@herbertgao/pi-extensions 2026.9.2 → 2026.9.4

package/node_modules/pi-lens/dist/clients/lsp/server.js

@@ -26,6 +26,8 @@ import { logSessionStart } from "../sessionstart-logger.js";
 import { findLocalSgconfig, resolveBaselineSgconfig } from "../sgconfig.js";
 import { findLocalTyposConfig } from "../typos-config.js";
 import { resolvePackagePath } from "../package-root.js";
+import { resolveToolCwd } from "../tool-cwd.js";
+import { recordDegradationOnce } from "../degradation-ledger.js";
 import { hasCargoWorkspaceTable, readCargoWorkspaceExclude, readCargoWorkspaceMembers, readTextFileOrUndefined, } from "../cargo-manifest.js";
 import { resolveAstGrepNativeExe } from "./wait-policy/index.js";
 import { hasSpawnFailureKind, isCommandAvailableAsync, safeSpawnAsync, } from "../safe-spawn.js";
@@ -36,6 +38,48 @@ import { normalizeMapKey } from "./path-utils.js";
 import { getRubyVersionDirNamesSync } from "./ruby-drive-dirs.js";
 import { getProcessSingleton } from "../process-singletons.js";
 import { createGenerationSource, } from "../generation-guard.js";
+function withRootMarkers(root, markers) {
+    root.rootMarkers = markers;
+    return root;
+}
+/** Resolve a server identity cwd through the shared tool-cwd seam. */
+export async function resolveLspServerCwd(server, filePath, sessionCwd, onRootFailure) {
+    const rootMarkers = server.rootMarkers ?? server.root.rootMarkers;
+    let serverRoot;
+    let rootFailed = false;
+    try {
+        serverRoot = await server.root(filePath);
+    }
+    catch (error) {
+        const reason = error instanceof Error ? error.message : String(error);
+        rootFailed = true;
+        onRootFailure?.(reason);
+    }
+    const isFileDirFallback = serverRoot !== undefined &&
+        rootMarkers?.length &&
+        path.resolve(serverRoot) === path.resolve(path.dirname(filePath));
+    if (!serverRoot || isFileDirFallback) {
+        if (!serverRoot) {
+            recordDegradationOnce({
+                kind: "tool-cwd-resolution",
+                subject: server.id,
+                reason: `lsp:server-root-${rootFailed ? "failed" : "fallback"}:${filePath}`,
+            });
+        }
+        if (!rootMarkers?.length)
+            return undefined;
+        return resolveToolCwd("lsp", server.id, filePath, {
+            cwd: path.dirname(path.resolve(filePath)),
+            rootMarkers,
+        });
+    }
+    const boundedServerRoot = enforceLspRootCeiling(serverRoot, sessionCwd, filePath);
+    return resolveToolCwd("lsp", server.id, filePath, {
+        cwd: sessionCwd,
+        rootMarkers,
+        serverRoot: boundedServerRoot,
+    });
+}
 const FIXTURE_ROOT_SEGMENTS = new Set(["__fixtures__", "testdata"]);
 const FALLBACK_PROJECT_MARKERS = [
     ".git",
@@ -845,12 +889,12 @@ function normalizeRootKey(root) {
 }
 function IgnoreHomeRoot(primary) {
     const homeKey = normalizeRootKey(os.homedir());
-    return async (file) => {
+    return withRootMarkers(async (file) => {
         const root = await primary(file);
         if (!root)
             return undefined;
         return normalizeRootKey(root) === homeKey ? undefined : root;
-    };
+    }, primary.rootMarkers ?? []);
 }
 function rubyBinCandidates(baseName) {
     const candidates = [];
@@ -879,6 +923,7 @@ function createInteractiveServer(spec) {
         name: spec.name,
         extensions: spec.extensions,
         root: spec.root,
+        rootMarkers: spec.root.rootMarkers,
         fallbackFor: spec.fallbackFor,
         availabilityKey: typeof spec.command === "string" && isSimpleCommand(spec.command)
             ? spec.command
@@ -917,29 +962,29 @@ function createInteractiveServer(spec) {
 }
 export function PriorityRoot(markerGroups, excludePatterns, stopDir) {
     const resolvers = markerGroups.map((markers) => NearestRoot(markers, excludePatterns, stopDir));
-    return async (file) => {
+    return withRootMarkers(async (file) => {
         for (const resolve of resolvers) {
             const root = await resolve(file);
             if (root)
                 return root;
         }
         return undefined;
-    };
+    }, markerGroups.flat());
 }
 export const FileDirRoot = async (file) => {
     const candidate = path.resolve(path.dirname(file));
     return nearestNonExcludedFallbackRoot(candidate);
 };
 export function RootWithFallback(primary, fallback = FileDirRoot) {
-    return async (file) => {
+    return withRootMarkers(async (file) => {
         const primaryRoot = await primary(file);
         if (primaryRoot)
             return primaryRoot;
         return fallback(file);
-    };
+    }, primary.rootMarkers ?? []);
 }
 export function WorkspacePriorityRoot(markerGroups, excludePatterns) {
-    return async (file) => PriorityRoot(markerGroups, excludePatterns, process.cwd())(file);
+    return withRootMarkers(async (file) => PriorityRoot(markerGroups, excludePatterns, process.cwd())(file), markerGroups.flat());
 }
 function isPermissionFsError(err) {
     const code = err?.code;
@@ -1010,7 +1055,7 @@ export function NearestRoot(includePatterns, excludePatterns, stopDir) {
     // re-walk cost for configless repos is a known trade-off; bounding the
     // walk with stopDir for in-cwd files is the tracked optimization (#1412).
     const inFlight = new Map();
-    return async (file) => {
+    return withRootMarkers(async (file) => {
         // Cache key is the resolved directory — all files in the same dir share a root.
         const startDir = path.resolve(path.dirname(file));
         const dirKey = normalizeMapKey(startDir);
@@ -1052,6 +1097,7 @@ export function NearestRoot(includePatterns, excludePatterns, stopDir) {
                 // glob markers like `*.csproj` match real project filenames (#201).
                 for (const pattern of includePatterns) {
                     if ((await markerExists(currentDir, pattern)) &&
+                        (pattern !== ".git" || currentDir !== os.tmpdir()) &&
                         !(await isExcludedLspRoot(currentDir))) {
                         return enforceLspRootCeiling(currentDir, process.cwd(), file);
                     }
@@ -1073,7 +1119,7 @@ export function NearestRoot(includePatterns, excludePatterns, stopDir) {
         finally {
             inFlight.delete(dirKey);
         }
-    };
+    }, includePatterns);
 }
 /** Alias kept for backward compatibility */
 export const createRootDetector = NearestRoot;
@@ -1579,7 +1625,7 @@ async function hasAgentLevelProjectMarker(extensionRootKey) {
     }
     return false;
 }
-const TypeScriptRoot = DenoExcludeRoot(async (file) => {
+const TypeScriptRoot = withRootMarkers(DenoExcludeRoot(async (file) => {
     const extensionRootKey = piAgentExtensionsRootKey(file);
     if (extensionRootKey) {
         // Bounded walk so we never adopt a parent (e.g. ~/.pi/agent/) as the
@@ -1603,13 +1649,14 @@ const TypeScriptRoot = DenoExcludeRoot(async (file) => {
     if (projectRoot)
         return projectRoot;
     return FileDirRoot(file);
-});
+}), [...TS_CONFIG_MARKERS, ...TS_TOOLING_MARKERS]);
 export const TypeScriptServer = {
     id: "typescript",
     name: "TypeScript Language Server",
     extensions: JS_TS_LSP_EXTENSIONS,
     autoPropagateDiagnostics: true,
     root: TypeScriptRoot,
+    rootMarkers: TypeScriptRoot.rootMarkers,
     async spawn(root, options) {
         const fs = await import("node:fs/promises");
         const nativeLsp = await findNativeTypeScriptLsp(root);
@@ -1919,7 +1966,7 @@ function sessionHoistCeiling(sessionCwd, file) {
 }
 function RustWorkspaceRoot() {
     const crateRoot = createRootDetector(["Cargo.toml", "Cargo.lock"]);
-    return async (file) => {
+    return withRootMarkers(async (file) => {
         const root = await crateRoot(file);
         if (!root)
             return undefined;
@@ -1958,7 +2005,7 @@ function RustWorkspaceRoot() {
             current = parent;
         }
         return root;
-    };
+    }, crateRoot.rootMarkers ?? []);
 }
 /**
  * Resolve whether `parentPomPath`'s <modules> block declares `childDir` as one
@@ -2011,7 +2058,7 @@ function JavaWorkspaceRoot() {
         "build.gradle",
         ".classpath",
     ]);
-    return async (file) => {
+    return withRootMarkers(async (file) => {
         const root = await moduleRoot(file);
         if (!root)
             return undefined;
@@ -2051,7 +2098,7 @@ function JavaWorkspaceRoot() {
             current = parent;
         }
         return enforceLspRootCeiling(lastHop, sessionCwd, file);
-    };
+    }, moduleRoot.rootMarkers ?? []);
 }
 export const RustServer = {
     id: "rust",

package/node_modules/pi-lens/dist/clients/lsp/workspace-diagnostics-cache.js

@@ -8,6 +8,7 @@ import { normalizeMapKey } from "../path-utils.js";
 import { loadReverseDependencyIndexFromSnapshot } from "../reverse-deps.js";
 import { freshnessFromMtime } from "../freshness.js";
 import { logLatency } from "../latency-logger.js";
+import { recordDegradationOnce } from "../degradation-ledger.js";
 import { compareOrdinal } from "../string-utils.js";
 import { workspaceDiagnosticsCacheSessionStart } from "./workspace-diagnostics-session.js";
 import { createDiskBindingCache, } from "./diagnostic-binding.js";
@@ -31,12 +32,17 @@ import { createDiskBindingCache, } from "./diagnostic-binding.js";
  * `LSPWorkspaceDiagnosticResult.timedOut` in `./index.ts`) into
  * `WorkspaceDiagnosticsCacheEntry`.
  */
+// v3 (#2776): cached diagnostics must carry per-diagnostic `serverId`
+// provenance before replay, because primary/auxiliary partitioning is
+// server-owned rather than source-owned. v2 entries predate that contract and
+// are rejected so the owning server can re-collect them instead of silently
+// demoting old primary findings to auxiliary.
 // v2 (#1095): entries may carry an optional `contentHash` fingerprint of the
 // file bytes the cached diagnostics were computed against, so a `lookup` can
 // surface a content `binding` (boundToCurrentDisk) beyond the mtime proxy.
 // Legacy v1 entries are rejected by the version guard and re-scanned — a
 // deliberately clean break so no entry lacking the field is ever served.
-export const WORKSPACE_DIAGNOSTICS_CACHE_VERSION = 2;
+export const WORKSPACE_DIAGNOSTICS_CACHE_VERSION = 3;
 const CACHE_FILE = "lsp-workspace-diagnostics.json";
 function cachePath(cwd) {
     return path.join(getProjectDataDir(cwd), "cache", CACHE_FILE);
@@ -161,11 +167,34 @@ export function loadWorkspaceDiagnosticsCache(cwd) {
         if (!parsed || typeof parsed !== "object")
             return undefined;
         const cache = parsed;
-        if (cache.version !== WORKSPACE_DIAGNOSTICS_CACHE_VERSION)
+        if (cache.version !== WORKSPACE_DIAGNOSTICS_CACHE_VERSION) {
+            if (cache.version === 1 || cache.version === 2) {
+                recordDegradationOnce({
+                    kind: "lsp-workspace-cache-migration",
+                    subject: path.resolve(cwd),
+                    reason: `rejected v${cache.version} cache with ${cache.entries && typeof cache.entries === "object"
+                        ? Object.keys(cache.entries).length
+                        : 0} entries during provenance migration`,
+                });
+            }
             return undefined;
+        }
         if (!cache.entries || typeof cache.entries !== "object")
             return undefined;
-        return cache;
+        const validEntries = {};
+        for (const [key, entry] of Object.entries(cache.entries)) {
+            if (!entry || typeof entry !== "object")
+                continue;
+            if (!Array.isArray(entry.diagnostics) ||
+                entry.diagnostics.some((diagnostic) => !diagnostic ||
+                    typeof diagnostic !== "object" ||
+                    typeof diagnostic.serverId !== "string" ||
+                    diagnostic.serverId.length === 0)) {
+                continue;
+            }
+            validEntries[key] = entry;
+        }
+        return { ...cache, entries: validEntries };
     });
 }
 export function saveWorkspaceDiagnosticsCache(cwd, cache) {
@@ -470,6 +499,9 @@ export function createWorkspaceDiagnosticsCacheContext(cwd) {
         depIndexColdRefusalCount = 0;
     };
     return {
+        importsFor(filePath) {
+            return getImports(filePath);
+        },
         lookup(filePath, scopeKey) {
             // #1669 review N4: the epoch guarded `persist()` but not `lookup()` —
             // an in-flight sweep kept REPLAYING disowned entries into its OWN
@@ -552,11 +584,12 @@ export function createWorkspaceDiagnosticsCacheContext(cwd) {
             };
         },
         record(filePath, scopeKey, diagnostics, mtimeMs, contentHash, sizeBytes) {
+            const scanGeneration = Date.now();
             entries[cacheKeyFor(filePath)] = {
                 diagnostics,
                 count: diagnostics.length,
                 mtimeMs,
-                scannedAt: Date.now(),
+                scannedAt: scanGeneration,
                 scopeKey,
                 // #1793: stamp whether THIS FILE actually had dependency
                 // knowledge this sweep (not just whether SOME index was

package/node_modules/pi-lens/dist/clients/mcp/analyze.js

@@ -367,6 +367,9 @@ export async function analyzeFile(filePath, cwd, options = {}) {
     const lspRunner = latencyReport?.runners.find((runner) => runner.runnerId === "lsp");
     const lsp = lspRunner
         ? {
+            // `deferred` means the runner entered the LSP path but its auxiliary
+            // coverage is delivered later, so it still counts as ran here. The
+            // status remains available to surfaces that need the coverage detail.
             ran: lspRunner.status !== "skipped" &&
                 lspRunner.status !== "when_skipped" &&
                 lspRunner.status !== "test_file_skipped",

package/node_modules/pi-lens/dist/clients/mcp/session.js

@@ -30,6 +30,7 @@ import { RuntimeCoordinator } from "../runtime-coordinator.js";
 import { handleSessionStart } from "../runtime-session.js";
 import { handleTurnEnd } from "../runtime-turn.js";
 import { createMcpHost } from "./host-shim.js";
+import { startSituationalToolTelemetrySession } from "../situational-tool-telemetry.js";
 let contextPromise;
 let resolvedRuntime;
 /**
@@ -79,6 +80,7 @@ function joinMessages(consumed) {
  * `pilens_health` afterwards for the scan results as they land.
  */
 export async function runSessionStart(cwd) {
+    startSituationalToolTelemetrySession("mcp");
     const ctx = await getMcpSessionContext();
     const host = createMcpHost(undefined, cwd);
     await handleSessionStart({

package/node_modules/pi-lens/dist/clients/opengrep-client.js

@@ -148,8 +148,10 @@ export class OpengrepClient extends SecurityScanClient {
                 };
             }
             const findings = parseOpengrepReport(fs.readFileSync(reportPath, "utf-8"));
+            // #2154: the one opengrep site that parsed a scan of this root.
             return {
                 success: true,
+                analyzed: true,
                 findings,
                 scannedAt,
             };

package/node_modules/pi-lens/dist/clients/package-manager.js

@@ -18,6 +18,7 @@ import * as os from "node:os";
 import * as path from "node:path";
 import { classifyProbeFailure, createAvailabilityLatch, isTransientDecision, logAvailabilityDecision, startHostStallSampler, } from "./dispatch/runners/utils/availability-policy.js";
 import { safeSpawnAsync } from "./safe-spawn.js";
+import { probeToolAsync } from "./tool-probe.js";
 import { createAvailabilityProbeFlight } from "./availability-probe-flight.js";
 import { createGenerationSource, } from "./generation-guard.js";
 import { isAtOrAboveHomeDir, walkUpDirs } from "./path-utils.js";
@@ -114,7 +115,7 @@ async function probeAvailability(pm) {
     let result;
     let hostStallMs;
     try {
-        result = await safeSpawnAsync(finder, [pm], { timeout: PROBE_TIMEOUT_MS });
+        result = await probeToolAsync(finder, [pm], { timeout: PROBE_TIMEOUT_MS });
     }
     finally {
         hostStallMs = sampler.stop();

package/node_modules/pi-lens/dist/clients/php-cs-fixer-config.js

@@ -91,8 +91,9 @@
  * gate says "config exists" while the carriage says "not found", silently
  * dropping the `--config` argv this module exists to carry.
  */
+import { existsSync } from "node:fs";
 import * as path from "node:path";
-import { findLocalToolConfig } from "./path-utils.js";
+import { resolveToolCwd } from "./tool-cwd.js";
 /**
  * In `computeConfigFiles()`'s own precedence order — `.php-cs-fixer.php`
  * before `.php-cs-fixer.dist.php` — so a same-directory precedence check can
@@ -109,6 +110,10 @@ const PHP_CS_FIXER_CONFIG_NAMES = [
  * agreeing with this tool's own (unceilinged) detection gates.
  */
 export function resolvePhpCsFixerConfig(filePath) {
-    const startDir = path.dirname(path.resolve(filePath));
-    return findLocalToolConfig(startDir, PHP_CS_FIXER_CONFIG_NAMES);
+    const absolute = path.resolve(filePath);
+    const startDir = resolveToolCwd("formatter", "php-cs-fixer", absolute, {
+        cwd: path.parse(absolute).root,
+        allowHomeMarker: true,
+    });
+    return PHP_CS_FIXER_CONFIG_NAMES.map((name) => path.join(startDir, name)).find(existsSync);
 }

package/node_modules/pi-lens/dist/clients/pipeline.js

@@ -34,6 +34,7 @@ import { clearGraphCache } from "./review-graph/builder.js";
 import { BoundedLruCache } from "./bounded-cache.js";
 import { RUNTIME_CONFIG } from "./runtime-config.js";
 import { getAmbientAbortSignal, safeSpawnAsync } from "./safe-spawn.js";
+import { probeToolAsync } from "./tool-probe.js";
 import { bounded } from "./deadline-utils.js";
 import { enabledAuxiliaryLspServerIds } from "./dispatch/auxiliary-lsp.js";
 import { recordDegradationOnce } from "./degradation-ledger.js";
@@ -356,7 +357,7 @@ async function tryOxlintFix(filePath, cwd) {
     return detectFileChangedAfterCommand(filePath, cmd, ["--fix", filePath], cwd, [1]);
 }
 async function tryRustClippyFix(filePath) {
-    const check = await safeSpawnAsync("cargo", ["--version"], { timeout: 5000 });
+    const check = await probeToolAsync("cargo", ["--version"], { timeout: 5000 });
     if (check.error || check.status !== 0)
         return [];
     const cargoDir = findNearestContaining(path.dirname(path.resolve(filePath)), [
@@ -371,7 +372,7 @@ async function tryRustClippyFix(filePath) {
     return diffProjectSnapshot(cargoDir, before);
 }
 async function tryDartFix(filePath) {
-    const check = await safeSpawnAsync("dart", ["--version"], { timeout: 5000 });
+    const check = await probeToolAsync("dart", ["--version"], { timeout: 5000 });
     if (check.error || check.status !== 0)
         return [];
     const pubspecDir = findNearestContaining(path.dirname(path.resolve(filePath)), ["pubspec.yaml"]);

package/node_modules/pi-lens/dist/clients/project-diagnostics/fresh-fetch.js

@@ -149,6 +149,7 @@ export async function fetchFreshProjectDiagnostics(cacheManager, cwd, clients, s
         return {
             diagnostics: [],
             runners: [],
+            analyzed: [],
             cold: [...ANALYZER_IDS],
             coldReasons: Object.fromEntries(ANALYZER_IDS.map((id) => [id, unsafeRootReason])),
             failed: [],
@@ -158,6 +159,7 @@ export async function fetchFreshProjectDiagnostics(cacheManager, cwd, clients, s
     }
     const diagnostics = [];
     const runners = [];
+    const analyzed = [];
     const cold = [];
     // #1623: the specific reason each `cold` id was skipped, captured at the
     // gate that decided it — see FreshProjectDiagnosticsResult.coldReasons.
@@ -188,7 +190,17 @@ export async function fetchFreshProjectDiagnostics(cacheManager, cwd, clients, s
         pushUnique(cold, id);
         coldReasons[id] = reason;
     }
-    function record(id, adapted, elapsedMs) {
+    /**
+     * `analysedRoot` is the client's own opt-in `AnalysedRootSignal` (#2154),
+     * never a property of reaching this function: `success: true` is also what
+     * a skipped, crashed-before-reporting or memoised run returns, and only the
+     * client knows which of those it is. Findings are recorded either way — an
+     * id that did not analyse the root simply carries no authority to retire a
+     * retained finding.
+     */
+    function record(id, adapted, elapsedMs, analysedRoot) {
+        if (analysedRoot)
+            pushUnique(analyzed, id);
         timings[id] = (timings[id] ?? 0) + elapsedMs;
         const kept = applyDispositionsMultiFile(adapted, analysisRoot, (d) => d.filePath);
         const suppressedHere = adapted.length - kept.length;
@@ -223,10 +235,17 @@ export async function fetchFreshProjectDiagnostics(cacheManager, cwd, clients, s
                 recordFailed("knip", result);
                 return;
             }
+            // knip reports `success: true` for a run that never happened (no
+            // project root, a memo hit, an unparseable exit-0). Those belong in
+            // the honest `cold` channel, not in "fetched fresh this call".
+            if (result.analyzed !== true) {
+                markCold("knip", result.summary ?? "knip did not analyse this root");
+                return;
+            }
             cacheManager.writeCache("knip", result, analysisRoot, {
                 scanDurationMs: Date.now() - startMs,
             });
-            record("knip", knipIssuesToProjectDiagnostics(analysisRoot, result.issues ?? []), Date.now() - startMs);
+            record("knip", knipIssuesToProjectDiagnostics(analysisRoot, result.issues ?? []), Date.now() - startMs, true);
         }),
         // jscpd — duplicate code detection. Cache key varies with TS-project
         // detection, exactly mirroring session_start's own logic.
@@ -243,10 +262,14 @@ export async function fetchFreshProjectDiagnostics(cacheManager, cwd, clients, s
                 recordFailed("jscpd", result);
                 return;
             }
+            if (result.analyzed !== true) {
+                markCold("jscpd", "jscpd did not analyse this root (no source files, or the scan produced no report)");
+                return;
+            }
             cacheManager.writeCache(scannerKey, result, analysisRoot, {
                 scanDurationMs: Date.now() - startMs,
             });
-            record("jscpd", jscpdResultToProjectDiagnostics(analysisRoot, result), Date.now() - startMs);
+            record("jscpd", jscpdResultToProjectDiagnostics(analysisRoot, result), Date.now() - startMs, true);
         }),
         // madge — circular-dependency detection.
         task("madge", async () => {
@@ -259,7 +282,7 @@ export async function fetchFreshProjectDiagnostics(cacheManager, cwd, clients, s
             cacheManager.writeCache("madge", result, analysisRoot, {
                 scanDurationMs: Date.now() - startMs,
             });
-            record("madge", circularDepsToProjectDiagnostics(analysisRoot, result.circular ?? []), Date.now() - startMs);
+            record("madge", circularDepsToProjectDiagnostics(analysisRoot, result.circular ?? []), Date.now() - startMs, result.analyzed === true);
         }),
         // gitleaks — committed-secrets detection. session_start/per-edit stay
         // config-gated per #130's strict default (GitleaksClient.hasGitleaksSignal),
@@ -290,7 +313,7 @@ export async function fetchFreshProjectDiagnostics(cacheManager, cwd, clients, s
             cacheManager.writeCache("gitleaks", result, analysisRoot, {
                 scanDurationMs: Date.now() - startMs,
             });
-            record("gitleaks", gitleaksResultToProjectDiagnostics(analysisRoot, result), Date.now() - startMs);
+            record("gitleaks", gitleaksResultToProjectDiagnostics(analysisRoot, result), Date.now() - startMs, result.analyzed === true);
         }),
         // govulncheck — Go module CVE detection. Go-module-gated per #132.
         task("govulncheck", async () => {
@@ -322,7 +345,7 @@ export async function fetchFreshProjectDiagnostics(cacheManager, cwd, clients, s
             cacheManager.writeCache("govulncheck", result, analysisRoot, {
                 scanDurationMs: Date.now() - startMs,
             });
-            record("govulncheck", govulncheckResultToProjectDiagnostics(analysisRoot, result), Date.now() - startMs);
+            record("govulncheck", govulncheckResultToProjectDiagnostics(analysisRoot, result), Date.now() - startMs, result.analyzed === true);
         }),
         // opengrep — full-workspace semgrep-grade security/quality findings via a
         // single project-wide CLI scan (#584). Structurally always-on: mirrors
@@ -352,7 +375,7 @@ export async function fetchFreshProjectDiagnostics(cacheManager, cwd, clients, s
             cacheManager.writeCache("opengrep", result, analysisRoot, {
                 scanDurationMs: Date.now() - startMs,
             });
-            record("opengrep", opengrepResultToProjectDiagnostics(analysisRoot, result), Date.now() - startMs);
+            record("opengrep", opengrepResultToProjectDiagnostics(analysisRoot, result), Date.now() - startMs, result.analyzed === true);
         }),
         // trivy — dependency CVE detection. Explicit opt-in per #131.
         task("trivy", async () => {
@@ -373,7 +396,7 @@ export async function fetchFreshProjectDiagnostics(cacheManager, cwd, clients, s
             cacheManager.writeCache("trivy", result, analysisRoot, {
                 scanDurationMs: Date.now() - startMs,
             });
-            record("trivy", trivyResultToProjectDiagnostics(analysisRoot, result), Date.now() - startMs);
+            record("trivy", trivyResultToProjectDiagnostics(analysisRoot, result), Date.now() - startMs, result.analyzed === true);
         }),
         // dead-code — cross-file dead-code for non-JS/TS languages (#127).
         // Each client self-gates via detect(); only matching-language projects
@@ -395,7 +418,7 @@ export async function fetchFreshProjectDiagnostics(cacheManager, cwd, clients, s
                 cacheManager.writeCache(cacheKey, result, analysisRoot, {
                     scanDurationMs: Date.now() - startMs,
                 });
-                record("dead-code", deadCodeResultToProjectDiagnostics(analysisRoot, result), Date.now() - startMs);
+                record("dead-code", deadCodeResultToProjectDiagnostics(analysisRoot, result), Date.now() - startMs, result.analyzed === true);
             }));
         }),
         // test-runner — CACHE-READ only, unlike every task above (#1004). Its
@@ -440,7 +463,10 @@ export async function fetchFreshProjectDiagnostics(cacheManager, cwd, clients, s
             // looking indistinguishable from a lane that just executed.
             cachedAgeMs["test-runner"] =
                 Date.now() - new Date(cached.meta.timestamp).getTime();
-            record("test-runner", testRunnerFindingsToProjectDiagnostics(cached.data, analysisRoot, options.runtime), Date.now() - startMs);
+            record("test-runner", testRunnerFindingsToProjectDiagnostics(cached.data, analysisRoot, options.runtime), Date.now() - startMs, 
+            // Never authoritative: this lane reads the cache turn_end wrote,
+            // it never runs a suite over the root this call (#2154).
+            false);
         }),
     ];
     // Swallow any later rejection so an aborted-and-abandoned task can never
@@ -470,6 +496,7 @@ export async function fetchFreshProjectDiagnostics(cacheManager, cwd, clients, s
         return {
             diagnostics,
             runners,
+            analyzed,
             cold,
             coldReasons,
             failed,
@@ -484,6 +511,7 @@ export async function fetchFreshProjectDiagnostics(cacheManager, cwd, clients, s
     return {
         diagnostics,
         runners,
+        analyzed,
         cold,
         coldReasons,
         failed,

package/node_modules/pi-lens/dist/clients/project-diagnostics/runner-adapters/gitleaks.js

@@ -3,12 +3,11 @@ import * as path from "node:path";
  * A gitleaks finding is a leaked secret at a concrete `file:startLine`. Secrets
  * are treated as **blocking** — a committed credential is not a style nit.
  *
- * Exception: `pathStatus: "scratch"` (#1562 review-round F2) — a finding
- * `classifyAndFilterFindings` demoted rather than dropped, so the observability
- * criterion ("record carries tracked/ignored/scratch status") stays honest
- * about a fourth REACHABLE value instead of silently deleting it. Demoted to
- * `severity: "info"`/`semantic: "none"` so it can never read as a blocking
- * "leaked secret" alarm, while remaining visible for an audit read.
+ * Findings in scratch trees, gitignored files, and nested repositories are
+ * retained for explicit audit but demoted to `severity: "info"` / `semantic:
+ * "none"`. They are outside the current repository's shippable source, so they
+ * must never read as blocking leaked-secret alarms. Tracked files and ordinary
+ * untracked files remain blocking.
  */
 export function gitleaksFindingToProjectDiagnostic(cwd, finding) {
     // #1562 observability criterion: surface the git status right in the
@@ -17,14 +16,16 @@ export function gitleaksFindingToProjectDiagnostic(cwd, finding) {
     const statusSuffix = finding.pathStatus
         ? ` [git: ${finding.pathStatus}]`
         : "";
-    const isScratch = finding.pathStatus === "scratch";
+    const isBlocking = finding.pathStatus !== "scratch" &&
+        finding.pathStatus !== "ignored" &&
+        finding.pathStatus !== "nested-repository";
     return {
         filePath: path.isAbsolute(finding.file)
             ? finding.file
             : path.resolve(cwd, finding.file),
         line: finding.startLine,
-        severity: isScratch ? "info" : "error",
-        semantic: isScratch ? "none" : "blocking",
+        severity: isBlocking ? "error" : "info",
+        semantic: isBlocking ? "blocking" : "none",
         tool: "gitleaks",
         runner: "gitleaks",
         rule: `gitleaks:${finding.ruleId}`,

package/node_modules/pi-lens/dist/clients/project-lens-config.js

@@ -69,6 +69,7 @@ import { deprecationRecords, ignoredRecordCollector, projectLocationFor, readCon
 import { finalizeRecords, } from "./config-core/records.js";
 import { homeRelativePath, isAtOrAboveHomeDir, walkUpDirs, } from "./path-utils.js";
 import { findPiLensConfigMarkerInDir } from "./workspace-topology.js";
+import { readToolConfig } from "./tool-config.js";
 /**
  * Project config basenames, in DESCENDING precedence (first match wins), for
  * this loader's own discovery.
@@ -563,6 +564,7 @@ function parseConfigFile(configPath) {
     for (const spec of PROJECT_SCOPED_LENS_FLAGS) {
         assignFlagConfigSection(obj, mutations, spec.configKey, note);
     }
+    const toolConfig = readToolConfig(obj, note);
     const rules = {};
     if (obj.rules && typeof obj.rules === "object" && !Array.isArray(obj.rules)) {
         const rawRules = obj.rules;
@@ -738,6 +740,7 @@ function parseConfigFile(configPath) {
     }
     return {
         config: {
+            ...(toolConfig === undefined ? {} : { tools: toolConfig }),
             ...(startup === undefined ? {} : { startup }),
             ignore,
             rules,

package/node_modules/pi-lens/dist/clients/read-guard-logger.js

@@ -3,6 +3,7 @@ import { isTestMode } from "./env-utils.js";
 import { getGlobalPiLensLogDir } from "./probe-home-state.js";
 import { createNdjsonLogger } from "./ndjson-logger.js";
 import { normalizeFilePath } from "./path-utils.js";
+import { getTurnId } from "./turn-context.js";
 const READ_GUARD_LOG_DIR = getGlobalPiLensLogDir();
 const READ_GUARD_LOG_FILE = path.join(READ_GUARD_LOG_DIR, "read-guard.log");
 const READ_GUARD_LOG_BACKUP_FILE = path.join(READ_GUARD_LOG_DIR, "read-guard.log.1");
@@ -236,6 +237,7 @@ export function logReadGuardEvent(entry) {
     writer.log({
         ts: new Date().toISOString(),
         ...logEntry,
+        turnId: getTurnId(),
         filePath: normalizeFilePath(logEntry.filePath),
         metadata,
     });

package/node_modules/pi-lens/dist/clients/review-graph-logger.js

@@ -4,6 +4,7 @@ import { getGlobalPiLensLogDir } from "./probe-home-state.js";
 import { getMaxLogSizeMB } from "./log-cleanup.js";
 import { createNdjsonLogger } from "./ndjson-logger.js";
 import { normalizeFilePath } from "./path-utils.js";
+import { getTurnId } from "./turn-context.js";
 const REVIEW_GRAPH_LOG_DIR = getGlobalPiLensLogDir();
 const REVIEW_GRAPH_LOG_FILE = path.join(REVIEW_GRAPH_LOG_DIR, "review-graph.log");
 // Bounded like every other global sink (#2505) — see sessionstart-logger.
@@ -64,6 +65,7 @@ export function logReviewGraph(entry) {
         ...entry,
         cwd: normalizeFilePath(entry.cwd),
         pid: process.pid,
+        turnId: getTurnId(),
     });
 }
 export function getReviewGraphLogPath() {