pi-lens 3.8.69 → 3.8.71

package/dist/clients/dispatch/runners/lsp.js

@@ -16,7 +16,7 @@ import { RUNTIME_CONFIG } from "../../runtime-config.js";
 import { PRIORITY } from "../priorities.js";
 import { resolveRunnerPath } from "../runner-context.js";
 import { convertLspDiagnostics } from "../utils/lsp-diagnostics.js";
-import { enabledAuxiliaryLspServerIds, findAuxiliaryProfileForSource, } from "../auxiliary-lsp.js";
+import { enabledAuxiliaryLspServerIds, retagAuxiliaryDiagnostics, } from "../auxiliary-lsp.js";
 import { readFileContent } from "./utils.js";
 const LSP_MAX_FILE_BYTES = RUNTIME_CONFIG.pipeline.lspMaxFileBytes;
 const LSP_MAX_FILE_LINES = RUNTIME_CONFIG.pipeline.lspMaxFileLines;
@@ -104,6 +104,11 @@ const lspRunner = {
         // spawn that didn't complete in the budget, or LSP unavailable for this
         // file) — distinct from `[]`, which means the server replied with zero.
         let lspClientReady = true;
+        // True when touchFile ran but couldn't confirm its result within
+        // budget (notify write and/or diagnostics wait timed out on at least
+        // one spawned server) — an empty `lspDiags` in that case is NOT a
+        // confirmed clean result and must not be reported as one (#570).
+        let diagnosticsInconclusive = false;
         let failureReason = "";
         const content = readFileContent(ctx.filePath);
         if (!content) {
@@ -133,6 +138,7 @@ const lspRunner = {
             }
             else {
                 lspDiags = touched;
+                diagnosticsInconclusive = touched.inconclusive === true;
             }
         }
         catch (err) {
@@ -173,6 +179,18 @@ const lspRunner = {
             // published late still land in the client cache and surface then.
             return { status: "skipped", diagnostics: [], semantic: "none" };
         }
+        if (diagnosticsInconclusive) {
+            // The touch ran and a client was ready, but the notify write and/or
+            // diagnostics wait hit their deadline before the server confirmed
+            // completion — `lspDiags` (even if non-empty) is not a trustworthy
+            // merged result. Same treatment as `!lspClientReady`: report
+            // "skipped" rather than "succeeded" with a possibly-incomplete
+            // diagnostics list, so the coverage notice flags the gap instead of
+            // the footer reading this as a confirmed clean/partial result (#570).
+            // Diagnostics that do arrive late still land in the client cache and
+            // surface on the next edit.
+            return { status: "skipped", diagnostics: [], semantic: "none" };
+        }
         if (lspDiags.length === 0) {
             return {
                 status: "succeeded",
@@ -207,39 +225,10 @@ const lspRunner = {
         // convertLspDiagnostics maps validLspDiags 1:1, so re-tag any
         // auxiliary-sourced diagnostics (opengrep emits source "Semgrep", …) with
         // their tool id + semantic policy — language-server diagnostics keep "lsp".
-        // blockingAllowed is per-workspace (e.g. curated repo rules), computed once.
-        const blockingAllowedByProfile = new Map();
-        // Diagnostics dropped by the tool's NATIVE inline suppression (e.g. opengrep
-        // `# nosemgrep`, #441). Reuses `content` from the sync read above.
-        const suppressedIndices = new Set();
-        for (let i = 0; i < diagnostics.length; i++) {
-            const profile = findAuxiliaryProfileForSource(validLspDiags[i]?.source);
-            if (!profile)
-                continue;
-            if (profile.isSuppressed) {
-                if (profile.isSuppressed(validLspDiags[i], content)) {
-                    suppressedIndices.add(i);
-                    continue;
-                }
-            }
-            let blockingAllowed = blockingAllowedByProfile.get(profile);
-            if (blockingAllowed === undefined) {
-                blockingAllowed = profile.allowBlocking?.(ctx.cwd) ?? false;
-                blockingAllowedByProfile.set(profile, blockingAllowed);
-            }
-            const d = diagnostics[i];
-            d.tool = profile.tool;
-            d.semantic = profile.semantic(validLspDiags[i], { blockingAllowed });
-            if (d.semantic !== "blocking" && d.severity === "error") {
-                d.severity = "warning";
-            }
-            const defectClass = profile.defectClass?.(validLspDiags[i]);
-            if (defectClass)
-                d.defectClass = defectClass;
-        }
-        const keptDiagnostics = suppressedIndices.size
-            ? diagnostics.filter((_, i) => !suppressedIndices.has(i))
-            : diagnostics;
+        // #692: shared with the scan/sweep reconcile paths (`retagAuxiliaryDiagnostics`
+        // in `../auxiliary-lsp.js`) so a scan-reconciled aux finding gets identical
+        // tool/semantic/defectClass tagging instead of keeping tool "lsp".
+        const keptDiagnostics = retagAuxiliaryDiagnostics(diagnostics, validLspDiags, content, { cwd: ctx.cwd, fileRole: ctx.fileRole });
         const hasErrors = keptDiagnostics.some((d) => d.semantic === "blocking");
         const resultSemantic = hasErrors
             ? "blocking"

package/dist/clients/dispatch/runners/oxlint.js

@@ -44,7 +44,7 @@ const oxlintRunner = {
     appliesTo: ["jsts"],
     priority: PRIORITY.LINT_SECONDARY,
     enabledByDefault: true,
-    skipTestFiles: true,
+    skipTestFiles: false,
     async run(ctx) {
         const cwd = ctx.cwd || process.cwd();
         const policy = getJstsLintPolicyForCwd(cwd);

package/dist/clients/dispatch/suppress-writer.js

@@ -0,0 +1,68 @@
+/**
+ * Writes the `pi-lens-ignore` suppression comment that inline-suppressions.ts
+ * already knows how to read (#690's `suppress` disposition). The reader
+ * accepts either `//` or `#` on any line regardless of language, but the
+ * WRITER must pick the syntactically valid comment character for the target
+ * file — an errant `#` line breaks parsing in a `//`-comment language and
+ * vice versa.
+ */
+import * as path from "node:path";
+const HASH_COMMENT_EXTENSIONS = new Set([
+    ".py",
+    ".rb",
+    ".sh",
+    ".bash",
+    ".zsh",
+    ".yml",
+    ".yaml",
+    ".toml",
+    ".r",
+    ".pl",
+    ".pm",
+    ".ex",
+    ".exs",
+    ".elixir",
+    ".dockerfile",
+    ".gitignore",
+    ".conf",
+    ".cfg",
+    ".ini",
+]);
+function commentPrefixFor(filePath) {
+    const ext = path.extname(filePath).toLowerCase();
+    return HASH_COMMENT_EXTENSIONS.has(ext) ? "#" : "//";
+}
+/**
+ * Insert a `pi-lens-ignore: <rule>` comment on the line immediately above
+ * `line` (1-based), matching inline-suppressions.ts's "same line or line
+ * above" read semantics. If the line above already carries a pi-lens-ignore
+ * comment, the rule is appended to its list instead of adding a duplicate
+ * comment line. Returns the updated content; throws if `line` is out of range.
+ */
+export function insertSuppressComment(content, filePath, line, rule) {
+    const lines = content.split(/\r?\n/);
+    if (line < 1 || line > lines.length) {
+        throw new Error(`line ${line} is out of range (file has ${lines.length} lines)`);
+    }
+    const prefix = commentPrefixFor(filePath);
+    const aboveIdx = line - 2; // 0-based index of the line immediately above
+    const existingAbove = aboveIdx >= 0 ? lines[aboveIdx] : undefined;
+    const suppressRe = /((?:\/\/|#)\s*pi-lens-ignore:\s*)(.+)$/;
+    const match = existingAbove !== undefined ? suppressRe.exec(existingAbove) : null;
+    if (match && existingAbove !== undefined) {
+        const rules = match[2]
+            .split(",")
+            .map((r) => r.trim())
+            .filter(Boolean);
+        if (!rules.includes(rule))
+            rules.push(rule);
+        lines[aboveIdx] = existingAbove.slice(0, match.index) + match[1] + rules.join(", ");
+        return lines.join("\n");
+    }
+    // Match the indentation of the flagged line so the inserted comment lines
+    // up rather than sitting at column 0.
+    const targetLine = lines[line - 1] ?? "";
+    const indent = /^\s*/.exec(targetLine)?.[0] ?? "";
+    lines.splice(line - 1, 0, `${indent}${prefix} pi-lens-ignore: ${rule}`);
+    return lines.join("\n");
+}

package/dist/clients/dispatch/utils/lsp-diagnostics.js

@@ -7,7 +7,9 @@ export function convertLspDiagnostics(diags, filePath, options = {}) {
         const severity = severityMap[d.severity] ?? "info";
         const semantic = d.severity === 1 ? "blocking" : (d.severity === 2 ? "warning" : "none");
         const code = String(d.code ?? "unknown");
-        const source = options.source ?? d.source ?? tool;
+        // #692: identity ALWAYS derives from the diagnostic's own source — never
+        // from a caller-supplied scan label (see `scanOrigin`'s doc comment above).
+        const source = d.source ?? tool;
         const hasSuggestion = options.fixSuggestionByIndex?.has(idx) ?? false;
         return {
             id: `${tool}:${code}:${d.range.start.line}`,
@@ -23,6 +25,7 @@ export function convertLspDiagnostics(diags, filePath, options = {}) {
             autoFixAvailable: false,
             fixKind: hasSuggestion ? "suggestion" : undefined,
             fixSuggestion: options.fixSuggestionByIndex?.get(idx),
+            scanOrigin: options.scanOrigin,
         };
     });
 }

package/dist/clients/disposition-logger.js

@@ -0,0 +1,39 @@
+/**
+ * NDJSON telemetry log for diagnostic disposition marks (#690). Same shape as
+ * clients/actionable-warnings-logger.ts: machine-global (getGlobalPiLensDir),
+ * size-capped with a single `.log.1` backup, isTestMode no-op.
+ *
+ * Why a log at all: #181 identified false-positive marks flowing to telemetry
+ * as THE highest-value rule-tuning signal — which shipped rules misfire, on
+ * what tools, how often — and this is that hookup. The disposition store
+ * itself is not enough: it keeps only the LATEST entry per anchor (a re-mark
+ * overwrites), and `defer` marks never touch the store at all (in-memory by
+ * design), so this log is the only durable trace of both re-mark history and
+ * defer activity.
+ */
+import * as path from "node:path";
+import { isTestMode } from "./env-utils.js";
+import { getGlobalPiLensDir } from "./file-utils.js";
+import { createNdjsonLogger } from "./ndjson-logger.js";
+const DISPOSITION_LOG_DIR = getGlobalPiLensDir();
+const DISPOSITION_LOG_FILE = path.join(DISPOSITION_LOG_DIR, "dispositions.log");
+const DISPOSITION_LOG_BACKUP_FILE = path.join(DISPOSITION_LOG_DIR, "dispositions.log.1");
+const MAX_LOG_BYTES = Math.max(128 * 1024, Number.parseInt(process.env.PI_LENS_DISPOSITION_LOG_MAX_BYTES ?? "1048576", 10) || 1048576);
+const writer = createNdjsonLogger({
+    filePath: DISPOSITION_LOG_FILE,
+    maxBytes: MAX_LOG_BYTES,
+    backupPath: DISPOSITION_LOG_BACKUP_FILE,
+});
+export function logDispositionEvent(entry) {
+    if (isTestMode()) {
+        return;
+    }
+    writer.log({ ts: new Date().toISOString(), ...entry });
+}
+export function getDispositionLogPath() {
+    return DISPOSITION_LOG_FILE;
+}
+/** Resolve once all enqueued disposition writes are on disk. */
+export function flushDispositionLog() {
+    return writer.flush();
+}

package/dist/clients/disposition-publish.js

@@ -0,0 +1,109 @@
+/**
+ * Publishes `pilens:diagnostic:disposition` on pi's shared `pi.events` bus
+ * (#690).
+ *
+ * Sibling to `clients/diagnostics-publish.ts` (#502) rather than a new export
+ * inside it, per the "owns nothing in common" rule spelled out in
+ * format-events-publish.ts's header: the event is diagnostic-DOMAIN, but it
+ * shares none of diagnostics-publish's module state or contract —
+ * dispositions are point-in-time FACTS ("a mark just happened"), not
+ * full-replace state snapshots, so the seq counter, the
+ * previously-reported-dirty set, and the whole staleness/replace consumer
+ * contract over there simply don't apply here. Only the emit plumbing shape
+ * and the `PI_LENS_BUS_PUBLISH` kill switch (`isBusPublishEnabled`, imported
+ * from bus-publish.ts) are shared, same as every other producer sibling.
+ *
+ * Fire-and-forget: publishing must never affect the mark path's success or
+ * latency. Any failure is swallowed; `dbg` fires at most once per process on
+ * first failure so a wired caller can log it without spamming.
+ *
+ * Versioning policy: frozen-additive, same discipline as #482/#502. New
+ * optional fields may be added under `v: 1`; a breaking change to an existing
+ * field's meaning must bump `v`.
+ */
+import { logBusEvent } from "./bus-events-logger.js";
+import { isBusPublishEnabled } from "./bus-publish.js";
+import { normalizeFilePath } from "./path-utils.js";
+export const BUS_DISPOSITION_EVENT = "pilens:diagnostic:disposition";
+export const BUS_DISPOSITION_VERSION = 1;
+let busEmit;
+let hasLoggedFailure = false;
+let hasLoggedUnwired = false;
+let hasLoggedDisabled = false;
+/**
+ * Wire the emit function from pi's `pi.events` bus. Called once at extension
+ * factory time from index.ts, same call as `wireDiagnosticsBusEmitter` (#502)
+ * — both producers share the identical `pi.events.emit` binding. Never called
+ * ⇒ `publishDisposition` no-ops, which is exactly the state unit tests and
+ * the MCP server path run in (no pi host, no `pi.events`).
+ */
+export function wireDispositionBusEmitter(emitFn) {
+    busEmit = emitFn;
+}
+/** Test-only: reset module state between test files. */
+export function _resetDispositionPublishForTests() {
+    busEmit = undefined;
+    hasLoggedFailure = false;
+    hasLoggedUnwired = false;
+    hasLoggedDisabled = false;
+}
+/**
+ * Publish one `pilens:diagnostic:disposition` event for a mark (one event per
+ * markDisposition call). Fire-and-forget: never throws, never awaited.
+ */
+export function publishDisposition(args) {
+    if (!isBusPublishEnabled()) {
+        if (!hasLoggedDisabled) {
+            hasLoggedDisabled = true;
+            logBusEvent({
+                event: BUS_DISPOSITION_EVENT,
+                outcome: "skipped_disabled",
+                cwd: normalizeFilePath(args.cwd),
+            });
+        }
+        return;
+    }
+    if (!busEmit) {
+        if (!hasLoggedUnwired) {
+            hasLoggedUnwired = true;
+            logBusEvent({
+                event: BUS_DISPOSITION_EVENT,
+                outcome: "skipped_unwired",
+                cwd: normalizeFilePath(args.cwd),
+            });
+        }
+        return;
+    }
+    try {
+        const payload = {
+            v: BUS_DISPOSITION_VERSION,
+            source: "pi-lens",
+            cwd: normalizeFilePath(args.cwd),
+            filePath: normalizeFilePath(args.filePath),
+            disposition: args.disposition,
+            tool: args.tool,
+            rule: args.rule,
+            line: args.line,
+            anchor: args.anchor,
+            reason: args.reason,
+        };
+        busEmit(BUS_DISPOSITION_EVENT, payload);
+        logBusEvent({
+            event: BUS_DISPOSITION_EVENT,
+            outcome: "emitted",
+            cwd: payload.cwd,
+        });
+    }
+    catch (err) {
+        logBusEvent({
+            event: BUS_DISPOSITION_EVENT,
+            outcome: "emit_failed",
+            cwd: normalizeFilePath(args.cwd),
+            error: String(err),
+        });
+        if (!hasLoggedFailure) {
+            hasLoggedFailure = true;
+            args.dbg?.(`disposition-publish: pilens:diagnostic:disposition emit failed (further failures suppressed): ${err}`);
+        }
+    }
+}

package/dist/clients/file-utils.js

@@ -5,8 +5,9 @@ import * as fs from "node:fs";
 import * as os from "node:os";
 import * as path from "node:path";
 import { minimatch } from "./deps/minimatch.js";
+import { collectTrackedFiles, getTrackedFilesSnapshot } from "./git-tracked-ignore.js";
 import { getGlobalIgnorePatterns, getPiLensGlobalConfigPath, } from "./lens-config.js";
-import { normalizeFilePath } from "./path-utils.js";
+import { normalizeEphemeralMapKey, normalizeFilePath } from "./path-utils.js";
 import { findPiLensProjectConfig, loadPiLensProjectConfig, } from "./project-lens-config.js";
 import { safeSpawnAsync } from "./safe-spawn.js";
 /**
@@ -167,7 +168,7 @@ function stripTrailingSpaces(value) {
         end -= 1;
     return value.slice(0, end).replace(/\\ /g, " ");
 }
-function parseGitignoreContent(content) {
+function parseGitignoreContent(content, layer) {
     const patterns = [];
     for (const rawLine of content.split(/\r?\n/)) {
         let line = stripTrailingSpaces(rawLine.trimStart());
@@ -195,6 +196,7 @@ function parseGitignoreContent(content) {
             directoryOnly,
             rooted,
             hasSlash: line.includes("/"),
+            layer,
         });
     }
     return patterns;
@@ -225,10 +227,10 @@ function matchesGitignorePattern(pattern, relativePath, isDirectory) {
         return candidates.some((value) => minimatch(value, expanded, options));
     });
 }
-export function readGitignorePatterns(rootDir) {
+export function readGitignorePatterns(rootDir, layer = "gitignore") {
     const gitignorePath = path.join(rootDir, ".gitignore");
     try {
-        return parseGitignoreContent(fs.readFileSync(gitignorePath, "utf-8"));
+        return parseGitignoreContent(fs.readFileSync(gitignorePath, "utf-8"), layer);
     }
     catch {
         return [];
@@ -264,7 +266,7 @@ function buildProjectIgnoreMatcher(resolvedRoot, patterns) {
         });
         return nextPatterns;
     };
-    // Per-matcher path → boolean memo. The matcher itself is cached by
+    // Per-matcher path → pattern-verdict memo. The matcher itself is cached by
     // `getProjectIgnoreMatcher` keyed on `.gitignore` mtime, so this Map's
     // lifetime is bounded to a single set of ignore rules — when any
     // `.gitignore` changes, the matcher is rebuilt and the memo is dropped
@@ -272,41 +274,97 @@ function buildProjectIgnoreMatcher(resolvedRoot, patterns) {
     // jscpd, call-graph, source-filter, pipeline) recomputes O(ancestorDirs ×
     // patterns) per file, multiplying into 2-3s of pure CPU on a 2k-file
     // project. With it, the second visitor of the same path is O(1).
-    const isIgnoredMemo = new Map();
+    //
+    // #703: this memoizes only the PATTERN verdict (which is deterministic —
+    // it never changes for a given matcher instance), NOT the tracked-aware
+    // final verdict. The tracked-files set can transition from "not yet
+    // primed" to "primed" mid-process (a walker calls `ensureTrackedIndex()`
+    // partway through the matcher's lifetime), so baking the tracked check
+    // into this memo would let an early, pre-priming call poison every later
+    // lookup of the same path for this matcher's entire cache lifetime. The
+    // tracked-set lookup itself is a cheap Set#has over syntactically-folded
+    // keys (see `isTrackedAndRescued` — no `realpathSync` anywhere in this
+    // function), and — critically — it's only ever paid for paths a pattern
+    // already flagged as ignored, so it doesn't reintroduce the per-file cost
+    // this memo exists to avoid for the common (not-ignored) case.
+    const patternMemo = new Map();
+    // #703 perf follow-up: `normalizeEphemeralMapKey` (cheap slash-fold +
+    // Windows-lowercase, zero fs I/O), NOT `normalizeMapKey` (realpath-backed).
+    // This runs on every `isIgnored` call that reaches this branch — walks
+    // over this repo alone visit thousands of pattern-ignored compiled
+    // `*.js`/`*.d.ts` files, and `dispatch/integration.ts`'s per-edit cascade
+    // check hits it too — so a `realpathSync` here would violate the
+    // event-loop/slow-FS discipline `isIgnored` is required to keep (#462: 75x
+    // slower on 9p/drvfs). Both `resolved` (this matcher's own `path.resolve`,
+    // never realpath'd) and the tracked-set's keys (`git-tracked-ignore.ts`,
+    // realpath'd ONCE per fetch on the shared root, not per file) are
+    // self-consistent within one process/session, which is exactly
+    // `normalizeEphemeralMapKey`'s contract — see that function's doc and
+    // `git-tracked-ignore.ts`'s module doc for the full reasoning. Accepted
+    // edge case: a symlinked or 8.3-short-name project root can make the cheap
+    // fold miss even after the fetch side's one realpath — the file then stays
+    // pattern-ignored, i.e. degrades to today's (pre-#703) behavior, which is
+    // consistent with this whole feature's fail-open contract.
+    function isTrackedAndRescued(resolved) {
+        const snapshot = getTrackedFilesSnapshot(resolvedRoot);
+        if (!snapshot)
+            return false; // never primed / git unavailable: fail-open to pattern-only
+        return snapshot.has(normalizeEphemeralMapKey(resolved));
+    }
     return {
         rootDir: resolvedRoot,
         patterns,
+        ensureTrackedIndex() {
+            return collectTrackedFiles(resolvedRoot).then(() => undefined);
+        },
         isIgnored(filePath, isDirectory = false) {
             const resolved = path.resolve(filePath);
             // Two namespaces (D: for directory queries, F: for file queries)
             // because gitignore semantics differ for trailing-slash patterns.
             const memoKey = (isDirectory ? "D:" : "F:") + resolved;
-            const cached = isIgnoredMemo.get(memoKey);
-            if (cached !== undefined)
-                return cached;
-            const rootRelative = path.relative(resolvedRoot, resolved);
-            if (!rootRelative ||
-                rootRelative.startsWith("..") ||
-                path.isAbsolute(rootRelative)) {
-                isIgnoredMemo.set(memoKey, false);
-                return false;
-            }
-            let ignored = false;
-            const patternDirs = ancestorDirsBetween(resolvedRoot, path.dirname(resolved));
-            for (const dir of patternDirs) {
-                const dirPatterns = patternsForDir(dir);
-                if (dirPatterns.length === 0)
-                    continue;
-                const relative = path.relative(dir, resolved);
-                const normalized = normalizeIgnorePath(relative);
-                for (const pattern of dirPatterns) {
-                    if (!matchesGitignorePattern(pattern, normalized, isDirectory))
-                        continue;
-                    ignored = !pattern.negated;
+            let verdict = patternMemo.get(memoKey);
+            if (verdict === undefined) {
+                const rootRelative = path.relative(resolvedRoot, resolved);
+                if (!rootRelative ||
+                    rootRelative.startsWith("..") ||
+                    path.isAbsolute(rootRelative)) {
+                    verdict = { ignored: false, layer: undefined };
+                }
+                else {
+                    let ignored = false;
+                    let layer;
+                    const patternDirs = ancestorDirsBetween(resolvedRoot, path.dirname(resolved));
+                    for (const dir of patternDirs) {
+                        const dirPatterns = patternsForDir(dir);
+                        if (dirPatterns.length === 0)
+                            continue;
+                        const relative = path.relative(dir, resolved);
+                        const normalized = normalizeIgnorePath(relative);
+                        for (const pattern of dirPatterns) {
+                            if (!matchesGitignorePattern(pattern, normalized, isDirectory))
+                                continue;
+                            ignored = !pattern.negated;
+                            layer = pattern.layer;
+                        }
+                    }
+                    verdict = { ignored, layer };
                 }
+                patternMemo.set(memoKey, verdict);
             }
-            isIgnoredMemo.set(memoKey, ignored);
-            return ignored;
+            if (!verdict.ignored)
+                return false;
+            // #703 layer semantics: a winning positive match from `global` or
+            // `gitignore` emulates git, so it inherits git's "a tracked file is
+            // never ignored" rule. A winning match from `pilens` is pi-lens-native
+            // intent and stays excluded regardless of tracked status. Directory
+            // queries are never tracked-rescued — the tracked set is a file-id
+            // set, not a directory set.
+            if (!isDirectory &&
+                verdict.layer !== "pilens" &&
+                isTrackedAndRescued(resolved)) {
+                return false;
+            }
+            return true;
         },
     };
 }
@@ -315,10 +373,13 @@ export function createProjectIgnoreMatcher(rootDir, extraPatterns = [], globalPa
     // Precedence is gitignore order: LATER patterns override earlier ones. So
     // global (lowest) → project .gitignore → project .pi-lens.json (highest),
     // which lets a project `!negation` re-include a globally-ignored path (#252).
+    // Each layer is tagged (#703) so `isIgnored` can tell a git-emulating match
+    // (`global`/`gitignore` — subject to "a tracked file is never ignored")
+    // apart from pi-lens-native intent (`pilens` — excludes regardless).
     const patterns = [
-        ...parseGitignoreContent(globalPatterns.join("\n")),
-        ...readGitignorePatterns(resolvedRoot),
-        ...parseGitignoreContent(extraPatterns.join("\n")),
+        ...parseGitignoreContent(globalPatterns.join("\n"), "global"),
+        ...readGitignorePatterns(resolvedRoot, "gitignore"),
+        ...parseGitignoreContent(extraPatterns.join("\n"), "pilens"),
     ];
     return buildProjectIgnoreMatcher(resolvedRoot, patterns);
 }