pi-lens 4.2.0 → 4.3.0

package/docs/pi-lens-reviewer.md

@@ -8,9 +8,25 @@
 - Reproduce the claimed behavior through the production entry point.
 - Report only proven findings; do not repair the author's branch.
 
+## Standard mechanics
+
+- Write `REVIEW.md` as a file at the worktree root, not only in the final
+  answer. Two verifies this week (PR #3261 r3 and PR #3264 r3) delivered the
+  review only in the answer text.
+- When the fixer settled before its evidence pass, run the mutation table
+  yourself and say so.
+
 ## Verification
 
 - Use `git diff origin/master...HEAD` or the merge-base equivalent.
+- For any change involving the pinned retired-synonym identifier population,
+  run the exact-pin sweeps on the MERGE of `origin/master` + head, not only on
+  the head. `tests/config/glossary-synonym-sweep.test.ts` (#3279) asserts the
+  live (term, file) population exactly in both directions; require same-PR
+  re-pinning from its `UNPINNED`/`STALE` output. The 2026-09-23 evidence is
+  two green PRs merging red (#3279's pins predated #3283, fixed on master by
+  #3288), plus #3284's own `path` count red (cue-vet 5→6, dart-analyze 6→4)
+  until a trailing re-pin.
 - Build and run the targeted and required governance suites.
 - Revert or neuter the source fix and verify the red-first test fails.
 - Mutate every new guard, filter, cap, fallback, and lifecycle path.

package/docs/pi-lens-subagent.md

@@ -51,6 +51,15 @@ runner's own notes say which mode lifts it). Run Vitest as
 tree-sitter grammar prefetch hangs offline, verify through direct probes of the
 built code and say so; the orchestrator re-runs the files outside the sandbox.
 
+Every Vitest invocation on the maintainer host exports
+`PI_LENS_TEST_MAX_WORKERS=6` and names its files; never the full suite. The
+plegma daemon's cgroup holds every worker's child processes, and on 2026-09-19
+one fixer's fan-out (16 forks on a 32-core host plus the real language servers
+its probes spawned) took the unit to 64 GB, systemd-oomd killed the daemon, and
+every live worker died with it. Kill every language server a probe spawns
+before moving on; the previous worker's unkilled servers were part of that
+footprint.
+
 When Git authority is granted, use one logical commit with an imperative,
 conventional-prefix subject of at most 50 characters, a blank line, and a
 72-column body that states what and why. Reference the issue. Open a PR, do not

package/docs/public-api-stability.md

@@ -108,6 +108,7 @@ this policy explicitly reserves the right to change.
 | `PILENS_CFG_0007` | Further config notices were suppressed by a bound, and this one carries the count — the WHOLE count, including anything an earlier bound in the same pipeline dropped. Nothing about the config is wrong; the notice list was truncated. | `MigrationRecordCollector.finalize` (`clients/config-core/records.ts`) — the ONE producer, reached through `finalizeRecords` by every record list: the shared resolution, the global loader's unknown-key scan, the project loader's unknown-key scan, and its legacy-document enumeration. Rendered with neutral prose and recorded under the `config-notice-suppressed` degradation kind, never `config-ignored`. |
 | `PILENS_CFG_0008` | Resolving a config failed internally, so the WHOLE file was ignored and pi-lens ran on defaults. | The two guards under the pipeline: `resolveConfig` (`clients/config-core/resolve.ts`) and the global loader's post-parse catch (`clients/lens-config.ts`). Carries the error class only, never its message. |
 | `PILENS_CFG_0009` | A tool config key is unknown or names a required, non-disableable tool. | The shared model-facing tool registry (`clients/tool-config.ts`) and both pi/MCP registration surfaces. |
+| `PILENS_CFG_0010` | A lower-precedence supported global config file exists but was shadowed by the winning file. | `reportGlobalConfigShadowing` (`clients/lens-config.ts`), recorded once through `recordDegradationOnce`. |
 
 A reserved code is registered and referenced by the deprecation registry, but
 nothing emits it today. That is deliberate: the number must be pinned before the

package/docs/release-qa-baseline.md

@@ -85,6 +85,8 @@ PR's packed tarball (#2700, the check #2587 was missing). `attw`
 | mcp-lsp-navigation | LSP navigation answers on a fixture | mcp-stdio | `tools/call` `pilens_lsp_navigation` with operation `documentSymbol` and the fixture path | result is not an error and names the fixture's exported `releaseQaFixtureSymbol` | tool result text | `scripts/smoke-tools.mjs --lsp` is the per-server sibling; this row is the packaged-path variant | #1829 lane 2/3 (gated real-binary + the rotating install lane): #1829 pins each tool's own contract, this row pins that the packaged LSP path answers |
 | config-provenance | a project config is LOADED and its provenance is reportable | mcp-stdio | `tools/call` `pilens_effective_config` with the fixture file | result names the fixture's `.pi-lens.json` as a contributing document | tool result text | new — `tests/config/pi-lens-config-schema.test.ts` covers the schema, not the packaged load | — |
 | degradation-visible | a silently-ignored input is RECORDED as a degradation instead of vanishing | mcp-stdio | `tools/call` `pilens_health` with the fixture's project-tier `lsp.enabled` (a global-only setting) loaded | health text carries a `config-ignored` degradation line naming the fixture's `.pi-lens.json` | health tool result text | `clients/degradation-ledger.ts` is the reused machinery; no smoke asserts it end to end | #1605 lane 2 (availability-lifecycle): the degradation-recorded half; #1605 additionally asserts RECOVERY, which this row does not |
+| global-config-location | the agent-dir global config file supplies the global tier when it exists and the legacy default does not | mcp-stdio | `tools/call` `pilens_effective_config` on a real pi-lens MCP server whose env sets `PI_CODING_AGENT_DIR` at a scratch dir holding `extensions/pi-lens.json` | the tool result NAMES the agent-dir file as a contributing config document (the `pi-coding-agent-dir` winner) | tool result text | `tests/clients/global-config-location.test.ts` covers the resolution in-process; no smoke drives the packaged MCP path with the env set | — |
+| config-shadow-record | a lower-precedence global config file beside the winner is recorded once per session | mcp-stdio | `tools/call` `pilens_effective_config` then `pilens_health` twice, on a real MCP server whose env has BOTH `~/.pi-lens/config.json` and `PI_CODING_AGENT_DIR/extensions/pi-lens.json` present | health carries a `config-location-shadowed: 1` line naming the shadowed agent-dir file, and the count stays 1 on a second health read after a further config load | the two health tool result texts | `clients/degradation-ledger.ts` `recordDegradationOnce` and `tests/clients/global-config-location.test.ts`; no smoke asserts the record end to end | #1605 lane 2 (availability-lifecycle): the degradation-recorded half, as `degradation-visible`; this row additionally pins the once-per-session count across two loads |
 | git-install-loads | a `git:` install of a pushed ref builds and loads in a real pi | git-install | `pi install git:github.com/apmantza/pi-lens@<ref>` then `get_commands` | at least 1 `lens-*` command and at least 4 skills | get_commands response JSON | `scripts/rpc-load-check.mjs` assertion, re-run against the git layout | — |
 | publish-toolchain-pinned | the RELEASE WORKFLOW's publish job runs the npm it pins, and that npm validates the tarball | npm-pack | `npx -y "npm@<packageManager pin>" --version` then `npx -y "npm@<packageManager pin>" publish --dry-run`, both in the scratch export | the pinned invocation reports the pin version AND the dry run exits 0, or npm reports the version is already published after packing; a pinned invocation resolution or registry failure leaves the row UNMEASURED | the two commands with their output | new — `tests/config/release-npm-pin-gate.test.ts` pins release.yml's TEXT; this row is the only thing that RUNS the publish job's toolchain before a tag exists (#2940) | — |
 | tool-smoke-install | every npm/pip entry in the installer registry resolves on a real install | npm-install | `node <export>/scripts/smoke-tools.mjs --install --install-registry --installer-root=<installed>/` (registry `<installed>/dist/clients/installer/index.js`; about 1m 29s cold on this box for 33 entries; harness from export root) | the report shows every npm/pip entry resolved or a named legitimate skip (toolchain absent, declined), and no genuine install failure; a registry-unreachable classification leaves the lane UNMEASURED; requires network access to the npm and pip registries | install-registry JSON report | `classifyInstallOutcome` from the #2661 fixture lanes — this lane sweeps the whole npm/pip registry, where fixture lanes exercise only the entries their fixtures name | — |

package/docs/servercapabilities.md

@@ -6,7 +6,7 @@ server's `initialize` handshake. Generated by `node scripts/server-capabilities.
 absent on the generating host are listed under *Unavailable* — run in a
 provisioned environment (the nightly) to capture those rows.
 
-_Last generated: 2026-09-09 on linux; 31 servers captured, 13 unavailable._
+_Last generated: 2026-09-23 on linux; 37 servers captured, 9 unavailable._
 
 ## Diagnostic mode + navigation/edit operations
 
@@ -17,13 +17,16 @@ Legend: ✓ advertised, · not. **mode** = document diagnostics (`pull` = `textD
 | ast-grep | push-only | · | · | · | · | · | ✓ | · | · | · | ✓ | · | · | · | 1 |
 | bash | push-only | · | ✓ | · | · | ✓ | ✓ | · | ✓ | ✓ | ✓ | ✓ | · | · | 0 |
 | clojure | push-only | · | ✓ | · | ✓ | ✓ | ✓ | ✓ | ✓ | ✓ | ✓ | ✓ | ✓ | ✓ | 62 |
+| cpp | push-only | · | ✓ | ✓ | ✓ | ✓ | ✓ | ✓ | ✓ | ✓ | ✓ | ✓ | ✓ | ✓ | 3 |
 | csharp | pull | ✓ | ✓ | ✓ | · | ✓ | ✓ | ✓ | ✓ | ✓ | ✓ | ✓ | ✓ | ✓ | 0 |
 | css | pull | · | ✓ | · | · | ✓ | ✓ | · | ✓ | · | ✓ | ✓ | · | · | 0 |
 | cue | push-only | · | ✓ | · | · | ✓ | ✓ | · | ✓ | · | ✓ | ✓ | · | · | 1 |
 | dart | push-only | · | ✓ | ✓ | · | ✓ | ✓ | ✓ | ✓ | ✓ | ✓ | ✓ | ✓ | ✓ | 18 |
 | deno | pull | · | ✓ | ✓ | · | ✓ | ✓ | ✓ | ✓ | ✓ | ✓ | ✓ | ✓ | ✓ | 2 |
 | docker | push-only | · | ✓ | · | · | · | ✓ | ✓ | ✓ | · | · | ✓ | · | · | 0 |
+| emmylua | pull | · | ✓ | · | · | ✓ | ✓ | · | ✓ | ✓ | ✓ | · | · | · | 4 |
 | expert | push-only | · | ✓ | · | · | ✓ | ✓ | · | ✓ | ✓ | ✓ | · | · | · | 2 |
+| fish | push-only | · | ✓ | · | · | ✓ | ✓ | ✓ | ✓ | ✓ | ✓ | ✓ | ✓ | · | 22 |
 | fsharp | push-only | · | ✓ | ✓ | · | ✓ | ✓ | ✓ | ✓ | ✓ | ✓ | ✓ | ✓ | ✓ | 0 |
 | gleam | push-only | · | ✓ | ✓ | · | ✓ | ✓ | ✓ | ✓ | · | ✓ | ✓ | · | · | 0 |
 | go | push-only | · | ✓ | ✓ | · | ✓ | ✓ | ✓ | ✓ | ✓ | ✓ | ✓ | ✓ | ✓ | 47 |
@@ -33,13 +36,15 @@ Legend: ✓ advertised, · not. **mode** = document diagnostics (`pull` = `textD
 | marksman | push-only | · | ✓ | · | · | ✓ | ✓ | · | ✓ | ✓ | ✓ | ✓ | · | · | 0 |
 | opengrep | push-only | · | · | · | · | · | ✓ | · | · | · | ✓ | · | · | · | 2 |
 | php | push-only | · | ✓ | · | · | ✓ | ✓ | ✓ | ✓ | ✓ | · | · | · | · | 0 |
-| prisma | push-only | · | ✓ | · | · | ✓ | ✓ | · | ✓ | · | · | ✓ | · | · | 0 |
+| powershell | push-only | · | ✓ | · | · | ✓ | ✓ | ✓ | ✓ | ✓ | ✓ | ✓ | · | · | 0 |
+| prisma | push-only | · | ✓ | · | · | ✓ | ✓ | · | ✓ | · | ✓ | ✓ | · | · | 0 |
 | python | push-only | · | ✓ | ✓ | ✓ | ✓ | ✓ | ✓ | ✓ | ✓ | ✓ | ✓ | · | ✓ | 0 |
 | python-jedi | push-only | · | ✓ | ✓ | ✓ | ✓ | ✓ | ✓ | ✓ | ✓ | ✓ | ✓ | · | · | 0 |
 | ruby | pull | · | ✓ | · | · | ✓ | ✓ | ✓ | ✓ | ✓ | ✓ | ✓ | · | · | 0 |
 | rust | pull | · | ✓ | ✓ | ✓ | ✓ | ✓ | ✓ | ✓ | ✓ | ✓ | ✓ | ✓ | ✓ | 0 |
 | svelte | pull | · | ✓ | ✓ | · | ✓ | ✓ | ✓ | ✓ | ✓ | ✓ | ✓ | ✓ | ✓ | 0 |
 | terraform | push-only | · | ✓ | · | ✓ | ✓ | ✓ | ✓ | ✓ | ✓ | ✓ | · | · | · | 7 |
+| tinymist | push-only | · | ✓ | · | · | ✓ | ✓ | ✓ | ✓ | ✓ | ✓ | ✓ | · | · | 29 |
 | toml | push-only | · | · | · | · | · | ✓ | · | ✓ | · | · | ✓ | · | · | 0 |
 | typescript | push-only | · | ✓ | ✓ | · | ✓ | ✓ | ✓ | ✓ | ✓ | ✓ | ✓ | ✓ | · | 8 |
 | typos | push-only | · | · | · | · | · | · | · | · | · | ✓ | · | · | · | 1 |
@@ -53,13 +58,16 @@ Legend: ✓ advertised, · not. **mode** = document diagnostics (`pull` = `textD
 - **ast-grep**: codeActionProvider, executeCommandProvider, hoverProvider, textDocumentSync
 - **bash**: codeActionProvider, completionProvider, definitionProvider, documentFormattingProvider, documentHighlightProvider, documentSymbolProvider, hoverProvider, referencesProvider, renameProvider, textDocumentSync, workspaceSymbolProvider
 - **clojure**: callHierarchyProvider, codeActionProvider, codeLensProvider, completionProvider, declarationProvider, definitionProvider, documentFormattingProvider, documentHighlightProvider, documentRangeFormattingProvider, documentSymbolProvider, executeCommandProvider, experimental, foldingRangeProvider, hoverProvider, implementationProvider, linkedEditingRangeProvider, referencesProvider, renameProvider, selectionRangeProvider, semanticTokensProvider, signatureHelpProvider, textDocumentSync, workspace, workspaceSymbolProvider
+- **cpp**: astProvider, callHierarchyProvider, clangdInlayHintsProvider, codeActionProvider, compilationDatabase, completionProvider, declarationProvider, definitionProvider, documentFormattingProvider, documentHighlightProvider, documentLinkProvider, documentOnTypeFormattingProvider, documentRangeFormattingProvider, documentSymbolProvider, executeCommandProvider, foldingRangeProvider, hoverProvider, implementationProvider, inactiveRegionsProvider, inlayHintProvider, memoryUsageProvider, positionEncoding, referencesProvider, renameProvider, selectionRangeProvider, semanticTokensProvider, signatureHelpProvider, standardTypeHierarchyProvider, textDocumentSync, typeDefinitionProvider, typeHierarchyProvider, workspaceSymbolProvider
 - **csharp**: callHierarchyProvider, codeActionProvider, codeLensProvider, completionProvider, definitionProvider, diagnosticProvider, documentFormattingProvider, documentHighlightProvider, documentOnTypeFormattingProvider, documentRangeFormattingProvider, documentSymbolProvider, foldingRangeProvider, hoverProvider, implementationProvider, inlayHintProvider, referencesProvider, renameProvider, semanticTokensProvider, signatureHelpProvider, textDocumentSync, typeDefinitionProvider, typeHierarchyProvider, workspace, workspaceSymbolProvider
 - **css**: codeActionProvider, colorProvider, definitionProvider, diagnosticProvider, documentFormattingProvider, documentHighlightProvider, documentLinkProvider, documentRangeFormattingProvider, documentSymbolProvider, foldingRangeProvider, hoverProvider, referencesProvider, renameProvider, selectionRangeProvider, textDocumentSync
 - **cue**: codeActionProvider, codeLensProvider, completionProvider, definitionProvider, documentFormattingProvider, documentSymbolProvider, executeCommandProvider, hoverProvider, referencesProvider, renameProvider, textDocumentSync, workspace
 - **dart**: callHierarchyProvider, codeActionProvider, codeLensProvider, colorProvider, completionProvider, definitionProvider, documentFormattingProvider, documentHighlightProvider, documentLinkProvider, documentOnTypeFormattingProvider, documentRangeFormattingProvider, documentSymbolProvider, executeCommandProvider, experimental, foldingRangeProvider, hoverProvider, implementationProvider, inlayHintProvider, inlineValueProvider, referencesProvider, renameProvider, selectionRangeProvider, semanticTokensProvider, signatureHelpProvider, textDocumentSync, typeDefinitionProvider, typeHierarchyProvider, workspace, workspaceSymbolProvider
 - **deno**: callHierarchyProvider, codeActionProvider, codeLensProvider, completionProvider, definitionProvider, diagnosticProvider, documentFormattingProvider, documentHighlightProvider, documentSymbolProvider, executeCommandProvider, experimental, foldingRangeProvider, hoverProvider, implementationProvider, inlayHintProvider, notebookDocumentSync, referencesProvider, renameProvider, selectionRangeProvider, semanticTokensProvider, signatureHelpProvider, textDocumentSync, typeDefinitionProvider, workspace, workspaceSymbolProvider
 - **docker**: codeActionProvider, completionProvider, definitionProvider, documentFormattingProvider, documentHighlightProvider, documentLinkProvider, documentOnTypeFormattingProvider, documentRangeFormattingProvider, documentSymbolProvider, foldingRangeProvider, hoverProvider, renameProvider, signatureHelpProvider, textDocumentSync
+- **emmylua**: codeActionProvider, definitionProvider, diagnosticProvider, documentSymbolProvider, executeCommandProvider, hoverProvider, referencesProvider, textDocumentSync, workspaceSymbolProvider
 - **expert**: codeActionProvider, codeLensProvider, completionProvider, definitionProvider, documentFormattingProvider, documentSymbolProvider, executeCommandProvider, experimental, hoverProvider, referencesProvider, textDocumentSync, workspace, workspaceSymbolProvider
+- **fish**: codeActionProvider, completionProvider, definitionProvider, documentFormattingProvider, documentHighlightProvider, documentOnTypeFormattingProvider, documentRangeFormattingProvider, documentSymbolProvider, executeCommandProvider, foldingRangeProvider, hoverProvider, implementationProvider, inlayHintProvider, referencesProvider, renameProvider, selectionRangeProvider, semanticTokensProvider, signatureHelpProvider, textDocumentSync, workspace, workspaceSymbolProvider
 - **fsharp**: callHierarchyProvider, codeActionProvider, codeLensProvider, completionProvider, definitionProvider, documentFormattingProvider, documentHighlightProvider, documentRangeFormattingProvider, documentSymbolProvider, foldingRangeProvider, hoverProvider, implementationProvider, inlayHintProvider, referencesProvider, renameProvider, selectionRangeProvider, semanticTokensProvider, signatureHelpProvider, textDocumentSync, typeDefinitionProvider, workspaceSymbolProvider
 - **gleam**: codeActionProvider, completionProvider, definitionProvider, documentFormattingProvider, documentHighlightProvider, documentSymbolProvider, foldingRangeProvider, hoverProvider, referencesProvider, renameProvider, signatureHelpProvider, textDocumentSync, typeDefinitionProvider, workspace
 - **go**: callHierarchyProvider, codeActionProvider, codeLensProvider, completionProvider, definitionProvider, documentFormattingProvider, documentHighlightProvider, documentLinkProvider, documentSymbolProvider, executeCommandProvider, experimental, foldingRangeProvider, hoverProvider, implementationProvider, inlayHintProvider, referencesProvider, renameProvider, selectionRangeProvider, semanticTokensProvider, signatureHelpProvider, textDocumentSync, typeDefinitionProvider, typeHierarchyProvider, workspace, workspaceSymbolProvider
@@ -69,13 +77,15 @@ Legend: ✓ advertised, · not. **mode** = document diagnostics (`pull` = `textD
 - **marksman**: codeActionProvider, codeLensProvider, completionProvider, definitionProvider, documentSymbolProvider, executeCommandProvider, hoverProvider, referencesProvider, renameProvider, semanticTokensProvider, textDocumentSync, workspace, workspaceSymbolProvider
 - **opengrep**: codeActionProvider, executeCommandProvider, hoverProvider, textDocumentSync, workspace
 - **php**: codeActionProvider, completionProvider, declarationProvider, definitionProvider, documentFormattingProvider, documentHighlightProvider, documentRangeFormattingProvider, documentSymbolProvider, foldingRangeProvider, hoverProvider, implementationProvider, inlineValueProvider, referencesProvider, renameProvider, selectionRangeProvider, signatureHelpProvider, textDocumentSync, typeDefinitionProvider, typeHierarchyProvider, workspace, workspaceSymbolProvider
-- **prisma**: completionProvider, definitionProvider, documentFormattingProvider, documentSymbolProvider, hoverProvider, referencesProvider, renameProvider, textDocumentSync
+- **powershell**: codeActionProvider, codeLensProvider, completionProvider, definitionProvider, documentFormattingProvider, documentHighlightProvider, documentRangeFormattingProvider, documentSymbolProvider, experimental, foldingRangeProvider, hoverProvider, referencesProvider, renameProvider, semanticTokensProvider, signatureHelpProvider, textDocumentSync, workspace, workspaceSymbolProvider
+- **prisma**: codeActionProvider, completionProvider, definitionProvider, documentFormattingProvider, documentSymbolProvider, hoverProvider, referencesProvider, renameProvider, textDocumentSync
 - **python**: callHierarchyProvider, codeActionProvider, completionProvider, declarationProvider, definitionProvider, documentHighlightProvider, documentSymbolProvider, executeCommandProvider, hoverProvider, referencesProvider, renameProvider, signatureHelpProvider, textDocumentSync, typeDefinitionProvider, workspace, workspaceSymbolProvider
 - **python-jedi**: codeActionProvider, completionProvider, declarationProvider, definitionProvider, documentHighlightProvider, documentSymbolProvider, executeCommandProvider, hoverProvider, positionEncoding, referencesProvider, renameProvider, signatureHelpProvider, textDocumentSync, typeDefinitionProvider, workspace, workspaceSymbolProvider
 - **ruby**: codeActionProvider, codeLensProvider, completionProvider, definitionProvider, diagnosticProvider, documentHighlightProvider, documentLinkProvider, documentOnTypeFormattingProvider, documentRangeFormattingProvider, documentSymbolProvider, experimental, foldingRangeProvider, hoverProvider, inlayHintProvider, positionEncoding, referencesProvider, renameProvider, selectionRangeProvider, semanticTokensProvider, signatureHelpProvider, textDocumentSync, typeHierarchyProvider, workspaceSymbolProvider
 - **rust**: callHierarchyProvider, codeActionProvider, codeLensProvider, completionProvider, declarationProvider, definitionProvider, diagnosticProvider, documentFormattingProvider, documentHighlightProvider, documentOnTypeFormattingProvider, documentRangeFormattingProvider, documentSymbolProvider, experimental, foldingRangeProvider, hoverProvider, implementationProvider, inlayHintProvider, positionEncoding, referencesProvider, renameProvider, selectionRangeProvider, semanticTokensProvider, signatureHelpProvider, textDocumentSync, typeDefinitionProvider, workspace, workspaceSymbolProvider
 - **svelte**: callHierarchyProvider, codeActionProvider, codeLensProvider, colorProvider, completionProvider, definitionProvider, diagnosticProvider, documentFormattingProvider, documentHighlightProvider, documentSymbolProvider, foldingRangeProvider, hoverProvider, implementationProvider, inlayHintProvider, linkedEditingRangeProvider, referencesProvider, renameProvider, selectionRangeProvider, semanticTokensProvider, signatureHelpProvider, textDocumentSync, typeDefinitionProvider, workspaceSymbolProvider
 - **terraform**: codeActionProvider, codeLensProvider, completionProvider, declarationProvider, definitionProvider, documentFormattingProvider, documentLinkProvider, documentSymbolProvider, executeCommandProvider, experimental, hoverProvider, referencesProvider, semanticTokensProvider, signatureHelpProvider, textDocumentSync, workspace, workspaceSymbolProvider
+- **tinymist**: codeActionProvider, codeLensProvider, colorProvider, completionProvider, definitionProvider, documentFormattingProvider, documentHighlightProvider, documentLinkProvider, documentRangeFormattingProvider, documentSymbolProvider, executeCommandProvider, experimental, foldingRangeProvider, hoverProvider, inlayHintProvider, positionEncoding, referencesProvider, renameProvider, selectionRangeProvider, semanticTokensProvider, signatureHelpProvider, textDocumentSync, workspace, workspaceSymbolProvider
 - **toml**: completionProvider, documentFormattingProvider, documentLinkProvider, documentSymbolProvider, foldingRangeProvider, hoverProvider, renameProvider, semanticTokensProvider, textDocumentSync, workspace
 - **typescript**: codeActionProvider, codeLensProvider, completionProvider, definitionProvider, documentFormattingProvider, documentHighlightProvider, documentRangeFormattingProvider, documentSymbolProvider, executeCommandProvider, foldingRangeProvider, hoverProvider, implementationProvider, inlayHintProvider, linkedEditingRangeProvider, referencesProvider, renameProvider, selectionRangeProvider, semanticTokensProvider, signatureHelpProvider, textDocumentSync, typeDefinitionProvider, workspace, workspaceSymbolProvider
 - **typos**: codeActionProvider, executeCommandProvider, positionEncoding, textDocumentSync, workspace
@@ -91,15 +101,19 @@ surface, including providers pi-lens does not yet consume.
 
 - **ast-grep** (1): ast-grep.applyAllFixes
 - **clojure** (62): add-import-to-namespace, add-missing-import, add-missing-libspec, add-require-suggestion, as-to-refer, backward, backward-barf, backward-select, backward-slurp, change-coll, clean-ns, cond->if-refactor, create-function, create-test, cursor-info, cycle-coll, cycle-keyword-auto-resolve, cycle-privacy, demote-fn, destructure-keys, drag-backward, drag-forward, drag-param-backward, drag-param-forward, expand-let, extract-function, extract-to-def, forward, forward-barf, forward-select, forward-slurp, get-in-all, get-in-less, get-in-more, get-in-none, if->cond-refactor, inline-function, inline-symbol, introduce-let, kill-sexp, …
+- **cpp** (3): clangd.applyFix, clangd.applyRename, clangd.applyTweak
 - **cue** (1): cuelsp.externalvalidate
-- **dart** (18): dart.edit.codeAction.apply, dart.edit.sortMembers, dart.edit.organizeImports, dart.edit.fixAll, dart.edit.fixAllInWorkspace.preview, dart.edit.fixAllInWorkspace, dart.edit.sendWorkspaceEdit, refactor.perform, refactor.validate, dart.logAction, dart.refactor.add_constructor_name, dart.refactor_add.import_prefix, dart.refactor.convert_all_formal_parameters_to_named, dart.refactor.convert_selected_formal_parameters_to_named, dart.refactor.move_selected_formal_parameters_left, dart.refactor.move_top_level_to_file, dart.refactor.remove_constructor_name, dart.refactor.remove_import_prefix
+- **dart** (18): dart.edit.codeAction.apply, dart.edit.fixAll, dart.edit.fixAllInWorkspace, dart.edit.fixAllInWorkspace.preview, dart.edit.organizeImports, dart.edit.sendWorkspaceEdit, dart.edit.sortMembers, dart.logAction, dart.refactor.add_constructor_name, dart.refactor.convert_all_formal_parameters_to_named, dart.refactor.convert_selected_formal_parameters_to_named, dart.refactor.move_selected_formal_parameters_left, dart.refactor.move_top_level_to_file, dart.refactor.remove_constructor_name, dart.refactor.remove_import_prefix, dart.refactor_add.import_prefix, refactor.perform, refactor.validate
 - **deno** (2): deno.cache, deno.reloadImportRegistries
+- **emmylua** (4): fake.applyEdit, fake.applyEditDeferred, fake.doThing, fake.releaseDeferredApplyEdit
 - **expert** (2): Reindex, connectionDetails
+- **fish** (22): fish-lsp.checkHealth, fish-lsp.createTheme, fish-lsp.execute, fish-lsp.executeBuffer, fish-lsp.executeLine, fish-lsp.executeRange, fish-lsp.fixAll, fish-lsp.generateEnvVariables, fish-lsp.showEnvVariables, fish-lsp.showInfo, fish-lsp.showReferences, fish-lsp.showStatusDocs, fish-lsp.showWorkspaceMessage, fish-lsp.toggleSingleWorkspaceSupport, fish-lsp.updateWorkspace, quickfix.delete, quickfix.disable, quickfix.fix, quickfix.fixAll, refactor.extract, refactor.rewrite, source.rename
 - **go** (47): gopls.add_dependency, gopls.add_import, gopls.add_telemetry_counters, gopls.add_test, gopls.apply_fix, gopls.assembly, gopls.change_signature, gopls.check_upgrades, gopls.client_open_url, gopls.diagnose_files, gopls.doc, gopls.edit_go_directive, gopls.extract_to_new_file, gopls.fetch_vulncheck_result, gopls.free_symbols, gopls.gc_details, gopls.generate, gopls.go_get_package, gopls.implement_interface, gopls.list_imports, gopls.list_known_packages, gopls.lsp, gopls.maybe_prompt_for_telemetry, gopls.mem_stats, gopls.modify_tags, gopls.modules, gopls.move_type, gopls.package_symbols, gopls.packages, gopls.regenerate_cgo, gopls.remove_dependency, gopls.reset_go_mod_diagnostics, gopls.run_go_work_command, gopls.run_govulncheck, gopls.run_tests, gopls.scan_imports, gopls.split_package, gopls.start_debugging, gopls.start_profile, gopls.stop_profile, …
-- **lua** (6): lua.removeSpace, lua.solve, lua.jsonToLua, lua.setConfig, lua.getConfig, lua.autoRequire
-- **opengrep** (2): semgrep/ignore, semgrep/autofix
+- **lua** (6): lua.autoRequire, lua.getConfig, lua.jsonToLua, lua.removeSpace, lua.setConfig, lua.solve
+- **opengrep** (2): semgrep/autofix, semgrep/ignore
 - **terraform** (7): terraform-ls.module.callers, terraform-ls.module.calls, terraform-ls.module.providers, terraform-ls.module.terraform, terraform-ls.rootmodules, terraform-ls.terraform.init, terraform-ls.terraform.validate
-- **typescript** (8): _typescript.applyRefactoring, _typescript.configurePlugin, _typescript.organizeImports, _typescript.applyRenameFile, _typescript.goToSourceDefinition, _typescript.applyCodeActionCommand, _typescript.applyFixAllCodeAction, typescript.tsserverRequest
+- **tinymist** (29): tinymist.doClearCache, tinymist.doGetTemplateEntry, tinymist.doInitTemplate, tinymist.doKillPreview, tinymist.doStartBrowsingPreview, tinymist.doStartPreview, tinymist.exportAnsiHighlight, tinymist.exportAst, tinymist.exportBundle, tinymist.exportHtml, tinymist.exportMarkdown, tinymist.exportPdf, tinymist.exportPng, tinymist.exportQuery, tinymist.exportSvg, tinymist.exportTeX, tinymist.exportText, tinymist.focusMain, tinymist.getDocumentMetrics, tinymist.getDocumentTrace, tinymist.getResources, tinymist.getServerInfo, tinymist.getWorkspaceLabels, tinymist.interactCodeContext, tinymist.pinMain, tinymist.scrollPreview, tinymist.startDefaultPreview, tinymist.startServerProfiling, tinymist.stopServerProfiling
+- **typescript** (8): _typescript.applyCodeActionCommand, _typescript.applyFixAllCodeAction, _typescript.applyRefactoring, _typescript.applyRenameFile, _typescript.configurePlugin, _typescript.goToSourceDefinition, _typescript.organizeImports, typescript.tsserverRequest
 - **typos** (1): ignore-in-project
 - **yaml** (1): jumpToSchema
 
@@ -108,11 +122,7 @@ surface, including providers pi-lens does not yet consume.
 Toolchain/binary not installed here, so capabilities weren't captured
 (many are the toolchain-gated family tracked in #241):
 
-- @prisma/language-server
-- PowerShell Editor Services (pwsh Start-EditorServices.ps1 -Stdio)
-- clangd
 - cmake-language-server
-- fish-lsp
 - haskell-language-server
 - jdtls
 - jdtls + lombok javaagent

package/docs/settings.md

@@ -29,7 +29,8 @@ contract.
    CI-scoped switches and for the handful of tuning knobs that have no config key.
 2. **CLI flags** (`--no-lsp`, `--immediate-format`, …) — per-session, passed on
    the pi command line.
-3. **Config JSON** — a per-user global file (`~/.pi-lens/config.json`) and an
+3. **Config JSON** — a per-user global file selected by the
+   [global-location table](configuration.md#global-config-location) and an
    optional per-project file (`.pi-lens.json` at the repo root).
 
 Every runtime toggle is settable **both** from the CLI and from `config.json`;
@@ -108,6 +109,9 @@ tool. The loader `pi_lens_activate_tools` and MCP lifecycle tools
 required by their host protocols and cannot be disabled. Unknown or
 non-disableable names emit `PILENS_CFG_0009`.
 
+When a lower-precedence supported global config file is shadowed by the
+winning file, pi-lens records the notice once with `PILENS_CFG_0010`.
+
 Valid names for `tools.<name>.enabled` include `ast_grep_search`,
 `ast_grep_replace`, `ast_grep_outline`, `lsp_navigation`,
 `lens_diagnostics`, `lens_diagnostic_mark`, `symbol_search`,
@@ -149,9 +153,10 @@ field docs.
 
 ## Global vs project config
 
-### Global — `~/.pi-lens/config.json`
+### Global — winning location
 
-User-level. Applies to **every** project. Honors **all** flag keys from the
+User-level. The file is selected by the [global-location table](configuration.md#global-config-location)
+and applies to **every** project. It honors **all** flag keys from the
 table above plus the non-flag global knobs (`ignore`, `widget.visible`,
 `dispatch.runnerTimeoutFloorMs`, `format.mode`,
 `actionableWarnings.autoFix.maxFixes`). On Windows the path is
@@ -238,6 +243,10 @@ manager, or CI config. The handful you are most likely to reach for:
   review graph) out of the workspace.
 - `PI_LENS_HOME` — relocate the machine-global root (logs, tool binaries, install
   caches, instance registry).
+- `PI_LENS_CONFIG_PATH` — point the global config file at an explicit path.
+- `PI_CODING_AGENT_DIR` — when pi sets it, `$PI_CODING_AGENT_DIR/extensions/
+  pi-lens.json` is read when it exists and the default global config file does
+  not; pi-lens does not write the file.
 - `PI_LENS_MAX_PROJECT_FILES` — base project-size scale knob (default `2000`).
 - `PI_LENS_STARTUP_MODE` — force the startup path: `full`, `minimal`, or `quick`.
 

package/docs/subagent-compat.md

@@ -17,7 +17,7 @@ every run.
 
 | # | Contract | Depended on by | Third-party file (as of the versions below) | Verified against |
 |---|----------|-----------------|-------------------------------------------------|-------------------|
-| 1 | `PI_SUBAGENT_CHILD` is set to the literal string `"1"` on every process that hosts a child session. | `clients/subagent-mode.ts` (`isSubagentSession()`, `getSubagentIdentity()`) | `pi-subagents@0.34.0` — co-located in `src/runs/shared/pi-args.ts` (`SUBAGENT_CHILD_ENV` const + the `env[SUBAGENT_CHILD_ENV] = "1"` assignment); as of `pi-subagents@0.66.0` the const moved to `src/runs/shared/child-runtime-config.ts` and the assignment to `src/runs/background/subagent-runner.ts` (#2581) — `compat-contract-locator.mjs`'s `locateContractSources` tries both layouts and concatenates whichever resolves. | `checkNicobailonChildEnv` |
+| 1 | `PI_SUBAGENT_CHILD` is set to the literal string `"1"` on every process that hosts a child session. | `clients/subagent-mode.ts` (`isSubagentSession()`, `getSubagentIdentity()`) | `pi-subagents@0.34.0` — co-located in `src/runs/shared/pi-args.ts` (`SUBAGENT_CHILD_ENV` const + the `env[SUBAGENT_CHILD_ENV] = "1"` assignment); as of `pi-subagents@0.66.0` the const moved to `src/runs/shared/child-runtime-config.ts` and the assignment to `src/runs/background/subagent-runner.ts` (#2581); as of `0.70.0`, the published files are `src/runs/shared/child-runtime-config.js` and `src/runs/background/subagent-runner.js` — `compat-contract-locator.mjs`'s `locateContractSources` tries all layouts and concatenates whichever resolves. | `checkNicobailonChildEnv` |
 | 1b | avtc-pi-subagent sets `PI_SUBAGENT_CHILD_AGENT` + `PI_SUBAGENT_PARENT_PID` (never `PI_SUBAGENT_CHILD`) on the per-spawn subagent env; `isSubagentSession()` treats the PAIR (both non-empty) as an additional subagent signal (#507). | `clients/subagent-mode.ts` (`isSubagentSession()`, `getSubagentIdentity()`) | `avtc-pi-subagent@1.0.3` — `src/process-runner.ts` (`subagentEnv.PI_SUBAGENT_CHILD_AGENT = agent.name` + `subagentEnv.PI_SUBAGENT_PARENT_PID = String(process.pid)`) | `checkAvtcChildEnv` |
 | 2a | The pi SDK's extension loader keeps a **process-global** cache (`extensionCache = new Map()`). This is what makes an in-process `bindExtensions()` reuse pi-lens's own module-scope singletons instead of a fresh isolated instance. | `clients/session-lifecycle.ts` (the whole premise of the concurrent-session guard) | `@earendil-works/pi-coding-agent@0.80.6` — `dist/core/extensions/loader.js` | `checkSdkExtensionCache` |
 | 2b | `AgentSession.bindExtensions()` **unconditionally** emits a `session_start`-typed event (`this._extensionRunner.emit(this._sessionStartEvent)`). | Same as 2a — this is why an in-process subagent bind re-triggers pi-lens's `session_start` handler at all. | `@earendil-works/pi-coding-agent@0.80.6` — `dist/core/agent-session.js` (`bindExtensions()`, ~line 1717) | `checkSdkBindExtensionsEmitsSessionStart` |

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "pi-lens",
-	"version": "4.2.0",
+	"version": "4.3.0",
 	"type": "module",
 	"description": "Real-time code feedback for pi — LSP, linters, formatters, type-checking, structural analysis & booboo",
 	"repository": {
@@ -20,9 +20,10 @@
 		"prepare": "npm run build:dist && node scripts/download-grammars.js --core --dest grammars && node scripts/setup-git-hooks.mjs && node scripts/warm-loader-cache.mjs",
 		"prepack": "node scripts/strip-dev-deps-for-pack.mjs --strip",
 		"postpack": "node scripts/strip-dev-deps-for-pack.mjs --restore",
-		"lint": "tsc --project tsconfig.json && npm run lint:js",
+		"lint": "tsc --project tsconfig.json && npm run lint:js && npm run lint:js:tests",
 		"lint:js": "oxlint --deny-warnings --import-plugin --promise-plugin -D block-scoped-var -D import/default -D import/namespace -D import/no-absolute-path -D import/no-empty-named-blocks -D import/no-named-as-default -D import/no-self-import -D no-extend-native -D no-extra-bind -D no-implied-eval -D no-new -D no-unexpected-multiline -D no-useless-constructor -D oxc/approx-constant -D oxc/misrefactored-assign-op -D oxc/no-accumulating-spread -D oxc/no-async-endpoint-handlers -D oxc/no-this-in-exported-function -D promise/no-callback-in-promise -D promise/no-multiple-resolved -D promise/no-new-statics -D promise/valid-params -D typescript/no-confusing-non-null-assertion -D typescript/no-extraneous-class -D typescript/no-unnecessary-type-constraint -D typescript/no-unsafe-enum-comparison -D unicorn/no-accessor-recursion -D unicorn/no-array-fill-with-reference-type -D unicorn/no-confusing-array-with -D unicorn/no-instanceof-builtins -D unicorn/prefer-array-flat-map -D unicorn/require-module-specifiers --ignore-pattern \"tests/**/*.ts\" --ignore-pattern \"tests/**/*.tsx\" --ignore-pattern \"**/*.d.mts\" --ignore-pattern \"tests/fixtures/autofix-smoke/**\" --ignore-pattern \"tests/fixtures/format-smoke/**\" --ignore-pattern \"tests/fixtures/tool-smoke/**\" --ignore-pattern \"tests/fixtures/call-graph/javascript/**\" --ignore-pattern \"tests/fixtures/function-facts/javascript-parameter.js\" .",
-		"lint:js:advisory": "node scripts/lint-js-advisory.mjs --deny-warnings --format default -D correctness -D suspicious -D perf --import-plugin --promise-plugin --type-aware -A no-underscore-dangle -A no-await-in-loop -A unicorn/no-array-sort -A unicorn/consistent-function-scoping -A promise/no-promise-in-callback -A no-useless-call -A import/no-unassigned-import -A no-unmodified-loop-condition --ignore-pattern \"**/*.d.mts\" --ignore-pattern \"tests/fixtures/autofix-smoke/**\" --ignore-pattern \"tests/fixtures/format-smoke/**\" --ignore-pattern \"tests/fixtures/tool-smoke/**\" --ignore-pattern \"tests/fixtures/call-graph/javascript/**\" --ignore-pattern \"tests/fixtures/function-facts/javascript-parameter.js\" .",
+		"lint:js:advisory": "node scripts/lint-js-advisory.mjs --deny-warnings --format unix -D correctness -D suspicious -D perf --import-plugin --promise-plugin --type-aware -A no-underscore-dangle -A no-await-in-loop -A unicorn/no-array-sort -A unicorn/consistent-function-scoping -A promise/no-promise-in-callback -A no-useless-call -A import/no-unassigned-import -A no-unmodified-loop-condition --ignore-pattern \"**/*.d.mts\" --ignore-pattern \"tests/fixtures/autofix-smoke/**\" --ignore-pattern \"tests/fixtures/format-smoke/**\" --ignore-pattern \"tests/fixtures/tool-smoke/**\" --ignore-pattern \"tests/fixtures/call-graph/javascript/**\" --ignore-pattern \"tests/fixtures/function-facts/javascript-parameter.js\" .",
+		"lint:js:tests": "node scripts/lint-js-advisory.mjs --deny-warnings --format unix --type-aware -A correctness -A suspicious -A perf --ignore-pattern \"tests/fixtures/**\" tests",
 		"depcruise:check": "depcruise --validate --config .dependency-cruiser.cjs --ignore-known .dependency-cruiser-known-violations.json --output-type err index.ts \"clients/**/*.ts\"",
 		"fmt": "oxfmt",
 		"fmt:check": "oxfmt --check",
@@ -103,6 +104,7 @@
 		"scripts/install-selftest.mjs",
 		"scripts/lib/host-provided-deps.mjs",
 		"scripts/lib/skills-predicate.mjs",
+		"scripts/lib/web-tree-sitter-dir.mjs",
 		"scripts/lib/warm-loader-cache.mjs",
 		"scripts/warm-loader-cache.mjs",
 		"scripts/rpc-load-check.mjs",

package/rules/ast-grep-rules/rule-tests/no-assert-tuple-test.yml

@@ -4,9 +4,22 @@ valid:
   - 'assert x == 1'
   - 'assert x, "message"'
   - 'assert (x == 1), "message"'  # explicit grouping, not a tuple
+  - 'assert actual == (1, 2)'
+  - 'assert (actual == (1, 2))'
+  - 'assert (f((1, 2)))'
+  - 'assert (left, right) == expected'
+  - 'assert value in {(1, 2), (3, 4)}'
+  - 'assert {item for item in values if item != (1, 2)}'
+  - 'assert all(item in {(1, 2)} for item in values)'
+  - 'assert True, ("tuple", "message")'
+  - 'assert actual == (1, 2), ("tuple", "message")'
 invalid:
+  - 'assert ()'
   - 'assert (1, 2)'
   - 'assert (x, y)'
+  - 'assert ((x, y))'
+  - 'assert (((x, y)))'
+  - 'assert (x, y), ("tuple", "message")'
   - 'assert (1, 2, 3), "message"'
   - |
     def f():

package/rules/ast-grep-rules/rule-tests/no-boolean-in-except-test.yml

@@ -15,6 +15,21 @@ valid:
         x()
     except:
         pass
+  - |
+    # #3211: body-only `or` must not be flagged — the handler condition
+    # itself is a plain exception type, only the return value uses `or`.
+    try:
+        x()
+    except Exception:
+        return 2 or 3
+  - |
+    # #3211: same shape one level deeper (an `if` inside the handler
+    # body) — still not a boolean-in-except-clause target.
+    try:
+        x()
+    except Exception:
+        if cond:
+            x = a or b
 invalid:
   - |
     try:
@@ -26,3 +41,14 @@ invalid:
         x()
     except ValueError and KeyError:
         pass
+  - |
+    # #3211: a nested try whose OWN except clause has the boolean
+    # condition must still be flagged, even though it sits inside an
+    # outer handler whose body also contains an `or`.
+    try:
+        outer()
+    except Exception:
+        try:
+            inner()
+        except (A or B):
+            return 3 or 4

package/rules/ast-grep-rules/rule-tests/no-http-headers-bracket-access-test.yml

@@ -2,6 +2,16 @@ id: no-http-headers-bracket-access
 valid:
   - "auth = request.headers.get('Authorization')"
   - "auth = request.headers.get('Authorization', '')"
+  - |
+    # #3211: a plain assignment through the bracket sets the header —
+    # it cannot raise KeyError, so it is not a read-site false positive.
+    resp.headers["X"] = "v"
+  - |
+    # #3211: augmented assignment is still a write, not a read.
+    resp.headers["X"] += "b"
+  - |
+    # #3211: `del` removes the key; it never raises KeyError either.
+    del resp.headers["Y"]
 invalid:
   - 'auth = request.headers["Authorization"]'
   - 'auth = response.headers["X-Request-Id"]'

package/rules/ast-grep-rules/rule-tests/unchecked-numeric-parse-python-test.yml

@@ -0,0 +1,18 @@
+id: unchecked-numeric-parse-python
+valid:
+  - |
+    # #3211: already-converted-by-construction — Decimal raises
+    # decimal.InvalidOperation, not ValueError, and is excluded here.
+    x = float(Decimal("1.5"))
+  - |
+    # #3211: a numeric literal argument can never raise ValueError.
+    x = int(3.7)
+  - |
+    try:
+        g = int(s)
+    except ValueError:
+        pass
+invalid:
+  - 'int("42")'
+  - 'float("3.14")'
+  - 'int(user_input)'

package/rules/ast-grep-rules/rule-tests/unchecked-throwing-call-python-test.yml

@@ -12,12 +12,13 @@ valid:
     except OSError:
         return None
   - 'CONSTANT = 42'
+  - |
+    # #3211: int()/float() moved to unchecked-numeric-parse-python — this
+    # rule no longer fires on the numeric-parse shape.
+    x = int(s)
 invalid:
   - 'data = json.loads(raw)'
   - 'f = open(path)'
   - 'os.remove(path)'
   - 'os.stat(path)'
   - 'shutil.rmtree(path)'
-  - 'int("42")'
-  - 'float("3.14")'
-  - 'int(user_input)'

package/rules/ast-grep-rules/rules/go-no-fmt-println.yml

@@ -26,8 +26,8 @@ constraints:
 ignores:
   - "**/*_test.go"
   - "**/examples/**"
-  - "tests/fixtures/**"
-  - "cases/**"
+  - "**/tests/fixtures/**"
+  - "**/cases/**"
 tags:
   - go
   - idiom

package/rules/ast-grep-rules/rules/no-assert-tuple.yml

@@ -1,24 +1,34 @@
 id: no-assert-tuple
 language: Python
 message: "Assert should not be called on a tuple literal"
-severity: error
+severity: warning
 note: |
   Port of SonarCloud python:S5905.
 
   `assert (a, b)` is always truthy because the tuple `(a, b)` is a
-  non-empty object. This is almost always a bug — the developer
-  probably meant `assert a, b` (two separate arguments) or
-  `assert (a == b)`.
+  non-empty object. The developer probably meant `assert a, b` (an
+  assertion with a message) or `assert (a == b)`.
 
-  The rule matches `assert` followed by a tuple literal. In Python
-  AST, `assert (1, 2)` parses as `assert_statement` whose test
-  is a `tuple` node (not parenthesized — the parens are just
-  grouping).
+  Bind the assertion's condition separately from its optional message,
+  then require that condition to be a tuple or a parentheses-only chain
+  ending in a tuple. Comparisons, calls, comprehensions, containers, and
+  tuple-valued assertion messages remain valid. The rule remains a
+  warning pending the multi-corpus false-positive audit required for
+  error severity.
 metadata:
   sonar: S5905
 rule:
-  all:
-    - kind: assert_statement
-    - has:
-        kind: tuple
-        stopBy: end
+  pattern: assert $COND
+constraints:
+  COND:
+    any:
+      - kind: tuple
+      - all:
+          - kind: parenthesized_expression
+          - has:
+              kind: tuple
+              stopBy:
+                not:
+                  any:
+                    - kind: parenthesized_expression
+                    - kind: tuple

package/rules/ast-grep-rules/rules/no-boolean-in-except.yml

@@ -11,8 +11,12 @@ note: |
   developer meant `except (ValueError, KeyError):` (a tuple of
   exception types).
 
-  Matches an `except_clause` whose direct children contain a
-  `boolean_operator` (and/or) node.
+  Matches an `except_clause` whose search for a `boolean_operator`
+  (and/or) descendant stops at the handler's own `block` — the
+  clause's condition, not anything inside the handler's body (a
+  `return x or y` or an `x = a or b` in the body is not a false
+  target; a nested `try`'s own `except` clause is checked on its
+  own merits when the walk reaches it).
 metadata:
   sonar: S5714
 rule:
@@ -20,4 +24,4 @@ rule:
     - kind: except_clause
     - has:
         kind: boolean_operator
-        stopBy: end
+        stopBy: { kind: block }

package/rules/ast-grep-rules/rules/no-console-except-error-js.yml

@@ -11,8 +11,8 @@ note: |
   just trains users to ignore the rule; `ignores` below carves those paths
   out while application/library code elsewhere still gets flagged (#965).
 ignores:
-  - "scripts/**"
-  - "bin/**"
+  - "**/scripts/**"
+  - "**/bin/**"
   - "**/logger.ts"
   - "**/logger.js"
   - "**/logger.mjs"

package/rules/ast-grep-rules/rules/no-console-except-error.yml

@@ -11,8 +11,8 @@ note: |
   just trains users to ignore the rule; `ignores` below carves those paths
   out while application/library code elsewhere still gets flagged (#965).
 ignores:
-  - "scripts/**"
-  - "bin/**"
+  - "**/scripts/**"
+  - "**/bin/**"
   - "**/logger.ts"
   - "**/logger.js"
   - "**/logger.mjs"

package/rules/ast-grep-rules/rules/no-http-headers-bracket-access.yml

@@ -9,14 +9,19 @@ note: |
   missing. Use `request.headers.get("X-Foo")` (returns None) or
   `request.headers["X-Foo"]` after a guard check.
 
-  Matches bracket-style subscript on a `headers` attribute. The
-  call shape `request.headers[...]` and `response.headers[...]`
-  are the most common cases.
+  Matches bracket-style subscript READS on a `headers` attribute
+  (`$REQ.headers[$KEY]` already subsumes the `request.`/`response.`-
+  named forms). A write through the same bracket syntax —
+  `resp.headers["X"] = v`, `resp.headers["X"] += v`, or
+  `del resp.headers["X"]` — sets or removes the header and can never
+  raise KeyError, so those are excluded.
 metadata:
   sonar: S8371
 rule:
-  any:
+  all:
     - pattern: "$REQ.headers[$KEY]"
-    - pattern: "$RES.headers[$KEY]"
-    - pattern: "request.headers[$KEY]"
-    - pattern: "response.headers[$KEY]"
+    - not:
+        any:
+          - inside: { kind: assignment, field: left }
+          - inside: { kind: augmented_assignment, field: left }
+          - inside: { kind: delete_statement }

package/rules/ast-grep-rules/rules/unchecked-numeric-parse-python.yml

@@ -0,0 +1,44 @@
+id: unchecked-numeric-parse-python
+language: Python
+severity: warning
+message: "int()/float() without try/except — raises ValueError on non-numeric input"
+note: |
+  Split out of `unchecked-throwing-call-python` (#3211): `int()`/`float()`
+  raise `ValueError` on non-numeric strings, but whether a given call CAN
+  raise depends on the argument's runtime type — often undecidable from
+  syntax alone — so this ships at `warning`, separate from the
+  syntactically-certain `error`-level calls (open/json/os/shutil).
+
+  Excluded as already-safe by construction: a numeric literal argument
+  (`int(3.7)`), and an argument that is itself a call to `int()`/
+  `float()`/`Decimal()` (already-converted, or a `Decimal` — which raises
+  `decimal.InvalidOperation`, not `ValueError`, and is out of scope here).
+
+  Residual, undecidable false positive: a call whose argument is a typed
+  parameter already known to be numeric, e.g.
+
+    def f(valor: Decimal):
+        return float(valor)  # valor is a Decimal, not a raw string
+
+  The rule cannot see the parameter's declared type from the call site.
+  Suppress that shape explicitly:
+
+    return float(valor)  # pi-lens-ignore: unchecked-numeric-parse-python
+rule:
+  any:
+    - pattern: int($EXPR)
+    - pattern: float($EXPR)
+  not:
+    any:
+      - inside:
+          stopBy: end
+          kind: try_statement
+      - has:
+          field: arguments
+          has:
+            any:
+              - kind: integer
+              - kind: float
+              - pattern: Decimal($$$)
+              - pattern: int($$$)
+              - pattern: float($$$)

package/rules/ast-grep-rules/rules/unchecked-throwing-call-python.yml

@@ -9,7 +9,11 @@ note: |
   json.loads(): raises json.JSONDecodeError on malformed JSON
   os.stat():    raises FileNotFoundError, PermissionError
   os.remove():  raises FileNotFoundError, PermissionError
-  int()/float():raises ValueError on non-numeric strings
+
+  `int()`/`float()` are a separate rule, `unchecked-numeric-parse-python`
+  (#3211): whether they can raise depends on the argument's runtime type,
+  which is often undecidable from syntax alone (a typed parameter, a prior
+  guard), so they ship at `warning` instead of `error` here.
 
   ✅ WRAP IN TRY/EXCEPT:
     try:
@@ -40,8 +44,6 @@ rule:
     - pattern: shutil.copy($$$)
     - pattern: shutil.move($$$)
     - pattern: shutil.rmtree($$$)
-    - pattern: int($EXPR)
-    - pattern: float($EXPR)
   not:
     inside:
       stopBy: end