pi-lens 4.1.2 → 4.1.4

package/dist/clients/generated-artifacts.js

@@ -167,18 +167,95 @@ function hasGeneratedArtifactContent(content) {
     const header = content.slice(0, DEFAULT_HEADER_BYTES);
     return GENERATED_HEADER_PATTERNS.some((pattern) => pattern.test(header));
 }
-// Memoize the generated-banner verdict per (path, mtimeMs, size, maxBytes).
-// The 4 KB header read (openSync + readSync + closeSync) is ~70% of the
-// per-file cost in `collectSourceFiles`, and the same files are re-scanned by
-// multiple background scanners (todo, project-diagnostics, language-profile)
+/**
+ * Content-shape classifier for machine-emitted text (refs #2346).
+ *
+ * A saved/scraped page, a minified bundle, or an embedded data blob is one
+ * giant line or a handful, so mean non-empty line length on already-loaded
+ * content is a language-agnostic generated signature. Extensions covered by
+ * name patterns can never cover it (`.html` has no `.min.`-style convention),
+ * which is the exact gap #2346 hit: a 269 KB scraped page on 38 lines (mean
+ * ~7084/line) drew the full auxiliary scanner stack.
+ *
+ * The threshold is derived from measurement ON THE SHIPPED STATISTIC (the
+ * 4096-byte header/prefix mean, not full-content means — the two differ by
+ * 3-7x on long-paragraph prose). Measured 2026-08-28 across all 3,331 text
+ * files in this repo: the maximum hand-authored prefix mean is 453.2
+ * (`docs/analysisall.md`, unwrapped prose paragraphs); the widest
+ * hand-authored one-line shape observed anywhere probed is a ~2048-char
+ * barrel re-export. The threshold of 2500 sits ~5.5x above the repo's worst
+ * prose file and above every observed hand-authored shape, while the #2346
+ * evidence file (269 KB / 38 lines) remains far above it. Direction of
+ * error is deliberate per #1107: a borderline machine-emitted file that
+ * slips through (false KEEP) costs noise once; a hand-authored file
+ * silently classified generated (false DROP) vanishes from scans with no
+ * signal. Both constants are exported so the tuning claim is checkable and
+ * the regression tests pin the margin probes on both sides.
+ *
+ * Prefix-path quantization: on the 4096-byte header/prefix paths the
+ * achievable means are quantized (~4096 for a one-line prefix, ~2048 for
+ * two lines), so any threshold in (2048, 4096] behaves as "is the first
+ * line longer than 4096 bytes". A machine-emitted file with 2500-4000-char
+ * lines is missed on the prefix path even though its full content would
+ * classify — the deliberate false-KEEP direction, not a continuous 5.5x
+ * margin there. The full-content path (dispatch) has no such quantization.
+ *
+ * Degenerate cases are guarded: content below the minimum byte length never
+ * classifies generated on line shape alone (a 500-byte single-line config
+ * file is not machine-emitted evidence), and an empty or whitespace-only
+ * file yields a zero mean and stays source.
+ */
+export const MACHINE_EMITTED_LINE_SHAPE_MIN_CONTENT = 2048;
+export const MACHINE_EMITTED_LINE_SHAPE_MEAN_THRESHOLD = 2500;
+export function classifyMachineEmittedLineShape(content) {
+    const contentLength = content.length;
+    if (contentLength < MACHINE_EMITTED_LINE_SHAPE_MIN_CONTENT) {
+        return { generated: false, meanLineLength: 0 };
+    }
+    // Single O(contentLength) pass. Deliberately no `split(/\r?\n/)`: a
+    // minified blob's single line can be megabytes, and splitting allocates a
+    // copy of the whole content. `\r` contributes nothing to line length so a
+    // CRLF line is measured by its display width.
+    let nonEmptyLineTotal = 0;
+    let nonEmptyLineCount = 0;
+    let currentLineLength = 0;
+    for (let i = 0; i < contentLength; i++) {
+        const code = content.charCodeAt(i);
+        if (code === 10 /* \n */) {
+            if (currentLineLength > 0) {
+                nonEmptyLineTotal += currentLineLength;
+                nonEmptyLineCount += 1;
+            }
+            currentLineLength = 0;
+        }
+        else if (code !== 13 /* \r */) {
+            currentLineLength += 1;
+        }
+    }
+    if (currentLineLength > 0) {
+        nonEmptyLineTotal += currentLineLength;
+        nonEmptyLineCount += 1;
+    }
+    if (nonEmptyLineCount === 0)
+        return { generated: false, meanLineLength: 0 };
+    const meanLineLength = nonEmptyLineTotal / nonEmptyLineCount;
+    return {
+        generated: meanLineLength > MACHINE_EMITTED_LINE_SHAPE_MEAN_THRESHOLD,
+        meanLineLength,
+    };
+}
+// Memoize the header analysis (banner + line shape) per (path, mtimeMs, size,
+// maxBytes). The 4 KB header read (openSync + readSync + closeSync) is ~70% of
+// the per-file cost in `collectSourceFiles`, and the same files are re-scanned
+// by multiple background scanners (todo, project-diagnostics, language-profile)
 // every session/turn. Keying on mtime+size makes the memo self-invalidating:
 // an edited file misses the cache and is re-read. A single stat replaces the
 // open/read/close on a hit. Bounded to avoid unbounded growth on giant repos.
 const HEADER_VERDICT_MEMO_CAP = 50_000;
-const headerVerdictMemo = new BoundedLruCache(HEADER_VERDICT_MEMO_CAP);
-/** Test-only: drop the header-verdict memo so fixtures don't leak across cases. */
+const headerAnalysisMemo = new BoundedLruCache(HEADER_VERDICT_MEMO_CAP);
+/** Test-only: drop the header-analysis memo so fixtures don't leak across cases. */
 export function _resetGeneratedArtifactCaches() {
-    headerVerdictMemo.clear();
+    headerAnalysisMemo.clear();
 }
 function readFileHeader(filePath, maxBytes = DEFAULT_HEADER_BYTES) {
     let fd;
@@ -202,27 +279,29 @@ function readFileHeader(filePath, maxBytes = DEFAULT_HEADER_BYTES) {
         }
     }
 }
-/**
- * Memoized form of "does this file's header contain a generated-code banner?".
- * Returns `false` when the file cannot be stat'd/read (same fallback as the
- * inline read path). Keyed on path + mtime + size so edits invalidate it.
- */
-function fileHeaderLooksGenerated(filePath, maxBytes) {
+function analyzeFileHeader(filePath, maxBytes) {
     let key;
     try {
         const st = fs.statSync(filePath);
         key = `${st.mtimeMs}:${st.size}:${maxBytes}:${filePath}`;
     }
     catch {
-        return false;
+        return undefined;
     }
-    const cached = headerVerdictMemo.get(key);
+    const cached = headerAnalysisMemo.get(key);
     if (cached !== undefined)
         return cached;
     const header = readFileHeader(filePath, maxBytes);
-    const verdict = header !== undefined && hasGeneratedArtifactContent(header);
-    headerVerdictMemo.set(key, verdict);
-    return verdict;
+    // A header that cannot be read classifies as clean (no banner, no shape
+    // signal) and is memoized as such, mirroring the pre-#2346 fallback.
+    const analysis = header === undefined
+        ? { banner: false, shape: { generated: false, meanLineLength: 0 } }
+        : {
+            banner: hasGeneratedArtifactContent(header),
+            shape: classifyMachineEmittedLineShape(header),
+        };
+    headerAnalysisMemo.set(key, analysis);
+    return analysis;
 }
 /**
  * The full verdict (+ evidence tier) behind {@link isGeneratedOrArtifact}'s
@@ -272,12 +351,28 @@ export function classifyGeneratedOrArtifactDetailed(filePath, options = {}) {
         if (hasGeneratedArtifactContent(options.content)) {
             return { verdict: "generated", evidence: "content" };
         }
+        const shape = classifyMachineEmittedLineShape(options.content);
+        if (shape.generated) {
+            return {
+                verdict: "generated",
+                evidence: "line-shape",
+                lineShapeMean: shape.meanLineLength,
+            };
+        }
         return { verdict: weakNameMatch ? "override" : "clean" };
     }
     if (options.readContentHeader) {
-        if (fileHeaderLooksGenerated(filePath, options.maxHeaderBytes ?? DEFAULT_HEADER_BYTES)) {
+        const analysis = analyzeFileHeader(filePath, options.maxHeaderBytes ?? DEFAULT_HEADER_BYTES);
+        if (analysis?.banner) {
             return { verdict: "generated", evidence: "content" };
         }
+        if (analysis?.shape.generated) {
+            return {
+                verdict: "generated",
+                evidence: "line-shape",
+                lineShapeMean: analysis.shape.meanLineLength,
+            };
+        }
         return { verdict: weakNameMatch ? "override" : "clean" };
     }
     // No content/header probe was supplied or enabled: there is no cheap way

package/dist/clients/generation-guard.js

@@ -50,6 +50,7 @@
  * `GenerationMapOptions.normalizeKey` for the correctness reason the slow
  * path exists at all.
  */
+import { BoundedFifoMap } from "./bounded-cache.js";
 import { incrementDegradationCount } from "./degradation-ledger.js";
 /**
  * Names of every generation-carrying store created through this module.
@@ -136,7 +137,7 @@ export function createGenerationMap(name, options = {}) {
     // Insertion-ordered: the oldest key is evicted first. Re-stamping a key
     // refreshes its position so a hot cwd is not evicted by a burst of
     // one-shot ones.
-    const stamps = new Map();
+    const stamps = new BoundedFifoMap(maxKeys);
     // ONE ticket counter for the whole map. See GenerationMap's doc comment:
     // per-key counters starting at 0 make eviction and forget() fail OPEN.
     // 0 is reserved for "this key holds no stamp" and is never issued.
@@ -149,14 +150,8 @@ export function createGenerationMap(name, options = {}) {
     function issue(key) {
         nextTicket += 1;
         stamps.delete(key);
-        stamps.set(key, nextTicket);
-        while (stamps.size > maxKeys) {
-            const oldest = stamps.keys().next().value;
-            if (oldest === undefined)
-                break;
-            stamps.delete(oldest);
-            invalidations += 1;
-        }
+        const evicted = stamps.set(key, nextTicket);
+        invalidations += evicted.length;
         return nextTicket;
     }
     return {

package/dist/clients/git-guard.js

@@ -207,7 +207,13 @@ function delimitedSubstitutionBody(command, start, opener, closer) {
     }
     return undefined;
 }
-function containsGuardedSubstitution(command, depth) {
+const COMMIT_PUSH_MATCHER = {
+    id: "commit-push",
+    matchesVerb: (verb) => verb === "commit" || verb === "push",
+    indirectAlwaysMatches: true,
+    suppressPostVerbHelp: false,
+};
+function containsGuardedSubstitution(command, depth, matcher) {
     if (depth > 3)
         return false;
     let quote;
@@ -249,8 +255,8 @@ function containsGuardedSubstitution(command, depth) {
                         : undefined;
         if (substitution && substitution.end >= 0) {
             const nested = canonicalizeGuardCommand(substitution.body);
-            if (containsGuardedSubstitution(nested, depth + 1) ||
-                tokenizeShellCommand(nested).some((segment) => containsCommitOrPush(segment.tokens, depth + 1))) {
+            if (containsGuardedSubstitution(nested, depth + 1, matcher) ||
+                tokenizeShellCommand(nested).some((segment) => containsGuardedGitVerb(segment.tokens, depth + 1, matcher))) {
                 return true;
             }
             i = substitution.end;
@@ -258,7 +264,169 @@ function containsGuardedSubstitution(command, depth) {
     }
     return false;
 }
-function containsCommitOrPush(tokens, depth) {
+/** Git global options that consume the following token as their value. */
+const GIT_GLOBAL_OPTIONS_WITH_VALUE = new Set([
+    "-C",
+    "-c",
+    "--config-env",
+    "--git-dir",
+    "--work-tree",
+    "--exec-path",
+    "--namespace",
+]);
+const GIT_GLOBAL_OPTIONS_WITH_INLINE_VALUE = [
+    "--config-env",
+    "--git-dir",
+    "--work-tree",
+    "--exec-path",
+    "--namespace",
+];
+/**
+ * Index of git's subcommand token in `gitTokens` (which starts at the `git`
+ * executable), after skipping global options and their values. Returns
+ * `undefined` when the invocation has no subcommand at all — `git --help`,
+ * `git --version`, or a trailing option with no verb behind it.
+ *
+ * Shared by the direct and indirect paths so both ask the same question about
+ * the same position (#2007).
+ */
+function gitVerbIndex(gitTokens) {
+    let i = 1;
+    while (i < gitTokens.length && gitTokens[i].startsWith("-")) {
+        const option = gitTokens[i];
+        if (["--help", "-h", "--version", "-v", "-V"].includes(option)) {
+            return undefined;
+        }
+        if (option === "--")
+            return i + 1 < gitTokens.length ? i + 1 : undefined;
+        if (["-C", "-c"].some((prefix) => option.startsWith(prefix) && option.length > prefix.length)) {
+            i += 1;
+            continue;
+        }
+        if (GIT_GLOBAL_OPTIONS_WITH_INLINE_VALUE.some((prefix) => option.startsWith(`${prefix}=`))) {
+            i += 1;
+            continue;
+        }
+        i += GIT_GLOBAL_OPTIONS_WITH_VALUE.has(option) ? 2 : 1;
+    }
+    return i < gitTokens.length ? i : undefined;
+}
+/**
+ * True when the subcommand in git's command position is one the matcher
+ * governs. `gitTokens[0]` is the `git` executable token.
+ */
+export function matchGitVerbAtCommandPosition(gitTokens, matcher) {
+    const index = gitVerbIndex(gitTokens);
+    if (index === undefined)
+        return false;
+    const argsAfterVerb = gitTokens.slice(index + 1);
+    // `git checkout --help` prints documentation and touches nothing, and the
+    // global-option walk above cannot see it, because it sits AFTER the verb.
+    //
+    // Only the FIRST argument counts, and only for matchers that opt in. `-h`
+    // deeper in the argv may be an option VALUE rather than a help request —
+    // `git commit -m -h` commits with the message `-h`, `git clean -e -h`
+    // excludes a pattern named `-h`. Reading any position would need a
+    // per-verb table of value-taking options for every governed verb, which is
+    // exactly the hand-maintained parallel list this repo forbids, and every
+    // gap in it would silently UNDER-block. Leading-position-only needs no
+    // table, covers how help is actually invoked, and every other spelling
+    // falls through to a match, which is the safe direction for a guard.
+    if (matcher.suppressPostVerbHelp &&
+        (argsAfterVerb[0] === "--help" || argsAfterVerb[0] === "-h")) {
+        return false;
+    }
+    const verbs = expandGuardVerbToken(gitTokens[index] ?? "");
+    return verbs.length === 1 && matcher.matchesVerb(verbs[0], argsAfterVerb);
+}
+/** Strip one layer of shell quoting the lexer preserved on a value token. */
+function unquoteGuardValue(value) {
+    const trimmed = value.trim();
+    if (trimmed.length >= 2) {
+        const first = trimmed[0];
+        const last = trimmed[trimmed.length - 1];
+        if ((first === '"' || first === "'") && first === last) {
+            return trimmed.slice(1, -1);
+        }
+    }
+    return trimmed;
+}
+/**
+ * The directory a git invocation actually targets (#2007).
+ *
+ * `git -C <dir>` and `--work-tree` retarget the command at a DIFFERENT
+ * directory, so a guard that evaluates the caller's cwd would inspect the
+ * wrong working tree and allow a destructive command against a shared one.
+ * `-C` composes cumulatively, exactly as git applies it; `--work-tree` names
+ * the working tree directly and therefore wins.
+ *
+ * Returns the resolved absolute directory, or `cwd` when the invocation
+ * carries no retargeting option.
+ */
+export function resolveGitTargetDirectory(gitTokens, cwd) {
+    let base = cwd;
+    let workTree;
+    let i = 1;
+    while (i < gitTokens.length && gitTokens[i].startsWith("-")) {
+        const option = gitTokens[i];
+        if (["--help", "-h", "--version", "-v", "-V"].includes(option))
+            break;
+        if (option === "--")
+            break;
+        if (option === "-C" && i + 1 < gitTokens.length) {
+            base = path.resolve(base, unquoteGuardValue(gitTokens[i + 1]));
+            i += 2;
+            continue;
+        }
+        if (option.startsWith("-C") && option.length > 2) {
+            base = path.resolve(base, unquoteGuardValue(option.slice(2)));
+            i += 1;
+            continue;
+        }
+        if (option === "--work-tree" && i + 1 < gitTokens.length) {
+            workTree = unquoteGuardValue(gitTokens[i + 1]);
+            i += 2;
+            continue;
+        }
+        if (option.startsWith("--work-tree=")) {
+            workTree = unquoteGuardValue(option.slice("--work-tree=".length));
+            i += 1;
+            continue;
+        }
+        if (option.startsWith("-c") &&
+            option.length > 2 &&
+            !option.startsWith("--")) {
+            i += 1;
+            continue;
+        }
+        if (GIT_GLOBAL_OPTIONS_WITH_INLINE_VALUE.some((prefix) => option.startsWith(`${prefix}=`))) {
+            i += 1;
+            continue;
+        }
+        i += GIT_GLOBAL_OPTIONS_WITH_VALUE.has(option) ? 2 : 1;
+    }
+    return workTree === undefined ? base : path.resolve(base, workTree);
+}
+/**
+ * Every git invocation the command contains, as token arrays starting at the
+ * `git` executable. Used by callers that must know WHICH directory a matched
+ * command targets, not merely that it matched (#2007).
+ */
+export function collectGitInvocations(toolName, input) {
+    if (toolName !== "bash")
+        return [];
+    const command = getShellCommand(input);
+    if (!command)
+        return [];
+    const invocations = [];
+    for (const segment of tokenizeShellCommand(canonicalizeGuardCommand(command))) {
+        const gitIndex = segment.tokens.findIndex((token) => isGitExecutable(token));
+        if (gitIndex >= 0)
+            invocations.push(segment.tokens.slice(gitIndex));
+    }
+    return invocations;
+}
+function containsGuardedGitVerb(tokens, depth, matcher) {
     if (depth > 3 || tokens.length === 0)
         return false;
     let commandTokens = tokens;
@@ -276,7 +444,7 @@ function containsCommitOrPush(tokens, depth) {
         const runIndex = lower.findIndex((token) => token === "--run");
         if (runIndex >= 0 && runIndex + 1 < commandTokens.length) {
             const nestedCommand = commandTokens.slice(runIndex + 2).join(" ");
-            return tokenizeShellCommand(canonicalizeGuardCommand(nestedCommand)).some((segment) => containsCommitOrPush(segment.tokens, depth + 1));
+            return tokenizeShellCommand(canonicalizeGuardCommand(nestedCommand)).some((segment) => containsGuardedGitVerb(segment.tokens, depth + 1, matcher));
         }
     }
     // These commands consume their following words as text/patterns; a bare
@@ -290,43 +458,14 @@ function containsCommitOrPush(tokens, depth) {
     if (gitIndex >= 0) {
         // Any non-leading git invocation is indirect. Do not maintain a wrapper
         // or flag allowlist: unknown launchers are the security boundary here.
-        if (gitIndex > 0)
+        if (gitIndex > 0 && matcher.indirectAlwaysMatches)
             return true;
-        const gitTokens = commandTokens.slice(gitIndex);
-        let i = 1;
-        const takesValue = new Set([
-            "-C",
-            "-c",
-            "--config-env",
-            "--git-dir",
-            "--work-tree",
-            "--exec-path",
-            "--namespace",
-        ]);
-        while (i < gitTokens.length && gitTokens[i].startsWith("-")) {
-            const option = gitTokens[i];
-            if (["--help", "-h", "--version", "-v", "-V"].includes(option))
-                return false;
-            if (option === "--")
-                return gitTokens[i + 1] === "commit" || gitTokens[i + 1] === "push";
-            if (["-C", "-c"].some((prefix) => option.startsWith(prefix) && option.length > prefix.length)) {
-                i += 1;
-                continue;
-            }
-            if ([
-                "--config-env",
-                "--git-dir",
-                "--work-tree",
-                "--exec-path",
-                "--namespace",
-            ].some((prefix) => option.startsWith(`${prefix}=`))) {
-                i += 1;
-                continue;
-            }
-            i += takesValue.has(option) ? 2 : 1;
-        }
-        const verbs = expandGuardVerbToken(gitTokens[i] ?? "");
-        return verbs.length === 1 && (verbs[0] === "commit" || verbs[0] === "push");
+        // #2007: a guard that protects the agent from its own accident must not
+        // decline `xargs git status`, so the indirect path stays armed only when
+        // a governed verb sits in git's real COMMAND POSITION. Scanning every
+        // token instead would fire on `find . -name checkout | xargs git add`,
+        // where `checkout` is a positional value and not a subcommand at all.
+        return matchGitVerbAtCommandPosition(commandTokens.slice(gitIndex), matcher);
     }
     const leadingExecutable = commandTokens[0] ?? "";
     const knownCommandStringWrapper = isShellWrapper(leadingExecutable) ||
@@ -344,7 +483,7 @@ function containsCommitOrPush(tokens, depth) {
         if (commandIndex >= commandTokens.length)
             return false;
         const nestedCommand = commandTokens.slice(commandIndex).join(" ");
-        return tokenizeShellCommand(canonicalizeGuardCommand(nestedCommand)).some((segment) => containsCommitOrPush(segment.tokens, depth + 1));
+        return tokenizeShellCommand(canonicalizeGuardCommand(nestedCommand)).some((segment) => containsGuardedGitVerb(segment.tokens, depth + 1, matcher));
     }
     const lower = commandTokens.slice(1).map((token) => token.toLowerCase());
     const switchIndex = lower.findIndex((token) => token === "-c" ||
@@ -369,19 +508,30 @@ function containsCommitOrPush(tokens, depth) {
     if (commandTokens[commandIndex] === "--")
         commandIndex += 1;
     const nestedCommand = commandTokens.slice(commandIndex).join(" ");
-    return tokenizeShellCommand(canonicalizeGuardCommand(nestedCommand)).some((segment) => containsCommitOrPush(segment.tokens, depth + 1));
+    return tokenizeShellCommand(canonicalizeGuardCommand(nestedCommand)).some((segment) => containsGuardedGitVerb(segment.tokens, depth + 1, matcher));
 }
-/** Analyze actual executable invocations, not substrings in shell text. */
-export function isGitCommitOrPushAttempt(toolName, input) {
+/**
+ * Analyze actual executable invocations, not substrings in shell text.
+ *
+ * Shared entry point for every guard that needs "is this bash input really a
+ * git invocation of a verb I govern" (#2007). The verb question is the only
+ * parameter; wrapper, substitution, and text-consumer analysis are identical
+ * for all callers by construction.
+ */
+export function detectGuardedGitVerb(toolName, input, matcher) {
     if (toolName !== "bash")
         return false;
     const command = getShellCommand(input);
     if (!command)
         return false;
     const canonical = canonicalizeGuardCommand(command);
-    if (containsGuardedSubstitution(canonical, 0))
+    if (containsGuardedSubstitution(canonical, 0, matcher))
         return true;
-    return tokenizeShellCommand(canonical).some((segment) => containsCommitOrPush(segment.tokens, 0));
+    return tokenizeShellCommand(canonical).some((segment) => containsGuardedGitVerb(segment.tokens, 0, matcher));
+}
+/** The #1063 commit gate's own question. */
+export function isGitCommitOrPushAttempt(toolName, input) {
+    return detectGuardedGitVerb(toolName, input, COMMIT_PUSH_MATCHER);
 }
 function isTurnEndFindingsCache(value) {
     if (!value || typeof value !== "object")
@@ -416,7 +566,7 @@ function markCacheUnknown(runtime, reason) {
 /** Persist a complete, bounded, content-bound guard record. */
 export function writeGitGuardRecord(cacheManager, runtime, cwd, record) {
     const capped = capAffectedFiles(Array.isArray(record.affectedFiles) ? record.affectedFiles : [], cwd);
-    const fileSeqByPath = { ...(record.fileSeqByPath ?? {}) };
+    const fileSeqByPath = { ...record.fileSeqByPath };
     for (const file of capped.files) {
         const key = guardPathKey(file, cwd);
         if (fileSeqByPath[key] === undefined) {

package/dist/clients/git-tracked-ignore.js

@@ -33,8 +33,25 @@
  */
 import * as path from "node:path";
 import { isExcludedDirName } from "./file-utils.js";
+import { recordDegradationOnce } from "./degradation-ledger.js";
 import { normalizeEphemeralMapKey, normalizeMapKey } from "./path-utils.js";
 import { safeSpawnAsync } from "./safe-spawn.js";
+import { truncatedByOutputCap } from "./spawn-output-cap.js";
+function recordTruncatedLsFiles(parseSite) {
+    recordDegradationOnce({
+        kind: "git-tracked-ignore-truncated",
+        subject: `git-ls-files:${parseSite}`,
+        reason: "safeSpawnAsync capped git ls-files stdout",
+    });
+}
+// The binding listing is the untracked-ignored one: a mid-size project's
+// node_modules alone yields a ~66k-line ignored list (roughly 4-6 MiB), and
+// a monorepo with several dependency trees can multiply that. 16 MiB leaves
+// that headroom while stopping safeSpawnAsync from retaining unbounded
+// stdout (an uncapped probe held 20 MiB in full). The tracked listing is
+// far smaller (~133 KiB in this repository). A capped read fails closed to
+// unavailable with one bounded ledger record per site.
+const MAX_LS_FILES_OUTPUT_BYTES = 16 * 1024 * 1024;
 /**
  * Parses `git ls-files --others --ignored --exclude-standard` output
  * (repo-relative paths, one per line) into normalized map-key file ids.
@@ -62,7 +79,16 @@ export function parseUntrackedIgnoredOutput(stdout, cwd) {
 }
 async function fetchUntrackedIgnoredIds(cwd) {
     try {
-        const result = await safeSpawnAsync("git", ["ls-files", "--others", "--ignored", "--exclude-standard"], { cwd, timeout: 10_000, resourceLabel: "git-tracked-ignore" });
+        const result = await safeSpawnAsync("git", ["ls-files", "--others", "--ignored", "--exclude-standard"], {
+            cwd,
+            timeout: 10_000,
+            maxOutputBytes: MAX_LS_FILES_OUTPUT_BYTES,
+            resourceLabel: "git-tracked-ignore",
+        });
+        if (truncatedByOutputCap(result)) {
+            recordTruncatedLsFiles("untracked-ignored");
+            return undefined;
+        }
         if (result.error || result.status !== 0)
             return undefined;
         return parseUntrackedIgnoredOutput(result.stdout, cwd);
@@ -141,8 +167,13 @@ async function fetchTrackedFiles(cwd) {
         const result = await safeSpawnAsync("git", ["ls-files"], {
             cwd,
             timeout: 10_000,
+            maxOutputBytes: MAX_LS_FILES_OUTPUT_BYTES,
             resourceLabel: "git-tracked-ignore",
         });
+        if (truncatedByOutputCap(result)) {
+            recordTruncatedLsFiles("tracked");
+            return undefined;
+        }
         if (result.error || result.status !== 0)
             return undefined;
         return parseTrackedFilesOutput(result.stdout, cwd);

package/dist/clients/go-client.js

@@ -62,4 +62,43 @@ export class GoClient {
     isGoFile(filePath) {
         return path.extname(filePath).toLowerCase() === ".go";
     }
+    /** Forget the memoized go path and latched availability verdict — #2455. */
+    resetAvailability() {
+        this.availability.reset();
+    }
+}
+/**
+ * The one `GoClient` this process owns (#2455 fix round 4, F2).
+ *
+ * `GoClient` is not stateless: it wraps a `createToolchainAvailability` latch
+ * whose probe-class "missing" verdict never expires (`isLatchingOutcome`), and
+ * `resetGoAvailability` below re-arms exactly ONE such latch. Round 2 shipped
+ * with two instances — `dispatch/runners/go-vet.ts` built one for the runner
+ * and `bootstrap.ts` built another for `BootstrapClients.goClient`, which is
+ * the object `handleSessionStart` reads for its "Active tools" line. The
+ * session reset cleared the runner's copy and left the session-start copy
+ * latched, so a go toolchain installed between sessions stayed invisible on
+ * the surface a user actually sees. One instance, in the module that owns the
+ * class, is what makes the reset total; `tests/clients/toolchain-client-singleton.test.ts`
+ * holds the line.
+ */
+export const goClient = new GoClient();
+/**
+ * Forget `goClient`'s memoized go path and latched availability verdict —
+ * #2455. Same #1496/#1535 shape as `resetZizmorTokenAvailability`; wired into
+ * `handleSessionStart` beside it (`clients/runtime-session.ts`) so a go
+ * toolchain installed mid-process is observed by the next session instead of
+ * staying "missing" for the rest of the process's life.
+ *
+ * This module — not `go-vet.ts` — because the reset must sit beside the single
+ * instance it clears (#2455 fix round 4, F2). It was invisible to the
+ * session-state sweep before round 2, but not for the reason an earlier draft
+ * of this comment gave (#2455 fix round 3, F4): the sweep skips any file
+ * exporting no reset at all, so widening the container predicate to "any class
+ * declared in `clients/`" could not have surfaced it. Adding this reset is
+ * what made the file visible — the fix preceded the detection, and the
+ * pair-with-reset blind spot (MISS 3 in `SWEEP_HEURISTIC_LIMITS`) is unchanged.
+ */
+export function resetGoAvailability() {
+    goClient.resetAvailability();
 }

package/dist/clients/govulncheck-client.js

@@ -110,6 +110,7 @@ export class GovulncheckClient extends SecurityScanClient {
                     hostStallMs: goHostStallMs,
                     ...(retryAfterMs > 0 && { retryAfterMs }),
                     budgetMs: 5000,
+                    classifiedBy: "probe",
                 });
                 return false;
             }
@@ -188,8 +189,10 @@ export class GovulncheckClient extends SecurityScanClient {
                     // row says so and carries the install facts behind it. Every retry
                     // DID run a `go install` that failed, so `install: "failed"` is
                     // earned, and the reason names the ceiling rather than the spawn.
+                    // Below the ceiling, outcome/cause are fresh off `classifyProbeFailure`
+                    // above, so that row is still `"probe"` (#2209).
+                    classifiedBy: exhausted ? "caller" : "probe",
                     ...(exhausted && {
-                        classifiedBy: "caller",
                         evidence: {
                             ...describeProbeEvidence(install, "go install"),
                             install: "failed",
@@ -313,6 +316,7 @@ export class GovulncheckClient extends SecurityScanClient {
                 hostStallMs: reprobeHostStallMs,
                 ...(retryAfterMs > 0 && { retryAfterMs }),
                 budgetMs: 5000,
+                classifiedBy: "probe",
             });
             return false;
         }