pi-lens 3.8.37 → 3.8.39

package/CHANGELOG.md

@@ -4,6 +4,27 @@ All notable changes to pi-lens will be documented in this file.
 
 ## [Unreleased]
 
+## [3.8.39] - 2026-05-02
+
+### Fixed
+
+- **Context injection now prepends guidance before the user prompt** — pi-lens previously appended session guidance after the user's message; provider bridges that treat the last message as the active user action would demote the real request. Guidance is now prepended so the user's prompt stays last. (PR #48 by @tifandotme)
+- **jscpd no longer runs on YAML/JSON/Markdown files** — `getFilesForJscpd` now filters to source code extensions only, preventing multi-second delays at `turn_end` when editing rule YAMLs or config files.
+- **ReDoS S5852 final (gleam/zig parsers)** — rewrote `gleamRe` and `zigRe` as line-by-line parsers, eliminating the multiline flag that SonarCloud continued to flag despite `[ \t]*` substitution.
+- **SonarCloud MAJOR code smells (batch 1 & 2)** — `readonly` members, `void` operator removals, nested ternaries, nested template literals, optional chains, duplicate branches, and redundant type alias across 15+ files.
+- **9 tree-sitter query bugs in new rule files** — predicate outside outermost parens (`cpp/no-auto-ptr`); false-positive `post_filter` gate added (`cpp/no-confused-move-forward`); leaf-node child match removed (`php/this-in-static-context`); invalid node name `class_hereditary` replaced (`java/no-field-shadowing`); field order corrected (`java/no-wait-notify-on-thread`); duplicate `modifiers` blocks merged (`java/spring-session-attributes-setcomplete`); invalid anonymous-node field label removed (`csharp/is-with-this`); inline alternation replaced with two patterns (`python/in-operator-unsupported`); adjacent sibling requirement removed, delegated to `post_filter` (`python/return-in-generator`).
+
+## [3.8.38] - 2026-05-02
+
+### Added
+
+- **`RuleCache` respects `PILENS_DATA_DIR`** — tree-sitter rule cache files are now stored under `getProjectDataDir(rootDir)` instead of `<cwd>/.pi-lens/cache`, consistent with all other pi-lens data files. Projects using `PILENS_DATA_DIR` no longer get a stray `.pi-lens` directory created in the project root. (PR #47 by @tifandotme)
+
+### Fixed
+
+- **ReDoS: `gleamRe` and `zigRe` compiler parsers** — residual `\s*` quantifiers (which match `\n` in JS) replaced with `[ \t]*` to eliminate cross-line backtracking. Completes the SonarCloud S5852 remediation started in 3.8.37.
+- **Test env leak in `file-utils.test.ts`** — `PILENS_DATA_DIR` is now saved and restored in a `finally` block so it doesn't bleed into subsequent tests in the suite.
+
 ## [3.8.37] - 2026-05-02
 
 ### Fixed

package/README.md

@@ -1,5 +1,5 @@
 <p align="center">
-  <img src="https://raw.githubusercontent.com/apmantza/pi-lens/master/banner.svg" alt="pi-lens" width="1100">
+  <img src="https://raw.githubusercontent.com/apmantza/pi-lens/master/banner.png" alt="pi-lens" width="1100">
 </p>
 
 # pi-lens
@@ -41,7 +41,7 @@ At `session_start`, pi-lens:
 - applies language-aware startup defaults for tool preinstall
 - warms caches and optional indexes (with overlap/session guardrails)
 - emits missing-tool install hints for detected languages when relevant
-- injects session guidance through internal context (non-user channel) to reduce acknowledgement-only first responses
+- prepends session guidance before the user's prompt so provider bridges keep the real prompt active
 - opens `warmFiles` (if configured in `.pi-lens/lsp.json`) to seed lazy-indexing language servers like clangd before the first symbol query
 
 For one-shot print sessions (for example `pi --print ...`), pi-lens auto-uses a quick startup path that skips heavy bootstrap work to reduce startup latency. Override with `PI_LENS_STARTUP_MODE=full|minimal|quick`.

package/banner.svg

@@ -1,4 +1,4 @@
-<svg width="1100" height="280" viewBox="0 0 1100 280" xmlns="http://www.w3.org/2000/svg">
+<svg width="1100" height="310" viewBox="0 0 1100 310" xmlns="http://www.w3.org/2000/svg">
   <defs>
     <linearGradient id="bg" x1="0%" y1="0%" x2="100%" y2="100%">
       <stop offset="0%" stop-color="#0d1117"/>
@@ -13,26 +13,26 @@
       <stop offset="100%" stop-color="#2f81f700"/>
     </linearGradient>
     <clipPath id="bounds">
-      <rect width="1100" height="280" rx="12"/>
+      <rect width="1100" height="310" rx="12"/>
     </clipPath>
   </defs>
 
   <!-- Background -->
-  <rect width="1100" height="280" fill="url(#bg)" rx="12"/>
+  <rect width="1100" height="310" fill="url(#bg)" rx="12"/>
 
   <!-- Top accent line -->
   <rect x="0" y="0" width="1100" height="3" fill="url(#accent)" rx="1.5" clip-path="url(#bounds)"/>
 
   <!-- Decorative aperture rings (right side) -->
   <g opacity="0.07" clip-path="url(#bounds)">
-    <circle cx="920" cy="140" r="180" fill="none" stroke="#2f81f7" stroke-width="1.5"/>
-    <circle cx="920" cy="140" r="145" fill="none" stroke="#2f81f7" stroke-width="1"/>
-    <circle cx="920" cy="140" r="110" fill="none" stroke="#2f81f7" stroke-width="1"/>
-    <circle cx="920" cy="140" r="75"  fill="none" stroke="#2f81f7" stroke-width="1"/>
-    <line x1="740" y1="140" x2="1100" y2="140" stroke="#2f81f7" stroke-width="0.8"/>
-    <line x1="920" y1="-40"  x2="920"  y2="320"  stroke="#2f81f7" stroke-width="0.8"/>
-    <line x1="793" y1="13"   x2="1047" y2="267"  stroke="#2f81f7" stroke-width="0.6"/>
-    <line x1="1047" y1="13"  x2="793"  y2="267"  stroke="#2f81f7" stroke-width="0.6"/>
+    <circle cx="920" cy="155" r="180" fill="none" stroke="#2f81f7" stroke-width="1.5"/>
+    <circle cx="920" cy="155" r="145" fill="none" stroke="#2f81f7" stroke-width="1"/>
+    <circle cx="920" cy="155" r="110" fill="none" stroke="#2f81f7" stroke-width="1"/>
+    <circle cx="920" cy="155" r="75"  fill="none" stroke="#2f81f7" stroke-width="1"/>
+    <line x1="740" y1="155" x2="1100" y2="155" stroke="#2f81f7" stroke-width="0.8"/>
+    <line x1="920" y1="-40"  x2="920"  y2="350"  stroke="#2f81f7" stroke-width="0.8"/>
+    <line x1="793" y1="28"   x2="1047" y2="282"  stroke="#2f81f7" stroke-width="0.6"/>
+    <line x1="1047" y1="28"  x2="793"  y2="282"  stroke="#2f81f7" stroke-width="0.6"/>
   </g>
 
   <!-- Lens icon -->
@@ -53,7 +53,7 @@
   <!-- Tagline -->
   <text x="261" y="164" font-family="-apple-system, BlinkMacSystemFont, 'Segoe UI', Helvetica, sans-serif" font-size="21" font-weight="400" fill="#8b949e" letter-spacing="0.3">Real-time code intelligence for AI agents</text>
 
-  <!-- Feature pills -->
+  <!-- Feature pills — row 1 -->
   <g font-family="-apple-system, BlinkMacSystemFont, 'Segoe UI', Helvetica, sans-serif" font-size="12" font-weight="500">
     <rect x="261" y="196" width="56"  height="24" rx="12" fill="#2f81f715" stroke="#2f81f740" stroke-width="1"/>
     <text x="289" y="213" fill="#58a6ff" text-anchor="middle">LSP</text>
@@ -64,10 +64,25 @@
     <rect x="405" y="196" width="90"  height="24" rx="12" fill="#2f81f715" stroke="#2f81f740" stroke-width="1"/>
     <text x="450" y="213" fill="#58a6ff" text-anchor="middle">Formatters</text>
 
-    <rect x="505" y="196" width="152" height="24" rx="12" fill="#2f81f715" stroke="#2f81f740" stroke-width="1"/>
-    <text x="581" y="213" fill="#58a6ff" text-anchor="middle">Structural Analysis</text>
+    <rect x="505" y="196" width="84"  height="24" rx="12" fill="#2f81f715" stroke="#2f81f740" stroke-width="1"/>
+    <text x="547" y="213" fill="#58a6ff" text-anchor="middle">Auto-Fix</text>
 
-    <rect x="667" y="196" width="96"  height="24" rx="12" fill="#2f81f715" stroke="#2f81f740" stroke-width="1"/>
-    <text x="715" y="213" fill="#58a6ff" text-anchor="middle">Read-Guard</text>
+    <rect x="599" y="196" width="100" height="24" rx="12" fill="#2f81f715" stroke="#2f81f740" stroke-width="1"/>
+    <text x="649" y="213" fill="#58a6ff" text-anchor="middle">Read-Guard</text>
+  </g>
+
+  <!-- Feature pills — row 2 -->
+  <g font-family="-apple-system, BlinkMacSystemFont, 'Segoe UI', Helvetica, sans-serif" font-size="12" font-weight="500">
+    <rect x="261" y="228" width="152" height="24" rx="12" fill="#2f81f715" stroke="#2f81f740" stroke-width="1"/>
+    <text x="337" y="245" fill="#58a6ff" text-anchor="middle">Structural Analysis</text>
+
+    <rect x="423" y="228" width="96"  height="24" rx="12" fill="#2f81f715" stroke="#2f81f740" stroke-width="1"/>
+    <text x="471" y="245" fill="#58a6ff" text-anchor="middle">Cascade</text>
+
+    <rect x="529" y="228" width="100" height="24" rx="12" fill="#2f81f715" stroke="#2f81f740" stroke-width="1"/>
+    <text x="579" y="245" fill="#58a6ff" text-anchor="middle">Tree-sitter</text>
+
+    <rect x="639" y="228" width="96"  height="24" rx="12" fill="#2f81f715" stroke="#2f81f740" stroke-width="1"/>
+    <text x="687" y="245" fill="#58a6ff" text-anchor="middle">ast-grep</text>
   </g>
 </svg>

package/clients/cache/rule-cache.ts

@@ -8,6 +8,7 @@
 import * as crypto from "node:crypto";
 import * as fs from "node:fs";
 import * as path from "node:path";
+import { getProjectDataDir } from "../file-utils.js";
 
 const CACHE_VERSION = "v1";
 
@@ -34,7 +35,7 @@ export class RuleCache {
 	private cacheDir: string;
 
 	constructor(language: string, rootDir = process.cwd()) {
-		this.cacheDir = path.join(rootDir, ".pi-lens", "cache");
+		this.cacheDir = path.join(getProjectDataDir(rootDir), "cache");
 		this.cacheFile = path.join(
 			this.cacheDir,
 			`${language}-rules-${CACHE_VERSION}.json`,

package/clients/cache-manager.ts

@@ -307,10 +307,13 @@ export class CacheManager {
 
 	/**
 	 * Get files that need jscpd re-scan (any edit).
+	 * Only returns source code files jscpd can meaningfully analyse.
 	 */
 	getFilesForJscpd(cwd: string): string[] {
 		const state = this.readTurnState(cwd);
-		return Object.keys(state.files);
+		return Object.keys(state.files).filter((f) =>
+			/\.(ts|tsx|js|jsx|mjs|cjs|py|go|rs|rb|java|cs|php|cpp|c|h|hpp|swift|kt)$/.test(f),
+		);
 	}
 
 	/**

package/clients/dispatch/fact-scheduler.ts

@@ -61,7 +61,8 @@ export function scheduleProviders(providers: FactProvider[]): FactProvider[] {
         }
       }
     }
-    wave = nextWave.sort((a, b) => a.id.localeCompare(b.id));
+    nextWave.sort((a, b) => a.id.localeCompare(b.id));
+    wave = nextWave;
   }
 
   if (result.length < providers.length) {

package/clients/dispatch/fact-store.ts

@@ -1,7 +1,5 @@
 import { normalizeMapKey } from "../path-utils.js";
 
-type FactValue = unknown;
-
 export interface ReadonlyFactStore {
   getFileFact<T>(filePath: string, factId: string): T | undefined;
   hasFileFact(filePath: string, factId: string): boolean;
@@ -10,8 +8,8 @@ export interface ReadonlyFactStore {
 }
 
 export class FactStore implements ReadonlyFactStore {
-  private readonly fileFacts = new Map<string, Map<string, FactValue>>();
-  private readonly sessionFacts = new Map<string, FactValue>();
+  private readonly fileFacts = new Map<string, Map<string, unknown>>();
+  private readonly sessionFacts = new Map<string, unknown>();
 
   // All file-keyed methods normalize the path internally via normalizeMapKey().
   // Callers always pass raw/resolved paths — normalization is not their concern.
@@ -20,7 +18,7 @@ export class FactStore implements ReadonlyFactStore {
     return this.fileFacts.get(normalizeMapKey(filePath))?.get(factId) as T | undefined;
   }
 
-  setFileFact(filePath: string, factId: string, value: FactValue): void {
+  setFileFact(filePath: string, factId: string, value: unknown): void {
     const key = normalizeMapKey(filePath);
     let facts = this.fileFacts.get(key);
     if (!facts) {
@@ -51,7 +49,7 @@ export class FactStore implements ReadonlyFactStore {
     return this.sessionFacts.get(factId) as T | undefined;
   }
 
-  setSessionFact(factId: string, value: FactValue): void {
+  setSessionFact(factId: string, value: unknown): void {
     this.sessionFacts.set(factId, value);
   }
 

package/clients/dispatch/integration.ts

@@ -479,7 +479,7 @@ export async function computeCascadeForFile(
 		.filter((n) => !primaryFilesThisTurn.has(normalizeMapKey(n)))
 		.sort((a, b) => {
 			const rank = (p: string) =>
-				importerSet.has(p) ? 0 : callerSet.has(p) ? 1 : 2;
+				importerSet.has(p) ? 0 : (callerSet.has(p) ? 1 : 2);
 			return rank(a) - rank(b);
 		})
 		.slice(0, MAX_FILES);
@@ -584,10 +584,7 @@ export async function computeCascadeForFile(
 				// write sequence. A new write (higher writeSeq) invalidates the cache entry.
 				const cached =
 					writeSeq != null ? neighborTouchCache.get(cacheKey) : undefined;
-				if (
-					cached != null &&
-					cached.turnSeq === turnSeq
-				) {
+				if (cached?.turnSeq === turnSeq) {
 					producedLspData = true;
 					const durationMs = Date.now() - neighborStart;
 					logCascade({

package/clients/dispatch/rules/quality-rules.ts

@@ -149,21 +149,16 @@ export const noBooleanParamsRule: FactRule = {
 					ts.isIdentifier(param.name) ? param.name.text : "";
 				if (BOOLEAN_PREFIX_OK.test(name)) continue;
 
-				let isBoolean = false;
-				if (param.type.kind === ts.SyntaxKind.BooleanKeyword) {
-					isBoolean = true;
-				} else if (
-					ts.isUnionTypeNode(param.type) &&
-					param.type.types.every(
-						(t) =>
-							t.kind === ts.SyntaxKind.BooleanKeyword ||
-							(ts.isLiteralTypeNode(t) &&
-								(t.literal.kind === ts.SyntaxKind.TrueKeyword ||
-									t.literal.kind === ts.SyntaxKind.FalseKeyword)),
-					)
-				) {
-					isBoolean = true;
-				}
+				const isBoolean =
+					param.type.kind === ts.SyntaxKind.BooleanKeyword ||
+					(ts.isUnionTypeNode(param.type) &&
+						param.type.types.every(
+							(t) =>
+								t.kind === ts.SyntaxKind.BooleanKeyword ||
+								(ts.isLiteralTypeNode(t) &&
+									(t.literal.kind === ts.SyntaxKind.TrueKeyword ||
+										t.literal.kind === ts.SyntaxKind.FalseKeyword)),
+						));
 
 				if (!isBoolean) continue;
 				const { line, character } = sf.getLineAndCharacterOfPosition(param.getStart(sf));

package/clients/dispatch/runners/biome-check.ts

@@ -134,7 +134,7 @@ const biomeCheckJsonRunner: RunnerDefinition = {
 				diagnostics: [
 					{
 						id: "biome:parse-error:1",
-						message: `Biome JSON parse failed: ${parsed.parseError}${preview ? ` (output preview: ${preview})` : ""}`,
+						message: "Biome JSON parse failed: " + parsed.parseError + (preview ? " (output preview: " + preview + ")" : ""),
 						filePath: ctx.filePath,
 						line: 1,
 						column: 1,

package/clients/dispatch/runners/eslint.ts

@@ -125,7 +125,7 @@ const eslintRunner: RunnerDefinition = {
 				diagnostics: [
 					{
 						id: "eslint:parse-error:1",
-						message: `ESLint JSON parse failed: ${parsed.parseError}${preview ? ` (output preview: ${preview})` : ""}`,
+						message: "ESLint JSON parse failed: " + parsed.parseError + (preview ? " (output preview: " + preview + ")" : ""),
 						filePath: ctx.filePath,
 						line: 1,
 						column: 1,

package/clients/dispatch/runners/lsp.ts

@@ -212,11 +212,7 @@ const lspRunner: RunnerDefinition = {
 		);
 
 		const hasErrors = diagnostics.some((d) => d.semantic === "blocking");
-		const resultSemantic = hasErrors
-			? "blocking"
-			: diagnostics.length > 0
-				? "warning"
-				: "none";
+		const resultSemantic = hasErrors ? "blocking" : (diagnostics.length > 0 ? "warning" : "none");
 
 		return {
 			status: hasErrors ? "failed" : "succeeded",

package/clients/dispatch/runners/psscriptanalyzer.ts

@@ -86,7 +86,7 @@ function parsePSAnalyzerOutput(raw: string, filePath: string): Diagnostic[] {
 		.map((item) => {
 			const sev = (item.Severity ?? "Warning").toLowerCase();
 			const severity: "error" | "warning" | "info" =
-				sev === "error" || sev === "parseerror" ? "error" : sev === "information" ? "info" : "warning";
+				(sev === "error" || sev === "parseerror") ? "error" : (sev === "information" ? "info" : "warning");
 			const rule = item.RuleName ?? "PSScriptAnalyzer";
 			return {
 				id: `psscriptanalyzer-${rule}-${item.Line}`,

package/clients/dispatch/runners/similarity.ts

@@ -394,10 +394,7 @@ function getArrowSignature(
 		| import("typescript").ArrowFunction
 		| import("typescript").FunctionExpression,
 ): string {
-	const params = node.parameters
-		.map((p) => (tsModule.isIdentifier(p.name) ? p.name.text : "param"))
-		.join(", ");
-	return `(${params})`;
+	return getSignature(tsModule, node as unknown as import("typescript").FunctionDeclaration);
 }
 
 // ============================================================================

package/clients/dispatch/utils/lsp-diagnostics.ts

@@ -16,16 +16,10 @@ export function convertLspDiagnostics(
 	return diags
 		.filter((d) => d.range?.start?.line !== undefined)
 		.map((d, idx) => {
-			const severity =
-				d.severity === 1
-					? "error"
-					: d.severity === 2
-						? "warning"
-						: d.severity === 4
-							? "hint"
-							: "info";
+			const severityMap: Record<number, "error" | "warning" | "hint"> = { 1: "error", 2: "warning", 4: "hint" };
+			const severity: "error" | "warning" | "info" | "hint" = severityMap[d.severity] ?? "info";
 			const semantic =
-				d.severity === 1 ? "blocking" : d.severity === 2 ? "warning" : "none";
+				d.severity === 1 ? "blocking" : (d.severity === 2 ? "warning" : "none");
 			const code = String(d.code ?? "unknown");
 			const source = options.source ?? d.source ?? tool;
 			const hasSuggestion = options.fixSuggestionByIndex?.has(idx) ?? false;

package/clients/formatters.ts

@@ -54,7 +54,7 @@ async function tryLazyInstallFormatterTool(
 		const ok = !res.error && res.status === 0;
 		if (!ok) {
 			console.error(
-				`[format] lazy-install rubocop failed: ${res.error?.message ?? res.stderr ?? `exit ${res.status}`}`,
+				`[format] lazy-install rubocop failed: ${res.error?.message ?? res.stderr ?? "exit " + res.status}`,
 			);
 		}
 		return ok;
@@ -67,7 +67,7 @@ async function tryLazyInstallFormatterTool(
 	const ok = !res.error && res.status === 0;
 	if (!ok) {
 		console.error(
-			`[format] lazy-install rustfmt failed: ${res.error?.message ?? res.stderr ?? `exit ${res.status}`}`,
+			`[format] lazy-install rustfmt failed: ${res.error?.message ?? res.stderr ?? "exit " + res.status}`,
 		);
 	}
 	return ok;
@@ -919,11 +919,16 @@ export async function getFormattersForFile(
 
 	const enabled = selected ? [selected] : [];
 
-	const selectionReason = selected
-		? (formatterPolicy
-			? (candidateFormatters.some((f) => hasExplicitFormatterConfig(f.name, cwd)) ? "explicit-config" : "smart-default")
-			: "detect")
-		: "none";
+	let selectionReason: string;
+	if (!selected) {
+		selectionReason = "none";
+	} else if (!formatterPolicy) {
+		selectionReason = "detect";
+	} else {
+		selectionReason = candidateFormatters.some((f) => hasExplicitFormatterConfig(f.name, cwd))
+			? "explicit-config"
+			: "smart-default";
+	}
 	logLatency({
 		type: "phase",
 		phase: "formatter_selected",

package/clients/lsp/index.ts

@@ -135,13 +135,13 @@ export interface LSPTouchFileOptions {
 
 export class LSPService {
 	private state: LSPState;
-	private workspaceProbeLogged = new Set<string>();
-	private warmStartLogged = new Set<string>();
-	private optionalFailureLogged = new Set<string>();
-	private optionalDisabled = new Set<string>();
+	private readonly workspaceProbeLogged = new Set<string>();
+	private readonly warmStartLogged = new Set<string>();
+	private readonly optionalFailureLogged = new Set<string>();
+	private readonly optionalDisabled = new Set<string>();
 	/** Consecutive failure counts for exponential backoff circuit breaker */
-	private failureCounts = new Map<string, number>();
-	private recentTouches = new Map<
+	private readonly failureCounts = new Map<string, number>();
+	private readonly recentTouches = new Map<
 		string,
 		{ fingerprint: string; touchedAt: number; clientScope: "primary" | "all" }
 	>();
@@ -309,7 +309,7 @@ export class LSPService {
 			if (!root) continue;
 			const key = `${server.id}:${normalizeMapKey(root)}`;
 			const existing = this.state.clients.get(key);
-			if (existing && existing.isAlive()) {
+			if (existing?.isAlive()) {
 				return { client: existing, info: server };
 			}
 		}
@@ -392,9 +392,7 @@ export class LSPService {
 		}
 	}
 
-	private shouldAllowInstall(filePath: string, root: string): boolean {
-		void filePath;
-		void root;
+	private shouldAllowInstall(_filePath: string, _root: string): boolean {
 		return process.env.PI_LENS_DISABLE_LSP_INSTALL !== "1";
 	}
 

package/clients/lsp/launch.ts

@@ -402,7 +402,7 @@ function _attachErrorHandler(
 	proc.on("error", (err) => {
 		if (logContext) {
 			logSessionStart(
-				`lsp process ${context}: spawn-error command=${logContext.command} args=${JSON.stringify(logContext.args)} cwd=${logContext.cwd} pid=${logContext.pid ?? 0} error=${err.message}${stderrPreview ? ` stderr=${compactLogValue(stderrPreview)}` : ""}`,
+				"lsp process " + context + ": spawn-error command=" + logContext.command + " args=" + JSON.stringify(logContext.args) + " cwd=" + logContext.cwd + " pid=" + (logContext.pid ?? 0) + " error=" + err.message + (stderrPreview ? " stderr=" + compactLogValue(stderrPreview) : ""),
 			);
 		}
 
@@ -422,12 +422,12 @@ function _attachErrorHandler(
 		if (code !== 0 && code !== null) {
 			if (logContext) {
 				logSessionStart(
-					`lsp process ${context}: closed code=${code}${signal ? ` signal=${signal}` : ""} command=${logContext.command} args=${JSON.stringify(logContext.args)} cwd=${logContext.cwd} pid=${logContext.pid ?? 0}${stderrPreview ? ` stderr=${compactLogValue(stderrPreview)}` : ""}`,
+					"lsp process " + context + ": closed code=" + code + (signal ? " signal=" + signal : "") + " command=" + logContext.command + " args=" + JSON.stringify(logContext.args) + " cwd=" + logContext.cwd + " pid=" + (logContext.pid ?? 0) + (stderrPreview ? " stderr=" + compactLogValue(stderrPreview) : ""),
 				);
 			}
 		} else if (signal && logContext) {
 			logSessionStart(
-				`lsp process ${context}: closed signal=${signal} command=${logContext.command} args=${JSON.stringify(logContext.args)} cwd=${logContext.cwd} pid=${logContext.pid ?? 0}${stderrPreview ? ` stderr=${compactLogValue(stderrPreview)}` : ""}`,
+				"lsp process " + context + ": closed signal=" + signal + " command=" + logContext.command + " args=" + JSON.stringify(logContext.args) + " cwd=" + logContext.cwd + " pid=" + (logContext.pid ?? 0) + (stderrPreview ? " stderr=" + compactLogValue(stderrPreview) : ""),
 			);
 		}
 	});
@@ -467,11 +467,8 @@ export async function launchLSP(
 	// - If already absolute, use as-is
 	// - If it's a simple command (no path separators), let system find it via PATH
 	// - Otherwise, resolve relative to cwd
-	const explicitCommand = path.isAbsolute(command)
-		? command
-		: command.includes(path.sep) || command.includes("/")
-			? path.resolve(cwd, command)
-			: command;
+	const isRelativePath = !path.isAbsolute(command) && (command.includes(path.sep) || command.includes("/"));
+	const explicitCommand = isRelativePath ? path.resolve(cwd, command) : command;
 	const resolvedCommand =
 		!path.isAbsolute(command) &&
 		!command.includes(path.sep) &&

package/clients/lsp/server.ts

@@ -89,7 +89,7 @@ function logSessionStart(message: string): void {
 		return;
 	}
 	const line = `[${new Date().toISOString()}] ${message}\n`;
-	void mkdir(SESSIONSTART_LOG_DIR, { recursive: true })
+	mkdir(SESSIONSTART_LOG_DIR, { recursive: true })
 		.then(() => appendFile(SESSIONSTART_LOG, line))
 		.catch(() => {
 			// best-effort logging

package/clients/pipeline.ts

@@ -96,7 +96,7 @@ function diffProjectSnapshot(root: string, before: FileSnapshot): string[] {
 	const changed = new Set<string>();
 	for (const [filePath, next] of after) {
 		const prev = before.get(filePath);
-		if (!prev || prev.mtimeMs !== next.mtimeMs || prev.size !== next.size) {
+		if (prev?.mtimeMs !== next.mtimeMs || prev?.size !== next.size) {
 			changed.add(filePath);
 		}
 	}
@@ -725,7 +725,7 @@ export async function runFormatPhase(
 		if (result.anyChanged) {
 			formatChanged = true;
 			dbg(
-				`autoformat: ${result.formatters.map((f) => `${f.name}(${f.changed ? "changed" : "unchanged"})`).join(", ")}`,
+				"autoformat: " + result.formatters.map((f) => f.name + "(" + (f.changed ? "changed" : "unchanged") + ")").join(", "),
 			);
 		}
 		if (!result.allSucceeded) {
@@ -734,7 +734,7 @@ export async function runFormatPhase(
 				...failures.map((f) => `${f.name}: ${f.error ?? "unknown error"}`),
 			);
 			dbg(
-				`autoformat: ${failures.map((f) => `${f.name} failed: ${f.error ?? "unknown error"}`).join("; ")}`,
+				"autoformat: " + failures.map((f) => f.name + " failed: " + (f.error ?? "unknown error")).join("; "),
 			);
 		}
 	} catch (err) {
@@ -946,14 +946,9 @@ export async function runPipeline(
 		const changedList = [...piChangedFiles].map((changedFile) =>
 			toRunnerDisplayPath(cwd, changedFile),
 		);
-		const fileList = changedList.length
-			? `\nModified files:\n${changedList
-					.slice(0, 8)
-					.map((f) => `  - ${f}`)
-					.join(
-						"\n",
-					)}${changedList.length > 8 ? `\n  - ... and ${changedList.length - 8} more` : ""}`
-			: "";
+		const topFiles = changedList.slice(0, 8).map((f) => "  - " + f).join("\n");
+		const overflow = changedList.length > 8 ? "\n  - ... and " + (changedList.length - 8) + " more" : "";
+		const fileList = changedList.length ? "\nModified files:\n" + topFiles + overflow : "";
 		output += `\n\n⚠️ **File was modified by auto-format/fix. You MUST re-read modified file(s) before making any further edits — the content on disk has changed (whitespace, indentation, quotes, or code). Editing from memory will produce mismatches.**${fileList}`;
 	}
 	phase.end("dispatch_lint", {

package/clients/read-guard.ts

@@ -210,9 +210,12 @@ export class ReadGuard {
 		const lastRead = fileReads[fileReads.length - 1];
 		const [editStart, editEnd] = touchedLines;
 		const lastReadEnd = lastRead.effectiveOffset + lastRead.effectiveLimit - 1;
+		const symbolCtx = lastRead.enclosingSymbol
+			? ` (${lastRead.enclosingSymbol.kind} \`${lastRead.enclosingSymbol.name}\`)`
+			: "";
 		const verdict = this.blockOrWarn(
 			"out-of-range",
-			`🔴 BLOCKED — Edit outside read range\n\nYou read \`${filePath}\` lines ${lastRead.effectiveOffset}-${lastReadEnd}${lastRead.enclosingSymbol ? ` (${lastRead.enclosingSymbol.kind} \`${lastRead.enclosingSymbol.name}\`)` : ""}, but your edit touches lines ${editStart}-${editEnd}.\n\nThe edit target is outside the context you previously read.\nTo proceed:\n  1. Read the relevant section: \`read path="${filePath}" offset=${Math.max(1, editStart - 5)} limit=${Math.min(30, editEnd - editStart + 10)}\`\n  2. Or read the full file: \`read path="${filePath}"\``,
+			`🔴 BLOCKED — Edit outside read range\n\nYou read \`${filePath}\` lines ${lastRead.effectiveOffset}-${lastReadEnd}${symbolCtx}, but your edit touches lines ${editStart}-${editEnd}.\n\nThe edit target is outside the context you previously read.\nTo proceed:\n  1. Read the relevant section: \`read path="${filePath}" offset=${Math.max(1, editStart - 5)} limit=${Math.min(30, editEnd - editStart + 10)}\`\n  2. Or read the full file: \`read path="${filePath}"\``,
 			{
 				editRange: touchedLines,
 				readRanges: fileReads.map((r) => ({
@@ -470,11 +473,7 @@ export class ReadGuard {
 		const reads = this.reads.get(filePath) ?? [];
 		logReadGuardEvent({
 			event:
-				verdict.action === "allow"
-					? "edit_allowed"
-					: verdict.action === "warn"
-						? "edit_warned"
-						: "edit_blocked",
+				verdict.action === "allow" ? "edit_allowed" : (verdict.action === "warn" ? "edit_warned" : "edit_blocked"),
 			sessionId: this.sessionId,
 			filePath,
 			metadata: {

package/clients/runtime-coordinator.ts

@@ -44,7 +44,7 @@ export class RuntimeCoordinator {
 	};
 	private _complexityBaselines = new Map<string, FileComplexity>();
 	private _fixedThisTurn = new Set<string>();
-	private _reportedThisTurn = new Set<string>();
+	private readonly _reportedThisTurn = new Set<string>();
 	private _projectRulesScan: RuleScanResult = {
 		rules: [],
 		hasCustomRules: false,
@@ -56,7 +56,7 @@ export class RuntimeCoordinator {
 	private _gitGuardHasBlockers = false;
 	private _gitGuardSummary = "";
 	private _readGuard: ReadGuard | null = null;
-	private _pendingDeferredFormatFiles = new Map<string, DeferredFormatRecord>();
+	private readonly _pendingDeferredFormatFiles = new Map<string, DeferredFormatRecord>();
 	private readonly _lspReadWarmState = new Map<
 		string,
 		{ status: "warming" | "ready"; ts: number }

package/clients/runtime-tool-result.ts

@@ -108,9 +108,7 @@ export async function handleToolResult(deps: ToolResultDeps): Promise<{
 	const rawFilePath = (event.input as { path?: string }).path;
 	const workspaceRoot = runtime.projectRoot || process.cwd();
 	const filePath = rawFilePath
-		? path.isAbsolute(rawFilePath)
-			? rawFilePath
-			: path.resolve(workspaceRoot, rawFilePath)
+		? (path.isAbsolute(rawFilePath) ? rawFilePath : path.resolve(workspaceRoot, rawFilePath))
 		: rawFilePath;
 	const behaviorWarnings = agentBehaviorRecord(event.toolName, filePath);
 

package/clients/secrets-scanner.ts

@@ -126,7 +126,7 @@ const SECRET_PATTERNS: SecretPattern[] = [
 	},
 	{
 		pattern:
-			/\b(secret|api_?key|token|access_?key)\b\s*[:=]\s*["']([a-zA-Z0-9_\-/.]{8,})["']/gi,
+			/\b(secret|api_?key|token|access_?key)\b\s*[:=]\s*["']([a-zA-Z0-9_./-]{8,})["']/gi,
 		name: "hardcoded-secret",
 		message: "Possible hardcoded secret or API key",
 	},

package/clients/session-summary.ts

@@ -46,7 +46,7 @@ export function formatSlopScoreSummary(summary: SlopScoreSummary): string {
 	const topRules = summary.ruleCounts.slice(0, 3);
 	const detail =
 		topRules.length > 0
-			? `  (${topRules.map((entry) => `${entry.ruleId} ×${entry.count}`).join(", ")})`
+			? "  (" + topRules.map((entry) => entry.ruleId + " ×" + entry.count).join(", ") + ")"
 			: "";
 
 	return `Slop score: ${summary.scorePerKloc.toFixed(1)}/KLOC${detail}`;

package/clients/tree-sitter-query-loader.ts

@@ -243,8 +243,9 @@ export class TreeSitterQueryLoader {
 						const nestedMatch = nextLine.match(/^\s+(\w+):\s*(.+)$/);
 						if (nestedMatch) {
 							let nv = nestedMatch[2].trim();
-							if (nv.startsWith('"') && nv.endsWith('"')) nv = nv.slice(1, -1);
-							else if (nv.startsWith("'") && nv.endsWith("'")) nv = nv.slice(1, -1);
+							if ((nv.startsWith('"') && nv.endsWith('"')) || (nv.startsWith("'") && nv.endsWith("'"))) {
+								nv = nv.slice(1, -1);
+							}
 							nestedObj[nestedMatch[1]] = nv;
 						}
 					}