@herbertgao/pi-extensions 2026.8.3 → 2026.8.5

package/node_modules/pi-lens/dist/clients/dispatch/lazy.js

@@ -0,0 +1,14 @@
+/** Lazy dispatch integration seam for startup-cost control (#1394). */
+let integrationPromise;
+/** Start loading the runner graph once; callers may fire-and-forget this. */
+export function warmDispatchIntegration() {
+    return (integrationPromise ??= import("./integration.js"));
+}
+/** Await the same promise used by session-start warming and first use. */
+export function loadDispatchIntegration() {
+    return warmDispatchIntegration();
+}
+/** Test-only reset; production sessions intentionally retain the promise. */
+export function resetDispatchIntegrationForTests() {
+    integrationPromise = undefined;
+}

package/node_modules/pi-lens/dist/clients/dispatch/plan.js

@@ -118,6 +118,11 @@ export const LANGUAGE_CAPABILITY_MATRIX = {
             { mode: "all", runnerIds: ["actionlint"], filterKinds: ["yaml"] },
         ],
     },
+    "helm-template": {
+        name: "Helm Template Linting",
+        capabilities: ["lint"],
+        writeGroups: [primary("helm-template")],
+    },
     sql: {
         name: "SQL Processing",
         capabilities: ["format", "lint"],
@@ -218,9 +223,14 @@ export const LANGUAGE_CAPABILITY_MATRIX = {
     },
     terraform: {
         name: "Terraform Linting",
-        capabilities: ["types", "lint"],
+        capabilities: ["types", "lint", "security"],
         writeGroups: [primary("terraform")],
     },
+    terragrunt: {
+        name: "Terragrunt Linting",
+        capabilities: ["lint", "format"],
+        writeGroups: [primary("terragrunt")],
+    },
     nix: {
         name: "Nix Linting",
         capabilities: ["types", "lint"],

package/node_modules/pi-lens/dist/clients/dispatch/rule-id-normalize.js

@@ -0,0 +1,50 @@
+/**
+ * Normalize a rule id to the form a user typically writes in a
+ * `pi-lens-ignore` comment, an inline suppression, or a project-level
+ * `disable`/`select` list. Strips the `ast-grep:` LSP source prefix and the
+ * language suffix used by the rule catalogs.
+ */
+import * as fs from "node:fs";
+import * as path from "node:path";
+import { getAstGrepRuleSources } from "../sgconfig.js";
+/** Derive language tags from shipped rule filenames, rather than a list. */
+export function deriveRuleIdLanguageSuffixes(ruleRoot) {
+    const suffixes = new Set();
+    const visit = (dir) => {
+        let entries;
+        try {
+            entries = fs.readdirSync(dir, { withFileTypes: true });
+        }
+        catch {
+            return;
+        }
+        for (const entry of entries) {
+            const entryPath = path.join(dir, entry.name);
+            if (entry.isDirectory())
+                visit(entryPath);
+            else {
+                const match = /-([a-z0-9]+)\.ya?ml$/i.exec(entry.name);
+                if (match)
+                    suffixes.add(match[1].toLowerCase());
+            }
+        }
+    };
+    visit(ruleRoot);
+    return suffixes;
+}
+const bundledCodeRabbitRules = getAstGrepRuleSources().find((source) => source.origin === "bundled" && source.tier === "secondary");
+const RULE_ID_LANGUAGE_SUFFIXES = new Set(["js"]);
+if (bundledCodeRabbitRules) {
+    for (const suffix of deriveRuleIdLanguageSuffixes(bundledCodeRabbitRules.dir)) {
+        RULE_ID_LANGUAGE_SUFFIXES.add(suffix);
+    }
+}
+export function normalizeRuleId(ruleId) {
+    const normalized = ruleId.replace(/^ast-grep:/, "");
+    for (const suffix of RULE_ID_LANGUAGE_SUFFIXES) {
+        if (normalized.endsWith(`-${suffix}`)) {
+            return normalized.slice(0, -(suffix.length + 1));
+        }
+    }
+    return normalized;
+}

package/node_modules/pi-lens/dist/clients/dispatch/rule-policy.js

@@ -0,0 +1,135 @@
+/**
+ * Project-level rule policy (`.pi-lens.json` `rules.<id>.disable` /
+ * `rules.<id>.select`) — output-only filtering of dispatches, so the project's
+ * own policy narrows what the user actually sees without widening the trusted
+ * surface area (widget state, baseline, dedup, and per-edit record stay
+ * authoritative).
+ *
+ * Matching is PROJECT-WIDE. The outer `rules.<key>` is a grouping label only —
+ * it does not scope which diagnostics a `disable`/`select` list under it can
+ * match. Every `disable` entry across every key is unioned into one drop list,
+ * and every `select` entry across every key is unioned into one allowlist.
+ * Disable is checked first, so it wins globally regardless of which key it's
+ * configured under.
+ *
+ * Match normalization is consolidated with the rest of the rule-id surfaces:
+ * `inline-suppressions.ts` and `lens-diagnostics.ts`'s `normalizeRuleId`
+ * both strip the `ast-grep:` prefix and the `-js` suffix, so a user listing
+ * `no-eval` once under `disable` covers both the LSP tag (`ast-grep:no-eval`)
+ * and the napi tag (`no-eval` / `no-eval-js`). Sharing the normalization keeps
+ * the three surfaces from drifting.
+ */
+import { normalizeRuleId } from "./rule-id-normalize.js";
+/**
+ * Decide whether a rule id (in the form it's emitted on a diagnostic — e.g.
+ * `ast-grep:no-eval`, `no-eval-js`, `no-eval`, `ts:2322`) should be filtered
+ * out under a project's rule policy map. Returns `dropped: true` when the
+ * diagnostic would be hidden from output.
+ *
+ * Project-wide: every `disable` entry across every configured key is checked
+ * first (disable wins globally over select). Then every `select` entry
+ * across every key is unioned into one allowlist — a non-empty union that
+ * the rule doesn't match also drops it. An absent/empty union across all
+ * keys means "no restriction". Matching uses the same normalization as
+ * inline suppression so a configured `no-eval` entry covers
+ * `ast-grep:no-eval` and `no-eval-js`.
+ */
+export function evaluateRulePolicy(ruleId, policyMap) {
+    if (!policyMap)
+        return { dropped: false };
+    const raw = ruleId || "";
+    const norm = normalizeRuleId(raw);
+    if (scanList(policyMap, (e) => e.disable, raw, norm).matched) {
+        return { dropped: true };
+    }
+    const select = scanList(policyMap, (e) => e.select, raw, norm);
+    return { dropped: select.sawEntry && !select.matched };
+}
+/**
+ * Union one list (`disable` or `select`) across every key in the map and test
+ * the rule against it. `sawEntry` reports whether the union was non-empty,
+ * which is what makes a `select` union restrictive rather than absent.
+ */
+function scanList(policyMap, pick, raw, norm) {
+    let sawEntry = false;
+    for (const entry of Object.values(policyMap)) {
+        for (const candidate of (entry && pick(entry)) ?? []) {
+            sawEntry = true;
+            if (matchesRule(candidate, raw, norm))
+                return { matched: true, sawEntry };
+        }
+    }
+    return { matched: false, sawEntry };
+}
+function matchesRule(entry, raw, normalized) {
+    if (entry === raw)
+        return true;
+    return normalizeRuleId(entry) === normalized;
+}
+/**
+ * Filter an array of diagnostics (returns a new array) by the project rule
+ * policy map. `rule` is preferred; code-only diagnostics use `code` as their
+ * policy key so project-diagnostics details and rendered summaries cannot
+ * disagree about a finding that has no explicit rule field. `Diagnostic.id`
+ * remains a dedup key (`eslint:unknown:12`), not a policy key, so id-only
+ * findings (including blocking parse errors) remain exempt.
+ *
+ * Used by both the per-edit dispatcher and the `lens-diagnostics` tool's
+ * `mode=delta`/`mode=all`/`mode=full` paths so a project's own policy
+ * applies consistently across every output surface.
+ */
+export function applyRulePolicy(diagnostics, policyMap) {
+    if (!policyMap)
+        return diagnostics;
+    // Fast-path: if every entry has neither disable nor select, there is no
+    // output filter to apply. Keeps the hot path (most projects have only
+    // thresholds) cheap.
+    let hasFilter = false;
+    for (const rawEntry of Object.values(policyMap)) {
+        if (!rawEntry || typeof rawEntry !== "object" || Array.isArray(rawEntry)) {
+            continue;
+        }
+        const entry = rawEntry;
+        if ((entry.disable?.length ?? 0) > 0 || (entry.select?.length ?? 0) > 0) {
+            hasFilter = true;
+            break;
+        }
+    }
+    if (!hasFilter)
+        return diagnostics;
+    return diagnostics.filter((d) => {
+        const ruleId = d.rule ?? d.code;
+        if (!ruleId)
+            return true;
+        const { dropped } = evaluateRulePolicy(ruleId, policyMap);
+        return !dropped;
+    });
+}
+/**
+ * Build the policy map from a `PiLensProjectConfig.rules`-shaped value. Returns
+ * undefined when there's nothing to filter (the hot path), or a map suitable
+ * for `applyRulePolicy` otherwise. Excludes entries whose only field is
+ * `threshold` (a threshold is a separate concern handled elsewhere) so the
+ * filter step doesn't repeat the work.
+ */
+export function rulePolicyMapFromConfig(rules) {
+    if (!rules)
+        return undefined;
+    let built;
+    for (const [key, rawEntry] of Object.entries(rules)) {
+        if (!rawEntry || typeof rawEntry !== "object" || Array.isArray(rawEntry)) {
+            continue;
+        }
+        const entry = rawEntry;
+        const hasDisable = (entry.disable?.length ?? 0) > 0;
+        const hasSelect = (entry.select?.length ?? 0) > 0;
+        if (!hasDisable && !hasSelect)
+            continue;
+        built ??= {};
+        built[key] = {
+            ...(hasDisable ? { disable: entry.disable } : {}),
+            ...(hasSelect ? { select: entry.select } : {}),
+        };
+    }
+    return built;
+}

package/node_modules/pi-lens/dist/clients/dispatch/runners/ast-grep-napi.js

@@ -19,6 +19,12 @@ import { isAuxiliaryLspAlive } from "../../lsp/index.js";
 import { resolveAstGrepNativeExe } from "../../lsp/wait-policy/index.js";
 import { PRIORITY } from "../priorities.js";
 import { calculateRuleComplexity, isOverlyBroadPattern, isStructuredRule, loadYamlRules, loadYamlRulesFresh, MAX_BLOCKING_RULE_COMPLEXITY, } from "./yaml-rule-parser.js";
+const defaultUnsupportedLanguageLog = new Set();
+const UNSUPPORTED_RULE_ID_SAMPLE_SIZE = 5;
+/** Clear per-session unsupported-language telemetry dedupe. */
+export function resetAstGrepUnsupportedLanguageLog() {
+    defaultUnsupportedLanguageLog.clear();
+}
 // Lazy load the napi package
 let sg;
 let sgLoadAttempted = false;
@@ -237,7 +243,7 @@ export function evaluateAstGrepRules(filePath, rootNode, cwd, kind, options = {}
     const maxTotalDiagnostics = options.maxTotalDiagnostics ?? MAX_TOTAL_DIAGNOSTICS;
     const blockingOnly = options.blockingOnly === true;
     const log = options.log;
-    const unsupportedLanguageLog = options.unsupportedLanguageLog ?? new Set();
+    const unsupportedLanguageLog = options.unsupportedLanguageLog ?? defaultUnsupportedLanguageLog;
     const diagnostics = [];
     const seenRuleIds = new Set();
     const suppressLinterOverlap = kind === "jsts" && hasEslintConfig(cwd);
@@ -249,15 +255,28 @@ export function evaluateAstGrepRules(filePath, rootNode, cwd, kind, options = {}
     const flushUnsupportedRuleSkips = () => {
         if (newlyUnsupported.size === 0)
             return;
+        const firstSeenLanguages = Array.from(newlyUnsupported.entries()).filter(([language]) => !unsupportedLanguageLog.has(language));
+        for (const [language] of firstSeenLanguages) {
+            unsupportedLanguageLog.add(language);
+        }
+        if (firstSeenLanguages.length === 0) {
+            newlyUnsupported.clear();
+            return;
+        }
+        for (const [language] of firstSeenLanguages)
+            unsupportedLanguageLog.add(language);
         logLatency({
             type: "phase",
             phase: "astgrep_napi_unsupported_rules_skipped",
             filePath,
             durationMs: 0,
             metadata: {
-                skippedByLanguage: Object.fromEntries(Array.from(newlyUnsupported.entries(), ([language, ruleIds]) => [
+                skippedByLanguage: Object.fromEntries(firstSeenLanguages.map(([language, ruleIds]) => [
                     language,
-                    { count: ruleIds.length, ruleIds },
+                    {
+                        count: ruleIds.length,
+                        ruleIds: ruleIds.slice(0, UNSUPPORTED_RULE_ID_SAMPLE_SIZE),
+                    },
                 ])),
             },
         });
@@ -315,8 +334,7 @@ export function evaluateAstGrepRules(filePath, rootNode, cwd, kind, options = {}
                 lang !== "typescript" &&
                 lang !== "tsx" &&
                 lang !== "javascript") {
-                if (!unsupportedLanguageLog.has(rule.id)) {
-                    unsupportedLanguageLog.add(rule.id);
+                if (!unsupportedLanguageLog.has(lang)) {
                     const ids = newlyUnsupported.get(lang) ?? [];
                     ids.push(rule.id);
                     newlyUnsupported.set(lang, ids);

package/node_modules/pi-lens/dist/clients/dispatch/runners/biome-check.js

@@ -6,9 +6,8 @@
  * mutating files mid-dispatch after LSP sync has already happened.
  */
 import * as path from "node:path";
-import { resolvePackagePath } from "../../package-root.js";
 import { safeSpawnAsync } from "../../safe-spawn.js";
-import { getAutofixCapability, getBiomeConfigPath, getJstsLintPolicyForCwd, } from "../../tool-policy.js";
+import { biomeConfigArgs, getAutofixCapability, getJstsLintPolicyForCwd, } from "../../tool-policy.js";
 import { PRIORITY } from "../priorities.js";
 import { resolveToolCommandWithInstallFallback } from "./utils/runner-helpers.js";
 function parseBiomeJson(raw, filePath) {
@@ -60,13 +59,10 @@ const biomeCheckJsonRunner = {
         if (!cmd) {
             return { status: "skipped", diagnostics: [], semantic: "none" };
         }
-        // Build config path — use user's if exists, else pi-lens config
-        const userConfigPath = getBiomeConfigPath(cwd);
-        const configArg = [
-            "--config-path=" +
-                (userConfigPath ??
-                    resolvePackagePath(import.meta.url, "config/biome/core.jsonc")),
-        ];
+        // Shared config-args seam (#1247): `biomeClient.fixFileAsync` consumes
+        // the same builder, so the user's config / package fallback applies on
+        // `lint --write` too.
+        const configArg = biomeConfigArgs(cwd);
         // Run biome lint (diagnostics only - format is handled separately)
         const checkResult = await safeSpawnAsync(cmd, [
             "lint",

package/node_modules/pi-lens/dist/clients/dispatch/runners/detekt.js

@@ -4,6 +4,7 @@ import { safeSpawnAsync } from "../../safe-spawn.js";
 import { getLinterPolicyForCwd } from "../../tool-policy.js";
 import { PRIORITY } from "../priorities.js";
 import { createAvailabilityChecker } from "./utils/runner-helpers.js";
+import { spawnFailedWithNoOutput } from "./utils/spawn-outcome.js";
 const detekt = createAvailabilityChecker("detekt", ".bat");
 const DETEKT_CONFIG_CANDIDATES = [
     "detekt.yml",
@@ -145,10 +146,10 @@ const detektRunner = {
             return { status: "skipped", diagnostics: [], semantic: "none" };
         const absPath = path.resolve(cwd, ctx.filePath);
         const result = await safeSpawnAsync(cmd, ["--input", absPath, "--config", configPath], { cwd, timeout: 60000 });
-        if (result.error && !result.stdout && !result.stderr) {
+        const raw = `${result.stdout ?? ""}${result.stderr ?? ""}`;
+        if (spawnFailedWithNoOutput(result, raw)) {
             return { status: "skipped", diagnostics: [], semantic: "none" };
         }
-        const raw = `${result.stdout ?? ""}${result.stderr ?? ""}`;
         const diagnostics = parseDetektOutput(raw, ctx.filePath);
         if (diagnostics.length === 0) {
             return { status: "succeeded", diagnostics: [], semantic: "none" };

package/node_modules/pi-lens/dist/clients/dispatch/runners/hadolint.js

@@ -3,6 +3,7 @@ import { safeSpawnAsync } from "../../safe-spawn.js";
 import { getLinterPolicyForCwd } from "../../tool-policy.js";
 import { PRIORITY } from "../priorities.js";
 import { createAvailabilityChecker, resolveToolCommandWithInstallFallback, } from "./utils/runner-helpers.js";
+import { spawnFailedWithNoOutput } from "./utils/spawn-outcome.js";
 const hadolint = createAvailabilityChecker("hadolint", ".exe");
 function parseHadolintOutput(raw, filePath) {
     try {
@@ -52,7 +53,7 @@ const hadolintRunner = {
             return { status: "skipped", diagnostics: [], semantic: "none" };
         }
         const result = await safeSpawnAsync(cmd, ["--format", "json", "--no-fail", path.resolve(cwd, ctx.filePath)], { cwd });
-        if (result.error && !result.stdout) {
+        if (spawnFailedWithNoOutput(result)) {
             return { status: "skipped", diagnostics: [], semantic: "none" };
         }
         const output = result.stdout || "";

package/node_modules/pi-lens/dist/clients/dispatch/runners/helm-lint.js

@@ -0,0 +1,154 @@
+import * as path from "node:path";
+import { PathKeyedMap } from "../../path-keyed-map.js";
+import { normalizeMapKey } from "../../path-utils.js";
+import { safeSpawnAsync } from "../../safe-spawn.js";
+import { findNearestDirWithMarker } from "../../workspace-topology.js";
+import { PRIORITY } from "../priorities.js";
+import { createAvailabilityChecker, resolveAvailableOrInstall, } from "./utils/runner-helpers.js";
+const helm = createAvailabilityChecker("helm", ".exe");
+const inFlightByChartRoot = new PathKeyedMap(normalizeMapKey);
+const HELM_LINT_TIMEOUT_MS = 30_000;
+const SKIPPED = {
+    status: "skipped",
+    diagnostics: [],
+    semantic: "none",
+};
+function isWithin(root, candidate) {
+    const relative = path.relative(normalizeMapKey(root), normalizeMapKey(candidate));
+    return relative === "" || (!relative.startsWith(`..${path.sep}`) && relative !== ".." && !path.isAbsolute(relative));
+}
+function diagnosticLocation(message, chartRoot) {
+    const location = message.match(/(?:^|\s)([^:\r\n]+\.(?:ya?ml|tpl|json))(?::(\d+))?(?::\d+)?(?::|\s)/i);
+    if (!location) {
+        return { filePath: path.join(chartRoot, "Chart.yaml"), message };
+    }
+    const candidate = path.resolve(chartRoot, location[1]);
+    return {
+        filePath: isWithin(chartRoot, candidate)
+            ? candidate
+            : path.join(chartRoot, "Chart.yaml"),
+        line: location[2] ? Number(location[2]) : undefined,
+        message,
+    };
+}
+export function parseHelmLintOutput(raw, chartRoot) {
+    const diagnostics = [];
+    for (const line of raw.split(/\r?\n/)) {
+        const match = line.trim().match(/^\[(INFO|WARNING|ERROR)\]\s*(.+)$/);
+        if (!match) {
+            // helm indents multi-line diagnostic detail under its [LEVEL] header
+            // (#1342 review): fold continuation text into the open diagnostic
+            // instead of silently dropping it.
+            const last = diagnostics[diagnostics.length - 1];
+            if (last && /^\s+\S/.test(line)) {
+                last.message += `
+${line.trim()}`;
+            }
+            continue;
+        }
+        const level = match[1];
+        const location = diagnosticLocation(match[2].trim(), chartRoot);
+        const severity = level === "ERROR" ? "error" : level === "WARNING" ? "warning" : "info";
+        diagnostics.push({
+            id: `helm-lint-${diagnostics.length + 1}-${level.toLowerCase()}`,
+            message: location.message,
+            filePath: location.filePath,
+            line: location.line,
+            column: 1,
+            severity,
+            semantic: severity === "error" ? "blocking" : "warning",
+            tool: "helm-lint",
+            rule: level.toLowerCase(),
+            fixable: false,
+        });
+    }
+    return diagnostics;
+}
+function failedResult(kind, message) {
+    return {
+        status: "failed",
+        diagnostics: [],
+        semantic: "warning",
+        failureKind: kind,
+        failureMessage: message.slice(0, 200),
+    };
+}
+async function lintChart(chartRoot, cwd) {
+    const cmd = await resolveAvailableOrInstall(helm, "helm", cwd);
+    if (!cmd) {
+        const outcome = helm.getOutcome(cwd);
+        return {
+            status: "failed",
+            diagnostics: [],
+            semantic: "warning",
+            failureKind: "unavailable",
+            failureMessage: `helm unavailable (${outcome ?? "unknown"})`,
+        };
+    }
+    const result = await safeSpawnAsync(cmd, ["lint", chartRoot], {
+        cwd,
+        timeout: HELM_LINT_TIMEOUT_MS,
+        deadlineAt: Date.now() + HELM_LINT_TIMEOUT_MS,
+        resourceLabel: "helm-lint",
+    });
+    const output = [result.stdout, result.stderr].filter(Boolean).join("\n");
+    const diagnostics = parseHelmLintOutput(output, chartRoot);
+    const typedFailure = result.spawnFailure?.kind;
+    if (typedFailure) {
+        const failureKind = typedFailure === "tool-not-found"
+            ? "unavailable"
+            : typedFailure === "timeout"
+                ? "timeout"
+                : typedFailure === "killed" && result.failure === "aborted"
+                    ? "aborted"
+                    : "server_error";
+        return failedResult(failureKind, result.error?.message || `helm lint ${typedFailure}`);
+    }
+    if (result.failure) {
+        return failedResult(result.failure === "timeout" ? "timeout" : result.failure, result.error?.message || `helm lint ${result.failure}`);
+    }
+    if (result.outputTruncated) {
+        return failedResult("parser_error", "helm lint output was truncated before parsing completed");
+    }
+    const hasErrorDiagnostic = diagnostics.some((diagnostic) => diagnostic.severity === "error");
+    if (result.status !== 0 && !hasErrorDiagnostic) {
+        return failedResult(output.trim() ? "parser_error" : "server_error", output.trim() || "helm lint exited without an error diagnostic");
+    }
+    return {
+        status: "succeeded",
+        diagnostics,
+        semantic: diagnostics.some((item) => item.severity === "error")
+            ? "blocking"
+            : diagnostics.length > 0
+                ? "warning"
+                : "none",
+    };
+}
+const helmLintRunner = {
+    id: "helm-lint",
+    appliesTo: ["yaml", "helm-template"],
+    priority: PRIORITY.GENERAL_ANALYSIS,
+    enabledByDefault: true,
+    skipTestFiles: false,
+    timeoutMs: 35_000,
+    async run(ctx) {
+        const workspaceRoot = path.resolve(ctx.projectRoot ?? ctx.cwd);
+        const startDir = path.dirname(path.resolve(ctx.filePath));
+        const discovered = findNearestDirWithMarker(startDir, "chartYamlPath");
+        if (!discovered)
+            return SKIPPED;
+        const chartRoot = path.resolve(discovered);
+        if (!isWithin(workspaceRoot, chartRoot))
+            return SKIPPED;
+        const existing = inFlightByChartRoot.get(chartRoot);
+        if (existing)
+            return existing;
+        const promise = lintChart(chartRoot, ctx.cwd).finally(() => {
+            if (inFlightByChartRoot.get(chartRoot) === promise)
+                inFlightByChartRoot.delete(chartRoot);
+        });
+        inFlightByChartRoot.set(chartRoot, promise);
+        return promise;
+    },
+};
+export default helmLintRunner;

package/node_modules/pi-lens/dist/clients/dispatch/runners/htmlhint.js

@@ -3,6 +3,7 @@ import { safeSpawnAsync } from "../../safe-spawn.js";
 import { getLinterPolicyForCwd } from "../../tool-policy.js";
 import { PRIORITY } from "../priorities.js";
 import { createAvailabilityChecker, resolveToolCommandWithInstallFallback, } from "./utils/runner-helpers.js";
+import { spawnFailedWithNoOutput } from "./utils/spawn-outcome.js";
 const htmlhint = createAvailabilityChecker("htmlhint");
 const HTMLHINT_RULES = {
     "tag-pair": true,
@@ -71,10 +72,10 @@ const htmlhintRunner = {
             "unix",
             path.resolve(cwd, ctx.filePath),
         ], { cwd });
-        if (result.error && !result.stdout && !result.stderr) {
+        const output = result.stdout || result.stderr || "";
+        if (spawnFailedWithNoOutput(result, output)) {
             return { status: "skipped", diagnostics: [], semantic: "none" };
         }
-        const output = result.stdout || result.stderr || "";
         const diagnostics = parseHtmlhintOutput(output, ctx.filePath);
         if (diagnostics.length === 0) {
             return { status: "succeeded", diagnostics: [], semantic: "none" };

package/node_modules/pi-lens/dist/clients/dispatch/runners/index.js

@@ -16,6 +16,7 @@ import gleamCheckRunner from "./gleam-check.js";
 import goVetRunner from "./go-vet.js";
 import golangciRunner from "./golangci-lint.js";
 import hadolintRunner from "./hadolint.js";
+import helmLintRunner from "./helm-lint.js";
 import htmlhintRunner from "./htmlhint.js";
 import javacRunner from "./javac.js";
 import ktlintRunner from "./ktlint.js";
@@ -40,6 +41,7 @@ import sqlfluffRunner from "./sqlfluff.js";
 import stylelintRunner from "./stylelint.js";
 import swiftlintRunner from "./swiftlint.js";
 import taploRunner from "./taplo.js";
+import terragruntRunner from "./terragrunt.js";
 import tflintRunner from "./tflint.js";
 import trivyConfigRunner from "./trivy-config.js";
 import valeRunner from "./vale.js";
@@ -81,6 +83,7 @@ export function registerDefaultRunners(registry) {
     registry.register(factRulesRunner); // FactRule pipeline — all registered rules (priority 21)
     registry.register(htmlhintRunner); // HTML linting — tag pairs, attribute rules (priority 20)
     registry.register(hadolintRunner); // Dockerfile linting — syntax, best practices (priority 20)
+    registry.register(helmLintRunner); // Helm chart linting (priority 20)
     registry.register(valeRunner); // Prose/style linting for Markdown — config-gated (.vale.ini) (priority 30)
     registry.register(phpLintRunner); // PHP syntax validation via php -l (priority 20)
     registry.register(psScriptAnalyzerRunner); // PowerShell linting via PSScriptAnalyzer module (priority 20)
@@ -88,7 +91,8 @@ export function registerDefaultRunners(registry) {
     registry.register(ktlintRunner); // Kotlin linting via ktlint (priority 10)
     registry.register(detektRunner); // Kotlin static analysis via detekt (priority 20, config-gated)
     registry.register(tflintRunner); // Terraform linting via tflint (priority 20)
-    registry.register(trivyConfigRunner); // IaC misconfig (Dockerfile/k8s) via trivy config (priority 20, trivy.enabled-gated)
+    registry.register(terragruntRunner); // Terragrunt linting via terragrunt hcl validate (priority 20)
+    registry.register(trivyConfigRunner); // IaC misconfig (Dockerfile/k8s/Terraform) via trivy config (priority 20, trivy.enabled-gated)
     registry.register(taploRunner); // TOML linting/validation via taplo (priority 10)
     registry.register(dartAnalyzeRunner); // Dart analysis via dart analyze (priority 20)
     registry.register(javacRunner); // Java compile diagnostics via javac (priority 20)

package/node_modules/pi-lens/dist/clients/dispatch/runners/lsp.js

@@ -11,6 +11,7 @@
  * Replaces language-specific runners (pyright, etc.) with a single
  * unified runner that delegates to the LSP service.
  */
+import { logExtension } from "../../extension-log.js";
 import { getLSPService } from "../../lsp/index.js";
 import { RUNTIME_CONFIG } from "../../runtime-config.js";
 import { PRIORITY } from "../priorities.js";
@@ -128,8 +129,13 @@ const lspRunner = {
         try {
             const attached = await tryWarmAttachedDiagnostics(ctx.filePath, content, Math.max(LSP_SPAWN_BUDGET_MS, LSP_DIAGNOSTICS_WAIT_MS));
             usedWarmAttach = attached?.available === true;
+            // #1179 (shape-5 structural fix): both branches normalize to the
+            // `touchFile` wrapper shape. The warm-attach IPC branch resolves a plain
+            // diagnostics array (the socket cannot carry a side-channel; the IPC client
+            // already rejected any inconclusive answer, so `available` ⟹ confirmed) —
+            // wrap it as `{ diags }`; the incumbent branch already returns the wrapper.
             const touched = attached?.available
-                ? attached.response.diagnostics
+                ? { diags: attached.response.diagnostics }
                 : await lspService.touchFile(ctx.filePath, content, {
                     diagnostics: "document",
                     collectDiagnostics: true,
@@ -143,10 +149,8 @@ const lspRunner = {
                 lspClientReady = false;
             }
             else {
-                lspDiags = touched;
-                diagnosticsInconclusive =
-                    touched
-                        .inconclusive === true;
+                lspDiags = touched.diags;
+                diagnosticsInconclusive = touched.inconclusive === true;
             }
         }
         catch (err) {
@@ -156,7 +160,11 @@ const lspRunner = {
                 failureReason.includes("exited") ||
                 failureReason.includes("connection") ||
                 failureReason.includes("JSON RPC")) {
-                console.error(`[lsp-runner] LSP server failed for ${diagnosticPath}: ${failureReason}`);
+                logExtension({
+                    subsystem: "lsp-runner",
+                    message: `LSP server failed for ${diagnosticPath}: ${failureReason}`,
+                    metadata: { filePath: diagnosticPath },
+                });
             }
         }
         if (serverFailed) {

package/node_modules/pi-lens/dist/clients/dispatch/runners/markdownlint.js

@@ -1,6 +1,5 @@
-import { resolvePackagePath } from "../../package-root.js";
 import { safeSpawnAsync } from "../../safe-spawn.js";
-import { getLinterPolicyForCwd, hasMarkdownlintConfig, } from "../../tool-policy.js";
+import { getLinterPolicyForCwd, markdownlintConfigArgs, } from "../../tool-policy.js";
 import { PRIORITY } from "../priorities.js";
 import { createAvailabilityChecker, resolveToolCommandWithInstallFallback, } from "./utils/runner-helpers.js";
 const markdownlint = createAvailabilityChecker("markdownlint-cli2", ".cmd");
@@ -93,7 +92,6 @@ const markdownlintRunner = {
         if (policy && !policy.preferredRunners.includes("markdownlint")) {
             return { status: "skipped", diagnostics: [], semantic: "none" };
         }
-        const hasConfig = hasMarkdownlintConfig(cwd);
         let cmd = null;
         if (await (markdownlint.isAvailableAsync(cwd))) {
             cmd = markdownlint.getCommand(cwd);
@@ -103,12 +101,9 @@ const markdownlintRunner = {
         }
         if (!cmd)
             return { status: "skipped", diagnostics: [], semantic: "none" };
-        const configArgs = hasConfig
-            ? []
-            : [
-                "--config",
-                resolvePackagePath(import.meta.url, "config/markdownlint/core.json"),
-            ];
+        // Shared config-args seam (#1247): the autofix path consumes the same
+        // builder, so the package-owned fallback config can never drift.
+        const configArgs = markdownlintConfigArgs(cwd);
         const result = await safeSpawnAsync(cmd, [...configArgs, ctx.filePath], {
             timeout: 15000,
             cwd,