pi-lens 4.4.0 → 4.4.2

package/dist/mcp/server.js

@@ -7,33 +7,32 @@ import {
   deadCodeIssues,
   formatDeadCodeDelta,
   stableFindingKey
-} from "../chunk-TT22N74J.js";
+} from "../chunk-OG5UUPN7.js";
 import {
   clearFormatterCache
-} from "../chunk-F3AU2TMM.js";
+} from "../chunk-ARJ6PLFH.js";
 import {
   findNearestProjectRoot,
-  getStartupScanMaxEntries,
   isStartupScanVerdictFresh,
   resolveStartupScanContext
-} from "../chunk-5RXBNSW2.js";
+} from "../chunk-3VPVG5SU.js";
 import {
   loadCallGraph
-} from "../chunk-NKOUFPQF.js";
+} from "../chunk-WOA4LN2R.js";
 import {
   RUNNERS,
   formatRunDurationMs,
   isExcludedTestTarget,
   isRunnerErrorResult
-} from "../chunk-IVP5KAB7.js";
+} from "../chunk-JWA5I3SR.js";
 import {
   GovulncheckClient
-} from "../chunk-NXPS2L6U.js";
+} from "../chunk-GZYBXISR.js";
 import {
   GitleaksClient,
   classifyAndFilterFindings
-} from "../chunk-BRJKOBZP.js";
-import "../chunk-6P62QVEA.js";
+} from "../chunk-VITUCP5A.js";
+import "../chunk-ZGDGW2V3.js";
 import {
   isHardFailureSummary
 } from "../chunk-7U2IDNXN.js";
@@ -54,12 +53,13 @@ import {
   peekTurnEndFindings,
   snapshotAdvisoryProvenance,
   validateAdvisoryProvenance
-} from "../chunk-Y4T27COV.js";
+} from "../chunk-KBG47GHP.js";
 import {
   CacheManager,
   DELTA_UNUSED_PROMOTION_NOTE,
   MCP_TURN_STATE_OWNER_ID,
   acquireWarmWordIndex,
+  admitsProjectWideFindings,
   analyzeFile,
   applyFindingPolicy,
   applyLspFindingPolicy,
@@ -99,56 +99,42 @@ import {
   resetPendingRunnerFindings,
   resetPsScriptAnalyzerAvailability,
   runProviders
-} from "../chunk-TLGFBM3F.js";
+} from "../chunk-ODBNXWT4.js";
 import {
   resetLazyInstallAttempts
-} from "../chunk-C2AUYXQH.js";
+} from "../chunk-OXXKQCSV.js";
 import {
   isTestRoleCollateral
-} from "../chunk-I3R7GKDR.js";
+} from "../chunk-EJIUXPBX.js";
 import "../chunk-FC4RP4I2.js";
 import {
   TrivyClient
-} from "../chunk-DFVMIKMQ.js";
-import "../chunk-TO6WL3GM.js";
-import "../chunk-7F72PXY2.js";
+} from "../chunk-66SXUJCA.js";
+import "../chunk-VCHXCQFG.js";
+import "../chunk-IXXDFY73.js";
 import {
   resetRustAvailability
-} from "../chunk-RPD5K5NC.js";
+} from "../chunk-MRXKYPCS.js";
 import {
   findingsResult,
   hasUsableResult
-} from "../chunk-ZMOL6RQC.js";
-import "../chunk-I7SPGOWI.js";
-import "../chunk-AS44CFQ4.js";
+} from "../chunk-2CD5RS6M.js";
+import "../chunk-UZ3TUTRV.js";
+import "../chunk-EETY4LF7.js";
 import {
   getSgCommand,
   resetDispatchAvailabilityState,
   resolveManagedToolClient
-} from "../chunk-7FBF7NPR.js";
-import "../chunk-HHYAELLJ.js";
-import "../chunk-V5PXFSZK.js";
-import "../chunk-YLF3PPT5.js";
-import "../chunk-JOLITGCC.js";
-import "../chunk-E2WFBRHM.js";
+} from "../chunk-GOYRYZ2R.js";
+import "../chunk-RPLINGVB.js";
+import "../chunk-XCJN5IJU.js";
+import "../chunk-76MWC2K6.js";
+import "../chunk-GXW6K4YJ.js";
+import "../chunk-2B73ZPOK.js";
 import {
   resetGoAvailability
-} from "../chunk-6VCD4VKZ.js";
-import "../chunk-F3P7VQ7H.js";
-import {
-  SYMBOL_KIND_NAMES,
-  captureReviewGraphStructuralIr,
-  formatReviewGraphRevisionDriftNote,
-  publishReviewGraphFileIr,
-  reviewGraphIrContentHash
-} from "../chunk-LSMJ6KBE.js";
-import {
-  buildSymbolId
-} from "../chunk-3MED75HT.js";
-import {
-  resolveGitCheckout,
-  resolveLinkedWorktreeOwner
-} from "../chunk-3I5QFT3N.js";
+} from "../chunk-XMSXXAHW.js";
+import "../chunk-7DYBLXYA.js";
 import {
   DEPENDENCY_DRIFT_MAX_DELIVERIES,
   MAX_LATE_AUX_REARMS,
@@ -156,7 +142,7 @@ import {
   RUNTIME_CONFIG,
   ReadGuard,
   STALE_LINE_MARKER,
-  SWEEP_IDLE_SAFETY_MARGIN_MS,
+  SYMBOL_KIND_NAMES,
   Text,
   TreeSitterSymbolExtractor,
   WriteOrderingGuard,
@@ -171,6 +157,8 @@ import {
   beginScope,
   buildScopeKey,
   canRearmPendingAuxiliary,
+  canWriteAnalysisRoot,
+  captureReviewGraphStructuralIr,
   classifyDiagnosticTier,
   clearAllSessions,
   countRetainedSuppressedRows,
@@ -184,10 +172,10 @@ import {
   drainRenderedDependencyDriftFilePaths,
   exceedsLspSyncLimits,
   findAuxiliaryProfileForSource,
+  formatReviewGraphRevisionDriftNote,
   getActiveSessionId,
   getDisposition,
   getFileDiagnosticSummaries,
-  getFullScanWallClockMs,
   getLSPService,
   getLspBudgetIdleTimeoutMs,
   getMutationBridge,
@@ -201,13 +189,13 @@ import {
   isBlocking,
   isPendingAuxiliaryPastRearmTtl,
   isWarmAttached,
-  isWorkspaceSweepActive,
   loadLspService,
   logBusEvent,
   markWidgetFileBlockersStale,
   newLspMutationCorrelationId,
   nextOrderTurn,
   pendingAuxiliaryCoverageSize,
+  publishReviewGraphFileIr,
   rearmPendingAuxiliaryCoverage,
   reconcileCorrelatedScanDiagnostics,
   reconcileScanDiagnostics,
@@ -230,8 +218,8 @@ import {
   retagAuxiliaryDiagnostics,
   retireScope,
   retireWidgetDependencyDriftBlockers,
+  reviewGraphIrContentHash,
   runPerServerGroups,
-  runWhenWorkspaceSweepIdle,
   scopeCell,
   setSessionLanguages,
   shouldShortenLspIdleTimeout,
@@ -244,18 +232,25 @@ import {
   widgetDiagnosticUri,
   workspaceEditTextPaths,
   writeOrderToken
-} from "../chunk-TVN5N6GY.js";
+} from "../chunk-PV6LR5P5.js";
+import {
+  buildSymbolId
+} from "../chunk-3MED75HT.js";
 import {
   emitBounded,
   resetBoundedTelemetry
-} from "../chunk-ARFCXG7S.js";
+} from "../chunk-CO2G5PHH.js";
 import {
   hashText,
   normalizeMessage,
   primePersistedMutationAttribution,
   resetMutationAttribution,
   stableFindingId
-} from "../chunk-OAXNDZJ7.js";
+} from "../chunk-IBGIOBEE.js";
+import {
+  resolveGitCheckout,
+  resolveLinkedWorktreeOwner
+} from "../chunk-PNQDPDRC.js";
 import {
   mapWithConcurrency
 } from "../chunk-XIMYZ3JA.js";
@@ -264,8 +259,10 @@ import {
   customServerSpecsOf,
   describeRootFallback,
   explainServersForFile,
+  getAstGrepRuleFingerprint,
   getServersForFileWithConfig,
   initLSPConfig,
+  isAuxiliary,
   isSameOrWithin,
   loadLSPConfig,
   lspConfigOf,
@@ -275,11 +272,26 @@ import {
   resetLSPCaseSensitivityState,
   resolveLspCwdForFile,
   shouldInitializeSessionRoot
-} from "../chunk-B3I2UUT4.js";
+} from "../chunk-ESBQHFMJ.js";
 import {
   hasAmbientPythonEnvironment
-} from "../chunk-DIULIWKU.js";
-import "../chunk-VDBPVIKD.js";
+} from "../chunk-34WSVGEM.js";
+import "../chunk-VWCXW2E7.js";
+import {
+  PROJECT_SNAPSHOT_VERSION,
+  getProjectSnapshotLegacyPath,
+  getProjectSnapshotPath,
+  hydrateRuntimeFromProjectSnapshot,
+  hydrateRuntimeFromProjectSnapshotIfIdle,
+  isProjectSnapshotFresh,
+  isProjectSnapshotMetaStale,
+  loadProjectSnapshot,
+  loadProjectSnapshotExportsAndRules,
+  loadProjectSnapshotWithoutWordIndex,
+  readJsonCache,
+  readProjectSnapshotMeta,
+  saveRuntimeProjectSnapshot
+} from "../chunk-ZXYDQ3TZ.js";
 import "../chunk-5W3R6LFT.js";
 import {
   EXT_TO_LANG,
@@ -293,51 +305,43 @@ import {
   queryLoader,
   reportBundledResourceDirHealth,
   resolveTreeSitterLanguage
-} from "../chunk-LW6XKDZQ.js";
+} from "../chunk-QHJ6DQ2R.js";
 import "../chunk-Z54ZSOBZ.js";
 import {
   SCAN_LANGUAGE_PRIORITY,
   extensionsForLanguage,
   extensionsForLanguageToken,
+  getUserRuleRoot,
   resolveLanguage
-} from "../chunk-TGPXLY2J.js";
+} from "../chunk-724UL2TJ.js";
 import {
   dump,
   resolvePackagePath
 } from "../chunk-QOZXJ4NA.js";
-import "../chunk-V7R425XG.js";
-import "../chunk-PAK6IDME.js";
+import "../chunk-GBPP5P7X.js";
+import "../chunk-P7266HLM.js";
+import {
+  SWEEP_IDLE_SAFETY_MARGIN_MS,
+  getFullScanWallClockMs,
+  isWorkspaceSweepActive,
+  runWhenWorkspaceSweepIdle
+} from "../chunk-MQLUAEOC.js";
 import {
   HOOK_WALL_BUDGET_MS,
   bounded,
   combineAbortSignals,
   withDeadline
-} from "../chunk-GUOGVTCQ.js";
-import {
-  PROJECT_SNAPSHOT_VERSION,
-  getProjectSnapshotLegacyPath,
-  getProjectSnapshotPath,
-  hydrateRuntimeFromProjectSnapshot,
-  hydrateRuntimeFromProjectSnapshotIfIdle,
-  isProjectSnapshotFresh,
-  isProjectSnapshotMetaStale,
-  loadProjectSnapshot,
-  loadProjectSnapshotExportsAndRules,
-  loadProjectSnapshotWithoutWordIndex,
-  readJsonCache,
-  readProjectSnapshotMeta,
-  saveRuntimeProjectSnapshot
-} from "../chunk-AJVLWNFN.js";
+} from "../chunk-52FUZI6K.js";
 import {
   centralityFromReverseDeps,
   getWordIndexBuildStatus,
   logWordIndex,
   searchWordIndex,
   triggerBackgroundWordIndexBuild
-} from "../chunk-YGVYKNSN.js";
+} from "../chunk-SAEFPSB6.js";
 import {
   getProjectDiagnosticsScannerMaxFiles
-} from "../chunk-LNAKEO63.js";
+} from "../chunk-GAEGEPOC.js";
 import {
   PathKeyedMap
 } from "../chunk-Z3CCVDUB.js";
@@ -350,30 +354,27 @@ import {
   readTurnEndStatus,
   resolveRunnerPath,
   toRunnerDisplayPath
-} from "../chunk-PWFHBTSF.js";
+} from "../chunk-L3BLXZG7.js";
 import "../chunk-2BEMIWEW.js";
 import {
   commitDurableStore,
   resetResolvedPathCache,
   resetZizmorTokenAvailability
-} from "../chunk-OQGFCZJ4.js";
+} from "../chunk-66VMUL7Q.js";
 import {
   resolveToolCwd
-} from "../chunk-RUOG5D2C.js";
+} from "../chunk-Q7DUK4LX.js";
 import {
   _resetPackageManagerCache,
   findGlobalBinary,
   pmBinary,
   resolveNodePackageManager,
   runScriptArgs
-} from "../chunk-U3VGR4VU.js";
-import {
-  isToolInstallAllowedByTrust,
-  projectTrustDenialReason
-} from "../chunk-NTUJEGDZ.js";
+} from "../chunk-AW7R2GWG.js";
 import {
+  getIsolatedNpxSpawnOptions,
   probeToolAsync
-} from "../chunk-EOKRQ3SA.js";
+} from "../chunk-RWWYJ623.js";
 import {
   classifyProbeFailure,
   createAvailabilityLatch,
@@ -381,20 +382,20 @@ import {
   logAvailabilityDecision,
   resetInstallRetryLatches,
   startHostStallSampler
-} from "../chunk-WONERJTP.js";
+} from "../chunk-VRZP76YM.js";
 import {
   canRunStartupHeavyScans,
   detectProjectLanguageProfile,
   getDefaultStartupTools
-} from "../chunk-22AVIGXS.js";
-import "../chunk-GVXA6CCE.js";
+} from "../chunk-QOBUHWHX.js";
+import "../chunk-QILIYSJF.js";
 import {
   collectSourceFilesWithBudgetAsync,
   getSlowFsVerdict,
   isSlowFs,
   slowFsDegradationNotice
-} from "../chunk-6QIUX4EP.js";
-import "../chunk-VHQLPIRJ.js";
+} from "../chunk-6C7JWPCP.js";
+import "../chunk-5NGR67U5.js";
 import {
   displayProjectDataPath,
   drainProjectDataDirMigrations,
@@ -421,7 +422,7 @@ import {
   sweepDeadEphemeralDataDirs,
   updateHeartbeat,
   withGenerationLockSync
-} from "../chunk-VN2AXLEX.js";
+} from "../chunk-C34ZXZ7O.js";
 import {
   createSingleFlight
 } from "../chunk-BW5KFIQC.js";
@@ -431,7 +432,7 @@ import {
 } from "../chunk-QYF5S6P6.js";
 import {
   detectFileKind
-} from "../chunk-5ZEJHV35.js";
+} from "../chunk-PHDMFAKM.js";
 import {
   compareKeys,
   detectFileRole,
@@ -441,12 +442,18 @@ import {
   provenanceView,
   resolvePiLensConfig,
   summarizeConfigResolution
-} from "../chunk-DQ2NZ7C4.js";
+} from "../chunk-2BBLFX75.js";
 import {
   LSP_NAMESPACE_KEY,
   getPiLensGlobalConfigPath,
   resetWorkspaceTopology
-} from "../chunk-VNMT7C64.js";
+} from "../chunk-XVF2VVXP.js";
+import {
+  getProjectTrustState,
+  isToolInstallAllowedByTrust,
+  projectTrustDenialReason,
+  setProjectTrustState
+} from "../chunk-ZANLILYD.js";
 import {
   DEFAULT_MAX_OUTPUT_BYTES,
   createBoundedOutputSink,
@@ -467,28 +474,30 @@ import {
   resolveLensToolEnabled,
   resolveLensToolName,
   toolRegistryEntryForMcp
-} from "../chunk-N3YQJI6O.js";
+} from "../chunk-JAU72XNY.js";
 import {
   createSubsystemLogger,
   flushExtensionLog,
   logExtension
-} from "../chunk-O6TQT6RI.js";
+} from "../chunk-XTMJ7XDT.js";
+import "../chunk-JMYYOTQG.js";
 import {
   claimPhaseOncePerSession,
   logLatency
-} from "../chunk-5THXD6X5.js";
+} from "../chunk-QQNQ7SJW.js";
 import {
   beginTurnContext,
   createNdjsonLogger,
   getGlobalPiLensLogDir,
+  getProcessSingleton,
   isTestMode,
   runLogCleanup,
   setTurnContextSession
-} from "../chunk-UK3CMEAL.js";
+} from "../chunk-AOHZU2BM.js";
 import "../chunk-LJDODBBZ.js";
 import {
   FactStore
-} from "../chunk-NMABWBZN.js";
+} from "../chunk-CHOW74WE.js";
 import {
   BoundedFifoMap,
   BoundedLruCache
@@ -503,15 +512,16 @@ import {
   normalizeMapKey,
   pathsEqual,
   realpathOrResolve,
+  resolveHostToolPath,
   toProjectRelativePath,
   uriToPath
-} from "../chunk-Q5U6FMDI.js";
+} from "../chunk-N2H3ZPZY.js";
 import "../chunk-NXL4FFQQ.js";
 
 // dist/mcp/server.js
 import * as fs25 from "node:fs";
 import * as net from "node:net";
-import * as path38 from "node:path";
+import * as path39 from "node:path";
 import { fileURLToPath as fileURLToPath3 } from "node:url";
 
 // dist/tools/render-compact.js
@@ -821,37 +831,59 @@ function checkAstGrepRulesHealth(ruleDir) {
 var AstGrepRuleManager = class {
   ruleDir;
   log;
+  fingerprint;
   ruleDescriptions = null;
-  constructor(ruleDir, log) {
+  ruleFingerprint = null;
+  constructor(ruleDir, log, fingerprint = () => getAstGrepRuleFingerprint()) {
     this.ruleDir = ruleDir;
     this.log = log;
+    this.fingerprint = fingerprint;
   }
   loadRuleDescriptions() {
-    if (this.ruleDescriptions !== null)
+    const fingerprint = this.fingerprint();
+    if (this.ruleDescriptions !== null && this.ruleFingerprint === fingerprint)
       return this.ruleDescriptions;
     const descriptions = /* @__PURE__ */ new Map();
-    const possiblePaths = candidateAstGrepRulesPaths(this.ruleDir);
-    const rulesPath = possiblePaths.find((p) => fs2.existsSync(p));
+    const roots = Array.isArray(this.ruleDir) ? this.ruleDir : [this.ruleDir];
+    const possiblePaths = roots.flatMap(candidateAstGrepRulesPaths);
+    const rulesPaths = [];
+    if (Array.isArray(this.ruleDir)) {
+      for (const candidate of possiblePaths) {
+        if (fs2.existsSync(candidate))
+          rulesPaths.push(candidate);
+      }
+    } else {
+      for (const candidate of possiblePaths) {
+        if (!fs2.existsSync(candidate))
+          continue;
+        rulesPaths.push(candidate);
+        break;
+      }
+    }
+    const rulesPath = rulesPaths[0];
     if (!rulesPath) {
       this.log(`Rule descriptions: no rules directory found in ${possiblePaths.join(", ")}`);
       this.ruleDescriptions = descriptions;
+      this.ruleFingerprint = fingerprint;
       return descriptions;
     }
     try {
-      const files = fs2.readdirSync(rulesPath).filter((f) => f.endsWith(".yml"));
-      this.log(`Loaded ${files.length} rule descriptions from ${rulesPath}`);
-      for (const file of files) {
-        const filePath = path2.join(rulesPath, file);
-        const content = fs2.readFileSync(filePath, "utf-8");
-        const rule = this.parseRuleYaml(content);
-        if (rule) {
-          descriptions.set(rule.id, rule);
+      for (const resolvedPath of rulesPaths) {
+        const files = fs2.readdirSync(resolvedPath).filter((f) => f.endsWith(".yml"));
+        this.log(`Loaded ${files.length} rule descriptions from ${resolvedPath}`);
+        for (const file of files) {
+          const filePath = path2.join(resolvedPath, file);
+          const content = fs2.readFileSync(filePath, "utf-8");
+          const rule = this.parseRuleYaml(content);
+          if (rule && !descriptions.has(rule.id))
+            descriptions.set(rule.id, rule);
         }
       }
     } catch (err) {
       this.log(`Failed to load rule descriptions: ${err.message}`);
     }
     this.ruleDescriptions = descriptions;
+    this.ruleFingerprint = fingerprint;
     return descriptions;
   }
   parseRuleYaml(content) {
@@ -953,6 +985,7 @@ var SgRunner = class {
   log;
   sgPath = null;
   sgArgsPrefix = [];
+  sgSpawnOptions;
   /**
    * Availability memo, backed by the shared transient-aware latch (#1476).
    *
@@ -1034,17 +1067,25 @@ var SgRunner = class {
     this.sweepFallbackCause = "probe-timeout";
     this.sweepHostStallMs = 0;
     this.sweepDurablyMissing = [];
+    const trustedProject = getProjectTrustState() === "trusted";
     const pathCommand = await this.probeCommandCandidates([
-      { cmd: "ast-grep", argsPrefix: [] },
-      { cmd: "sg", argsPrefix: [] },
-      // `npx --no -- ast-grep` starts a Node process before it can answer, so
+      ...trustedProject ? [
+        { cmd: "ast-grep", argsPrefix: [] },
+        { cmd: "sg", argsPrefix: [] }
+      ] : [],
+      // The scoped npx fallback starts a Node process before it can answer, so
       // it is the candidate most likely to blow a 5 s budget on a cold or busy
       // box. Marked a fallback so its timeout cannot veto the install.
-      { cmd: "npx", argsPrefix: ["--no", "--", "ast-grep"], fallback: true }
+      {
+        cmd: "npx",
+        argsPrefix: ["--no", "--package", "@ast-grep/cli", "--", "ast-grep"],
+        fallback: true
+      }
     ]);
     if (pathCommand) {
       this.sgPath = pathCommand.cmd;
       this.sgArgsPrefix = pathCommand.argsPrefix;
+      this.sgSpawnOptions = pathCommand.cmd === "npx" ? getIsolatedNpxSpawnOptions() : void 0;
       this.noteAvailable(startedAt, `ast-grep found on PATH: ${pathCommand.cmd}`);
       return true;
     }
@@ -1057,7 +1098,7 @@ var SgRunner = class {
         return true;
       }
     }
-    const platformBinary = await this.probePlatformPackageBinary();
+    const platformBinary = trustedProject ? await this.probePlatformPackageBinary() : void 0;
     if (platformBinary) {
       this.sgPath = platformBinary;
       this.sgArgsPrefix = [];
@@ -1090,6 +1131,7 @@ var SgRunner = class {
     if (installed.outcome === "success") {
       this.sgPath = installed.value;
       this.sgArgsPrefix = [];
+      this.sgSpawnOptions = void 0;
       this.noteAvailable(startedAt, `ast-grep auto-installed: ${installed.value}`);
       return true;
     }
@@ -1109,7 +1151,7 @@ var SgRunner = class {
    * sweep already asked, and the sweep returns at the first one that answers,
    * so at this point the flag means "a tier the winner is supposed to lose to
    * never got a fair hearing". Latching that pinned the session to
-   * `npx --no -- ast-grep` — a Node start per invocation — over a healthy
+   * `npx` — a Node start per invocation — over a healthy
    * ast-grep on PATH, until the next restart. Provisional instead: served now,
    * re-swept once the stalled tier's cooldown expires.
    *
@@ -1252,7 +1294,10 @@ var SgRunner = class {
     let result;
     let hostStallMs;
     try {
-      result = await probeToolAsync(cmd, [...argsPrefix, "--version"], {
+      result = cmd === "npx" ? await safeSpawnAsync(cmd, [...argsPrefix, "--version"], {
+        ...getIsolatedNpxSpawnOptions(),
+        timeout: PROBE_TIMEOUT_MS
+      }) : await probeToolAsync(cmd, [...argsPrefix, "--version"], {
         timeout: PROBE_TIMEOUT_MS
       });
     } finally {
@@ -1339,6 +1384,7 @@ Original error: ${stderr}`;
   async execRaw(args, timeout = DEFAULT_EXEC_TIMEOUT_MS, options = {}) {
     const command = this.getSgCommand();
     const result = await safeSpawnAsync(command.cmd, [...command.argsPrefix, ...args], {
+      ...this.sgSpawnOptions,
       timeout,
       deadlineAt: options.deadlineAt,
       signal: options.signal,
@@ -1367,6 +1413,7 @@ Original error: ${stderr}`;
     const hasBash = Boolean(process.env.MSYSTEM || process.env.GIT_SHELL);
     const useBash = isWindows && hasBash;
     const result = await safeSpawnAsync(useBash ? "bash" : command.cmd, useBash ? buildBashRunArgs(command.cmd, allArgs) : allArgs, {
+      ...this.sgSpawnOptions,
       timeout: DEFAULT_EXEC_TIMEOUT_MS,
       deadlineAt: options.deadlineAt,
       signal: options.signal,
@@ -1515,6 +1562,7 @@ Original error: ${stderr}`;
         ...sgExcludeArgsForProject(dir),
         dir
       ], {
+        ...sgCmd === "npx" ? getIsolatedNpxSpawnOptions() : {},
         timeout,
         deadlineAt: options.deadlineAt,
         signal: options.signal,
@@ -1552,6 +1600,7 @@ Original error: ${stderr}`;
         dir
       ];
       const spawnOptions = {
+        ...sgCmd === "npx" ? getIsolatedNpxSpawnOptions() : {},
         timeout,
         deadlineAt: options.deadlineAt,
         signal: options.signal,
@@ -1641,7 +1690,7 @@ function reportAstGrepRulesHealth(bundledRuleDir) {
   });
   reportBundledResourceDirHealth("ast-grep-rules-dir-missing", bundledRuleDir, health, "ast-grep rule descriptions");
 }
-function recordAstGrepApply(matches, lineage) {
+function recordAstGrepApply(matches, lineage, toolCallId) {
   const bridge = getMutationBridge();
   if (!bridge || matches.length === 0)
     return;
@@ -1657,13 +1706,22 @@ function recordAstGrepApply(matches, lineage) {
   }
   for (const [filePath, editRanges] of rangesByFile) {
     bridge.recordMutation({
-      filePath,
+      // ast-grep echoes the spelling passed to its CLI. Resolve that
+      // tool-relative spelling at the producer boundary, then use the
+      // existing canonical path seam before recordability is checked (#4140).
+      filePath: normalizeFilePath(path4.resolve(process.cwd(), filePath)),
       kind: "edit",
       editRanges,
       consumer: "ast_grep_replace",
+      provenance: "observed",
       // #3763: the call's session, so an apply that lands after `/new`
       // writes none of the next session's state.
-      ...lineage && { lineage }
+      ...lineage && { lineage },
+      // #4187 R4-1: the apply rewrites every matched file, which an
+      // `ast_grep_replace` call names only when its `paths` are files. The
+      // call's own id lets the guard advance exactly the paths that call
+      // checked, and end the authorship of every other file it rewrote.
+      ...toolCallId !== void 0 && { toolCallId }
     });
   }
 }
@@ -1732,6 +1790,9 @@ function validateInputShape(value, maxChars, label) {
   }
   return void 0;
 }
+function extractRuleLanguage(ruleYaml) {
+  return /^[^\S\n\r\u2028\u2029]*language:\s*([^\s#]+)/im.exec(ruleYaml)?.[1];
+}
 function stderrHasError(stderr) {
   return stderr.split(/\r?\n/).some((line) => /^\s*(error|Error):/.test(line));
 }
@@ -1766,7 +1827,7 @@ var AstGrepClient = class {
     this.log = verbose ? createSubsystemLogger("ast-grep") : () => {
     };
     this.ensureRulesHealthReported();
-    this.ruleManager = new AstGrepRuleManager(this.ruleDir, this.log);
+    this.ruleManager = new AstGrepRuleManager(ruleDir ? this.ruleDir : [projectRuleDir, getUserRuleRoot(), this.ruleDir], this.log, () => getAstGrepRuleFingerprint(process.cwd()));
     this.runner = new SgRunner(verbose);
   }
   /**
@@ -1810,7 +1871,7 @@ var AstGrepClient = class {
    * Replace using a raw YAML rule that includes a `fix:` field (Phase 3/4 of #125).
    * Dry-run returns matches for preview; apply writes fixes to disk.
    */
-  async replaceWithRule(ruleYaml, paths, apply) {
+  async replaceWithRule(ruleYaml, paths, apply, options) {
     const allMatches = [];
     for (const scanPath of paths) {
       if (apply) {
@@ -1843,6 +1904,8 @@ var AstGrepClient = class {
       }
       allMatches.push(...result.matches);
     }
+    if (apply)
+      recordAstGrepApply(allMatches, options?.lineage, options?.toolCallId);
     return {
       matches: allMatches,
       totalMatches: allMatches.length,
@@ -1964,7 +2027,7 @@ var AstGrepClient = class {
     const shapeError = validateInputShape(ruleYaml, MAX_VALIDATE_RULE_CHARS, "rule");
     if (shapeError)
       return { valid: false, error: shapeError };
-    const language = /^\s*language:\s*([^\s#]+)/im.exec(ruleYaml)?.[1] ?? "typescript";
+    const language = extractRuleLanguage(ruleYaml) ?? "typescript";
     const snippet = validationSnippetFor(language);
     const tmpDir = fs4.mkdtempSync(path4.join(os2.tmpdir(), "pi-lens-sg-rule-"));
     try {
@@ -2109,7 +2172,7 @@ var AstGrepClient = class {
         error: applyResult.error
       };
     }
-    recordAstGrepApply(preCheck.matches, options?.lineage);
+    recordAstGrepApply(preCheck.matches, options?.lineage, options?.toolCallId);
     return {
       matches: preCheck.matches,
       totalMatches: preCheck.totalMatches,
@@ -2239,7 +2302,7 @@ message: found
 };
 
 // dist/clients/lens-engine.js
-import * as path28 from "node:path";
+import * as path29 from "node:path";
 
 // dist/clients/project-diagnostics/scanner.js
 import * as fs6 from "node:fs";
@@ -2686,7 +2749,7 @@ function resolveRebuildScript(serverFilePath) {
   return serverFilePath.replace(/\\/g, "/").includes("/dist/") ? "build:dist" : "build";
 }
 function analyzeFileFresh(workerPath, file, cwd, options = {}, timeoutMs = 12e4) {
-  return new Promise((resolve30) => {
+  return new Promise((resolve32) => {
     const args = [workerPath, `--file=${file}`, `--cwd=${cwd}`];
     if (options.flags)
       args.push(`--flags=${JSON.stringify(options.flags)}`);
@@ -2696,7 +2759,7 @@ function analyzeFileFresh(workerPath, file, cwd, options = {}, timeoutMs = 12e4)
         stdio: ["ignore", "pipe", "pipe"]
       });
     } catch (err) {
-      resolve30({
+      resolve32({
         error: `failed to fork worker: ${err instanceof Error ? err.message : String(err)}`
       });
       return;
@@ -2709,7 +2772,7 @@ function analyzeFileFresh(workerPath, file, cwd, options = {}, timeoutMs = 12e4)
         return;
       settled = true;
       clearTimeout(timer);
-      resolve30(outcome);
+      resolve32(outcome);
     };
     const timer = setTimeout(() => {
       child.kill();
@@ -2817,7 +2880,7 @@ function summarizeScan(diagnostics) {
 // dist/clients/mcp/session.js
 import * as crypto from "node:crypto";
 import * as fs18 from "node:fs";
-import * as path24 from "node:path";
+import * as path25 from "node:path";
 
 // dist/clients/bootstrap.js
 var residentClients = null;
@@ -2874,29 +2937,29 @@ async function buildBootstrapClients() {
     }
   }
   const [ruffClient, biomeClient, knipClient, todoScanner, jscpdClient, depChecker, testRunnerClient, metricsClient, complexityClient, goClient, govulncheckClient, gitleaksClient, trivyClient, opengrepClient, rustClient, agentBehaviorClient2, deadCodeClients] = await Promise.all([
-    load("ruff", async () => new (await import("../chunk-52H5B5TC.js")).RuffClient()),
-    load("biome", async () => new (await import("../chunk-4RERDEXR.js")).BiomeClient()),
-    load("knip", async () => new (await import("../chunk-AJ3QXTRQ.js")).KnipClient()),
-    load("todo", async () => new (await import("../chunk-NL5GLMFI.js")).TodoScanner()),
-    load("jscpd", async () => new (await import("../chunk-HVUZXSWK.js")).JscpdClient()),
-    load("dependency-checker", async () => new (await import("../chunk-T6D4Q4AQ.js")).DependencyChecker()),
-    load("test-runner", async () => new (await import("../chunk-AHDW3GPE.js")).TestRunnerClient()),
-    load("metrics", async () => new (await import("../chunk-27BBHSZC.js")).MetricsClient()),
-    load("complexity", async () => new (await import("../chunk-OS32RNR2.js")).ComplexityClient()),
+    load("ruff", async () => new (await import("../chunk-PFNSLWU5.js")).RuffClient()),
+    load("biome", async () => new (await import("../chunk-QZVW3AAK.js")).BiomeClient()),
+    load("knip", async () => new (await import("../chunk-7ULNCDCO.js")).KnipClient()),
+    load("todo", async () => new (await import("../chunk-JSQFTSC6.js")).TodoScanner()),
+    load("jscpd", async () => new (await import("../chunk-3UUPUE3O.js")).JscpdClient()),
+    load("dependency-checker", async () => new (await import("../chunk-3WA4HP4I.js")).DependencyChecker()),
+    load("test-runner", async () => new (await import("../chunk-Q6ZWTCLY.js")).TestRunnerClient()),
+    load("metrics", async () => new (await import("../chunk-N3X6Q4YT.js")).MetricsClient()),
+    load("complexity", async () => new (await import("../chunk-VSSBEUFT.js")).ComplexityClient()),
     // The process-wide singleton, NOT a fresh instance (#2455 fix round 4,
     // F2). `handleSessionStart` reads this object for its "Active tools"
     // line while `resetGoAvailability` re-arms the singleton's latch; a
     // second instance here meant the reset never reached the surface a
     // user actually sees.
-    load("go", async () => (await import("../chunk-NTHH2J74.js")).goClient),
-    load("govulncheck", async () => new (await import("../chunk-54B42YRX.js")).GovulncheckClient()),
-    load("gitleaks", async () => new (await import("../chunk-RIISMHKN.js")).GitleaksClient()),
-    load("trivy", async () => new (await import("../chunk-IIXOAGHR.js")).TrivyClient()),
-    load("opengrep", async () => new (await import("../chunk-ORTMY4Q4.js")).OpengrepClient()),
+    load("go", async () => (await import("../chunk-Z527N6YQ.js")).goClient),
+    load("govulncheck", async () => new (await import("../chunk-XPZPXCBV.js")).GovulncheckClient()),
+    load("gitleaks", async () => new (await import("../chunk-WOKKRCJ5.js")).GitleaksClient()),
+    load("trivy", async () => new (await import("../chunk-IBRALRBR.js")).TrivyClient()),
+    load("opengrep", async () => new (await import("../chunk-XKIZ2HNN.js")).OpengrepClient()),
     // The process-wide singleton, for the same reason as "go" above.
-    load("rust", async () => (await import("../chunk-4W2PLC4J.js")).rustClient),
-    load("agent-behavior", async () => (await import("../chunk-IXEBJSUE.js")).agentBehaviorClient),
-    loadList("dead-code", async () => (await import("../chunk-UY752QSN.js")).getDeadCodeClients())
+    load("rust", async () => (await import("../chunk-BRGDSBJE.js")).rustClient),
+    load("agent-behavior", async () => (await import("../chunk-23WOO7TX.js")).agentBehaviorClient),
+    loadList("dead-code", async () => (await import("../chunk-NW7BOILN.js")).getDeadCodeClients())
   ]);
   if (failures.length > 0)
     await logBootstrapFailures(failures);
@@ -2983,7 +3046,7 @@ function resetAnalyzerBootstrapSessionState() {
 }
 
 // dist/clients/formatters-lazy.js
-var lazyFormatters = createLazyImport(() => import("../chunk-XK4CIILI.js"));
+var lazyFormatters = createLazyImport(() => import("../chunk-GHB6AYCP.js"));
 function warmFormatters() {
   return lazyFormatters.get();
 }
@@ -3332,6 +3395,13 @@ function deriveProviderFromModelId(modelId) {
 
 // dist/clients/runtime-coordinator.js
 var MAX_PENDING_CASCADE_RUNS = 32;
+function nextTelemetrySessionId() {
+  const state = getProcessSingleton("runtime-coordinator-telemetry", 1, () => ({
+    processId: randomBytes(6).toString("hex"),
+    nextGeneration: 0
+  }));
+  return `lens-${state.processId}-${++state.nextGeneration}`;
+}
 var MAX_CUT_ADVISORY_LANES = 16;
 var MAX_MUTATION_RECEIPTS = 512;
 function recordViewIncomplete(cwd, cause) {
@@ -3403,7 +3473,8 @@ var RuntimeCoordinator = class {
     rules: [],
     hasCustomRules: false
   };
-  _telemetrySessionId = `lens-${Date.now().toString(36)}`;
+  /** Process-unique and monotonic across coordinator reloads (#4213). */
+  _telemetrySessionId = nextTelemetrySessionId();
   _lifecycleReason;
   _hasStableSessionId = false;
   _telemetryModel = "unknown";
@@ -3472,9 +3543,10 @@ var RuntimeCoordinator = class {
   /** tool_call → tool_result path-attribution correlation (#1642). */
   _toolCallAttributions = new BoundedLruCache(TOOL_CALL_ATTRIBUTION_CAPACITY);
   /**
-   * #3555: reads carry no {@link ToolCallAttribution} (it is recorded for
-   * mutations, and its origin cwd would change how a read's path resolves),
-   * so a widening rides its own correlation, with the same bound.
+   * #3555: a widening rides its own correlation, with the same bound. Since
+   * #4138 a read also carries a {@link ToolCallAttribution} (its origin cwd
+   * is what a relative read path resolves against at tool_result); the
+   * widening stays separate because it outlives a blocked call's attribution.
    */
   _readWidenings = new BoundedLruCache(TOOL_CALL_ATTRIBUTION_CAPACITY);
   _lspReadWarmState = /* @__PURE__ */ new Map();
@@ -3543,7 +3615,7 @@ var RuntimeCoordinator = class {
     this._droppedMutationReceipts = 0;
     this._actionableWarningsThisTurn.clear(this._telemetrySessionId);
     this._codeQualityWarningsThisTurn.clear(this._telemetrySessionId);
-    this._telemetrySessionId = `lens-${Date.now().toString(36)}-${randomBytes(4).toString("hex")}`;
+    this._telemetrySessionId = nextTelemetrySessionId();
     this._hasStableSessionId = false;
     this._telemetryModel = "unknown";
     this._telemetryModelId = "";
@@ -4013,7 +4085,9 @@ var RuntimeCoordinator = class {
    * session; it is therefore required. `filePath` is the edited file the
    * compute belongs to, the subject of a dropped admission's ledger row.
    */
-  appendCascadePromise(p, generation, filePath) {
+  appendCascadePromise(p, generation, filePath, analysisRootMode = "session") {
+    if (!canWriteAnalysisRoot(analysisRootMode))
+      return;
     if (generation.guardedWrite(filePath, () => true) === void 0)
       return;
     if (this._pendingCascadeRuns.length < MAX_PENDING_CASCADE_RUNS) {
@@ -4075,8 +4149,8 @@ var RuntimeCoordinator = class {
         });
         return entry;
       });
-      const timeout = new Promise((resolve30) => {
-        setTimeout(resolve30, maxWaitMs).unref?.();
+      const timeout = new Promise((resolve32) => {
+        setTimeout(resolve32, maxWaitMs).unref?.();
       });
       await Promise.race([
         Promise.allSettled(tracked.map((t) => t.promise)),
@@ -4782,7 +4856,9 @@ var RuntimeCoordinator = class {
    * for a same-kind re-touch. Callers publish each kind's first transition
    * without spamming repeated edits before `agent_end`.
    */
-  deferMutation(filePath, cwd, toolName, turnStateCwd, kind, ownerSessionId, originCwd, readGuardBranchEpoch = this.readGuard.currentBranchEpoch) {
+  deferMutation(filePath, cwd, toolName, turnStateCwd, kind, ownerSessionId, originCwd, readGuardBranchEpoch = this.readGuard.currentBranchEpoch, analysisRootMode = "session") {
+    if (!canWriteAnalysisRoot(analysisRootMode))
+      return false;
     const key = path8.resolve(filePath);
     const now = Date.now();
     const resolvedOriginCwd = originCwd ?? turnStateCwd;
@@ -4817,8 +4893,19 @@ var RuntimeCoordinator = class {
     });
     return true;
   }
-  deferFormat(filePath, cwd, toolName, turnStateCwd, ownerSessionId, originCwd) {
-    return this.deferMutation(filePath, cwd, toolName, turnStateCwd, "format", ownerSessionId, originCwd);
+  deferFormat(filePath, cwd, toolName, turnStateCwd, ownerSessionId, originCwd, analysisRootMode = "session") {
+    return this.deferMutation(filePath, cwd, toolName, turnStateCwd, "format", ownerSessionId, originCwd, void 0, analysisRootMode);
+  }
+  /** Return the ownership identity of a queued format record for bus events. */
+  deferredFormatIdentity(filePath) {
+    const record = this._pendingDeferredMutations.get(path8.resolve(filePath));
+    if (!record || !record.kinds.has("format"))
+      return void 0;
+    return {
+      ownerSessionId: record.ownerSessionId,
+      turnIndex: record.queuedTurnIndex,
+      batchId: record.queuedTurnId
+    };
   }
   get pendingDeferredFormatCount() {
     return this._pendingDeferredMutations.size;
@@ -4946,7 +5033,7 @@ var RuntimeCoordinator = class {
 
 // dist/clients/runtime-session.js
 import * as nodeFs from "node:fs";
-import * as path12 from "node:path";
+import * as path13 from "node:path";
 
 // dist/clients/message-end-attribution.js
 var lastStableSessionId;
@@ -5224,6 +5311,38 @@ function emitSituationalDeadWeight() {
   });
 }
 
+// dist/clients/deferred-test-targets.js
+import * as path12 from "node:path";
+var TEST_RUNNER_MAX_PERSISTED_TARGETS = 64;
+function deferralEntryKey(entry) {
+  return `${entry.sessionId ?? ""}\0${normalizeMapKey(path12.resolve(entry.testFile))}`;
+}
+function mergeDeferredTargets(existing, incoming) {
+  const byKey = /* @__PURE__ */ new Map();
+  for (const entry of [...existing, ...incoming]) {
+    const key = deferralEntryKey(entry);
+    const prior = byKey.get(key);
+    if (prior && (prior.attempts ?? 0) >= (entry.attempts ?? 0))
+      continue;
+    byKey.set(key, entry);
+  }
+  return [...byKey.values()];
+}
+function boundDeferredTargets(entries, max, isOwn) {
+  const foreign = [];
+  const own = [];
+  for (const entry of entries) {
+    if (isOwn(entry))
+      own.push(entry);
+    else
+      foreign.push(entry);
+  }
+  const ordered = [...foreign, ...own];
+  if (ordered.length <= max)
+    return ordered;
+  return ordered.slice(-max);
+}
+
 // dist/clients/test-runner-delivery.js
 var pending = /* @__PURE__ */ new Map();
 function resetTestRunnerDelivery() {
@@ -5231,6 +5350,30 @@ function resetTestRunnerDelivery() {
 }
 
 // dist/clients/runtime-session.js
+function notifyStartupWarmSkip(args) {
+  if (!args.runtime.isCurrentSession(args.sessionGeneration))
+    return;
+  const reason = args.scan.reason;
+  if (reason !== "too-many-source-files" && reason !== "too-many-entries") {
+    return;
+  }
+  const bound = reason === "too-many-entries" ? {
+    name: "maxScanEntries",
+    value: args.scan.maxScanEntries,
+    hint: `set PI_LENS_STARTUP_SCAN_MAX_ENTRIES=<n> to override the ${args.scan.maxScanEntries}-entry cap`
+  } : {
+    name: "maxProjectFiles",
+    value: args.scan.maxProjectFiles,
+    hint: `set maxProjectFiles in .pi-lens.json to override the ${args.scan.maxProjectFiles}-source-file cap`
+  };
+  recordDegradationOnce({
+    kind: "startup-warm-skipped",
+    subject: args.analysisRoot,
+    reason: `${reason}; ${bound.name}=${bound.value}`,
+    metadata: { reason, [bound.name]: bound.value }
+  });
+  args.notify(`\u{1F4E6} Project-size limits disabled background warm scans (heavy scans, TODO scan, LSP pre-warm) (${bound.hint}).`, "warning");
+}
 async function demandBootstrapDeps(deps, reason) {
   const clients = await deps.bootstrap.request(reason);
   if (!clients)
@@ -5256,7 +5399,7 @@ function logHostReadyDelay(deps, cwd) {
   });
 }
 function resolveSnapshotRoot(cwd) {
-  const resolvedCwd = path12.resolve(cwd);
+  const resolvedCwd = path13.resolve(cwd);
   const nearest = findNearestProjectRoot(resolvedCwd);
   if (!nearest || isAtOrAboveHomeDir(nearest)) {
     return resolvedCwd;
@@ -5359,8 +5502,8 @@ async function readSequenceWithBudget(args) {
   const { snapshotRoot, base, cwd, runtime, sessionGeneration, dbg, onDeferredSequenceResolved } = args;
   const readPromise = readLatestProjectSequenceAsync(snapshotRoot, base);
   let timeoutHandle;
-  const timeoutPromise = new Promise((resolve30) => {
-    timeoutHandle = setTimeout(() => resolve30({ timedOut: true }), sequenceReadBudgetMs());
+  const timeoutPromise = new Promise((resolve32) => {
+    timeoutHandle = setTimeout(() => resolve32({ timedOut: true }), sequenceReadBudgetMs());
     timeoutHandle.unref();
   });
   const raced = await Promise.race([
@@ -5429,7 +5572,7 @@ async function igniteWarmFiles(cwd, warmFiles, runtime, sessionGeneration, dbg)
     for (const relPath of warmFiles) {
       if (!runtime.isCurrentSession(sessionGeneration))
         return;
-      const filePath = path12.isAbsolute(relPath) ? relPath : path12.resolve(cwd, relPath);
+      const filePath = path13.isAbsolute(relPath) ? relPath : path13.resolve(cwd, relPath);
       if (!nodeFs.existsSync(filePath)) {
         dbg(`session_start lsp-warm: not found: ${relPath}`);
         errors++;
@@ -5460,8 +5603,8 @@ async function igniteDominantLanguageWarm(cwd, runtime, sessionGeneration, dbg)
     if (!runtime.isCurrentSession(sessionGeneration))
       return;
     const lspService = (await loadLspService()).getLSPService();
-    const { collectSourceFilesAsync } = await import("../chunk-E4MAEDPM.js");
-    const { CODE_KINDS, detectFileKind: detectFileKind2 } = await import("../chunk-O5WILGMI.js");
+    const { collectSourceFilesAsync } = await import("../chunk-4W4VLAPJ.js");
+    const { CODE_KINDS, detectFileKind: detectFileKind2 } = await import("../chunk-FLKWCIZH.js");
     const files = await collectSourceFilesAsync(cwd, {
       inspectGeneratedHeaders: false
     });
@@ -5495,7 +5638,7 @@ async function igniteDominantLanguageWarm(cwd, runtime, sessionGeneration, dbg)
         clientScope: "primary",
         maxClientWaitMs: 2e3
       });
-      dbg(`session_start lsp-warm: dominant=${kind} via ${path12.basename(sample)}`);
+      dbg(`session_start lsp-warm: dominant=${kind} via ${path13.basename(sample)}`);
       return;
     }
     dbg("session_start lsp-warm: no dominant-language LSP file found to warm");
@@ -5527,7 +5670,7 @@ function scheduleManagedToolRefresh(dbg) {
   const timer = setTimeout(() => {
     void (async () => {
       try {
-        const refresh = await import("../chunk-T4ERT73Y.js");
+        const refresh = await import("../chunk-CF24OIYI.js");
         const outcome = await refresh.runManagedToolRefresh();
         if (outcome.skipped) {
           dbg(`session_start tool-refresh: skipped (${outcome.skipped})`);
@@ -5544,7 +5687,7 @@ function scheduleManagedToolRefresh(dbg) {
   timer.unref?.();
 }
 async function probePrettierInstall(ensureTool, dbg, analysisRoot) {
-  const pkgPath = path12.join(analysisRoot, "package.json");
+  const pkgPath = path13.join(analysisRoot, "package.json");
   try {
     const raw = await nodeFs.promises.readFile(pkgPath, "utf-8");
     const pkg = JSON.parse(raw);
@@ -5574,7 +5717,7 @@ function scanOneTodoFile(scanner, filePath, items) {
 async function collectTodoBaselineItems(scanner, analysisRoot, stillCurrent) {
   const items = [];
   try {
-    const { getSourceFilesAsync } = await import("../chunk-RPD4ZSB7.js");
+    const { getSourceFilesAsync } = await import("../chunk-IZSHAIJ7.js");
     const files = await getSourceFilesAsync(analysisRoot, true);
     if (!stillCurrent())
       return items;
@@ -5603,7 +5746,7 @@ async function buildOrRefreshWordIndex(args) {
   const snapshot = loadProjectSnapshot(snapshotRoot);
   const snapshotLoadMs = Date.now() - snapshotLoadStartMs;
   if (snapshot?.wordIndex) {
-    const { deserializeWordIndex, refreshWordIndexIncrementally, countWordIndexPostingEntries: countWordIndexPostingEntries2, estimateWordIndexResidentBytes: estimateWordIndexResidentBytes2 } = await import("../chunk-XECLWQZN.js");
+    const { deserializeWordIndex, refreshWordIndexIncrementally, countWordIndexPostingEntries: countWordIndexPostingEntries2, estimateWordIndexResidentBytes: estimateWordIndexResidentBytes2 } = await import("../chunk-WU567RSC.js");
     const deserializeStartMs = Date.now();
     const index = deserializeWordIndex(snapshot.wordIndex);
     const deserializeMs = Date.now() - deserializeStartMs;
@@ -5675,7 +5818,7 @@ async function buildOrRefreshWordIndex(args) {
       }
     }
   }
-  const { buildWordIndexAsync, collectWordIndexDocs, countWordIndexPostingEntries, estimateWordIndexResidentBytes } = await import("../chunk-XECLWQZN.js");
+  const { buildWordIndexAsync, collectWordIndexDocs, countWordIndexPostingEntries, estimateWordIndexResidentBytes } = await import("../chunk-WU567RSC.js");
   const docs = await collectWordIndexDocs(analysisRoot, () => runtime.isCurrentSession(sessionGeneration), rebuildPreflightFiles);
   if (!runtime.isCurrentSession(sessionGeneration))
     return;
@@ -5745,7 +5888,7 @@ function scheduleStartupScansWithClients(deps, runtime, sessionGeneration, analy
     const queuedAt = Date.now();
     dbg(`session_start task ${name}: scheduled`);
     runtime.markStartupScanInFlight(name, sessionGeneration);
-    const completion = new Promise((resolve30) => {
+    const completion = new Promise((resolve32) => {
       const fire = () => {
         const startedAt = Date.now();
         dbg(`session_start task ${name}: start queuedMs=${startedAt - queuedAt}`);
@@ -5757,7 +5900,7 @@ function scheduleStartupScansWithClients(deps, runtime, sessionGeneration, analy
         }).finally(() => {
           runtime.clearStartupScanInFlight(name, sessionGeneration);
           dbg(`session_start task ${name}: end`);
-          resolve30();
+          resolve32();
         });
       };
       const delay = taskDeferMsByName[name] ?? 0;
@@ -5834,7 +5977,7 @@ function scheduleStartupScansWithClients(deps, runtime, sessionGeneration, analy
     if (await jscpdClient.ensureAvailable()) {
       if (!runtime.isCurrentSession(sessionGeneration))
         return;
-      const isTsProject = nodeFs.existsSync(path12.join(analysisRoot, "tsconfig.json"));
+      const isTsProject = nodeFs.existsSync(path13.join(analysisRoot, "tsconfig.json"));
       const scannerKey = isTsProject ? "jscpd-ts" : "jscpd";
       const cached = cacheManager2.readCache(scannerKey, analysisRoot);
       if (cached) {
@@ -6040,9 +6183,9 @@ function scheduleStartupScansWithClients(deps, runtime, sessionGeneration, analy
   });
   let callGraphIdentity;
   const callGraphTask = runTask("call-graph", async () => {
-    const { FactStore: FactStore2 } = await import("../chunk-YSNFMJKN.js");
-    const { buildOrUpdateGraph, extractSymbolsAndRefsFromGraph, getReviewGraphCacheIdentity } = await import("../chunk-VD4JQCQC.js");
-    const { buildCallGraph, saveCallGraph, loadCallGraph: loadCallGraph2 } = await import("../chunk-FJNKANOS.js");
+    const { FactStore: FactStore2 } = await import("../chunk-QGQ5CCCG.js");
+    const { buildOrUpdateGraph, extractSymbolsAndRefsFromGraph, getReviewGraphCacheIdentity } = await import("../chunk-2ZGIZPDG.js");
+    const { buildCallGraph, saveCallGraph, loadCallGraph: loadCallGraph2 } = await import("../chunk-BKE7E7TC.js");
     if (!runtime.isCurrentSession(sessionGeneration))
       return;
     const startMs = Date.now();
@@ -6083,7 +6226,7 @@ function scheduleStartupScansWithClients(deps, runtime, sessionGeneration, analy
       return;
     if (!runtime.callGraph)
       return;
-    const { buildCodebaseModel, saveCodebaseModel, DEFAULT_CODEBASE_MODEL_TOKEN_BUDGET } = await import("../chunk-K6VYLB2U.js");
+    const { buildCodebaseModel, saveCodebaseModel, DEFAULT_CODEBASE_MODEL_TOKEN_BUDGET } = await import("../chunk-TYM6OUIT.js");
     if (!callGraphIdentity)
       return;
     const model = buildCodebaseModel(runtime.callGraph, analysisRoot, DEFAULT_CODEBASE_MODEL_TOKEN_BUDGET, callGraphIdentity);
@@ -6156,11 +6299,79 @@ function scheduleDeferredToolProbesWithClients(deps, languageProfile, startupDef
     dbg(`session_start tools (deferred probes complete, ${Date.now() - warmStart}ms): ${summary}`);
   })();
 }
-var SESSION_START_GUIDANCE = [
-  "\u{1F4CC} pi-lens active \u2014 automated checks run on every edit/write; blocking errors (including pre-existing) show inline and must be fixed.\nKey tools (see each tool's own description for args):\n\u2022 lens_diagnostics \u2014 source=session reads cache; empty cache \u2260 clean; use source=lsp scope=paths for changed files with absent or stale findings (aggregate hosts: lens(action=diagnostics)).\n\u2022 symbol_search \u2192 module_report \u2192 read_symbol/read_enclosing \u2014 ranked identifier search, then navigable outline/callback handles + exact body reads; cheaper than reading a whole file before editing.\n\u2022 Situational (activate via pi_lens_activate_tools): lsp_navigation, ast_grep_search, ast_grep_replace. Use ast_grep_search with dump=true to inspect AST nodes."
-];
+function readSubstituteGuidance(isEnabled) {
+  const units = [];
+  if (isEnabled("symbol_search")) {
+    units.push({ name: "symbol_search", role: "ranked identifier search" });
+  }
+  if (isEnabled("module_report")) {
+    units.push({
+      name: "module_report",
+      role: "navigable outline/callback handles"
+    });
+  }
+  const readSymbol2 = isEnabled("read_symbol");
+  const readEnclosing2 = isEnabled("read_enclosing");
+  if (readSymbol2 && readEnclosing2) {
+    units.push({
+      name: "read_symbol/read_enclosing",
+      role: "exact body reads"
+    });
+  } else if (readSymbol2) {
+    units.push({ name: "read_symbol", role: "exact body reads" });
+  } else if (readEnclosing2) {
+    units.push({ name: "read_enclosing", role: "exact body reads" });
+  }
+  if (units.length === 0)
+    return void 0;
+  const roles = units.map((unit) => unit.role);
+  const roleTail = roles.length === 1 ? roles[0] : roles.length === 2 ? `${roles[0]}, then ${roles[1]}` : `${roles[0]}, then ${roles[1]} + ${roles[2]}`;
+  return `\u2022 ${units.map((unit) => unit.name).join(" \u2192 ")} \u2014 ${roleTail}; cheaper than reading a whole file before editing.`;
+}
+function situationalGuidance(isEnabled) {
+  const active = [];
+  for (const name of [
+    "lsp_navigation",
+    "ast_grep_search",
+    "ast_grep_replace"
+  ]) {
+    if (isEnabled(name))
+      active.push(name);
+  }
+  if (active.length === 0)
+    return void 0;
+  let text = `\u2022 Situational (activate via pi_lens_activate_tools): ${active.join(", ")}.`;
+  if (isEnabled("ast_grep_search")) {
+    text += " Use ast_grep_search with dump=true to inspect AST nodes.";
+  }
+  return text;
+}
+function renderSessionStartGuidance(options = {}) {
+  const disabled = new Set(options.disabledToolNames ?? []);
+  const isEnabled = (name) => !disabled.has(name);
+  const requirePreExistingFixes = options.requirePreExistingFixes !== false;
+  const header = "\u{1F4CC} pi-lens active \u2014 automated checks run on every edit/write; " + (requirePreExistingFixes ? "blocking errors (including pre-existing) show inline and must be fixed." : "blocking errors you introduce must be fixed; pre-existing ones are only reported.");
+  const bullets = [];
+  if (isEnabled("lens_diagnostics")) {
+    bullets.push("\u2022 lens_diagnostics \u2014 source=session reads cache; empty cache \u2260 clean; use source=lsp scope=paths for changed files with absent or stale findings (aggregate hosts: lens(action=diagnostics)).");
+  }
+  const readSubstitute = readSubstituteGuidance(isEnabled);
+  if (readSubstitute)
+    bullets.push(readSubstitute);
+  const situational = situationalGuidance(isEnabled);
+  if (situational)
+    bullets.push(situational);
+  const lines = [header];
+  if (bullets.length > 0) {
+    lines.push("Key tools (see each tool's own description for args):");
+    lines.push(...bullets);
+  }
+  return [lines.join("\n")];
+}
+var SESSION_START_GUIDANCE = renderSessionStartGuidance();
 async function handleSessionStart(deps) {
   resetDegradationLedger();
+  let sessionGenerationAtStart = deps.runtime.sessionGeneration;
   resetAnalyzerBootstrapSessionState();
   resetProjectDataDirSessionState();
   resetTestRunnerDelivery();
@@ -6199,8 +6410,8 @@ async function handleSessionStart(deps) {
         try {
           warmupDbg("warmup: starting background warmup");
           const scanContextStartedAt = Date.now();
-          const startupScanModule = await import("../chunk-ODEEOXPH.js");
-          const languageProfileModule = await import("../chunk-AWE5TMPO.js");
+          const startupScanModule = await import("../chunk-ZHFZWTZV.js");
+          const languageProfileModule = await import("../chunk-R3PCY3YS.js");
           const warmupSnapshotRoot = resolveSnapshotRoot(warmupCwd);
           const cachedSnapshot = loadProjectSnapshot(warmupSnapshotRoot);
           warmupOwnSnapshotRead = cachedSnapshot ? {
@@ -6212,7 +6423,7 @@ async function handleSessionStart(deps) {
           const cachedVerdict = cachedSnapshot?.startupScan;
           let scan;
           if (cachedVerdict && startupScanModule.isStartupScanVerdictFresh(cachedVerdict)) {
-            scan = { ...cachedVerdict, cwd: path12.resolve(warmupCwd) };
+            scan = { ...cachedVerdict, cwd: path13.resolve(warmupCwd) };
             warmupDbg(`warmup: scan-context reused from cache (canWarm=${scan.canWarmCaches}${scan.reason ? `, reason=${scan.reason}` : ""})`);
           } else {
             scan = await startupScanModule.resolveStartupScanContextAsync(warmupCwd);
@@ -6241,6 +6452,13 @@ async function handleSessionStart(deps) {
           });
           if (!scan.canWarmCaches) {
             warmupDbg(`warmup: skipping language-profile (canWarm=false, reason=${scan.reason ?? "unknown"})`);
+            notifyStartupWarmSkip({
+              scan,
+              analysisRoot: scan.projectRoot ?? warmupCwd,
+              notify: deps.notify,
+              runtime: deps.runtime,
+              sessionGeneration: sessionGenerationAtStart
+            });
             return;
           }
           const languageRoot = scan.projectRoot ?? warmupCwd;
@@ -6356,6 +6574,7 @@ async function handleSessionStart(deps) {
   deps.bootstrap.peek()?.knipClient.resetSessionState?.();
   resetCascadeTierSessionState();
   runtime.resetForSession(sessionStartMs);
+  sessionGenerationAtStart = runtime.sessionGeneration;
   logLatency({
     type: "phase",
     phase: "session_start_runtime_reset",
@@ -6398,7 +6617,7 @@ async function handleSessionStart(deps) {
   const cwd = ctxCwd ?? process.cwd();
   const projectDataDir = getProjectDataDir(cwd);
   for (const migration of drainProjectDataDirMigrations()) {
-    const targetName = path12.basename(migration.to);
+    const targetName = path13.basename(migration.to);
     const hash = targetName.match(/([0-9a-f]{8})$/)?.[1] ?? "unknown";
     if (migration.outcome === "ephemeral") {
       recordDegradationOnce({
@@ -6417,11 +6636,11 @@ async function handleSessionStart(deps) {
   const globalDir = getGlobalPiLensDir();
   void sweepAtomicWriteStages([
     projectDataDir,
-    path12.join(projectDataDir, "cache"),
-    path12.join(projectDataDir, "sessions"),
+    path13.join(projectDataDir, "cache"),
+    path13.join(projectDataDir, "sessions"),
     globalDir,
-    path12.join(globalDir, "bin"),
-    path12.join(globalDir, "tools")
+    path13.join(globalDir, "bin"),
+    path13.join(globalDir, "tools")
   ]).catch(() => {
   });
   void sweepDeadEphemeralDataDirs({ isPidAlive: realIsPidAlive }).catch(() => {
@@ -6570,7 +6789,7 @@ async function handleSessionStart(deps) {
   if (allowBootstrapTasks && !getFlag("no-lsp")) {
     const cleaned = cleanStaleTsBuildInfo(ctxCwd ?? process.cwd());
     if (cleaned.length > 0) {
-      notify(`\u{1F9F9} Deleted stale TypeScript build cache (${cleaned.map((f) => path12.basename(f)).join(", ")}) \u2014 phantom errors suppressed.`, "warning");
+      notify(`\u{1F9F9} Deleted stale TypeScript build cache (${cleaned.map((f) => path13.basename(f)).join(", ")}) \u2014 phantom errors suppressed.`, "warning");
       dbg(`session_start: cleaned stale tsbuildinfo: ${cleaned.join(", ")}`);
     }
   }
@@ -6655,7 +6874,7 @@ async function handleSessionStart(deps) {
   const startupScanSource = cachedStartupScan ? "snapshot" : "computed";
   let startupScan;
   if (cachedStartupScan) {
-    startupScan = { ...cachedStartupScan, cwd: path12.resolve(cwd) };
+    startupScan = { ...cachedStartupScan, cwd: path13.resolve(cwd) };
   } else {
     const scanContextStartedAt = Date.now();
     startupScan = resolveStartupScanContext(cwd);
@@ -6760,7 +6979,10 @@ async function handleSessionStart(deps) {
     tools.push("Rust (cargo)");
   log(`Active tools: ${tools.join(", ")}`);
   dbg(`session_start tools: ${tools.join(", ")}`);
-  const agentStartupGuidance = SESSION_START_GUIDANCE;
+  const agentStartupGuidance = renderSessionStartGuidance({
+    disabledToolNames: deps.disabledToolNames,
+    requirePreExistingFixes: deps.globalConfig?.contextInjection?.requirePreExistingFixes
+  });
   runtime.projectRulesScan = scanProjectRules(analysisRoot);
   saveRuntimeProjectSnapshot({
     cwd: snapshotRoot,
@@ -6792,10 +7014,13 @@ async function handleSessionStart(deps) {
   } else if (!startupScan.canWarmCaches) {
     dbg(`session_start: skipping heavy scans (${startupScan.reason ?? "unknown"})`);
     dbg(`session_start: skipping TODO scan (${startupScan.reason ?? "unknown"})`);
-    if (startupScan.reason === "too-many-source-files" || startupScan.reason === "too-many-entries") {
-      const overrideHint = startupScan.reason === "too-many-entries" ? ` (set PI_LENS_STARTUP_SCAN_MAX_ENTRIES=<n> to override the ${getStartupScanMaxEntries()}-entry cap)` : "";
-      notify(`\u{1F4E6} Project-size limits disabled background warm scans (heavy scans, TODO scan, LSP pre-warm)${overrideHint}.`, "warning");
-    }
+    notifyStartupWarmSkip({
+      scan: startupScan,
+      analysisRoot,
+      notify,
+      runtime,
+      sessionGeneration
+    });
   } else {
     scheduleStartupScans(deps, runtime, sessionGeneration, analysisRoot, snapshotRoot, languageProfile, dbg);
   }
@@ -6857,18 +7082,18 @@ function emitSmellsSessionStartLine(dbg, sessionStartMs) {
 
 // dist/clients/runtime-turn.js
 import * as fs17 from "node:fs";
-import * as path23 from "node:path";
+import * as path24 from "node:path";
 
 // dist/clients/actionable-warnings.js
 import { createHash as createHash2 } from "node:crypto";
 import * as fs12 from "node:fs";
-import * as path14 from "node:path";
+import * as path15 from "node:path";
 
 // dist/clients/actionable-warnings-logger.js
-import * as path13 from "node:path";
+import * as path14 from "node:path";
 var AW_LOG_DIR = getGlobalPiLensLogDir();
-var AW_LOG_FILE = path13.join(AW_LOG_DIR, "actionable-warnings.log");
-var AW_LOG_BACKUP_FILE = path13.join(AW_LOG_DIR, "actionable-warnings.log.1");
+var AW_LOG_FILE = path14.join(AW_LOG_DIR, "actionable-warnings.log");
+var AW_LOG_BACKUP_FILE = path14.join(AW_LOG_DIR, "actionable-warnings.log.1");
 var MAX_LOG_BYTES2 = Math.max(128 * 1024, Number.parseInt(process.env.PI_LENS_AW_LOG_MAX_BYTES ?? "1048576", 10) || 1048576);
 var writer2 = createNdjsonLogger({
   filePath: AW_LOG_FILE,
@@ -6903,7 +7128,7 @@ function createActionableWarningId(args) {
   });
 }
 function legacyActionableWarningId(args) {
-  const rel = path14.relative(args.cwd, args.filePath).replace(/\\/g, "/");
+  const rel = path15.relative(args.cwd, args.filePath).replace(/\\/g, "/");
   const legacyRelativeFile = rel && !rel.startsWith("..") ? rel : normalizeMapKey(args.filePath);
   const parts = [
     legacyRelativeFile,
@@ -6949,7 +7174,7 @@ function deserializeSuppressionState(contents) {
   }
 }
 function readSuppressionState(cwd) {
-  const statePath = path14.join(getProjectDataDir(cwd), "cache", "actionable-warning-state.json");
+  const statePath = path15.join(getProjectDataDir(cwd), "cache", "actionable-warning-state.json");
   try {
     return deserializeSuppressionState(fs12.readFileSync(statePath, "utf8"));
   } catch {
@@ -6957,8 +7182,8 @@ function readSuppressionState(cwd) {
   }
 }
 function updateWarningState(cwd, warnings) {
-  const statePath = path14.join(getProjectDataDir(cwd), "cache", "actionable-warning-state.json");
-  fs12.mkdirSync(path14.dirname(statePath), { recursive: true });
+  const statePath = path15.join(getProjectDataDir(cwd), "cache", "actionable-warning-state.json");
+  fs12.mkdirSync(path15.dirname(statePath), { recursive: true });
   const hook = beforeWarningStateLockForTests;
   beforeWarningStateLockForTests = null;
   hook?.();
@@ -7103,7 +7328,7 @@ function boundedNumber(value, fallback) {
   return value !== void 0 && Number.isFinite(value) && value > 0 ? value : fallback;
 }
 async function buildActionableWarningsReport(args) {
-  const cwd = path14.resolve(args.cwd);
+  const cwd = path15.resolve(args.cwd);
   const records = [...args.dispatchWarnings];
   const lspService = getLSPService();
   const observedAtByPath = /* @__PURE__ */ new Map();
@@ -7125,7 +7350,7 @@ async function buildActionableWarningsReport(args) {
     const eligible = [];
     let outsideRoot = 0;
     for (const file of args.files) {
-      const filePath = path14.resolve(cwd, file);
+      const filePath = path15.resolve(cwd, file);
       if (normalizeMapKey(filePath) === normalizeMapKey(cwd) || !isUnderDir(filePath, cwd)) {
         outsideRoot++;
         logActionableWarningsEvent({
@@ -7235,7 +7460,7 @@ async function buildActionableWarningsReport(args) {
           }
         };
         const deferredWork = (async () => {
-          await new Promise((resolve30) => setTimeout(resolve30, 0));
+          await new Promise((resolve32) => setTimeout(resolve32, 0));
           const deferredRecords = [...carried];
           const deferredDeadline = Date.now() + ACTIONABLE_WARNINGS_DEFERRED_BUDGET_MS;
           deferredDeps.deadlineAt = deferredDeadline;
@@ -7612,7 +7837,7 @@ function publishActionableWarningsReport(cacheManager2, cwd, report, opts = {})
     const reason = `${merged.droppedFiles.length} carried-forward entries: findings are LOST on this channel; ${cause} (files: ${merged.droppedFiles.slice(0, 3).join(", ")}${merged.droppedFiles.length > 3 ? ", ..." : ""})`;
     incrementDegradationCount({
       kind: "actionable-warnings-inband-superseded",
-      subject: `${path14.resolve(cwd)}:inband-carry-superseded`,
+      subject: `${path15.resolve(cwd)}:inband-carry-superseded`,
       reason
     });
     opts.dbg?.(`actionable_warnings: in-band publish dropped ${merged.droppedFiles.length} superseded carried-forward file entry/entries (${merged.droppedFiles.slice(0, 3).join(", ")}${merged.droppedFiles.length > 3 ? ", ..." : ""})`);
@@ -7664,7 +7889,7 @@ function writeDeferredActionableWarningsReport(args) {
   if (droppedFiles.length > 0) {
     incrementDegradationCount({
       kind: "actionable-warnings-deferred-superseded",
-      subject: `${path14.resolve(args.cwd)}:deferred-file-superseded`,
+      subject: `${path15.resolve(args.cwd)}:deferred-file-superseded`,
       reason: `${droppedFiles.length} changed file(s): warnings are LOST; unchanged files were merged into the persisted report (files: ${droppedFiles.slice(0, 3).join(", ")}${droppedFiles.length > 3 ? ", ..." : ""})`
     });
     args.dbg?.(`turn_end: deferred actionable-warnings dropped ${droppedFiles.length} superseded file entry/entries`);
@@ -7673,7 +7898,7 @@ function writeDeferredActionableWarningsReport(args) {
   return { mergedFiles, droppedFiles: droppedFiles.length };
 }
 function getActionableWarningsHistoryPath(cwd) {
-  return path14.join(getProjectDataDir(cwd), "actionable-warnings.jsonl");
+  return path15.join(getProjectDataDir(cwd), "actionable-warnings.jsonl");
 }
 function appendActionableWarningsHistory(cwd, report) {
   const entries = [];
@@ -7712,7 +7937,7 @@ function appendActionableWarningsHistory(cwd, report) {
     return;
   const historyPath = getActionableWarningsHistoryPath(cwd);
   try {
-    fs12.mkdirSync(path14.dirname(historyPath), { recursive: true });
+    fs12.mkdirSync(path15.dirname(historyPath), { recursive: true });
     fs12.appendFileSync(historyPath, `${entries.map((entry) => JSON.stringify(entry)).join("\n")}
 `, "utf8");
   } catch {
@@ -7751,7 +7976,7 @@ ${fileList}${more}` : void 0,
 
 // dist/clients/code-quality-warnings.js
 import * as fs13 from "node:fs";
-import * as path15 from "node:path";
+import * as path16 from "node:path";
 var TIER_BUDGET_ORDER = [
   "warning",
   "info",
@@ -7765,7 +7990,7 @@ function lineInModifiedRanges2(line, ranges) {
   return ranges.some((range) => line >= range.start - 2 && line <= range.end + 2);
 }
 function buildCodeQualityWarningsReport(args) {
-  const cwd = path15.resolve(args.cwd);
+  const cwd = path16.resolve(args.cwd);
   const maxWarnings = Math.max(1, args.maxWarnings ?? 50);
   const byId = /* @__PURE__ */ new Map();
   for (const warning of args.warnings) {
@@ -7829,7 +8054,7 @@ function writeCodeQualityWarningsReport(cacheManager2, cwd, report) {
   cacheManager2.writeCache("code-quality-warnings", report, cwd);
 }
 function getCodeQualityWarningsHistoryPath(cwd) {
-  return path15.join(getProjectDataDir(cwd), "code-quality-warnings.jsonl");
+  return path16.join(getProjectDataDir(cwd), "code-quality-warnings.jsonl");
 }
 function appendCodeQualityWarningsHistory(cwd, report) {
   const warnings = report.files.flatMap((file) => file.warnings.map((warning) => ({
@@ -7854,7 +8079,7 @@ function appendCodeQualityWarningsHistory(cwd, report) {
     return;
   const historyPath = getCodeQualityWarningsHistoryPath(cwd);
   try {
-    fs13.mkdirSync(path15.dirname(historyPath), { recursive: true });
+    fs13.mkdirSync(path16.dirname(historyPath), { recursive: true });
     fs13.appendFileSync(historyPath, `${warnings.map((entry) => JSON.stringify(entry)).join("\n")}
 `, "utf8");
   } catch {
@@ -7886,7 +8111,7 @@ function formatCodeQualityWarningsAdvisory(report, cwd, host = "pi") {
 }
 
 // dist/clients/git-guard.js
-import * as path16 from "node:path";
+import * as path17 from "node:path";
 
 // dist/clients/read-guard-tool-lines.js
 var MAX_FAILURE_TRACKER_SIZE = 200;
@@ -7961,7 +8186,7 @@ function readBytes(filePath) {
 
 // dist/clients/git-guard.js
 function resolveGuardPath(filePath, cwd) {
-  return path16.resolve(cwd, filePath);
+  return path17.resolve(cwd, filePath);
 }
 function guardPathKey(filePath, cwd) {
   return advisoryPathKey(filePath, cwd);
@@ -8084,7 +8309,9 @@ function resyncGitGuardAfterInlinePolicy(args) {
     return;
   args.runtime.updateGitGuardStatus(false, "");
 }
-function syncGitGuardRecord(runtime, cacheManager2, cwd, editedFilePath) {
+function syncGitGuardRecord(runtime, cacheManager2, cwd, editedFilePath, analysisRootMode = "session") {
+  if (!canWriteAnalysisRoot(analysisRootMode))
+    return;
   const entries = (runtime.getInlineBlockersSnapshot?.() ?? []).filter((entry) => !entry.policySuppressed);
   const inspection = cacheManager2.inspectCache("turn-end-findings", cwd);
   const existing = cacheRecord(cacheManager2, cwd);
@@ -8278,10 +8505,10 @@ function dedupeSecretFindings(findings) {
 }
 
 // dist/clients/project-diagnostics/runner-adapters/govulncheck.js
-import * as path17 from "node:path";
+import * as path18 from "node:path";
 function govulncheckFindingToProjectDiagnostic(cwd, finding) {
   const frame = finding.trace?.find((f) => f.filename);
-  const filePath = frame?.filename ? path17.isAbsolute(frame.filename) ? frame.filename : path17.resolve(cwd, frame.filename) : cwd;
+  const filePath = frame?.filename ? path18.isAbsolute(frame.filename) ? frame.filename : path18.resolve(cwd, frame.filename) : cwd;
   const fix = finding.fixedVersion ? ` (fixed in ${finding.fixedVersion})` : "";
   return {
     filePath,
@@ -8354,12 +8581,12 @@ var govulncheckLane = {
 };
 
 // dist/clients/project-diagnostics/runner-adapters/gitleaks.js
-import * as path18 from "node:path";
+import * as path19 from "node:path";
 function gitleaksFindingToProjectDiagnostic(cwd, finding) {
   const statusSuffix = finding.pathStatus ? ` [git: ${finding.pathStatus}]` : "";
   const isBlocking2 = finding.pathStatus !== "scratch" && finding.pathStatus !== "ignored" && finding.pathStatus !== "nested-repository";
   return {
-    filePath: path18.isAbsolute(finding.file) ? finding.file : path18.resolve(cwd, finding.file),
+    filePath: path19.isAbsolute(finding.file) ? finding.file : path19.resolve(cwd, finding.file),
     line: finding.startLine,
     severity: isBlocking2 ? "error" : "info",
     semantic: isBlocking2 ? "blocking" : "none",
@@ -8377,9 +8604,9 @@ function gitleaksResultToProjectDiagnostics(cwd, result) {
 }
 
 // dist/clients/project-diagnostics/runner-adapters/trivy.js
-import * as path19 from "node:path";
+import * as path20 from "node:path";
 function trivyFindingToProjectDiagnostic(cwd, finding) {
-  const filePath = finding.target ? path19.isAbsolute(finding.target) ? finding.target : path19.resolve(cwd, finding.target) : cwd;
+  const filePath = finding.target ? path20.isAbsolute(finding.target) ? finding.target : path20.resolve(cwd, finding.target) : cwd;
   const version = finding.installedVersion ? `@${finding.installedVersion}` : "";
   const fix = finding.fixedVersion ? ` (fixed in ${finding.fixedVersion})` : "";
   return {
@@ -8396,7 +8623,7 @@ function trivyFindingToProjectDiagnostic(cwd, finding) {
 }
 function trivySecretFindingToProjectDiagnostic(cwd, finding) {
   return {
-    filePath: path19.isAbsolute(finding.file) ? finding.file : path19.resolve(cwd, finding.file),
+    filePath: path20.isAbsolute(finding.file) ? finding.file : path20.resolve(cwd, finding.file),
     line: finding.line,
     severity: "error",
     semantic: "blocking",
@@ -8610,7 +8837,7 @@ function stillReportedParked(parked, current, keyOf, offeredKeys) {
 }
 
 // dist/clients/knip-scan-roots.js
-import { resolve as resolve11 } from "node:path";
+import { resolve as resolve13 } from "node:path";
 var MAX_KNIP_ROOTS_PER_TURN = 3;
 function resolveKnipScanRoots(sessionCwd, modifiedFiles) {
   const session = resolveGitCheckout(sessionCwd);
@@ -8620,7 +8847,7 @@ function resolveKnipScanRoots(sessionCwd, modifiedFiles) {
   let sessionOwnsEdit = false;
   const linked = [];
   for (const file of modifiedFiles) {
-    const owner = resolveLinkedWorktreeOwner(session, resolve11(sessionCwd, file));
+    const owner = resolveLinkedWorktreeOwner(session, resolve13(sessionCwd, file));
     if (owner === null) {
       sessionOwnsEdit = true;
     } else if (!linked.some((known) => pathsEqual(known.root, owner.root))) {
@@ -8636,7 +8863,7 @@ function resolveKnipScanRoots(sessionCwd, modifiedFiles) {
 }
 
 // dist/clients/project-diagnostics/runner-adapters/dead-code.js
-import * as path20 from "node:path";
+import * as path21 from "node:path";
 function deadCodeRunnerId(language) {
   return `dead-code-${language}`;
 }
@@ -8652,7 +8879,7 @@ function deadCodeMessage(issue) {
 function deadCodeIssueToProjectDiagnostic(cwd, issue, language) {
   const blocking = issue.category === "unlisted";
   return {
-    filePath: issue.file ? path20.isAbsolute(issue.file) ? issue.file : path20.resolve(cwd, issue.file) : cwd,
+    filePath: issue.file ? path21.isAbsolute(issue.file) ? issue.file : path21.resolve(cwd, issue.file) : cwd,
     line: issue.line,
     severity: blocking ? "error" : "warning",
     semantic: blocking ? "blocking" : "warning",
@@ -8676,11 +8903,11 @@ function deadCodeResultToProjectDiagnostics(cwd, result) {
 }
 
 // dist/clients/project-diagnostics/runner-adapters/knip.js
-import * as path21 from "node:path";
+import * as path22 from "node:path";
 function knipIssueFile(cwd, issue) {
   if (!issue.file)
     return cwd;
-  return path21.isAbsolute(issue.file) ? issue.file : path21.resolve(cwd, issue.file);
+  return path22.isAbsolute(issue.file) ? issue.file : path22.resolve(cwd, issue.file);
 }
 function knipIssueMessage(issue) {
   if (issue.type === "unlisted") {
@@ -9025,7 +9252,7 @@ async function runPersistentReverify(args) {
 
 // dist/clients/inline-blocker-dispositions.js
 import * as fs16 from "node:fs";
-import * as path22 from "node:path";
+import * as path23 from "node:path";
 function readCurrentContent(filePath) {
   try {
     return fs16.readFileSync(filePath, "utf-8");
@@ -9053,7 +9280,7 @@ function applyInlineBlockerPolicy(record, cwd) {
   }
   const byFile = /* @__PURE__ */ new Map();
   for (const diagnostic of diagnostics) {
-    const owner = path22.resolve(cwd, diagnostic.filePath);
+    const owner = path23.resolve(cwd, diagnostic.filePath);
     const group = byFile.get(owner);
     if (group)
       group.push(diagnostic);
@@ -9192,21 +9419,6 @@ var TEST_RUNNER_MAX_TARGETS = 12;
 var TURN_END_SELECTION_ROOT_ROWS = 8;
 var TEST_RUNNER_BATCH_BUDGET_MS = 2e4;
 var TEST_RUNNER_MAX_DEFERRALS = 2;
-var TEST_RUNNER_MAX_PERSISTED_TARGETS = 64;
-function deferralEntryKey(entry) {
-  return `${entry.sessionId ?? ""}\0${normalizeMapKey(path23.resolve(entry.testFile))}`;
-}
-function mergeDeferredTargets(existing, incoming) {
-  const byKey = /* @__PURE__ */ new Map();
-  for (const entry of [...existing, ...incoming]) {
-    const key = deferralEntryKey(entry);
-    const prior = byKey.get(key);
-    if (prior && (prior.attempts ?? 0) >= (entry.attempts ?? 0))
-      continue;
-    byKey.set(key, entry);
-  }
-  return [...byKey.values()];
-}
 async function runTestTargetsBounded(args) {
   const results = [];
   if (args.targets.length === 0)
@@ -9249,7 +9461,7 @@ async function runTestTargetsBounded(args) {
   });
   void pool.catch(() => {
   });
-  await new Promise((resolve30) => {
+  await new Promise((resolve32) => {
     let settled = false;
     const finish = (reason) => {
       if (settled)
@@ -9261,7 +9473,7 @@ async function runTestTargetsBounded(args) {
       batchAbort.abort();
       clearTimeout(timer);
       args.signal?.removeEventListener("abort", onAbort);
-      resolve30();
+      resolve32();
     };
     const onAbort = () => finish("abort");
     const timer = setTimeout(() => finish("budget"), budgetMs);
@@ -9495,22 +9707,26 @@ async function handleTurnEnd(deps) {
       dbg(`turn_end: retaining newer turn state (dispatch=${turnIndexAtDispatch}, current=${runtime.turnIndex})`);
       return;
     }
-    cacheManager2.clearTurnState(cwd, currentOwner);
+    cacheManager2.clearTurnState(cwd, currentOwner, isSecondarySession ? sessionId : void 0);
   };
   void updateHeartbeat().catch(() => {
   });
   const cwd = ctxCwd ?? process.cwd();
-  let turnState = cacheManager2.readTurnState(cwd);
+  const isSecondarySession = deps.sessionScope?.role === "secondary";
+  const sessionRole = isSecondarySession ? "secondary" : "primary";
+  const allowProjectWideFindings = admitsProjectWideFindings(sessionRole);
+  const turnStateSessionId = isSecondarySession ? sessionId : void 0;
+  let turnState = cacheManager2.readTurnState(cwd, turnStateSessionId);
   const currentOwner = {
     ...owner ?? {
       kind: "pi",
-      id: runtime.telemetrySessionId,
+      id: sessionId ?? runtime.telemetrySessionId,
       pid: process.pid,
       lastSeen: (/* @__PURE__ */ new Date()).toISOString()
     },
     sessionStartedAt: owner?.sessionStartedAt ?? runtime.sessionStartedAt
   };
-  const access = cacheManager2.getTurnStateAccess(cwd, currentOwner);
+  const access = isSecondarySession ? "owned" : cacheManager2.getTurnStateAccess(cwd, currentOwner);
   const gateOwnerLabel = turnState.owner ? `${turnState.owner.kind}:${turnState.owner.id}` : turnState.sessionId ? `legacy:${turnState.sessionId}` : "none";
   const sameProcessPiSessionHandoff = access === "foreign-live" && currentOwner.kind === "pi" && turnState.owner?.kind === "pi" && turnState.owner.pid === process.pid && turnState.owner.id !== currentOwner.id;
   if (access === "foreign-live" && !sameProcessPiSessionHandoff) {
@@ -9520,9 +9736,10 @@ async function handleTurnEnd(deps) {
   if (access === "available" && (turnState.files || turnState.owner || turnState.sessionId)) {
     dbg("turn_end: evicting stale turn-state owner");
     clearOwnedTurnState();
-    turnState = cacheManager2.readTurnState(cwd);
+    turnState = cacheManager2.readTurnState(cwd, turnStateSessionId);
   }
-  const files = Object.keys(turnState.files);
+  const ownFiles = Object.keys(turnState.files);
+  const files = ownFiles;
   let widgetDemotedFindingsRetired = 0;
   for (const wPath of drainRenderedDependencyDriftFilePaths()) {
     const deliveryCount = incrementWidgetDependencyDriftDelivery(wPath);
@@ -9538,7 +9755,7 @@ async function handleTurnEnd(deps) {
       }
     }
   }
-  if (files.length === 0 && !runtime.hasCascadeRuns()) {
+  if (files.length === 0 && !runtime.hasCascadeRuns() && !isSecondarySession) {
     if (getFlag("lens-guard") && !runtime.gitGuardHasBlockers) {
       const guardRecord = cacheManager2.readCache("turn-end-findings", cwd)?.data;
       if (guardRecord?.sessionId === runtime.telemetrySessionId && guardRecord.testFailures !== true) {
@@ -9570,7 +9787,7 @@ async function handleTurnEnd(deps) {
     dbg("turn_end: cancelled pending LSP idle reset (active editing)");
   }
   dbg(`turn_end: ${files.length} file(s) modified, cycles: ${turnState.turnCycles}/${turnState.maxCycles}, access: ${access}, owner: ${gateOwnerLabel}`);
-  if (cacheManager2.isMaxCyclesExceeded(cwd)) {
+  if (cacheManager2.isMaxCyclesExceeded(cwd, turnStateSessionId)) {
     dbg("turn_end: max cycles exceeded, clearing state and forcing through");
     clearOwnedTurnState();
     runtime.fixedThisTurn.clear();
@@ -9613,7 +9830,14 @@ async function handleTurnEnd(deps) {
   const projectDiagnosticsDelta = [];
   const projectDiagnosticsSources = /* @__PURE__ */ new Set();
   const runnerFindingsStart = Date.now();
-  const pendingRunnerFindings = await drainPendingRunnerFindings(0);
+  const runnerDrainSignal = deps.signal;
+  const deliverySessionId = sessionId ?? runtime.telemetrySessionId;
+  const pendingRunnerFindings = await bounded(drainPendingRunnerFindings(0, runtime.sessionScope.capture(), deliverySessionId), {
+    ms: HOOK_WALL_BUDGET_MS.turn_end,
+    signal: runnerDrainSignal,
+    hook: "turn_end",
+    label: "drainPendingRunnerFindings"
+  }) ?? [];
   let runnerFindingsDelivered = 0;
   let runnerFindingsStale = 0;
   let runnerFindingsFailed = 0;
@@ -9838,7 +10062,16 @@ ${policy.body}`);
     });
   }
   const cascadeSettleStart = Date.now();
-  const { settled, timedOut } = await runtime.settleCascadeRuns(cascadeSettleWaitMs(), { trackTurnEndClock: true, generation: holdScope });
+  const cascadeSettleSignal = deps.signal;
+  const { settled, timedOut } = await bounded(runtime.settleCascadeRuns(cascadeSettleWaitMs(), {
+    trackTurnEndClock: true,
+    generation: holdScope
+  }), {
+    ms: HOOK_WALL_BUDGET_MS.turn_end,
+    signal: cascadeSettleSignal,
+    hook: "turn_end",
+    label: "settleCascadeRuns"
+  }) ?? { settled: 0, timedOut: 0 };
   logLatency({
     type: "phase",
     toolName: "turn_end",
@@ -9855,11 +10088,11 @@ ${policy.body}`);
       const changedSince = runtime.getFilesChangedSince(originSeq);
       if (changedSince.length > 0) {
         const changedSet = new Set(changedSince);
-        const primaryKey = normalizeMapKey(path23.resolve(run.filePath));
+        const primaryKey = normalizeMapKey(path24.resolve(run.filePath));
         const neighborKeys = [
           ...(run.result?.neighbors ?? []).map((n) => n.filePath),
           ...run.selectedNeighborPaths ?? []
-        ].map((filePath) => normalizeMapKey(path23.resolve(filePath)));
+        ].map((filePath) => normalizeMapKey(path24.resolve(filePath)));
         const supersededByOwnFile = changedSet.has(primaryKey) || neighborKeys.some((k) => changedSet.has(k));
         if (supersededByOwnFile) {
           logCascade({
@@ -10565,15 +10798,15 @@ ${suffix}`;
   const govGate = scannerGates.govulncheck;
   const gitleaksGate = scannerGates.gitleaks;
   const trivySecretsGate = scannerGates["trivy-secrets"];
-  const govDelivery = govulncheckLane.render(govulncheckLane.gate({ govulncheck: govGate }, laneCtx), laneCtx);
+  const govDelivery = allowProjectWideFindings ? govulncheckLane.render(govulncheckLane.gate({ govulncheck: govGate }, laneCtx), laneCtx) : {};
   for (const [store, count] of Object.entries(govDelivery.dispositionSuppressed ?? {})) {
     recordDispositionSuppressed(store, count);
   }
   advisoryParts.push(...govDelivery.advisoryParts ?? []);
-  const secretsDelivery = secretsLane.render(secretsLane.gate({
+  const secretsDelivery = allowProjectWideFindings ? secretsLane.render(secretsLane.gate({
     gitleaks: gitleaksGate,
     "trivy-secrets": trivySecretsGate
-  }, laneCtx), laneCtx);
+  }, laneCtx), laneCtx) : {};
   for (const [store, count] of Object.entries(secretsDelivery.dispositionSuppressed ?? {})) {
     recordDispositionSuppressed(store, count);
   }
@@ -10640,16 +10873,22 @@ ${suffix}`;
   }
   const t3 = Date.now();
   let madgeStats;
-  if (getFlag("lens-turn-end-madge") && await depChecker.ensureAvailable()) {
-    const madgeFiles = cacheManager2.getFilesForMadge(cwd);
+  const madgeAvailabilitySignal = deps.signal;
+  if (getFlag("lens-turn-end-madge") && await bounded(depChecker.ensureAvailable(), {
+    ms: HOOK_WALL_BUDGET_MS.turn_end,
+    signal: madgeAvailabilitySignal,
+    hook: "turn_end",
+    label: "madge.ensureAvailable"
+  })) {
+    const madgeFiles = cacheManager2.getFilesForMadge(cwd, turnStateSessionId);
     if (madgeFiles.length > 0) {
       dbg(`turn_end: madge checking ${madgeFiles.length} file(s) for circular deps`);
-      const absFiles = madgeFiles.map((file) => path23.resolve(cwd, file));
+      const absFiles = madgeFiles.map((file) => path24.resolve(cwd, file));
       const batch = await depChecker.checkFilesBatch(absFiles, cwd);
       const depResults = batch.results;
       madgeStats = batch.stats;
       for (const file of madgeFiles) {
-        const absPath = path23.resolve(cwd, file);
+        const absPath = path24.resolve(cwd, file);
         const depResult = depResults.get(absPath);
         if (!depResult)
           continue;
@@ -10685,7 +10924,7 @@ ${suffix}`;
     }
     for (const result of cascadeResults) {
       for (const neighbor of result.neighbors) {
-        const abs = path23.isAbsolute(neighbor.filePath) ? neighbor.filePath : resolveRunnerPath(cwd, neighbor.filePath);
+        const abs = path24.isAbsolute(neighbor.filePath) ? neighbor.filePath : resolveRunnerPath(cwd, neighbor.filePath);
         const key = normalizeMapKey(abs);
         if (seenCandidateKeys.has(key))
           continue;
@@ -10697,20 +10936,17 @@ ${suffix}`;
     const carriedDeferred = priorTestCache?.deferredTargets ?? [];
     const turnSessionId = sessionId ?? runtime.telemetrySessionId;
     const isThisSession = (entry) => entry.sessionId === turnSessionId;
-    const entryPathKey = (entry) => normalizeMapKey(path23.resolve(cwd, entry.testFile));
+    const entryPathKey = (entry) => normalizeMapKey(path24.resolve(cwd, entry.testFile));
     const retiredCarry = (priorTestCache?.retiredTargets ?? []).filter(isThisSession);
     const retiredKeys = new Set(retiredCarry.map(entryPathKey));
     const resolvedDeferralKeys = /* @__PURE__ */ new Set();
     const heldDeferred = [];
     const boundPersisted = (entries, label) => {
-      const ordered = [
-        ...entries.filter((entry) => !isThisSession(entry)),
-        ...entries.filter(isThisSession)
-      ];
-      if (ordered.length <= TEST_RUNNER_MAX_PERSISTED_TARGETS)
-        return ordered;
-      dbg(`turn_end: ${label} test target list held ${ordered.length} entries, bounded to the newest ${TEST_RUNNER_MAX_PERSISTED_TARGETS} (oldest foreign-session rows dropped)`);
-      return ordered.slice(-TEST_RUNNER_MAX_PERSISTED_TARGETS);
+      const bounded2 = boundDeferredTargets(entries, TEST_RUNNER_MAX_PERSISTED_TARGETS, isThisSession);
+      if (bounded2.length !== entries.length) {
+        dbg(`turn_end: ${label} test target list held ${entries.length} entries, bounded to the newest ${TEST_RUNNER_MAX_PERSISTED_TARGETS} (oldest foreign-session rows dropped)`);
+      }
+      return bounded2;
     };
     const writeTestFindings = (record, ownDeferred) => {
       const live = cacheManager2.readCache("test-runner-findings", cwd)?.data;
@@ -10734,7 +10970,7 @@ ${suffix}`;
     let redispatchedDeferred = 0;
     let retiredThisTurn = 0;
     for (const carried of carriedDeferred) {
-      const testFile = path23.resolve(cwd, carried.testFile);
+      const testFile = path24.resolve(cwd, carried.testFile);
       const carriedKey = normalizeMapKey(testFile);
       if (!isThisSession(carried)) {
         foreignDeferred++;
@@ -10759,9 +10995,9 @@ ${suffix}`;
           incrementDegradationCount({
             kind: "test-runner-batch-capped",
             subject: `${cwd}:deferral-exhausted`,
-            reason: `test target was cut after ${attempts} turn(s) at the turn-end budget and is retired for this session \u2014 too slow for a per-turn batch; run it explicitly (target: ${path23.relative(cwd, testFile)})`
+            reason: `test target was cut after ${attempts} turn(s) at the turn-end budget and is retired for this session \u2014 too slow for a per-turn batch; run it explicitly (target: ${path24.relative(cwd, testFile)})`
           });
-          dbg(`turn_end: retiring deferred test target ${path23.relative(cwd, testFile)} after ${attempts} cut batch(es) \u2014 too slow for the turn-end budget, run it explicitly`);
+          dbg(`turn_end: retiring deferred test target ${path24.relative(cwd, testFile)} after ${attempts} cut batch(es) \u2014 too slow for the turn-end budget, run it explicitly`);
         }
         continue;
       }
@@ -10795,7 +11031,7 @@ ${suffix}`;
         testRoot: carriedRoot,
         deferralAttempts: attempts
       });
-      dbg(`turn_end: re-running deferred test target ${path23.relative(cwd, testFile)} (${carried.runner}) from the previous turn's cut batch`);
+      dbg(`turn_end: re-running deferred test target ${path24.relative(cwd, testFile)} (${carried.runner}) from the previous turn's cut batch`);
     }
     if (deadDeferred > 0) {
       dbg(`turn_end: dropped ${deadDeferred} deferred test target(s) that no longer resolve (missing file, excluded, or unknown runner)`);
@@ -10839,17 +11075,17 @@ ${suffix}`;
         seen.add(targetKey);
         if (retiredKeys.has(targetKey)) {
           retiredSkips++;
-          dbg(`turn_end: ${display} \u2192 test target retired earlier this session (outran the turn-end batch budget), skipping spawn (${path23.relative(cwd, target.testFile)})`);
+          dbg(`turn_end: ${display} \u2192 test target retired earlier this session (outran the turn-end batch budget), skipping spawn (${path24.relative(cwd, target.testFile)})`);
           continue;
         }
         if (isExcludedTestTarget(target.testFile, testRoot)) {
           excludedTargets++;
-          dbg(`turn_end: ${display} \u2192 test target excluded by the built-in turn-end policy, skipping spawn (${path23.relative(cwd, target.testFile)})`);
+          dbg(`turn_end: ${display} \u2192 test target excluded by the built-in turn-end policy, skipping spawn (${path24.relative(cwd, target.testFile)})`);
           continue;
         }
         if (!fs17.existsSync(target.testFile)) {
           missingTargetFiles++;
-          dbg(`turn_end: ${display} \u2192 test file missing, skipping spawn (${path23.relative(cwd, target.testFile)})`);
+          dbg(`turn_end: ${display} \u2192 test file missing, skipping spawn (${path24.relative(cwd, target.testFile)})`);
           continue;
         }
         if (targets.length >= TEST_RUNNER_MAX_TARGETS) {
@@ -10857,7 +11093,7 @@ ${suffix}`;
           continue;
         }
         targets.push({ ...target, sourceFile: abs, testRoot });
-        dbg(`turn_end: ${display} \u2192 test ${target.runner} ${path23.relative(cwd, target.testFile)} (${target.strategy}${isNeighbor ? ", cascade-neighbor" : ""})`);
+        dbg(`turn_end: ${display} \u2192 test ${target.runner} ${path24.relative(cwd, target.testFile)} (${target.strategy}${isNeighbor ? ", cascade-neighbor" : ""})`);
       } else if (!target) {
         noTestFile++;
         dbg(`turn_end: ${display} \u2192 no test file found${isNeighbor ? " (cascade-neighbor)" : ""}`);
@@ -10989,6 +11225,7 @@ ${suffix}`;
             {
               file: result.value.file,
               sourceFile: target.sourceFile,
+              runner: target.runner,
               fileSeq: target.fileSeqAtRun === void 0 ? {
                 state: "unknown",
                 reason: "sequence-unavailable"
@@ -11020,7 +11257,7 @@ ${suffix}`;
           });
           dbg(`turn_end: test batch stopped early (${stopReason ?? "incomplete"}), ${deferred.length} target(s) deferred to the next turn`);
         }
-        const deferralNote = deferred.length > 0 ? `${deferred.length} test target(s) did not finish within the turn-end batch budget and are deferred to the next turn (they run first): ${deferredTargets.map((t) => path23.relative(cwd, t.testFile)).join(", ")}` : "";
+        const deferralNote = deferred.length > 0 ? `${deferred.length} test target(s) did not finish within the turn-end batch budget and are deferred to the next turn (they run first): ${deferredTargets.map((t) => path24.relative(cwd, t.testFile)).join(", ")}` : "";
         const supersededByNewerGeneration = (label) => {
           const current = cacheManager2.readCache("test-runner-findings", cwd)?.data;
           const currentGeneration = current?.testRunGeneration;
@@ -11072,7 +11309,7 @@ ${suffix}`;
           const { file, runner, passed, failed, duration, error } = r.value;
           if (failed > 0)
             hasRealFailure = true;
-          const shortFile = path23.basename(file);
+          const shortFile = path24.basename(file);
           const elapsed = formatRunDurationMs(duration);
           const verdict = failed > 0 ? "FAIL" : "PASS";
           const summary = isRunnerErrorResult(r.value) ? passed > 0 ? `error: ${error} (${passed} passed before)` : `error: ${error}` : `${verdict} ${passed}p/${failed}f (${elapsed})`;
@@ -11236,8 +11473,8 @@ ${suffix}`;
     } else {
       const callGraphStart = Date.now();
       try {
-        const { impact, formatImpact, parseSymbolKey } = await import("../chunk-FJNKANOS.js");
-        const { callGraphImpactToProjectDiagnostics } = await import("../chunk-47D2BO4S.js");
+        const { impact, formatImpact, parseSymbolKey } = await import("../chunk-BKE7E7TC.js");
+        const { callGraphImpactToProjectDiagnostics } = await import("../chunk-6GFRNVYR.js");
         const impactLines = [];
         let callGraphDispositionSuppressed = 0;
         const impactFindings = [];
@@ -11544,13 +11781,17 @@ ${impactLines.join("\n")}`;
       }
     });
   }
-  cacheManager2.incrementTurnCycle(cwd, currentOwner);
+  cacheManager2.incrementTurnCycle(cwd, currentOwner, turnStateSessionId);
   const lateAuxStart = Date.now();
-  const { drainedPairs, lateAuxCapEvicted } = holdScope.guardedWrite("turn-end:late-aux", () => ({
+  const lateAuxDrain = isSecondarySession ? {
+    drainedPairs: drainPendingAuxiliaryCoverage(),
+    lateAuxCapEvicted: drainPendingAuxCapEvictedCount()
+  } : holdScope.guardedWrite("turn-end:late-aux", () => ({
     drainedPairs: drainPendingAuxiliaryCoverage(),
     lateAuxCapEvicted: drainPendingAuxCapEvictedCount()
   })) ?? { drainedPairs: [], lateAuxCapEvicted: 0 };
-  const rearmLateAux = (pair) => holdScope.guardedWrite(
+  const { drainedPairs, lateAuxCapEvicted } = lateAuxDrain;
+  const rearmLateAux = (pair) => isSecondarySession ? (rearmPendingAuxiliaryCoverage(pair), true) : holdScope.guardedWrite(
     // One subject for the store (#4168 F3): the row's count carries how many.
     "turn-end:late-aux-rearm",
     () => {
@@ -11830,7 +12071,7 @@ ${lines.join("\n")}`;
       }
     });
   }
-  const unresolvedKeys = new Set(unresolvedBlockers.map((record) => normalizeMapKey(path23.resolve(record.filePath))));
+  const unresolvedKeys = new Set(unresolvedBlockers.map((record) => normalizeMapKey(path24.resolve(record.filePath))));
   const formatResolvedTail = (dropped) => `\u2026 and ${dropped} more`;
   const resolvedTailMax = formatResolvedTail(Number.MAX_SAFE_INTEGER).length;
   const resolvedShareChars = Math.floor(RUNTIME_CONFIG.turnEnd.maxChars * RESOLVED_SHARE_OF_CHARS) - resolvedTailMax;
@@ -11855,7 +12096,7 @@ ${lines.join("\n")}`;
   let resolvedChars = 0;
   let resolvedCount = 0;
   const { files: resolvedBlockerFileList, dropped: resolvedBlockerFilesDropped } = runtime.consumeResolvedBlockerFiles((entry) => {
-    if (unresolvedKeys.has(normalizeMapKey(path23.resolve(entry.filePath))))
+    if (unresolvedKeys.has(normalizeMapKey(path24.resolve(entry.filePath))))
       return true;
     const cost = formatResolvedLine(entry).length + 1;
     if (resolvedCount > 0 && (resolvedCount >= resolvedLineBudget || resolvedChars + cost > resolvedCharBudget))
@@ -11951,7 +12192,7 @@ ${raw}`
             projectSeqStart: runtime.turnStartProjectSeq,
             projectSeqEnd: runtime.projectSeq,
             fileSeqByPath: Object.fromEntries(runtime.getFileSeqEntries().map(([filePath, seq]) => [
-              normalizeMapKey(path23.resolve(filePath)),
+              normalizeMapKey(path24.resolve(filePath)),
               seq
             ])),
             fileContentHashes: {},
@@ -11968,7 +12209,7 @@ ${raw}`
     settleHolds(false);
     const fileSeqByPath2 = {};
     for (const [filePath, seq] of runtime.getFileSeqEntries()) {
-      fileSeqByPath2[normalizeMapKey(path23.resolve(filePath))] = seq;
+      fileSeqByPath2[normalizeMapKey(path24.resolve(filePath))] = seq;
     }
     if (getFlag("lens-guard")) {
       const existingGuard = cacheManager2.readCache("turn-end-findings", cwd)?.data;
@@ -12186,10 +12427,10 @@ var TurnEndQueue = class {
     if (this.pending.length >= 1) {
       return Promise.reject(new Error("turn_end queue is busy"));
     }
-    return new Promise((resolve30, reject) => {
+    return new Promise((resolve32, reject) => {
       const item = {
         work,
-        resolve: resolve30,
+        resolve: resolve32,
         reject,
         timer: setTimeout(() => {
           const index = this.pending.indexOf(item);
@@ -12233,7 +12474,7 @@ async function runTurnEndNowImpl(cwd, files = [], deferredDelivery = false) {
   const host = createMcpHost(void 0, cwd);
   let registered = 0;
   for (const file of files) {
-    const abs = path24.isAbsolute(file) ? file : path24.resolve(cwd, file);
+    const abs = path25.isAbsolute(file) ? file : path25.resolve(cwd, file);
     let lineCount3 = 1;
     try {
       lineCount3 = fs18.readFileSync(abs, "utf8").split("\n").length;
@@ -12377,7 +12618,7 @@ function acknowledgeTurnEnd(cwd, deliveryId) {
 
 // dist/clients/module-report.js
 import * as fs19 from "node:fs";
-import * as path25 from "node:path";
+import * as path26 from "node:path";
 
 // dist/clients/middle-man-analysis.js
 var SELF_TOKEN = {
@@ -12926,7 +13167,7 @@ function blastReadArgs(graph, normalizedFile) {
   return { path: normalizedFile, offset: 1, limit };
 }
 async function computeBlastRadius(graph, normalizedPath, projectRoot, maxDepth) {
-  const { computeTransitiveImpact } = await import("../chunk-34U7PLGE.js");
+  const { computeTransitiveImpact } = await import("../chunk-4UNXBNE2.js");
   const result = computeTransitiveImpact(graph, normalizedPath, { maxDepth });
   const byFile = /* @__PURE__ */ new Map();
   for (const hit of result.hits) {
@@ -13516,7 +13757,7 @@ async function moduleReport(file, cwd, options) {
   const startedAt = Date.now();
   const maxRefs = normalizeMaxRefsPerSymbol(options?.maxRefsPerSymbol);
   const maxCallGraphEntries = Math.min(CALL_GRAPH_MAX_ENTRY_CAP, Math.max(1, Math.floor(options?.maxCallGraphEntries ?? CALL_GRAPH_DEFAULT_ENTRY_CAP)));
-  const absPath = path25.resolve(cwd, file);
+  const absPath = path26.resolve(cwd, file);
   const normalizedPath = normalizeMapKey(absPath);
   let content;
   try {
@@ -13543,7 +13784,7 @@ async function moduleReport(file, cwd, options) {
   let callGraphIdentity;
   let revisionDriftNote;
   try {
-    const { getCachedReviewGraph, getReviewGraphCacheIdentity, getReviewGraphSizeSkipVerdict, getReviewGraphRevisionDrift, formatReviewGraphRevisionDriftNote: formatReviewGraphRevisionDriftNote2 } = await import("../chunk-VD4JQCQC.js");
+    const { getCachedReviewGraph, getReviewGraphCacheIdentity, getReviewGraphSizeSkipVerdict, getReviewGraphRevisionDrift, formatReviewGraphRevisionDriftNote: formatReviewGraphRevisionDriftNote2 } = await import("../chunk-2ZGIZPDG.js");
     graph = getCachedReviewGraph(cwd);
     graphFileCap = getReviewGraphSizeSkipVerdict(cwd)?.maxFileCount;
     const drift = graph ? getReviewGraphRevisionDrift(cwd) : void 0;
@@ -13833,7 +14074,7 @@ function suggestSimilarNames(candidates, target) {
 async function readSymbol(file, symbolName, cwd, options = {}) {
   const { kind: symbolKindFilter } = options;
   const startedAt = Date.now();
-  const absPath = path25.resolve(cwd, file);
+  const absPath = path26.resolve(cwd, file);
   const log = (found) => {
     logLatency({
       type: "phase",
@@ -14008,7 +14249,7 @@ function enclosingOutline(selected, symbols, callbacks, filters, filePath) {
 }
 async function readEnclosing(file, line, cwd, options) {
   const startedAt = Date.now();
-  const absPath = path25.resolve(cwd, file);
+  const absPath = path26.resolve(cwd, file);
   const targetLine = Math.max(1, Math.floor(line));
   const log = (found) => {
     logLatency({
@@ -14184,7 +14425,7 @@ async function readEnclosing(file, line, cwd, options) {
 }
 
 // dist/clients/project-report.js
-import * as path26 from "node:path";
+import * as path27 from "node:path";
 var DEFAULT_LIMIT = 10;
 var STALE_THRESHOLD_MS = 15 * 6e4;
 var LOW_COVERAGE_THRESHOLD = 0.8;
@@ -14327,7 +14568,7 @@ function roleFor(graph, filePath) {
   return top.length > 0 ? top.map((s) => s.name).join(", ") : void 0;
 }
 async function computeHubs(graph, degrees, cwd, limit, focusTerms) {
-  const { computeTransitiveImpact } = await import("../chunk-34U7PLGE.js");
+  const { computeTransitiveImpact } = await import("../chunk-4UNXBNE2.js");
   const ranked = [...graph.fileNodes.entries()].map(([filePath, fileNodeId]) => ({
     filePath,
     fileNodeId,
@@ -14565,7 +14806,7 @@ function computeDeadWeight(graph, degrees, entryPointFiles, cwd, limit) {
 }
 var inFlightGraphBuilds = /* @__PURE__ */ new Set();
 function triggerBackgroundGraphBuild(cwd, deps) {
-  const key = normalizeMapKey(path26.resolve(cwd));
+  const key = normalizeMapKey(path27.resolve(cwd));
   if (inFlightGraphBuilds.has(key))
     return "already_running";
   const deduped = deps.isGraphBuildInFlight(key, []);
@@ -14579,7 +14820,7 @@ async function projectReport(cwd, options) {
   const limit = clampLimit(options?.limit);
   const focusTerms = normalizeFocus2(options?.focus);
   const view = options?.view;
-  const { getCachedReviewGraph, getReviewGraphSizeSkipVerdict, getLastReviewGraphBuildAttempt, buildOrUpdateGraph, isGraphBuildInFlight, getReviewGraphRevisionDrift } = await import("../chunk-VD4JQCQC.js");
+  const { getCachedReviewGraph, getReviewGraphSizeSkipVerdict, getLastReviewGraphBuildAttempt, buildOrUpdateGraph, isGraphBuildInFlight, getReviewGraphRevisionDrift } = await import("../chunk-2ZGIZPDG.js");
   let graph;
   try {
     graph = getCachedReviewGraph(cwd);
@@ -14603,7 +14844,7 @@ async function projectReport(cwd, options) {
       };
     }
     const previousAttempt = getLastReviewGraphBuildAttempt(cwd);
-    const { FactStore: FactStore2 } = await import("../chunk-YSNFMJKN.js");
+    const { FactStore: FactStore2 } = await import("../chunk-QGQ5CCCG.js");
     const trigger = triggerBackgroundGraphBuild(cwd, {
       buildOrUpdateGraph,
       isGraphBuildInFlight,
@@ -14705,7 +14946,7 @@ function renderCompactProjectReport(report) {
 
 // dist/clients/effective-config.js
 import * as os3 from "node:os";
-import * as path27 from "node:path";
+import * as path28 from "node:path";
 function isEffectiveFileViewError(file) {
   return "error" in file;
 }
@@ -14779,10 +15020,10 @@ async function effectiveConfig(options = {}) {
     globalConfigPath: getPiLensGlobalConfigPath(),
     homeDir
   });
-  const requestedFile = options.file === void 0 ? void 0 : path27.resolve(cwd, options.file);
+  const requestedFile = options.file === void 0 ? void 0 : path28.resolve(cwd, options.file);
   const fileOutsideCwd = requestedFile !== void 0 && !isSameOrWithin(cwd, requestedFile);
   const absolute = fileOutsideCwd ? void 0 : requestedFile;
-  const resolution = resolveAt(absolute === void 0 ? cwd : path27.dirname(absolute));
+  const resolution = resolveAt(absolute === void 0 ? cwd : path28.dirname(absolute));
   const resolved = {
     value: resolution.value,
     provenance: resolution.provenance
@@ -14816,7 +15057,7 @@ async function effectiveConfig(options = {}) {
         // `{ absolute, lspConfig }` struct (#2520): `absolute` is already
         // this branch's narrowed local, so the struct's own field was
         // carrying the same fact twice.
-        registerLSPConfig(lspConfigOf(resolution.value))
+        registerLSPConfig(lspConfigOf(resolution.value, void 0, resolution.provenance))
       )
     }
   };
@@ -14944,10 +15185,10 @@ function symbolSearchFileMatchesLang(file, lang) {
   const exts = extensionsForLanguageToken(lang);
   if (exts.length === 0)
     return false;
-  return exts.includes(path28.extname(file).toLowerCase());
+  return exts.includes(path29.extname(file).toLowerCase());
 }
 function fileMatchesPathGlobs(file, cwd, globs) {
-  const rel = path28.relative(cwd, file).split(path28.sep).join("/");
+  const rel = path29.relative(cwd, file).split(path29.sep).join("/");
   const options = { dot: true, nocase: process.platform === "win32" };
   return globs.some((raw) => {
     const pattern = raw.split("\\").join("/");
@@ -14969,7 +15210,7 @@ function buildSymbolSearchFileFilter(cwd, options) {
 }
 function annotateSymbolSearchHitsWithGraph(hits, centrality, graph) {
   for (const hit of hits) {
-    const normalized = normalizeMapKey(path28.resolve(hit.file));
+    const normalized = normalizeMapKey(path29.resolve(hit.file));
     const fanIn = centrality.get(hit.file) ?? 0;
     let complexity;
     for (const symbolId of graph.symbolNodesByFile.get(normalized) ?? []) {
@@ -15015,14 +15256,14 @@ async function symbolSearch(query, cwd, limit = 20, options = {}) {
   let centrality;
   let results;
   try {
-    centrality = centralityFromReverseDeps(index, snapshot?.reverseDeps, (file) => normalizeMapKey(path28.resolve(file)));
+    centrality = centralityFromReverseDeps(index, snapshot?.reverseDeps, (file) => normalizeMapKey(path29.resolve(file)));
     const fileFilter = buildSymbolSearchFileFilter(cwd, options);
     results = searchWordIndex(index, query, { limit, centrality, fileFilter });
   } finally {
     warmLease.release();
   }
   const hits = results.map(toSymbolSearchHit);
-  const { getCachedReviewGraph } = await import("../chunk-VD4JQCQC.js");
+  const { getCachedReviewGraph } = await import("../chunk-2ZGIZPDG.js");
   const graph = getCachedReviewGraph(cwd);
   if (graph)
     annotateSymbolSearchHitsWithGraph(hits, centrality, graph);
@@ -15039,10 +15280,10 @@ async function symbolSearch(query, cwd, limit = 20, options = {}) {
 import { Type } from "typebox";
 
 // dist/clients/ast-grep-tool-logger.js
-import * as path29 from "node:path";
+import * as path30 from "node:path";
 var AG_LOG_DIR = getGlobalPiLensLogDir();
-var AG_LOG_FILE = path29.join(AG_LOG_DIR, "ast-grep-tools.log");
-var AG_LOG_BACKUP_FILE = path29.join(AG_LOG_DIR, "ast-grep-tools.log.1");
+var AG_LOG_FILE = path30.join(AG_LOG_DIR, "ast-grep-tools.log");
+var AG_LOG_BACKUP_FILE = path30.join(AG_LOG_DIR, "ast-grep-tools.log.1");
 var MAX_LOG_BYTES3 = Math.max(128 * 1024, Number.parseInt(process.env.PI_LENS_AST_GREP_LOG_MAX_BYTES ?? "1048576", 10) || 1048576);
 var writer3 = createNdjsonLogger({
   filePath: AG_LOG_FILE,
@@ -15219,6 +15460,11 @@ function canonicalLanguage(lang) {
 }
 
 // dist/tools/shared.js
+function resolveAstGrepPaths(paths, cwd) {
+  const base = cwd || ".";
+  const requested = paths?.length ? paths : [base];
+  return requested.map((p) => resolveHostToolPath(p, base));
+}
 var LANGUAGES = [
   "bash",
   "c",
@@ -15355,7 +15601,7 @@ function createAstGrepReplaceTool(astGrepClient2, captureLineage) {
           details: {}
         };
       }
-      const searchPaths = paths?.length ? paths : [ctx.cwd || "."];
+      const searchPaths = resolveAstGrepPaths(paths, ctx.cwd);
       if (hasStructuralIntent({
         insideKind,
         hasKind,
@@ -15388,7 +15634,7 @@ function createAstGrepReplaceTool(astGrepClient2, captureLineage) {
             details: {}
           };
         }
-        const ruleResult = await astGrepClient2.replaceWithRule(ruleYaml, searchPaths, applyFlag);
+        const ruleResult = await astGrepClient2.replaceWithRule(ruleYaml, searchPaths, applyFlag, { lineage, toolCallId: _toolCallId });
         if (ruleResult.stalePreview) {
           logOutcome("error", { errorRaw: "stale_preview" });
           return {
@@ -15427,7 +15673,7 @@ function createAstGrepReplaceTool(astGrepClient2, captureLineage) {
           }
         };
       }
-      const result = await astGrepClient2.replace(pattern, rewrite, lang, searchPaths, applyFlag, { strictness, lineage });
+      const result = await astGrepClient2.replace(pattern, rewrite, lang, searchPaths, applyFlag, { strictness, lineage, toolCallId: _toolCallId });
       if (result.stalePreview) {
         logOutcome("error", { errorRaw: "stale_preview" });
         return {
@@ -15975,7 +16221,7 @@ function createAstGrepSearchTool(astGrepClient2) {
             details: {}
           };
         }
-        const searchPaths = paths?.length ? paths : [ctx.cwd || "."];
+        const searchPaths = resolveAstGrepPaths(paths, ctx.cwd);
         const PAGE_SIZE = Math.max(1, Math.min(MAX_PAGE_SIZE, Number.isFinite(maxMatches) ? Math.floor(maxMatches) : DEFAULT_PAGE_SIZE));
         let effectiveRule = hasRawRule ? rawRule : void 0;
         if (!effectiveRule && (hasNodeKind || hasStructuralIntent({
@@ -16167,7 +16413,7 @@ ${hint}` : `${output}${paginationNote}`;
 // dist/tools/lens-diagnostics.js
 import { promises as fs23 } from "node:fs";
 import * as fsSync from "node:fs";
-import * as path36 from "node:path";
+import * as path37 from "node:path";
 
 // dist/clients/project-diagnostics/extractors.js
 var WARM_TRIGGER = {
@@ -16227,12 +16473,12 @@ function reasonFromAvailabilityVerdict(tool, verdict) {
 // dist/clients/project-diagnostics/fresh-fetch.js
 import * as fs21 from "node:fs";
 import * as os4 from "node:os";
-import * as path34 from "node:path";
+import * as path35 from "node:path";
 
 // dist/clients/project-diagnostics/runner-adapters/jscpd.js
-import * as path30 from "node:path";
+import * as path31 from "node:path";
 function resolveClonePath(cwd, file) {
-  return path30.isAbsolute(file) ? file : path30.resolve(cwd, file);
+  return path31.isAbsolute(file) ? file : path31.resolve(cwd, file);
 }
 function jscpdCloneToProjectDiagnostics(cwd, clone) {
   const a = resolveClonePath(cwd, clone.fileA);
@@ -16245,7 +16491,7 @@ function jscpdCloneToProjectDiagnostics(cwd, clone) {
     tool: "jscpd",
     runner: "jscpd",
     rule: "jscpd:duplicate",
-    message: `Duplicate code (${clone.lines} lines) \u2014 also at ${path30.relative(cwd, otherFile)}:${otherLine}`,
+    message: `Duplicate code (${clone.lines} lines) \u2014 also at ${path31.relative(cwd, otherFile)}:${otherLine}`,
     source: "project-scan"
   });
   return [
@@ -16260,16 +16506,16 @@ function jscpdResultToProjectDiagnostics(cwd, result) {
 }
 
 // dist/clients/project-diagnostics/runner-adapters/madge.js
-import * as path31 from "node:path";
+import * as path32 from "node:path";
 function resolveCyclePath(cwd, file) {
-  return path31.isAbsolute(file) ? file : path31.resolve(cwd, file);
+  return path32.isAbsolute(file) ? file : path32.resolve(cwd, file);
 }
 function cycleMembers(dep) {
   return dep.path.length > 0 ? dep.path : [dep.file];
 }
 function circularDepToProjectDiagnostics(cwd, dep) {
   const members = cycleMembers(dep);
-  const rendered = `${members.map((f) => path31.basename(f)).join(" \u2192 ")} \u2192 ${path31.basename(members[0] ?? "")}`;
+  const rendered = `${members.map((f) => path32.basename(f)).join(" \u2192 ")} \u2192 ${path32.basename(members[0] ?? "")}`;
   return members.map((file) => ({
     filePath: resolveCyclePath(cwd, file),
     severity: "warning",
@@ -16295,7 +16541,7 @@ function circularDepsToProjectDiagnostics(cwd, circular) {
 }
 
 // dist/clients/project-diagnostics/runner-adapters/opengrep.js
-import * as path32 from "node:path";
+import * as path33 from "node:path";
 function severityFor(raw) {
   switch (raw.toUpperCase()) {
     case "ERROR":
@@ -16310,7 +16556,7 @@ function opengrepFindingToProjectDiagnostic(cwd, finding) {
   const { severity, blocking } = severityFor(finding.severity);
   const cweSuffix = finding.cwe?.length ? ` (${finding.cwe[0]})` : "";
   return {
-    filePath: path32.isAbsolute(finding.path) ? finding.path : path32.resolve(cwd, finding.path),
+    filePath: path33.isAbsolute(finding.path) ? finding.path : path33.resolve(cwd, finding.path),
     line: finding.startLine,
     column: finding.startCol,
     severity,
@@ -16330,7 +16576,7 @@ function opengrepResultToProjectDiagnostics(cwd, result) {
 
 // dist/clients/project-diagnostics/runner-adapters/runner-findings.js
 import * as fs20 from "node:fs";
-import * as path33 from "node:path";
+import * as path34 from "node:path";
 function failureMessage(failure) {
   const firstLine2 = failure.message.split("\n")[0]?.slice(0, 300) ?? "";
   return firstLine2 ? `${failure.name}: ${firstLine2}` : failure.name;
@@ -16396,7 +16642,7 @@ function testRunnerFindingsToProjectDiagnostics(cache, cwd, runtime) {
     return [];
   const validation = cwd ? validateAdvisoryProvenance(cache, cwd, runtime) : { status: "unknown", reasons: ["validation-context-missing"] };
   const root = cwd ?? process.cwd();
-  const missingKeys = new Set((cache.provenance?.files ?? []).filter((file) => !fs20.existsSync(path33.resolve(root, file.path))).map((file) => advisoryPathKey(file.path, root)));
+  const missingKeys = new Set((cache.provenance?.files ?? []).filter((file) => !fs20.existsSync(path34.resolve(root, file.path))).map((file) => advisoryPathKey(file.path, root)));
   const historical = cache.superseded === true || cache.stale === true || validation.status !== "current";
   return cache.results.filter((result) => !missingKeys.has(advisoryPathKey(result.file, root))).flatMap((result) => testResultToProjectDiagnostics(result, historical)).map((diagnostic) => historical ? {
     ...diagnostic,
@@ -16426,7 +16672,7 @@ function laneObservedAtMs(scannedAt, startedAtMs) {
   return parseScannedAtMs(scannedAt) ?? startedAtMs;
 }
 async function fetchFreshProjectDiagnostics(cacheManager2, cwd, clients, signal, options = {}) {
-  const requestedRoot = options.analysisRoot === void 0 ? cwd : path34.resolve(cwd, options.analysisRoot);
+  const requestedRoot = options.analysisRoot === void 0 ? cwd : path35.resolve(cwd, options.analysisRoot);
   let analysisRoot;
   let analysisRootValidation;
   if (options.analysisRoot !== void 0) {
@@ -16593,7 +16839,7 @@ async function fetchFreshProjectDiagnostics(cacheManager2, cwd, clients, signal,
         markCold("jscpd", reasonFromAvailabilityVerdict("jscpd", clients.jscpdClient.getAvailabilityVerdict?.()));
         return;
       }
-      const isTsProject = fs21.existsSync(path34.join(analysisRoot, "tsconfig.json"));
+      const isTsProject = fs21.existsSync(path35.join(analysisRoot, "tsconfig.json"));
       const scannerKey = isTsProject ? "jscpd-ts" : "jscpd";
       const startMs = Date.now();
       const result = await clients.jscpdClient.scan(analysisRoot, void 0, void 0, isTsProject);
@@ -16824,12 +17070,12 @@ async function fetchFreshProjectDiagnostics(cacheManager2, cwd, clients, signal,
   const allSettled = Promise.all(tasks).then(() => "completed").catch(() => "completed");
   const outcome = signal ? await Promise.race([
     allSettled,
-    new Promise((resolve30) => {
+    new Promise((resolve32) => {
       if (signal.aborted) {
-        resolve30("aborted");
+        resolve32("aborted");
         return;
       }
-      signal.addEventListener("abort", () => resolve30("aborted"), {
+      signal.addEventListener("abort", () => resolve32("aborted"), {
         once: true
       });
     })
@@ -16910,7 +17156,7 @@ function makeProgressReporter(onUpdate, label, throttleMs = 250) {
 
 // dist/tools/lsp-diagnostics.js
 import * as fs22 from "node:fs";
-import * as path35 from "node:path";
+import * as path36 from "node:path";
 var MAX_FILES = 100;
 var MAX_BATCH_FILES = 100;
 var MAX_DIAGNOSTICS = 200;
@@ -16993,11 +17239,11 @@ async function collectFiles(dir, extensions, maxFiles, isIgnored = () => false)
         return;
       if (entry.isSymbolicLink())
         continue;
-      const full = path35.join(current, entry.name);
+      const full = path36.join(current, entry.name);
       if (entry.isDirectory()) {
         if (!isExcludedDirName(entry.name) && !isIgnored(full, true))
           await walk(full);
-      } else if (entry.isFile() && extensions.includes(path35.extname(full))) {
+      } else if (entry.isFile() && extensions.includes(path36.extname(full))) {
         if (isIgnored(full, false))
           continue;
         files.push(full);
@@ -17091,7 +17337,7 @@ function createLspDiagnosticsTool(nextWriteIndex, onConfirmedNoBlockers, getServ
           details: {}
         };
       }
-      const absPath = normalizeMapKey(path35.resolve(cwd, rawPath));
+      const absPath = normalizeMapKey(path36.resolve(cwd, rawPath));
       let stat;
       try {
         stat = fs22.statSync(absPath);
@@ -17272,7 +17518,7 @@ function coveredSourcesForCheck(file, serverScope, unconfirmedServerIds) {
     return [];
   }
   for (const server of servers) {
-    const auxiliary = server.role === "auxiliary";
+    const auxiliary = isAuxiliary(server);
     if (auxiliary && serverScope === "primary")
       continue;
     if (unconfirmed.has(server.id))
@@ -17748,12 +17994,12 @@ async function collectBatchDiagnostics(files, severity, lspService, options) {
       });
       const result = options.signal ? await Promise.race([
         bounded2,
-        new Promise((resolve30) => {
+        new Promise((resolve32) => {
           if (options.signal?.aborted) {
-            resolve30(void 0);
+            resolve32(void 0);
             return;
           }
-          options.signal?.addEventListener("abort", () => resolve30(void 0), {
+          options.signal?.addEventListener("abort", () => resolve32(void 0), {
             once: true
           });
         })
@@ -17812,7 +18058,7 @@ async function expandPathsToFiles(cwd, rawPaths) {
   const directories = [];
   const seenFileKeys = /* @__PURE__ */ new Set();
   for (const entry of rawPaths) {
-    const abs = normalizeMapKey(path35.resolve(cwd, entry));
+    const abs = normalizeMapKey(path36.resolve(cwd, entry));
     let stat;
     try {
       stat = fs22.statSync(abs);
@@ -18016,7 +18262,7 @@ async function runDirectoryDiagnostics(absPath, severity, lspService, options) {
     outcome: result.outcome,
     reason: result.tooLargeReason ?? result.inconclusiveReason ?? result.error ?? result.unavailable
   }));
-  const tooLargeLines = renderBatchOutcomeLines(outcomeDetails, (file) => path35.relative(absPath, file));
+  const tooLargeLines = renderBatchOutcomeLines(outcomeDetails, (file) => path36.relative(absPath, file));
   let text;
   if (total === 0) {
     const cleanLine = unconfirmed > 0 ? `${clean} clean \xB7 ${unconfirmed} unconfirmed: ${unconfirmedReasonClause(unconfirmed, timedOut, rootFallbackReasons)} NOT the same as 0 diagnostics.` : "No diagnostics found.";
@@ -18048,7 +18294,7 @@ async function runDirectoryDiagnostics(absPath, severity, lspService, options) {
     ];
     const toRelative = (d) => ({
       ...d,
-      file: path35.relative(absPath, d.file)
+      file: path36.relative(absPath, d.file)
     });
     if (primaryDisplay.length > 0) {
       lines.push(`Primary findings (${primaryDisplay.length}):`);
@@ -18079,7 +18325,7 @@ async function runDirectoryDiagnostics(absPath, severity, lspService, options) {
       filesScanned: filesToProcess.length,
       capped: wasCapped,
       diagnostics: display.map((d) => ({
-        file: path35.relative(absPath, d.file),
+        file: path36.relative(absPath, d.file),
         line: d.line,
         character: d.character,
         severity: d.severity,
@@ -18170,7 +18416,7 @@ async function findFullScanBindingMismatches(results) {
     sinceYield += 1;
     if (sinceYield >= FULL_SCAN_BINDING_YIELD_EVERY) {
       sinceYield = 0;
-      await new Promise((resolve30) => setImmediate(resolve30));
+      await new Promise((resolve32) => setImmediate(resolve32));
     }
   }
   return mismatched;
@@ -18209,7 +18455,7 @@ function createLensDiagnosticsTool(cacheManager2, getCwd, getLspService = getLSP
         const files2 = details.filesChecked ?? details.filesScanned ?? 0;
         const noun = count === 1 ? "diagnostic" : "diagnostics";
         const filePath = typeof details?.filePath === "string" ? details.filePath : Array.isArray(args?.paths) && args.paths.length === 1 && typeof args.paths[0] === "string" ? args.paths[0] : void 0;
-        const singleFile = (details?.mode === "file" || files2 === 1) && typeof filePath === "string" ? ` ${path36.basename(filePath)}` : "";
+        const singleFile = (details?.mode === "file" || files2 === 1) && typeof filePath === "string" ? ` ${path37.basename(filePath)}` : "";
         const scope = files2 > 1 ? ` across ${files2} files` : singleFile;
         if (isError)
           return `lens_diagnostics lsp \u2014 ${text.split("\n")[0] ?? "error"}`;
@@ -18455,7 +18701,7 @@ function appendProjectDiagnosticsDeltaLines(groups, cwd, report, severity, inclu
   const diagnostics = [...gated.live, ...gated.stale];
   const byFile = /* @__PURE__ */ new Map();
   for (const diagnostic of diagnostics) {
-    const filePath = path36.resolve(diagnostic.filePath);
+    const filePath = path37.resolve(diagnostic.filePath);
     const bucket = byFile.get(filePath) ?? [];
     bucket.push(diagnostic);
     byFile.set(filePath, bucket);
@@ -18515,7 +18761,10 @@ function filterDeltaReportDispositions(report, cwd, policyMap) {
   if (!report?.diagnostics.length)
     return report;
   const kept = report.diagnostics.filter((d) => applyCachedDispositions([projectDiagnosticToWidget(d, d.filePath)], cwd, d.filePath).length === 1);
-  const policyKept = applyRulePolicy(kept, policyMap);
+  const policyKept = applyRulePolicy(kept, policyMap, {
+    root: cwd,
+    filePath: cwd
+  });
   if (policyKept.length === report.diagnostics.length)
     return report;
   return { ...report, diagnostics: policyKept };
@@ -18579,7 +18828,7 @@ function applyDeltaFreshnessGate(files, cwd, generatedAt) {
   })).filter((file) => file.warnings.length > 0);
 }
 function getDeltaFileGroup(groups, cwd, filePath) {
-  const rel = path36.relative(cwd, filePath);
+  const rel = path37.relative(cwd, filePath);
   let group = groups.get(rel);
   if (!group) {
     group = {
@@ -18607,7 +18856,7 @@ function formatDeltaMode(cacheManager2, cwd, severity, pathsScope) {
     // #2504 r4 (F1): carried through, so a merged report's older
     // entries keep their own age all the way to the freshness gate.
     generatedAt: file.generatedAt,
-    warnings: applyRulePolicy(applyCachedDispositions(file.warnings ?? [], cwd, file.filePath), policyMap)
+    warnings: applyRulePolicy(applyCachedDispositions(file.warnings ?? [], cwd, file.filePath), policyMap, { root: cwd, filePath: file.filePath })
   })).filter((file) => file.warnings.length > 0);
   const actionableFiles = applyDeltaFreshnessGate(visibleWarningFiles(actionable?.files), cwd, actionable?.generatedAt);
   const qualityFiles = applyDeltaFreshnessGate(visibleWarningFiles(quality?.files), cwd, quality?.generatedAt);
@@ -18676,7 +18925,7 @@ function formatDeltaMode(cacheManager2, cwd, severity, pathsScope) {
     let text = `No ${severity === "all" ? "" : severity + " "}issues in the current turn delta.`;
     const carried = getFileDiagnosticSummaries().filter((f) => includeFile(f.filePath)).map((f) => ({
       ...f,
-      diagnostics: applyRulePolicy(applyCachedDispositions(f.diagnostics, cwd, f.filePath), policyMap)
+      diagnostics: applyRulePolicy(applyCachedDispositions(f.diagnostics, cwd, f.filePath), policyMap, { root: cwd, filePath: f.filePath })
     })).filter((f) => f.diagnostics.length > 0);
     const carriedIssues = carried.reduce((n, f) => n + f.diagnostics.length, 0);
     if (carried.length > 0) {
@@ -18703,7 +18952,7 @@ Summary (turn delta): ${aw} actionable warning${aw === 1 ? "" : "s"} \xB7 ${cq}
 function createCurrentIgnoreFilter(cwd) {
   try {
     const matcher = getProjectIgnoreMatcher(cwd);
-    return (filePath) => !matcher.isIgnored(path36.resolve(filePath), false);
+    return (filePath) => !matcher.isIgnored(path37.resolve(filePath), false);
   } catch {
     return () => true;
   }
@@ -18714,7 +18963,7 @@ function resolvePathsScope(cwd, rawPaths) {
   if (rawPaths.length > MAX_PATHS_ENTRIES) {
     throw new Error(`paths has ${rawPaths.length} entries, over the ${MAX_PATHS_ENTRIES} cap. Narrow the list or omit paths to scan without a restriction.`);
   }
-  const entries = rawPaths.filter((entry) => typeof entry === "string" && entry.trim().length > 0).map((entry) => path36.resolve(path36.isAbsolute(entry) ? entry : path36.resolve(cwd, entry)));
+  const entries = rawPaths.filter((entry) => typeof entry === "string" && entry.trim().length > 0).map((entry) => path37.resolve(path37.isAbsolute(entry) ? entry : path37.resolve(cwd, entry)));
   const missing = [];
   const fileEntries = [];
   const existingEntries = [];
@@ -18737,9 +18986,9 @@ function resolvePathsScope(cwd, rawPaths) {
   }
   const fileKeys = new Set(fileEntries.map((f) => normalizeFilePath(f)));
   const dirPrefixes = dirEntries.map((d) => normalizeFilePath(d));
-  const includeExplicitFile = (filePath) => fileKeys.has(normalizeFilePath(path36.resolve(filePath)));
+  const includeExplicitFile = (filePath) => fileKeys.has(normalizeFilePath(path37.resolve(filePath)));
   const includeFile = (filePath) => {
-    const key = normalizeFilePath(path36.resolve(filePath));
+    const key = normalizeFilePath(path37.resolve(filePath));
     if (fileKeys.has(key))
       return true;
     return dirPrefixes.some((prefix) => key === prefix || key.startsWith(`${prefix}/`));
@@ -18760,7 +19009,7 @@ function pathsScopeCacheOnlyNote(scope) {
 function pathsScopeMissingNote(scope) {
   if (!scope || scope.missing.length === 0)
     return "";
-  const shown2 = scope.missing.slice(0, 10).map((p) => path36.basename(p));
+  const shown2 = scope.missing.slice(0, 10).map((p) => path37.basename(p));
   const more = scope.missing.length > shown2.length ? ` (+${scope.missing.length - shown2.length} more)` : "";
   return `
 
@@ -18792,12 +19041,15 @@ function filterProjectDiagnosticsDeltaReport(report, includeFile) {
     diagnostics: report.diagnostics.filter((d) => includeFile(d.filePath))
   };
 }
-function applyProjectRulePolicy(value, policyMap) {
+function applyProjectRulePolicy(value, policyMap, root) {
   if (!value)
     return void 0;
   return {
     ...value,
-    diagnostics: applyRulePolicy(value.diagnostics, policyMap)
+    diagnostics: applyRulePolicy(value.diagnostics, policyMap, {
+      root,
+      filePath: value.diagnostics[0]?.filePath ?? root
+    })
   };
 }
 function isErrorLike(d) {
@@ -18888,7 +19140,7 @@ function projectDiagnosticToWidget(diagnostic, filePath) {
 }
 function diagnosticDedupKey(filePath, diagnostic) {
   const ruleId = normalizeRuleId(diagnostic.rule ?? diagnostic.tool ?? "");
-  return [path36.resolve(filePath), diagnostic.line ?? "?", ruleId].join(":");
+  return [path37.resolve(filePath), diagnostic.line ?? "?", ruleId].join(":");
 }
 function runnerIdOf(diagnostic) {
   return diagnostic.tool ?? diagnostic.rule?.split(":", 1)[0] ?? "";
@@ -18902,8 +19154,8 @@ function runnerRetirementDecision(diagnostic, filePath, authoritativeRunnerIds,
   const realFilePath = realpathOrResolve(filePath);
   for (const entry of coverage) {
     const root = entry.root;
-    const relative9 = path36.relative(root, realFilePath);
-    const underRoot = relative9 === "" || !relative9.startsWith("..") && !path36.isAbsolute(relative9);
+    const relative9 = path37.relative(root, realFilePath);
+    const underRoot = relative9 === "" || !relative9.startsWith("..") && !path37.isAbsolute(relative9);
     if (!underRoot)
       continue;
     if (entry.files.has(realFilePath)) {
@@ -19027,7 +19279,7 @@ function mergeDiagnosticsWithWidgetSummaries(widgetSummaries, lspResults, projec
   const byFile = /* @__PURE__ */ new Map();
   const seen = /* @__PURE__ */ new Set();
   for (const summary of widgetSummaries) {
-    const filePath = path36.resolve(summary.filePath);
+    const filePath = path37.resolve(summary.filePath);
     if (authoritativeLspFiles?.has(filePath))
       continue;
     const retained = summary.diagnostics ?? [];
@@ -19055,7 +19307,7 @@ function mergeDiagnosticsWithWidgetSummaries(widgetSummaries, lspResults, projec
     byFile.set(filePath, summarizeDiagnostics(filePath, diagnostics, existing?.hasFinalSnapshot ?? true));
   };
   for (const result of lspResults) {
-    const filePath = path36.resolve(result.filePath);
+    const filePath = path37.resolve(result.filePath);
     for (const diagnostic of result.diagnostics ?? []) {
       addDiagnostic(filePath, {
         ...lspDiagnosticToWidget(diagnostic),
@@ -19075,12 +19327,12 @@ function mergeDiagnosticsWithWidgetSummaries(widgetSummaries, lspResults, projec
     });
   }
   for (const diagnostic of projectSnapshot?.diagnostics ?? []) {
-    addDiagnostic(path36.resolve(diagnostic.filePath), projectDiagnosticToWidget(diagnostic, diagnostic.filePath));
+    addDiagnostic(path37.resolve(diagnostic.filePath), projectDiagnosticToWidget(diagnostic, diagnostic.filePath));
   }
   for (const diagnostic of deltaDiagnostics) {
     const widget = projectDiagnosticToWidget(diagnostic, diagnostic.filePath);
     const observedAt = widget.observedAt ?? deltaObservedAt;
-    addDiagnostic(path36.resolve(diagnostic.filePath), {
+    addDiagnostic(path37.resolve(diagnostic.filePath), {
       ...widget,
       ...observedAt !== void 0 && { observedAt }
     });
@@ -19095,7 +19347,10 @@ async function applyInlineSuppressionsToSummaries(summaries, cwd, policyMap) {
     try {
       content = await fs23.readFile(summary.filePath, "utf8");
     } catch {
-      const policyKept2 = applyRulePolicy(summary.diagnostics, policyMap);
+      const policyKept2 = applyRulePolicy(summary.diagnostics, policyMap, {
+        root: cwd,
+        filePath: summary.filePath
+      });
       return policyKept2.length === summary.diagnostics.length ? summary : summarizeDiagnostics(summary.filePath, policyKept2, summary.hasFinalSnapshot);
     }
     const { kept: policyKept } = applyFindingPolicy(summary.diagnostics, {
@@ -19280,20 +19535,20 @@ async function formatFullMode(cwd, severity, lspService, cacheManager2, options
         result2.observedAt
       );
       if (retired === true) {
-        authoritativeLspFiles.add(path36.resolve(result2.filePath));
+        authoritativeLspFiles.add(path37.resolve(result2.filePath));
       } else {
-        unreconciledFiles.add(path36.resolve(result2.filePath));
+        unreconciledFiles.add(path37.resolve(result2.filePath));
         recordDegradationOnce({
           kind: "diagnostic-retained-unreconciled",
-          subject: `${path36.resolve(result2.filePath)}:lsp`,
+          subject: `${path37.resolve(result2.filePath)}:lsp`,
           reason: "confirmed diagnostic result could not replace retained widget state"
         });
       }
     } catch {
-      unreconciledFiles.add(path36.resolve(result2.filePath));
+      unreconciledFiles.add(path37.resolve(result2.filePath));
       recordDegradationOnce({
         kind: "diagnostic-retained-unreconciled",
-        subject: `${path36.resolve(result2.filePath)}:lsp`,
+        subject: `${path37.resolve(result2.filePath)}:lsp`,
         reason: "confirmed diagnostic result failed during widget reconciliation"
       });
     }
@@ -19303,9 +19558,9 @@ async function formatFullMode(cwd, severity, lspService, cacheManager2, options
   const authoritativeRunnerIds = new Set(extracted.analyzed ?? []);
   const authoritativeRunnerCoverage = extracted.authoritativeCoverage ?? [];
   const foldedProjectSnapshot = foldExtraDiagnosticsIntoSnapshot(scannedSnapshot, extracted.diagnostics.filter((d) => includeFile(d.filePath)), extracted.runners, cwd);
-  const projectSnapshot = applyProjectRulePolicy(foldedProjectSnapshot, policyMap);
-  const projectDelta = applyProjectRulePolicy(filterProjectDiagnosticsDeltaReport(loadProjectDiagnosticsDeltaReport(cwd), includeFile), policyMap);
-  const authoritativeRetiredCount = getFileDiagnosticSummaries().filter((summary) => includeFile(summary.filePath) && authoritativeLspFiles.has(path36.resolve(summary.filePath)) && (summary.diagnostics?.length ?? 0) > 0).length;
+  const projectSnapshot = applyProjectRulePolicy(foldedProjectSnapshot, policyMap, cwd);
+  const projectDelta = applyProjectRulePolicy(filterProjectDiagnosticsDeltaReport(loadProjectDiagnosticsDeltaReport(cwd), includeFile), policyMap, cwd);
+  const authoritativeRetiredCount = getFileDiagnosticSummaries().filter((summary) => includeFile(summary.filePath) && authoritativeLspFiles.has(path37.resolve(summary.filePath)) && (summary.diagnostics?.length ?? 0) > 0).length;
   if (authoritativeRetiredCount > 0) {
     logLatency({
       type: "phase",
@@ -19360,7 +19615,7 @@ async function formatFullMode(cwd, severity, lspService, cacheManager2, options
   }
   let summaries = await applyInlineSuppressionsToSummaries(mergeDiagnosticsWithWidgetSummaries(getFileDiagnosticSummaries().filter((summary) => includeFile(summary.filePath)), confirmedLspResults, projectSnapshot, projectDelta, authoritativeLspFiles, authoritativeRunnerIds, authoritativeRunnerCoverage), cwd, policyMap);
   if (unreconciledFiles.size > 0) {
-    summaries = summaries.map((summary) => unreconciledFiles.has(path36.resolve(summary.filePath)) ? summarizeDiagnostics(summary.filePath, markUnreconciledFindings(summary.diagnostics), summary.hasFinalSnapshot) : summary);
+    summaries = summaries.map((summary) => unreconciledFiles.has(path37.resolve(summary.filePath)) ? summarizeDiagnostics(summary.filePath, markUnreconciledFindings(summary.diagnostics), summary.hasFinalSnapshot) : summary);
   }
   const parsedProjectScanObservedAt = projectSnapshot?.scannedAt ? Date.parse(projectSnapshot.scannedAt) : void 0;
   const projectScanObservedAt = parsedProjectScanObservedAt !== void 0 && Number.isFinite(parsedProjectScanObservedAt) ? parsedProjectScanObservedAt : void 0;
@@ -19579,7 +19834,10 @@ async function formatAllMode(cwd, severity, summaries = getFileDiagnosticSummari
   const dispositioned = isFullMode ? summaries : summaries.map((s) => {
     const diagnostics = s.diagnostics ?? [];
     const kept = applyCachedDispositions(diagnostics, cwd, s.filePath);
-    const policyKept = applyRulePolicy(kept, policyMap);
+    const policyKept = applyRulePolicy(kept, policyMap, {
+      root: cwd,
+      filePath: s.filePath
+    });
     if (policyKept.length === kept.length && kept.length === diagnostics.length)
       return s;
     return summarizeDiagnostics(s.filePath, policyKept, s.hasFinalSnapshot);
@@ -19624,7 +19882,7 @@ async function formatAllMode(cwd, severity, summaries = getFileDiagnosticSummari
   let totalWarnings = 0;
   let totalAdvisories = 0;
   for (const s of rendered) {
-    const rel = path36.relative(cwd, s.filePath);
+    const rel = path37.relative(cwd, s.filePath);
     const parts = [];
     if (s.blocking > 0)
       parts.push(`\u{1F534} ${s.blocking} blocking`);
@@ -19692,7 +19950,7 @@ Summary (${visibleSummaries.length} files diagnosed this session):`,
 
 // dist/tools/lsp-navigation.js
 import * as nodeFs2 from "node:fs";
-import * as path37 from "node:path";
+import * as path38 from "node:path";
 import { fileURLToPath as fileURLToPath2, pathToFileURL as pathToFileURL2 } from "node:url";
 
 // dist/tools/lsp-structured-output.js
@@ -20402,7 +20660,7 @@ function collectSearchReadsForOperation(operation, result, callHierarchyItem) {
 }
 function formatCapabilities(snapshots, filePath) {
   if (snapshots.length === 0) {
-    return filePath ? `No active LSP server for ${path37.basename(filePath)}. Open/touch the file first or run another LSP operation to start the server.` : "No active LSP servers in this session.";
+    return filePath ? `No active LSP server for ${path38.basename(filePath)}. Open/touch the file first or run another LSP operation to start the server.` : "No active LSP servers in this session.";
   }
   const rows = [
     ["definition", (s) => !!s.operationSupport.definition],
@@ -20432,7 +20690,7 @@ function formatCapabilities(snapshots, filePath) {
   ];
   const lines = [];
   for (const snapshot of snapshots) {
-    const label = filePath ? `${snapshot.serverId} (${path37.basename(filePath)})` : `${snapshot.serverId} (${snapshot.root})`;
+    const label = filePath ? `${snapshot.serverId} (${path38.basename(filePath)})` : `${snapshot.serverId} (${snapshot.root})`;
     lines.push(label);
     for (const [name, supported, note] of rows) {
       const suffix = note ? ` (${note})` : "";
@@ -20723,7 +20981,12 @@ function createLspNavigationTool(getFlag, mutationDeps) {
         const mutationSource = operation === "executeCommand" ? "lsp-execute-command" : "lsp-rename";
         mutationContext = {
           cwd,
+          sessionId: ctx.sessionManager?.getSessionId?.(),
           correlationId: newLspMutationCorrelationId(_toolCallId),
+          // #4187 R4-1: the call whose `tool_call` licensed the paths it
+          // named; the workspace edit's other files (a rename's importers)
+          // are unlicensed, so they end an authorship instead of advancing it.
+          toolCallId: _toolCallId,
           tool: `lsp_navigation:${operation}`,
           source: mutationSource,
           ...mutationDeps,
@@ -20767,7 +21030,7 @@ function createLspNavigationTool(getFlag, mutationDeps) {
           resultCount: 0
         });
       }
-      const filePath = rawPath ? path37.isAbsolute(rawPath) ? rawPath : path37.resolve(ctx.cwd || ".", rawPath) : "";
+      const filePath = rawPath ? path38.isAbsolute(rawPath) ? rawPath : path38.resolve(ctx.cwd || ".", rawPath) : "";
       let filePathIsDirectory = false;
       if (filePath) {
         try {
@@ -20803,7 +21066,7 @@ function createLspNavigationTool(getFlag, mutationDeps) {
               content: [
                 {
                   type: "text",
-                  text: `No LSP server available for ${path37.basename(filePath)}. Check that the language server is installed.`
+                  text: `No LSP server available for ${path38.basename(filePath)}. Check that the language server is installed.`
                 }
               ],
               isError: true
@@ -20904,7 +21167,7 @@ ${JSON.stringify(result2)}`
           content: [
             {
               type: "text",
-              text: `No LSP server available for ${path37.basename(filePath)}. Check that the language server is installed.`
+              text: `No LSP server available for ${path38.basename(filePath)}. Check that the language server is installed.`
             }
           ],
           isError: true
@@ -20923,7 +21186,7 @@ ${JSON.stringify(result2)}`
             content: [
               {
                 type: "text",
-                text: `LSP server for ${path37.basename(filePath)} does not advertise support for ${operation}`
+                text: `LSP server for ${path38.basename(filePath)} does not advertise support for ${operation}`
               }
             ],
             isError: true,
@@ -20977,7 +21240,7 @@ ${JSON.stringify(result2)}`
           const msg = err instanceof Error ? err.message : String(err);
           if (rawPath && /No Project/i.test(msg)) {
             await openFileBestEffort(lspService, filePath);
-            await new Promise((resolve30) => setTimeout(resolve30, 120));
+            await new Promise((resolve32) => setTimeout(resolve32, 120));
             const retryRaw = await lspService.workspaceSymbol(query ?? "", filePath);
             const retrySymbols = (Array.isArray(retryRaw) ? retryRaw : [retryRaw]).filter((s) => typeof s === "object" && s !== null);
             return dedupeWorkspaceSymbols(retrySymbols);
@@ -21052,7 +21315,7 @@ ${JSON.stringify(result2)}`
             if (!newFilePath || newFilePath.trim().length === 0) {
               throw new Error("__BADINPUT__ newFilePath parameter required for rename_file");
             }
-            const resolvedNewFilePath = path37.isAbsolute(newFilePath) ? newFilePath : path37.resolve(ctx.cwd || ".", newFilePath);
+            const resolvedNewFilePath = path38.isAbsolute(newFilePath) ? newFilePath : path38.resolve(ctx.cwd || ".", newFilePath);
             const result2 = await lspService.renameFile(filePath, resolvedNewFilePath, {
               cwd: ctx.cwd || ".",
               apply: apply ?? false,
@@ -21196,7 +21459,7 @@ ${JSON.stringify(result2)}`
         }, { operation, filePath, failureKind: "lsp_error", resultCount: 0 });
       }
       const isEmpty = !result || Array.isArray(result) && result.length === 0;
-      const fileCtx = filePath ? " at " + path37.basename(filePath) : "";
+      const fileCtx = filePath ? " at " + path38.basename(filePath) : "";
       const lineCtx = line ? ":" + line + ":" + character : "";
       let output = isEmpty ? "No results for " + operation + fileCtx + lineCtx : JSON.stringify(result);
       if (isEmpty && operation === "workspaceSymbol" && !rawPath) {
@@ -21438,11 +21701,11 @@ function resolveDefaultCwd() {
   const fromArg = process.argv.find((arg) => arg.startsWith("--cwd="))?.slice("--cwd=".length);
   return fromArg ?? process.env.PI_LENS_MCP_CWD ?? process.cwd();
 }
-var DEFAULT_CWD = path38.resolve(resolveDefaultCwd());
+var DEFAULT_CWD = path39.resolve(resolveDefaultCwd());
 var lspReadyCwds = /* @__PURE__ */ new Set();
 var SERVER_FILE = fileURLToPath3(import.meta.url);
-var SERVER_DIR = path38.dirname(SERVER_FILE);
-var WORKER_PATH = path38.join(SERVER_DIR, "worker.js");
+var SERVER_DIR = path39.dirname(SERVER_FILE);
+var WORKER_PATH = path39.join(SERVER_DIR, "worker.js");
 var REBUILD_SCRIPT = resolveRebuildScript(SERVER_FILE);
 var STALENESS_STAT_PATH = process.env.PI_LENS_MCP_STALENESS_STAT_PATH ?? SERVER_FILE;
 var BUILD_STAMP = computeBuildStamp(STALENESS_STAT_PATH);
@@ -21464,7 +21727,7 @@ function isWarmBuildStale() {
 function findRepoRoot(start) {
   let dir = start;
   for (let depth = 0; depth < 6; depth++) {
-    const pkgPath = path38.join(dir, "package.json");
+    const pkgPath = path39.join(dir, "package.json");
     if (fs25.existsSync(pkgPath)) {
       try {
         const pkg = JSON.parse(fs25.readFileSync(pkgPath, "utf8"));
@@ -21473,16 +21736,16 @@ function findRepoRoot(start) {
       } catch {
       }
     }
-    const parent = path38.dirname(dir);
+    const parent = path39.dirname(dir);
     if (parent === dir)
       break;
     dir = parent;
   }
-  return path38.resolve(start, "..", "..");
+  return path39.resolve(start, "..", "..");
 }
-var REPO_ROOT = process.env.PI_LENS_MCP_REPO_ROOT ? path38.resolve(process.env.PI_LENS_MCP_REPO_ROOT) : findRepoRoot(SERVER_DIR);
+var REPO_ROOT = process.env.PI_LENS_MCP_REPO_ROOT ? path39.resolve(process.env.PI_LENS_MCP_REPO_ROOT) : findRepoRoot(SERVER_DIR);
 async function ensureReady(cwd) {
-  const normalized = path38.resolve(cwd);
+  const normalized = path39.resolve(cwd);
   if (!shouldInitializeSessionRoot(normalized, lspReadyCwds)) {
     return;
   }
@@ -21528,14 +21791,14 @@ function getAutoSessionStatus() {
 }
 var IPC_PATH = ipcPathForCwd(DEFAULT_CWD);
 function rejectForeignTurnCwd(route, cwd) {
-  const message = `${route} cwd outside this server's workspace: ${path38.resolve(cwd)} not within ${DEFAULT_CWD}`;
+  const message = `${route} cwd outside this server's workspace: ${path39.resolve(cwd)} not within ${DEFAULT_CWD}`;
   console.error(`[pi-lens-mcp] rejected ${message}`);
   return message;
 }
 function isWithinServerWorkspace(cwd) {
-  const target = path38.resolve(cwd);
-  const rel = path38.relative(DEFAULT_CWD, target);
-  return !rel.startsWith("..") && !path38.isAbsolute(rel);
+  const target = path39.resolve(cwd);
+  const rel = path39.relative(DEFAULT_CWD, target);
+  return !rel.startsWith("..") && !path39.isAbsolute(rel);
 }
 function startIpcServer() {
   if (process.platform !== "win32") {
@@ -21685,6 +21948,12 @@ function graphStalenessNote(builtAtIso, label) {
     return void 0;
   return `${label} last updated ${formatRelativeAge(ageMs)}; run pilens_analyze on recently-changed files, pilens_session_start, or pilens_rebuild to refresh it.`;
 }
+setProjectTrustState("trusted");
+logExtension({
+  subsystem: "project-trust",
+  level: "debug",
+  message: "mcp: workspace trust belongs to the MCP client; pi trust not consulted"
+});
 var cacheManager = new CacheManager();
 var isLensGuardEnabled = () => Boolean(createMcpHost(void 0, DEFAULT_CWD).getFlag("lens-guard"));
 var lensDiagnosticsTool = createLensDiagnosticsTool(
@@ -22024,7 +22293,7 @@ function enabledToolsForCwd(cwd) {
 }
 function formatAnalyze(result, cwd, mode, servedBy) {
   const lspNote = result.lsp ? ` \xB7 lsp ${result.lsp.diagnosticCount} (${result.lsp.status}${result.lsp.failureKind ? `: ${result.lsp.failureKind}` : ""}, ${result.lsp.durationMs}ms)` : "";
-  const summary = `${path38.relative(cwd, result.filePath) || result.filePath} [${mode}] \u2014 ${result.counts.blockers} blocking, ${result.counts.warnings} warning(s), ${result.counts.advisories} advisory(ies), ${result.counts.diagnostics} total` + (result.latency ? ` \xB7 ${result.latency.totalDurationMs}ms` : "") + lspNote + (result.counts.fixed > 0 ? ` \xB7 ${result.counts.fixed} auto-fixed` : "") + (servedBy ? `
+  const summary = `${path39.relative(cwd, result.filePath) || result.filePath} [${mode}] \u2014 ${result.counts.blockers} blocking, ${result.counts.warnings} warning(s), ${result.counts.advisories} advisory(ies), ${result.counts.diagnostics} total` + (result.latency ? ` \xB7 ${result.latency.totalDurationMs}ms` : "") + lspNote + (result.counts.fixed > 0 ? ` \xB7 ${result.counts.fixed} auto-fixed` : "") + (servedBy ? `
 
 servedBy: ${servedBy}` : "");
   return renderToolText(summary, servedBy ? { ...result, servedBy } : result);
@@ -22158,7 +22427,7 @@ ${outcome.output}`, {
     }
     const { deduped, byRule, byFile } = summarizeScan(snapshot.diagnostics);
     const topRules = Object.entries(byRule).sort((a, b) => b[1] - a[1]);
-    const topFiles = Object.entries(byFile).sort((a, b) => b[1] - a[1]).slice(0, 15).map(([file, count]) => ({ file: path38.relative(cwd, file), count }));
+    const topFiles = Object.entries(byFile).sort((a, b) => b[1] - a[1]).slice(0, 15).map(([file, count]) => ({ file: path39.relative(cwd, file), count }));
     const summaryLines = [
       `Scanned ${snapshot.filesScanned} file(s) [${snapshot.runners.join(", ")}] \u2192 ${deduped.length} unique diagnostic(s)` + (snapshot.diagnostics.length !== deduped.length ? ` (${snapshot.diagnostics.length} raw, ${snapshot.diagnostics.length - deduped.length} duplicate)` : ""),
       ...topRules.slice(0, 12).map(([rule, count]) => `  ${count}\xD7 ${rule}`)
@@ -22211,7 +22480,7 @@ ${stalenessNote}` : ""), {
     }
     const lines = [
       `Top ${results.length} file(s) for "${query}":`,
-      ...results.map((result, i) => `  ${i + 1}. ${path38.relative(cwd, result.file)} (score ${result.score.toFixed(2)}, ${result.hits} hit(s), line ${result.startLine})`),
+      ...results.map((result, i) => `  ${i + 1}. ${path39.relative(cwd, result.file)} (score ${result.score.toFixed(2)}, ${result.hits} hit(s), line ${result.startLine})`),
       ...stalenessNote ? ["", stalenessNote] : [],
       ...coverage ? [
         `Index covers ${coverage.files} files${coverage.truncated ? " (capped \u2014 results may be incomplete)" : ""}.`
@@ -22221,7 +22490,7 @@ ${stalenessNote}` : ""), {
       query,
       coverage,
       results: results.map((result) => {
-        const relFile = path38.relative(cwd, result.file);
+        const relFile = path39.relative(cwd, result.file);
         return {
           file: relFile,
           score: result.score,
@@ -22260,12 +22529,12 @@ ${stalenessNote}` : ""), {
     });
     if (!report.available) {
       return {
-        ...renderToolText(`No module report for ${path38.relative(cwd, path38.resolve(cwd, file))} \u2014 not a symbol-bearing file, or unreadable.`, report, true),
+        ...renderToolText(`No module report for ${path39.relative(cwd, path39.resolve(cwd, file))} \u2014 not a symbol-bearing file, or unreadable.`, report, true),
         isError: true
       };
     }
     const graphStaleness = graphStalenessNote(report.graphBuiltAt, "Review graph");
-    const summary = `${path38.relative(cwd, report.path) || report.path} [${report.staleness}] \u2014 ${report.summary.symbols} symbol(s), ${report.summary.exports} exported, ${report.api.length} in public API` + (graphStaleness ? `
+    const summary = `${path39.relative(cwd, report.path) || report.path} [${report.staleness}] \u2014 ${report.summary.symbols} symbol(s), ${report.summary.exports} exported, ${report.api.length} in public API` + (graphStaleness ? `
 
 ${graphStaleness}` : "");
     if (view === "compact") {
@@ -22326,7 +22595,7 @@ ${graphStaleness}` : "");
     if (!result.found) {
       const suggestionSuffix = result.suggestions?.length ? ` Did you mean: ${result.suggestions.join(", ")}?` : " Use pilens_module_report to list symbols.";
       return {
-        ...renderToolText(`Symbol "${symbol}" not found in ${path38.basename(file)}.${suggestionSuffix}`, {
+        ...renderToolText(`Symbol "${symbol}" not found in ${path39.basename(file)}.${suggestionSuffix}`, {
           found: false,
           ...result.suggestions ? { suggestions: result.suggestions } : {}
         }),
@@ -22335,7 +22604,7 @@ ${graphStaleness}` : "");
     }
     const sigSuffix = result.signature ? `  ${result.signature}` : "";
     const ambiguityNote = result.ambiguous ? ` (${result.ambiguous.count} matches \u2014 returned the ${result.kind}; pass \`kind\` to disambiguate: ${result.ambiguous.kinds.join(", ")})` : "";
-    const header = `${result.kind} ${result.name}${ambiguityNote}${sigSuffix}  ${path38.relative(cwd, result.path)}:${result.startLine}-${result.endLine}`;
+    const header = `${result.kind} ${result.name}${ambiguityNote}${sigSuffix}  ${path39.relative(cwd, result.path)}:${result.startLine}-${result.endLine}`;
     return {
       content: [
         {
@@ -22373,14 +22642,14 @@ ${result.source ?? ""}`
 
 Nested outline:
 ${JSON.stringify(result.outline)}` : "";
-      const text = result.error ? `Could not read enclosing range in ${path38.basename(file)}:${result.line}: ${result.error}${warningSuffix}${outlineSuffix}` : `No enclosing symbol/callback found in ${path38.basename(file)}:${result.line}.${warningSuffix}`;
+      const text = result.error ? `Could not read enclosing range in ${path39.basename(file)}:${result.line}: ${result.error}${warningSuffix}${outlineSuffix}` : `No enclosing symbol/callback found in ${path39.basename(file)}:${result.line}.${warningSuffix}`;
       return {
         ...renderToolText(text, { found: false, line: result.line }),
         isError: true
       };
     }
     const range = result.partial ? `${result.startLine}-${result.endLine} (partial of ${result.enclosingStartLine}-${result.enclosingEndLine})` : `${result.startLine}-${result.endLine}`;
-    const header = `${result.kind} ${result.name}  ${path38.relative(cwd, result.path)}:${range}`;
+    const header = `${result.kind} ${result.name}  ${path39.relative(cwd, result.path)}:${range}`;
     return {
       content: [
         {
@@ -22415,7 +22684,7 @@ ${result.source ?? ""}`
       ]),
       ...renderLspBrokenStatusLines(brokenServers),
       ...renderDegradationLines(degradations),
-      last ? `Last dispatch: ${path38.basename(last.filePath)} \u2014 ${last.totalDurationMs}ms, ${last.totalDiagnostics} diagnostic(s)` : "Last dispatch: none yet",
+      last ? `Last dispatch: ${path39.basename(last.filePath)} \u2014 ${last.totalDurationMs}ms, ${last.totalDiagnostics} diagnostic(s)` : "Last dispatch: none yet",
       `Diagnostics this session: ${stats.totalShown} shown \xB7 ${stats.totalAutoFixed} auto-fixed \xB7 ${stats.totalUnresolved} unresolved`,
       autoSession ? `Auto session_start: ${autoSession.succeeded ? "succeeded" : autoSession.error ? "FAILED" : autoSession.attempted ? "in progress" : "not yet attempted"}${autoSession.firedAt ? ` (fired ${autoSession.firedAt})` : ""}${autoSession.error ? ` \u2014 ${autoSession.error}` : ""}` : "Auto session_start: disabled (PI_LENS_MCP_AUTO_SESSION not set)",
       turnEnd ? `Stop-hook turn-end: ${turnEnd.ran} ran \xB7 ${turnEnd.skipped} skipped${turnEnd.lastRunAt ? ` (last ran ${turnEnd.lastRunAt})` : ""}${turnEnd.lastSkipReason ? ` \u2014 last skip: ${turnEnd.lastSkipReason}${turnEnd.lastSkipAt ? ` at ${turnEnd.lastSkipAt}` : ""}` : ""}` : "Stop-hook turn-end: no activity recorded (hook not installed, or no Stop yet)",
@@ -22481,7 +22750,7 @@ ${result.source ?? ""}`
     const limit = typeof args.limit === "number" && Number.isFinite(args.limit) ? Math.max(1, Math.floor(args.limit)) : 5;
     const fileFilter = typeof args.file === "string" ? args.file : void 0;
     const recent = recentLatency(limit, fileFilter);
-    const summary = recent.length === 0 ? "No dispatch latency reports yet." : recent.map((report) => `${path38.basename(report.filePath)}: ${report.totalDurationMs}ms (${report.totalDiagnostics} diag${report.stoppedEarly ? ", stopped early" : ""})`).join("\n");
+    const summary = recent.length === 0 ? "No dispatch latency reports yet." : recent.map((report) => `${path39.basename(report.filePath)}: ${report.totalDurationMs}ms (${report.totalDiagnostics} diag${report.stoppedEarly ? ", stopped early" : ""})`).join("\n");
     return renderToolText(summary, recent);
   }
   if (name === "pilens_session_start") {