@herbertgao/pi-extensions 2026.9.0 → 2026.9.1

package/node_modules/pi-lens/dist/clients/path-utils.js

@@ -61,6 +61,26 @@ export function isFullyQualified(filePath) {
         ? isFullyQualifiedWin32(filePath)
         : isFullyQualifiedPosix(filePath);
 }
+/**
+ * Shape-based absolute check (mirrors `toProjectRelativePath`'s idiom): a
+ * Windows-shaped path (drive-letter/UNC) is parsed with `win32.isAbsolute`
+ * regardless of host OS, since the host-default `path.isAbsolute` returns
+ * FALSE for a Windows-shaped path on POSIX (#1150 class) and would let a
+ * cross-platform-persisted relative path slip past this guard on Linux CI.
+ * MUST run on the RAW `filePath`, before `normalizeMapKey`: on Windows,
+ * `normalizeMapKey`'s nonexistent-path fallback (`resolveNonExisting`) calls
+ * `win32.resolve`, which silently makes any relative path absolute against
+ * `process.cwd()` — checking the normalized value would defeat this guard
+ * entirely on Windows.
+ *
+ * Promoted from a private copy in `clients/review-graph/service.ts` (#2477)
+ * so `clients/dispatch/dispatcher.ts`'s baseline-key guard (#2489) can share
+ * the same sanctioned check instead of hand-rolling a second one.
+ */
+export function isAbsoluteFilePath(filePath) {
+    const p = isWindowsPath(filePath) ? win32 : path;
+    return p.isAbsolute(filePath);
+}
 /**
  * Split a path into its non-empty segments on EITHER separator (`\` or `/`),
  * regardless of the running OS — the shape-safe form of `p.split(path.sep)` /
@@ -346,7 +366,30 @@ export function findNearestContaining(startDir, candidates) {
  * directory in `names` order. Single source of truth for the "walk up
  * looking for one of these config filenames" loop that `opengrep-config.ts`,
  * `typos-config.ts`, `zizmor-config.ts`, and `sgconfig.ts` each hand-rolled
- * independently (refs #680).
+ * independently (refs #680), and that `php-cs-fixer-config.ts` now delegates
+ * to as well (refs #2472 review F2).
+ *
+ * UNCEILINGED by default (refs #2472 review round 3, F1) — `options.homeDir`
+ * is opt-in, not default-on. A prior version applied the SAME `$HOME`
+ * ceiling as `findNearestMarkerRoot` unconditionally, which broke every one
+ * of these tools' actual discovery contract: each of them treats a config
+ * living directly at `$HOME` (`~/typos.toml`, `~/sgconfig.yml`, …) as the
+ * user's legitimate GLOBAL config, and reads it itself regardless of pi-lens
+ * — the ceiling didn't stop pi-lens from seeing an unrelated ancestor
+ * config, it stopped pi-lens from seeing the SAME config the tool was about
+ * to read on its own, so pi-lens silently fell back to (or, for typos,
+ * injected and let its own shipped `_typos.toml` merge over) the user's
+ * config where the tool's own resolver would have honored it. `php-cs-fixer`
+ * makes the same mismatch concrete: its detection gates
+ * (`hasPhpCsFixerConfig` via `findNearestContaining`, `phpCsFixerFormatter
+ * .detect` via its own `findUp`) are both unceilinged, so a ceilinged
+ * carriage here disagreed with its own gate — "config exists" from the gate,
+ * "config not found" from the resolver — and dropped the very `--config`
+ * argv #2472 exists to carry. Pass `options.homeDir` only when a caller
+ * affirmatively wants the ceiling (a config found at or above THAT directory
+ * is never returned); omitting it walks all the way to the filesystem root,
+ * matching `findNearestContaining`'s unceilinged behavior and every
+ * underlying tool's own discovery.
  *
  * Distinct from `findNearestContaining`, which returns the containing
  * directory rather than the matched file path — use that one when the caller
@@ -356,8 +399,12 @@ export function findNearestContaining(startDir, candidates) {
  *   findLocalToolConfig(cwd, ["typos.toml", "_typos.toml", ".typos.toml"]);
  *   // → "/repo/typos.toml" if present, else undefined
  */
-export function findLocalToolConfig(startDir, names) {
+export function findLocalToolConfig(startDir, names, options = {}) {
+    const homeDir = options.homeDir !== undefined ? path.resolve(options.homeDir) : undefined;
     for (const dir of walkUpDirs(startDir || process.cwd())) {
+        if (homeDir !== undefined && isAtOrAboveHomeDir(dir, homeDir)) {
+            return undefined;
+        }
         for (const name of names) {
             const candidate = path.join(dir, name);
             if (existsSync(candidate))
@@ -415,17 +462,74 @@ export function findNearestMarkerRoot(startDir, markers, options = {}) {
  * `=== os.homedir()` check (which a marker found *above* `$HOME` slips past).
  * A normal project *under* home (e.g. `~/code/app`) is NOT at-or-above home,
  * so it still resolves fine. Refs #253.
+ *
+ * ONE expression, deliberately: `path.relative` alone answers "is home inside
+ * `dir`, or the same directory as `dir`", and it answers with the PLATFORM's
+ * path-equality semantics — case-folding on win32, case-sensitive on POSIX.
+ * The `resolvedDir === resolvedHome` shortcut that used to precede it was
+ * case-SENSITIVE on every platform, so `c:\Users\jane` (the lowercase-drive
+ * form VS Code URIs produce, and the form 46 records in a real `latency.log`
+ * carry) missed the equality test AND was then rejected by a `rel !== ""`
+ * clause — reporting "not at home" for the home directory itself and letting
+ * every ceilinged walker climb straight past HOME (#2544 review F1).
+ *
+ *   rel === ""                       ⇢ `dir` IS home
+ *   rel relative, no leading `..`    ⇢ home is INSIDE `dir` (an ancestor)
+ *   rel starts with `..`             ⇢ home is elsewhere — sibling, or the
+ *                                      prefix trap `C:\Users\jane2` → home
+ *                                      `C:\Users\jane` gives `..\jane`
+ *   rel absolute                     ⇢ different Windows drive
+ *
+ * Same shape as `isUnderDir` above; keep the two in step.
+ *
+ * `pathImpl` exists so the ubuntu Unit tests lane — the authoritative one —
+ * can exercise the WIN32 semantics this helper's whole bug was about. Every
+ * assertion that matters here (drive-letter folding, cross-drive `rel`) is
+ * win32-only, so with the ambient `path` hardcoded the ceiling was enforced
+ * only on a maintainer's dev box and CI's diff was structurally zero (#2544
+ * review F2). Production never passes it; `path.win32`/`path.posix` are pure,
+ * host-independent implementations, so `tests/clients/path-utils.test.ts` runs
+ * the same table under both on every lane. Lane-level fix tracked as #2536.
  */
-export function isAtOrAboveHomeDir(dir, homeDir = os.homedir()) {
-    const resolvedDir = path.resolve(dir);
-    const resolvedHome = path.resolve(homeDir);
-    if (resolvedDir === resolvedHome)
-        return true;
-    // `dir` is an ancestor of home ⇢ home lies inside dir ⇢ the relative path
-    // from dir to home has no leading `..` and is not absolute (cross-drive on
-    // Windows yields an absolute rel, correctly treated as "not above").
-    const rel = path.relative(resolvedDir, resolvedHome);
-    return rel !== "" && !rel.startsWith("..") && !path.isAbsolute(rel);
+export function isAtOrAboveHomeDir(dir, homeDir = os.homedir(), pathImpl = path) {
+    const rel = pathImpl.relative(pathImpl.resolve(dir), pathImpl.resolve(homeDir));
+    return !rel.startsWith("..") && !pathImpl.isAbsolute(rel);
+}
+/**
+ * Rewrite a `$HOME`-anchored path to its `~` form for a DIAGNOSTIC surface.
+ *
+ * `~/.pi-lens/config.json` says everything an operator needs about which file
+ * won, and `C:/Users/jane.doe/.pi-lens/config.json` says that plus the
+ * account name. The second is the shape a global config path always has, so any
+ * projection that names one leaks an identifier by default rather than by
+ * accident (#2440 review finding F5).
+ *
+ * Deliberately NOT built on `normalizeFilePath`/`isUnderDir`: those resolve
+ * through `realpathSync`, and a redaction helper on a diagnostic path must be
+ * pure, total, and unable to throw for a file that no longer exists. This is a
+ * string rewrite and nothing else.
+ *
+ * A path that is not under home is returned UNCHANGED — separators included.
+ * Normalizing unrelated paths on the way past would make the helper's blast
+ * radius every path any projection ever carries, for no redaction benefit.
+ */
+export function homeRelativePath(filePath, homeDir = os.homedir()) {
+    if (filePath.length === 0)
+        return filePath;
+    const candidate = toPosix(filePath);
+    const home = toPosix(homeDir).replace(/\/+$/, "");
+    if (home.length === 0)
+        return filePath;
+    // Windows paths are case-insensitive, so the COMPARISON folds case there
+    // while the returned tail keeps the caller's own casing.
+    const fold = (text) => process.platform === "win32" ? text.toLowerCase() : text;
+    const foldedHome = fold(home);
+    const foldedCandidate = fold(candidate);
+    if (foldedCandidate === foldedHome)
+        return "~";
+    if (!foldedCandidate.startsWith(`${foldedHome}/`))
+        return filePath;
+    return `~${candidate.slice(home.length)}`;
 }
 export function isUnderDir(child, parent) {
     const normChild = normalizeFilePath(child);
@@ -484,6 +588,317 @@ export function direntsHaveMarkerGlobMatch(entries, pattern) {
     return entries.some((entry) => (entry.isFile() || entry.isSymbolicLink()) &&
         nameMatchesMarkerGlob(entry.name, pattern));
 }
+/**
+ * Cargo `[workspace] members`/`exclude` entries.
+ *
+ * KNOWN LIMITATION (#1671 F6, documented rather than implemented, preserved
+ * byte-for-byte by #2591's fold): a recursive `**` component is NOT supported
+ * and a pattern containing one never matches — cargo workspaces that rely on
+ * `**` to pull in an arbitrarily-nested crate tree under-hoist (the crate stays
+ * independently rooted instead of joining the workspace). Folding cargo onto
+ * uv's `crosses-components` globstar would silently change Rust-LSP root
+ * selection, so the divergence is kept as a dialect value, not resolved.
+ *
+ * `characterClasses: false` is likewise a preserved divergence, not a
+ * considered choice: cargo's pre-fold segment compiler escaped `[` and `]`
+ * into literals, so `crates/[ab]` names a directory literally called `[ab]`.
+ * Real cargo (the `glob` crate) would read it as a class; changing that here
+ * would be the same unreviewed Rust-hoisting change.
+ */
+export const CARGO_WORKSPACE_MEMBER_DIALECT = {
+    name: "cargo",
+    globstar: "pattern-never-matches",
+    wildcardCrossesSeparator: false,
+    characterClasses: false,
+    normalizePattern: (pattern) => pattern.replace(/\/+$/, ""),
+};
+/**
+ * uv `[tool.uv.workspace] members`, pinned to
+ * `astral-sh/uv@3c979abda4530fe9bf3d92e9bcf5c5575e3b3126`,
+ * `crates/uv-workspace/src/workspace.rs` `is_included_in_workspace`: the glob is
+ * `normalize_path`d first (so a leading `./` and any interior `.` component are
+ * not part of the pattern) and matched with
+ * `MatchOptions { require_literal_separator: true, ..MatchOptions::new() }`.
+ */
+export const UV_WORKSPACE_MEMBERS_DIALECT = {
+    name: "uv-members",
+    globstar: "crosses-components",
+    wildcardCrossesSeparator: false,
+    characterClasses: true,
+    normalizePattern: (pattern) => path.posix.normalize(toPosix(pattern)),
+};
+/**
+ * uv `[tool.uv.workspace] exclude`, same upstream file and SHA
+ * (`WorkspaceExclusions::matches`): an exclusion is matched with
+ * `Pattern::matches_path`, i.e. `MatchOptions::new()` defaults, where
+ * `require_literal_separator` is FALSE — so a `*` in an exclusion DOES cross
+ * `/` (`exclude = ['packages/a*c']` excludes `packages/a/b/c`). Two different
+ * option sets inside one tool, which is why the dialect is an object and the
+ * two uv constants are not one.
+ *
+ * Before #2591 this was a documented limitation: minimatch cannot express a
+ * separator-crossing `*`, so pi-lens under-excluded. The dialect object can, so
+ * it is now implemented rather than documented.
+ */
+export const UV_WORKSPACE_EXCLUDE_DIALECT = {
+    name: "uv-exclude",
+    globstar: "crosses-components",
+    wildcardCrossesSeparator: true,
+    characterClasses: true,
+    normalizePattern: (pattern) => path.posix.normalize(toPosix(pattern)),
+};
+/**
+ * Index of the `]` closing the character class opened at `open`, or `-1` when
+ * the run is unterminated (in which case the `[` is a literal). A leading `!`
+ * or `^` negates, and a `]` in first position is a literal class member — the
+ * shape both minimatch and rust `glob` accept.
+ */
+function findCharacterClassEnd(segment, open) {
+    let i = open + 1;
+    if (segment[i] === "!" || segment[i] === "^")
+        i += 1;
+    if (segment[i] === "]")
+        i += 1;
+    for (; i < segment.length; i += 1)
+        if (segment[i] === "]")
+            return i;
+    return -1;
+}
+/**
+ * May a wildcard with this separator policy consume `ch`?
+ *
+ * A separator-confined wildcard (`[^/]` in the regex this replaced) takes
+ * anything but `/`. A separator-CROSSING one — uv `exclude`'s `*`/`?`, and
+ * every `**` in either uv dialect — spelled `.` in that regex, which is every
+ * code unit EXCEPT the four line terminators. That exclusion is preserved
+ * deliberately rather than "fixed": minimatch's globstar is `.`-based too, so
+ * a `\n` inside a directory name has never matched across a `**` in either
+ * implementation, and the differential oracle would flag a change here as a
+ * divergence rather than an improvement (#2603).
+ */
+function stepAcceptsChar(crossesSeparator, ch) {
+    return crossesSeparator
+        ? ch !== "\n" && ch !== "\r" && ch !== "\u2028" && ch !== "\u2029"
+        : ch !== "/";
+}
+/**
+ * Compile a normalized workspace-member pattern into a step list, or
+ * `undefined` when it cannot be compiled at all.
+ *
+ * A `**` component consumes zero or more path components — except as the LAST
+ * component, where it requires at least one (`a/**` matches `a/b`, not `a`),
+ * reproducing both minimatch's and rust `glob`'s answer. It is emitted as
+ * `split → one → star → literal "/"`, i.e. "nothing, or one-or-more characters
+ * followed by the `/` that ends them", after the separator that precedes it.
+ * That is the same language as the `(?:/.+)?/` group the previous compiler
+ * emitted — `X(?:/.+)?/Y` and `X/(?:.+/)?Y` both denote `X/Y` ∪ `X/.+/Y` — in a
+ * form with no nested quantifier.
+ */
+function compileWorkspaceMemberPattern(pattern, dialect) {
+    const isGlobstar = (component) => component === "**" && dialect.globstar === "crosses-components";
+    const components = pattern.split("/");
+    const steps = [];
+    let needSeparator = false;
+    for (let c = 0; c < components.length; c += 1) {
+        if (needSeparator)
+            steps.push({ kind: "literal", char: "/" });
+        needSeparator = false;
+        const component = components[c];
+        if (isGlobstar(component)) {
+            if (c === components.length - 1) {
+                // `.+` — a trailing `**` requires at least one character.
+                steps.push({ kind: "one", crossesSeparator: true });
+                steps.push({ kind: "star", crossesSeparator: true });
+                continue;
+            }
+            // `(?:.+/)?` — zero or more whole components. The group already ends
+            // at a `/`, so the next component must NOT emit one.
+            const split = { kind: "split", alternative: -1 };
+            steps.push(split);
+            steps.push({ kind: "one", crossesSeparator: true });
+            steps.push({ kind: "star", crossesSeparator: true });
+            steps.push({ kind: "literal", char: "/" });
+            split.alternative = steps.length;
+            continue;
+        }
+        for (let i = 0; i < component.length; i += 1) {
+            const ch = component[i];
+            if (ch === "*") {
+                steps.push({
+                    kind: "star",
+                    crossesSeparator: dialect.wildcardCrossesSeparator,
+                });
+                continue;
+            }
+            if (ch === "?") {
+                steps.push({
+                    kind: "one",
+                    crossesSeparator: dialect.wildcardCrossesSeparator,
+                });
+                continue;
+            }
+            if (ch === "[" && dialect.characterClasses) {
+                const close = findCharacterClassEnd(component, i);
+                if (close !== -1) {
+                    // `\` and a first-position `]` are literal class MEMBERS in glob;
+                    // left alone they would be a regex escape and an empty-class
+                    // terminator (`[]ab]` is `[]` + `ab]` in JS), so both are escaped.
+                    const body = component.slice(i + 1, close).replace(/[\\\]]/g, "\\$&");
+                    const source = body.startsWith("!")
+                        ? `[^${body.slice(1)}]`
+                        : `[${body}]`;
+                    let match;
+                    try {
+                        match = new RegExp(`^${source}$`);
+                    }
+                    catch {
+                        // A glob character class is not a JS character class: `[z-a]`
+                        // is a legal glob (matching nothing, since the range is empty)
+                        // and an illegal RegExp ("Range out of order"). Fail CLOSED —
+                        // an uncompilable pattern declares no member and excludes
+                        // nothing — which is also the answer the deleted minimatch call
+                        // gave (#2591 review round 2, F2).
+                        return undefined;
+                    }
+                    steps.push({ kind: "class", match });
+                    i = close;
+                    continue;
+                }
+            }
+            steps.push({ kind: "literal", char: ch });
+        }
+        needSeparator = true;
+    }
+    return steps;
+}
+/**
+ * Does the whole of `subject` match the whole of `steps`?
+ *
+ * A memoized (step index, path index) table, filled once, bottom-up:
+ * `table[s][p]` is "steps `s…` match `subject[p…]`". Every cell reads only
+ * cells with a larger step index or a larger path index, so one backward
+ * double loop fills the table with no recursion and no re-entry — the match is
+ * O(steps x characters) in time and space, with no path through it that can
+ * take exponential time (#2603).
+ *
+ * The compiled whole-path regex this replaced was correct but backtracking:
+ * every `**` emitted its own nullable `.+`, and N of them explored 2^N splits
+ * of a non-matching subject. #2591 collapsed CONSECUTIVE `**`s, which is a
+ * normalization that cannot fire across a separating component, so
+ * `("**\/*" x12)/zzz` against a 40-component path still took 124900 ms (#2603);
+ * the same shapes are microseconds here. There is nothing left to collapse for
+ * speed, so no collapse is done: `a/**\/**\/b` compiles to two adjacent
+ * `(?:.+/)?` groups, which denote the same language as one and cost the same
+ * table.
+ */
+function matchesWorkspaceMemberSteps(steps, subject) {
+    const stepCount = steps.length;
+    const width = subject.length + 1;
+    // One byte per (step, position) cell; `1` means "the rest matches from here".
+    const table = new Uint8Array((stepCount + 1) * width);
+    for (let p = subject.length; p >= 0; p -= 1) {
+        const atEnd = p === subject.length;
+        // The empty step list matches only the empty remainder.
+        table[stepCount * width + p] = atEnd ? 1 : 0;
+        for (let s = stepCount - 1; s >= 0; s -= 1) {
+            const step = steps[s];
+            const next = (s + 1) * width;
+            let matched = 0;
+            switch (step.kind) {
+                case "literal":
+                    matched =
+                        !atEnd && subject[p] === step.char ? table[next + p + 1] : 0;
+                    break;
+                case "one":
+                    matched =
+                        !atEnd && stepAcceptsChar(step.crossesSeparator, subject[p])
+                            ? table[next + p + 1]
+                            : 0;
+                    break;
+                case "class":
+                    matched =
+                        !atEnd && step.match.test(subject[p]) ? table[next + p + 1] : 0;
+                    break;
+                case "star":
+                    // Consume nothing, or one more character and stay on this step.
+                    matched =
+                        table[next + p] === 1 ||
+                            (!atEnd &&
+                                stepAcceptsChar(step.crossesSeparator, subject[p]) &&
+                                table[s * width + p + 1] === 1)
+                            ? 1
+                            : 0;
+                    break;
+                case "split":
+                    matched =
+                        table[step.alternative * width + p] === 1 || table[next + p] === 1
+                            ? 1
+                            : 0;
+                    break;
+            }
+            table[s * width + p] = matched;
+        }
+    }
+    return table[0] === 1;
+}
+/**
+ * Does `relativePath` — a `/`-separated path relative to the workspace root —
+ * match one declared workspace-member (or workspace-exclude) `pattern` under
+ * `dialect`?
+ *
+ * This is the ONE workspace-member matcher (#2591). `clients/lsp/server.ts`'s
+ * `cargoWorkspaceDeclaresMember` and `clients/python-environment.ts`'s
+ * `isUvWorkspaceMember` are thin callers of it; neither keeps a private segment
+ * compiler or minimatch options block any more.
+ *
+ * `clients/review-graph/workspace-modules.ts`'s `expandWorkspacePattern` is
+ * deliberately NOT a caller: npm/pnpm `workspaces` entries are EXPANDED against
+ * the filesystem (one `readdir` of the directory preceding the first `*`,
+ * yielding the directories that exist and hold a manifest) rather than tested
+ * against a candidate path. It answers "which directories does this pattern
+ * name", not "does this pattern name this directory"; folding it in would mean
+ * giving this pure function a filesystem.
+ *
+ * The supported syntax is the intersection of the two upstream dialects: `*`,
+ * `?`, `**`, `[abc]`/`[!abc]` (dialect-gated), and literals. minimatch-only
+ * extensions the pre-fold uv path inherited by accident — brace expansion,
+ * extglobs, leading-`!` negation, leading-`#` comments — are NOT honored, and
+ * uv's own `glob` crate does not honor them either (same pinned SHA), so
+ * dropping them moves uv toward upstream rather than away from it.
+ *
+ * Matching is NON-BACKTRACKING (#2603): the pattern compiles to a list of
+ * bounded steps and {@link matchesWorkspaceMemberSteps} decides it with one
+ * memoized (step, position) table, O(steps x characters), no matter how many
+ * `**`s the pattern carries. The anchored whole-path regex this replaced was
+ * correct but explored 2^N splits of a non-matching path for N `**`
+ * components — 124900 ms for `("**\/*" x12)/zzz` against a 40-component path,
+ * on a call `detectPythonEnvironment` awaits with no timeout, i.e. a wedged
+ * turn rather than a slow answer. The wall-clock half of that fix lives in
+ * `tests/clients/workspace-glob-nonbacktracking-budget.test.ts`; the answers
+ * are unchanged, pinned by the dialect table and the minimatch differential in
+ * `tests/clients/path-utils.test.ts`.
+ *
+ * A pattern that cannot be compiled at all answers `false` for every path —
+ * it declares no member and excludes nothing (#2591 review round 2, F2). The
+ * only such patterns today carry an empty character-class range (`[z-a]`:
+ * legal glob, illegal JS RegExp). Reachability note, recorded rather than
+ * assumed away: no such pattern can reach here through a manifest right now,
+ * because `parseTomlStringArray` (`clients/cargo-manifest.ts`) captures an
+ * array body non-greedily up to the FIRST `]`, so any entry containing a `]`
+ * loses its closing quote and is dropped before it becomes a pattern. That is
+ * a property of the TOML reader, not of this matcher, and it is not this
+ * function's to rely on — the character-class axis stays because upstream
+ * cargo and uv both support classes, and the reader's gap may be closed later.
+ */
+export function matchesWorkspaceMemberPattern(pattern, relativePath, dialect) {
+    const normalized = dialect.normalizePattern(pattern);
+    if (dialect.globstar === "pattern-never-matches" &&
+        normalized.includes("**")) {
+        return false;
+    }
+    const steps = compileWorkspaceMemberPattern(normalized, dialect);
+    return (steps !== undefined && matchesWorkspaceMemberSteps(steps, relativePath));
+}
 /**
  * Narrow no-break space, U+202F. macOS writes it before AM/PM in screenshot
  * file names; users type an ordinary space.
@@ -549,7 +964,7 @@ export function normalizeHostToolPath(input, options = {}) {
         (process.platform === "win32" && normalized.startsWith("~\\"))) {
         return path.join(os.homedir(), normalized.slice(2));
     }
-    if (/^file:\/\//.test(normalized)) {
+    if (normalized.startsWith("file://")) {
         try {
             return fileURLToPath(normalized);
         }

package/node_modules/pi-lens/dist/clients/persist-debounce.js

@@ -40,7 +40,14 @@ export function createDebounceScheduler(args) {
         write(key, payload);
     }
     function flushAll() {
-        for (const key of [...pending.keys()])
+        // Iterates `pending.keys()` live (a `Map` iterator reflects mutation
+        // during iteration): `flush` deletes the current key before calling
+        // `write`, which is safe, but the injected `write` callback must NOT
+        // synchronously call `schedule` again for a key not yet visited — that
+        // would insert into `pending` mid-iteration and the live iterator would
+        // pick it up, flushing a payload the caller expected to survive as
+        // "still pending" after this call returns.
+        for (const key of pending.keys())
             flush(key);
     }
     function schedule(key, payload) {

package/node_modules/pi-lens/dist/clients/php-cs-fixer-config.js

@@ -0,0 +1,114 @@
+/**
+ * php-cs-fixer ancestor config carriage (#2472).
+ *
+ * `php-cs-fixer`'s own `ConfigurationResolver` does NOT walk up parent
+ * directories looking for a config file — verified against
+ * `computeConfigFiles()` in `PHP-CS-Fixer/PHP-CS-Fixer` at tag `v3.64.0`
+ * (commit `58dd9c931c785a79739310aef5178928305ffa67`,
+ * `src/Console/ConfigurationResolver.php:548-588`). There is no `--path`
+ * OPTION on `fix` — `path` is a positional `InputArgument` (the file(s) to
+ * format; `--path-mode` only changes how an EXPLICIT `--config`'s own
+ * `finder()` intersects with it, per `FixCommand.php:206-207`), and the
+ * candidate directory is driven by that positional argument's dirname, not
+ * by `$this->cwd` — cwd is only a SECOND, ADDITIONAL probe appended when it
+ * differs from the path's directory:
+ *
+ *   $path = $this->getPath();
+ *
+ *   if ($this->isStdIn() || 0 === \count($path)) {
+ *       $configDir = $this->cwd;
+ *   } elseif (1 < \count($path)) {
+ *       throw new InvalidConfigurationException('For multiple paths config parameter is required.');
+ *   } elseif (!is_file($path[0])) {
+ *       $configDir = $path[0];
+ *   } else {
+ *       $dirName = pathinfo($path[0], PATHINFO_DIRNAME);
+ *       $configDir = is_dir($dirName) ? $dirName : $path[0];
+ *   }
+ *
+ *   $candidates = [
+ *       $configDir.\DIRECTORY_SEPARATOR.'.php-cs-fixer.php',
+ *       $configDir.\DIRECTORY_SEPARATOR.'.php-cs-fixer.dist.php',
+ *       $configDir.\DIRECTORY_SEPARATOR.'.php_cs', // old v2 config, present here only to throw nice error message later
+ *       $configDir.\DIRECTORY_SEPARATOR.'.php_cs.dist', // old v2 config, present here only to throw nice error message later
+ *   ];
+ *
+ *   if ($configDir !== $this->cwd) {
+ *       $candidates[] = $this->cwd.\DIRECTORY_SEPARATOR.'.php-cs-fixer.php';
+ *       $candidates[] = $this->cwd.\DIRECTORY_SEPARATOR.'.php-cs-fixer.dist.php';
+ *       $candidates[] = $this->cwd.\DIRECTORY_SEPARATOR.'.php_cs'; // old v2 config, present here only to throw nice error message later
+ *       $candidates[] = $this->cwd.\DIRECTORY_SEPARATOR.'.php_cs.dist'; // old v2 config, present here only to throw nice error message later
+ *   }
+ *
+ *   return $candidates;
+ *
+ * We always spawn `fix` with the FILE as a positional argument (not stdin,
+ * never a bare directory), so `$path[0]` is always that file and `$configDir`
+ * always resolves to `pathinfo($path[0], PATHINFO_DIRNAME)` — the file's OWN
+ * directory — REGARDLESS of the spawned process's cwd.
+ *
+ * #2472 review round 3, F3 correction: an EARLIER version of this comment
+ * concluded from the above that "spawning with `cwd = <ancestor config's
+ * directory>` would NOT work" and that `--config` is "the only carriage —
+ * there is no spawn-option workaround." That conclusion does not follow from
+ * the quoted code and is FALSE: the `$configDir !== $this->cwd` branch
+ * appends `$this->cwd`-rooted candidates whenever the file's own directory
+ * differs from the spawn's cwd — the common case, since we always spawn one
+ * file below the project root. Spawning with `cwd` set to the ancestor
+ * config's directory WOULD make `computeConfigFiles()` find it, via that
+ * second branch. `--config <path>` remains the better fix regardless: it
+ * names the exact winning file directly, with no reliance on this
+ * inequality quirk (and no need to compute a spawn `cwd` distinct from the
+ * file's own directory, which `formatFile` doesn't do) — it is the better
+ * carriage, not the only possible one.
+ *
+ * Unlike prettier/biome/eslint, an ancestor config found by `detect()`'s own
+ * climb (`hasPhpCsFixerConfig` in `clients/tool-policy.ts`,
+ * `phpCsFixerFormatter.detect` in `clients/formatters.ts`) is invisible to a
+ * bare `php-cs-fixer fix <file>` invocation whenever that ancestor directory
+ * is neither the file's own directory nor the spawn's cwd — php-cs-fixer
+ * silently falls back to its built-in default ruleset instead of the
+ * project's configured one.
+ *
+ * `computeConfigFiles()`'s own candidate order also settles same-directory
+ * precedence: `.php-cs-fixer.php` wins over `.php-cs-fixer.dist.php` when
+ * both sit in the SAME directory (first match in the array wins). This
+ * resolver mirrors that precedence; the two legacy v2 names are not one of
+ * pi-lens's detection targets (`hasPhpCsFixerConfig`/
+ * `phpCsFixerFormatter.detect` never look for them either) so they are not
+ * candidates here.
+ *
+ * Reuses the shared `findLocalToolConfig` walker (`clients/path-utils.ts`) —
+ * the same single source of truth `opengrep-config.ts`, `sgconfig.ts`,
+ * `typos-config.ts`, and `zizmor-config.ts` already delegate to for their own
+ * "walk up for one of these config filenames" search (refs #680, #2472
+ * review F2), rather than a private walker of its own. Called with NO
+ * `homeDir` — deliberately UNCEILINGED (#2472 review round 3, F1): this
+ * resolver's own gates (`hasPhpCsFixerConfig` in `clients/tool-policy.ts`,
+ * `phpCsFixerFormatter.detect` in `clients/formatters.ts`) are both
+ * unceilinged too (`findNearestContaining`/`findUp` walk to the filesystem
+ * root), so a ceilinged carriage here would disagree with its own gate — the
+ * gate says "config exists" while the carriage says "not found", silently
+ * dropping the `--config` argv this module exists to carry.
+ */
+import * as path from "node:path";
+import { findLocalToolConfig } from "./path-utils.js";
+/**
+ * In `computeConfigFiles()`'s own precedence order — `.php-cs-fixer.php`
+ * before `.php-cs-fixer.dist.php` — so a same-directory precedence check can
+ * just take the first existing name.
+ */
+export const PHP_CS_FIXER_CONFIG_NAMES = [
+    ".php-cs-fixer.php",
+    ".php-cs-fixer.dist.php",
+];
+/**
+ * Resolve the nearest ancestor php-cs-fixer config FILE for `filePath`
+ * (climbing from the file's own directory, never the file itself), or
+ * `undefined` when none is found up to the filesystem root — unceilinged,
+ * agreeing with this tool's own (unceilinged) detection gates.
+ */
+export function resolvePhpCsFixerConfig(filePath) {
+    const startDir = path.dirname(path.resolve(filePath));
+    return findLocalToolConfig(startDir, PHP_CS_FIXER_CONFIG_NAMES);
+}