pi-lens 4.1.2 → 4.1.4

package/dist/clients/cache/rule-cache.js

@@ -7,10 +7,12 @@
 import * as crypto from "node:crypto";
 import * as fs from "node:fs";
 import * as path from "node:path";
+import { reportBundledResourceDirHealth } from "../bundled-resource-health.js";
 import { getProjectDataDir } from "../file-utils.js";
 import { readJsonCache } from "../json-cache-read.js";
-import { resolvePackagePath } from "../package-root.js";
+import { BUNDLED_QUERIES_ROOT, getBundledQueriesRootHealth, } from "../tree-sitter-query-loader.js";
 import { writeFileAtomic } from "../atomic-write.js";
+import { compareOrdinal } from "../string-utils.js";
 // v4: cache skip_test_files + fix_action — v3 entries silently dropped them,
 // and ruleHash (rule-file mtimes) never invalidates on a code-only fix.
 // v5 (#675): rule SELECTION changed in code — javascript no longer inherits the
@@ -47,11 +49,36 @@ export const CACHE_VERSION = "v7";
  * on this prefix mirrors the split `yaml-rule-parser.ts`/`ast-grep-napi.ts`
  * already use for the ast-grep side of the same class (#1105): project-origin
  * trees get a content-hash CONFIRM, bundled trees stay mtime-cheap.
+ *
+ * #2636 review F4: re-exported from `tree-sitter-query-loader.ts`'s
+ * `BUNDLED_QUERIES_ROOT` rather than computed a second time here — the two
+ * modules read the IDENTICAL physical directory, and the "one ledger row"
+ * claim below rests on that being reference equality, not two independently
+ * `resolvePackagePath`-resolved strings that happen to match.
  */
-const BUNDLED_RULES_ROOT = resolvePackagePath(import.meta.url, "rules", "tree-sitter-queries");
+export { BUNDLED_QUERIES_ROOT as BUNDLED_RULES_ROOT } from "../tree-sitter-query-loader.js";
 function isBundledRuleFile(resolvedFile) {
-    return (resolvedFile === BUNDLED_RULES_ROOT ||
-        resolvedFile.startsWith(BUNDLED_RULES_ROOT + path.sep));
+    return (resolvedFile === BUNDLED_QUERIES_ROOT ||
+        resolvedFile.startsWith(BUNDLED_QUERIES_ROOT + path.sep));
+}
+/**
+ * #2636 (the #2626 class sweep's tree-sitter leg): the bundled
+ * tree-sitter-queries root above was used unconditionally with no existence
+ * check — same managed-cache-relocation gap #2626 fixed for `skills/`.
+ * Purely observational (never gates `isBundledRuleFile`'s classification):
+ * records a bounded `tree-sitter-queries-dir-missing` degradation only when
+ * the bundled root is absent, unreadable, or (uncommonly) present but empty.
+ * Shares the exact kind + subject `clients/tree-sitter-query-loader.ts`'s
+ * `ruleFilesForLanguage` reports under — both read the SAME physical
+ * directory (`getBundledQueriesRootHealth`'s process-lifetime memo, #2636
+ * review F6 — this constructor runs per dispatched file, so an unmemoized
+ * `readdirSync` here would be the same unconditional hot-path cost the
+ * class doc comment above forbids for rule-file hashing), so the ledger's
+ * own (kind, subject) dedup collapses whichever call site observes it first
+ * into ONE row rather than two duplicates.
+ */
+function reportBundledRulesRootHealth() {
+    reportBundledResourceDirHealth("tree-sitter-queries-dir-missing", BUNDLED_QUERIES_ROOT, getBundledQueriesRootHealth(), "bundled tree-sitter query rules");
 }
 export class RuleCache {
     cacheFile;
@@ -59,6 +86,7 @@ export class RuleCache {
     language;
     constructor(language, rootDir = process.cwd()) {
         this.language = language;
+        reportBundledRulesRootHealth();
         this.cacheDir = path.join(getProjectDataDir(rootDir), "cache");
         this.cacheFile = path.join(this.cacheDir, `${language}-rules-${CACHE_VERSION}.json`);
     }
@@ -69,7 +97,7 @@ export class RuleCache {
     }
     computeRuleHash(ruleFiles) {
         const hash = crypto.createHash("sha256");
-        for (const file of ruleFiles.sort((a, b) => a.localeCompare(b))) {
+        for (const file of ruleFiles.sort(compareOrdinal)) {
             const resolved = path.resolve(file);
             if (!fs.existsSync(resolved))
                 continue;

package/dist/clients/cache-manager.js

@@ -3,10 +3,14 @@
  *
  * Manages persistent cache for scanner results and turn state.
  * Provides read/write/freshness checks for:
- * - Scanner cache: .pi-lens/cache/{scanner}.json
- * - Turn state: .pi-lens/turn-state.json
+ * - Scanner cache: <project-data-dir>/cache/{scanner}.json
+ * - Turn state: <project-data-dir>/turn-state.json
  *
- * All paths are relative to project root (process.cwd()).
+ * `<project-data-dir>` is `getProjectDataDir(cwd)` (clients/file-utils.ts) --
+ * `<cwd>/.pi-lens` only when that legacy directory already exists, otherwise
+ * `~/.pi-lens/projects/<slug>` or a `PILENS_DATA_DIR` location. Never assume
+ * the legacy spelling, and never show it to an agent: build a displayed path
+ * with `displayProjectDataPath` (#2521).
  */
 import { createSubsystemLogger } from "./extension-log.js";
 import * as fs from "node:fs";
@@ -14,7 +18,7 @@ import * as path from "node:path";
 import { getProjectDataDir } from "./file-utils.js";
 import { writeFileAtomic } from "./atomic-write.js";
 import { readJsonCache } from "./json-cache-read.js";
-import { normalizeMapKey } from "./path-utils.js";
+import { isUnderDir, normalizeMapKey } from "./path-utils.js";
 // --- Defaults ---
 const DEFAULT_MAX_AGE_MS = 30 * 60 * 1000; // 30 minutes
 const DEFAULT_TURN_STATE = {
@@ -58,6 +62,31 @@ export class CacheManager {
     /**
      * Get turn-state entry for a file path using normalized lookup.
      */
+    /**
+     * #2504: is this path inside the PROJECT the worklist belongs to?
+     *
+     * Routed through `isUnderDir` (which normalises via `normalizeFilePath`) so
+     * the answer is separator- and case-form independent, the same key rule
+     * every other turn-state map obeys.
+     *
+     * The root is the PROJECT root, not the caller's `cwd` (#2504 review round
+     * 2, F1). The two coincide for every producer whose `cwd` IS the session
+     * root, but not for `clients/lsp-mutation.ts`: `tools/lsp-navigation.ts`
+     * threads a `cwd`-scoped context for a call issued from a sub-package
+     * directory, so a monorepo-wide server's edit on a SIBLING package is
+     * inside the project and outside that `cwd`. Judging it against `cwd`
+     * dropped exactly the server-initiated edits #2450/#2479 exist to record.
+     * This is the same root `isRecordableProjectPath` (clients/file-utils.ts)
+     * is given at that call site — one predicate root, taken from
+     * `runtime.projectRoot`, not two that can disagree.
+     */
+    isTurnStatePathWithinRoot(filePath, projectRoot) {
+        const root = path.resolve(projectRoot);
+        const abs = path.resolve(root, filePath);
+        if (normalizeMapKey(abs) === normalizeMapKey(root))
+            return false;
+        return isUnderDir(abs, root);
+    }
     getTurnFileState(filePath, cwd) {
         const state = this.readTurnState(cwd);
         const key = this.toTurnStateKey(filePath, cwd);
@@ -217,9 +246,22 @@ export class CacheManager {
     /** Return whether a writer may read/write this workspace worklist. */
     getTurnStateAccess(cwd, owner) {
         const state = this.readTurnState(cwd);
+        const hasFiles = Object.keys(state.files ?? {}).length > 0;
         if (!state.owner) {
-            if (!state.sessionId || state.sessionId === owner.id)
+            if (!state.sessionId || state.sessionId === owner.id) {
+                // #2504: an OWNERLESS state was unconditionally "owned" here, and
+                // ownerless was the resting shape (pre-#2504 `clearTurnState`
+                // dropped the owner and `addModifiedRange` only stamps one when a
+                // sessionId is supplied). A worklist persisted by a session that
+                // has since exited was therefore adopted wholesale by the next
+                // session — 154 historical paths reported as "modified this turn"
+                // on a turn that made no tool calls at all. A worklist whose last
+                // write predates this session's start is not this session's work.
+                if (hasFiles && this.turnStatePredatesSession(state, owner)) {
+                    return "available";
+                }
                 return "owned";
+            }
             // Pre-owner files have no liveness information. Preserve the existing
             // stale-session eviction behavior for this legacy shape.
             return "available";
@@ -227,10 +269,35 @@ export class CacheManager {
         if (state.owner.kind === owner.kind && state.owner.id === owner.id) {
             return "owned";
         }
+        // #2504: an EMPTY worklist carries nothing to protect, so it never
+        // latches a foreign writer out. This keeps the new `clearTurnState`
+        // owner stamp from turning a cleared worklist into a cross-process lock:
+        // an MCP writer in another process must still be able to register work
+        // against a worklist a pi session just cleared, exactly as it could when
+        // clearing left the state ownerless.
+        if (!hasFiles)
+            return "owned";
         return this.isTurnStateOwnerStale(state.owner)
             ? "available"
             : "foreign-live";
     }
+    /**
+     * #2504: true when this worklist was last written before the asking
+     * session began. `lastUpdated` is restamped by `writeTurnState` on EVERY
+     * write (add/clear/cycle), so a live session's own worklist is always
+     * newer than its start; only a carried-over file can be older. An
+     * unparseable stamp is treated as stale — a worklist we cannot date is
+     * exactly the legacy shape this gate exists to evict.
+     */
+    turnStatePredatesSession(state, owner) {
+        const startedAt = owner.sessionStartedAt;
+        if (startedAt === undefined || !Number.isFinite(startedAt))
+            return false;
+        const lastUpdated = Date.parse(state.lastUpdated ?? "");
+        if (!Number.isFinite(lastUpdated))
+            return true;
+        return lastUpdated < startedAt;
+    }
     isTurnStateOwnerStale(owner) {
         if (owner.pid > 0 && owner.pid !== process.pid) {
             try {
@@ -250,7 +317,24 @@ export class CacheManager {
      * current owner; callers must provide an explicit owner id to claim a stale
      * worklist.
      */
-    addModifiedRange(filePath, range, importsChanged, cwd, sessionId, ownerKind = "pi") {
+    addModifiedRange(filePath, range, importsChanged, cwd, sessionId, ownerKind = "pi", projectRoot) {
+        // #2504: the worklist is a PROJECT worklist. A path outside the project
+        // was accepted and keyed by its absolute path, so a prior session's
+        // scratchpad, `~/.claude/plans/*.md` and `~/.plegma/work/.../TASK.md`
+        // all became "modified files" that turn_end then fed to the test runner
+        // and opened in an LSP client. Reject before the owner stamp below, so
+        // an out-of-project write cannot claim the worklist either.
+        //
+        // `projectRoot` defaults to `cwd` — true for every producer whose cwd
+        // IS the session root. A caller whose `cwd` is NARROWER than the
+        // project (an LSP call issued from a sub-package directory) passes the
+        // real root explicitly; `cwd` still selects which `turn-state.json`
+        // the entry lands in, exactly as before (#2504 review round 2, F1).
+        const containmentRoot = projectRoot ?? cwd;
+        if (!this.isTurnStatePathWithinRoot(filePath, containmentRoot)) {
+            this.log(`turn-state: rejected out-of-project path ${filePath} (project root ${containmentRoot})`);
+            return this.readTurnState(cwd);
+        }
         const state = this.readTurnState(cwd);
         if (sessionId) {
             const owner = {
@@ -293,10 +377,25 @@ export class CacheManager {
         const isCurrentOwner = this.getTurnStateAccess(cwd, owner) !== "foreign-live";
         if (!isCurrentOwner && process.pid !== currentState.owner?.pid)
             return false;
+        // #2504: stamp the CLEARING owner. Dropping `owner`/`sessionId` here made
+        // ownerless the resting shape of turn-state.json, which is what let the
+        // next session read a carried-over worklist as its own. A cleared state
+        // now says who cleared it and when, so `getTurnStateAccess` can judge it
+        // by liveness like any other owned state — and, since the worklist is
+        // empty, the stamp never latches another writer out (see the
+        // empty-worklist branch there).
         const state = {
             ...DEFAULT_TURN_STATE,
             files: {}, // fresh object — DEFAULT_TURN_STATE.files can be polluted by addModifiedRange
             lastUpdated: new Date().toISOString(),
+            sessionId: owner.id,
+            owner: {
+                kind: owner.kind,
+                id: owner.id,
+                pid: process.pid,
+                lastSeen: new Date().toISOString(),
+                sessionStartedAt: owner.sessionStartedAt,
+            },
         };
         this.writeTurnState(state, cwd);
         return true;

package/dist/clients/cache-observability.js

@@ -48,8 +48,10 @@
  * event handlers.
  */
 import { createHash } from "node:crypto";
+import { BoundedFifoMap, BoundedLruCache } from "./bounded-cache.js";
 import { lazyEnvNumber } from "./env-utils.js";
 import { logLatency } from "./latency-logger.js";
+import { compareOrdinal } from "./string-utils.js";
 /** RuntimeCoordinator's counter is process-global when sessions share a host. */
 const PROCESS_TURN_SCOPE = "process-global-runtime";
 const SECONDARY_TURN_SCOPE = "unavailable-concurrent-secondary";
@@ -160,7 +162,11 @@ function newCacheUsageSummary() {
         unknownEvidenceReasons: emptyUnknownEvidenceReasons(),
     };
 }
-const attributionBySession = new Map();
+// Shared cap for every per-session bounded map in this module (also used by
+// `prefixHashBySession` below) — a long-lived process cycling through many
+// sessions cannot grow any of them without limit.
+export const MAX_TRACKED_SESSIONS = 32;
+const attributionBySession = new BoundedLruCache(MAX_TRACKED_SESSIONS);
 function newAttributionState() {
     return {
         prefixBrokeSinceLastUsage: false,
@@ -182,14 +188,9 @@ function newAttributionState() {
 function attributionFor(key) {
     const existing = attributionBySession.get(key);
     const state = existing ?? newAttributionState();
-    attributionBySession.delete(key);
+    // `get` above already moved an existing entry to MRU; `set` below also
+    // refreshes recency on a create, so every fetch counts as a touch.
     attributionBySession.set(key, state);
-    while (attributionBySession.size > MAX_TRACKED_SESSIONS) {
-        const oldest = attributionBySession.keys().next().value;
-        if (oldest === undefined)
-            break;
-        attributionBySession.delete(oldest);
-    }
     return state;
 }
 /**
@@ -490,7 +491,7 @@ function boundedHashArray(value, depth, seen, state) {
     return `array:${value.length}:[${items.join(",")}]`;
 }
 function boundedHashObject(value, depth, seen, state) {
-    const keys = Object.keys(value).sort((left, right) => left.localeCompare(right));
+    const keys = Object.keys(value).sort((left, right) => compareOrdinal(left, right));
     if (keys.length > 24)
         state.contentTruncated = true;
     const fields = keys
@@ -998,11 +999,13 @@ function hashFirstMessage(first) {
  *     session state (read guard #1041, widget #190) which IS rehydrated from the
  *     sidecar.
  *
- * Bounded as an insertion-ordered LRU (evict oldest-inserted past the cap) so a
- * long-lived process cycling through many sessions can't grow this unbounded.
+ * Bounded as insertion-ordered FIFO (evict oldest-inserted past the cap,
+ * refreshed on every WRITE by {@link recordSessionHash}'s delete+set — a
+ * plain read never reorders) so a long-lived process cycling through many
+ * sessions can't grow this unbounded. Shares {@link MAX_TRACKED_SESSIONS}
+ * with `attributionBySession` above.
  */
-const MAX_TRACKED_SESSIONS = 32;
-const prefixHashBySession = new Map();
+const prefixHashBySession = new BoundedFifoMap(MAX_TRACKED_SESSIONS);
 /**
  * Reported key used when no session id is available (undefined/empty). Internal
  * attribution additionally separates primary and concurrent-secondary roles;
@@ -1018,12 +1021,6 @@ const NO_SESSION_KEY = "<no-session>";
 function recordSessionHash(key, hash) {
     prefixHashBySession.delete(key);
     prefixHashBySession.set(key, hash);
-    while (prefixHashBySession.size > MAX_TRACKED_SESSIONS) {
-        const oldest = prefixHashBySession.keys().next().value;
-        if (oldest === undefined)
-            break;
-        prefixHashBySession.delete(oldest);
-    }
 }
 /**
  * Part 2 — observe `messages[0]` stability turn-over-turn, keyed by session id.
@@ -1168,3 +1165,33 @@ export function resetCachePrefixObservation() {
     prefixHashBySession.clear();
     attributionBySession.clear();
 }
+/** #2442 test-only membership reads, bypassing emitCacheUsageSummaryAtSessionEnd's
+ *  usageRecords>0 gate and log side effects. */
+export function _attributionKeyForTests(sessionId, sessionRole) {
+    return attributionKey(sessionId, sessionRole);
+}
+export function _attributionBySessionHasForTests(key) {
+    return attributionBySession.has(key);
+}
+export function _prefixHashBySessionHasForTests(key) {
+    return prefixHashBySession.has(key);
+}
+/** #2442 test-only: drive attributionFor's fetch-or-create touch directly
+ *  (every call refreshes LRU recency, matching production — see
+ *  attributionFor's own doc comment). */
+export function _touchAttributionForTests(key) {
+    attributionFor(key);
+}
+/** #2442 test-only: drive recordSessionHash's write-refresh directly. */
+export function _recordSessionHashForTests(key, hash) {
+    recordSessionHash(key, hash);
+}
+/**
+ * #2442 test-only: the exact `prefixHashBySession.get(key)` that
+ * `observeCachePrefix` performs to fetch a session's previous hash. A
+ * `.has()` reorders nothing on either bounded class, so only a real `get`
+ * can pin FIFO-vs-LRU behavior (#2442 review F4).
+ */
+export function _prefixHashBySessionGetForTests(key) {
+    return prefixHashBySession.get(key);
+}