Added
- Dogfood knip on pi-lens's own source (closes #2698)
PreToolUseBash guard hook for the fixer/reviewer non-negotiables (closes #2699)- Add per-analyzer
knip.enabled,jscpd.enabled,madge.enabled,gitleaks.enabled,govulncheck.enabled,deadCode.enabled, andcomplexity.enabledkeys plusstartup.modeandstartup.scans.enabledcontrols (refs #2721)
Changed
- Nightly tracking-issue updates share one reusable CLI (closes #2683)
- oxlint advisory tier (categories, plugins, type-aware) and publint on the packed tarball (refs #2700, refs #2697)
- Internal: 295 unused exports, 235 unused exported types and 4 duplicate exports removed, with the 85 declarations that became dead (refs #2708)
- knip advisory job green: the last three unused test-support exports are private, the dead `scripts/hooks/
- Cleared 51 of the 54 knip rows (23 of the 26 unused test exports; the 3 flake-shape rows stay for #2742) and 28 unused exported test types (refs #2708)
- Advisory CI adds jscpd, yamllint, typos, and taplo (refs #2706)
- Delegated-worker contract: handoff files for workers without Git authority (refs #2733, #2721)
- Reviewer contract diffs from the merge base
Fixed
- Keep admission registry ordering checks mutation-sensitive.
- Turn-end session test doubles use the shared runner-error predicate (closes #2673)
- yamllint, ruff, spellcheck, psscriptanalyzer, oxlint, and shellcheck now lint from the project's cwd, not the extension host's (closes #2691)
- Call-site sweeps now share the AST-backed
sweep-kit.callSitesseam (refs #2694) - The sweep-floor meta-sweep now matches floor calls over comment- and string-blanked source (closes #2710)
- PHP LSP (intelephense) now installs (closes #2722)
- Custom LSP servers that never publish diagnostics are navigation-only, not timed out (closes #2765)
- Read-guard exemption globs and the file-utils directory glob no longer backtrack on adjacent wildcards (closes #2622)
- The install-time warm-loader log now honors
PI_LENS_HOME(closes #2628) - Require title close keywords to be repeated in the PR body, preventing the four 2026-09-06 incidents including #2610's merge …
- The flake-shape ratchet now sees child processes routed through test support helpers (refs #2653)
- Managed npm refreshes deduplicate shared packages (closes #2666)
- Hold the merge train for unconcluded gating checks (closes #2679)
scripts/npm-retry.mjsannotatesinfra: registry unreachableonly for network-shaped failures (closes #2684)- LSP and smoke harness scratch directories use liveness-gated cleanup (closes #2688, closes #2687)
- Guard-bash preserves here-string boundaries and classifies heredoc substitutions the way bash expands them (closes #2705, refs #2726)
- Fail the oxlint advisory tier when type-aware support is unavailable (refs #2709)
- A red
Tool smoke (nightly)run now notifies through a persistent tracking issue, on the failure path too (closes #2723) - Heredoc bodies no longer leak into Bash command analysis (refs #2726)
- Turn-end test failures now reach the next model context without a terminal entry (closes #2733)
- Test ratchets now ignore comment and string laundering when matching source requirements (closes #2736)
- Formatters now run from the project root (closes #2756)
- Remove the unused scratch export and declaration, and fix oxfmt violations in two tests (refs #2759).
- Nightly tool smoke: the six
--installsteps share one tool tree again (refs #2762, refs #2687) - Format smoke rows classify typed unavailable outcomes as skips (refs #2767)
- Ledger fields no longer read
[object Object], and a rejected LSP push-wait no longer surfaces as an unhandled rejection (refs #2700)