pi-lens 4.1.5 → 4.2.0

package/dist/clients/diagnostic-dispositions.js

@@ -78,6 +78,11 @@ import { lineContentHash } from "./read-guard.js";
 // below goes through `deferredKey`, which folds the resolved cwd into the Set
 // key, so the two projects can no longer collide.
 const deferredThisSession = new Set();
+let widgetDispositionReconciler = null;
+/** Register the widget's mirror of the durable disposition state. */
+export function registerWidgetDispositionReconciler(reconciler) {
+    widgetDispositionReconciler = reconciler;
+}
 function deferredKey(cwd, anchor) {
     return `${normalizeMapKey(cwd)}::${anchor}`;
 }
@@ -97,7 +102,8 @@ export const normalizeMessage = sharedNormalizeMessage;
 // case, symlink/realpath, or slash difference between the two forms silently
 // orphans the agent's own false-positive/flagged mark (a #533 dropped-signal).
 // Canonicalize BOTH inputs through `normalizeMapKey` (the SAME normalizer the
-// read side already relies on — realpathSync.native on Windows) BEFORE computing
+// read side already relies on — realpathSync.native on Windows, and on POSIX
+// too since #3098) BEFORE computing
 // the relative path, so write and read produce identical anchors regardless of
 // the form the caller held. `normalizeMapKey` is idempotent, so the already-
 // canonicalized read side is unaffected; the realpath I/O is acceptable here
@@ -357,6 +363,7 @@ function emitMarkTelemetry(cwd, target, disposition, anchor, reason, existing, i
         publishDisposition({
             cwd,
             filePath: target.filePath,
+            message: target.message,
             disposition,
             tool: target.tool,
             rule: target.rule,
@@ -390,6 +397,7 @@ export function markDisposition(cwd, target, disposition, reason, identity) {
     const existing = readState(cwd).dispositions?.[anchor];
     if (disposition === "defer") {
         deferredThisSession.add(deferredKey(cwd, anchor));
+        widgetDispositionReconciler?.(cwd, target, disposition);
         emitMarkTelemetry(cwd, target, disposition, anchor, reason, existing, identity);
         return anchor;
     }
@@ -407,6 +415,9 @@ export function markDisposition(cwd, target, disposition, reason, identity) {
         lineText,
     };
     commitDisposition(cwd, anchor, entry);
+    // The durable commit is the guard for this mirror: a failed commit must not
+    // make the in-memory widget claim that a mark exists.
+    widgetDispositionReconciler?.(cwd, target, disposition);
     emitMarkTelemetry(cwd, target, disposition, anchor, reason, existing, identity);
     return anchor;
 }

package/dist/clients/dispatch/ast-grep-catalog.js

@@ -0,0 +1,65 @@
+/**
+ * The effective ast-grep rule catalog for a workspace root (#3053).
+ *
+ * Before this module, `clients/dispatch/runners/ast-grep-napi.ts` (the NAPI
+ * runner) and `clients/dispatch/rule-ignores.ts` (the LSP-seam matcher, #3041)
+ * each walked `getAstGrepRuleSources(root)` and resolved rule-id precedence
+ * independently — two implementations of the same derivation. They had
+ * already drifted once by the time #3053 was filed: #3046 round 2 found the
+ * LSP seam claiming an id only when the winning document declared `ignores`,
+ * so a project rule that redefines a bundled id with NO `ignores` fired
+ * per-edit (the runner) but stayed carved out over LSP (the seam) — the same
+ * defect the whole PR existed to remove, just inverted. This module is the
+ * one place that walk and that precedence rule now live.
+ *
+ * Precedence: sources are walked in `getAstGrepRuleSources`'s order (project
+ * primary, project secondary, bundled primary, bundled secondary), each
+ * loaded with the same loader the runner always used (`loadYamlRulesFresh`
+ * for mutable project trees, `loadYamlRules`'s mtime-cached path for
+ * immutable bundled catalogs). The FIRST rule sighted for an id — scanning
+ * sources in order, and each source's own rules in file order — claims it;
+ * no later document for the same id is ever consulted.
+ *
+ * Deliberately does NOT special-case an id that recurs WITHIN one source's
+ * own rule list. That is `duplicateRuleIds` in ast-grep-napi.ts, a
+ * runner-only concern layered on top of this catalog's plain result: the
+ * runner drops such an id entirely (one Duplicate-rule-id diagnostic, no
+ * rule fires for it), but `materializeMergedRuleDir` (clients/sgconfig.ts) —
+ * what ast-grep's own LSP binary actually runs — keeps every document an
+ * EARLIER source hasn't already claimed, so both copies of a within-source
+ * duplicate still survive into what ast-grep publishes over LSP. Baking the
+ * runner's drop into this catalog would leave those published findings with
+ * no registered `ignores` at all, silently unsuppressed — reopening #3041 for
+ * that id (#3046 round 2 F7). So the catalog resolves a within-source
+ * duplicate to its first-sighted document like any other collision, and it
+ * is each consumer's job to decide what a within-source duplicate means for
+ * it — the runner still computes `duplicateRuleIds` itself and skips those
+ * ids before ever consulting this catalog's answer for them.
+ */
+import { getAstGrepRuleSources } from "../sgconfig.js";
+import { loadYamlRules, loadYamlRulesFresh, } from "./runners/yaml-rule-parser.js";
+/**
+ * Build the effective ast-grep catalog for `root`. See the module docstring
+ * for the precedence rule and the within-source-duplicate decision.
+ *
+ * No try/catch around either loader: every I/O path inside them already
+ * swallows its own failure (missing dir, unreadable readdir, unreadable file
+ * all yield an empty list — `yaml-rule-parser.ts`'s `findYamlRuleFiles` and
+ * `loadYamlRuleFiles`), so a catch here would be a guard no mutation can red.
+ */
+export function buildEffectiveAstGrepCatalog(root) {
+    const sources = [];
+    const effectiveRules = new Map();
+    for (const source of getAstGrepRuleSources(root)) {
+        const rules = source.origin === "project"
+            ? loadYamlRulesFresh(source.dir)
+            : loadYamlRules(source.dir);
+        sources.push({ source, rules });
+        for (const rule of rules) {
+            if (effectiveRules.has(rule.id))
+                continue;
+            effectiveRules.set(rule.id, { rule, source });
+        }
+    }
+    return { sources, effectiveRules };
+}

package/dist/clients/dispatch/auxiliary-lsp.js

@@ -22,6 +22,7 @@ import { findLocalOpengrepConfig } from "../opengrep-config.js";
 import { findLocalTyposConfig } from "../typos-config.js";
 import { findLocalZizmorConfig } from "../zizmor-config.js";
 import { classifyDefect } from "./diagnostic-taxonomy.js";
+import { isRuleIgnoredForPath, loadRuleIgnorePatterns, } from "./rule-ignores.js";
 /**
  * Semgrep/opengrep `# nosemgrep` / `# nosemgrep: <rule-id>[,<rule-id>]` inline
  * suppression (#441). A bare `# nosemgrep` drops every finding on its line; the
@@ -248,8 +249,22 @@ export function isAuxiliaryDiagnosticSuppressed(d, content) {
  * files that are suppressed per-edit reappeared wholesale in every
  * `mode=full` sweep. Omitting `opts` (or `opts.fileRole`) keeps every existing
  * 2-arg call site's behavior byte-for-byte unchanged.
+ *
+ * #3041: `opts.filePath` + `opts.scanRoot` additionally apply each rule's own
+ * `ignores` path carve-out (#965) — the THIRD member of the same defect class
+ * as #586 and #692 above. `ast-grep scan` applies `ignores` during its own
+ * project walk, but `ast-grep lsp` publishes per-document diagnostics WITHOUT
+ * applying them (measured against ast-grep 0.45.3), so a rule the NAPI runner
+ * correctly skips on `scripts/**` came back over LSP on every `source=lsp`
+ * query and every `mode=full` sweep. Both routes reach this function, so the
+ * carve-out belongs here rather than in either route's own output merge.
  */
 export function applyAuxiliarySuppressions(diagnostics, content, opts) {
+    // One catalog read per call, not per diagnostic. Both rule loaders behind it
+    // are cached (~0.09 ms per call on pi-lens's own catalog), so a per-file call
+    // from a sweep costs the same order as the NAPI runner's own per-file load.
+    const { filePath, scanRoot } = opts ?? {};
+    const ruleIgnores = filePath && scanRoot ? loadRuleIgnorePatterns(scanRoot) : undefined;
     return diagnostics.filter((d) => {
         if (isAuxiliaryDiagnosticSuppressed(d, content))
             return false;
@@ -258,6 +273,19 @@ export function applyAuxiliarySuppressions(diagnostics, content, opts) {
             if (profile?.skipTestFiles)
                 return false;
         }
+        // Keyed by the diagnostic's own rule id — ast-grep's LSP reports the bare
+        // catalog id as `code`. Gated on the producing tool as well: the map is
+        // built from the AST-GREP catalog, so without the gate any auxiliary whose
+        // own rule id happened to collide with a catalog id (several are generic —
+        // `no-raw-types`, `no-string-concat-in-loop`) would be silently dropped on
+        // a path an unrelated rule carved out. Losing a finding silently is the
+        // harm this whole change exists to stop, so the collision is gated, not
+        // accepted (#3041 r2 F4).
+        if (ruleIgnores !== undefined &&
+            findAuxiliaryProfileForSource(d.source)?.tool === "ast-grep" &&
+            isRuleIgnoredForPath(filePath, scanRoot, ruleIgnores.get(String(d.code)))) {
+            return false;
+        }
         return true;
     });
 }

package/dist/clients/dispatch/dispatcher.js

@@ -26,10 +26,10 @@ import { getPrimaryDispatchGroup } from "../language-policy.js";
 import { resolveLanguageRootForFile } from "../language-profile.js";
 import { logLatency, phaseFinished, phaseStarted } from "../latency-logger.js";
 import { isSpawnableCommand } from "../installer/index.js";
-import { isAbsoluteFilePath, normalizeEphemeralMapKey, normalizeMapKey, } from "../path-utils.js";
+import { isAbsoluteFilePath, isWindowsPath, normalizeEphemeralMapKey, normalizeMapKey, } from "../path-utils.js";
 import { loadPiLensProjectConfig } from "../project-lens-config.js";
 import { RUNTIME_CONFIG, getRunnerTimeoutFloorMs } from "../runtime-config.js";
-import { safeSpawnAsync } from "../safe-spawn.js";
+import { probeToolAsync } from "../tool-probe.js";
 import { classifyDiagnostic } from "./diagnostic-taxonomy.js";
 import { classifyProbeFailure, logAvailabilityDecision, startHostStallSampler, transientRetryDelayMs, } from "./runners/utils/availability-policy.js";
 import { recordAvailabilityProbeOverrun, getDispatchAvailabilityGeneration, } from "./runners/utils/runner-helpers.js";
@@ -147,7 +147,7 @@ export async function checkToolAvailability(command, facts) {
         let hostStallMs;
         let probeJoined = false;
         try {
-            const shared = dispatcherProbeFlights.run(`dispatcher:${key}`, () => safeSpawnAsync(command, ["--version"], {
+            const shared = dispatcherProbeFlights.run(`dispatcher:${key}`, () => probeToolAsync(command, ["--version"], {
                 timeout: TOOL_PROBE_TIMEOUT_MS,
             }));
             probeJoined = shared.joined;
@@ -249,7 +249,13 @@ telemetryModel, telemetryProvider) {
     const normalizedProjectRoot = normalizeMapKey(path.resolve(projectRoot ?? cwd));
     const normalizedCwd = normalizeMapKey(resolveLanguageRootForFile(absoluteFilePath, cwd));
     const normalizedFilePath = normalizeMapKey(absoluteFilePath);
-    const kind = detectFileKind(normalizedFilePath);
+    // `resolveRunnerPath` intentionally normalizes map keys, which folds a
+    // literal POSIX backslash into a separator. Preserve that one proven
+    // classifier distinction while still resolving relative inputs from `cwd`.
+    const kindFilePath = !isWindowsPath(filePath) && filePath.includes("\\")
+        ? path.resolve(cwd, filePath)
+        : absoluteFilePath;
+    const kind = detectFileKind(kindFilePath);
     const contentPrefix = readFilePrefix(normalizedFilePath);
     const fileRole = detectFileRole(normalizedFilePath, contentPrefix);
     // Captured once here so the generated short-circuit below can emit a
@@ -282,14 +288,17 @@ telemetryModel, telemetryProvider) {
         writeIndex,
         telemetryModel,
         telemetryProvider,
+        toolCwdMemo: {},
         async hasTool(command) {
             return checkToolAvailability(command, facts);
         },
-        log(message) {
+        log(message, level) {
             // #1333: pi owns the terminal — a runner advisory must never be a raw
             // write. Every DispatchContext.log line lands in extension.log instead.
             logExtension({
                 subsystem: "dispatch",
+                // exactOptionalPropertyTypes: an omitted level must stay omitted.
+                ...(level !== undefined && { level }),
                 message,
                 metadata: { filePath: normalizedFilePath, kind },
             });
@@ -446,31 +455,49 @@ function buildCoverageNotice(ctx, runnerLatencies) {
         ...new Set(relevant.flatMap((r) => r.unconfirmedServerIds ?? [])),
     ];
     if (unconfirmedServerIds.length > 0) {
-        // The marker describes this exact silent-scanner set. A scanner can
-        // recover while another goes dark on the same file, so the set belongs
-        // in the session dedupe identity rather than only kind and path.
+        const deferredIds = new Set(relevant.flatMap((r) => r.deferredServerIds ?? []));
+        const markerFor = (ids) => {
+            const shown = ids.slice(0, 4);
+            const remainder = ids.length - shown.length;
+            return `${shown.join(", ")}${remainder > 0 ? ` +${remainder}` : ""}`;
+        };
+        const deferredServerIds = unconfirmedServerIds.filter((id) => deferredIds.has(id));
+        const silentServerIds = unconfirmedServerIds.filter((id) => !deferredIds.has(id));
+        // The marker describes this exact scanner set. A scanner can recover
+        // while another goes dark on the same file, so the set belongs in the
+        // session dedupe identity rather than only kind and path.
         // #2016: these are SCANNER IDS, not filesystem paths. `normalizeMapKey`
         // would realpath each one; on Windows that fails, falls through to
         // `resolveNonExisting`, and resolves the id against the CURRENT process
         // cwd, so the dedupe key differed by platform and by cwd (the #2219
         // non-path-sentinel class). The cheap syntactic fold is what this
-        // session-scoped dedupe key actually needs.
-        const silentScannerSet = [...new Set(unconfirmedServerIds)]
+        // session-scoped dedupe key actually needs. Code-unit comparator: the
+        // sorted set is a KEY, so ordering must be deterministic across locales
+        // — localeCompare is not.
+        const dedupeSet = (ids) => [...new Set(ids)]
             .map(normalizeEphemeralMapKey)
-            // Code-unit comparator: the sorted set is a dedupe KEY, so ordering
-            // must be deterministic across locales — localeCompare is not.
             .sort((a, b) => Number(a > b) - Number(a < b))
             .join(",");
-        const onceKey = `${ctx.kind}:${ctx.filePath}:${silentScannerSet}`;
+        // #2810 round 4: the PARTITION is part of the identity, not just the
+        // scanner set. The same scanner can be silent on one edit and marked for
+        // late delivery on the next; keying on the unconfirmed set alone showed
+        // the session whichever message came first and suppressed the other, so a
+        // scanner that recovered a delivery path (or lost one) kept the stale
+        // wording for the rest of the session.
+        const onceKey = `${ctx.kind}:${ctx.filePath}:${dedupeSet(silentServerIds)}|${dedupeSet(deferredServerIds)}`;
         if (coverageNoticeSeen.has(onceKey))
             return undefined;
         coverageNoticeSeen.add(onceKey);
-        const shown = unconfirmedServerIds.slice(0, 4);
-        const remainder = unconfirmedServerIds.length - shown.length;
-        const marker = `${shown.join(", ")}${remainder > 0 ? ` +${remainder}` : ""}`;
+        const coverageParts = [];
+        if (deferredServerIds.length > 0) {
+            coverageParts.push(`coverage: ${markerFor(deferredServerIds)} deferred — diagnostics are incomplete; findings arrive at turn end if the scan lands.`);
+        }
+        if (silentServerIds.length > 0) {
+            coverageParts.push(`coverage: ${markerFor(silentServerIds)} silent — diagnostics are incomplete (not a clean result).`);
+        }
         return {
             id: `coverage-partial:${ctx.kind}:${path.basename(ctx.filePath)}`,
-            message: `coverage: ${marker} silent — diagnostics are incomplete (not a clean result).`,
+            message: coverageParts.join("\n"),
             filePath: ctx.filePath,
             severity: "warning",
             semantic: "warning",
@@ -837,6 +864,9 @@ async function runGroup(ctx, group, registry, onRunnerResult) {
             ...(result.unconfirmedServerIds !== undefined && {
                 unconfirmedServerIds: result.unconfirmedServerIds,
             }),
+            ...(result.deferredServerIds !== undefined && {
+                deferredServerIds: result.deferredServerIds,
+            }),
         });
         logLatency({
             type: "runner",

package/dist/clients/dispatch/facts/function-facts.js

@@ -135,7 +135,7 @@ function isCallPassThrough(stmt, paramNames) {
     }
     return { pass: true, target: (expr.children ?? [])[0]?.text };
 }
-function calcCyclomaticComplexity(body) {
+export function calcCyclomaticComplexity(body) {
     let cc = 1;
     walk(body, (node) => {
         if (COMPLEXITY_TYPES.has(node.type)) {

package/dist/clients/dispatch/facts/import-facts.js

@@ -1,6 +1,10 @@
 import { logLatency } from "../../latency-logger.js";
 import { isJstsFactFile } from "../../file-kinds.js";
 import { childrenOfType, firstChildOfType, withFactTree, walk, } from "./tree-sitter-facts.js";
+/** Whether the import-facts provider applies to a source path. */
+export function importFactsApplyTo(filePath) {
+    return isJstsFactFile(filePath);
+}
 function stripQuotes(raw) {
     return raw.replace(/^["'`]+|["'`]+$/g, "");
 }
@@ -69,7 +73,7 @@ export const importFactProvider = {
     provides: ["file.imports", "file.reexports", "file.importFactsCoverage"],
     requires: ["file.content"],
     appliesTo(ctx) {
-        return isJstsFactFile(ctx.filePath);
+        return importFactsApplyTo(ctx.filePath);
     },
     async run(ctx, store) {
         const content = store.getFileFact(ctx.filePath, "file.content");

package/dist/clients/dispatch/finding-policy.js

@@ -0,0 +1,222 @@
+/**
+ * The ONE filter stack a findings surface applies before a diagnostic reaches
+ * the agent: inline `pi-lens-ignore` comments (#442), stored dispositions
+ * (#690 — false-positive/suppress/defer), and the project's `.pi-lens.json`
+ * `rules.<id>.disable`/`select` policy, in that order.
+ *
+ * The order is load-bearing and is the one the per-edit dispatcher established:
+ * inline suppression first (the user's in-file intent), then the stored marks,
+ * then the project policy — so the policy filter sees the same set the per-edit
+ * path produces, with no double counting and no policy-rejected leftovers.
+ *
+ * #3088: these were three separate calls open-coded in `lens-diagnostics.ts`'s
+ * `mode=full` merge and nothing at all on the `lens_diagnostics source=lsp` /
+ * `lsp_diagnostics` probe lane — so a finding an agent had marked
+ * `false-positive` was hidden in `mode=delta`/`mode=full` and re-reported on
+ * the lane `skills/pi-lens-lsp-navigation` steers agents to as PRIMARY. Both
+ * lanes call this module now: `applyFindingPolicy` for surfaces that already
+ * hold dispatch `Diagnostic`s, `applyLspFindingPolicy` for the probe lane,
+ * which holds raw `LSPDiagnostic`s.
+ */
+import { applyDispositions, hasAnyDispositionMarks, } from "../diagnostic-dispositions.js";
+import { loadPiLensProjectConfig } from "../project-lens-config.js";
+import { retagAuxiliaryDiagnostics } from "./auxiliary-lsp.js";
+import { applyInlineSuppressions } from "./inline-suppressions.js";
+import { applyRulePolicy, rulePolicyMapFromConfig } from "./rule-policy.js";
+import { convertLspDiagnostics } from "./utils/lsp-diagnostics.js";
+/**
+ * Inline suppression → stored dispositions → project rule policy, over
+ * diagnostics that already carry dispatch identity (`tool`/`rule`/`line`).
+ */
+export function applyFindingPolicy(diagnostics, options) {
+    const inlineKept = applyInlineSuppressions(diagnostics, options.content);
+    const disposed = filterDisposed(inlineKept, options);
+    return { kept: applyRulePolicy(disposed, options.policyMap), inlineKept };
+}
+/** The project's `.pi-lens.json` `rules.<id>.disable`/`select` policy map.
+ * One derivation for every surface that filters by it — `loadPiLensProjectConfig`
+ * is mtime-cached, so repeated calls in one sweep cost one stat. */
+export function loadProjectRulePolicyMap(cwd) {
+    return rulePolicyMapFromConfig(loadPiLensProjectConfig(cwd).rules);
+}
+/**
+ * Disposition filter over the candidate identities a mark can carry.
+ *
+ * With no `identities` provider this is `applyDispositions` on the diagnostics
+ * themselves — one anchor pair per diagnostic, the behavior every existing
+ * caller has. With one, the SAME `applyDispositions` runs over the flattened
+ * candidate list — no second strict/weak implementation to drift away from it
+ * (#1617's single-source rule) — and a diagnostic drops when ANY of its
+ * candidate identities was disposed.
+ */
+function filterDisposed(diagnostics, options) {
+    const identities = options.identities;
+    if (!identities) {
+        return applyDispositions(diagnostics, options.cwd, options.filePath, options.content);
+    }
+    // Same zero-I/O hoist the cache-only modes use (#1625 F2): with no marks at
+    // all there is nothing a candidate expansion could match, so the probe lane
+    // pays no per-finding allocation for the overwhelmingly common empty store.
+    if (!diagnostics.length || !hasAnyDispositionMarks(options.cwd)) {
+        return diagnostics;
+    }
+    const expanded = diagnostics.flatMap((diagnostic) => identities(diagnostic).map((identity) => ({
+        diagnostic,
+        candidate: {
+            ...identity,
+            message: diagnostic.message,
+            ...(diagnostic.line !== undefined && { line: diagnostic.line }),
+            ...(diagnostic.semantic !== undefined && {
+                semantic: diagnostic.semantic,
+            }),
+        },
+    })));
+    const survivors = new Set(applyDispositions(expanded.map((entry) => entry.candidate), options.cwd, options.filePath, options.content));
+    const disposed = new Set();
+    for (const entry of expanded) {
+        if (!survivors.has(entry.candidate))
+            disposed.add(entry.diagnostic);
+    }
+    return disposed.size === 0
+        ? diagnostics
+        : diagnostics.filter((diagnostic) => !disposed.has(diagnostic));
+}
+/**
+ * #3088 / AGENTS.md shape 26: the identity spellings a mark against a probe
+ * finding can carry, derived from the surfaces that RENDER it rather than
+ * guessed:
+ *
+ *  - `convertLspDiagnostics` + `retagAuxiliaryDiagnostics` — the canonical
+ *    dispatch identity (`tool: "lsp"`, or the auxiliary's own id, and
+ *    `rule: "<source>:<code>"`). This is what the widget footer, `mode=delta`
+ *    and `mode=full` render, so it is the spelling of a mark made anywhere
+ *    else in the session.
+ *  - `formatDiag` in `tools/lsp-diagnostics.ts` — the probe's OWN text render
+ *    is `[<source>] (<code>)`, so a mark made from THIS lane's output carries
+ *    `tool: "<source>"`, `rule: "<code>"`.
+ *
+ * plus, for each, the form with `tool` omitted: `lens_diagnostic_mark`'s
+ * `tool` parameter is optional and #3088's own reproduction omits it. A
+ * single-spelling filter honors a mark made on one surface while re-reporting
+ * the same finding when the mark was made on the other, which is exactly the
+ * non-convergence #3088 reported.
+ */
+function probeIdentities(canonical, raw) {
+    const rendered = [
+        [canonical.tool, canonical.rule],
+    ];
+    if (raw !== undefined &&
+        (raw.source !== undefined || raw.code !== undefined)) {
+        rendered.push([
+            raw.source,
+            raw.code === undefined ? undefined : String(raw.code),
+        ]);
+    }
+    return expandRenderedIdentities(rendered);
+}
+/**
+ * #3102: the identity spellings a mark against a surface that renders a
+ * finding's RULE but never its TOOL can carry — the turn-end late-auxiliary
+ * advisory (`<file>:<line>:<col> [<rule>] <message>`) and the cold-neighbour
+ * cascade run (`line N, col M rule=<rule>: <message>`). Both print the
+ * canonical dispatch `rule`, so a mark made ELSEWHERE (the widget, `mode=full`)
+ * carries the full `(tool, rule)` pair while a mark made from the surface's own
+ * output has no tool to pass on — and `lens_diagnostic_mark`'s `tool` parameter
+ * is optional. Honoring only one of the two spellings is exactly the
+ * non-convergence #3088 reported, so both go through the SAME expansion
+ * `probeIdentities` uses.
+ */
+export function renderedRuleIdentities(diagnostic) {
+    return expandRenderedIdentities([[diagnostic.tool, diagnostic.rule]]);
+}
+/** Every rendered `(tool, rule)` spelling plus the `tool`-omitted form of
+ * each, de-duplicated, in order. One derivation for both callers. */
+function expandRenderedIdentities(rendered) {
+    const out = [];
+    const seen = new Set();
+    for (const [tool, rule] of rendered) {
+        // Both spellings also in the `tool`-omitted form the mark tool admits.
+        for (const candidateTool of [tool, undefined]) {
+            const key = `${candidateTool ?? ""}\u0000${rule ?? ""}`;
+            if (seen.has(key))
+                continue;
+            seen.add(key);
+            out.push({
+                ...(candidateTool !== undefined && { tool: candidateTool }),
+                ...(rule !== undefined && { rule }),
+            });
+        }
+    }
+    return out;
+}
+/* No drop COUNT is returned here on purpose (round 2 F1): the number an agent
+ * is shown has to be scoped to that caller's severity threshold, and this
+ * module must not learn about a threshold its other caller (`mode=full`) does
+ * not have. `kept` versus the input is all a caller needs to derive its own. */
+/**
+ * The probe lane's entry point: the same stack, over RAW LSP diagnostics.
+ *
+ * Identity comes from the two shared converters the widget footer already runs
+ * on this very path (`convertLspDiagnostics` + `retagAuxiliaryDiagnostics`),
+ * never a third derivation — a second copy of the conversion giving the same
+ * finding a different `rule`, and orphaning every mark against it, is the #692
+ * defect itself.
+ *
+ * `retagAuxiliaryDiagnostics` is used for its in-place re-tag only; its own
+ * drop set (native aux comments, `skipTestFiles`) is deliberately ignored here
+ * because `applyAuxiliarySuppressions` already applied exactly that filter to
+ * these diagnostics at collection time — re-dropping would double-apply a
+ * filter this route owns upstream.
+ */
+export function applyLspFindingPolicy(diagnostics, options) {
+    if (!diagnostics.length)
+        return { kept: diagnostics, inlineKept: diagnostics };
+    const content = options.content ?? "";
+    // `convertLspDiagnostics` drops entries with no start line, which would
+    // break the 1:1 index alignment `retagAuxiliaryDiagnostics` and the map-back
+    // below depend on. Partition first so the converted array IS aligned with
+    // `anchored`; a line-less entry passes straight through (it carries no line
+    // for an anchor to bind to, and dropping it would silently lose a finding
+    // this filter has no claim over).
+    const anchored = [];
+    for (const diagnostic of diagnostics) {
+        if (diagnostic.range?.start?.line !== undefined)
+            anchored.push(diagnostic);
+    }
+    if (!anchored.length)
+        return { kept: diagnostics, inlineKept: diagnostics };
+    const converted = convertLspDiagnostics(anchored, options.filePath);
+    retagAuxiliaryDiagnostics(converted, anchored, content, {
+        cwd: options.cwd,
+        fileRole: options.fileRole,
+    });
+    // `convertLspDiagnostics` maps its (pre-filtered) input 1:1, so `converted[i]`
+    // belongs to `anchored[i]`. Pair them up front and work from the pairing: a
+    // converted entry with no counterpart is simply never paired, so it can never
+    // be dropped — fail open, never hide a finding this filter could not identify.
+    const rawByConverted = new Map();
+    for (const [index, diagnostic] of converted.entries()) {
+        const raw = anchored[index];
+        if (raw !== undefined)
+            rawByConverted.set(diagnostic, raw);
+    }
+    const { kept, inlineKept } = applyFindingPolicy(converted, {
+        cwd: options.cwd,
+        filePath: options.filePath,
+        content,
+        policyMap: options.policyMap,
+        identities: (diagnostic) => probeIdentities(diagnostic, rawByConverted.get(diagnostic)),
+    });
+    const survivorsOf = (survivors) => {
+        if (survivors.length === converted.length)
+            return diagnostics;
+        const keptConverted = new Set(survivors);
+        const dropped = new Set();
+        for (const [diagnostic, raw] of rawByConverted) {
+            if (!keptConverted.has(diagnostic))
+                dropped.add(raw);
+        }
+        return diagnostics.filter((d) => !dropped.has(d));
+    };
+    return { kept: survivorsOf(kept), inlineKept: survivorsOf(inlineKept) };
+}