pi-lens 4.3.0 → 4.4.1

package/dist/clients/lsp/content-limits.js

@@ -1,41 +0,0 @@
-/**
- * The one byte/line bound on document content pi-lens hands a language server.
- *
- * #3405 r2 (M3406-1): this predicate used to exist twice — as a private
- * `exceedsLspSyncLimits` in `clients/pipeline.ts` and again inline in
- * `clients/dispatch/runners/lsp.ts` — so a THIRD writer could be added that
- * simply had neither. That is what happened: `tools/lsp-diagnostics.ts` reads a
- * whole file with `fs.readFileSync` and touches with it, and once the touch
- * could also carry `textDocument/didSave.text` (`includeText`), the same
- * unbounded string was serialized into a second JSON-RPC frame. Both callers now
- * ask this module, and so does the didSave payload seam, so the bound is one
- * constant pair in one place rather than a convention each new writer must
- * remember.
- *
- * The two established callers act on it by skipping their whole LSP step — a
- * file this large is not synced at all. That behaviour is deliberately NOT
- * folded in here: what a caller does at the bound is the caller's policy, and
- * `sendDidSave`'s is different (it drops the redundant `text` and still sends
- * the save, because the server already received these bytes in the didOpen or
- * didChange this save follows).
- */
-import { RUNTIME_CONFIG } from "../runtime-config.js";
-const LSP_MAX_FILE_BYTES = RUNTIME_CONFIG.pipeline.lspMaxFileBytes;
-const LSP_MAX_FILE_LINES = RUNTIME_CONFIG.pipeline.lspMaxFileLines;
-export function exceedsLspSyncLimits(content) {
-    const sizeBytes = Buffer.byteLength(content, "utf-8");
-    if (sizeBytes > LSP_MAX_FILE_BYTES) {
-        return {
-            tooLarge: true,
-            reason: `${sizeBytes} bytes > ${LSP_MAX_FILE_BYTES} limit`,
-        };
-    }
-    const lineCount = content.split("\n").length;
-    if (lineCount > LSP_MAX_FILE_LINES) {
-        return {
-            tooLarge: true,
-            reason: `${lineCount} lines > ${LSP_MAX_FILE_LINES} limit`,
-        };
-    }
-    return { tooLarge: false, reason: "" };
-}

package/dist/clients/lsp/diagnostic-binding.js

@@ -1,225 +0,0 @@
-import { createHash } from "node:crypto";
-import * as fs from "node:fs";
-import { PathKeyedMap } from "../path-keyed-map.js";
-import { normalizeEphemeralMapKey } from "../path-utils.js";
-/**
- * #1549: the ONE rule that decides whether a touch is inconclusive, and who is
- * responsible.
- *
- * The rule this replaced was `notifyWriteTimedOut || diagnosticsTimedOut` with
- * both flags TOUCH-WIDE over every spawned server, so one slow auxiliary
- * discarded every good answer in the touch: a clean typescript reply beside an
- * opengrep scan that needed 2s read as "nothing is known about this file". Over
- * 6,079 cascade neighbour sweeps that produced a 97.6% inconclusive rate
- * (ordinary edit-time touches in the same window: 15%).
- *
- * The verdict is therefore decided from the PRIMARY population only. An
- * auxiliary that never reported is a named COVERAGE GAP — `confirmation:
- * "partial"` plus {@link touchCoverageGap} — which withdraws the claim of full
- * coverage while the primary's findings still flow. That is the #533 honesty
- * doctrine cutting both ways: overclaiming ("confirmed" while a scanner was
- * silent) and underclaiming ("inconclusive" while the language server answered)
- * are both dishonest.
- *
- * Keep this a pure function: it is the single place a consumer's reading of
- * `inconclusive` can be audited against, and it is unit-tested directly.
- */
-export function resolveTouchVerdict(input) {
-    const notifyIds = [...new Set(input.primaryNotifyWriteTimedOutServerIds)];
-    const waitIds = input.diagnosticsTimedOut
-        ? [...new Set(input.diagnosticsUnansweredServerIds)]
-        : [];
-    if (notifyIds.length === 0 && !input.diagnosticsTimedOut) {
-        return { inconclusive: false };
-    }
-    const serverIds = [...new Set([...notifyIds, ...waitIds])];
-    const reason = notifyIds.length > 0 && input.diagnosticsTimedOut
-        ? "mixed"
-        : notifyIds.length > 0
-            ? "notify-write"
-            : "diagnostics-wait";
-    return {
-        inconclusive: true,
-        ...(serverIds.length > 0 && { inconclusiveServerIds: serverIds }),
-        inconclusiveReason: reason,
-    };
-}
-/**
- * #1470: the single source of truth for "which servers did this touch NOT hear
- * from". Read this instead of comparing `confirmation` to a string literal — a
- * consumer that tests `confirmation === "confirmed"` is correct only by accident
- * (it happens to fail closed for `"partial"`), and one that tests `!inconclusive`
- * is outright wrong, because a partially-confirmed touch is deliberately NOT
- * inconclusive: the primary's answer is still trustworthy and must survive.
- */
-export function touchCoverageGap(result) {
-    return result?.unconfirmedServerIds ?? [];
-}
-/**
- * #1470: did this touch complete its configured confirmation policy at all —
- * `"confirmed"` (for every spawned server) or `"partial"` (for every server
- * except the named cut-off auxiliaries)?
- *
- * This is deliberately NOT `confirmation === "confirmed"`. A consumer asking
- * "did the PRIMARY confirm?" must answer yes for a partial touch: `partial`
- * implies neither the notify write nor the diagnostics wait lapsed, so the
- * silent-clean gates ran to completion exactly as they do for a full
- * confirmation. Reading `=== "confirmed"` there looks safely fail-closed but
- * reports "the language server could not confirm clean" when the truth is "the
- * language server confirmed clean and a scanner never reported" — the same overclaim
- * pointing the other way. Pair this with {@link touchCoverageGap}, which names
- * what the touch does not speak for.
- */
-export function touchCompletedConfirmationPolicy(result) {
-    return result?.confirmation !== undefined;
-}
-/**
- * #2878: one publication-evidence predicate for auxiliary coverage. A
- * content-hash binding proves that the stored publication describes these
- * bytes. For a version-less publisher, an advanced per-path publication stamp
- * proves that the auxiliary published after this touch's pre-notify baseline;
- * the stamp alone cannot prove that the bytes matched. The pre-notify boolean
- * passed as `bindingMatchesContent` preserves a binding that the notify
- * cleared, while the live stamp covers a publication that landed after the
- * wait began. This predicate is the union. Four callers use it; only the
- * demoted row's `publishedThisContent` takes the union — the sibling and
- * aggregate rows compute that field from `auxCoversThisContent` directly
- * (#2914), while their `outcome` field still reads the stamp through this
- * predicate. Absent evidence fails closed.
- */
-export function auxiliaryPublicationEvidence({ bindingMatchesContent, baseline, currentPathVersion, raced = true, }) {
-    return (bindingMatchesContent ||
-        (raced &&
-            Number.isFinite(baseline) &&
-            currentPathVersion !== undefined &&
-            currentPathVersion > baseline));
-}
-/**
- * #1493: the single policy deciding which auxiliaries a touch carries NO
- * evidence from. Both no-answer shapes belong here, because they are the same
- * fact about coverage:
- *   - `cut_off` (#1470) — our grace timer ended the wait.
- *   - `silent` — the auxiliary's own budget lapsed with nothing published.
- *   - `deferred` (#1459) — the fan-out gate never sent it these bytes.
- * The rule is written as `outcome !== "answered"`, not as a list, so a new
- * no-answer shape fails closed by default instead of needing to be remembered
- * here — which is how `deferred` joined without touching this filter.
- * An auxiliary that never reported has told us nothing about the file, and
- * whether a SIBLING answered fast enough for the wait to settle early is
- * irrelevant to that. Before this policy, a silent auxiliary was a gap only by
- * accident: it burned the whole touch deadline when it was the only one, which
- * tripped `diagnosticsTimedOut`. With a fast sibling the wait settled early and
- * the silence went unrecorded, so the touch claimed an unqualified
- * `"confirmed"` for a scanner that said nothing (#1493, the #1470 shape on the
- * sibling outcome).
- *
- * NOT an overcorrection into demoting every clean file: `answered` is decided
- * by a publication landing, not by findings existing, so an auxiliary that ran
- * to budget and published an empty set is covered and its touch stays
- * `"confirmed"`. `publishedThisContent` covers the second honest case — an
- * auxiliary whose publication for these exact bytes is already stored (the
- * touch's notify was debounce-skipped, or its late publication was carried in),
- * which has reported even though nothing new landed during this wait.
- *
- * The `publishedThisContent` exemption applies to BOTH no-answer shapes, for the
- * same reason it applies to either: the question is whether this auxiliary has
- * reported on these exact bytes, and how a wait we abandoned would have ended is
- * irrelevant once a verified publication for them exists. Exempting `silent` but
- * not `cut_off` on identical evidence would report the same coverage two ways
- * depending on which timer happened to win. This stays fail-closed — it
- * un-narrows only against publication evidence (content-hash match, or an
- * advanced per-path publication stamp for version-less publishers), never
- * against a timer.
- */
-export function auxiliaryCoverageGap(evidence) {
-    return evidence
-        .filter((aux) => aux.outcome !== "answered" && aux.publishedThisContent !== true)
-        .map((aux) => aux.serverId);
-}
-/**
- * Fingerprint the EXACT text handed to didOpen/didChange. sha256 over the raw
- * string — no normalization — so the disk comparison (which reads the file with
- * the SAME raw `utf-8` transform pi-lens builds LSP payloads with) round-trips
- * CRLF and BOM bytes identically. See `createDiskBindingCache`.
- */
-export function hashDiagnosticContent(content) {
-    return createHash("sha256").update(content).digest("hex");
-}
-/**
- * Compose the merged `boundToCurrentDisk` across every client contributing to a
- * merged diagnostics result (primary + auxiliaries). The merged set is only as
- * trustworthy as its least-bound contributor:
- *   - ANY contributor demonstrably mismatches disk        → false
- *   - otherwise, all contributors are "unknown" (or none) → "unknown"
- *   - otherwise (≥1 bound, none mismatched)               → true
- * Unknowns never block a `true`: a version-less auxiliary alongside a bound
- * primary must not erase the primary's binding, only a real mismatch does.
- */
-export function composeBoundToCurrentDisk(values) {
-    if (values.some((v) => v === false))
-        return false;
-    if (values.every((v) => v === "unknown")) {
-        return "unknown";
-    }
-    return true;
-}
-/** One-word summary of a binding verdict for latency/observability logs. */
-export function bindingStateLabel(value) {
-    if (value === true)
-        return "bound";
-    if (value === false)
-        return "mismatch";
-    return "unknown";
-}
-/**
- * Bound on the per-(file,mtime) disk-fingerprint memo. The memo grows by one
- * entry per distinct tracked file; a full clear on overflow (rather than an LRU)
- * is fine because each entry is a pure, cheaply-recomputed derivation of disk
- * bytes — the worst case after a clear is one extra re-hash per file. Keeps the
- * map from growing unbounded across a long-lived session.
- */
-const DISK_BINDING_MEMO_MAX = 4096;
-export function createDiskBindingCache() {
-    // #1025: key through PathKeyedMap + normalizeEphemeralMapKey so two forms of
-    // the same path (`SUB\a.ts` vs `sub/a.ts`) can't produce a duplicate memo or a
-    // false miss. Ephemeral (slash-fold + win32-lowercase, no realpath I/O) — the
-    // keys are file paths this process is already stat'ing on the hot read path.
-    // #2300: the memo guards a CONTENT HASH recompute, so a stale memo serves a
-    // stale hash — `size` is the cheap second axis alongside `mtimeMs`, from the
-    // SAME stat call, so a same-mtime-bucket external rewrite is not masked.
-    const diskHashByPath = new PathKeyedMap(normalizeEphemeralMapKey);
-    return {
-        boundToCurrentDisk(filePath, stored) {
-            // No fingerprint captured (version-less server) → unknown, never false.
-            if (stored.contentHash === undefined)
-                return "unknown";
-            let stat;
-            try {
-                stat = fs.statSync(filePath);
-            }
-            catch {
-                // Can't stat (deleted/unreadable): can't disprove the binding either,
-                // so stay honest — "unknown", never a manufactured false.
-                return "unknown";
-            }
-            let cached = diskHashByPath.get(filePath);
-            if (!cached ||
-                cached.mtimeMs !== stat.mtimeMs ||
-                cached.size !== stat.size) {
-                let diskHash;
-                try {
-                    diskHash = hashDiagnosticContent(fs.readFileSync(filePath, "utf-8"));
-                }
-                catch {
-                    return "unknown";
-                }
-                cached = { mtimeMs: stat.mtimeMs, size: stat.size, hash: diskHash };
-                if (diskHashByPath.size >= DISK_BINDING_MEMO_MAX) {
-                    diskHashByPath.clear();
-                }
-                diskHashByPath.set(filePath, cached);
-            }
-            return cached.hash === stored.contentHash;
-        },
-    };
-}