pi-lens 4.2.0 → 4.3.0

package/dist/clients/dispatch/suppress-writer.js

@@ -7,6 +7,7 @@
  * vice versa.
  */
 import * as path from "node:path";
+import { parseInlineSuppressionRuleIds, splitInlineSuppressionPayload, } from "./inline-suppressions.js";
 const HASH_COMMENT_EXTENSIONS = new Set([
     ".py",
     ".rb",
@@ -50,14 +51,23 @@ export function insertSuppressComment(content, filePath, line, rule) {
     const suppressRe = /((?:\/\/|#)\s*pi-lens-ignore:\s*)(.+)$/;
     const match = existingAbove !== undefined ? suppressRe.exec(existingAbove) : null;
     if (match && existingAbove !== undefined) {
-        const rules = match[2]
+        const prefix = match[1];
+        const payload = match[2];
+        if (prefix === undefined || payload === undefined)
+            return content;
+        const { ruleList, trailingReason } = splitInlineSuppressionPayload(payload);
+        const rules = ruleList
             .split(",")
             .map((r) => r.trim())
             .filter(Boolean);
-        if (!rules.includes(rule))
+        const ruleIds = parseInlineSuppressionRuleIds(ruleList);
+        if (!ruleIds.includes(rule))
             rules.push(rule);
         lines[aboveIdx] =
-            existingAbove.slice(0, match.index) + match[1] + rules.join(", ");
+            existingAbove.slice(0, match.index) +
+                prefix +
+                rules.join(", ") +
+                trailingReason;
         return lines.join("\n");
     }
     // Match the indentation of the flagged line so the inserted comment lines

package/dist/clients/effective-config.js

@@ -229,7 +229,9 @@ export async function effectiveConfig(options = {}) {
     const resolveAt = (dir) => resolvePiLensConfig({
         cwd: dir,
         globalDir: getGlobalPiLensDir(),
-        globalConfigPath: getPiLensGlobalConfigPath(homeDir),
+        // Production resolution for the global tier — see loadLSPConfig's
+        // comment (global-config-location PR, refs #2457).
+        globalConfigPath: getPiLensGlobalConfigPath(),
         homeDir,
     });
     // The queried path resolves HERE, beside the resolution root it selects, so

package/dist/clients/extension-log.js

@@ -211,6 +211,48 @@ function inCaptureWindow(fn) {
 function isCaptureSeam(prop) {
     return (prop === "on" || (typeof prop === "string" && prop.startsWith("register")));
 }
+/**
+ * True for a host SCHEMA value that happens to be callable.
+ *
+ * A tool definition's `parameters` is DATA the host reads, not a pi-lens
+ * callback — but the schema builder pi-lens imports is host-provided
+ * (`clients/deps/typebox.ts`: the host resolves the bare `typebox`
+ * specifier), and on a host whose builders are ArkType-style the schema is a
+ * FUNCTION. `@oh-my-pi/pi-coding-agent` rewrites an extension's `typebox`
+ * import to its own `src/extensibility/legacy-typebox.ts`, which re-exports
+ * `@oh-my-pi/omptype`'s builders; those return a callable whose prototype
+ * carries `toJsonSchema`/`assert`. `inCaptureWindow` returns a plain rest
+ * wrapper with neither, so the host falls off its ark branch, the wire schema
+ * degrades to `undefined`, and every xd:// device renders `type Args =
+ * unknown` and rejects every call with `root: schema must be an object or
+ * boolean` (#3195).
+ *
+ * The predicate IS the host's own, copied from `@oh-my-pi/pi-ai@18.2.4`
+ * `src/utils/schema/wire.ts:21-27` (`isArkSchema`) — the same test the host's
+ * `applyToolProxy` (`@oh-my-pi/pi-coding-agent@18.2.4`
+ * `src/extensibility/tool-proxy.ts:26`) uses to leave a callable schema
+ * unbound for exactly this hazard ("`bind()` … drops the schema surface …
+ * so a bound schema later stringifies to `undefined`"). Matching it means
+ * pi-lens declines to wrap precisely the values the host reads as schemas,
+ * and still wraps everything else.
+ * `tests/clients/pi-host-callable-schema-contract.test.ts` asserts against
+ * that upstream predicate (and against a fixture measured from a real
+ * `@oh-my-pi/omptype@18.2.4` schema), not against this copy of it.
+ *
+ * Deliberately NOT an allow-list of handler keys (`execute`, `renderResult`,
+ * `handler` — the measured set today): that is `isCaptureSeam`'s #1434 S1a
+ * mistake one level down (defect shape 34, spelling enumerator). The host's
+ * own `ToolDefinition` already declares `onSession`, `renderCall` and
+ * `shellEnv`, and `registerCommand` takes `getArgumentCompletions`; the day
+ * pi-lens adopts one of those, an allow-list drops its console capture
+ * SILENTLY — the #1333 regression this seam exists to prevent — while this
+ * predicate keeps wrapping it.
+ */
+function isCallableSchema(value) {
+    return (typeof value === "function" &&
+        typeof value.toJsonSchema === "function" &&
+        typeof value.assert === "function");
+}
 /**
  * Wrap every function value found in `value`, in place. Handles the two
  * shapes a `register*`/`on` call takes today: a function passed directly
@@ -218,6 +260,11 @@ function isCaptureSeam(prop) {
  * function ONE level inside a plain options/definition object
  * (`options.handler`, `tool.execute`).
  *
+ * Only the property walk screens for a callable schema (#3195): every
+ * function pi-lens passes as a register argument DIRECTLY is a handler
+ * (`on`, `registerMessageRenderer`), measured across the whole activation,
+ * so a schema can only ever arrive as a property of a definition object.
+ *
  * Deliberately NOT recursive past that one level (#1434 perf review): a tool
  * definition's `parameters`/`schema` is a large, deeply nested TypeBox object
  * that holds no functions, but walking its full tree on every `registerTool`
@@ -249,7 +296,7 @@ function wrapFunctionsInPlace(value) {
     const obj = value;
     for (const key of Object.keys(obj)) {
         const propValue = obj[key];
-        if (typeof propValue === "function") {
+        if (typeof propValue === "function" && !isCallableSchema(propValue)) {
             assignWrapped(obj, key, propValue);
         }
     }

package/dist/clients/finding-delivery-gate.js

@@ -30,7 +30,11 @@
  *     deliver unchanged. A missed demotion is noise; a wrong drop can hide a
  *     live credential or CVE.
  * The turn-end secrets (gitleaks/trivy-secrets) and govulncheck advisory both
- * route through this gate in `clients/runtime-turn.ts`.
+ * route through this gate in `clients/runtime-turn.ts`, in ONE shared call
+ * (#3264) whose arms the secrets LANE (`clients/turn-end/lanes/secrets.ts`,
+ * #1892) renders. A lane declares its sources and never gates itself: the
+ * pass, its stat budget and its bounded records are per DELIVERY, not per
+ * lane.
  *
  * The SAME freshness family, one level up, covers cross-file drift: a cached
  * inline blocker is a verdict about its file *and everything that file
@@ -222,9 +226,25 @@ function labeled(file, description, reason, ageSource, evidence = [], extra = {}
 const RUNTIME_TURN_FILE = "clients/runtime-turn.ts";
 const LENS_DIAGNOSTICS_FILE = "tools/lens-diagnostics.ts";
 export const DELIVERY_SURFACES = {
-    "runtime-turn:secrets-gitleaks": gated(RUNTIME_TURN_FILE, "Turn-end 🔴 secrets blocker, gitleaks cache.", ["gateFindingsByPathFreshness"], ['store: "gitleaks"']),
-    "runtime-turn:secrets-trivy": gated(RUNTIME_TURN_FILE, "Turn-end 🔴 secrets blocker, trivy secrets cache.", ["gateFindingsByPathFreshness"], ['store: "trivy-secrets"']),
-    "runtime-turn:govulncheck-advisory": gated(RUNTIME_TURN_FILE, "Turn-end 🛡️ Go CVE advisory (call-site line only).", ["gateFindingsByPathFreshness"], ['store: "govulncheck"']),
+    // #1892 (lane extraction): both secrets tiers are rendered by the secrets
+    // LANE (`clients/turn-end/lanes/secrets.ts`), so `clients/runtime-turn.ts`
+    // no longer reads `.live`/`.stale` itself — the arm it can still be pinned
+    // to is the whole gated store object it hands the lane. That is WEAKER than
+    // the previous `gitleaksGate.live,` pin (it no longer says which partition
+    // feeds which tier) and the loss is deliberate: the live/stale split is a
+    // lane rule now, pinned behaviourally instead, by
+    // `tests/clients/runtime-turn-finding-freshness.test.ts` ("keeps an
+    // unmodified file's finding as a full-severity blocker" / "DEMOTES a
+    // finding whose file was edited after the scan — kept, no line") and the
+    // committed witness goldens under `tests/fixtures/witness/`. What the pin
+    // still proves is what this registry exists for: the rows the tier renders
+    // came out of a real `gateFindingsByPathFreshness` call and not out of a
+    // hand-built object (the R2 binding chain in
+    // `tests/clients/finding-delivery-gate.test.ts` walks
+    // `gitleaksGate` → `scannerGates` → the call).
+    "runtime-turn:secrets-gitleaks": gated(RUNTIME_TURN_FILE, "Turn-end 🔴 secrets blocker, gitleaks cache.", ["gateFindingsByPathFreshness"], ["gitleaksGate,"]),
+    "runtime-turn:secrets-trivy": gated(RUNTIME_TURN_FILE, "Turn-end 🔴 secrets blocker, trivy secrets cache.", ["gateFindingsByPathFreshness"], ["trivySecretsGate,"]),
+    "runtime-turn:govulncheck-advisory": gated(RUNTIME_TURN_FILE, "Turn-end 🛡️ Go CVE advisory (call-site line only).", ["gateFindingsByPathFreshness"], ["scannerGates.govulncheck"]),
     // Two tagged seams (the stale and live render branches below the same
     // `sweepInlineBlockerFreshness` call) legitimately share one evidence
     // occurrence — evidenceMin: 2 tells the exclusive-assignment check both
@@ -234,9 +254,11 @@ export const DELIVERY_SURFACES = {
     // third argument, so the literal is the call's opening rather than the
     // whole single-line invocation.
     ["sweepInlineBlockerFreshness(runtime, cwd, {"], { evidenceMin: 2 }),
-    // Same two gate calls as the live secrets tier — this tier renders their
-    // `.stale` arm, so it has no OWN gate call to point at.
-    "runtime-turn:stale-secrets-tier": gated(RUNTIME_TURN_FILE, "Turn-end 🔑 demoted-secrets tier (drifted since scan).", ["gateFindingsByPathFreshness"], ['store: "gitleaks"', 'store: "trivy-secrets"']),
+    // The same shared gate call and the same two stores as the live secrets
+    // tier — one lane renders both tiers, so this surface has no gate call and
+    // no arm read of its own; see the note above the live tier for what the pin
+    // does and does not prove.
+    "runtime-turn:stale-secrets-tier": gated(RUNTIME_TURN_FILE, "Turn-end 🔑 demoted-secrets tier (drifted since scan).", ["gateFindingsByPathFreshness"], ["gitleaksGate,", "trivySecretsGate,"]),
     // The evidence below is the literal header FRAGMENT including the
     // interpolation — proves the label is actually rendered, not merely
     // computed and discarded (review round F1's "deleted the age
@@ -280,24 +302,32 @@ export const DELIVERY_SURFACES = {
     // nowhere else in this file: a bare `applyFindingPolicy` would also be
     // satisfied by an import line or an unrelated caller.
     "runtime-turn:late-auxiliary-findings": gated(RUNTIME_TURN_FILE, "Turn-end late-auxiliary LSP findings (collect-later probe of aux " +
-        "client caches whose grace window expired).", ["gateFindingsByPathFreshness", "applyFindingPolicy"], ['store: "late-auxiliary-findings"', "applyFindingPolicy(gate.live, {"]),
-    "runtime-turn:late-runner-findings": gated(RUNTIME_TURN_FILE, "Turn-end CLI runner findings collected after the post-write path.", ["gateFindingsByPathFreshness"], ['store: "late-runner-findings"'], { evidenceMin: 2 }),
+        "client caches whose grace window expired).", 
+    // #3248: the open-coded `applyFindingPolicy(...)` here and the identical
+    // one the late-RUNNER lane needed are now one `applyPushedFindingPolicy`
+    // call, so the gate and the evidence name that call. Same stack, same
+    // identities — only the spelling moved.
+    ["gateFindingsByPathFreshness", "applyPushedFindingPolicy"], ['"late-auxiliary-findings": {', "applyPushedFindingPolicy(gate.live, {"]),
+    "runtime-turn:late-runner-findings": gated(RUNTIME_TURN_FILE, "Turn-end CLI runner findings collected after the post-write path.", 
+    // #3248: this lane was the last push surface with no disposition stage;
+    // it now routes through the same shared policy call as its
+    // late-auxiliary twin, which is what this gate pins.
+    ["gateFindingsByPathFreshness", "applyPushedFindingPolicy"], ['"late-runner-findings"'], { evidenceMin: 2 }),
     "runtime-turn:cascade-blocker": labeled(RUNTIME_TURN_FILE, "Turn-end 🧪 cascade neighbor blocker.", "Cascade results settle synchronously this turn where possible " +
         "(`settleCascadeRuns`), but an unsettled compute can carry over to a " +
-        "later turn (bounded by a carry cap) — this round does not freshness-" +
-        "gate that carry-over window.", "live", [], {
-        status: "partial",
-        partialReason: "A carried-over cascade result (run.carriedTurns > 0) is rendered " +
-            "without an age label. Follow-up: surface carriedTurns as an explicit " +
-            "label when > 0, or route through formatCacheAgeLabel using the run's " +
-            "own timestamp.",
-    }),
+        "later turn (bounded by a carry cap) — a carried-over result renders " +
+        "with an explicit `(carried N turns · scanned Xm ago)` label (#3167, " +
+        "#3168 F3), so the agent can tell it from a fresh observation.", "live", ["cascadeCarrySuffix("], { evidenceMin: 1 }),
     "runtime-turn:cascade-coverage-advisory": labeled(RUNTIME_TURN_FILE, "Turn-end cascade-coverage-gap advisories (graph/binding/budget).", "Explains what the cascade check could NOT confirm this turn — not a " +
         "finding with a cited path, an absence-of-coverage disclosure computed " +
-        "from this turn's own indeterminate-run list.", "live", [], {
-        status: "partial",
-        partialReason: "Same cascade carry-over caveat as runtime-turn:cascade-blocker.",
-    }),
+        "from this turn's own indeterminate-run list. An advisory computed from " +
+        "a carried indeterminate run is labeled `(carried N turns · <age>)` " +
+        "(#3167, #3168 F4 — dropped on mixed carried/fresh buckets). The age " +
+        "half reads `scan age unknown` on this surface today: no indeterminate-" +
+        "run producer stamps `observedAt` (only the resolved-found plumb does, " +
+        "`clients/cascade-format.ts`), and one unstamped carried run collapses " +
+        "the whole bucket's age rather than claiming the stamped runs' (#3168 " +
+        "F13). The carry COUNT is always real.", "live", ["withCarryLabel("], { evidenceMin: 3 }),
     // #3102: the cold-neighbour cascade run is BUILT here, in the quiet-window
     // reconcile (`onResolvedFound` in index.ts), a turn earlier than the
     // `runtime-turn:cascade-blocker` render that finally carries it — so it is
@@ -360,9 +390,9 @@ export const DELIVERY_SURFACES = {
     "lens-diagnostics:mode-delta": gated(LENS_DIAGNOSTICS_FILE, "`lens_diagnostics mode=delta` report (the tool's DEFAULT mode) — " +
         "re-serves the actionable-warnings/code-quality-warnings caches AND " +
         "the persisted project-diagnostics delta report.", ["gateFindingsByPathFreshness"], [
-        'store: "lens-diagnostics-delta"',
+        '"lens-diagnostics-delta": {',
         "applyDeltaFreshnessGate(",
-        'store: "lens-diagnostics-delta-project"',
+        '"lens-diagnostics-delta-project": {',
     ]),
     "widget-state:footer": gated("clients/widget-state.ts", "TUI footer blocking/error/warning tally.", ["reconcileStaleWidgetFiles", "isBlocking"], ["isBlocking(diagnostic)", "reconcileStaleWidgetFiles()"]),
     "agent-nudge:context-message": labeled("clients/agent-nudge.ts", "Post-edit file-touch nudge injected via `context`.", "Not a scanner finding store: no severity, no cited line, no cache — the " +

package/dist/clients/formatters.js

@@ -1823,7 +1823,10 @@ export function clearFormatterRuntimeState() {
     // is `session_start`'s block in runtime-session.ts.
 }
 const BOX_DRAWING_GLOBAL = /[\u2500-\u257F]/g;
-const HAS_BOX_DRAWING = /[\u2500-\u257F]/;
+/** Blank, or a rule made of box-drawing characters and spacing alone. */
+const DECORATION_RULE = /^[\u2500-\u257F\s]*$/;
+/** The renderer's section heading: one word, then box-drawing to end of line. */
+const DECORATION_HEADING = /^\S+[ \t]+[\u2500-\u257F][\u2500-\u257F\s]*$/;
 /**
  * First line of `text` that actually carries a diagnostic.
  *
@@ -1839,18 +1842,53 @@ const HAS_BOX_DRAWING = /[\u2500-\u257F]/;
 export function firstDiagnosticLine(text) {
     for (const raw of (text ?? "").split("\n")) {
         const line = stripAnsi(raw).trimEnd();
-        const stripped = line.replace(BOX_DRAWING_GLOBAL, "").trim();
-        if (!stripped)
+        if (isDecorativeLine(line))
             continue;
-        // "format ━━━━━━━━" is a section banner, not a diagnostic. Require a rule
-        // AND a short remainder so a real one-line error containing a box
-        // character is not discarded.
-        if (HAS_BOX_DRAWING.test(line) && stripped.length <= 24)
-            continue;
-        return stripped.slice(0, 300);
+        return line.replace(BOX_DRAWING_GLOBAL, "").trim().slice(0, 300);
     }
     return undefined;
 }
+/**
+ * The two decoration SHAPES a renderer emits, and nothing else: a rule made of
+ * box-drawing characters alone (blank lines included), and a `<word> ━━━━`
+ * section heading whose remainder after the word is box-drawing only.
+ *
+ * The single normalization both readers above and below share, so the bounded
+ * tail cannot surface what the first-line reader already rejects (#3312 review
+ * R3-4: the tail put biome's `format ━━━━` banner back in front of the strict
+ * #1337 seam). Matching SHAPES rather than "contains a box character and is
+ * short" is #3312 review R4-1: the length heuristic deleted
+ * `━ traceback source excerpt`, a diagnostic whose own text opens with a box
+ * character. A line carrying any non-decorative text is never decoration.
+ */
+function isDecorativeLine(line) {
+    return DECORATION_RULE.test(line) || DECORATION_HEADING.test(line);
+}
+const FORMATTER_ERROR_TAIL_LINES = 20;
+/**
+ * Preserve a bounded tail of a formatter's diagnostic output.
+ *
+ * A traceback's first line is not actionable on its own (#3312). Keep the
+ * final lines, which include the exception and its message, while bounding
+ * the model-facing error when a formatter emits an unexpectedly large log.
+ *
+ * Decorative lines are dropped FIRST, by the same predicate `firstDiagnosticLine`
+ * uses: a tail that kept them would hand the strict #1337 seam the banner this
+ * module already decided is not a diagnostic, and every banner line it kept
+ * would evict a real traceback line from the bound.
+ */
+export function diagnosticTail(text, maxLines = FORMATTER_ERROR_TAIL_LINES) {
+    const lines = [];
+    for (const raw of (text ?? "").split("\n")) {
+        const line = stripAnsi(raw).trimEnd();
+        if (isDecorativeLine(line))
+            continue;
+        lines.push(line.slice(0, 300));
+    }
+    if (lines.length === 0)
+        return undefined;
+    return lines.slice(-maxLines).join("\n");
+}
 /**
  * Resolve a formatter command without allowing the static command fallback to
  * bypass a resolver's style-preservation refusal (#1345). `null` means the
@@ -1963,11 +2001,11 @@ export async function formatFile(filePath, formatter) {
                 changed: false,
                 outcome: "failed",
                 error: result.error?.message ||
-                    firstDiagnosticLine(result.stderr) ||
+                    diagnosticTail(result.stderr) ||
                     // biome, ktlint and `mix format` report on STDOUT; without this
                     // their diagnostic is discarded and the user is told only that
                     // the tool "exited with status 1".
-                    firstDiagnosticLine(result.stdout) ||
+                    diagnosticTail(result.stdout) ||
                     `${formatter.name} exited with status ${result.status}`,
             };
         }