pi-lens 4.2.1 → 4.4.0

package/docs/usage.md

@@ -114,6 +114,7 @@ pi --lens-turn-summary   # Persist a per-turn summary of diagnostics, autofixes,
 pi --lens-compact-tool-line   # Render tool results as one compact, theme-aware line (closes #1327)
 pi --lens-compact-lsp-status  # Collapse the footer LSP status to one state glyph instead of the server names (refs #3099)
 pi --lens-hide-lsp-status     # Publish no pi-lens-lsp footer status at all, so a status-rendering host stops showing the key (closes #3099)
+pi --lens-compact-widget      # Render the widget as one summary line (languages + totals, LSP↑ chip while servers spawn) with no file rows or blocker details (refs #3959)
 pi --no-lazy-tools       # Keep every pi-lens tool active instead of activating the situational ones on demand
 pi --lens-turn-end-madge # Run the madge circular-dependency check at every turn end, not just at session start
 pi --no-knip             # Disable the knip session-start analyzer
@@ -199,4 +200,7 @@ turn-end is skipped, not faked: one line on stderr and nothing on stdout.
 - Check `~/.pi-lens/sessionstart.log`, `~/.pi-lens/latency.log`, and
   `~/.pi-lens/cascade.log` for lifecycle/performance/debug traces.
 - For live tool validation, use `node scripts/smoke-tools.mjs` with the relevant
-  `--lsp`, `--format`, or `--autofix` layer.
+  `--lsp`, `--format`, or `--autofix` layer. `--resolution` checks, without
+  installing or spawning anything, that the resolvers find project-local tools in
+  `.venv/bin`, `vendor/bin` and `node_modules/.bin` (it runs nightly in
+  tool-smoke).

package/grammars/tree-sitter-bash.wasm.json

@@ -1,5 +1,5 @@
 {
-  "npmPackage": "tree-sitter-wasms",
-  "version": "0.1.13",
-  "sha256": "sha256:807dcdb1380a59befb112ed8fbd3d3872c7fadaf5903a769282b50973b30696d"
+  "npmPackage": "tree-sitter-bash",
+  "version": "0.25.1",
+  "sha256": "sha256:8292919c88a0f7d3fb31d0cd0253ca5a9531bc1ede82b0537f2c63dd8abe6a7a"
 }

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "pi-lens",
-	"version": "4.2.1",
+	"version": "4.4.0",
 	"type": "module",
 	"description": "Real-time code feedback for pi — LSP, linters, formatters, type-checking, structural analysis & booboo",
 	"repository": {
@@ -17,12 +17,13 @@
 		"build": "tsc --project tsconfig.build.json",
 		"build:dist": "node -e \"require('fs').rmSync('dist',{recursive:true,force:true})\" && node scripts/build-dist-tsc.mjs tsconfig.dist.json && npm run bundle:dist",
 		"bundle:dist": "node scripts/bundle-dist.mjs",
-		"prepare": "npm run build:dist && node scripts/download-grammars.js --core --dest grammars && node scripts/setup-git-hooks.mjs && node scripts/warm-loader-cache.mjs",
+		"prepare": "npm run build:dist && node scripts/download-grammars.js --core --dest grammars && node scripts/setup-git-hooks.mjs && node scripts/stamp-package-lock.mjs && node scripts/warm-loader-cache.mjs",
 		"prepack": "node scripts/strip-dev-deps-for-pack.mjs --strip",
 		"postpack": "node scripts/strip-dev-deps-for-pack.mjs --restore",
-		"lint": "tsc --project tsconfig.json && npm run lint:js",
+		"lint": "tsc --project tsconfig.json && npm run lint:js && npm run lint:js:tests",
 		"lint:js": "oxlint --deny-warnings --import-plugin --promise-plugin -D block-scoped-var -D import/default -D import/namespace -D import/no-absolute-path -D import/no-empty-named-blocks -D import/no-named-as-default -D import/no-self-import -D no-extend-native -D no-extra-bind -D no-implied-eval -D no-new -D no-unexpected-multiline -D no-useless-constructor -D oxc/approx-constant -D oxc/misrefactored-assign-op -D oxc/no-accumulating-spread -D oxc/no-async-endpoint-handlers -D oxc/no-this-in-exported-function -D promise/no-callback-in-promise -D promise/no-multiple-resolved -D promise/no-new-statics -D promise/valid-params -D typescript/no-confusing-non-null-assertion -D typescript/no-extraneous-class -D typescript/no-unnecessary-type-constraint -D typescript/no-unsafe-enum-comparison -D unicorn/no-accessor-recursion -D unicorn/no-array-fill-with-reference-type -D unicorn/no-confusing-array-with -D unicorn/no-instanceof-builtins -D unicorn/prefer-array-flat-map -D unicorn/require-module-specifiers --ignore-pattern \"tests/**/*.ts\" --ignore-pattern \"tests/**/*.tsx\" --ignore-pattern \"**/*.d.mts\" --ignore-pattern \"tests/fixtures/autofix-smoke/**\" --ignore-pattern \"tests/fixtures/format-smoke/**\" --ignore-pattern \"tests/fixtures/tool-smoke/**\" --ignore-pattern \"tests/fixtures/call-graph/javascript/**\" --ignore-pattern \"tests/fixtures/function-facts/javascript-parameter.js\" .",
-		"lint:js:advisory": "node scripts/lint-js-advisory.mjs --deny-warnings --format default -D correctness -D suspicious -D perf --import-plugin --promise-plugin --type-aware -A no-underscore-dangle -A no-await-in-loop -A unicorn/no-array-sort -A unicorn/consistent-function-scoping -A promise/no-promise-in-callback -A no-useless-call -A import/no-unassigned-import -A no-unmodified-loop-condition --ignore-pattern \"**/*.d.mts\" --ignore-pattern \"tests/fixtures/autofix-smoke/**\" --ignore-pattern \"tests/fixtures/format-smoke/**\" --ignore-pattern \"tests/fixtures/tool-smoke/**\" --ignore-pattern \"tests/fixtures/call-graph/javascript/**\" --ignore-pattern \"tests/fixtures/function-facts/javascript-parameter.js\" .",
+		"lint:js:advisory": "node scripts/lint-js-advisory.mjs --deny-warnings --format unix -D correctness -D suspicious -D perf --import-plugin --promise-plugin --type-aware -A no-underscore-dangle -A no-await-in-loop -A unicorn/no-array-sort -A unicorn/consistent-function-scoping -A promise/no-promise-in-callback -A no-useless-call -A import/no-unassigned-import -A no-unmodified-loop-condition --ignore-pattern \"**/*.d.mts\" --ignore-pattern \"tests/fixtures/autofix-smoke/**\" --ignore-pattern \"tests/fixtures/format-smoke/**\" --ignore-pattern \"tests/fixtures/tool-smoke/**\" --ignore-pattern \"tests/fixtures/call-graph/javascript/**\" --ignore-pattern \"tests/fixtures/function-facts/javascript-parameter.js\" .",
+		"lint:js:tests": "node scripts/lint-js-advisory.mjs --deny-warnings --format unix --type-aware -A correctness -A suspicious -A perf --ignore-pattern \"tests/fixtures/**\" tests",
 		"depcruise:check": "depcruise --validate --config .dependency-cruiser.cjs --ignore-known .dependency-cruiser-known-violations.json --output-type err index.ts \"clients/**/*.ts\"",
 		"fmt": "oxfmt",
 		"fmt:check": "oxfmt --check",
@@ -39,6 +40,7 @@
 		"check": "node scripts/check-extensions.mjs",
 		"selftest:install": "node scripts/install-selftest.mjs",
 		"check:lockfile": "node scripts/check-lockfile-sync.mjs",
+		"check:allow-scripts": "node scripts/check-allow-scripts.mjs",
 		"preflight": "node scripts/pr-preflight.mjs",
 		"knip": "node scripts/run-knip.mjs",
 		"check:grammars": "node scripts/check-grammar-provenance.mjs",
@@ -47,6 +49,7 @@
 		"audit:rule-catalog": "node scripts/validate-rule-catalog.mjs",
 		"audit:astgrep-rule-pairs": "node scripts/audit-astgrep-rule-pairs.mjs",
 		"astgrep:self-scan": "node scripts/run-astgrep-pi-lens.mjs",
+		"lane:check": "node scripts/lane-check.mjs",
 		"astgrep:self-scan:update-baseline": "node scripts/run-astgrep-pi-lens.mjs --update-baseline",
 		"audit:playground": "node scripts/playground-verify-rule.mjs",
 		"bench:cascade-budget": "node scripts/bench-cascade-budget.mjs",
@@ -54,6 +57,7 @@
 		"logs:smells": "node scripts/analyze-pi-lens-logs.mjs",
 		"complexity": "node scripts/complexity-report.mjs",
 		"changelog:check": "node scripts/rollup-changelog.mjs --check",
+		"contributors:update": "node scripts/update-contributors.mjs",
 		"test:regen": "node scripts/regen-test-baseline.mjs",
 		"changelog:release": "node scripts/changelog-release.mjs",
 		"changelog:extract": "node scripts/changelog-extract.mjs",
@@ -90,7 +94,14 @@
 	},
 	"packageManager": "npm@11.18.0",
 	"files": [
-		"dist/",
+		"dist/index.js",
+		"dist/chunk-*.js",
+		"dist/mcp/cli.js",
+		"dist/mcp/server.js",
+		"dist/mcp/analyze-cli.js",
+		"dist/mcp/worker.js",
+		"dist/workers/",
+		"dist/probes/",
 		"docs/",
 		"grammars/",
 		"vendor/grammars/",
@@ -103,6 +114,7 @@
 		"scripts/install-selftest.mjs",
 		"scripts/lib/host-provided-deps.mjs",
 		"scripts/lib/skills-predicate.mjs",
+		"scripts/lib/web-tree-sitter-dir.mjs",
 		"scripts/lib/warm-loader-cache.mjs",
 		"scripts/warm-loader-cache.mjs",
 		"scripts/rpc-load-check.mjs",
@@ -112,7 +124,7 @@
 		"banner.png"
 	],
 	"dependencies": {
-		"@ast-grep/cli": "^0.45.0",
+		"@ast-grep/cli": "0.45.3",
 		"@ast-grep/napi": "^0.45.0",
 		"js-yaml": "^5.2.2",
 		"minimatch": "^10.2.6",
@@ -121,7 +133,7 @@
 	},
 	"peerDependencies": {
 		"@earendil-works/pi-coding-agent": "*",
-		"@earendil-works/pi-tui": "^0.84.1 || ^0.85.0",
+		"@earendil-works/pi-tui": "*",
 		"typebox": "^1.0.0"
 	},
 	"peerDependenciesMeta": {
@@ -149,8 +161,10 @@
 	},
 	"allowScripts": {
 		"@ast-grep/cli@0.45.3": true,
-		"@google/genai@1.52.0": true,
-		"protobufjs@7.6.5": true
+		"@google/genai@2.21.0": true,
+		"esbuild@0.28.2": true,
+		"fsevents@2.3.3": false,
+		"protobufjs@7.6.6": true
 	},
 	"overrides": {
 		"qs": "^6.15.4"

package/rules/ast-grep-rules/rule-tests/advisory-registry-subset-test.yml

@@ -0,0 +1,41 @@
+id: advisory-registry-subset
+valid:
+  - |
+    // /^(typescript|python|marksman|opengrep):/ is prose, not code.
+    const one = "typescript|python";
+  - |
+    // ["typescript", "python"] is prose, not code.
+    const one = "['typescript', 'python']";
+  - |
+    const one = /^(typescript):/;
+  - |
+    const one = ["typescript"];
+  - |
+    const one = ["typescript", "not-a-server"];
+  - |
+    const one = /^(go|typescript-x):/;
+  - |
+    const one = /^(foo|typescript):/;
+  - |
+    const one = /^(typescript|foo):/;
+  - |
+    const one = /^typescript-python$/;
+invalid:
+  - |
+    const servers = /^(typescript|python|marksman|opengrep):/;
+  - |
+    const servers = ["typescript", "python", "marksman"];
+  - |
+    const servers = ["typescript", "python"];
+  - |
+    const servers = ['typescript', 'python', 'marksman'];
+  - |
+    const servers = ["foo", "typescript", "python"];
+  - |
+    const servers = ["typescript", "foo", "python"];
+  - |
+    const servers = ["foo", "typescript", "bar", "python"];
+  - |
+    const servers = /^(go|rust|ruby):/;
+  - |
+    const servers = /^(foo|typescript|python):/;

package/rules/ast-grep-rules/rule-tests/no-assert-tuple-test.yml

@@ -4,9 +4,22 @@ valid:
   - 'assert x == 1'
   - 'assert x, "message"'
   - 'assert (x == 1), "message"'  # explicit grouping, not a tuple
+  - 'assert actual == (1, 2)'
+  - 'assert (actual == (1, 2))'
+  - 'assert (f((1, 2)))'
+  - 'assert (left, right) == expected'
+  - 'assert value in {(1, 2), (3, 4)}'
+  - 'assert {item for item in values if item != (1, 2)}'
+  - 'assert all(item in {(1, 2)} for item in values)'
+  - 'assert True, ("tuple", "message")'
+  - 'assert actual == (1, 2), ("tuple", "message")'
 invalid:
+  - 'assert ()'
   - 'assert (1, 2)'
   - 'assert (x, y)'
+  - 'assert ((x, y))'
+  - 'assert (((x, y)))'
+  - 'assert (x, y), ("tuple", "message")'
   - 'assert (1, 2, 3), "message"'
   - |
     def f():

package/rules/ast-grep-rules/rule-tests/no-boolean-in-except-test.yml

@@ -15,6 +15,21 @@ valid:
         x()
     except:
         pass
+  - |
+    # #3211: body-only `or` must not be flagged — the handler condition
+    # itself is a plain exception type, only the return value uses `or`.
+    try:
+        x()
+    except Exception:
+        return 2 or 3
+  - |
+    # #3211: same shape one level deeper (an `if` inside the handler
+    # body) — still not a boolean-in-except-clause target.
+    try:
+        x()
+    except Exception:
+        if cond:
+            x = a or b
 invalid:
   - |
     try:
@@ -26,3 +41,14 @@ invalid:
         x()
     except ValueError and KeyError:
         pass
+  - |
+    # #3211: a nested try whose OWN except clause has the boolean
+    # condition must still be flagged, even though it sits inside an
+    # outer handler whose body also contains an `or`.
+    try:
+        outer()
+    except Exception:
+        try:
+            inner()
+        except (A or B):
+            return 3 or 4

package/rules/ast-grep-rules/rule-tests/no-http-headers-bracket-access-test.yml

@@ -2,6 +2,16 @@ id: no-http-headers-bracket-access
 valid:
   - "auth = request.headers.get('Authorization')"
   - "auth = request.headers.get('Authorization', '')"
+  - |
+    # #3211: a plain assignment through the bracket sets the header —
+    # it cannot raise KeyError, so it is not a read-site false positive.
+    resp.headers["X"] = "v"
+  - |
+    # #3211: augmented assignment is still a write, not a read.
+    resp.headers["X"] += "b"
+  - |
+    # #3211: `del` removes the key; it never raises KeyError either.
+    del resp.headers["Y"]
 invalid:
   - 'auth = request.headers["Authorization"]'
   - 'auth = response.headers["X-Request-Id"]'

package/rules/ast-grep-rules/rule-tests/unchecked-numeric-parse-python-test.yml

@@ -0,0 +1,18 @@
+id: unchecked-numeric-parse-python
+valid:
+  - |
+    # #3211: already-converted-by-construction — Decimal raises
+    # decimal.InvalidOperation, not ValueError, and is excluded here.
+    x = float(Decimal("1.5"))
+  - |
+    # #3211: a numeric literal argument can never raise ValueError.
+    x = int(3.7)
+  - |
+    try:
+        g = int(s)
+    except ValueError:
+        pass
+invalid:
+  - 'int("42")'
+  - 'float("3.14")'
+  - 'int(user_input)'

package/rules/ast-grep-rules/rule-tests/unchecked-throwing-call-python-test.yml

@@ -12,12 +12,13 @@ valid:
     except OSError:
         return None
   - 'CONSTANT = 42'
+  - |
+    # #3211: int()/float() moved to unchecked-numeric-parse-python — this
+    # rule no longer fires on the numeric-parse shape.
+    x = int(s)
 invalid:
   - 'data = json.loads(raw)'
   - 'f = open(path)'
   - 'os.remove(path)'
   - 'os.stat(path)'
   - 'shutil.rmtree(path)'
-  - 'int("42")'
-  - 'float("3.14")'
-  - 'int(user_input)'

package/rules/ast-grep-rules/rules/advisory-registry-subset.yml

@@ -0,0 +1,50 @@
+id: advisory-registry-subset
+language: TypeScript
+severity: info
+metadata:
+  category: pi-lens-self-scan
+message: "Hand-enumerated registry subset — explain the excluded ids or use the registry"
+ignores:
+  - "**/tests/**"
+note: |
+  Advisory only: `severity: info` self-scan rules are printed by
+  `npm run astgrep:self-scan` and never gate or enter the baseline
+  (scripts/lib/astgrep-self-scan.mjs), and are reported only in files
+  changed against a diff base (`--base <ref>`, CI's GITHUB_BASE_REF), or
+  everywhere with `--all-advisory`. This is a population-screening
+  prompt: two or more LSP server ids from clients/lsp/server.ts in a regex
+  alternation (any branch position) or in a string array (any position,
+  either quote style). The AST matcher does not scan comments or ordinary
+  strings. Tool and language registries remain a follow-up because their
+  larger populations need a separate low-noise rule shape.
+
+  Admission classes (every current hit belongs to one; the reader decides
+  whether a new hit needs a reason in the owning change):
+  - Extension / shell-name regexes (`file-role.ts`, `word-index.ts`,
+    `cache-manager.ts`, `jscpd-client.ts`, `tree-sitter-client.ts`,
+    `git-guard.ts`): file suffixes or shell binaries that share a spelling
+    with a server id; lexical coincidence, not a registry subset.
+  - Language-kind and runner-applicability arrays (`language-registry.ts`,
+    `tree-sitter-shared.ts`, `tree-sitter.ts`, `review-graph/builder.ts`,
+    `fact-rules.ts`, `biome-client.ts`, `ast-grep-napi.ts`,
+    `integration.ts`, `spotbugs.ts`, `test-runner-client.ts`,
+    `trivy-config.ts`): file-kind or language ids, an intentional
+    per-consumer applicability subset.
+  - `clients/file-kinds.ts` CODE_KINDS and NON_CODE_KINDS: derived
+    partitions of one registry, not independent registry choices.
+  - `clients/lsp/server.ts` OPENGREP_KINDS and AST_GREP_KINDS: auxiliary
+    servers attach to a deliberate cross-language subset.
+  - `clients/installer/index.ts` GITHUB_TOOLS: tool names, enforced against
+    the tool registry by tool-registry-consistency.
+rule:
+  any:
+    - kind: regex
+      regex: '^/[^/\n]*\b(?:typescript|deno|python|python-jedi|rust|ruby|php|powershell|csharp|omnisharp|fsharp|java|kotlin|swift|dart|lua|cpp|zig|haskell|elixir|expert|gleam|tinymist|marksman|ocaml|clojure|cue|terraform|nix|bash|fish|cmake|docker|yaml|json|html|toml|prisma|vue|svelte|css|opengrep|ast-grep|zizmor|typos)\b[^/\n]*\|[^/\n]*\b(?:typescript|deno|python|python-jedi|rust|ruby|php|powershell|csharp|omnisharp|fsharp|java|kotlin|swift|dart|lua|cpp|zig|haskell|elixir|expert|gleam|tinymist|marksman|ocaml|clojure|cue|terraform|nix|bash|fish|cmake|docker|yaml|json|html|toml|prisma|vue|svelte|css|opengrep|ast-grep|zizmor|typos)\b[^/\n]*/[dgimsuvy]*$'
+    - kind: array
+      has:
+        kind: string
+        regex: '^["''](typescript|deno|python|python-jedi|go|rust|ruby|php|powershell|csharp|omnisharp|fsharp|java|kotlin|swift|dart|lua|cpp|zig|haskell|elixir|expert|gleam|tinymist|marksman|ocaml|clojure|cue|terraform|nix|bash|fish|cmake|docker|yaml|json|html|toml|prisma|vue|svelte|css|opengrep|ast-grep|zizmor|typos)["'']$'
+        follows:
+          kind: string
+          regex: '^["''](typescript|deno|python|python-jedi|go|rust|ruby|php|powershell|csharp|omnisharp|fsharp|java|kotlin|swift|dart|lua|cpp|zig|haskell|elixir|expert|gleam|tinymist|marksman|ocaml|clojure|cue|terraform|nix|bash|fish|cmake|docker|yaml|json|html|toml|prisma|vue|svelte|css|opengrep|ast-grep|zizmor|typos)["'']$'
+          stopBy: end

package/rules/ast-grep-rules/rules/go-no-fmt-println.yml

@@ -26,8 +26,8 @@ constraints:
 ignores:
   - "**/*_test.go"
   - "**/examples/**"
-  - "tests/fixtures/**"
-  - "cases/**"
+  - "**/tests/fixtures/**"
+  - "**/cases/**"
 tags:
   - go
   - idiom

package/rules/ast-grep-rules/rules/no-assert-tuple.yml

@@ -1,24 +1,34 @@
 id: no-assert-tuple
 language: Python
 message: "Assert should not be called on a tuple literal"
-severity: error
+severity: warning
 note: |
   Port of SonarCloud python:S5905.
 
   `assert (a, b)` is always truthy because the tuple `(a, b)` is a
-  non-empty object. This is almost always a bug — the developer
-  probably meant `assert a, b` (two separate arguments) or
-  `assert (a == b)`.
+  non-empty object. The developer probably meant `assert a, b` (an
+  assertion with a message) or `assert (a == b)`.
 
-  The rule matches `assert` followed by a tuple literal. In Python
-  AST, `assert (1, 2)` parses as `assert_statement` whose test
-  is a `tuple` node (not parenthesized — the parens are just
-  grouping).
+  Bind the assertion's condition separately from its optional message,
+  then require that condition to be a tuple or a parentheses-only chain
+  ending in a tuple. Comparisons, calls, comprehensions, containers, and
+  tuple-valued assertion messages remain valid. The rule remains a
+  warning pending the multi-corpus false-positive audit required for
+  error severity.
 metadata:
   sonar: S5905
 rule:
-  all:
-    - kind: assert_statement
-    - has:
-        kind: tuple
-        stopBy: end
+  pattern: assert $COND
+constraints:
+  COND:
+    any:
+      - kind: tuple
+      - all:
+          - kind: parenthesized_expression
+          - has:
+              kind: tuple
+              stopBy:
+                not:
+                  any:
+                    - kind: parenthesized_expression
+                    - kind: tuple

package/rules/ast-grep-rules/rules/no-boolean-in-except.yml

@@ -11,8 +11,12 @@ note: |
   developer meant `except (ValueError, KeyError):` (a tuple of
   exception types).
 
-  Matches an `except_clause` whose direct children contain a
-  `boolean_operator` (and/or) node.
+  Matches an `except_clause` whose search for a `boolean_operator`
+  (and/or) descendant stops at the handler's own `block` — the
+  clause's condition, not anything inside the handler's body (a
+  `return x or y` or an `x = a or b` in the body is not a false
+  target; a nested `try`'s own `except` clause is checked on its
+  own merits when the walk reaches it).
 metadata:
   sonar: S5714
 rule:
@@ -20,4 +24,4 @@ rule:
     - kind: except_clause
     - has:
         kind: boolean_operator
-        stopBy: end
+        stopBy: { kind: block }

package/rules/ast-grep-rules/rules/no-console-except-error-js.yml

@@ -11,8 +11,8 @@ note: |
   just trains users to ignore the rule; `ignores` below carves those paths
   out while application/library code elsewhere still gets flagged (#965).
 ignores:
-  - "scripts/**"
-  - "bin/**"
+  - "**/scripts/**"
+  - "**/bin/**"
   - "**/logger.ts"
   - "**/logger.js"
   - "**/logger.mjs"

package/rules/ast-grep-rules/rules/no-console-except-error.yml

@@ -11,8 +11,8 @@ note: |
   just trains users to ignore the rule; `ignores` below carves those paths
   out while application/library code elsewhere still gets flagged (#965).
 ignores:
-  - "scripts/**"
-  - "bin/**"
+  - "**/scripts/**"
+  - "**/bin/**"
   - "**/logger.ts"
   - "**/logger.js"
   - "**/logger.mjs"

package/rules/ast-grep-rules/rules/no-http-headers-bracket-access.yml

@@ -9,14 +9,19 @@ note: |
   missing. Use `request.headers.get("X-Foo")` (returns None) or
   `request.headers["X-Foo"]` after a guard check.
 
-  Matches bracket-style subscript on a `headers` attribute. The
-  call shape `request.headers[...]` and `response.headers[...]`
-  are the most common cases.
+  Matches bracket-style subscript READS on a `headers` attribute
+  (`$REQ.headers[$KEY]` already subsumes the `request.`/`response.`-
+  named forms). A write through the same bracket syntax —
+  `resp.headers["X"] = v`, `resp.headers["X"] += v`, or
+  `del resp.headers["X"]` — sets or removes the header and can never
+  raise KeyError, so those are excluded.
 metadata:
   sonar: S8371
 rule:
-  any:
+  all:
     - pattern: "$REQ.headers[$KEY]"
-    - pattern: "$RES.headers[$KEY]"
-    - pattern: "request.headers[$KEY]"
-    - pattern: "response.headers[$KEY]"
+    - not:
+        any:
+          - inside: { kind: assignment, field: left }
+          - inside: { kind: augmented_assignment, field: left }
+          - inside: { kind: delete_statement }

package/rules/ast-grep-rules/rules/unchecked-numeric-parse-python.yml

@@ -0,0 +1,44 @@
+id: unchecked-numeric-parse-python
+language: Python
+severity: warning
+message: "int()/float() without try/except — raises ValueError on non-numeric input"
+note: |
+  Split out of `unchecked-throwing-call-python` (#3211): `int()`/`float()`
+  raise `ValueError` on non-numeric strings, but whether a given call CAN
+  raise depends on the argument's runtime type — often undecidable from
+  syntax alone — so this ships at `warning`, separate from the
+  syntactically-certain `error`-level calls (open/json/os/shutil).
+
+  Excluded as already-safe by construction: a numeric literal argument
+  (`int(3.7)`), and an argument that is itself a call to `int()`/
+  `float()`/`Decimal()` (already-converted, or a `Decimal` — which raises
+  `decimal.InvalidOperation`, not `ValueError`, and is out of scope here).
+
+  Residual, undecidable false positive: a call whose argument is a typed
+  parameter already known to be numeric, e.g.
+
+    def f(valor: Decimal):
+        return float(valor)  # valor is a Decimal, not a raw string
+
+  The rule cannot see the parameter's declared type from the call site.
+  Suppress that shape explicitly:
+
+    return float(valor)  # pi-lens-ignore: unchecked-numeric-parse-python
+rule:
+  any:
+    - pattern: int($EXPR)
+    - pattern: float($EXPR)
+  not:
+    any:
+      - inside:
+          stopBy: end
+          kind: try_statement
+      - has:
+          field: arguments
+          has:
+            any:
+              - kind: integer
+              - kind: float
+              - pattern: Decimal($$$)
+              - pattern: int($$$)
+              - pattern: float($$$)

package/rules/ast-grep-rules/rules/unchecked-throwing-call-python.yml

@@ -9,7 +9,11 @@ note: |
   json.loads(): raises json.JSONDecodeError on malformed JSON
   os.stat():    raises FileNotFoundError, PermissionError
   os.remove():  raises FileNotFoundError, PermissionError
-  int()/float():raises ValueError on non-numeric strings
+
+  `int()`/`float()` are a separate rule, `unchecked-numeric-parse-python`
+  (#3211): whether they can raise depends on the argument's runtime type,
+  which is often undecidable from syntax alone (a typed parameter, a prior
+  guard), so they ship at `warning` instead of `error` here.
 
   ✅ WRAP IN TRY/EXCEPT:
     try:
@@ -40,8 +44,6 @@ rule:
     - pattern: shutil.copy($$$)
     - pattern: shutil.move($$$)
     - pattern: shutil.rmtree($$$)
-    - pattern: int($EXPR)
-    - pattern: float($EXPR)
   not:
     inside:
       stopBy: end

package/rules/tree-sitter-queries/typescript/console-statement.yml

@@ -29,8 +29,8 @@ post_filter: not_in_test_block  # skip test blocks — no-console-in-tests handl
 # trains users to ignore the rule (#965). Application/library code outside
 # these paths still gets flagged.
 ignore_paths:
-  - "scripts/**"
-  - "bin/**"
+  - "**/scripts/**"
+  - "**/bin/**"
   - "**/logger.ts"
   - "**/logger.js"
   - "**/logger.mjs"