pi-lens 4.4.0 → 4.4.2

package/dist/{chunk-TLGFBM3F.js → chunk-ODBNXWT4.js}

@@ -2,17 +2,17 @@ import { createRequire as __pilensCreateRequire } from "node:module"; const requ
 import {
   getLazyInstallAttempt,
   tryLazyInstall
-} from "./chunk-C2AUYXQH.js";
+} from "./chunk-OXXKQCSV.js";
 import {
   stripAnsi
 } from "./chunk-FC4RP4I2.js";
 import {
   isTrivyEnabled,
   resolveSeverityFloor
-} from "./chunk-DFVMIKMQ.js";
+} from "./chunk-66SXUJCA.js";
 import {
   rustClient
-} from "./chunk-RPD5K5NC.js";
+} from "./chunk-MRXKYPCS.js";
 import {
   findingsResult,
   finishParsedRun,
@@ -22,10 +22,10 @@ import {
   isRunnerSkipReason,
   parseToolRun,
   skipUnlessToolRan
-} from "./chunk-ZMOL6RQC.js";
+} from "./chunk-2CD5RS6M.js";
 import {
   spawnFailedWithNoOutput
-} from "./chunk-I7SPGOWI.js";
+} from "./chunk-UZ3TUTRV.js";
 import {
   coveringLaneAvailable,
   createAvailabilityChecker,
@@ -40,7 +40,7 @@ import {
   resolveToolCommand,
   resolveToolCommandWithInstallFallback,
   resolveVendorToolCommand
-} from "./chunk-7FBF7NPR.js";
+} from "./chunk-GOYRYZ2R.js";
 import {
   biomeConfigArgs,
   findCompiledClassesDir,
@@ -59,41 +59,39 @@ import {
   hasYamllintConfig,
   markdownlintConfigArgs,
   ruffConfigArgs
-} from "./chunk-HHYAELLJ.js";
+} from "./chunk-RPLINGVB.js";
 import {
   importFactProvider
-} from "./chunk-V5PXFSZK.js";
+} from "./chunk-XCJN5IJU.js";
 import {
   functionFactProvider
-} from "./chunk-YLF3PPT5.js";
+} from "./chunk-76MWC2K6.js";
 import {
   extractFactsFromTree
-} from "./chunk-JOLITGCC.js";
+} from "./chunk-GXW6K4YJ.js";
 import {
   computeImpactCascade
-} from "./chunk-E2WFBRHM.js";
+} from "./chunk-2B73ZPOK.js";
 import {
   goClient
-} from "./chunk-6VCD4VKZ.js";
-import {
-  buildOrUpdateGraph,
-  clearReviewGraphWorkspaceCache,
-  fileContentProvider
-} from "./chunk-LSMJ6KBE.js";
+} from "./chunk-XMSXXAHW.js";
 import {
   MAX_BLOCKING_RULE_COMPLEXITY,
   RUNTIME_CONFIG,
   applyDispositions,
   applyDispositionsMultiFile,
   buildEffectiveAstGrepCatalog,
+  buildOrUpdateGraph,
   calculateRuleComplexity,
   classifyDefect,
   classifyDiagnostic,
   classifyDiagnosticTier,
   clearPendingAuxiliaryCoverage,
+  clearReviewGraphWorkspaceCache,
   enabledAuxiliaryLspServerIds,
   exceedsLspSyncLimits,
   fetchTsserverProjectIdentity,
+  fileContentProvider,
   getLSPService,
   getRunnerTimeoutFloorMs,
   hasAnyDispositionMarks,
@@ -109,7 +107,7 @@ import {
   touchCoverageGap,
   tryWarmAttachedCodeActions,
   tryWarmAttachedDiagnostics
-} from "./chunk-TVN5N6GY.js";
+} from "./chunk-PV6LR5P5.js";
 import {
   mapWithConcurrency
 } from "./chunk-XIMYZ3JA.js";
@@ -117,14 +115,20 @@ import {
   LSP_SERVERS,
   getAstGrepRuleSources,
   registerRunnerId
-} from "./chunk-B3I2UUT4.js";
+} from "./chunk-ESBQHFMJ.js";
 import {
   augmentPythonEnvironment,
   detectPythonEnvironment
-} from "./chunk-DIULIWKU.js";
+} from "./chunk-34WSVGEM.js";
+import {
+  loadProjectSnapshot,
+  readJsonCache,
+  readJsonCacheAsync
+} from "./chunk-ZXYDQ3TZ.js";
 import {
   BUNDLED_QUERIES_ROOT,
   classifyTreeSitterWasmError,
+  computeRuleFilesFingerprint,
   firstChildOfType,
   getBundledQueriesRootHealth,
   getSharedTreeSitterClient,
@@ -140,16 +144,11 @@ import {
   ruleFilesForLanguage,
   ruleSourceLanguages,
   walk
-} from "./chunk-LW6XKDZQ.js";
+} from "./chunk-QHJ6DQ2R.js";
 import {
   buildModuleGraph,
   clearModuleGraphCache
-} from "./chunk-V7R425XG.js";
-import {
-  loadProjectSnapshot,
-  readJsonCache,
-  readJsonCacheAsync
-} from "./chunk-AJVLWNFN.js";
+} from "./chunk-GBPP5P7X.js";
 import {
   WORD_INDEX_MAX_BYTES,
   deserializeWordIndex,
@@ -157,7 +156,7 @@ import {
   removeWordIndexDocumentAsync,
   scheduleWordIndexPersist,
   updateWordIndexDocumentForEdit
-} from "./chunk-YGVYKNSN.js";
+} from "./chunk-SAEFPSB6.js";
 import {
   PathKeyedMap
 } from "./chunk-Z3CCVDUB.js";
@@ -165,26 +164,24 @@ import {
   WARM_CODE_ACTION_LOOKUP_LIMIT,
   contentHash,
   resolveRunnerPath
-} from "./chunk-PWFHBTSF.js";
+} from "./chunk-L3BLXZG7.js";
 import {
   isSpawnableCommand
-} from "./chunk-OQGFCZJ4.js";
+} from "./chunk-66VMUL7Q.js";
 import {
   logRunnerAdvisoryOnce,
   resolveRunnerCwd,
   resolveRunnerCwdWithReason
-} from "./chunk-RUOG5D2C.js";
+} from "./chunk-Q7DUK4LX.js";
 import {
-  findLocalBinUpwards
-} from "./chunk-U3VGR4VU.js";
-import {
-  getProjectTrustState,
-  projectTrustDenialReason
-} from "./chunk-NTUJEGDZ.js";
+  findLocalBinUpwards,
+  localBinPath
+} from "./chunk-AW7R2GWG.js";
 import {
   createAvailabilityProbeFlight,
+  getIsolatedNpxSpawnOptions,
   probeToolAsync
-} from "./chunk-EOKRQ3SA.js";
+} from "./chunk-RWWYJ623.js";
 import {
   classifyProbeFailure,
   createAvailabilityLatch,
@@ -194,13 +191,14 @@ import {
   logAvailabilityDecision,
   startHostStallSampler,
   transientRetryDelayMs
-} from "./chunk-WONERJTP.js";
+} from "./chunk-VRZP76YM.js";
 import {
   getLspCapableKinds,
   getPrimaryDispatchGroup,
   resolveLanguageRootForFile
-} from "./chunk-22AVIGXS.js";
+} from "./chunk-QOBUHWHX.js";
 import {
+  getGlobalPiLensDir,
   getProjectDataDir,
   isInSpawnTimeoutCooldown,
   isTestFile,
@@ -208,48 +206,53 @@ import {
   noteSpawnTimeout,
   resolvePiLensFlag,
   safeSpawnAsync
-} from "./chunk-VN2AXLEX.js";
+} from "./chunk-C34ZXZ7O.js";
 import {
   detectFileKind
-} from "./chunk-5ZEJHV35.js";
+} from "./chunk-PHDMFAKM.js";
 import {
   classifyGeneratedOrArtifactDetailed,
   detectFileRole,
-  loadPiLensProjectConfig
-} from "./chunk-DQ2NZ7C4.js";
+  loadPiLensProjectConfig,
+  resolvePiLensConfig
+} from "./chunk-2BBLFX75.js";
 import {
   findNearestDirWithAnyBasename,
-  findNearestDirWithMarker
-} from "./chunk-VNMT7C64.js";
+  findNearestDirWithMarker,
+  getPiLensGlobalConfigPath
+} from "./chunk-XVF2VVXP.js";
+import {
+  getProjectTrustState,
+  projectTrustDenialReason
+} from "./chunk-ZANLILYD.js";
 import {
   killedForOutputCap,
   truncatedByOutputCap,
   writeFileAtomic
 } from "./chunk-2EECBNC5.js";
 import {
-  compareOrdinal,
   incrementDegradationCount,
   recordDegradationOnce
-} from "./chunk-N3YQJI6O.js";
+} from "./chunk-JAU72XNY.js";
 import {
   createSubsystemLogger,
   logExtension
-} from "./chunk-O6TQT6RI.js";
+} from "./chunk-XTMJ7XDT.js";
 import {
   logLatency,
   phaseFinished,
   phaseStarted
-} from "./chunk-5THXD6X5.js";
+} from "./chunk-QQNQ7SJW.js";
 import {
   createNdjsonLogger,
   getGlobalPiLensLogDir,
   getMaxLogSizeMB,
   isTestMode
-} from "./chunk-UK3CMEAL.js";
+} from "./chunk-AOHZU2BM.js";
 import {
   FactStore,
   setFactStoreEvictionReporter
-} from "./chunk-NMABWBZN.js";
+} from "./chunk-CHOW74WE.js";
 import {
   BoundedLruCache
 } from "./chunk-ABBOA7UD.js";
@@ -263,7 +266,7 @@ import {
   normalizeMapKey,
   pathsEqual,
   toProjectRelativePath
-} from "./chunk-Q5U6FMDI.js";
+} from "./chunk-N2H3ZPZY.js";
 
 // dist/clients/mcp/analyze.js
 import * as fs19 from "node:fs";
@@ -281,6 +284,8 @@ var DEFAULT_TURN_STATE = {
 };
 var MCP_TURN_STATE_OWNER_ID = `mcp-${process.pid}`;
 var TURN_OWNER_STALE_MS = 30 * 60 * 1e3;
+var TURN_SESSION_PARTITION_TTL_MS = 30 * 60 * 1e3;
+var MAX_TURN_SESSION_PARTITIONS = 16;
 function getLensDir(cwd) {
   return getProjectDataDir(cwd);
 }
@@ -521,7 +526,68 @@ var CacheManager = class {
   /**
    * Read turn state. Returns default if not found.
    */
-  readTurnState(cwd) {
+  readTurnState(cwd, sessionId) {
+    return this.resolveTurnStatePartition(cwd, sessionId).state;
+  }
+  /**
+   * Reserve a secondary's durable partition at turn start. The legacy
+   * envelope may still be ownerless before the first write, so the write
+   * itself cannot infer that this session is concurrent from persisted state.
+   */
+  ensureSecondaryTurnStatePartition(cwd, sessionId) {
+    const envelope = this.readTurnStateEnvelope(cwd);
+    if (envelope.sessions?.[sessionId])
+      return;
+    const secondary = {
+      ...DEFAULT_TURN_STATE,
+      files: {},
+      lastUpdated: (/* @__PURE__ */ new Date()).toISOString(),
+      sessionId,
+      owner: {
+        kind: "pi",
+        id: sessionId,
+        pid: process.pid,
+        lastSeen: (/* @__PURE__ */ new Date()).toISOString()
+      }
+    };
+    this.writeTurnState({
+      ...envelope,
+      sessions: { ...envelope.sessions, [sessionId]: secondary }
+    }, cwd);
+  }
+  /** Resolve the persisted primary/secondary turn-state partition. */
+  resolveTurnStatePartition(cwd, sessionId) {
+    const envelope = this.readTurnStateEnvelope(cwd);
+    const persistedSecondary = sessionId === void 0 ? void 0 : envelope.sessions?.[sessionId];
+    const primary2 = sessionId === void 0 || envelope.owner === void 0 && persistedSecondary === void 0 || envelope.owner?.kind === "pi" && envelope.owner.id === sessionId;
+    const isSecondary = !primary2 && (persistedSecondary !== void 0 || envelope.owner?.kind === "pi" && envelope.owner.pid === process.pid);
+    const state = primary2 ? envelope : persistedSecondary ?? {
+      ...DEFAULT_TURN_STATE,
+      files: {},
+      lastUpdated: (/* @__PURE__ */ new Date()).toISOString()
+    };
+    return {
+      envelope,
+      state,
+      isSecondary,
+      persist: (next) => {
+        if (isSecondary && sessionId !== void 0) {
+          this.writeTurnState({
+            ...envelope,
+            sessions: { ...envelope.sessions, [sessionId]: next }
+          }, cwd);
+        } else
+          this.writeTurnState(next, cwd);
+      },
+      remove: () => {
+        if (!isSecondary || sessionId === void 0)
+          return;
+        const { [sessionId]: _retired, ...remaining } = envelope.sessions ?? {};
+        this.writeTurnState({ ...envelope, sessions: remaining }, cwd);
+      }
+    };
+  }
+  readTurnStateEnvelope(cwd) {
     const statePath = getTurnStatePath(cwd);
     if (!fs.existsSync(statePath)) {
       return {
@@ -531,11 +597,26 @@ var CacheManager = class {
       };
     }
     const state = readJsonCache(statePath, (parsed) => parsed);
-    return state ?? {
+    const envelope = state ?? {
       ...DEFAULT_TURN_STATE,
       files: {},
       lastUpdated: (/* @__PURE__ */ new Date()).toISOString()
     };
+    if (!envelope.sessions)
+      return envelope;
+    const now = Date.now();
+    const liveEntries = Object.entries(envelope.sessions).filter(([, partition]) => {
+      const updated = Date.parse(partition.lastUpdated ?? "");
+      return Number.isFinite(updated) && now - updated <= TURN_SESSION_PARTITION_TTL_MS;
+    });
+    liveEntries.sort(([, left], [, right]) => Date.parse(right.lastUpdated) - Date.parse(left.lastUpdated));
+    const sessions = Object.fromEntries(liveEntries.slice(0, MAX_TURN_SESSION_PARTITIONS));
+    if (Object.keys(sessions).length !== Object.keys(envelope.sessions).length) {
+      const pruned = { ...envelope, sessions };
+      writeFileAtomic(statePath, JSON.stringify(pruned, null, 2));
+      return pruned;
+    }
+    return envelope;
   }
   /**
    * Write turn state.
@@ -602,13 +683,17 @@ var CacheManager = class {
    * current owner; callers must provide an explicit owner id to claim a stale
    * worklist.
    */
-  addModifiedRange(filePath, range, importsChanged, cwd, sessionId, ownerKind = "pi", projectRoot) {
+  addModifiedRange(filePath, range, importsChanged, cwd, sessionId, ownerKind = "pi", projectRoot, analysisRootMode) {
+    if (analysisRootMode !== void 0 && analysisRootMode !== "session" && analysisRootMode !== "linked-worktree")
+      return this.readTurnState(cwd);
     const containmentRoot = projectRoot ?? cwd;
     if (!this.isTurnStatePathWithinRoot(filePath, containmentRoot)) {
       this.log(`turn-state: rejected out-of-project path ${filePath} (project root ${containmentRoot})`);
       return this.readTurnState(cwd);
     }
-    const state = this.readTurnState(cwd);
+    const partition = this.resolveTurnStatePartition(cwd, sessionId !== null ? sessionId : void 0);
+    const useSessionPartition = partition.isSecondary && ownerKind === "pi" && sessionId != null;
+    const state = useSessionPartition ? partition.state : partition.envelope;
     if (sessionId) {
       const owner = {
         kind: ownerKind,
@@ -616,7 +701,7 @@ var CacheManager = class {
         pid: process.pid,
         lastSeen: (/* @__PURE__ */ new Date()).toISOString()
       };
-      if (this.getTurnStateAccess(cwd, owner) === "foreign-live")
+      if (!useSessionPartition && this.getTurnStateAccess(cwd, owner) === "foreign-live")
         return state;
       state.sessionId = sessionId;
       state.owner = owner;
@@ -637,14 +722,23 @@ var CacheManager = class {
         lastEdit: (/* @__PURE__ */ new Date()).toISOString()
       };
     }
-    this.writeTurnState(state, cwd);
+    if (useSessionPartition)
+      partition.persist(state);
+    else
+      this.writeTurnState(state, cwd);
     return state;
   }
   /**
    * Clear turn state (after turn_end processes it).
    */
-  clearTurnState(cwd, owner) {
-    const currentState = this.readTurnState(cwd);
+  clearTurnState(cwd, owner, sessionId) {
+    const partition = this.resolveTurnStatePartition(cwd, sessionId);
+    if (sessionId !== void 0 && partition.isSecondary) {
+      if (partition.envelope.sessions?.[sessionId])
+        partition.remove();
+      return true;
+    }
+    const currentState = partition.envelope;
     const isCurrentOwner = this.getTurnStateAccess(cwd, owner) !== "foreign-live";
     if (!isCurrentOwner && process.pid !== currentState.owner?.pid)
       return false;
@@ -668,35 +762,38 @@ var CacheManager = class {
   /**
    * Increment turn cycle counter.
    */
-  incrementTurnCycle(cwd, owner) {
-    const state = this.readTurnState(cwd);
+  incrementTurnCycle(cwd, owner, sessionId) {
+    const partition = this.resolveTurnStatePartition(cwd, sessionId);
+    const state = partition.state;
+    if (sessionId !== void 0 && state.owner?.id !== sessionId)
+      return state;
     const isCurrentOwner = this.getTurnStateAccess(cwd, owner) !== "foreign-live";
     if (!isCurrentOwner && process.pid !== state.owner?.pid)
       return state;
     state.turnCycles++;
-    this.writeTurnState(state, cwd);
+    partition.persist(state);
     return state;
   }
   /**
    * Check if max cycles exceeded.
    */
-  isMaxCyclesExceeded(cwd) {
-    const state = this.readTurnState(cwd);
+  isMaxCyclesExceeded(cwd, sessionId) {
+    const state = this.readTurnState(cwd, sessionId);
     return state.turnCycles >= state.maxCycles;
   }
   /**
    * Get files that need jscpd re-scan (any edit).
    * Only returns source code files jscpd can meaningfully analyse.
    */
-  getFilesForJscpd(cwd) {
-    const state = this.readTurnState(cwd);
+  getFilesForJscpd(cwd, sessionId) {
+    const state = this.readTurnState(cwd, sessionId);
     return Object.keys(state.files).filter((f) => /\.(ts|tsx|js|jsx|mjs|cjs|py|go|rs|rb|java|cs|php|cpp|c|h|hpp|swift|kt)$/.test(f));
   }
   /**
    * Get files that need madge re-scan (imports changed).
    */
-  getFilesForMadge(cwd) {
-    const state = this.readTurnState(cwd);
+  getFilesForMadge(cwd, sessionId) {
+    const state = this.readTurnState(cwd, sessionId);
     return Object.entries(state.files).filter(([, f]) => f.importsChanged).map(([p]) => p);
   }
   // ---- Utilities ----
@@ -1084,6 +1181,11 @@ var LANGUAGE_CAPABILITY_MATRIX = {
       { mode: "fallback", runnerIds: ["detekt"], filterKinds: ["kotlin"] }
     ]
   },
+  lean: {
+    name: "Lean 4 Diagnostics",
+    capabilities: ["types", "lint"],
+    writeGroups: [primary("lean")]
+  },
   swift: {
     name: "Swift Linting",
     capabilities: ["types", "lint"],
@@ -1158,6 +1260,7 @@ var LANGUAGE_CAPABILITY_MATRIX = {
 function toWritePlan(entry) {
   return {
     name: entry.name,
+    capabilities: entry.capabilities,
     groups: [...entry.writeGroups]
   };
 }
@@ -1208,6 +1311,7 @@ function settledSnapshot(entry) {
     // #3758/#3813: carry the producer's handle so a requeued snapshot keeps
     // the scope that owned it, and the gate's peek can fence with it.
     session: entry.session,
+    sessionId: entry.sessionId,
     result: entry.result
   };
 }
@@ -1218,12 +1322,17 @@ function ownedByLiveSession(entry, site) {
   return entry.session.guardedWrite(`${site}:${entry.runnerId}:${entry.filePath}`, () => true) !== void 0;
 }
 function deferRunnerFindings(entry) {
-  const { session, ...owned } = entry;
+  const { session, sessionId, ...owned } = entry;
   if (session !== void 0 && session.guardedWrite(`${entry.runnerId}:${entry.filePath}`, () => true) === void 0) {
     void entry.promise.catch(() => void 0);
     return;
   }
-  const tracked = { ...owned, session, settled: false };
+  const tracked = {
+    ...owned,
+    session,
+    sessionId,
+    settled: false
+  };
   void tracked.promise.then((result) => {
     tracked.result = result;
     tracked.settled = true;
@@ -1244,6 +1353,7 @@ function requeueRunnerFindings(entry) {
   track({
     ...owned,
     session: entry.session,
+    sessionId: entry.sessionId,
     promise: Promise.resolve(result),
     settled: true,
     result
@@ -1262,7 +1372,7 @@ function track(tracked) {
     }
   }
 }
-async function drainPendingRunnerFindings(maxWaitMs = 2e3) {
+async function drainPendingRunnerFindings(maxWaitMs = 2e3, currentSession, currentSessionId) {
   if (pending.length === 0)
     return [];
   const current = pending.splice(0, pending.length);
@@ -1270,14 +1380,22 @@ async function drainPendingRunnerFindings(maxWaitMs = 2e3) {
   if (maxWaitMs === 0)
     await Promise.resolve();
   if (maxWaitMs > 0 && current.some((entry) => !entry.settled)) {
-    await new Promise((resolve45) => {
-      const timer = setTimeout(resolve45, maxWaitMs);
+    await new Promise((resolve44) => {
+      const timer = setTimeout(resolve44, maxWaitMs);
       timer.unref?.();
     });
   }
   for (const entry of current) {
     if (!ownedByLiveSession(entry, "turn-end"))
       continue;
+    if (currentSessionId !== void 0 && entry.sessionId !== void 0 && entry.sessionId !== currentSessionId) {
+      pending.push(entry);
+      continue;
+    }
+    if (currentSession !== void 0 && entry.session !== void 0 && entry.session.generation !== currentSession.generation) {
+      pending.push(entry);
+      continue;
+    }
     if (entry.settled && entry.result) {
       results.push(settledSnapshot(entry));
     } else {
@@ -1303,6 +1421,26 @@ function pendingRunnerFindingsSize() {
 }
 
 // dist/clients/dispatch/rule-policy.js
+function resolvedRulePolicyMap(root) {
+  const resolved = resolvePiLensConfig({
+    cwd: root,
+    globalDir: getGlobalPiLensDir(),
+    globalConfigPath: getPiLensGlobalConfigPath()
+  });
+  return rulePolicyMapFromConfig(resolved.value.rules);
+}
+function ruleIgnoredForPath(ruleId, filePath, root, policyMap) {
+  const normalized = normalizeRuleId(ruleId);
+  const patterns = [];
+  for (const [configuredId, entry] of Object.entries(policyMap ?? {})) {
+    if (normalizeRuleId(configuredId) !== normalized || !entry?.ignorePaths)
+      continue;
+    patterns.push(...entry.ignorePaths);
+  }
+  if (patterns.length === 0)
+    return false;
+  return isRuleIgnoredForPath(filePath, root, patterns);
+}
 function evaluateRulePolicy(ruleId, policyMap) {
   if (!policyMap)
     return { dropped: false };
@@ -1330,7 +1468,7 @@ function matchesRule(entry, raw, normalized) {
     return true;
   return normalizeRuleId(entry) === normalized;
 }
-function applyRulePolicy(diagnostics, policyMap) {
+function applyRulePolicy(diagnostics, policyMap, options) {
   if (!policyMap)
     return diagnostics;
   let hasFilter = false;
@@ -1339,7 +1477,7 @@ function applyRulePolicy(diagnostics, policyMap) {
       continue;
     }
     const entry = rawEntry;
-    if ((entry.disable?.length ?? 0) > 0 || (entry.select?.length ?? 0) > 0) {
+    if ((entry.disable?.length ?? 0) > 0 || (entry.select?.length ?? 0) > 0 || (entry.ignorePaths?.length ?? 0) > 0) {
       hasFilter = true;
       break;
     }
@@ -1350,6 +1488,9 @@ function applyRulePolicy(diagnostics, policyMap) {
     const ruleId = d.rule ?? d.code;
     if (!ruleId)
       return true;
+    const filePath = d.filePath ?? options.filePath;
+    if (filePath && ruleIgnoredForPath(ruleId, filePath, options.root, policyMap))
+      return false;
     const { dropped } = evaluateRulePolicy(ruleId, policyMap);
     return !dropped;
   });
@@ -1365,12 +1506,14 @@ function rulePolicyMapFromConfig(rules2) {
     const entry = rawEntry;
     const hasDisable = (entry.disable?.length ?? 0) > 0;
     const hasSelect = (entry.select?.length ?? 0) > 0;
-    if (!hasDisable && !hasSelect)
+    const hasIgnorePaths = (entry.ignorePaths?.length ?? 0) > 0;
+    if (!hasDisable && !hasSelect && !hasIgnorePaths)
       continue;
     built ??= {};
     built[key2] = {
       ...hasDisable ? { disable: entry.disable } : {},
-      ...hasSelect ? { select: entry.select } : {}
+      ...hasSelect ? { select: entry.select } : {},
+      ...hasIgnorePaths ? { ignorePaths: entry.ignorePaths } : {}
     };
   }
   return built;
@@ -1610,7 +1753,7 @@ function readFilePrefix(filePath, maxBytes = 4096) {
     }
   }
 }
-function createDispatchContext(filePath, cwd, pi, facts, blockingOnly, modifiedRanges, projectRoot, writeIndex, telemetryModel, telemetryProvider, sessionGeneration) {
+function createDispatchContext(filePath, cwd, pi, facts, blockingOnly, modifiedRanges, projectRoot, writeIndex, telemetryModel, telemetryProvider, sessionGeneration, sessionId, analysisRootMode) {
   const absoluteFilePath = resolveRunnerPath(cwd, filePath);
   const normalizedProjectRoot = normalizeMapKey(path4.resolve(projectRoot ?? cwd));
   const normalizedCwd = normalizeMapKey(resolveLanguageRootForFile(absoluteFilePath, cwd));
@@ -1624,12 +1767,14 @@ function createDispatchContext(filePath, cwd, pi, facts, blockingOnly, modifiedR
     includeDeclarations: false
   }) : void 0;
   const projectConfig = loadPiLensProjectConfig(normalizedCwd);
+  const rulePolicy = resolvedRulePolicyMap(normalizedProjectRoot);
   return {
     filePath: normalizedFilePath,
     projectRoot: normalizedProjectRoot,
     cwd: normalizedCwd,
     kind,
     fileRole,
+    analysisRootMode,
     generatedEvidence: generatedDetail?.evidence,
     generatedLineShapeMean: generatedDetail?.lineShapeMean,
     pi,
@@ -1637,10 +1782,12 @@ function createDispatchContext(filePath, cwd, pi, facts, blockingOnly, modifiedR
     deltaMode: !pi.getFlag("no-delta"),
     facts,
     projectConfig,
+    rulePolicy,
     blockingOnly,
     modifiedRanges,
     writeIndex,
     sessionGeneration,
+    sessionId,
     telemetryModel,
     telemetryProvider,
     toolCwdMemo: {},
@@ -1832,8 +1979,9 @@ function buildCoverageNotice(ctx, runnerLatencies, dedupe) {
     "fact-rules",
     "opengrep"
   ]);
-  const anyLinterHasCoverage = runnerLatencies.some((r) => fallbackRunnerIds.has(r.runnerId) && !STRUCTURAL_RUNNERS.has(r.runnerId) && hasUsableResult(r));
-  if (anyLinterHasCoverage)
+  const TYPE_CAPABLE_FALLBACK_RUNNERS = /* @__PURE__ */ new Set(["mypy"]);
+  const anyFallbackHasCoverage = runnerLatencies.some((r) => fallbackRunnerIds.has(r.runnerId) && !STRUCTURAL_RUNNERS.has(r.runnerId) && hasUsableResult(r) && (!plan?.capabilities.includes("types") || TYPE_CAPABLE_FALLBACK_RUNNERS.has(r.runnerId)));
+  if (anyFallbackHasCoverage)
     return void 0;
   const onceKey = `${ctx.kind}:${ctx.filePath}`;
   if (dedupe) {
@@ -2026,7 +2174,8 @@ async function runGroup(ctx, group, registry, onRunnerResult) {
         markedAtMs,
         writeIndex: ctx.writeIndex,
         promise: deferred,
-        session: ctx.sessionGeneration
+        session: ctx.sessionGeneration,
+        sessionId: ctx.sessionId
       });
       latencies.push({
         runnerId: runner.id,
@@ -2138,6 +2287,19 @@ async function runGroup(ctx, group, registry, onRunnerResult) {
 }
 async function dispatchForFile(ctx, groups, registry, onRunnerResult, options) {
   const _overallStart = Date.now();
+  if (ctx.analysisRootMode === "adopted") {
+    return {
+      diagnostics: [],
+      blockers: [],
+      warnings: [],
+      baselineWarningCount: 0,
+      fixed: [],
+      resolvedCount: 0,
+      output: "",
+      blockerOutput: "",
+      hasBlockers: false
+    };
+  }
   if (ctx.fileRole === "generated") {
     const evidence = ctx.generatedEvidence;
     const lineShapeMean = ctx.generatedLineShapeMean;
@@ -2202,13 +2364,16 @@ async function dispatchForFile(ctx, groups, registry, onRunnerResult, options) {
   }
   const dedupedDiagnostics = dedupeOverlappingDiagnostics(allDiagnostics);
   const fileContent = ctx.facts.getFileFact(ctx.filePath, "file.content") ?? "";
-  const rulePolicy = rulePolicyMapFromConfig(loadPiLensProjectConfig(ctx.projectRoot ?? ctx.cwd).rules);
+  const rulePolicy = ctx.rulePolicy ?? rulePolicyMapFromConfig(loadPiLensProjectConfig(ctx.projectRoot ?? ctx.cwd).rules);
   const applyOutputFilters = (diags) => {
     const dockerOverlap = suppressTrivyConfigDockerOverlap(diags);
     const overlap = suppressLintOverlapsWithLsp(dockerOverlap);
     const inline = applyInlineSuppressions(overlap, fileContent);
     const disposition = applyDispositions(inline, ctx.projectRoot ?? ctx.cwd, ctx.filePath, fileContent);
-    return applyRulePolicy(disposition, rulePolicy);
+    return applyRulePolicy(disposition, rulePolicy, {
+      root: ctx.projectRoot ?? ctx.cwd,
+      filePath: ctx.filePath
+    });
   };
   let visibleDiagnostics = applyOutputFilters(dedupedDiagnostics);
   let resolvedCount = 0;
@@ -2228,14 +2393,14 @@ async function dispatchForFile(ctx, groups, registry, onRunnerResult, options) {
     provider: ctx.telemetryProvider
   };
   if (fixedItems.length > 0) {
-    import("./chunk-ZAWW3AF6.js").then(({ appendToWorklog }) => {
+    import("./chunk-6SDEP3AJ.js").then(({ appendToWorklog }) => {
       appendToWorklog(ctx.cwd, fixedItems, true, worklogIdentity);
     }).catch(() => {
     });
   }
   const fixableWarnings = warnings.filter((d) => d.fixable);
   if (fixableWarnings.length > 0) {
-    import("./chunk-ZAWW3AF6.js").then(({ appendToWorklog }) => {
+    import("./chunk-6SDEP3AJ.js").then(({ appendToWorklog }) => {
       appendToWorklog(ctx.cwd, fixableWarnings, false, worklogIdentity);
     }).catch(() => {
     });
@@ -2429,10 +2594,16 @@ function convertLspDiagnostics(diags, filePath, options = {}) {
 function applyFindingPolicy(diagnostics, options) {
   const inlineKept = applyInlineSuppressions(diagnostics, options.content);
   const disposed = filterDisposed(inlineKept, options);
-  return { kept: applyRulePolicy(disposed, options.policyMap), inlineKept };
+  return {
+    kept: applyRulePolicy(disposed, options.policyMap, {
+      root: options.cwd,
+      filePath: options.filePath
+    }),
+    inlineKept
+  };
 }
 function loadProjectRulePolicyMap(cwd) {
-  return rulePolicyMapFromConfig(loadPiLensProjectConfig(cwd).rules);
+  return resolvedRulePolicyMap(cwd);
 }
 function filterDisposed(diagnostics, options) {
   const identities = options.identities;
@@ -2603,6 +2774,9 @@ function formatCacheAgeLabel(scannedAt, nowMs = Date.now()) {
   const remMinutes = ageMinutes % 60;
   return remMinutes === 0 ? `scanned ${ageHours}h ago` : `scanned ${ageHours}h ${remMinutes}m ago`;
 }
+function admitsProjectWideFindings(sessionRole) {
+  return sessionRole === "primary";
+}
 function gated(file, description, gates, evidence, extra = {}) {
   return { mode: "gated", file, description, gates, evidence, ...extra };
 }
@@ -3441,6 +3615,8 @@ function evaluateAstGrepRules(filePath, rootNode, cwd, kind, options = {}) {
         continue;
       if (catalog.effectiveRules.get(rule.id)?.rule !== rule)
         continue;
+      if (ruleIgnoredForPath(rule.id, filePath, ignoreRoot, options.rulePolicy))
+        continue;
       if (blockingOnly && rule.severity !== "error")
         continue;
       if (isRuleIgnoredForPath(filePath, ignoreRoot, rule.ignores))
@@ -3630,6 +3806,7 @@ var astGrepNapiRunner = {
     const diagnostics = evaluateAstGrepRules(ctx.filePath, rootNode, ctx.cwd, ctx.kind, {
       blockingOnly: runningAsLspSubstitute ? false : ctx.blockingOnly,
       projectRoot: ctx.projectRoot,
+      rulePolicy: ctx.rulePolicy,
       log: (message) => ctx.log(message),
       content,
       sgModule
@@ -6912,6 +7089,7 @@ var lspRunner = {
     let serverFailed = false;
     let lspClientReady = true;
     let diagnosticsInconclusive = false;
+    let inconclusiveServerIds = [];
     let unconfirmedServerIds = [];
     let deferredServerIds = [];
     let usedWarmAttach = false;
@@ -6948,8 +7126,24 @@ var lspRunner = {
       } else {
         lspDiags = touched.diags;
         diagnosticsInconclusive = touched.inconclusive === true;
-        unconfirmedServerIds = touchCoverageGap(touched);
+        inconclusiveServerIds = touched.inconclusiveServerIds ?? [];
+        unconfirmedServerIds = [
+          .../* @__PURE__ */ new Set([
+            ...touchCoverageGap(touched),
+            ...diagnosticsInconclusive ? inconclusiveServerIds : []
+          ])
+        ];
         deferredServerIds = touched.deferredServerIds ?? [];
+        if (diagnosticsInconclusive && touched.binding?.boundToCurrentDisk === false) {
+          const unconfirmed = new Set(unconfirmedServerIds);
+          const currentContentDiags = [];
+          for (const diagnostic of lspDiags) {
+            if (diagnostic.serverId !== void 0 && !unconfirmed.has(diagnostic.serverId)) {
+              currentContentDiags.push(diagnostic);
+            }
+          }
+          lspDiags = currentContentDiags;
+        }
       }
     } catch (err) {
       serverFailed = true;
@@ -6986,7 +7180,7 @@ var lspRunner = {
     if (!lspClientReady) {
       return { status: "skipped", diagnostics: [], semantic: "none" };
     }
-    if (diagnosticsInconclusive) {
+    if (diagnosticsInconclusive && lspDiags.length === 0) {
       return { status: "skipped", diagnostics: [], semantic: "none" };
     }
     if (lspDiags.length === 0) {
@@ -7274,7 +7468,7 @@ var OXLINT_NO_FILES_REPORT_KEYS = /* @__PURE__ */ new Set([
   "start_time"
 ]);
 function resolveLocalVp(cwd) {
-  return findLocalBinUpwards("vp", cwd) ?? null;
+  return localBinPath(findLocalBinUpwards("vp", cwd)) ?? null;
 }
 async function resolveVitePlusCommand(cwd) {
   const local = resolveLocalVp(cwd);
@@ -7746,7 +7940,13 @@ var prismaValidateRunner = {
     const cwd = resolveRunnerCwd(ctx, "prisma-validate");
     const resolved = await resolveLocalFirstAsync("prisma", cwd);
     const absPath = path32.resolve(cwd, ctx.filePath);
-    const result = await safeSpawnAsync(resolved.cmd, [...resolved.args, "validate", "--schema", absPath], { timeout: 2e4, cwd });
+    const result = await safeSpawnAsync(resolved.cmd, [...resolved.args, "validate", "--schema", absPath], {
+      timeout: 2e4,
+      // ONE neutral-cwd seam for npx fallbacks (#4193, #4268 acceptance 3),
+      // an override of the resolver's project cwd that the scan can still see.
+      cwd,
+      ...resolved.cmd === "npx" ? getIsolatedNpxSpawnOptions() : {}
+    });
     if (result.error && !result.stdout && !result.stderr) {
       return { status: "skipped", diagnostics: [], semantic: "none" };
     }
@@ -8101,7 +8301,7 @@ var pyrightRunner = {
         cmd = installedPath;
     }
     if (!cmd) {
-      const { findCommandAsync } = await import("./chunk-HWBZIGMJ.js");
+      const { findCommandAsync } = await import("./chunk-67WMNWEE.js");
       const foundCmd = await findCommandAsync("pyright");
       if (foundCmd)
         cmd = foundCmd;
@@ -9551,7 +9751,7 @@ var taploRunner = {
         claimSource: cover.claimSource
       };
     }
-    let cmd = findLocalBinUpwards("taplo", cwd) ?? null;
+    let cmd = localBinPath(findLocalBinUpwards("taplo", cwd)) ?? null;
     if (!cmd) {
       if (await taplo.isAvailableAsync(cwd)) {
         cmd = taplo.getCommand(cwd);
@@ -10046,13 +10246,9 @@ var vale_default = valeRunner;
 import * as path47 from "node:path";
 
 // dist/clients/cache/rule-cache.js
-import * as crypto from "node:crypto";
 import * as fs18 from "node:fs";
 import * as path46 from "node:path";
 var CACHE_VERSION = "v7";
-function isBundledRuleFile(resolvedFile) {
-  return resolvedFile === BUNDLED_QUERIES_ROOT || resolvedFile.startsWith(BUNDLED_QUERIES_ROOT + path46.sep);
-}
 function reportBundledRulesRootHealth() {
   reportBundledResourceDirHealth("tree-sitter-queries-dir-missing", BUNDLED_QUERIES_ROOT, getBundledQueriesRootHealth(), "bundled tree-sitter query rules");
 }
@@ -10072,18 +10268,7 @@ var RuleCache = class {
     }
   }
   computeRuleHash(ruleFiles) {
-    const hash = crypto.createHash("sha256");
-    for (const file of ruleFiles.sort(compareOrdinal)) {
-      const resolved = path46.resolve(file);
-      if (!fs18.existsSync(resolved))
-        continue;
-      const stat = fs18.statSync(resolved);
-      hash.update(`${file}:${stat.mtimeMs}:${stat.size}`);
-      if (!isBundledRuleFile(resolved)) {
-        hash.update(fs18.readFileSync(resolved));
-      }
-    }
-    return hash.digest("hex").slice(0, 16);
+    return computeRuleFilesFingerprint(ruleFiles);
   }
   get(ruleFiles) {
     try {
@@ -10524,7 +10709,7 @@ var treeSitterRunner = {
     }
     const fileIsTest = isTestFile(filePath);
     const ignoreRoot = ctx.projectRoot ?? ctx.cwd;
-    const effectiveQueries = (ctx.blockingOnly ? languageQueries.filter((q) => q.inline_tier !== "review") : languageQueries).filter((q) => !(fileIsTest && q.skip_test_files) && !isRuleIgnoredForPath(filePath, ignoreRoot, q.ignore_paths));
+    const effectiveQueries = (ctx.blockingOnly ? languageQueries.filter((q) => q.inline_tier !== "review") : languageQueries).filter((q) => !(fileIsTest && q.skip_test_files) && !isRuleIgnoredForPath(filePath, ignoreRoot, q.ignore_paths) && !ruleIgnoredForPath(q.id, filePath, ignoreRoot, ctx.rulePolicy));
     logTreeSitter({
       phase: "queries_loaded",
       filePath,
@@ -10534,6 +10719,9 @@ var treeSitterRunner = {
       cacheHit,
       metadata: { blockingOnly: !!ctx.blockingOnly }
     });
+    if (effectiveQueries.length === 0) {
+      return { status: "succeeded", diagnostics: [], semantic: "none" };
+    }
     const contentFromFacts = ctx.facts.getFileFact(filePath, "file.content");
     const contentOverride = contentFromFacts !== void 0 && contentFromFacts !== null ? contentFromFacts : void 0;
     const diagnostics = [];
@@ -11723,7 +11911,7 @@ var CASCADE_GRAPH_KINDS = /* @__PURE__ */ new Set([
   "cxx"
 ]);
 async function dispatchLintWithResult(filePath, cwd, pi, modifiedRanges, logContext, options) {
-  const ctx = createDispatchContext(filePath, cwd, pi, sessionFacts, options?.blockingOnly ?? true, modifiedRanges, options?.projectRoot, options?.writeIndex, options?.telemetryModel, options?.telemetryProvider, options?.sessionGeneration);
+  const ctx = createDispatchContext(filePath, cwd, pi, sessionFacts, options?.blockingOnly ?? true, modifiedRanges, options?.projectRoot, options?.writeIndex, options?.telemetryModel, options?.telemetryProvider, options?.sessionGeneration, options?.sessionId, options?.analysisRootMode);
   sessionFacts.clearFileFactsFor(ctx.filePath);
   try {
     const kind = ctx.kind;
@@ -12093,6 +12281,7 @@ export {
   filterFindingsByDisposition,
   markUnreconciledFindings,
   formatCacheAgeLabel,
+  admitsProjectWideFindings,
   cascadeCarrySuffix,
   logCascade,
   resetCascadeTierSessionState,