@herbertgao/pi-extensions 2026.8.5 → 2026.8.7

package/node_modules/pi-lens/dist/clients/dispatch/runners/index.js

@@ -6,6 +6,7 @@ import astGrepNapiRunner from "./ast-grep-napi.js";
 import biomeCheckJsonRunner from "./biome-check.js";
 import cppCheckRunner from "./cpp-check.js";
 import credoRunner from "./credo.js";
+import cueVetRunner from "./cue-vet.js";
 import dartAnalyzeRunner from "./dart-analyze.js";
 import detektRunner from "./detekt.js";
 import dotnetBuildRunner from "./dotnet-build.js";
@@ -17,6 +18,7 @@ import goVetRunner from "./go-vet.js";
 import golangciRunner from "./golangci-lint.js";
 import hadolintRunner from "./hadolint.js";
 import helmLintRunner from "./helm-lint.js";
+import helmRenderRunner from "./helm-render.js";
 import htmlhintRunner from "./htmlhint.js";
 import javacRunner from "./javac.js";
 import ktlintRunner from "./ktlint.js";
@@ -84,6 +86,7 @@ export function registerDefaultRunners(registry) {
     registry.register(htmlhintRunner); // HTML linting — tag pairs, attribute rules (priority 20)
     registry.register(hadolintRunner); // Dockerfile linting — syntax, best practices (priority 20)
     registry.register(helmLintRunner); // Helm chart linting (priority 20)
+    registry.register(helmRenderRunner); // Rendered-manifest validation (priority 20, helm.renderValidation.enabled-gated, off by default)
     registry.register(valeRunner); // Prose/style linting for Markdown — config-gated (.vale.ini) (priority 30)
     registry.register(phpLintRunner); // PHP syntax validation via php -l (priority 20)
     registry.register(psScriptAnalyzerRunner); // PowerShell linting via PSScriptAnalyzer module (priority 20)
@@ -103,4 +106,5 @@ export function registerDefaultRunners(registry) {
     registry.register(credoRunner); // Elixir static analysis via credo (priority 20, mix.exs-gated)
     registry.register(elixirCheckRunner); // Elixir compile/syntax diagnostics via mix/elixirc (priority 20)
     registry.register(phpstanRunner); // PHP static analysis via phpstan (priority 20, config-gated)
+    registry.register(cueVetRunner); // CUE evaluation-error validation via cue vet (priority 20) — covers the class cuelsp doesn't publish
 }

package/node_modules/pi-lens/dist/clients/dispatch/runners/javac.js

@@ -1,5 +1,6 @@
 import * as path from "node:path";
 import { safeSpawnAsync } from "../../safe-spawn.js";
+import { hasJavaBuildDescriptor } from "../../tool-policy.js";
 import { PRIORITY } from "../priorities.js";
 import { createAvailabilityChecker } from "./utils/runner-helpers.js";
 const javac = createAvailabilityChecker("javac", ".exe");
@@ -24,7 +25,9 @@ function parseJavacOutput(raw, filePath) {
             line: lineNum,
             column: 1,
             severity,
-            semantic: severity === "error" ? "blocking" : "warning",
+            // A standalone single-file javac run has no project classpath. It can
+            // report useful syntax/type evidence, but it cannot prove a blocker.
+            semantic: "warning",
             tool: "javac",
             rule: "compile",
             fixable: false,
@@ -40,6 +43,17 @@ const javacRunner = {
     skipTestFiles: false,
     async run(ctx) {
         const cwd = ctx.cwd || process.cwd();
+        const absPath = path.resolve(cwd, ctx.filePath);
+        // Inside a Maven/Gradle project a classpath-less single-file compile
+        // cannot produce a valid verdict: every non-JDK import becomes a
+        // "package does not exist" error, and the fallback turns those into
+        // false blocking diagnostics (#1877). jdtls owns those projects; this
+        // runner keeps its value for standalone files with no build descriptor.
+        // Same shared descriptor walk the SpotBugs gate uses.
+        if (hasJavaBuildDescriptor(path.dirname(absPath), ctx.projectRoot ?? ctx.cwd)) {
+            ctx.log?.("javac: skipped — file is inside a Maven/Gradle project; a classpath-less compile would emit false positives");
+            return { status: "skipped", diagnostics: [], semantic: "none" };
+        }
         if (!(await (javac.isAvailableAsync(cwd)))) {
             return { status: "skipped", diagnostics: [], semantic: "none" };
         }
@@ -47,7 +61,6 @@ const javacRunner = {
         if (!cmd) {
             return { status: "skipped", diagnostics: [], semantic: "none" };
         }
-        const absPath = path.resolve(cwd, ctx.filePath);
         const result = await safeSpawnAsync(cmd, ["-Xlint:none", "-proc:none", absPath], {
             cwd,
             timeout: 30000,
@@ -69,7 +82,7 @@ const javacRunner = {
         return {
             status: hasErrors ? "failed" : "succeeded",
             diagnostics,
-            semantic: hasErrors ? "blocking" : "warning",
+            semantic: "warning",
         };
     },
 };

package/node_modules/pi-lens/dist/clients/dispatch/runners/lsp.js

@@ -12,11 +12,14 @@
  * unified runner that delegates to the LSP service.
  */
 import { logExtension } from "../../extension-log.js";
+import { getLspCapableKinds } from "../../language-policy.js";
+import { touchCoverageGap } from "../../lsp/diagnostic-binding.js";
 import { getLSPService } from "../../lsp/index.js";
 import { RUNTIME_CONFIG } from "../../runtime-config.js";
 import { PRIORITY } from "../priorities.js";
 import { resolveRunnerPath } from "../runner-context.js";
 import { convertLspDiagnostics } from "../utils/lsp-diagnostics.js";
+import { demoteInferredProjectDiagnostics } from "../../lsp/inferred-project.js";
 import { enabledAuxiliaryLspServerIds, retagAuxiliaryDiagnostics, } from "../auxiliary-lsp.js";
 import { readFileContent } from "./utils.js";
 import { tryWarmAttachedCodeActions, tryWarmAttachedDiagnostics, } from "../../warm-attach.js";
@@ -49,41 +52,11 @@ function buildCodeActionSuggestion(actions) {
 }
 const lspRunner = {
     id: "lsp",
-    appliesTo: [
-        "jsts",
-        "python",
-        "go",
-        "rust",
-        "ruby",
-        "cxx",
-        "cmake",
-        "shell",
-        "json",
-        "markdown",
-        "css",
-        "yaml",
-        "html",
-        "docker",
-        "php",
-        "powershell",
-        "prisma",
-        "csharp",
-        "fsharp",
-        "java",
-        "kotlin",
-        "swift",
-        "dart",
-        "lua",
-        "zig",
-        "haskell",
-        "elixir",
-        "gleam",
-        "ocaml",
-        "clojure",
-        "terraform",
-        "nix",
-        "toml",
-    ],
+    // Derived from LANGUAGE_POLICY, never hand-maintained: the copy this
+    // replaced had drifted (fish was lspCapable but absent, so getForKind
+    // answered that no LSP runs on fish). Registering a language as lspCapable
+    // is now the only step this seam needs (#1545).
+    appliesTo: getLspCapableKinds(),
     priority: PRIORITY.LSP_PRIMARY,
     enabledByDefault: true,
     async run(ctx) {
@@ -111,6 +84,13 @@ const lspRunner = {
         // one spawned server) — an empty `lspDiags` in that case is NOT a
         // confirmed clean result and must not be reported as one (#570).
         let diagnosticsInconclusive = false;
+        // #1470/#1493: server ids the touch carries no evidence for — an auxiliary
+        // whose push wait our aux grace timer cut off (#1470), or one that stayed
+        // silent with no stored publication for this content (#1493). The touch is
+        // NOT inconclusive (the primary answered, and its findings below are real),
+        // so this is tracked separately: the only claim it invalidates is "0
+        // diagnostics means clean".
+        let unconfirmedServerIds = [];
         let usedWarmAttach = false;
         let failureReason = "";
         const content = readFileContent(ctx.filePath);
@@ -131,11 +111,24 @@ const lspRunner = {
             usedWarmAttach = attached?.available === true;
             // #1179 (shape-5 structural fix): both branches normalize to the
             // `touchFile` wrapper shape. The warm-attach IPC branch resolves a plain
-            // diagnostics array (the socket cannot carry a side-channel; the IPC client
-            // already rejected any inconclusive answer, so `available` ⟹ confirmed) —
-            // wrap it as `{ diags }`; the incumbent branch already returns the wrapper.
+            // diagnostics array — `available` no longer implies a fully confirmed
+            // answer: a `partial` confirmation (an auxiliary that never
+            // reported — cut off by the grace timer, or silent) is served as
+            // `available: true` too (the IPC gate at
+            // `clients/mcp/ipc.ts:248` rejects only `inconclusive`). Carry the
+            // incumbent's `unconfirmedServerIds` onto the wrapper so
+            // `touchCoverageGap` below sees it — dropping it here is the same
+            // false-clean defect already fixed at `clients/lsp/index.ts` (the
+            // workspace sweep wrapper) and `tools/lsp-diagnostics.ts` (the tool
+            // consumer); wrap it as `{ diags }`; the incumbent branch already
+            // returns the wrapper.
             const touched = attached?.available
-                ? { diags: attached.response.diagnostics }
+                ? {
+                    diags: attached.response.diagnostics,
+                    ...(attached.response.unconfirmedServerIds !== undefined && {
+                        unconfirmedServerIds: attached.response.unconfirmedServerIds,
+                    }),
+                }
                 : await lspService.touchFile(ctx.filePath, content, {
                     diagnostics: "document",
                     collectDiagnostics: true,
@@ -151,6 +144,7 @@ const lspRunner = {
             else {
                 lspDiags = touched.diags;
                 diagnosticsInconclusive = touched.inconclusive === true;
+                unconfirmedServerIds = touchCoverageGap(touched);
             }
         }
         catch (err) {
@@ -208,6 +202,24 @@ const lspRunner = {
             return { status: "skipped", diagnostics: [], semantic: "none" };
         }
         if (lspDiags.length === 0) {
+            if (unconfirmedServerIds.length > 0) {
+                // #1470/#1493: an auxiliary never reported — cut off by the aux grace
+                // timer, or silent with nothing published for this content — so this
+                // empty merged result is missing whatever that scanner would have said.
+                // A hung OR silent opengrep must not read as a clean bill of health on
+                // the security lane. The empty result remains skipped, while the correlated
+                // server ids let the coverage notice name the missing scanners once. Nothing
+                // is thrown away: the primary answered with zero findings, so there is nothing to
+                // report; when it DOES have findings the branches below still report
+                // them (see the non-empty path), which is how a trustworthy primary
+                // stays trustworthy under an auxiliary that never reported.
+                return {
+                    status: "skipped",
+                    diagnostics: [],
+                    semantic: "none",
+                    unconfirmedServerIds: [...unconfirmedServerIds],
+                };
+            }
             return {
                 status: "succeeded",
                 diagnostics: [],
@@ -217,9 +229,34 @@ const lspRunner = {
         }
         // Convert LSP diagnostics to our format
         // Defensive: filter out malformed diagnostics that may lack range
-        const validLspDiags = lspDiags.filter((d) => d.range?.start?.line !== undefined);
+        const rawValidLspDiags = lspDiags.filter((d) => d.range?.start?.line !== undefined);
+        // #1640: the per-edit path renders the same authority as the mode=full
+        // sweep, so it applies the same demotion. Costs one bounded `projectInfo`
+        // request, and only when the file already has a TypeScript ERROR — an edit
+        // that type-checks clean pays nothing.
+        //
+        // #1645 review F2: NOT under warm attach. There, diagnostics came from an
+        // already-running remote session over IPC and no local client exists — so
+        // the probe would have to spawn a whole tsserver fleet to answer, breaking
+        // this branch's spawn-free contract (see the comment below), and the
+        // answer it spawned for would be the NEW server's project resolution, not
+        // the warm session's. A meaningless answer bought with a process is worse
+        // than no answer, so the warm-attach path keeps pre-#1640 rendering. This
+        // is a known gap, recorded on the issue rather than papered over with an
+        // "unverified" label that would fire on every warm-attach file including
+        // the properly configured majority.
+        const validLspDiags = usedWarmAttach
+            ? rawValidLspDiags
+            : await demoteInferredProjectDiagnostics(rawValidLspDiags, {
+                filePath: diagnosticPath,
+                cwd: ctx.cwd,
+                service: lspService,
+            });
         const fixSuggestionByIndex = new Map();
-        const blockingDiagIndexes = validLspDiags
+        // #1640: read severity off the RAW list. A demoted diagnostic is still
+        // worth a quick-fix suggestion — the demotion changes its authority, not
+        // whether tsserver can offer a fix. Indexes align 1:1 with `validLspDiags`.
+        const blockingDiagIndexes = rawValidLspDiags
             .map((d, idx) => ({ d, idx }))
             .filter(({ d }) => d.severity === 1)
             .slice(0, WARM_CODE_ACTION_LOOKUP_LIMIT);
@@ -279,6 +316,9 @@ const lspRunner = {
             failureKind: hasErrors ? "blocking_diagnostics" : undefined,
             diagnostics: keptDiagnostics,
             semantic: resultSemantic,
+            ...(unconfirmedServerIds.length > 0 && {
+                unconfirmedServerIds: [...unconfirmedServerIds],
+            }),
         };
     },
 };

package/node_modules/pi-lens/dist/clients/dispatch/runners/markdownlint.js

@@ -2,7 +2,12 @@ import { safeSpawnAsync } from "../../safe-spawn.js";
 import { getLinterPolicyForCwd, markdownlintConfigArgs, } from "../../tool-policy.js";
 import { PRIORITY } from "../priorities.js";
 import { createAvailabilityChecker, resolveToolCommandWithInstallFallback, } from "./utils/runner-helpers.js";
+import { skipUnlessToolRan } from "./utils/tool-failure.js";
 const markdownlint = createAvailabilityChecker("markdownlint-cli2", ".cmd");
+// markdownlint-cli2 exit codes (its README's "Exit Codes" section): 0 = no
+// findings, 1 = lint findings, 2 = unexpected error (unreadable config, bad
+// glob, crash). Only 2 is a rejected invocation.
+const MARKDOWNLINT_EXIT_CODES = { ran: [1] };
 // markdownlint-cli2 text output does not include per-violation fixability,
 // so we keep a static allowlist of MD### rules whose --fix is deterministic.
 // Sourced from the rule pages in
@@ -108,7 +113,18 @@ const markdownlintRunner = {
             timeout: 15000,
             cwd,
         });
+        // #1816: this runner read `result.status` zero times, so an exit-2
+        // config error with an empty stdout parsed to zero diagnostics and was
+        // reported as a clean Markdown file. An empty result must distinguish
+        // clean from errored.
         const raw = `${result.stdout ?? ""}${result.stderr ?? ""}`;
+        const skipped = skipUnlessToolRan("markdownlint", {
+            result,
+            output: raw,
+            exitCodes: MARKDOWNLINT_EXIT_CODES,
+        });
+        if (skipped)
+            return skipped;
         const diagnostics = parseMarkdownlintOutput(raw, ctx.filePath);
         if (diagnostics.length === 0) {
             return { status: "succeeded", diagnostics: [], semantic: "none" };

package/node_modules/pi-lens/dist/clients/dispatch/runners/mypy.js

@@ -3,7 +3,19 @@ import { safeSpawnAsync } from "../../safe-spawn.js";
 import { hasMypyConfig } from "../../tool-policy.js";
 import { PRIORITY } from "../priorities.js";
 import { createAvailabilityChecker, resolveToolCommandWithInstallFallback, } from "./utils/runner-helpers.js";
+import { skipUnlessToolRan } from "./utils/tool-failure.js";
 const mypy = createAvailabilityChecker("mypy", "");
+// mypy exit codes: 0 = no type errors, 1 = type errors found, 2 = a blocking
+// error. 2 is NOT a rejected invocation on its own — mypy reports a source
+// SYNTAX error under 2 and still writes a normal parsable diagnostic to stdout
+// (verified live against mypy 2.3.1: `syn.py:1: error: Invalid syntax
+// [syntax]`). A bad flag or unreadable config also exits 2, but writes its
+// message to STDERR and leaves stdout empty.
+//
+// So the exit code cannot separate the two, and the STREAM does: the gate below
+// judges "nothing to parse" on stdout alone, while the parser still reads both.
+// The table's remaining job is to reject any OTHER nonzero status.
+const MYPY_EXIT_CODES = { ran: [1, 2] };
 // mypy output: file.py:10: error: Incompatible types [assignment]
 //
 // mypy follows imports and reports errors in OTHER modules, not just the file
@@ -64,7 +76,18 @@ const mypyRunner = {
         if (!cmd)
             return { status: "skipped", diagnostics: [], semantic: "none" };
         const result = await safeSpawnAsync(cmd, ["--no-error-summary", "--show-column-numbers", ctx.filePath], { timeout: 30000, cwd });
+        // #1816: this runner read `result.status` zero times, so an exit-2
+        // config error reported the file as cleanly type-checked. The gate reads
+        // stdout only (see MYPY_EXIT_CODES) so an exit-2 SYNTAX error, which
+        // does write a diagnostic there, still reaches the parser.
         const raw = `${result.stdout ?? ""}${result.stderr ?? ""}`;
+        const skipped = skipUnlessToolRan("mypy", {
+            result,
+            output: result.stdout,
+            exitCodes: MYPY_EXIT_CODES,
+        });
+        if (skipped)
+            return skipped;
         const diagnostics = parseMypyOutput(raw, ctx.filePath, cwd);
         if (diagnostics.length === 0) {
             return { status: "succeeded", diagnostics: [], semantic: "none" };