@herbertgao/pi-extensions 2026.9.1 → 2026.9.2

package/node_modules/pi-lens/dist/clients/file-utils.js

@@ -302,7 +302,7 @@ function matchesGitignorePattern(pattern, relativePath, isDirectory, matchExpand
         return candidates.some((value) => matchExpanded(value, expanded));
     });
 }
-export function readGitignorePatterns(rootDir, layer = "gitignore") {
+function readGitignorePatterns(rootDir, layer = "gitignore") {
     const gitignorePath = path.join(rootDir, ".gitignore");
     try {
         return parseGitignoreContent(fs.readFileSync(gitignorePath, "utf-8"), layer);
@@ -762,7 +762,11 @@ export function readGitignoreDirs(rootDir) {
         .map((entry) => entry.pattern);
 }
 function globToRegExp(glob) {
+    // Directory names use the same `*`-only dialect as read-guard exemptions.
+    // Collapse adjacent stars before compiling to avoid nullable-group
+    // backtracking on a non-matching name (#2622).
     const escaped = glob
+        .replace(/\*+/g, "*")
         .replace(/[.+^${}()|[\]\\]/g, "\\$&")
         .replace(/\*/g, ".*")
         .replace(/\?/g, ".");

package/node_modules/pi-lens/dist/clients/format-service.js

@@ -202,4 +202,3 @@ export function clearFormatServiceAndFileState() {
     resetFormatService();
 }
 // Re-export for convenience
-export { clearAllSessions } from "./file-time.js";

package/node_modules/pi-lens/dist/clients/formatters.js

@@ -11,10 +11,11 @@
 import { logExtension } from "./extension-log.js";
 import { AsyncLocalStorage } from "node:async_hooks";
 import * as fs from "node:fs/promises";
+import * as os from "node:os";
 import * as path from "node:path";
 import { BoundedLruCache } from "./bounded-cache.js";
 import { createGenerationSource } from "./generation-guard.js";
-import { normalizeMapKey } from "./path-utils.js";
+import { findNearestMarkerRoot, isRealGitMarker, normalizeMapKey, } from "./path-utils.js";
 import { resolveCargoPackageEdition } from "./cargo-manifest.js";
 import { resolveKtfmtGradleStyle } from "./gradle-ktfmt-style.js";
 import { resolvePhpCsFixerConfig } from "./php-cs-fixer-config.js";
@@ -602,6 +603,110 @@ async function indentationArgs(filePath, tool, cwd) {
         String(indentation.width),
     ];
 }
+const FORMATTER_MARKERS_BY_NAME = new Map([
+    ["biome", ["biome.json", "biome.jsonc", "package.json"]],
+    [
+        "prettier",
+        [
+            ".prettierrc",
+            ".prettierrc.json",
+            ".prettierrc.yaml",
+            ".prettierrc.yml",
+            ".prettierrc.js",
+            ".prettierrc.cjs",
+            ".prettierrc.mjs",
+            "prettier.config.js",
+            "prettier.config.cjs",
+            "prettier.config.mjs",
+            ".prettierignore",
+            "package.json",
+        ],
+    ],
+    [
+        "oxfmt",
+        ["oxfmt.toml", ".oxfmtrc.json", "vite-plus.json", "package.json"],
+    ],
+    ["ruff", ["pyproject.toml", "ruff.toml", ".ruff.toml"]],
+    ["black", ["pyproject.toml", "black.toml", ".black"]],
+    ["sqlfluff", [".sqlfluff", "pyproject.toml", "setup.cfg"]],
+    ["rustfmt", ["rustfmt.toml", ".rustfmt.toml", "Cargo.toml"]],
+    ["rubocop", [".rubocop.yml", ".rubocop.yaml"]],
+    ["standardrb", [".standard.yml", ".standard.yaml"]],
+    ["clang-format", [".clang-format", "_clang-format"]],
+    ["php-cs-fixer", [".php-cs-fixer.php", ".php-cs-fixer.dist.php"]],
+    ["stylua", ["stylua.toml", ".stylua.toml"]],
+    ["ocamlformat", [".ocamlformat"]],
+    ["google-java-format", [".google-java-format", ".editorconfig"]],
+    ["cljfmt", [".cljfmt.edn", "cljfmt.edn", ".cljfmt"]],
+    [
+        "cmake-format",
+        [
+            ".cmake-format",
+            ".cmake-format.yaml",
+            ".cmake-format.yml",
+            ".cmake-format.json",
+            ".cmake-format.py",
+            "cmake-format.yaml",
+            "cmake-format.yml",
+            ".editorconfig",
+        ],
+    ],
+    [
+        "psscriptanalyzer-format",
+        ["PSScriptAnalyzerSettings.psd1", "ScriptAnalyzerSettings.psd1"],
+    ],
+    [
+        "csharpier",
+        [
+            ".csharpierrc",
+            ".csharpierrc.json",
+            ".csharpierrc.yaml",
+            ".csharpierrc.yml",
+        ],
+    ],
+    ["ormolu", [".ormolu"]],
+    ["taplo", ["taplo.toml", ".taplo.toml"]],
+    ["terraform", [".terraform.lock.hcl"]],
+    ["swiftformat", [".swiftformat"]],
+    ["fantomas", [".fantomasignore", ".editorconfig"]],
+    ["mix", [".formatter.exs"]],
+    ["shfmt", [".editorconfig"]],
+    ["ktlint", [".editorconfig"]],
+    [
+        "ktfmt",
+        [
+            ".editorconfig",
+            ".ktfmt",
+            ".ktfmt.kts",
+            "build.gradle",
+            "build.gradle.kts",
+            "settings.gradle",
+            "settings.gradle.kts",
+        ],
+    ],
+]);
+/**
+ * Resolve the cwd for the formatter child, capped at the user's home
+ * directory. Files outside a project retain the historical file-directory
+ * cwd. The optional homeDir is only for the ceiling regression test.
+ */
+export function resolveFormatterCwd(absolutePath, formatterName, homeDir = os.homedir()) {
+    const fileDir = path.dirname(path.resolve(absolutePath));
+    const effectiveHome = homeDir || undefined;
+    const markers = formatterName
+        ? [...(FORMATTER_MARKERS_BY_NAME.get(formatterName) ?? []), ".gitignore"]
+        : [".gitignore"];
+    const root = findNearestMarkerRoot(fileDir, markers, {
+        homeDir: effectiveHome,
+    });
+    if (root)
+        return root;
+    const gitRoot = findNearestMarkerRoot(fileDir, [".git"], {
+        homeDir: effectiveHome,
+        markerPredicate: isRealGitMarker,
+    });
+    return gitRoot ?? fileDir;
+}
 /**
  * Every biome invocation must carry this. Biome exits 1 with "No files were
  * processed in the specified paths" when the path is ignored by the repo's own
@@ -1438,7 +1543,7 @@ const detectionCache = new BoundedLruCache(32);
 // The signature is immutable for a cache generation. This memo is separate
 // from detectionCache because a cwd can have several extension entries, and a
 // warm lookup must not repeat the ancestor walk or stat matched configs.
-const formatterSignatureFlights = new Map();
+const formatterSignatureFlights = new BoundedLruCache(32);
 const formatterCacheGeneration = createGenerationSource("formatter-cache");
 // These are the formatter configuration files consulted by the policy helpers
 // above. Their metadata is captured by the cold detection signature. The
@@ -1810,6 +1915,7 @@ export function _getFormatterResetStateForTests() {
         whichTransientCommands,
         cooldownRecordedForRetryAtMs,
         detectionCache,
+        formatterSignatureFlights,
     };
 }
 export function clearFormatterRuntimeState() {
@@ -1887,6 +1993,7 @@ export async function formatFile(filePath, formatter) {
     try {
         const absolutePath = path.resolve(filePath);
         const cwd = path.dirname(absolutePath);
+        const formatterCwd = resolveFormatterCwd(absolutePath, formatter.name);
         const contentBefore = await fs.readFile(absolutePath, "utf-8");
         // Resolve command: prefer local (venv/vendor/node_modules) over global.
         // The shared seam must honor SKIP_FORMATTING before selecting the static
@@ -1912,7 +2019,7 @@ export async function formatFile(filePath, formatter) {
         // Run formatter without blocking the event loop.
         const result = await safeSpawnAsync(cmd[0], cmd.slice(1), {
             timeout: 15000,
-            cwd,
+            cwd: formatterCwd,
         });
         // A resolver that could NOT prove absence (it never probed PATH — e.g.
         // black/sqlfluff, which only look in a venv) legitimately falls back to the

package/node_modules/pi-lens/dist/clients/generated-artifacts.js

@@ -205,7 +205,7 @@ function hasGeneratedArtifactContent(content) {
  * file is not machine-emitted evidence), and an empty or whitespace-only
  * file yields a zero mean and stays source.
  */
-export const MACHINE_EMITTED_LINE_SHAPE_MIN_CONTENT = 2048;
+const MACHINE_EMITTED_LINE_SHAPE_MIN_CONTENT = 2048;
 export const MACHINE_EMITTED_LINE_SHAPE_MEAN_THRESHOLD = 2500;
 export function classifyMachineEmittedLineShape(content) {
     const contentLength = content.length;
@@ -325,8 +325,7 @@ function analyzeFileHeader(filePath, maxBytes) {
  * function and short-circuit on a hit, so by the time this function runs for
  * those callers evidence (a) has already come back negative. Non-walk
  * callers with no upstream sibling probe (`file-role.ts`'s content-based
- * check, `project-scan-policy.ts`'s single-path `shouldSkipProjectPath`)
- * evaluate evidence (b) only — a documented, narrower guarantee than the
+ * check) evaluate evidence (b) only — a documented, narrower guarantee than the
  * walk path's.
  *
  * Tradeoff (documented per the issue): when NEITHER piece of evidence
@@ -387,7 +386,7 @@ export function classifyGeneratedOrArtifactDetailed(filePath, options = {}) {
         : { verdict: "clean" };
 }
 /** Verdict-only convenience wrapper over {@link classifyGeneratedOrArtifactDetailed}. */
-export function classifyGeneratedOrArtifact(filePath, options = {}) {
+function classifyGeneratedOrArtifact(filePath, options = {}) {
     return classifyGeneratedOrArtifactDetailed(filePath, options).verdict;
 }
 export function isGeneratedOrArtifact(filePath, options = {}) {

package/node_modules/pi-lens/dist/clients/git-guard.js

@@ -141,6 +141,11 @@ function canonicalizeGuardCommand(command) {
     let pendingSpace = false;
     quote = undefined;
     for (const ch of result) {
+        if (!quote && ch === "\n") {
+            collapsed += ch;
+            pendingSpace = false;
+            continue;
+        }
         if (!quote && /\s/.test(ch)) {
             pendingSpace = collapsed.length > 0;
             continue;

package/node_modules/pi-lens/dist/clients/grammar-source.js

@@ -18,7 +18,7 @@ import { getPackageRoot } from "./package-root.js";
 /** tree-sitter-wasms release the grammars are pulled from. */
 export const TREE_SITTER_WASMS_VERSION = "0.1.13";
 /** unpkg mirror of the tree-sitter-wasms artifacts. */
-export const GRAMMAR_CDN_BASE = `https://unpkg.com/tree-sitter-wasms@${TREE_SITTER_WASMS_VERSION}/out`;
+const GRAMMAR_CDN_BASE = `https://unpkg.com/tree-sitter-wasms@${TREE_SITTER_WASMS_VERSION}/out`;
 export const GRAMMAR_SOURCE_OVERRIDES = {
     "tree-sitter-lua.wasm": {
         package: "@tree-sitter-grammars/tree-sitter-lua",
@@ -145,7 +145,7 @@ export const BLOCKED_GRAMMARS = {
     },
 };
 /** Runtime signals for the currently-running process. */
-export function currentGrammarRuntime() {
+function currentGrammarRuntime() {
     const m = /^v?(\d+)/.exec(process.versions?.node ?? "");
     return {
         nodeMajor: m ? Number(m[1]) : 0,
@@ -173,7 +173,7 @@ export function grammarBlockReason(filename, rt = currentGrammarRuntime()) {
  * both the download path (validate before writing) and the on-disk path
  * (`fileHasWasmMagic`, for a file poisoned before this shipped) key off it.
  */
-export const WASM_MAGIC = [0x00, 0x61, 0x73, 0x6d];
+const WASM_MAGIC = [0x00, 0x61, 0x73, 0x6d];
 /** Do `bytes` start with the wasm magic number? */
 export function hasWasmMagic(bytes) {
     if (bytes.length < WASM_MAGIC.length)

package/node_modules/pi-lens/dist/clients/installer/index.js

@@ -548,10 +548,27 @@ export const TOOLS = [
         binaryName: "docker-langserver",
     },
     {
+        // #2722: intelephense has no CLI — its entry calls createConnection()
+        // unconditionally — and Node prints the offending source line before the
+        // error. The bundle is one ~4 MB minified line, so the transport-required
+        // marker #208 rescues on lands at byte 4,154,741 of a 4,423,356-byte
+        // stderr while Node truncates piped stderr at 1 MiB on exit. Measured on
+        // intelephense@1.18.5, linux, Node v22.22.1:
+        //   $ intelephense --version 2>&1 | wc -c              -> 1048576
+        //   $ intelephense --version 2>&1 | grep -c "Connection input stream is not set" -> 0
+        //   $ intelephense --version 2>err.txt; wc -c < err.txt -> 4423356
+        // Same run over the alternatives, each with stdin closed the way
+        // verifyToolBinary closes it (`input: ""`):
+        //   --help, -v, --socket=0 -> identical dump (exit 1, 4423356 bytes,
+        //     marker at 4154741, 1048576 through a pipe, marker absent)
+        //   --stdio                -> exit 1 with ZERO bytes on either stream,
+        //     so it carries no marker to rescue on either.
+        // No checkArgs value produces a verdict. Verified spawn-free instead.
         id: "intelephense",
         name: "Intelephense",
         checkCommand: "intelephense",
         checkArgs: ["--version"],
+        verification: "package-entry",
         installStrategy: "npm",
         packageName: "intelephense",
         binaryName: "intelephense",
@@ -1851,6 +1868,111 @@ function extractVersionToken(output) {
  * maven/archive) never populate or read this map.
  */
 const lastManagedInstallVersion = new Map();
+/**
+ * The package whose entry module verifies `tool`'s managed install spawn-free,
+ * or undefined when the tool is verified by spawning `checkArgs` (#2722).
+ * Registry-declared per tool — never inferred from the strategy: a spawn probe
+ * is the stronger check everywhere it can actually return a verdict.
+ */
+export function packageEntryVerification(tool) {
+    return tool.verification === "package-entry" ? tool.packageName : undefined;
+}
+/**
+ * Spawn-free verification of a managed npm install (#2722).
+ *
+ * For an stdio LSP server with no CLI surface, every `checkArgs` value is a
+ * throw, and #208's transport-required rescue is output-ORDER dependent: Node
+ * prints the offending source line ahead of the error, so a server whose bundle
+ * is megabytes of minified JS pushes the marker past both our retained window
+ * and Node's own 1 MiB pipe truncation. The bytes never leave the child, so no
+ * spawn can answer "is this install intact".
+ *
+ * The evidence used instead is the same class the `archive` strategy already
+ * accepts through `treeMarker`: the installed tree is inspected on disk. The
+ * install verifies when the package directory beside the `.bin` shim carries a
+ * readable `package.json` with a `version`, and the entry module that
+ * package.json itself names — `bin[<shim name>]` or a bare `bin` string —
+ * exists as a non-empty file. `main` is deliberately NOT a fallback: npm
+ * creates the `node_modules/.bin/<shim>` this function is given only from a
+ * `bin` field, so a manifest without one cannot be the manifest behind this
+ * shim. That is exactly what `verifyToolBinary` was documented to catch here —
+ * broken symlinks and partial installs — and it is strictly more than the
+ * `--version` spawn can report for this class.
+ */
+export async function verifyNpmPackageEntry(binPath, packageName) {
+    // `<...>/node_modules/.bin/<shim>` → `<...>/node_modules`.
+    const nodeModulesDir = path.dirname(path.dirname(binPath));
+    const pinned = parsePinnedVersion(packageName);
+    const bareName = pinned
+        ? packageName.slice(0, -(pinned.length + 1))
+        : packageName;
+    const packageDir = path.join(nodeModulesDir, ...bareName.split("/"));
+    const shimName = path
+        .basename(binPath)
+        .replace(/\.(cmd|exe|ps1|bat)$/i, "")
+        .toLowerCase();
+    const fail = (reason) => {
+        logSessionStart(`auto-install verify: failed for ${binPath} (check=package-entry, kind=${reason})`);
+        return false;
+    };
+    // R2-F1: the shim ITSELF, before anything else. Every path below is DERIVED
+    // from `binPath`, so without this a partial install — npm never wrote the
+    // `.bin` entry, or wrote one that is empty, a directory, or a symlink
+    // dangling at a deleted target — verified `true` on the strength of a
+    // package tree that nothing can execute, and `installNpmTool` then recorded
+    // the install as SUCCEEDED. `classifyInstallOutcome` grades any non-"failed"
+    // outcome as `⚠ unavailable (succeeded)`, so that answer re-hid exactly the
+    // nightly row #2722 exists to expose. `statSync` FOLLOWS the link, which is
+    // what makes missing and dangling one branch.
+    try {
+        const shim = statSync(binPath);
+        if (!shim.isFile() || shim.size === 0)
+            return fail("shim-not-a-file");
+    }
+    catch {
+        return fail("shim-missing");
+    }
+    let manifest;
+    try {
+        manifest = JSON.parse(await fs.readFile(path.join(packageDir, "package.json"), "utf8"));
+    }
+    catch {
+        return fail("package-json-unreadable");
+    }
+    if (typeof manifest.version !== "string" || !manifest.version) {
+        return fail("package-json-no-version");
+    }
+    const bin = manifest.bin;
+    const entry = typeof bin === "string"
+        ? bin
+        : bin && typeof bin === "object"
+            ? Object.entries(bin).find(
+            // Case-folded on purpose: on a case-insensitive filesystem the
+            // shim on disk can differ in case from the manifest key npm
+            // wrote it from, and `path.basename` reads the disk name.
+            ([name]) => name.toLowerCase() === shimName)?.[1]
+            : undefined;
+    if (typeof entry !== "string" || !entry) {
+        return fail("package-json-no-entry");
+    }
+    try {
+        const stat = statSync(path.join(packageDir, entry));
+        if (!stat.isFile() || stat.size === 0)
+            return fail("entry-not-a-file");
+    }
+    catch {
+        return fail("entry-missing");
+    }
+    // R2-F3 (catalog shape 31): "did the new verifier run at all, and on what"
+    // has to be answerable from sessionstart.log, not only from a debug build —
+    // the failure branches above already log there. Measured volume on a real
+    // intelephense install, scratch PI_LENS_HOME: TWO rows on the session that
+    // installs (installNpmTool's verify, then the post-install resolution), and
+    // ZERO on every later session — the probe cache answers before any verify
+    // runs (`auto-install ensure intelephense: probe cache hit`).
+    logSessionStart(`auto-install verify: succeeded for ${binPath} (check=package-entry, version=${manifest.version}, entry=${entry})`);
+    return true;
+}
 /**
  * Verify a tool binary actually works by running its configured checkArgs.
  * This catches broken symlinks, partial installs, and corrupted binaries.
@@ -1878,7 +2000,26 @@ onTransient,
  * sensitive caller on the dispatch hot path passes a shorter one and treats
  * the expiry as transient rather than as a verdict (#1657).
  */
-timeoutMs = 10000, verificationArgs = ["--version"]) {
+timeoutMs = 10000, verificationArgs = ["--version"], 
+/**
+ * Package name from {@link packageEntryVerification} — present only for a
+ * registry entry declaring `verification: "package-entry"`. When present the
+ * spawn is skipped entirely and {@link verifyNpmPackageEntry} answers (#2722).
+ */
+packageEntryOf, 
+/**
+ * Called when a `false` verdict is INCONCLUSIVE rather than a verdict: the
+ * transport-required matcher was armed, never matched, and the child's
+ * output was cut off before the tail arrived, so the #208 rescue could not
+ * be evaluated at all (#2722). Distinct from `onTransient` on purpose — the
+ * prober DID run to completion and re-probing reproduces it exactly, so this
+ * is a durable "cannot be verified", not a stall (catalog shape 13). A
+ * caller must not treat it as "broken" and delete the installation.
+ */
+onInconclusive) {
+    if (packageEntryOf !== undefined) {
+        return verifyNpmPackageEntry(binPath, packageEntryOf);
+    }
     // #2015: safeSpawnAsync instead of raw spawn. Raw spawn's timeout
     // SIGTERMed only cmd.exe on Windows (.cmd shims run shell:true), orphaning
     // the grandchild node process - which kept scanning, held handles against
@@ -1937,6 +2078,31 @@ timeoutMs = 10000, verificationArgs = ["--version"]) {
         // verdict from the binary (#1569 transient semantics).
         if (result.signal !== undefined || result.spawnFailure)
             onTransient?.();
+        if (result.outputTruncated &&
+            result.signal === undefined &&
+            !result.spawnFailure) {
+            // #2722: the transport-required matcher above is armed on EVERY probe,
+            // and it never matched — but the output we kept is a prefix, so the
+            // marker may simply sit past it (intelephense emits ~4 MB of bundle
+            // ahead of its own diagnostic). "Unmatched within a truncated prefix"
+            // is not "this binary is broken"; callers must not delete the install
+            // on it. Recorded as its own kind so a monitor can tell an unreadable
+            // probe apart from a rejected binary.
+            //
+            // R2-F4: gated on the probe having actually FINISHED. A verbose child
+            // that is SIGTERMed at the timeout also arrives here truncated, and
+            // that is the #1569 transient class one line above, not this one —
+            // ungated, the two overlapped and `installNpmTool` (which tests
+            // inconclusive first) replaced the #2015 transient message with this
+            // one. The doc comment's "the prober DID run to completion" is now
+            // true rather than aspirational.
+            onInconclusive?.();
+            recordDegradationOnce({
+                kind: "installer-verification-inconclusive",
+                subject: binPath,
+                reason: `transport-required marker unresolved in truncated output (${verificationArgs.join(" ")})`,
+            });
+        }
         const kind = result.spawnFailure?.kind ??
             (result.signal
                 ? `killed-signal=${result.signal}`
@@ -2056,7 +2222,7 @@ export async function getAllToolStatuses() {
         const localPath = installerPlatform() === "win32" ? `${localBase}.cmd` : localBase;
         try {
             await fs.access(localPath);
-            if (await verifyToolBinary(localPath, undefined, undefined, getToolVerificationTimeout(tool), tool.checkArgs)) {
+            if (await verifyToolBinary(localPath, undefined, undefined, getToolVerificationTimeout(tool), tool.checkArgs, packageEntryVerification(tool))) {
                 status.installed = true;
                 status.source = "pi-lens-auto";
                 status.path = localPath;
@@ -2225,7 +2391,7 @@ async function getToolPathResolved(toolId, onTransient) {
         const cmdPath = `${localBase}.cmd`;
         try {
             await fs.access(cmdPath);
-            if (await verifyToolBinary(cmdPath, recordVersion, onTransient, getToolVerificationTimeout(tool), tool.checkArgs)) {
+            if (await verifyToolBinary(cmdPath, recordVersion, onTransient, getToolVerificationTimeout(tool), tool.checkArgs, packageEntryVerification(tool))) {
                 return cmdPath;
             }
             logSessionStart(`auto-install verify: ${cmdPath} exists but is broken, will reinstall`);
@@ -2238,7 +2404,7 @@ async function getToolPathResolved(toolId, onTransient) {
         const exePath = `${localBase}.exe`;
         try {
             await fs.access(exePath);
-            if (await verifyToolBinary(exePath, recordVersion, onTransient, getToolVerificationTimeout(tool), tool.checkArgs)) {
+            if (await verifyToolBinary(exePath, recordVersion, onTransient, getToolVerificationTimeout(tool), tool.checkArgs, packageEntryVerification(tool))) {
                 return exePath;
             }
             logSessionStart(`auto-install verify: ${exePath} exists but is broken, will reinstall`);
@@ -2250,7 +2416,7 @@ async function getToolPathResolved(toolId, onTransient) {
     if (installerPlatform() !== "win32") {
         try {
             await fs.access(localBase);
-            if (await verifyToolBinary(localBase, recordVersion, onTransient, getToolVerificationTimeout(tool), tool.checkArgs)) {
+            if (await verifyToolBinary(localBase, recordVersion, onTransient, getToolVerificationTimeout(tool), tool.checkArgs, packageEntryVerification(tool))) {
                 return localBase;
             }
             logSessionStart(`auto-install verify: ${localBase} exists but is broken, will reinstall`);
@@ -2873,6 +3039,7 @@ export function npmToolNeedsPostinstall(packageName) {
  * that wanders off it.
  */
 export function getRefreshableManagedNpmTools() {
+    const seenPackages = new Set();
     return getRefreshableManagedTools()
         .filter((candidate) => candidate.strategy === "npm")
         .map((candidate) => ({
@@ -2881,7 +3048,13 @@ export function getRefreshableManagedNpmTools() {
         // have both, so these are total.
         packageName: candidate.packageName,
         binaryName: candidate.binaryName,
-    }));
+    }))
+        .filter((candidate) => {
+        if (seenPackages.has(candidate.packageName))
+            return false;
+        seenPackages.add(candidate.packageName);
+        return true;
+    });
 }
 /** The Maven GAV a `maven` entry pins, as a stable identity string. */
 function mavenCoordinate(spec) {
@@ -2928,6 +3101,7 @@ export function getRefreshableManagedTools() {
                     packageName: tool.packageName,
                     binaryName: tool.binaryName,
                     verificationTimeoutMs: tool.verificationTimeoutMs,
+                    packageEntryOf: packageEntryVerification(tool),
                 });
                 break;
             }
@@ -3757,7 +3931,9 @@ function recordPackageManagerInstallException(toolId, strategyLabel, packageName
     installFailureReasons.set(toolId, message);
     return undefined;
 }
-async function installNpmTool(toolId, packageName, binaryName, verificationArgs = ["--version"], verificationTimeoutMs = 10_000) {
+async function installNpmTool(toolId, packageName, binaryName, verificationArgs = ["--version"], verificationTimeoutMs = 10_000, 
+/** See {@link packageEntryVerification} — spawn-free verification (#2722). */
+packageEntryOf) {
     try {
         // Ensure tools directory exists
         await fs.mkdir(TOOLS_DIR, { recursive: true });
@@ -3837,11 +4013,15 @@ async function installNpmTool(toolId, packageName, binaryName, verificationArgs
         debugLog(`Verifying ${binaryName}...`);
         let isValid = false;
         let lastAttemptTransient = false;
+        let lastAttemptInconclusive = false;
         for (let attempt = 1; attempt <= 3; attempt++) {
             lastAttemptTransient = false;
+            lastAttemptInconclusive = false;
             isValid = await verifyToolBinary(binPath, undefined, () => {
                 lastAttemptTransient = true;
-            }, verificationTimeoutMs, verificationArgs);
+            }, verificationTimeoutMs, verificationArgs, packageEntryOf, () => {
+                lastAttemptInconclusive = true;
+            });
             if (isValid)
                 break;
             if (attempt < 3) {
@@ -3849,6 +4029,37 @@ async function installNpmTool(toolId, packageName, binaryName, verificationArgs
                 await new Promise((r) => setTimeout(r, 1000 * attempt));
             }
         }
+        if (!isValid && lastAttemptInconclusive) {
+            // #2722: the probe ran to completion but could not decide — the #208
+            // transport-required matcher was armed, never matched, and the kept
+            // output is a truncated prefix, so the marker may sit past it (the
+            // class intelephense fell into: ~4 MB of bundle ahead of the marker,
+            // unreachable through any pipe). Same rule as the transient branch
+            // below (#2015): a non-verdict must not delete a freshly installed
+            // package. Deliberately NOT folded into `lastAttemptTransient` —
+            // re-probing reproduces this exactly, so it is durable, and a
+            // transient verdict would keep re-arming the reinstall path
+            // (catalog shape 13).
+            // R2-F2: a non-verdict is a reason to keep ONLY while the tree on disk
+            // still looks like a complete install. With intelephense verified
+            // spawn-free, no registry entry reaches this branch healthy (measured:
+            // no other npm-strategy LSP server emits more than 1,527 bytes), so
+            // its live population is BROKEN servers that spew past the retained
+            // window and die — and for those the delete was the only repair that
+            // existed. Measured on npm 9.2.0 against a real managed prefix: a
+            // package file corrupted IN PLACE is not repaired by re-installing
+            // (`up to date`, the zeroed file stays zeroed), while a package
+            // directory, a `.bin` shim or a nested dependency that is GONE is
+            // reinstalled. So the same on-disk evidence `verification:
+            // "package-entry"` uses decides keep-vs-delete here — strictly as a
+            // gate, never as a verdict: the install is still recorded as failed,
+            // so the tool still reads `✗` and nothing is re-hidden.
+            if (await verifyNpmPackageEntry(binPath, packageName)) {
+                logSessionStart(`auto-install ${packageName}: verification inconclusive (output truncated before the transport-required marker) but the installed tree is intact; keeping installation for re-probe`);
+                return undefined;
+            }
+            logSessionStart(`auto-install ${packageName}: verification inconclusive AND the installed tree is incomplete; cleaning up so the next install can repair it`);
+        }
         if (!isValid && lastAttemptTransient) {
             // #2015: a killed/spawn-failed prober is NOT a verdict about the
             // binary (#1569 semantics). Cold-start verifies on fresh installs
@@ -4132,7 +4343,7 @@ export async function installTool(toolId) {
             case "npm": {
                 if (!tool.packageName || !tool.binaryName)
                     return false;
-                const npmPath = await installNpmTool(tool.id, tool.packageName, tool.binaryName, tool.checkArgs, getToolVerificationTimeout(tool));
+                const npmPath = await installNpmTool(tool.id, tool.packageName, tool.binaryName, tool.checkArgs, getToolVerificationTimeout(tool), packageEntryVerification(tool));
                 if (npmPath !== undefined) {
                     // #1746 review F4: an install just resolved this package's range
                     // against the registry, so record it as freshly checked. Otherwise a