@herbertgao/pi-extensions 2026.9.5 → 2026.9.7

package/node_modules/pi-lens/dist/clients/runtime-turn.js

@@ -39,6 +39,9 @@ import { sweepInlineBlockerPastEof } from "./blocker-past-eof.js";
 import { getLSPService } from "./lsp/index.js";
 import { drainPendingAuxCapEvictedCount, drainPendingAuxiliaryCoverage, isPendingAuxiliaryPastRearmTtl, rearmPendingAuxiliaryCoverage, MAX_LATE_AUX_REARMS, pendingAuxiliaryCoverageSize, } from "./lsp/pending-aux-coverage.js";
 import { convertLspDiagnostics } from "./dispatch/utils/lsp-diagnostics.js";
+import { retagAuxiliaryDiagnostics } from "./dispatch/auxiliary-lsp.js";
+import { applyFindingPolicy, loadProjectRulePolicyMap, renderedRuleIdentities, } from "./dispatch/finding-policy.js";
+import { detectFileRole } from "./file-role.js";
 import { drainPendingRunnerFindings, dropStaleRunnerFindings, pendingRunnerFindingsSize, } from "./dispatch/pending-runner-findings.js";
 // #1631 review V2: moved to its own leaf module so a low-level store
 // (widget-state.ts) can use the marker without importing this orchestrator —
@@ -472,7 +475,15 @@ function capTurnEndMessage(content) {
     return out;
 }
 export async function handleTurnEnd(deps) {
-    const { ctxCwd, getFlag, dbg, runtime, cacheManager, knipClient, deadCodeClients, depChecker, testRunnerClient, sessionId, owner, resetLSPService, resetFormatService, } = deps;
+    const { ctxCwd, getFlag, dbg, runtime, cacheManager, knipClient, deadCodeClients, depChecker, testRunnerClient, sessionId, host = "pi", owner, resetLSPService, resetFormatService, } = deps;
+    const turnIndexAtDispatch = runtime.turnIndex;
+    const clearOwnedTurnState = () => {
+        if (runtime.turnIndex !== turnIndexAtDispatch) {
+            dbg(`turn_end: retaining newer turn state (dispatch=${turnIndexAtDispatch}, current=${runtime.turnIndex})`);
+            return;
+        }
+        cacheManager.clearTurnState(cwd, currentOwner);
+    };
     // #449 slice 1: piggyback the instance-registry heartbeat on this existing
     // per-turn touchpoint rather than adding a new timer/interval. Cheap (reads
     // process.memoryUsage().rss, one read-modify-write of instances.json) and
@@ -527,7 +538,7 @@ export async function handleTurnEnd(deps) {
     if (access === "available" &&
         (turnState.files || turnState.owner || turnState.sessionId)) {
         dbg("turn_end: evicting stale turn-state owner");
-        cacheManager.clearTurnState(cwd, currentOwner);
+        clearOwnedTurnState();
         turnState = cacheManager.readTurnState(cwd);
     }
     const files = Object.keys(turnState.files);
@@ -640,7 +651,7 @@ export async function handleTurnEnd(deps) {
     dbg(`turn_end: ${files.length} file(s) modified, cycles: ${turnState.turnCycles}/${turnState.maxCycles}, access: ${access}, owner: ${gateOwnerLabel}`);
     if (cacheManager.isMaxCyclesExceeded(cwd)) {
         dbg("turn_end: max cycles exceeded, clearing state and forcing through");
-        cacheManager.clearTurnState(cwd, currentOwner);
+        clearOwnedTurnState();
         runtime.fixedThisTurn.clear();
         resetFormatService();
         return;
@@ -691,6 +702,9 @@ export async function handleTurnEnd(deps) {
     // map — see blocker-freshness.ts's `WidgetSweepBlockerEntry` doc for why this
     // is injected here rather than imported by blocker-freshness.ts itself.
     const blockerFreshness = await sweepInlineBlockerFreshness(runtime, cwd, {
+        // #2982: the hook's own signal, so the self axis's filesystem work is
+        // bounded by the same abort everything else in this handler honours.
+        ...(deps.signal === undefined ? {} : { signal: deps.signal }),
         additionalEntries: getWidgetBlockingFilesForSweep().map((row) => ({
             filePath: row.filePath,
             recordedAtMs: row.recordedAtMs,
@@ -709,6 +723,9 @@ export async function handleTurnEnd(deps) {
             revalidated: blockerFreshness.revalidated,
             alreadyStale: blockerFreshness.alreadyStale,
             truncatedImports: blockerFreshness.truncatedImports,
+            selfHealed: blockerFreshness.selfHealed,
+            selfUnverifiable: blockerFreshness.selfUnverifiable,
+            hashBudgetExhausted: blockerFreshness.hashBudgetExhausted,
         },
     });
     // Re-surface inline blockers from this turn that the agent didn't fix.
@@ -1960,6 +1977,7 @@ export async function handleTurnEnd(deps) {
                 heldDeferred.push({
                     testFile,
                     runner: carried.runner,
+                    sourceFile: carried.sourceFile ?? testFile,
                     attempts,
                     sessionId: turnSessionId,
                 });
@@ -1970,6 +1988,7 @@ export async function handleTurnEnd(deps) {
             redispatchedDeferred++;
             targets.push({
                 testFile,
+                sourceFile: carried.sourceFile ?? testFile,
                 runner: carried.runner,
                 config,
                 strategy: "deferred",
@@ -2063,7 +2082,7 @@ export async function handleTurnEnd(deps) {
                     overCapTargets++;
                     continue;
                 }
-                targets.push(target);
+                targets.push({ ...target, sourceFile: abs });
                 dbg(`turn_end: ${display} → test ${target.runner} ${path.relative(cwd, target.testFile)} (${target.strategy}${isNeighbor ? ", cascade-neighbor" : ""})`);
             }
             else if (!target) {
@@ -2091,6 +2110,9 @@ export async function handleTurnEnd(deps) {
             dbg(`turn_end: test target count capped at ${TEST_RUNNER_MAX_TARGETS}, ${overCapTargets} skipped`);
         }
         if (targets.length > 0) {
+            for (const target of targets) {
+                target.fileSeqAtRun = runtime.getFileSeq(target.sourceFile);
+            }
             dbg(`turn_end: firing ${targets.length} test target(s) async (non-blocking, max ${TEST_RUNNER_BATCH_CONCURRENCY} concurrent)`);
             const firedAtTurn = runtime.turnIndex;
             const firedSessionId = turnSessionId;
@@ -2137,8 +2159,32 @@ export async function handleTurnEnd(deps) {
                 }),
             })
                 .then(({ results, deferred, stopReason }) => {
+                const settledResults = results;
+                const verdicts = settledResults.flatMap((result) => {
+                    if (result.status === "rejected")
+                        return [];
+                    const target = targets.find((candidate) => candidate.testFile === result.value.file);
+                    return target
+                        ? [
+                            {
+                                file: result.value.file,
+                                sourceFile: target.sourceFile,
+                                fileSeq: target.fileSeqAtRun === undefined
+                                    ? {
+                                        state: "unknown",
+                                        reason: "sequence-unavailable",
+                                    }
+                                    : {
+                                        state: "known",
+                                        value: target.fileSeqAtRun,
+                                    },
+                            },
+                        ]
+                        : [];
+                });
                 const deferredTargets = deferred.map((t) => ({
                     testFile: t.testFile,
+                    sourceFile: t.sourceFile,
                     runner: t.runner,
                     // One more cut batch for this target. Read back by the
                     // selection loop above, which retires it at
@@ -2342,6 +2388,7 @@ export async function handleTurnEnd(deps) {
                         content,
                         stale,
                         results: resultValues,
+                        verdicts,
                         testRunGeneration,
                         launchedFrom,
                         publishedAgainst,
@@ -2439,6 +2486,7 @@ export async function handleTurnEnd(deps) {
                         content: deferralNote,
                         stale,
                         results: resultValues,
+                        verdicts,
                         testRunGeneration,
                         launchedFrom,
                         publishedAgainst,
@@ -2718,7 +2766,7 @@ export async function handleTurnEnd(deps) {
             // #2521: `cwd` is what resolves the store location the advisory
             // names -- it is the SAME cwd `publishActionableWarningsReport`
             // just wrote through, so the two cannot disagree.
-            const advisory = formatActionableWarningsAdvisory(publishResult.report, cwd);
+            const advisory = formatActionableWarningsAdvisory(publishResult.report, cwd, host);
             // @delivery-surface: runtime-turn:actionable-warnings-advisory
             if (advisory)
                 advisoryParts.push(advisory);
@@ -2774,7 +2822,7 @@ export async function handleTurnEnd(deps) {
         });
         writeCodeQualityWarningsReport(cacheManager, cwd, qualityReport);
         appendCodeQualityWarningsHistory(cwd, qualityReport);
-        const advisory = formatCodeQualityWarningsAdvisory(qualityReport, cwd);
+        const advisory = formatCodeQualityWarningsAdvisory(qualityReport, cwd, host);
         // @delivery-surface: runtime-turn:code-quality-warnings-advisory
         if (advisory)
             advisoryParts.push(advisory);
@@ -2900,6 +2948,13 @@ export async function handleTurnEnd(deps) {
     let lateAuxCeilingExhausted = 0;
     let lateAuxAnswered = 0;
     let lateAuxNotifyStallDemoted = 0;
+    // #3102: dropped by the shared finding-policy stack (inline `pi-lens-ignore`
+    // / stored disposition / `.pi-lens.json` rule policy) and, separately, by the
+    // auxiliary profile's OWN native suppression inside `retagAuxiliaryDiagnostics`.
+    // Both are reported in the one bounded per-turn record below — a drop is
+    // never silent (shape 10).
+    let lateAuxDispositionSuppressed = 0;
+    let lateAuxAuxSuppressed = 0;
     const lateAuxCoverageGapPairs = [];
     let lateAuxCoverageGapDetailCount = 0;
     let lateAuxCoverageGapDropCount = 0;
@@ -2947,6 +3002,32 @@ export async function handleTurnEnd(deps) {
                     continue;
                 }
                 const displayLateAuxPath = toRunnerDisplayPath(cwd, lateAuxPath);
+                // #3102: the file's CURRENT bytes, for the two content-bound halves
+                // of the policy stack (inline `pi-lens-ignore` and the STRICT
+                // `false-positive` anchor) and for the auxiliary profile's own
+                // native suppression. Read at most ONCE per file per drain, lazily:
+                // a turn that drains nothing, finds no live client, re-arms, or
+                // confirms clean pays no I/O at all, and a file with several pending
+                // servers pays one read for all of them. Measured cost on the one
+                // file that does publish: 0.10-0.20 ms typical, 4.0 ms worst case
+                // (a 180 KB file, 5 findings, a populated disposition store) against
+                // the 3000 ms `HOOK_WALL_BUDGET_MS.turn_end`. A read failure yields
+                // `undefined`: the content-free half still applies and nothing is
+                // hidden on an I/O error (shape 48).
+                let lateAuxContentRead = false;
+                let lateAuxContentValue;
+                const readLateAuxContent = () => {
+                    if (!lateAuxContentRead) {
+                        lateAuxContentRead = true;
+                        try {
+                            lateAuxContentValue = fs.readFileSync(lateAuxPath, "utf-8");
+                        }
+                        catch {
+                            lateAuxContentValue = undefined;
+                        }
+                    }
+                    return lateAuxContentValue;
+                };
                 for (const pair of pairs) {
                     const cachedEntry = cached.get(pair.serverId);
                     if (cachedEntry === undefined) {
@@ -3034,14 +3115,29 @@ export async function handleTurnEnd(deps) {
                         lateAuxCleanConfirmed += 1;
                         continue;
                     }
-                    const converted = convertLspDiagnostics(rawDiags, lateAuxPath, {
-                        tool: "lsp",
-                    });
-                    if (converted.length === 0) {
+                    // `convertLspDiagnostics` drops entries with no start line, which
+                    // would break the 1:1 index alignment `retagAuxiliaryDiagnostics`
+                    // needs. Partition first so `converted[i]` IS `anchored[i]` —
+                    // the same pre-partition `applyLspFindingPolicy` does.
+                    const anchored = rawDiags.filter((d) => d.range?.start?.line !== undefined);
+                    if (anchored.length === 0) {
                         lateAuxMissing += rawDiags.length;
                         lateAuxAnswered += 1;
                         continue;
                     }
+                    const lateAuxContent = readLateAuxContent();
+                    const converted = convertLspDiagnostics(anchored, lateAuxPath);
+                    // #3046/#3047: the auxiliary's REAL tool id (and its own native
+                    // inline suppression — opengrep's `# nosemgrep`, ast-grep's
+                    // test-file gate), from the ONE shared derivation every other
+                    // surface anchors a mark against. These diagnostics come straight
+                    // off the aux client's cache, so nothing upstream applied it.
+                    const retained = retagAuxiliaryDiagnostics(converted, anchored, lateAuxContent ?? "", { cwd, fileRole: detectFileRole(lateAuxPath, lateAuxContent) });
+                    lateAuxAuxSuppressed += converted.length - retained.length;
+                    if (retained.length === 0) {
+                        lateAuxAnswered += 1;
+                        continue;
+                    }
                     // Freshness kernel (#1634 gated surface): stat the cited file
                     // against the mark timestamp. Missing → drop (no remediation for
                     // a deleted file); mtime drifted past the mark → drop too, NOT
@@ -3053,14 +3149,14 @@ export async function handleTurnEnd(deps) {
                     // never silent (shape 10).
                     const gate = gateFindingsByPathFreshness({
                         store: "late-auxiliary-findings",
-                        findings: converted,
+                        findings: retained,
                         cwd,
                         scannedAt: pair.markedAtMs,
                         citedPath: () => lateAuxPath,
                     });
                     lateAuxStale += gate.stale.length;
                     lateAuxMissing +=
-                        converted.length - gate.live.length - gate.stale.length;
+                        retained.length - gate.live.length - gate.stale.length;
                     if (gate.live.length === 0) {
                         if (gate.stale.length > 0) {
                             // Stale findings mean the scan predates the last edit. Re-arm
@@ -3092,11 +3188,43 @@ export async function handleTurnEnd(deps) {
                     // merged one). Late findings reach the agent as the gated advisory
                     // below; the turn-end hash-guarded fast path stays cold for a file
                     // whose touch was partial, which is exactly what #1470 requires.
-                    const lines = gate.live.map((f) => `  ${displayLateAuxPath}:${f.line}:${f.column} [${f.rule}] ${f.message}`);
-                    lateAuxDelivered += gate.live.length;
+                    // #3102: the survivors are what the agent READS, so they take the
+                    // same `clients/dispatch/finding-policy.ts` stack — inline
+                    // `pi-lens-ignore` → stored dispositions → `.pi-lens.json` rule
+                    // policy — the per-edit dispatcher, `mode=full` and the
+                    // `source=lsp` probe lane apply. Without it a finding the agent
+                    // marked `false-positive` re-reported on every turn that drained
+                    // a late pair. Runs AFTER the freshness gate, like the #1625
+                    // govulncheck/secrets filters: the anchor is derived from the
+                    // post-gate identity, never the raw pre-gate set.
+                    const { kept: lateAuxKept } = applyFindingPolicy(gate.live, {
+                        cwd,
+                        filePath: lateAuxPath,
+                        content: lateAuxContent ?? "",
+                        // mtime-cached, so a drain of several files costs one stat.
+                        policyMap: loadProjectRulePolicyMap(cwd),
+                        identities: renderedRuleIdentities,
+                    });
+                    const lateAuxSuppressedHere = gate.live.length - lateAuxKept.length;
+                    lateAuxDispositionSuppressed += lateAuxSuppressedHere;
+                    if (lateAuxKept.length === 0) {
+                        // Every late finding was suppressed. This is a PUSH surface:
+                        // silence after a mark is the mark working, not a clean
+                        // verdict, so the count rides the bounded per-turn record below
+                        // instead of re-announcing the suppression every single turn.
+                        lateAuxAnswered += 1;
+                        continue;
+                    }
+                    const lines = lateAuxKept.map((f) => `  ${displayLateAuxPath}:${f.line}:${f.column} [${f.rule}] ${f.message}`);
+                    lateAuxDelivered += lateAuxKept.length;
                     lateAuxAnswered += 1;
+                    // #1616 suppressed-bucket rule: a delivery that still has
+                    // something to say states what it dropped, once per delivery.
+                    const lateAuxSuppressedNote = lateAuxSuppressedHere > 0
+                        ? `; suppressed by disposition: ${lateAuxSuppressedHere} finding(s)`
+                        : "";
                     // @delivery-surface: runtime-turn:late-auxiliary-findings
-                    advisoryParts.push(`🕐 Late auxiliary diagnostics (${pair.serverId} answered after its grace window):\n${lines.join("\n")}`);
+                    advisoryParts.push(`🕐 Late auxiliary diagnostics (${pair.serverId} answered after its grace window${lateAuxSuppressedNote}):\n${lines.join("\n")}`);
                 }
             }
         }
@@ -3150,6 +3278,8 @@ export async function handleTurnEnd(deps) {
                 expired: lateAuxExpired,
                 ceilingExhausted: lateAuxCeilingExhausted,
                 answered: lateAuxAnswered,
+                dispositionSuppressed: lateAuxDispositionSuppressed,
+                auxSuppressed: lateAuxAuxSuppressed,
                 notifyStallDemoted: lateAuxNotifyStallDemoted,
                 coverageGapReRaised: lateAuxCoverageGapPairs.length,
                 coverageGapReRaisedDetailed: lateAuxCoverageGapDetailCount,
@@ -3202,7 +3332,7 @@ export async function handleTurnEnd(deps) {
                     });
                 }
             }
-            cacheManager.clearTurnState(cwd, currentOwner);
+            clearOwnedTurnState();
             runtime.fixedThisTurn.clear();
             resetFormatService();
             return;
@@ -3289,7 +3419,7 @@ export async function handleTurnEnd(deps) {
         });
     }
     if (blockerParts.length === 0) {
-        cacheManager.clearTurnState(cwd, currentOwner);
+        clearOwnedTurnState();
         // `staleSecretParts` counts here too (#1622 review M2): clearing the
         // findings record while a stale secret is still unverified would drop the
         // only surviving trace of it.

package/node_modules/pi-lens/dist/clients/safe-spawn.js

@@ -16,9 +16,9 @@
 import { spawn, spawnSync, } from "node:child_process";
 import * as fs from "node:fs";
 import * as path from "node:path";
-import { BoundedFifoMap } from "./bounded-cache.js";
+import { BoundedFifoMap, BoundedSet } from "./bounded-cache.js";
 import { logLatency } from "./latency-logger.js";
-import { recordDegradation } from "./degradation-ledger.js";
+import { incrementDegradationCount, recordDegradation, recordDegradationOnce, } from "./degradation-ledger.js";
 import { logExtension } from "./extension-log.js";
 import { isFullyQualifiedWin32 } from "./path-utils.js";
 import { startSpawnUsageSampler } from "./resource-sampler.js";
@@ -212,6 +212,228 @@ const lifetimeState = processWithLifetimeState[lifetimeStateKey] ??
         pids: new Set(),
         installed: false,
     });
+/**
+ * THE ownership predicate for every kill-by-raw-pid in this repo (#2042).
+ *
+ * A pid is signalable only when it is a LIVE DIRECT CHILD of this process.
+ * `tests/clients/lsp/launch.test.ts` mocked `node:child_process` with a fake
+ * child carrying the literal pid `2468`; `safeSpawnAsync` registered it in
+ * `lifetimeState.pids`, the fake never emitted `close` so nothing removed it,
+ * and at fork teardown `installLifetimeCleanup()` fired
+ * `process.kill(-2468, "SIGKILL")`. On ~10 % of GitHub runners pid 2468 was
+ * one of the job's own long-lived processes — that is the whole of #2042:
+ * exit 137, no failing assertion, no kernel record, five weeks of "infra
+ * kill" reruns. A `pid <= 0` guard would not have stopped it; 2468 is a
+ * perfectly plausible pid. The defect is OWNERSHIP, not sign.
+ *
+ * Three guards fold into this one (net-count rule): `lsp/client.ts`'s
+ * `pid <= 0`, `lsp/launch.ts`'s `handle.pid <= 0` plus its already-exited
+ * recycled-pid check, and `killTree`'s `child.pid > 0` below. It closes
+ * fabricated, stale and recycled pids together.
+ *
+ * NOT folded: `instance-reaper.ts#killPidTree`. Its pids come from OTHER
+ * pi-lens instances' registries and from an OS scan of managed binaries with
+ * confirmed-dead parents — deliberately NOT our children. Its `!isFinite ||
+ * pid <= 0` guard is well-formedness on a different axis, and applying this
+ * predicate there would turn the orphan reaper into a no-op.
+ *
+ * Platform behaviour, stated rather than implied:
+ *  - Linux (the authoritative lane, and the one that lost five weeks):
+ *    `/proc/<pid>/status` is the kernel's own answer. Missing entry = the pid
+ *    does not exist, so there is nothing of ours to kill; `PPid` other than
+ *    ours = someone else's process, which is recorded and never signalled.
+ *  - Windows and macOS have no `/proc` (and neither does a Linux host with
+ *    `/proc` unmounted — probed once, not assumed from `process.platform`),
+ *    so ownership is unverifiable from a raw pid and the predicate keeps
+ *    today's best-effort behaviour. The `handle` arm applies THERE and only
+ *    there: it is the only ownership evidence Windows has, and it is what
+ *    `killWindowsTree` already used. It must not gate the POSIX group kill,
+ *    which legitimately runs after its leader has died (#3091 F1).
+ */
+/**
+ * Whether `/proc/<pid>/status` can actually be read here, probed ONCE against
+ * this process's own entry (#3091 F4). `process.platform === "linux"` is not
+ * the same question: a container or a hardened host can run Linux with no
+ * `/proc` mounted, and there the per-pid read fails exactly the way a dead pid
+ * does. Without this probe that silently refused every registration, so
+ * `lifetimeState.pids` stayed empty and the host-exit tree kill stopped working
+ * with no record anywhere.
+ */
+const PROC_PPID_READABLE = (() => {
+    if (process.platform !== "linux")
+        return false;
+    try {
+        return /^PPid:\s*\d+$/m.test(fs.readFileSync("/proc/self/status", "utf8"));
+    }
+    catch {
+        return false;
+    }
+})();
+/**
+ * Pids this process has PROVEN, from the kernel, to be its own live children.
+ * FIFO-bounded (`BoundedFifoMap`, not a wholesale clear): a process that spawns
+ * more than the cap drops its OLDEST verdicts, where a wholesale clear would
+ * drop the one it is about to need.
+ */
+export const VERIFIED_OWN_PID_CAP = 512;
+const verifiedOwnPids = new BoundedFifoMap(VERIFIED_OWN_PID_CAP);
+/**
+ * Pids whose OWNERSHIP IS HELD for the lifetime of a long-lived resource —
+ * today, the LSP children `clients/lsp/launch.ts` spawns with `nodeSpawn`
+ * (#3091 F1-r2b).
+ *
+ * These deliberately do NOT live in `verifiedOwnPids`. Age is the wrong
+ * retirement axis for a resource-scoped verdict: an LSP leader is verified once
+ * at spawn and then sits untouched for the whole session, so in a FIFO that
+ * every `safeSpawnAsync` writes to it is the OLDEST entry and therefore the
+ * FIRST evicted — measured, 520 later verdicts were enough — and its group kill
+ * at host exit is refused precisely because the server was long-lived enough to
+ * matter. Retirement here is by RESOURCE STATE instead: `releaseOwnChildPid`
+ * when the shutdown ladder is done with the pid, plus the confirmed-dead sweep
+ * below for the paths that never reach a ladder (a server that crashes, or a
+ * host killed mid-session).
+ *
+ * The bound that remains, stated rather than implied: at most
+ * `HELD_OWN_PID_SWEEP_AT` entries — the confirmed-dead sweep below runs before
+ * every insert, and `BoundedSet`'s own FIFO overflow is the last resort for the
+ * case where every held group really is still alive. A crash-looping server cannot grow it without bound
+ * because each sweep drops every pid whose process GROUP no longer exists,
+ * which is exactly the condition under which the entry can never be needed
+ * again.
+ */
+const HELD_OWN_PID_SWEEP_AT = 256;
+const heldOwnPids = new BoundedSet(HELD_OWN_PID_SWEEP_AT);
+/** A process group that no longer exists can never need another signal. */
+function groupIsGone(pid) {
+    try {
+        process.kill(-pid, 0);
+        return false;
+    }
+    catch (error) {
+        return errorCode(error) === "ESRCH";
+    }
+}
+function sweepHeldOwnPids() {
+    if (heldOwnPids.size < HELD_OWN_PID_SWEEP_AT)
+        return;
+    // Deleting the current entry mid-iteration is well-defined for a Set, so
+    // no snapshot copy is needed.
+    for (const pid of heldOwnPids) {
+        if (groupIsGone(pid))
+            heldOwnPids.delete(pid);
+    }
+    // No hand-rolled "drop the oldest" block (#2442 / #3091 round 4): the
+    // last-resort eviction, for the case where every held group is still alive
+    // at the ceiling, is `BoundedSet.add`'s own FIFO overflow.
+}
+/**
+ * Verify a pid at ADMISSION and hold the verdict for the resource's lifetime.
+ *
+ * This is AGENTS.md shape 50's own rule, which #3091 round 1 broke at the site
+ * it was fixing: `isOwnLiveChild`'s three call sites were the `safeSpawnAsync`
+ * registration, the Windows tree kill, and the SHUTDOWN group kill — so for an
+ * LSP child, spawned with `nodeSpawn`, the first offer of verification was also
+ * the last, and on the `processExiting` path the leader could already be dead
+ * by then (`/proc` gone, nothing on record, signal refused, grandchildren
+ * orphaned).
+ */
+export function holdOwnChildPid(pid, site) {
+    const owned = isOwnLiveChild(pid, site);
+    if (!owned || !PROC_PPID_READABLE || typeof pid !== "number")
+        return owned;
+    // Exactly one home: the verification above filed the verdict in the
+    // age-bounded FIFO, and leaving a copy there would make BOTH the held set
+    // and its release mutation-inert — the FIFO copy would answer for them.
+    verifiedOwnPids.delete(pid);
+    sweepHeldOwnPids();
+    heldOwnPids.add(pid);
+    return true;
+}
+/**
+ * Retire a held pid once nothing will signal it again — the end of the
+ * shutdown ladder. Idempotent.
+ */
+export function releaseOwnChildPid(pid) {
+    if (typeof pid === "number")
+        heldOwnPids.delete(pid);
+}
+/** Once per session: a Linux host whose `/proc` cannot answer the question. */
+function recordProcUnavailable(site) {
+    if (process.platform !== "linux")
+        return;
+    recordDegradationOnce({
+        kind: "kill-ownership-unverifiable",
+        subject: site,
+        reason: "/proc/self/status is unreadable on this Linux host; kill-by-pid ownership falls back to best-effort",
+    });
+}
+export function isOwnLiveChild(pid, site, handle) {
+    if (typeof pid !== "number" || !Number.isInteger(pid) || pid <= 0)
+        return false;
+    if (!PROC_PPID_READABLE) {
+        // No `/proc` to consult. A handle that has already reported exit is then
+        // the ONLY ownership evidence available, and it is exactly what
+        // `killWindowsTree` used before this predicate existed: a dead pid may
+        // have been recycled, and `taskkill /F /T` on a recycled pid destroys an
+        // unrelated tree. It overrides the memo below deliberately.
+        if (handle && (handle.exitCode != null || handle.signalCode != null))
+            return false;
+        recordProcUnavailable(site);
+        return true;
+    }
+    let status;
+    try {
+        status = fs.readFileSync(`/proc/${pid}/status`, "utf8");
+    }
+    catch {
+        // The pid does not exist. Not a degradation — a child that exited before
+        // the teardown signal is the ordinary case — but not automatically a
+        // refusal either: a POSIX process GROUP outlives its leader, and #2026's
+        // whole point is that the escalation must still reach a SIGTERM-hardy
+        // grandchild after the direct child has died. Ownership verified while
+        // the leader was alive is what answers that; a pid this process never
+        // owned is still refused.
+        return heldOwnPids.has(pid) || verifiedOwnPids.has(pid);
+    }
+    const parent = /^PPid:\s*(\d+)$/m.exec(status);
+    if (!parent)
+        return true;
+    if (Number(parent[1]) === process.pid) {
+        // Memoized only on a KERNEL-verified verdict, and only here: a pid we
+        // never proved was ours can never enter the memo, and a pid that is
+        // alive under a different parent is refused above regardless of what the
+        // memo holds — so a recycled pid cannot be signalled on the strength of
+        // its previous owner.
+        //
+        // Never for a pid already HELD, though: the shutdown ladder verifies a
+        // still-live leader on its way to the group signal, and filing that
+        // verdict in the FIFO too would put a held pid back in both stores —
+        // which outlives `releaseOwnChildPid` (the FIFO copy would keep
+        // answering for a pid this process has explicitly stopped claiming) and
+        // makes the held store's own tests unable to fail.
+        if (!heldOwnPids.has(pid))
+            verifiedOwnPids.set(pid, true);
+        return true;
+    }
+    // Alive AND someone else's: the dangerous case, and the only one worth a
+    // record. Subject is the SITE (a fixed, tiny set), never the pid, so the
+    // ledger stays bounded however often it fires.
+    incrementDegradationCount({
+        kind: "kill-foreign-pid-refused",
+        subject: site,
+        reason: `pid ${pid} has parent ${parent[1]}, not this process — signal refused`,
+    });
+    return false;
+}
+/**
+ * Kill one registered pid's tree at host exit. Deliberately NOT re-checked
+ * against `isOwnLiveChild` here: `lifetimeState.pids` has exactly one writer
+ * (the registration below), that writer is now gated, and a second gate on
+ * the same feeder would make BOTH mutation-inert — remove either one and the
+ * other still blocks the kill, so neither would have a test that reds. The
+ * gate lives where the pid enters, which is also where ownership is a fact
+ * rather than a stale reading (#2042).
+ */
 function killPidTreeSync(pid) {
     if (process.platform === "win32") {
         try {
@@ -836,6 +1058,17 @@ export function resetUtf8ConsoleCodePageStateForTests() {
 // caller's overall budget unboundedly.
 const EXIT_PIPE_IDLE_GRACE_MS = 100;
 const EXIT_PIPE_IDLE_MAX_WAIT_MS = 2000;
+/**
+ * #2968: how long past its own deadline this spawn's CPU/RSS sampler may keep
+ * polling. Everything this function does to end a child after the deadline
+ * fits inside it: `killTree`'s SIGTERM plus its 1000ms SIGKILL escalation (or
+ * Windows' `taskkill /F /T`), then at most EXIT_PIPE_IDLE_MAX_WAIT_MS of
+ * pipe-idle wait. A child still alive past deadline + this grace has outlived
+ * every teardown available here, so polling it further only buys the Windows
+ * process pile-up the report measured — and `stop()` still returns whatever
+ * the sampler gathered before the cap.
+ */
+const SPAWN_SAMPLER_TEARDOWN_GRACE_MS = 5_000;
 // ============================================================================
 // ASYNC VERSION (Recommended - Non-blocking)
 // ============================================================================
@@ -1225,7 +1458,14 @@ export async function safeSpawnAsync(command, args, options) {
             child.stdin?.on("error", () => { });
             child.stdin?.end(options.input);
         }
-        if (child.pid && (posixProcessGroup || options?.lifetimeCoupled)) {
+        // #2042: ownership is a SPAWN-TIME fact — a real child is alive with
+        // `PPid == ours` the instant `spawn` returns, while a test double's
+        // invented pid never is. Resolve it once, here, and reuse the verdict:
+        // the group escalation below must still fire after the direct child
+        // dies (#2027: a SIGTERM-hardy grandchild keeps the group alive), so it
+        // cannot re-read `/proc` at kill time.
+        const ownsChildPid = isOwnLiveChild(child.pid, "safe-spawn-register");
+        if (ownsChildPid && (posixProcessGroup || options?.lifetimeCoupled)) {
             // #2026: POSIX registers unconditionally - detached children no
             // longer receive terminal signals directly, so the lifetime
             // cleanup's signal forwarding IS their die-with-host path.
@@ -1240,9 +1480,22 @@ export async function safeSpawnAsync(command, args, options) {
         // best-effort/never-throws by design, but this call site wraps it anyway
         // (belt and suspenders: the sampling seam must never be the reason a real
         // spawn fails) with a no-op fallback sampler.
+        //
+        // #2968: the sampler's polling lifetime is bounded by THIS spawn's own
+        // deadline plus the teardown grace, not by the child's willingness to
+        // exit. `finalize`/the `error` handler still stop it on every settle
+        // path, but none of those paths exist for a child that never settles —
+        // a hung `.cmd` shim whose tree survives `taskkill /F /T` kept polling
+        // for 5-6 hours in the report.
         let usageSampler;
         try {
-            usageSampler = startSpawnUsageSampler(child.pid);
+            usageSampler = startSpawnUsageSampler(
+            // The poll CADENCE is the sampler's own policy (it owns the backoff
+            // too); the DEADLINE is this function's. Passing `undefined` rather
+            // than importing the cadence constant keeps this module's view of
+            // the sampler at one export, which is also what every existing
+            // `vi.mock` of it provides.
+            child.pid, undefined, timeout + SPAWN_SAMPLER_TEARDOWN_GRACE_MS);
         }
         catch {
             usageSampler = { stop: () => null };
@@ -1272,7 +1525,7 @@ export async function safeSpawnAsync(command, args, options) {
                     child.kill("SIGKILL");
                 }
             }
-            else if (posixProcessGroup && child.pid && child.pid > 0) {
+            else if (posixProcessGroup && ownsChildPid) {
                 // #2026: signal the whole process group. Grandchildren spawned
                 // by the tool share its group, so one signal reaches the whole
                 // tree; a negative-pid ESRCH means it already exited.

package/node_modules/pi-lens/dist/clients/scratch-tree-policy.js

@@ -91,6 +91,12 @@ export function getScratchTreeFnmatchPatterns() {
 export const SECRETS_LANE_SCRATCH_DIR_NAMES = [
     // pi-ecosystem / coding-agent data + cache directories.
     ".pi",
+    // The same agent's rebranded config dir (#3112) — pi's config-dir name is
+    // `pkg.piConfig?.configDir || ".pi"`, so `.omp/agent/sessions` is the very
+    // history `.pi/agent/sessions` holds. Without it the secrets lane READS a
+    // project-local session history and can report a key a user pasted into a
+    // transcript as a blocking first-party leak.
+    ".omp",
     ".pi-lens",
     ".claude",
     ".codex",