pi-lens 4.1.5 → 4.2.0

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "pi-lens",
-	"version": "4.1.5",
+	"version": "4.2.0",
 	"type": "module",
 	"description": "Real-time code feedback for pi — LSP, linters, formatters, type-checking, structural analysis & booboo",
 	"repository": {
@@ -33,10 +33,13 @@
 		"test:integration": "node scripts/with-test-lock.mjs -- vitest run tests/index-integration.test.ts tests/clients/lsp/integration.test.ts",
 		"test:targeted": "node scripts/with-test-lock.mjs --shared -- vitest run",
 		"test:watch": "vitest",
+		"test:real-harness": "node scripts/with-test-lock.mjs --shared -- vitest run",
+		"mutation:diff": "node scripts/stryker-diff.mjs --base origin/master --max-files 6",
 		"hygiene": "node scripts/prune-agent-worktrees.mjs",
 		"check": "node scripts/check-extensions.mjs",
 		"selftest:install": "node scripts/install-selftest.mjs",
 		"check:lockfile": "node scripts/check-lockfile-sync.mjs",
+		"preflight": "node scripts/pr-preflight.mjs",
 		"knip": "node scripts/run-knip.mjs",
 		"check:grammars": "node scripts/check-grammar-provenance.mjs",
 		"check:grammar-load": "node scripts/check-grammar-load.mjs",
@@ -49,7 +52,9 @@
 		"bench:cascade-budget": "node scripts/bench-cascade-budget.mjs",
 		"bench:word-index-replacement": "node scripts/bench-word-index-replacement.mjs",
 		"logs:smells": "node scripts/analyze-pi-lens-logs.mjs",
+		"complexity": "node scripts/complexity-report.mjs",
 		"changelog:check": "node scripts/rollup-changelog.mjs --check",
+		"test:regen": "node scripts/regen-test-baseline.mjs",
 		"changelog:release": "node scripts/changelog-release.mjs",
 		"changelog:extract": "node scripts/changelog-extract.mjs",
 		"release:backfill-notes": "node scripts/backfill-github-releases.mjs",
@@ -83,6 +88,7 @@
 	"engines": {
 		"node": ">=22.19.0"
 	},
+	"packageManager": "npm@11.18.0",
 	"files": [
 		"dist/",
 		"docs/",
@@ -145,5 +151,8 @@
 		"@ast-grep/cli@0.45.3": true,
 		"@google/genai@1.52.0": true,
 		"protobufjs@7.6.5": true
+	},
+	"overrides": {
+		"qs": "^6.15.4"
 	}
 }

package/rules/tree-sitter-queries/typescript/sql-injection.yml

@@ -1,5 +1,7 @@
 # SQL Injection Detection
-# Detects unsafe interpolation in SQL-like template literals
+# Detects unsafe interpolation in SQL-like template literals.
+# The structural query keeps the common callee set, while the TypeScript-aware
+# post-filter requires a receiver bound to a known DB client or a SQL-leading template.
 id: sql-injection
 name: SQL Injection Risk
 severity: error
@@ -26,18 +28,32 @@ description: |
 
 query: |
   (call_expression
-    function: [
-      (identifier) @SQL_FUNC
-      (member_expression property: (property_identifier) @SQL_FUNC)
-    ]
+    function: (identifier) @SQL_FUNC
     arguments: (arguments
-      (template_string (template_substitution) @INTERPOLATION))
-    (#match? @SQL_FUNC "^(query|execute|exec|run)$"))
+      (template_string (template_substitution) @INTERPOLATION) @TEMPLATE)
+    (#match? @SQL_FUNC "^(query|execute|exec|run|\\$queryRaw|\\$executeRaw|\\$queryRawUnsafe|\\$executeRawUnsafe|raw|prepare)$"))
+  (call_expression
+    function: (member_expression
+      object: (_) @OBJ
+      property: (property_identifier) @SQL_FUNC)
+    arguments: (arguments
+      (template_string (template_substitution) @INTERPOLATION) @TEMPLATE)
+    (#match? @SQL_FUNC "^(query|execute|exec|run|\\$queryRaw|\\$executeRaw|\\$queryRawUnsafe|\\$executeRawUnsafe|raw|prepare)$"))
+  (call_expression
+    function: (member_expression
+      object: (_) @OBJ
+      property: (property_identifier) @SQL_FUNC)
+    arguments: (template_string (template_substitution) @INTERPOLATION) @TEMPLATE
+    (#match? @SQL_FUNC "^(query|execute|exec|run|\\$queryRaw|\\$executeRaw|\\$queryRawUnsafe|\\$executeRawUnsafe|raw|prepare)$"))
 
 metavars:
   - SQL_FUNC
+  - OBJ
+  - TEMPLATE
   - INTERPOLATION
 
+post_filter: ts_sql_injection_sink
+
 has_fix: false
 
 tags:

package/scripts/analyze-pi-lens-logs.mjs

@@ -195,6 +195,7 @@ function createState(files) {
 		projects: counter(),
 		smellTotals: counter(),
 		latency: {
+			testRunnerVerdicts: new Map(),
 			runnerStatus: counter(),
 			runnerFailureKinds: counter(),
 			runnerBlockingFindings: counter(),
@@ -381,6 +382,22 @@ async function analyzeLatency(files, state) {
 				const phase = entry.phase ?? "unknown";
 				state.latency.phaseCounts.inc(phase);
 				if (phase.endsWith("_timeout")) state.latency.phaseTimeouts.inc(phase);
+				if (phase === "test_runner_verdict_delivery") {
+					const sessionId = entry.metadata?.sessionId ?? "unknown";
+					const summary = state.latency.testRunnerVerdicts.get(sessionId) ?? {
+						total: 0,
+						stale: 0,
+						unknown: 0,
+					};
+					const verdictCount = entry.metadata?.verdictCount;
+					const staleCount = entry.metadata?.staleCount;
+					const unknownCount = entry.metadata?.unknownCount;
+					summary.total += typeof verdictCount === "number" ? verdictCount : 1;
+					if (typeof staleCount === "number") summary.stale += staleCount;
+					else if (entry.metadata?.stale === true) summary.stale += 1;
+					if (typeof unknownCount === "number") summary.unknown += unknownCount;
+					state.latency.testRunnerVerdicts.set(sessionId, summary);
+				}
 				if (phase === "config_resolved") {
 					// #2526. Counted here rather than derived from phaseCounts so the
 					// legacy/record cross-check reads the same row it counts.
@@ -1481,6 +1498,18 @@ function buildReport(state) {
 			shownInlineShownAgentUnresolved: state.diagnostics.shownInline.toJSON(),
 		},
 		latency: {
+			testRunnerVerdicts: Object.fromEntries(
+				[...state.latency.testRunnerVerdicts.entries()].map(
+					([sessionId, summary]) => [
+						sessionId,
+						{
+							...summary,
+							denominator: summary.total,
+							rate: summary.total ? summary.stale / summary.total : 0,
+						},
+					],
+				),
+			),
 			runnerStatus: state.latency.runnerStatus.top(limit * 2),
 			runnerFailureKinds: state.latency.runnerFailureKinds.top(limit * 2),
 			runnerBlockingFindings: state.latency.runnerBlockingFindings.toJSON(),
@@ -1672,6 +1701,17 @@ function printReport(report) {
 		report.latency.runnerFailureKinds,
 		(x) => `${x.count.toString().padStart(5)}  ${x.key}`,
 	);
+	const verdictSessions = Object.entries(
+		report.latency.testRunnerVerdicts ?? {},
+	);
+	if (verdictSessions.length) {
+		console.log("\nTest-runner stale verdicts per session");
+		for (const [sessionId, summary] of verdictSessions) {
+			console.log(
+				`  ${sessionId}: ${summary.stale}/${summary.total} stale (${(summary.rate * 100).toFixed(1)}%)`,
+			);
+		}
+	}
 
 	const a = report.actionable;
 	if (a.reports || a.advisoriesInjected) {

package/skills/pi-lens-ast-grep/SKILL.md

@@ -7,7 +7,22 @@ description: Use when searching or replacing code patterns - use ast-grep instea
 
 Use `ast_grep_search` and `ast_grep_replace` for semantic code search/replace. ast-grep understands code structure, not just text.
 
-These tools (plus `ast_grep_outline`, `ast_grep_dump`, `lsp_navigation`) are registered but inactive by default on hosts that support pi's dynamic tooling. If a call to one of them isn't recognized, activate it first: `pi_lens_activate_tools tools=["ast_grep_search", "ast_grep_replace"]`.
+These tools (plus `ast_grep_outline`, `lsp_navigation`) are registered but inactive by default on hosts that support pi's dynamic tooling. If a call to one of them isn't recognized, activate it first: `pi_lens_activate_tools tools=["ast_grep_search", "ast_grep_replace"]`.
+
+On hosts that aggregate pi-lens behind a single `lens` tool, the `ast_grep_*` tools and `pi_lens_activate_tools` may not be registered at all. There, fall back to the `ast-grep` CLI (alias `sg`) — patterns, metavariables, and YAML rules are identical:
+
+```bash
+# search (≈ ast_grep_search)
+ast-grep run -p 'fetchMetrics($$$ARGS)' -l ts src/
+
+# rewrite (≈ ast_grep_replace; -U applies all)
+ast-grep run -p 'var $X' -r 'let $X' -l js src/ -U
+
+# full YAML rule (≈ the rule: parameter)
+ast-grep scan --rule my-rule.yml src/
+```
+
+Structural-intent parameters map to YAML constraints: `insideKind` → `inside: { kind: ..., stopBy: end }`, `hasKind`/`hasDescendantKind` → `has: { kind: ... }`, `follows` → `follows: { pattern: ... }`, `precedes` → `precedes: { pattern: ... }`.
 
 ## When to Use
 
@@ -88,15 +103,15 @@ rule:
     stopBy: end" lang="typescript"
 ```
 
-### Debugging unknown node kinds — `ast_grep_dump`
+### Debugging unknown node kinds — `ast_grep_search` dump mode
 
-When a pattern returns zero matches and you don't know the correct node kind or field name, use `ast_grep_dump` to inspect a SMALL representative snippet:
+When a pattern returns zero matches and you don't know the correct node kind or field name, use `ast_grep_search` with `dump=true` to inspect a SMALL representative snippet:
 
 ```
-ast_grep_dump source="function foo() { return 1; }" lang="typescript"
+ast_grep_search dump=true pattern="function foo() { return 1; }" lang="typescript"
 ```
 
-Returns the full indented AST with node kinds and positions. Then use the correct kind in your pattern or `insideKind`. `ast_grep_dump` is registered but inactive by default — call `pi_lens_activate_tools` with `tools: ["ast_grep_dump"]` first if it isn't already active.
+Returns the full indented AST with node kinds and positions. Then use the correct kind in your pattern or `insideKind`.
 
 ### Composite (has/inside) in raw YAML
 
@@ -146,8 +161,10 @@ kind: arrow_function
 
 **No matches?**
 
+For `nodeKind`, do not also pass `pattern` or `rule`; those forms are mutually exclusive. For `rule`, provide YAML containing both `id` and `language` fields. Use `strictness: relaxed` when unnamed punctuation is the only mismatch.
+
 1. Try `strictness: relaxed` — ignores unnamed punctuation (trailing commas, semicolons) that `smart` mode requires
-2. Use `ast_grep_dump` on a sample snippet to verify the correct node kind
+2. Use `ast_grep_search dump=true` on a sample snippet to verify the correct node kind
 3. Simplify the pattern and retry once
 4. Fall back to `grep` or `lsp_navigation`
 

package/skills/pi-lens-lsp-navigation/SKILL.md

@@ -5,22 +5,35 @@ description: Navigate code with IDE features and run proactive LSP diagnostics o
 
 # LSP Navigation and Diagnostics
 
-Use `lsp_navigation` as **PRIMARY** for code intelligence. Use `lsp_diagnostics` as **PRIMARY** for proactive type/error checks. Do NOT use grep/glob/ast-grep first for code intelligence.
+Use `lsp_navigation` as **PRIMARY** for code intelligence. Use `lens_diagnostics` with `source=lsp` as **PRIMARY** for proactive type/error checks. Do NOT use grep/glob/ast-grep first for code intelligence.
+
+## Aggregate-tool hosts
+
+Some hosts expose pi-lens through a single aggregate tool — `lens(action=...)` — instead of registering the standalone names below. On those hosts:
+
+- Proactive checks: `lens({ action: "lsp_diagnostics", ... })` — same parameters as the table below; the cached-report entry point maps to `lens({ action: "diagnostics", ... })`.
+- If `lsp_navigation` is not among the aggregate's actions, do not call the standalone name: use the host's structural search funnel (`symbol_search` → `module_report` → `read_symbol`) or the `ast-grep` CLI for navigation instead.
 
 ## Diagnostics
 
-Use `lsp_diagnostics` before builds/tests or after touching several files:
+Use `lens_diagnostics` with `source=lsp` before builds/tests or after touching several files:
 
 | Need | Tool call |
 |---|---|
-| Check one file | `lsp_diagnostics({ path: "src/file.ts" })` |
-| Check a folder | `lsp_diagnostics({ path: "src/", severity: "error" })` |
-| Check exact touched files | `lsp_diagnostics({ paths: ["src/a.ts", "src/b.ts"], concurrency: 8 })` |
-| Slow server (Rust, Java) | `lsp_diagnostics({ paths: files, waitMs: 2000 })` |
-| Include warnings | `lsp_diagnostics({ paths: files, severity: "all" })` |
+| Check one file | `lens_diagnostics({ source: "lsp", scope: "paths", paths: ["src/file.ts"] })` |
+| Check a folder | `lens_diagnostics({ source: "lsp", scope: "workspace", path: "src/", severity: "error" })` |
+| Check exact touched files | `lens_diagnostics({ source: "lsp", scope: "paths", paths: ["src/a.ts", "src/b.ts"] })` |
+| Slow server (Rust, Java) | `lens_diagnostics({ source: "lsp", scope: "paths", paths: files, waitMs: 2000 })` |
+| Include warnings | `lens_diagnostics({ source: "lsp", scope: "paths", paths: files, severity: "all" })` |
 
 Prefer explicit `paths` batches after multi-file edits — bounded concurrency, no unrelated directory noise.
 
+### Parameter reference
+
+`lens_diagnostics` accepts `source: "session" | "lsp"` and `scope: "paths" | "workspace"`. Use `mode: "delta"` for the current turn, `"all"` for the cache-only session view, or `"full"` for an active scan. `path` selects one file or directory; `paths` filters a batch. `severity` is `"error"`, `"warning"`, or `"all"`; `serverScope` is `"primary"` or `"all"`.
+
+For `mode: "full"`, `refreshRunners: "cached" | "cheap" | "all" | "none"` (or `false`/`true`) controls project analyzers. The first three string modes can launch a fresh heavyweight analyzer pass, bounded by the slowest runner's roughly 180-second ceiling; `none` disables it. `maxProjectFiles` limits cheap project runners, `maxLspFiles` limits the LSP sweep, and `includeGenerated: true` includes generated-name paths. These three limits apply to full scans. `concurrency` and `waitMs` tune LSP batches.
+
 ## Navigation (Code Intelligence)
 
 | Question | Operation | Parameters |
@@ -41,6 +54,10 @@ Prefer explicit `paths` batches after multi-file edits — bounded concurrency,
 | What commands does the server offer? | `capabilities` | (optional path) — lists advertised commands |
 | Run a server command (e.g. organize imports) | `executeCommand` | command (+ commandArguments); dry-run unless `apply:true` |
 
+The `operation` values are `definition`, `typeDefinition`, `declaration`, `references`, `hover`, `signatureHelp`, `documentSymbol`, `findSymbol`, `workspaceSymbol`, `codeAction`, `rename`, `rename_file`, `implementation`, `prepareCallHierarchy`, `incomingCalls`, `outgoingCalls`, `executeCommand`, `workspaceDiagnostics`, and `capabilities`.
+
+For `findSymbol`, pass `query`; optionally narrow with `kinds`, `exactMatch`, `topLevelOnly`, and `maxResults`. `rename_file` uses `newFilePath`. `symbol` resolves a character automatically; `character: -1` requests automatic resolution, and `symbol#N` selects a numbered symbol when the result lists one. `callHierarchyItem` is the object returned by `prepareCallHierarchy` and is required by the incoming/outgoing follow-up calls.
+
 ## Call Hierarchy Pattern
 
 ```
@@ -59,7 +76,7 @@ lsp_navigation(operation="outgoingCalls", callHierarchyItem=<item from step 1>)
 - **`workspaceSymbol` empty?** Always pass `path`. Unscoped queries are best-effort and frequently return nothing. If TypeScript returns "No Project", open the scoped file first.
 - **`references`** — query from the *definition site* for full cross-file coverage; usage-site queries can be partial.
 - **`signatureHelp`** — only valid at call-site argument positions; declaration positions return empty.
-- **`workspaceDiagnostics`** — tracked push snapshot only, not an active check. Use `lsp_diagnostics` when you need fresh results.
+- **`workspaceDiagnostics`** — tracked push snapshot only, not an active check. Use `lens_diagnostics` with `source=lsp` when you need fresh results.
 - **`codeAction`** — distinguish `quickfix` from generic refactors ("Move to new file"). Generic refactors are not error fixes.
 - **`prepareCallHierarchy`** — server-capability dependent; if unsupported, skip incoming/outgoing calls.
 
@@ -74,4 +91,4 @@ lsp_navigation(operation="outgoingCalls", callHierarchyItem=<item from step 1>)
 
 ## Golden Rule
 
-**Code intelligence → `lsp_navigation` first. Type/error validation → `lsp_diagnostics` first. Text/pattern search → grep/ast-grep.**
+**Code intelligence → `lsp_navigation` first. Type/error validation → `lens_diagnostics source=lsp` first. Text/pattern search → grep/ast-grep.**

package/dist/tools/ast-dump.js

@@ -1,103 +0,0 @@
-import { Type } from "../clients/deps/typebox.js";
-import { compactRenderResult } from "./render-compact.js";
-import { LANGUAGES } from "./shared.js";
-function createAstDumpToolWithName(astGrepClient, name) {
-    return {
-        name,
-        label: "AST-Grep Dump",
-        description: "Dump the tree-sitter AST for a source snippet using ast-grep CLI. Use when ast_grep_search returns zero matches and you need exact node kinds, field names, or nesting. Named nodes only by default; includeAnonymous=true shows punctuation/CST nodes too.",
-        promptSnippet: "Inspect AST node kinds before writing ast-grep patterns",
-        renderResult: compactRenderResult(({ details, args, isError, lineCount, text }) => {
-            const lang = details?.lang ?? (typeof args.lang === "string" ? args.lang : "");
-            if (isError) {
-                return `${name} ${lang} — ${text.split("\n")[0] ?? "error"}`.trim();
-            }
-            return `${name} ${lang} — ${lineCount} AST nodes`.replace(/\s+/g, " ");
-        }),
-        parameters: Type.Object({
-            source: Type.String({
-                description: "Source code snippet to parse and dump",
-            }),
-            lang: Type.String({
-                enum: [...LANGUAGES],
-                description: "Target language",
-            }),
-            includeAnonymous: Type.Optional(Type.Boolean({
-                description: "Show anonymous punctuation/CST nodes too (default false)",
-            })),
-        }),
-        async execute(_toolCallId, params, _signal, _onUpdate) {
-            const source = typeof params.source === "string" ? params.source : "";
-            const lang = typeof params.lang === "string"
-                ? params.lang.replace(/^"|"$/g, "")
-                : "";
-            const includeAnonymous = params.includeAnonymous === true;
-            try {
-                if (!source.trim()) {
-                    return {
-                        content: [{ type: "text", text: "source is required" }],
-                        isError: true,
-                        details: { lang, includeAnonymous },
-                    };
-                }
-                if (_signal.aborted) {
-                    return {
-                        content: [
-                            { type: "text", text: "Error: operation aborted" },
-                        ],
-                        isError: true,
-                        details: { lang, includeAnonymous },
-                    };
-                }
-                if (!(await astGrepClient.ensureAvailable())) {
-                    return {
-                        content: [
-                            {
-                                type: "text",
-                                text: "ast-grep CLI not found. Install: npm i -D @ast-grep/cli",
-                            },
-                        ],
-                        isError: true,
-                        details: { lang, includeAnonymous },
-                    };
-                }
-                if (_signal.aborted) {
-                    return {
-                        content: [
-                            { type: "text", text: "Error: operation aborted" },
-                        ],
-                        isError: true,
-                        details: { lang, includeAnonymous },
-                    };
-                }
-                const result = await astGrepClient.dumpAst(source, lang, {
-                    includeAnonymous,
-                });
-                if (result.error) {
-                    return {
-                        content: [
-                            { type: "text", text: `Error: ${result.error}` },
-                        ],
-                        isError: true,
-                        details: { lang, includeAnonymous },
-                    };
-                }
-                return {
-                    content: [{ type: "text", text: result.output ?? "" }],
-                    details: { lang, includeAnonymous },
-                };
-            }
-            catch (err) {
-                const message = err instanceof Error ? err.message : String(err);
-                return {
-                    content: [{ type: "text", text: `Error: ${message}` }],
-                    isError: true,
-                    details: { lang, includeAnonymous },
-                };
-            }
-        },
-    };
-}
-export function createAstGrepDumpTool(astGrepClient) {
-    return createAstDumpToolWithName(astGrepClient, "ast_grep_dump");
-}