pi-lens 3.8.69 → 3.8.71

package/README.md

@@ -18,6 +18,10 @@ pi-lens gives AI coding agents fast, language-aware feedback while they write/ed
 - Review-graph intelligence for supported languages via bundled tree-sitter WASMs
 - Ranked identifier search (`symbol_search`) over an always-warm word index,
   feeding the discovery funnel (symbol_search → module_report → read_symbol)
+- Diagnostic triage (`lens_diagnostic_mark`): findings can be marked
+  false-positive, suppressed in source, deferred, or flagged-to-fix — honored
+  across all surfaces
+- `/lens-map` — interactive HTML dependency map of the project
 - Read-guard and edit-autopatch support to reduce bad edits
 - Background security/dependency scans for opted-in projects
 
@@ -33,6 +37,14 @@ Or from git:
 pi install git:github.com/apmantza/pi-lens
 ```
 
+> **npm v12 users:** dependency lifecycle scripts (e.g. `@ast-grep/cli`'s
+> `postinstall`) now require explicit approval — if `npm install` warns about
+> unreviewed install scripts, review and allow them with
+> `npm approve-scripts`, or trust the `allowScripts` entries already declared
+> in this package's `package.json`. Installing from a git source (`pi install
+> git:...` / `pi update --extension git:...`) may similarly prompt for
+> git-dependency approval; accept it to let the `prepare` build step run.
+
 ## Documentation
 
 - [Agent tools](docs/agent-tools.md) — pi tool names, scopes, and arguments
@@ -42,6 +54,8 @@ pi install git:github.com/apmantza/pi-lens
 - [Word index](docs/word-index.md) — identifier search (`symbol_search`) and
   the discovery funnel
 - [Tools and commands](docs/tools.md) — runtime flags and slash commands
+- [Diagnostic dispositions](docs/dispositions.md) — triage: false-positive,
+  suppress, defer, flagged-to-fix
 - [Configuration](docs/globalconfig.md) — global and project config files
 - [Environment variables](docs/env_variables.md) — common env vars and full
   reference link
@@ -66,7 +80,7 @@ Thanks goes to these wonderful people:
 <!-- markdownlint-disable -->
 <table>
 <tbody>
-    <tr>
+<tr>
       <td align="center" valign="top" width="14.28%"><a href="https://github.com/apmantza"><img src="https://avatars.githubusercontent.com/u/247365598?v=4" width="100px;" alt=""/><br /><sub><b>Apostolos Mantzaris</b></sub></a><br /><a href="#code-apmantza" title="Code">💻</a> <a href="#doc-apmantza" title="Documentation">📖</a> <a href="#ideas-apmantza" title="Ideas & Planning">🤔</a> <a href="#maintenance-apmantza" title="Maintenance">🚧</a> <a href="#review-apmantza" title="Reviewed Pull Requests">👀</a></td>
       <td align="center" valign="top" width="14.28%"><a href="https://github.com/anh-chu"><img src="https://avatars.githubusercontent.com/u/34973633?v=4" width="100px;" alt=""/><br /><sub><b>Anh Chu</b></sub></a><br /><a href="#code-anh-chu" title="Code">💻</a></td>
       <td align="center" valign="top" width="14.28%"><a href="https://github.com/loss-and-quick"><img src="https://avatars.githubusercontent.com/u/39405619?v=4" width="100px;" alt=""/><br /><sub><b>minicx</b></sub></a><br /><a href="#code-loss-and-quick" title="Code">💻</a></td>
@@ -74,7 +88,7 @@ Thanks goes to these wonderful people:
       <td align="center" valign="top" width="14.28%"><a href="https://github.com/tifandotme"><img src="https://avatars.githubusercontent.com/u/33323177?v=4" width="100px;" alt=""/><br /><sub><b>Tifan Dwi Avianto</b></sub></a><br /><a href="#code-tifandotme" title="Code">💻</a></td>
       <td align="center" valign="top" width="14.28%"><a href="https://github.com/amit-gshe"><img src="https://avatars.githubusercontent.com/u/7383028?v=4" width="100px;" alt=""/><br /><sub><b>Amit</b></sub></a><br /><a href="#code-amit-gshe" title="Code">💻</a> <a href="#bug-amit-gshe" title="Bug reports">🐛</a></td>
       <td align="center" valign="top" width="14.28%"><a href="https://github.com/fractiunate"><img src="https://avatars.githubusercontent.com/u/78024279?v=4" width="100px;" alt=""/><br /><sub><b>Fractiunate // David Rahäuser</b></sub></a><br /><a href="#code-fractiunate" title="Code">💻</a></td>
-    </tr>
+    </tr><br />
     <tr>
       <td align="center" valign="top" width="14.28%"><a href="https://github.com/vkarasen"><img src="https://avatars.githubusercontent.com/u/7932536?v=4" width="100px;" alt=""/><br /><sub><b>Vitali Karasenko</b></sub></a><br /><a href="#code-vkarasen" title="Code">💻</a></td>
       <td align="center" valign="top" width="14.28%"><a href="https://github.com/rfxlamia"><img src="https://avatars.githubusercontent.com/u/222023708?v=4" width="100px;" alt=""/><br /><sub><b>V</b></sub></a><br /><a href="#code-rfxlamia" title="Code">💻</a></td>
@@ -83,7 +97,7 @@ Thanks goes to these wonderful people:
       <td align="center" valign="top" width="14.28%"><a href="https://github.com/mehalter"><img src="https://avatars.githubusercontent.com/u/1591837?v=4" width="100px;" alt=""/><br /><sub><b>Micah Halter</b></sub></a><br /><a href="#code-mehalter" title="Code">💻</a></td>
       <td align="center" valign="top" width="14.28%"><a href="https://github.com/JulienEllie"><img src="https://avatars.githubusercontent.com/u/670518?v=4" width="100px;" alt=""/><br /><sub><b>Julien Ellie</b></sub></a><br /><a href="#code-JulienEllie" title="Code">💻</a></td>
       <td align="center" valign="top" width="14.28%"><a href="https://github.com/Istar-Eldritch"><img src="https://avatars.githubusercontent.com/u/3746468?v=4" width="100px;" alt=""/><br /><sub><b>Ruben Paz</b></sub></a><br /><a href="#code-Istar-Eldritch" title="Code">💻</a> <a href="#bug-Istar-Eldritch" title="Bug reports">🐛</a></td>
-    </tr>
+    </tr><br />
     <tr>
       <td align="center" valign="top" width="14.28%"><a href="https://github.com/cjunxiang"><img src="https://avatars.githubusercontent.com/u/26619858?v=4" width="100px;" alt=""/><br /><sub><b>C.Junxiang</b></sub></a><br /><a href="#code-cjunxiang" title="Code">💻</a> <a href="#bug-cjunxiang" title="Bug reports">🐛</a></td>
       <td align="center" valign="top" width="14.28%"><a href="https://github.com/trvon"><img src="https://avatars.githubusercontent.com/u/6031322?v=4" width="100px;" alt=""/><br /><sub><b>Trevon</b></sub></a><br /><a href="#code-trvon" title="Code">💻</a></td>
@@ -92,7 +106,7 @@ Thanks goes to these wonderful people:
       <td align="center" valign="top" width="14.28%"><a href="https://github.com/spyrosbazios"><img src="https://avatars.githubusercontent.com/u/37960233?v=4" width="100px;" alt=""/><br /><sub><b>spyrosbazios</b></sub></a><br /><a href="#code-spyrosbazios" title="Code">💻</a></td>
       <td align="center" valign="top" width="14.28%"><a href="https://github.com/Roman-Galeev"><img src="https://avatars.githubusercontent.com/u/40388226?v=4" width="100px;" alt=""/><br /><sub><b>Roman Galeev</b></sub></a><br /><a href="#code-Roman-Galeev" title="Code">💻</a></td>
       <td align="center" valign="top" width="14.28%"><a href="https://github.com/jerryfan"><img src="https://avatars.githubusercontent.com/u/2540814?v=4" width="100px;" alt=""/><br /><sub><b>jerryfan</b></sub></a><br /><a href="#code-jerryfan" title="Code">💻</a></td>
-    </tr>
+    </tr><br />
     <tr>
       <td align="center" valign="top" width="14.28%"><a href="https://github.com/shaDmx"><img src="https://avatars.githubusercontent.com/u/91132641?v=4" width="100px;" alt=""/><br /><sub><b>Max L.</b></sub></a><br /><a href="#code-shaDmx" title="Code">💻</a></td>
       <td align="center" valign="top" width="14.28%"><a href="https://github.com/radge"><img src="https://avatars.githubusercontent.com/u/129205?v=4" width="100px;" alt=""/><br /><sub><b>David Ryan</b></sub></a><br /><a href="#code-radge" title="Code">💻</a></td>
@@ -101,7 +115,7 @@ Thanks goes to these wonderful people:
       <td align="center" valign="top" width="14.28%"><a href="https://github.com/feoh"><img src="https://avatars.githubusercontent.com/u/330070?v=4" width="100px;" alt=""/><br /><sub><b>Chris Patti</b></sub></a><br /><a href="#code-feoh" title="Code">💻</a> <a href="#bug-feoh" title="Bug reports">🐛</a></td>
       <td align="center" valign="top" width="14.28%"><a href="https://github.com/chenxin-yan"><img src="https://avatars.githubusercontent.com/u/71162231?v=4" width="100px;" alt=""/><br /><sub><b>Chenxin Yan</b></sub></a><br /><a href="#code-chenxin-yan" title="Code">💻</a> <a href="#doc-chenxin-yan" title="Documentation">📖</a> <a href="#bug-chenxin-yan" title="Bug reports">🐛</a></td>
       <td align="center" valign="top" width="14.28%"><a href="https://github.com/flowing-abyss"><img src="https://avatars.githubusercontent.com/u/98622217?v=4" width="100px;" alt=""/><br /><sub><b>flowing-abyss</b></sub></a><br /><a href="#code-flowing-abyss" title="Code">💻</a></td>
-    </tr>
+    </tr><br />
     <tr>
       <td align="center" valign="top" width="14.28%"><a href="https://github.com/xuli500177"><img src="https://avatars.githubusercontent.com/u/62830942?v=4" width="100px;" alt=""/><br /><sub><b>Xu Yili</b></sub></a><br /><a href="#bug-xuli500177" title="Bug reports">🐛</a></td>
       <td align="center" valign="top" width="14.28%"><a href="https://github.com/ricardoraposo"><img src="https://avatars.githubusercontent.com/u/50217712?v=4" width="100px;" alt=""/><br /><sub><b>Ricardo Raposo</b></sub></a><br /><a href="#code-ricardoraposo" title="Code">💻</a></td>
@@ -110,7 +124,7 @@ Thanks goes to these wonderful people:
       <td align="center" valign="top" width="14.28%"><a href="https://github.com/PeraSite"><img src="https://avatars.githubusercontent.com/u/19837403?v=4" width="100px;" alt=""/><br /><sub><b>정제훈</b></sub></a><br /><a href="#code-PeraSite" title="Code">💻</a></td>
       <td align="center" valign="top" width="14.28%"><a href="https://github.com/carolitascl"><img src="https://avatars.githubusercontent.com/u/26188349?v=4" width="100px;" alt=""/><br /><sub><b>Carolina</b></sub></a><br /><a href="#bug-carolitascl" title="Bug reports">🐛</a></td>
       <td align="center" valign="top" width="14.28%"><a href="https://github.com/leakedby"><img src="https://avatars.githubusercontent.com/u/4213260?v=4" width="100px;" alt=""/><br /><sub><b>LeakedBy</b></sub></a><br /><a href="#bug-leakedby" title="Bug reports">🐛</a></td>
-    </tr>
+    </tr><br />
     <tr>
       <td align="center" valign="top" width="14.28%"><a href="https://github.com/mdbooth"><img src="https://avatars.githubusercontent.com/u/1318691?v=4" width="100px;" alt=""/><br /><sub><b>Matthew Booth</b></sub></a><br /><a href="#bug-mdbooth" title="Bug reports">🐛</a></td>
       <td align="center" valign="top" width="14.28%"><a href="https://github.com/Wiedzmin89"><img src="https://avatars.githubusercontent.com/u/61706855?v=4" width="100px;" alt=""/><br /><sub><b>Wiedzmin89</b></sub></a><br /><a href="#ideas-Wiedzmin89" title="Ideas & Planning">🤔</a></td>
@@ -119,7 +133,7 @@ Thanks goes to these wonderful people:
       <td align="center" valign="top" width="14.28%"><a href="https://github.com/ywh555hhh"><img src="https://avatars.githubusercontent.com/u/121592812?v=4" width="100px;" alt=""/><br /><sub><b>Wayne E</b></sub></a><br /><a href="#bug-ywh555hhh" title="Bug reports">🐛</a></td>
       <td align="center" valign="top" width="14.28%"><a href="https://github.com/RimuruW"><img src="https://avatars.githubusercontent.com/u/59136309?v=4" width="100px;" alt=""/><br /><sub><b>RimuruW</b></sub></a><br /><a href="#ideas-RimuruW" title="Ideas & Planning">🤔</a></td>
       <td align="center" valign="top" width="14.28%"><a href="https://github.com/Bjynt"><img src="https://avatars.githubusercontent.com/u/22177300?v=4" width="100px;" alt=""/><br /><sub><b>Bjynt</b></sub></a><br /><a href="#bug-Bjynt" title="Bug reports">🐛</a> <a href="#ideas-Bjynt" title="Ideas & Planning">🤔</a></td>
-    </tr>
+    </tr><br />
     <tr>
       <td align="center" valign="top" width="14.28%"><a href="https://github.com/pvtri96"><img src="https://avatars.githubusercontent.com/u/28696888?v=4" width="100px;" alt=""/><br /><sub><b>Tri Van Pham</b></sub></a><br /><a href="#bug-pvtri96" title="Bug reports">🐛</a></td>
       <td align="center" valign="top" width="14.28%"><a href="https://github.com/BingWuJ"><img src="https://avatars.githubusercontent.com/u/117666511?v=4" width="100px;" alt=""/><br /><sub><b>BingWuJ</b></sub></a><br /><a href="#bug-BingWuJ" title="Bug reports">🐛</a></td>
@@ -128,7 +142,7 @@ Thanks goes to these wonderful people:
       <td align="center" valign="top" width="14.28%"><a href="https://github.com/ProbabilityEngineer"><img src="https://avatars.githubusercontent.com/u/38498804?v=4" width="100px;" alt=""/><br /><sub><b>ProbabilityEngineer</b></sub></a><br /><a href="#ideas-ProbabilityEngineer" title="Ideas & Planning">🤔</a></td>
       <td align="center" valign="top" width="14.28%"><a href="https://github.com/LeonardoRick"><img src="https://avatars.githubusercontent.com/u/17517057?v=4" width="100px;" alt=""/><br /><sub><b>Leonardo Rick</b></sub></a><br /><a href="#bug-LeonardoRick" title="Bug reports">🐛</a> <a href="#ideas-LeonardoRick" title="Ideas & Planning">🤔</a></td>
       <td align="center" valign="top" width="14.28%"><a href="https://github.com/kenbanks-peng"><img src="https://avatars.githubusercontent.com/u/26904200?v=4" width="100px;" alt=""/><br /><sub><b>Ken Banks</b></sub></a><br /><a href="#bug-kenbanks-peng" title="Bug reports">🐛</a></td>
-    </tr>
+    </tr><br />
     <tr>
       <td align="center" valign="top" width="14.28%"><a href="https://github.com/rstacruz"><img src="https://avatars.githubusercontent.com/u/74385?v=4" width="100px;" alt=""/><br /><sub><b>Rico Sta. Cruz</b></sub></a><br /><a href="#ideas-rstacruz" title="Ideas & Planning">🤔</a></td>
       <td align="center" valign="top" width="14.28%"><a href="https://github.com/acidnik"><img src="https://avatars.githubusercontent.com/u/1227955?v=4" width="100px;" alt=""/><br /><sub><b>Nikita Bilous</b></sub></a><br /><a href="#bug-acidnik" title="Bug reports">🐛</a></td>
@@ -137,7 +151,7 @@ Thanks goes to these wonderful people:
       <td align="center" valign="top" width="14.28%"><a href="https://github.com/nodnarbnitram"><img src="https://avatars.githubusercontent.com/u/44812862?v=4" width="100px;" alt=""/><br /><sub><b>Brandon Martin</b></sub></a><br /><a href="#bug-nodnarbnitram" title="Bug reports">🐛</a></td>
       <td align="center" valign="top" width="14.28%"><a href="https://github.com/alpertarhan"><img src="https://avatars.githubusercontent.com/u/50966980?v=4" width="100px;" alt=""/><br /><sub><b>Alper Tarhan</b></sub></a><br /><a href="#bug-alpertarhan" title="Bug reports">🐛</a></td>
       <td align="center" valign="top" width="14.28%"><a href="https://github.com/asolopovas"><img src="https://avatars.githubusercontent.com/u/6893216?v=4" width="100px;" alt=""/><br /><sub><b>Andrius Solopovas</b></sub></a><br /><a href="#bug-asolopovas" title="Bug reports">🐛</a></td>
-    </tr>
+    </tr><br />
     <tr>
       <td align="center" valign="top" width="14.28%"><a href="https://github.com/GrahamJenkins"><img src="https://avatars.githubusercontent.com/u/6607975?v=4" width="100px;" alt=""/><br /><sub><b>Graham Jenkins</b></sub></a><br /><a href="#bug-GrahamJenkins" title="Bug reports">🐛</a></td>
       <td align="center" valign="top" width="14.28%"><a href="https://github.com/wings1848"><img src="https://avatars.githubusercontent.com/u/120104016?v=4" width="100px;" alt=""/><br /><sub><b>Wings Butterfly</b></sub></a><br /><a href="#bug-wings1848" title="Bug reports">🐛</a></td>
@@ -146,7 +160,7 @@ Thanks goes to these wonderful people:
       <td align="center" valign="top" width="14.28%"><a href="https://github.com/fmatray"><img src="https://avatars.githubusercontent.com/u/8267716?v=4" width="100px;" alt=""/><br /><sub><b>Frédéric</b></sub></a><br /><a href="#bug-fmatray" title="Bug reports">🐛</a></td>
       <td align="center" valign="top" width="14.28%"><a href="https://github.com/fuentesjr"><img src="https://avatars.githubusercontent.com/u/9240?v=4" width="100px;" alt=""/><br /><sub><b>Salvador Fuentes Jr</b></sub></a><br /><a href="#bug-fuentesjr" title="Bug reports">🐛</a></td>
       <td align="center" valign="top" width="14.28%"><a href="https://github.com/Viterkim"><img src="https://avatars.githubusercontent.com/u/17838985?v=4" width="100px;" alt=""/><br /><sub><b>Viktor</b></sub></a><br /><a href="#bug-Viterkim" title="Bug reports">🐛</a></td>
-    </tr>
+    </tr><br />
     <tr>
       <td align="center" valign="top" width="14.28%"><a href="https://github.com/ortonomy"><img src="https://avatars.githubusercontent.com/u/6688676?v=4" width="100px;" alt=""/><br /><sub><b>Gregory Orton</b></sub></a><br /><a href="#bug-ortonomy" title="Bug reports">🐛</a></td>
       <td align="center" valign="top" width="14.28%"><a href="https://github.com/jimallen"><img src="https://avatars.githubusercontent.com/u/868773?v=4" width="100px;" alt=""/><br /><sub><b>Jim Allen</b></sub></a><br /><a href="#bug-jimallen" title="Bug reports">🐛</a></td>
@@ -155,7 +169,7 @@ Thanks goes to these wonderful people:
       <td align="center" valign="top" width="14.28%"><a href="https://github.com/chozandrias76"><img src="https://avatars.githubusercontent.com/u/2087677?v=4" width="100px;" alt=""/><br /><sub><b>Colin Swenson-Healey</b></sub></a><br /><a href="#bug-chozandrias76" title="Bug reports">🐛</a></td>
       <td align="center" valign="top" width="14.28%"><a href="https://github.com/JustlyAI"><img src="https://avatars.githubusercontent.com/u/12634140?v=4" width="100px;" alt=""/><br /><sub><b>Laurent Wiesel</b></sub></a><br /><a href="#bug-JustlyAI" title="Bug reports">🐛</a></td>
       <td align="center" valign="top" width="14.28%"><a href="https://github.com/stark-bit"><img src="https://avatars.githubusercontent.com/u/44064758?v=4" width="100px;" alt=""/><br /><sub><b>Rei Starks</b></sub></a><br /><a href="#bug-stark-bit" title="Bug reports">🐛</a></td>
-    </tr>
+    </tr><br />
     <tr>
       <td align="center" valign="top" width="14.28%"><a href="https://github.com/robertoecf"><img src="https://avatars.githubusercontent.com/u/54923863?v=4" width="100px;" alt=""/><br /><sub><b>Roberto Freitas</b></sub></a><br /><a href="#bug-robertoecf" title="Bug reports">🐛</a></td>
       <td align="center" valign="top" width="14.28%"><a href="https://github.com/tmttodd"><img src="https://avatars.githubusercontent.com/u/160077416?v=4" width="100px;" alt=""/><br /><sub><b>tmttodd</b></sub></a><br /><a href="#bug-tmttodd" title="Bug reports">🐛</a></td>
@@ -164,15 +178,19 @@ Thanks goes to these wonderful people:
       <td align="center" valign="top" width="14.28%"><a href="http://jasonrimmer.com/"><img src="https://avatars.githubusercontent.com/u/629?v=4" width="100px;" alt=""/><br /><sub><b>Jason Rimmer</b></sub></a><br /><a href="#bug-jrimmer" title="Bug reports">🐛</a></td>
       <td align="center" valign="top" width="14.28%"><a href="https://github.com/ArthurHeymans"><img src="https://avatars.githubusercontent.com/u/15137817?v=4" width="100px;" alt=""/><br /><sub><b>Arthur Heymans</b></sub></a><br /><a href="#ideas-ArthurHeymans" title="Ideas & Planning">🤔</a></td>
       <td align="center" valign="top" width="14.28%"><a href="https://github.com/Blue-B"><img src="https://avatars.githubusercontent.com/u/55532956?v=4" width="100px;" alt=""/><br /><sub><b>Blue-B</b></sub></a><br /><a href="#bug-Blue-B" title="Bug reports">🐛</a></td>
-    </tr>
+    </tr><br />
     <tr>
       <td align="center" valign="top" width="14.28%"><a href="https://github.com/bisko"><img src="https://avatars.githubusercontent.com/u/184938?v=4" width="100px;" alt=""/><br /><sub><b>Biser Perchinkov</b></sub></a><br /><a href="#bug-bisko" title="Bug reports">🐛</a></td>
       <td align="center" valign="top" width="14.28%"><a href="https://github.com/xificurC"><img src="https://avatars.githubusercontent.com/u/4800719?v=4" width="100px;" alt=""/><br /><sub><b>Peter Nagy</b></sub></a><br /><a href="#bug-xificurC" title="Bug reports">🐛</a></td>
       <td align="center" valign="top" width="14.28%"><a href="https://github.com/orest-tokovenko-block"><img src="https://avatars.githubusercontent.com/u/190554467?v=4" width="100px;" alt=""/><br /><sub><b>Orest Tokovenko</b></sub></a><br /><a href="#bug-orest-tokovenko-block" title="Bug reports">🐛</a></td>
+      <td align="center" valign="top" width="14.28%"><a href="https://eisterman.dev/"><img src="https://avatars.githubusercontent.com/u/3028953?v=4" width="100px;" alt=""/><br /><sub><b>Federico Pasqua</b></sub></a><br /><a href="#bug-eisterman" title="Bug reports">🐛</a></td>
+      <td align="center" valign="top" width="14.28%"><a href="https://github.com/ymek"><img src="https://avatars.githubusercontent.com/u/300569?v=4" width="100px;" alt=""/><br /><sub><b>Myke Stubbs</b></sub></a><br /><a href="#code-ymek" title="Code">💻</a> <a href="#bug-ymek" title="Bug reports">🐛</a></td>
+      <td align="center" valign="top" width="14.28%"><a href="https://github.com/black-snow"><img src="https://avatars.githubusercontent.com/u/579733?v=4" width="100px;" alt=""/><br /><sub><b>Ronald</b></sub></a><br /><a href="#bug-black-snow" title="Bug reports">🐛</a></td>
     </tr>
-  </tbody>
+</tbody>
 </table>
 
+
 <!-- markdownlint-restore -->
 <!-- prettier-ignore-end -->
 

package/dist/clients/bootstrap.js

@@ -63,7 +63,7 @@ export function loadBootstrapClients() {
                 return [];
             }
         }
-        const [ruffClient, biomeClient, knipClient, todoScanner, jscpdClient, depChecker, testRunnerClient, metricsClient, complexityClient, goClient, govulncheckClient, gitleaksClient, trivyClient, rustClient, agentBehaviorClient, deadCodeClients,] = await Promise.all([
+        const [ruffClient, biomeClient, knipClient, todoScanner, jscpdClient, depChecker, testRunnerClient, metricsClient, complexityClient, goClient, govulncheckClient, gitleaksClient, trivyClient, opengrepClient, rustClient, agentBehaviorClient, deadCodeClients,] = await Promise.all([
             load("ruff", async () => new (await import("./ruff-client.js")).RuffClient()),
             load("biome", async () => new (await import("./biome-client.js")).BiomeClient()),
             load("knip", async () => new (await import("./knip-client.js")).KnipClient()),
@@ -77,6 +77,7 @@ export function loadBootstrapClients() {
             load("govulncheck", async () => new (await import("./govulncheck-client.js")).GovulncheckClient()),
             load("gitleaks", async () => new (await import("./gitleaks-client.js")).GitleaksClient()),
             load("trivy", async () => new (await import("./trivy-client.js")).TrivyClient()),
+            load("opengrep", async () => new (await import("./opengrep-client.js")).OpengrepClient()),
             load("rust", async () => new (await import("./rust-client.js")).RustClient()),
             load("agent-behavior", async () => new (await import("./agent-behavior-client.js")).AgentBehaviorClient()),
             loadList("dead-code", async () => (await import("./dead-code-client.js")).getDeadCodeClients()),
@@ -97,6 +98,7 @@ export function loadBootstrapClients() {
             govulncheckClient,
             gitleaksClient,
             trivyClient,
+            opengrepClient,
             rustClient,
             agentBehaviorClient,
             deadCodeClients,

package/dist/clients/bus-events-logger.js

@@ -0,0 +1,53 @@
+/**
+ * Persistent NDJSON trace of `pi.events` bus publish attempts
+ * (`pilens:files:touched` #482 / `pilens:diagnostics` #502 /
+ * `pilens:format:queued` + `pilens:format:start` #673).
+ *
+ * All four producers (clients/bus-publish.ts, clients/diagnostics-publish.ts,
+ * clients/format-events-publish.ts) are fire-and-forget: on failure or on a
+ * structural no-op (never wired, kill switch off) they only invoke an
+ * optional `dbg` callback, which varies by host and is a documented no-op in
+ * the MCP host (clients/mcp/session.ts's `dbg: noop`). That leaves
+ * bus-publish outcomes invisible in exactly the context where they matter
+ * most — same failure shape as the #544 MCP session_start incident this repo
+ * already fixed once.
+ *
+ * This module gives bus events the same durable trace every other pi-lens
+ * subsystem already has (latency.log, cascade.log, read-guard.log, ...) —
+ * see clients/latency-logger.ts for the house pattern this mirrors exactly:
+ * one shared `createNdjsonLogger` writer, `isTestMode()` no-op guard,
+ * `getBusEventsLogPath()` for testability.
+ *
+ * Logging volume: `emitted` and `emit_failed` are logged on every call —
+ * they're the two outcomes an operator actually needs a per-event trace for.
+ * `skipped_unwired` and `skipped_disabled` are process-lifetime-static facts
+ * (wiring happens once at extension factory time; the kill switch is an env
+ * var read once at startup) — logging them on every publish attempt would
+ * spam one identical line per write batch for an entire session with zero
+ * new information after the first. Both are gated log-once-per-process, the
+ * same `hasLoggedFailure` shape the producers already use for emit_failed.
+ * The empty-batch branch (`paths.length === 0` / `files.length === 0`) is
+ * NOT logged at all: every call site already guards against invoking these
+ * functions with nothing to report (see clients/pipeline.ts,
+ * clients/runtime-agent-end.ts), so it's a normal, frequent no-op rather
+ * than a real event worth a log line.
+ */
+import * as path from "node:path";
+import { isTestMode } from "./env-utils.js";
+import { getGlobalPiLensDir } from "./file-utils.js";
+import { createNdjsonLogger } from "./ndjson-logger.js";
+const BUS_EVENTS_LOG_FILE = path.join(getGlobalPiLensDir(), "bus-events.log");
+const writer = createNdjsonLogger({ filePath: BUS_EVENTS_LOG_FILE });
+export function logBusEvent(entry) {
+    if (isTestMode()) {
+        return;
+    }
+    writer.log({ ts: new Date().toISOString(), ...entry });
+}
+export function getBusEventsLogPath() {
+    return BUS_EVENTS_LOG_FILE;
+}
+/** Resolve once all enqueued bus-event writes are on disk (tests/shutdown). */
+export function flushBusEventsLog() {
+    return writer.flush();
+}

package/dist/clients/bus-publish.js

@@ -17,12 +17,19 @@
  * callback is invoked at most once on first failure so a wired caller can log
  * it without spamming.
  */
+import { logBusEvent } from "./bus-events-logger.js";
 import { normalizeFilePath } from "./path-utils.js";
 import { appendRecentTouches } from "./recent-touches.js";
 export const BUS_FILES_TOUCHED_EVENT = "pilens:files:touched";
 export const BUS_FILES_TOUCHED_VERSION = 1;
 let busEmit;
 let hasLoggedFailure = false;
+// Log-once-per-process guards for the two structural-no-op outcomes below
+// (see bus-events-logger.ts's module doc for why these aren't logged on
+// every call — both are static, session-lifetime facts, not transient
+// per-event failures).
+let hasLoggedUnwired = false;
+let hasLoggedDisabled = false;
 /**
  * Wire the emit function from pi's `pi.events` bus. Called once at extension
  * factory time from index.ts (module-level singleton, same pattern as
@@ -37,6 +44,8 @@ export function wireBusEmitter(emitFn) {
 export function _resetForTests() {
     busEmit = undefined;
     hasLoggedFailure = false;
+    hasLoggedUnwired = false;
+    hasLoggedDisabled = false;
     _envCache = undefined;
 }
 let _envCache;
@@ -73,8 +82,18 @@ export function publishFilesTouched(args) {
         return;
     if (args.paths.length === 0)
         return;
-    if (!isBusPublishEnabled())
+    if (!isBusPublishEnabled()) {
+        if (!hasLoggedDisabled) {
+            hasLoggedDisabled = true;
+            logBusEvent({
+                event: BUS_FILES_TOUCHED_EVENT,
+                outcome: "skipped_disabled",
+                cwd: normalizeFilePath(args.cwd),
+                reason: args.reason,
+            });
+        }
         return;
+    }
     void appendRecentTouches({
         cwd: args.cwd,
         reason: args.reason,
@@ -83,8 +102,18 @@ export function publishFilesTouched(args) {
     }).catch((err) => {
         args.dbg?.(`bus-publish: recent-touches append failed: ${err}`);
     });
-    if (!busEmit)
+    if (!busEmit) {
+        if (!hasLoggedUnwired) {
+            hasLoggedUnwired = true;
+            logBusEvent({
+                event: BUS_FILES_TOUCHED_EVENT,
+                outcome: "skipped_unwired",
+                cwd: normalizeFilePath(args.cwd),
+                reason: args.reason,
+            });
+        }
         return;
+    }
     try {
         const payload = {
             v: BUS_FILES_TOUCHED_VERSION,
@@ -100,8 +129,22 @@ export function publishFilesTouched(args) {
             }));
         }
         busEmit(BUS_FILES_TOUCHED_EVENT, payload);
+        logBusEvent({
+            event: BUS_FILES_TOUCHED_EVENT,
+            outcome: "emitted",
+            cwd: payload.cwd,
+            reason: args.reason,
+            fileCount: payload.paths.length,
+        });
     }
     catch (err) {
+        logBusEvent({
+            event: BUS_FILES_TOUCHED_EVENT,
+            outcome: "emit_failed",
+            cwd: normalizeFilePath(args.cwd),
+            reason: args.reason,
+            error: String(err),
+        });
         if (!hasLoggedFailure) {
             hasLoggedFailure = true;
             args.dbg?.(`bus-publish: pilens:files:touched emit failed (further failures suppressed): ${err}`);

package/dist/clients/cache/rule-cache.js

@@ -8,6 +8,7 @@ import * as crypto from "node:crypto";
 import * as fs from "node:fs";
 import * as path from "node:path";
 import { getProjectDataDir } from "../file-utils.js";
+import { readJsonCache } from "../json-cache-read.js";
 const CACHE_VERSION = "v3";
 export class RuleCache {
     cacheFile;
@@ -36,12 +37,15 @@ export class RuleCache {
             this.ensureCacheDir();
             if (!fs.existsSync(this.cacheFile))
                 return null;
-            const cached = JSON.parse(fs.readFileSync(this.cacheFile, "utf-8"));
             const currentHash = this.computeRuleHash(ruleFiles);
-            if (cached.version !== CACHE_VERSION || cached.ruleHash !== currentHash) {
-                return null; // Cache invalid
-            }
-            return cached;
+            const cached = readJsonCache(this.cacheFile, (parsed) => {
+                const entry = parsed;
+                if (entry.version !== CACHE_VERSION || entry.ruleHash !== currentHash) {
+                    return undefined; // Cache invalid
+                }
+                return entry;
+            });
+            return cached ?? null;
         }
         catch {
             return null;

package/dist/clients/cache-manager.js

@@ -11,6 +11,7 @@
 import * as fs from "node:fs";
 import * as path from "node:path";
 import { getProjectDataDir } from "./file-utils.js";
+import { readJsonCache } from "./json-cache-read.js";
 import { normalizeMapKey } from "./path-utils.js";
 // --- Defaults ---
 const DEFAULT_MAX_AGE_MS = 30 * 60 * 1000; // 30 minutes
@@ -72,13 +73,20 @@ export class CacheManager {
             return null;
         }
         try {
-            const meta = JSON.parse(fs.readFileSync(metaPath, "utf-8"));
+            const onReadError = (err) => {
+                this.log(`Cache read error: ${scanner} — ${err}`);
+            };
+            const meta = readJsonCache(metaPath, (parsed) => parsed, onReadError);
+            if (meta === undefined)
+                return null;
             const age = Date.now() - new Date(meta.timestamp).getTime();
             if (age > maxAgeMs) {
                 this.log(`Cache stale: ${scanner} (age: ${Math.round(age / 1000)}s, max: ${maxAgeMs / 1000}s)`);
                 return null;
             }
-            const data = JSON.parse(fs.readFileSync(cachePath, "utf-8"));
+            const data = readJsonCache(cachePath, (parsed) => parsed, onReadError);
+            if (data === undefined)
+                return null;
             this.log(`Cache hit: ${scanner} (age: ${Math.round(age / 1000)}s)`);
             return { data, meta };
         }
@@ -111,7 +119,9 @@ export class CacheManager {
         if (!fs.existsSync(metaPath))
             return false;
         try {
-            const meta = JSON.parse(fs.readFileSync(metaPath, "utf-8"));
+            const meta = readJsonCache(metaPath, (parsed) => parsed);
+            if (meta === undefined)
+                return false;
             const age = Date.now() - new Date(meta.timestamp).getTime();
             return age <= maxAgeMs;
         }
@@ -150,16 +160,12 @@ export class CacheManager {
                 lastUpdated: new Date().toISOString(),
             };
         }
-        try {
-            return JSON.parse(fs.readFileSync(statePath, "utf-8"));
-        }
-        catch {
-            return {
-                ...DEFAULT_TURN_STATE,
-                files: {},
-                lastUpdated: new Date().toISOString(),
-            };
-        }
+        const state = readJsonCache(statePath, (parsed) => parsed);
+        return (state ?? {
+            ...DEFAULT_TURN_STATE,
+            files: {},
+            lastUpdated: new Date().toISOString(),
+        });
     }
     /**
      * Write turn state.

package/dist/clients/code-quality-warnings.js

@@ -135,6 +135,33 @@ export function buildCodeQualityWarningsReport(args) {
         },
     };
 }
+/**
+ * #557 audit (same race class as #555's LSP client fix and #560's
+ * `widget-state.ts` `recordDiagnostics` fix): pi-lens deliberately allows
+ * concurrent pipeline runs for the SAME file across DIFFERENT same-turn
+ * edits (dedupe key is `filePath + contentHash`, not just `filePath` — see
+ * `clients/runtime-tool-result.ts`), so a per-key cache fed directly from
+ * those concurrent pipeline runs needs an ordering guard (`WriteOrderingGuard`
+ * from `clients/write-ordering-guard.ts`) or an older edit's slower pipeline
+ * can silently overwrite a newer edit's fresher write.
+ *
+ * This call site is NOT exposed to that race. Unlike `widget-state.ts`'s
+ * `recordDiagnostics` (called directly from `clients/pipeline.ts`, once per
+ * pipeline run — i.e. potentially several times per turn, out of completion
+ * order), `writeCodeQualityWarningsReport` has exactly one caller:
+ * `handleTurnEnd` in `clients/runtime-turn.ts`, which per-edit pipeline runs
+ * never call directly — they only feed `runtime.recordCodeQualityWarnings`
+ * (an accumulating, order-independent Map). `handleTurnEnd` itself reads that
+ * accumulator once via `runtime.peekCodeQualityWarnings()` and writes the
+ * aggregate report exactly once per turn-end invocation — the same single
+ * sequential turn-end-only shape already confirmed safe for
+ * `writeActionableWarningsReport` in `clients/actionable-warnings.ts`, right
+ * next to this call site in `handleTurnEnd`. No second writer, so no
+ * ordering token to guard against — see
+ * `tests/clients/code-quality-warnings.test.ts`'s
+ * "single sequential caller" test, which pins this invariant so a future
+ * change that adds a second call site has a better chance of being caught.
+ */
 export function writeCodeQualityWarningsReport(cacheManager, cwd, report) {
     cacheManager.writeCache("code-quality-warnings", report, cwd);
 }

package/dist/clients/dead-code-client.js

@@ -11,10 +11,8 @@
  * Phase 1 ships Python via `vulture`. Future phases add Go/Rust/etc. by
  * implementing DeadCodeClient and adding to getDeadCodeClients().
  */
-import * as fs from "node:fs";
-import * as os from "node:os";
 import * as path from "node:path";
-import { isAtOrAboveHomeDir } from "./path-utils.js";
+import { findNearestMarkerRoot } from "./path-utils.js";
 import { safeSpawnAsync } from "./safe-spawn.js";
 function emptyResult(language) {
     return {
@@ -108,34 +106,18 @@ export class PythonDeadCodeClient {
      * Nearest dir with a Python project marker, never at/above $HOME and never
      * escaping a VCS boundary — same containment rules as KnipClient so a scan
      * launched from a bare cwd can't recurse the whole home tree (#250/#296).
+     * Delegates to the shared path-utils helper (refs #625) rather than
+     * hand-rolling the climb; only the marker list differs from KnipClient's.
      */
     resolveProjectRoot(startDir, homeDirOverride) {
-        const markers = [
+        return findNearestMarkerRoot(startDir, [
             "pyproject.toml",
             "setup.py",
             "setup.cfg",
             "requirements.txt",
             "Pipfile",
             "tox.ini",
-        ];
-        const boundaries = [".git", ".hg", ".svn"];
-        const homeDir = path.resolve(homeDirOverride ?? os.homedir());
-        let current = path.resolve(startDir);
-        for (let depth = 0; depth < 64; depth++) {
-            if (isAtOrAboveHomeDir(current, homeDir))
-                return null;
-            if (markers.some((m) => fs.existsSync(path.join(current, m)))) {
-                return current;
-            }
-            if (boundaries.some((m) => fs.existsSync(path.join(current, m)))) {
-                return null;
-            }
-            const parent = path.dirname(current);
-            if (parent === current)
-                return null;
-            current = parent;
-        }
-        return null;
+        ], { boundaries: [".git", ".hg", ".svn"], homeDir: homeDirOverride });
     }
     async ensureAvailable() {
         if (this.available !== null)