@herbertgao/pi-extensions 2026.9.5 → 2026.9.7

package/node_modules/pi-lens/dist/mcp/server.js

@@ -969,7 +969,8 @@ async function callTool(name, args) {
             summaryLines.push(truncationNotice);
         // #1107 phase 2: same "reached the seam but nothing rendered it" gap as
         // #784's scanTruncationNotice, for the generated-name skip counters.
-        const skipNotice = generatedSkipNotice(snapshot);
+        // #2535: render the MCP-callable tool names on this route.
+        const skipNotice = generatedSkipNotice(snapshot, "mcp");
         if (skipNotice)
             summaryLines.push(skipNotice);
         return toolText(summaryLines.join("\n"), {
@@ -1375,7 +1376,9 @@ async function callTool(name, args) {
     if (name === "pilens_diagnostics") {
         const cwd = typeof args.cwd === "string" ? args.cwd : DEFAULT_CWD;
         await ensureReady(cwd);
-        const out = (await lensDiagnosticsTool.execute("mcp", args, new AbortController().signal, undefined, { cwd }));
+        const out = (await lensDiagnosticsTool.execute("mcp", args, new AbortController().signal, undefined, 
+        // #2535: the shared tool renders host-callable advisory names.
+        { cwd, host: "mcp" }));
         return out;
     }
     if (name === "pilens_latency") {

package/node_modules/pi-lens/dist/tools/lens-diagnostic-mark.js

@@ -46,6 +46,7 @@ import { Type } from "../clients/deps/typebox.js";
 import { markDisposition, normalizeMessage, } from "../clients/diagnostic-dispositions.js";
 import { insertSuppressComment } from "../clients/dispatch/suppress-writer.js";
 import { getFileDiagnostics, } from "../clients/widget-state.js";
+import { resolveLensToolName } from "../clients/tool-config.js";
 const DISPOSITIONS = [
     "false-positive",
     "suppress",
@@ -179,7 +180,12 @@ getIdentity) {
         name: "lens_diagnostic_mark",
         label: "Mark Diagnostic",
         description: "Record a disposition for a diagnostic. Exact reported identity is required; suppress re-anchors against live diagnostics and writes an inline ignore comment, apply multiple suppressions bottom-up, and defer is session-only. Example: mark a false positive with its reported file, line, rule, and message.",
-        promptSnippet: "Use lens_diagnostic_mark to dismiss a false-positive, suppress a won't-fix, defer, or flag a finding to fix later",
+        // #2535 F3: this snippet registers on pi only (`lens_diagnostic_mark`
+        // is declared pi-only in PI_ONLY_TOOL_REASONS — MCP has no such
+        // tool), so the host is pinned, not defaulted. The fallback restates
+        // the same pi canonical and can only fire if the registry regresses,
+        // which the adapter-aware guard reds on first.
+        promptSnippet: `Use ${resolveLensToolName("lens_diagnostic_mark", "pi") ?? "lens_diagnostic_mark"} to dismiss a false-positive, suppress a won't-fix, defer, or flag a finding to fix later`,
         parameters: Type.Object({
             filePath: Type.String({
                 description: "The file the diagnostic was reported on (relative or absolute).",

package/node_modules/pi-lens/dist/tools/lens-diagnostics.js

@@ -16,16 +16,15 @@ import { Type } from "../clients/deps/typebox.js";
 import { anchorsForDiagnostic, applyDispositions, applyWeakDispositions, hasAnyDispositionMarks, hasStrictDispositionMarks, getDisposition, } from "../clients/diagnostic-dispositions.js";
 import { DEPENDENCY_DRIFT_MAX_DELIVERIES } from "../clients/blocker-freshness.js";
 import { freshnessFromMtime } from "../clients/freshness.js";
-import { applyInlineSuppressions } from "../clients/dispatch/inline-suppressions.js";
+import { applyFindingPolicy, loadProjectRulePolicyMap, } from "../clients/dispatch/finding-policy.js";
 import { gateFindingsByPathFreshness } from "../clients/advisory-provenance.js";
 import { markUnreconciledFindings } from "../clients/finding-delivery-gate.js";
 import { normalizeRuleId } from "../clients/dispatch/rule-id-normalize.js";
-import { applyRulePolicy, rulePolicyMapFromConfig, } from "../clients/dispatch/rule-policy.js";
-import { loadPiLensProjectConfig } from "../clients/project-lens-config.js";
+import { applyRulePolicy, } from "../clients/dispatch/rule-policy.js";
 import { compactRenderResult } from "./render-compact.js";
 import { combineAbortSignals } from "../clients/deadline-utils.js";
 import { getProjectIgnoreMatcher } from "../clients/file-utils.js";
-import { isAtOrAboveHomeDir, normalizeEphemeralMapKey, normalizeFilePath, } from "../clients/path-utils.js";
+import { isAtOrAboveHomeDir, normalizeEphemeralMapKey, normalizeFilePath, realpathOrResolve, } from "../clients/path-utils.js";
 import { getLSPService } from "../clients/lsp/index.js";
 import { retireInlineBlockerAndResyncGuard } from "../clients/git-guard.js";
 import { primaryServerId, resolveLspCwdForFile, } from "../clients/lsp/config.js";
@@ -36,14 +35,15 @@ import { loadProjectDiagnosticsDeltaReport, loadProjectDiagnosticsSnapshot, PROJ
 import { formatCacheAgeOld, formatNotRunEntry, } from "../clients/project-diagnostics/extractors.js";
 import { ANALYZER_IDS, fetchFreshProjectDiagnostics, } from "../clients/project-diagnostics/fresh-fetch.js";
 import { loadBootstrapClients } from "../clients/bootstrap.js";
+import { resolveLensToolName, } from "../clients/tool-config.js";
 import { generatedSkipNotice, scanTruncationNotice, } from "../clients/lens-engine.js";
 import { scanProjectDiagnostics } from "../clients/project-diagnostics/scanner.js";
 import { classifyDiagnosticTier, getFileDiagnosticSummaries, reconcileCorrelatedScanDiagnostics, reconcileScanDiagnostics, reconcileStaleWidgetDependencyBlockers, reconcileStaleWidgetFiles, widgetDiagnosticUri, } from "../clients/widget-state.js";
-import { logLatency } from "../clients/latency-logger.js";
+import { claimPhaseOncePerSession, logLatency, } from "../clients/latency-logger.js";
 import { logExtension } from "../clients/extension-log.js";
 import { recordDegradationOnce } from "../clients/degradation-ledger.js";
 import { convertLspDiagnostics } from "../clients/dispatch/utils/lsp-diagnostics.js";
-import { retagAuxiliaryDiagnostics } from "../clients/dispatch/auxiliary-lsp.js";
+import { findAuxiliaryProfileForSource, retagAuxiliaryDiagnostics, } from "../clients/dispatch/auxiliary-lsp.js";
 import { detectFileRole } from "../clients/file-role.js";
 import { STALE_LINE_MARKER } from "../clients/stale-marker.js";
 import { makeProgressReporter, scanningSummaryLine } from "./scan-progress.js";
@@ -63,9 +63,13 @@ const MAX_PATHS_ENTRIES = MAX_BATCH_FILES;
 // trivy, govulncheck, dead-code, knip, jscpd, madge, opengrep, test-runner)
 // when mode=full is called without refreshRunners=cheap/all/cached — the
 // "quick mode" gate that skips the expensive fresh-fetch entirely (see
-// `formatFullMode`'s `analyzersPromise`). One shared string so it renders
-// identically everywhere it's used.
-const NOT_REQUESTED_REASON = "refreshRunners not requested this call (quick mode) — pass refreshRunners=cheap/all/cached to lens_diagnostics mode=full to run it";
+// `formatFullMode`'s `analyzersPromise`). One shared function so it renders
+// identically everywhere it's used, naming the tool THIS host can call
+// (#2535 F1 — the shared const named the pi tool on MCP too).
+function notRequestedReason(host) {
+    return ("refreshRunners not requested this call (quick mode) — pass " +
+        `refreshRunners=cheap/all/cached to ${resolveLensToolName("lens_diagnostics", host) ?? "diagnostics"} mode=full to run it`);
+}
 // Wall-clock ceiling for the whole mode=full scan. Even with per-file budgets
 // and abort-signal honoring, a pathological state (a language server hanging on
 // spawn/initialize across many files) could otherwise stall the tool
@@ -314,6 +318,9 @@ captureLspStatusRepaint, getRuntime, isLensGuardEnabled = () => true) {
             includeGenerated: Type.Optional(Type.Boolean({
                 description: "Include generated-name paths in full scans.",
             })),
+            analysisRoot: Type.Optional(Type.String({
+                description: "Explicit project directory for heavyweight analyzers; it must exist and resolve strictly below the home directory.",
+            })),
             severity: Type.Optional(Type.String({
                 enum: [...LSP_SEVERITY_FILTERS],
                 description: "Filter by severity threshold (default: all): error shows errors; warning includes errors and warnings; information includes errors, warnings, and information; hint and all show every known tier.",
@@ -464,6 +471,10 @@ captureLspStatusRepaint, getRuntime, isLensGuardEnabled = () => true) {
                     pathsScope,
                     nextWriteIndex,
                     runtime: getRuntime?.(),
+                    analysisRoot: typeof params.analysisRoot === "string"
+                        ? params.analysisRoot
+                        : undefined,
+                    host: ctx.host ?? "pi",
                 });
             }
             return formatDeltaMode(cacheManager, cwd, severity, pathsScope);
@@ -643,17 +654,6 @@ function filterDeltaReportDispositions(report, cwd, policyMap) {
         return report;
     return { ...report, diagnostics: policyKept };
 }
-/**
- * Load the rule-policy map from a project's `.pi-lens.json` — same source the
- * per-edit dispatch path uses, so a project's policy applies consistently
- * across every output surface. `loadPiLensProjectConfig` is mtime-cached, and
- * the map is filtered to entries that actually have a `disable`/`select` list
- * (thresholds are handled elsewhere), so the common case returns undefined and
- * the filter step is skipped outright.
- */
-function loadProjectRulePolicyMap(cwd) {
-    return rulePolicyMapFromConfig(loadPiLensProjectConfig(cwd).rules);
-}
 /**
  * #1634 review round: `formatDeltaMode` re-serves the `actionable-warnings`/
  * `code-quality-warnings` caches verbatim — each cited `file:line`, no
@@ -1048,7 +1048,13 @@ function lspDiagnosticToWidget(diagnostic) {
         line: diagnostic.range.start.line + 1,
         col: diagnostic.range.start.character + 1,
         rule,
-        tool: "lsp",
+        // #3041: keep auxiliary provenance. The footer-reconcile loop above already
+        // gives a swept aux finding its real tool id via `retagAuxiliaryDiagnostics`
+        // (#692); this second conversion of the SAME raw diagnostics did not, and
+        // dispositions are anchored by `tool` — so a `false-positive`/`suppress`
+        // mark recorded against the per-edit `ast-grep` finding never matched the
+        // `lsp`-labelled copy mode=full renders.
+        tool: findAuxiliaryProfileForSource(diagnostic.source)?.tool ?? "lsp",
     };
 }
 function projectDiagnosticToWidget(diagnostic, filePath) {
@@ -1085,6 +1091,30 @@ function diagnosticDedupKey(filePath, diagnostic) {
 function runnerIdOf(diagnostic) {
     return diagnostic.tool ?? diagnostic.rule?.split(":", 1)[0] ?? "";
 }
+/**
+ * The one project-runner retirement decision. Coverage is authoritative when
+ * present for the runner; the older id-only arm is used only when absent.
+ */
+export function runnerRetirementDecision(diagnostic, filePath, authoritativeRunnerIds, authoritativeCoverage) {
+    const runnerId = runnerIdOf(diagnostic);
+    const coverage = (authoritativeCoverage ?? []).filter((entry) => entry.runnerId === runnerId && entry.files.size > 0);
+    if (coverage.length === 0) {
+        return authoritativeRunnerIds?.has(runnerId) ? "retire" : "keep";
+    }
+    const realFilePath = realpathOrResolve(filePath);
+    for (const entry of coverage) {
+        const root = entry.root;
+        const relative = path.relative(root, realFilePath);
+        const underRoot = relative === "" ||
+            (!relative.startsWith("..") && !path.isAbsolute(relative));
+        if (!underRoot)
+            continue;
+        if (entry.files.has(realFilePath)) {
+            return "retire";
+        }
+    }
+    return "keep";
+}
 function summarizeDiagnostics(filePath, diagnostics, hasFinalSnapshot) {
     let blocking = 0;
     let errors = 0;
@@ -1292,7 +1322,7 @@ function mergeDiagnosticsWithWidgetSummaries(widgetSummaries, lspResults, projec
  * additive behavior (fail-open: unconfirmed/timed-out sweeps never retire
  * widget state they did not actually re-check).
  */
-authoritativeLspFiles, authoritativeRunnerIds) {
+authoritativeLspFiles, authoritativeRunnerIds, authoritativeRunnerCoverage) {
     const byFile = new Map();
     const seen = new Set();
     for (const summary of widgetSummaries) {
@@ -1307,7 +1337,7 @@ authoritativeLspFiles, authoritativeRunnerIds) {
             continue;
         const retained = summary.diagnostics ?? [];
         const diagnostics = retained
-            .filter((diagnostic) => !authoritativeRunnerIds?.has(runnerIdOf(diagnostic)))
+            .filter((diagnostic) => runnerRetirementDecision(diagnostic, filePath, authoritativeRunnerIds, authoritativeRunnerCoverage) !== "retire")
             .map((d) => ({ ...d }));
         byFile.set(filePath, 
         // #2154 v4: when the filter retires rows, the stored tallies describe
@@ -1377,17 +1407,20 @@ async function applyInlineSuppressionsToSummaries(summaries, cwd, policyMap) {
                 ? summary
                 : summarizeDiagnostics(summary.filePath, policyKept, summary.hasFinalSnapshot);
         }
-        const inlineKept = applyInlineSuppressions(summary.diagnostics, content);
-        // #690: same false-positive/suppress/defer disposition filter the
-        // per-edit dispatch path applies (dispatcher.ts) — mode=full merges in
-        // diagnostics from a fresh LSP sweep/project scan that never went
-        // through that path, so without this a disposed finding reappears here.
-        const kept = applyDispositions(inlineKept, cwd, summary.filePath, content);
-        // Project rule policy (`.pi-lens.json` `rules.<id>.disable`/`select`).
-        // Applied after inline suppression / disposition so the policy's
-        // output-only filtering affects the same surface the per-edit path
-        // produces (no double-counting, no leftover policy-rejected findings).
-        const policyKept = applyRulePolicy(kept, policyMap);
+        // #690/#3088: inline `pi-lens-ignore` → the same false-positive/
+        // suppress/defer disposition filter the per-edit dispatch path applies
+        // (dispatcher.ts) → the project's `.pi-lens.json` rule policy. mode=full
+        // merges in diagnostics from a fresh LSP sweep/project scan that never
+        // went through the dispatch path, so without this a disposed finding
+        // reappears here. #3088 folded the three calls onto the shared
+        // `applyFindingPolicy` seam, which the `source=lsp` probe lane now calls
+        // too — one stack, one order, for every model-facing surface.
+        const { kept: policyKept } = applyFindingPolicy(summary.diagnostics, {
+            cwd,
+            filePath: summary.filePath,
+            content,
+            policyMap,
+        });
         // Tag `flagged` diagnostics for the render loop (formatAllMode). Content
         // is already in hand here (unlike mode=all/delta's cache-only path), so
         // this is the one place the tag can be computed without adding I/O to
@@ -1458,9 +1491,30 @@ async function getProjectDiagnosticsSnapshotForFullMode(cwd, options) {
         // edited/deleted since the scan so a stale entry isn't replayed (#298). A
         // fresh scan (above) is current by construction and needs no reconcile.
         const cached = loadProjectDiagnosticsSnapshot(cwd);
-        return cached
-            ? reconcileProjectDiagnosticsSnapshot(cached).snapshot
-            : undefined;
+        if (!cached)
+            return undefined;
+        const reconciled = reconcileProjectDiagnosticsSnapshot(cached);
+        // #2154: what this gate DROPS was invisible — the count was computed and
+        // thrown away, so a session that silently retired another session's rows
+        // (the whole point of the content axis added this round) left no record
+        // of having done so. Bounded by construction: at most one row per
+        // mode=full call, and only when rows were actually retired — the shape
+        // `lsp_authoritative_widget_retire` uses for the sibling arm.
+        if (reconciled.staleDropped > 0) {
+            logLatency({
+                type: "phase",
+                toolName: "lens_diagnostics",
+                filePath: cwd,
+                phase: "project_snapshot_rows_retired",
+                durationMs: 0,
+                metadata: {
+                    files: reconciled.staleDropped,
+                    rows: cached.diagnostics.length - reconciled.snapshot.diagnostics.length,
+                    scannedAt: cached.scannedAt,
+                },
+            });
+        }
+        return reconciled.snapshot;
     }
     return undefined;
 }
@@ -1479,6 +1533,9 @@ async function formatFullMode(cwd, severity, lspService, cacheManager, options =
         };
     }
     const { signal, pathsScope, nextWriteIndex } = options;
+    // #2535: advisories name the delivery host's callable tools; pi callers
+    // omit host and keep the pi spelling.
+    const host = options.host ?? "pi";
     const includeFile = createScopedFileFilter(cwd, pathsScope);
     // `paths` (#461): route the active scans at exactly the requested files
     // instead of walking the whole project. Three cases:
@@ -1507,11 +1564,13 @@ async function formatFullMode(cwd, severity, lspService, cacheManager, options =
     const analyzersPromise = projectRunnersRequested
         ? loadBootstrapClients().then((clients) => fetchFreshProjectDiagnostics(cacheManager, cwd, clients, signal, {
             runtime: options.runtime,
+            analysisRoot: options.analysisRoot,
         }))
         : Promise.resolve({
             diagnostics: [],
             runners: [],
             analyzed: [],
+            authoritativeCoverage: [],
             // #1623: every heavyweight analyzer is ELIGIBLE for this project but
             // this call never asked for it (refreshRunners wasn't cheap/all/
             // cached) — the expensive fetch below deliberately never runs in
@@ -1521,7 +1580,7 @@ async function formatFullMode(cwd, severity, lspService, cacheManager, options =
             // truth for which lanes this covers — reuse it rather than
             // hand-listing ids here.
             cold: [...ANALYZER_IDS],
-            coldReasons: Object.fromEntries(ANALYZER_IDS.map((id) => [id, NOT_REQUESTED_REASON])),
+            coldReasons: Object.fromEntries(ANALYZER_IDS.map((id) => [id, notRequestedReason(host)])),
             failed: [],
             timings: {},
         });
@@ -1540,6 +1599,17 @@ async function formatFullMode(cwd, severity, lspService, cacheManager, options =
         }),
         analyzersPromise,
     ]);
+    if (extracted.analysisRootError) {
+        return {
+            content: [{ type: "text", text: extracted.analysisRootError }],
+            isError: true,
+            details: {
+                mode: "full",
+                analysisRootError: extracted.analysisRootError,
+                analysisRootValidation: extracted.analysisRootValidation,
+            },
+        };
+    }
     const aborted = signal?.aborted ?? false;
     // #1640: before ANY consumer sees them — the footer reconcile, the widget
     // merge, the rendered counts — demote TypeScript errors on files tsserver
@@ -1662,6 +1732,7 @@ async function formatFullMode(cwd, severity, lspService, cacheManager, options =
     // here; a second list of "which ids don't count" would be the mirror this
     // repo's single-source-of-truth rule forbids.
     const authoritativeRunnerIds = new Set(extracted.analyzed ?? []);
+    const authoritativeRunnerCoverage = extracted.authoritativeCoverage ?? [];
     const foldedProjectSnapshot = foldExtraDiagnosticsIntoSnapshot(scannedSnapshot, extracted.diagnostics.filter((d) => includeFile(d.filePath)), extracted.runners, cwd);
     const projectSnapshot = applyProjectRulePolicy(foldedProjectSnapshot, policyMap);
     const projectDelta = applyProjectRulePolicy(filterProjectDiagnosticsDeltaReport(loadProjectDiagnosticsDeltaReport(cwd), includeFile), policyMap);
@@ -1691,10 +1762,18 @@ async function formatFullMode(cwd, severity, lspService, cacheManager, options =
     // LSP sibling above — a retirement nobody can see is how a regression
     // deletes findings silently. Bounded by construction: at most one row per
     // mode=full call, and only when rows were actually retired.
+    const retiredRunnerCounts = new Map();
     const runnerRetiredRows = getFileDiagnosticSummaries()
         .filter((summary) => includeFile(summary.filePath))
         .reduce((total, summary) => total +
-        (summary.diagnostics ?? []).filter((diagnostic) => authoritativeRunnerIds.has(runnerIdOf(diagnostic))).length, 0);
+        (summary.diagnostics ?? []).filter((diagnostic) => {
+            const retired = runnerRetirementDecision(diagnostic, summary.filePath, authoritativeRunnerIds, authoritativeRunnerCoverage) === "retire";
+            if (retired) {
+                const runnerId = runnerIdOf(diagnostic);
+                retiredRunnerCounts.set(runnerId, (retiredRunnerCounts.get(runnerId) ?? 0) + 1);
+            }
+            return retired;
+        }).length, 0);
     if (runnerRetiredRows > 0) {
         logLatency({
             type: "phase",
@@ -1703,11 +1782,31 @@ async function formatFullMode(cwd, severity, lspService, cacheManager, options =
             durationMs: 0,
             metadata: {
                 rows: runnerRetiredRows,
-                runners: [...authoritativeRunnerIds].join(","),
+                runners: [...retiredRunnerCounts.keys()].join(","),
+                coverage: authoritativeRunnerCoverage.map((entry) => ({
+                    runnerId: entry.runnerId,
+                    root: entry.root,
+                    files: entry.files.size,
+                })),
+            },
+        });
+    }
+    for (const entry of authoritativeRunnerCoverage) {
+        if (!claimPhaseOncePerSession("runner_coverage_retired", entry.runnerId)) {
+            continue;
+        }
+        logLatency({
+            type: "phase",
+            phase: "runner_coverage_retired",
+            filePath: "",
+            durationMs: 0,
+            metadata: {
+                runnerId: entry.runnerId,
+                count: retiredRunnerCounts.get(entry.runnerId) ?? 0,
             },
         });
     }
-    let summaries = await applyInlineSuppressionsToSummaries(mergeDiagnosticsWithWidgetSummaries(getFileDiagnosticSummaries().filter((summary) => includeFile(summary.filePath)), confirmedLspResults, projectSnapshot, projectDelta, authoritativeLspFiles, authoritativeRunnerIds), cwd, policyMap);
+    let summaries = await applyInlineSuppressionsToSummaries(mergeDiagnosticsWithWidgetSummaries(getFileDiagnosticSummaries().filter((summary) => includeFile(summary.filePath)), confirmedLspResults, projectSnapshot, projectDelta, authoritativeLspFiles, authoritativeRunnerIds, authoritativeRunnerCoverage), cwd, policyMap);
     if (unreconciledFiles.size > 0) {
         summaries = summaries.map((summary) => unreconciledFiles.has(path.resolve(summary.filePath))
             ? summarizeDiagnostics(summary.filePath, markUnreconciledFindings(summary.diagnostics), summary.hasFinalSnapshot)
@@ -1831,6 +1930,7 @@ async function formatFullMode(cwd, severity, lspService, cacheManager, options =
     // isn't (a re-run may well complete for that analyzer).
     const abortedIds = new Set(extracted.abortedIds ?? []);
     const genuinelyColdIds = extracted.cold.filter((id) => !abortedIds.has(id));
+    const partialIds = extracted.partial ?? [];
     // #747: an unsafe analysis root (cwd at/above $HOME) skips ALL heavyweight
     // analyzers before anything spawns — rendering that as the per-analyzer
     // "not applicable / unavailable" list would send the caller chasing seven
@@ -1842,7 +1942,7 @@ async function formatFullMode(cwd, severity, lspService, cacheManager, options =
     // shape). Single formatter (extractors.ts) so this note's wording can't
     // drift from any other caller that renders the same `cold` list.
     // #1623 fix-round F5: the "not requested" (quick-mode) batch shares ONE
-    // reason (`NOT_REQUESTED_REASON`) across every id — `formatNotRunEntry`
+    // reason (`notRequestedReason`) across every id — `formatNotRunEntry`
     // repeating that same ~130-char sentence per id makes the note nearly
     // unreadable, and the "not applicable / unavailable this run" header
     // below is a dishonest label for it: these lanes ARE applicable and
@@ -1852,14 +1952,21 @@ async function formatFullMode(cwd, severity, lspService, cacheManager, options =
     // id's reason really does differ (not a git repo vs binary unavailable
     // vs retry cooldown, ...).
     const coldNote = extracted.unsafeRoot
-        ? `\n\nheavyweight analyzers skipped: the working directory resolves at or above the home directory, so a fresh knip/jscpd/madge/gitleaks/govulncheck/trivy/dead-code scan would walk every unrelated tree under it. Re-run from inside a project directory. Absence of their findings is NOT a clean verdict.`
-        : !projectRunnersRequested && genuinelyColdIds.length > 0
-            ? `\n\nnot run this call (quick mode): ${genuinelyColdIds.join(", ")}. ${NOT_REQUESTED_REASON}. Absence of their findings is NOT a clean verdict.`
-            : genuinelyColdIds.length > 0
-                ? `\n\ncold (not applicable / unavailable this run): ${genuinelyColdIds
-                    .map((id) => formatNotRunEntry(id, extracted.coldReasons))
-                    .join(", ")}. These analyzers have not contributed to this result — absence of their findings is NOT a clean verdict.`
-                : "";
+        ? `\n\nheavyweight analyzers skipped: the analysis root resolves at or above the home directory, so a fresh knip/jscpd/madge/gitleaks/govulncheck/trivy/dead-code scan would walk every unrelated tree under it. Supply a project directory below the home ceiling. Absence of their findings is NOT a clean verdict.`
+        : extracted.analysisRootError
+            ? `\n\nheavyweight analyzers skipped: ${extracted.analysisRootError}. Supply an existing project directory below the home ceiling. Absence of their findings is NOT a clean verdict.`
+            : !projectRunnersRequested && genuinelyColdIds.length > 0
+                ? `\n\nnot run this call (quick mode): ${genuinelyColdIds.join(", ")}. ${notRequestedReason(host)}. Absence of their findings is NOT a clean verdict.`
+                : genuinelyColdIds.length > 0
+                    ? `\n\ncold (not applicable / unavailable this run): ${genuinelyColdIds
+                        .map((id) => formatNotRunEntry(id, extracted.coldReasons))
+                        .join(", ")}. These analyzers have not contributed to this result — absence of their findings is NOT a clean verdict.`
+                    : "";
+    const partialNote = partialIds.length > 0
+        ? `\n\n⚠ partial coverage (findings included): ${partialIds
+            .map((id) => `${id} — ${extracted.partialReasons?.[id] ?? "coverage is incomplete"}`)
+            .join(", ")}. Coverage is incomplete, so absence of findings is NOT a clean verdict.`
+        : "";
     // #1004: unlike every other analyzer above (knip/jscpd/madge/gitleaks/
     // govulncheck/opengrep/trivy/dead-code all run a FRESH whole-project scan
     // per the fresh-fetch.ts header, so "clean" there really does mean "the
@@ -1923,7 +2030,7 @@ async function formatFullMode(cwd, severity, lspService, cacheManager, options =
     // #1107 phase 2: same "reached the seam, nothing rendered it" gap as #784
     // above, for the generated-name/dir skip counters.
     const generatedSkipNoticeText = projectSnapshot
-        ? generatedSkipNotice(projectSnapshot)
+        ? generatedSkipNotice(projectSnapshot, host)
         : undefined;
     const generatedSkipNote = generatedSkipNoticeText
         ? `\n\n${generatedSkipNoticeText}`
@@ -1944,7 +2051,7 @@ async function formatFullMode(cwd, severity, lspService, cacheManager, options =
         ? Date.parse(rawProjectSnapshot.scannedAt)
         : undefined;
     const cheapScanStatusNote = !projectRunnersRequested
-        ? `\n\ncheap project scan (tree-sitter/fact-rules/ast-grep): not run this call (${NOT_REQUESTED_REASON}).`
+        ? `\n\ncheap project scan (tree-sitter/fact-rules/ast-grep): not run this call (${notRequestedReason(host)}).`
         : options.refreshRunners === "cached"
             ? cheapScanScannedAtMs !== undefined &&
                 Number.isFinite(cheapScanScannedAtMs)
@@ -1989,6 +2096,7 @@ async function formatFullMode(cwd, severity, lspService, cacheManager, options =
         details: {
             ...result.details,
             coldRunners: extracted.cold,
+            partialRunners: partialIds,
             // #1623: the specific reason each cold id was skipped (single source
             // of truth: extractors.ts's `formatNotRunEntry` renders the same map
             // into the text note above) — lets a caller check WHY without parsing
@@ -2007,7 +2115,11 @@ async function formatFullMode(cwd, severity, lspService, cacheManager, options =
             // #747: true when the fresh fetch refused an at-or-above-$HOME root —
             // lets a caller distinguish "skipped for safety" from per-analyzer
             // cold reasons without parsing the text note.
-            analyzersUnsafeRoot: extracted.unsafeRoot ?? false,
+            // This is the fetch seam's explicit-root policy. The cwd walk below is
+            // intentionally separate: it answers a different root question.
+            analyzersUnsafeRoot: extracted.analysisRootValidation?.state === "unsafe" ||
+                extracted.unsafeRoot === true,
+            analysisRootValidation: extracted.analysisRootValidation,
             // #747: true when the cwd resolved at/above $HOME so the cheap project
             // scan and the LSP workspace sweep both refused to walk — lets a caller
             // distinguish "walked nothing for safety" from a genuinely clean sweep.
@@ -2067,6 +2179,7 @@ async function formatFullMode(cwd, severity, lspService, cacheManager, options =
                         unconfirmedLspNote +
                         auxiliaryCoverageNote +
                         lspPrimaryVsAuxiliaryNote +
+                        partialNote +
                         coldNote +
                         testRunnerEditScopedNote +
                         failedNote +
@@ -2086,6 +2199,7 @@ async function formatFullMode(cwd, severity, lspService, cacheManager, options =
     }
     if (missingNote ||
         coldNote ||
+        partialNote ||
         testRunnerEditScopedNote ||
         failedNote ||
         dispositionSuppressedNote ||
@@ -2107,6 +2221,7 @@ async function formatFullMode(cwd, severity, lspService, cacheManager, options =
                         unconfirmedLspNote +
                         auxiliaryCoverageNote +
                         lspPrimaryVsAuxiliaryNote +
+                        partialNote +
                         coldNote +
                         testRunnerEditScopedNote +
                         failedNote +