@herbertgao/pi-extensions 2026.9.15 → 2026.9.17

package/node_modules/pi-lens/dist/clients/pipeline.js

@@ -25,6 +25,7 @@ import { loadDispatchIntegration } from "./dispatch/lazy.js";
 import { toRunnerDisplayPath } from "./dispatch/runner-context.js";
 import { classifyProbeFailure, createAvailabilityChecker, createAvailabilityLatch, describeProbeEvidence, logAvailabilityDecision, startHostStallSampler, resolveAvailableOrInstall, resolveCommandArgsWithInstallFallback, resolveToolCommand, resolveToolCommandWithInstallFallback, } from "./dispatch/runners/utils/runner-helpers.js";
 import { findDetektConfig } from "./dispatch/runners/detekt.js";
+import { formatDiagnostics } from "./dispatch/utils/format-utils.js";
 import { detectFileKind, getFileKindLabel } from "./file-kinds.js";
 import { detectFileChangedAfterCommand, getProjectIgnoreMatcher, isExcludedDirName, } from "./file-utils.js";
 import { logLatency } from "./latency-logger.js";
@@ -40,12 +41,11 @@ import { probeToolAsync } from "./tool-probe.js";
 import { bounded } from "./deadline-utils.js";
 import { HOOK_WALL_BUDGET_MS } from "./hook-budgets.js";
 import { enabledAuxiliaryLspServerIds } from "./dispatch/auxiliary-lsp.js";
-import { recordDegradationOnce } from "./degradation-ledger.js";
+import { incrementDegradationCount, recordDegradationOnce, } from "./degradation-ledger.js";
 import { establishToolAgreement } from "./tool-agreement.js";
 import { dropFindingsForMissingPaths } from "./advisory-provenance.js";
 import { getAutofixPolicyForFile, getPreferredAutofixTools, getRubocopCommand, hasBiomeConfig, hasDetektConfig, hasEslintConfig, hasGolangciConfig, hasKtfmtConfig, hasKtlintConfig, hasOxlintConfig, hasRubocopConfig, hasSqlfluffConfig, hasStylelintConfig, markdownlintConfigArgs, } from "./tool-policy.js";
-const LSP_MAX_FILE_BYTES = RUNTIME_CONFIG.pipeline.lspMaxFileBytes;
-const LSP_MAX_FILE_LINES = RUNTIME_CONFIG.pipeline.lspMaxFileLines;
+import { exceedsLspSyncLimits } from "./lsp/content-limits.js";
 const LSP_SPAWN_BUDGET_MS = RUNTIME_CONFIG.pipeline.lspSpawnBudgetMs;
 const AUTOFIX_CHANGED_FILE_SCAN_LIMIT = 5000;
 /**
@@ -60,10 +60,6 @@ function lspSyncBudgetMs() {
     const raw = Number(process.env.PI_LENS_LSP_SYNC_BUDGET_MS);
     return Number.isFinite(raw) && raw > 0 ? raw : 3000;
 }
-// Scan one directory's entries into `snapshot`, pushing walkable subdirs onto
-// `stack`. Extracted from the walk loop to keep each function's cognitive
-// complexity low. Excluded/ignored dirs are not descended; ignored/vanished
-// files are skipped.
 // Files stat'd between event-loop yields. The walk stays on the tool_result
 // hot path; yielding every N keeps its longest synchronous stretch well under
 // the <50ms hook-burst budget even at the AUTOFIX_CHANGED_FILE_SCAN_LIMIT cap.
@@ -144,23 +140,6 @@ async function diffProjectSnapshot(root, before) {
     }
     return [...changed].sort((a, b) => a.localeCompare(b));
 }
-function exceedsLspSyncLimits(_filePath, content) {
-    const sizeBytes = Buffer.byteLength(content, "utf-8");
-    if (sizeBytes > LSP_MAX_FILE_BYTES) {
-        return {
-            tooLarge: true,
-            reason: `${Math.round(sizeBytes / 1024)}KB exceeds ${Math.round(LSP_MAX_FILE_BYTES / 1024)}KB`,
-        };
-    }
-    const lineCount = content.split("\n").length;
-    if (lineCount > LSP_MAX_FILE_LINES) {
-        return {
-            tooLarge: true,
-            reason: `${lineCount} lines exceeds ${LSP_MAX_FILE_LINES}`,
-        };
-    }
-    return { tooLarge: false, reason: "" };
-}
 function createPhaseTracker(toolName, filePath) {
     const phases = [];
     return {
@@ -677,7 +656,13 @@ export async function resyncLspFile(filePath, fileContent, needsContentRefresh,
         return;
     if (!needsContentRefresh && lspSyncCompleted)
         return;
-    const limitCheck = exceedsLspSyncLimits(filePath, fileContent);
+    // #3405 r2: the bound is `clients/lsp/content-limits.ts` now, shared with the
+    // dispatch runner and the didSave payload. THIS call stays: a file past the
+    // bound is not synced to the server AT ALL, which is a stricter policy than
+    // the save seam's (drop the redundant text, still send the save) and the one
+    // a post-write sync owes — removing it would start writing whole-file
+    // didOpen frames for files this pipeline has always refused.
+    const limitCheck = exceedsLspSyncLimits(fileContent);
     if (limitCheck.tooLarge)
         return;
     try {
@@ -711,6 +696,11 @@ export async function resyncLspFile(filePath, fileContent, needsContentRefresh,
                 source: "lsp_sync",
                 clientScope: "primary",
                 maxClientWaitMs: LSP_SPAWN_BUDGET_MS,
+                // #3405: pi-lens just wrote these bytes to disk, so this is the one
+                // touch that is a save. A save-triggered server (Expert recompiles
+                // the project on didSave and on nothing else) publishes for the edit
+                // only because of this flag.
+                saved: true,
             })
                 .then(() => "done")
                 .catch((err) => {
@@ -961,6 +951,14 @@ function buildEnrichedBlockerOutput(blockers, fileContent = "") {
 export async function runPipeline(ctx, deps) {
     const { filePath, cwd, toolName, getFlag, getFlagSource, dbg } = ctx;
     const { getFormatService } = deps;
+    const allowAutonomousWriters = ctx.allowAutonomousWriters !== false;
+    if (!allowAutonomousWriters) {
+        incrementDegradationCount({
+            kind: "opaque-mutation-ownership-boundary",
+            subject: "pipeline",
+            reason: `observed mutation is not evidence of agent authorship (${filePath})`,
+        });
+    }
     admitWidgetDiagnosticsWrite(filePath, ctx.telemetry?.writeIndex);
     const phase = createPhaseTracker(toolName, filePath);
     const pipelineStart = Date.now();
@@ -984,8 +982,14 @@ export async function runPipeline(ctx, deps) {
     const piChangedFiles = new Set();
     const autoformatDisabled = !!getFlag("no-autoformat", filePath);
     const immediateFormat = !!getFlag("immediate-format");
-    const formatDeferred = !autoformatDisabled && !immediateFormat && !!fileContent;
-    if (!autoformatDisabled && immediateFormat && fileContent) {
+    const formatDeferred = allowAutonomousWriters &&
+        !autoformatDisabled &&
+        !immediateFormat &&
+        !!fileContent;
+    if (allowAutonomousWriters &&
+        !autoformatDisabled &&
+        immediateFormat &&
+        fileContent) {
         const formatResult = await runFormatPhase(filePath, getFormatService, dbg, ctx.signal);
         formatChanged = formatResult.formatChanged;
         formattersUsed = formatResult.formattersUsed;
@@ -1010,6 +1014,9 @@ export async function runPipeline(ctx, deps) {
     else if (formatDeferred) {
         dbg(`autoformat: deferred until agent_end for ${filePath}`);
     }
+    else if (!allowAutonomousWriters) {
+        dbg(`autoformat: skipped for ${filePath} (mutation ownership is unproven)`);
+    }
     else if (autoformatDisabled) {
         const source = getFlagSource?.("no-autoformat", filePath);
         dbg(`autoformat: skipped for ${filePath} (--no-autoformat${source ? `, source=${source}` : ""})`);
@@ -1027,7 +1034,11 @@ export async function runPipeline(ctx, deps) {
     let autofixChangedFiles = [];
     let fixRefresh = false;
     let autofixSkipReason;
-    if (ctx.autofixMode === "deferred") {
+    if (!allowAutonomousWriters) {
+        autofixSkipReason = "mutation_ownership_unproven";
+        dbg(`autofix: skipped for ${filePath} (mutation ownership is unproven)`);
+    }
+    else if (ctx.autofixMode === "deferred") {
         autofixSkipReason = "deferred_to_agent_end";
         dbg(`autofix: deferred until agent_end for ${filePath}`);
     }
@@ -1166,34 +1177,22 @@ export async function runPipeline(ctx, deps) {
             });
         }
     }
-    const hasBlockers = dispatchResult.hasBlockers;
-    const actionableWarnings = dispatchResult.warnings
-        .map((diagnostic) => recordFromDispatchDiagnostic(diagnostic, cwd))
-        .filter((warning) => Boolean(warning));
+    // Opaque recovery is a valid analysis input, but its bytes are not an agent
+    // authored surface. Keep diagnostics and advisory output visible while
+    // withholding the edit-directed channels that would tell the agent to mutate
+    // the observed artifact (#3226).
+    const hasBlockers = allowAutonomousWriters && dispatchResult.hasBlockers;
+    const actionableWarnings = allowAutonomousWriters
+        ? dispatchResult.warnings
+            .map((diagnostic) => recordFromDispatchDiagnostic(diagnostic, cwd))
+            .filter((warning) => Boolean(warning))
+        : [];
     const codeQualityWarnings = dispatchResult.warnings
         .map((diagnostic) => recordFromCodeQualityDiagnostic(diagnostic, cwd))
         .filter((warning) => Boolean(warning));
     if (dispatchResult.diagnostics.length > 0) {
-        const logger = getDiagnosticLogger();
         const tracker = getDiagnosticTracker();
         tracker.trackShown(dispatchResult.diagnostics);
-        const toKey = (d) => [
-            d.tool || "",
-            d.id || "",
-            d.rule || "",
-            d.filePath || "",
-            d.line || 0,
-            d.column || 0,
-        ].join("|");
-        const inlineKeys = new Set([...dispatchResult.blockers, ...dispatchResult.fixed].map(toKey));
-        for (const d of dispatchResult.diagnostics) {
-            logger.logCaught(d, {
-                model: ctx.telemetry?.model ?? "unknown",
-                sessionId: ctx.telemetry?.sessionId ?? "unknown",
-                turnIndex: ctx.telemetry?.turnIndex ?? 0,
-                writeIndex: ctx.telemetry?.writeIndex ?? 0,
-            }, inlineKeys.has(toKey(d)));
-        }
     }
     if (fixedCount > 0)
         getDiagnosticTracker().trackAutoFixed(fixedCount);
@@ -1207,15 +1206,48 @@ export async function runPipeline(ctx, deps) {
     // the deleted file's content), so it is dropped here rather than re-asserted.
     // One bounded stat per unique cited path, only when blockers exist — zero
     // cost on the clean/fast paths.
-    const deliverableBlockers = dispatchResult.hasBlockers
+    const deliverableBlockers = hasBlockers
         ? dropFindingsForMissingPaths({
             store: "stop-blocker",
             findings: dispatchResult.blockers,
             cwd,
             citedPath: (b) => b.filePath || undefined,
         })
-        : dispatchResult.blockers;
-    if (dispatchResult.hasBlockers && fileContent) {
+        : [];
+    // #3190: ONE gate, applied once here, for EVERY surface. The durable record
+    // this function hands `runtime.recordInlineBlockers` (and through it the
+    // turn-end `Unresolved from this turn` re-serve) used to be built from the
+    // UNGATED `dispatchResult.blockerOutput`/`blockers`, so a blocker retracted
+    // from the tool result above was re-delivered at turn end — and the ungated
+    // verdict still latched the commit gate through `updateGitGuardStatus`. It is
+    // exactly `hasBlockers && nothing-survived-the-gate` inverted: the gate
+    // returns `[]` whenever `hasBlockers` is false, so this one expression is the
+    // whole condition.
+    const hasDeliverableBlockers = deliverableBlockers.length > 0;
+    if (dispatchResult.diagnostics.length > 0) {
+        const logger = getDiagnosticLogger();
+        const toKey = (d) => [
+            d.tool || "",
+            d.id || "",
+            d.rule || "",
+            d.filePath || "",
+            d.line || 0,
+            d.column || 0,
+        ].join("|");
+        const inlineKeys = new Set([...deliverableBlockers, ...dispatchResult.fixed].map(toKey));
+        for (const d of dispatchResult.diagnostics) {
+            logger.logCaught(d, {
+                model: ctx.telemetry?.model ?? "unknown",
+                sessionId: ctx.telemetry?.sessionId ?? "unknown",
+                turnIndex: ctx.telemetry?.turnIndex ?? 0,
+                writeIndex: ctx.telemetry?.writeIndex ?? 0,
+            }, inlineKeys.has(toKey(d)));
+        }
+    }
+    const deliveredOutput = !allowAutonomousWriters && dispatchResult.hasBlockers
+        ? dispatchResult.output.slice(dispatchResult.blockerOutput.length)
+        : dispatchResult.output;
+    if (hasBlockers && fileContent) {
         // Enrich blocker output with a code snippet so the agent can see the
         // exact line it wrote that caused each violation — no re-read needed.
         if (deliverableBlockers.length > 0) {
@@ -1227,11 +1259,11 @@ export async function runPipeline(ctx, deps) {
         if (rest)
             output += rest;
     }
-    else if (dispatchResult.output) {
+    else if (deliveredOutput) {
         // #2028 review P3: this path fires when readback FAILED - raw output
         // still cites possibly-deleted files. Re-render from the gated set
         // (no snippets without fileContent) and keep the post-blocker slice.
-        if (dispatchResult.hasBlockers &&
+        if (hasBlockers &&
             deliverableBlockers.length !== dispatchResult.blockers.length) {
             let gatedOut = buildEnrichedBlockerOutput(deliverableBlockers);
             const rest = dispatchResult.output.slice(dispatchResult.blockerOutput.length);
@@ -1245,7 +1277,7 @@ export async function runPipeline(ctx, deps) {
                 output += `\n\n${gatedOut}`;
         }
         else {
-            output += `\n\n${dispatchResult.output}`;
+            output += `\n\n${deliveredOutput}`;
         }
     }
     if (fixedCount > 0) {
@@ -1340,7 +1372,7 @@ export async function runPipeline(ctx, deps) {
         turnIndex: ctx.telemetry?.turnIndex ?? 0,
         writeIndex: ctx.telemetry?.writeIndex ?? 0,
         diagnostics: dispatchResult.diagnostics,
-        blockers: dispatchResult.blockers,
+        blockers: hasBlockers ? dispatchResult.blockers : [],
         warnings: dispatchResult.warnings,
         fixed: dispatchResult.fixed,
         resolvedCount: dispatchResult.resolvedCount,
@@ -1351,28 +1383,44 @@ export async function runPipeline(ctx, deps) {
     });
     return {
         output,
-        hasBlockers,
+        // #3190: the verdict every consumer reads — `updateGitGuardStatus`'s commit
+        // latch above all — is what was DELIVERED, not what the dispatch found. The
+        // two disagreed whenever the deleted-path gate retracted every blocker: the
+        // tool result said `✓ clean` while the commit gate stayed latched, its
+        // summary falling back to that very all-clear line. `emitLensAnalysisComplete`
+        // above deliberately keeps the raw dispatch counts — it records what was
+        // observed, not what was served.
+        hasBlockers: hasDeliverableBlockers,
         cascadePromise,
         isError: false,
         fileModified,
         postWriteStateHash,
         changedFiles,
-        inlineBlockerSummary: dispatchResult.hasBlockers
-            ? dispatchResult.blockerOutput.trim() || undefined
+        // #3190: re-rendered from the GATED set with `formatDiagnostics(...,
+        // "blocking")` — the very expression `dispatcher.ts:1409` builds
+        // `blockerOutput` with, over a subset of the very array it rendered. When
+        // the gate drops nothing the two are byte-identical (same renderer, same
+        // array, same display cap), so an unretracted record is unchanged; when it
+        // drops something the stored text can no longer disagree with the tool
+        // result, and `inline-blocker-dispositions.ts`' re-render at turn end still
+        // matches this string exactly.
+        inlineBlockerSummary: hasDeliverableBlockers
+            ? formatDiagnostics(deliverableBlockers, "blocking").trim() || undefined
             : undefined,
         // #1561 F1: taken from the very diagnostics `blockerOutput` was rendered
         // from, so the provenance can never disagree with the text it guards. An
         // untagged diagnostic contributes the literal "unknown", which no verdict
         // claims coverage for — it pins the entry rather than silently widening
         // what an LSP check is allowed to clear.
-        inlineBlockerSources: dispatchResult.hasBlockers
+        inlineBlockerSources: hasDeliverableBlockers
             ? [
-                ...new Set(dispatchResult.blockers.map((d) => d.tool?.trim() || "unknown")),
+                ...new Set(deliverableBlockers.map((d) => d.tool?.trim() || "unknown")),
             ]
             : undefined,
-        inlineBlockerLines: dispatchResult.hasBlockers
-            ? dispatchResult.blockers
-                // #1641 review F2: `dispatchResult.blockers` is NOT guaranteed to be
+        inlineBlockerLines: hasDeliverableBlockers
+            ? deliverableBlockers
+                // #1641 review F2: the blocker array (#3190: the deliverable subset
+                // of `dispatchResult.blockers`) is NOT guaranteed to be
                 // scoped to THIS file — a chart-wide runner (helm-lint, helm-render)
                 // reports blocking diagnostics against other files in the chart
                 // (e.g. `values.yaml`) alongside `ctx.filePath`. The precedent every
@@ -1418,8 +1466,15 @@ export async function runPipeline(ctx, deps) {
                 source: "autofix",
             }
             : undefined,
-        inlineBlockerFileContent: dispatchResult.hasBlockers
+        inlineBlockerFileContent: hasBlockers
             ? inlineBlockerFileContent
             : undefined,
+        // #3246: the very array `blockerOutput` above was rendered from, so the
+        // turn-end policy filter and its re-render can never disagree with the
+        // text they guard — the same provenance argument `inlineBlockerSources`
+        // makes one field up.
+        inlineBlockerDiagnostics: hasDeliverableBlockers
+            ? deliverableBlockers
+            : undefined,
     };
 }

package/node_modules/pi-lens/dist/clients/project-diagnostics/fresh-fetch.js

@@ -87,7 +87,7 @@ import { applyDispositionsMultiFile } from "../diagnostic-dispositions.js";
 import { getKnipIgnorePatterns } from "../file-utils.js";
 import { isAtOrAboveHomeDir, realpathOrResolve } from "../path-utils.js";
 import { isSameOrWithin } from "../lsp/server.js";
-import { incrementDegradationCount } from "../degradation-ledger.js";
+import { incrementDegradationCount, recordDegradationOnce, } from "../degradation-ledger.js";
 import { GitleaksClient } from "../gitleaks-client.js";
 import { GovulncheckClient } from "../govulncheck-client.js";
 import { isToolInstallAllowedByTrust, projectTrustDenialReason, } from "../project-trust.js";
@@ -281,8 +281,15 @@ export async function fetchFreshProjectDiagnostics(cacheManager, cwd, clients, s
     function record(id, adapted, elapsedMs, analysedRoot, analysis) {
         if (analysedRoot) {
             pushUnique(analyzed, id);
-            if (analysis?.analyzedFiles !== undefined &&
-                analysis.analyzedFiles.length > 0) {
+            // #2962: the entry is pushed on the DECLARATION, not on its size. A
+            // coverage producer that analysed the root and proved zero files is a
+            // third state, distinct from both "covered, file absent from the set"
+            // and "this runner declares no coverage" — and it is the only one of
+            // the three that used to fall through to the whole-root id-only arm in
+            // `runnerRetirementDecision`, retiring findings for files nothing
+            // scanned. The eight non-producer runners pass no `analyzedFiles` at
+            // all and are untouched by this.
+            if (analysis?.analyzedFiles !== undefined) {
                 const root = realpathOrResolve(analysisRoot);
                 authoritativeCoverage.push({
                     runnerId: id,
@@ -291,6 +298,17 @@ export async function fetchFreshProjectDiagnostics(cacheManager, cwd, clients, s
                         return realpathOrResolve(file);
                     })),
                 });
+                if (analysis.analyzedFiles.length === 0) {
+                    // Bounded at one row per (producer, root) per session: the kept
+                    // finding is otherwise indistinguishable from a healthy run, and
+                    // "the only coverage producer proved nothing" is the fact an
+                    // operator needs when mode=full keeps showing a stale finding.
+                    recordDegradationOnce({
+                        kind: "runner-coverage-empty",
+                        subject: `${id}:${root}`,
+                        reason: `${id} analysed this root but declared zero scanned files, so retained ${id} findings are kept rather than retired`,
+                    });
+                }
             }
         }
         timings[id] = (timings[id] ?? 0) + elapsedMs;

package/node_modules/pi-lens/dist/clients/project-lens-config.js

@@ -64,11 +64,11 @@ import * as path from "node:path";
 import { toPositiveFinite } from "./env-utils.js";
 import { FRESHNESS_CADENCE_MS } from "./freshness-cadence.js";
 import { assignFlagConfigSection, flagConfigSectionKeys, GLOBAL_NON_FLAG_CONFIG_SECTIONS, GLOBAL_ONLY_NON_FLAG_KEYS, hasFlagConfigPath, LENS_FLAGS, PROJECT_FOREIGN_CONFIG_NAMESPACES, PROJECT_FOREIGN_NAMESPACE_HONORED_KEYS, PROJECT_NON_FLAG_CONFIG_SECTIONS, PROJECT_SCOPED_LENS_FLAGS, readFlagConfigValue, } from "./lens-flag-registry.js";
-import { configSearchDirs, getPiLensGlobalConfigPath, PROJECT_CONFIG_BASENAMES, PROJECT_CONFIG_LOCATIONS, } from "./config-locations.js";
+import { configSearchDirs, getPiLensGlobalConfigPath, isResolvedGlobalConfigPath, PROJECT_CONFIG_BASENAMES, PROJECT_CONFIG_LOCATIONS, } from "./config-locations.js";
 import { deprecationRecords, ignoredRecordCollector, projectLocationFor, readConfigDocument, reportConfigReadFailure, reportPiLensConfigRecords, resolveOnePiLensConfigDocument, } from "./config-resolve.js";
 import { finalizeRecords, } from "./config-core/records.js";
 import { homeRelativePath, isAtOrAboveHomeDir, walkUpDirs, } from "./path-utils.js";
-import { findPiLensConfigMarkerInDir } from "./workspace-topology.js";
+import { dirMtimesStillFresh, findPiLensConfigMarkerInDir, } from "./workspace-topology.js";
 import { readToolConfig } from "./tool-config.js";
 /**
  * Project config basenames, in DESCENDING precedence (first match wins), for
@@ -289,7 +289,7 @@ function safeDirMtimeMs(dir) {
     }
 }
 function discoveryCacheStillFresh(entry) {
-    if (!entry.dirMtimes.every((cached) => safeDirMtimeMs(cached.dir) === cached.mtimeMs)) {
+    if (!dirMtimesStillFresh(entry.dirMtimes)) {
         return false;
     }
     // #2483 round 2. When no config was found anywhere, `bearingDirMtimes`'s
@@ -344,6 +344,12 @@ function discoverPiLensProjectConfig(startDir) {
         if (!info) {
             for (const name of PROJECT_CONFIG_BASENAMES) {
                 const candidate = path.join(dir, name);
+                // The global tier reads its file by absolute path; a candidate that
+                // IS that file is refused here rather than adopted as a project
+                // config, which would double-read and double-validate it
+                // (global-config-location PR, refs #2457).
+                if (isResolvedGlobalConfigPath(candidate))
+                    continue;
                 const stat = safeFileStat(candidate);
                 if (stat?.isFile()) {
                     info = {
@@ -358,6 +364,8 @@ function discoverPiLensProjectConfig(startDir) {
         }
         for (const location of LEGACY_PROJECT_LOCATIONS) {
             const file = path.join(dir, location.relativePath);
+            if (isResolvedGlobalConfigPath(file))
+                continue;
             const stat = safeFileStat(file);
             if (!stat?.isFile())
                 continue;