pi-lens 4.4.1 → 4.4.3

package/dist/{chunk-ZZUFZUQZ.js → chunk-H6MF6EVN.js}

@@ -2,17 +2,7 @@ import { createRequire as __pilensCreateRequire } from "node:module"; const requ
 import {
   getLazyInstallAttempt,
   tryLazyInstall
-} from "./chunk-ZOEYVXSV.js";
-import {
-  stripAnsi
-} from "./chunk-FC4RP4I2.js";
-import {
-  isTrivyEnabled,
-  resolveSeverityFloor
-} from "./chunk-YLN4K6WD.js";
-import {
-  rustClient
-} from "./chunk-3MRXIJ6I.js";
+} from "./chunk-OXXKQCSV.js";
 import {
   findingsResult,
   finishParsedRun,
@@ -22,10 +12,23 @@ import {
   isRunnerSkipReason,
   parseToolRun,
   skipUnlessToolRan
-} from "./chunk-TA5L5KWQ.js";
+} from "./chunk-2CD5RS6M.js";
+import {
+  stripAnsi
+} from "./chunk-FC4RP4I2.js";
 import {
   spawnFailedWithNoOutput
-} from "./chunk-FGALODG3.js";
+} from "./chunk-UZ3TUTRV.js";
+import {
+  goClient
+} from "./chunk-XMSXXAHW.js";
+import {
+  isTrivyEnabled,
+  resolveSeverityFloor
+} from "./chunk-77M37OKR.js";
+import {
+  rustClient
+} from "./chunk-MRXKYPCS.js";
 import {
   coveringLaneAvailable,
   createAvailabilityChecker,
@@ -33,6 +36,7 @@ import {
   getDispatchAvailabilityGeneration,
   lspPrimaryCoversFile,
   recordAvailabilityProbeOverrun,
+  resolveAdoptedRootCommand,
   resolveAvailableOrInstall,
   resolveCommandArgsWithInstallFallback,
   resolveLocalFirstAsync,
@@ -40,7 +44,7 @@ import {
   resolveToolCommand,
   resolveToolCommandWithInstallFallback,
   resolveVendorToolCommand
-} from "./chunk-NFXP47RV.js";
+} from "./chunk-YSZNHOBY.js";
 import {
   biomeConfigArgs,
   findCompiledClassesDir,
@@ -59,27 +63,24 @@ import {
   hasYamllintConfig,
   markdownlintConfigArgs,
   ruffConfigArgs
-} from "./chunk-MGIWSROG.js";
+} from "./chunk-RPLINGVB.js";
 import {
   importFactProvider
-} from "./chunk-WSEWKCXU.js";
+} from "./chunk-XCJN5IJU.js";
 import {
   functionFactProvider
-} from "./chunk-MQA2YBAH.js";
+} from "./chunk-76MWC2K6.js";
 import {
   extractFactsFromTree
-} from "./chunk-TQFBZVCG.js";
+} from "./chunk-GXW6K4YJ.js";
 import {
   computeImpactCascade
-} from "./chunk-WATC3IQR.js";
-import {
-  goClient
-} from "./chunk-OYOB3ZFG.js";
+} from "./chunk-2B73ZPOK.js";
 import {
   buildOrUpdateGraph,
   clearReviewGraphWorkspaceCache,
   fileContentProvider
-} from "./chunk-V5MEBST3.js";
+} from "./chunk-YYOIQFRS.js";
 import {
   MAX_BLOCKING_RULE_COMPLEXITY,
   RUNTIME_CONFIG,
@@ -109,19 +110,25 @@ import {
   touchCoverageGap,
   tryWarmAttachedCodeActions,
   tryWarmAttachedDiagnostics
-} from "./chunk-MTDRLSI7.js";
+} from "./chunk-M6HSLBWY.js";
 import {
   mapWithConcurrency
 } from "./chunk-XIMYZ3JA.js";
 import {
   LSP_SERVERS,
   getAstGrepRuleSources,
-  registerRunnerId
-} from "./chunk-IQZXOZ7S.js";
+  registerRunnerId,
+  resolveAnalysisRoot
+} from "./chunk-EU63SDCG.js";
 import {
   augmentPythonEnvironment,
   detectPythonEnvironment
-} from "./chunk-LNOMA3MP.js";
+} from "./chunk-FCSOVF55.js";
+import {
+  loadProjectSnapshot,
+  readJsonCache,
+  readJsonCacheAsync
+} from "./chunk-ZXYDQ3TZ.js";
 import {
   BUNDLED_QUERIES_ROOT,
   classifyTreeSitterWasmError,
@@ -141,16 +148,11 @@ import {
   ruleFilesForLanguage,
   ruleSourceLanguages,
   walk
-} from "./chunk-UEAHAMEI.js";
+} from "./chunk-QHJ6DQ2R.js";
 import {
   buildModuleGraph,
   clearModuleGraphCache
-} from "./chunk-6XX5HCLK.js";
-import {
-  loadProjectSnapshot,
-  readJsonCache,
-  readJsonCacheAsync
-} from "./chunk-AXKPQ6ZI.js";
+} from "./chunk-GBPP5P7X.js";
 import {
   WORD_INDEX_MAX_BYTES,
   deserializeWordIndex,
@@ -158,7 +160,7 @@ import {
   removeWordIndexDocumentAsync,
   scheduleWordIndexPersist,
   updateWordIndexDocumentForEdit
-} from "./chunk-7BX5DWSA.js";
+} from "./chunk-SAEFPSB6.js";
 import {
   PathKeyedMap
 } from "./chunk-Z3CCVDUB.js";
@@ -166,26 +168,24 @@ import {
   WARM_CODE_ACTION_LOOKUP_LIMIT,
   contentHash,
   resolveRunnerPath
-} from "./chunk-XGUL4SLQ.js";
+} from "./chunk-L3BLXZG7.js";
 import {
   isSpawnableCommand
-} from "./chunk-LD7WFTRX.js";
+} from "./chunk-ACXEQZOU.js";
 import {
   logRunnerAdvisoryOnce,
   resolveRunnerCwd,
   resolveRunnerCwdWithReason
-} from "./chunk-IUR76K6A.js";
-import {
-  findLocalBinUpwards
-} from "./chunk-T4QZ6FEH.js";
+} from "./chunk-Q7DUK4LX.js";
 import {
-  getProjectTrustState,
-  projectTrustDenialReason
-} from "./chunk-D6YF5HKX.js";
+  findLocalBinUpwards,
+  localBinPath
+} from "./chunk-AW7R2GWG.js";
 import {
   createAvailabilityProbeFlight,
+  getIsolatedNpxSpawnOptions,
   probeToolAsync
-} from "./chunk-CMU4RMJB.js";
+} from "./chunk-RWWYJ623.js";
 import {
   classifyProbeFailure,
   createAvailabilityLatch,
@@ -195,13 +195,14 @@ import {
   logAvailabilityDecision,
   startHostStallSampler,
   transientRetryDelayMs
-} from "./chunk-O7HZX7CA.js";
+} from "./chunk-VRZP76YM.js";
 import {
   getLspCapableKinds,
   getPrimaryDispatchGroup,
   resolveLanguageRootForFile
-} from "./chunk-VYKKMYVT.js";
+} from "./chunk-QOBUHWHX.js";
 import {
+  getGlobalPiLensDir,
   getProjectDataDir,
   isInSpawnTimeoutCooldown,
   isTestFile,
@@ -209,19 +210,25 @@ import {
   noteSpawnTimeout,
   resolvePiLensFlag,
   safeSpawnAsync
-} from "./chunk-T54VJRAD.js";
+} from "./chunk-C34ZXZ7O.js";
 import {
   detectFileKind
-} from "./chunk-64LU2OVH.js";
+} from "./chunk-PHDMFAKM.js";
 import {
   classifyGeneratedOrArtifactDetailed,
   detectFileRole,
-  loadPiLensProjectConfig
-} from "./chunk-N2IRDBZI.js";
+  loadPiLensProjectConfig,
+  resolvePiLensConfig
+} from "./chunk-2BBLFX75.js";
 import {
   findNearestDirWithAnyBasename,
-  findNearestDirWithMarker
-} from "./chunk-Z6BB4JLQ.js";
+  findNearestDirWithMarker,
+  getPiLensGlobalConfigPath
+} from "./chunk-XVF2VVXP.js";
+import {
+  getProjectTrustState,
+  projectTrustDenialReason
+} from "./chunk-ZANLILYD.js";
 import {
   killedForOutputCap,
   truncatedByOutputCap,
@@ -230,26 +237,26 @@ import {
 import {
   incrementDegradationCount,
   recordDegradationOnce
-} from "./chunk-7ELY2CSM.js";
+} from "./chunk-JAU72XNY.js";
 import {
   createSubsystemLogger,
   logExtension
-} from "./chunk-34OCDWOS.js";
+} from "./chunk-XTMJ7XDT.js";
 import {
   logLatency,
   phaseFinished,
   phaseStarted
-} from "./chunk-3PNFWVHT.js";
+} from "./chunk-QQNQ7SJW.js";
 import {
   createNdjsonLogger,
   getGlobalPiLensLogDir,
   getMaxLogSizeMB,
   isTestMode
-} from "./chunk-VSMJK3ZJ.js";
+} from "./chunk-AOHZU2BM.js";
 import {
   FactStore,
   setFactStoreEvictionReporter
-} from "./chunk-UGSMCQ4D.js";
+} from "./chunk-CHOW74WE.js";
 import {
   BoundedLruCache
 } from "./chunk-ABBOA7UD.js";
@@ -263,7 +270,7 @@ import {
   normalizeMapKey,
   pathsEqual,
   toProjectRelativePath
-} from "./chunk-G3RLJYA2.js";
+} from "./chunk-N2H3ZPZY.js";
 
 // dist/clients/mcp/analyze.js
 import * as fs19 from "node:fs";
@@ -281,6 +288,8 @@ var DEFAULT_TURN_STATE = {
 };
 var MCP_TURN_STATE_OWNER_ID = `mcp-${process.pid}`;
 var TURN_OWNER_STALE_MS = 30 * 60 * 1e3;
+var TURN_SESSION_PARTITION_TTL_MS = 30 * 60 * 1e3;
+var MAX_TURN_SESSION_PARTITIONS = 16;
 function getLensDir(cwd) {
   return getProjectDataDir(cwd);
 }
@@ -521,7 +530,68 @@ var CacheManager = class {
   /**
    * Read turn state. Returns default if not found.
    */
-  readTurnState(cwd) {
+  readTurnState(cwd, sessionId) {
+    return this.resolveTurnStatePartition(cwd, sessionId).state;
+  }
+  /**
+   * Reserve a secondary's durable partition at turn start. The legacy
+   * envelope may still be ownerless before the first write, so the write
+   * itself cannot infer that this session is concurrent from persisted state.
+   */
+  ensureSecondaryTurnStatePartition(cwd, sessionId) {
+    const envelope = this.readTurnStateEnvelope(cwd);
+    if (envelope.sessions?.[sessionId])
+      return;
+    const secondary = {
+      ...DEFAULT_TURN_STATE,
+      files: {},
+      lastUpdated: (/* @__PURE__ */ new Date()).toISOString(),
+      sessionId,
+      owner: {
+        kind: "pi",
+        id: sessionId,
+        pid: process.pid,
+        lastSeen: (/* @__PURE__ */ new Date()).toISOString()
+      }
+    };
+    this.writeTurnState({
+      ...envelope,
+      sessions: { ...envelope.sessions, [sessionId]: secondary }
+    }, cwd);
+  }
+  /** Resolve the persisted primary/secondary turn-state partition. */
+  resolveTurnStatePartition(cwd, sessionId) {
+    const envelope = this.readTurnStateEnvelope(cwd);
+    const persistedSecondary = sessionId === void 0 ? void 0 : envelope.sessions?.[sessionId];
+    const primary2 = sessionId === void 0 || envelope.owner === void 0 && persistedSecondary === void 0 || envelope.owner?.kind === "pi" && envelope.owner.id === sessionId;
+    const isSecondary = !primary2 && (persistedSecondary !== void 0 || envelope.owner?.kind === "pi" && envelope.owner.pid === process.pid);
+    const state = primary2 ? envelope : persistedSecondary ?? {
+      ...DEFAULT_TURN_STATE,
+      files: {},
+      lastUpdated: (/* @__PURE__ */ new Date()).toISOString()
+    };
+    return {
+      envelope,
+      state,
+      isSecondary,
+      persist: (next) => {
+        if (isSecondary && sessionId !== void 0) {
+          this.writeTurnState({
+            ...envelope,
+            sessions: { ...envelope.sessions, [sessionId]: next }
+          }, cwd);
+        } else
+          this.writeTurnState(next, cwd);
+      },
+      remove: () => {
+        if (!isSecondary || sessionId === void 0)
+          return;
+        const { [sessionId]: _retired, ...remaining } = envelope.sessions ?? {};
+        this.writeTurnState({ ...envelope, sessions: remaining }, cwd);
+      }
+    };
+  }
+  readTurnStateEnvelope(cwd) {
     const statePath = getTurnStatePath(cwd);
     if (!fs.existsSync(statePath)) {
       return {
@@ -531,11 +601,26 @@ var CacheManager = class {
       };
     }
     const state = readJsonCache(statePath, (parsed) => parsed);
-    return state ?? {
+    const envelope = state ?? {
       ...DEFAULT_TURN_STATE,
       files: {},
       lastUpdated: (/* @__PURE__ */ new Date()).toISOString()
     };
+    if (!envelope.sessions)
+      return envelope;
+    const now = Date.now();
+    const liveEntries = Object.entries(envelope.sessions).filter(([, partition]) => {
+      const updated = Date.parse(partition.lastUpdated ?? "");
+      return Number.isFinite(updated) && now - updated <= TURN_SESSION_PARTITION_TTL_MS;
+    });
+    liveEntries.sort(([, left], [, right]) => Date.parse(right.lastUpdated) - Date.parse(left.lastUpdated));
+    const sessions = Object.fromEntries(liveEntries.slice(0, MAX_TURN_SESSION_PARTITIONS));
+    if (Object.keys(sessions).length !== Object.keys(envelope.sessions).length) {
+      const pruned = { ...envelope, sessions };
+      writeFileAtomic(statePath, JSON.stringify(pruned, null, 2));
+      return pruned;
+    }
+    return envelope;
   }
   /**
    * Write turn state.
@@ -602,13 +687,17 @@ var CacheManager = class {
    * current owner; callers must provide an explicit owner id to claim a stale
    * worklist.
    */
-  addModifiedRange(filePath, range, importsChanged, cwd, sessionId, ownerKind = "pi", projectRoot) {
+  addModifiedRange(filePath, range, importsChanged, cwd, sessionId, ownerKind = "pi", projectRoot, analysisRootMode) {
+    if (analysisRootMode !== void 0 && analysisRootMode !== "session" && analysisRootMode !== "linked-worktree")
+      return this.readTurnState(cwd);
     const containmentRoot = projectRoot ?? cwd;
     if (!this.isTurnStatePathWithinRoot(filePath, containmentRoot)) {
       this.log(`turn-state: rejected out-of-project path ${filePath} (project root ${containmentRoot})`);
       return this.readTurnState(cwd);
     }
-    const state = this.readTurnState(cwd);
+    const partition = this.resolveTurnStatePartition(cwd, sessionId !== null ? sessionId : void 0);
+    const useSessionPartition = partition.isSecondary && ownerKind === "pi" && sessionId != null;
+    const state = useSessionPartition ? partition.state : partition.envelope;
     if (sessionId) {
       const owner = {
         kind: ownerKind,
@@ -616,7 +705,7 @@ var CacheManager = class {
         pid: process.pid,
         lastSeen: (/* @__PURE__ */ new Date()).toISOString()
       };
-      if (this.getTurnStateAccess(cwd, owner) === "foreign-live")
+      if (!useSessionPartition && this.getTurnStateAccess(cwd, owner) === "foreign-live")
         return state;
       state.sessionId = sessionId;
       state.owner = owner;
@@ -637,14 +726,23 @@ var CacheManager = class {
         lastEdit: (/* @__PURE__ */ new Date()).toISOString()
       };
     }
-    this.writeTurnState(state, cwd);
+    if (useSessionPartition)
+      partition.persist(state);
+    else
+      this.writeTurnState(state, cwd);
     return state;
   }
   /**
    * Clear turn state (after turn_end processes it).
    */
-  clearTurnState(cwd, owner) {
-    const currentState = this.readTurnState(cwd);
+  clearTurnState(cwd, owner, sessionId) {
+    const partition = this.resolveTurnStatePartition(cwd, sessionId);
+    if (sessionId !== void 0 && partition.isSecondary) {
+      if (partition.envelope.sessions?.[sessionId])
+        partition.remove();
+      return true;
+    }
+    const currentState = partition.envelope;
     const isCurrentOwner = this.getTurnStateAccess(cwd, owner) !== "foreign-live";
     if (!isCurrentOwner && process.pid !== currentState.owner?.pid)
       return false;
@@ -668,35 +766,38 @@ var CacheManager = class {
   /**
    * Increment turn cycle counter.
    */
-  incrementTurnCycle(cwd, owner) {
-    const state = this.readTurnState(cwd);
+  incrementTurnCycle(cwd, owner, sessionId) {
+    const partition = this.resolveTurnStatePartition(cwd, sessionId);
+    const state = partition.state;
+    if (sessionId !== void 0 && state.owner?.id !== sessionId)
+      return state;
     const isCurrentOwner = this.getTurnStateAccess(cwd, owner) !== "foreign-live";
     if (!isCurrentOwner && process.pid !== state.owner?.pid)
       return state;
     state.turnCycles++;
-    this.writeTurnState(state, cwd);
+    partition.persist(state);
     return state;
   }
   /**
    * Check if max cycles exceeded.
    */
-  isMaxCyclesExceeded(cwd) {
-    const state = this.readTurnState(cwd);
+  isMaxCyclesExceeded(cwd, sessionId) {
+    const state = this.readTurnState(cwd, sessionId);
     return state.turnCycles >= state.maxCycles;
   }
   /**
    * Get files that need jscpd re-scan (any edit).
    * Only returns source code files jscpd can meaningfully analyse.
    */
-  getFilesForJscpd(cwd) {
-    const state = this.readTurnState(cwd);
+  getFilesForJscpd(cwd, sessionId) {
+    const state = this.readTurnState(cwd, sessionId);
     return Object.keys(state.files).filter((f) => /\.(ts|tsx|js|jsx|mjs|cjs|py|go|rs|rb|java|cs|php|cpp|c|h|hpp|swift|kt)$/.test(f));
   }
   /**
    * Get files that need madge re-scan (imports changed).
    */
-  getFilesForMadge(cwd) {
-    const state = this.readTurnState(cwd);
+  getFilesForMadge(cwd, sessionId) {
+    const state = this.readTurnState(cwd, sessionId);
     return Object.entries(state.files).filter(([, f]) => f.importsChanged).map(([p]) => p);
   }
   // ---- Utilities ----
@@ -1084,6 +1185,11 @@ var LANGUAGE_CAPABILITY_MATRIX = {
       { mode: "fallback", runnerIds: ["detekt"], filterKinds: ["kotlin"] }
     ]
   },
+  lean: {
+    name: "Lean 4 Diagnostics",
+    capabilities: ["types", "lint"],
+    writeGroups: [primary("lean")]
+  },
   swift: {
     name: "Swift Linting",
     capabilities: ["types", "lint"],
@@ -1209,6 +1315,7 @@ function settledSnapshot(entry) {
     // #3758/#3813: carry the producer's handle so a requeued snapshot keeps
     // the scope that owned it, and the gate's peek can fence with it.
     session: entry.session,
+    sessionId: entry.sessionId,
     result: entry.result
   };
 }
@@ -1219,12 +1326,17 @@ function ownedByLiveSession(entry, site) {
   return entry.session.guardedWrite(`${site}:${entry.runnerId}:${entry.filePath}`, () => true) !== void 0;
 }
 function deferRunnerFindings(entry) {
-  const { session, ...owned } = entry;
+  const { session, sessionId, ...owned } = entry;
   if (session !== void 0 && session.guardedWrite(`${entry.runnerId}:${entry.filePath}`, () => true) === void 0) {
     void entry.promise.catch(() => void 0);
     return;
   }
-  const tracked = { ...owned, session, settled: false };
+  const tracked = {
+    ...owned,
+    session,
+    sessionId,
+    settled: false
+  };
   void tracked.promise.then((result) => {
     tracked.result = result;
     tracked.settled = true;
@@ -1245,6 +1357,7 @@ function requeueRunnerFindings(entry) {
   track({
     ...owned,
     session: entry.session,
+    sessionId: entry.sessionId,
     promise: Promise.resolve(result),
     settled: true,
     result
@@ -1263,7 +1376,7 @@ function track(tracked) {
     }
   }
 }
-async function drainPendingRunnerFindings(maxWaitMs = 2e3) {
+async function drainPendingRunnerFindings(maxWaitMs = 2e3, currentSession, currentSessionId) {
   if (pending.length === 0)
     return [];
   const current = pending.splice(0, pending.length);
@@ -1279,6 +1392,14 @@ async function drainPendingRunnerFindings(maxWaitMs = 2e3) {
   for (const entry of current) {
     if (!ownedByLiveSession(entry, "turn-end"))
       continue;
+    if (currentSessionId !== void 0 && entry.sessionId !== void 0 && entry.sessionId !== currentSessionId) {
+      pending.push(entry);
+      continue;
+    }
+    if (currentSession !== void 0 && entry.session !== void 0 && entry.session.generation !== currentSession.generation) {
+      pending.push(entry);
+      continue;
+    }
     if (entry.settled && entry.result) {
       results.push(settledSnapshot(entry));
     } else {
@@ -1303,7 +1424,51 @@ function pendingRunnerFindingsSize() {
   return pending.length;
 }
 
+// dist/clients/dispatch/adopted-root-runners.js
+var ADOPTED_ROOT_RUNNER_ALLOWLIST = [
+  "fish-indent",
+  "php-lint"
+];
+var ADMITTED = new Set(ADOPTED_ROOT_RUNNER_ALLOWLIST);
+function isAdoptedRootRunnerAdmitted(runnerId) {
+  return ADMITTED.has(runnerId);
+}
+function filterGroupsForAdoptedRoot(groups) {
+  const filtered = [];
+  for (const group of groups) {
+    const runnerIds = [];
+    for (const runnerId of group.runnerIds) {
+      if (isAdoptedRootRunnerAdmitted(runnerId))
+        runnerIds.push(runnerId);
+    }
+    if (runnerIds.length === 0)
+      continue;
+    filtered.push(runnerIds.length === group.runnerIds.length ? group : { ...group, runnerIds });
+  }
+  return filtered;
+}
+
 // dist/clients/dispatch/rule-policy.js
+function resolvedRulePolicyMap(root) {
+  const resolved = resolvePiLensConfig({
+    cwd: root,
+    globalDir: getGlobalPiLensDir(),
+    globalConfigPath: getPiLensGlobalConfigPath()
+  });
+  return rulePolicyMapFromConfig(resolved.value.rules);
+}
+function ruleIgnoredForPath(ruleId, filePath, root, policyMap) {
+  const normalized = normalizeRuleId(ruleId);
+  const patterns = [];
+  for (const [configuredId, entry] of Object.entries(policyMap ?? {})) {
+    if (normalizeRuleId(configuredId) !== normalized || !entry?.ignorePaths)
+      continue;
+    patterns.push(...entry.ignorePaths);
+  }
+  if (patterns.length === 0)
+    return false;
+  return isRuleIgnoredForPath(filePath, root, patterns);
+}
 function evaluateRulePolicy(ruleId, policyMap) {
   if (!policyMap)
     return { dropped: false };
@@ -1331,7 +1496,7 @@ function matchesRule(entry, raw, normalized) {
     return true;
   return normalizeRuleId(entry) === normalized;
 }
-function applyRulePolicy(diagnostics, policyMap) {
+function applyRulePolicy(diagnostics, policyMap, options) {
   if (!policyMap)
     return diagnostics;
   let hasFilter = false;
@@ -1340,7 +1505,7 @@ function applyRulePolicy(diagnostics, policyMap) {
       continue;
     }
     const entry = rawEntry;
-    if ((entry.disable?.length ?? 0) > 0 || (entry.select?.length ?? 0) > 0) {
+    if ((entry.disable?.length ?? 0) > 0 || (entry.select?.length ?? 0) > 0 || (entry.ignorePaths?.length ?? 0) > 0) {
       hasFilter = true;
       break;
     }
@@ -1351,6 +1516,9 @@ function applyRulePolicy(diagnostics, policyMap) {
     const ruleId = d.rule ?? d.code;
     if (!ruleId)
       return true;
+    const filePath = d.filePath ?? options.filePath;
+    if (filePath && ruleIgnoredForPath(ruleId, filePath, options.root, policyMap))
+      return false;
     const { dropped } = evaluateRulePolicy(ruleId, policyMap);
     return !dropped;
   });
@@ -1366,12 +1534,14 @@ function rulePolicyMapFromConfig(rules2) {
     const entry = rawEntry;
     const hasDisable = (entry.disable?.length ?? 0) > 0;
     const hasSelect = (entry.select?.length ?? 0) > 0;
-    if (!hasDisable && !hasSelect)
+    const hasIgnorePaths = (entry.ignorePaths?.length ?? 0) > 0;
+    if (!hasDisable && !hasSelect && !hasIgnorePaths)
       continue;
     built ??= {};
     built[key2] = {
       ...hasDisable ? { disable: entry.disable } : {},
-      ...hasSelect ? { select: entry.select } : {}
+      ...hasSelect ? { select: entry.select } : {},
+      ...hasIgnorePaths ? { ignorePaths: entry.ignorePaths } : {}
     };
   }
   return built;
@@ -1611,7 +1781,7 @@ function readFilePrefix(filePath, maxBytes = 4096) {
     }
   }
 }
-function createDispatchContext(filePath, cwd, pi, facts, blockingOnly, modifiedRanges, projectRoot, writeIndex, telemetryModel, telemetryProvider, sessionGeneration) {
+function createDispatchContext(filePath, cwd, pi, facts, blockingOnly, modifiedRanges, projectRoot, writeIndex, telemetryModel, telemetryProvider, sessionGeneration, sessionId, analysisRootMode) {
   const absoluteFilePath = resolveRunnerPath(cwd, filePath);
   const normalizedProjectRoot = normalizeMapKey(path4.resolve(projectRoot ?? cwd));
   const normalizedCwd = normalizeMapKey(resolveLanguageRootForFile(absoluteFilePath, cwd));
@@ -1625,12 +1795,14 @@ function createDispatchContext(filePath, cwd, pi, facts, blockingOnly, modifiedR
     includeDeclarations: false
   }) : void 0;
   const projectConfig = loadPiLensProjectConfig(normalizedCwd);
+  const rulePolicy = resolvedRulePolicyMap(normalizedProjectRoot);
   return {
     filePath: normalizedFilePath,
     projectRoot: normalizedProjectRoot,
     cwd: normalizedCwd,
     kind,
     fileRole,
+    analysisRootMode,
     generatedEvidence: generatedDetail?.evidence,
     generatedLineShapeMean: generatedDetail?.lineShapeMean,
     pi,
@@ -1638,10 +1810,12 @@ function createDispatchContext(filePath, cwd, pi, facts, blockingOnly, modifiedR
     deltaMode: !pi.getFlag("no-delta"),
     facts,
     projectConfig,
+    rulePolicy,
     blockingOnly,
     modifiedRanges,
     writeIndex,
     sessionGeneration,
+    sessionId,
     telemetryModel,
     telemetryProvider,
     toolCwdMemo: {},
@@ -2028,7 +2202,8 @@ async function runGroup(ctx, group, registry, onRunnerResult) {
         markedAtMs,
         writeIndex: ctx.writeIndex,
         promise: deferred,
-        session: ctx.sessionGeneration
+        session: ctx.sessionGeneration,
+        sessionId: ctx.sessionId
       });
       latencies.push({
         runnerId: runner.id,
@@ -2140,6 +2315,36 @@ async function runGroup(ctx, group, registry, onRunnerResult) {
 }
 async function dispatchForFile(ctx, groups, registry, onRunnerResult, options) {
   const _overallStart = Date.now();
+  if (ctx.analysisRootMode === "adopted") {
+    const planned = groups.flatMap((g) => g.runnerIds);
+    groups = filterGroupsForAdoptedRoot(groups);
+    const admitted = new Set(groups.flatMap((g) => g.runnerIds));
+    logLatency({
+      type: "phase",
+      filePath: ctx.filePath,
+      phase: "dispatch_adopted_root_allowlist",
+      durationMs: 0,
+      metadata: {
+        admissionList: ADOPTED_ROOT_RUNNER_ALLOWLIST.join(","),
+        admitted: groups.flatMap((g) => g.runnerIds).join(","),
+        refused: planned.flatMap((id) => admitted.has(id) ? [] : [id]).join(","),
+        noAdmittedRunner: groups.length === 0
+      }
+    });
+    if (groups.length === 0) {
+      return {
+        diagnostics: [],
+        blockers: [],
+        warnings: [],
+        baselineWarningCount: 0,
+        fixed: [],
+        resolvedCount: 0,
+        output: "",
+        blockerOutput: "",
+        hasBlockers: false
+      };
+    }
+  }
   if (ctx.fileRole === "generated") {
     const evidence = ctx.generatedEvidence;
     const lineShapeMean = ctx.generatedLineShapeMean;
@@ -2204,13 +2409,16 @@ async function dispatchForFile(ctx, groups, registry, onRunnerResult, options) {
   }
   const dedupedDiagnostics = dedupeOverlappingDiagnostics(allDiagnostics);
   const fileContent = ctx.facts.getFileFact(ctx.filePath, "file.content") ?? "";
-  const rulePolicy = rulePolicyMapFromConfig(loadPiLensProjectConfig(ctx.projectRoot ?? ctx.cwd).rules);
+  const rulePolicy = ctx.rulePolicy ?? rulePolicyMapFromConfig(loadPiLensProjectConfig(ctx.projectRoot ?? ctx.cwd).rules);
   const applyOutputFilters = (diags) => {
     const dockerOverlap = suppressTrivyConfigDockerOverlap(diags);
     const overlap = suppressLintOverlapsWithLsp(dockerOverlap);
     const inline = applyInlineSuppressions(overlap, fileContent);
     const disposition = applyDispositions(inline, ctx.projectRoot ?? ctx.cwd, ctx.filePath, fileContent);
-    return applyRulePolicy(disposition, rulePolicy);
+    return applyRulePolicy(disposition, rulePolicy, {
+      root: ctx.projectRoot ?? ctx.cwd,
+      filePath: ctx.filePath
+    });
   };
   let visibleDiagnostics = applyOutputFilters(dedupedDiagnostics);
   let resolvedCount = 0;
@@ -2230,14 +2438,14 @@ async function dispatchForFile(ctx, groups, registry, onRunnerResult, options) {
     provider: ctx.telemetryProvider
   };
   if (fixedItems.length > 0) {
-    import("./chunk-3JL6IFD7.js").then(({ appendToWorklog }) => {
+    import("./chunk-6SDEP3AJ.js").then(({ appendToWorklog }) => {
       appendToWorklog(ctx.cwd, fixedItems, true, worklogIdentity);
     }).catch(() => {
     });
   }
   const fixableWarnings = warnings.filter((d) => d.fixable);
   if (fixableWarnings.length > 0) {
-    import("./chunk-3JL6IFD7.js").then(({ appendToWorklog }) => {
+    import("./chunk-6SDEP3AJ.js").then(({ appendToWorklog }) => {
       appendToWorklog(ctx.cwd, fixableWarnings, false, worklogIdentity);
     }).catch(() => {
     });
@@ -2431,10 +2639,16 @@ function convertLspDiagnostics(diags, filePath, options = {}) {
 function applyFindingPolicy(diagnostics, options) {
   const inlineKept = applyInlineSuppressions(diagnostics, options.content);
   const disposed = filterDisposed(inlineKept, options);
-  return { kept: applyRulePolicy(disposed, options.policyMap), inlineKept };
+  return {
+    kept: applyRulePolicy(disposed, options.policyMap, {
+      root: options.cwd,
+      filePath: options.filePath
+    }),
+    inlineKept
+  };
 }
 function loadProjectRulePolicyMap(cwd) {
-  return rulePolicyMapFromConfig(loadPiLensProjectConfig(cwd).rules);
+  return resolvedRulePolicyMap(cwd);
 }
 function filterDisposed(diagnostics, options) {
   const identities = options.identities;
@@ -2605,6 +2819,9 @@ function formatCacheAgeLabel(scannedAt, nowMs = Date.now()) {
   const remMinutes = ageMinutes % 60;
   return remMinutes === 0 ? `scanned ${ageHours}h ago` : `scanned ${ageHours}h ${remMinutes}m ago`;
 }
+function admitsProjectWideFindings(sessionRole) {
+  return sessionRole === "primary";
+}
 function gated(file, description, gates, evidence, extra = {}) {
   return { mode: "gated", file, description, gates, evidence, ...extra };
 }
@@ -3443,6 +3660,8 @@ function evaluateAstGrepRules(filePath, rootNode, cwd, kind, options = {}) {
         continue;
       if (catalog.effectiveRules.get(rule.id)?.rule !== rule)
         continue;
+      if (ruleIgnoredForPath(rule.id, filePath, ignoreRoot, options.rulePolicy))
+        continue;
       if (blockingOnly && rule.severity !== "error")
         continue;
       if (isRuleIgnoredForPath(filePath, ignoreRoot, rule.ignores))
@@ -3632,6 +3851,7 @@ var astGrepNapiRunner = {
     const diagnostics = evaluateAstGrepRules(ctx.filePath, rootNode, ctx.cwd, ctx.kind, {
       blockingOnly: runningAsLspSubstitute ? false : ctx.blockingOnly,
       projectRoot: ctx.projectRoot,
+      rulePolicy: ctx.rulePolicy,
       log: (message) => ctx.log(message),
       content,
       sgModule
@@ -7293,7 +7513,7 @@ var OXLINT_NO_FILES_REPORT_KEYS = /* @__PURE__ */ new Set([
   "start_time"
 ]);
 function resolveLocalVp(cwd) {
-  return findLocalBinUpwards("vp", cwd) ?? null;
+  return localBinPath(findLocalBinUpwards("vp", cwd)) ?? null;
 }
 async function resolveVitePlusCommand(cwd) {
   const local = resolveLocalVp(cwd);
@@ -7616,13 +7836,9 @@ var phpLintRunner = {
   skipTestFiles: false,
   async run(ctx) {
     const cwd = resolveRunnerCwd(ctx, "php-lint");
-    if (!await php.isAvailableAsync(cwd)) {
-      return { status: "skipped", diagnostics: [], semantic: "none" };
-    }
-    const cmd = php.getCommand(cwd);
-    if (!cmd) {
+    const cmd = ctx.analysisRootMode === "adopted" ? resolveAdoptedRootCommand("php", ctx, cwd) : await php.isAvailableAsync(cwd) ? php.getCommand(cwd) : null;
+    if (!cmd)
       return { status: "skipped", diagnostics: [], semantic: "none" };
-    }
     const absPath = path30.resolve(cwd, ctx.filePath);
     const result = await safeSpawnAsync(cmd, ["-l", absPath], {
       timeout: 15e3,
@@ -7765,7 +7981,13 @@ var prismaValidateRunner = {
     const cwd = resolveRunnerCwd(ctx, "prisma-validate");
     const resolved = await resolveLocalFirstAsync("prisma", cwd);
     const absPath = path32.resolve(cwd, ctx.filePath);
-    const result = await safeSpawnAsync(resolved.cmd, [...resolved.args, "validate", "--schema", absPath], { timeout: 2e4, cwd });
+    const result = await safeSpawnAsync(resolved.cmd, [...resolved.args, "validate", "--schema", absPath], {
+      timeout: 2e4,
+      // ONE neutral-cwd seam for npx fallbacks (#4193, #4268 acceptance 3),
+      // an override of the resolver's project cwd that the scan can still see.
+      cwd,
+      ...resolved.cmd === "npx" ? getIsolatedNpxSpawnOptions() : {}
+    });
     if (result.error && !result.stdout && !result.stderr) {
       return { status: "skipped", diagnostics: [], semantic: "none" };
     }
@@ -8120,7 +8342,7 @@ var pyrightRunner = {
         cmd = installedPath;
     }
     if (!cmd) {
-      const { findCommandAsync } = await import("./chunk-BHWHXMQ2.js");
+      const { findCommandAsync } = await import("./chunk-67WMNWEE.js");
       const foundCmd = await findCommandAsync("pyright");
       if (foundCmd)
         cmd = foundCmd;
@@ -8902,10 +9124,7 @@ var fishIndentRunner = {
   skipTestFiles: false,
   async run(ctx) {
     const cwd = resolveRunnerCwd(ctx, "fish-indent");
-    const available = await fishIndent.isAvailableAsync(cwd);
-    if (!available)
-      return { status: "skipped", diagnostics: [], semantic: "none" };
-    const cmd = fishIndent.getCommand(cwd);
+    const cmd = ctx.analysisRootMode === "adopted" ? resolveAdoptedRootCommand("fish_indent", ctx, cwd) : await fishIndent.isAvailableAsync(cwd) ? fishIndent.getCommand(cwd) : null;
     if (!cmd)
       return { status: "skipped", diagnostics: [], semantic: "none" };
     const result = await safeSpawnAsync(cmd, ["--check", ctx.filePath], {
@@ -9570,7 +9789,7 @@ var taploRunner = {
         claimSource: cover.claimSource
       };
     }
-    let cmd = findLocalBinUpwards("taplo", cwd) ?? null;
+    let cmd = localBinPath(findLocalBinUpwards("taplo", cwd)) ?? null;
     if (!cmd) {
       if (await taplo.isAvailableAsync(cwd)) {
         cmd = taplo.getCommand(cwd);
@@ -10528,7 +10747,7 @@ var treeSitterRunner = {
     }
     const fileIsTest = isTestFile(filePath);
     const ignoreRoot = ctx.projectRoot ?? ctx.cwd;
-    const effectiveQueries = (ctx.blockingOnly ? languageQueries.filter((q) => q.inline_tier !== "review") : languageQueries).filter((q) => !(fileIsTest && q.skip_test_files) && !isRuleIgnoredForPath(filePath, ignoreRoot, q.ignore_paths));
+    const effectiveQueries = (ctx.blockingOnly ? languageQueries.filter((q) => q.inline_tier !== "review") : languageQueries).filter((q) => !(fileIsTest && q.skip_test_files) && !isRuleIgnoredForPath(filePath, ignoreRoot, q.ignore_paths) && !ruleIgnoredForPath(q.id, filePath, ignoreRoot, ctx.rulePolicy));
     logTreeSitter({
       phase: "queries_loaded",
       filePath,
@@ -10538,6 +10757,9 @@ var treeSitterRunner = {
       cacheHit,
       metadata: { blockingOnly: !!ctx.blockingOnly }
     });
+    if (effectiveQueries.length === 0) {
+      return { status: "succeeded", diagnostics: [], semantic: "none" };
+    }
     const contentFromFacts = ctx.facts.getFileFact(filePath, "file.content");
     const contentOverride = contentFromFacts !== void 0 && contentFromFacts !== null ? contentFromFacts : void 0;
     const diagnostics = [];
@@ -11727,7 +11949,7 @@ var CASCADE_GRAPH_KINDS = /* @__PURE__ */ new Set([
   "cxx"
 ]);
 async function dispatchLintWithResult(filePath, cwd, pi, modifiedRanges, logContext, options) {
-  const ctx = createDispatchContext(filePath, cwd, pi, sessionFacts, options?.blockingOnly ?? true, modifiedRanges, options?.projectRoot, options?.writeIndex, options?.telemetryModel, options?.telemetryProvider, options?.sessionGeneration);
+  const ctx = createDispatchContext(filePath, cwd, pi, sessionFacts, options?.blockingOnly ?? true, modifiedRanges, options?.projectRoot, options?.writeIndex, options?.telemetryModel, options?.telemetryProvider, options?.sessionGeneration, options?.sessionId, options?.analysisRootMode);
   sessionFacts.clearFileFactsFor(ctx.filePath);
   try {
     const kind = ctx.kind;
@@ -11970,6 +12192,7 @@ async function analyzeFile(filePath, cwd, options = {}) {
   const start = Date.now();
   const result = await dispatchLintWithResult(absPath, cwd, host, void 0, void 0, {
     blockingOnly: options.blockingOnly ?? false,
+    analysisRootMode: resolveAnalysisRoot(absPath, cwd),
     // #3791: this is a pull surface. Each call is an independent question,
     // so the synthetic coverage notice must come back on every call rather
     // than being latched once per session by the dispatcher — otherwise a
@@ -12097,6 +12320,7 @@ export {
   filterFindingsByDisposition,
   markUnreconciledFindings,
   formatCacheAgeLabel,
+  admitsProjectWideFindings,
   cascadeCarrySuffix,
   logCascade,
   resetCascadeTierSessionState,