@herbertgao/pi-extensions 2026.9.2 → 2026.9.4

package/node_modules/pi-lens/dist/clients/installer/index.js

@@ -66,6 +66,7 @@ import { commitDurableStoreAsync } from "../durable-store.js";
 import { getGlobalPiLensDir } from "../file-utils.js";
 import { allAvailableGlobalBinDirs, installArgs, pmBinary, resolveNodePackageManager, } from "../package-manager.js";
 import { resetSafeSpawnWindowsCommandCache, safeSpawnAsync, } from "../safe-spawn.js";
+import { probeToolAsync } from "../tool-probe.js";
 import { logSessionStart } from "../sessionstart-logger.js";
 // Global installation directory for pi-lens tools
 const TOOLS_DIR = path.join(getGlobalPiLensDir(), "tools");
@@ -227,6 +228,114 @@ const OS_ARCH_ZIP_ASSETS = {
     darwin: { x64: "darwin_amd64.zip", arm64: "darwin_arm64.zip" },
     win32: { x64: "windows_amd64.zip", arm64: "windows_arm64.zip" },
 };
+function managedPackageFormatterTool(spec) {
+    return {
+        id: spec.id,
+        name: spec.name,
+        checkCommand: spec.id,
+        checkArgs: ["--version"],
+        installStrategy: spec.installStrategy,
+        packageName: spec.packageName,
+        binaryName: spec.id,
+    };
+}
+const MANAGED_PACKAGE_FORMATTERS = [
+    { id: "black", name: "Black", installStrategy: "pip", packageName: "black" },
+    {
+        id: "cmake-format",
+        name: "cmake-format",
+        installStrategy: "pip",
+        packageName: "cmakelang",
+    },
+    { id: "oxfmt", name: "oxfmt", installStrategy: "npm", packageName: "oxfmt" },
+];
+function managedGitHubFormatterTool(spec) {
+    return {
+        id: spec.id,
+        name: spec.name,
+        checkCommand: spec.id,
+        checkArgs: ["--version"],
+        installStrategy: "github",
+        binaryName: spec.id,
+        github: {
+            repo: `${spec.owner}/${spec.repo}`,
+            assetMatch: spec.assetPattern,
+            ...(spec.binaryInArchive && { binaryInArchive: spec.binaryInArchive }),
+            ...(spec.kind === "phar" && { launcher: "php" }),
+            ...(spec.kind === "jar" && { launcher: "java" }),
+        },
+    };
+}
+const MANAGED_GITHUB_FORMATTERS = [
+    {
+        id: "stylua",
+        name: "StyLua",
+        owner: "JohnnyMorganz",
+        repo: "StyLua",
+        assetPattern: archAssetMatch({
+            linux: { x64: "linux-x86_64.zip", arm64: "linux-aarch64.zip" },
+            darwin: { x64: "macos-x86_64.zip", arm64: "macos-aarch64.zip" },
+            win32: { x64: "windows-x86_64.zip" },
+        }),
+        kind: "binary",
+        binaryInArchive: "stylua",
+    },
+    {
+        id: "php-cs-fixer",
+        name: "PHP CS Fixer",
+        owner: "PHP-CS-Fixer",
+        repo: "PHP-CS-Fixer",
+        assetPattern: (platform) => platform === "linux" || platform === "darwin" || platform === "win32"
+            ? "php-cs-fixer.phar"
+            : undefined,
+        kind: "phar",
+    },
+    {
+        id: "cljfmt",
+        name: "cljfmt",
+        owner: "weavejester",
+        repo: "cljfmt",
+        assetPattern: (platform, arch) => {
+            if (platform === "linux")
+                return arch === "arm64"
+                    ? "standalone.jar"
+                    : "linux-amd64-static.tar.gz";
+            if (platform === "darwin")
+                return "standalone.jar";
+            if (platform === "win32")
+                return "win-amd64.zip";
+            return undefined;
+        },
+        kind: "jar",
+        binaryInArchive: "cljfmt",
+    },
+];
+const MANAGED_MAVEN_FORMATTERS = [
+    {
+        id: "google-java-format",
+        name: "google-java-format",
+        groupId: "com.google.googlejavaformat",
+        artifactId: "google-java-format",
+        version: "1.27.0",
+        classifier: "all-deps",
+    },
+];
+function managedMavenFormatterTool(spec) {
+    return {
+        id: spec.id,
+        name: spec.name,
+        checkCommand: spec.id,
+        checkArgs: ["--version"],
+        installStrategy: "maven",
+        binaryName: spec.id,
+        maven: {
+            groupId: spec.groupId,
+            artifactId: spec.artifactId,
+            version: spec.version,
+            classifier: spec.classifier,
+        },
+    };
+}
 export const TOOLS = [
     // Core LSP servers
     {
@@ -275,6 +384,7 @@ export const TOOLS = [
         packageName: "prettier",
         binaryName: "prettier",
     },
+    ...MANAGED_PACKAGE_FORMATTERS.map(managedPackageFormatterTool),
     {
         id: "ruff",
         name: "Ruff",
@@ -707,6 +817,8 @@ export const TOOLS = [
             // bare binary, no archive
         },
     },
+    ...MANAGED_GITHUB_FORMATTERS.map(managedGitHubFormatterTool),
+    ...MANAGED_MAVEN_FORMATTERS.map(managedMavenFormatterTool),
     {
         id: "rust-analyzer",
         name: "rust-analyzer",
@@ -1633,29 +1745,16 @@ function isAstGrepVersionOutput(output) {
     return /\bast[- ]grep\b/i.test(output);
 }
 async function verifyAstGrepProbePath(binPath) {
-    return new Promise((resolve) => {
-        let proc;
-        try {
-            proc = spawn(binPath, ["--version"], {
-                stdio: ["ignore", "pipe", "pipe"],
-                shell: process.platform === "win32" && /\.(cmd|bat)$/i.test(binPath),
-                timeout: 5000,
-            });
-        }
-        catch {
-            // SYNCHRONOUS spawn throw (Windows `spawn UNKNOWN`/EINVAL, the pidusage
-            // bug class, #533) — best-effort probe, resolve rather than reject.
-            resolve(false);
-            return;
-        }
-        let output = "";
-        proc.stdout?.on("data", (data) => (output += data));
-        proc.stderr?.on("data", (data) => (output += data));
-        proc.on("exit", (code) => {
-            resolve(code === 0 && isAstGrepVersionOutput(output));
-        });
-        proc.on("error", () => resolve(false));
+    // #2894: through the probe seam rather than a hand-rolled `spawn` promise.
+    // `probeToolAsync` already owns the synchronous-throw case (#533), the
+    // Windows `.cmd`/`.bat` resolution this used `shell: true` for, and the
+    // timeout tree-kill a bare `spawn({ timeout })` does not do.
+    const result = await probeToolAsync(binPath, ["--version"], {
+        timeout: 5000,
     });
+    return (!result.error &&
+        result.status === 0 &&
+        isAstGrepVersionOutput(`${result.stdout}${result.stderr}`));
 }
 // Exported for testing only.
 export async function checkProbeCache(toolId) {
@@ -2151,29 +2250,15 @@ export async function getAllToolStatuses() {
             status.installed = true;
             status.source = "global-path";
             status.path = tool.checkCommand;
-            // Try to get version
-            const versionResult = await new Promise((resolve) => {
-                let proc;
-                try {
-                    proc = spawn(tool.checkCommand, ["--version"], {
-                        stdio: ["ignore", "pipe", "pipe"],
-                        shell: process.platform === "win32",
-                        timeout: 5000,
-                    });
-                }
-                catch {
-                    // SYNCHRONOUS spawn throw (Windows `spawn UNKNOWN`/EINVAL, the
-                    // pidusage bug class, #533) — best-effort, resolve empty version.
-                    resolve("");
-                    return;
-                }
-                let out = "";
-                proc.stdout?.on("data", (d) => (out += d));
-                proc.stderr?.on("data", (d) => (out += d));
-                proc.on("exit", () => resolve(out.trim().split("\n")[0]?.slice(0, 30) || ""));
-                proc.on("error", () => resolve(""));
+            // Try to get version — through the probe seam (#2894), which owns the
+            // synchronous-throw case (#533) and the timeout tree-kill that a bare
+            // `spawn({ timeout })` promise did not do.
+            const probe = await probeToolAsync(tool.checkCommand, ["--version"], {
+                timeout: 5000,
             });
-            status.version = versionResult || undefined;
+            status.version =
+                `${probe.stdout}${probe.stderr}`.trim().split("\n")[0]?.slice(0, 30) ||
+                    undefined;
             statuses.push(status);
             continue;
         }
@@ -2515,6 +2600,13 @@ function getGitHubInstalledBinaryName(binaryName, platform, assetName) {
         return `${binaryName}.cmd`;
     return `${binaryName}.exe`;
 }
+function launcherForGitHubAsset(spec, assetName) {
+    if (spec.launcher === "php" && assetName.endsWith(".phar"))
+        return "php";
+    if (spec.launcher === "java" && assetName.endsWith(".jar"))
+        return "java";
+    return undefined;
+}
 function getArchiveBinaryCandidates(binaryName, platform, assetName) {
     if (platform !== "win32")
         return [binaryName];
@@ -2867,10 +2959,35 @@ prefetchedRelease) {
     const binaryName = tool.binaryName ?? tool.id;
     const isWindows = platform === "win32";
     const finalBinaryName = getGitHubInstalledBinaryName(binaryName, platform, asset.name);
-    const destPath = path.join(GITHUB_BIN_DIR, finalBinaryName);
+    let destPath = path.join(GITHUB_BIN_DIR, finalBinaryName);
     const assetName = asset.name;
+    const launcherRuntime = launcherForGitHubAsset(spec, assetName);
+    if (launcherRuntime &&
+        !(await isCommandAvailable(launcherRuntime, ["--version"]))) {
+        logSessionStart(`github-install ${tool.id}: ${launcherRuntime} not found — asset requires a runtime launcher`);
+        return undefined;
+    }
     try {
-        if (assetName.endsWith(".gz") && !assetName.endsWith(".tar.gz")) {
+        if (launcherRuntime) {
+            const assetPath = path.join(GITHUB_BIN_DIR, `${tool.id}${assetName.endsWith(".phar") ? ".phar" : ".jar"}`);
+            await writeFileAtomicAsync(assetPath, assetBuffer, {
+                bestEffort: false,
+                mode: 0o750,
+            });
+            const launcherName = isWindows ? `${binaryName}.bat` : binaryName;
+            destPath = path.join(GITHUB_BIN_DIR, launcherName);
+            const runtimeTarget = assetName.endsWith(".phar")
+                ? `${tool.id}.phar`
+                : `${tool.id}.jar`;
+            const command = isWindows
+                ? `@echo off\r\n${launcherRuntime} "%~dp0${runtimeTarget}" %*\r\n`
+                : `#!/bin/sh\nexec ${launcherRuntime} "$(dirname "$0")/${runtimeTarget}" "$@"\n`;
+            await writeFileAtomicAsync(destPath, command, {
+                bestEffort: false,
+                mode: isWindows ? undefined : 0o750,
+            });
+        }
+        else if (assetName.endsWith(".gz") && !assetName.endsWith(".tar.gz")) {
             // Bare gzip (e.g. rust-analyzer-x86_64-unknown-linux-gnu.gz) — decompress directly
             const decompressed = await new Promise((resolve, reject) => {
                 const gunzip = createGunzip();
@@ -3220,7 +3337,7 @@ async function probeManagedToolVersion(tool) {
     if (!cached?.path || !existsSync(cached.path))
         return undefined;
     try {
-        const result = await safeSpawnAsync(cached.path, tool.checkArgs, {
+        const result = await probeToolAsync(cached.path, tool.checkArgs, {
             timeout: getToolVerificationTimeout(tool),
             input: "",
             ignoreAmbientSignal: true,
@@ -3926,11 +4043,17 @@ async function installArchiveTool(tool) {
  * generic fallback `finishInstallAttempt` uses when nothing set it.
  */
 function recordPackageManagerInstallException(toolId, strategyLabel, packageName, err) {
-    const message = err.message;
+    const message = boundInstallError(err.message);
     logSessionStart(`auto-install ${strategyLabel} ${packageName}: exception: ${message}`);
     installFailureReasons.set(toolId, message);
     return undefined;
 }
+const INSTALL_ERROR_LINE_LIMIT = 1000;
+const INSTALL_CANDIDATE_ERROR_LIMIT = 200;
+function boundInstallError(value, limit = INSTALL_ERROR_LINE_LIMIT) {
+    const line = value.replace(/[\r\n]+/g, " ").trim();
+    return line.length > limit ? `${line.slice(0, limit - 3)}...` : line;
+}
 async function installNpmTool(toolId, packageName, binaryName, verificationArgs = ["--version"], verificationTimeoutMs = 10_000, 
 /** See {@link packageEntryVerification} — spawn-free verification (#2722). */
 packageEntryOf) {
@@ -4136,7 +4259,7 @@ options = {}) {
                 ? [...verb, packageName]
                 : ["-m", "pip", ...verb, packageName],
         }));
-        let lastError = "";
+        const errors = [];
         for (const candidate of pipCandidates) {
             const pipResult = await safeSpawnAsync(candidate.command, candidate.args, {
                 timeout: 120_000,
@@ -4226,10 +4349,11 @@ options = {}) {
                 }
                 return packageName;
             }
-            lastError = `${candidate.command} ${candidate.args.join(" ")}: ${outcome.error}`;
-            debugLog(`[pip-fallback] ${lastError}`);
+            const candidateError = `${candidate.command} ${candidate.args.join(" ")}: ${boundInstallError(outcome.error, INSTALL_CANDIDATE_ERROR_LIMIT)}`;
+            errors.push(candidateError);
+            debugLog(`[pip-fallback] ${candidateError}`);
         }
-        throw new Error(`Failed to install ${packageName}: no usable pip command found (${lastError || "unknown error"})`);
+        throw new Error(`Failed to install ${packageName}: no usable pip command found (${errors.join(" | ") || "unknown error"})`);
     }
     catch (err) {
         return recordPackageManagerInstallException(toolId, "pip", packageName, err);
@@ -4381,6 +4505,12 @@ export async function installTool(toolId) {
             case "github": {
                 if (!tool.github)
                     return false;
+                if (!tool.github.assetMatch(process.platform, process.arch)) {
+                    const reason = `unsupported platform=${process.platform} arch=${process.arch}`;
+                    noteInstallAttempt(tool.id, "unavailable", reason);
+                    logSessionStart(`auto-install ${tool.id}: ${reason}`);
+                    return false;
+                }
                 const ghPath = await installGitHubTool(tool);
                 return finishInstallAttempt(tool.id, ghPath !== undefined, startedAt);
             }
@@ -4393,6 +4523,12 @@ export async function installTool(toolId) {
             case "archive": {
                 if (!tool.archive)
                     return false;
+                if (!resolveArchiveUrl(tool.archive)) {
+                    const reason = `unsupported platform=${process.platform} arch=${process.arch}`;
+                    noteInstallAttempt(tool.id, "unavailable", reason);
+                    logSessionStart(`auto-install ${tool.id}: ${reason}`);
+                    return false;
+                }
                 const archivePath = await installArchiveTool(tool);
                 return finishInstallAttempt(tool.id, archivePath !== undefined, startedAt);
             }
@@ -4711,6 +4847,8 @@ export function getToolInstallStrategy(toolId) {
  * "at least one platform" guard instead.
  */
 export const GITHUB_TOOLS = [
+    "cljfmt",
+    "php-cs-fixer",
     "shellcheck",
     "shfmt",
     "rust-analyzer",
@@ -4745,6 +4883,12 @@ export function resolveGitHubAsset(toolId, platform, arch) {
     const tool = TOOLS.find((t) => t.id === toolId);
     return tool?.github?.assetMatch(platform, arch);
 }
+export function resolveGitHubAssetLauncher(toolId, _platform, assetName) {
+    const tool = TOOLS.find((t) => t.id === toolId);
+    return tool?.github
+        ? launcherForGitHubAsset(tool.github, assetName)
+        : undefined;
+}
 export function resolveGitHubInstalledBinaryName(toolId, platform, assetName) {
     const tool = TOOLS.find((t) => t.id === toolId);
     if (!tool)

package/node_modules/pi-lens/dist/clients/jscpd-client.js

@@ -346,7 +346,15 @@ export class JscpdClient {
                 lines: c.lines ?? 0,
                 tokens: c.tokens ?? 0,
             }));
-            return { success: true, clones, duplicatedLines, totalLines, percentage };
+            // #2154: the one jscpd site that parsed a scan of this root.
+            return {
+                success: true,
+                analyzed: true,
+                clones,
+                duplicatedLines,
+                totalLines,
+                percentage,
+            };
         }
         catch (err) {
             void err;

package/node_modules/pi-lens/dist/clients/knip-client.js

@@ -323,7 +323,10 @@ export class KnipClient {
             completed?.projectSeq === options.projectSeq &&
             this.matchesMemoSignal(targetDir, completed.signal)) {
             this.log(`Analysis cache hit for ${key} at projectSeq ${options.projectSeq}`);
-            return { ...completed.result, execution: "cache" };
+            // #2154: a memo hit did not scan the root during THIS call, so it
+            // carries no authority to retire a retained finding — the flag is
+            // cleared even though the memoised result set it when it ran.
+            return { ...completed.result, execution: "cache", analyzed: false };
         }
         // A project that ships its own knip needs no managed install and no
         // managed probe — the shim is already on disk, and gating on
@@ -510,7 +513,9 @@ export class KnipClient {
             // status === 0 with empty stdout has never been observed against a
             // real knip binary (a genuine clean run still prints
             // `{"issues":[]}`), but a defensive fallback is cheap insurance
-            // against a future knip release that changes this.
+            // against a future knip release that changes this. Deliberately NOT
+            // `analyzed` (#2154): nothing was parsed, so this shape must not
+            // retire a retained knip finding — it is reported cold instead.
             return {
                 ...EMPTY_RESULT,
                 success: true,
@@ -711,6 +716,8 @@ export class KnipClient {
             }
             return {
                 success: true,
+                // #2154: the one knip site that parsed a scan of this root.
+                analyzed: true,
                 issues,
                 unusedExports,
                 unusedFiles,

package/node_modules/pi-lens/dist/clients/language-profile.js

@@ -30,7 +30,13 @@ const PROJECT_MARKERS_BY_KIND = {
     sql: [".sqlfluff", "pyproject.toml"],
     php: ["composer.json", "composer.lock"],
     prisma: ["schema.prisma", "prisma/schema.prisma"],
-    java: ["pom.xml", "build.gradle", ".classpath"],
+    // #2870: `build.gradle.kts` is the Kotlin-DSL spelling of `build.gradle`
+    // and marks a Java module just as well — its absence here (and in
+    // ROOT_MARKERS_BY_KIND below) is what left a `.java` file in a
+    // Kotlin-DSL Gradle module resolving to the workspace root, where a
+    // polyglot repo's go.mod then claimed it. `kotlin` already lists both
+    // spellings; java listed only the Groovy one.
+    java: ["pom.xml", "build.gradle", "build.gradle.kts", ".classpath"],
     kotlin: ["build.gradle.kts", "build.gradle", "pom.xml"],
     swift: ["Package.swift"],
     dart: ["pubspec.yaml"],
@@ -76,7 +82,11 @@ const ROOT_MARKERS_BY_KIND = {
     sql: [".sqlfluff", "pyproject.toml", "setup.cfg", "tox.ini"],
     php: ["composer.json", "composer.lock"],
     prisma: ["prisma/schema.prisma", "schema.prisma"],
-    java: ["pom.xml", "build.gradle", ".classpath"],
+    // #2870: see PROJECT_MARKERS_BY_KIND.java above — this is the table
+    // `resolveLanguageRootForFile` walks, so the missing Kotlin-DSL spelling
+    // is what anchored a nested Gradle module's `.java` file at the
+    // workspace root.
+    java: ["pom.xml", "build.gradle", "build.gradle.kts", ".classpath"],
     kotlin: ["build.gradle.kts", "build.gradle", "pom.xml"],
     swift: ["Package.swift"],
     dart: ["pubspec.yaml"],

package/node_modules/pi-lens/dist/clients/latency-logger.js

@@ -4,6 +4,7 @@ import { getGlobalPiLensLogDir } from "./probe-home-state.js";
 import { createNdjsonLogger } from "./ndjson-logger.js";
 import { getMaxLogSizeMB } from "./log-cleanup.js";
 import { normalizeLoggedPath } from "./path-utils.js";
+import { getTurnId } from "./turn-context.js";
 const LATENCY_LOG_DIR = getGlobalPiLensLogDir();
 const LATENCY_LOG_FILE = path.join(LATENCY_LOG_DIR, "latency.log");
 const writer = createNdjsonLogger({
@@ -697,6 +698,7 @@ export function logLatency(entry) {
         ...entry,
         ts,
         pid: process.pid,
+        turnId: entry.turnId ?? getTurnId(),
         filePath: normalizeLoggedPath(entry.filePath),
     });
 }

package/node_modules/pi-lens/dist/clients/lens-config.js

@@ -9,6 +9,7 @@ import { CANONICAL_GLOBAL_CONFIG_FILE, getPiLensGlobalConfigPath, GLOBAL_CONFIG_
 export { getPiLensGlobalConfigPath } from "./config-locations.js";
 import { ignoredRecordCollector, readConfigDocument, reportConfigReadFailure, reportPiLensConfigRecords, resolveOnePiLensConfigDocument, } from "./config-resolve.js";
 import { findNestedProjectMutationValue, } from "./project-lens-config.js";
+import { readToolConfig } from "./tool-config.js";
 /**
  * The canonical global location, looked up rather than constructed, so a change
  * to the shared table cannot leave this loader describing a file that is no
@@ -123,6 +124,9 @@ export function loadPiLensGlobalConfig(configPath = getPiLensGlobalConfigPath())
         const raw = resolved.value;
         const warnInvalid = note;
         const config = {};
+        const toolConfig = readToolConfig(raw, warnInvalid);
+        if (toolConfig)
+            config.tools = toolConfig;
         for (const spec of LENS_FLAGS) {
             if (spec.readGlobal)
                 continue;

package/node_modules/pi-lens/dist/clients/lsp/config.js

@@ -63,10 +63,11 @@ import { getGlobalPiLensDir } from "../file-utils.js";
 import { claimPhaseOncePerSession, currentSessionRecordId, logLatency, releaseOncePerSessionPhase, releasePhaseClaim, } from "../latency-logger.js";
 import { getPiLensGlobalConfigPath } from "../lens-config.js";
 import { normalizeFilePath } from "../path-utils.js";
+import { resolveToolCwd } from "../tool-cwd.js";
 import { logSessionStart } from "../sessionstart-logger.js";
 import { launchLSP } from "./launch.js";
 import { registerSessionRoot, resetSessionRootsForTests, sessionRootConfigEntries, setSessionRootConfig, } from "./session-roots.js";
-import { createRootDetector, LSP_SERVERS, resetLSPCaseSensitivityState, } from "./server.js";
+import { LSP_SERVERS, resetLSPCaseSensitivityState, resolveLspServerCwd, } from "./server.js";
 // --- Config Loading ---
 /**
  * For tests that need to force the warn-once cache to reset between cases —
@@ -338,9 +339,13 @@ export function createCustomServer(config, id) {
         name: config.name,
         custom: true,
         extensions: config.extensions,
+        ...(config.rootMarkers ? { rootMarkers: config.rootMarkers } : {}),
         root: config.rootMarkers
-            ? createRootDetector(config.rootMarkers)
-            : async () => process.cwd(),
+            ? async (file) => resolveToolCwd("lsp", id, file, {
+                cwd: process.cwd(),
+                ...(config.rootMarkers ? { rootMarkers: config.rootMarkers } : {}),
+            })
+            : async (file) => resolveToolCwd("lsp", id, file, { cwd: process.cwd() }),
         async spawn(root) {
             const proc = await launchLSP(config.command, config.args ?? ["--stdio"], {
                 cwd: root,
@@ -600,12 +605,21 @@ export function getServersForFileWithConfig(filePath) {
     const base = path.basename(filePath).toLowerCase();
     return registeredServers(config).filter((server) => selectionReason(server, config, filePath, ext, base) === "selected");
 }
+/**
+ * The primary language server ENTRY for a file — the one "first non-auxiliary
+ * server" predicate, shared by {@link primaryServerId} and
+ * {@link resolveLspCwdForFile} so the id-level and entry-level consumers
+ * cannot drift. `role` is only ever set to "auxiliary" on cross-cutting
+ * scanner entries (ast-grep, opengrep, zizmor, typos, marksman, ...) — see
+ * clients/lsp/server.ts; undefined here means a real language server.
+ */
+function primaryServerEntry(filePath) {
+    return getServersForFileWithConfig(filePath).find((s) => s.role !== "auxiliary");
+}
 /**
  * The primary language server for a file (e.g. "typescript"), as opposed to a
  * cross-cutting auxiliary scanner attached via clientScope "all"/
- * "with-auxiliary" (ast-grep, opengrep, zizmor, typos, marksman, ...). `role`
- * is only ever set to "auxiliary" on those auxiliary entries (see
- * clients/lsp/server.ts) — undefined means a real language server. Used to
+ * "with-auxiliary" (ast-grep, opengrep, zizmor, typos, marksman, ...). Used to
  * split a file's diagnostics into "primary confirmation" vs "auxiliary
  * findings" so a page of ast-grep/opengrep/marksman noise never buries
  * whether the actual type checker/compiler confirmed the file clean.
@@ -616,7 +630,22 @@ export function getServersForFileWithConfig(filePath) {
  * now report the same primary-vs-auxiliary split for the same file.
  */
 export function primaryServerId(filePath) {
-    return getServersForFileWithConfig(filePath).find((s) => s.role !== "auxiliary")?.id;
+    return primaryServerEntry(filePath)?.id;
+}
+/**
+ * #2777 O1: the one seam a tool uses to answer "which cwd did this file's
+ * primary LSP server resolve to". Folds the three-step lookup callers used to
+ * hand-roll (`primaryServerId` + `getServersForFileWithConfig` +
+ * `resolveLspServerCwd`) into one call that returns `undefined` for a file
+ * with no primary LSP server, so the caller must handle the absent case
+ * instead of rendering it (the N1 `cwd=undefined` row becomes structurally
+ * impossible).
+ */
+export async function resolveLspCwdForFile(filePath, sessionCwd) {
+    const primary = primaryServerEntry(filePath);
+    if (!primary)
+        return undefined;
+    return resolveLspServerCwd(primary, filePath, sessionCwd);
 }
 /**
  * Look up an initializationOptions override for a built-in server.

package/node_modules/pi-lens/dist/clients/lsp/diagnostic-binding.js

@@ -73,6 +73,27 @@ export function touchCoverageGap(result) {
 export function touchCompletedConfirmationPolicy(result) {
     return result?.confirmation !== undefined;
 }
+/**
+ * #2878: one publication-evidence predicate for auxiliary coverage. A
+ * content-hash binding proves that the stored publication describes these
+ * bytes. For a version-less publisher, an advanced per-path publication stamp
+ * proves that the auxiliary published after this touch's pre-notify baseline;
+ * the stamp alone cannot prove that the bytes matched. The pre-notify boolean
+ * passed as `bindingMatchesContent` preserves a binding that the notify
+ * cleared, while the live stamp covers a publication that landed after the
+ * wait began. This predicate is the union. Four callers use it; only the
+ * demoted row's `publishedThisContent` takes the union — the sibling and
+ * aggregate rows compute that field from `auxCoversThisContent` directly
+ * (#2914), while their `outcome` field still reads the stamp through this
+ * predicate. Absent evidence fails closed.
+ */
+export function auxiliaryPublicationEvidence({ bindingMatchesContent, baseline, currentPathVersion, raced = true, }) {
+    return (bindingMatchesContent ||
+        (raced &&
+            Number.isFinite(baseline) &&
+            currentPathVersion !== undefined &&
+            currentPathVersion > baseline));
+}
 /**
  * #1493: the single policy deciding which auxiliaries a touch carries NO
  * evidence from. Both no-answer shapes belong here, because they are the same
@@ -106,7 +127,9 @@ export function touchCompletedConfirmationPolicy(result) {
  * irrelevant once a verified publication for them exists. Exempting `silent` but
  * not `cut_off` on identical evidence would report the same coverage two ways
  * depending on which timer happened to win. This stays fail-closed — it
- * un-narrows only against a content-hash match, never against a timer.
+ * un-narrows only against publication evidence (content-hash match, or an
+ * advanced per-path publication stamp for version-less publishers), never
+ * against a timer.
  */
 export function auxiliaryCoverageGap(evidence) {
     return evidence