@herbertgao/pi-extensions 2026.8.5 → 2026.8.7

package/node_modules/pi-lens/dist/clients/dispatch/runners/spellcheck.js

@@ -18,10 +18,14 @@
  * Install: cargo install typos-cli
  * Or: npm install -g typos-cli (if wrapped)
  */
+import { skipUnlessToolRan } from "./utils/tool-failure.js";
 import { safeSpawnAsync } from "../../safe-spawn.js";
 import { PRIORITY } from "../priorities.js";
 import { createAvailabilityChecker } from "./utils/runner-helpers.js";
 const typos = createAvailabilityChecker("typos", ".exe");
+// typos-cli exit codes: 0 = no typos, 2 = typos found, 1 = an error that
+// stopped the scan. Anything nonzero outside {2} is a rejected invocation.
+const TYPOS_EXIT_CODES = { ran: [2] };
 /**
  * Parse typos-cli JSON output (JSON Lines format)
  *
@@ -90,6 +94,16 @@ const spellcheckRunner = {
         const result = await safeSpawnAsync(typos.getCommand(ctx.cwd || process.cwd()), args, {
             timeout: 15000,
         });
+        // #1816: typos-cli exits 0 clean, 2 with typos found, and 1 on an ERROR
+        // (unreadable config, bad argument). The `status === 2 || stdout` test
+        // below is false for exit 1 with an empty stdout, so a failed run was
+        // reported as a clean file. Only 0 and 2 are runs.
+        const skipped = skipUnlessToolRan("spellcheck", {
+            result,
+            exitCodes: TYPOS_EXIT_CODES,
+        });
+        if (skipped)
+            return skipped;
         // typos-cli exits with code 2 if typos found, 0 if clean
         const hasTypos = result.status === 2 || result.stdout?.trim();
         if (!hasTypos) {

package/node_modules/pi-lens/dist/clients/dispatch/runners/sqlfluff.js

@@ -2,7 +2,17 @@ import { safeSpawnAsync } from "../../safe-spawn.js";
 import { getLinterPolicyForCwd, hasSqlfluffConfig } from "../../tool-policy.js";
 import { PRIORITY } from "../priorities.js";
 import { createAvailabilityChecker, resolveToolCommandWithInstallFallback, } from "./utils/runner-helpers.js";
+import { skipUnlessToolRan } from "./utils/tool-failure.js";
 const sqlfluff = createAvailabilityChecker("sqlfluff", ".exe");
+// sqlfluff exit codes (its CLI docs): 0 = clean, 1 = violations found, 2 = a
+// user error that stopped the lint (unknown dialect, unreadable config).
+// Only 2 is a rejected invocation.
+//
+// The exit TABLE is what protects this runner, not the nothing-to-parse rule:
+// sqlfluff writes its user errors to STDOUT, not stderr (live: an unknown
+// dialect prints the error there), so stdout is non-empty and the fallback
+// rule would read the failed run as a run that found nothing.
+const SQLFLUFF_EXIT_CODES = { ran: [1] };
 export { hasSqlfluffConfig };
 // sqlfluff's JSON lint output does not carry a per-violation fixable flag —
 // `sqlfluff fix` is a separate command and the lint surface doesn't tell us
@@ -131,7 +141,17 @@ const sqlfluffRunner = {
         }
         const result = await safeSpawnAsync(cmd, args, {
             timeout: 20000,
+            cwd,
+        });
+        // #1816: this runner read `result.status` zero times, so a user error
+        // fell through `parseSqlfluffOutput`'s JSON catch to zero violations and
+        // reported the SQL file as clean.
+        const skipped = skipUnlessToolRan("sqlfluff", {
+            result,
+            exitCodes: SQLFLUFF_EXIT_CODES,
         });
+        if (skipped)
+            return skipped;
         const diagnostics = parseSqlfluffOutput(result.stdout ?? "", ctx.filePath);
         if (diagnostics.length === 0) {
             return { status: "succeeded", diagnostics: [], semantic: "none" };

package/node_modules/pi-lens/dist/clients/dispatch/runners/stylelint.js

@@ -3,7 +3,20 @@ import { safeSpawnAsync } from "../../safe-spawn.js";
 import { getLinterPolicyForCwd, hasStylelintConfig, } from "../../tool-policy.js";
 import { PRIORITY } from "../priorities.js";
 import { createAvailabilityChecker, resolveToolCommandWithInstallFallback, } from "./utils/runner-helpers.js";
+import { skipUnlessToolRan } from "./utils/tool-failure.js";
 const stylelint = createAvailabilityChecker("stylelint", ".cmd");
+// stylelint exit codes (its "Exit codes" docs page): 0 = no problems, 1 = a
+// fatal error, 2 = lint problems found, 78 = a configuration error.
+//
+// 1 is listed as a run here rather than a rejection. The evidence for that is
+// NOT a live stylelint: it is this repo's own hand-written fixture
+// (tests/clients/dispatch/runners/stylelint-fixable.test.ts), which reports
+// findings under exit 1. Rather than rewrite a fixture whose provenance is
+// unknown, the table keeps 1 permissive. That is safe because a genuinely
+// fatal stylelint under `--formatter json` writes nothing to stdout, so the
+// nothing-to-parse rule still catches it. 78 is the rejection this table
+// exists to name.
+const STYLELINT_EXIT_CODES = { ran: [1, 2] };
 // Stylelint's standard JSON output reports only aggregate fixableErrorCount /
 // fixableWarningCount per file — there is no per-warning fix flag in the CLI
 // surface. To route the actionable warnings here without a tool rewrite, we
@@ -100,6 +113,15 @@ const stylelintRunner = {
         if (!cmd)
             return { status: "skipped", diagnostics: [], semantic: "none" };
         const result = await safeSpawnAsync(cmd, ["--formatter", "json", ctx.filePath], { timeout: 20000, cwd });
+        // #1816: this runner read `result.status` zero times, so an exit-78
+        // config error (or an exit-1 crash) fell through parseStylelintJson's
+        // catch to zero diagnostics and reported a clean stylesheet.
+        const skipped = skipUnlessToolRan("stylelint", {
+            result,
+            exitCodes: STYLELINT_EXIT_CODES,
+        });
+        if (skipped)
+            return skipped;
         const raw = result.stdout ?? "";
         const diagnostics = parseStylelintJson(raw, ctx.filePath);
         if (diagnostics.length === 0) {

package/node_modules/pi-lens/dist/clients/dispatch/runners/swiftlint.js

@@ -2,6 +2,7 @@ import * as path from "node:path";
 import { safeSpawnAsync } from "../../safe-spawn.js";
 import { PRIORITY } from "../priorities.js";
 import { createAvailabilityChecker, resolveToolCommandWithInstallFallback, } from "./utils/runner-helpers.js";
+import { skipUnlessToolRan } from "./utils/tool-failure.js";
 const swiftlint = createAvailabilityChecker("swiftlint", ".exe");
 // SwiftLint rules whose rule class declares a `corrector` — i.e. rules that
 // `swiftlint --fix` rewrites deterministically. The JSON reporter does not
@@ -126,6 +127,15 @@ const swiftlintRunner = {
         if (!cmd)
             return { status: "skipped", diagnostics: [], semantic: "none" };
         const result = await safeSpawnAsync(cmd, ["--reporter", "json", path.resolve(cwd, ctx.filePath)], { cwd, timeout: 15000 });
+        // #1816: this runner read `result.status` zero times, so a SwiftLint
+        // that refused the invocation reported a clean Swift file. No exit-code
+        // table is declared: SwiftLint's nonzero codes are not documented
+        // stably enough to call any of them a rejection, so classification
+        // rests on the conservative rule — a nonzero exit with nothing to parse
+        // never ran.
+        const skipped = skipUnlessToolRan("swiftlint", { result });
+        if (skipped)
+            return skipped;
         // SwiftLint exits non-zero on violations — stdout still has the JSON
         const raw = result.stdout || "";
         const diagnostics = parseSwiftLintOutput(raw, ctx.filePath);

package/node_modules/pi-lens/dist/clients/dispatch/runners/taplo.js

@@ -1,4 +1,5 @@
 import * as path from "node:path";
+import { findLocalBinUpwards } from "../../package-manager.js";
 import { safeSpawnAsync } from "../../safe-spawn.js";
 import { getLinterPolicyForCwd } from "../../tool-policy.js";
 import { PRIORITY } from "../priorities.js";
@@ -45,12 +46,23 @@ const taploRunner = {
         if (lspPrimaryCoversFile(ctx, "toml") && (await ctx.hasTool("taplo"))) {
             return { status: "skipped", diagnostics: [], semantic: "none" };
         }
-        let cmd = null;
-        if (await (taplo.isAvailableAsync(cwd))) {
-            cmd = taplo.getCommand(cwd);
-        }
-        else {
-            cmd = await resolveToolCommandWithInstallFallback(cwd, "taplo");
+        // Project binary first (#1731, discipline B): `taplo.isAvailableAsync`
+        // resolves through `findManagedNodeToolBinary`, pi-lens's own managed
+        // shim — checked BEFORE any project-local candidate, so a project's own
+        // `node_modules/.bin/taplo` (npm `@taplo/cli`) never won once the managed
+        // copy answered. `findLocalBinUpwards` defaults to `.cmd` on Windows,
+        // matching that npm shim; the availability checker's `.exe` extension is
+        // correct for pi-lens's OWN managed install (a GitHub-release binary,
+        // `clients/installer/index.ts` taplo entry), a different artifact with a
+        // different extension, so it stays as the checker's fallback only.
+        let cmd = findLocalBinUpwards("taplo", cwd) ?? null;
+        if (!cmd) {
+            if (await (taplo.isAvailableAsync(cwd))) {
+                cmd = taplo.getCommand(cwd);
+            }
+            else {
+                cmd = await resolveToolCommandWithInstallFallback(cwd, "taplo");
+            }
         }
         if (!cmd)
             return { status: "skipped", diagnostics: [], semantic: "none" };

package/node_modules/pi-lens/dist/clients/dispatch/runners/trivy-config.js

@@ -10,6 +10,11 @@
  * v1 scope — the highest-value, lowest-overlap surface:
  *   - **Kubernetes manifests** (yaml with an `apiVersion:` + `kind:` signature):
  *     zero existing coverage in pi-lens, so no dedup needed.
+ *   - **CloudFormation templates** (yaml OR json with an
+ *     `AWSTemplateFormatVersion` key, or a `Resources` map whose entries carry
+ *     an `AWS::`/`Custom::`-namespaced `Type`; refs #1757): same zero-overlap
+ *     rationale as Kubernetes — trivy's `cloudformation` misconfig scanner is
+ *     the only IaC-misconfig coverage pi-lens has for CFN.
  *   - **Dockerfiles**: overlaps hadolint on a few rules (`:latest`, root, …);
  *     the dispatcher suppresses trivy-config findings that hadolint already
  *     reports at the same line (`suppressTrivyConfigDockerOverlap`), so trivy
@@ -17,12 +22,11 @@
  *
  *   - **Terraform**: the `.tf` language files themselves — trivy evaluates
  *     the Terraform language directly, so no content gate is needed (unlike
- *     the yaml/k8s heuristic above). Terragrunt (`.hcl`) is deliberately
- *     excluded: trivy has no terragrunt support, and terragrunt config is
- *     covered by the terragrunt runner instead.
+ *     the yaml/k8s/CloudFormation heuristics above). Terragrunt (`.hcl`) is
+ *     deliberately excluded: trivy has no terragrunt support, and terragrunt
+ *     config is covered by the terragrunt runner instead.
  *
- * Deferred (tracked on #131): Helm chart rendering, Docker Compose,
- * CloudFormation.
+ * Deferred (tracked on #131): Helm chart rendering, Docker Compose.
  *
  * Gating: the same explicit `trivy.enabled` opt-in as the session-scan modes —
  * trivy is opt-in, period. (Misconfig needs only the small policy bundle, not
@@ -31,13 +35,14 @@
  *
  * Refs: #131 (Mode 2)
  */
+import { formatToolFailure } from "./utils/tool-failure.js";
 import * as fs from "node:fs";
 import * as path from "node:path";
+import { incrementDegradationCount } from "../../degradation-ledger.js";
 import { safeSpawnAsync } from "../../safe-spawn.js";
 import { isTrivyEnabled, resolveSeverityFloor, } from "../../trivy-client.js";
 import { PRIORITY } from "../priorities.js";
 import { createAvailabilityChecker, resolveAvailableOrInstall, } from "./utils/runner-helpers.js";
-import { spawnFailedWithNoOutput } from "./utils/spawn-outcome.js";
 const trivy = createAvailabilityChecker("trivy", ".exe");
 /**
  * Heuristic: does this YAML look like a Kubernetes manifest (vs a CI workflow,
@@ -53,6 +58,23 @@ export function looksLikeKubernetesManifest(content) {
     }
     return false;
 }
+/**
+ * Heuristic: does this file (yaml OR json) look like a CloudFormation
+ * template? The unambiguous signal is the `AWSTemplateFormatVersion` key,
+ * present on the vast majority of real templates; SAM templates instead
+ * declare `Transform: AWS::Serverless-2016-10-31` (or an array containing
+ * it). Templates that skip both still always declare a `Resources` map whose
+ * entries carry a `Type` in the `AWS::`/`Custom::`/`Alexa::` namespaces — the
+ * one field CFN mandates on every resource. Any one signal qualifies (refs
+ * #1757).
+ */
+export function looksLikeCloudFormationTemplate(content) {
+    if (/AWSTemplateFormatVersion/.test(content))
+        return true;
+    if (/Transform:\s*(\[.*)?["']?AWS::Serverless/.test(content))
+        return true;
+    return /Type["']?\s*:\s*["']?(AWS|Custom|Alexa)::/.test(content);
+}
 function normalizeSeverity(raw) {
     const s = typeof raw === "string" ? raw.toUpperCase() : "";
     if (s === "CRITICAL" || s === "HIGH" || s === "MEDIUM" || s === "LOW") {
@@ -122,7 +144,7 @@ export function parseTrivyConfigOutput(raw, filePath) {
 }
 const trivyConfigRunner = {
     id: "trivy-config",
-    appliesTo: ["docker", "yaml", "terraform"],
+    appliesTo: ["docker", "yaml", "terraform", "json"],
     priority: PRIORITY.GENERAL_ANALYSIS,
     enabledByDefault: true,
     skipTestFiles: false,
@@ -133,8 +155,10 @@ const trivyConfigRunner = {
             return { status: "skipped", diagnostics: [], semantic: "none" };
         }
         const absPath = path.resolve(cwd, ctx.filePath);
-        // YAML is far broader than k8s; only scan files that look like manifests.
-        if (ctx.kind === "yaml") {
+        // YAML is far broader than k8s/CloudFormation; JSON is far broader than
+        // CloudFormation — only scan files that look like one of the IaC
+        // manifest shapes trivy's misconfig scanners understand (refs #1757).
+        if (ctx.kind === "yaml" || ctx.kind === "json") {
             let content = "";
             try {
                 content = fs.readFileSync(absPath, "utf-8");
@@ -142,7 +166,11 @@ const trivyConfigRunner = {
             catch {
                 return { status: "skipped", diagnostics: [], semantic: "none" };
             }
-            if (!looksLikeKubernetesManifest(content)) {
+            const isManifest = ctx.kind === "yaml"
+                ? looksLikeKubernetesManifest(content) ||
+                    looksLikeCloudFormationTemplate(content)
+                : looksLikeCloudFormationTemplate(content);
+            if (!isManifest) {
                 return { status: "skipped", diagnostics: [], semantic: "none" };
             }
         }
@@ -160,15 +188,48 @@ const trivyConfigRunner = {
         const severities = resolveSeverityFloor(cwd).join(",");
         const result = await safeSpawnAsync(cmd, [
             "config",
+            // `--quiet` alone suppresses both the progress bar and log output.
+            // `--no-progress` is NOT a `config` subcommand flag (unlike `fs`,
+            // which does accept it) — trivy 0.73.0 exits 1 on the rejected
+            // flag, but prints its full usage/help text (thousands of bytes)
+            // to STDOUT before the FATAL line on stderr. That stdout is
+            // non-empty, so an empty-output-only guard did not catch it: the
+            // help text failed to JSON-parse, `parseTrivyConfigOutput`
+            // returned `[]`, and this reported `{ status: "succeeded",
+            // diagnostics: [] }` — a clean scan — on every single real
+            // invocation (refs #1757; verified against the real installed
+            // binary, not assumed).
             "--quiet",
-            "--no-progress",
             "--format",
             "json",
             "--severity",
             severities,
             absPath,
         ], { cwd, timeout: 60_000 });
-        if (spawnFailedWithNoOutput(result)) {
+        // `trivy config` is not given `--exit-code`, so it exits 0 whenever it
+        // completed (findings included — see parseTrivyConfigOutput's severity
+        // mapping for how CRITICAL becomes blocking). ANY nonzero status is
+        // therefore a real error, WITH or WITHOUT something on stdout — mirrors
+        // the model already in clients/dispatch/runners/helm-render.ts's
+        // runIacPass, which has the same "trivy prints usage text on a bad
+        // flag" exposure and already got this right. A bounded ledger record
+        // means a broken trivy invocation can no longer go unnoticed for an
+        // entire lane's lifetime the way this one did (refs #1757).
+        if (result.error || result.status !== 0) {
+            // #1816: one shared wording, one truncation, signal named. `subject`
+            // stays the file path — the discriminating identity a reader needs
+            // is WHICH file trivy stopped covering.
+            incrementDegradationCount({
+                kind: "runner-empty-result",
+                subject: absPath,
+                reason: formatToolFailure({
+                    tool: "trivy config",
+                    status: result.status,
+                    signal: result.signal,
+                    stderr: result.stderr || result.error?.message,
+                    stdout: result.stdout,
+                }),
+            });
             return { status: "skipped", diagnostics: [], semantic: "none" };
         }
         const diagnostics = parseTrivyConfigOutput(result.stdout || "", ctx.filePath);