@herbertgao/pi-extensions 2026.8.4 → 2026.8.6

package/node_modules/pi-lens/dist/clients/dispatch/runners/lsp.js

@@ -11,6 +11,8 @@
  * Replaces language-specific runners (pyright, etc.) with a single
  * unified runner that delegates to the LSP service.
  */
+import { logExtension } from "../../extension-log.js";
+import { touchCoverageGap } from "../../lsp/diagnostic-binding.js";
 import { getLSPService } from "../../lsp/index.js";
 import { RUNTIME_CONFIG } from "../../runtime-config.js";
 import { PRIORITY } from "../priorities.js";
@@ -110,6 +112,11 @@ const lspRunner = {
         // one spawned server) — an empty `lspDiags` in that case is NOT a
         // confirmed clean result and must not be reported as one (#570).
         let diagnosticsInconclusive = false;
+        // #1470: server ids the touch carries no evidence for — an auxiliary whose
+        // push wait our aux grace timer cut off. The touch is NOT inconclusive (the
+        // primary answered, and its findings below are real), so this is tracked
+        // separately: the only claim it invalidates is "0 diagnostics means clean".
+        let unconfirmedServerIds = [];
         let usedWarmAttach = false;
         let failureReason = "";
         const content = readFileContent(ctx.filePath);
@@ -128,8 +135,25 @@ const lspRunner = {
         try {
             const attached = await tryWarmAttachedDiagnostics(ctx.filePath, content, Math.max(LSP_SPAWN_BUDGET_MS, LSP_DIAGNOSTICS_WAIT_MS));
             usedWarmAttach = attached?.available === true;
+            // #1179 (shape-5 structural fix): both branches normalize to the
+            // `touchFile` wrapper shape. The warm-attach IPC branch resolves a plain
+            // diagnostics array — `available` no longer implies a fully confirmed
+            // answer: a `partial` confirmation (an auxiliary cut off by the grace
+            // timer) is served as `available: true` too (the IPC gate at
+            // `clients/mcp/ipc.ts:248` rejects only `inconclusive`). Carry the
+            // incumbent's `unconfirmedServerIds` onto the wrapper so
+            // `touchCoverageGap` below sees it — dropping it here is the same
+            // false-clean defect already fixed at `clients/lsp/index.ts` (the
+            // workspace sweep wrapper) and `tools/lsp-diagnostics.ts` (the tool
+            // consumer); wrap it as `{ diags }`; the incumbent branch already
+            // returns the wrapper.
             const touched = attached?.available
-                ? attached.response.diagnostics
+                ? {
+                    diags: attached.response.diagnostics,
+                    ...(attached.response.unconfirmedServerIds !== undefined && {
+                        unconfirmedServerIds: attached.response.unconfirmedServerIds,
+                    }),
+                }
                 : await lspService.touchFile(ctx.filePath, content, {
                     diagnostics: "document",
                     collectDiagnostics: true,
@@ -143,10 +167,9 @@ const lspRunner = {
                 lspClientReady = false;
             }
             else {
-                lspDiags = touched;
-                diagnosticsInconclusive =
-                    touched
-                        .inconclusive === true;
+                lspDiags = touched.diags;
+                diagnosticsInconclusive = touched.inconclusive === true;
+                unconfirmedServerIds = touchCoverageGap(touched);
             }
         }
         catch (err) {
@@ -156,7 +179,11 @@ const lspRunner = {
                 failureReason.includes("exited") ||
                 failureReason.includes("connection") ||
                 failureReason.includes("JSON RPC")) {
-                console.error(`[lsp-runner] LSP server failed for ${diagnosticPath}: ${failureReason}`);
+                logExtension({
+                    subsystem: "lsp-runner",
+                    message: `LSP server failed for ${diagnosticPath}: ${failureReason}`,
+                    metadata: { filePath: diagnosticPath },
+                });
             }
         }
         if (serverFailed) {
@@ -200,6 +227,20 @@ const lspRunner = {
             return { status: "skipped", diagnostics: [], semantic: "none" };
         }
         if (lspDiags.length === 0) {
+            if (unconfirmedServerIds.length > 0) {
+                // #1470: an auxiliary was cut off by the aux grace timer, so this empty
+                // merged result is missing whatever that scanner would have said — a
+                // hung opengrep must not read as a clean bill of health on the security
+                // lane. `RunnerResult` has no channel for "clean for these servers,
+                // unknown for those", so the only honest verdict this seam can express
+                // for an EMPTY result is "not checked" — which is what "skipped" means
+                // here, and it lets the coverage notice say so once. Nothing is thrown
+                // away: the primary answered with zero findings, so there is nothing to
+                // report; when it DOES have findings the branches below still report
+                // them (see the non-empty path), which is how a trustworthy primary
+                // stays trustworthy under a cut-off auxiliary.
+                return { status: "skipped", diagnostics: [], semantic: "none" };
+            }
             return {
                 status: "succeeded",
                 diagnostics: [],

package/node_modules/pi-lens/dist/clients/dispatch/runners/markdownlint.js

@@ -1,6 +1,5 @@
-import { resolvePackagePath } from "../../package-root.js";
 import { safeSpawnAsync } from "../../safe-spawn.js";
-import { getLinterPolicyForCwd, hasMarkdownlintConfig, } from "../../tool-policy.js";
+import { getLinterPolicyForCwd, markdownlintConfigArgs, } from "../../tool-policy.js";
 import { PRIORITY } from "../priorities.js";
 import { createAvailabilityChecker, resolveToolCommandWithInstallFallback, } from "./utils/runner-helpers.js";
 const markdownlint = createAvailabilityChecker("markdownlint-cli2", ".cmd");
@@ -93,7 +92,6 @@ const markdownlintRunner = {
         if (policy && !policy.preferredRunners.includes("markdownlint")) {
             return { status: "skipped", diagnostics: [], semantic: "none" };
         }
-        const hasConfig = hasMarkdownlintConfig(cwd);
         let cmd = null;
         if (await (markdownlint.isAvailableAsync(cwd))) {
             cmd = markdownlint.getCommand(cwd);
@@ -103,12 +101,9 @@ const markdownlintRunner = {
         }
         if (!cmd)
             return { status: "skipped", diagnostics: [], semantic: "none" };
-        const configArgs = hasConfig
-            ? []
-            : [
-                "--config",
-                resolvePackagePath(import.meta.url, "config/markdownlint/core.json"),
-            ];
+        // Shared config-args seam (#1247): the autofix path consumes the same
+        // builder, so the package-owned fallback config can never drift.
+        const configArgs = markdownlintConfigArgs(cwd);
         const result = await safeSpawnAsync(cmd, [...configArgs, ctx.filePath], {
             timeout: 15000,
             cwd,

package/node_modules/pi-lens/dist/clients/dispatch/runners/pyright.js

@@ -6,11 +6,11 @@
  *
  * Requires: pyright (pip install pyright or npm install -g pyright)
  */
-import { ensureTool } from "../../installer/index.js";
+import { logExtension } from "../../extension-log.js";
 import { getLSPService } from "../../lsp/index.js";
 import { safeSpawnAsync } from "../../safe-spawn.js";
 import { PRIORITY } from "../priorities.js";
-import { createAvailabilityChecker } from "./utils/runner-helpers.js";
+import { createAvailabilityChecker, resolveAvailableOrInstall, } from "./utils/runner-helpers.js";
 const pyright = createAvailabilityChecker("pyright", ".exe");
 const pyrightRunner = {
     id: "pyright",
@@ -34,9 +34,9 @@ const pyrightRunner = {
         if (await (pyright.isAvailableAsync(cwd))) {
             cmd = pyright.getCommand(cwd);
         }
-        // Strategy 2: Try to find pyright via ensureTool (installs if needed)
+        // Strategy 2: use the shared availability taxonomy and install suppression.
         if (!cmd) {
-            const installedPath = await ensureTool("pyright");
+            const installedPath = await resolveAvailableOrInstall(pyright, "pyright", cwd);
             if (installedPath)
                 cmd = installedPath;
         }
@@ -85,7 +85,11 @@ const pyrightRunner = {
             // pi-lens-ignore: missing-error-propagation
         }
         catch {
-            console.error(`[runner:pyright] JSON parse failed for ${ctx.filePath} — raw output: ${output.slice(0, 200)}`);
+            logExtension({
+                subsystem: "runner:pyright",
+                message: `JSON parse failed for ${ctx.filePath} — raw output: ${output.slice(0, 200)}`,
+                metadata: { filePath: ctx.filePath },
+            });
             return {
                 status: "failed",
                 diagnostics: [],

package/node_modules/pi-lens/dist/clients/dispatch/runners/ruff.js

@@ -6,10 +6,9 @@
  * mutating files mid-dispatch after LSP sync has already happened.
  * Supports venv-local installations.
  */
-import { resolvePackagePath } from "../../package-root.js";
 import { safeSpawnAsync } from "../../safe-spawn.js";
 import { stripAnsi } from "../../sanitize.js";
-import { getAutofixCapability, getLinterPolicyForCwd, hasRuffConfig, } from "../../tool-policy.js";
+import { getAutofixCapability, getLinterPolicyForCwd, ruffConfigArgs, } from "../../tool-policy.js";
 import { PRIORITY } from "../priorities.js";
 import { parseRuffOutput } from "./utils/diagnostic-parsers.js";
 import { createAvailabilityChecker, resolveAvailableOrInstall, } from "./utils/runner-helpers.js";
@@ -61,12 +60,9 @@ const ruffRunner = {
         if (!cmd) {
             return { status: "skipped", diagnostics: [], semantic: "none" };
         }
-        const configArgs = hasRuffConfig(cwd)
-            ? []
-            : [
-                "--config",
-                resolvePackagePath(import.meta.url, "config/ruff/core.toml"),
-            ];
+        // Shared config-args seam (#1247): the autofix path consumes the same
+        // builder, so the package-owned fallback config can never drift.
+        const configArgs = ruffConfigArgs(cwd);
         // Step 1: Capture diagnostics (before fixing) — teaching signal for the agent
         const checkResult = await safeSpawnAsync(cmd, ["check", "--output-format", "json", ...configArgs, ctx.filePath], { timeout: 30000 });
         const raw = stripAnsi(checkResult.stdout + checkResult.stderr);

package/node_modules/pi-lens/dist/clients/dispatch/runners/shellcheck.js

@@ -21,10 +21,9 @@
  */
 import * as fs from "node:fs";
 import * as path from "node:path";
-import { ensureTool } from "../../installer/index.js";
 import { safeSpawnAsync } from "../../safe-spawn.js";
 import { PRIORITY } from "../priorities.js";
-import { createAvailabilityChecker, lspPrimaryCoversFile, } from "./utils/runner-helpers.js";
+import { createAvailabilityChecker, lspPrimaryCoversFile, resolveAvailableOrInstall, } from "./utils/runner-helpers.js";
 const shellcheck = createAvailabilityChecker("shellcheck", ".exe");
 function findShellcheckConfig(cwd) {
     const local = path.join(cwd, ".shellcheckrc");
@@ -127,7 +126,7 @@ const shellcheckRunner = {
             cmd = shellcheck.getCommand(cwd);
         }
         else {
-            const managed = await ensureTool("shellcheck");
+            const managed = await resolveAvailableOrInstall(shellcheck, "shellcheck", cwd);
             if (managed)
                 cmd = managed;
         }

package/node_modules/pi-lens/dist/clients/dispatch/runners/shfmt.js

@@ -1,9 +1,8 @@
 import * as fs from "node:fs";
 import * as path from "node:path";
-import { ensureTool } from "../../installer/index.js";
 import { safeSpawnAsync } from "../../safe-spawn.js";
 import { PRIORITY } from "../priorities.js";
-import { createAvailabilityChecker } from "./utils/runner-helpers.js";
+import { createAvailabilityChecker, resolveAvailableOrInstall, } from "./utils/runner-helpers.js";
 const shfmt = createAvailabilityChecker("shfmt", ".exe");
 // shfmt's only config source is .editorconfig. We treat its presence as the
 // opt-in for the (non-error) format-diff warning, so out of the box shfmt only
@@ -39,7 +38,7 @@ const shfmtRunner = {
             cmd = shfmt.getCommand(cwd);
         }
         else {
-            const installed = await ensureTool("shfmt");
+            const installed = await resolveAvailableOrInstall(shfmt, "shfmt", cwd);
             if (!installed) {
                 return { status: "skipped", diagnostics: [], semantic: "none" };
             }

package/node_modules/pi-lens/dist/clients/dispatch/runners/spotbugs.js

@@ -1,6 +1,7 @@
 import * as fs from "node:fs";
 import * as os from "node:os";
 import * as path from "node:path";
+import { BoundedLruCache } from "../../bounded-cache.js";
 import { safeSpawnAsync } from "../../safe-spawn.js";
 import { findCompiledClassesDir } from "../../tool-policy.js";
 import { PRIORITY } from "../priorities.js";
@@ -11,7 +12,7 @@ const java = createAvailabilityChecker("java", ".exe", ["-version"]);
 const spotbugs = createAvailabilityChecker("spotbugs", ".bat", ["-version"]);
 const MAX_DIAGNOSTICS = 50;
 const MAX_XML_BYTES = 4 * 1024 * 1024;
-const scanCache = new Map();
+const scanCache = new BoundedLruCache(32);
 /** Reset the SpotBugs scan cache (tests). */
 export function _resetSpotbugsCacheForTests() {
     scanCache.clear();

package/node_modules/pi-lens/dist/clients/dispatch/runners/taplo.js

@@ -3,6 +3,7 @@ import { safeSpawnAsync } from "../../safe-spawn.js";
 import { getLinterPolicyForCwd } from "../../tool-policy.js";
 import { PRIORITY } from "../priorities.js";
 import { createAvailabilityChecker, lspPrimaryCoversFile, resolveToolCommandWithInstallFallback, } from "./utils/runner-helpers.js";
+import { spawnFailedWithNoOutput } from "./utils/spawn-outcome.js";
 const taplo = createAvailabilityChecker("taplo", ".exe");
 function parseTaploOutput(raw, filePath) {
     try {
@@ -55,7 +56,7 @@ const taploRunner = {
             return { status: "skipped", diagnostics: [], semantic: "none" };
         const absPath = path.resolve(cwd, ctx.filePath);
         const result = await safeSpawnAsync(cmd, ["check", "--output=json", absPath], { cwd, timeout: 15000 });
-        if (result.error && !result.stdout) {
+        if (spawnFailedWithNoOutput(result)) {
             return { status: "skipped", diagnostics: [], semantic: "none" };
         }
         const diagnostics = parseTaploOutput(result.stdout || "", ctx.filePath);

package/node_modules/pi-lens/dist/clients/dispatch/runners/terragrunt.js

@@ -0,0 +1,163 @@
+import * as path from "node:path";
+import { safeSpawnAsync } from "../../safe-spawn.js";
+import { pathsEqual } from "../../path-utils.js";
+import { getLinterPolicyForCwd } from "../../tool-policy.js";
+import { PRIORITY } from "../priorities.js";
+import { createAvailabilityChecker, resolveAvailableOrInstall, } from "./utils/runner-helpers.js";
+import { spawnFailedWithNoOutput } from "./utils/spawn-outcome.js";
+const terragrunt = createAvailabilityChecker("terragrunt", ".exe");
+function normalizeSeverity(raw) {
+    if (typeof raw === "number")
+        return raw === 1 ? "error" : "warning";
+    if (typeof raw === "string" && raw.toLowerCase() === "error")
+        return "error";
+    return "warning";
+}
+function toRawDiagnostics(parsed) {
+    if (Array.isArray(parsed))
+        return parsed;
+    if (!parsed || typeof parsed !== "object")
+        return [];
+    const invalidFiles = parsed.invalid_files;
+    if (!Array.isArray(invalidFiles))
+        return [];
+    return invalidFiles.flatMap((f) => Array.isArray(f?.diagnostics) ? f.diagnostics : []);
+}
+/**
+ * Parse `terragrunt hcl validate --json` output.
+ *
+ * OBSERVED CONTRACT (captured empirically from terragrunt v1.1.2, win-x64):
+ * the payload is a FLAT JSON array of diagnostic objects on stdout, e.g.
+ *
+ *   [{"range":{"filename":"<ABSOLUTE path>","start":{"line":1,"column":8,...},
+ *     "end":{...}},"snippet":{...},"summary":"Unclosed configuration block",
+ *     "detail":"...","severity":"error"}]
+ *
+ * Key facts: `severity` is a STRING ("error"), `range.filename` is an ABSOLUTE
+ * path (host separator), and a CLEAN unit prints NOTHING (empty stdout, exit 0)
+ * — not `[]`. The nested `{invalid_files:[{diagnostics:[...]}]}` wrapper and the
+ * numeric (1=error/2=warning) severity encoding were NOT observed on v1.1.2 and
+ * are retained only as a tolerant fallback for other/older shapes.
+ * Malformed/unparseable input returns [].
+ */
+export function parseTerragruntOutput(raw, filePath, absPath = path.resolve(filePath)) {
+    if (!raw.trim())
+        return [];
+    let parsed;
+    try {
+        parsed = JSON.parse(raw);
+    }
+    catch {
+        return [];
+    }
+    // Resolved against the unit dir, not compared by basename: a unit that
+    // includes its parent via find_in_parent_folders() gets diagnostics from a
+    // parent terragrunt.hcl, whose basename matches but whose lines do not.
+    const unitDir = path.dirname(absPath);
+    const diagnostics = [];
+    for (const d of toRawDiagnostics(parsed)) {
+        if (!d || typeof d !== "object")
+            continue;
+        const diagFile = d.range?.filename;
+        if (diagFile && !pathsEqual(path.resolve(unitDir, diagFile), absPath))
+            continue;
+        const line = d.range?.start?.line ?? 1;
+        const column = d.range?.start?.column ?? 1;
+        const severity = normalizeSeverity(d.severity);
+        const message = d.summary ?? d.detail ?? "terragrunt hcl validate error";
+        // No rule code in hcl validate output, so the message carries the identity.
+        const idMessage = message
+            .toLowerCase()
+            .replace(/[^a-z0-9]+/g, "-")
+            .slice(0, 80);
+        diagnostics.push({
+            id: `terragrunt-hclvalidate-${line}-${column}-${idMessage}`,
+            message,
+            filePath,
+            line,
+            column,
+            severity,
+            semantic: severity === "error" ? "blocking" : "warning",
+            tool: "terragrunt",
+            fixable: false,
+        });
+    }
+    return diagnostics;
+}
+const SKIPPED = {
+    status: "skipped",
+    diagnostics: [],
+    semantic: "none",
+};
+/**
+ * Runner for `terragrunt hcl validate --json`, the linter for terragrunt units.
+ *
+ * REQUIRES the redesigned terragrunt CLI: the `terragrunt hcl validate` /
+ * `terragrunt hcl fmt` command group replaced the old `hclvalidate`/`hclfmt`
+ * top-level commands in the CLI redesign (~terragrunt v0.75; the legacy names
+ * were removed in v1.0). Contract verified empirically on terragrunt v1.1.2.
+ *
+ * Observed exit-code / output table (terragrunt v1.1.2, win-x64):
+ *   - clean unit ............ exit 0, EMPTY stdout (no `[]`)
+ *   - validation findings ... exit 1, flat JSON array on stdout (+ a log line
+ *                             "N HCL validation error(s) found" on stderr)
+ *   - unknown command ....... an older binary that predates `hcl validate`
+ *                             exits non-zero with the error on STDERR and EMPTY
+ *                             stdout; `spawnFailedWithNoOutput` classifies that
+ *                             as SKIPPED (never a false blocker, and never a
+ *                             false CLEAN — a nonzero exit carries no
+ *                             `SpawnResult.error`, so the status has to be part
+ *                             of the test).
+ *
+ * `hcl validate` recursively validates the unit(s) at its working dir; it has no
+ * per-file flag (`--filter` takes component filter-syntax, NOT a filename — a
+ * bare basename silently matches zero components and suppresses ALL findings,
+ * verified on v1.1.2). So we validate the edited file's unit directory and
+ * attribute findings back to the edited file by absolute path in
+ * parseTerragruntOutput.
+ *
+ * Misdetection edge: `root.hcl` is filename-detected as terragrunt, so a
+ * `root.hcl` that is NOT a terragrunt file still gets validated here — `hcl
+ * validate` just checks generic HCL, so a non-terragrunt file fails soft
+ * (either clean or a plain HCL diagnostic, never a spurious hard blocker).
+ */
+const terragruntRunner = {
+    id: "terragrunt",
+    appliesTo: ["terragrunt"],
+    priority: PRIORITY.GENERAL_ANALYSIS,
+    enabledByDefault: true,
+    skipTestFiles: false,
+    async run(ctx) {
+        const cwd = ctx.cwd || process.cwd();
+        const policy = getLinterPolicyForCwd(ctx.filePath, cwd);
+        if (policy && !policy.preferredRunners.includes("terragrunt"))
+            return SKIPPED;
+        let cmd = null;
+        if (await terragrunt.isAvailableAsync(cwd)) {
+            cmd = terragrunt.getCommand(cwd);
+        }
+        else {
+            const managed = await resolveAvailableOrInstall(terragrunt, "terragrunt", cwd);
+            if (managed)
+                cmd = managed;
+        }
+        if (!cmd)
+            return SKIPPED;
+        const absPath = path.resolve(cwd, ctx.filePath);
+        const fileDir = path.dirname(absPath);
+        const result = await safeSpawnAsync(cmd, ["hcl", "validate", "--json", "--non-interactive"], { cwd: fileDir, timeout: 30000 });
+        if (spawnFailedWithNoOutput(result))
+            return SKIPPED;
+        const diagnostics = parseTerragruntOutput(result.stdout || "", ctx.filePath, absPath);
+        if (diagnostics.length === 0) {
+            return { status: "succeeded", diagnostics: [], semantic: "none" };
+        }
+        const hasErrors = diagnostics.some((d) => d.severity === "error");
+        return {
+            status: hasErrors ? "failed" : "succeeded",
+            diagnostics,
+            semantic: hasErrors ? "blocking" : "warning",
+        };
+    },
+};
+export default terragruntRunner;

package/node_modules/pi-lens/dist/clients/dispatch/runners/tflint.js

@@ -1,9 +1,26 @@
 import * as path from "node:path";
-import { ensureTool } from "../../installer/index.js";
 import { safeSpawnAsync } from "../../safe-spawn.js";
-import { createAvailabilityChecker } from "./utils/runner-helpers.js";
+import { getLinterPolicyForCwd } from "../../tool-policy.js";
+import { findNearestDirWithAnyBasename } from "../../workspace-topology.js";
+import { createAvailabilityChecker, resolveAvailableOrInstall, } from "./utils/runner-helpers.js";
+import { spawnFailedWithNoOutput } from "./utils/spawn-outcome.js";
 import { PRIORITY } from "../priorities.js";
 const tflint = createAvailabilityChecker("tflint", ".exe");
+const TFLINT_CONFIG = ".tflint.hcl";
+/**
+ * tflint resolves `.tflint.hcl` from its own working directory and never walks
+ * parents (its only fallback is `~/.tflint.hcl`). We run it from the edited
+ * file's directory, so a repo-root config would govern nothing beneath the
+ * root unless we name it explicitly. Returns null when `TFLINT_CONFIG_FILE` is
+ * set: `--config` outranks the env var in tflint's own precedence, so passing
+ * one would override a deliberate choice.
+ */
+function findTflintConfig(fileDir) {
+    if (process.env.TFLINT_CONFIG_FILE)
+        return null;
+    const dir = findNearestDirWithAnyBasename(fileDir, [TFLINT_CONFIG]);
+    return dir ? path.join(dir, TFLINT_CONFIG) : null;
+}
 function parseTflintOutput(raw, filePath) {
     try {
         const parsed = JSON.parse(raw);
@@ -36,12 +53,16 @@ const tflintRunner = {
     skipTestFiles: false,
     async run(ctx) {
         const cwd = ctx.cwd || process.cwd();
+        const policy = getLinterPolicyForCwd(ctx.filePath, cwd);
+        if (policy && !policy.preferredRunners.includes("tflint")) {
+            return { status: "skipped", diagnostics: [], semantic: "none" };
+        }
         let cmd = null;
         if (await (tflint.isAvailableAsync(cwd))) {
             cmd = tflint.getCommand(cwd);
         }
         else {
-            const managed = await ensureTool("tflint");
+            const managed = await resolveAvailableOrInstall(tflint, "tflint", cwd);
             if (managed)
                 cmd = managed;
         }
@@ -49,8 +70,19 @@ const tflintRunner = {
             return { status: "skipped", diagnostics: [], semantic: "none" };
         const absPath = path.resolve(cwd, ctx.filePath);
         const fileDir = path.dirname(absPath);
-        const result = await safeSpawnAsync(cmd, ["--format=json", "--no-color", `--filter=${path.basename(absPath)}`], { cwd: fileDir, timeout: 30000 });
-        if (result.error && !result.stdout) {
+        const args = [
+            "--format=json",
+            "--no-color",
+            `--filter=${path.basename(absPath)}`,
+        ];
+        const configPath = findTflintConfig(fileDir);
+        if (configPath)
+            args.push(`--config=${configPath}`);
+        const result = await safeSpawnAsync(cmd, args, {
+            cwd: fileDir,
+            timeout: 30000,
+        });
+        if (spawnFailedWithNoOutput(result)) {
             return { status: "skipped", diagnostics: [], semantic: "none" };
         }
         const diagnostics = parseTflintOutput(result.stdout || "", ctx.filePath);

package/node_modules/pi-lens/dist/clients/dispatch/runners/tree-sitter.js

@@ -525,7 +525,9 @@ const treeSitterRunner = {
                 });
             }
             else {
-                console.error("[tree-sitter] Batched query run failed:", err);
+                // #1333: the logTreeSitter call below already carries this failure to
+                // tree-sitter.log — the console.error was a duplicate RAW write into
+                // pi's frame, not a second destination. Sink kept, write dropped.
                 logTreeSitter({
                     phase: "query_error",
                     filePath,

package/node_modules/pi-lens/dist/clients/dispatch/runners/trivy-config.js

@@ -15,8 +15,14 @@
  *     reports at the same line (`suppressTrivyConfigDockerOverlap`), so trivy
  *     only adds the security checks hadolint lacks.
  *
- * Deferred (tracked on #131): Terraform (tflint overlap), Helm chart rendering,
- * Docker Compose, CloudFormation.
+ *   - **Terraform**: the `.tf` language files themselves — trivy evaluates
+ *     the Terraform language directly, so no content gate is needed (unlike
+ *     the yaml/k8s heuristic above). Terragrunt (`.hcl`) is deliberately
+ *     excluded: trivy has no terragrunt support, and terragrunt config is
+ *     covered by the terragrunt runner instead.
+ *
+ * Deferred (tracked on #131): Helm chart rendering, Docker Compose,
+ * CloudFormation.
  *
  * Gating: the same explicit `trivy.enabled` opt-in as the session-scan modes —
  * trivy is opt-in, period. (Misconfig needs only the small policy bundle, not
@@ -30,7 +36,8 @@ import * as path from "node:path";
 import { safeSpawnAsync } from "../../safe-spawn.js";
 import { isTrivyEnabled, resolveSeverityFloor, } from "../../trivy-client.js";
 import { PRIORITY } from "../priorities.js";
-import { createAvailabilityChecker } from "./utils/runner-helpers.js";
+import { createAvailabilityChecker, resolveAvailableOrInstall, } from "./utils/runner-helpers.js";
+import { spawnFailedWithNoOutput } from "./utils/spawn-outcome.js";
 const trivy = createAvailabilityChecker("trivy", ".exe");
 /**
  * Heuristic: does this YAML look like a Kubernetes manifest (vs a CI workflow,
@@ -115,7 +122,7 @@ export function parseTrivyConfigOutput(raw, filePath) {
 }
 const trivyConfigRunner = {
     id: "trivy-config",
-    appliesTo: ["docker", "yaml"],
+    appliesTo: ["docker", "yaml", "terraform"],
     priority: PRIORITY.GENERAL_ANALYSIS,
     enabledByDefault: true,
     skipTestFiles: false,
@@ -144,8 +151,7 @@ const trivyConfigRunner = {
             cmd = trivy.getCommand(cwd);
         }
         else {
-            const { ensureTool } = await import("../../installer/index.js");
-            const managed = await ensureTool("trivy");
+            const managed = await resolveAvailableOrInstall(trivy, "trivy", cwd);
             if (managed)
                 cmd = managed;
         }
@@ -162,7 +168,7 @@ const trivyConfigRunner = {
             severities,
             absPath,
         ], { cwd, timeout: 60_000 });
-        if (result.error && !result.stdout) {
+        if (spawnFailedWithNoOutput(result)) {
             return { status: "skipped", diagnostics: [], semantic: "none" };
         }
         const diagnostics = parseTrivyConfigOutput(result.stdout || "", ctx.filePath);