pi-lens 4.4.2 → 4.4.3

package/CHANGELOG.md

@@ -16,6 +16,31 @@ All notable changes to pi-lens will be documented in this file.
 
 ### Security
 
+## [4.4.3] - 2026-10-11
+
+### Added
+
+- **Adopted out-of-root projects now get global, config-free per-file linters** — when an edit lands in a marked project outside the session root, pi-lens admits only the explicit admission list of dispatch runners that read no project config and cannot execute project code (`php-lint`, `fish-indent`), and only from global or pi-lens-managed binaries; the advisory now says the LSP plus these per-file linters run. Executable paths inside the adopted or session root are refused, including PATH entries and symlink targets. Formatting, autofix, other dispatch runners, whole-project scanners, and automatic tests stay off (refs #4242).
+
+### Fixed
+
+- **LSP warms again in the published package (closes #4314)** — 4.4.2 loaded the LSP stack through a computed `import()` that esbuild could not inline, so every session logged `LSP warm failed: Cannot find module './lsp/capabilities.js'` and the LSP-backed tools went dead. The import is a literal again, and a packaging test now fails the build if any shipped file dynamic-imports something the tarball does not carry.
+
+### Internal
+
+<details>
+<summary>4 internal changes: tests, CI, tooling, and refactors</summary>
+
+- **tmp-hygiene attributes a leaked root to the test file that created it** — the tmp-root interposer records one creator per entry, the serialized owner's failure message names that file beside the prefix owner, and an entry with no observed creator is labelled `created outside the test process, or the creators record was unreadable` instead of taking a prefix owner's blame. (#2912)
+
+- Add an end-to-end witness that a save-only LSP server's diagnostics reach pi-lens exactly when `textDocument/didSave` is sent: the fake stdio server publishes only from its `didSave` branch (`FAKE_LSP_PUBLISH_ON_SAVE`), and a real `createLSPClient` reads the seeded diagnostic after a save touch and none without one (refs #3405).
+
+- Keep a killed scanner scan's report directory inside a harness-owned root: one shared seam (`PI_LENS_TEST_SCANNER_TMPDIR`, `clients/scanner-temp-root.ts`) now parents jscpd, gitleaks, opengrep, and trivy report directories, and the MCP and real-pi test harnesses apply owned scanner roots after caller environment overrides, so even a TMPDIR-overriding child SIGKILLed mid-scan no longer strands a `pi-lens-<scanner>-*` entry in the shared tmpdir and reds `tmp-fixture-hygiene` (refs #4133). The scan-setup cleanup guard is retained as defence-in-depth.
+
+- Flake-shape ratchet: yield the event loop between files so `@ast-grep/napi` releases each parsed tree's native memory, cutting the test file's peak RSS from ~2,049 MB (over the 2,048 MB per-worker budget) to ~313 MB (refs #4292).
+
+</details>
+
 ## [4.4.2] - 2026-10-10
 
 ### Added

package/dist/{chunk-2ZGIZPDG.js → chunk-2VUQMUMT.js}

@@ -54,15 +54,15 @@ import {
   reviewGraphCachePath,
   terminateReviewGraphPersistWorkerForTests,
   waitForReviewGraphPersistsForTests
-} from "./chunk-PV6LR5P5.js";
+} from "./chunk-YYOIQFRS.js";
 import "./chunk-3MED75HT.js";
-import "./chunk-CO2G5PHH.js";
+import "./chunk-M6HSLBWY.js";
 import "./chunk-IBGIOBEE.js";
-import "./chunk-PNQDPDRC.js";
 import "./chunk-XIMYZ3JA.js";
-import "./chunk-ESBQHFMJ.js";
-import "./chunk-34WSVGEM.js";
+import "./chunk-EU63SDCG.js";
 import "./chunk-VWCXW2E7.js";
+import "./chunk-FCSOVF55.js";
+import "./chunk-PNQDPDRC.js";
 import "./chunk-ZXYDQ3TZ.js";
 import "./chunk-5W3R6LFT.js";
 import "./chunk-QHJ6DQ2R.js";
@@ -78,7 +78,7 @@ import "./chunk-GAEGEPOC.js";
 import "./chunk-Z3CCVDUB.js";
 import "./chunk-L3BLXZG7.js";
 import "./chunk-2BEMIWEW.js";
-import "./chunk-66VMUL7Q.js";
+import "./chunk-ACXEQZOU.js";
 import "./chunk-Q7DUK4LX.js";
 import "./chunk-AW7R2GWG.js";
 import "./chunk-RWWYJ623.js";

package/dist/{chunk-ARJ6PLFH.js → chunk-3W7IEVVL.js}

@@ -56,7 +56,7 @@ import {
 } from "./chunk-P7266HLM.js";
 import {
   getToolPath
-} from "./chunk-66VMUL7Q.js";
+} from "./chunk-ACXEQZOU.js";
 import {
   resolveToolCwd
 } from "./chunk-Q7DUK4LX.js";

package/dist/{chunk-5JM2524W.js → chunk-3YN6V5TV.js}

@@ -5,34 +5,35 @@ import {
   acquireWarmWordIndex,
   analyzeFile,
   summarizeWarningTiers
-} from "./chunk-ODBNXWT4.js";
+} from "./chunk-H6MF6EVN.js";
 import "./chunk-OXXKQCSV.js";
 import "./chunk-EJIUXPBX.js";
+import "./chunk-2CD5RS6M.js";
 import "./chunk-FC4RP4I2.js";
-import "./chunk-66SXUJCA.js";
+import "./chunk-UZ3TUTRV.js";
+import "./chunk-XMSXXAHW.js";
+import "./chunk-77M37OKR.js";
+import "./chunk-CSHFH5IN.js";
 import "./chunk-VCHXCQFG.js";
-import "./chunk-IXXDFY73.js";
+import "./chunk-3EFKIGZN.js";
 import "./chunk-MRXKYPCS.js";
-import "./chunk-2CD5RS6M.js";
-import "./chunk-UZ3TUTRV.js";
-import "./chunk-EETY4LF7.js";
-import "./chunk-GOYRYZ2R.js";
+import "./chunk-7DYBLXYA.js";
+import "./chunk-AB3YYG6N.js";
+import "./chunk-YSZNHOBY.js";
 import "./chunk-RPLINGVB.js";
 import "./chunk-XCJN5IJU.js";
 import "./chunk-76MWC2K6.js";
 import "./chunk-GXW6K4YJ.js";
 import "./chunk-2B73ZPOK.js";
-import "./chunk-XMSXXAHW.js";
-import "./chunk-7DYBLXYA.js";
-import "./chunk-PV6LR5P5.js";
+import "./chunk-YYOIQFRS.js";
 import "./chunk-3MED75HT.js";
-import "./chunk-CO2G5PHH.js";
+import "./chunk-M6HSLBWY.js";
 import "./chunk-IBGIOBEE.js";
-import "./chunk-PNQDPDRC.js";
 import "./chunk-XIMYZ3JA.js";
-import "./chunk-ESBQHFMJ.js";
-import "./chunk-34WSVGEM.js";
+import "./chunk-EU63SDCG.js";
 import "./chunk-VWCXW2E7.js";
+import "./chunk-FCSOVF55.js";
+import "./chunk-PNQDPDRC.js";
 import "./chunk-ZXYDQ3TZ.js";
 import "./chunk-5W3R6LFT.js";
 import "./chunk-QHJ6DQ2R.js";
@@ -48,7 +49,7 @@ import "./chunk-GAEGEPOC.js";
 import "./chunk-Z3CCVDUB.js";
 import "./chunk-L3BLXZG7.js";
 import "./chunk-2BEMIWEW.js";
-import "./chunk-66VMUL7Q.js";
+import "./chunk-ACXEQZOU.js";
 import "./chunk-Q7DUK4LX.js";
 import "./chunk-AW7R2GWG.js";
 import "./chunk-RWWYJ623.js";

package/dist/{chunk-CF24OIYI.js → chunk-5UCAH366.js}

@@ -19,7 +19,7 @@ import {
   refreshManagedTool,
   resolveManagedNpmBinPath,
   verifyToolBinary
-} from "./chunk-66VMUL7Q.js";
+} from "./chunk-ACXEQZOU.js";
 import "./chunk-Q7DUK4LX.js";
 import {
   pmBinary,

package/dist/{chunk-NW7BOILN.js → chunk-6STA6Z7I.js}

@@ -9,11 +9,11 @@ import {
   getDeadCodeClients,
   parseVultureOutput,
   stableFindingKey
-} from "./chunk-OG5UUPN7.js";
+} from "./chunk-OCAGUNBC.js";
 import "./chunk-7U2IDNXN.js";
-import "./chunk-VCHXCQFG.js";
 import "./chunk-2CD5RS6M.js";
 import "./chunk-UZ3TUTRV.js";
+import "./chunk-VCHXCQFG.js";
 import "./chunk-PNQDPDRC.js";
 import "./chunk-P7266HLM.js";
 import "./chunk-AW7R2GWG.js";

package/dist/{chunk-66SXUJCA.js → chunk-77M37OKR.js}

@@ -1,11 +1,14 @@
 import { createRequire as __pilensCreateRequire } from "node:module"; const require = __pilensCreateRequire(import.meta.url);
+import {
+  scannerReportParentDir
+} from "./chunk-CSHFH5IN.js";
 import {
   getScratchTreeGlobPatterns,
   nestedWorktreeOffsets
 } from "./chunk-VCHXCQFG.js";
 import {
   SecurityScanClient
-} from "./chunk-IXXDFY73.js";
+} from "./chunk-3EFKIGZN.js";
 import {
   safeSpawnAsync
 } from "./chunk-C34ZXZ7O.js";
@@ -21,7 +24,6 @@ import {
 
 // dist/clients/trivy-client.js
 import * as fs from "node:fs";
-import * as os from "node:os";
 import * as path from "node:path";
 import { mkdtempSync } from "node:fs";
 var EMPTY_RESULT = {
@@ -178,7 +180,7 @@ var TrivyClient = class extends SecurityScanClient {
     const scannedAt = (/* @__PURE__ */ new Date()).toISOString();
     const bin = this.binaryPath ?? "trivy";
     const severities = resolveSeverityFloor(cwd);
-    const outDir = mkdtempSync(path.join(os.tmpdir(), "pi-lens-trivy-"));
+    const outDir = mkdtempSync(path.join(scannerReportParentDir(), "pi-lens-trivy-"));
     const reportPath = path.join(outDir, "trivy-report.json");
     try {
       const result = await safeSpawnAsync(bin, [

package/dist/{chunk-EETY4LF7.js → chunk-AB3YYG6N.js}

@@ -4,7 +4,7 @@ import {
   discoverManagedTool,
   getManagedToolEnvironment,
   resolveAvailableOrInstall
-} from "./chunk-GOYRYZ2R.js";
+} from "./chunk-YSZNHOBY.js";
 import {
   mapWithConcurrency
 } from "./chunk-XIMYZ3JA.js";

package/dist/{chunk-66VMUL7Q.js → chunk-ACXEQZOU.js}

@@ -4057,7 +4057,7 @@ async function stampInstallResolution(toolId) {
     return;
   try {
     const resolutionId = lastInstallResolutionId.get(toolId);
-    const refresh = await import("./chunk-CF24OIYI.js");
+    const refresh = await import("./chunk-5UCAH366.js");
     await refresh.stampManagedToolInstall(toolId, resolutionId);
   } catch {
   }
@@ -4070,7 +4070,7 @@ async function finishInstallAttempt(toolId, ok, startedAt) {
   if (ok) {
     resetSafeSpawnWindowsCommandCache();
     try {
-      const { resetMadgeManagedPathMemo } = await import("./chunk-3WA4HP4I.js");
+      const { resetMadgeManagedPathMemo } = await import("./chunk-EC47DWFA.js");
       resetMadgeManagedPathMemo();
     } catch (err) {
       logSessionStart(`auto-install ${toolId}: madge memo reset failed: ${err.message}`);
@@ -4100,7 +4100,7 @@ async function installTool(toolId, ownsLock) {
           return false;
         const npmPath = await installNpmTool(tool.id, tool.packageName, tool.binaryName, tool.checkArgs, getToolVerificationTimeout(tool), packageEntryVerification(tool), ownsLock);
         if (npmPath !== void 0) {
-          await import("./chunk-CF24OIYI.js").then((m) => m.stampManagedToolInstalled(tool.id, tool.packageName)).catch(() => {
+          await import("./chunk-5UCAH366.js").then((m) => m.stampManagedToolInstalled(tool.id, tool.packageName)).catch(() => {
           });
         }
         return finishInstallAttempt(tool.id, npmPath !== void 0, startedAt);

package/dist/{chunk-3UUPUE3O.js → chunk-CMMHNUZ2.js}

@@ -1,21 +1,24 @@
 import { createRequire as __pilensCreateRequire } from "node:module"; const require = __pilensCreateRequire(import.meta.url);
-import {
-  nestedWorktreeOffsets
-} from "./chunk-VCHXCQFG.js";
 import {
   formatToolFailure
 } from "./chunk-2CD5RS6M.js";
 import "./chunk-UZ3TUTRV.js";
+import {
+  scannerReportParentDir
+} from "./chunk-CSHFH5IN.js";
+import {
+  nestedWorktreeOffsets
+} from "./chunk-VCHXCQFG.js";
 import {
   createAvailabilityChecker,
   findManagedNodeToolBinary,
   resolveAvailableOrInstall
-} from "./chunk-GOYRYZ2R.js";
+} from "./chunk-YSZNHOBY.js";
 import "./chunk-RPLINGVB.js";
-import "./chunk-PNQDPDRC.js";
-import "./chunk-ESBQHFMJ.js";
-import "./chunk-34WSVGEM.js";
+import "./chunk-EU63SDCG.js";
 import "./chunk-VWCXW2E7.js";
+import "./chunk-FCSOVF55.js";
+import "./chunk-PNQDPDRC.js";
 import "./chunk-ZXYDQ3TZ.js";
 import "./chunk-724UL2TJ.js";
 import "./chunk-QOZXJ4NA.js";
@@ -27,7 +30,7 @@ import {
 } from "./chunk-GAEGEPOC.js";
 import "./chunk-Z3CCVDUB.js";
 import "./chunk-2BEMIWEW.js";
-import "./chunk-66VMUL7Q.js";
+import "./chunk-ACXEQZOU.js";
 import "./chunk-Q7DUK4LX.js";
 import {
   findNodeToolBinary
@@ -77,7 +80,6 @@ import "./chunk-NXL4FFQQ.js";
 // dist/clients/jscpd-client.js
 import * as fs from "node:fs";
 import { mkdtempSync } from "node:fs";
-import * as os from "node:os";
 import * as path from "node:path";
 var EMPTY_RESULT = {
   success: false,
@@ -268,27 +270,27 @@ var JscpdClient = class {
   }
   async runScan(cwd, minLines, minTokens, isTsProject) {
     const scannedAt = (/* @__PURE__ */ new Date()).toISOString();
-    const outDir = mkdtempSync(`${os.tmpdir()}${path.sep}pi-lens-jscpd-`);
-    const baseIgnores = [
-      ...getExcludedDirGlobs(),
-      ...getProjectIgnoreGlobs(cwd),
-      "**/*.md",
-      "**/*.txt",
-      "**/*.json",
-      "**/*.yaml",
-      "**/*.yml",
-      "**/*.toml",
-      "**/*.lock",
-      "**/*.test.*",
-      "**/*.spec.*",
-      "**/*.poc.test.*",
-      "**/__tests__/**",
-      "**/tests/**"
-    ];
-    if (isTsProject) {
-      baseIgnores.push("**/*.js", "**/*.jsx");
-    }
+    const outDir = mkdtempSync(path.join(scannerReportParentDir(), "pi-lens-jscpd-"));
     try {
+      const baseIgnores = [
+        ...getExcludedDirGlobs(),
+        ...getProjectIgnoreGlobs(cwd),
+        "**/*.md",
+        "**/*.txt",
+        "**/*.json",
+        "**/*.yaml",
+        "**/*.yml",
+        "**/*.toml",
+        "**/*.lock",
+        "**/*.test.*",
+        "**/*.spec.*",
+        "**/*.poc.test.*",
+        "**/__tests__/**",
+        "**/tests/**"
+      ];
+      if (isTsProject) {
+        baseIgnores.push("**/*.js", "**/*.jsx");
+      }
       const bin = await findNodeToolBinary("jscpd", cwd);
       const { cmd, prefix } = bin ? { cmd: bin, prefix: [] } : this.jscpdManagedPath ? { cmd: this.jscpdManagedPath, prefix: [] } : { cmd: "npx", prefix: ["jscpd"] };
       const config = readProjectJscpdConfig(cwd);

package/dist/chunk-CSHFH5IN.js

@@ -0,0 +1,17 @@
+import { createRequire as __pilensCreateRequire } from "node:module"; const require = __pilensCreateRequire(import.meta.url);
+import {
+  isTestMode
+} from "./chunk-AOHZU2BM.js";
+
+// dist/clients/scanner-temp-root.js
+import * as os from "node:os";
+function scannerReportParentDir() {
+  if (!isTestMode() && process.env.PI_LENS_TEST_SCANNER_HARNESS !== "1")
+    return os.tmpdir();
+  const override = process.env.PI_LENS_TEST_SCANNER_TMPDIR?.trim();
+  return override && override.length > 0 ? override : os.tmpdir();
+}
+
+export {
+  scannerReportParentDir
+};

package/dist/{chunk-3WA4HP4I.js → chunk-EC47DWFA.js}

@@ -3,15 +3,16 @@ import {
   DependencyChecker,
   buildMadgeArgs,
   resetMadgeManagedPathMemo
-} from "./chunk-EETY4LF7.js";
-import "./chunk-GOYRYZ2R.js";
+} from "./chunk-AB3YYG6N.js";
+import "./chunk-YSZNHOBY.js";
 import "./chunk-RPLINGVB.js";
 import {
   mapWithConcurrency
 } from "./chunk-XIMYZ3JA.js";
-import "./chunk-ESBQHFMJ.js";
-import "./chunk-34WSVGEM.js";
+import "./chunk-EU63SDCG.js";
 import "./chunk-VWCXW2E7.js";
+import "./chunk-FCSOVF55.js";
+import "./chunk-PNQDPDRC.js";
 import "./chunk-ZXYDQ3TZ.js";
 import "./chunk-724UL2TJ.js";
 import "./chunk-QOZXJ4NA.js";
@@ -21,7 +22,7 @@ import "./chunk-SAEFPSB6.js";
 import "./chunk-GAEGEPOC.js";
 import "./chunk-Z3CCVDUB.js";
 import "./chunk-2BEMIWEW.js";
-import "./chunk-66VMUL7Q.js";
+import "./chunk-ACXEQZOU.js";
 import "./chunk-Q7DUK4LX.js";
 import "./chunk-AW7R2GWG.js";
 import "./chunk-RWWYJ623.js";