@herbertgao/pi-extensions 2026.9.14 → 2026.9.16

package/node_modules/pi-lens/dist/clients/actionable-warnings.js

@@ -1547,22 +1547,35 @@ export async function applyConservativeActionableWarningFixes(args) {
  * unread under `~/.pi-lens/projects/<slug>/cache/`. An OPTIONAL `cwd` would
  * have kept that bug alive behind a default, so callers must pass it.
  */
-export function formatActionableWarningsAdvisory(report, cwd, host = "pi") {
-    if (report.summary.unsuppressed === 0)
+export function formatActionableWarningsAdvisory(report, cwd, host = "pi", filterBuiltReport) {
+    // The cache record is deliberately kept raw: lens_diagnostics mode=delta
+    // applies dispositions on read. The turn-end advisory is a separate
+    // delivery surface, so filter the report AFTER its builder and after the
+    // deferred merge (which is where LSP-enriched rows enter), then derive the
+    // summary from the same per-file rows before rendering.
+    const filtered = filterBuiltReport?.(report);
+    const advisoryReport = filtered
+        ? {
+            ...report,
+            files: filtered.files,
+            summary: summarizeReportFiles(filtered.files),
+        }
+        : report;
+    if (advisoryReport.summary.unsuppressed === 0)
         return undefined;
-    const files = report.files.filter((file) => file.warnings.some((warning) => !warning.suppressed));
+    const files = advisoryReport.files.filter((file) => file.warnings.some((warning) => !warning.suppressed));
     const fileList = files
         .slice(0, 5)
         .map((file) => `  ${file.displayPath}: ${file.warnings.filter((warning) => !warning.suppressed).length}${file.reVerifyIncomplete ? " (re-verify incomplete)" : ""}`)
         .join("\n");
     const more = files.length > 5 ? `\n  ... and ${files.length - 5} more file(s)` : "";
-    const safe = report.summary.autoFixEligible > 0
-        ? ` ${report.summary.autoFixEligible} appear to have conservative preferred quickfixes.`
+    const safe = advisoryReport.summary.autoFixEligible > 0
+        ? ` ${advisoryReport.summary.autoFixEligible} appear to have conservative preferred quickfixes.`
         : "";
     // #1777: hint and info are style opinions, so say how much of the count is
     // opinion. The line appears only when a quiet tier is actually present —
     // an all-warning turn already says everything in the count above.
-    const byTier = report.summary.byTier;
+    const byTier = advisoryReport.summary.byTier;
     const quiet = byTier ? byTier.hint + byTier.info : 0;
     const tierLine = quiet > 0
         ? `${quiet} of those are hint/info tier — style opinions, worth fixing only while you are already in that code.`
@@ -1580,7 +1593,10 @@ export function formatActionableWarningsAdvisory(report, cwd, host = "pi") {
     // defensive only.
     const diagnosticsTool = resolveLensToolName("lens_diagnostics", host);
     return [
-        `🟡 Fixable warnings introduced this turn: ${report.summary.unsuppressed}.${safe}`,
+        `🟡 Fixable warnings introduced this turn: ${advisoryReport.summary.unsuppressed}.${safe}`,
+        filtered && filtered.suppressed > 0
+            ? `suppressed by disposition: ${filtered.suppressed} finding(s).`
+            : undefined,
         tierLine,
         diagnosticsTool
             ? `Use ${diagnosticsTool} with mode=delta to inspect these warnings.`

package/node_modules/pi-lens/dist/clients/advisory-provenance.js

@@ -248,25 +248,39 @@ const MAX_LOGGED_DEAD_PATHS = 3;
  * truth for the measured skew.
  */
 export function findingPathFreshness(resolvedPath, scannedAtMs) {
+    return freshnessFromFacts(statFindingPath(resolvedPath), scannedAtMs);
+}
+/** The one filesystem touch. Injectable via `probePath` so rules stay testable. */
+function statFindingPath(resolvedPath) {
     try {
-        const stat = fs.statSync(resolvedPath);
-        // No scan timestamp recorded: the pre-kernel behavior treated the
-        // path as live (no reference to be stale against) - preserved.
-        if (scannedAtMs === undefined)
-            return "live";
-        const verdict = freshnessFromMtime({
-            mtimeMs: stat.mtimeMs,
-            referenceMs: scannedAtMs,
-        });
-        return verdict.verdict === "stale" ? "stale" : "live";
+        return { state: "present", mtimeMs: fs.statSync(resolvedPath).mtimeMs };
     }
     catch (error) {
         const code = error.code ?? "unknown";
         // ENOTDIR: an ancestor component is no longer a directory — the cited
         // path cannot exist either, same as ENOENT.
-        return code === "ENOENT" || code === "ENOTDIR" ? "missing" : "unknown";
+        return code === "ENOENT" || code === "ENOTDIR"
+            ? { state: "missing" }
+            : { state: "unknown" };
     }
 }
+/** Pure: one store's verdict for one path's facts. No filesystem, no policy. */
+function freshnessFromFacts(facts, scannedAtMs) {
+    if (facts.state === "missing")
+        return "missing";
+    if (facts.state === "unknown")
+        return "unknown";
+    // No scan timestamp recorded: the pre-kernel behavior treated the path as
+    // live (no reference to be stale against) - preserved.
+    if (scannedAtMs === undefined)
+        return "live";
+    return freshnessFromMtime({
+        mtimeMs: facts.mtimeMs,
+        referenceMs: scannedAtMs,
+    }).verdict === "stale"
+        ? "stale"
+        : "live";
+}
 /** Existence-only probe. Retained for callers that have no scan timestamp. */
 export function findingPathExistence(resolvedPath) {
     return findingPathFreshness(resolvedPath);
@@ -294,8 +308,17 @@ export function parseScannedAtMs(scannedAt) {
  * every later turn, which is the very defect this gate exists to close.
  */
 export function partitionFindingsByCitedPath(args) {
-    const limit = args.maxUniquePaths ?? MAX_FINDING_PATH_STATS;
-    const probe = args.existence ?? findingPathFreshness;
+    return partitionOneSource({ ...args, store: args.store ?? "" }, createPathFactsMemo(args));
+}
+function createPathFactsMemo(args) {
+    return {
+        facts: new Map(),
+        probe: args.probePath ?? statFindingPath,
+        limit: args.maxUniquePaths ?? MAX_FINDING_PATH_STATS,
+        starved: new Map(),
+    };
+}
+function partitionOneSource(args, memo) {
     const scannedAtMs = parseScannedAtMs(args.scannedAt);
     const onMissing = args.onMissing ?? "drop";
     // Two dedup layers, cheapest first. `rawVerdicts` collapses findings that
@@ -303,19 +326,24 @@ export function partitionFindingsByCitedPath(args) {
     // (#1460's live record: 126 findings over a handful of distinct `file`
     // strings). Only a raw string not seen before pays for
     // `resolveRunnerPath`/`advisoryPathKey`, which folds FS-confirmed spelling
-    // variants (case, separators, ancestor walk-up) into `verdicts`, the
+    // variants (case, separators, ancestor walk-up) into `memo.facts`, the
     // canonical-key map that `statCount` reports. Keying the expensive work by
     // the RESOLVED path instead of the raw one (the pre-#1461-HIGH-2 shape)
     // still called it once per finding, since the dedup lookup came after the
     // cost it was meant to dedupe.
+    //
+    // `rawVerdicts` is per SOURCE (the verdict is this store's), `memo.facts` is
+    // per DELIVERY (the stat is nobody's). #1892.
     const rawVerdicts = new Map();
-    const verdicts = new Map();
     const live = [];
     const stale = [];
     const dropped = [];
     const deadPaths = [];
     const stalePaths = [];
-    let truncated = false;
+    const seenPaths = new Set();
+    // This SOURCE's own probes. A memo hit costs nothing, so an earlier source
+    // having paid for a path only ever helps this one (#3264 review F2).
+    let probed = 0;
     for (const finding of args.findings) {
         const cited = args.citedPath(finding);
         if (!cited) {
@@ -332,30 +360,37 @@ export function partitionFindingsByCitedPath(args) {
             // `normalizeMapKey`, so the resolved path IS the canonical key — a
             // second `advisoryPathKey` pass would re-pay the same realpath cost.
             const resolved = resolveRunnerPath(args.cwd, cited);
-            const key = resolved;
-            verdict = verdicts.get(key);
-            if (verdict === undefined) {
-                if (verdicts.size >= limit) {
-                    // Budget spent on paths we have not seen before — deliver rather
-                    // than guess. Already-probed paths keep their cached verdict.
-                    truncated = true;
-                    verdict = "live";
+            let facts = memo.facts.get(resolved);
+            if (facts === undefined) {
+                if (probed >= memo.limit) {
+                    // Allowance spent on paths nobody in this delivery has seen —
+                    // deliver rather than guess, exactly as the pre-fold per-lane cap
+                    // did. Guessing a verdict for a path nobody looked at is the worse
+                    // error; what the fold adds is that the guess is now RECORDED.
+                    memo.starved.set(args.store, (memo.starved.get(args.store) ?? 0) + 1);
+                    facts = { state: "unknown" };
                 }
                 else {
-                    verdict = probe(resolved, scannedAtMs);
-                    // A store that treats deletion as evidence-loss rather than
-                    // remediation-loss folds `missing` into the demote arm here, so
-                    // every downstream list and record sees one consistent verdict.
-                    if (verdict === "missing" && onMissing === "demote") {
-                        verdict = "stale";
-                    }
-                    verdicts.set(key, verdict);
-                    if (verdict === "missing")
-                        deadPaths.push(resolved);
-                    else if (verdict === "stale")
-                        stalePaths.push(resolved);
+                    probed += 1;
+                    facts = memo.probe(resolved);
+                    memo.facts.set(resolved, facts);
                 }
             }
+            verdict = freshnessFromFacts(facts, scannedAtMs);
+            // A store that treats deletion as evidence-loss rather than
+            // remediation-loss folds `missing` into the demote arm here, so
+            // every downstream list and record sees one consistent verdict. It is
+            // applied per SOURCE, after the shared lookup: `onMissing` is this
+            // store's policy and must never be cached into another store's answer.
+            if (verdict === "missing" && onMissing === "demote")
+                verdict = "stale";
+            if (!seenPaths.has(resolved)) {
+                seenPaths.add(resolved);
+                if (verdict === "missing")
+                    deadPaths.push(resolved);
+                else if (verdict === "stale")
+                    stalePaths.push(resolved);
+            }
             rawVerdicts.set(cited, verdict);
         }
         if (verdict === "missing")
@@ -371,8 +406,8 @@ export function partitionFindingsByCitedPath(args) {
         dropped,
         deadPaths,
         stalePaths,
-        statCount: verdicts.size,
-        truncated,
+        statCount: memo.facts.size,
+        truncated: (memo.starved.get(args.store) ?? 0) > 0,
     };
 }
 /**
@@ -386,32 +421,93 @@ export function partitionFindingsByCitedPath(args) {
 export function dropFindingsForMissingPaths(args) {
     // No `scannedAt` — existence-only, so `partition.stale` is always empty.
     const partition = partitionFindingsByCitedPath(args);
-    emitDeadPathDropRecord(args.store, args.cwd, partition);
+    emitDeadPathDropRecord(args.cwd, partition, {
+        [args.store]: partition.dropped.length,
+    });
     return partition.live;
 }
 /**
- * Delivery-seam wrapper with the #1622 freshness verdict. Emits at most one
- * `finding_dead_path_drop` and one `finding_stale_line_demote` record per store
- * per delivery, each with a capped path sample; never one per finding.
+ * Delivery-seam wrapper with the #1622 freshness verdict, over one or more
+ * stores at once. The store name is the KEY of `sources`, and it is also the
+ * finding's source identity inside the gate: every store's `scannedAt` and
+ * `onMissing` decide that store's findings and only that store's.
+ *
+ * #1892: the three turn-end scanner lanes used to call this once each, so one
+ * file cited by gitleaks AND trivy-secrets was stat'd twice, spent two separate
+ * stat budgets, and wrote two `finding_stale_line_demote` rows for ONE decision.
+ * Passing them together makes the filesystem pass shared and the record one per
+ * delivery, without letting one store's clean/stale/missing answer speak for
+ * another's — the two directions this seam has to keep apart.
  *
  * Callers that have no scan timestamp keep using `dropFindingsForMissingPaths`.
  */
 export function gateFindingsByPathFreshness(args) {
-    const partition = partitionFindingsByCitedPath(args);
-    emitDeadPathDropRecord(args.store, args.cwd, partition);
-    emitStaleLineDemoteRecord(args.store, args.cwd, args.scannedAt, partition);
-    return { live: partition.live, stale: partition.stale };
+    const memo = createPathFactsMemo(args);
+    // Sorted, not literal order: which source pays for a shared path, and the
+    // order stores appear in the records, must not depend on how the CALLER
+    // happened to write the object (#3264 review F2).
+    const names = Object.keys(args.sources).sort((a, b) => a < b ? -1 : a > b ? 1 : 0);
+    const gates = {};
+    const dropped = {};
+    const demoted = {};
+    const merged = {
+        live: [],
+        stale: [],
+        dropped: [],
+        deadPaths: [],
+        stalePaths: [],
+        statCount: 0,
+        truncated: false,
+    };
+    const scannedAtByStore = {};
+    for (const name of names) {
+        const source = args.sources[name];
+        const partition = partitionOneSource({ ...source, store: name, cwd: args.cwd }, memo);
+        gates[name] = { live: partition.live, stale: partition.stale };
+        if (partition.dropped.length > 0)
+            dropped[name] = partition.dropped.length;
+        if (partition.stale.length > 0)
+            demoted[name] = partition.stale.length;
+        if (source.scannedAt !== undefined) {
+            scannedAtByStore[name] = String(source.scannedAt);
+        }
+        merged.live.push(...partition.live);
+        merged.stale.push(...partition.stale);
+        merged.dropped.push(...partition.dropped);
+        for (const deadPath of partition.deadPaths) {
+            if (!merged.deadPaths.includes(deadPath))
+                merged.deadPaths.push(deadPath);
+        }
+        for (const stalePath of partition.stalePaths) {
+            if (!merged.stalePaths.includes(stalePath)) {
+                merged.stalePaths.push(stalePath);
+            }
+        }
+    }
+    merged.statCount = memo.facts.size;
+    merged.truncated = memo.starved.size > 0;
+    emitDeadPathDropRecord(args.cwd, merged, dropped);
+    emitStaleLineDemoteRecord(args.cwd, scannedAtByStore, merged, demoted);
+    emitStatBudgetRecord(args.cwd, memo);
+    return gates;
 }
-function emitDeadPathDropRecord(store, cwd, partition) {
+/**
+ * `store` is the joined source names, so a single-source delivery still reads
+ * `store: "gitleaks"` exactly as it did pre-#1892; `byStore` is what makes the
+ * merged record discriminating — which store's findings this decision retired.
+ */
+function emitDeadPathDropRecord(cwd, partition, byStore) {
     if (partition.dropped.length === 0)
         return;
+    const stores = Object.keys(byStore);
     logLatency({
         type: "phase",
         phase: "finding_dead_path_drop",
         filePath: cwd,
         durationMs: 0,
         metadata: {
-            store,
+            store: stores.join("+"),
+            byStore,
             droppedDeadPaths: partition.dropped.length,
             deadPathCount: partition.deadPaths.length,
             deliveredCount: partition.live.length,
@@ -428,16 +524,22 @@ function emitDeadPathDropRecord(store, cwd, partition) {
  * path. Before this, a stale-line replay window was reconstructible only by
  * proxy — the blocker payload is written nowhere.
  */
-function emitStaleLineDemoteRecord(store, cwd, scannedAt, partition) {
+function emitStaleLineDemoteRecord(cwd, scannedAtByStore, partition, byStore) {
     if (partition.stale.length === 0)
         return;
+    // Only the stores that actually contributed to THIS decision are named, so
+    // `store` still reads `gitleaks` for a gitleaks-only demotion whether the
+    // delivery gated one store or three.
+    const stores = Object.keys(byStore);
+    const single = stores.length === 1 ? scannedAtByStore[stores[0]] : undefined;
     logLatency({
         type: "phase",
         phase: "finding_stale_line_demote",
         filePath: cwd,
         durationMs: 0,
         metadata: {
-            store,
+            store: stores.join("+"),
+            byStore,
             demotedStalePaths: partition.stale.length,
             stalePathCount: partition.stalePaths.length,
             deliveredCount: partition.live.length,
@@ -445,11 +547,45 @@ function emitStaleLineDemoteRecord(store, cwd, scannedAt, partition) {
             samplePaths: partition.stalePaths
                 .slice(0, MAX_LOGGED_DEAD_PATHS)
                 .map((stalePath) => toProjectRelativePath(stalePath, cwd)),
-            ...(scannedAt === undefined ? {} : { scannedAt: String(scannedAt) }),
+            // One store: the flat `scannedAt` field, unchanged. Several: the
+            // per-store map, because the whole point of the fold is that they
+            // differ — one flattened timestamp here would be the same authority
+            // collapse the gate refuses to make on the findings themselves.
+            ...(single === undefined ? {} : { scannedAt: single }),
+            ...(stores.length > 1
+                ? {
+                    scannedAtByStore: Object.fromEntries(stores.map((name) => [name, scannedAtByStore[name] ?? ""])),
+                }
+                : {}),
             ...(partition.truncated ? { truncated: true } : {}),
         },
     });
 }
+/**
+ * #3264 review F2: the drop and demote records both return early when nothing
+ * was dropped or demoted, so a delivery whose only casualty was the stat
+ * allowance — every starved finding failing OPEN, delivered at full severity
+ * against a path nobody looked at — wrote no row at all. This is that row: one
+ * per delivery, naming the cap and every source that hit it, never one per
+ * finding.
+ */
+function emitStatBudgetRecord(cwd, memo) {
+    if (memo.starved.size === 0)
+        return;
+    const stores = [...memo.starved.keys()].sort((a, b) => a < b ? -1 : a > b ? 1 : 0);
+    logLatency({
+        type: "phase",
+        phase: "finding_path_stat_budget_exhausted",
+        filePath: cwd,
+        durationMs: 0,
+        metadata: {
+            store: stores.join("+"),
+            byStore: Object.fromEntries(stores.map((name) => [name, memo.starved.get(name) ?? 0])),
+            maxUniquePaths: memo.limit,
+            statCount: memo.facts.size,
+        },
+    });
+}
 export function provenanceStamp(provenance) {
     if (!isWellFormed(provenance))
         return "session unknown / turn unknown / generation unknown";

package/node_modules/pi-lens/dist/clients/cache-manager.js

@@ -17,7 +17,7 @@ import * as fs from "node:fs";
 import * as path from "node:path";
 import { getProjectDataDir } from "./file-utils.js";
 import { writeFileAtomic } from "./atomic-write.js";
-import { readJsonCache } from "./json-cache-read.js";
+import { readJsonCache, readJsonCacheAsync } from "./json-cache-read.js";
 import { isUnderDir, normalizeMapKey } from "./path-utils.js";
 // --- Defaults ---
 const DEFAULT_MAX_AGE_MS = 30 * 60 * 1000; // 30 minutes
@@ -93,8 +93,69 @@ export class CacheManager {
         return state.files[key];
     }
     // ---- Scanner Cache ----
+    /**
+     * The ONE staleness rule both scanner reads apply (#3274): the envelope's
+     * age in ms when it is inside `maxAgeMs`, or `null` — having logged the
+     * stale verdict — when it is not.
+     *
+     * Extracted rather than copied into {@link readCacheAsync} because the TTL
+     * boundary is exactly what the two seams must not disagree about while
+     * #3300 migrates callers across: a delivery that read one store through
+     * each method would otherwise be able to see it fresh and stale at once.
+     */
+    freshAgeMs(scanner, meta, maxAgeMs) {
+        const age = Date.now() - new Date(meta.timestamp).getTime();
+        if (age > maxAgeMs) {
+            this.log(`Cache stale: ${scanner} (age: ${Math.round(age / 1000)}s, max: ${maxAgeMs / 1000}s)`);
+            return null;
+        }
+        return age;
+    }
+    /**
+     * Read a scanner cache entry WITHOUT blocking the event loop (#3274).
+     *
+     * `readCache` below is synchronous: two `existsSync` plus two
+     * `readFileSync`+`JSON.parse`, all of which complete during ARGUMENT
+     * EVALUATION. `bounded()` (`clients/deadline-utils.ts`) takes a promise, so
+     * a hook that wrapped the sync read registered a budget that could never be
+     * spent — probed on #3274 with an already-aborted signal and `ms: 0`:
+     * `bounded()` returned `undefined` and the read had already parsed its JSON.
+     * This sibling suspends on `fs.promises`, so the turn_end budget and the
+     * hook's `ctx.signal` can actually abandon it.
+     *
+     * Same outcomes as the sync seam — an envelope, or `null` for missing,
+     * stale, corrupt or unreadable — and the same parser
+     * (`readJsonCacheAsync`, the async sibling in `clients/json-cache-read.ts`;
+     * there is no second parser). ONE deliberate difference, in the verbose log
+     * only: a missing store is reported as `Cache miss: <scanner> — <err>` from
+     * the read's own ENOENT instead of a preceding `existsSync` pair, because
+     * the pair is half the blocking cost this method exists to remove.
+     */
+    async readCacheAsync(scanner, cwd, maxAgeMs = DEFAULT_MAX_AGE_MS) {
+        const cachePath = path.join(getCacheDir(cwd), `${scanner}.json`);
+        const metaPath = path.join(getCacheDir(cwd), `${scanner}.meta.json`);
+        const onReadError = (err) => {
+            this.log(`Cache miss: ${scanner} — ${err}`);
+        };
+        const meta = await readJsonCacheAsync(metaPath, (parsed) => parsed, onReadError);
+        if (meta === undefined)
+            return null;
+        const age = this.freshAgeMs(scanner, meta, maxAgeMs);
+        if (age === null)
+            return null;
+        const data = await readJsonCacheAsync(cachePath, (parsed) => parsed, onReadError);
+        if (data === undefined)
+            return null;
+        this.log(`Cache hit: ${scanner} (age: ${Math.round(age / 1000)}s)`);
+        return { data, meta };
+    }
     /**
      * Read a scanner cache entry. Returns null if not found or stale.
+     *
+     * Synchronous, and therefore unboundable on a hook path — see
+     * {@link readCacheAsync}, and the `sync-hook-read` population in
+     * `tests/config/hook-await-bounds.test.ts` that counts the callers still
+     * on it. #3300 migrates them and deletes this method in its last slice.
      */
     readCache(scanner, cwd, maxAgeMs = DEFAULT_MAX_AGE_MS) {
         const cachePath = path.join(getCacheDir(cwd), `${scanner}.json`);
@@ -110,11 +171,9 @@ export class CacheManager {
             const meta = readJsonCache(metaPath, (parsed) => parsed, onReadError);
             if (meta === undefined)
                 return null;
-            const age = Date.now() - new Date(meta.timestamp).getTime();
-            if (age > maxAgeMs) {
-                this.log(`Cache stale: ${scanner} (age: ${Math.round(age / 1000)}s, max: ${maxAgeMs / 1000}s)`);
+            const age = this.freshAgeMs(scanner, meta, maxAgeMs);
+            if (age === null)
                 return null;
-            }
             const data = readJsonCache(cachePath, (parsed) => parsed, onReadError);
             if (data === undefined)
                 return null;

package/node_modules/pi-lens/dist/clients/child-unref.js

@@ -11,12 +11,16 @@
  * new-code-duplication finding: two near-identical spawn→collect-stdout
  * blocks in `clients/resource-sampler.ts` collapsed to one shared helper).
  *
- * Deliberately has NO imports beyond `node:child_process` types, so both
+ * Deliberately has NO imports beyond `node:child_process` types and
+ * `spawn-output-cap.ts` (itself import-free, #3383), so both
  * `clients/instance-reaper.ts` and `clients/resource-sampler.ts` (which
  * `clients/safe-spawn.ts` itself depends on) can import this without risking
- * a circular-import chain.
+ * a circular-import chain. That is also why the output bound below reports
+ * nothing to the degradation ledger: importing the ledger here would put
+ * `safe-spawn.ts`'s own dependency above it in the graph.
  */
 import { spawn as nodeSpawn } from "node:child_process";
+import { createBoundedOutputSink } from "./spawn-output-cap.js";
 /**
  * Detach a best-effort, fire-and-forget child process from the event loop.
  *
@@ -64,13 +68,18 @@ export function spawnCollectStdoutResult(command, args, options, collectOptions
         try {
             const child = nodeSpawn(command, args, options);
             unrefChildAndPipes(child);
-            let out = "";
-            child.stdout?.on("data", (chunk) => {
-                out += chunk.toString();
-            });
+            // #3383: bounded, not `out += chunk`. The producer is a process-table
+            // query (`ps`, `wmic`, `powershell`) whose output nothing else limits,
+            // and the concatenation runs inside a `data` handler where V8's
+            // `RangeError: Invalid string length` would be an uncaught exception
+            // rather than this promise's result. A truncated table is the ending
+            // this contract already documents for a timed-out child: whatever was
+            // kept is parsed, and the caller reads `status`.
+            const out = createBoundedOutputSink();
+            child.stdout?.on("data", (chunk) => out.append(chunk));
             child.once("error", (error) => settle({ stdout: "", status: "spawn-error", error }));
             child.once("close", (code, signal) => settle(code === 0 && signal === null
-                ? { stdout: out, status: "ok" }
+                ? { stdout: out.text, status: "ok" }
                 : {
                     stdout: "",
                     status: "exit-error",
@@ -83,7 +92,7 @@ export function spawnCollectStdoutResult(command, args, options, collectOptions
                     // Settle only AFTER the child's fate is known. Killing and
                     // resolving in the same tick bounds the caller and abandons the
                     // child, which is the leak this timeout exists to prevent.
-                    void terminateTimedOutChild(child, collectOptions.onTimeout).then((timeoutKill) => settle({ stdout: out, status: "timeout", timeoutKill }));
+                    void terminateTimedOutChild(child, collectOptions.onTimeout).then((timeoutKill) => settle({ stdout: out.text, status: "timeout", timeoutKill }));
                 }, timeoutMs);
                 timer.unref();
             }

package/node_modules/pi-lens/dist/clients/config-diagnostic-codes.js

@@ -173,6 +173,8 @@ export const CONFIG_DIAGNOSTIC_CODES = {
     PILENS_CFG_0008: "config resolution failed; whole configuration ignored",
     /** A tool key is unknown or names a required, non-disableable tool. */
     PILENS_CFG_0009: "unknown or non-disableable tool config key ignored",
+    /** A lower-precedence supported global config file was shadowed by the winner. */
+    PILENS_CFG_0010: "lower-precedence global config file shadowed",
 };
 /** The shape every code in the namespace must match. */
 export const CONFIG_DIAGNOSTIC_CODE_PATTERN = /^PILENS_CFG_\d{4}$/;