@herbertgao/pi-extensions 2026.9.6 → 2026.9.7

package/node_modules/pi-lens/dist/clients/cascade-format.js

@@ -1,3 +1,8 @@
+import * as fs from "node:fs";
+import { retagAuxiliaryDiagnostics } from "./dispatch/auxiliary-lsp.js";
+import { applyFindingPolicy, loadProjectRulePolicyMap, renderedRuleIdentities, } from "./dispatch/finding-policy.js";
+import { detectFileRole } from "./file-role.js";
+import { logLatency } from "./latency-logger.js";
 import { convertLspDiagnostics } from "./dispatch/utils/lsp-diagnostics.js";
 import { toRunnerDisplayPath } from "./dispatch/runner-context.js";
 export function formatCascadeNeighborDiagnostics(cwd, neighbors, options = {}) {
@@ -60,20 +65,64 @@ export function formatCascadeNeighborDiagnostics(cwd, neighbors, options = {}) {
  * Lives here rather than inline in the quiet-window callback so the delivery
  * path (reconcile → run → turn_end) is testable end to end; index.ts only wires
  * it to `runtime.appendCascadeRun`.
+ *
+ * #3102: the survivors are what the agent READS, so they go through the same
+ * `clients/dispatch/finding-policy.ts` stack — inline `pi-lens-ignore` → stored
+ * dispositions → the project's `.pi-lens.json` rule policy — that the per-edit
+ * dispatcher, `mode=full` and the `source=lsp` probe lane apply. Without it a
+ * cold-neighbour ERROR the agent already marked `false-positive` came back on
+ * every quiet-window reconcile.
  */
 export function buildResolvedFoundCascadeRun(cwd, neighbor) {
     const { filePath } = neighbor;
-    const diagnostics = convertLspDiagnostics(neighbor.diagnostics.filter((d) => d.severity === 1), filePath, { tool: "lsp" });
-    if (diagnostics.length === 0)
+    const errors = neighbor.diagnostics.filter((d) => d.severity === 1);
+    if (errors.length === 0)
         return undefined;
+    const policyStart = Date.now();
+    // This lane's roots are one and the same: index.ts hands `runtime.projectRoot`
+    // in as `cwd`, so the retag's config lookup and the disposition/rule-policy
+    // store read the same directory. The in-lane cascade's do NOT — see
+    // `applyCascadeDisplayPolicy`.
+    const { diagnostics, suppressed, auxSuppressed, total } = applyCascadeDisplayPolicy(errors, {
+        cwd,
+        policyRoot: cwd,
+        filePath,
+    });
+    // One bounded record per RUN, never one per finding (AGENTS.md "bounded
+    // observability"). This is a PUSH surface: silence after a mark is the mark
+    // working, not a clean verdict, so the count is recorded here rather than
+    // re-announced to the agent on every reconcile. `durationMs` covers the
+    // content read too — the latency this fold added to the quiet-window
+    // callback, measurable in the same per-phase record as every other cost.
+    recordCascadeFindingPolicy({
+        filePath,
+        durationMs: Date.now() - policyStart,
+        suppressed,
+        total,
+        auxSuppressed,
+    });
+    // No zero-length early return here: `formatCascadeNeighborDiagnostics`
+    // renders "" for a neighbour with no diagnostics and the `!formatted` guard
+    // below already returns `undefined` for it — a second check was mutation-
+    // inert (M7: deleting it left all 7 cascade cases green).
     const neighbors = [
         { filePath, reason: "references", diagnostics, lspTouched: true },
     ];
-    const formatted = formatCascadeNeighborDiagnostics(cwd, neighbors, {
+    const rendered = formatCascadeNeighborDiagnostics(cwd, neighbors, {
         noun: "cold neighbor",
     });
-    if (!formatted)
+    if (!rendered)
         return undefined;
+    // #1616 / #3102 AC 4, round 2 F2: a delivery that still has something to say
+    // states what it dropped, once per delivery — the same sentence the
+    // late-auxiliary advisory renders (`clients/runtime-turn.ts`). Policy drops
+    // only: an aux drop is the file's own suppression comment, which the
+    // per-edit dispatch path honours silently too, and it stays in the record
+    // above. A delivery with NOTHING left says nothing at all — silence on a
+    // push surface is not a claim that the neighbour is clean.
+    const formatted = suppressed > 0
+        ? `${rendered}\nsuppressed by disposition: ${suppressed} finding(s) (marked false-positive or won't-fix).`
+        : rendered;
     return {
         filePath,
         result: {
@@ -93,3 +142,150 @@ export function buildResolvedFoundCascadeRun(cwd, neighbor) {
         diagnosticCount: diagnostics.length,
     };
 }
+/**
+ * The ONE convert → retag → `applyFindingPolicy` derivation every cascade
+ * DISPLAY lane runs before its diagnostics reach the agent (#3102/#3157).
+ *
+ * Five lanes render `CascadeNeighborResult.diagnostics` through
+ * `formatCascadeNeighborDiagnostics`: the quiet-window builder above, and the
+ * four in-lane sites in `clients/dispatch/integration.ts` (passive cold
+ * snapshot, fresh touch, touch-error fallback, degraded fallback). Each one
+ * used to open-code `convertLspDiagnostics(...)` and render the result raw, so
+ * a neighbour ERROR the agent had marked `false-positive` was hidden by
+ * `mode=delta`/`mode=full`/the per-edit dispatcher/the probe lane and STILL
+ * re-reported by the cascade block on every edit that cascaded to it (#3157).
+ *
+ * TWO ROOTS, deliberately separate (the #1030 rule):
+ *  - `cwd` is the LANGUAGE root, and only `retagAuxiliaryDiagnostics` sees it
+ *    — `profile.allowBlocking(cwd)` looks for a local opengrep/zizmor/typos
+ *    config, exactly as the per-edit runner (`runners/lsp.ts`) passes
+ *    `ctx.cwd`.
+ *  - `policyRoot` is the PROJECT root, and the disposition store and the
+ *    `.pi-lens.json` rule map are read from it — `lens_diagnostic_mark` writes
+ *    under `runtime.projectRoot` (`index.ts`), so reading from a nested
+ *    language root in a monorepo opens a different
+ *    `diagnostic-dispositions.json` and silently no-ops every mark. This is
+ *    what `dispatcher.ts` already does with `ctx.projectRoot ?? ctx.cwd`.
+ *
+ * The auxiliary drop set (native `# nosemgrep`-style comments, `skipTestFiles`)
+ * is KEPT: every caller's diagnostics come straight off a client cache or a
+ * `touchFile` result, so nothing upstream ran `applyAuxiliarySuppressions`
+ * (only the `mode=full` workspace sweep does, `clients/lsp/index.ts`) and this
+ * is the FIRST application, not a double-apply — which is why the probe lane
+ * ignores it and these lanes do not.
+ *
+ * No `range.start.line` pre-partition here, unlike the late-auxiliary drain,
+ * whose own comment gives the alignment reason (`clients/runtime-turn.ts`,
+ * above its `anchored` filter): `convertLspDiagnostics` drops line-less
+ * entries, which would break the 1:1 index pairing `retagAuxiliaryDiagnostics`
+ * needs. That reason holds here too — it is simply already satisfied. Every
+ * caller reads the same `client.getAllDiagnostics()` / `touchFile` map, whose
+ * `mergeDiagnosticLists` (`clients/lsp/client.ts`) dereferences
+ * `diagnostic.range.start.line` unguarded, so a line-less entry throws long
+ * before any builder sees it and `converted` is always 1:1 with `errors`.
+ *
+ * Reads nothing when there is nothing to render, and never logs: the RECORD is
+ * the caller's decision, because the in-lane lane walks up to
+ * `CASCADE_NEIGHBOUR_BUDGET` neighbours per edit and must aggregate one row per
+ * run rather than one per neighbour.
+ */
+export function applyCascadeDisplayPolicy(
+/** ERROR-severity raw diagnostics, already capped by the caller's own
+ * display cap (`MAX_PER_FILE` in-lane; uncapped for the single-neighbour
+ * quiet-window run). */
+errors, options) {
+    if (errors.length === 0) {
+        return { diagnostics: [], suppressed: 0, auxSuppressed: 0, total: 0 };
+    }
+    const { cwd, policyRoot, filePath } = options;
+    // `undefined` → the fail-open empty string: inline suppression becomes a
+    // no-op and a STRICT `false-positive` anchor hashes an empty line, so a
+    // finding is never hidden by an I/O error (AGENTS.md shape 48).
+    const content = options.content ?? readNeighborContent(filePath);
+    const converted = convertLspDiagnostics(errors, filePath);
+    // #692/#3046: identity comes from the ONE shared derivation every other
+    // surface anchors a mark against — never a hardcoded `tool: "lsp"`.
+    const retained = retagAuxiliaryDiagnostics(converted, errors, content ?? "", {
+        cwd,
+        fileRole: detectFileRole(filePath, content),
+    });
+    const { kept } = applyFindingPolicy(retained, {
+        cwd: policyRoot,
+        filePath,
+        content: content ?? "",
+        policyMap: loadProjectRulePolicyMap(policyRoot),
+        identities: renderedRuleIdentities,
+    });
+    return {
+        diagnostics: options.displayCap === undefined
+            ? kept
+            : kept.slice(0, options.displayCap),
+        // Policy drops only, DISJOINT from `auxSuppressed` — the same split the
+        // `late_auxiliary_findings` record uses, so one operator reading both
+        // records does not have to know that one nests and the other does not.
+        suppressed: retained.length - kept.length,
+        auxSuppressed: converted.length - retained.length,
+        total: converted.length,
+    };
+}
+/**
+ * The ONE `cascade_finding_policy` row both cascade display lanes write.
+ *
+ * Gated on EITHER counter (#3102 round 2, F1): gating on the policy count alone
+ * made an aux-only drop — an ERROR master rendered, removed by the profile's own
+ * `# nosemgrep` / `skipTestFiles` rule — vanish with no row at all, the
+ * silent-drop shape this record exists to prevent (AGENTS.md shape 10). The
+ * `late_auxiliary_findings` twin reports both counters every drain.
+ */
+export function recordCascadeFindingPolicy(entry) {
+    const inputTruncated = entry.inputTruncated ?? 0;
+    if (entry.suppressed === 0 &&
+        entry.auxSuppressed === 0 &&
+        inputTruncated === 0)
+        return;
+    logLatency({
+        type: "phase",
+        toolName: "cascade",
+        filePath: entry.filePath,
+        phase: "cascade_finding_policy",
+        durationMs: entry.durationMs,
+        metadata: {
+            suppressed: entry.suppressed,
+            total: entry.total,
+            auxSuppressed: entry.auxSuppressed,
+            ...(inputTruncated > 0 && { inputTruncated }),
+        },
+    });
+}
+/**
+ * The neighbour's current bytes, for the two content-bound halves of the
+ * policy stack (inline `pi-lens-ignore` and the STRICT `false-positive`
+ * anchor). One synchronous read, paid only once a neighbour actually has ERROR
+ * diagnostics to render — the same read `mode=full` pays per flagged file and
+ * the probe lane pays per cache replay.
+ *
+ * SYNC here, while the in-lane cascade's own neighbour read at
+ * `clients/dispatch/integration.ts` (the active touch, under its "A6: async
+ * read to avoid blocking event loop on network-mounted drives" comment) is
+ * ASYNC. The asymmetry is deliberate and measured, not an oversight: that read
+ * happens for EVERY actively-touched neighbour in a parallel fan-out, while
+ * this one is paid at most once per DELIVERING neighbour — 0.0125 ms per
+ * neighbour measured on 40 real 15.6 KiB sources (#3157 AC 3), on loops that
+ * already do synchronous fs work (`nodeFs.existsSync` in the degraded
+ * fallback, and the `boundToCurrentDisk` verify whenever the producer attached
+ * a content hash and its (path, mtime, size) memo misses —
+ * `clients/lsp/diagnostic-binding.ts`). An async read here would force the
+ * quiet-window builder's synchronous callback to become async for no
+ * measurable gain.
+ *
+ * `undefined` on any failure: the caller degrades to the content-free half
+ * rather than hiding a finding it could not identify.
+ */
+function readNeighborContent(filePath) {
+    try {
+        return fs.readFileSync(filePath, "utf-8");
+    }
+    catch {
+        return undefined;
+    }
+}

package/node_modules/pi-lens/dist/clients/code-quality-warnings.js

@@ -4,6 +4,7 @@ import { toRunnerDisplayPath } from "./dispatch/runner-context.js";
 import { displayProjectDataPath, getProjectDataDir } from "./file-utils.js";
 import { normalizeMessage, stableFindingId } from "./finding-identity.js";
 import { normalizeMapKey } from "./path-utils.js";
+import { resolveLensToolName } from "./tool-config.js";
 /**
  * Report-budget precedence (#1777). A hint is an opinion; a warning is a
  * finding. When the report is capped, warnings must be spent first, or an
@@ -239,7 +240,7 @@ export function appendCodeQualityWarningsHistory(cwd, report) {
  * {@link formatActionableWarningsAdvisory} (#2521): this advisory carried the
  * identical hardcoded-legacy-path defect, one cache key over.
  */
-export function formatCodeQualityWarningsAdvisory(report, cwd) {
+export function formatCodeQualityWarningsAdvisory(report, cwd, host = "pi") {
     if (report.summary.warnings === 0)
         return undefined;
     const topRules = report.summary.topRules
@@ -261,6 +262,9 @@ export function formatCodeQualityWarningsAdvisory(report, cwd) {
             .filter(Boolean)
             .join(", ")
         : "";
+    // #2535 F3: a known tool with no mapping on this host resolves to
+    // undefined — omit the instruction rather than naming a dead tool.
+    const diagnosticsTool = resolveLensToolName("lens_diagnostics", host);
     return [
         `Code-quality warnings introduced/touched this turn: ${report.summary.warnings} across ${report.summary.files} file(s).`,
         tiers
@@ -269,7 +273,11 @@ export function formatCodeQualityWarningsAdvisory(report, cwd) {
         topRules ? `Top rules: ${topRules}` : undefined,
         // #2521: tool route first (`mode=delta` covers the code-quality cache
         // as well as the actionable one), resolved path second.
-        "Use lens_diagnostics with mode=delta to inspect these warnings.",
+        // #2535 F3: omit when unmapped on this host, never name a dead tool
+        // (pinned available on both hosts; defensive only).
+        diagnosticsTool
+            ? `Use ${diagnosticsTool} with mode=delta to inspect these warnings.`
+            : undefined,
         "No action required unless you are already refactoring these areas.",
         `Raw report (only if you need the JSON): ${displayProjectDataPath(cwd, "cache", "code-quality-warnings.json")}`,
     ]

package/node_modules/pi-lens/dist/clients/degradation-ledger.js

@@ -2,7 +2,7 @@
 import { logExtension } from "./extension-log.js";
 import { DEGRADATION_ENTRIES_PER_KIND, LEDGER_FIELD_MAX, truncateForLedger, } from "./ledger-bounds.js";
 import { logLatency } from "./latency-logger.js";
-import { getSinkRotations, getSinkWriteFailures, resetSinkRotations, resetSinkWriteFailures, } from "./ndjson-logger.js";
+import { getSinkRotations, getSinkOptionConflicts, getSinkWriteFailures, resetSinkRotations, resetSinkWriteFailures, } from "./ndjson-logger.js";
 // #2146: pulled at READ time, never pushed. `process-singletons.ts` is a
 // dependency leaf on purpose — it cannot import this module without closing a
 // no-client-cycles cycle through instance-registry/instance-reaper — so the
@@ -233,6 +233,18 @@ export function getDegradationSummary() {
             })),
         });
     }
+    const optionConflicts = getSinkOptionConflicts();
+    if (optionConflicts.length > 0) {
+        summary.push({
+            kind: "log-sink-option-conflict",
+            count: optionConflicts.length,
+            droppedCount: 0,
+            latestReasons: optionConflicts.map((sink) => ({
+                subject: truncateForLedger(sink.file),
+                reason: truncateForLedger("shared writer rotation options differed across module graphs; first writer retained ownership"),
+            })),
+        });
+    }
     // #2146, same read-time fold: process-singleton resets live in the leaf
     // module's own bounded log. One entry per family, so this group's count is
     // the number of families this build could not adopt, never an event tally.
@@ -310,6 +322,9 @@ const INFORMATIONAL_DEGRADATION_KINDS = new Set([
     // doc comment above) and is frequent/self-healing by design — a `⚠` would
     // cry wolf on the sampler's ordinary best-effort data loss.
     "resource-sampler-scanner-escalated",
+    // #2874: a successful legacy-directory migration is an upgrade tally, not
+    // a call to action. The hash-only subject avoids exposing the project path.
+    "data_dir_migrated",
 ]);
 export function renderDegradationLines(summary = getDegradationSummary()) {
     if (!isRenderableSummary(summary))

package/node_modules/pi-lens/dist/clients/diagnostic-dispositions.js

@@ -78,6 +78,11 @@ import { lineContentHash } from "./read-guard.js";
 // below goes through `deferredKey`, which folds the resolved cwd into the Set
 // key, so the two projects can no longer collide.
 const deferredThisSession = new Set();
+let widgetDispositionReconciler = null;
+/** Register the widget's mirror of the durable disposition state. */
+export function registerWidgetDispositionReconciler(reconciler) {
+    widgetDispositionReconciler = reconciler;
+}
 function deferredKey(cwd, anchor) {
     return `${normalizeMapKey(cwd)}::${anchor}`;
 }
@@ -97,7 +102,8 @@ export const normalizeMessage = sharedNormalizeMessage;
 // case, symlink/realpath, or slash difference between the two forms silently
 // orphans the agent's own false-positive/flagged mark (a #533 dropped-signal).
 // Canonicalize BOTH inputs through `normalizeMapKey` (the SAME normalizer the
-// read side already relies on — realpathSync.native on Windows) BEFORE computing
+// read side already relies on — realpathSync.native on Windows, and on POSIX
+// too since #3098) BEFORE computing
 // the relative path, so write and read produce identical anchors regardless of
 // the form the caller held. `normalizeMapKey` is idempotent, so the already-
 // canonicalized read side is unaffected; the realpath I/O is acceptable here
@@ -357,6 +363,7 @@ function emitMarkTelemetry(cwd, target, disposition, anchor, reason, existing, i
         publishDisposition({
             cwd,
             filePath: target.filePath,
+            message: target.message,
             disposition,
             tool: target.tool,
             rule: target.rule,
@@ -390,6 +397,7 @@ export function markDisposition(cwd, target, disposition, reason, identity) {
     const existing = readState(cwd).dispositions?.[anchor];
     if (disposition === "defer") {
         deferredThisSession.add(deferredKey(cwd, anchor));
+        widgetDispositionReconciler?.(cwd, target, disposition);
         emitMarkTelemetry(cwd, target, disposition, anchor, reason, existing, identity);
         return anchor;
     }
@@ -407,6 +415,9 @@ export function markDisposition(cwd, target, disposition, reason, identity) {
         lineText,
     };
     commitDisposition(cwd, anchor, entry);
+    // The durable commit is the guard for this mirror: a failed commit must not
+    // make the in-memory widget claim that a mark exists.
+    widgetDispositionReconciler?.(cwd, target, disposition);
     emitMarkTelemetry(cwd, target, disposition, anchor, reason, existing, identity);
     return anchor;
 }

package/node_modules/pi-lens/dist/clients/dispatch/ast-grep-catalog.js

@@ -0,0 +1,65 @@
+/**
+ * The effective ast-grep rule catalog for a workspace root (#3053).
+ *
+ * Before this module, `clients/dispatch/runners/ast-grep-napi.ts` (the NAPI
+ * runner) and `clients/dispatch/rule-ignores.ts` (the LSP-seam matcher, #3041)
+ * each walked `getAstGrepRuleSources(root)` and resolved rule-id precedence
+ * independently — two implementations of the same derivation. They had
+ * already drifted once by the time #3053 was filed: #3046 round 2 found the
+ * LSP seam claiming an id only when the winning document declared `ignores`,
+ * so a project rule that redefines a bundled id with NO `ignores` fired
+ * per-edit (the runner) but stayed carved out over LSP (the seam) — the same
+ * defect the whole PR existed to remove, just inverted. This module is the
+ * one place that walk and that precedence rule now live.
+ *
+ * Precedence: sources are walked in `getAstGrepRuleSources`'s order (project
+ * primary, project secondary, bundled primary, bundled secondary), each
+ * loaded with the same loader the runner always used (`loadYamlRulesFresh`
+ * for mutable project trees, `loadYamlRules`'s mtime-cached path for
+ * immutable bundled catalogs). The FIRST rule sighted for an id — scanning
+ * sources in order, and each source's own rules in file order — claims it;
+ * no later document for the same id is ever consulted.
+ *
+ * Deliberately does NOT special-case an id that recurs WITHIN one source's
+ * own rule list. That is `duplicateRuleIds` in ast-grep-napi.ts, a
+ * runner-only concern layered on top of this catalog's plain result: the
+ * runner drops such an id entirely (one Duplicate-rule-id diagnostic, no
+ * rule fires for it), but `materializeMergedRuleDir` (clients/sgconfig.ts) —
+ * what ast-grep's own LSP binary actually runs — keeps every document an
+ * EARLIER source hasn't already claimed, so both copies of a within-source
+ * duplicate still survive into what ast-grep publishes over LSP. Baking the
+ * runner's drop into this catalog would leave those published findings with
+ * no registered `ignores` at all, silently unsuppressed — reopening #3041 for
+ * that id (#3046 round 2 F7). So the catalog resolves a within-source
+ * duplicate to its first-sighted document like any other collision, and it
+ * is each consumer's job to decide what a within-source duplicate means for
+ * it — the runner still computes `duplicateRuleIds` itself and skips those
+ * ids before ever consulting this catalog's answer for them.
+ */
+import { getAstGrepRuleSources } from "../sgconfig.js";
+import { loadYamlRules, loadYamlRulesFresh, } from "./runners/yaml-rule-parser.js";
+/**
+ * Build the effective ast-grep catalog for `root`. See the module docstring
+ * for the precedence rule and the within-source-duplicate decision.
+ *
+ * No try/catch around either loader: every I/O path inside them already
+ * swallows its own failure (missing dir, unreadable readdir, unreadable file
+ * all yield an empty list — `yaml-rule-parser.ts`'s `findYamlRuleFiles` and
+ * `loadYamlRuleFiles`), so a catch here would be a guard no mutation can red.
+ */
+export function buildEffectiveAstGrepCatalog(root) {
+    const sources = [];
+    const effectiveRules = new Map();
+    for (const source of getAstGrepRuleSources(root)) {
+        const rules = source.origin === "project"
+            ? loadYamlRulesFresh(source.dir)
+            : loadYamlRules(source.dir);
+        sources.push({ source, rules });
+        for (const rule of rules) {
+            if (effectiveRules.has(rule.id))
+                continue;
+            effectiveRules.set(rule.id, { rule, source });
+        }
+    }
+    return { sources, effectiveRules };
+}

package/node_modules/pi-lens/dist/clients/dispatch/auxiliary-lsp.js

@@ -22,6 +22,7 @@ import { findLocalOpengrepConfig } from "../opengrep-config.js";
 import { findLocalTyposConfig } from "../typos-config.js";
 import { findLocalZizmorConfig } from "../zizmor-config.js";
 import { classifyDefect } from "./diagnostic-taxonomy.js";
+import { isRuleIgnoredForPath, loadRuleIgnorePatterns, } from "./rule-ignores.js";
 /**
  * Semgrep/opengrep `# nosemgrep` / `# nosemgrep: <rule-id>[,<rule-id>]` inline
  * suppression (#441). A bare `# nosemgrep` drops every finding on its line; the
@@ -248,8 +249,22 @@ export function isAuxiliaryDiagnosticSuppressed(d, content) {
  * files that are suppressed per-edit reappeared wholesale in every
  * `mode=full` sweep. Omitting `opts` (or `opts.fileRole`) keeps every existing
  * 2-arg call site's behavior byte-for-byte unchanged.
+ *
+ * #3041: `opts.filePath` + `opts.scanRoot` additionally apply each rule's own
+ * `ignores` path carve-out (#965) — the THIRD member of the same defect class
+ * as #586 and #692 above. `ast-grep scan` applies `ignores` during its own
+ * project walk, but `ast-grep lsp` publishes per-document diagnostics WITHOUT
+ * applying them (measured against ast-grep 0.45.3), so a rule the NAPI runner
+ * correctly skips on `scripts/**` came back over LSP on every `source=lsp`
+ * query and every `mode=full` sweep. Both routes reach this function, so the
+ * carve-out belongs here rather than in either route's own output merge.
  */
 export function applyAuxiliarySuppressions(diagnostics, content, opts) {
+    // One catalog read per call, not per diagnostic. Both rule loaders behind it
+    // are cached (~0.09 ms per call on pi-lens's own catalog), so a per-file call
+    // from a sweep costs the same order as the NAPI runner's own per-file load.
+    const { filePath, scanRoot } = opts ?? {};
+    const ruleIgnores = filePath && scanRoot ? loadRuleIgnorePatterns(scanRoot) : undefined;
     return diagnostics.filter((d) => {
         if (isAuxiliaryDiagnosticSuppressed(d, content))
             return false;
@@ -258,6 +273,19 @@ export function applyAuxiliarySuppressions(diagnostics, content, opts) {
             if (profile?.skipTestFiles)
                 return false;
         }
+        // Keyed by the diagnostic's own rule id — ast-grep's LSP reports the bare
+        // catalog id as `code`. Gated on the producing tool as well: the map is
+        // built from the AST-GREP catalog, so without the gate any auxiliary whose
+        // own rule id happened to collide with a catalog id (several are generic —
+        // `no-raw-types`, `no-string-concat-in-loop`) would be silently dropped on
+        // a path an unrelated rule carved out. Losing a finding silently is the
+        // harm this whole change exists to stop, so the collision is gated, not
+        // accepted (#3041 r2 F4).
+        if (ruleIgnores !== undefined &&
+            findAuxiliaryProfileForSource(d.source)?.tool === "ast-grep" &&
+            isRuleIgnoredForPath(filePath, scanRoot, ruleIgnores.get(String(d.code)))) {
+            return false;
+        }
         return true;
     });
 }

package/node_modules/pi-lens/dist/clients/dispatch/dispatcher.js

@@ -26,7 +26,7 @@ import { getPrimaryDispatchGroup } from "../language-policy.js";
 import { resolveLanguageRootForFile } from "../language-profile.js";
 import { logLatency, phaseFinished, phaseStarted } from "../latency-logger.js";
 import { isSpawnableCommand } from "../installer/index.js";
-import { isAbsoluteFilePath, normalizeEphemeralMapKey, normalizeMapKey, } from "../path-utils.js";
+import { isAbsoluteFilePath, isWindowsPath, normalizeEphemeralMapKey, normalizeMapKey, } from "../path-utils.js";
 import { loadPiLensProjectConfig } from "../project-lens-config.js";
 import { RUNTIME_CONFIG, getRunnerTimeoutFloorMs } from "../runtime-config.js";
 import { probeToolAsync } from "../tool-probe.js";
@@ -249,7 +249,13 @@ telemetryModel, telemetryProvider) {
     const normalizedProjectRoot = normalizeMapKey(path.resolve(projectRoot ?? cwd));
     const normalizedCwd = normalizeMapKey(resolveLanguageRootForFile(absoluteFilePath, cwd));
     const normalizedFilePath = normalizeMapKey(absoluteFilePath);
-    const kind = detectFileKind(normalizedFilePath);
+    // `resolveRunnerPath` intentionally normalizes map keys, which folds a
+    // literal POSIX backslash into a separator. Preserve that one proven
+    // classifier distinction while still resolving relative inputs from `cwd`.
+    const kindFilePath = !isWindowsPath(filePath) && filePath.includes("\\")
+        ? path.resolve(cwd, filePath)
+        : absoluteFilePath;
+    const kind = detectFileKind(kindFilePath);
     const contentPrefix = readFilePrefix(normalizedFilePath);
     const fileRole = detectFileRole(normalizedFilePath, contentPrefix);
     // Captured once here so the generated short-circuit below can emit a
@@ -282,6 +288,7 @@ telemetryModel, telemetryProvider) {
         writeIndex,
         telemetryModel,
         telemetryProvider,
+        toolCwdMemo: {},
         async hasTool(command) {
             return checkToolAvailability(command, facts);
         },