@herbertgao/pi-extensions 2026.8.13 → 2026.8.15

package/node_modules/pi-lens/dist/clients/dispatch/runners/ast-grep-napi.js

@@ -2,7 +2,9 @@
  * ast-grep NAPI runner for dispatch system
  *
  * Uses @ast-grep/napi for programmatic parsing instead of CLI.
- * Handles TypeScript/JavaScript/CSS/HTML files with YAML rule support.
+ * The languages it can serve are exactly the grammars that addon bundles —
+ * see `NAPI_LANGUAGE_BINDINGS` for the matrix and for what the other twelve
+ * catalog languages deliver through instead.
  *
  * Replaces CLI-based runners for faster performance (100x speedup).
  */
@@ -15,9 +17,9 @@ import { logLatency } from "../../latency-logger.js";
 import { hasEslintConfig } from "../../tool-policy.js";
 import { enabledAuxiliaryLspServerIds } from "../auxiliary-lsp.js";
 import { classifyDefect } from "../diagnostic-taxonomy.js";
-import { recordDegradationOnce } from "../../degradation-ledger.js";
-import { isAuxiliaryLspAlive } from "../../lsp/index.js";
-import { resolveAstGrepNativeExe } from "../../lsp/wait-policy/index.js";
+import { incrementDegradationCount, recordDegradationOnce, } from "../../degradation-ledger.js";
+import { hasAuxiliaryLspPublishedForRoot } from "../../lsp/index.js";
+import { clearPendingAuxiliaryCoverage, hasPendingAuxiliaryCoverage, recordNapiFallbackCoverage, } from "../../lsp/pending-aux-coverage.js";
 import { PRIORITY } from "../priorities.js";
 import { calculateRuleComplexity, isOverlyBroadPattern, isStructuredRule, loadYamlRules, loadYamlRulesFresh, MAX_BLOCKING_RULE_COMPLEXITY, } from "./yaml-rule-parser.js";
 const defaultUnsupportedLanguageLog = new Set();
@@ -200,8 +202,85 @@ export function resetAstGrepNapiLoadState() {
     sgSessionHold = false;
     sgHoldReason = undefined;
 }
-// Supported extensions for NAPI
-const SUPPORTED_EXTS = [".ts", ".tsx", ".js", ".jsx", ".css", ".html", ".htm"];
+const NAPI_LANGUAGE_BINDINGS = [
+    // `.mts`/`.cts` and `.mjs`/`.cjs` are the same two grammars under a
+    // module-system-flavored extension; leaving them off the old hand list meant
+    // the whole catalog went dark on every ES/CommonJS module file (#2215).
+    {
+        ruleLanguage: "typescript",
+        napiExport: "ts",
+        extensions: [".ts", ".mts", ".cts"],
+    },
+    { ruleLanguage: "tsx", napiExport: "tsx", extensions: [".tsx"] },
+    {
+        ruleLanguage: "javascript",
+        napiExport: "js",
+        // `.jsx` stays on the `js` grammar it has always used here. The addon
+        // also exports a separate `jsx`, but switching to it is a matching
+        // change, not a coverage one, and belongs with its own fixtures.
+        extensions: [".js", ".jsx", ".mjs", ".cjs"],
+    },
+    { ruleLanguage: "css", napiExport: "css", extensions: [".css"] },
+    { ruleLanguage: "html", napiExport: "html", extensions: [".html", ".htm"] },
+];
+const BINDING_BY_EXTENSION = new Map(NAPI_LANGUAGE_BINDINGS.flatMap((binding) => binding.extensions.map((ext) => [ext, binding])));
+const SUPPORTED_RULE_LANGUAGES = NAPI_LANGUAGE_BINDINGS.map((binding) => binding.ruleLanguage);
+/**
+ * Rule `language:` tokens the shipped catalog carries that NO bundled napi
+ * grammar can parse. Their rules deliver through the ast-grep LSP/CLI, which
+ * ships its own grammar set — never in-process. One shared reason, so this is
+ * a list of decisions rather than twelve copies of a sentence: the addon
+ * bundles six grammars (see `NAPI_LANGUAGE_BINDINGS`) and nothing registers
+ * more at runtime.
+ *
+ * The LSP/CLI half of that claim is measured, not assumed: every entry below
+ * was run through the real `ast-grep run -l <lang>` on 2026-08-26 and parsed,
+ * with `cobol` as the negative control (`cobol is not supported!`, exit 2). So
+ * no catalog language is unreachable by BOTH engines — the issue's
+ * "genuinely missing" bucket is empty, and this list is a routing fact rather
+ * than a coverage hole.
+ *
+ * This is the deliberate-exclusion half of the #2215 contract; the served half
+ * is derived from the addon itself. `ast-grep-napi-language-coverage.test.ts`
+ * reds when a catalog language with enabled rules is in neither half.
+ */
+export const AST_GREP_LSP_ONLY_RULE_LANGUAGES = [
+    "c",
+    "cpp",
+    "csharp",
+    "go",
+    "java",
+    "kotlin",
+    "php",
+    "python",
+    "ruby",
+    "rust",
+    "scala",
+    "swift",
+];
+const LSP_ONLY_RULE_LANGUAGES = new Set(AST_GREP_LSP_ONLY_RULE_LANGUAGES);
+/**
+ * How a rule's declared language reaches the user. `unclassified` is the
+ * runtime signal that the #2215 class regrew: rules ship for a language nobody
+ * decided a delivery route for, so they may run nowhere at all.
+ */
+export function deliveryRouteForRuleLanguage(ruleLanguage) {
+    if (SUPPORTED_RULE_LANGUAGES.includes(ruleLanguage))
+        return "napi";
+    return LSP_ONLY_RULE_LANGUAGES.has(ruleLanguage)
+        ? "ast-grep-lsp-cli"
+        : "unclassified";
+}
+/**
+ * Delivery route for one aggregated skip key. A `mismatch:<rule>-><file>` key
+ * is a rule whose language this engine DOES serve and that simply isn't this
+ * file's grammar, so it still routes through napi on its own files.
+ */
+function skipRouteFor(key) {
+    return key.startsWith("mismatch:")
+        ? "napi"
+        : deliveryRouteForRuleLanguage(key);
+}
 /** Maximum matches per rule to prevent excessive false positives */
 const MAX_MATCHES_PER_RULE = 10;
 /** Maximum total diagnostics per file to prevent output spam */
@@ -302,7 +381,7 @@ function matchesRuleIgnores(filePath, root, patterns) {
     return patterns.some((pattern) => minimatch(rel, pattern, { dot: true }));
 }
 export function canHandle(filePath) {
-    return SUPPORTED_EXTS.includes(path.extname(filePath).toLowerCase());
+    return BINDING_BY_EXTENSION.has(path.extname(filePath).toLowerCase());
 }
 /**
  * The TypeScript grammar is a syntactic superset of JavaScript, so a
@@ -327,41 +406,35 @@ export function canHandle(filePath) {
  * parsed as tsx (ast-grep-tsx-coverage.test.ts) rather than assumed.
  * Without this exception the entire TS ruleset silently never runs on
  * `.tsx` files. `TSX`-tagged rules stay `.tsx`-exclusive; the exception
- * is TS→TSX only. Returns undefined for extensions this scoping doesn't
- * apply to (css/html), where no filtering is added.
+ * is TS→TSX only. Returns undefined for an extension outside the matrix.
  */
 export function ruleLanguageForFile(filePath) {
-    const ext = path.extname(filePath).toLowerCase();
-    switch (ext) {
-        case ".ts":
-            return "typescript";
-        case ".tsx":
-            return "tsx";
-        case ".js":
-        case ".jsx":
-            return "javascript";
-        default:
-            return undefined;
-    }
+    return BINDING_BY_EXTENSION.get(path.extname(filePath).toLowerCase())
+        ?.ruleLanguage;
 }
+/**
+ * The grammar for `filePath` on the addon that actually loaded, or undefined
+ * when there is none.
+ *
+ * Both callers (this file's runner and clients/project-diagnostics/scanner.ts)
+ * gate on `canHandle` first, so an undefined return HERE means the matrix
+ * admitted the file and the addon then dropped it — the silent skip #2215 is
+ * about, which is why it records instead of just returning. An extension
+ * outside the matrix was never admitted, so it records nothing.
+ */
 export function getLang(filePath, sgModule) {
-    const ext = path.extname(filePath).toLowerCase();
-    switch (ext) {
-        case ".ts":
-            return sgModule.ts;
-        case ".tsx":
-            return sgModule.tsx;
-        case ".js":
-        case ".jsx":
-            return sgModule.js;
-        case ".css":
-            return sgModule.css;
-        case ".html":
-        case ".htm":
-            return sgModule.html;
-        default:
-            return undefined;
+    const binding = BINDING_BY_EXTENSION.get(path.extname(filePath).toLowerCase());
+    if (!binding)
+        return undefined;
+    const lang = sgModule[binding.napiExport];
+    if (!lang) {
+        recordDegradationOnce({
+            kind: "ast-grep-napi-language-unavailable",
+            subject: binding.ruleLanguage,
+            reason: `@ast-grep/napi exposes no "${binding.napiExport}" grammar; every ${binding.ruleLanguage} rule is skipped in-process this session`,
+        });
     }
+    return lang;
 }
 function duplicateRuleIds(rules) {
     const counts = new Map();
@@ -467,6 +540,13 @@ export function evaluateAstGrepRules(filePath, rootNode, cwd, kind, options = {}
                     {
                         count: ruleIds.length,
                         ruleIds: ruleIds.slice(0, UNSUPPORTED_RULE_ID_SAMPLE_SIZE),
+                        // #2215: a skip count alone says a rule did not run and
+                        // nothing about whether it runs anywhere else. `route` names
+                        // the delivery path (`ast-grep-lsp-cli` for the twelve
+                        // grammar-less catalog languages); `unclassified` means rules
+                        // ship for a language nobody decided a route for, which is the
+                        // class this issue closed regrowing.
+                        route: skipRouteFor(language),
                     },
                 ])),
             },
@@ -520,11 +600,14 @@ export function evaluateAstGrepRules(filePath, rootNode, cwd, kind, options = {}
                 !isStructuredRule(rule)) {
                 continue;
             }
+            // CSS and HTML rules are scoped to their parsed roots.
+            // Without this scope, language-tagged rules scan unrelated roots.
+            // The file-language mismatch check below enforces this scope.
+            // CSS rules therefore run only on CSS roots.
+            // This preserves CSS rule findings while avoiding unrelated scans.
+            // The fallback and LSP paths share the same parsed-language scope.
             const lang = rule.language?.toLowerCase();
-            if (lang &&
-                lang !== "typescript" &&
-                lang !== "tsx" &&
-                lang !== "javascript") {
+            if (lang && !SUPPORTED_RULE_LANGUAGES.includes(lang)) {
                 if (!unsupportedLanguageLog.has(lang)) {
                     const ids = newlyUnsupported.get(lang) ?? [];
                     ids.push(rule.id);
@@ -640,7 +723,7 @@ export function evaluateAstGrepRules(filePath, rootNode, cwd, kind, options = {}
 // --- Runner Definition ---
 const astGrepNapiRunner = {
     id: "ast-grep-napi",
-    appliesTo: ["jsts"],
+    appliesTo: ["jsts", "css", "html"],
     priority: PRIORITY.SPECIALIZED_ANALYSIS,
     enabledByDefault: true,
     skipTestFiles: true,
@@ -654,20 +737,31 @@ const astGrepNapiRunner = {
         // report against the LSP's `tool: ast-grep` diagnostics. Resume ONLY as the
         // fallback when the binary is absent / can't spawn (Gate B).
         const astGrepLspEnabled = enabledAuxiliaryLspServerIds((f) => ctx.pi?.getFlag?.(f)).includes("ast-grep");
-        // Gate B asks whether the LSP will handle this file, not whether a bare
-        // `ast-grep` command happens to be on PATH. The launcher first tries the
-        // platform-native package binary, then PATH; mirror that resolution here.
-        // A live client covers the already-warm case, while a resolvable binary
-        // covers the cold case before the LSP has spawned for this root.
-        const astGrepLspAlive = astGrepLspEnabled
-            ? await isAuxiliaryLspAlive("ast-grep", ctx.filePath)
+        // Gate B asks whether the LSP has proved it can handle this root, not
+        // whether an ast-grep process or binary merely exists.
+        // A first publication covers the warm case. Process liveness and binary
+        // resolution do not: both precede proof that this root can publish findings.
+        const astGrepLspPublished = astGrepLspEnabled
+            ? await hasAuxiliaryLspPublishedForRoot("ast-grep", ctx.filePath)
             : false;
-        let astGrepBinaryResolvable = false;
-        if (astGrepLspEnabled && !astGrepLspAlive) {
-            astGrepBinaryResolvable =
-                Boolean(resolveAstGrepNativeExe()) || (await ctx.hasTool("ast-grep"));
-        }
-        if (astGrepLspEnabled && (astGrepLspAlive || astGrepBinaryResolvable)) {
+        if (astGrepLspEnabled && astGrepLspPublished) {
+            // #2324 F2/R2-C: "has this server EVER published for this file" can go
+            // stale — a LATER touch's aux-grace wait can find the server silent
+            // for the CURRENT content while an OLDER revision's publication still
+            // satisfies this per-file gate. Any pending late-aux entry visible
+            // HERE is necessarily a LEFTOVER from an earlier touch, never this
+            // one: the wait that marks a pair for THIS touch runs to completion
+            // (up to its own grace budget, ~1800ms) strictly AFTER this
+            // synchronous Gate-B check returns, so it cannot have marked
+            // anything yet. Re-running napi here would risk the F3 duplicate
+            // this fix closes, so the loss is made observable instead.
+            if (hasPendingAuxiliaryCoverage(ctx.filePath, "ast-grep")) {
+                incrementDegradationCount({
+                    kind: "aux-runner-findings-lost",
+                    subject: "ast-grep",
+                    reason: `Gate B skipped napi for ${ctx.filePath}: a pending late-auxiliary pair from an EARLIER touch is still undelivered while a prior publication satisfies the per-file gate`,
+                });
+            }
             return { status: "skipped", diagnostics: [], semantic: "none" };
         }
         const sgModule = await loadSg();
@@ -718,6 +812,31 @@ const astGrepNapiRunner = {
         catch {
             return { status: "skipped", diagnostics: [], semantic: "none" };
         }
+        if (astGrepLspEnabled && !astGrepLspPublished) {
+            // #2324 F3/R2-A/R2-B: napi is about to ACTUALLY EVALUATE RULES —
+            // every early-return skip above (load failure, missing file,
+            // unresolved language, stat/size/read/parse failure) is now behind
+            // us, so this run genuinely covers the file rather than reporting a
+            // zero-finding no-op. Placing this here (not at Gate-B's decision
+            // point) matters twice over:
+            //   - R2-B: a napi run that never reached rule evaluation must NOT
+            //     consume anything — an unparseable .html file, say, would
+            //     otherwise silence the LSP's legitimate late delivery for a
+            //     file napi never actually covered.
+            //   - R2-A: recording coverage HERE, keyed by timestamp, lets the
+            //     aux-grace wait (clients/lsp/index.ts) — which decides whether
+            //     to mark a pending pair for THIS touch strictly AFTER this
+            //     synchronous call returns — see that napi already delivered
+            //     and skip marking, instead of racing a clear against a mark
+            //     that has not been written yet.
+            // The clear below only ever removes a LEFTOVER pair from an
+            // EARLIER touch (this touch's own pair, if the wait decides to
+            // mark one, is marked strictly later) — that pair describes a
+            // PREVIOUS revision this fresh evaluation supersedes, so dropping
+            // it is safe. Unknown pairs are a no-op.
+            recordNapiFallbackCoverage(ctx.filePath);
+            clearPendingAuxiliaryCoverage(ctx.filePath, "ast-grep");
+        }
         const diagnostics = evaluateAstGrepRules(ctx.filePath, rootNode, ctx.cwd, ctx.kind, {
             blockingOnly: ctx.blockingOnly,
             projectRoot: ctx.projectRoot,

package/node_modules/pi-lens/dist/clients/dispatch/runners/eslint.js

@@ -24,7 +24,11 @@ function makeEslintProbe(cmd) {
     return createCwdCachedProbe((cwd) => safeSpawnAsync(cmd, ["--version"], {
         timeout: ESLINT_PROBE_BUDGET_MS,
         cwd,
-    }), { tool: "eslint", budgetMs: ESLINT_PROBE_BUDGET_MS });
+    }), {
+        tool: "eslint",
+        budgetMs: ESLINT_PROBE_BUDGET_MS,
+        flightKeyComponent: cmd,
+    });
 }
 const eslintAvailabilityByCmd = new Map();
 function getEslintProbe(cmd) {

package/node_modules/pi-lens/dist/clients/dispatch/runners/helm-lint.js

@@ -2,12 +2,18 @@ import * as path from "node:path";
 import { PathKeyedMap } from "../../path-keyed-map.js";
 import { normalizeMapKey } from "../../path-utils.js";
 import { safeSpawnAsync } from "../../safe-spawn.js";
+import { truncatedByOutputCap } from "../../spawn-output-cap.js";
 import { findNearestDirWithMarker } from "../../workspace-topology.js";
 import { PRIORITY } from "../priorities.js";
 import { createAvailabilityChecker, resolveAvailableOrInstall, } from "./utils/runner-helpers.js";
 const helm = createAvailabilityChecker("helm", ".exe");
 const inFlightByChartRoot = new PathKeyedMap(normalizeMapKey);
 const HELM_LINT_TIMEOUT_MS = 30_000;
+// `helm lint` prints one `[LEVEL]` line per finding for one chart, so nothing
+// legitimate approaches 8 MiB: this bounds a wedged or runaway helm rather than
+// real lint output, and it is what makes `outputTruncated` reachable for this
+// runner at all (#2100). Same value as the sibling report caps.
+const MAX_HELM_LINT_OUTPUT_BYTES = 8 * 1024 * 1024;
 const SKIPPED = {
     status: "skipped",
     diagnostics: [],
@@ -93,7 +99,17 @@ async function lintChart(chartRoot, cwd) {
         timeout: HELM_LINT_TIMEOUT_MS,
         deadlineAt: Date.now() + HELM_LINT_TIMEOUT_MS,
         resourceLabel: "helm-lint",
+        maxOutputBytes: MAX_HELM_LINT_OUTPUT_BYTES,
     });
+    // FIRST (#2100): the cap kill is OUR SIGTERM, so it also sets
+    // `spawnFailure.kind === "killed"` and `failure === "signal"`. Read after
+    // those two, a truncated lint was reported as a server_error — helm blamed
+    // for output we threw away. A timed-out or aborted run carries
+    // `outputTruncated` too, and `truncatedByOutputCap` leaves those to the
+    // typed-failure block below so they keep reporting timeout/aborted.
+    if (truncatedByOutputCap(result)) {
+        return failedResult("parser_error", "helm lint output was truncated before parsing completed");
+    }
     const output = [result.stdout, result.stderr].filter(Boolean).join("\n");
     const diagnostics = parseHelmLintOutput(output, chartRoot);
     const typedFailure = result.spawnFailure?.kind;
@@ -110,9 +126,6 @@ async function lintChart(chartRoot, cwd) {
     if (result.failure) {
         return failedResult(result.failure === "timeout" ? "timeout" : result.failure, result.error?.message || `helm lint ${result.failure}`);
     }
-    if (result.outputTruncated) {
-        return failedResult("parser_error", "helm lint output was truncated before parsing completed");
-    }
     const hasErrorDiagnostic = diagnostics.some((diagnostic) => diagnostic.severity === "error");
     if (result.status !== 0 && !hasErrorDiagnostic) {
         return failedResult(output.trim() ? "parser_error" : "server_error", output.trim() || "helm lint exited without an error diagnostic");

package/node_modules/pi-lens/dist/clients/dispatch/runners/helm-render.js

@@ -78,6 +78,7 @@ import { normalizeMapKey } from "../../path-utils.js";
 import { loadPiLensProjectConfig } from "../../project-lens-config.js";
 import { getProjectTrustState, projectTrustDenialReason, } from "../../project-trust.js";
 import { safeSpawnAsync } from "../../safe-spawn.js";
+import { killedForOutputCap, truncatedByOutputCap, } from "../../spawn-output-cap.js";
 import { isTrivyEnabled, resolveSeverityFloor } from "../../trivy-client.js";
 import { findNearestDirWithMarker } from "../../workspace-topology.js";
 import { PRIORITY } from "../priorities.js";
@@ -100,6 +101,15 @@ const TRIVY_TIMEOUT_MS = 45_000;
 const MAX_RENDERED_FILES = 400;
 /** Bytes of trivy report we retain. Truncation is reported, never parsed past. */
 const MAX_REPORT_BYTES = 8 * 1024 * 1024;
+/**
+ * Bytes of `helm template` output we retain. The manifests go to `--output-dir`,
+ * so stdout is one short "wrote <path>" line per file — bounded near
+ * {@link MAX_RENDERED_FILES} — and stderr carries template errors. 8 MiB is
+ * therefore a blast-radius bound on a chart that loops or a helm that wedges,
+ * not a working limit, and it is what makes `render.outputTruncated` reachable
+ * at all (#2100).
+ */
+const MAX_RENDER_OUTPUT_BYTES = 8 * 1024 * 1024;
 const SKIPPED = {
     status: "skipped",
     diagnostics: [],
@@ -661,6 +671,16 @@ export async function runIacPass(options) {
         // hold in memory rather than trusting the chart's size (shape 9).
         maxOutputBytes: MAX_REPORT_BYTES,
     });
+    // FIRST (#2100): hitting the cap makes safe-spawn SIGTERM trivy, so a
+    // truncated report also arrives as a killed spawn with a null status. Read
+    // after the gate below, this said "the IaC pass failed" when what actually
+    // happened is that WE stopped reading. A timed-out or aborted scan carries
+    // the flag too and stays with the failure gate, which names its real cause.
+    if (truncatedByOutputCap(scan)) {
+        return [
+            coverageGap(chartRoot, "iac-report-unreadable", `Rendered-manifest IaC checks did not run: the trivy report exceeded ${MAX_REPORT_BYTES} bytes and was truncated before parsing.`),
+        ];
+    }
     const scanFailure = spawnFailureKind(scan);
     // `trivy config` is not given `--exit-code`, so it exits 0 whenever it
     // completed. ANY nonzero status is therefore a real error, with or without
@@ -673,11 +693,6 @@ export async function runIacPass(options) {
             coverageGap(chartRoot, "iac-pass-failed", `Rendered-manifest IaC checks failed to complete (${why}): ${detail}`),
         ];
     }
-    if (scan.outputTruncated) {
-        return [
-            coverageGap(chartRoot, "iac-report-unreadable", `Rendered-manifest IaC checks did not run: the trivy report exceeded ${MAX_REPORT_BYTES} bytes and was truncated before parsing.`),
-        ];
-    }
     const sourceByRendered = new PathKeyedMap(normalizeMapKey);
     for (const manifest of options.manifests) {
         sourceByRendered.set(manifest.renderedPath, {
@@ -754,7 +769,30 @@ async function renderAndValidate(chartRoot, cwd, filePath) {
             timeout: RENDER_TIMEOUT_MS,
             deadlineAt: Date.now() + RENDER_TIMEOUT_MS,
             resourceLabel: "helm-render",
+            maxOutputBytes: MAX_RENDER_OUTPUT_BYTES,
         });
+        const renderOutput = [render.stdout, render.stderr]
+            .filter(Boolean)
+            .join("\n");
+        // `killedForOutputCap` is platform-neutral. POSIX usually reports SIGTERM,
+        // but Windows reports status 1 with no failure or signal. A timed-out or
+        // aborted render retains its own classification.
+        const renderCapped = truncatedByOutputCap(render);
+        if (killedForOutputCap(render)) {
+            // helm was cut off mid-render, so the scratch tree is a PREFIX —
+            // reading it back would report the manifests we never saw as clean
+            // (shape 10). Not parsed as a chart failure either: helm never reported
+            // a verdict, and `parseHelmTemplateFailure` synthesizes a BLOCKING
+            // "helm template failed" finding when it sees no `Error:` line, which
+            // would blame the chart for our own cap (the #1487 inversion).
+            logRenderPass(filePath, chartRoot, startedAt, {
+                outcome: "render-truncated",
+                diagnostics: 1,
+            });
+            return summarize([
+                coverageGap(chartRoot, "render-truncated", `helm template produced more than ${MAX_RENDER_OUTPUT_BYTES} bytes and was stopped mid-render, so the rendered manifests are UNCHECKED rather than clean.`),
+            ]);
+        }
         const startupFailure = spawnFailureKind(render);
         if (startupFailure) {
             // The runner never got a verdict about the chart. Reporting this as a
@@ -766,9 +804,6 @@ async function renderAndValidate(chartRoot, cwd, filePath) {
             });
             return failedResult(startupFailure, render.error?.message || `helm template ${startupFailure}`);
         }
-        const renderOutput = [render.stdout, render.stderr]
-            .filter(Boolean)
-            .join("\n");
         if (render.status !== 0) {
             // Before blaming the chart: did helm reject OUR OWN command line? An old
             // helm (v2 has no `helm template --output-dir`) or a wrapper shim exits
@@ -785,7 +820,9 @@ async function renderAndValidate(chartRoot, cwd, filePath) {
             }
             // A failed RENDER is a real diagnostic: the chart cannot be installed.
             const diagnostics = parseHelmTemplateFailure(renderOutput, chartRoot);
-            if (render.outputTruncated) {
+            if (renderCapped) {
+                // helm reported this failure itself, but we kept only a prefix of
+                // what it said, so the report above may be missing errors.
                 diagnostics.push(coverageGap(chartRoot, "render-truncated", "helm template output was truncated, so this failure report may be incomplete."));
             }
             logRenderPass(filePath, chartRoot, startedAt, {
@@ -804,6 +841,14 @@ async function renderAndValidate(chartRoot, cwd, filePath) {
                 sourceMapped: manifest.sourceMapped,
             }));
         }
+        if (renderCapped) {
+            // helm exited 0, so `--output-dir` holds the COMPLETE tree and every
+            // manifest above was validated from disk — the cap only cost us the
+            // "wrote <path>" lines on stdout, which this runner never parses.
+            // Recorded rather than silent (shape 8), but deliberately not an
+            // UNCHECKED claim: nothing was skipped (review F1).
+            diagnostics.push(coverageGap(chartRoot, "render-output-truncated", `helm template printed more than ${MAX_RENDER_OUTPUT_BYTES} bytes and its stdout was truncated. The rendered manifests were still validated from disk; only helm's own progress output was lost.`));
+        }
         if (tree.truncated) {
             // A partly-validated chart reported as clean is the shape-10 trap.
             diagnostics.push(coverageGap(chartRoot, "render-truncated", `This chart rendered more than ${MAX_RENDERED_FILES} manifests; only the first ${MAX_RENDERED_FILES} were validated, so the rest are UNCHECKED rather than clean.`));

package/node_modules/pi-lens/dist/clients/dispatch/runners/index.js

@@ -57,9 +57,7 @@ export function registerDefaultRunners(registry) {
     registry.register(lspRunner); // Unified LSP type-checking for all languages (priority 4)
     registry.register(pyrightRunner); // Python type-checking (priority 5) - fallback when --lens-lsp disabled
     registry.register(biomeCheckJsonRunner); // Biome check with JSON output for diagnostic capture (priority 9)
-    // DISABLED in post-write dispatch - ast-grep-napi can crash. Runs in the
-    // project-wide pass via lens_diagnostics mode=full (refreshRunners) instead.
-    registry.register(astGrepNapiRunner); // TS/JS structural analysis via NAPI (priority 15, post-write disabled)
+    registry.register(astGrepNapiRunner); // JS/TS, CSS, and HTML structural analysis via NAPI (priority 15)
     registry.register(treeSitterRunner); // Tree-sitter structural analysis (priority 14)
     registry.register(ruffRunner); // Python linting (priority 10)
     registry.register(shellcheckRunner); // Shell script linting (priority 20)

package/node_modules/pi-lens/dist/clients/dispatch/runners/lsp.js

@@ -15,6 +15,7 @@ import { logExtension } from "../../extension-log.js";
 import { getLspCapableKinds } from "../../language-policy.js";
 import { touchCoverageGap } from "../../lsp/diagnostic-binding.js";
 import { getLSPService } from "../../lsp/index.js";
+import { LSP_SERVERS } from "../../lsp/server.js";
 import { RUNTIME_CONFIG } from "../../runtime-config.js";
 import { PRIORITY } from "../priorities.js";
 import { resolveRunnerPath } from "../runner-context.js";
@@ -32,8 +33,42 @@ const LSP_SPAWN_BUDGET_MS = RUNTIME_CONFIG.pipeline.lspSpawnBudgetMs;
 // can't dominate the per-edit pipeline budget. Diagnostics that arrive
 // after the cap still land in the client's cache and surface on the
 // next edit. Overridable via PI_LENS_LSP_DIAGNOSTICS_MAX_WAIT_MS.
-const LSP_DIAGNOSTICS_WAIT_MS = 2500;
+export const LSP_DIAGNOSTICS_WAIT_MS = 2500;
 const MAX_CODE_ACTION_TITLES = 3;
+/**
+ * Fixed margin above the worst-case cold-spawn-plus-diagnostics wait, so
+ * scheduling jitter alone can't reopen the F2 race below.
+ */
+const LSP_COLD_SPAWN_MARGIN_MS = 5_000;
+/**
+ * This runner's own dispatch wall-clock budget. `runRunner` in
+ * `dispatcher.ts` races `runner.timeoutMs ?? RUNNER_TIMEOUT_MS` (30s)
+ * against `runner.run()` for the WHOLE call — reading the file, waiting for
+ * a client (bounded by `LSP_SPAWN_BUDGET_MS`, raised per-server via
+ * `LSPServerInfo.clientWaitTimeoutMs`), then waiting for diagnostics
+ * (`LSP_DIAGNOSTICS_WAIT_MS`).
+ *
+ * Left undeclared, this runner inherited the shared 30s default. A server
+ * whose `clientWaitTimeoutMs` exceeds that — Prisma's 40s, Vue's 30s
+ * (#2169, #2176) — could never actually use its own raised wait: the outer
+ * race always fired first, at 30s, so raising a server's floor without also
+ * raising this ceiling was a no-op on the real dispatch path (fix-round F2,
+ * #2233). Derive the ceiling from the registry instead of a second
+ * hand-picked literal, so the next slow server's `clientWaitTimeoutMs` keeps
+ * this budget correct automatically: the highest declared
+ * `clientWaitTimeoutMs` (or the shared 5s default, whichever is larger),
+ * plus the diagnostics wait that still runs after a cold spawn succeeds,
+ * plus a fixed margin.
+ *
+ * This raises the failure-detection latency for every OTHER language's
+ * hung-server case too (30s -> the value below), not just the five servers
+ * that need the headroom — the tradeoff is stated in PR #2233's body. It
+ * remains well inside the spread other dispatch runners already use
+ * (pyright 75s, golangci-lint/dotnet-build/rust-clippy 90s).
+ */
+export const LSP_RUNNER_TIMEOUT_MS = Math.max(LSP_SPAWN_BUDGET_MS, ...LSP_SERVERS.map((server) => server.clientWaitTimeoutMs ?? 0)) +
+    LSP_DIAGNOSTICS_WAIT_MS +
+    LSP_COLD_SPAWN_MARGIN_MS;
 function normalizeActionTitle(title) {
     return title.replace(/\s+/g, " ").trim();
 }
@@ -59,6 +94,7 @@ const lspRunner = {
     appliesTo: getLspCapableKinds(),
     priority: PRIORITY.LSP_PRIMARY,
     enabledByDefault: true,
+    timeoutMs: LSP_RUNNER_TIMEOUT_MS,
     async run(ctx) {
         const diagnosticPath = resolveRunnerPath(ctx.cwd, ctx.filePath);
         // Only run if LSP is not disabled via --no-lsp

package/node_modules/pi-lens/dist/clients/dispatch/runners/markdownlint.js

@@ -5,7 +5,10 @@ import { createAvailabilityChecker, resolveToolCommandWithInstallFallback, } fro
 import { parseToolRun } from "./utils/tool-failure.js";
 import { isInSpawnTimeoutCooldown, noteSpawnTimeout, } from "../../spawn-timeout-cooldown.js";
 import { finishParsedRun } from "./utils/tool-failure.js";
-const markdownlint = createAvailabilityChecker("markdownlint-cli2", ".cmd");
+const markdownlint = createAvailabilityChecker("markdownlint-cli2", ".cmd", [
+    "--no-globs",
+    "-",
+]);
 // markdownlint-cli2 exit codes (its README's "Exit Codes" section): 0 = no
 // findings, 1 = lint findings, 2 = unexpected error (unreadable config, bad
 // glob, crash). Only 2 is a rejected invocation.

package/node_modules/pi-lens/dist/clients/dispatch/runners/oxlint.js

@@ -10,10 +10,16 @@ import * as fs from "node:fs";
 import * as path from "node:path";
 import { walkUpDirs } from "../../path-utils.js";
 import { safeSpawnAsync } from "../../safe-spawn.js";
+import { truncatedByOutputCap } from "../../spawn-output-cap.js";
 import { getJstsLintPolicyForCwd, hasVitePlusConfig, } from "../../tool-policy.js";
 import { PRIORITY } from "../priorities.js";
 import { resolveToolCommand, resolveToolCommandWithInstallFallback, } from "./utils/runner-helpers.js";
 import { finishParsedRun, parseToolRun } from "./utils/tool-failure.js";
+// One file's JSON report. Nothing legitimate approaches 8 MiB here, so this is
+// a blast-radius bound on a runaway or wedged oxlint rather than a working
+// limit — the same value MAX_SG_OUTPUT_BYTES and MAX_REPORT_BYTES use, and what
+// makes `outputTruncated` reachable for this runner at all (#2100).
+const MAX_OXLINT_OUTPUT_BYTES = 8 * 1024 * 1024;
 const OXLINT_NO_FILES = Symbol("oxlint-no-files");
 const OXLINT_NO_FILES_UNCONFIRMED = Symbol("oxlint-no-files-unconfirmed");
 const OXLINT_NO_FILES_BANNER = "No files found to lint. Please check your paths and ignore patterns.";
@@ -86,6 +92,7 @@ const oxlintRunner = {
         // Run oxlint (or Vite+'s vp lint wrapper) on the file.
         const result = await safeSpawnAsync(cmd, args, {
             timeout: 30000,
+            maxOutputBytes: MAX_OXLINT_OUTPUT_BYTES,
         });
         // Oxlint exits 0 whenever nothing at ERROR severity was found — that
         // includes a run that found only warnings, its own default severity
@@ -194,16 +201,16 @@ const oxlintRunner = {
 };
 function oxlintProcessState(result) {
     const failureKind = result.spawnFailure?.kind;
-    if (result.signal || result.failure === "signal")
-        return "signal";
+    if (truncatedByOutputCap(result))
+        return "truncated";
     if (result.failure === "timeout" || failureKind === "timeout")
         return "timeout";
     if (result.failure === "aborted" || failureKind === "killed")
         return "killed";
+    if (result.signal || result.failure === "signal")
+        return "signal";
     if (result.failure === "spawn" || result.error)
         return "spawn";
-    if (result.outputTruncated)
-        return "truncated";
     return "normal";
 }
 function isNonnegativeInteger(value) {

package/node_modules/pi-lens/dist/clients/dispatch/runners/psscriptanalyzer.js

@@ -77,6 +77,7 @@ function notePsDecision(latch, tool, verdict) {
         cause: verdict.available ? "ok" : verdict.cause,
         elapsedMs: verdict.elapsedMs,
         latched: verdict.available || isLatchingOutcome(verdict.outcome),
+        classifiedBy: "probe",
         hostStallMs: verdict.hostStallMs,
         ...(retryAfterMs !== undefined && { retryAfterMs }),
         budgetMs: PS_TIMEOUT_MS,
@@ -412,6 +413,9 @@ const psScriptAnalyzerRunner = {
                     latched: false,
                     hostStallMs,
                     budgetMs: PS_TIMEOUT_MS,
+                    // A read of the process's own stdout, not classifyProbeFailure, is
+                    // what decided this (#2209).
+                    classifiedBy: "caller",
                 });
                 incrementDegradationCount({
                     kind: "grammar-blocked",