pi-lens 4.2.0 → 4.3.0

package/dist/clients/project-diagnostics/fresh-fetch.js

@@ -87,7 +87,7 @@ import { applyDispositionsMultiFile } from "../diagnostic-dispositions.js";
 import { getKnipIgnorePatterns } from "../file-utils.js";
 import { isAtOrAboveHomeDir, realpathOrResolve } from "../path-utils.js";
 import { isSameOrWithin } from "../lsp/server.js";
-import { incrementDegradationCount } from "../degradation-ledger.js";
+import { incrementDegradationCount, recordDegradationOnce, } from "../degradation-ledger.js";
 import { GitleaksClient } from "../gitleaks-client.js";
 import { GovulncheckClient } from "../govulncheck-client.js";
 import { isToolInstallAllowedByTrust, projectTrustDenialReason, } from "../project-trust.js";
@@ -281,8 +281,15 @@ export async function fetchFreshProjectDiagnostics(cacheManager, cwd, clients, s
     function record(id, adapted, elapsedMs, analysedRoot, analysis) {
         if (analysedRoot) {
             pushUnique(analyzed, id);
-            if (analysis?.analyzedFiles !== undefined &&
-                analysis.analyzedFiles.length > 0) {
+            // #2962: the entry is pushed on the DECLARATION, not on its size. A
+            // coverage producer that analysed the root and proved zero files is a
+            // third state, distinct from both "covered, file absent from the set"
+            // and "this runner declares no coverage" — and it is the only one of
+            // the three that used to fall through to the whole-root id-only arm in
+            // `runnerRetirementDecision`, retiring findings for files nothing
+            // scanned. The eight non-producer runners pass no `analyzedFiles` at
+            // all and are untouched by this.
+            if (analysis?.analyzedFiles !== undefined) {
                 const root = realpathOrResolve(analysisRoot);
                 authoritativeCoverage.push({
                     runnerId: id,
@@ -291,6 +298,17 @@ export async function fetchFreshProjectDiagnostics(cacheManager, cwd, clients, s
                         return realpathOrResolve(file);
                     })),
                 });
+                if (analysis.analyzedFiles.length === 0) {
+                    // Bounded at one row per (producer, root) per session: the kept
+                    // finding is otherwise indistinguishable from a healthy run, and
+                    // "the only coverage producer proved nothing" is the fact an
+                    // operator needs when mode=full keeps showing a stale finding.
+                    recordDegradationOnce({
+                        kind: "runner-coverage-empty",
+                        subject: `${id}:${root}`,
+                        reason: `${id} analysed this root but declared zero scanned files, so retained ${id} findings are kept rather than retired`,
+                    });
+                }
             }
         }
         timings[id] = (timings[id] ?? 0) + elapsedMs;

package/dist/clients/project-lens-config.js

@@ -64,11 +64,11 @@ import * as path from "node:path";
 import { toPositiveFinite } from "./env-utils.js";
 import { FRESHNESS_CADENCE_MS } from "./freshness-cadence.js";
 import { assignFlagConfigSection, flagConfigSectionKeys, GLOBAL_NON_FLAG_CONFIG_SECTIONS, GLOBAL_ONLY_NON_FLAG_KEYS, hasFlagConfigPath, LENS_FLAGS, PROJECT_FOREIGN_CONFIG_NAMESPACES, PROJECT_FOREIGN_NAMESPACE_HONORED_KEYS, PROJECT_NON_FLAG_CONFIG_SECTIONS, PROJECT_SCOPED_LENS_FLAGS, readFlagConfigValue, } from "./lens-flag-registry.js";
-import { configSearchDirs, getPiLensGlobalConfigPath, PROJECT_CONFIG_BASENAMES, PROJECT_CONFIG_LOCATIONS, } from "./config-locations.js";
+import { configSearchDirs, getPiLensGlobalConfigPath, isResolvedGlobalConfigPath, PROJECT_CONFIG_BASENAMES, PROJECT_CONFIG_LOCATIONS, } from "./config-locations.js";
 import { deprecationRecords, ignoredRecordCollector, projectLocationFor, readConfigDocument, reportConfigReadFailure, reportPiLensConfigRecords, resolveOnePiLensConfigDocument, } from "./config-resolve.js";
 import { finalizeRecords, } from "./config-core/records.js";
 import { homeRelativePath, isAtOrAboveHomeDir, walkUpDirs, } from "./path-utils.js";
-import { findPiLensConfigMarkerInDir } from "./workspace-topology.js";
+import { dirMtimesStillFresh, findPiLensConfigMarkerInDir, } from "./workspace-topology.js";
 import { readToolConfig } from "./tool-config.js";
 /**
  * Project config basenames, in DESCENDING precedence (first match wins), for
@@ -289,7 +289,7 @@ function safeDirMtimeMs(dir) {
     }
 }
 function discoveryCacheStillFresh(entry) {
-    if (!entry.dirMtimes.every((cached) => safeDirMtimeMs(cached.dir) === cached.mtimeMs)) {
+    if (!dirMtimesStillFresh(entry.dirMtimes)) {
         return false;
     }
     // #2483 round 2. When no config was found anywhere, `bearingDirMtimes`'s
@@ -344,6 +344,12 @@ function discoverPiLensProjectConfig(startDir) {
         if (!info) {
             for (const name of PROJECT_CONFIG_BASENAMES) {
                 const candidate = path.join(dir, name);
+                // The global tier reads its file by absolute path; a candidate that
+                // IS that file is refused here rather than adopted as a project
+                // config, which would double-read and double-validate it
+                // (global-config-location PR, refs #2457).
+                if (isResolvedGlobalConfigPath(candidate))
+                    continue;
                 const stat = safeFileStat(candidate);
                 if (stat?.isFile()) {
                     info = {
@@ -358,6 +364,8 @@ function discoverPiLensProjectConfig(startDir) {
         }
         for (const location of LEGACY_PROJECT_LOCATIONS) {
             const file = path.join(dir, location.relativePath);
+            if (isResolvedGlobalConfigPath(file))
+                continue;
             const stat = safeFileStat(file);
             if (!stat?.isFile())
                 continue;

package/dist/clients/review-graph/builder.js

@@ -30,7 +30,7 @@ import { getSharedTreeSitterClient } from "../tree-sitter-shared.js";
 import { symbolExtractionGrammar, TreeSitterSymbolExtractor, } from "../tree-sitter-symbol-extractor.js";
 import { withTreeSitterRoot } from "../tree-sitter-shared.js";
 import { incrementDegradationCount } from "../degradation-ledger.js";
-import { resolveGitIdentity } from "./git-identity.js";
+import { createGitIdentityResolver, resolveGitIdentity, } from "./git-identity.js";
 import { formatReviewGraphRevisionDriftNote, } from "./revision-drift.js";
 import { buildSymbolId } from "./symbol-id.js";
 import { clearReviewGraphFileIr, getFreshReviewGraphFileIr, reviewGraphIrContentHash, } from "./shared-extraction-ir.js";
@@ -670,18 +670,18 @@ export function getReviewGraphCacheIdentity(cwd, graph) {
 // path, that assumption silently breaks. This doesn't hard-fail (the issue
 // is explicit: log-once observability is enough) — it just makes the
 // assumption visible. The Set records every cwd whose check has RUN (not just
-// mismatches), so resolveGitIdentity's fs reads happen once per cwd per
-// process — zero per-build cost after the first, mismatch or not.
+// mismatches), so a build-local resolver keeps repeated checks in one build
+// bounded without retaining repository presence across builds.
 const _cwdWorktreeCheckedCwds = new Set();
 export function _resetCwdWorktreeMismatchLogForTests() {
     _cwdWorktreeCheckedCwds.clear();
 }
-function logCwdWorktreeMismatchOnce(cwd) {
+function logCwdWorktreeMismatchOnce(cwd, resolveIdentity = resolveGitIdentity) {
     const key = normalizeMapKey(cwd);
     if (_cwdWorktreeCheckedCwds.has(key))
         return;
     _cwdWorktreeCheckedCwds.add(key);
-    const identity = resolveGitIdentity(cwd);
+    const identity = resolveIdentity(cwd);
     if (!identity)
         return; // not a git repo — nothing to compare against
     if (identity.worktreeRoot === normalizeFilePath(path.resolve(cwd)))
@@ -1345,7 +1345,7 @@ function logSnapshotReadVerdict(cwd, phase, reason) {
         return;
     logReviewGraph({ cwd, phase, reason });
 }
-function loadPersistedGraph(cwd, opts) {
+function loadPersistedGraph(cwd, opts, resolveIdentity = resolveGitIdentity) {
     const cacheDir = path.join(getProjectDataDir(cwd), "cache");
     const cachePath = path.join(cacheDir, GRAPH_CACHE_FILENAME);
     const legacyPath = path.join(cacheDir, LEGACY_GRAPH_CACHE_FILENAME);
@@ -1382,7 +1382,7 @@ function loadPersistedGraph(cwd, opts) {
         // "can't verify," not a mismatch, so it does not drop the snapshot.
         let stampedHead;
         if (opts?.verifyWorktreeIdentity && data.gitStamp) {
-            const current = resolveGitIdentity(cwd);
+            const current = resolveIdentity(cwd);
             if (current && current.worktreeRoot !== data.gitStamp.worktreeRoot) {
                 logSnapshotReadVerdict(cwd, "snapshot_read_dropped", "worktree_mismatch");
                 return null;
@@ -2198,11 +2198,11 @@ function persistGraph(cwd, signature, fileSignatures, fileHashes, graph, options
     const cacheDir = path.join(getProjectDataDir(cwd), "cache");
     const cachePath = path.join(cacheDir, GRAPH_CACHE_FILENAME);
     sweepStaleStageFiles(cacheDir);
-    // #300: resolve the git stamp fresh at persist time (HEAD changes on
-    // commit/checkout, so it isn't cached like the gitdir location — but these
-    // are plain fs reads, cheap even called per-persist). undefined for
+    // #300: resolve the git stamp at persist time. The build-local resolver
+    // deduplicates repeated checks within this build, while a later build gets a
+    // fresh lifecycle view. undefined for
     // non-git cwds, which serializes as `gitStamp: undefined` → omitted key.
-    const gitStamp = resolveGitIdentity(cwd);
+    const gitStamp = (options.resolveIdentity ?? resolveGitIdentity)(cwd);
     // Retain the immutable snapshot inputs and build their O(graph) serializable
     // arrays only after the quiet window. Replacing a pending entry during an edit
     // burst now avoids both serialization and the pre-serialization full copies.
@@ -2353,7 +2353,7 @@ function hashIgnoredIds(ignoredIds) {
 }
 /** Assemble the checkpoint DTO from the current PRE-resolution graph. Isolated
  * so both the offloaded and synchronous writers serialize identical bytes. */
-function buildReviewGraphCheckpointData(cwd, graph, processedHashes, targetFileCount, ignoredIds) {
+function buildReviewGraphCheckpointData(cwd, graph, processedHashes, targetFileCount, ignoredIds, resolveIdentity = resolveGitIdentity) {
     return {
         version: REVIEW_GRAPH_VERSION,
         builtAt: new Date().toISOString(),
@@ -2363,7 +2363,7 @@ function buildReviewGraphCheckpointData(cwd, graph, processedHashes, targetFileC
         ignoredIdsHash: hashIgnoredIds(ignoredIds),
         nodes: Array.from(graph.nodes.entries()),
         edges: graph.edges,
-        gitStamp: resolveGitIdentity(cwd),
+        gitStamp: resolveIdentity(cwd),
     };
 }
 /**
@@ -2375,12 +2375,12 @@ function buildReviewGraphCheckpointData(cwd, graph, processedHashes, targetFileC
  * resurrect one over a completed build; it falls back to a synchronous write
  * when the worker is unavailable. A lost checkpoint only costs a cold rebuild.
  */
-function writeReviewGraphCheckpoint(cwd, graph, processedHashes, targetFileCount, ignoredIds) {
+function writeReviewGraphCheckpoint(cwd, graph, processedHashes, targetFileCount, ignoredIds, resolveIdentity = resolveGitIdentity) {
     const generation = (_checkpointGenerations.get(cwd) ?? 0) + 1;
     _checkpointGenerations.set(cwd, generation);
     let data;
     try {
-        data = buildReviewGraphCheckpointData(cwd, graph, processedHashes, targetFileCount, ignoredIds);
+        data = buildReviewGraphCheckpointData(cwd, graph, processedHashes, targetFileCount, ignoredIds, resolveIdentity);
     }
     catch {
         return; // best-effort — building the DTO failed, skip this stride
@@ -2488,7 +2488,7 @@ function deleteReviewGraphCheckpoint(cwd) {
  * The returned graph carries `persistCoverage.inProgress` so it can never be
  * mistaken for a complete graph if it escapes the resume path.
  */
-function loadReviewGraphCheckpoint(cwd) {
+function loadReviewGraphCheckpoint(cwd, resolveIdentity = resolveGitIdentity) {
     const checkpointPath = reviewGraphCheckpointPath(cwd);
     let data;
     try {
@@ -2515,7 +2515,7 @@ function loadReviewGraphCheckpoint(cwd) {
         return null;
     }
     if (data.gitStamp) {
-        const current = resolveGitIdentity(cwd);
+        const current = resolveIdentity(cwd);
         if (current && current.worktreeRoot !== data.gitStamp.worktreeRoot) {
             logReviewGraph({
                 cwd,
@@ -2598,8 +2598,8 @@ function pruneOrphanNonFileNodes(graph) {
  *  - The ignored-id fingerprint must match (import-edge resolution depends on
  *    it), else fail open.
  */
-async function tryResumeFromCheckpoint(cwd, filesToBuild, ignoredIds) {
-    const loaded = loadReviewGraphCheckpoint(cwd);
+async function tryResumeFromCheckpoint(cwd, filesToBuild, ignoredIds, resolveIdentity = resolveGitIdentity) {
+    const loaded = loadReviewGraphCheckpoint(cwd, resolveIdentity);
     if (!loaded)
         return null;
     if (loaded.ignoredIdsHash !== hashIgnoredIds(ignoredIds)) {
@@ -4153,6 +4153,7 @@ async function tryIncrementalFromCache(cached, ctx) {
         projectSeq: ctx.seqAtBuildStart,
         seqHint: ctx.seqHint,
         mode: ctx.mode,
+        resolveIdentity: ctx.resolveIdentity,
     });
     setGraphBuildInfo(graph, {
         reused: true,
@@ -4179,7 +4180,7 @@ function hasGraphKindExtension(file) {
  * `_lastGraphBuildInfo` (the caller's full sweep sets the mode and stamps the
  * fallback reason). Correctness bar is HIGH: any doubt ⇒ fall back.
  */
-async function trySeqFastpath(cwd, buildId, normalizedCwd, normalizedChanged, facts, seqHint, seqAtBuildStart, ignoredIds, cacheEpoch) {
+async function trySeqFastpath(cwd, buildId, normalizedCwd, normalizedChanged, facts, seqHint, seqAtBuildStart, ignoredIds, cacheEpoch, resolveIdentity) {
     const cached = _workspaceGraphCache.get(normalizedCwd);
     // Condition 2: need an in-process entry that recorded a build seq and whose
     // SOURCE WALK was complete. An entry-budget-truncated or checkpoint graph has
@@ -4326,6 +4327,7 @@ async function trySeqFastpath(cwd, buildId, normalizedCwd, normalizedChanged, fa
         projectSeq: seqAtBuildStart,
         seqHint: true,
         mode: "seq-fastpath",
+        resolveIdentity,
     });
     // #459: filesToUpdate was non-empty — this fastpath re-extracted real files,
     // so (unlike the no-op branch above) the graph object did change.
@@ -4343,6 +4345,7 @@ async function trySeqFastpath(cwd, buildId, normalizedCwd, normalizedChanged, fa
     return { graph };
 }
 async function _doBuildGraph(cwd, changedFiles, facts, seqHint, buildId) {
+    const resolveIdentity = createGitIdentityResolver();
     const normalizedCwd = normalizeMapKey(cwd);
     const cacheEpoch = workspaceCacheEpoch(normalizedCwd);
     // `await undefined` still yields a microtask, which reorders overlapping
@@ -4352,7 +4355,7 @@ async function _doBuildGraph(cwd, changedFiles, facts, seqHint, buildId) {
         await _reviewGraphBuildGateForTests();
     const normalizedChanged = changedFiles.map((file) => normalizeMapKey(file));
     const normalizedChangedSet = new Set(normalizedChanged);
-    logCwdWorktreeMismatchOnce(cwd);
+    logCwdWorktreeMismatchOnce(cwd, resolveIdentity);
     // #622: reject a cwd that IS (or is an ancestor of) $HOME before any walk is
     // attempted. The 3 real per-edit callers (dispatch/integration.ts's
     // computeCascadeForFile, mcp/analyze.ts, tree-sitter.ts's
@@ -4405,7 +4408,7 @@ async function _doBuildGraph(cwd, changedFiles, facts, seqHint, buildId) {
     // cascade.log can watch the fast-path hit/miss rate.
     let seqFastpathFallback;
     if (seqHint && seqAtBuildStart !== undefined && seqFastpathEnabled()) {
-        const fast = await trySeqFastpath(cwd, buildId, normalizedCwd, normalizedChanged, facts, seqHint, seqAtBuildStart, await ignoredIdsPromise, cacheEpoch);
+        const fast = await trySeqFastpath(cwd, buildId, normalizedCwd, normalizedChanged, facts, seqHint, seqAtBuildStart, await ignoredIdsPromise, cacheEpoch, resolveIdentity);
         if ("graph" in fast)
             return fast.graph;
         seqFastpathFallback = fast.fallback;
@@ -4550,6 +4553,7 @@ async function _doBuildGraph(cwd, changedFiles, facts, seqHint, buildId) {
             seqAtBuildStart,
             ignoredIds,
             cacheEpoch,
+            resolveIdentity,
         });
         if (incremental) {
             updateGraphBuildInfo(incremental, { seqFastpathFallback });
@@ -4561,7 +4565,9 @@ async function _doBuildGraph(cwd, changedFiles, facts, seqHint, buildId) {
     // #202 content-hash confirm below already content-verify the load, and
     // dropping on every HEAD move would force a full whole-repo rebuild after
     // each plain `git commit` (HEAD moves, files unchanged).
-    const diskCached = sourceFilesTruncated ? null : loadPersistedGraph(cwd);
+    const diskCached = sourceFilesTruncated
+        ? null
+        : loadPersistedGraph(cwd, undefined, resolveIdentity);
     if (diskCached?.signature === signature) {
         const graph = cloneGraph(diskCached.graph);
         rebuildIndexes(graph);
@@ -4613,6 +4619,7 @@ async function _doBuildGraph(cwd, changedFiles, facts, seqHint, buildId) {
             facts,
             seqAtBuildStart,
             ignoredIds,
+            resolveIdentity,
         });
         if (incremental) {
             updateGraphBuildInfo(incremental, { seqFastpathFallback });
@@ -4623,7 +4630,7 @@ async function _doBuildGraph(cwd, changedFiles, facts, seqHint, buildId) {
     // present and still current (#936 limit 2), else cold from an empty graph.
     const resumed = sourceFilesTruncated
         ? null
-        : await tryResumeFromCheckpoint(cwd, filesToBuild, ignoredIds);
+        : await tryResumeFromCheckpoint(cwd, filesToBuild, ignoredIds, resolveIdentity);
     const graph = resumed?.graph ?? createEmptyGraph();
     const filesToExtract = resumed?.remaining ?? filesToBuild;
     const treeSitterClient = getSharedTreeSitterClient();
@@ -4674,7 +4681,7 @@ async function _doBuildGraph(cwd, changedFiles, facts, seqHint, buildId) {
             if (Number.isFinite(testStopAfter) &&
                 testStopAfter > 0 &&
                 extractedCount >= testStopAfter) {
-                writeReviewGraphCheckpointSync(cwd, buildReviewGraphCheckpointData(cwd, graph, fileHashes, filesToBuild.length, ignoredIds), {
+                writeReviewGraphCheckpointSync(cwd, buildReviewGraphCheckpointData(cwd, graph, fileHashes, filesToBuild.length, ignoredIds, resolveIdentity), {
                     nodes: graph.nodes.size,
                     edges: graph.edges.length,
                     processed: fileHashes.size,
@@ -4686,7 +4693,7 @@ async function _doBuildGraph(cwd, changedFiles, facts, seqHint, buildId) {
             if (filesSinceCheckpoint >= checkpointEvery &&
                 remainingAfter >= checkpointEvery &&
                 Date.now() - lastCheckpointMs >= checkpointMinIntervalMs) {
-                writeReviewGraphCheckpoint(cwd, graph, fileHashes, filesToBuild.length, ignoredIds);
+                writeReviewGraphCheckpoint(cwd, graph, fileHashes, filesToBuild.length, ignoredIds, resolveIdentity);
                 filesSinceCheckpoint = 0;
                 lastCheckpointMs = Date.now();
             }
@@ -4776,6 +4783,7 @@ async function _doBuildGraph(cwd, changedFiles, facts, seqHint, buildId) {
         mode: "full",
         sourceFileCount,
         sourceFilesTruncated,
+        resolveIdentity,
     }); // fire-and-forget
     setGraphBuildInfo(graph, {
         reused: false,

package/dist/clients/review-graph/git-identity.js

@@ -14,14 +14,24 @@
  */
 import * as fs from "node:fs";
 import * as path from "node:path";
-import { BoundedLruCache } from "../bounded-cache.js";
 import { normalizeFilePath, walkUpDirs } from "../path-utils.js";
-// Per-process cache of resolved gitdir location keyed by cwd — the gitdir
-// location itself is stable for the life of the process; only HEAD's
-// CONTENT changes (on commit/checkout), so that's re-read fresh every call.
-const _gitDirCache = new BoundedLruCache(32);
+/** A build-local memo: it is discarded when the build settles. */
+export function createGitIdentityResolver() {
+    const memo = new Map();
+    return (cwd) => {
+        if (memo.has(cwd))
+            return memo.get(cwd);
+        const identity = resolveGitIdentity(cwd);
+        memo.set(cwd, identity);
+        return identity;
+    };
+}
+// Kept as a compatibility no-op for tests that reset the former memo. Git
+// repository creation/removal is a process-lifecycle change, so the lookup
+// below must walk the filesystem on every call rather than cache presence or
+// absence by cwd.
 export function _resetGitIdentityCacheForTests() {
-    _gitDirCache.clear();
+    return;
 }
 function readCommonDir(gitDir) {
     try {
@@ -84,9 +94,6 @@ function resolveGitDir(cwd) {
     return null;
 }
 function getResolvedGitDir(cwd) {
-    const key = normalizeFilePath(path.resolve(cwd));
-    if (_gitDirCache.has(key))
-        return _gitDirCache.get(key) ?? null;
     let resolved;
     try {
         resolved = resolveGitDir(cwd);
@@ -94,7 +101,6 @@ function getResolvedGitDir(cwd) {
     catch {
         resolved = null;
     }
-    _gitDirCache.set(key, resolved);
     return resolved;
 }
 function resolveRefToSha(commonDir, ref) {

package/dist/clients/ruff-client.js

@@ -12,6 +12,7 @@ import * as fs from "node:fs";
 import * as path from "node:path";
 import { createAvailabilityChecker, resolveAvailableOrInstall, } from "./dispatch/runners/utils/runner-helpers.js";
 import { isFileKind } from "./file-kinds.js";
+import { pathsEqual } from "./path-utils.js";
 import { safeSpawnAsync } from "./safe-spawn.js";
 import { resolveToolCwd } from "./tool-cwd.js";
 import { ruffConfigArgs } from "./tool-policy.js";
@@ -95,7 +96,7 @@ export class RuffClient {
                 absolutePath,
             ], { timeout: 10000, cwd: ruffCwd });
             const beforeDiags = pre.stdout?.trim()
-                ? this.parseOutput(pre.stdout, absolutePath)
+                ? this.parseOutput(pre.stdout, ruffCwd, absolutePath)
                 : [];
             const fixableCount = beforeDiags.filter((d) => d.fixable).length;
             const fix = await safeSpawnAsync(this.ruffCommand, ["check", "--fix", ...configArgs, absolutePath], { timeout: 15000, cwd: ruffCwd });
@@ -119,15 +120,41 @@ export class RuffClient {
         }
     }
     // --- Internal ---
-    parseOutput(output, filterFile) {
+    /**
+     * `cwd` is the directory ruff RAN in, and it is REQUIRED: a default would
+     * hide the wrong base at a call site that forgot it (#3284's D11).
+     *
+     * ruff's JSON `filename` is the `SourceFile`'s name verbatim — the JSON
+     * renderer reads `span.file().path(resolver)` (ruff 0.16.8
+     * `crates/ruff_db/src/diagnostic/render/json.rs:58,120`), which for a ruff
+     * (not `ty`) diagnostic is `file.name()` (`crates/ruff_db/src/diagnostic/
+     * mod.rs:1187-1193`), NOT the cwd-relative `relative_path` the text
+     * renderers use (`mod.rs:1195-1204`). That name is
+     * `SourceFileBuilder::new(path.to_string_lossy(), …)`
+     * (`crates/ruff_linter/src/linter.rs:1049`) over a path the resolver has
+     * already absolutized ("Normalize every path (e.g., convert from relative to
+     * absolute)", `crates/ruff_workspace/src/resolver.rs:484`). So ruff echoes
+     * the absolute path we hand it as argv: the BASE was already right here and
+     * the fold deletes a `path.resolve` with no base — which silently meant the
+     * EXTENSION's `process.cwd()`, not ruff's — rather than leaving it for a
+     * future relative invocation to re-enable.
+     */
+    parseOutput(output, cwd, filterFile) {
         if (!output.trim())
             return [];
         try {
             const items = JSON.parse(output);
             const diagnostics = [];
             for (const item of items) {
-                // Filter to single file if requested
-                if (filterFile && path.resolve(item.filename) !== filterFile)
+                // Filter to single file if requested. #3278/#3286: one seam answers
+                // "is this reported diagnostic about the file I ran for?" — resolve
+                // the tool's spelling against the cwd the tool RAN in and compare
+                // through `pathsEqual`, the repo's on-disk identity predicate. A bare
+                // `!==` treats a spelling that differs only in case (the SAME file on
+                // Windows and on a case-folding POSIX mount) as a different file and
+                // drops every finding for the edited file (#209, #3277).
+                if (filterFile &&
+                    !pathsEqual(path.resolve(cwd, item.filename), filterFile))
                     continue;
                 diagnostics.push({
                     line: item.location.row - 1, // ruff is 1-indexed

package/dist/clients/runtime-coordinator.js

@@ -184,12 +184,45 @@ export class RuntimeCoordinator {
         this._cascadeSessionStats.diagnosticsSurfaced += diagnosticsSurfaced;
         this._cascadeSessionStats.coldSnapshotTouches += coldSnapshotTouches;
     }
+    /**
+     * Record the turn-end policy verdict on every live inline-blocker record
+     * (#3248): `true` for a file whose every blocker the policy suppressed,
+     * `false` for every other record in the map.
+     *
+     * ONE writer, rewriting the WHOLE axis each turn end, so the verdict can
+     * never outlive the pass that made it: a record demoted since, or one whose
+     * survivors came back because the file's bytes moved under a content-bound
+     * anchor, is cleared by the same call that sets its sibling. A fresh
+     * dispatch replaces the record wholesale (`recordInlineBlockers`), so a NEW
+     * blocker is never born pre-suppressed (#1198 ordering).
+     *
+     * @returns how many records this call CHANGED — 0 means the gate's view of
+     * the map is already what the policy just decided.
+     */
+    applyInlineBlockerPolicyVerdicts(suppressedFilePaths) {
+        const suppressed = new Set(suppressedFilePaths.map((filePath) => path.resolve(filePath)));
+        let changed = 0;
+        for (const [key, entry] of this._pendingInlineBlockers.entries()) {
+            const policySuppressed = suppressed.has(path.resolve(entry.filePath));
+            if (!!entry.policySuppressed === policySuppressed)
+                continue;
+            this._pendingInlineBlockers.set(key, { ...entry, policySuppressed });
+            changed += 1;
+        }
+        return changed;
+    }
     updateGitGuardStatus(hasBlockers, output) {
         // The status is an aggregate over the current per-file map. A clean B
         // result must not erase an unresolved A result; the pipeline records/clears
         // the edited file immediately before this method runs.
-        this._gitGuardHasBlockers =
-            hasBlockers || this.getInlineBlockersSnapshot().length > 0;
+        // #3248: every live record except one whose whole blocker set the
+        // turn-end disposition policy suppressed. The record itself stays in the
+        // map — the policy is content-bound and re-derived from the record's
+        // diagnostics at every turn end, so dropping it there would be silencing
+        // rather than filtering (AGENTS.md shape 10); it just stops counting for
+        // the gate the agent was shown nothing for.
+        const blocking = this.getInlineBlockersSnapshot().filter((entry) => !entry.policySuppressed);
+        this._gitGuardHasBlockers = hasBlockers || blocking.length > 0;
         if (!this._gitGuardHasBlockers) {
             this._gitGuardSummary = "";
             return;
@@ -198,7 +231,7 @@ export class RuntimeCoordinator {
             .split("\n")
             .map((line) => line.trim())
             .find((line) => line.length > 0);
-        const summaries = this.getInlineBlockersSnapshot()
+        const summaries = blocking
             .map((entry) => entry.summary.trim())
             .filter(Boolean);
         this._gitGuardSummary = (summaries[0] ??
@@ -665,7 +698,7 @@ export class RuntimeCoordinator {
         // that actually settles it delivers it.
         return this._cascadeRuns.length > 0;
     }
-    recordInlineBlockers(filePath, summary, writeIndex, sources, lines, contentBaseline) {
+    recordInlineBlockers(filePath, summary, writeIndex, sources, lines, contentBaseline, diagnostics) {
         const recordedAtMs = Date.now();
         this._pendingInlineBlockers.set(path.resolve(filePath), {
             filePath,
@@ -673,6 +706,7 @@ export class RuntimeCoordinator {
             writeIndex,
             sources,
             lines,
+            diagnostics,
             recordedAtMs,
             stale: false,
             ...(contentBaseline

package/dist/clients/runtime-tool-call.js

@@ -8,7 +8,7 @@ import { evaluateGitGuard, isGitCommitOrPushAttempt } from "./git-guard.js";
 import { dropHashlineAnchorMemo } from "./hashline-anchor.js";
 import { evaluateSharedCheckoutGuard } from "./shared-checkout-guard.js";
 import { logLatency } from "./latency-logger.js";
-import { normalizeMapKey } from "./path-utils.js";
+import { normalizeMapKey, toPosix } from "./path-utils.js";
 import { captureFileStats, getOpaqueBaselineStore, isGitWorktree, } from "./opaque-mutation-scan.js";
 import { normalizeForGuardMatch } from "./host-edit-normalize.js";
 import { retargetReplacementIndentation } from "./indent-retarget.js";
@@ -133,7 +133,12 @@ function isLspCapableFile(filePath) {
     return LANGUAGE_POLICY[kind]?.lspCapable !== false;
 }
 function shouldSkipLspAutoTouch(filePath, projectRoot) {
-    const normalized = path.resolve(filePath).replace(/\\/g, "/").toLowerCase();
+    // #1193 P3: the separator fold is `toPosix`, not a fourth inline copy of
+    // `.replace(/\\/g, "/")`. The `toLowerCase` stays and is NOT a path-key case
+    // fold: `normalized` is never a map key, only the haystack for the
+    // lowercase marker substrings below, which must match a mis-cased spelling
+    // of the same marker directory on a case-insensitive filesystem.
+    const normalized = toPosix(path.resolve(filePath)).toLowerCase();
     const base = path.basename(filePath).toLowerCase();
     if (normalized.includes("/.pi-lens/"))
         return true;
@@ -792,9 +797,15 @@ async function handleToolCallImpl(deps) {
             // budgeted families rather than leaving this site to spell its
             // own axis value (#2557 review F7).
             hook: "tool_call",
-            // The ambient slot is populated by tool_result, after this hook has
-            // already run. Use the live tool_call signal so Escape can release
-            // this await (#2523 AC4).
+            // The ambient slot is populated by tool_result, AFTER this hook has
+            // already run, so the live `tool_call` signal is the only one that
+            // can release this await when the user presses Escape (#2523 AC4).
+            // #2939 round 2 restored this after round 2's own measurement: with
+            // the signal absent, an aborted caller waits the demand's whole
+            // `BOOTSTRAP_LOAD_TIMEOUT_MS` out and the cancel then surfaces on the
+            // ledger as a `timeout` degradation — the exact inversion
+            // `requestBootstrapClients`'s `unavailableReason !== "aborted"` guard
+            // exists to prevent.
             signal: deps.ctx.signal,
         }))?.complexityClient;
         const baseline = await complexityClient?.analyzeFile(filePath);