_AGENT_DIR,
+    ]);
+}
+export function getProductionGlobalConfigResolution() {
+    const fingerprint = globalConfigEnvFingerprint();
+    if (memoizedGlobalConfigResolution?.fingerprint !== fingerprint) {
+        memoizedGlobalConfigResolution = {
+            fingerprint,
+            resolution: resolveGlobalConfigLocation(),
+        };
+    }
+    return memoizedGlobalConfigResolution.resolution;
+}
+/** Test-only: drop the memoized production resolution so the next call re-probes. */
+export function resetGlobalConfigLocationCache() {
+    memoizedGlobalConfigResolution = undefined;
+}
+/**
+ * The absolute path of the canonical GLOBAL config (see
+ * `GlobalConfigLocationSource` for the full resolution order).
  *
  * Lives here rather than in `lens-config.ts` (#2426 review round 3, S1),
  * which is where it originated: this module is the one that already states
@@ -152,9 +315,74 @@ export function configSearchDirs(startDir, homeDir = os.homedir()) {
  * `project-lens-config.ts`. `lens-config.ts` re-exports this so its own,
  * pre-existing import sites are unaffected.
  */
-export function getPiLensGlobalConfigPath(homeDir = os.homedir()) {
-    const override = process.env.PI_LENS_CONFIG_PATH;
-    if (override)
-        return path.resolve(override);
-    return path.join(homeDir, ".pi-lens", CANONICAL_GLOBAL_CONFIG_FILE);
+export function getPiLensGlobalConfigPath(homeDir) {
+    return homeDir === undefined
+        ? getProductionGlobalConfigResolution().path
+        : resolveGlobalConfigLocation({ homeDir }).path;
+}
+/**
+ * Whether `candidate` matches ANY location the global config tier recognizes —
+ * the resolved file, the legacy default, and the agent-dir target.
+ *
+ * The one predicate every project-config discovery seam consults before it
+ * adopts a candidate (#783's nested layering, the upward walk, and the
+ * workspace marker index): a file the global tier recognizes must not be
+ * discovered a second time as a project config — the discovery loader would
+ * full-validate it, ignore every global-only key in it, and advise the user
+ * to set those keys in the very file it is ignoring. The check covers the
+ * POTENTIAL set, not just whichever file currently won the read: a second
+ * recognized file that exists but lost the tier walk (the grandfathered
+ * legacy file beside an adopted agent-dir file, say) is equally not a project
+ * config.
+ *
+ * Comparison is alias-anchored on BOTH sides (#3251 review M1 round 2):
+ * each path is canonicalized through `realpathOrResolve` (resolving existing
+ * symlink aliases; a nonexistent path falls back to its resolved spelling —
+ * the documented fallback) and then `normalizeFilePath` (separator-agnostic,
+ * case-insensitive on Windows, casing-adoption). A symlinked-home alias of a
+ * recognized location is therefore the same identity as its real spelling,
+ * and a case-folded or separator-differing Windows spelling cannot dodge the
+ * refusal either.
+ */
+export function isResolvedGlobalConfigPath(candidate) {
+    return recognizedGlobalConfigPaths().has(canonicalPathIdentity(candidate));
+}
+/**
+ * Canonical path identity for one candidate: realpath-anchored so an
+ * existing symlink alias resolves to the same identity as its real spelling
+ * (#3251 review M1 round 2), with `realpathOrResolve`'s documented
+ * nonexistent-path fallback (the resolved spelling, dot-folded and
+ * case-normalized by `normalizeFilePath` — which pays its own `realpath`
+ * only when the path exists). The discovery seams consult this predicate
+ * per config candidate, and the env-derived recognized set is canonicalized
+ * with the SAME helper once per env fingerprint, so both sides of the
+ * comparison share one identity function.
+ */
+export function canonicalPathIdentity(candidate) {
+    // Shape-aware (defect shape 2): a Windows-shaped path is resolved with
+    // `path.win32` — the host resolver on POSIX treats a drive-letter path as
+    // RELATIVE and mangles it before any comparison could run. On a real
+    // Windows host this arm is the native one, and `normalizeFilePath`'s
+    // Windows branch does the alias resolution itself (realpathSync.native
+    // plus canonical-casing adoption).
+    if (isWindowsPath(candidate)) {
+        return normalizeFilePath(path.win32.resolve(candidate));
+    }
+    return normalizeFilePath(realpathOrResolve(candidate));
+}
+let recognizedCache;
+function recognizedGlobalConfigPaths() {
+    const fingerprint = globalConfigEnvFingerprint();
+    if (recognizedCache?.fingerprint !== fingerprint) {
+        const paths = new Set();
+        const override = process.env.PI_LENS_CONFIG_PATH;
+        if (override)
+            paths.add(canonicalPathIdentity(path.resolve(override)));
+        paths.add(canonicalPathIdentity(path.join(os.homedir(), ".pi-lens", CANONICAL_GLOBAL_CONFIG_FILE)));
+        const agentDir = process.env.PI_CODING_AGENT_DIR?.trim();
+        if (agentDir)
+            paths.add(canonicalPathIdentity(agentConfigPathFor(agentDir)));
+        recognizedCache = { fingerprint, paths };
+    }
+    return recognizedCache.paths;
 }

package/node_modules/pi-lens/dist/clients/config-resolve.js

@@ -60,7 +60,7 @@ import * as fs from "node:fs";
 import * as os from "node:os";
 import * as path from "node:path";
 import { DEPRECATED_CONFIG_SURFACES, } from "./config-diagnostic-codes.js";
-import { CANONICAL_GLOBAL_CONFIG_FILE, CANONICAL_PROJECT_CONFIG_FILE, GLOBAL_CONFIG_LOCATIONS, LEGACY_ROOT_LSP_KEYS, LSP_NAMESPACE_KEY, PROJECT_CONFIG_LOCATIONS, configSearchDirs, } from "./config-locations.js";
+import { CANONICAL_GLOBAL_CONFIG_FILE, CANONICAL_PROJECT_CONFIG_FILE, GLOBAL_CONFIG_LOCATIONS, isResolvedGlobalConfigPath, LEGACY_ROOT_LSP_KEYS, LSP_NAMESPACE_KEY, PROJECT_CONFIG_LOCATIONS, configSearchDirs, } from "./config-locations.js";
 // The core's halves are imported directly rather than through
 // `config-core/index.js` (#2426). The barrel re-exports the whole vocabulary
 // including `process-spec.js`, which reaches `project-trust.js` and the
@@ -126,6 +126,12 @@ function collectDocuments(dir, locations, tier, onReadError) {
     const documents = [];
     for (const location of locations) {
         const file = path.join(dir, location.relativePath);
+        // The global tier reads its file by absolute path; a candidate that IS
+        // that file is refused rather than adopted as a project/nested-project
+        // document, which would double-read and double-validate it
+        // (global-config-location PR, refs #2457).
+        if (tier !== "global" && isResolvedGlobalConfigPath(file))
+            continue;
         const outcome = readConfigDocument(file);
         if (outcome.status === "missing")
             continue;

package/node_modules/pi-lens/dist/clients/degradation-ledger.js

@@ -37,10 +37,21 @@ let ledgerGeneration = 0;
 export function getDegradationLedgerGeneration() {
     return ledgerGeneration;
 }
+/**
+ * Test-only population probe for bounded-container regressions. Keep this
+ * read-only and deliberately expose sizes, not the retained identities.
+ */
+export function _getDegradationLedgerStateForTests() {
+    return {
+        onceKeys: onceKeys.size,
+        tallies: tallies.size,
+        retainedEntries: [...groups.values()].reduce((total, group) => total + group.entries.length, 0),
+    };
+}
 export function recordDegradation(record) {
     try {
         const kind = boundedKind(record.kind);
-        const subject = truncateForLedger(record.subject);
+        const subject = subjectForLedger(record.subject);
         const reason = truncateForLedger(record.reason);
         let group = groups.get(kind);
         if (!group) {
@@ -67,7 +78,7 @@ export function recordDegradation(record) {
 export function recordDegradationOnce(record) {
     try {
         const kind = boundedKind(record.kind);
-        const subject = truncateForLedger(record.subject);
+        const subject = subjectForLedger(record.subject);
         const key = `${kind}\0${subject}`;
         if (onceKeys.has(key))
             return;
@@ -96,7 +107,7 @@ export function recordDegradationOnce(record) {
 export function incrementDegradationCount(record) {
     try {
         const kind = boundedKind(record.kind);
-        const subject = truncateForLedger(record.subject);
+        const subject = subjectForLedger(record.subject);
         const reason = truncateForLedger(record.reason);
         const key = `${kind}\0${subject}`;
         const count = (tallies.get(key) ?? 0) + 1;
@@ -172,6 +183,25 @@ function boundLedgerMetadata(metadata) {
 function isPowerOfTwo(value) {
     return value > 0 && (value & (value - 1)) === 0;
 }
+/**
+ * A subject is an IDENTITY: it is the row's discriminator, the `filePath` of
+ * its durable latency row, and the text `renderDegradationLines` prints after
+ * the count. A blank one names nothing — `⚠ kind: 1 — : reason` — so blank and
+ * missing are the same case and both read `unknown` (#3389 verify round 2,
+ * F3395-02: a socket error carrying `code: ""` wrote an empty subject).
+ *
+ * This is deliberately NOT `normalizeForLedger`'s job, though every ledger
+ * field passes through it: that normalizer keeps falsy primitives on purpose
+ * (`tests/clients/ledger-bounds.test.ts` "keeps primitives, including falsy
+ * ones"), because a metadata VALUE of `""` or `0` is data, not absence. Only
+ * the identity fields fold blank into missing, and `0`/`false` still name
+ * something here too — the check reads the NORMALIZED text, never the caller's
+ * truthiness.
+ */
+function subjectForLedger(value) {
+    const subject = truncateForLedger(value);
+    return subject.trim() === "" ? "unknown" : subject;
+}
 function boundedKind(value) {
     const kind = truncateForLedger(value);
     if (groups.has(kind) || kind === OVERFLOW_KIND)

package/node_modules/pi-lens/dist/clients/dependency-checker.js

@@ -8,6 +8,7 @@
  * Requires: npm install -D madge
  * Docs: https://github.com/pahen/madge
  */
+import { recordDegradationOnce } from "./degradation-ledger.js";
 import { createSubsystemLogger } from "./extension-log.js";
 import * as fs from "node:fs";
 import * as path from "node:path";
@@ -36,34 +37,79 @@ export function buildMadgeArgs(target, projectRoot) {
     if (fs.existsSync(tsConfig)) {
         args.push("--ts-config", tsConfig);
     }
-    // --warning surfaces files madge couldn't resolve into the graph (to stderr;
-    // stdout JSON is unaffected). Without it those skips are SILENT — and a
-    // skipped *local* file could hide a real cycle. We log them (see
-    // parseMadgeSkips) instead of discarding stderr.
-    args.push("--warning", "--json", target);
+    // No `--warning`: madge gates it on `!program.json` (bin/cli.js:195) and this
+    // argv always passes `--json`, so the flag is inert; ungated it prints the
+    // skipped-file list to STDOUT (lib/output.js), which would corrupt the JSON
+    // this reader parses. The skip list is therefore unreachable through any
+    // argv this builder emits — `parseMadgeSkips` could only ever return zeros
+    // (#3436). The lost visibility is disclosed once per session/root by
+    // `recordDegradationOnce` from `parseMadgeCycles`, the one reader both
+    // madge lanes pass through, instead of parsed from bytes madge never
+    // writes.
+    args.push("--json", target);
     return args;
 }
 /**
- * Parse madge's `--warning` stderr for skipped (unresolvable) files. External
- * package specifiers (bare names / subpaths like `web-tree-sitter`,
- * `vitest/config`) are expected — madge doesn't traverse node_modules. We flag
- * only **local** skips (relative/absolute paths), which are the ones that could
- * silently drop an internal edge and hide a cycle.
+ * The ONE reader of madge's `--circular --json` contract (#3428).
  *
- * @returns total skip count and the subset that look local.
+ * madge prints an array of cycles, each cycle an array of member paths —
+ * `[["src/a.ts", "src/b.ts"]]` — not a dependency graph. Upstream 8.0.0:
+ * `bin/cli.js:258-268` hands `Madge.circular()` (an Array, `lib/api.js:103`) to
+ * `output.circular`, which for `--json` is `printJSON(circular)`
+ * (`lib/output.js:71-73`). The graph OBJECT is what `--json` prints WITHOUT
+ * `--circular`, and `buildMadgeArgs` always passes `--circular`.
+ *
+ * This function exists because there were two readers and they disagreed: the
+ * whole-project scan read the array with `Object.entries`, so every cycle it
+ * reported was anchored at the array INDEX (`<root>/0`, a path that does not
+ * exist) and every member was resolved against the extension host's cwd. Both
+ * callers now share this one reader.
+ *
+ * `baseDir` is the directory madge's relative members resolve against, which is
+ * the TARGET it was pointed at (measured, madge 8.0.0: `--json <root>` prints
+ * `src/a.ts`; `--json <root>/src/a.ts` prints `a.ts`), so each caller passes
+ * the base its own target implies.
+ *
+ * Malformed JSON throws, which both callers already treat as "did not parse". A
+ * parse that is not an array does NOT throw: it yields zero cycles, so an
+ * unexpected shape reports no findings instead of turning a completed scan into
+ * a failed one (#2154 — a failed madge scan is a COLD lane in `mode=full`).
+ *
+ * This reader is also the ONE place both madge lanes (the turn-end
+ * `runMadgeSpawn` and the session-start `runScanProject`) turn bytes into
+ * findings, so the argv's blind spot is recorded here rather than once per
+ * caller (#3436). `projectRoot` is the ledger subject, not the resolve
+ * `baseDir`: a single-file target resolves members against its own directory
+ * but the gap is a property of the project's scan, disclosed once per
+ * session/root.
  */
-export function parseMadgeSkips(stderr) {
-    const lines = (stderr || "").split(/\r?\n/);
-    const headerIdx = lines.findIndex((l) => /Skipped\s+\d+\s+file/i.test(l));
-    if (headerIdx === -1)
-        return { total: 0, local: [] };
-    const total = Number.parseInt(lines[headerIdx].match(/Skipped\s+(\d+)/i)?.[1] ?? "0", 10) || 0;
-    const specifiers = lines
-        .slice(headerIdx + 1)
-        .map((l) => l.trim())
-        .filter(Boolean);
-    const local = specifiers.filter((s) => s.startsWith(".") || s.startsWith("/") || /^[a-zA-Z]:[\\/]/.test(s));
-    return { total, local };
+function parseMadgeCycles(stdout, baseDir, projectRoot) {
+    const parsed = JSON.parse(stdout || "[]");
+    const cycles = Array.isArray(parsed) ? parsed : [];
+    const circular = [];
+    const circularFiles = new Set();
+    for (const cycle of cycles) {
+        const resolvedPaths = cycle.map((f) => path.resolve(baseDir, f));
+        for (const f of resolvedPaths) {
+            circularFiles.add(f);
+        }
+        circular.push({
+            file: resolvedPaths[0],
+            path: resolvedPaths,
+        });
+    }
+    // madge's `--warning` is inert under `--json` (bin/cli.js:195 gates it on
+    // `!program.json`) and, ungated, prints the skip list to stdout where it
+    // would corrupt the JSON this reader parses, so no argv `buildMadgeArgs`
+    // emits can report which LOCAL files madge failed to resolve. A skipped
+    // local file can hide a real cycle, so the gap is disclosed once per
+    // session/root instead of being read as a clean graph (#3436).
+    recordDegradationOnce({
+        kind: "madge-skip-visibility-unavailable",
+        subject: projectRoot,
+        reason: "madge --warning is inert under --json; skipped-file visibility is unavailable for this scan",
+    });
+    return { circular, circularFiles };
 }
 /**
  * Defensive cap on concurrent madge spawns for a single `checkFilesBatch`
@@ -520,7 +566,6 @@ export class DependencyChecker {
             circular: spawnResult.circular.filter((d) => d.file === normalized || d.path.includes(normalized)),
             checked: true,
             cacheHit: false,
-            localSkips: spawnResult.localSkips,
         };
     }
     /**
@@ -542,31 +587,20 @@ export class DependencyChecker {
                 this.log(`Check error: ${result.error.message}`);
                 return { ok: false };
             }
-            const output = result.stdout || "[]";
-            const parsed = JSON.parse(output);
-            // Madge --circular --json returns array of cycle arrays: [["a.ts", "b.ts"], ...]
-            const cycles = Array.isArray(parsed) ? parsed : [];
-            const circular = [];
-            const circularFiles = new Set();
-            for (const cycle of cycles) {
-                const resolvedPaths = cycle.map((f) => path.resolve(projectRoot, f));
-                for (const f of resolvedPaths) {
-                    circularFiles.add(f);
-                }
-                circular.push({
-                    file: resolvedPaths[0],
-                    path: resolvedPaths,
-                });
-            }
-            const skips = parseMadgeSkips(result.stderr || "");
-            if (skips.local.length > 0) {
-                this.log(`madge skipped ${skips.local.length} local file(s) (possible silent cycle-miss): ${skips.local.slice(0, 5).join(", ")}`);
-            }
+            // madge resolves its printed members against the TARGET, which this
+            // lane points at a single FILE, so they come back relative to that
+            // file's directory — `a.ts`/`b.ts` for a `src/a.ts` target, and
+            // `../lib/b.ts` for a cycle that leaves it (measured with madge 8.0.0,
+            // see parseMadgeCycles). Resolving them against `projectRoot` instead
+            // anchors `<root>/a.ts`, a path that does not exist, and keys the
+            // shared `circularFiles` set with it (#3435). `path.dirname` of the
+            // target is the file-independent form of "the directory madge printed
+            // relative to"; a top-level target degenerates to `projectRoot`.
+            const { circular, circularFiles } = parseMadgeCycles(result.stdout || "", path.dirname(normalized), projectRoot);
             return {
                 ok: true,
                 circular,
                 circularFiles,
-                localSkips: skips.local.length,
             };
         }
         catch (err) {
@@ -729,7 +763,6 @@ export class DependencyChecker {
                 circular: spawnResult.circular.filter((d) => d.file === entry.normalized || d.path.includes(entry.normalized)),
                 checked: true,
                 cacheHit: false,
-                localSkips: spawnResult.localSkips,
             });
         }
         // A batch that learned nothing publishes nothing — advancing the
@@ -800,25 +833,15 @@ export class DependencyChecker {
                 this.log(`Scan error: ${result.error.message}`);
                 return { circular: [], count: 0 };
             }
-            const output = result.stdout || "{}";
-            const data = JSON.parse(output);
-            const circular = [];
-            const circularFiles = new Set();
-            for (const [file, deps] of Object.entries(data)) {
-                if (Array.isArray(deps) && deps.length > 0) {
-                    const resolvedFile = path.resolve(file);
-                    circularFiles.add(resolvedFile);
-                    circular.push({
-                        file: resolvedFile,
-                        path: [resolvedFile, ...deps.map((d) => path.resolve(d))],
-                    });
-                }
-            }
+            // The scan's target IS `projectRoot`, so that is the base madge's
+            // relative members resolve against (#3428: this site used to read the
+            // cycle array as a graph and anchor every finding at `<hostCwd>/0`).
+            const { circular, circularFiles } = parseMadgeCycles(result.stdout || "", projectRoot, projectRoot);
             this.publishState(gen, circular, circularFiles);
-            // #2154: the one madge site that parsed a graph for this root. Every
-            // other return here (missing root, no top-level source file, madge
-            // unavailable, spawn error, parse throw) is the SAME empty shape and
-            // must not be read as "no cycles in this project".
+            // #2154: the one madge site that parsed madge's output for this root.
+            // Every other return here (missing root, no top-level source file,
+            // madge unavailable, spawn error, parse throw) is the SAME empty shape
+            // and must not be read as "no cycles in this project".
             return { circular, count: circular.length, analyzed: true };
         }
         catch (err) {

package/node_modules/pi-lens/dist/clients/diagnostic-dispositions.js

@@ -118,10 +118,42 @@ export const normalizeMessage = sharedNormalizeMessage;
 // file, and the module doc/comments above referencing `relativeFile`, keep
 // working unchanged.
 const relativeFile = sharedRelativeFile;
+/**
+ * The SPAN component of a strict anchor: the `lineContentHash` of the
+ * diagnostic's OWN line in `content`. `undefined` when there is no line to
+ * hash — no content, no line, or a line outside the content's range.
+ *
+ * Exported for #3183. The widget store's retention lifetime asks the same
+ * question a strict anchor does — "is the marked line still in this file?" —
+ * so it reuses this derivation rather than re-spelling it; a second spelling is
+ * how the store's answer drifts from the filter's (the retention identity's own
+ * drift from `computeWeakAnchor`'s parts cost #3158 a round). Note what is NOT
+ * here: the cwd/path component `stableFindingId` adds. Both sides of a
+ * retention comparison are the same file, so the span alone discriminates
+ * exactly as well while needing no `cwd` — which is why the store can ask it at
+ * all (see `retentionIdentity` in `clients/widget-state.ts`).
+ */
+export function strictAnchorSpan(content, line) {
+    if (content === undefined || line === undefined)
+        return undefined;
+    const lines = content.split(/\r?\n/);
+    if (line < 1 || line > lines.length)
+        return undefined;
+    return lineContentHash(lines[line - 1] ?? "");
+}
+/**
+ * Every span {@link strictAnchorSpan} could produce for `content` — one hash
+ * per line (#3183). Membership answers "does the line a mark was made against
+ * still exist in this file", wherever it has since moved to.
+ */
+export function strictAnchorSpansIn(content) {
+    const spans = new Set();
+    for (const line of content.split(/\r?\n/))
+        spans.add(lineContentHash(line));
+    return spans;
+}
 /** Site-specific anchor — see module doc. Used only for false-positive. */
 export function computeStrictAnchor(args) {
-    const lines = args.content?.split(/\r?\n/);
-    const lineText = args.line !== undefined && lines ? (lines[args.line - 1] ?? "") : "";
     return stableFindingId("dd:", {
         cwd: args.cwd,
         filePath: args.filePath,
@@ -129,7 +161,11 @@ export function computeStrictAnchor(args) {
             args.tool ?? "",
             args.rule ?? "",
             normalizeMessage(args.message),
-            lineContentHash(lineText),
+            // An absent/out-of-range line hashes the empty string, exactly as the
+            // pre-#3183 `lines[args.line - 1] ?? ""` fallback did: stable, but less
+            // resistant to a same-file/rule/message collision (see
+            // `DispositionAnchorArgs.content`).
+            strictAnchorSpan(args.content, args.line) ?? lineContentHash(""),
         ],
     });
 }