pi-lens 3.8.69 → 3.8.70

package/dist/clients/bootstrap.js

@@ -63,7 +63,7 @@ export function loadBootstrapClients() {
                 return [];
             }
         }
-        const [ruffClient, biomeClient, knipClient, todoScanner, jscpdClient, depChecker, testRunnerClient, metricsClient, complexityClient, goClient, govulncheckClient, gitleaksClient, trivyClient, rustClient, agentBehaviorClient, deadCodeClients,] = await Promise.all([
+        const [ruffClient, biomeClient, knipClient, todoScanner, jscpdClient, depChecker, testRunnerClient, metricsClient, complexityClient, goClient, govulncheckClient, gitleaksClient, trivyClient, opengrepClient, rustClient, agentBehaviorClient, deadCodeClients,] = await Promise.all([
             load("ruff", async () => new (await import("./ruff-client.js")).RuffClient()),
             load("biome", async () => new (await import("./biome-client.js")).BiomeClient()),
             load("knip", async () => new (await import("./knip-client.js")).KnipClient()),
@@ -77,6 +77,7 @@ export function loadBootstrapClients() {
             load("govulncheck", async () => new (await import("./govulncheck-client.js")).GovulncheckClient()),
             load("gitleaks", async () => new (await import("./gitleaks-client.js")).GitleaksClient()),
             load("trivy", async () => new (await import("./trivy-client.js")).TrivyClient()),
+            load("opengrep", async () => new (await import("./opengrep-client.js")).OpengrepClient()),
             load("rust", async () => new (await import("./rust-client.js")).RustClient()),
             load("agent-behavior", async () => new (await import("./agent-behavior-client.js")).AgentBehaviorClient()),
             loadList("dead-code", async () => (await import("./dead-code-client.js")).getDeadCodeClients()),
@@ -97,6 +98,7 @@ export function loadBootstrapClients() {
             govulncheckClient,
             gitleaksClient,
             trivyClient,
+            opengrepClient,
             rustClient,
             agentBehaviorClient,
             deadCodeClients,

package/dist/clients/bus-events-logger.js

@@ -0,0 +1,51 @@
+/**
+ * Persistent NDJSON trace of `pi.events` bus publish attempts
+ * (`pilens:files:touched` #482 / `pilens:diagnostics` #502).
+ *
+ * Both producers (clients/bus-publish.ts, clients/diagnostics-publish.ts) are
+ * fire-and-forget: on failure or on a structural no-op (never wired, kill
+ * switch off) they only invoke an optional `dbg` callback, which varies by
+ * host and is a documented no-op in the MCP host (clients/mcp/session.ts's
+ * `dbg: noop`). That leaves bus-publish outcomes invisible in exactly the
+ * context where they matter most — same failure shape as the #544 MCP
+ * session_start incident this repo already fixed once.
+ *
+ * This module gives bus events the same durable trace every other pi-lens
+ * subsystem already has (latency.log, cascade.log, read-guard.log, ...) —
+ * see clients/latency-logger.ts for the house pattern this mirrors exactly:
+ * one shared `createNdjsonLogger` writer, `isTestMode()` no-op guard,
+ * `getBusEventsLogPath()` for testability.
+ *
+ * Logging volume: `emitted` and `emit_failed` are logged on every call —
+ * they're the two outcomes an operator actually needs a per-event trace for.
+ * `skipped_unwired` and `skipped_disabled` are process-lifetime-static facts
+ * (wiring happens once at extension factory time; the kill switch is an env
+ * var read once at startup) — logging them on every publish attempt would
+ * spam one identical line per write batch for an entire session with zero
+ * new information after the first. Both are gated log-once-per-process, the
+ * same `hasLoggedFailure` shape the producers already use for emit_failed.
+ * The empty-batch branch (`paths.length === 0` / `files.length === 0`) is
+ * NOT logged at all: every call site already guards against invoking these
+ * functions with nothing to report (see clients/pipeline.ts,
+ * clients/runtime-agent-end.ts), so it's a normal, frequent no-op rather
+ * than a real event worth a log line.
+ */
+import * as path from "node:path";
+import { isTestMode } from "./env-utils.js";
+import { getGlobalPiLensDir } from "./file-utils.js";
+import { createNdjsonLogger } from "./ndjson-logger.js";
+const BUS_EVENTS_LOG_FILE = path.join(getGlobalPiLensDir(), "bus-events.log");
+const writer = createNdjsonLogger({ filePath: BUS_EVENTS_LOG_FILE });
+export function logBusEvent(entry) {
+    if (isTestMode()) {
+        return;
+    }
+    writer.log({ ts: new Date().toISOString(), ...entry });
+}
+export function getBusEventsLogPath() {
+    return BUS_EVENTS_LOG_FILE;
+}
+/** Resolve once all enqueued bus-event writes are on disk (tests/shutdown). */
+export function flushBusEventsLog() {
+    return writer.flush();
+}

package/dist/clients/bus-publish.js

@@ -17,12 +17,19 @@
  * callback is invoked at most once on first failure so a wired caller can log
  * it without spamming.
  */
+import { logBusEvent } from "./bus-events-logger.js";
 import { normalizeFilePath } from "./path-utils.js";
 import { appendRecentTouches } from "./recent-touches.js";
 export const BUS_FILES_TOUCHED_EVENT = "pilens:files:touched";
 export const BUS_FILES_TOUCHED_VERSION = 1;
 let busEmit;
 let hasLoggedFailure = false;
+// Log-once-per-process guards for the two structural-no-op outcomes below
+// (see bus-events-logger.ts's module doc for why these aren't logged on
+// every call — both are static, session-lifetime facts, not transient
+// per-event failures).
+let hasLoggedUnwired = false;
+let hasLoggedDisabled = false;
 /**
  * Wire the emit function from pi's `pi.events` bus. Called once at extension
  * factory time from index.ts (module-level singleton, same pattern as
@@ -37,6 +44,8 @@ export function wireBusEmitter(emitFn) {
 export function _resetForTests() {
     busEmit = undefined;
     hasLoggedFailure = false;
+    hasLoggedUnwired = false;
+    hasLoggedDisabled = false;
     _envCache = undefined;
 }
 let _envCache;
@@ -73,8 +82,18 @@ export function publishFilesTouched(args) {
         return;
     if (args.paths.length === 0)
         return;
-    if (!isBusPublishEnabled())
+    if (!isBusPublishEnabled()) {
+        if (!hasLoggedDisabled) {
+            hasLoggedDisabled = true;
+            logBusEvent({
+                event: BUS_FILES_TOUCHED_EVENT,
+                outcome: "skipped_disabled",
+                cwd: normalizeFilePath(args.cwd),
+                reason: args.reason,
+            });
+        }
         return;
+    }
     void appendRecentTouches({
         cwd: args.cwd,
         reason: args.reason,
@@ -83,8 +102,18 @@ export function publishFilesTouched(args) {
     }).catch((err) => {
         args.dbg?.(`bus-publish: recent-touches append failed: ${err}`);
     });
-    if (!busEmit)
+    if (!busEmit) {
+        if (!hasLoggedUnwired) {
+            hasLoggedUnwired = true;
+            logBusEvent({
+                event: BUS_FILES_TOUCHED_EVENT,
+                outcome: "skipped_unwired",
+                cwd: normalizeFilePath(args.cwd),
+                reason: args.reason,
+            });
+        }
         return;
+    }
     try {
         const payload = {
             v: BUS_FILES_TOUCHED_VERSION,
@@ -100,8 +129,22 @@ export function publishFilesTouched(args) {
             }));
         }
         busEmit(BUS_FILES_TOUCHED_EVENT, payload);
+        logBusEvent({
+            event: BUS_FILES_TOUCHED_EVENT,
+            outcome: "emitted",
+            cwd: payload.cwd,
+            reason: args.reason,
+            fileCount: payload.paths.length,
+        });
     }
     catch (err) {
+        logBusEvent({
+            event: BUS_FILES_TOUCHED_EVENT,
+            outcome: "emit_failed",
+            cwd: normalizeFilePath(args.cwd),
+            reason: args.reason,
+            error: String(err),
+        });
         if (!hasLoggedFailure) {
             hasLoggedFailure = true;
             args.dbg?.(`bus-publish: pilens:files:touched emit failed (further failures suppressed): ${err}`);

package/dist/clients/code-quality-warnings.js

@@ -135,6 +135,33 @@ export function buildCodeQualityWarningsReport(args) {
         },
     };
 }
+/**
+ * #557 audit (same race class as #555's LSP client fix and #560's
+ * `widget-state.ts` `recordDiagnostics` fix): pi-lens deliberately allows
+ * concurrent pipeline runs for the SAME file across DIFFERENT same-turn
+ * edits (dedupe key is `filePath + contentHash`, not just `filePath` — see
+ * `clients/runtime-tool-result.ts`), so a per-key cache fed directly from
+ * those concurrent pipeline runs needs an ordering guard (`WriteOrderingGuard`
+ * from `clients/write-ordering-guard.ts`) or an older edit's slower pipeline
+ * can silently overwrite a newer edit's fresher write.
+ *
+ * This call site is NOT exposed to that race. Unlike `widget-state.ts`'s
+ * `recordDiagnostics` (called directly from `clients/pipeline.ts`, once per
+ * pipeline run — i.e. potentially several times per turn, out of completion
+ * order), `writeCodeQualityWarningsReport` has exactly one caller:
+ * `handleTurnEnd` in `clients/runtime-turn.ts`, which per-edit pipeline runs
+ * never call directly — they only feed `runtime.recordCodeQualityWarnings`
+ * (an accumulating, order-independent Map). `handleTurnEnd` itself reads that
+ * accumulator once via `runtime.peekCodeQualityWarnings()` and writes the
+ * aggregate report exactly once per turn-end invocation — the same single
+ * sequential turn-end-only shape already confirmed safe for
+ * `writeActionableWarningsReport` in `clients/actionable-warnings.ts`, right
+ * next to this call site in `handleTurnEnd`. No second writer, so no
+ * ordering token to guard against — see
+ * `tests/clients/code-quality-warnings.test.ts`'s
+ * "single sequential caller" test, which pins this invariant so a future
+ * change that adds a second call site has a better chance of being caught.
+ */
 export function writeCodeQualityWarningsReport(cacheManager, cwd, report) {
     cacheManager.writeCache("code-quality-warnings", report, cwd);
 }

package/dist/clients/dead-code-client.js

@@ -11,10 +11,8 @@
  * Phase 1 ships Python via `vulture`. Future phases add Go/Rust/etc. by
  * implementing DeadCodeClient and adding to getDeadCodeClients().
  */
-import * as fs from "node:fs";
-import * as os from "node:os";
 import * as path from "node:path";
-import { isAtOrAboveHomeDir } from "./path-utils.js";
+import { findNearestMarkerRoot } from "./path-utils.js";
 import { safeSpawnAsync } from "./safe-spawn.js";
 function emptyResult(language) {
     return {
@@ -108,34 +106,18 @@ export class PythonDeadCodeClient {
      * Nearest dir with a Python project marker, never at/above $HOME and never
      * escaping a VCS boundary — same containment rules as KnipClient so a scan
      * launched from a bare cwd can't recurse the whole home tree (#250/#296).
+     * Delegates to the shared path-utils helper (refs #625) rather than
+     * hand-rolling the climb; only the marker list differs from KnipClient's.
      */
     resolveProjectRoot(startDir, homeDirOverride) {
-        const markers = [
+        return findNearestMarkerRoot(startDir, [
             "pyproject.toml",
             "setup.py",
             "setup.cfg",
             "requirements.txt",
             "Pipfile",
             "tox.ini",
-        ];
-        const boundaries = [".git", ".hg", ".svn"];
-        const homeDir = path.resolve(homeDirOverride ?? os.homedir());
-        let current = path.resolve(startDir);
-        for (let depth = 0; depth < 64; depth++) {
-            if (isAtOrAboveHomeDir(current, homeDir))
-                return null;
-            if (markers.some((m) => fs.existsSync(path.join(current, m)))) {
-                return current;
-            }
-            if (boundaries.some((m) => fs.existsSync(path.join(current, m)))) {
-                return null;
-            }
-            const parent = path.dirname(current);
-            if (parent === current)
-                return null;
-            current = parent;
-        }
-        return null;
+        ], { boundaries: [".git", ".hg", ".svn"], homeDir: homeDirOverride });
     }
     async ensureAvailable() {
         if (this.available !== null)

package/dist/clients/diagnostics-publish.js

@@ -59,6 +59,7 @@
  * fields may be added under `v: 1`; a breaking change to an existing field's
  * meaning must bump `v`.
  */
+import { logBusEvent } from "./bus-events-logger.js";
 import { normalizeFilePath } from "./path-utils.js";
 import { isBusPublishEnabled } from "./bus-publish.js";
 export const BUS_DIAGNOSTICS_EVENT = "pilens:diagnostics";
@@ -67,6 +68,8 @@ export const BUS_DIAGNOSTICS_VERSION = 1;
 export const MAX_DIAGNOSTICS_PER_FILE_EVENT = 12;
 let busEmit;
 let hasLoggedFailure = false;
+let hasLoggedUnwired = false;
+let hasLoggedDisabled = false;
 let seqCounter = 0;
 /** Paths this producer has reported with at least one non-empty diagnostics array, so we know when to fire the one-time clean-transition event. */
 const reportedDirtyPaths = new Set();
@@ -82,6 +85,8 @@ export function wireDiagnosticsBusEmitter(emitFn) {
 export function _resetDiagnosticsPublishForTests() {
     busEmit = undefined;
     hasLoggedFailure = false;
+    hasLoggedUnwired = false;
+    hasLoggedDisabled = false;
     seqCounter = 0;
     reportedDirtyPaths.clear();
 }
@@ -129,10 +134,28 @@ export function publishDiagnostics(args) {
         return;
     if (args.files.length === 0)
         return;
-    if (!isBusPublishEnabled())
+    if (!isBusPublishEnabled()) {
+        if (!hasLoggedDisabled) {
+            hasLoggedDisabled = true;
+            logBusEvent({
+                event: BUS_DIAGNOSTICS_EVENT,
+                outcome: "skipped_disabled",
+                cwd: normalizeFilePath(args.cwd),
+            });
+        }
         return;
-    if (!busEmit)
+    }
+    if (!busEmit) {
+        if (!hasLoggedUnwired) {
+            hasLoggedUnwired = true;
+            logBusEvent({
+                event: BUS_DIAGNOSTICS_EVENT,
+                outcome: "skipped_unwired",
+                cwd: normalizeFilePath(args.cwd),
+            });
+        }
         return;
+    }
     try {
         const fileEntries = args.files.map((f) => {
             const normPath = normalizeFilePath(f.path);
@@ -161,8 +184,21 @@ export function publishDiagnostics(args) {
             files: fileEntries,
         };
         busEmit(BUS_DIAGNOSTICS_EVENT, payload);
+        logBusEvent({
+            event: BUS_DIAGNOSTICS_EVENT,
+            outcome: "emitted",
+            cwd: payload.cwd,
+            fileCount: payload.files.length,
+            seq: payload.seq,
+        });
     }
     catch (err) {
+        logBusEvent({
+            event: BUS_DIAGNOSTICS_EVENT,
+            outcome: "emit_failed",
+            cwd: normalizeFilePath(args.cwd),
+            error: String(err),
+        });
         if (!hasLoggedFailure) {
             hasLoggedFailure = true;
             args.dbg?.(`diagnostics-publish: pilens:diagnostics emit failed (further failures suppressed): ${err}`);

package/dist/clients/dispatch/auxiliary-lsp.js

@@ -16,6 +16,7 @@
  * Adding a new cross-cutting tool = register an `LSPServerInfo` with
  * `role:"auxiliary"` (clients/lsp/server.ts) + one profile entry here.
  */
+import { shouldDegradeAuxiliaryLsp } from "../lsp-budget.js";
 import { findLocalOpengrepConfig } from "../opengrep-config.js";
 import { findLocalTyposConfig } from "../typos-config.js";
 import { findLocalZizmorConfig } from "../zizmor-config.js";
@@ -56,6 +57,11 @@ export function isNosemgrepSuppressed(d, content) {
     return (checkLine(lines[startLine], false) ||
         checkLine(lines[startLine - 1], true));
 }
+// #277 R7: every profile below used this exact same rule (ERROR-severity
+// findings block only when the workspace opted into curated/authored rules;
+// everything else stays advisory) — shared here instead of copy-pasted per
+// profile so a future policy change (e.g. a WARNING-blocking tier) is one edit.
+const blockOnErrorWhenAllowed = (d, { blockingAllowed }) => (blockingAllowed && d.severity === 1 ? "blocking" : "warning");
 export const AUXILIARY_LSP_PROFILES = [
     {
         serverId: "opengrep",
@@ -71,7 +77,7 @@ export const AUXILIARY_LSP_PROFILES = [
         // supplies its own curated rules (the author's deliberate severity); the
         // auto set is advisory. Either way, findings surface via lens_diagnostics.
         allowBlocking: (cwd) => Boolean(findLocalOpengrepConfig(cwd)),
-        semantic: (d, { blockingAllowed }) => blockingAllowed && d.severity === 1 ? "blocking" : "warning",
+        semantic: blockOnErrorWhenAllowed,
         defectClass: (d) => classifyDefect(String(d.code ?? ""), "opengrep", d.message ?? ""),
         // Honor the canonical Semgrep suppression the user already knows (#441).
         isSuppressed: isNosemgrepSuppressed,
@@ -88,7 +94,7 @@ export const AUXILIARY_LSP_PROFILES = [
         // deliberate, so preserve ast-grep's severity semantics: ERROR can block,
         // WARNING/INFO stay advisory.
         allowBlocking: () => true,
-        semantic: (d, { blockingAllowed }) => blockingAllowed && d.severity === 1 ? "blocking" : "warning",
+        semantic: blockOnErrorWhenAllowed,
         defectClass: (d) => classifyDefect(String(d.code ?? ""), "ast-grep", d.message ?? ""),
     },
     {
@@ -104,7 +110,7 @@ export const AUXILIARY_LSP_PROFILES = [
         // ignores). Advisory otherwise — findings still surface via lens_diagnostics.
         // zizmor maps High→ERROR(1), Medium/Low→WARNING(2), Informational→INFO(3).
         allowBlocking: (cwd) => Boolean(findLocalZizmorConfig(cwd)),
-        semantic: (d, { blockingAllowed }) => blockingAllowed && d.severity === 1 ? "blocking" : "warning",
+        semantic: blockOnErrorWhenAllowed,
         defectClass: (d) => classifyDefect(String(d.code ?? ""), "zizmor", d.message ?? ""),
     },
     {
@@ -122,23 +128,73 @@ export const AUXILIARY_LSP_PROFILES = [
         // severity is WARNING, so even with a config it stays advisory unless the
         // repo raises `diagnostic-severity` to Error.
         allowBlocking: (cwd) => Boolean(findLocalTyposConfig(cwd)),
-        semantic: (d, { blockingAllowed }) => blockingAllowed && d.severity === 1 ? "blocking" : "warning",
+        semantic: blockOnErrorWhenAllowed,
         // A misspelling is a documentation/quality defect — not security or
         // correctness. "style" is the closest taxonomy class.
         defectClass: () => "style",
     },
 ];
 /** The auxiliary server ids enabled for this turn (the lsp runner passes these
- *  to `touchFile` since it — not the LSP service — owns flag access). */
+ *  to `touchFile` since it — not the LSP service — owns flag access).
+ *
+ * #449 slice 2 (prototype): when this process decided at `session_start` that
+ * the machine-wide LSP budget is exceeded (`clients/lsp-budget.ts`), auxiliary
+ * servers are skipped entirely for the rest of the session — the primary
+ * language server per file is unaffected. This is a per-SESSION degrade, not
+ * per-file: once over budget, this session never spawns its auxiliary fleet,
+ * rather than flip-flopping file to file. */
 export function enabledAuxiliaryLspServerIds(getFlag) {
+    if (shouldDegradeAuxiliaryLsp())
+        return [];
     return AUXILIARY_LSP_PROFILES.flatMap((p) => p.enabledByDefault &&
         !(p.killSwitchFlag && getFlag(p.killSwitchFlag) === true)
         ? [p.serverId]
         : []);
 }
+// #277 R7: `findAuxiliaryProfileForSource` is called once per diagnostic, and a
+// file's diagnostics are typically dominated by a handful of distinct `source`
+// strings (one per tool that fired). Memoizing by exact `source` turns an
+// O(profiles) regex scan per diagnostic into one scan per distinct source seen
+// — safe because `AUXILIARY_LSP_PROFILES` is a fixed module-level const, never
+// mutated at runtime, so a source's matching profile never changes.
+const profileForSourceCache = new Map();
 /** Find the profile whose server emitted a diagnostic with this `source`. */
 export function findAuxiliaryProfileForSource(source) {
     if (!source)
         return undefined;
-    return AUXILIARY_LSP_PROFILES.find((p) => p.sourceMatch.test(source));
+    const cached = profileForSourceCache.get(source);
+    if (cached !== undefined || profileForSourceCache.has(source))
+        return cached;
+    const found = AUXILIARY_LSP_PROFILES.find((p) => p.sourceMatch.test(source));
+    profileForSourceCache.set(source, found);
+    return found;
+}
+/**
+ * Single-diagnostic suppression check (#586): look up the diagnostic's
+ * auxiliary profile by `source` and, if that profile declares an
+ * `isSuppressed` callback (currently only opengrep's `# nosemgrep`, #441),
+ * apply it. Returns false for diagnostics with no matching profile or whose
+ * profile has no native suppression syntax — the common case for plain
+ * language-server diagnostics.
+ *
+ * This is the ONE lookup+apply implementation; every call site that decides
+ * whether to drop a diagnostic for its tool's own inline suppression comment
+ * should go through this (or `applyAuxiliarySuppressions` below) rather than
+ * re-deriving the profile lookup.
+ */
+export function isAuxiliaryDiagnosticSuppressed(d, content) {
+    const profile = findAuxiliaryProfileForSource(d.source);
+    return Boolean(profile?.isSuppressed?.(d, content));
+}
+/**
+ * Filter a diagnostic list down to the ones NOT suppressed by their
+ * auxiliary profile's native inline-comment syntax (#586). This is the
+ * shared helper `tools/lsp-diagnostics.ts` and `clients/lsp/index.ts`'s
+ * `runWorkspaceDiagnostics` use so a `// nosemgrep` (or any future profile's
+ * equivalent) suppresses a finding identically whether it's seen via the
+ * per-edit dispatch runner or a standalone diagnostics query — previously
+ * only the former honored it (#586).
+ */
+export function applyAuxiliarySuppressions(diagnostics, content) {
+    return diagnostics.filter((d) => !isAuxiliaryDiagnosticSuppressed(d, content));
 }

package/dist/clients/dispatch/facts/function-facts.js

@@ -1,3 +1,4 @@
+import { findOwnerName } from "../../symbol-containment.js";
 import { extractFactsFromTree, firstChildOfType, walk, } from "./tree-sitter-facts.js";
 const BOUNDARY_PREFIXES = [
     "fetch",
@@ -160,6 +161,62 @@ function collectOutgoingCalls(body) {
     });
     return [...calls];
 }
+/**
+ * `obj.method()` call sites with a simple-identifier receiver (refs #655
+ * phase 2). Only the plain shape `identifier.identifier(...)` is captured —
+ * chained (`a.b.c()`), computed (`a[x]()`), and `this.`-receiver calls are
+ * left out of this list (they still show up in `outgoingCalls`'s flattened
+ * text form as before); those richer shapes need real type inference to
+ * resolve safely, which is out of scope for this bounded slice.
+ */
+function collectMemberCallSites(body) {
+    const sites = [];
+    walk(body, (node) => {
+        if (node.type !== "call_expression")
+            return;
+        const callee = (node.children ?? [])[0];
+        if (!callee || callee.type !== "member_expression")
+            return;
+        const object = (callee.children ?? [])[0];
+        const property = (callee.children ?? []).find((c) => c?.type === "property_identifier");
+        if (!object || object.type !== "identifier" || !property)
+            return;
+        sites.push({ receiver: object.text, method: property.text });
+    });
+    return sites;
+}
+/**
+ * Best-effort receiver -> class-name map for one function (refs #655 phase
+ * 2). Two clear, common shapes only — see {@link FunctionSummary.receiverTypes}.
+ */
+function collectReceiverTypes(body, params) {
+    const types = {};
+    for (const param of params) {
+        const id = firstNamedChild(param);
+        if (!id || id.type !== "identifier")
+            continue;
+        const typeAnnotation = (param.children ?? []).find((c) => c?.type === "type_annotation");
+        const typeId = typeAnnotation
+            ? firstChildOfType(typeAnnotation, "type_identifier")
+            : undefined;
+        if (typeId)
+            types[id.text] = typeId.text;
+    }
+    walk(body, (node) => {
+        if (node.type !== "variable_declarator")
+            return;
+        const id = firstChildOfType(node, "identifier");
+        if (!id)
+            return;
+        const value = (node.children ?? []).find((c) => c?.type === "new_expression");
+        if (!value)
+            return;
+        const ctor = firstNamedChild(value);
+        if (ctor?.type === "identifier")
+            types[id.text] = ctor.text;
+    });
+    return types;
+}
 function hasAwaitInNode(node) {
     let found = false;
     walk(node, (n) => {
@@ -192,6 +249,13 @@ export const functionFactProvider = {
     async run(ctx, store) {
         await extractFactsFromTree(ctx, store, { "file.functionSummaries": [] }, (root) => {
             const summaries = [];
+            // Class/interface declarations, collected in the SAME walk over the
+            // already-parsed tree (refs #655 phase 2) so owner/qualified-name
+            // computation for jsts needs no second parse — see
+            // `symbol-containment.ts`'s doc comment for why this can't literally
+            // share code with module-report.ts's tree-sitter-symbol-extractor path
+            // (different tree-sitter integration), only the same algorithm.
+            const containers = [];
             const addSummary = (node) => {
                 const body = getBody(node);
                 if (!body)
@@ -210,6 +274,7 @@ export const functionFactProvider = {
                     name: getFunctionName(node),
                     line: node.startPosition.row + 1,
                     column: node.startPosition.column + 1,
+                    endLine: body.endPosition.row + 1,
                     isAsync: Boolean(firstChildOfType(node, "async")),
                     hasAwait: hasAwaitInNode(body),
                     hasReturnAwaitCall: hasReturnAwaitCall(body),
@@ -221,12 +286,30 @@ export const functionFactProvider = {
                     cyclomaticComplexity: calcCyclomaticComplexity(body),
                     maxNestingDepth: calcMaxNestingDepth(body),
                     outgoingCalls: collectOutgoingCalls(body),
+                    memberCallSites: collectMemberCallSites(body),
+                    receiverTypes: collectReceiverTypes(body, params),
                 });
             };
             walk(root, (node) => {
                 if (FUNCTION_TYPES.has(node.type))
                     addSummary(node);
+                if (node.type === "class_declaration" ||
+                    node.type === "interface_declaration") {
+                    const nameNode = firstChildOfType(node, "type_identifier");
+                    if (nameNode) {
+                        containers.push({
+                            name: nameNode.text,
+                            startLine: node.startPosition.row + 1,
+                            endLine: node.endPosition.row + 1,
+                        });
+                    }
+                }
             });
+            for (const summary of summaries) {
+                const owner = findOwnerName(containers, summary.line, summary.endLine ?? summary.line);
+                if (owner)
+                    summary.owner = owner;
+            }
             return { "file.functionSummaries": summaries };
         });
     },

package/dist/clients/dispatch/rules/async-noise.js

@@ -23,7 +23,7 @@ export const asyncNoiseRule = {
                 fn.statementCount > 1) {
                 diagnostics.push({
                     id: `async-noise:${ctx.filePath}:${fn.line}:${fn.column}`,
-                    tool: "async-noise",
+                    tool: "fact-rules",
                     filePath: ctx.filePath,
                     line: fn.line,
                     column: fn.column,

package/dist/clients/dispatch/rules/async-unnecessary-wrapper.js

@@ -12,7 +12,7 @@ export const asyncUnnecessaryWrapperRule = {
                 continue;
             diagnostics.push({
                 id: `async-unnecessary-wrapper:${ctx.filePath}:${f.line}`,
-                tool: "async-unnecessary-wrapper",
+                tool: "fact-rules",
                 rule: "async-unnecessary-wrapper",
                 filePath: ctx.filePath,
                 line: f.line,

package/dist/clients/dispatch/rules/cors-wildcard.js

@@ -38,7 +38,7 @@ export const corsWildcardRule = {
             if (isWildcard) {
                 diagnostics.push({
                     id: `cors-wildcard:${ctx.filePath}:${i + 1}`,
-                    tool: "cors-wildcard",
+                    tool: "fact-rules",
                     rule: "cors-wildcard",
                     filePath: ctx.filePath,
                     line: i + 1,

package/dist/clients/dispatch/rules/error-obscuring.js

@@ -16,7 +16,8 @@ export const errorObscuringRule = {
                 !s.bodyText.includes(s.catchParam)) {
                 diagnostics.push({
                     id: `error-obscuring:${ctx.filePath}:${s.line}:${s.column}`,
-                    tool: "error-obscuring",
+                    tool: "fact-rules",
+                    rule: "error-obscuring",
                     filePath: ctx.filePath,
                     line: s.line,
                     column: s.column,

package/dist/clients/dispatch/rules/error-swallowing.js

@@ -13,7 +13,8 @@ export const errorSwallowingRule = {
             if (s.isEmpty && !s.isDocumentedLocalFallback && s.boundaryCategory !== "fs") {
                 diagnostics.push({
                     id: `error-swallowing:${ctx.filePath}:${s.line}:${s.column}`,
-                    tool: "error-swallowing",
+                    tool: "fact-rules",
+                    rule: "error-swallowing",
                     filePath: ctx.filePath,
                     line: s.line,
                     column: s.column,