@herbertgao/pi-extensions 2026.8.6 → 2026.8.8

package/node_modules/pi-lens/dist/clients/dispatch/runners/spellcheck.js

@@ -21,7 +21,11 @@
 import { safeSpawnAsync } from "../../safe-spawn.js";
 import { PRIORITY } from "../priorities.js";
 import { createAvailabilityChecker } from "./utils/runner-helpers.js";
+import { parseToolRun } from "./utils/tool-failure.js";
 const typos = createAvailabilityChecker("typos", ".exe");
+// typos-cli exit codes: 0 = no typos, 2 = typos found, 1 = an error that
+// stopped the scan. Anything nonzero outside {2} is a rejected invocation.
+const TYPOS_EXIT_CODES = { ran: [2] };
 /**
  * Parse typos-cli JSON output (JSON Lines format)
  *
@@ -90,14 +94,19 @@ const spellcheckRunner = {
         const result = await safeSpawnAsync(typos.getCommand(ctx.cwd || process.cwd()), args, {
             timeout: 15000,
         });
-        // typos-cli exits with code 2 if typos found, 0 if clean
-        const hasTypos = result.status === 2 || result.stdout?.trim();
-        if (!hasTypos) {
-            return { status: "succeeded", diagnostics: [], semantic: "none" };
-        }
-        // Parse diagnostics
-        const raw = result.stdout + result.stderr;
-        const diagnostics = parseTyposOutput(raw, ctx.filePath);
+        // #1816: typos-cli exits 0 clean, 2 with typos found, and 1 on an ERROR
+        // (unreadable config, bad argument). The `status === 2 || stdout` test
+        // below is false for exit 1 with an empty stdout, so a failed run was
+        // reported as a clean file. Only 0 and 2 are runs.
+        //
+        // #1948: parse through the shared seam so an exit-2 run whose JSON lines
+        // yield nothing leaves a record. `parseOutput` keeps the historical
+        // split: the gate judges "did it run" on stdout, the parser reads both
+        // streams.
+        const run = parseToolRun("spellcheck", { result, exitCodes: TYPOS_EXIT_CODES }, (out) => parseTyposOutput(out, ctx.filePath), { parseOutput: `${result.stdout ?? ""}${result.stderr ?? ""}` });
+        if (run.skipped)
+            return run.skipped;
+        const diagnostics = run.diagnostics;
         if (diagnostics.length === 0) {
             return { status: "succeeded", diagnostics: [], semantic: "none" };
         }

package/node_modules/pi-lens/dist/clients/dispatch/runners/sqlfluff.js

@@ -2,7 +2,17 @@ import { safeSpawnAsync } from "../../safe-spawn.js";
 import { getLinterPolicyForCwd, hasSqlfluffConfig } from "../../tool-policy.js";
 import { PRIORITY } from "../priorities.js";
 import { createAvailabilityChecker, resolveToolCommandWithInstallFallback, } from "./utils/runner-helpers.js";
+import { parseToolRun } from "./utils/tool-failure.js";
 const sqlfluff = createAvailabilityChecker("sqlfluff", ".exe");
+// sqlfluff exit codes (its CLI docs): 0 = clean, 1 = violations found, 2 = a
+// user error that stopped the lint (unknown dialect, unreadable config).
+// Only 2 is a rejected invocation.
+//
+// The exit TABLE is what protects this runner, not the nothing-to-parse rule:
+// sqlfluff writes its user errors to STDOUT, not stderr (live: an unknown
+// dialect prints the error there), so stdout is non-empty and the fallback
+// rule would read the failed run as a run that found nothing.
+const SQLFLUFF_EXIT_CODES = { ran: [1] };
 export { hasSqlfluffConfig };
 // sqlfluff's JSON lint output does not carry a per-violation fixable flag —
 // `sqlfluff fix` is a separate command and the lint surface doesn't tell us
@@ -117,7 +127,7 @@ const sqlfluffRunner = {
             ctx.log("sqlfluff: no config detected, using ANSI dialect defaults");
         }
         let cmd = null;
-        if (await (sqlfluff.isAvailableAsync(cwd))) {
+        if (await sqlfluff.isAvailableAsync(cwd)) {
             cmd = sqlfluff.getCommand(cwd);
         }
         else {
@@ -125,14 +135,32 @@ const sqlfluffRunner = {
         }
         if (!cmd)
             return { status: "skipped", diagnostics: [], semantic: "none" };
-        const args = ["lint", "--format", "json", ctx.filePath];
+        // #1937: this used to be `args.splice(2, 0, "--dialect", "ansi")` on
+        // `["lint", "--format", "json", file]`, which inserts BETWEEN the flag
+        // and its value and yields `lint --format --dialect ansi json file`.
+        // sqlfluff rejects `--dialect` as the value of `--format` and exits 2,
+        // so every SQL project WITHOUT a .sqlfluff — exactly the case this
+        // dialect default exists to serve — was never linted. Built in order
+        // rather than patched by index, and pinned by the argv-tie assertion
+        // in runners/captured-real-output.test.ts.
+        const args = ["lint", "--format", "json"];
         if (!hasConfig) {
-            args.splice(2, 0, "--dialect", "ansi");
+            args.push("--dialect", "ansi");
         }
+        args.push(ctx.filePath);
         const result = await safeSpawnAsync(cmd, args, {
             timeout: 20000,
+            cwd,
         });
-        const diagnostics = parseSqlfluffOutput(result.stdout ?? "", ctx.filePath);
+        // #1816: this runner read `result.status` zero times, so a user error
+        // fell through `parseSqlfluffOutput`'s JSON catch to zero violations and
+        // reported the SQL file as clean.
+        // #1948: sqlfluff exit 1 with a JSON report we read nothing out of is a
+        // parser break, not a clean file.
+        const run = parseToolRun("sqlfluff", { result, exitCodes: SQLFLUFF_EXIT_CODES }, (out) => parseSqlfluffOutput(out, ctx.filePath), { parseOutput: result.stdout ?? "" });
+        if (run.skipped)
+            return run.skipped;
+        const diagnostics = run.diagnostics;
         if (diagnostics.length === 0) {
             return { status: "succeeded", diagnostics: [], semantic: "none" };
         }

package/node_modules/pi-lens/dist/clients/dispatch/runners/stylelint.js

@@ -3,7 +3,43 @@ import { safeSpawnAsync } from "../../safe-spawn.js";
 import { getLinterPolicyForCwd, hasStylelintConfig, } from "../../tool-policy.js";
 import { PRIORITY } from "../priorities.js";
 import { createAvailabilityChecker, resolveToolCommandWithInstallFallback, } from "./utils/runner-helpers.js";
+import { parseToolRun } from "./utils/tool-failure.js";
 const stylelint = createAvailabilityChecker("stylelint", ".cmd");
+// stylelint exit codes (its "Exit codes" docs page): 0 = no problems, 1 = a
+// fatal error, 2 = lint problems found, 78 = a configuration error.
+//
+// 1 is listed as a run here rather than a rejection. The evidence for that is
+// NOT a live stylelint: it is this repo's own hand-written fixture
+// (tests/clients/dispatch/runners/stylelint-fixable.test.ts), which reports
+// findings under exit 1. Rather than rewrite a fixture whose provenance is
+// unknown, the table keeps 1 permissive. 78 is the rejection this table
+// exists to name.
+//
+// #1937 corrected the safety argument that used to sit here: it claimed a
+// fatal stylelint "writes nothing to stdout", which is true but useless,
+// because a stylelint that DID find problems writes nothing to stdout either.
+// `stylelintReport` below is what now separates the two.
+const STYLELINT_EXIT_CODES = { ran: [1, 2] };
+/**
+ * The JSON report out of a stylelint run, whichever stream carried it (#1937).
+ *
+ * stylelint 16+ writes the formatted report to STDERR whenever the run
+ * "errored" — which is every run that found an error-severity warning, i.e.
+ * every run with something to say. Reading stdout alone parsed nothing and
+ * called the stylesheet clean, the #1933 vale shape. Verified against
+ * stylelint 17.8.0 in tests/fixtures/runner-output/stylelint/.
+ *
+ * Only a stream that actually starts a JSON array counts. A crash's stack
+ * trace on stderr must stay "nothing to parse" so #1816's empty-result skip
+ * still fires instead of reporting a clean file.
+ */
+export function stylelintReport(stdout, stderr) {
+    for (const stream of [stdout, stderr]) {
+        if (stream?.trimStart().startsWith("["))
+            return stream;
+    }
+    return "";
+}
 // Stylelint's standard JSON output reports only aggregate fixableErrorCount /
 // fixableWarningCount per file — there is no per-warning fix flag in the CLI
 // surface. To route the actionable warnings here without a tool rewrite, we
@@ -91,7 +127,7 @@ const stylelintRunner = {
             ctx.log("stylelint: no config detected, running with default rules");
         }
         let cmd = null;
-        if (await (stylelint.isAvailableAsync(cwd))) {
+        if (await stylelint.isAvailableAsync(cwd)) {
             cmd = stylelint.getCommand(cwd);
         }
         else {
@@ -100,8 +136,16 @@ const stylelintRunner = {
         if (!cmd)
             return { status: "skipped", diagnostics: [], semantic: "none" };
         const result = await safeSpawnAsync(cmd, ["--formatter", "json", ctx.filePath], { timeout: 20000, cwd });
-        const raw = result.stdout ?? "";
-        const diagnostics = parseStylelintJson(raw, ctx.filePath);
+        // #1816: this runner read `result.status` zero times, so an exit-78
+        // config error (or an exit-1 crash) fell through parseStylelintJson's
+        // catch to zero diagnostics and reported a clean stylesheet.
+        const raw = stylelintReport(result.stdout, result.stderr);
+        // #1948: the stdout-vs-stderr report bug landed here as exit 2 plus a
+        // full JSON report and zero parsed warnings. That now leaves a record.
+        const run = parseToolRun("stylelint", { result, output: raw, exitCodes: STYLELINT_EXIT_CODES }, (out) => parseStylelintJson(out, ctx.filePath));
+        if (run.skipped)
+            return run.skipped;
+        const diagnostics = run.diagnostics;
         if (diagnostics.length === 0) {
             return { status: "succeeded", diagnostics: [], semantic: "none" };
         }

package/node_modules/pi-lens/dist/clients/dispatch/runners/swiftlint.js

@@ -2,6 +2,7 @@ import * as path from "node:path";
 import { safeSpawnAsync } from "../../safe-spawn.js";
 import { PRIORITY } from "../priorities.js";
 import { createAvailabilityChecker, resolveToolCommandWithInstallFallback, } from "./utils/runner-helpers.js";
+import { parseToolRun } from "./utils/tool-failure.js";
 const swiftlint = createAvailabilityChecker("swiftlint", ".exe");
 // SwiftLint rules whose rule class declares a `corrector` — i.e. rules that
 // `swiftlint --fix` rewrites deterministically. The JSON reporter does not
@@ -117,7 +118,7 @@ const swiftlintRunner = {
     async run(ctx) {
         const cwd = ctx.cwd || process.cwd();
         let cmd = null;
-        if (await (swiftlint.isAvailableAsync(cwd))) {
+        if (await swiftlint.isAvailableAsync(cwd)) {
             cmd = swiftlint.getCommand(cwd);
         }
         else {
@@ -126,9 +127,18 @@ const swiftlintRunner = {
         if (!cmd)
             return { status: "skipped", diagnostics: [], semantic: "none" };
         const result = await safeSpawnAsync(cmd, ["--reporter", "json", path.resolve(cwd, ctx.filePath)], { cwd, timeout: 15000 });
-        // SwiftLint exits non-zero on violations — stdout still has the JSON
-        const raw = result.stdout || "";
-        const diagnostics = parseSwiftLintOutput(raw, ctx.filePath);
+        // #1816: this runner read `result.status` zero times, so a SwiftLint
+        // that refused the invocation reported a clean Swift file. No exit-code
+        // table is declared: SwiftLint's nonzero codes are not documented
+        // stably enough to call any of them a rejection, so classification
+        // rests on the conservative rule — a nonzero exit with nothing to parse
+        // never ran.
+        // SwiftLint exits non-zero on violations — stdout still has the JSON, so
+        // a nonzero exit whose JSON yields nothing is a parser break (#1948).
+        const run = parseToolRun("swiftlint", { result }, (out) => parseSwiftLintOutput(out, ctx.filePath));
+        if (run.skipped)
+            return run.skipped;
+        const diagnostics = run.diagnostics;
         if (diagnostics.length === 0) {
             return { status: "succeeded", diagnostics: [], semantic: "none" };
         }

package/node_modules/pi-lens/dist/clients/dispatch/runners/taplo.js

@@ -1,30 +1,104 @@
 import * as path from "node:path";
+import { findLocalBinUpwards } from "../../package-manager.js";
 import { safeSpawnAsync } from "../../safe-spawn.js";
 import { getLinterPolicyForCwd } from "../../tool-policy.js";
 import { PRIORITY } from "../priorities.js";
 import { createAvailabilityChecker, lspPrimaryCoversFile, resolveToolCommandWithInstallFallback, } from "./utils/runner-helpers.js";
-import { spawnFailedWithNoOutput } from "./utils/spawn-outcome.js";
+import { parseToolRun } from "./utils/tool-failure.js";
 const taplo = createAvailabilityChecker("taplo", ".exe");
-function parseTaploOutput(raw, filePath) {
-    try {
-        const parsed = JSON.parse(raw);
-        const errors = parsed.errors ?? [];
-        return errors.map((err, idx) => ({
-            id: `taplo-${err.kind}-${err.range?.start.line ?? idx}`,
-            message: `[${err.kind}] ${err.message}`,
+// Verified against taplo 0.10.0: 0 = clean, 1 = the file is invalid (lint
+// findings, or a schema it could not load), 2 = clap rejected the invocation.
+//
+// #1937 round 2: the parser fix alone turned the old silent-clean into a false
+// BLOCKING diagnostic. clap prints `error: unexpected argument '--output'
+// found`, which starts with the same lowercase `error:` a real taplo
+// diagnostic does, so a mistyped flag would have reddened every valid TOML
+// file. Both readings are wrong; the exit code is what separates them.
+const TAPLO_EXIT_CODES = { ran: [1] };
+/** `error: <summary>` or `warning: <summary>` at the head of a codespan block. */
+const HEADER_PATTERN = /^\s*(error|warning):(.*)$/;
+/** The box-drawing lead taplo puts on a codespan location line. */
+const LOCATION_LEAD = "┌─";
+/** The `:line:column` tail of a codespan location line. */
+const LOCATION_PATTERN = /:(\d+):(\d+)$/;
+/**
+ * Parse `taplo lint` output (#1937).
+ *
+ * This parser used to `JSON.parse` a `{ errors: [{ range, message, kind }] }`
+ * envelope that taplo has never emitted, fed by a `--output=json` flag taplo
+ * has never accepted. Real taplo rejected the flag with exit 2 and a usage
+ * error, the JSON parse threw, the catch returned [], and malformed TOML was
+ * reported clean. Same shape as the vale parser in #1933.
+ *
+ * Real taplo 0.10.0 writes codespan diagnostics to STDERR, interleaved with
+ * uppercase tracing lines:
+ *
+ *     error: invalid TOML
+ *       ┌─ /path/to/bad.toml:2:9
+ *       │
+ *     2 │   [package
+ *
+ * Verified against tests/fixtures/runner-output/taplo/real.captured.json.
+ *
+ * A header alone is NOT enough to emit a diagnostic. The codespan location
+ * line must follow it. clap's own failures start with the same lowercase
+ * `error:` and carry no location, so without that requirement a rejected
+ * invocation becomes a blocking finding on line 1 of a perfectly valid file
+ * (#1937 round 2). The exit-code table in the runner is the primary guard;
+ * this is the structural one, and each covers a case the other does not.
+ */
+export function parseTaploOutput(raw, filePath) {
+    const diagnostics = [];
+    const lines = (raw ?? "").split(/\r?\n/);
+    for (let i = 0; i < lines.length; i++) {
+        // Lowercase `error:`/`warning:` starts a diagnostic. taplo's tracing
+        // lines are uppercase (`ERROR taplo:lint_files: ...`), so a
+        // case-sensitive match keeps them out.
+        //
+        // Both patterns below trim in code rather than with a trailing `\s*`,
+        // and the location one tests for its box-drawing lead separately
+        // instead of skipping to it with `.*`. Either shape backtracks
+        // super-linearly on a long line, and this parser reads bytes a third
+        // party wrote.
+        const header = HEADER_PATTERN.exec(lines[i].trimEnd());
+        if (!header)
+            continue;
+        const severityWord = header[1];
+        const summary = header[2].trim();
+        if (!summary)
+            continue;
+        // The location arrives on a following `┌─ file:line:col` line. Scan a
+        // short window rather than assuming adjacency: taplo puts a gutter line
+        // between them in some layouts.
+        let line = null;
+        let column = 1;
+        for (let j = i + 1; j < Math.min(i + 4, lines.length); j++) {
+            if (!lines[j].includes(LOCATION_LEAD))
+                continue;
+            const location = LOCATION_PATTERN.exec(lines[j].trimEnd());
+            if (!location)
+                continue;
+            line = Number.parseInt(location[1], 10) || 1;
+            column = Number.parseInt(location[2], 10) || 1;
+            break;
+        }
+        if (line === null)
+            continue;
+        const severity = severityWord === "warning" ? "warning" : "error";
+        diagnostics.push({
+            id: `taplo-${severity}-${line}-${column}`,
+            message: summary,
             filePath,
-            line: (err.range?.start.line ?? 0) + 1,
-            column: (err.range?.start.col ?? 0) + 1,
-            severity: "error",
-            semantic: "blocking",
+            line,
+            column,
+            severity,
+            semantic: severity === "error" ? "blocking" : "warning",
             tool: "taplo",
-            rule: err.kind,
+            rule: `taplo/${severity}`,
             fixable: false,
-        }));
-    }
-    catch {
-        return [];
+        });
     }
+    return diagnostics;
 }
 const taploRunner = {
     id: "taplo",
@@ -45,21 +119,46 @@ const taploRunner = {
         if (lspPrimaryCoversFile(ctx, "toml") && (await ctx.hasTool("taplo"))) {
             return { status: "skipped", diagnostics: [], semantic: "none" };
         }
-        let cmd = null;
-        if (await (taplo.isAvailableAsync(cwd))) {
-            cmd = taplo.getCommand(cwd);
-        }
-        else {
-            cmd = await resolveToolCommandWithInstallFallback(cwd, "taplo");
+        // Project binary first (#1731, discipline B): `taplo.isAvailableAsync`
+        // resolves through `findManagedNodeToolBinary`, pi-lens's own managed
+        // shim — checked BEFORE any project-local candidate, so a project's own
+        // `node_modules/.bin/taplo` (npm `@taplo/cli`) never won once the managed
+        // copy answered. `findLocalBinUpwards` defaults to `.cmd` on Windows,
+        // matching that npm shim; the availability checker's `.exe` extension is
+        // correct for pi-lens's OWN managed install (a GitHub-release binary,
+        // `clients/installer/index.ts` taplo entry), a different artifact with a
+        // different extension, so it stays as the checker's fallback only.
+        let cmd = findLocalBinUpwards("taplo", cwd) ?? null;
+        if (!cmd) {
+            if (await taplo.isAvailableAsync(cwd)) {
+                cmd = taplo.getCommand(cwd);
+            }
+            else {
+                cmd = await resolveToolCommandWithInstallFallback(cwd, "taplo");
+            }
         }
         if (!cmd)
             return { status: "skipped", diagnostics: [], semantic: "none" };
         const absPath = path.resolve(cwd, ctx.filePath);
-        const result = await safeSpawnAsync(cmd, ["check", "--output=json", absPath], { cwd, timeout: 15000 });
-        if (spawnFailedWithNoOutput(result)) {
-            return { status: "skipped", diagnostics: [], semantic: "none" };
-        }
-        const diagnostics = parseTaploOutput(result.stdout || "", ctx.filePath);
+        // #1937: `--output=json` is not a taplo flag. taplo rejected it with a
+        // usage error, so this runner never linted anything. `--colors never`
+        // keeps ANSI escapes out of the bytes the parser reads.
+        const result = await safeSpawnAsync(cmd, ["check", "--colors", "never", absPath], { cwd, timeout: 15000 });
+        // taplo reports on stderr and leaves stdout empty, so the
+        // "nothing to parse" test must read the same string the parser gets —
+        // otherwise every real run looks like a failed spawn.
+        const raw = result.stderr?.trim() ? result.stderr : (result.stdout ?? "");
+        //
+        // taplo exits 1 only when a file is INVALID, and it does not always draw
+        // a codespan block when it does: a schema it could not load is reported
+        // through its tracing output alone. Claiming that file clean would be an
+        // outright lie, so taplo opts into `skipWhenParsedNothing` (#1948). This
+        // replaces a hand-rolled per-runner copy of the same rule, which wrote
+        // its own `runner-empty-result` row with its own wording.
+        const run = parseToolRun("taplo", { result, output: raw, exitCodes: TAPLO_EXIT_CODES }, (out) => parseTaploOutput(out, ctx.filePath), { skipWhenParsedNothing: true });
+        if (run.skipped)
+            return run.skipped;
+        const diagnostics = run.diagnostics;
         if (diagnostics.length === 0) {
             return { status: "succeeded", diagnostics: [], semantic: "none" };
         }

package/node_modules/pi-lens/dist/clients/dispatch/runners/tflint.js

@@ -2,9 +2,9 @@ import * as path from "node:path";
 import { safeSpawnAsync } from "../../safe-spawn.js";
 import { getLinterPolicyForCwd } from "../../tool-policy.js";
 import { findNearestDirWithAnyBasename } from "../../workspace-topology.js";
-import { createAvailabilityChecker, resolveAvailableOrInstall, } from "./utils/runner-helpers.js";
-import { spawnFailedWithNoOutput } from "./utils/spawn-outcome.js";
 import { PRIORITY } from "../priorities.js";
+import { createAvailabilityChecker, resolveAvailableOrInstall, } from "./utils/runner-helpers.js";
+import { parseToolRun } from "./utils/tool-failure.js";
 const tflint = createAvailabilityChecker("tflint", ".exe");
 const TFLINT_CONFIG = ".tflint.hcl";
 /**
@@ -58,7 +58,7 @@ const tflintRunner = {
             return { status: "skipped", diagnostics: [], semantic: "none" };
         }
         let cmd = null;
-        if (await (tflint.isAvailableAsync(cwd))) {
+        if (await tflint.isAvailableAsync(cwd)) {
             cmd = tflint.getCommand(cwd);
         }
         else {
@@ -82,10 +82,15 @@ const tflintRunner = {
             cwd: fileDir,
             timeout: 30000,
         });
-        if (spawnFailedWithNoOutput(result)) {
-            return { status: "skipped", diagnostics: [], semantic: "none" };
-        }
-        const diagnostics = parseTflintOutput(result.stdout || "", ctx.filePath);
+        // #1948: tflint exits nonzero and writes its JSON report to stdout, so a
+        // nonzero exit whose report yields zero diagnostics is a parser break,
+        // not a clean file. No exit-code table: tflint's nonzero codes are not
+        // verified against a real binary here, so the conservative
+        // nothing-to-parse rule stays the only discriminator.
+        const run = parseToolRun("tflint", { result }, (out) => parseTflintOutput(out, ctx.filePath));
+        if (run.skipped)
+            return run.skipped;
+        const diagnostics = run.diagnostics;
         if (diagnostics.length === 0) {
             return { status: "succeeded", diagnostics: [], semantic: "none" };
         }

package/node_modules/pi-lens/dist/clients/dispatch/runners/trivy-config.js

@@ -10,6 +10,11 @@
  * v1 scope — the highest-value, lowest-overlap surface:
  *   - **Kubernetes manifests** (yaml with an `apiVersion:` + `kind:` signature):
  *     zero existing coverage in pi-lens, so no dedup needed.
+ *   - **CloudFormation templates** (yaml OR json with an
+ *     `AWSTemplateFormatVersion` key, or a `Resources` map whose entries carry
+ *     an `AWS::`/`Custom::`-namespaced `Type`; refs #1757): same zero-overlap
+ *     rationale as Kubernetes — trivy's `cloudformation` misconfig scanner is
+ *     the only IaC-misconfig coverage pi-lens has for CFN.
  *   - **Dockerfiles**: overlaps hadolint on a few rules (`:latest`, root, …);
  *     the dispatcher suppresses trivy-config findings that hadolint already
  *     reports at the same line (`suppressTrivyConfigDockerOverlap`), so trivy
@@ -17,12 +22,11 @@
  *
  *   - **Terraform**: the `.tf` language files themselves — trivy evaluates
  *     the Terraform language directly, so no content gate is needed (unlike
- *     the yaml/k8s heuristic above). Terragrunt (`.hcl`) is deliberately
- *     excluded: trivy has no terragrunt support, and terragrunt config is
- *     covered by the terragrunt runner instead.
+ *     the yaml/k8s/CloudFormation heuristics above). Terragrunt (`.hcl`) is
+ *     deliberately excluded: trivy has no terragrunt support, and terragrunt
+ *     config is covered by the terragrunt runner instead.
  *
- * Deferred (tracked on #131): Helm chart rendering, Docker Compose,
- * CloudFormation.
+ * Deferred (tracked on #131): Helm chart rendering, Docker Compose.
  *
  * Gating: the same explicit `trivy.enabled` opt-in as the session-scan modes —
  * trivy is opt-in, period. (Misconfig needs only the small policy bundle, not
@@ -31,13 +35,14 @@
  *
  * Refs: #131 (Mode 2)
  */
+import { formatToolFailure } from "./utils/tool-failure.js";
 import * as fs from "node:fs";
 import * as path from "node:path";
+import { incrementDegradationCount } from "../../degradation-ledger.js";
 import { safeSpawnAsync } from "../../safe-spawn.js";
 import { isTrivyEnabled, resolveSeverityFloor, } from "../../trivy-client.js";
 import { PRIORITY } from "../priorities.js";
 import { createAvailabilityChecker, resolveAvailableOrInstall, } from "./utils/runner-helpers.js";
-import { spawnFailedWithNoOutput } from "./utils/spawn-outcome.js";
 const trivy = createAvailabilityChecker("trivy", ".exe");
 /**
  * Heuristic: does this YAML look like a Kubernetes manifest (vs a CI workflow,
@@ -53,6 +58,23 @@ export function looksLikeKubernetesManifest(content) {
     }
     return false;
 }
+/**
+ * Heuristic: does this file (yaml OR json) look like a CloudFormation
+ * template? The unambiguous signal is the `AWSTemplateFormatVersion` key,
+ * present on the vast majority of real templates; SAM templates instead
+ * declare `Transform: AWS::Serverless-2016-10-31` (or an array containing
+ * it). Templates that skip both still always declare a `Resources` map whose
+ * entries carry a `Type` in the `AWS::`/`Custom::`/`Alexa::` namespaces — the
+ * one field CFN mandates on every resource. Any one signal qualifies (refs
+ * #1757).
+ */
+export function looksLikeCloudFormationTemplate(content) {
+    if (/AWSTemplateFormatVersion/.test(content))
+        return true;
+    if (/Transform:\s*(\[.*)?["']?AWS::Serverless/.test(content))
+        return true;
+    return /Type["']?\s*:\s*["']?(AWS|Custom|Alexa)::/.test(content);
+}
 function normalizeSeverity(raw) {
     const s = typeof raw === "string" ? raw.toUpperCase() : "";
     if (s === "CRITICAL" || s === "HIGH" || s === "MEDIUM" || s === "LOW") {
@@ -122,7 +144,7 @@ export function parseTrivyConfigOutput(raw, filePath) {
 }
 const trivyConfigRunner = {
     id: "trivy-config",
-    appliesTo: ["docker", "yaml", "terraform"],
+    appliesTo: ["docker", "yaml", "terraform", "json"],
     priority: PRIORITY.GENERAL_ANALYSIS,
     enabledByDefault: true,
     skipTestFiles: false,
@@ -133,8 +155,10 @@ const trivyConfigRunner = {
             return { status: "skipped", diagnostics: [], semantic: "none" };
         }
         const absPath = path.resolve(cwd, ctx.filePath);
-        // YAML is far broader than k8s; only scan files that look like manifests.
-        if (ctx.kind === "yaml") {
+        // YAML is far broader than k8s/CloudFormation; JSON is far broader than
+        // CloudFormation — only scan files that look like one of the IaC
+        // manifest shapes trivy's misconfig scanners understand (refs #1757).
+        if (ctx.kind === "yaml" || ctx.kind === "json") {
             let content = "";
             try {
                 content = fs.readFileSync(absPath, "utf-8");
@@ -142,7 +166,11 @@ const trivyConfigRunner = {
             catch {
                 return { status: "skipped", diagnostics: [], semantic: "none" };
             }
-            if (!looksLikeKubernetesManifest(content)) {
+            const isManifest = ctx.kind === "yaml"
+                ? looksLikeKubernetesManifest(content) ||
+                    looksLikeCloudFormationTemplate(content)
+                : looksLikeCloudFormationTemplate(content);
+            if (!isManifest) {
                 return { status: "skipped", diagnostics: [], semantic: "none" };
             }
         }
@@ -160,15 +188,48 @@ const trivyConfigRunner = {
         const severities = resolveSeverityFloor(cwd).join(",");
         const result = await safeSpawnAsync(cmd, [
             "config",
+            // `--quiet` alone suppresses both the progress bar and log output.
+            // `--no-progress` is NOT a `config` subcommand flag (unlike `fs`,
+            // which does accept it) — trivy 0.73.0 exits 1 on the rejected
+            // flag, but prints its full usage/help text (thousands of bytes)
+            // to STDOUT before the FATAL line on stderr. That stdout is
+            // non-empty, so an empty-output-only guard did not catch it: the
+            // help text failed to JSON-parse, `parseTrivyConfigOutput`
+            // returned `[]`, and this reported `{ status: "succeeded",
+            // diagnostics: [] }` — a clean scan — on every single real
+            // invocation (refs #1757; verified against the real installed
+            // binary, not assumed).
             "--quiet",
-            "--no-progress",
             "--format",
             "json",
             "--severity",
             severities,
             absPath,
         ], { cwd, timeout: 60_000 });
-        if (spawnFailedWithNoOutput(result)) {
+        // `trivy config` is not given `--exit-code`, so it exits 0 whenever it
+        // completed (findings included — see parseTrivyConfigOutput's severity
+        // mapping for how CRITICAL becomes blocking). ANY nonzero status is
+        // therefore a real error, WITH or WITHOUT something on stdout — mirrors
+        // the model already in clients/dispatch/runners/helm-render.ts's
+        // runIacPass, which has the same "trivy prints usage text on a bad
+        // flag" exposure and already got this right. A bounded ledger record
+        // means a broken trivy invocation can no longer go unnoticed for an
+        // entire lane's lifetime the way this one did (refs #1757).
+        if (result.error || result.status !== 0) {
+            // #1816: one shared wording, one truncation, signal named. `subject`
+            // stays the file path — the discriminating identity a reader needs
+            // is WHICH file trivy stopped covering.
+            incrementDegradationCount({
+                kind: "runner-empty-result",
+                subject: absPath,
+                reason: formatToolFailure({
+                    tool: "trivy config",
+                    status: result.status,
+                    signal: result.signal,
+                    stderr: result.stderr || result.error?.message,
+                    stdout: result.stdout,
+                }),
+            });
             return { status: "skipped", diagnostics: [], semantic: "none" };
         }
         const diagnostics = parseTrivyConfigOutput(result.stdout || "", ctx.filePath);