pi-lens 3.8.73 → 3.8.74

package/dist/clients/call-graph.js

@@ -65,6 +65,26 @@ export function impact(graph, startKey, maxDepth = 3, minWeight = 0.1) {
     // Sort by depth then symbolKey for stable output
     return results.sort((a, b) => a.depth - b.depth || a.symbolKey.localeCompare(b.symbolKey));
 }
+/**
+ * Splits a `SymbolKey` into its file and symbol-name parts. Two shapes exist
+ * (see `buildCallGraph` above): the normal `"filePath:symbolName"` form, and
+ * the file-level fallback `"file:filePath"` used when no enclosing symbol was
+ * found for a call site (module-level code). Splitting at the LAST colon
+ * (rather than a naive `split(":")`) means a Windows drive letter in
+ * `filePath` (`C:\...`) is never mistaken for the name/file separator; the
+ * `"file:"` fallback is matched as a literal prefix first so it isn't
+ * misparsed by the same last-colon rule.
+ */
+export function parseSymbolKey(key) {
+    if (key.startsWith("file:")) {
+        return { filePath: key.slice("file:".length) };
+    }
+    const idx = key.lastIndexOf(":");
+    if (idx === -1)
+        return { filePath: key };
+    const symbolName = key.slice(idx + 1);
+    return { filePath: key.slice(0, idx), symbolName: symbolName || undefined };
+}
 /**
  * Format an impact result set as a compact human-readable summary.
  * Example: "handleToolResult (WillBreak) → handleAgentEnd (MayBreak) → 3 Review callers"

package/dist/clients/cascade-logger.js

@@ -2,9 +2,13 @@ import * as path from "node:path";
 import { isTestMode } from "./env-utils.js";
 import { getGlobalPiLensDir } from "./file-utils.js";
 import { createNdjsonLogger } from "./ndjson-logger.js";
+import { getMaxLogSizeMB } from "./log-cleanup.js";
 const CASCADE_LOG_DIR = getGlobalPiLensDir();
 const CASCADE_LOG_FILE = path.join(CASCADE_LOG_DIR, "cascade.log");
-const writer = createNdjsonLogger({ filePath: CASCADE_LOG_FILE });
+const writer = createNdjsonLogger({
+    filePath: CASCADE_LOG_FILE,
+    maxBytes: getMaxLogSizeMB() * 1024 * 1024,
+});
 export function logCascade(entry) {
     if (isTestMode()) {
         return;

package/dist/clients/complexity-client.js

@@ -12,7 +12,7 @@
  */
 import * as fs from "node:fs";
 import * as path from "node:path";
-import { firstChildOfType, parseTreeSitterRoot, resolveTreeSitterLanguage, walk, } from "./tree-sitter-shared.js";
+import { firstChildOfType, withTreeSitterRoot, resolveTreeSitterLanguage, walk, } from "./tree-sitter-shared.js";
 // JS/TS/JSX share one grammar shape.
 const JSTS = {
     functionLike: new Set([
@@ -387,21 +387,18 @@ export class ComplexityClient {
         if (!nodes)
             return null;
         let content;
-        let root;
         try {
             if (!fs.existsSync(absolutePath))
                 return null;
             content = fs.readFileSync(absolutePath, "utf-8");
-            root = await parseTreeSitterRoot(absolutePath, content);
         }
         catch (err) {
-            this.log(`Read/parse error for ${filePath}: ${err.message}`);
+            this.log(`Read error for ${filePath}: ${err.message}`);
             return null;
         }
-        if (!root)
-            return null;
         try {
-            return this.computeMetrics(absolutePath, content, root, nodes);
+            const parsed = await withTreeSitterRoot(absolutePath, content, (root) => this.computeMetrics(absolutePath, content, root, nodes));
+            return parsed.parsed ? parsed.value : null;
         }
         catch (err) {
             this.log(`Analysis error for ${filePath}: ${err.message}`);

package/dist/clients/dependency-checker.js

@@ -60,6 +60,29 @@ export function parseMadgeSkips(stderr) {
     const local = specifiers.filter((s) => s.startsWith(".") || s.startsWith("/") || /^[a-zA-Z]:[\\/]/.test(s));
     return { total, local };
 }
+/**
+ * Defensive cap on concurrent madge spawns for a single `checkFilesBatch`
+ * call. A turn usually only touches 1-3 import-changed files, so this rarely
+ * binds — it just guards against a pathological turn (bulk rename/move) from
+ * fork-bombing subprocesses.
+ */
+const MADGE_BATCH_CONCURRENCY = 6;
+/** Run `mapper` over `items` with at most `concurrency` in flight at once. */
+async function mapWithConcurrency(items, concurrency, mapper) {
+    if (items.length === 0)
+        return;
+    let nextIndex = 0;
+    const workerCount = Math.max(1, Math.min(concurrency, items.length));
+    const workers = Array.from({ length: workerCount }, async () => {
+        while (true) {
+            const index = nextIndex++;
+            if (index >= items.length)
+                return;
+            await mapper(items[index]);
+        }
+    });
+    await Promise.all(workers);
+}
 // --- Client ---
 export class DependencyChecker {
     available = null;
@@ -258,6 +281,33 @@ export class DependencyChecker {
         return promise;
     }
     async runCheckFile(normalized, projectRoot) {
+        const spawnResult = await this.runMadgeSpawn(normalized, projectRoot);
+        if (!spawnResult.ok) {
+            return {
+                hasCircular: false,
+                circular: [],
+                checked: false,
+                cacheHit: false,
+            };
+        }
+        this.lastCircular = spawnResult.circular;
+        this.circularFiles = spawnResult.circularFiles;
+        return {
+            hasCircular: spawnResult.circular.length > 0,
+            circular: spawnResult.circular.filter((d) => d.file === normalized || d.path.includes(normalized)),
+            checked: true,
+            cacheHit: false,
+            localSkips: spawnResult.localSkips,
+        };
+    }
+    /**
+     * Run madge on a single file and parse its cycle output. Pure: unlike
+     * `runCheckFile`, this does NOT mutate `lastCircular`/`circularFiles` — it
+     * hands the parsed result back so callers can apply the shared-state update
+     * themselves (`runCheckFile` does so immediately; `checkFilesBatch` defers
+     * it so concurrent spawns can't clobber each other's writes, see #766).
+     */
+    async runMadgeSpawn(normalized, projectRoot) {
         this.log(`Imports changed for ${path.basename(normalized)}, checking dependencies...`);
         // Run madge on the specific file (fast)
         try {
@@ -268,12 +318,7 @@ export class DependencyChecker {
             });
             if (result.error) {
                 this.log(`Check error: ${result.error.message}`);
-                return {
-                    hasCircular: false,
-                    circular: [],
-                    checked: false,
-                    cacheHit: false,
-                };
+                return { ok: false };
             }
             const output = result.stdout || "[]";
             const parsed = JSON.parse(output);
@@ -291,29 +336,115 @@ export class DependencyChecker {
                     path: resolvedPaths,
                 });
             }
-            this.lastCircular = circular;
-            this.circularFiles = circularFiles;
             const skips = parseMadgeSkips(result.stderr || "");
             if (skips.local.length > 0) {
                 this.log(`madge skipped ${skips.local.length} local file(s) (possible silent cycle-miss): ${skips.local.slice(0, 5).join(", ")}`);
             }
-            return {
-                hasCircular: circular.length > 0,
-                circular: circular.filter((d) => d.file === normalized || d.path.includes(normalized)),
-                checked: true,
-                cacheHit: false,
-                localSkips: skips.local.length,
-            };
+            return { ok: true, circular, circularFiles, localSkips: skips.local.length };
         }
         catch (err) {
             this.log(`Check error: ${err.message}`);
-            return {
-                hasCircular: false,
-                circular: [],
-                checked: false,
+            return { ok: false };
+        }
+    }
+    /** Build the cache-hit `DepCheckResult` for `normalized` from current shared state. */
+    buildCachedResult(normalized) {
+        return {
+            hasCircular: this.circularFiles.has(normalized),
+            circular: this.lastCircular.filter((d) => d.file === normalized || d.path.includes(normalized)),
+            checked: true,
+            cacheHit: true,
+        };
+    }
+    /**
+     * Batch-check multiple files for circular deps in one turn-end pass,
+     * running the madge subprocess spawns concurrently (bounded by
+     * `MADGE_BATCH_CONCURRENCY`) instead of one at a time (#766).
+     *
+     * Equivalence with the sequential `for…await checkFile(file)` loop it
+     * replaces:
+     *  - Classification (existence + `importsChanged`) runs synchronously in
+     *    original array order first — identical to what each sequential
+     *    `checkFile()` call would do, including the `importCache` side effect.
+     *  - Only the actual madge spawns for import-changed ("miss") files run
+     *    concurrently; each one's parsed result stays LOCAL (no shared-state
+     *    write) until every spawn has settled.
+     *  - The shared `lastCircular`/`circularFiles` state is then folded by
+     *    replaying the miss results in ORIGINAL array order (not completion
+     *    order), so the final state — and each cache-hit file's result, which
+     *    reads the state as of its position in the array — is byte-for-byte
+     *    what the sequential last-write-wins loop would have produced. No
+     *    concurrent write can clobber another's, because none are applied
+     *    until after `Promise.all` resolves.
+     */
+    async checkFilesBatch(filePaths, cwd) {
+        const projectRoot = path.resolve(cwd || process.cwd());
+        const results = new Map();
+        const entries = [];
+        for (const file of filePaths) {
+            const normalized = path.resolve(projectRoot, file);
+            if (!fs.existsSync(normalized)) {
+                entries.push({ kind: "missing", file });
+                continue;
+            }
+            entries.push(this.importsChanged(normalized)
+                ? { kind: "miss", file, normalized }
+                : { kind: "hit", file, normalized });
+        }
+        const missEntries = entries.filter((e) => e.kind === "miss");
+        const notAvailableResult = {
+            hasCircular: false,
+            circular: [],
+            checked: false,
+            cacheHit: false,
+        };
+        if (missEntries.length > 0 && !(await this.ensureAvailable())) {
+            // madge unavailable: mirrors checkFile()'s "not available" branch for
+            // every miss; hits still read whatever shared state already exists.
+            for (const entry of entries) {
+                if (entry.kind === "hit") {
+                    results.set(entry.file, this.buildCachedResult(entry.normalized));
+                }
+                else {
+                    results.set(entry.file, notAvailableResult);
+                }
+            }
+            return results;
+        }
+        // Run the concurrent (bounded) madge spawns for the miss set only. Each
+        // result stays local — keyed by normalized path — until folded below.
+        const spawnResults = new Map();
+        await mapWithConcurrency(missEntries, MADGE_BATCH_CONCURRENCY, async (entry) => {
+            spawnResults.set(entry.normalized, await this.runMadgeSpawn(entry.normalized, projectRoot));
+        });
+        // Fold in original order: each miss overwrites the shared state exactly
+        // as the sequential loop would, and each hit is resolved against the
+        // state as folded up to (but not past) its own position.
+        for (const entry of entries) {
+            if (entry.kind === "missing") {
+                results.set(entry.file, notAvailableResult);
+                continue;
+            }
+            if (entry.kind === "hit") {
+                results.set(entry.file, this.buildCachedResult(entry.normalized));
+                continue;
+            }
+            const spawnResult = spawnResults.get(entry.normalized);
+            if (!spawnResult || !spawnResult.ok) {
+                results.set(entry.file, notAvailableResult);
+                continue;
+            }
+            this.lastCircular = spawnResult.circular;
+            this.circularFiles = spawnResult.circularFiles;
+            results.set(entry.file, {
+                hasCircular: spawnResult.circular.length > 0,
+                circular: spawnResult.circular.filter((d) => d.file === entry.normalized || d.path.includes(entry.normalized)),
+                checked: true,
                 cacheHit: false,
-            };
+                localSkips: spawnResult.localSkips,
+            });
         }
+        return results;
     }
     /**
      * Format circular dependency warning for LLM

package/dist/clients/diagnostic-dispositions.js

@@ -73,9 +73,29 @@ const deferredThisSession = new Set();
 export function normalizeMessage(message) {
     return message.replace(/\s+/g, " ").trim().toLowerCase();
 }
+// Anchor derivation chokepoint (#1024, #210 class): the `dd:`/`ddw:` id builders
+// (computeStrictAnchor/computeWeakAnchor) both derive their path component here,
+// so a mark and its later lookup diverge whenever the two callers pass different
+// path FORMS of the same file. That is exactly the bug: the mark tool
+// (lens-diagnostic-mark.ts) passes a RAW cwd / `path.resolve(cwd, arg)`, while
+// the dispatch read side (dispatcher.ts createDispatchContext) passes
+// `normalizeMapKey`-canonicalized cwd/filePath — so a Windows drive/segment
+// case, symlink/realpath, or slash difference between the two forms silently
+// orphans the agent's own false-positive/flagged mark (a #533 dropped-signal).
+// Canonicalize BOTH inputs through `normalizeMapKey` (the SAME normalizer the
+// read side already relies on — realpathSync.native on Windows) BEFORE computing
+// the relative path, so write and read produce identical anchors regardless of
+// the form the caller held. `normalizeMapKey` is idempotent, so the already-
+// canonicalized read side is unaffected; the realpath I/O is acceptable here
+// because dispositions are marked/applied far less often than the per-write
+// widget hot path, and the read side already pays exactly this cost. Semantics
+// are unchanged: the `..`-escape fallback still returns the canonical filePath,
+// only now in the same canonical form the non-escape branch uses.
 function relativeFile(filePath, cwd) {
-    const rel = path.relative(cwd, filePath).replace(/\\/g, "/");
-    return rel && !rel.startsWith("..") ? rel : normalizeMapKey(filePath);
+    const canonicalCwd = normalizeMapKey(cwd);
+    const canonicalFile = normalizeMapKey(filePath);
+    const rel = path.relative(canonicalCwd, canonicalFile).replace(/\\/g, "/");
+    return rel && !rel.startsWith("..") ? rel : canonicalFile;
 }
 /** Site-specific anchor — see module doc. Used only for false-positive. */
 export function computeStrictAnchor(args) {

package/dist/clients/dispatch/auxiliary-lsp.js

@@ -58,6 +58,35 @@ export function isNosemgrepSuppressed(d, content) {
     return (checkLine(lines[startLine], false) ||
         checkLine(lines[startLine - 1], true));
 }
+/**
+ * zizmor's own native inline suppression: `# zizmor: ignore[audit-id[,audit-id]]`
+ * on the finding's own line (https://docs.zizmor.sh/usage/#ignoring-results —
+ * zizmor calls this "inline ignores"). Honoring it here mirrors
+ * `isNosemgrepSuppressed` for Opengrep — a per-finding suppression path a repo
+ * can reach for even without its own `zizmor.yml` (#971): e.g. a `# zizmor:
+ * ignore[artipacked]` on a checkout-only job's `actions/checkout` step, or
+ * `# zizmor: ignore[adhoc-packages]` on a `npm pack` tarball's local install
+ * line, both cases the audit has no way to tell "checkout-only, no artifact
+ * upload" or "this is testing our own just-built tarball" apart from a
+ * remote-package install without this local, human-authored signal.
+ */
+const ZIZMOR_IGNORE_RE = /#\s*zizmor:\s*ignore\[([^\]]+)\]/i;
+export function isZizmorIgnoreSuppressed(d, content) {
+    const startLine = d.range?.start?.line; // 0-based
+    if (startLine == null)
+        return false;
+    const line = content.split("\n")[startLine];
+    if (!line)
+        return false;
+    const match = ZIZMOR_IGNORE_RE.exec(line);
+    if (!match)
+        return false;
+    const ruleId = String(d.code ?? "").toLowerCase();
+    return match[1]
+        .split(",")
+        .map((s) => s.trim().toLowerCase())
+        .includes(ruleId);
+}
 // #277 R7: every profile below used this exact same rule (ERROR-severity
 // findings block only when the workspace opted into curated/authored rules;
 // everything else stays advisory) — shared here instead of copy-pasted per
@@ -118,6 +147,11 @@ export const AUXILIARY_LSP_PROFILES = [
         allowBlocking: (cwd) => Boolean(findLocalZizmorConfig(cwd)),
         semantic: blockOnErrorWhenAllowed,
         defectClass: (d) => classifyDefect(String(d.code ?? ""), "zizmor", d.message ?? ""),
+        // Honor zizmor's own native per-finding suppression (#971) — a documented
+        // escape hatch for a workflow-context judgment call the audit itself has no
+        // way to make (checkout-only vs. artifact-uploading job; a locally-built
+        // tarball install vs. an arbitrary remote package).
+        isSuppressed: isZizmorIgnoreSuppressed,
     },
     {
         serverId: "typos",

package/dist/clients/dispatch/dispatcher.js

@@ -22,6 +22,7 @@ import { isTestFile } from "../file-utils.js";
 import { getPrimaryDispatchGroup } from "../language-policy.js";
 import { resolveLanguageRootForFile } from "../language-profile.js";
 import { logLatency } from "../latency-logger.js";
+import { isSpawnableCommand } from "../installer/index.js";
 import { normalizeMapKey } from "../path-utils.js";
 import { loadPiLensProjectConfig } from "../project-lens-config.js";
 import { RUNTIME_CONFIG, getRunnerTimeoutFloorMs } from "../runtime-config.js";
@@ -79,6 +80,12 @@ async function checkToolAvailability(command, facts) {
     if (cached !== undefined) {
         return cached;
     }
+    // A command that isn't even on disk can't pass a --version probe; the ~μs
+    // stat/PATH walk saves a guaranteed-to-fail spawn round-trip per cold tool.
+    if (!(await isSpawnableCommand(command))) {
+        facts.setSessionFact(key, false);
+        return false;
+    }
     try {
         const result = await safeSpawnAsync(command, ["--version"], {
             timeout: 5000,
@@ -563,7 +570,15 @@ export async function dispatchForFile(ctx, groups, registry, onRunnerResult) {
     // #690: agent/user disposition layer — drop false-positive/suppress marks
     // and anything deferred this session. flagged marks are left in place;
     // lens_diagnostics tags them at render time via the same anchor.
-    const dispositionFiltered = applyDispositions(inlineSuppressed, ctx.cwd, ctx.filePath, fileContent);
+    //
+    // #1030: anchor + store MUST key off the PROJECT ROOT, not ctx.cwd. In a
+    // monorepo ctx.cwd is the nested language root (resolveLanguageRootForFile,
+    // used for tool/config resolution), but the mark tool writes dispositions
+    // under runtime.projectRoot. Keying the read on ctx.cwd computed a different
+    // anchor AND opened a different diagnostic-dispositions.json (getProjectDataDir
+    // is keyed on cwd), so every false-positive/flagged/defer on a file under a
+    // nested marker silently no-op'd. Read from the project root to match the write.
+    const dispositionFiltered = applyDispositions(inlineSuppressed, ctx.projectRoot ?? ctx.cwd, ctx.filePath, fileContent);
     let visibleDiagnostics = dispositionFiltered;
     let resolvedCount = 0;
     if (ctx.deltaMode && previousBaseline) {

package/dist/clients/dispatch/fact-store.js

@@ -19,6 +19,17 @@ export class FactStore {
     hasFileFact(filePath, factId) {
         return this.fileFacts.get(normalizeMapKey(filePath))?.has(factId) ?? false;
     }
+    /** Drop one file fact without disturbing the file's derived facts.
+     *  Removes the per-file entry too when the deleted fact was its last value. */
+    deleteFileFact(filePath, factId) {
+        const key = normalizeMapKey(filePath);
+        const facts = this.fileFacts.get(key);
+        if (!facts)
+            return;
+        facts.delete(factId);
+        if (facts.size === 0)
+            this.fileFacts.delete(key);
+    }
     /** Clear facts for one specific file only. Use at the start of each per-file dispatch call.
      *  Preserves facts for other files computed in the same turn.
      *  Normalizes filePath internally — callers pass raw paths. */

package/dist/clients/dispatch/facts/function-facts.js

@@ -217,6 +217,19 @@ function collectReceiverTypes(body, params) {
     });
     return types;
 }
+/**
+ * Does this function/method declaration have an explicit `: Promise<...>`
+ * return type? The `type_annotation` for a return type is a DIRECT child of
+ * the function node itself (after `formal_parameters`, before the body) —
+ * distinct from a parameter's own `type_annotation`, which is nested inside
+ * `formal_parameters` and therefore invisible to `firstChildOfType` here.
+ */
+function hasExplicitPromiseReturnType(node) {
+    const returnType = firstChildOfType(node, "type_annotation");
+    if (!returnType)
+        return false;
+    return /:\s*Promise\b/.test(returnType.text);
+}
 function hasAwaitInNode(node) {
     let found = false;
     walk(node, (n) => {
@@ -283,6 +296,7 @@ export const functionFactProvider = {
                     isPassThroughWrapper: passThrough.pass,
                     passThroughTarget: passThrough.target,
                     isBoundaryWrapper,
+                    hasExplicitPromiseReturnType: hasExplicitPromiseReturnType(node),
                     cyclomaticComplexity: calcCyclomaticComplexity(body),
                     maxNestingDepth: calcMaxNestingDepth(body),
                     outgoingCalls: collectOutgoingCalls(body),