pi-lens 4.1.5 → 4.2.0

package/dist/clients/dispatch/integration.js

@@ -19,7 +19,7 @@ import * as nodeFs from "node:fs";
 import * as nodePath from "node:path";
 import { fileURLToPath } from "node:url";
 import { CASCADE_NEIGHBOUR_BUDGET, deriveCascadeNeighbourBudget, } from "../cascade-budget.js";
-import { formatCascadeNeighborDiagnostics } from "../cascade-format.js";
+import { applyCascadeDisplayPolicy, formatCascadeNeighborDiagnostics, recordCascadeFindingPolicy, } from "../cascade-format.js";
 import { logCascade } from "../cascade-logger.js";
 import { getDiagnosticTracker } from "../diagnostic-tracker.js";
 import { classifyCascadeWaitTier, isTierAwareCascadeEnabled, recordOutstandingCascadeTouch, } from "../lsp/cascade-tier.js";
@@ -434,6 +434,25 @@ function ensureCascadeTurnScope(turnSeq) {
 }
 const MAX_PER_FILE = RUNTIME_CONFIG.pipeline.cascadeMaxDiagnosticsPerFile;
 const MAX_FILES = RUNTIME_CONFIG.pipeline.cascadeMaxFiles;
+/**
+ * How many of ONE neighbour's ERRORs the display policy may look at (#3157
+ * round 2, F1). `MAX_PER_FILE` is the DISPLAY cap and now applies to the
+ * survivors, so this is the separate, deliberately generous bound on the
+ * policy's INPUT — four full display caps of headroom, so a neighbour would
+ * need 80 suppressed findings before a genuine one could fall off the end
+ * again.
+ *
+ * It exists because the policy's cost is linear in the finding count once a
+ * project has ANY disposition mark (the zero-I/O hoist in
+ * `finding-policy.ts` stops firing and every finding expands into its
+ * candidate identities): measured on 40 real neighbours, 1.31 ms/neighbour at
+ * 20 findings, 4.74 ms at 80, and 28.29 ms at 500 — that last one is 1131
+ * ms/edit across a full 40-neighbour walk, a quarter of the `cascadeSettleWaitMs`
+ * window, for a neighbour nobody can read anyway. Truncation here is COUNTED
+ * (`inputTruncated` on the `cascade_finding_policy` row), because an input
+ * bound whose loss is invisible is exactly the defect F1 found.
+ */
+const MAX_POLICY_INPUT_PER_FILE = MAX_PER_FILE * 4;
 /**
  * The genuine language-server ERROR diagnostics from a cascade neighbor
  * re-check, ready to reconcile into the footer widget (#1093).
@@ -455,8 +474,14 @@ const MAX_FILES = RUNTIME_CONFIG.pipeline.cascadeMaxFiles;
  * entries untouched. This keeps `isLspErrorEntry`'s "tool === 'lsp' uniquely
  * identifies a genuine language-server entry" contract true for what we write.
  *
- * The DISPLAY list (`diags` at each call site) is deliberately left as-is —
- * that is pre-existing cascade output behavior, out of scope for #1093.
+ * The DISPLAY list is no longer "left as-is" as it was for #1093: since #3157
+ * every display site runs `cascadeDisplay` → `applyCascadeDisplayPolicy`, which
+ * applies the finding-policy stack AND keeps the auxiliary retag's own drop set
+ * — so the display drops natively-suppressed aux findings while still RENDERING
+ * the aux findings this widget writer excludes wholesale. The two remain
+ * deliberately different: this one protects `isLspErrorEntry`'s "tool === 'lsp'"
+ * contract for PERSISTED widget state, which the ephemeral display list never
+ * touches.
  */
 function cascadeReconcilableLspErrors(rawDiags, neighborPath) {
     return convertLspDiagnostics(rawDiags
@@ -732,7 +757,7 @@ export async function computeCascadeForFile(filePath, cwd, options = {}) {
     // time that elapsed before turn_end began waiting.
     const cascadeStart = Date.now();
     try {
-        const { hasBlockers = false, dbg, turnSeq = 0, writeSeq, seqState, turnEndCascadeSettleStart, fileContent, wordIndex, onWordIndexUpdated, } = options;
+        const { hasBlockers = false, dbg, turnSeq = 0, writeSeq, projectRoot, seqState, turnEndCascadeSettleStart, fileContent, wordIndex, onWordIndexUpdated, } = options;
         ensureCascadeTurnScope(turnSeq);
         if (hasBlockers) {
             logCascade({
@@ -1311,6 +1336,64 @@ export async function computeCascadeForFile(filePath, cwd, options = {}) {
         let passiveSnapshotHits = 0;
         let noLspConfigured = 0;
         let touchFailures = 0;
+        // #3157: this run's AGGREGATE display-policy drops, across every neighbour
+        // the four display sites below rendered. Aggregate, not per neighbour: a
+        // cascade walks up to `CASCADE_NEIGHBOUR_BUDGET` (40) neighbours per edit,
+        // so a record inside the loop would be per-occurrence logging on a per-edit
+        // path — one bounded row per RUN instead (AGENTS.md "bounded observability").
+        // `policyElapsedMs` accumulates ONLY the stack's own time (round 2, F2): a
+        // clock started here would have spanned the whole `touchFile` fan-out and
+        // reported the neighbour WALK as the policy phase — hundreds of ms against
+        // the sub-millisecond cost AC 3 measured, under the same phase literal the
+        // quiet-window lane writes.
+        let policyElapsedMs = 0;
+        const policyCounts = {
+            suppressed: 0,
+            auxSuppressed: 0,
+            total: 0,
+            inputTruncated: 0,
+        };
+        /**
+         * The ONE seam every in-lane cascade DISPLAY list goes through (#3157).
+         *
+         * Before this, all four sites open-coded `convertLspDiagnostics(...)` and
+         * rendered the result raw: `grep applyFindingPolicy clients/dispatch/
+         * integration.ts` returned nothing, so a neighbour ERROR the agent had
+         * marked `false-positive` was hidden by `mode=delta`/`mode=full`/the
+         * per-edit dispatcher/the probe lane/the quiet-window cascade run and STILL
+         * re-reported here on every edit that cascaded to it. The severity filter
+         * and the `MAX_PER_FILE` display cap were the fourth copy of the same three
+         * lines and fold in with it.
+         *
+         * `neighborContent` is passed by the ONE caller that has already read the
+         * neighbour (the active touch reads it to feed `touchFile`) — those are the
+         * exact bytes the diagnostics were computed against, so it is both free and
+         * more faithful than a re-read. The other three sites let the shared helper
+         * read once, and only once a neighbour actually has an ERROR to render.
+         *
+         * Stage order (round 2, F1): severity filter → input bound → convert →
+         * retag → policy → DISPLAY cap. `MAX_PER_FILE` is applied to the survivors
+         * inside the helper; applying it here, before the policy, let policy drops
+         * consume display slots and rendered a false clean.
+         */
+        const cascadeDisplay = (rawDiags, neighborPath, neighborContent) => {
+            const started = Date.now();
+            const errors = rawDiags.filter((d) => d.severity === 1);
+            const policyInput = errors.slice(0, MAX_POLICY_INPUT_PER_FILE);
+            const result = applyCascadeDisplayPolicy(policyInput, {
+                cwd,
+                policyRoot: projectRoot ?? cwd,
+                filePath: neighborPath,
+                displayCap: MAX_PER_FILE,
+                ...(neighborContent !== undefined && { content: neighborContent }),
+            });
+            policyCounts.suppressed += result.suppressed;
+            policyCounts.auxSuppressed += result.auxSuppressed;
+            policyCounts.total += result.total;
+            policyCounts.inputTruncated += errors.length - policyInput.length;
+            policyElapsedMs += Date.now() - started;
+            return result.diagnostics;
+        };
         if (sortedNeighbors.length > 0) {
             const snapshotPaths = sortedNeighbors.filter(shouldReadCascadeFromSnapshot);
             const activePaths = sortedNeighbors.filter((n) => !shouldReadCascadeFromSnapshot(n));
@@ -1371,7 +1454,8 @@ export async function computeCascadeForFile(filePath, cwd, options = {}) {
                 // cascade neighbor diagnostics are ephemeral display-only output
                 // (never reconciled into persisted widget/dedup state), so the label
                 // had no remaining purpose and is simply dropped rather than migrated.
-                const diags = convertLspDiagnostics(entry.diags.filter((d) => d.severity === 1).slice(0, MAX_PER_FILE), neighborPath);
+                // #3157 site 1 of 4: the passive cold-snapshot hit.
+                const diags = cascadeDisplay(entry.diags, neighborPath);
                 producedLspData = true;
                 passiveSnapshotHits++;
                 const durationMs = Date.now() - neighborStart;
@@ -1623,12 +1707,12 @@ export async function computeCascadeForFile(filePath, cwd, options = {}) {
                 // doc comment on the sibling call above) — dropped rather than
                 // migrated to `scanOrigin` since cascade output never touches
                 // persisted widget/dedup state.
-                // #1179: `.filter()` here operates on `rawDiags.diags`; the
-                // `inconclusive`/`binding` flags read above stay on the `rawDiags`
-                // wrapper and are unaffected by this copy (the shape-5 fix).
-                const diags = convertLspDiagnostics(rawDiags.diags
-                    .filter((d) => d.severity === 1)
-                    .slice(0, MAX_PER_FILE), neighborPath);
+                // #1179: the severity filter inside `cascadeDisplay` operates on
+                // `rawDiags.diags`; the `inconclusive`/`binding` flags read above
+                // stay on the `rawDiags` wrapper and are unaffected (the shape-5 fix).
+                // #3157 site 2 of 4: the fresh in-lane touch. `content` is the copy
+                // this touch was computed against — no second read.
+                const diags = cascadeDisplay(rawDiags.diags, neighborPath, content);
                 const durationMs = Date.now() - neighborStart;
                 // #1899: the A5 same-write cache write stood here.
                 if (diags.length === 0) {
@@ -1755,10 +1839,10 @@ export async function computeCascadeForFile(filePath, cwd, options = {}) {
                     // #692: `source: "cascade"` dropped (see the doc comment above the
                     // first cascade call site in this file) — no longer affects `rule`
                     // and cascade output never touches persisted widget/dedup state.
+                    // #3157 site 3 of 4: the touch-error fallback. The touch failed, so
+                    // no content was read for this neighbour — the helper reads it.
                     const diags = ttlFresh && !bindingRejected
-                        ? convertLspDiagnostics(entry.diags
-                            .filter((d) => d.severity === 1)
-                            .slice(0, MAX_PER_FILE), neighborPath)
+                        ? cascadeDisplay(entry.diags, neighborPath)
                         : [];
                     neighbors.push({
                         filePath: neighborPath,
@@ -1774,12 +1858,12 @@ export async function computeCascadeForFile(filePath, cwd, options = {}) {
         // candidates that had no configured LSP may use passive fallback; broadening
         // to unrelated cache entries would make the partial active result misleading.
         if (producedLspData && noLspCandidatePaths.size > 0) {
-            const bindingRejected = appendFallbackNeighbors(neighbors, allDiags, normalizedFileKey, cwd, filePath, noLspCandidatePaths);
+            const bindingRejected = appendFallbackNeighbors(neighbors, allDiags, normalizedFileKey, cwd, filePath, cascadeDisplay, noLspCandidatePaths);
             if (bindingRejected)
                 fallbackBindingRejected = true;
         }
         else if (!producedLspData) {
-            const bindingRejected = appendFallbackNeighbors(neighbors, allDiags, normalizedFileKey, cwd, filePath);
+            const bindingRejected = appendFallbackNeighbors(neighbors, allDiags, normalizedFileKey, cwd, filePath, cascadeDisplay);
             if (bindingRejected)
                 fallbackBindingRejected = true;
             if (neighbors.some((n) => n.reason === "fallback")) {
@@ -1791,8 +1875,23 @@ export async function computeCascadeForFile(filePath, cwd, options = {}) {
                 });
             }
         }
+        // #3157: ONE row per cascade run, covering every neighbour the four display
+        // sites filtered — never one per neighbour. `durationMs` is the stack's own
+        // accumulated time (the content reads the fold added included), NOT the
+        // neighbour walk it runs inside, so this row stays comparable with the
+        // quiet-window lane's row under the same phase literal (round 2, F2).
+        // Silent when nothing was dropped or truncated; gated inside
+        // `recordCascadeFindingPolicy`.
+        recordCascadeFindingPolicy({
+            filePath,
+            durationMs: policyElapsedMs,
+            suppressed: policyCounts.suppressed,
+            total: policyCounts.total,
+            auxSuppressed: policyCounts.auxSuppressed,
+            inputTruncated: policyCounts.inputTruncated,
+        });
         const visibleNeighbors = applyCascadeDeltaBaselines(neighbors);
-        const formatted = formatCascadeResult(cwd, impact, visibleNeighbors, impact.neighborFiles.length);
+        const formatted = formatCascadeResult(cwd, impact, visibleNeighbors, impact.neighborFiles.length, policyCounts.suppressed, policyCounts.inputTruncated);
         // #1104 HONESTY: filtering a bound-false display candidate must not turn a
         // degraded/indeterminate cascade into a clean-looking one (same doctrine as
         // #1023's graph-degraded marker). If every candidate the degraded-fallback
@@ -1977,7 +2076,10 @@ function applyCascadeDeltaBaselines(neighbors) {
  * because its content binding was rejected (#1104) — the caller folds this
  * into the run-level `fallbackBindingRejected` flag for the honesty check.
  */
-function appendFallbackNeighbors(neighbors, allDiags, normalizedFileKey, cwd, filePath, allowedPaths) {
+function appendFallbackNeighbors(neighbors, allDiags, normalizedFileKey, cwd, filePath, 
+/** The run's shared display-policy seam (#3157) — see `cascadeDisplay` in
+ * `computeCascadeForFile`. */
+cascadeDisplay, allowedPaths) {
     const now = Date.now();
     const seen = new Set(neighbors.map((n) => normalizeMapKey(n.filePath)));
     let bindingRejected = false;
@@ -2022,8 +2124,10 @@ function appendFallbackNeighbors(neighbors, allDiags, normalizedFileKey, cwd, fi
             continue;
         }
         // #692: `source: "cascade"` dropped — see the doc comment above the
-        // first cascade `convertLspDiagnostics` call site in this file.
-        const errors = convertLspDiagnostics(diags.filter((d) => d.severity === 1).slice(0, MAX_PER_FILE), diagPath);
+        // first cascade display call site in this file.
+        // #3157 site 4 of 4: the degraded fallback. `cascadeDisplay` is passed in
+        // rather than re-derived so this run's aggregate drop counters see it too.
+        const errors = cascadeDisplay(diags, diagPath);
         if (errors.length === 0)
             continue;
         neighbors.push({
@@ -2048,17 +2152,36 @@ function neighborReason(importerSet, callerSet, neighborPath) {
         return "calls";
     return "references";
 }
-function formatCascadeResult(cwd, impact, neighbors, totalNeighbors) {
+function formatCascadeResult(cwd, impact, neighbors, totalNeighbors, 
+/** This run's aggregate policy-stack drops (#3157). */
+policySuppressed, 
+/**
+ * This run's aggregate `MAX_POLICY_INPUT_PER_FILE` truncation (#3157 round
+ * 3, N1) — ERRORs the policy never LOOKED at.
+ */
+policyInputTruncated) {
     const diagnosticsBlock = formatCascadeNeighborDiagnostics(cwd, neighbors, {
         noun: "neighbor",
         includeReason: true,
     });
-    if (!diagnosticsBlock)
+    // #3157 round 3, N1: an empty block is silence, and silence is a CLEAN
+    // verdict to the agent. That is honest only when everything was looked at.
+    // `policyInputTruncated > 0` means this run's own cost bound declined to
+    // evaluate findings that exist — the #1459 coverage-gap case, not a verdict —
+    // so it must speak even with nothing to render. `policySuppressed` does NOT
+    // get the same treatment on purpose: those findings WERE evaluated and every
+    // drop is the agent's own mark or its project's own rule policy, and the
+    // quiet-window lane deliberately says nothing at all for that case
+    // (`buildResolvedFoundCascadeRun` returns `undefined`). Speaking here and not
+    // there would re-open the two-lane divergence #3157 exists to close.
+    if (!diagnosticsBlock && policyInputTruncated === 0)
         return "";
     const impactHeader = formatImpactCascade(impact, RUNTIME_CONFIG.pipeline.cascadeMaxFiles);
-    let out = impactHeader
-        ? `${impactHeader}\n${diagnosticsBlock}`
-        : diagnosticsBlock;
+    let out = !diagnosticsBlock
+        ? ""
+        : impactHeader
+            ? `${impactHeader}\n${diagnosticsBlock}`
+            : diagnosticsBlock;
     // A10: include truncated filenames so agent knows which files were cut
     const truncated = totalNeighbors - neighbors.length;
     if (truncated > 0) {
@@ -2071,6 +2194,33 @@ function formatCascadeResult(cwd, impact, neighbors, totalNeighbors) {
             : `${truncated} more dependent file(s)`;
         out += `\n... and ${moreLabel}`;
     }
+    // #1616 / #3157: a delivery that still has something to say states what it
+    // dropped, once per delivery — the same sentence the quiet-window cascade run
+    // (`buildResolvedFoundCascadeRun`) and the late-auxiliary advisory render, so
+    // the two cascade lanes do not disagree about whether a mark is worth
+    // mentioning. Policy drops only: an aux drop is the file's own suppression
+    // comment, which the per-edit dispatch path honours silently too, and it stays
+    // in the `cascade_finding_policy` record. A run with NOTHING left returned ""
+    // above and says nothing at all — silence is not a claim that a neighbour is
+    // clean.
+    // #3157 round 3, N1: the same shape and the same closing clause as the
+    // "did not cover" line this file's renderer already uses for a neighbour no
+    // scanner looked at (`clients/cascade-format.ts`) — the agent must not read
+    // an empty or short block as a clean verdict when the bound cut findings
+    // nobody evaluated.
+    if (policyInputTruncated > 0) {
+        if (out)
+            out += "\n";
+        out +=
+            `⚠️ Cascade did not evaluate ${policyInputTruncated} finding(s) — the per-neighbor ` +
+                `policy input is bounded at ${MAX_POLICY_INPUT_PER_FILE}; no findings does NOT mean clean here.`;
+    }
+    // Rides along whenever anything is rendered at all: when the block is empty
+    // and the coverage line above is speaking, this is what explains WHY it is
+    // empty. The empty-and-nothing-truncated case returned above.
+    if (policySuppressed > 0) {
+        out += `\nsuppressed by disposition: ${policySuppressed} finding(s) (marked false-positive or won't-fix).`;
+    }
     return out;
 }
 /**

package/dist/clients/dispatch/rule-ignores.js

@@ -0,0 +1,62 @@
+/**
+ * Per-rule path carve-outs (`ignores:` in a rule's own YAML, #965).
+ *
+ * ONE matcher, shared by every surface that decides whether a rule may fire on
+ * a path: the NAPI ast-grep runner, the tree-sitter runner (`ignore_paths`),
+ * and — since #3041 — the LSP output seam (`applyAuxiliarySuppressions`).
+ *
+ * #3041, measured against ast-grep 0.45.3: `ast-grep scan` applies a rule's
+ * `ignores` globs during its own project walk, but `ast-grep lsp` publishes
+ * per-document diagnostics WITHOUT applying them — the same rule on the same
+ * file is filtered by the CLI and unfiltered over LSP. So every pi-lens path
+ * that delivers ast-grep's LSP diagnostics has to apply the carve-out itself;
+ * the runner-side matcher below is what it applies.
+ */
+import * as path from "node:path";
+import { minimatch } from "../deps/minimatch.js";
+import { buildEffectiveAstGrepCatalog } from "./ast-grep-catalog.js";
+/**
+ * True when `filePath` is carved out of a rule by one of its glob `patterns`.
+ *
+ * The glob is matched against `filePath` relative to `root`, forward-slashed.
+ * Falls back to the absolute (slash-normalized) path when `filePath` isn't
+ * under `root` (e.g. an out-of-tree temp file), so a glob like `scripts/**`
+ * simply never matches rather than throwing.
+ */
+export function isRuleIgnoredForPath(filePath, root, patterns) {
+    if (!patterns || patterns.length === 0)
+        return false;
+    const relative = path.relative(root, filePath);
+    const displayPath = (relative.startsWith("..") ? filePath : relative)
+        .split(path.sep)
+        .join("/");
+    return patterns.some((pattern) => minimatch(displayPath, pattern, { dot: true }));
+}
+/**
+ * Rule id → its `ignores` globs, for the effective ast-grep catalog at `root`.
+ *
+ * #3053: the catalog walk and its first-source-wins precedence used to be
+ * reimplemented here; both this function and the NAPI runner now read
+ * `buildEffectiveAstGrepCatalog` (clients/dispatch/ast-grep-catalog.ts), so
+ * the LSP seam carves out exactly the paths the runner carves out by
+ * construction rather than by two hand-aligned copies — see that module's
+ * docstring for the precedence rule and the within-source-duplicate decision
+ * this function inherits from it. The catalog's own loaders are cached, so
+ * this is ~0.09 ms per call on pi-lens's own catalog (17 rules with
+ * `ignores`, measured) — cheap enough to call per file rather than thread a
+ * preloaded map through every sweep.
+ *
+ * Keyed by the EXACT rule id, matching the runner: a `-js` twin (e.g.
+ * `no-console-except-error-js`) carries its own `ignores` in its own document,
+ * so normalizing the suffix here would apply one document's carve-out to the
+ * other's findings.
+ */
+export function loadRuleIgnorePatterns(root) {
+    const patterns = new Map();
+    for (const [id, { rule }] of buildEffectiveAstGrepCatalog(root)
+        .effectiveRules) {
+        if (rule.ignores?.length)
+            patterns.set(id, rule.ignores);
+    }
+    return patterns;
+}

package/dist/clients/dispatch/runners/actionlint.js

@@ -1,5 +1,6 @@
 import path from "node:path";
 import { safeSpawnAsync } from "../../safe-spawn.js";
+import { resolveRunnerCwd } from "../../tool-cwd.js";
 import { PRIORITY } from "../priorities.js";
 import { createAvailabilityChecker, resolveToolCommandWithInstallFallback, } from "./utils/runner-helpers.js";
 const actionlint = createAvailabilityChecker("actionlint", ".exe");
@@ -66,7 +67,7 @@ const actionlintRunner = {
         return isGitHubWorkflowFile(ctx.filePath);
     },
     async run(ctx) {
-        const cwd = ctx.cwd || process.cwd();
+        const cwd = resolveRunnerCwd(ctx, "actionlint");
         let cmd = null;
         if (await actionlint.isAvailableAsync(cwd)) {
             cmd = actionlint.getCommand(cwd);

package/dist/clients/dispatch/runners/ast-grep-napi.js

@@ -12,16 +12,16 @@ import * as fs from "node:fs";
 import * as path from "node:path";
 import { incrementDegradationCount, recordDegradationOnce, } from "../../degradation-ledger.js";
 import { loadAstGrepNapi, } from "../../deps/ast-grep-napi.js";
-import { minimatch } from "../../deps/minimatch.js";
+import { buildEffectiveAstGrepCatalog } from "../ast-grep-catalog.js";
+import { isRuleIgnoredForPath } from "../rule-ignores.js";
 import { logLatency } from "../../latency-logger.js";
 import { hasAuxiliaryLspPublishedForRoot } from "../../lsp/index.js";
 import { clearPendingAuxiliaryCoverage, hasPendingAuxiliaryCoverage, recordNapiFallbackCoverage, } from "../../lsp/pending-aux-coverage.js";
-import { getAstGrepRuleSources, } from "../../sgconfig.js";
 import { hasEslintConfig } from "../../tool-policy.js";
 import { enabledAuxiliaryLspServerIds } from "../auxiliary-lsp.js";
 import { classifyDefect } from "../diagnostic-taxonomy.js";
 import { PRIORITY } from "../priorities.js";
-import { calculateRuleComplexity, isOverlyBroadPattern, isStructuredRule, loadYamlRules, loadYamlRulesFresh, MAX_BLOCKING_RULE_COMPLEXITY, } from "./yaml-rule-parser.js";
+import { calculateRuleComplexity, isOverlyBroadPattern, isStructuredRule, MAX_BLOCKING_RULE_COMPLEXITY, } from "./yaml-rule-parser.js";
 const defaultUnsupportedLanguageLog = new Set();
 const UNSUPPORTED_RULE_ID_SAMPLE_SIZE = 5;
 /** Clear per-session unsupported-language telemetry dedupe. */
@@ -366,22 +366,6 @@ function explicitRuleFixSuggestion(rule) {
 function normalizeRuleId(ruleId) {
     return ruleId.replace(/-js$/, "");
 }
-/**
- * `filePath` relative to `root`, forward-slashed, for matching a rule's
- * `ignores` globs (#965). Falls back to the absolute (slash-normalized) path
- * when `filePath` isn't under `root` (e.g. an out-of-tree temp file), so a
- * glob like `scripts/**` simply never matches rather than throwing.
- */
-function relativeForIgnoreGlob(filePath, root) {
-    const rel = path.relative(root, filePath);
-    return (rel.startsWith("..") ? filePath : rel).split(path.sep).join("/");
-}
-function matchesRuleIgnores(filePath, root, patterns) {
-    if (!patterns || patterns.length === 0)
-        return false;
-    const rel = relativeForIgnoreGlob(filePath, root);
-    return patterns.some((pattern) => minimatch(rel, pattern, { dot: true }));
-}
 export function canHandle(filePath) {
     return BINDING_BY_EXTENSION.has(path.extname(filePath).toLowerCase());
 }
@@ -660,7 +644,7 @@ function duplicateRuleIds(rules) {
         .map(([id]) => id)
         .sort((a, b) => a.localeCompare(b));
 }
-function appendDuplicateRuleDiagnostics(diagnostics, seenRuleIds, duplicateIds, source, filePath, maxTotalDiagnostics) {
+function appendDuplicateRuleDiagnostics(diagnostics, duplicateIds, source, filePath, maxTotalDiagnostics) {
     const sourceLabel = `${source.origin} ${source.tier} rules`;
     for (const ruleId of duplicateIds) {
         diagnostics.push({
@@ -678,7 +662,6 @@ function appendDuplicateRuleDiagnostics(diagnostics, seenRuleIds, duplicateIds,
             autoFixAvailable: false,
             fixSuggestion: `Give every rule in ${sourceLabel} a unique id`,
         });
-        seenRuleIds.add(ruleId);
         if (diagnostics.length >= maxTotalDiagnostics)
             return true;
     }
@@ -723,7 +706,6 @@ export function evaluateAstGrepRules(filePath, rootNode, cwd, kind, options = {}
     const log = options.log;
     const unsupportedLanguageLog = options.unsupportedLanguageLog ?? defaultUnsupportedLanguageLog;
     const diagnostics = [];
-    const seenRuleIds = new Set();
     const suppressLinterOverlap = kind === "jsts" && hasEslintConfig(cwd);
     const fileLang = ruleLanguageForFile(filePath);
     // Embedded `<script>` coverage (#2347): on an HTML file, every script body
@@ -811,23 +793,14 @@ export function evaluateAstGrepRules(filePath, rootNode, cwd, kind, options = {}
         });
         newlyUnsupported.clear();
     };
-    // Shared with the raw sgconfig materializer so both surfaces walk the same
-    // workspace-rooted sources in the same precedence order.
+    // Same walk and precedence the LSP-seam matcher uses
+    // (clients/dispatch/rule-ignores.ts), folded onto one derivation by #3053
+    // after #3046 shipped them as two independently-drifting copies.
     const ignoreRoot = options.projectRoot ?? cwd;
-    const ruleSources = getAstGrepRuleSources(ignoreRoot);
-    for (const source of ruleSources) {
-        let rules;
-        try {
-            // Project rules are mutable during a session, so their cache fingerprints
-            // relative paths and contents. Bundled catalogs are immutable per install.
-            const loader = source.origin === "project" ? loadYamlRulesFresh : loadYamlRules;
-            rules = loader(source.dir);
-        }
-        catch {
-            continue;
-        }
+    const catalog = buildEffectiveAstGrepCatalog(ignoreRoot);
+    for (const { source, rules } of catalog.sources) {
         const duplicates = duplicateRuleIds(rules);
-        if (appendDuplicateRuleDiagnostics(diagnostics, seenRuleIds, duplicates, source, filePath, maxTotalDiagnostics)) {
+        if (appendDuplicateRuleDiagnostics(diagnostics, duplicates, source, filePath, maxTotalDiagnostics)) {
             flushUnsupportedRuleSkips();
             return diagnostics;
         }
@@ -835,16 +808,23 @@ export function evaluateAstGrepRules(filePath, rootNode, cwd, kind, options = {}
         for (const rule of rules) {
             if (duplicateSet.has(rule.id))
                 continue;
-            // Cross-layer collisions keep the first (higher-precedence) source.
-            if (seenRuleIds.has(rule.id))
+            // Cross-layer collisions keep the first (higher-precedence) source —
+            // resolved once by `buildEffectiveAstGrepCatalog`, not per-rule here.
+            // Compares the winning DOCUMENT (object identity), not merely its
+            // source: comparing `.source` alone can't tell a within-source
+            // duplicate's two copies apart (they share one source), so it gave
+            // no defense if `duplicateSet.has` above were ever the only guard
+            // standing (#3053 round 2 F1). Every `rule` iterated here is the
+            // same object instance the catalog recorded, since both read the
+            // identical `rules` arrays off `catalog.sources`.
+            if (catalog.effectiveRules.get(rule.id)?.rule !== rule)
                 continue;
-            seenRuleIds.add(rule.id);
             if (blockingOnly && rule.severity !== "error")
                 continue;
             // Per-rule path carve-out (#965): a rule that's noise on CLI scripts or
             // a project's own logging sink (e.g. no-console-except-error firing
             // inside scripts/** or lib/logger.ts) opts out via `ignores`.
-            if (matchesRuleIgnores(filePath, ignoreRoot, rule.ignores))
+            if (isRuleIgnoredForPath(filePath, ignoreRoot, rule.ignores))
                 continue;
             if (suppressLinterOverlap &&
                 LINTER_OVERLAP.has(normalizeRuleId(rule.id)) &&

package/dist/clients/dispatch/runners/biome-check.js

@@ -5,13 +5,12 @@
  * Autofix is handled earlier by the post-write pipeline to avoid
  * mutating files mid-dispatch after LSP sync has already happened.
  */
-import * as path from "node:path";
 import { incrementDegradationCount } from "../../degradation-ledger.js";
 import { mapWithConcurrency } from "../../dependency-checker.js";
 import { safeSpawnAsync } from "../../safe-spawn.js";
 import { biomeConfigArgs, getAutofixCapability, getJstsLintPolicyForCwd, } from "../../tool-policy.js";
 import { PRIORITY } from "../priorities.js";
-import { resolveToolCommandWithInstallFallback } from "./utils/runner-helpers.js";
+import { resolveRunnerCwd, resolveToolCommandWithInstallFallback, } from "./utils/runner-helpers.js";
 import { finishParsedRun } from "./utils/tool-failure.js";
 /**
  * Map biome's own severity vocabulary onto the four-tier `Diagnostic.severity`
@@ -198,12 +197,17 @@ const biomeCheckJsonRunner = {
     appliesTo: ["jsts"],
     priority: PRIORITY.FORMAT_AND_LINT_PRIMARY,
     async run(ctx) {
-        const cwd = ctx.cwd || path.dirname(ctx.filePath);
+        const cwd = resolveRunnerCwd(ctx, "biome");
         const policy = getJstsLintPolicyForCwd(cwd);
         // Defer to ESLint/oxlint if the project has explicitly configured one —
         // biome runs as the default linter only when no alternative is present.
         if (!policy.hasBiomeConfig && policy.hasExplicitNonBiomeLinter) {
-            return { status: "skipped", diagnostics: [], semantic: "none" };
+            return {
+                status: "skipped",
+                diagnostics: [],
+                semantic: "none",
+                skipReason: "configured-non-biome-linter",
+            };
         }
         const cmd = await resolveToolCommandWithInstallFallback(cwd, "biome");
         if (!cmd) {

package/dist/clients/dispatch/runners/cpp-check.js

@@ -1,6 +1,8 @@
 import * as fs from "node:fs";
 import * as path from "node:path";
 import { safeSpawnAsync } from "../../safe-spawn.js";
+import { probeToolAsync } from "../../tool-probe.js";
+import { resolveRunnerCwd } from "../../tool-cwd.js";
 import { PRIORITY } from "../priorities.js";
 import { createAvailabilityChecker } from "./utils/runner-helpers.js";
 // Per-compiler availability checkers — each one caches per-cwd and
@@ -100,8 +102,7 @@ async function resolveCompiler(absPath, cwd) {
     // Mirrors the deliberate global-PATH probes in utils/runner-helpers.ts:
     // this never resolves a config file or a target path, so there is no cwd
     // for it to get wrong.
-    // cwd-exempt: presence probe only -- `cl` with no args and no target file, used solely to detect whether MSVC is on PATH
-    const clProbe = await safeSpawnAsync("cl", [], { timeout: 5000 });
+    const clProbe = await probeToolAsync("cl", [], { timeout: 5000 });
     if (!clProbe.error && clProbe.status !== null) {
         return {
             command: "cl",
@@ -181,7 +182,7 @@ const cppCheckRunner = {
     priority: PRIORITY.GENERAL_ANALYSIS,
     skipTestFiles: false,
     async run(ctx) {
-        const cwd = ctx.cwd || process.cwd();
+        const cwd = resolveRunnerCwd(ctx, "cpp-check");
         const absPath = path.resolve(cwd, ctx.filePath);
         const compiler = await resolveCompiler(absPath, cwd);
         if (!compiler) {

package/dist/clients/dispatch/runners/credo.js

@@ -1,6 +1,7 @@
 import * as path from "node:path";
 import * as fs from "node:fs";
 import { safeSpawnAsync } from "../../safe-spawn.js";
+import { resolveRunnerCwd } from "../../tool-cwd.js";
 import { PRIORITY } from "../priorities.js";
 import { createCwdCachedProbe } from "./utils/runner-helpers.js";
 const CREDO_PROBE_BUDGET_MS = 10_000;
@@ -50,7 +51,7 @@ const credoRunner = {
     priority: PRIORITY.GENERAL_ANALYSIS,
     skipTestFiles: false,
     async run(ctx) {
-        const cwd = ctx.cwd || process.cwd();
+        const cwd = resolveRunnerCwd(ctx, "credo");
         if (!hasMixExs(cwd)) {
             return { status: "skipped", diagnostics: [], semantic: "none" };
         }

package/dist/clients/dispatch/runners/cue-vet.js

@@ -104,6 +104,7 @@
 import * as fs from "node:fs";
 import * as path from "node:path";
 import { safeSpawnAsync } from "../../safe-spawn.js";
+import { resolveRunnerCwd } from "../../tool-cwd.js";
 import { createAvailabilityChecker, resolveAvailableOrInstall, } from "./utils/runner-helpers.js";
 import { spawnFailedWithNoOutput } from "./utils/spawn-outcome.js";
 import { PRIORITY } from "../priorities.js";
@@ -281,7 +282,7 @@ const cueVetRunner = {
     skipTestFiles: false,
     timeoutMs: 30_000,
     async run(ctx) {
-        const cwd = ctx.cwd || process.cwd();
+        const cwd = resolveRunnerCwd(ctx, "cue-vet");
         let cmd = null;
         if (await cue.isAvailableAsync(cwd)) {
             cmd = cue.getCommand(cwd);

package/dist/clients/dispatch/runners/dart-analyze.js

@@ -1,5 +1,6 @@
 import * as path from "node:path";
 import { safeSpawnAsync } from "../../safe-spawn.js";
+import { resolveRunnerCwd } from "../../tool-cwd.js";
 import { createAvailabilityChecker } from "./utils/runner-helpers.js";
 import { PRIORITY } from "../priorities.js";
 const dart = createAvailabilityChecker("dart", ".exe");
@@ -147,7 +148,7 @@ const dartAnalyzeRunner = {
     priority: PRIORITY.GENERAL_ANALYSIS,
     skipTestFiles: false,
     async run(ctx) {
-        const cwd = ctx.cwd || process.cwd();
+        const cwd = resolveRunnerCwd(ctx, "dart-analyze");
         const absPath = path.resolve(cwd, ctx.filePath);
         const dartAvailable = await dart.isAvailableAsync(cwd);
         const flutterAvailable = !dartAvailable && (await flutter.isAvailableAsync(cwd));

package/dist/clients/dispatch/runners/detekt.js

@@ -1,6 +1,7 @@
 import * as fs from "node:fs";
 import * as path from "node:path";
 import { safeSpawnAsync } from "../../safe-spawn.js";
+import { resolveRunnerCwd } from "../../tool-cwd.js";
 import { getLinterPolicyForCwd } from "../../tool-policy.js";
 import { PRIORITY } from "../priorities.js";
 import { createAvailabilityChecker } from "./utils/runner-helpers.js";
@@ -129,7 +130,7 @@ const detektRunner = {
     timeoutMs: 90_000,
     skipTestFiles: false,
     async run(ctx) {
-        const cwd = ctx.cwd || process.cwd();
+        const cwd = resolveRunnerCwd(ctx, "detekt");
         const policy = getLinterPolicyForCwd(ctx.filePath, cwd);
         if (policy && !policy.preferredRunners.includes("detekt")) {
             return { status: "skipped", diagnostics: [], semantic: "none" };