@herbertgao/pi-extensions 2026.8.6 → 2026.8.8

package/node_modules/pi-lens/dist/clients/dispatch/runners/htmlhint.js

@@ -3,7 +3,7 @@ import { safeSpawnAsync } from "../../safe-spawn.js";
 import { getLinterPolicyForCwd } from "../../tool-policy.js";
 import { PRIORITY } from "../priorities.js";
 import { createAvailabilityChecker, resolveToolCommandWithInstallFallback, } from "./utils/runner-helpers.js";
-import { spawnFailedWithNoOutput } from "./utils/spawn-outcome.js";
+import { parseToolRun } from "./utils/tool-failure.js";
 const htmlhint = createAvailabilityChecker("htmlhint");
 const HTMLHINT_RULES = {
     "tag-pair": true,
@@ -55,7 +55,7 @@ const htmlhintRunner = {
             return { status: "skipped", diagnostics: [], semantic: "none" };
         }
         let cmd = null;
-        if (await (htmlhint.isAvailableAsync(cwd))) {
+        if (await htmlhint.isAvailableAsync(cwd)) {
             cmd = htmlhint.getCommand(cwd);
         }
         else {
@@ -72,11 +72,13 @@ const htmlhintRunner = {
             "unix",
             path.resolve(cwd, ctx.filePath),
         ], { cwd });
+        // #1948: htmlhint exits 1 when it finds errors and prints them in `unix`
+        // format on stdout. Zero parsed out of a nonzero exit is a parser break.
         const output = result.stdout || result.stderr || "";
-        if (spawnFailedWithNoOutput(result, output)) {
-            return { status: "skipped", diagnostics: [], semantic: "none" };
-        }
-        const diagnostics = parseHtmlhintOutput(output, ctx.filePath);
+        const run = parseToolRun("htmlhint", { result, output }, (out) => parseHtmlhintOutput(out, ctx.filePath));
+        if (run.skipped)
+            return run.skipped;
+        const diagnostics = run.diagnostics;
         if (diagnostics.length === 0) {
             return { status: "succeeded", diagnostics: [], semantic: "none" };
         }

package/node_modules/pi-lens/dist/clients/dispatch/runners/index.js

@@ -6,6 +6,7 @@ import astGrepNapiRunner from "./ast-grep-napi.js";
 import biomeCheckJsonRunner from "./biome-check.js";
 import cppCheckRunner from "./cpp-check.js";
 import credoRunner from "./credo.js";
+import cueVetRunner from "./cue-vet.js";
 import dartAnalyzeRunner from "./dart-analyze.js";
 import detektRunner from "./detekt.js";
 import dotnetBuildRunner from "./dotnet-build.js";
@@ -17,6 +18,7 @@ import goVetRunner from "./go-vet.js";
 import golangciRunner from "./golangci-lint.js";
 import hadolintRunner from "./hadolint.js";
 import helmLintRunner from "./helm-lint.js";
+import helmRenderRunner from "./helm-render.js";
 import htmlhintRunner from "./htmlhint.js";
 import javacRunner from "./javac.js";
 import ktlintRunner from "./ktlint.js";
@@ -84,6 +86,7 @@ export function registerDefaultRunners(registry) {
     registry.register(htmlhintRunner); // HTML linting — tag pairs, attribute rules (priority 20)
     registry.register(hadolintRunner); // Dockerfile linting — syntax, best practices (priority 20)
     registry.register(helmLintRunner); // Helm chart linting (priority 20)
+    registry.register(helmRenderRunner); // Rendered-manifest validation (priority 20, helm.renderValidation.enabled-gated, off by default)
     registry.register(valeRunner); // Prose/style linting for Markdown — config-gated (.vale.ini) (priority 30)
     registry.register(phpLintRunner); // PHP syntax validation via php -l (priority 20)
     registry.register(psScriptAnalyzerRunner); // PowerShell linting via PSScriptAnalyzer module (priority 20)
@@ -103,4 +106,5 @@ export function registerDefaultRunners(registry) {
     registry.register(credoRunner); // Elixir static analysis via credo (priority 20, mix.exs-gated)
     registry.register(elixirCheckRunner); // Elixir compile/syntax diagnostics via mix/elixirc (priority 20)
     registry.register(phpstanRunner); // PHP static analysis via phpstan (priority 20, config-gated)
+    registry.register(cueVetRunner); // CUE evaluation-error validation via cue vet (priority 20) — covers the class cuelsp doesn't publish
 }

package/node_modules/pi-lens/dist/clients/dispatch/runners/javac.js

@@ -1,5 +1,6 @@
 import * as path from "node:path";
 import { safeSpawnAsync } from "../../safe-spawn.js";
+import { hasJavaBuildDescriptor } from "../../tool-policy.js";
 import { PRIORITY } from "../priorities.js";
 import { createAvailabilityChecker } from "./utils/runner-helpers.js";
 const javac = createAvailabilityChecker("javac", ".exe");
@@ -24,7 +25,9 @@ function parseJavacOutput(raw, filePath) {
             line: lineNum,
             column: 1,
             severity,
-            semantic: severity === "error" ? "blocking" : "warning",
+            // A standalone single-file javac run has no project classpath. It can
+            // report useful syntax/type evidence, but it cannot prove a blocker.
+            semantic: "warning",
             tool: "javac",
             rule: "compile",
             fixable: false,
@@ -40,6 +43,17 @@ const javacRunner = {
     skipTestFiles: false,
     async run(ctx) {
         const cwd = ctx.cwd || process.cwd();
+        const absPath = path.resolve(cwd, ctx.filePath);
+        // Inside a Maven/Gradle project a classpath-less single-file compile
+        // cannot produce a valid verdict: every non-JDK import becomes a
+        // "package does not exist" error, and the fallback turns those into
+        // false blocking diagnostics (#1877). jdtls owns those projects; this
+        // runner keeps its value for standalone files with no build descriptor.
+        // Same shared descriptor walk the SpotBugs gate uses.
+        if (hasJavaBuildDescriptor(path.dirname(absPath), ctx.projectRoot ?? ctx.cwd)) {
+            ctx.log?.("javac: skipped — file is inside a Maven/Gradle project; a classpath-less compile would emit false positives");
+            return { status: "skipped", diagnostics: [], semantic: "none" };
+        }
         if (!(await (javac.isAvailableAsync(cwd)))) {
             return { status: "skipped", diagnostics: [], semantic: "none" };
         }
@@ -47,7 +61,6 @@ const javacRunner = {
         if (!cmd) {
             return { status: "skipped", diagnostics: [], semantic: "none" };
         }
-        const absPath = path.resolve(cwd, ctx.filePath);
         const result = await safeSpawnAsync(cmd, ["-Xlint:none", "-proc:none", absPath], {
             cwd,
             timeout: 30000,
@@ -69,7 +82,7 @@ const javacRunner = {
         return {
             status: hasErrors ? "failed" : "succeeded",
             diagnostics,
-            semantic: hasErrors ? "blocking" : "warning",
+            semantic: "warning",
         };
     },
 };

package/node_modules/pi-lens/dist/clients/dispatch/runners/lsp.js

@@ -12,12 +12,14 @@
  * unified runner that delegates to the LSP service.
  */
 import { logExtension } from "../../extension-log.js";
+import { getLspCapableKinds } from "../../language-policy.js";
 import { touchCoverageGap } from "../../lsp/diagnostic-binding.js";
 import { getLSPService } from "../../lsp/index.js";
 import { RUNTIME_CONFIG } from "../../runtime-config.js";
 import { PRIORITY } from "../priorities.js";
 import { resolveRunnerPath } from "../runner-context.js";
 import { convertLspDiagnostics } from "../utils/lsp-diagnostics.js";
+import { demoteInferredProjectDiagnostics } from "../../lsp/inferred-project.js";
 import { enabledAuxiliaryLspServerIds, retagAuxiliaryDiagnostics, } from "../auxiliary-lsp.js";
 import { readFileContent } from "./utils.js";
 import { tryWarmAttachedCodeActions, tryWarmAttachedDiagnostics, } from "../../warm-attach.js";
@@ -50,41 +52,11 @@ function buildCodeActionSuggestion(actions) {
 }
 const lspRunner = {
     id: "lsp",
-    appliesTo: [
-        "jsts",
-        "python",
-        "go",
-        "rust",
-        "ruby",
-        "cxx",
-        "cmake",
-        "shell",
-        "json",
-        "markdown",
-        "css",
-        "yaml",
-        "html",
-        "docker",
-        "php",
-        "powershell",
-        "prisma",
-        "csharp",
-        "fsharp",
-        "java",
-        "kotlin",
-        "swift",
-        "dart",
-        "lua",
-        "zig",
-        "haskell",
-        "elixir",
-        "gleam",
-        "ocaml",
-        "clojure",
-        "terraform",
-        "nix",
-        "toml",
-    ],
+    // Derived from LANGUAGE_POLICY, never hand-maintained: the copy this
+    // replaced had drifted (fish was lspCapable but absent, so getForKind
+    // answered that no LSP runs on fish). Registering a language as lspCapable
+    // is now the only step this seam needs (#1545).
+    appliesTo: getLspCapableKinds(),
     priority: PRIORITY.LSP_PRIMARY,
     enabledByDefault: true,
     async run(ctx) {
@@ -112,10 +84,12 @@ const lspRunner = {
         // one spawned server) — an empty `lspDiags` in that case is NOT a
         // confirmed clean result and must not be reported as one (#570).
         let diagnosticsInconclusive = false;
-        // #1470: server ids the touch carries no evidence for — an auxiliary whose
-        // push wait our aux grace timer cut off. The touch is NOT inconclusive (the
-        // primary answered, and its findings below are real), so this is tracked
-        // separately: the only claim it invalidates is "0 diagnostics means clean".
+        // #1470/#1493: server ids the touch carries no evidence for — an auxiliary
+        // whose push wait our aux grace timer cut off (#1470), or one that stayed
+        // silent with no stored publication for this content (#1493). The touch is
+        // NOT inconclusive (the primary answered, and its findings below are real),
+        // so this is tracked separately: the only claim it invalidates is "0
+        // diagnostics means clean".
         let unconfirmedServerIds = [];
         let usedWarmAttach = false;
         let failureReason = "";
@@ -138,8 +112,9 @@ const lspRunner = {
             // #1179 (shape-5 structural fix): both branches normalize to the
             // `touchFile` wrapper shape. The warm-attach IPC branch resolves a plain
             // diagnostics array — `available` no longer implies a fully confirmed
-            // answer: a `partial` confirmation (an auxiliary cut off by the grace
-            // timer) is served as `available: true` too (the IPC gate at
+            // answer: a `partial` confirmation (an auxiliary that never
+            // reported — cut off by the grace timer, or silent) is served as
+            // `available: true` too (the IPC gate at
             // `clients/mcp/ipc.ts:248` rejects only `inconclusive`). Carry the
             // incumbent's `unconfirmedServerIds` onto the wrapper so
             // `touchCoverageGap` below sees it — dropping it here is the same
@@ -228,18 +203,22 @@ const lspRunner = {
         }
         if (lspDiags.length === 0) {
             if (unconfirmedServerIds.length > 0) {
-                // #1470: an auxiliary was cut off by the aux grace timer, so this empty
-                // merged result is missing whatever that scanner would have said — a
-                // hung opengrep must not read as a clean bill of health on the security
-                // lane. `RunnerResult` has no channel for "clean for these servers,
-                // unknown for those", so the only honest verdict this seam can express
-                // for an EMPTY result is "not checked" — which is what "skipped" means
-                // here, and it lets the coverage notice say so once. Nothing is thrown
-                // away: the primary answered with zero findings, so there is nothing to
+                // #1470/#1493: an auxiliary never reported — cut off by the aux grace
+                // timer, or silent with nothing published for this content — so this
+                // empty merged result is missing whatever that scanner would have said.
+                // A hung OR silent opengrep must not read as a clean bill of health on
+                // the security lane. The empty result remains skipped, while the correlated
+                // server ids let the coverage notice name the missing scanners once. Nothing
+                // is thrown away: the primary answered with zero findings, so there is nothing to
                 // report; when it DOES have findings the branches below still report
                 // them (see the non-empty path), which is how a trustworthy primary
-                // stays trustworthy under a cut-off auxiliary.
-                return { status: "skipped", diagnostics: [], semantic: "none" };
+                // stays trustworthy under an auxiliary that never reported.
+                return {
+                    status: "skipped",
+                    diagnostics: [],
+                    semantic: "none",
+                    unconfirmedServerIds: [...unconfirmedServerIds],
+                };
             }
             return {
                 status: "succeeded",
@@ -250,9 +229,34 @@ const lspRunner = {
         }
         // Convert LSP diagnostics to our format
         // Defensive: filter out malformed diagnostics that may lack range
-        const validLspDiags = lspDiags.filter((d) => d.range?.start?.line !== undefined);
+        const rawValidLspDiags = lspDiags.filter((d) => d.range?.start?.line !== undefined);
+        // #1640: the per-edit path renders the same authority as the mode=full
+        // sweep, so it applies the same demotion. Costs one bounded `projectInfo`
+        // request, and only when the file already has a TypeScript ERROR — an edit
+        // that type-checks clean pays nothing.
+        //
+        // #1645 review F2: NOT under warm attach. There, diagnostics came from an
+        // already-running remote session over IPC and no local client exists — so
+        // the probe would have to spawn a whole tsserver fleet to answer, breaking
+        // this branch's spawn-free contract (see the comment below), and the
+        // answer it spawned for would be the NEW server's project resolution, not
+        // the warm session's. A meaningless answer bought with a process is worse
+        // than no answer, so the warm-attach path keeps pre-#1640 rendering. This
+        // is a known gap, recorded on the issue rather than papered over with an
+        // "unverified" label that would fire on every warm-attach file including
+        // the properly configured majority.
+        const validLspDiags = usedWarmAttach
+            ? rawValidLspDiags
+            : await demoteInferredProjectDiagnostics(rawValidLspDiags, {
+                filePath: diagnosticPath,
+                cwd: ctx.cwd,
+                service: lspService,
+            });
         const fixSuggestionByIndex = new Map();
-        const blockingDiagIndexes = validLspDiags
+        // #1640: read severity off the RAW list. A demoted diagnostic is still
+        // worth a quick-fix suggestion — the demotion changes its authority, not
+        // whether tsserver can offer a fix. Indexes align 1:1 with `validLspDiags`.
+        const blockingDiagIndexes = rawValidLspDiags
             .map((d, idx) => ({ d, idx }))
             .filter(({ d }) => d.severity === 1)
             .slice(0, WARM_CODE_ACTION_LOOKUP_LIMIT);
@@ -312,6 +316,9 @@ const lspRunner = {
             failureKind: hasErrors ? "blocking_diagnostics" : undefined,
             diagnostics: keptDiagnostics,
             semantic: resultSemantic,
+            ...(unconfirmedServerIds.length > 0 && {
+                unconfirmedServerIds: [...unconfirmedServerIds],
+            }),
         };
     },
 };

package/node_modules/pi-lens/dist/clients/dispatch/runners/markdownlint.js

@@ -2,7 +2,12 @@ import { safeSpawnAsync } from "../../safe-spawn.js";
 import { getLinterPolicyForCwd, markdownlintConfigArgs, } from "../../tool-policy.js";
 import { PRIORITY } from "../priorities.js";
 import { createAvailabilityChecker, resolveToolCommandWithInstallFallback, } from "./utils/runner-helpers.js";
+import { parseToolRun } from "./utils/tool-failure.js";
 const markdownlint = createAvailabilityChecker("markdownlint-cli2", ".cmd");
+// markdownlint-cli2 exit codes (its README's "Exit Codes" section): 0 = no
+// findings, 1 = lint findings, 2 = unexpected error (unreadable config, bad
+// glob, crash). Only 2 is a rejected invocation.
+const MARKDOWNLINT_EXIT_CODES = { ran: [1] };
 // markdownlint-cli2 text output does not include per-violation fixability,
 // so we keep a static allowlist of MD### rules whose --fix is deterministic.
 // Sourced from the rule pages in
@@ -93,7 +98,7 @@ const markdownlintRunner = {
             return { status: "skipped", diagnostics: [], semantic: "none" };
         }
         let cmd = null;
-        if (await (markdownlint.isAvailableAsync(cwd))) {
+        if (await markdownlint.isAvailableAsync(cwd)) {
             cmd = markdownlint.getCommand(cwd);
         }
         else {
@@ -108,8 +113,17 @@ const markdownlintRunner = {
             timeout: 15000,
             cwd,
         });
+        // #1816: this runner read `result.status` zero times, so an exit-2
+        // config error with an empty stdout parsed to zero diagnostics and was
+        // reported as a clean Markdown file. An empty result must distinguish
+        // clean from errored.
         const raw = `${result.stdout ?? ""}${result.stderr ?? ""}`;
-        const diagnostics = parseMarkdownlintOutput(raw, ctx.filePath);
+        // #1948: one seam for both gates — the tool produced nothing, and the
+        // tool produced something the parser could not read.
+        const run = parseToolRun("markdownlint", { result, output: raw, exitCodes: MARKDOWNLINT_EXIT_CODES }, (out) => parseMarkdownlintOutput(out, ctx.filePath));
+        if (run.skipped)
+            return run.skipped;
+        const diagnostics = run.diagnostics;
         if (diagnostics.length === 0) {
             return { status: "succeeded", diagnostics: [], semantic: "none" };
         }

package/node_modules/pi-lens/dist/clients/dispatch/runners/mypy.js

@@ -3,7 +3,19 @@ import { safeSpawnAsync } from "../../safe-spawn.js";
 import { hasMypyConfig } from "../../tool-policy.js";
 import { PRIORITY } from "../priorities.js";
 import { createAvailabilityChecker, resolveToolCommandWithInstallFallback, } from "./utils/runner-helpers.js";
+import { parseToolRun } from "./utils/tool-failure.js";
 const mypy = createAvailabilityChecker("mypy", "");
+// mypy exit codes: 0 = no type errors, 1 = type errors found, 2 = a blocking
+// error. 2 is NOT a rejected invocation on its own — mypy reports a source
+// SYNTAX error under 2 and still writes a normal parsable diagnostic to stdout
+// (verified live against mypy 2.3.1: `syn.py:1: error: Invalid syntax
+// [syntax]`). A bad flag or unreadable config also exits 2, but writes its
+// message to STDERR and leaves stdout empty.
+//
+// So the exit code cannot separate the two, and the STREAM does: the gate below
+// judges "nothing to parse" on stdout alone, while the parser still reads both.
+// The table's remaining job is to reject any OTHER nonzero status.
+const MYPY_EXIT_CODES = { ran: [1, 2] };
 // mypy output: file.py:10: error: Incompatible types [assignment]
 //
 // mypy follows imports and reports errors in OTHER modules, not just the file
@@ -55,7 +67,7 @@ const mypyRunner = {
             return { status: "skipped", diagnostics: [], semantic: "none" };
         }
         let cmd = null;
-        if (await (mypy.isAvailableAsync(cwd))) {
+        if (await mypy.isAvailableAsync(cwd)) {
             cmd = mypy.getCommand(cwd);
         }
         else {
@@ -64,8 +76,19 @@ const mypyRunner = {
         if (!cmd)
             return { status: "skipped", diagnostics: [], semantic: "none" };
         const result = await safeSpawnAsync(cmd, ["--no-error-summary", "--show-column-numbers", ctx.filePath], { timeout: 30000, cwd });
+        // #1816: this runner read `result.status` zero times, so an exit-2
+        // config error reported the file as cleanly type-checked. The gate reads
+        // stdout only (see MYPY_EXIT_CODES) so an exit-2 SYNTAX error, which
+        // does write a diagnostic there, still reaches the parser.
         const raw = `${result.stdout ?? ""}${result.stderr ?? ""}`;
-        const diagnostics = parseMypyOutput(raw, ctx.filePath, cwd);
+        // #1948: `parseOutput` keeps the split this runner already had — the gate
+        // judges "did it run" on stdout alone, the parser still reads both
+        // streams — so adding the parsed-nothing record does not widen the
+        // did-it-run verdict.
+        const run = parseToolRun("mypy", { result, output: result.stdout, exitCodes: MYPY_EXIT_CODES }, (out) => parseMypyOutput(out, ctx.filePath, cwd), { parseOutput: raw });
+        if (run.skipped)
+            return run.skipped;
+        const diagnostics = run.diagnostics;
         if (diagnostics.length === 0) {
             return { status: "succeeded", diagnostics: [], semantic: "none" };
         }

package/node_modules/pi-lens/dist/clients/dispatch/runners/oxlint.js

@@ -76,10 +76,13 @@ const oxlintRunner = {
         const result = await safeSpawnAsync(cmd, args, {
             timeout: 30000,
         });
-        // Oxlint returns non-zero when issues found
-        if (result.status === 0) {
-            return { status: "succeeded", diagnostics: [], semantic: "none" };
-        }
+        // Oxlint exits 0 whenever nothing at ERROR severity was found — that
+        // includes a run that found only warnings, its own default severity
+        // (#1947). A run that found nothing at all also exits 0, but still
+        // prints a report with an empty `diagnostics` array, so parsing
+        // unconditionally and branching on the parsed count (below) tells the
+        // two apart instead of the exit code discarding the warning case.
+        //
         // Parse JSON output. Fall back to the unix-format parser if JSON parsing
         // fails (older oxlint versions, malformed stderr noise, etc.) — keeps the
         // runner producing diagnostics even when the structured-fix metadata is
@@ -94,8 +97,20 @@ const oxlintRunner = {
             return { status: "succeeded", diagnostics: [], semantic: "none" };
         }
         const hasBlocking = diagnostics.some((d) => d.semantic === "blocking");
+        // A warning-only result on exit 0 is oxlint's normal outcome, not a
+        // failure: exit 0 means nothing hit ERROR severity. `status: "failed"`
+        // here would stop this arm from reporting "succeeded", which breaks two
+        // things downstream — plan.ts's ["eslint", "oxlint", "biome-check-json"]
+        // fallback group only stops at the first `status: "succeeded"` runner
+        // (dispatcher.ts's `runGroup`), so biome-check-json would run again on
+        // every warning-only save (extra spawns, a possible install, duplicate
+        // findings); and it would mismatch the sibling convention (biome-check,
+        // golangci-lint, rubocop) of keying `status` off blocking severity, not
+        // off the tool's raw exit code. The findings themselves still reach the
+        // delivery pipeline regardless of `status` — dispatcher.ts buckets by
+        // each diagnostic's own `semantic`, so a warning stays a warning.
         return {
-            status: "failed",
+            status: !hasBlocking && result.status === 0 ? "succeeded" : "failed",
             diagnostics,
             semantic: hasBlocking ? "blocking" : "warning",
         };

package/node_modules/pi-lens/dist/clients/dispatch/runners/phpstan.js

@@ -3,6 +3,11 @@ import { safeSpawnAsync } from "../../safe-spawn.js";
 import { getLinterPolicyForCwd, hasPhpstanConfig } from "../../tool-policy.js";
 import { PRIORITY } from "../priorities.js";
 import { createAvailabilityChecker, resolveVendorToolCommand, } from "./utils/runner-helpers.js";
+import { parseToolRun } from "./utils/tool-failure.js";
+// phpstan's documented exit codes: 0 = no errors, 1 = errors found, 2 = a
+// fatal/internal error that stopped the analysis. Only 1 is a run that carries
+// findings.
+const PHPSTAN_EXIT_CODES = { ran: [1] };
 const phpstan = createAvailabilityChecker("phpstan", ".phar");
 // phpstan analyses the target file PLUS its dependency closure and keys errors
 // by the real file in `output.files`. Attribute each diagnostic to that key
@@ -19,7 +24,7 @@ export function parsePhpstanJson(raw, fallbackPath, cwd) {
                     ? file
                     : path.resolve(cwd, file)
                 : fallbackPath;
-            for (const err of fileErrors.errors ?? []) {
+            for (const err of fileErrors?.messages ?? []) {
                 diagnostics.push({
                     id: `phpstan:${err.line ?? 1}:${err.message.slice(0, 40)}`,
                     message: err.message,
@@ -29,11 +34,38 @@ export function parsePhpstanJson(raw, fallbackPath, cwd) {
                     severity: "error",
                     semantic: "blocking",
                     tool: "phpstan",
-                    rule: "phpstan",
+                    rule: err.identifier || "phpstan",
                     fixable: false,
                 });
             }
         }
+        // #1937 round 2: the top-level `errors[]` array carries phpstan's
+        // FILE-INDEPENDENT findings — internal errors, and ignore patterns that
+        // matched nothing. A run can report `totals.errors: 1` with `files: {}`
+        // and exit 1, and reading only `files` turned that into zero
+        // diagnostics: the same defect class as the `errors`-vs-`messages` bug
+        // above, one level up. Pinned by
+        // tests/fixtures/runner-output/phpstan/top-level-errors.captured.json.
+        //
+        // These have no file or line, so they attach to the edited file at line
+        // 1. That is the honest placement: the reader needs to see them, and
+        // there is nowhere truer to put them.
+        for (const message of output.errors ?? []) {
+            if (typeof message !== "string" || !message.trim())
+                continue;
+            diagnostics.push({
+                id: `phpstan:global:${message.slice(0, 40)}`,
+                message,
+                filePath: fallbackPath,
+                line: 1,
+                column: 1,
+                severity: "error",
+                semantic: "blocking",
+                tool: "phpstan",
+                rule: "phpstan/analysis",
+                fixable: false,
+            });
+        }
         return diagnostics;
     }
     catch {
@@ -41,7 +73,7 @@ export function parsePhpstanJson(raw, fallbackPath, cwd) {
     }
 }
 async function resolvePhpstan(cwd) {
-    if (await (phpstan.isAvailableAsync(cwd)))
+    if (await phpstan.isAvailableAsync(cwd))
         return phpstan.getCommand(cwd);
     return resolveVendorToolCommand(cwd, "phpstan", ".bat");
 }
@@ -66,14 +98,15 @@ const phpstanRunner = {
             return { status: "skipped", diagnostics: [], semantic: "none" };
         const absPath = path.resolve(cwd, ctx.filePath);
         const result = await safeSpawnAsync(cmd, ["analyse", "--error-format=json", "--no-progress", absPath], { timeout: 30000, cwd });
-        // phpstan exits 0 = no errors, 1 = errors found, 2 = fatal
-        if (result.status === 2 || result.error) {
-            return { status: "skipped", diagnostics: [], semantic: "none" };
-        }
-        if (result.status === 0) {
-            return { status: "succeeded", diagnostics: [], semantic: "none" };
-        }
-        const diagnostics = parsePhpstanJson(result.stdout ?? "", ctx.filePath, cwd);
+        // phpstan exits 0 = no errors, 1 = errors found, 2 = fatal. The fatal
+        // case used to return `skipped` silently; routing it through the shared
+        // seam keeps that verdict and adds the bounded `runner-empty-result` row
+        // (#1816), and the exit-1 case now also records when the JSON report
+        // parses to nothing (#1948) — the shape the error-count-as-array bug had.
+        const run = parseToolRun("phpstan", { result, exitCodes: PHPSTAN_EXIT_CODES }, (out) => parsePhpstanJson(out, ctx.filePath, cwd), { parseOutput: result.stdout ?? "" });
+        if (run.skipped)
+            return run.skipped;
+        const diagnostics = run.diagnostics;
         if (diagnostics.length === 0) {
             return { status: "succeeded", diagnostics: [], semantic: "none" };
         }