@herbertgao/pi-extensions 2026.9.7 → 2026.9.9

package/node_modules/pi-jev-auto-mode/src/settings.ts

@@ -0,0 +1,327 @@
+/**
+ * Settings, policy notes, and the stored API key.
+ *
+ * Global settings live next to the rest of the Pi agent state
+ * (`$PI_CODING_AGENT_DIR` or `~/.pi/agent`). A project can override them from
+ * `<cwd>/<CONFIG_DIR_NAME>/jev-auto-mode.json`, but only for a trusted project:
+ * an untrusted checkout must not be able to loosen the gate that is judging it.
+ *
+ * The API key is not a setting. It goes to `<agentDir>/secrets/` as a `0600` file,
+ * which is where Pi keeps its own credentials, so that it is neither committed with
+ * a project nor readable by other users on the machine.
+ */
+
+import { chmod, mkdir, readFile, rename, rm, writeFile } from "node:fs/promises";
+import { dirname, join } from "node:path";
+
+export interface JevAutoModeSettings {
+  readonly enabled: boolean;
+  /** Per-attempt Jev timeout. Kept short: this is a gate, not a batch job. */
+  readonly timeoutMs: number;
+  /** Retries after the first attempt. */
+  readonly maxRetries: number;
+  /** Commands the user considers safe to run without a decision record. */
+  readonly safeCommands: readonly string[];
+  /** Commands that override a dangerous-pattern match; the override is recorded. */
+  readonly allowedCommands: readonly string[];
+  readonly disallowedCommands: readonly string[];
+  readonly extraProtectedPaths: readonly string[];
+  /** Shared state + questions budget guard, in characters. */
+  readonly maxStateCharacters: number;
+  /** What a middle-band judgment means. Default `allow`: no user confirmation. */
+  readonly uncertain: UncertainAction;
+  /**
+   * Which calls reach the semantic layer.
+   *
+   * `all` (the default) sends every call the deterministic layer cannot vouch for
+   * to Jev, so an unrecognised shape is still judged. `matched` only judges calls
+   * that match a dangerous-command pattern, which is the older denylist behaviour.
+   */
+  readonly gateScope: GateScope;
+  /**
+   * Per-rule probability thresholds, overriding the calibrated defaults.
+   *
+   * Keys are rule ids. An unknown key is kept but has no effect, so a typo is
+   * visible in `/jev-auto-mode threshold` instead of silently resetting the rule.
+   */
+  readonly thresholds: Readonly<Record<string, number>>;
+}
+
+export type SettingsScope = "global" | "project";
+
+/**
+ * How a judgment that lands in the middle band is resolved.
+ *
+ * `allow` (the default) keeps an auto mode useful: Jev blocks what it can clearly
+ * reject and lets an unclear answer through, so the gate never interrupts. `deny`
+ * is the conservative alternative for anyone who wants "not sure" to stop a call.
+ * `ask` hands the call to the user, which contradicts the point of an auto mode and
+ * is therefore not the default.
+ */
+export type UncertainAction = "deny" | "ask" | "allow";
+
+export const UNCERTAIN_ACTIONS: readonly UncertainAction[] = ["deny", "ask", "allow"];
+
+/**
+ * How far the semantic layer reaches.
+ *
+ * A denylist can only recognise the shapes someone thought of first: a request that
+ * uploads a file (`curl -d @...`) once ran with no judgment at all because no pattern
+ * described it. `all` inverts that: the deterministic layer names what it can vouch
+ * for, and everything else is judged.
+ */
+export type GateScope = "all" | "matched";
+
+export const GATE_SCOPES: readonly GateScope[] = ["all", "matched"];
+
+export function isGateScope(value: unknown): value is GateScope {
+  return typeof value === "string" && GATE_SCOPES.includes(value as GateScope);
+}
+
+export const DEFAULT_SETTINGS: JevAutoModeSettings = {
+  enabled: true,
+  timeoutMs: 4000,
+  maxRetries: 1,
+  safeCommands: [],
+  allowedCommands: [],
+  disallowedCommands: [],
+  extraProtectedPaths: [],
+  maxStateCharacters: 120_000,
+  uncertain: "allow",
+  gateScope: "all",
+  thresholds: {},
+};
+
+const MAX_PATTERN_ENTRIES = 200;
+const MAX_PATTERN_LENGTH = 300;
+const MAX_THRESHOLD_ENTRIES = 32;
+const MAX_RULE_ID_LENGTH = 64;
+const MAX_POLICY_NOTES_LENGTH = 8000;
+const CREDENTIAL_FILE_NAME = "jev-auto-mode-typesafe-api-key";
+/** Mirrors Pi's own secret directory/file modes. */
+const SECRET_DIRECTORY_MODE = 0o700;
+const SECRET_FILE_MODE = 0o600;
+const MIN_TIMEOUT_MS = 250;
+const MAX_TIMEOUT_MS = 60_000;
+const MAX_RETRIES = 5;
+
+/** A probability threshold must leave a middle band on both sides. */
+export const MIN_THRESHOLD = 0.5;
+export const MAX_THRESHOLD = 1;
+
+export interface StoreOptions {
+  /** Usually `~/.pi/agent`, honoring `PI_CODING_AGENT_DIR`. */
+  readonly agentDir: string;
+  /** Usually `.pi` (`CONFIG_DIR_NAME`). */
+  readonly configDirName: string;
+}
+
+export type SettingsPatch = { -readonly [K in keyof JevAutoModeSettings]?: JevAutoModeSettings[K] };
+
+function isRecord(value: unknown): value is Record<string, unknown> {
+  return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+
+/** Validate a single threshold value. Returns `undefined` when it is not usable. */
+export function parseThreshold(value: unknown): number | undefined {
+  if (typeof value !== "number" || !Number.isFinite(value)) return undefined;
+  if (value <= MIN_THRESHOLD || value > MAX_THRESHOLD) return undefined;
+  return value;
+}
+
+function readThresholds(value: unknown): Readonly<Record<string, number>> | undefined {
+  if (!isRecord(value)) return undefined;
+  const thresholds: Record<string, number> = {};
+  for (const [ruleId, raw] of Object.entries(value)) {
+    if (ruleId.length === 0 || ruleId.length > MAX_RULE_ID_LENGTH) continue;
+    const threshold = parseThreshold(raw);
+    if (threshold === undefined) continue;
+    thresholds[ruleId] = threshold;
+    if (Object.keys(thresholds).length >= MAX_THRESHOLD_ENTRIES) break;
+  }
+  return thresholds;
+}
+
+export function isUncertainAction(value: unknown): value is UncertainAction {
+  return typeof value === "string" && UNCERTAIN_ACTIONS.includes(value as UncertainAction);
+}
+
+function readBoundedInteger(value: unknown, min: number, max: number): number | undefined {
+  if (typeof value !== "number" || !Number.isFinite(value)) return undefined;
+  const rounded = Math.round(value);
+  if (rounded < min || rounded > max) return undefined;
+  return rounded;
+}
+
+function readStringArray(value: unknown): readonly string[] | undefined {
+  if (!Array.isArray(value)) return undefined;
+  return value
+    .filter((entry): entry is string => typeof entry === "string")
+    .map((entry) => entry.trim())
+    .filter((entry) => entry.length > 0 && entry.length <= MAX_PATTERN_LENGTH && !entry.includes("\n"))
+    .slice(0, MAX_PATTERN_ENTRIES);
+}
+
+/**
+ * Validate an untrusted settings file.
+ *
+ * Malformed values are dropped rather than replaced by a default: a broken
+ * project file must not be able to pin a value that overrides the global layer.
+ * Unknown fields are ignored too.
+ */
+export function parseSettingsPatch(value: unknown): SettingsPatch {
+  if (!value || typeof value !== "object" || Array.isArray(value)) return {};
+  const record = value as Record<string, unknown>;
+  const patch: SettingsPatch = {};
+
+  if (typeof record.enabled === "boolean") patch.enabled = record.enabled;
+
+  const timeoutMs = readBoundedInteger(record.timeoutMs, MIN_TIMEOUT_MS, MAX_TIMEOUT_MS);
+  if (timeoutMs !== undefined) patch.timeoutMs = timeoutMs;
+
+  const maxRetries = readBoundedInteger(record.maxRetries, 0, MAX_RETRIES);
+  if (maxRetries !== undefined) patch.maxRetries = maxRetries;
+
+  const maxStateCharacters = readBoundedInteger(record.maxStateCharacters, 1000, 1_000_000);
+  if (maxStateCharacters !== undefined) patch.maxStateCharacters = maxStateCharacters;
+
+  if (record.uncertain !== undefined && isUncertainAction(record.uncertain)) {
+    patch.uncertain = record.uncertain;
+  }
+
+  if (record.gateScope !== undefined && isGateScope(record.gateScope)) {
+    patch.gateScope = record.gateScope;
+  }
+
+  const safeCommands = record.safeCommands === undefined ? undefined : readStringArray(record.safeCommands);
+  if (safeCommands !== undefined) patch.safeCommands = safeCommands;
+
+  const allowedCommands = record.allowedCommands === undefined ? undefined : readStringArray(record.allowedCommands);
+  if (allowedCommands !== undefined) patch.allowedCommands = allowedCommands;
+
+  const disallowedCommands =
+    record.disallowedCommands === undefined ? undefined : readStringArray(record.disallowedCommands);
+  if (disallowedCommands !== undefined) patch.disallowedCommands = disallowedCommands;
+
+  const extraProtectedPaths =
+    record.extraProtectedPaths === undefined ? undefined : readStringArray(record.extraProtectedPaths);
+  if (extraProtectedPaths !== undefined) patch.extraProtectedPaths = extraProtectedPaths;
+
+  const thresholds = record.thresholds === undefined ? undefined : readThresholds(record.thresholds);
+  if (thresholds !== undefined) patch.thresholds = thresholds;
+
+  return patch;
+}
+
+export function mergeSettings(base: JevAutoModeSettings, patch: SettingsPatch): JevAutoModeSettings {
+  const merged = { ...base, ...patch };
+  // Thresholds merge per rule: a project file that retunes one condition must not
+  // wipe the global overrides for the others.
+  if (patch.thresholds !== undefined) {
+    merged.thresholds = { ...base.thresholds, ...patch.thresholds };
+  }
+  return merged;
+}
+
+async function readJsonFile(path: string): Promise<unknown> {
+  try {
+    return JSON.parse(await readFile(path, "utf8"));
+  } catch {
+    return undefined;
+  }
+}
+
+async function writeFileAtomic(path: string, contents: string): Promise<void> {
+  const temporary = `${path}.${process.pid}.${Date.now()}.tmp`;
+  await mkdir(dirname(path), { recursive: true });
+  await writeFile(temporary, contents, "utf8");
+  await rename(temporary, path);
+}
+
+export class JevAutoModeStore {
+  private readonly agentDir: string;
+  private readonly configDirName: string;
+
+  constructor(options: StoreOptions) {
+    this.agentDir = options.agentDir;
+    this.configDirName = options.configDirName;
+  }
+
+  globalSettingsPath(): string {
+    return join(this.agentDir, "jev-auto-mode.json");
+  }
+
+  projectSettingsPath(cwd: string): string {
+    return join(cwd, this.configDirName, "jev-auto-mode.json");
+  }
+
+  policyNotesPath(): string {
+    return join(this.agentDir, "jev-auto-mode-policy.md");
+  }
+
+  /** Global settings with the project override layered on top, when trusted. */
+  async loadSettings(cwd: string, projectTrusted: boolean): Promise<{ settings: JevAutoModeSettings; scope: SettingsScope }> {
+    const globalPatch = parseSettingsPatch(await readJsonFile(this.globalSettingsPath()));
+    if (!projectTrusted) {
+      return { settings: mergeSettings(DEFAULT_SETTINGS, globalPatch), scope: "global" };
+    }
+    const projectValue = await readJsonFile(this.projectSettingsPath(cwd));
+    const hasProjectSettings = projectValue !== undefined;
+    const projectPatch = parseSettingsPatch(projectValue);
+    return {
+      settings: mergeSettings(mergeSettings(DEFAULT_SETTINGS, globalPatch), projectPatch),
+      scope: hasProjectSettings ? "project" : "global",
+    };
+  }
+
+  async saveSettings(settings: JevAutoModeSettings, scope: SettingsScope, cwd: string): Promise<void> {
+    const path = scope === "project" ? this.projectSettingsPath(cwd) : this.globalSettingsPath();
+    await writeFileAtomic(path, `${JSON.stringify(settings, null, 2)}\n`);
+  }
+
+  /** User-authored policy notes. Advisory input to Jev, never a hard rule. */
+  async loadPolicyNotes(): Promise<string> {
+    try {
+      return (await readFile(this.policyNotesPath(), "utf8")).slice(0, MAX_POLICY_NOTES_LENGTH);
+    } catch {
+      return "";
+    }
+  }
+
+  async savePolicyNotes(notes: string): Promise<void> {
+    await writeFileAtomic(this.policyNotesPath(), notes.slice(0, MAX_POLICY_NOTES_LENGTH));
+  }
+
+  credentialPath(): string {
+    return join(this.agentDir, "secrets", CREDENTIAL_FILE_NAME);
+  }
+
+  async readStoredApiKey(): Promise<string | undefined> {
+    try {
+      const value = (await readFile(this.credentialPath(), "utf8")).trim();
+      return value.length > 0 ? value : undefined;
+    } catch {
+      return undefined;
+    }
+  }
+
+  /**
+   * Store the API key with owner-only permissions.
+   *
+   * `mode` on `writeFile` only applies when the file is created, so the mode is set
+   * again afterwards: an existing file with looser permissions is tightened rather
+   * than trusted.
+   */
+  async writeStoredApiKey(apiKey: string): Promise<void> {
+    const path = this.credentialPath();
+    const directory = dirname(path);
+    await mkdir(directory, { recursive: true, mode: SECRET_DIRECTORY_MODE });
+    await chmod(directory, SECRET_DIRECTORY_MODE).catch(() => undefined);
+    await writeFile(path, `${apiKey.trim()}\n`, { encoding: "utf8", mode: SECRET_FILE_MODE });
+    await chmod(path, SECRET_FILE_MODE).catch(() => undefined);
+  }
+
+  async deleteStoredApiKey(): Promise<void> {
+    await rm(this.credentialPath(), { force: true });
+  }
+}

package/node_modules/pi-jev-auto-mode/src/ui.ts

@@ -0,0 +1,233 @@
+/**
+ * Footer status and user-facing text.
+ *
+ * The status line is the only always-visible signal that a probabilistic gate is
+ * standing between the model and the shell, so it stays short but never silent:
+ * "off" and "no decision engine" are different states and are shown differently.
+ */
+
+import type { JevAutoModeSettings, SettingsScope } from "./settings.ts";
+import { DEFAULT_RULES, type JevRule } from "./jev/questions.ts";
+import { formatThreshold, observe } from "./jev/decide.ts";
+
+export const STATUS_ID = "jev-auto-mode";
+
+export interface StatusInput {
+  readonly enabled: boolean;
+  readonly engineId: string;
+  readonly scope: SettingsScope;
+}
+
+export function statusText(input: StatusInput): string {
+  if (!input.enabled) return "🛡 jev off";
+  const scope = input.scope === "project" ? "project" : "global";
+  return input.engineId === "manual" ? `🛡 jev no key (${scope})` : `🛡 jev (${scope})`;
+}
+
+export interface StatusContext {
+  readonly ui: { setStatus(key: string, value: string | undefined): void };
+}
+
+export function updateStatus(ctx: StatusContext, input: StatusInput): void {
+  ctx.ui.setStatus(STATUS_ID, statusText(input));
+}
+
+export function describeSettings(settings: JevAutoModeSettings, scope: SettingsScope): string {
+  return [
+    `enabled: ${settings.enabled}`,
+    `scope: ${scope}`,
+    `timeout: ${settings.timeoutMs}ms (retries ${settings.maxRetries})`,
+    `safe commands: ${settings.safeCommands.length}`,
+    `allowed commands: ${settings.allowedCommands.length}`,
+    `disallowed commands: ${settings.disallowedCommands.length}`,
+    `extra protected paths: ${settings.extraProtectedPaths.length}`,
+    `max state characters: ${settings.maxStateCharacters}`,
+    `uncertain band: ${settings.uncertain}`,
+    `gate scope: ${settings.gateScope}`,
+  ].join("\n");
+}
+
+/**
+ * A bounded rendering of a command, for dialogs.
+ *
+ * Pi's dialogs do not clip their content: a 60-line title fills the pane and pushes
+ * the dialog's own heading off screen, and opening and closing one per tool call
+ * makes the terminal scroll back and forth. So the preview is bounded here, and the
+ * full command stays where it already is — in the tool call above the dialog.
+ */
+export interface CommandPreview {
+  readonly lines: readonly string[];
+  readonly truncated: boolean;
+  readonly hiddenLines: number;
+  readonly hiddenCharacters: number;
+}
+
+export const DEFAULT_PREVIEW_LINES = 6;
+export const DEFAULT_PREVIEW_LINE_LENGTH = 120;
+
+export function previewCommand(
+  command: string,
+  options: { readonly maxLines?: number; readonly maxLineLength?: number } = {},
+): CommandPreview {
+  const maxLines = options.maxLines ?? DEFAULT_PREVIEW_LINES;
+  const maxLineLength = options.maxLineLength ?? DEFAULT_PREVIEW_LINE_LENGTH;
+
+  const all = command.split("\n");
+  const kept = all.slice(0, maxLines);
+  const lines = kept.map((line) => (line.length > maxLineLength ? `${line.slice(0, maxLineLength)}…` : line));
+  const hidden = all.slice(maxLines);
+
+  // A single 4000-character line has no hidden lines, but most of it was still cut.
+  const cutCharacters = kept.reduce((total, line, index) => total + Math.max(0, line.length - (lines[index]?.length ?? 0)), 0);
+  const hiddenCharacters = hidden.reduce((total, line) => total + line.length + 1, 0) + cutCharacters;
+
+  return {
+    lines,
+    truncated: hidden.length > 0 || cutCharacters > 0,
+    hiddenLines: hidden.length,
+    hiddenCharacters,
+  };
+}
+
+/** Cut a text block to a line budget, marking what was dropped. */
+export function clampLines(text: string, maxLines: number): string {
+  const lines = text.split("\n");
+  if (lines.length <= maxLines) return text;
+  return [...lines.slice(0, maxLines - 1), `… (${lines.length - maxLines + 1} more lines)`].join("\n");
+}
+
+export interface ConfirmationParts {
+  readonly tool: string;
+  readonly command?: string;
+  readonly path?: string;
+  readonly reasons: readonly string[];
+  readonly rationale: string;
+}
+
+/** The dialog shown when a judgment is delegated to the user. */
+export const CONFIRMATION_MAX_LINES = 14;
+
+export function buildConfirmationDialog(parts: ConfirmationParts): string {
+  const preview = parts.command === undefined ? undefined : previewCommand(parts.command);
+  const hiddenNote =
+    preview?.truncated === true
+      ? `… ${[
+          preview.hiddenLines > 0 ? `${preview.hiddenLines} more line(s)` : undefined,
+          `${preview.hiddenCharacters} more character(s)`,
+        ]
+          .filter(Boolean)
+          .join(", ")} — the full command is in the tool call above`
+      : undefined;
+
+  return clampLines(
+    [
+      "Jev auto mode wants confirmation before this runs.",
+      `Tool: ${parts.tool}`,
+      ...(preview?.lines ?? []),
+      ...(hiddenNote === undefined ? [] : [hiddenNote]),
+      ...(parts.path === undefined ? [] : [parts.path]),
+      "",
+      `Escalated: ${parts.reasons.join(", ")}`,
+      parts.rationale,
+    ].join("\n"),
+    CONFIRMATION_MAX_LINES,
+  );
+}
+
+export const USAGE_TEXT = [
+  "Usage:",
+  "  /jev-auto-mode                     show status",
+  "  /jev-auto-mode on|off              toggle auto mode",
+  "  /jev-auto-mode login|logout        store or remove the TypeSafe API key",
+  "  /jev-auto-mode policy              list the user policy notes",
+  "  /jev-auto-mode policy edit",
+  "  /jev-auto-mode policy clear",
+  "  /jev-auto-mode threshold           show thresholds and last observed probabilities",
+  "  /jev-auto-mode threshold <rule> <0.5-1.0>",
+  "  /jev-auto-mode threshold reset [rule]",
+  "  /jev-auto-mode threshold edit      pick a rule and type a value",
+  "  /jev-auto-mode uncertain            show what the middle band resolves to",
+  "  /jev-auto-mode uncertain deny|ask|allow",
+  "  /jev-auto-mode scope all|matched    which calls reach Jev",
+].join("\n");
+
+export const GATE_SCOPE_EXPLANATION = [
+  "How far the semantic layer reaches.",
+  "  all     - judge everything the deterministic layer cannot vouch for (default).",
+  "            Read-only commands, user-declared safe commands, and in-project",
+  "            unprotected edits stay on the fast path.",
+  "  matched - judge only calls that match a dangerous-command pattern. Faster,",
+  "            but a shape nobody wrote a pattern for runs unjudged.",
+].join("\n");
+
+export const UNCERTAIN_EXPLANATION = [
+  "The middle band is where Jev is neither satisfied nor rejecting.",
+  "  deny  - block it. No prompt, no screen takeover: Jev's probability is the answer.",
+  "  ask   - hand the call to the user. Opt-in, because it hands the decision back to a human.",
+  "  allow - let it through. Trusts the band; the least safe of the three.",
+].join("\n");
+
+export const POLICY_HEADER = [
+  "# Jev auto mode policy",
+  "",
+  "Free-form notes describing what this machine and these repositories allow.",
+  "They are reference material for the semantic judgment: they can justify an",
+  "approval, but they cannot override hard-deny rules.",
+].join("\n");
+
+/**
+ * The most recent judgment of one condition, kept for threshold tuning.
+ *
+ * Only the probability is stored. The band is recomputed against the *current*
+ * threshold, so changing a threshold immediately shows what the last judgment would
+ * have become — storing the band would leave a stale label next to a threshold that
+ * no longer produced it.
+ */
+export interface ObservedCondition {
+  readonly probability: number;
+  readonly at: number;
+}
+
+function pad(value: string, width: number): string {
+  return value.length >= width ? value : value + " ".repeat(width - value.length);
+}
+
+/**
+ * The tuning table.
+ *
+ * Showing the last observed probability next to each threshold is the whole point:
+ * a threshold cannot be chosen from a rule description, only from what the model
+ * actually answered for calls you care about. The band is recomputed against the
+ * current threshold, so the table doubles as a what-if view while tuning.
+ */
+export function formatRuleTable(
+  rules: readonly JevRule[] = DEFAULT_RULES,
+  overrides: Readonly<Record<string, number>> = {},
+  observed: ReadonlyMap<string, ObservedCondition> = new Map(),
+): string {
+  const header = `${pad("rule", 28)}${pad("mode", 10)}${pad("severity", 10)}${pad("threshold", 30)}last observed`;
+  const rows = rules.map((rule) => {
+    const override = overrides[rule.id];
+    const threshold = override ?? rule.threshold;
+    const origin = override === undefined ? "default" : `override (default ${formatThreshold(rule.threshold)})`;
+    // Recompute against the effective rule, not the default one: the point of the
+    // last-observed column is to answer "what would this answer mean now".
+    const effective = override === undefined ? rule : { ...rule, threshold: override };
+    return `${pad(rule.id, 28)}${pad(rule.mode, 10)}${pad(rule.severity, 10)}${pad(`${formatThreshold(threshold)} ${origin}`, 30)}${describeLast(effective, observed.get(rule.id))}`;
+  });
+
+  const unknown = Object.keys(overrides).filter((ruleId) => !rules.some((rule) => rule.id === ruleId));
+  if (unknown.length > 0) {
+    rows.push(`\noverride(s) that match no known rule: ${unknown.join(", ")}`);
+  }
+
+  return [header, ...rows].join("\n");
+}
+
+function describeLast(rule: JevRule, last: ObservedCondition | undefined): string {
+  if (!last) return "-";
+  const [observation] = observe([rule], { [rule.id]: last.probability });
+  const band = observation?.verdict ?? "uncertain";
+  const label = band === "uncertain" && observation?.effective === "satisfied" ? "ignored" : band;
+  return `p=${last.probability.toFixed(2)} (${label})`;
+}

package/node_modules/pi-lens/CHANGELOG.md

@@ -16,6 +16,51 @@ All notable changes to pi-lens will be documented in this file.
 
 ### Security
 
+## [4.2.1] - 2026-09-17
+
+### Added
+
+- **Carried cascade advisories and demoted delta rows now render with explicit age labels (refs #3167)** — a cascade result carried across a turn boundary renders `(carried 1 turn · scanned Xm ago)` from the run's own observation stamp (#1444's `publishedAt`, threaded to `CascadeRun.observedAt`), a coverage advisory computed entirely from carried indeterminate runs is labeled the same way on its own line, and a demoted delta file group closes with one scan-age line under that file's own header through `formatCacheAgeLabel` — so an agent can tell a just-observed finding from one re-served from cache. An absent or partial stamp renders `scan age unknown`, never a fabricated number. The two `partial` delivery-gate entries naming this gap resolve to full, and each carrying turn emits one bounded `cascade_carry_rendered` record.
+
+- **Stale carried findings are now re-verified against the live server before re-delivery (refs #3170)** — a deferred-origin finding whose file has not moved re-served turn after turn even when the root cause was fixed elsewhere (the #1093 cross-file class on the advisory lane). At turn_end, up to four such files per turn are re-observed through the probe's `touchFile` path (bounded by a wall budget and the turn's abort signal, both of which re-arm the rest for the next turn). A carried finding is dropped only when the touch itself completed its confirmation policy and no longer reports it; a silent, skipped or wedged answer keeps the finding verbatim and renders an explicit "(re-verify incomplete)" label in the turn-end advisory and in `lens_diagnostics` delta output — never a false clean. Findings sourced from an auxiliary scanner are left to their own lane rather than scored against a primary-scope answer. One `persistent_reverify` latency record per pass, carrying the candidate, touched, outcome and skip counts.
+
+### Fixed
+
+- **The widget `suppressed: N` chip keeps counting a marked finding (refs #3158)** — A finding marked `false-positive` or `suppress` stopped contributing to the pi-lens footer's `suppressed: N` chip as soon as any fresh `lens_diagnostics source=lsp` probe ran, because the probe hands the widget store the post-disposition filtered set and the store replaces a file's entries wholesale. Suppressed rows the latest scan no longer reports are now retained, and a suppressed row is no longer treated as a blocker anywhere — it cannot draw a red footer row, displace a live finding, or enter the turn-end blocker sweep. Known window: the retained row is retired by the file's next edit, even one that leaves the marked line unchanged and the mark still applying, and nothing re-creates it; the chip therefore counts a mark until that file is next edited rather than for as long as the mark stands.
+
+- **`lens_diagnostic_mark` widget cross-check missed mis-cased paths on case-insensitive filesystems (refs #3160)** — the #802 line-reanchor
+  cross-check looked up the raw, possibly mis-cased, mark target against
+  widget state, which is keyed case-preservingly on POSIX; on a
+  case-insensitive filesystem (macOS APFS, `nocase` vfat/ntfs3/cifs) this
+  silently missed the live diagnostic and fell back to the fuzzy line guess.
+  The lookup now normalizes the path to on-disk casing before checking
+  widget state. `pilens_analyze` also recorded diagnostics under the raw,
+  un-normalized spelling of its agent-supplied `file` argument, so it now
+  normalizes on write too — both sides key on-disk casing consistently. The
+  `lsp_diagnostics`/`lens_diagnostics(source: "lsp", scope: "paths")`
+  explicit-`paths` batch had the same raw-key write for a mis-cased entry
+  (refs #3182); it now normalizes on write as well.
+
+- **`guard-bash` refuses `git worktree remove` on a tree whose `node_modules` is a symlink into another checkout (refs #3173)** — twice on 2026-09-16 a fixer removed a worktree whose `node_modules` was symlinked to the shared checkout (the fixer playbook's own speed convention), and git followed the link and emptied the shared install, breaking every other agent building or testing in that window. The PreToolUse hook now denies (exit 2) ANY `git worktree remove <tree>` — force or not — when `<tree>` is a real linked git worktree and its `node_modules` entry is a symlink whose target resolves outside `<tree>`; the stderr note names the fix (`rm <tree>/node_modules`, then retry). A path that does not exist, is not a git worktree, or whose `node_modules` is a real directory (or a symlink that stays inside the worktree) is left to git.
+
+- **The tests-tree write guard no longer crashes the Unit tests job on a scratch-directory race (refs #3179)** — `tests/support/tests-tree-write-guard-setup.ts` armed a recursive `fs.watch` over `tests/` with no `'error'` listener. On Linux, node's recursive watch is a JS polyfill that re-scans a changed subfolder with a synchronous `readdirSync`; when `tests/index-2992-integration.test.ts` removed its own exempt scratch directory (`tests/support/.index-2992-scratch`) between the change event and that rescan, the polyfill emitted an unhandled `'error'` event and killed the whole vitest process with exit 1 and no failing test. The guard now attaches an `'error'` handler that swallows ENOENT for paths under its existing exempt prefixes and records any other error once via `console.warn`, never per event.
+
+- **A tool path with `/../` in it no longer orphans its own diagnostics record (refs #3184)** — `normalizeMapKey`, the canonical map-key normalizer, passed dot segments through unchanged on macOS and Linux whenever the path's casing was already right, so an absolute path containing `/../` (or `/./`, or a doubled separator) keyed under a spelling no other writer or reader ever derives. A `lens_diagnostic_mark`, `pilens_analyze` or `lens_diagnostics {source:"lsp"}` call typed that way produced an orphan widget row, a missed line reanchor and a split disposition anchor. The POSIX arm now folds dot segments before it looks at casing, so every consumer inherits one key per file; the fold is pure string algebra, so a relative path is still never resolved against the process working directory. The `lsp_diagnostics` single-`path` mode, which derives its key without that normalizer, was folded onto the same expression its `paths` batch already uses.
+
+- **`tmp-fixture-hygiene`'s governance owner attributed another test file's async-recreated directory to itself (refs #3186)** — PR #3168's CI run redded `tests/config/tmp-fixture-hygiene.test.ts` over `pi-lens-tool-policy-conventions-*` directories owned by `tests/clients/tool-policy-conventions.test.ts`. That file's `afterEach` removed its `setupTestEnvironment` directory synchronously while `saveProjectSnapshot` (called from within the test) was still mid-flight: its body persist is dispatched to a worker thread / main-thread fallback the caller never awaited, and that persist's write path recreates the just-removed directory via a recursive `mkdir` — measured directly landing ~10-50ms later, unforced, on a bare invocation of the real function. Fixed at the producer: the `afterEach` now awaits the repo's own `waitForProjectSnapshotPersistsForTests()` drain seam before cleanup, the same seam five other test files already use for this, closing the race instead of admitting its symptom in the tmp-hygiene baseline.
+
+- **A cold diagnostics sweep no longer burns its whole warm-up budget on a silent TypeScript server (closes #3187)** — The shared pre-sweep warm-up (`LSPService.ensureWarmForSweep`) touches a representative file to prove the server can answer, and that touch collects nothing. The tsserver sync clean-confirm race was gated on a collecting touch, so on a project whose classic typescript-language-server publishes nothing for clean files the warm-up could only reach a verdict by waiting out its entire cold-start budget — measured on a real session at 6,972 ms of a 20,000 ms budget, and on a fake tier3-silent server through the real service at 4,509 ms (initial attempt plus the retry) against 308 ms after the fix. The warm-up is now eligible for the sync confirm on its own identity while still collecting nothing, so it neither primes nor erases the file's last-known diagnostics, and a server that does not offer the sync commands still certifies through the existing silent-clean fallback instead of failing warm-up and skipping the sweep group.
+
+- **No more `🔴 STOP — 0 issue(s) must be fixed:` with nothing under it (refs [#3188](https://github.com/apmantza/pi-lens/issues/3188))** — When #2028's deleted-path gate retracted *every* blocker — the common shape being a bash command that writes a file and deletes it again (`cat > probe.py … ; rm probe.py`), whose recovered path the per-edit pipeline still analyses — the readback-failed re-render path emitted the STOP header with a count of zero and an empty body, so the agent read a "must be fixed" imperative naming no finding and no file. The external reporter measured 154 of 159 of their banners in that zero form. The blocker renderer now returns nothing when it has no blockers (the same guard `formatDiagnostics` already carries), and the re-render path no longer appends a bare separator, which would still have been delivered as a whitespace-only tool-result block. A partial retraction is unchanged: the surviving blockers render with their own count, and the coverage/auto-fix tail after the blocker section is still delivered. The existing bounded `finding_dead_path_drop` record (`store=stop-blocker`, `deliveredCount=0`) is unchanged and remains the way a total retraction is observed.
+
+- **Tool schemas survive registration on hosts with callable schemas (closes #3195)** — On a host whose `typebox` specifier resolves to an ArkType-style builder — `@oh-my-pi/pi-coding-agent` (the `@oh-my-pi/omptype` shim it rewrites an extension's `typebox` import to), and any other host whose schema builders return callables — every pi-lens tool lost its parameter schema at registration: the console-capture seam replaced each function-valued property of a tool definition with a capture wrapper, and a schema is itself a function there. All 13 tools then rendered `type Args = unknown;` and rejected every `xd://` call with `root: schema must be an object or boolean`. Callable schemas are now handed to the host untouched, using the host's own `isArkSchema` test, while `execute`, `renderResult` and command handlers keep their console-capture window. Hosts whose schemas are plain objects (`@earendil-works/pi-coding-agent`) are unaffected.
+
+- **`mode=delta` no longer renders a file's quality (or project-diagnostics) rows under another file's header (refs #3196)** — `formatDeltaMode`'s quality loop and `appendProjectDiagnosticsDeltaLines` both suppressed a file's header with `if (!lines.includes(rel)) lines.push(rel)`, true whenever an earlier tier already pushed that exact path — but each tier's rows were appended to the END of the shared buffer, not under that earlier header. A file present in more than one report (actionable, quality, or project) had its later tier's rows, and any age/re-verify-incomplete label describing them, land under whichever OTHER file's header happened to be last in the buffer, misdirecting an agent acting on the finding. The render is now a single pass grouped by file: every tier appends into that file's own bucket, which makes the header-membership guess (and #3168's label-prediction dedupe) unnecessary — both are removed.
+
+- **`mutation (advisory)` no longer false-reds on `scripts/with-memory-watch.mjs` (closes #3108)** — its two source-text pins in `tests/scripts/with-memory-watch.test.ts` matched only the un-instrumented wrapper, so Stryker's in-place `// @ts-nocheck` + switch-mutant scaffolding (added even with no mutant active) failed the dry run on every PR that edited the file. The pins now tolerate that optional wrapper and still red when the pinned code is genuinely removed.
+
+- **The skills-directory degradation record no longer drops which entry file triggered it (refs #3175)** — when `resources_discover`'s `skills/` lookup misses, the ledger's `reason` field concatenated a classification that repeats `skillsDir` (already recorded verbatim in `subject`) ahead of the entry file's directory — the one fact the record uniquely carries for diagnosing a managed-cache-relocated entry (#2587). Once the shared root was long enough that the two exceeded the ledger's 200-char cap (a real dry-roll/CI-lane TMPDIR shape), the head-preserving truncation kept the redundant path and silently dropped the entry directory. The ledger's copy of the reason now uses a short, path-free classification tag instead, leaving room for the entry directory to survive intact; the user-facing notification is unaffected.
+
 ## [4.2.0] - 2026-09-16
 
 ### Added