@herbertgao/pi-extensions 2026.9.6 → 2026.9.7

package/node_modules/pi-lens/dist/clients/session-event-guard.js

@@ -65,6 +65,8 @@
  */
 import { emitBounded } from "./bounded-telemetry.js";
 import { recordDegradationOnce } from "./degradation-ledger.js";
+import { bounded } from "./deadline-utils.js";
+import { HOOK_WALL_BUDGET_MS } from "./hook-budgets.js";
 import { probeCtxActive } from "./session-lifecycle.js";
 import { runWithTurnContext } from "./turn-context.js";
 function stableSessionId(ctx) {
@@ -176,6 +178,16 @@ function isThenable(value) {
  * never drift apart between a void handler and a value-returning one.
  */
 function guardSessionEvent(eventName, handler, onStaleResult, options) {
+    const defaultBudgetKey = (eventName) => {
+        if (eventName === "tool_result")
+            return "tool_result_edit";
+        if (eventName === "session_start" ||
+            eventName === "turn_end" ||
+            eventName === "agent_end" ||
+            eventName === "agent_settled")
+            return eventName;
+        return undefined;
+    };
     const skip = (event, detectedAt) => {
         recordStaleSkip(eventName, detectedAt);
         try {
@@ -199,17 +211,50 @@ function guardSessionEvent(eventName, handler, onStaleResult, options) {
             // below.
             return skip(event, "pre-dispatch");
         try {
+            let signal;
+            try {
+                signal = ctx?.signal;
+            }
+            catch (err) {
+                if (isStaleExtensionCtxError(err))
+                    return Promise.resolve(skip(event, "mid-handler"));
+                // The signal read moved out of each handler's own try/catch and
+                // into the guard (#2523 hook budgets), so a ctx whose `signal`
+                // accessor throws for a NON-stale reason is a crashed handler and
+                // must leave the same record the handler's own catch used to (#2884).
+                // This preserves the old catch behavior for lifecycle handlers. The
+                // `tool_result` and `context` handlers never caught this signal read,
+                // so their non-stale accessor errors are surfaced as a swallowed
+                // handler crash instead (#2939 F5). `rethrow` is intentionally not
+                // forwarded: wrappers do not pass it, and only `surfaceHandlerCrash`
+                // honors that option (#2939 F4).
+                const crashOptions = {};
+                if (options.dbg !== undefined)
+                    crashOptions.dbg = options.dbg;
+                surfaceHandlerCrash(eventName, err, crashOptions);
+                return Promise.resolve(onStaleResult(event));
+            }
             const result = runWithTurnContext(stableSessionId(ctx), () => handler(event, ctx));
             if (isThenable(result)) {
-                // Recover the rejection in place. The host awaits the same promise
-                // it would have awaited anyway; it just resolves instead.
-                // SAFETY: the recovered promise settles to `Awaited<R>`, which the
-                // host consumes exactly as it would an `R` — see the note above.
-                return Promise.resolve(result).catch((err) => {
+                const recovered = Promise.resolve(result).catch((err) => {
                     if (isStaleExtensionCtxError(err))
                         return skip(event, "mid-handler");
                     throw err;
                 });
+                const budget = typeof options.budgetKey === "function"
+                    ? options.budgetKey(event, ctx)
+                    : (options.budgetKey ?? defaultBudgetKey(eventName));
+                if (budget === undefined)
+                    return recovered;
+                return bounded(recovered, {
+                    ms: HOOK_WALL_BUDGET_MS[budget],
+                    // The settled drain must observe an aborted signal and requeue
+                    // before its promise is released; its own workers read the same
+                    // signal and remain bounded at their seams.
+                    signal: budget === "agent_settled" ? undefined : signal,
+                    hook: budget,
+                    label: "registered-handler",
+                });
             }
             return result;
         }

package/node_modules/pi-lens/dist/clients/sg-runner.js

@@ -652,13 +652,19 @@ export class SgRunner {
     }
     // --- Shared helpers for temp-dir rule scans ---
     prepareTempScan(ruleId, ruleYaml) {
-        const sessionDir = path.join(os.tmpdir(), `pi-lens-temp-${ruleId}-${Date.now()}`);
-        const rulesSubdir = path.join(sessionDir, "rules");
-        const configFile = path.join(sessionDir, ".sgconfig.yml");
-        fs.mkdirSync(rulesSubdir, { recursive: true });
-        fs.writeFileSync(configFile, `ruleDirs:\n  - ./rules\n`);
-        fs.writeFileSync(path.join(rulesSubdir, `${ruleId}.yml`), ruleYaml);
-        return { sessionDir, configFile };
+        const sessionDir = fs.mkdtempSync(path.join(os.tmpdir(), `pi-lens-temp-${ruleId}-`));
+        try {
+            const rulesSubdir = path.join(sessionDir, "rules");
+            const configFile = path.join(sessionDir, ".sgconfig.yml");
+            fs.mkdirSync(rulesSubdir, { recursive: true });
+            fs.writeFileSync(configFile, `ruleDirs:\n  - ./rules\n`);
+            fs.writeFileSync(path.join(rulesSubdir, `${ruleId}.yml`), ruleYaml);
+            return { sessionDir, configFile };
+        }
+        catch (error) {
+            this.cleanupTempScan(sessionDir);
+            throw error;
+        }
     }
     cleanupTempScan(sessionDir) {
         try {
@@ -732,8 +738,10 @@ export class SgRunner {
         }
     }
     async tempScanDetailedAsync(dir, ruleId, ruleYaml, timeout = DEFAULT_EXEC_TIMEOUT_MS, options = {}) {
-        const { sessionDir, configFile } = this.prepareTempScan(ruleId, ruleYaml);
+        let sessionDir;
         try {
+            ({ sessionDir } = this.prepareTempScan(ruleId, ruleYaml));
+            const configFile = path.join(sessionDir, ".sgconfig.yml");
             const { cmd: sgCmd, args: sgPre } = getSgCommand();
             const result = await safeSpawnAsync(sgCmd, [
                 ...sgPre,
@@ -752,7 +760,8 @@ export class SgRunner {
             return this.interpretScanResult(result, ["scan"]);
         }
         finally {
-            this.cleanupTempScan(sessionDir);
+            if (sessionDir)
+                this.cleanupTempScan(sessionDir);
         }
     }
     /** Backwards-compatible match-only wrapper for existing session scanners. */
@@ -766,8 +775,10 @@ export class SgRunner {
      * Apply:   --update-all (writes fixes defined in the YAML `fix:` field).
      */
     async tempScanWithFixAsync(dir, ruleId, ruleYaml, applyFixes, timeout = DEFAULT_EXEC_TIMEOUT_MS, options = {}) {
-        const { sessionDir, configFile } = this.prepareTempScan(ruleId, ruleYaml);
+        let sessionDir;
         try {
+            ({ sessionDir } = this.prepareTempScan(ruleId, ruleYaml));
+            const configFile = path.join(sessionDir, ".sgconfig.yml");
             const { cmd: sgCmd, args: sgPre } = getSgCommand();
             const scanArgs = [
                 ...sgPre,
@@ -823,7 +834,8 @@ export class SgRunner {
             return { matches: [], error: String(err) };
         }
         finally {
-            this.cleanupTempScan(sessionDir);
+            if (sessionDir)
+                this.cleanupTempScan(sessionDir);
         }
     }
     /**

package/node_modules/pi-lens/dist/clients/sgconfig.js

@@ -2,6 +2,7 @@ import { createHash } from "node:crypto";
 import * as fs from "node:fs";
 import * as os from "node:os";
 import * as path from "node:path";
+import { recordDegradationOnce } from "./degradation-ledger.js";
 import { load as loadYaml } from "./deps/js-yaml.js";
 import { resolvePackagePath } from "./package-root.js";
 import { findLocalToolConfig } from "./path-utils.js";
@@ -236,8 +237,83 @@ export function resolveBaselineSgconfig(projectRoot = process.cwd()) {
     const ruleDirForYaml = mergedDir.split(path.sep).join("/");
     fs.writeFileSync(file, `ruleDirs:\n  - ${JSON.stringify(ruleDirForYaml)}\n`);
     cachedBaselines.set(root, { fingerprint, path: file, mergedDir });
+    // Only the current pair is protected: every other baseline this process
+    // resolved is an eviction candidate too, or the keep-set would grow with
+    // the root count and the cap could never fire. An evicted sibling
+    // re-materializes on its next resolve through the existsSync check above.
+    enforceBaselineEntryCap(dir, new Set([file, mergedDir]));
     return file;
 }
+/**
+ * Hard bound on the shared scratch dir (#2912: it held ~703,000 entries after
+ * one merge train). An entry cap, not a per-session subdirectory: no
+ * session-end seam owns this module, and a cap is race-safe across concurrent
+ * processes — a sibling whose baseline is evicted re-materializes on its next
+ * resolve (the existsSync check above self-heals). Each root baseline is two
+ * entries (config + merged rules dir); 24 entries ≈ 12 live roots, ample for
+ * concurrent agents times worktrees. Eviction is oldest-mtime-first and emits
+ * one bounded record per session.
+ */
+const SG_BASELINE_RETAINED_ENTRIES = 24;
+function enforceBaselineEntryCap(dir, keep) {
+    let names;
+    try {
+        names = fs.readdirSync(dir);
+    }
+    catch {
+        return;
+    }
+    const candidates = [];
+    for (const name of names) {
+        const isConfig = /^baseline(?:-\d+(?:-[a-f0-9]+)?)?\.sgconfig\.yml$/.test(name);
+        const isMergedDir = /^baseline-\d+(?:-[a-f0-9]+)?\.rules$/.test(name);
+        if (!isConfig && !isMergedDir)
+            continue;
+        const full = path.join(dir, name);
+        if (keep.has(full))
+            continue;
+        try {
+            candidates.push({
+                full,
+                mtimeMs: fs.statSync(full).mtimeMs,
+                recursive: isMergedDir,
+            });
+        }
+        catch {
+            // Racing another session; leave its artifact alone.
+        }
+    }
+    const over = candidates.length + keep.size - SG_BASELINE_RETAINED_ENTRIES;
+    if (over <= 0)
+        return;
+    candidates.sort((a, b) => a.mtimeMs - b.mtimeMs);
+    let evicted = 0;
+    for (const candidate of candidates.slice(0, over)) {
+        try {
+            fs.rmSync(candidate.full, {
+                recursive: candidate.recursive,
+                force: true,
+            });
+            evicted += 1;
+            for (const [root, baseline] of cachedBaselines) {
+                if (baseline.path === candidate.full ||
+                    baseline.mergedDir === candidate.full) {
+                    cachedBaselines.delete(root);
+                }
+            }
+        }
+        catch {
+            // Racing another session; leave its artifact alone.
+        }
+    }
+    if (evicted > 0) {
+        recordDegradationOnce({
+            kind: "sgconfig-baseline-cap-evict",
+            subject: dir,
+            reason: `evicted ${evicted} oldest baseline entries over the ${SG_BASELINE_RETAINED_ENTRIES}-entry cap`,
+        });
+    }
+}
 function cleanupStaleBaselines(dir, keep) {
     try {
         const cutoff = Date.now() - 7 * 24 * 60 * 60 * 1000;
@@ -250,8 +326,9 @@ function cleanupStaleBaselines(dir, keep) {
             if (keep.has(full))
                 continue;
             try {
-                if (fs.statSync(full).mtimeMs < cutoff) {
-                    fs.rmSync(full, { recursive: isMergedDir, force: true });
+                const stat = fs.statSync(full);
+                if (stat.mtimeMs < cutoff) {
+                    fs.rmSync(full, { recursive: stat.isDirectory(), force: true });
                 }
             }
             catch {

package/node_modules/pi-lens/dist/clients/test-runner-client.js

@@ -65,8 +65,8 @@ import { resolveToolCwd } from "./tool-cwd.js";
 export function isRunnerErrorResult(result) {
     return result.failed === 0 && !!result.error;
 }
-// Source file → test file patterns (reverse lookup)
-const SOURCE_TO_TEST_PATTERNS = [
+// Discovery table; exported so the #2928 parity test enumerates its conventions.
+export const SOURCE_TO_TEST_PATTERNS = [
     {
         ext: ".ts",
         testExts: [".test.ts", ".spec.ts"],
@@ -281,7 +281,6 @@ export const RUNNERS = {
         kinds: ["java", "kotlin"],
         configFiles: ["pom.xml"],
         command: "mvn",
-        spawnCwdMarkers: ["mvnw", "mvnw.cmd"],
         args: (_testFile, _cwd) => ["test", "-q"],
         parseJson: false,
     },
@@ -1162,43 +1161,6 @@ export class TestRunnerClient {
             strategy: "related",
         };
     }
-    /**
-     * The working directory the test-runner CHILD is spawned in (#2871).
-     *
-     * AGENTS.md defect shape 40: `resolveToolCwd` is the one seam for a child
-     * process's cwd, and this file resolved its own — it handed
-     * `safeSpawnAsync` the dispatch root, so `RUNNERS.go.args` built
-     * `./tools/tapctl/internal/lightning` relative to a root module that does
-     * not own that package. Marker discovery, the `.git` fallback, the
-     * dispatch-root fallback, the `$HOME` ceiling, the once-per-key `tool-cwd`
-     * log line and the bounded `tool-cwd-resolution` degradation now all come
-     * from the seam, with the runner's own table as the markers.
-     *
-     * This is a SECOND value, never a reassignment of `cwd`: the failed-target
-     * ledger (`recordResult` → `getFailedTargets`, read back by
-     * `getTestRunTarget`) is keyed by the DISPATCH root, and re-keying it per
-     * module would make a recorded failure unfindable from the turn that
-     * selects targets.
-     *
-     * Review round 2, F6: there is deliberately NO clamp on a resolution that
-     * lands outside the dispatch root. The seam only answers outside it when
-     * the FILE is outside it (`tool-cwd.ts`: every in-tree branch is
-     * `isUnderDir`-checked), and the one production caller —
-     * `runtime-turn.ts`'s turn-end batch, on both the fresh and the deferred
-     * path — filters every target through `isExcludedTestTarget`, which fails
-     * CLOSED out of tree (#2522). Round 1 shipped that clamp plus a
-     * `tool-cwd-resolution` ledger row for it; neither could fire in a live
-     * session, so the row was a record nothing could observe and the guard was
-     * defence against a caller that does not exist. Both are gone. If a second
-     * caller is ever added that can pass an out-of-tree file, it needs this
-     * decision made where that caller is, with a test that reaches it.
-     */
-    resolveSpawnCwd(runner, config, testFile, dispatchRoot) {
-        return resolveToolCwd("runner", runner, testFile, {
-            cwd: path.resolve(dispatchRoot),
-            rootMarkers: config.spawnCwdMarkers ?? config.configFiles,
-        });
-    }
     async runTestFileAsync(testFile, cwd, runnerOrRequest, legacyConfig) {
         const absoluteTestFile = path.resolve(testFile);
         let request;
@@ -1216,7 +1178,10 @@ export class TestRunnerClient {
             return this.emptyResult(absoluteTestFile, "", runner, "Test file not found");
         }
         try {
-            const spawnCwd = this.resolveSpawnCwd(runner, config, absoluteTestFile, cwd);
+            const spawnCwd = resolveToolCwd("runner", runner, absoluteTestFile, {
+                cwd: path.resolve(cwd),
+                rootMarkers: config.spawnCwdMarkers ?? config.configFiles,
+            }).cwd;
             const { command, args, env } = await this.resolveExec(runner, config, absoluteTestFile, cwd, spawnCwd);
             this.log(`Running (async): ${command} ${args.join(" ")} (cwd ${spawnCwd})`);
             const result = await safeSpawnAsync(command, args, {

package/node_modules/pi-lens/dist/clients/test-runner-delivery.js

@@ -8,9 +8,51 @@
  * delivery gate for this cache.
  */
 import { emitBounded } from "./bounded-telemetry.js";
+import { recordDegradationOnce } from "./degradation-ledger.js";
+import { logLatency } from "./latency-logger.js";
 import { consumeTestFindings, peekTestFindings } from "./runtime-context.js";
 const MAX_PENDING_DELIVERIES = 32;
 const pending = new Map();
+function logDeliveredVerdicts(cacheManager, cwd, runtime, delivery) {
+    const verdicts = cacheManager.readCache("test-runner-findings", cwd)?.data?.verdicts;
+    let knownCount = 0;
+    let staleCount = 0;
+    let unknownCount = 0;
+    for (const verdict of verdicts ?? []) {
+        const evidence = verdict.fileSeq ?? {
+            state: "unknown",
+            reason: "legacy-cache-record",
+        };
+        if (evidence.state === "unknown") {
+            unknownCount += 1;
+            recordDegradationOnce({
+                kind: "test-runner-delivery",
+                subject: `${delivery.sessionId}:${verdict.sourceFile}`,
+                reason: `missing file sequence evidence (${evidence.reason})`,
+            });
+            continue;
+        }
+        knownCount += 1;
+        const currentFileSeq = runtime.getFileSeq(verdict.sourceFile);
+        if (currentFileSeq > evidence.value)
+            staleCount += 1;
+    }
+    if (knownCount === 0 && unknownCount === 0)
+        return;
+    logLatency({
+        type: "phase",
+        phase: "test_runner_verdict_delivery",
+        filePath: cwd,
+        durationMs: 0,
+        metadata: {
+            sessionId: delivery.sessionId,
+            generation: delivery.generation,
+            verdictCount: knownCount,
+            staleCount,
+            unknownCount,
+        },
+    });
+}
 function key(cwd, sessionId, ownerId) {
     // `cwd` comes from the same host session field at turn_end and settle. Keep
     // that canonical value unchanged so cache reads use the identical workspace
@@ -221,6 +263,7 @@ export function consumeStagedTestRunnerFindings(args) {
         record(deliveryKey, "superseded", delivery, { currentGeneration });
         return undefined;
     }
+    logDeliveredVerdicts(args.cacheManager, args.cwd, args.runtime, delivery);
     const findings = consumeTestFindings(args.cacheManager, args.cwd, args.runtime);
     if (!findings) {
         pending.delete(deliveryKey);