@herbertgao/pi-extensions 2026.9.1 → 2026.9.3

package/node_modules/pi-lens/dist/clients/file-role.js

@@ -51,15 +51,32 @@ function isTypeStub(content) {
  */
 export function detectFileRole(filePath, content) {
     const windowsShaped = isWindowsPath(filePath);
-    const base = (windowsShaped ? win32.basename(filePath) : basename(filePath)).toLowerCase();
+    const rawBase = windowsShaped ? win32.basename(filePath) : basename(filePath);
+    const base = rawBase.toLowerCase();
     const dir = (windowsShaped ? win32.dirname(filePath) : dirname(filePath))
         .replace(/\\/g, "/")
         .toLowerCase();
     // --- Test ---
+    // Suffix conventions informed by the test-runner table
+    // (SOURCE_TO_TEST_PATTERNS + RUNNERS kinds in
+    // clients/test-runner-client.ts); hand-written, not iterated from it —
+    // see #2928 for the single-classifier fold:
+    // - `_test.` infix: Go (`*_test.go`), pytest (`*_test.py`), ExUnit
+    //   (`*_test.exs`), Dart (`*_test.dart`). The underscore anchor keeps
+    //   this precise: `contest.py` and `latest.ts` do not match.
+    // - `_spec.` infix: RSpec (`*_spec.rb`).
+    // - CamelCase `*Test(s).<ext>` suffix, matched case-SENSITIVELY on the
+    //   raw basename: JUnit/Surefire (`*Test.java`, `*TestCase.java`),
+    //   Kotlin (`*Test.kt`), dotnet (`*Test.cs`/`*Tests.cs`), PHPUnit
+    //   (`*Test.php`). Case matters: Surefire's `*Test.java` does not match
+    //   `contest.java`, so neither do we.
     if (base.includes(".test.") ||
         base.includes(".spec.") ||
+        base.includes("_test.") ||
+        base.includes("_spec.") ||
         base.startsWith("test_") ||
         base.startsWith("spec_") ||
+        /(Test|Tests|TestCase)\.(java|kt|kts|cs|fs|php)$/.test(rawBase) ||
         dir.includes("/__tests__/") ||
         dir.includes("/test/") ||
         dir.includes("/tests/") ||

package/node_modules/pi-lens/dist/clients/file-time.js

@@ -119,7 +119,7 @@ export class FileTime {
     }
 }
 // --- Error Type ---
-export class FileTimeError extends Error {
+class FileTimeError extends Error {
     filePath;
     reason;
     constructor(message, filePath, reason) {

package/node_modules/pi-lens/dist/clients/file-utils.js

@@ -302,7 +302,7 @@ function matchesGitignorePattern(pattern, relativePath, isDirectory, matchExpand
         return candidates.some((value) => matchExpanded(value, expanded));
     });
 }
-export function readGitignorePatterns(rootDir, layer = "gitignore") {
+function readGitignorePatterns(rootDir, layer = "gitignore") {
     const gitignorePath = path.join(rootDir, ".gitignore");
     try {
         return parseGitignoreContent(fs.readFileSync(gitignorePath, "utf-8"), layer);
@@ -762,7 +762,11 @@ export function readGitignoreDirs(rootDir) {
         .map((entry) => entry.pattern);
 }
 function globToRegExp(glob) {
+    // Directory names use the same `*`-only dialect as read-guard exemptions.
+    // Collapse adjacent stars before compiling to avoid nullable-group
+    // backtracking on a non-matching name (#2622).
     const escaped = glob
+        .replace(/\*+/g, "*")
         .replace(/[.+^${}()|[\]\\]/g, "\\$&")
         .replace(/\*/g, ".*")
         .replace(/\?/g, ".");

package/node_modules/pi-lens/dist/clients/finding-delivery-gate.js

@@ -139,6 +139,10 @@
  * agent-facing surface is EITHER gated OR explicitly labeled — never neither.
  */
 const MS_PER_MINUTE = 60_000;
+/** Mark retained findings whose replacement result could not be reconciled. */
+export function markUnreconciledFindings(findings) {
+    return findings.map((finding) => ({ ...finding, stale: true }));
+}
 /**
  * Render a short, honest age suffix for a store that cannot be freshness-
  * gated per-path (see module doc). `undefined`/unparseable `scannedAt`

package/node_modules/pi-lens/dist/clients/format-service.js

@@ -202,4 +202,3 @@ export function clearFormatServiceAndFileState() {
     resetFormatService();
 }
 // Re-export for convenience
-export { clearAllSessions } from "./file-time.js";

package/node_modules/pi-lens/dist/clients/formatters.js

@@ -11,10 +11,12 @@
 import { logExtension } from "./extension-log.js";
 import { AsyncLocalStorage } from "node:async_hooks";
 import * as fs from "node:fs/promises";
+import * as os from "node:os";
 import * as path from "node:path";
 import { BoundedLruCache } from "./bounded-cache.js";
 import { createGenerationSource } from "./generation-guard.js";
 import { normalizeMapKey } from "./path-utils.js";
+import { resolveToolCwd } from "./tool-cwd.js";
 import { resolveCargoPackageEdition } from "./cargo-manifest.js";
 import { resolveKtfmtGradleStyle } from "./gradle-ktfmt-style.js";
 import { resolvePhpCsFixerConfig } from "./php-cs-fixer-config.js";
@@ -26,8 +28,10 @@ import { compareOrdinal } from "./string-utils.js";
 import { classifyProbeFailure, createAvailabilityLatch, logAvailabilityDecision, startHostStallSampler, } from "./dispatch/runners/utils/availability-policy.js";
 import { findGlobalBinary, findLocalBinUpwards, VENDOR_BIN_DIRS, VENV_BIN_DIRS, } from "./package-manager.js";
 import { safeSpawnAsync } from "./safe-spawn.js";
+import { probeToolAsync } from "./tool-probe.js";
 import { assertInstallAllowed } from "./project-trust.js";
 import { tryLazyInstallForFormatter } from "./dispatch/runners/utils/lazy-installer.js";
+import { getToolPath } from "./installer/index.js";
 import { findPSScriptAnalyzerConfigPath, getAutoInstallToolIdForFormatter, getFormatterPolicyForFile, getSmartDefaultFormatterName, hasBiomeConfig, hasBlackConfig, hasClangFormatConfig, hasCljfmtConfig, hasCmakeFormatConfig, hasCsharpierConfig, hasFantomasConfig, hasGoogleJavaFormatConfig, hasKtfmtConfig, hasKtlintConfig, hasMixFormatConfig, hasNearestPackageJsonDependency, hasNearestPackageJsonField, hasOcamlformatConfig, hasOrmoluConfig, hasOxfmtConfig, hasOxfmtSvelteConfig, hasPhpCsFixerConfig, hasPrettierConfig, hasPSScriptAnalyzerConfig, hasRubocopConfig, hasRuffConfig, hasSqlfluffConfig, hasStandardrbConfig, hasStyluaConfig, hasSwiftformatConfig, hasTaploConfig, hasTerraformConfig, hasVitePlusConfig, OXFMT_SUPPORTED_EXTENSIONS, } from "./tool-policy.js";
 /**
  * Lazy-install a formatter's tool, through the shared seam (#1537).
@@ -379,7 +383,7 @@ async function resolveGoFmtBinary() {
     const inPath = await which("gofmt");
     if (inPath)
         return inPath;
-    const goCheck = await safeSpawnAsync("go", ["env", "GOROOT"], {
+    const goCheck = await probeToolAsync("go", ["env", "GOROOT"], {
         timeout: 5000,
     });
     if (goCheck.error || goCheck.status !== 0)
@@ -467,6 +471,22 @@ async function resolveManagedSmartDefaultCommand(formatterName, filePath, args)
         return null;
     return [installed, ...args, filePath];
 }
+/** Resolve an explicitly selected formatter from the shared managed-tool seam. */
+async function resolveManagedFormatterCommand(toolId, filePath, args, findLocal, cwd) {
+    const local = findLocal && cwd ? await findLocal(toolId, cwd) : null;
+    const installed = local ?? (await which(toolId)) ?? (await getToolPath(toolId));
+    return installed ? [installed, ...args, filePath] : FORMATTER_UNAVAILABLE;
+}
+function managedFormatterResolver(toolId, args, findLocal) {
+    return (filePath, cwd) => resolveManagedFormatterCommand(toolId, filePath, args, findLocal, cwd);
+}
+function managedToolDetect(toolId, configDetect, nativeDetect) {
+    return async (cwd) => {
+        const available = (nativeDetect && (await nativeDetect(cwd))) ||
+            Boolean(await getToolPath(toolId));
+        return available && (configDetect ? await configDetect(cwd) : true);
+    };
+}
 /**
  * One entry per formatter that can be selected via explicit project config
  * (the `formatterPolicy` "explicit-config" branch of `getFormattersForFile`).
@@ -602,6 +622,20 @@ async function indentationArgs(filePath, tool, cwd) {
         String(indentation.width),
     ];
 }
+/**
+ * Resolve the cwd for the formatter child, capped at the user's home
+ * directory. Files outside a project retain the historical file-directory
+ * cwd. The optional homeDir is only for the ceiling regression test.
+ */
+export function resolveFormatterCwd(absolutePath, formatterName, homeDir = os.homedir()) {
+    return resolveToolCwd("formatter", formatterName ?? "unknown", absolutePath, {
+        // Formatter discovery historically walks above the file directory. The
+        // filesystem root is the neutral dispatch boundary; the seam's `$HOME`
+        // ceiling prevents it from escaping the user's workspace.
+        cwd: path.parse(path.resolve(absolutePath)).root,
+        homeDir,
+    });
+}
 /**
  * Every biome invocation must carry this. Biome exits 1 with "No files were
  * processed in the specified paths" when the path is ignored by the repo's own
@@ -783,11 +817,7 @@ export const oxfmtFormatter = {
         const found = await which("oxfmt");
         if (found)
             return [found, OXFMT_NO_ERROR_ON_UNMATCHED, filePath];
-        // #2413: neither node_modules/.bin nor PATH has oxfmt, and `detect()` is
-        // config-only (it never probes the binary), so selection can reach here
-        // with nothing installed. The static command is bare `oxfmt` — spawning it
-        // only reproduces the reported `spawn oxfmt ENOENT`. Prove it unavailable.
-        return FORMATTER_UNAVAILABLE;
+        return ((await resolveManagedFormatterCommand("oxfmt", filePath, [OXFMT_NO_ERROR_ON_UNMATCHED], findInNodeModules, cwd)) ?? FORMATTER_UNAVAILABLE);
     },
     // Single source of truth: OXFMT_SUPPORTED_EXTENSIONS in tool-policy.ts.
     // Do not hand-maintain a second copy of this list (#1134 — previously two
@@ -836,21 +866,14 @@ export const ruffFormatter = {
             return true;
         // No-config fallback: if Ruff is already available, allow formatter usage.
         // This keeps Python default behavior consistent with startup defaults.
-        const { getToolPath } = await import("./installer/index.js");
-        const installed = await getToolPath("ruff");
-        return Boolean(installed);
+        return Boolean(await getToolPath("ruff"));
     },
 };
 export const blackFormatter = {
     name: "black",
     command: ["black", "$FILE"],
     extensions: [".py", ".pyi"],
-    async resolveCommand(filePath, cwd) {
-        const venv = await findInVenv("black", cwd);
-        if (venv)
-            return [venv, filePath];
-        return null;
-    },
+    resolveCommand: managedFormatterResolver("black", [], findInVenv),
     async detect(cwd) {
         return hasBlackConfig(cwd);
     },
@@ -949,12 +972,7 @@ export const shfmtFormatter = {
             ...styleArgs,
         ]);
     },
-    async detect(_cwd) {
-        if ((await which("shfmt")) !== null)
-            return true;
-        const { getToolPath } = await import("./installer/index.js");
-        return Boolean(await getToolPath("shfmt"));
-    },
+    detect: managedToolDetect("shfmt", undefined, async () => (await which("shfmt")) !== null),
 };
 export const nixfmtFormatter = {
     name: "nixfmt",
@@ -1016,12 +1034,7 @@ export const ktlintFormatter = {
             return [inPath, "-F", filePath];
         return resolveManagedSmartDefaultCommand("ktlint", filePath, ["-F"]);
     },
-    async detect(_cwd) {
-        if ((await which("ktlint")) !== null)
-            return true;
-        const { getToolPath } = await import("./installer/index.js");
-        return Boolean(await getToolPath("ktlint"));
-    },
+    detect: managedToolDetect("ktlint", undefined, async () => (await which("ktlint")) !== null),
 };
 export const ktfmtFormatter = {
     name: "ktfmt",
@@ -1151,36 +1164,25 @@ export const phpCsFixerFormatter = {
         const configPath = resolvePhpCsFixerConfig(filePath);
         const binary = (await findInVendorBin("php-cs-fixer", cwd)) ??
             (await which("php-cs-fixer"));
+        const managed = await resolveManagedFormatterCommand("php-cs-fixer", filePath, [], findInVendorBin, cwd);
+        if (managed === FORMATTER_UNAVAILABLE)
+            return FORMATTER_UNAVAILABLE;
+        const resolved = binary ?? managed[0];
         // #2413/#2472 review F4: both probes (vendor/bin, then PATH) have
         // PROVEN the binary is absent — returning `null` here would fall back
         // to the static `command` above, which is the SAME bare
         // `php-cs-fixer` this just failed to find, spawning it only to
         // re-observe the ENOENT already known. Report the proven-missing
         // state instead so `formatFile` skips the wasted spawn.
-        if (!binary)
+        if (!resolved)
             return FORMATTER_UNAVAILABLE;
         return configPath
-            ? [binary, "fix", "--config", configPath, filePath]
-            : [binary, "fix", filePath];
-    },
-    async detect(cwd) {
-        const vendorBin = await findInVendorBin("php-cs-fixer", cwd);
-        const globalBin = await which("php-cs-fixer");
-        if (!vendorBin && !globalBin)
-            return false;
-        // Only run if project has explicit config. This is a presence-only
-        // climb from the project `cwd` (not necessarily the formatted file's
-        // own directory) via this file's own `findUp` — deliberately NOT
-        // merged with `resolvePhpCsFixerConfig` above (#2472 AC4): that
-        // resolver climbs from the FILE's directory and needs the exact
-        // winning path for `--config`, while this only needs a yes/no answer
-        // from whatever `cwd` the caller passed. `rustfmtFormatter.detect`
-        // keeps the same non-merged shape against `resolveCargoPackageEdition`
-        // for the identical reason.
-        const configs = [".php-cs-fixer.php", ".php-cs-fixer.dist.php"];
-        const found = await findUp(configs, cwd);
-        return found.length > 0;
+            ? [resolved, "fix", "--config", configPath, filePath]
+            : [resolved, "fix", filePath];
     },
+    detect: managedToolDetect("php-cs-fixer", async (cwd) => (await findUp([".php-cs-fixer.php", ".php-cs-fixer.dist.php"], cwd))
+        .length > 0, async (cwd) => Boolean((await findInVendorBin("php-cs-fixer", cwd)) ||
+        (await which("php-cs-fixer")))),
 };
 export const csharpierFormatter = {
     name: "csharpier",
@@ -1196,9 +1198,7 @@ export const csharpierFormatter = {
         }
         // CSharpier 0.x: invoked through the dotnet driver.
         if ((await which("dotnet")) !== null) {
-            const legacy = await safeSpawnAsync("dotnet", ["csharpier", "--version"], {
-                timeout: 5000,
-            });
+            const legacy = await probeToolAsync("dotnet", ["csharpier", "--version"], { timeout: 5000 });
             if (!legacy.error && legacy.status === 0) {
                 return ["dotnet", "csharpier", filePath];
             }
@@ -1212,7 +1212,7 @@ export const csharpierFormatter = {
         // … or the legacy dotnet-driver form (CSharpier 0.x).
         if ((await which("dotnet")) === null)
             return false;
-        const result = await safeSpawnAsync("dotnet", ["csharpier", "--version"], {
+        const result = await probeToolAsync("dotnet", ["csharpier", "--version"], {
             timeout: 5000,
         });
         return !result.error && result.status === 0;
@@ -1238,23 +1238,8 @@ export const styluaFormatter = {
     name: "stylua",
     command: ["stylua", "$FILE"],
     extensions: [".lua"],
-    async resolveCommand(filePath, cwd) {
-        // Project binary first (#1731, discipline B): stylua has no pi-lens
-        // managed install, so before this the ONLY resolution was a bare
-        // `stylua` PATH lookup — a project-local install via npm
-        // `@johnnymorganz/stylua` (`node_modules/.bin/stylua`) was invisible.
-        const local = findLocalBinUpwards("stylua", cwd);
-        return local ? [local, filePath] : null;
-    },
-    async detect(cwd) {
-        const local = findLocalBinUpwards("stylua", cwd);
-        if (!local && (await which("stylua")) === null)
-            return false;
-        // Prefer explicit config but also run if binary is present in a Lua project
-        const configs = ["stylua.toml", ".stylua.toml"];
-        const found = await findUp(configs, cwd);
-        return found.length > 0;
-    },
+    resolveCommand: managedFormatterResolver("stylua", [], findLocalBinUpwards),
+    detect: managedToolDetect("stylua", async (cwd) => (await findUp(["stylua.toml", ".stylua.toml"], cwd)).length > 0, async (cwd) => Boolean(findLocalBinUpwards("stylua", cwd) || (await which("stylua")))),
 };
 export const ormoluFormatter = {
     name: "ormolu",
@@ -1274,42 +1259,28 @@ export const taploFormatter = {
             return [inPath, "fmt", filePath];
         return resolveManagedSmartDefaultCommand("taplo", filePath, ["fmt"]);
     },
-    async detect(_cwd) {
-        if ((await which("taplo")) !== null)
-            return true;
-        const { getToolPath } = await import("./installer/index.js");
-        return Boolean(await getToolPath("taplo"));
-    },
+    detect: managedToolDetect("taplo", undefined, async () => (await which("taplo")) !== null),
 };
 export const googleJavaFormatFormatter = {
     name: "google-java-format",
     command: ["google-java-format", "--replace", "$FILE"],
     extensions: [".java"],
-    async detect(cwd) {
-        if ((await which("google-java-format")) === null)
-            return false;
-        return hasGoogleJavaFormatConfig(cwd);
-    },
+    resolveCommand: managedFormatterResolver("google-java-format", ["--replace"]),
+    detect: managedToolDetect("google-java-format", hasGoogleJavaFormatConfig, async () => (await which("google-java-format")) !== null),
 };
 export const cljfmtFormatter = {
     name: "cljfmt",
     command: ["cljfmt", "fix", "$FILE"],
     extensions: [".clj", ".cljc", ".cljs"],
-    async detect(cwd) {
-        if ((await which("cljfmt")) === null)
-            return false;
-        return hasCljfmtConfig(cwd);
-    },
+    resolveCommand: managedFormatterResolver("cljfmt", ["fix"]),
+    detect: managedToolDetect("cljfmt", hasCljfmtConfig, async () => (await which("cljfmt")) !== null),
 };
 export const cmakeFormatFormatter = {
     name: "cmake-format",
     command: ["cmake-format", "-i", "$FILE"],
     extensions: [".cmake"],
-    async detect(cwd) {
-        if ((await which("cmake-format")) === null)
-            return false;
-        return hasCmakeFormatConfig(cwd);
-    },
+    resolveCommand: managedFormatterResolver("cmake-format", ["-i"]),
+    detect: managedToolDetect("cmake-format", hasCmakeFormatConfig, async () => (await which("cmake-format")) !== null),
 };
 export const cueFormatter = {
     name: "cue",
@@ -1382,7 +1353,7 @@ export const psscriptanalyzerFormatFormatter = {
         if (!pwsh)
             return false;
         // Check PSScriptAnalyzer module is available
-        const result = await safeSpawnAsync(pwsh, [
+        const result = await probeToolAsync(pwsh, [
             "-NoProfile",
             "-Command",
             "Get-Module -ListAvailable PSScriptAnalyzer | Select-Object -First 1 -ExpandProperty Name",
@@ -1438,7 +1409,7 @@ const detectionCache = new BoundedLruCache(32);
 // The signature is immutable for a cache generation. This memo is separate
 // from detectionCache because a cwd can have several extension entries, and a
 // warm lookup must not repeat the ancestor walk or stat matched configs.
-const formatterSignatureFlights = new Map();
+const formatterSignatureFlights = new BoundedLruCache(32);
 const formatterCacheGeneration = createGenerationSource("formatter-cache");
 // These are the formatter configuration files consulted by the policy helpers
 // above. Their metadata is captured by the cold detection signature. The
@@ -1810,6 +1781,7 @@ export function _getFormatterResetStateForTests() {
         whichTransientCommands,
         cooldownRecordedForRetryAtMs,
         detectionCache,
+        formatterSignatureFlights,
     };
 }
 export function clearFormatterRuntimeState() {
@@ -1887,6 +1859,7 @@ export async function formatFile(filePath, formatter) {
     try {
         const absolutePath = path.resolve(filePath);
         const cwd = path.dirname(absolutePath);
+        const formatterCwd = resolveFormatterCwd(absolutePath, formatter.name);
         const contentBefore = await fs.readFile(absolutePath, "utf-8");
         // Resolve command: prefer local (venv/vendor/node_modules) over global.
         // The shared seam must honor SKIP_FORMATTING before selecting the static
@@ -1912,7 +1885,7 @@ export async function formatFile(filePath, formatter) {
         // Run formatter without blocking the event loop.
         const result = await safeSpawnAsync(cmd[0], cmd.slice(1), {
             timeout: 15000,
-            cwd,
+            cwd: formatterCwd,
         });
         // A resolver that could NOT prove absence (it never probed PATH — e.g.
         // black/sqlfluff, which only look in a venv) legitimately falls back to the

package/node_modules/pi-lens/dist/clients/generated-artifacts.js

@@ -205,7 +205,7 @@ function hasGeneratedArtifactContent(content) {
  * file is not machine-emitted evidence), and an empty or whitespace-only
  * file yields a zero mean and stays source.
  */
-export const MACHINE_EMITTED_LINE_SHAPE_MIN_CONTENT = 2048;
+const MACHINE_EMITTED_LINE_SHAPE_MIN_CONTENT = 2048;
 export const MACHINE_EMITTED_LINE_SHAPE_MEAN_THRESHOLD = 2500;
 export function classifyMachineEmittedLineShape(content) {
     const contentLength = content.length;
@@ -325,8 +325,7 @@ function analyzeFileHeader(filePath, maxBytes) {
  * function and short-circuit on a hit, so by the time this function runs for
  * those callers evidence (a) has already come back negative. Non-walk
  * callers with no upstream sibling probe (`file-role.ts`'s content-based
- * check, `project-scan-policy.ts`'s single-path `shouldSkipProjectPath`)
- * evaluate evidence (b) only — a documented, narrower guarantee than the
+ * check) evaluate evidence (b) only — a documented, narrower guarantee than the
  * walk path's.
  *
  * Tradeoff (documented per the issue): when NEITHER piece of evidence
@@ -387,7 +386,7 @@ export function classifyGeneratedOrArtifactDetailed(filePath, options = {}) {
         : { verdict: "clean" };
 }
 /** Verdict-only convenience wrapper over {@link classifyGeneratedOrArtifactDetailed}. */
-export function classifyGeneratedOrArtifact(filePath, options = {}) {
+function classifyGeneratedOrArtifact(filePath, options = {}) {
     return classifyGeneratedOrArtifactDetailed(filePath, options).verdict;
 }
 export function isGeneratedOrArtifact(filePath, options = {}) {

package/node_modules/pi-lens/dist/clients/generation-guard.js

@@ -186,6 +186,10 @@ export function createGenerationMap(name, options = {}) {
             invalidations += 1;
             stamps.delete(normalize(key));
         },
+        clear() {
+            invalidations += 1;
+            stamps.clear();
+        },
         size() {
             return stamps.size;
         },

package/node_modules/pi-lens/dist/clients/git-guard.js

@@ -141,6 +141,11 @@ function canonicalizeGuardCommand(command) {
     let pendingSpace = false;
     quote = undefined;
     for (const ch of result) {
+        if (!quote && ch === "\n") {
+            collapsed += ch;
+            pendingSpace = false;
+            continue;
+        }
         if (!quote && /\s/.test(ch)) {
             pendingSpace = collapsed.length > 0;
             continue;

package/node_modules/pi-lens/dist/clients/gitleaks-client.js

@@ -45,11 +45,12 @@
  * module doc for why blanket gitignore-respect is wrong for a secrets scanner
  * (an untracked `.env` with a real credential is exactly the case gitleaks
  * exists to catch, and `.env` is commonly gitignored). `classifyAndFilterFindings`
- * backstops the config with a TS-side re-classification: a finding under the
- * secrets-lane scratch tier is DEMOTED (not deleted) to `severity: "info"`,
- * `semantic: "none"`, `pathStatus: "scratch"` — visible for an audit read,
- * but it can never surface as a blocking "leaked secret" alarm. Every other
- * finding gets `pathStatus` from git's tracked/ignored view.
+ * backstops the config with a TS-side re-classification. Findings under the
+ * secrets-lane scratch tier, in gitignored files, or inside nested repositories
+ * are DEMOTED (not deleted) to `severity: "info"` / `semantic: "none"` by the
+ * project-diagnostics adapter. They remain visible for an explicit audit but
+ * can never surface as blocking "leaked secret" alarms or automatic turn
+ * context. Tracked and ordinary untracked files remain blocking.
  *
  * Refs: #130, #1562
  */
@@ -333,8 +334,10 @@ export class GitleaksClient extends SecurityScanClient {
             }
             const rawFindings = parseGitleaksReport(fs.readFileSync(reportPath, "utf-8"));
             const findings = await classifyAndFilterFindings(rawFindings, cwd);
+            // #2154: the one gitleaks site that parsed a scan of this root.
             return {
                 success: true,
+                analyzed: true,
                 findings,
                 scannedAt,
             };
@@ -375,7 +378,10 @@ export class GitleaksClient extends SecurityScanClient {
  *      assert the config we hand it, so this backstop guarantees the demotion
  *      even if the generated regex ever mismatches gitleaks's own path
  *      normalization.
- *   2. Every OTHER finding gets `pathStatus` set from git's tracked/ignored
+ *   2. A finding below a nested git boundary is labelled
+ *      `nested-repository`. Parent scans must not claim ownership of a
+ *      submodule's or nested repository's files.
+ *   3. Every OTHER finding gets `pathStatus` set from git's tracked/ignored
  *      view, so a future false-positive triage is a log read.
  *
  * `collectTrackedFiles`/`collectUntrackedIgnoredIds` degrade to `undefined`
@@ -383,6 +389,32 @@ export class GitleaksClient extends SecurityScanClient {
  * keep `pathStatus: undefined` rather than a guessed value (fail-open,
  * matching `git-tracked-ignore.ts`'s own contract). Exported for unit tests.
  */
+function isInsideNestedGitRepository(file, cwd) {
+    const root = path.resolve(cwd);
+    const absoluteFile = path.isAbsolute(file)
+        ? path.resolve(file)
+        : path.resolve(root, file);
+    const relative = path.relative(root, absoluteFile);
+    if (relative === ".." ||
+        relative.startsWith(`..${path.sep}`) ||
+        path.isAbsolute(relative))
+        return false;
+    let directory = path.dirname(absoluteFile);
+    while (directory !== root) {
+        try {
+            if (fs.existsSync(path.join(directory, ".git")))
+                return true;
+        }
+        catch {
+            return false;
+        }
+        const parent = path.dirname(directory);
+        if (parent === directory)
+            return false;
+        directory = parent;
+    }
+    return false;
+}
 export async function classifyAndFilterFindings(findings, cwd) {
     if (findings.length === 0)
         return findings;
@@ -399,6 +431,10 @@ export async function classifyAndFilterFindings(findings, cwd) {
         const absPath = path.isAbsolute(finding.file)
             ? finding.file
             : path.resolve(cwd, finding.file);
+        if (isInsideNestedGitRepository(absPath, cwd)) {
+            classified.push({ ...finding, pathStatus: "nested-repository" });
+            continue;
+        }
         let pathStatus;
         if (trackedIds?.has(normalizeEphemeralMapKey(absPath))) {
             pathStatus = "tracked";

package/node_modules/pi-lens/dist/clients/govulncheck-client.js

@@ -20,6 +20,8 @@ import * as fs from "node:fs";
 import * as os from "node:os";
 import * as path from "node:path";
 import { safeSpawnAsync } from "./safe-spawn.js";
+import { probeToolAsync } from "./tool-probe.js";
+import { firstOutputLine, spawnFailedWithNoOutput, } from "./dispatch/runners/utils/spawn-outcome.js";
 import { assertInstallAllowed } from "./project-trust.js";
 import { SecurityScanClient } from "./security-scan-client.js";
 import { classifyProbeFailure, describeProbeEvidence, INSTALL_TRANSIENT_MAX_ATTEMPTS, logAvailabilityDecision, startHostStallSampler, } from "./dispatch/runners/utils/availability-policy.js";
@@ -86,7 +88,7 @@ export class GovulncheckClient extends SecurityScanClient {
         let goOnPath;
         let goHostStallMs;
         try {
-            goOnPath = await safeSpawnAsync("go", ["version"], {
+            goOnPath = await probeToolAsync("go", ["version"], {
                 timeout: 5000,
             });
         }
@@ -219,7 +221,7 @@ export class GovulncheckClient extends SecurityScanClient {
         let reprobe;
         let reprobeHostStallMs;
         try {
-            reprobe = await safeSpawnAsync("govulncheck", ["-version"], {
+            reprobe = await probeToolAsync("govulncheck", ["-version"], {
                 timeout: 5000,
             });
         }
@@ -366,21 +368,60 @@ export class GovulncheckClient extends SecurityScanClient {
         const bin = this.binaryPath ?? "govulncheck";
         try {
             const result = await safeSpawnAsync(bin, ["-mode=source", "-format=json", "./..."], { cwd, timeout: SCAN_TIMEOUT_MS });
+            // #2154 v4 F1: this was the one runner client with no `result.error`
+            // check before its parse site. `safeSpawnAsync` reports a timeout or
+            // an ambient abort as `{status: null, error, stdout: <partial>}`, and
+            // the old guard (`!stdout.trim() && status !== 0 && status !== 3`)
+            // let that partial stream through as an authoritative scan. Same
+            // order as the seven sibling clients: the process first, its output
+            // second.
+            if (result.error) {
+                this.log(`Scan error: ${result.error.message}`);
+                return {
+                    ...EMPTY_RESULT,
+                    scannedAt,
+                    summary: result.error.message.slice(0, 200),
+                };
+            }
             // govulncheck exits non-zero (status 3) when vulnerabilities are
-            // found — that's success from our perspective. Genuine failures
-            // produce empty stdout + a stderr message.
+            // found — that's success from our perspective. Any other exit code
+            // means the scan was not analysed, even if its config preamble or
+            // partial stream reached stdout before the failure.
             const rawStdout = result.stdout ?? "";
-            if (!rawStdout.trim() && result.status !== 0 && result.status !== 3) {
-                this.log(`Scan failed: ${(result.stderr ?? "").slice(0, 200)}`);
+            if (result.status !== 0 && result.status !== 3) {
+                return {
+                    ...EMPTY_RESULT,
+                    scannedAt,
+                    summary: firstOutputLine(result.stderr) || "scan failed",
+                };
+            }
+            if (!rawStdout.trim()) {
+                // Nothing to parse. `govulncheck -format=json` always writes a
+                // stream (a `config` record at minimum), so an empty one is never
+                // evidence of "no vulnerabilities" — it must not retire a retained
+                // CVE finding, whatever the exit code. `spawnFailedWithNoOutput`
+                // is the same shared discriminator knip and dead-code use, in
+                // place of this file's hand-rolled status test.
+                if (spawnFailedWithNoOutput(result, rawStdout)) {
+                    this.log(`Scan failed: ${(result.stderr ?? "").slice(0, 200)}`);
+                    return {
+                        ...EMPTY_RESULT,
+                        scannedAt,
+                        summary: firstOutputLine(result.stderr) || "scan failed",
+                    };
+                }
                 return {
                     ...EMPTY_RESULT,
+                    success: true,
                     scannedAt,
-                    summary: (result.stderr ?? "").trim().split("\n")[0] || "scan failed",
+                    summary: "govulncheck produced no output; nothing parsed",
                 };
             }
             const findings = parseGovulncheckJson(rawStdout);
+            // #2154: the one govulncheck site that parsed a scan of this root.
             return {
                 success: true,
+                analyzed: true,
                 findings,
                 scannedAt,
             };