@herbertgao/pi-extensions 2026.9.6 → 2026.9.7

package/node_modules/pi-lens/dist/clients/dispatch/integration.js

@@ -19,7 +19,7 @@ import * as nodeFs from "node:fs";
 import * as nodePath from "node:path";
 import { fileURLToPath } from "node:url";
 import { CASCADE_NEIGHBOUR_BUDGET, deriveCascadeNeighbourBudget, } from "../cascade-budget.js";
-import { formatCascadeNeighborDiagnostics } from "../cascade-format.js";
+import { applyCascadeDisplayPolicy, formatCascadeNeighborDiagnostics, recordCascadeFindingPolicy, } from "../cascade-format.js";
 import { logCascade } from "../cascade-logger.js";
 import { getDiagnosticTracker } from "../diagnostic-tracker.js";
 import { classifyCascadeWaitTier, isTierAwareCascadeEnabled, recordOutstandingCascadeTouch, } from "../lsp/cascade-tier.js";
@@ -434,6 +434,25 @@ function ensureCascadeTurnScope(turnSeq) {
 }
 const MAX_PER_FILE = RUNTIME_CONFIG.pipeline.cascadeMaxDiagnosticsPerFile;
 const MAX_FILES = RUNTIME_CONFIG.pipeline.cascadeMaxFiles;
+/**
+ * How many of ONE neighbour's ERRORs the display policy may look at (#3157
+ * round 2, F1). `MAX_PER_FILE` is the DISPLAY cap and now applies to the
+ * survivors, so this is the separate, deliberately generous bound on the
+ * policy's INPUT — four full display caps of headroom, so a neighbour would
+ * need 80 suppressed findings before a genuine one could fall off the end
+ * again.
+ *
+ * It exists because the policy's cost is linear in the finding count once a
+ * project has ANY disposition mark (the zero-I/O hoist in
+ * `finding-policy.ts` stops firing and every finding expands into its
+ * candidate identities): measured on 40 real neighbours, 1.31 ms/neighbour at
+ * 20 findings, 4.74 ms at 80, and 28.29 ms at 500 — that last one is 1131
+ * ms/edit across a full 40-neighbour walk, a quarter of the `cascadeSettleWaitMs`
+ * window, for a neighbour nobody can read anyway. Truncation here is COUNTED
+ * (`inputTruncated` on the `cascade_finding_policy` row), because an input
+ * bound whose loss is invisible is exactly the defect F1 found.
+ */
+const MAX_POLICY_INPUT_PER_FILE = MAX_PER_FILE * 4;
 /**
  * The genuine language-server ERROR diagnostics from a cascade neighbor
  * re-check, ready to reconcile into the footer widget (#1093).
@@ -455,8 +474,14 @@ const MAX_FILES = RUNTIME_CONFIG.pipeline.cascadeMaxFiles;
  * entries untouched. This keeps `isLspErrorEntry`'s "tool === 'lsp' uniquely
  * identifies a genuine language-server entry" contract true for what we write.
  *
- * The DISPLAY list (`diags` at each call site) is deliberately left as-is —
- * that is pre-existing cascade output behavior, out of scope for #1093.
+ * The DISPLAY list is no longer "left as-is" as it was for #1093: since #3157
+ * every display site runs `cascadeDisplay` → `applyCascadeDisplayPolicy`, which
+ * applies the finding-policy stack AND keeps the auxiliary retag's own drop set
+ * — so the display drops natively-suppressed aux findings while still RENDERING
+ * the aux findings this widget writer excludes wholesale. The two remain
+ * deliberately different: this one protects `isLspErrorEntry`'s "tool === 'lsp'"
+ * contract for PERSISTED widget state, which the ephemeral display list never
+ * touches.
  */
 function cascadeReconcilableLspErrors(rawDiags, neighborPath) {
     return convertLspDiagnostics(rawDiags
@@ -732,7 +757,7 @@ export async function computeCascadeForFile(filePath, cwd, options = {}) {
     // time that elapsed before turn_end began waiting.
     const cascadeStart = Date.now();
     try {
-        const { hasBlockers = false, dbg, turnSeq = 0, writeSeq, seqState, turnEndCascadeSettleStart, fileContent, wordIndex, onWordIndexUpdated, } = options;
+        const { hasBlockers = false, dbg, turnSeq = 0, writeSeq, projectRoot, seqState, turnEndCascadeSettleStart, fileContent, wordIndex, onWordIndexUpdated, } = options;
         ensureCascadeTurnScope(turnSeq);
         if (hasBlockers) {
             logCascade({
@@ -1311,6 +1336,64 @@ export async function computeCascadeForFile(filePath, cwd, options = {}) {
         let passiveSnapshotHits = 0;
         let noLspConfigured = 0;
         let touchFailures = 0;
+        // #3157: this run's AGGREGATE display-policy drops, across every neighbour
+        // the four display sites below rendered. Aggregate, not per neighbour: a
+        // cascade walks up to `CASCADE_NEIGHBOUR_BUDGET` (40) neighbours per edit,
+        // so a record inside the loop would be per-occurrence logging on a per-edit
+        // path — one bounded row per RUN instead (AGENTS.md "bounded observability").
+        // `policyElapsedMs` accumulates ONLY the stack's own time (round 2, F2): a
+        // clock started here would have spanned the whole `touchFile` fan-out and
+        // reported the neighbour WALK as the policy phase — hundreds of ms against
+        // the sub-millisecond cost AC 3 measured, under the same phase literal the
+        // quiet-window lane writes.
+        let policyElapsedMs = 0;
+        const policyCounts = {
+            suppressed: 0,
+            auxSuppressed: 0,
+            total: 0,
+            inputTruncated: 0,
+        };
+        /**
+         * The ONE seam every in-lane cascade DISPLAY list goes through (#3157).
+         *
+         * Before this, all four sites open-coded `convertLspDiagnostics(...)` and
+         * rendered the result raw: `grep applyFindingPolicy clients/dispatch/
+         * integration.ts` returned nothing, so a neighbour ERROR the agent had
+         * marked `false-positive` was hidden by `mode=delta`/`mode=full`/the
+         * per-edit dispatcher/the probe lane/the quiet-window cascade run and STILL
+         * re-reported here on every edit that cascaded to it. The severity filter
+         * and the `MAX_PER_FILE` display cap were the fourth copy of the same three
+         * lines and fold in with it.
+         *
+         * `neighborContent` is passed by the ONE caller that has already read the
+         * neighbour (the active touch reads it to feed `touchFile`) — those are the
+         * exact bytes the diagnostics were computed against, so it is both free and
+         * more faithful than a re-read. The other three sites let the shared helper
+         * read once, and only once a neighbour actually has an ERROR to render.
+         *
+         * Stage order (round 2, F1): severity filter → input bound → convert →
+         * retag → policy → DISPLAY cap. `MAX_PER_FILE` is applied to the survivors
+         * inside the helper; applying it here, before the policy, let policy drops
+         * consume display slots and rendered a false clean.
+         */
+        const cascadeDisplay = (rawDiags, neighborPath, neighborContent) => {
+            const started = Date.now();
+            const errors = rawDiags.filter((d) => d.severity === 1);
+            const policyInput = errors.slice(0, MAX_POLICY_INPUT_PER_FILE);
+            const result = applyCascadeDisplayPolicy(policyInput, {
+                cwd,
+                policyRoot: projectRoot ?? cwd,
+                filePath: neighborPath,
+                displayCap: MAX_PER_FILE,
+                ...(neighborContent !== undefined && { content: neighborContent }),
+            });
+            policyCounts.suppressed += result.suppressed;
+            policyCounts.auxSuppressed += result.auxSuppressed;
+            policyCounts.total += result.total;
+            policyCounts.inputTruncated += errors.length - policyInput.length;
+            policyElapsedMs += Date.now() - started;
+            return result.diagnostics;
+        };
         if (sortedNeighbors.length > 0) {
             const snapshotPaths = sortedNeighbors.filter(shouldReadCascadeFromSnapshot);
             const activePaths = sortedNeighbors.filter((n) => !shouldReadCascadeFromSnapshot(n));
@@ -1371,7 +1454,8 @@ export async function computeCascadeForFile(filePath, cwd, options = {}) {
                 // cascade neighbor diagnostics are ephemeral display-only output
                 // (never reconciled into persisted widget/dedup state), so the label
                 // had no remaining purpose and is simply dropped rather than migrated.
-                const diags = convertLspDiagnostics(entry.diags.filter((d) => d.severity === 1).slice(0, MAX_PER_FILE), neighborPath);
+                // #3157 site 1 of 4: the passive cold-snapshot hit.
+                const diags = cascadeDisplay(entry.diags, neighborPath);
                 producedLspData = true;
                 passiveSnapshotHits++;
                 const durationMs = Date.now() - neighborStart;
@@ -1623,12 +1707,12 @@ export async function computeCascadeForFile(filePath, cwd, options = {}) {
                 // doc comment on the sibling call above) — dropped rather than
                 // migrated to `scanOrigin` since cascade output never touches
                 // persisted widget/dedup state.
-                // #1179: `.filter()` here operates on `rawDiags.diags`; the
-                // `inconclusive`/`binding` flags read above stay on the `rawDiags`
-                // wrapper and are unaffected by this copy (the shape-5 fix).
-                const diags = convertLspDiagnostics(rawDiags.diags
-                    .filter((d) => d.severity === 1)
-                    .slice(0, MAX_PER_FILE), neighborPath);
+                // #1179: the severity filter inside `cascadeDisplay` operates on
+                // `rawDiags.diags`; the `inconclusive`/`binding` flags read above
+                // stay on the `rawDiags` wrapper and are unaffected (the shape-5 fix).
+                // #3157 site 2 of 4: the fresh in-lane touch. `content` is the copy
+                // this touch was computed against — no second read.
+                const diags = cascadeDisplay(rawDiags.diags, neighborPath, content);
                 const durationMs = Date.now() - neighborStart;
                 // #1899: the A5 same-write cache write stood here.
                 if (diags.length === 0) {
@@ -1755,10 +1839,10 @@ export async function computeCascadeForFile(filePath, cwd, options = {}) {
                     // #692: `source: "cascade"` dropped (see the doc comment above the
                     // first cascade call site in this file) — no longer affects `rule`
                     // and cascade output never touches persisted widget/dedup state.
+                    // #3157 site 3 of 4: the touch-error fallback. The touch failed, so
+                    // no content was read for this neighbour — the helper reads it.
                     const diags = ttlFresh && !bindingRejected
-                        ? convertLspDiagnostics(entry.diags
-                            .filter((d) => d.severity === 1)
-                            .slice(0, MAX_PER_FILE), neighborPath)
+                        ? cascadeDisplay(entry.diags, neighborPath)
                         : [];
                     neighbors.push({
                         filePath: neighborPath,
@@ -1774,12 +1858,12 @@ export async function computeCascadeForFile(filePath, cwd, options = {}) {
         // candidates that had no configured LSP may use passive fallback; broadening
         // to unrelated cache entries would make the partial active result misleading.
         if (producedLspData && noLspCandidatePaths.size > 0) {
-            const bindingRejected = appendFallbackNeighbors(neighbors, allDiags, normalizedFileKey, cwd, filePath, noLspCandidatePaths);
+            const bindingRejected = appendFallbackNeighbors(neighbors, allDiags, normalizedFileKey, cwd, filePath, cascadeDisplay, noLspCandidatePaths);
             if (bindingRejected)
                 fallbackBindingRejected = true;
         }
         else if (!producedLspData) {
-            const bindingRejected = appendFallbackNeighbors(neighbors, allDiags, normalizedFileKey, cwd, filePath);
+            const bindingRejected = appendFallbackNeighbors(neighbors, allDiags, normalizedFileKey, cwd, filePath, cascadeDisplay);
             if (bindingRejected)
                 fallbackBindingRejected = true;
             if (neighbors.some((n) => n.reason === "fallback")) {
@@ -1791,8 +1875,23 @@ export async function computeCascadeForFile(filePath, cwd, options = {}) {
                 });
             }
         }
+        // #3157: ONE row per cascade run, covering every neighbour the four display
+        // sites filtered — never one per neighbour. `durationMs` is the stack's own
+        // accumulated time (the content reads the fold added included), NOT the
+        // neighbour walk it runs inside, so this row stays comparable with the
+        // quiet-window lane's row under the same phase literal (round 2, F2).
+        // Silent when nothing was dropped or truncated; gated inside
+        // `recordCascadeFindingPolicy`.
+        recordCascadeFindingPolicy({
+            filePath,
+            durationMs: policyElapsedMs,
+            suppressed: policyCounts.suppressed,
+            total: policyCounts.total,
+            auxSuppressed: policyCounts.auxSuppressed,
+            inputTruncated: policyCounts.inputTruncated,
+        });
         const visibleNeighbors = applyCascadeDeltaBaselines(neighbors);
-        const formatted = formatCascadeResult(cwd, impact, visibleNeighbors, impact.neighborFiles.length);
+        const formatted = formatCascadeResult(cwd, impact, visibleNeighbors, impact.neighborFiles.length, policyCounts.suppressed, policyCounts.inputTruncated);
         // #1104 HONESTY: filtering a bound-false display candidate must not turn a
         // degraded/indeterminate cascade into a clean-looking one (same doctrine as
         // #1023's graph-degraded marker). If every candidate the degraded-fallback
@@ -1977,7 +2076,10 @@ function applyCascadeDeltaBaselines(neighbors) {
  * because its content binding was rejected (#1104) — the caller folds this
  * into the run-level `fallbackBindingRejected` flag for the honesty check.
  */
-function appendFallbackNeighbors(neighbors, allDiags, normalizedFileKey, cwd, filePath, allowedPaths) {
+function appendFallbackNeighbors(neighbors, allDiags, normalizedFileKey, cwd, filePath, 
+/** The run's shared display-policy seam (#3157) — see `cascadeDisplay` in
+ * `computeCascadeForFile`. */
+cascadeDisplay, allowedPaths) {
     const now = Date.now();
     const seen = new Set(neighbors.map((n) => normalizeMapKey(n.filePath)));
     let bindingRejected = false;
@@ -2022,8 +2124,10 @@ function appendFallbackNeighbors(neighbors, allDiags, normalizedFileKey, cwd, fi
             continue;
         }
         // #692: `source: "cascade"` dropped — see the doc comment above the
-        // first cascade `convertLspDiagnostics` call site in this file.
-        const errors = convertLspDiagnostics(diags.filter((d) => d.severity === 1).slice(0, MAX_PER_FILE), diagPath);
+        // first cascade display call site in this file.
+        // #3157 site 4 of 4: the degraded fallback. `cascadeDisplay` is passed in
+        // rather than re-derived so this run's aggregate drop counters see it too.
+        const errors = cascadeDisplay(diags, diagPath);
         if (errors.length === 0)
             continue;
         neighbors.push({
@@ -2048,17 +2152,36 @@ function neighborReason(importerSet, callerSet, neighborPath) {
         return "calls";
     return "references";
 }
-function formatCascadeResult(cwd, impact, neighbors, totalNeighbors) {
+function formatCascadeResult(cwd, impact, neighbors, totalNeighbors, 
+/** This run's aggregate policy-stack drops (#3157). */
+policySuppressed, 
+/**
+ * This run's aggregate `MAX_POLICY_INPUT_PER_FILE` truncation (#3157 round
+ * 3, N1) — ERRORs the policy never LOOKED at.
+ */
+policyInputTruncated) {
     const diagnosticsBlock = formatCascadeNeighborDiagnostics(cwd, neighbors, {
         noun: "neighbor",
         includeReason: true,
     });
-    if (!diagnosticsBlock)
+    // #3157 round 3, N1: an empty block is silence, and silence is a CLEAN
+    // verdict to the agent. That is honest only when everything was looked at.
+    // `policyInputTruncated > 0` means this run's own cost bound declined to
+    // evaluate findings that exist — the #1459 coverage-gap case, not a verdict —
+    // so it must speak even with nothing to render. `policySuppressed` does NOT
+    // get the same treatment on purpose: those findings WERE evaluated and every
+    // drop is the agent's own mark or its project's own rule policy, and the
+    // quiet-window lane deliberately says nothing at all for that case
+    // (`buildResolvedFoundCascadeRun` returns `undefined`). Speaking here and not
+    // there would re-open the two-lane divergence #3157 exists to close.
+    if (!diagnosticsBlock && policyInputTruncated === 0)
         return "";
     const impactHeader = formatImpactCascade(impact, RUNTIME_CONFIG.pipeline.cascadeMaxFiles);
-    let out = impactHeader
-        ? `${impactHeader}\n${diagnosticsBlock}`
-        : diagnosticsBlock;
+    let out = !diagnosticsBlock
+        ? ""
+        : impactHeader
+            ? `${impactHeader}\n${diagnosticsBlock}`
+            : diagnosticsBlock;
     // A10: include truncated filenames so agent knows which files were cut
     const truncated = totalNeighbors - neighbors.length;
     if (truncated > 0) {
@@ -2071,6 +2194,33 @@ function formatCascadeResult(cwd, impact, neighbors, totalNeighbors) {
             : `${truncated} more dependent file(s)`;
         out += `\n... and ${moreLabel}`;
     }
+    // #1616 / #3157: a delivery that still has something to say states what it
+    // dropped, once per delivery — the same sentence the quiet-window cascade run
+    // (`buildResolvedFoundCascadeRun`) and the late-auxiliary advisory render, so
+    // the two cascade lanes do not disagree about whether a mark is worth
+    // mentioning. Policy drops only: an aux drop is the file's own suppression
+    // comment, which the per-edit dispatch path honours silently too, and it stays
+    // in the `cascade_finding_policy` record. A run with NOTHING left returned ""
+    // above and says nothing at all — silence is not a claim that a neighbour is
+    // clean.
+    // #3157 round 3, N1: the same shape and the same closing clause as the
+    // "did not cover" line this file's renderer already uses for a neighbour no
+    // scanner looked at (`clients/cascade-format.ts`) — the agent must not read
+    // an empty or short block as a clean verdict when the bound cut findings
+    // nobody evaluated.
+    if (policyInputTruncated > 0) {
+        if (out)
+            out += "\n";
+        out +=
+            `⚠️ Cascade did not evaluate ${policyInputTruncated} finding(s) — the per-neighbor ` +
+                `policy input is bounded at ${MAX_POLICY_INPUT_PER_FILE}; no findings does NOT mean clean here.`;
+    }
+    // Rides along whenever anything is rendered at all: when the block is empty
+    // and the coverage line above is speaking, this is what explains WHY it is
+    // empty. The empty-and-nothing-truncated case returned above.
+    if (policySuppressed > 0) {
+        out += `\nsuppressed by disposition: ${policySuppressed} finding(s) (marked false-positive or won't-fix).`;
+    }
     return out;
 }
 /**

package/node_modules/pi-lens/dist/clients/dispatch/rule-ignores.js

@@ -0,0 +1,62 @@
+/**
+ * Per-rule path carve-outs (`ignores:` in a rule's own YAML, #965).
+ *
+ * ONE matcher, shared by every surface that decides whether a rule may fire on
+ * a path: the NAPI ast-grep runner, the tree-sitter runner (`ignore_paths`),
+ * and — since #3041 — the LSP output seam (`applyAuxiliarySuppressions`).
+ *
+ * #3041, measured against ast-grep 0.45.3: `ast-grep scan` applies a rule's
+ * `ignores` globs during its own project walk, but `ast-grep lsp` publishes
+ * per-document diagnostics WITHOUT applying them — the same rule on the same
+ * file is filtered by the CLI and unfiltered over LSP. So every pi-lens path
+ * that delivers ast-grep's LSP diagnostics has to apply the carve-out itself;
+ * the runner-side matcher below is what it applies.
+ */
+import * as path from "node:path";
+import { minimatch } from "../deps/minimatch.js";
+import { buildEffectiveAstGrepCatalog } from "./ast-grep-catalog.js";
+/**
+ * True when `filePath` is carved out of a rule by one of its glob `patterns`.
+ *
+ * The glob is matched against `filePath` relative to `root`, forward-slashed.
+ * Falls back to the absolute (slash-normalized) path when `filePath` isn't
+ * under `root` (e.g. an out-of-tree temp file), so a glob like `scripts/**`
+ * simply never matches rather than throwing.
+ */
+export function isRuleIgnoredForPath(filePath, root, patterns) {
+    if (!patterns || patterns.length === 0)
+        return false;
+    const relative = path.relative(root, filePath);
+    const displayPath = (relative.startsWith("..") ? filePath : relative)
+        .split(path.sep)
+        .join("/");
+    return patterns.some((pattern) => minimatch(displayPath, pattern, { dot: true }));
+}
+/**
+ * Rule id → its `ignores` globs, for the effective ast-grep catalog at `root`.
+ *
+ * #3053: the catalog walk and its first-source-wins precedence used to be
+ * reimplemented here; both this function and the NAPI runner now read
+ * `buildEffectiveAstGrepCatalog` (clients/dispatch/ast-grep-catalog.ts), so
+ * the LSP seam carves out exactly the paths the runner carves out by
+ * construction rather than by two hand-aligned copies — see that module's
+ * docstring for the precedence rule and the within-source-duplicate decision
+ * this function inherits from it. The catalog's own loaders are cached, so
+ * this is ~0.09 ms per call on pi-lens's own catalog (17 rules with
+ * `ignores`, measured) — cheap enough to call per file rather than thread a
+ * preloaded map through every sweep.
+ *
+ * Keyed by the EXACT rule id, matching the runner: a `-js` twin (e.g.
+ * `no-console-except-error-js`) carries its own `ignores` in its own document,
+ * so normalizing the suffix here would apply one document's carve-out to the
+ * other's findings.
+ */
+export function loadRuleIgnorePatterns(root) {
+    const patterns = new Map();
+    for (const [id, { rule }] of buildEffectiveAstGrepCatalog(root)
+        .effectiveRules) {
+        if (rule.ignores?.length)
+            patterns.set(id, rule.ignores);
+    }
+    return patterns;
+}

package/node_modules/pi-lens/dist/clients/dispatch/runners/ast-grep-napi.js

@@ -12,16 +12,16 @@ import * as fs from "node:fs";
 import * as path from "node:path";
 import { incrementDegradationCount, recordDegradationOnce, } from "../../degradation-ledger.js";
 import { loadAstGrepNapi, } from "../../deps/ast-grep-napi.js";
-import { minimatch } from "../../deps/minimatch.js";
+import { buildEffectiveAstGrepCatalog } from "../ast-grep-catalog.js";
+import { isRuleIgnoredForPath } from "../rule-ignores.js";
 import { logLatency } from "../../latency-logger.js";
 import { hasAuxiliaryLspPublishedForRoot } from "../../lsp/index.js";
 import { clearPendingAuxiliaryCoverage, hasPendingAuxiliaryCoverage, recordNapiFallbackCoverage, } from "../../lsp/pending-aux-coverage.js";
-import { getAstGrepRuleSources, } from "../../sgconfig.js";
 import { hasEslintConfig } from "../../tool-policy.js";
 import { enabledAuxiliaryLspServerIds } from "../auxiliary-lsp.js";
 import { classifyDefect } from "../diagnostic-taxonomy.js";
 import { PRIORITY } from "../priorities.js";
-import { calculateRuleComplexity, isOverlyBroadPattern, isStructuredRule, loadYamlRules, loadYamlRulesFresh, MAX_BLOCKING_RULE_COMPLEXITY, } from "./yaml-rule-parser.js";
+import { calculateRuleComplexity, isOverlyBroadPattern, isStructuredRule, MAX_BLOCKING_RULE_COMPLEXITY, } from "./yaml-rule-parser.js";
 const defaultUnsupportedLanguageLog = new Set();
 const UNSUPPORTED_RULE_ID_SAMPLE_SIZE = 5;
 /** Clear per-session unsupported-language telemetry dedupe. */
@@ -366,22 +366,6 @@ function explicitRuleFixSuggestion(rule) {
 function normalizeRuleId(ruleId) {
     return ruleId.replace(/-js$/, "");
 }
-/**
- * `filePath` relative to `root`, forward-slashed, for matching a rule's
- * `ignores` globs (#965). Falls back to the absolute (slash-normalized) path
- * when `filePath` isn't under `root` (e.g. an out-of-tree temp file), so a
- * glob like `scripts/**` simply never matches rather than throwing.
- */
-function relativeForIgnoreGlob(filePath, root) {
-    const rel = path.relative(root, filePath);
-    return (rel.startsWith("..") ? filePath : rel).split(path.sep).join("/");
-}
-function matchesRuleIgnores(filePath, root, patterns) {
-    if (!patterns || patterns.length === 0)
-        return false;
-    const rel = relativeForIgnoreGlob(filePath, root);
-    return patterns.some((pattern) => minimatch(rel, pattern, { dot: true }));
-}
 export function canHandle(filePath) {
     return BINDING_BY_EXTENSION.has(path.extname(filePath).toLowerCase());
 }
@@ -660,7 +644,7 @@ function duplicateRuleIds(rules) {
         .map(([id]) => id)
         .sort((a, b) => a.localeCompare(b));
 }
-function appendDuplicateRuleDiagnostics(diagnostics, seenRuleIds, duplicateIds, source, filePath, maxTotalDiagnostics) {
+function appendDuplicateRuleDiagnostics(diagnostics, duplicateIds, source, filePath, maxTotalDiagnostics) {
     const sourceLabel = `${source.origin} ${source.tier} rules`;
     for (const ruleId of duplicateIds) {
         diagnostics.push({
@@ -678,7 +662,6 @@ function appendDuplicateRuleDiagnostics(diagnostics, seenRuleIds, duplicateIds,
             autoFixAvailable: false,
             fixSuggestion: `Give every rule in ${sourceLabel} a unique id`,
         });
-        seenRuleIds.add(ruleId);
         if (diagnostics.length >= maxTotalDiagnostics)
             return true;
     }
@@ -723,7 +706,6 @@ export function evaluateAstGrepRules(filePath, rootNode, cwd, kind, options = {}
     const log = options.log;
     const unsupportedLanguageLog = options.unsupportedLanguageLog ?? defaultUnsupportedLanguageLog;
     const diagnostics = [];
-    const seenRuleIds = new Set();
     const suppressLinterOverlap = kind === "jsts" && hasEslintConfig(cwd);
     const fileLang = ruleLanguageForFile(filePath);
     // Embedded `<script>` coverage (#2347): on an HTML file, every script body
@@ -811,23 +793,14 @@ export function evaluateAstGrepRules(filePath, rootNode, cwd, kind, options = {}
         });
         newlyUnsupported.clear();
     };
-    // Shared with the raw sgconfig materializer so both surfaces walk the same
-    // workspace-rooted sources in the same precedence order.
+    // Same walk and precedence the LSP-seam matcher uses
+    // (clients/dispatch/rule-ignores.ts), folded onto one derivation by #3053
+    // after #3046 shipped them as two independently-drifting copies.
     const ignoreRoot = options.projectRoot ?? cwd;
-    const ruleSources = getAstGrepRuleSources(ignoreRoot);
-    for (const source of ruleSources) {
-        let rules;
-        try {
-            // Project rules are mutable during a session, so their cache fingerprints
-            // relative paths and contents. Bundled catalogs are immutable per install.
-            const loader = source.origin === "project" ? loadYamlRulesFresh : loadYamlRules;
-            rules = loader(source.dir);
-        }
-        catch {
-            continue;
-        }
+    const catalog = buildEffectiveAstGrepCatalog(ignoreRoot);
+    for (const { source, rules } of catalog.sources) {
         const duplicates = duplicateRuleIds(rules);
-        if (appendDuplicateRuleDiagnostics(diagnostics, seenRuleIds, duplicates, source, filePath, maxTotalDiagnostics)) {
+        if (appendDuplicateRuleDiagnostics(diagnostics, duplicates, source, filePath, maxTotalDiagnostics)) {
             flushUnsupportedRuleSkips();
             return diagnostics;
         }
@@ -835,16 +808,23 @@ export function evaluateAstGrepRules(filePath, rootNode, cwd, kind, options = {}
         for (const rule of rules) {
             if (duplicateSet.has(rule.id))
                 continue;
-            // Cross-layer collisions keep the first (higher-precedence) source.
-            if (seenRuleIds.has(rule.id))
+            // Cross-layer collisions keep the first (higher-precedence) source —
+            // resolved once by `buildEffectiveAstGrepCatalog`, not per-rule here.
+            // Compares the winning DOCUMENT (object identity), not merely its
+            // source: comparing `.source` alone can't tell a within-source
+            // duplicate's two copies apart (they share one source), so it gave
+            // no defense if `duplicateSet.has` above were ever the only guard
+            // standing (#3053 round 2 F1). Every `rule` iterated here is the
+            // same object instance the catalog recorded, since both read the
+            // identical `rules` arrays off `catalog.sources`.
+            if (catalog.effectiveRules.get(rule.id)?.rule !== rule)
                 continue;
-            seenRuleIds.add(rule.id);
             if (blockingOnly && rule.severity !== "error")
                 continue;
             // Per-rule path carve-out (#965): a rule that's noise on CLI scripts or
             // a project's own logging sink (e.g. no-console-except-error firing
             // inside scripts/** or lib/logger.ts) opts out via `ignores`.
-            if (matchesRuleIgnores(filePath, ignoreRoot, rule.ignores))
+            if (isRuleIgnoredForPath(filePath, ignoreRoot, rule.ignores))
                 continue;
             if (suppressLinterOverlap &&
                 LINTER_OVERLAP.has(normalizeRuleId(rule.id)) &&

package/node_modules/pi-lens/dist/clients/dispatch/runners/biome-check.js

@@ -202,7 +202,12 @@ const biomeCheckJsonRunner = {
         // Defer to ESLint/oxlint if the project has explicitly configured one —
         // biome runs as the default linter only when no alternative is present.
         if (!policy.hasBiomeConfig && policy.hasExplicitNonBiomeLinter) {
-            return { status: "skipped", diagnostics: [], semantic: "none" };
+            return {
+                status: "skipped",
+                diagnostics: [],
+                semantic: "none",
+                skipReason: "configured-non-biome-linter",
+            };
         }
         const cmd = await resolveToolCommandWithInstallFallback(cwd, "biome");
         if (!cmd) {

package/node_modules/pi-lens/dist/clients/dispatch/runners/rust-clippy.js

@@ -3,15 +3,14 @@
  *
  * Runs `cargo clippy` for Rust files to catch common mistakes.
  */
-import { existsSync } from "node:fs";
-import { isAbsolute, join, resolve } from "node:path";
+import { isAbsolute, resolve } from "node:path";
 import { rustClient } from "../../rust-client.js";
 import { safeSpawnAsync } from "../../safe-spawn.js";
 import { stripAnsi } from "../../sanitize.js";
 import { getLazyInstallAttempt, tryLazyInstall, } from "./utils/lazy-installer.js";
 import { describeInstallAttempt, logAvailabilityDecision, } from "./utils/availability-policy.js";
 import { PRIORITY } from "../priorities.js";
-import { resolveRunnerCwd } from "../../tool-cwd.js";
+import { resolveRunnerCwdWithReason } from "../../tool-cwd.js";
 import { createCwdCachedProbe } from "./utils/runner-helpers.js";
 // Cached per-cwd `cargo clippy --version` probe (#120). Before this, the
 // probe fired on every Rust file save in a project where clippy was already
@@ -91,13 +90,14 @@ const rustClippyRunner = {
             }
         }
         // The package root (where Cargo.toml is), through the shared cwd seam
-        // (#2894): `RUNNER_MARKERS["rust-clippy"]` is `["Cargo.toml"]`, so this
-        // IS the walk this runner used to do with `findNearestContaining` — plus
+        // (#2894): the shared language marker vocabulary includes `Cargo.toml`, so
+        // this IS the walk this runner used to do with `findNearestContaining` — plus
         // the seam's dispatch-root and `$HOME` ceilings, which the hand-rolled
         // walk had neither of. The gate then asks about exactly the directory
         // cargo will run in, rather than about a separately-derived one.
-        const cargoDir = resolveRunnerCwd(ctx, "rust-clippy");
-        if (!existsSync(join(cargoDir, "Cargo.toml"))) {
+        const cargoResolution = resolveRunnerCwdWithReason(ctx, "rust-clippy");
+        const cargoDir = cargoResolution.cwd;
+        if (cargoResolution.marker !== "Cargo.toml") {
             return { status: "skipped", diagnostics: [], semantic: "none" };
         }
         // Run cargo clippy on the package

package/node_modules/pi-lens/dist/clients/dispatch/runners/shfmt.js

@@ -1,6 +1,5 @@
-import * as fs from "node:fs";
-import * as path from "node:path";
 import { safeSpawnAsync } from "../../safe-spawn.js";
+import { findNearestContaining } from "../../path-utils.js";
 import { resolveRunnerCwd } from "../../tool-cwd.js";
 import { PRIORITY } from "../priorities.js";
 import { createAvailabilityChecker, resolveAvailableOrInstall, } from "./utils/runner-helpers.js";
@@ -10,16 +9,7 @@ const shfmt = createAvailabilityChecker("shfmt", ".exe");
 // reports genuine parse errors instead of nagging every unformatted shell file
 // against shfmt's built-in defaults (#211).
 function hasEditorConfig(cwd) {
-    let current = path.resolve(cwd);
-    while (true) {
-        if (fs.existsSync(path.join(current, ".editorconfig")))
-            return true;
-        const parent = path.dirname(current);
-        if (parent === current)
-            break;
-        current = parent;
-    }
-    return false;
+    return findNearestContaining(cwd, [".editorconfig"]) !== undefined;
 }
 /**
  * shfmt runner — checks shell script formatting.

package/node_modules/pi-lens/dist/clients/dispatch/runners/tree-sitter.js

@@ -6,7 +6,7 @@
  */
 import * as path from "node:path";
 import { RuleCache } from "../../cache/rule-cache.js";
-import { minimatch } from "../../deps/minimatch.js";
+import { isRuleIgnoredForPath } from "../rule-ignores.js";
 import { isTestFile } from "../../file-utils.js";
 import { buildOrUpdateGraph, computeImpactCascade, recordEntitySnapshotDiff, } from "../../review-graph/service.js";
 import { getSharedTreeSitterClient, isTreeSitterWasmAborted, markTreeSitterWasmAborted, resolveTreeSitterLanguage, } from "../../tree-sitter-shared.js";
@@ -292,25 +292,6 @@ function getTotalLinesChanged(ranges) {
 }
 /** Threshold: skip entity extraction for changes under 5 lines */
 const ENTITY_EXTRACTION_LINE_THRESHOLD = 5;
-/**
- * `filePath` relative to `root`, forward-slashed, for matching a rule's
- * `ignore_paths` globs. Falls back to the absolute (slash-normalized) path
- * when `filePath` isn't under `root` (e.g. an out-of-tree temp file), so a
- * glob like `scripts/**` simply never matches rather than throwing.
- */
-function relativeForIgnoreGlob(filePath, root) {
-    const rel = path.relative(root, filePath);
-    const normalized = (rel.startsWith("..") ? filePath : rel)
-        .split(path.sep)
-        .join("/");
-    return normalized;
-}
-function matchesIgnorePaths(filePath, root, patterns) {
-    if (!patterns || patterns.length === 0)
-        return false;
-    const rel = relativeForIgnoreGlob(filePath, root);
-    return patterns.some((pattern) => minimatch(rel, pattern, { dot: true }));
-}
 const treeSitterRunner = {
     id: "tree-sitter",
     appliesTo: [
@@ -447,7 +428,7 @@ const treeSitterRunner = {
         const effectiveQueries = (ctx.blockingOnly
             ? languageQueries.filter((q) => q.inline_tier !== "review")
             : languageQueries).filter((q) => !(fileIsTest && q.skip_test_files) &&
-            !matchesIgnorePaths(filePath, ignoreRoot, q.ignore_paths));
+            !isRuleIgnoredForPath(filePath, ignoreRoot, q.ignore_paths));
         logTreeSitter({
             phase: "queries_loaded",
             filePath,

package/node_modules/pi-lens/dist/clients/dispatch/runners/utils/runner-helpers.js

@@ -1697,5 +1697,5 @@ export const sg = {
 };
 /** Shared cwd seam for runner probes and analysis children (#2777). */
 export function resolveRunnerCwd(ctx, tool) {
-    return resolveToolCwd("runner", tool, ctx.filePath, ctx);
+    return resolveToolCwd("runner", tool, ctx.filePath, ctx).cwd;
 }

package/node_modules/pi-lens/dist/clients/dispatch/types.js

@@ -11,7 +11,10 @@
  * The dispatcher must handle these semantics consistently.
  */
 /** Closed telemetry taxonomy for expected runner skips. */
-export const RUNNER_SKIP_REASONS = ["no-files-matched"];
+export const RUNNER_SKIP_REASONS = [
+    "no-files-matched",
+    "configured-non-biome-linter",
+];
 /** Runtime guard for untyped/plugin-provided runner results. */
 export function isRunnerSkipReason(value) {
     return RUNNER_SKIP_REASONS.some((reason) => reason === value);

package/node_modules/pi-lens/dist/clients/disposition-publish.js

@@ -97,6 +97,7 @@ export function publishDisposition(args) {
             line: args.line,
             anchor: args.anchor,
             reason: args.reason,
+            message: args.message,
         };
         busEmit(BUS_DISPOSITION_EVENT, payload);
         hasLoggedFailure = false;