@herbertgao/pi-extensions 2026.9.1 → 2026.9.3

package/node_modules/pi-lens/dist/clients/config-schema.js

@@ -42,8 +42,9 @@ import { LEGACY_ROOT_LSP_KEYS, LSP_NAMESPACE_KEY } from "./config-locations.js";
 // every config loader's import graph for one type alias.
 import { DENY_KEY, } from "./config-core/schema.js";
 import { flagConfigSectionKeys, GLOBAL_NON_FLAG_CONFIG_SECTIONS, LENS_FLAGS, PROJECT_FOREIGN_CONFIG_NAMESPACES, PROJECT_NON_FLAG_CONFIG_SECTIONS, } from "./lens-flag-registry.js";
+import { LENS_TOOL_NAMES } from "./tool-config.js";
 /** The JSON Schema dialect the published artifact declares. */
-export const CONFIG_SCHEMA_DIALECT = "https://json-schema.org/draft/2020-12/schema";
+const CONFIG_SCHEMA_DIALECT = "https://json-schema.org/draft/2020-12/schema";
 /**
  * A node the schema says nothing else about. `config-core` treats a node with
  * no `type` as opaque and walks its children OPEN, so an undeclared section
@@ -109,7 +110,6 @@ export { LSP_KEY_TYPES };
 const LSP_KEY_DENY = {
     disabledServers: "array-union",
 };
-export { LSP_KEY_DENY };
 /** The `x-deny` annotation for a key, or nothing when it carries no denial. */
 function denyAnnotation(key) {
     const policy = LSP_KEY_DENY[key];
@@ -155,12 +155,66 @@ function buildConfigSchema() {
     ]) {
         properties[key] = opaque("stable");
     }
+    properties.tools = {
+        type: "object",
+        additionalProperties: true,
+        properties: Object.fromEntries(LENS_TOOL_NAMES.map((name) => [
+            name,
+            {
+                type: "object",
+                additionalProperties: true,
+                properties: {
+                    enabled: { type: "boolean", [STABILITY_TIER_KEY]: "experimental" },
+                },
+                [STABILITY_TIER_KEY]: "experimental",
+            },
+        ])),
+        [STABILITY_TIER_KEY]: "stable",
+    };
     // Namespaces owned by another tool that ride in the same file (`trivy`,
     // `helm`). Reserved so they survive validation, `experimental` because their
     // shape belongs to those runners, not to this schema.
     for (const key of PROJECT_FOREIGN_CONFIG_NAMESPACES) {
         properties[key] ??= opaque("experimental");
     }
+    for (const key of [
+        "knip",
+        "jscpd",
+        "madge",
+        "gitleaks",
+        "govulncheck",
+        "deadCode",
+        "complexity",
+    ]) {
+        properties[key] = {
+            type: "object",
+            additionalProperties: true,
+            properties: {
+                enabled: { type: "boolean", [STABILITY_TIER_KEY]: "experimental" },
+            },
+            [STABILITY_TIER_KEY]: "stable",
+        };
+    }
+    properties.startup = {
+        type: "object",
+        additionalProperties: true,
+        properties: {
+            mode: {
+                type: "string",
+                enum: ["quick", "full", "minimal"],
+                [STABILITY_TIER_KEY]: "experimental",
+            },
+            scans: {
+                type: "object",
+                additionalProperties: true,
+                properties: {
+                    enabled: { type: "boolean", [STABILITY_TIER_KEY]: "experimental" },
+                },
+                [STABILITY_TIER_KEY]: "experimental",
+            },
+        },
+        [STABILITY_TIER_KEY]: "stable",
+    };
     // The four legacy ROOT LSP keys. Still accepted for their deprecation window
     // (#2418 registry), and `experimental` because they are scheduled for
     // removal — a `stable` tier on a key with a `removeNotBefore` would be two

package/node_modules/pi-lens/dist/clients/config-warn.js

@@ -22,7 +22,7 @@
  * extraction — the prose is not API (the code is), but silently rewording a
  * warning inside a refactor is still not a thing this PR does.
  */
-import { DEPRECATED_CONFIG_SURFACES, } from "./config-diagnostic-codes.js";
+import { DEPRECATED_CONFIG_SURFACES, withConfigDiagnosticCode, } from "./config-diagnostic-codes.js";
 import { recordDegradationOnce } from "./degradation-ledger.js";
 import { errorClassName } from "./error-class.js";
 import { logExtension } from "./extension-log.js";
@@ -378,7 +378,7 @@ export function warnIgnoredConfigOnce(options) {
     logExtension({
         subsystem,
         level: "warn",
-        message,
+        message: withConfigDiagnosticCode(message, code),
         metadata: { configPath: file, reason, code, ...(key ? { key } : {}) },
     });
     // HUMAN-audience too: a config the user wrote is being ignored. Routed

package/node_modules/pi-lens/dist/clients/dead-code-client.js

@@ -19,6 +19,7 @@ import { findLocalBinsAt, VENV_BIN_DIRS } from "./package-manager.js";
 import { findNearestMarkerRoot } from "./path-utils.js";
 import { getScratchTreeFnmatchPatterns } from "./scratch-tree-policy.js";
 import { safeSpawnAsync } from "./safe-spawn.js";
+import { probeToolAsync } from "./tool-probe.js";
 import { classifyProbeFailure, createAvailabilityLatch, logAvailabilityDecision, startHostStallSampler, } from "./dispatch/runners/utils/availability-policy.js";
 import { firstOutputLine, spawnFailedWithNoOutput, } from "./dispatch/runners/utils/spawn-outcome.js";
 import { formatToolFailure } from "./dispatch/runners/utils/tool-failure.js";
@@ -229,7 +230,7 @@ export class PythonDeadCodeClient {
             let probe;
             let hostStallMs;
             try {
-                probe = await safeSpawnAsync(c.cmd, [...c.prefix, "--version"], {
+                probe = await probeToolAsync(c.cmd, [...c.prefix, "--version"], {
                     timeout: 5000,
                 });
             }
@@ -415,9 +416,13 @@ export class PythonDeadCodeClient {
                     durationMs,
                 };
             }
+            // vulture's verified exit-code table (above): exit 0 with empty
+            // stdout IS the clean-run signal, so this ran over the root
+            // (#2154) — unlike knip, whose clean run always prints JSON.
             return {
                 ...emptyResult(this.language),
                 success: true,
+                analyzed: true,
                 summary: "No dead code found",
                 durationMs,
             };
@@ -430,6 +435,8 @@ export class PythonDeadCodeClient {
         return {
             ...emptyResult(this.language),
             success: true,
+            // #2154: parsed vulture output for this root.
+            analyzed: true,
             unusedExports,
             summary: total === 0
                 ? "No dead code found"

package/node_modules/pi-lens/dist/clients/dead-code-logger.js

@@ -28,7 +28,3 @@ export function logDeadCodeScan(event) {
         return;
     writer.log({ ts: new Date().toISOString(), ...event });
 }
-/** Resolve once all enqueued dead-code writes are on disk (tests/shutdown). */
-export function flushDeadCodeLog() {
-    return writer.flush();
-}

package/node_modules/pi-lens/dist/clients/dependency-checker.js

@@ -815,7 +815,11 @@ export class DependencyChecker {
                 }
             }
             this.publishState(gen, circular, circularFiles);
-            return { circular, count: circular.length };
+            // #2154: the one madge site that parsed a graph for this root. Every
+            // other return here (missing root, no top-level source file, madge
+            // unavailable, spawn error, parse throw) is the SAME empty shape and
+            // must not be read as "no cycles in this project".
+            return { circular, count: circular.length, analyzed: true };
         }
         catch (err) {
             this.log(`Scan error: ${err.message}`);

package/node_modules/pi-lens/dist/clients/diagnostic-dispositions.js

@@ -128,7 +128,7 @@ export function computeStrictAnchor(args) {
     });
 }
 /** Intent-level anchor — see module doc. Used for defer/flagged/suppress. */
-export function computeWeakAnchor(args) {
+function computeWeakAnchor(args) {
     return stableFindingId("ddw:", {
         cwd: args.cwd,
         filePath: args.filePath,

package/node_modules/pi-lens/dist/clients/diagnostic-logger.js

@@ -23,7 +23,7 @@ export function getDiagnosticLogger() {
     }
     return _logger;
 }
-export function createDiagnosticLogger() {
+function createDiagnosticLogger() {
     // Lazy filePath: the log file is keyed on the current date, resolved per
     // drain so a long-lived logger rolls over at midnight. A daily rollover
     // is NOT a size bound (#2505): one very busy day, or a long-lived

package/node_modules/pi-lens/dist/clients/dispatch/collect-later-tier.js

@@ -33,7 +33,3 @@ export function observeRunnerLatency(options) {
 export function resetObservedRunnerLatency() {
     slowRunners.clear();
 }
-/** Test-only inspection without exposing mutable state. */
-export function observedRunnerTierForTests(projectRoot, runnerId) {
-    return classifyObservedRunner(projectRoot, runnerId);
-}

package/node_modules/pi-lens/dist/clients/dispatch/dispatcher.js

@@ -29,7 +29,7 @@ import { isSpawnableCommand } from "../installer/index.js";
 import { isAbsoluteFilePath, normalizeEphemeralMapKey, normalizeMapKey, } from "../path-utils.js";
 import { loadPiLensProjectConfig } from "../project-lens-config.js";
 import { RUNTIME_CONFIG, getRunnerTimeoutFloorMs } from "../runtime-config.js";
-import { safeSpawnAsync } from "../safe-spawn.js";
+import { probeToolAsync } from "../tool-probe.js";
 import { classifyDiagnostic } from "./diagnostic-taxonomy.js";
 import { classifyProbeFailure, logAvailabilityDecision, startHostStallSampler, transientRetryDelayMs, } from "./runners/utils/availability-policy.js";
 import { recordAvailabilityProbeOverrun, getDispatchAvailabilityGeneration, } from "./runners/utils/runner-helpers.js";
@@ -147,7 +147,7 @@ export async function checkToolAvailability(command, facts) {
         let hostStallMs;
         let probeJoined = false;
         try {
-            const shared = dispatcherProbeFlights.run(`dispatcher:${key}`, () => safeSpawnAsync(command, ["--version"], {
+            const shared = dispatcherProbeFlights.run(`dispatcher:${key}`, () => probeToolAsync(command, ["--version"], {
                 timeout: TOOL_PROBE_TIMEOUT_MS,
             }));
             probeJoined = shared.joined;
@@ -285,11 +285,13 @@ telemetryModel, telemetryProvider) {
         async hasTool(command) {
             return checkToolAvailability(command, facts);
         },
-        log(message) {
+        log(message, level) {
             // #1333: pi owns the terminal — a runner advisory must never be a raw
             // write. Every DispatchContext.log line lands in extension.log instead.
             logExtension({
                 subsystem: "dispatch",
+                // exactOptionalPropertyTypes: an omitted level must stay omitted.
+                ...(level !== undefined && { level }),
                 message,
                 metadata: { filePath: normalizedFilePath, kind },
             });
@@ -446,31 +448,49 @@ function buildCoverageNotice(ctx, runnerLatencies) {
         ...new Set(relevant.flatMap((r) => r.unconfirmedServerIds ?? [])),
     ];
     if (unconfirmedServerIds.length > 0) {
-        // The marker describes this exact silent-scanner set. A scanner can
-        // recover while another goes dark on the same file, so the set belongs
-        // in the session dedupe identity rather than only kind and path.
+        const deferredIds = new Set(relevant.flatMap((r) => r.deferredServerIds ?? []));
+        const markerFor = (ids) => {
+            const shown = ids.slice(0, 4);
+            const remainder = ids.length - shown.length;
+            return `${shown.join(", ")}${remainder > 0 ? ` +${remainder}` : ""}`;
+        };
+        const deferredServerIds = unconfirmedServerIds.filter((id) => deferredIds.has(id));
+        const silentServerIds = unconfirmedServerIds.filter((id) => !deferredIds.has(id));
+        // The marker describes this exact scanner set. A scanner can recover
+        // while another goes dark on the same file, so the set belongs in the
+        // session dedupe identity rather than only kind and path.
         // #2016: these are SCANNER IDS, not filesystem paths. `normalizeMapKey`
         // would realpath each one; on Windows that fails, falls through to
         // `resolveNonExisting`, and resolves the id against the CURRENT process
         // cwd, so the dedupe key differed by platform and by cwd (the #2219
         // non-path-sentinel class). The cheap syntactic fold is what this
-        // session-scoped dedupe key actually needs.
-        const silentScannerSet = [...new Set(unconfirmedServerIds)]
+        // session-scoped dedupe key actually needs. Code-unit comparator: the
+        // sorted set is a KEY, so ordering must be deterministic across locales
+        // — localeCompare is not.
+        const dedupeSet = (ids) => [...new Set(ids)]
             .map(normalizeEphemeralMapKey)
-            // Code-unit comparator: the sorted set is a dedupe KEY, so ordering
-            // must be deterministic across locales — localeCompare is not.
             .sort((a, b) => Number(a > b) - Number(a < b))
             .join(",");
-        const onceKey = `${ctx.kind}:${ctx.filePath}:${silentScannerSet}`;
+        // #2810 round 4: the PARTITION is part of the identity, not just the
+        // scanner set. The same scanner can be silent on one edit and marked for
+        // late delivery on the next; keying on the unconfirmed set alone showed
+        // the session whichever message came first and suppressed the other, so a
+        // scanner that recovered a delivery path (or lost one) kept the stale
+        // wording for the rest of the session.
+        const onceKey = `${ctx.kind}:${ctx.filePath}:${dedupeSet(silentServerIds)}|${dedupeSet(deferredServerIds)}`;
         if (coverageNoticeSeen.has(onceKey))
             return undefined;
         coverageNoticeSeen.add(onceKey);
-        const shown = unconfirmedServerIds.slice(0, 4);
-        const remainder = unconfirmedServerIds.length - shown.length;
-        const marker = `${shown.join(", ")}${remainder > 0 ? ` +${remainder}` : ""}`;
+        const coverageParts = [];
+        if (deferredServerIds.length > 0) {
+            coverageParts.push(`coverage: ${markerFor(deferredServerIds)} deferred — diagnostics are incomplete; findings arrive at turn end if the scan lands.`);
+        }
+        if (silentServerIds.length > 0) {
+            coverageParts.push(`coverage: ${markerFor(silentServerIds)} silent — diagnostics are incomplete (not a clean result).`);
+        }
         return {
             id: `coverage-partial:${ctx.kind}:${path.basename(ctx.filePath)}`,
-            message: `coverage: ${marker} silent — diagnostics are incomplete (not a clean result).`,
+            message: coverageParts.join("\n"),
             filePath: ctx.filePath,
             severity: "warning",
             semantic: "warning",
@@ -837,6 +857,9 @@ async function runGroup(ctx, group, registry, onRunnerResult) {
             ...(result.unconfirmedServerIds !== undefined && {
                 unconfirmedServerIds: result.unconfirmedServerIds,
             }),
+            ...(result.deferredServerIds !== undefined && {
+                deferredServerIds: result.deferredServerIds,
+            }),
         });
         logLatency({
             type: "runner",
@@ -1237,29 +1260,3 @@ async function runRunner(ctx, runner, defaultSemantic) {
     }
 }
 // --- Simple Integration Helper ---
-/**
- * @internal
- * Low-level dispatch entry point. Use `dispatchLint` from `./integration.js` instead —
- * that version provides session-persistent baselines and FactStore.
- * This function creates an ephemeral FactStore per call; facts do not persist across calls.
- */
-export async function dispatchLint(filePath, cwd, pi, facts, registry) {
-    // By default, only run BLOCKING rules for fast feedback on file write
-    const ctx = createDispatchContext(filePath, cwd, pi, facts, true);
-    // Get runners for this file kind
-    if (!ctx.kind)
-        return "";
-    const runners = registry.getForKind(ctx.kind, ctx.filePath);
-    if (runners.length === 0) {
-        return "";
-    }
-    // Create groups from registered runners (all in fallback mode)
-    const groups = [
-        {
-            mode: "fallback",
-            runnerIds: runners.map((r) => r.id),
-        },
-    ];
-    const result = await dispatchForFile(ctx, groups, registry);
-    return result.output;
-}

package/node_modules/pi-lens/dist/clients/dispatch/facts/function-facts.js

@@ -135,7 +135,7 @@ function isCallPassThrough(stmt, paramNames) {
     }
     return { pass: true, target: (expr.children ?? [])[0]?.text };
 }
-function calcCyclomaticComplexity(body) {
+export function calcCyclomaticComplexity(body) {
     let cc = 1;
     walk(body, (node) => {
         if (COMPLEXITY_TYPES.has(node.type)) {

package/node_modules/pi-lens/dist/clients/dispatch/facts/import-facts.js

@@ -1,6 +1,10 @@
 import { logLatency } from "../../latency-logger.js";
 import { isJstsFactFile } from "../../file-kinds.js";
 import { childrenOfType, firstChildOfType, withFactTree, walk, } from "./tree-sitter-facts.js";
+/** Whether the import-facts provider applies to a source path. */
+export function importFactsApplyTo(filePath) {
+    return isJstsFactFile(filePath);
+}
 function stripQuotes(raw) {
     return raw.replace(/^["'`]+|["'`]+$/g, "");
 }
@@ -69,7 +73,7 @@ export const importFactProvider = {
     provides: ["file.imports", "file.reexports", "file.importFactsCoverage"],
     requires: ["file.content"],
     appliesTo(ctx) {
-        return isJstsFactFile(ctx.filePath);
+        return importFactsApplyTo(ctx.filePath);
     },
     async run(ctx, store) {
         const content = store.getFileFact(ctx.filePath, "file.content");

package/node_modules/pi-lens/dist/clients/dispatch/integration.js

@@ -1489,7 +1489,9 @@ export async function computeCascadeForFile(filePath, cwd, options = {}) {
                     try {
                         const snapshots = (await lspService.getCapabilitySnapshots?.(neighborPath)) ?? [];
                         const tier = classifyCascadeWaitTier(lspService, neighborPath, snapshots);
-                        if (tier === "tier3-silent" || tier === "collect-later") {
+                        if (tier === "tier3-silent" ||
+                            tier === "collect-later" ||
+                            tier === "diagnostics-unsupported") {
                             const spawnedForTouch = await lspService.getClientForFile(neighborPath);
                             if (spawnedForTouch) {
                                 // Sampled BEFORE the touchFile notify: a publish landing
@@ -1505,6 +1507,21 @@ export async function computeCascadeForFile(filePath, cwd, options = {}) {
                                     source: "cascade",
                                     clientScope: "primary",
                                 });
+                                if (tier === "diagnostics-unsupported") {
+                                    logCascade({
+                                        phase: "cascade_skip",
+                                        filePath,
+                                        neighborFile: neighborPath,
+                                        durationMs: Date.now() - neighborStart,
+                                        lspServerCount: configuredServerCount,
+                                        coldSnapshot: isColdSnapshot,
+                                        metadata: {
+                                            serverId: spawnedForTouch.client.serverId,
+                                            waitTier: tier,
+                                        },
+                                    });
+                                    return undefined;
+                                }
                                 recordOutstandingCascadeTouch({
                                     filePath: neighborPath,
                                     serverId: spawnedForTouch.client.serverId,

package/node_modules/pi-lens/dist/clients/dispatch/lazy.js

@@ -9,9 +9,3 @@ export function warmDispatchIntegration() {
 export function loadDispatchIntegration() {
     return warmDispatchIntegration();
 }
-/** Test-only reset; production sessions intentionally retain the promise
- * across successful loads (a rejection already evicts itself — see
- * `createLazyImport`). */
-export function resetDispatchIntegrationForTests() {
-    lazyIntegration.resetForTests();
-}

package/node_modules/pi-lens/dist/clients/dispatch/pending-runner-findings.js

@@ -1,7 +1,7 @@
 /** Turn-end handoff for runners moved off the post-write critical path. */
 import { incrementDegradationCount } from "../degradation-ledger.js";
 const pending = [];
-export const MAX_PENDING_RUNNER_FINDINGS = 50;
+const MAX_PENDING_RUNNER_FINDINGS = 50;
 export function deferRunnerFindings(entry) {
     const tracked = { ...entry, settled: false };
     // Attach exactly once at ownership time. Re-attaching at every turn end

package/node_modules/pi-lens/dist/clients/dispatch/plan.js

@@ -276,6 +276,3 @@ export const TOOL_PLANS = Object.fromEntries(Object.entries(LANGUAGE_CAPABILITY_
 export function getToolPlan(kind) {
     return TOOL_PLANS[kind];
 }
-export function getAllToolPlans() {
-    return TOOL_PLANS;
-}

package/node_modules/pi-lens/dist/clients/dispatch/rules/high-complexity.js

@@ -3,8 +3,8 @@ import { isTestSuiteOrganizer } from "./framework-call-noise.js";
 // projects without a config. Project-specific overrides are read from the
 // per-dispatch context; these mutable fallbacks exist for tests/legacy direct
 // rule evaluation only.
-export const DEFAULT_HIGH_COMPLEXITY_THRESHOLD = 15;
-export const DEFAULT_HIGH_COMPLEXITY_DEPTH_THRESHOLD = 6;
+const DEFAULT_HIGH_COMPLEXITY_THRESHOLD = 15;
+const DEFAULT_HIGH_COMPLEXITY_DEPTH_THRESHOLD = 6;
 let ccThreshold = DEFAULT_HIGH_COMPLEXITY_THRESHOLD;
 let depthThreshold = DEFAULT_HIGH_COMPLEXITY_DEPTH_THRESHOLD;
 function isPositiveFiniteThreshold(value) {

package/node_modules/pi-lens/dist/clients/dispatch/rules/high-fan-out.js

@@ -3,7 +3,7 @@ import { isTestFrameworkNoiseCall, isTestSuiteOrganizer, } from "./framework-cal
 // projects without a config. Project-specific overrides are read from the
 // per-dispatch context; this mutable fallback exists for tests/legacy direct
 // rule evaluation only.
-export const DEFAULT_HIGH_FAN_OUT_THRESHOLD = 20;
+const DEFAULT_HIGH_FAN_OUT_THRESHOLD = 20;
 let fanOutThreshold = DEFAULT_HIGH_FAN_OUT_THRESHOLD;
 /** Override fallback threshold for tests/legacy direct rule evaluation. */
 export function setHighFanOutThreshold(n) {

package/node_modules/pi-lens/dist/clients/dispatch/runners/actionlint.js

@@ -1,5 +1,6 @@
 import path from "node:path";
 import { safeSpawnAsync } from "../../safe-spawn.js";
+import { resolveRunnerCwd } from "../../tool-cwd.js";
 import { PRIORITY } from "../priorities.js";
 import { createAvailabilityChecker, resolveToolCommandWithInstallFallback, } from "./utils/runner-helpers.js";
 const actionlint = createAvailabilityChecker("actionlint", ".exe");
@@ -66,7 +67,7 @@ const actionlintRunner = {
         return isGitHubWorkflowFile(ctx.filePath);
     },
     async run(ctx) {
-        const cwd = ctx.cwd || process.cwd();
+        const cwd = resolveRunnerCwd(ctx, "actionlint");
         let cmd = null;
         if (await actionlint.isAvailableAsync(cwd)) {
             cmd = actionlint.getCommand(cwd);

package/node_modules/pi-lens/dist/clients/dispatch/runners/ast-grep-napi.js

@@ -184,7 +184,9 @@ export async function loadSg() {
         }
     })();
     sgLoadPromise = task;
-    task.finally(() => {
+    // `task` never rejects (the IIFE catches), so the derived promise is inert;
+    // `void` records that no consumer awaits it (oxlint no-floating-promises).
+    void task.finally(() => {
         if (sgLoadPromise === task)
             sgLoadPromise = undefined;
     });

package/node_modules/pi-lens/dist/clients/dispatch/runners/biome-check.js

@@ -5,13 +5,12 @@
  * Autofix is handled earlier by the post-write pipeline to avoid
  * mutating files mid-dispatch after LSP sync has already happened.
  */
-import * as path from "node:path";
 import { incrementDegradationCount } from "../../degradation-ledger.js";
 import { mapWithConcurrency } from "../../dependency-checker.js";
 import { safeSpawnAsync } from "../../safe-spawn.js";
 import { biomeConfigArgs, getAutofixCapability, getJstsLintPolicyForCwd, } from "../../tool-policy.js";
 import { PRIORITY } from "../priorities.js";
-import { resolveToolCommandWithInstallFallback } from "./utils/runner-helpers.js";
+import { resolveRunnerCwd, resolveToolCommandWithInstallFallback, } from "./utils/runner-helpers.js";
 import { finishParsedRun } from "./utils/tool-failure.js";
 /**
  * Map biome's own severity vocabulary onto the four-tier `Diagnostic.severity`
@@ -198,7 +197,7 @@ const biomeCheckJsonRunner = {
     appliesTo: ["jsts"],
     priority: PRIORITY.FORMAT_AND_LINT_PRIMARY,
     async run(ctx) {
-        const cwd = ctx.cwd || path.dirname(ctx.filePath);
+        const cwd = resolveRunnerCwd(ctx, "biome");
         const policy = getJstsLintPolicyForCwd(cwd);
         // Defer to ESLint/oxlint if the project has explicitly configured one —
         // biome runs as the default linter only when no alternative is present.

package/node_modules/pi-lens/dist/clients/dispatch/runners/cpp-check.js

@@ -1,6 +1,8 @@
 import * as fs from "node:fs";
 import * as path from "node:path";
 import { safeSpawnAsync } from "../../safe-spawn.js";
+import { probeToolAsync } from "../../tool-probe.js";
+import { resolveRunnerCwd } from "../../tool-cwd.js";
 import { PRIORITY } from "../priorities.js";
 import { createAvailabilityChecker } from "./utils/runner-helpers.js";
 // Per-compiler availability checkers — each one caches per-cwd and
@@ -97,7 +99,10 @@ async function resolveCompiler(absPath, cwd) {
             flavor: "msvc",
         };
     }
-    const clProbe = await safeSpawnAsync("cl", [], { timeout: 5000 });
+    // Mirrors the deliberate global-PATH probes in utils/runner-helpers.ts:
+    // this never resolves a config file or a target path, so there is no cwd
+    // for it to get wrong.
+    const clProbe = await probeToolAsync("cl", [], { timeout: 5000 });
     if (!clProbe.error && clProbe.status !== null) {
         return {
             command: "cl",
@@ -177,7 +182,7 @@ const cppCheckRunner = {
     priority: PRIORITY.GENERAL_ANALYSIS,
     skipTestFiles: false,
     async run(ctx) {
-        const cwd = ctx.cwd || process.cwd();
+        const cwd = resolveRunnerCwd(ctx, "cpp-check");
         const absPath = path.resolve(cwd, ctx.filePath);
         const compiler = await resolveCompiler(absPath, cwd);
         if (!compiler) {

package/node_modules/pi-lens/dist/clients/dispatch/runners/credo.js

@@ -1,6 +1,7 @@
 import * as path from "node:path";
 import * as fs from "node:fs";
 import { safeSpawnAsync } from "../../safe-spawn.js";
+import { resolveRunnerCwd } from "../../tool-cwd.js";
 import { PRIORITY } from "../priorities.js";
 import { createCwdCachedProbe } from "./utils/runner-helpers.js";
 const CREDO_PROBE_BUDGET_MS = 10_000;
@@ -50,7 +51,7 @@ const credoRunner = {
     priority: PRIORITY.GENERAL_ANALYSIS,
     skipTestFiles: false,
     async run(ctx) {
-        const cwd = ctx.cwd || process.cwd();
+        const cwd = resolveRunnerCwd(ctx, "credo");
         if (!hasMixExs(cwd)) {
             return { status: "skipped", diagnostics: [], semantic: "none" };
         }

package/node_modules/pi-lens/dist/clients/dispatch/runners/cue-vet.js

@@ -104,6 +104,7 @@
 import * as fs from "node:fs";
 import * as path from "node:path";
 import { safeSpawnAsync } from "../../safe-spawn.js";
+import { resolveRunnerCwd } from "../../tool-cwd.js";
 import { createAvailabilityChecker, resolveAvailableOrInstall, } from "./utils/runner-helpers.js";
 import { spawnFailedWithNoOutput } from "./utils/spawn-outcome.js";
 import { PRIORITY } from "../priorities.js";
@@ -281,7 +282,7 @@ const cueVetRunner = {
     skipTestFiles: false,
     timeoutMs: 30_000,
     async run(ctx) {
-        const cwd = ctx.cwd || process.cwd();
+        const cwd = resolveRunnerCwd(ctx, "cue-vet");
         let cmd = null;
         if (await cue.isAvailableAsync(cwd)) {
             cmd = cue.getCommand(cwd);

package/node_modules/pi-lens/dist/clients/dispatch/runners/dart-analyze.js

@@ -1,5 +1,6 @@
 import * as path from "node:path";
 import { safeSpawnAsync } from "../../safe-spawn.js";
+import { resolveRunnerCwd } from "../../tool-cwd.js";
 import { createAvailabilityChecker } from "./utils/runner-helpers.js";
 import { PRIORITY } from "../priorities.js";
 const dart = createAvailabilityChecker("dart", ".exe");
@@ -147,7 +148,7 @@ const dartAnalyzeRunner = {
     priority: PRIORITY.GENERAL_ANALYSIS,
     skipTestFiles: false,
     async run(ctx) {
-        const cwd = ctx.cwd || process.cwd();
+        const cwd = resolveRunnerCwd(ctx, "dart-analyze");
         const absPath = path.resolve(cwd, ctx.filePath);
         const dartAvailable = await dart.isAvailableAsync(cwd);
         const flutterAvailable = !dartAvailable && (await flutter.isAvailableAsync(cwd));

package/node_modules/pi-lens/dist/clients/dispatch/runners/detekt.js

@@ -1,6 +1,7 @@
 import * as fs from "node:fs";
 import * as path from "node:path";
 import { safeSpawnAsync } from "../../safe-spawn.js";
+import { resolveRunnerCwd } from "../../tool-cwd.js";
 import { getLinterPolicyForCwd } from "../../tool-policy.js";
 import { PRIORITY } from "../priorities.js";
 import { createAvailabilityChecker } from "./utils/runner-helpers.js";
@@ -129,7 +130,7 @@ const detektRunner = {
     timeoutMs: 90_000,
     skipTestFiles: false,
     async run(ctx) {
-        const cwd = ctx.cwd || process.cwd();
+        const cwd = resolveRunnerCwd(ctx, "detekt");
         const policy = getLinterPolicyForCwd(ctx.filePath, cwd);
         if (policy && !policy.preferredRunners.includes("detekt")) {
             return { status: "skipped", diagnostics: [], semantic: "none" };

package/node_modules/pi-lens/dist/clients/dispatch/runners/dotnet-build.js

@@ -1,6 +1,7 @@
 import * as fs from "node:fs";
 import * as path from "node:path";
 import { safeSpawnAsync } from "../../safe-spawn.js";
+import { resolveRunnerCwd } from "../../tool-cwd.js";
 import { PRIORITY } from "../priorities.js";
 import { createAvailabilityChecker } from "./utils/runner-helpers.js";
 const dotnet = createAvailabilityChecker("dotnet", ".exe");
@@ -118,7 +119,7 @@ const dotnetBuildRunner = {
     timeoutMs: 90_000,
     skipTestFiles: false,
     async run(ctx) {
-        const cwd = ctx.cwd || process.cwd();
+        const cwd = resolveRunnerCwd(ctx, "dotnet-build");
         if (!(await dotnet.isAvailableAsync(cwd))) {
             return { status: "skipped", diagnostics: [], semantic: "none" };
         }

package/node_modules/pi-lens/dist/clients/dispatch/runners/elixir-check.js

@@ -2,6 +2,7 @@ import * as fs from "node:fs";
 import * as path from "node:path";
 import { getProjectDataDir } from "../../file-utils.js";
 import { safeSpawnAsync } from "../../safe-spawn.js";
+import { resolveRunnerCwd } from "../../tool-cwd.js";
 import { PRIORITY } from "../priorities.js";
 import { createAvailabilityChecker } from "./utils/runner-helpers.js";
 // Per-cwd cached `--version` probes (#120). Before this, each dispatch
@@ -141,7 +142,7 @@ const elixirCheckRunner = {
     priority: PRIORITY.GENERAL_ANALYSIS,
     skipTestFiles: false,
     async run(ctx) {
-        const cwd = ctx.cwd || process.cwd();
+        const cwd = resolveRunnerCwd(ctx, "elixir-check");
         const absPath = path.resolve(cwd, ctx.filePath);
         let command;
         let args = [];