@herbertgao/pi-extensions 2026.9.6 → 2026.9.7

package/node_modules/pi-lens/dist/clients/path-utils.js

@@ -7,7 +7,9 @@
  * Approach (inspired by OpenCode's Filesystem.normalizePath):
  * - On Windows: try realpathSync.native() for canonical casing
  * - Falls back to lowercase for files that don't exist yet
- * - On non-Windows: return path as-is (case-sensitive filesystem)
+ * - On non-Windows: adopt the on-disk casing of an existing path (#3098 — a
+ *   case-insensitive POSIX filesystem otherwise derives two Map keys for one
+ *   file); a path that does not exist is returned as-is, case-preserving
  * - Always convert backslashes to forward slashes for Map key consistency
  */
 import { existsSync, readFileSync, realpathSync, statSync, } from "node:fs";
@@ -91,6 +93,64 @@ export function isAbsoluteFilePath(filePath) {
 export function splitPathSegments(filePath) {
     return filePath.split(/[\\/]+/).filter(Boolean);
 }
+/**
+ * Adopt `canonical`'s CASING for the trailing segments of `held`, stopping at
+ * the first segment that differs by more than case.
+ *
+ * `realpathSync.native` answers a different question than the one the POSIX
+ * arm of `normalizeFilePath` asks: it resolves symlinks AND reports on-disk
+ * casing, and we want only the second half. Walking from the tail and halting
+ * at the first structural divergence separates them with no extra syscall:
+ *
+ *   held      /var/folders/T/x/SUB/a.ts   (macOS tmpdir, mis-cased segment)
+ *   canonical /private/var/folders/T/x/sub/a.ts
+ *   result    /var/folders/T/x/sub/a.ts   (case fixed, symlink prefix kept)
+ *
+ * The symlink prefix matters: macOS's `os.tmpdir()` is `/var/folders/...`,
+ * a symlink into `/private/var`, so a whole-string "is this a case variant"
+ * test would decline to canonicalize exactly the paths the #1024 regression
+ * test (and any macOS temp-dir workflow) runs on. Keeping the prefix is also
+ * what bounds this change: on POSIX, `normalizeFilePath` still never resolves
+ * a symlink, so a symlinked monorepo package keeps keying under the path the
+ * caller held (refs #2490 — a cwd fold for its own sake broke every monorepo).
+ *
+ * PURE string algebra: this pins what the rewrite DOES, never what the kernel
+ * reports — and from two strings alone it cannot tell "the same file, spelled
+ * with different case" from "a different file whose name happens to be a case
+ * variant". Any symlink whose BASENAME is a case variant of its target's
+ * basename (`<root>/MyProject` → `work/myproject`, `node_modules/Foo` →
+ * `../pkgs/foo`) has its name replaced while its own parent is kept, so the
+ * result names a different place — or no place at all. Measured in #3159
+ * review round 2 (F1): two different inodes collapsed onto ONE key (the #1024
+ * defect inverted — false suppression), and a symlinked package keyed under a
+ * path that does not exist on disk, breaking the #2490 bound above. The caller
+ * therefore CONFIRMS every rewrite against the filesystem before adopting it
+ * (see `normalizeFilePath`); do not use this function without that step.
+ */
+function adoptCanonicalCasing(held, canonical) {
+    const heldParts = held.split("/");
+    const realParts = canonical.split("/");
+    let i = heldParts.length - 1;
+    let j = realParts.length - 1;
+    let changed = false;
+    while (i >= 0 && j >= 0) {
+        const a = heldParts[i];
+        const b = realParts[j];
+        if (a !== b) {
+            if (a.toLowerCase() !== b.toLowerCase())
+                break;
+            heldParts[i] = b;
+            changed = true;
+        }
+        i--;
+        j--;
+    }
+    // Identity-preserving when nothing moved — this runs on every POSIX map-key
+    // derivation and the overwhelmingly common answer is "already canonical".
+    // NOT a behavioural branch (both arms produce an equal string): it is the
+    // same allocation guard `normalizeEphemeralMapKey` documents below.
+    return changed ? heldParts.join("/") : held;
+}
 /**
  * Normalize a file path for consistent Map key usage.
  *
@@ -100,7 +160,33 @@ export function splitPathSegments(filePath) {
  * - If the file doesn't exist: resolves the path and lowercases
  *   (needed for new files where we haven't written yet)
  *
- * On non-Windows: returns path as-is (case-sensitive filesystem).
+ * On POSIX:
+ * - If the file exists: adopts the on-disk CASING of the trailing segments
+ *   (see `adoptCanonicalCasing`) — no lowercasing, no symlink resolution.
+ * - If the file doesn't exist: returns the path as-is, case-PRESERVING. On a
+ *   case-sensitive filesystem `SUB/a.ts` and `sub/a.ts` are two different
+ *   files, and nothing may fold one into the other; only the filesystem's own
+ *   answer for a path that EXISTS can tell the two apart, and for a path that
+ *   does not exist there is no such answer to ask for.
+ *
+ * Why POSIX canonicalizes casing at all (#3098, the #1024 defect's live half):
+ * a case-insensitive POSIX filesystem — macOS's default APFS, `nocase` vfat /
+ * ntfs3 / cifs mounts — makes `SUB/a.ts` and `sub/a.ts` ONE file, so a raw
+ * mis-cased write (`lens_diagnostic_mark` anchors under `path.resolve(cwd,
+ * arg)`) and a `normalizeMapKey` read derived two anchors for one file and the
+ * agent's own disposition mark silently never applied. A case-preserving POSIX
+ * arm cannot close that: the two keys only become one if the normalizer asks
+ * the filesystem which name is really on disk.
+ *
+ * `realpathSync.native` is `realpath(3)`. On Darwin it rebuilds every
+ * component from the filesystem's own `ATTR_CMN_NAME` — Libc-1669.0.4
+ * `stdlib/FreeBSD/realpath.c:233` (`getattrlist(resolved, &_rp_alist, …,
+ * FSOPT_NOFOLLOW)` with `ATTR_CMN_NAME`) and `:348-354` ("attrs already has
+ * the real name") — which is why it returns on-disk casing on APFS/HFS+.
+ * MEASURED counter-example (#3098): a Linux ext4/tmpfs `chattr +F` casefold
+ * directory aliases the two spellings but `realpath(3)` there returns the
+ * spelling the caller asked with, so this arm is a no-op on casefolded Linux
+ * directories — filed with the transcript as #3154.
  *
  * Always converts backslashes to forward slashes for consistent Map keys.
  */
@@ -108,7 +194,31 @@ export function normalizeFilePath(filePath) {
     // Convert backslashes to forward slashes first
     const normalized = filePath.replace(/\\/g, "/");
     if (process.platform !== "win32" && !isWindowsPath(normalized)) {
-        return normalized;
+        try {
+            const canonical = realpathSync.native(normalized);
+            // Fast path, not a guard: both arms answer `normalized` when the
+            // strings match, but skipping the two `split`s there is a measured
+            // 1.9 vs 2.3 microseconds per call on the per-edit seam (#3098).
+            if (canonical === normalized)
+                return normalized;
+            const adopted = adoptCanonicalCasing(normalized, canonical);
+            if (adopted === normalized)
+                return normalized;
+            // The rewrite is string algebra and can land on a DIFFERENT file
+            // (#3159 review round 2, F1 — see `adoptCanonicalCasing`). Adopt it
+            // only once the filesystem agrees it still names the file the caller
+            // held: `canonical` IS `realpath(normalized)`, so this asks exactly
+            // "does the rewritten spelling resolve to the same file?". One extra
+            // syscall, and only on the rare branch where casing actually moved —
+            // never on an already-canonical path. A throw here (the rewritten
+            // path does not exist, the #2490 monorepo case) lands in the catch
+            // below and keeps the caller's spelling, which is the same answer.
+            return realpathSync.native(adopted) === canonical ? adopted : normalized;
+        }
+        catch {
+            // Does not exist (or is unreadable): case-preserving, as above.
+            return normalized;
+        }
     }
     // Windows: try realpathSync.native() for canonical casing
     // This resolves symlinks and returns the actual filesystem casing
@@ -130,6 +240,16 @@ export function normalizeFilePath(filePath) {
         }
     }
 }
+/** Resolve a filesystem identity once, retaining a usable absolute fallback. */
+export function realpathOrResolve(filePath) {
+    const resolved = path.resolve(filePath);
+    try {
+        return realpathSync(resolved);
+    }
+    catch {
+        return resolved;
+    }
+}
 /**
  * Normalize a logged `filePath`/`cwd` value, but ONLY when it is already a
  * fully-qualified path (#2219, the #2141 class's sibling loggers). Several

package/node_modules/pi-lens/dist/clients/performance-report.js

@@ -5,7 +5,11 @@ import { getMaxLogSizeMB } from "./log-cleanup.js";
 const DEFAULT_PERF_TOP_N = 5;
 const MAX_PERF_TOP_N = 50;
 export const MAX_PERF_PHASE_SAMPLES = 20_000;
-const PARSE_YIELD_EVERY = 500;
+// Yield cadence for the full-window parse below. Exported so the occupancy
+// guard can count yields against the lines fed instead of measuring a
+// wall-clock block the scheduler can inflate (#2886): the count is a
+// deterministic function of the input, not of worker contention.
+export const PARSE_YIELD_EVERY = 500;
 // The window follows the same threshold that rotates the log out from under it.
 // Exported so a test can size a fixture to the window it means to saturate
 // rather than to a second copy of the default that can drift out of agreement.

package/node_modules/pi-lens/dist/clients/php-cs-fixer-config.js

@@ -114,6 +114,6 @@ export function resolvePhpCsFixerConfig(filePath) {
     const startDir = resolveToolCwd("formatter", "php-cs-fixer", absolute, {
         cwd: path.parse(absolute).root,
         allowHomeMarker: true,
-    });
+    }).cwd;
     return PHP_CS_FIXER_CONFIG_NAMES.map((name) => path.join(startDir, name)).find(existsSync);
 }

package/node_modules/pi-lens/dist/clients/pipeline.js

@@ -11,12 +11,14 @@
  *   6. Test runner (run corresponding test file)
  *   7. Cascade diagnostics (other files with errors, LSP only)
  */
+import { createHash } from "node:crypto";
 import * as nodeFs from "node:fs";
+import * as nodeCrypto from "node:crypto";
 import * as path from "node:path";
 import { findNearestContaining, normalizeEphemeralMapKey, } from "./path-utils.js";
 import { recordFromDispatchDiagnostic, } from "./actionable-warnings.js";
 import { recordFromCodeQualityDiagnostic, } from "./code-quality-warnings.js";
-import { recordDiagnostics } from "./widget-state.js";
+import { admitWidgetDiagnosticsWrite, recordDiagnostics, } from "./widget-state.js";
 import { getDiagnosticLogger } from "./diagnostic-logger.js";
 import { getDiagnosticTracker } from "./diagnostic-tracker.js";
 import { loadDispatchIntegration } from "./dispatch/lazy.js";
@@ -36,8 +38,10 @@ import { RUNTIME_CONFIG } from "./runtime-config.js";
 import { getAmbientAbortSignal, safeSpawnAsync } from "./safe-spawn.js";
 import { probeToolAsync } from "./tool-probe.js";
 import { bounded } from "./deadline-utils.js";
+import { HOOK_WALL_BUDGET_MS } from "./hook-budgets.js";
 import { enabledAuxiliaryLspServerIds } from "./dispatch/auxiliary-lsp.js";
 import { recordDegradationOnce } from "./degradation-ledger.js";
+import { establishToolAgreement } from "./tool-agreement.js";
 import { dropFindingsForMissingPaths } from "./advisory-provenance.js";
 import { getAutofixPolicyForFile, getPreferredAutofixTools, getRubocopCommand, hasBiomeConfig, hasDetektConfig, hasEslintConfig, hasGolangciConfig, hasKtfmtConfig, hasKtlintConfig, hasOxlintConfig, hasRubocopConfig, hasSqlfluffConfig, hasStylelintConfig, markdownlintConfigArgs, } from "./tool-policy.js";
 const LSP_MAX_FILE_BYTES = RUNTIME_CONFIG.pipeline.lspMaxFileBytes;
@@ -462,6 +466,17 @@ export async function runAutofix(filePath, cwd, getFlag, dbg, deps, getFlagSourc
     }
     for (const toolName of preferredAutofixTools) {
         attemptedTools.push(toolName);
+        const agreement = establishToolAgreement(toolName, cwd);
+        if (agreement.decision === "decline") {
+            const reason = agreement.reason;
+            dbg(`autofix: ${toolName} declined (${reason})`);
+            recordDegradationOnce({
+                kind: "autofix-agreement-unavailable",
+                subject: agreement.subject,
+                reason,
+            });
+            continue;
+        }
         if (toolName === "ruff") {
             const ruffReady = ruffClient.isPythonFile(filePath)
                 ? await ruffClient.ensureAvailable()
@@ -818,7 +833,7 @@ function buildAllClearOutput(_dispatchResult, elapsed, filePath) {
     parts.push(`${elapsed}ms`);
     return `checkmark ${parts.join(" · ")}`.replace("checkmark", "\u2713");
 }
-export async function runFormatPhase(filePath, getFormatService, dbg) {
+export async function runFormatPhase(filePath, getFormatService, dbg, signal, budgetMs = HOOK_WALL_BUDGET_MS.tool_result_edit, hook = "tool_result_edit") {
     let formatChanged = false;
     let formattersUsed = [];
     const formatFailures = [];
@@ -827,13 +842,19 @@ export async function runFormatPhase(filePath, getFormatService, dbg) {
     const formatService = getFormatService();
     try {
         formatService.recordRead(filePath);
-        const result = await formatService.formatFile(filePath);
+        const result = await formatService.formatFile(filePath, {
+            signal,
+            budgetMs,
+            hook,
+        });
         // An unavailable tool is NOT a formatter that ran (#2413): keep it out of
         // `formattersUsed` (which drives change bookkeeping / turn summaries) and
         // out of `formatFailures` (which requeues). Record it once, distinctly.
         for (const f of result.formatters) {
             if (f.outcome !== "unavailable")
                 continue;
+            if (f.error?.includes("project tool agreement could not be established"))
+                continue;
             const reason = f.error ?? "formatter executable not found";
             formatUnavailable.push({ formatter: f.name, reason });
             recordDegradationOnce({
@@ -931,6 +952,7 @@ function buildEnrichedBlockerOutput(blockers, fileContent = "") {
 export async function runPipeline(ctx, deps) {
     const { filePath, cwd, toolName, getFlag, getFlagSource, dbg } = ctx;
     const { getFormatService } = deps;
+    admitWidgetDiagnosticsWrite(filePath, ctx.telemetry?.writeIndex);
     const phase = createPhaseTracker(toolName, filePath);
     const pipelineStart = Date.now();
     clearGraphCache();
@@ -955,7 +977,7 @@ export async function runPipeline(ctx, deps) {
     const immediateFormat = !!getFlag("immediate-format");
     const formatDeferred = !autoformatDisabled && !immediateFormat && !!fileContent;
     if (!autoformatDisabled && immediateFormat && fileContent) {
-        const formatResult = await runFormatPhase(filePath, getFormatService, dbg);
+        const formatResult = await runFormatPhase(filePath, getFormatService, dbg, ctx.signal);
         formatChanged = formatResult.formatChanged;
         formattersUsed = formatResult.formattersUsed;
         formatFailures = formatResult.formatFailures;
@@ -1043,6 +1065,30 @@ export async function runPipeline(ctx, deps) {
         attemptedTools,
         skipReason: autofixSkipReason,
     });
+    // Capture the target's bytes immediately after pi-lens writes and before any
+    // awaitable LSP or dispatch work. `fileModified` also covers side-effect
+    // files, so target membership is the discriminator for pipeline ownership
+    // (#2499).
+    const fileModified = formatChanged || fixedCount > 0;
+    const targetFileModified = piChangedFiles.has(path.resolve(filePath));
+    const postWriteStateHash = fileModified && targetFileModified
+        ? (() => {
+            try {
+                return nodeCrypto
+                    .createHash("sha256")
+                    .update(nodeFs.readFileSync(filePath))
+                    .digest("hex");
+            }
+            catch (error) {
+                recordDegradationOnce({
+                    kind: "pipeline-post-write-hash-unavailable",
+                    subject: filePath,
+                    reason: error instanceof Error ? error.message : String(error),
+                });
+                return undefined;
+            }
+        })()
+        : undefined;
     // --- 4. LSP file sync ---
     // Sync once with final post-format/post-fix content so dispatch and cascade
     // diagnostics do not observe stale pre-format text.
@@ -1060,6 +1106,21 @@ export async function runPipeline(ctx, deps) {
         getFlag: getFlag,
     };
     const { dispatchLintWithResult, computeCascadeForFile } = await loadDispatchIntegration();
+    // Capture the bytes the pipeline presents to analysis before the dispatch
+    // promise can yield to another writer. The blocker evidence below belongs to
+    // this analysis input, not to whatever happens to be on disk when the whole
+    // pipeline returns.
+    const inlineBlockerFileContent = fileContent
+        ? (() => {
+            const content = Buffer.from(fileContent, "utf8");
+            return content.byteLength <= 2 * 1024 * 1024
+                ? {
+                    size: content.byteLength,
+                    sha256: createHash("sha256").update(content).digest("hex"),
+                }
+                : undefined;
+        })()
+        : undefined;
     const dispatchResult = await dispatchLintWithResult(filePath, cwd, piApi, ctx.modifiedRanges, {
         model: ctx.telemetry?.model ?? "unknown",
         sessionId: ctx.telemetry?.sessionId ?? "unknown",
@@ -1216,6 +1277,11 @@ export async function runPipeline(ctx, deps) {
             dbg,
             turnSeq: ctx.telemetry?.turnIndex,
             writeSeq: ctx.telemetry?.writeIndex,
+            // #3157: `cwd` here is the LANGUAGE root. The cascade's display
+            // filter reads the disposition store and the `.pi-lens.json` rule
+            // policy, both written under the PROJECT root (#1030) — the same
+            // pair the dispatcher is handed above.
+            projectRoot: ctx.projectRoot,
             seqState: ctx.seqState,
             turnEndCascadeSettleStart: ctx.turnEndCascadeSettleStart,
             fileContent,
@@ -1250,7 +1316,6 @@ export async function runPipeline(ctx, deps) {
         output = buildAllClearOutput(dispatchResult, elapsed, filePath);
     }
     phase.end("total", { hasOutput: !!output });
-    const fileModified = formatChanged || fixedCount > 0;
     const changedFiles = [...piChangedFiles];
     emitLensAnalysisComplete({
         cwd,
@@ -1276,6 +1341,7 @@ export async function runPipeline(ctx, deps) {
         cascadePromise,
         isError: false,
         fileModified,
+        postWriteStateHash,
         changedFiles,
         inlineBlockerSummary: dispatchResult.hasBlockers
             ? dispatchResult.blockerOutput.trim() || undefined
@@ -1338,5 +1404,8 @@ export async function runPipeline(ctx, deps) {
                 source: "autofix",
             }
             : undefined,
+        inlineBlockerFileContent: dispatchResult.hasBlockers
+            ? inlineBlockerFileContent
+            : undefined,
     };
 }

package/node_modules/pi-lens/dist/clients/project-diagnostics/cache.js

@@ -4,9 +4,17 @@ import { getProjectDataDir } from "../file-utils.js";
 import { writeFileAtomic } from "../atomic-write.js";
 import { readJsonCache } from "../json-cache-read.js";
 import { freshnessFromMtime } from "../freshness.js";
+import { hashDiagnosticContent } from "../lsp/diagnostic-binding.js";
+// v3 (#2154, #3060 review F1): rows carry `fileFingerprints` — the size and
+// sha256 of the bytes the scan actually read. A v2 snapshot has no content
+// axis at all; its rows can only be judged by `mtime <= scannedAt`, the test
+// that let an edit landing mid-scan read as fresh forever. Every row here is
+// a POSITIVE claim, so v2 records are rejected by the version guard and the
+// project is re-scanned rather than served under the axis that failed — the
+// same clean break `WORKSPACE_DIAGNOSTICS_CACHE_VERSION` v3 (#2776) made.
 // v2: cheap-tier scan now also runs ast-grep-napi (#308); invalidate older
 // snapshots so a pre-ast-grep cache isn't served as complete via refreshRunners=cached.
-export const PROJECT_DIAGNOSTICS_CACHE_VERSION = 2;
+export const PROJECT_DIAGNOSTICS_CACHE_VERSION = 3;
 const SNAPSHOT_CACHE_FILE = "project-diagnostics.json";
 const DELTA_CACHE_FILE = "project-diagnostics-delta.json";
 function cachePath(cwd, fileName) {
@@ -80,15 +88,39 @@ export function reconcileProjectDiagnosticsSnapshot(snapshot) {
         if (cached !== undefined)
             return cached;
         let stale;
-        let mtimeMs;
+        let stat;
         try {
-            mtimeMs = fs.statSync(filePath).mtimeMs;
+            stat = fs.statSync(filePath);
         }
         catch {
-            mtimeMs = undefined; // deleted / unreadable -> indeterminate -> drop
+            stat = undefined; // deleted / unreadable -> indeterminate -> drop
+        }
+        // #2154: when the scan recorded what this file's bytes WERE, that answers
+        // the question directly and the timestamp comparison below cannot — a
+        // file edited while the scan was still running carries an mtime at or
+        // before `scannedAt` while holding bytes no rule here ever saw. Size is
+        // the cheap reject; only a same-size file is read and hashed. An exact
+        // content match is stronger evidence than any mtime ordering, so it
+        // settles the verdict on its own: these are per-file syntax rules, so
+        // identical bytes mean identical findings no matter what the clock says.
+        const fingerprint = snapshot.fileFingerprints?.[filePath];
+        if (fingerprint && stat) {
+            stale = true;
+            if (stat.size === fingerprint.sizeBytes) {
+                try {
+                    stale =
+                        hashDiagnosticContent(fs.readFileSync(filePath, "utf-8")) !==
+                            fingerprint.contentHash;
+                }
+                catch {
+                    stale = true; // unreadable now -> indeterminate -> drop
+                }
+            }
+            staleByFile.set(filePath, stale);
+            return stale;
         }
         const verdict = freshnessFromMtime({
-            mtimeMs,
+            mtimeMs: stat?.mtimeMs,
             referenceMs: scannedAtMs,
         });
         // Pre-kernel policy: an unreadable/missing file is stale (dropped).