@herbertgao/pi-extensions 2026.9.15 → 2026.9.16

package/node_modules/pi-lens/dist/clients/formatters.js

@@ -1823,7 +1823,10 @@ export function clearFormatterRuntimeState() {
     // is `session_start`'s block in runtime-session.ts.
 }
 const BOX_DRAWING_GLOBAL = /[\u2500-\u257F]/g;
-const HAS_BOX_DRAWING = /[\u2500-\u257F]/;
+/** Blank, or a rule made of box-drawing characters and spacing alone. */
+const DECORATION_RULE = /^[\u2500-\u257F\s]*$/;
+/** The renderer's section heading: one word, then box-drawing to end of line. */
+const DECORATION_HEADING = /^\S+[ \t]+[\u2500-\u257F][\u2500-\u257F\s]*$/;
 /**
  * First line of `text` that actually carries a diagnostic.
  *
@@ -1839,18 +1842,53 @@ const HAS_BOX_DRAWING = /[\u2500-\u257F]/;
 export function firstDiagnosticLine(text) {
     for (const raw of (text ?? "").split("\n")) {
         const line = stripAnsi(raw).trimEnd();
-        const stripped = line.replace(BOX_DRAWING_GLOBAL, "").trim();
-        if (!stripped)
+        if (isDecorativeLine(line))
             continue;
-        // "format ━━━━━━━━" is a section banner, not a diagnostic. Require a rule
-        // AND a short remainder so a real one-line error containing a box
-        // character is not discarded.
-        if (HAS_BOX_DRAWING.test(line) && stripped.length <= 24)
-            continue;
-        return stripped.slice(0, 300);
+        return line.replace(BOX_DRAWING_GLOBAL, "").trim().slice(0, 300);
     }
     return undefined;
 }
+/**
+ * The two decoration SHAPES a renderer emits, and nothing else: a rule made of
+ * box-drawing characters alone (blank lines included), and a `<word> ━━━━`
+ * section heading whose remainder after the word is box-drawing only.
+ *
+ * The single normalization both readers above and below share, so the bounded
+ * tail cannot surface what the first-line reader already rejects (#3312 review
+ * R3-4: the tail put biome's `format ━━━━` banner back in front of the strict
+ * #1337 seam). Matching SHAPES rather than "contains a box character and is
+ * short" is #3312 review R4-1: the length heuristic deleted
+ * `━ traceback source excerpt`, a diagnostic whose own text opens with a box
+ * character. A line carrying any non-decorative text is never decoration.
+ */
+function isDecorativeLine(line) {
+    return DECORATION_RULE.test(line) || DECORATION_HEADING.test(line);
+}
+const FORMATTER_ERROR_TAIL_LINES = 20;
+/**
+ * Preserve a bounded tail of a formatter's diagnostic output.
+ *
+ * A traceback's first line is not actionable on its own (#3312). Keep the
+ * final lines, which include the exception and its message, while bounding
+ * the model-facing error when a formatter emits an unexpectedly large log.
+ *
+ * Decorative lines are dropped FIRST, by the same predicate `firstDiagnosticLine`
+ * uses: a tail that kept them would hand the strict #1337 seam the banner this
+ * module already decided is not a diagnostic, and every banner line it kept
+ * would evict a real traceback line from the bound.
+ */
+export function diagnosticTail(text, maxLines = FORMATTER_ERROR_TAIL_LINES) {
+    const lines = [];
+    for (const raw of (text ?? "").split("\n")) {
+        const line = stripAnsi(raw).trimEnd();
+        if (isDecorativeLine(line))
+            continue;
+        lines.push(line.slice(0, 300));
+    }
+    if (lines.length === 0)
+        return undefined;
+    return lines.slice(-maxLines).join("\n");
+}
 /**
  * Resolve a formatter command without allowing the static command fallback to
  * bypass a resolver's style-preservation refusal (#1345). `null` means the
@@ -1963,11 +2001,11 @@ export async function formatFile(filePath, formatter) {
                 changed: false,
                 outcome: "failed",
                 error: result.error?.message ||
-                    firstDiagnosticLine(result.stderr) ||
+                    diagnosticTail(result.stderr) ||
                     // biome, ktlint and `mix format` report on STDOUT; without this
                     // their diagnostic is discarded and the user is told only that
                     // the tool "exited with status 1".
-                    firstDiagnosticLine(result.stdout) ||
+                    diagnosticTail(result.stdout) ||
                     `${formatter.name} exited with status ${result.status}`,
             };
         }

package/node_modules/pi-lens/dist/clients/git-guard.js

@@ -32,31 +32,132 @@ function capAffectedFiles(files, cwd) {
         truncated: unique.length > MAX_ADVISORY_AFFECTED_FILES,
     };
 }
-/** Recovery is safe only when blocker content and its file provenance agree. */
-function hasCompleteBlockingProvenance(blockerContent, blockingFiles, cwd) {
+/**
+ * The turn-end composer's per-file attribution line
+ * (`clients/runtime-turn.ts:1085`). The optional suppression notice carries its
+ * own `": "`, so this shape is tried BEFORE the per-edit one below — otherwise
+ * everything up to `disposition` reads as the file name (#3282 F5).
+ */
+const TURN_END_BLOCKER_SECTION = /^Unresolved from this turn — ([^\s].*?)(?: \(suppressed by disposition: \d+ finding\(s\)\))?:$/;
+/**
+ * The file a line of `blockerContent` ATTRIBUTES a new blocker section to, or
+ * `undefined` when the line is rendered body that attributes nothing.
+ *
+ * Exactly the two shapes the two writers emit, and nothing else:
+ *
+ * - `<path>: <text>` at column 0 — `syncGitGuardRecord`'s own join below;
+ * - `Unresolved from this turn — <path>[ (suppressed by disposition: N
+ *   finding(s))]:` — the turn-end composer's blocker section header.
+ *
+ * Both writers render the blocker BODY with `formatDiagnostics(…, "blocking")`
+ * (`clients/dispatch/utils/format-utils.ts:29`), which indents every line it
+ * emits — the `  L<n>: <message>` diagnostics, their `    💡 Fix:` lines, the
+ * `  ... and N more` tail, and the two-space continuations of a multi-line
+ * message. The leading-whitespace test is therefore what separates body from
+ * attribution, and it is why #3282 happened: a line-by-line parse read
+ * `  L1: alpha is unsafe` as a file named `L1`.
+ */
+function blockerSectionFile(line) {
+    const turnEndSection = TURN_END_BLOCKER_SECTION.exec(line);
+    if (turnEndSection)
+        return turnEndSection[1];
+    if (/^\s/.test(line))
+        return undefined;
+    const separator = line.indexOf(": ");
+    if (separator <= 0)
+        return undefined;
+    return line.slice(0, separator);
+}
+/**
+ * The path key of every blocker SECTION `blockerContent` attributes, or
+ * `undefined` when the text cannot be attributed at all.
+ *
+ * `blockerContent` is a sequence of per-file blocker SECTIONS: an attribution
+ * line, then the rendered body it owns, up to the next attribution line or the
+ * composer's `"\n\n"` part separator (`clients/runtime-turn.ts:4291`). The one
+ * consumer is `clearedLastKnownBlocker` below, which drops `blockerContent`
+ * when the file that just dispatched clean was the last entry in
+ * `blockingFiles` — sound only if `blockingFiles` accounts for the WHOLE of
+ * that text.
+ *
+ * Named recurrences, both live:
+ *
+ * - #3282: the writers render MULTI-LINE blocker text and a line-by-line parse
+ *   judged every such record untrusted, so the first blocker of a session
+ *   latched `blocking_provenance_untrusted` and refused every later commit —
+ *   including after the agent fixed it.
+ * - #1561: a section for a file `blockingFiles` omits must keep the gate
+ *   closed, and so must a section no file owns at all. `blockerParts` is
+ *   multi-lane — the trivy CRITICAL report (`clients/runtime-turn.ts:2141`),
+ *   knip (`:2147`), the secrets lane (`:2099`) and cascade (`:1340`) each push
+ *   sections belonging to no file — and clearing one of those on a clean
+ *   dispatch of the file beside it would drop a live CVE or leaked secret out
+ *   of the commit gate. That is the fail-closed direction, and the reason an
+ *   unattributable line answers `unknown` rather than being swallowed.
+ *
+ * The rule is one-directional on purpose — every SECTION is owned, and
+ * `blockingFiles` may name more. Demanding a bijection was #3282's second
+ * cause: the composer writes `blockingFiles: affectedFiles`
+ * (`clients/runtime-turn.ts:4292`), which carries every file the turn touched
+ * plus every cascade neighbour with diagnostics, while only the files with a
+ * surviving blocker get a section — so any turn that edited a second file was
+ * judged untrusted for the rest of the session. The extra direction also
+ * guarded nothing: the one consumer clears only when `blockingFiles` has
+ * shrunk to the single file that just dispatched clean, and every section is
+ * then that file's by this rule. For the same reason a duplicate section and a
+ * duplicate `blockingFiles` entry need no clause of their own: neither can make
+ * the clear drop a blocker some other file owns. An all-blank `blockerContent`
+ * is NOT in that company — round 1 claimed it was, and the section-count guard
+ * below is why (HIGH-3287-1).
+ */
+function blockingProvenance(blockerContent, blockingFiles, cwd) {
     if (typeof blockerContent !== "string" || blockerContent.length === 0)
-        return false;
-    if (!Array.isArray(blockingFiles) || blockingFiles.length === 0)
-        return false;
+        return undefined;
+    // `Array.isArray` only: a non-empty `blockingFiles` is not a separate
+    // requirement (MEDIUM-3287-2, mutation M11 — it stayed green across the whole
+    // seam suite). With at least one section required below, an empty
+    // `blockingFiles` cannot satisfy the ownership test either way, so the clause
+    // decided nothing; the entry type check under it still does, and has its own
+    // red (M8).
+    if (!Array.isArray(blockingFiles))
+        return undefined;
     if (blockingFiles.some((file) => typeof file !== "string" || file.trim().length === 0)) {
-        return false;
+        return undefined;
     }
     const provenanceKeys = blockingFiles.map((file) => guardPathKey(file, cwd));
-    if (new Set(provenanceKeys).size !== provenanceKeys.length)
-        return false;
-    const blockerKeys = blockerContent.split("\n").map((line) => {
-        const separator = line.indexOf(": ");
-        if (separator <= 0)
-            return undefined;
-        const file = line.slice(0, separator).trim();
-        return file.length > 0 ? guardPathKey(file, cwd) : undefined;
-    });
-    if (blockerKeys.some((key) => key === undefined))
-        return false;
-    const uniqueBlockerKeys = new Set(blockerKeys);
-    return (uniqueBlockerKeys.size === blockerKeys.length &&
-        uniqueBlockerKeys.size === provenanceKeys.length &&
-        [...uniqueBlockerKeys].every((key) => provenanceKeys.includes(key)));
+    const sectionKeys = [];
+    let inSection = false;
+    for (const line of blockerContent.split("\n")) {
+        // A ZERO-LENGTH line only: the composer's part separator. A
+        // whitespace-only line is how `formatDiagnostics` renders a blank line
+        // inside a multi-line diagnostic message, and it is body (#3282 F13).
+        if (line.length === 0) {
+            inSection = false;
+            continue;
+        }
+        const file = blockerSectionFile(line);
+        if (file === undefined) {
+            // Body of the open section, or — with no section open — text that no
+            // entry of `blockingFiles` can be held responsible for.
+            if (!inSection)
+                return undefined;
+            continue;
+        }
+        sectionKeys.push(guardPathKey(file, cwd));
+        inSection = true;
+    }
+    // No line opened a section, so there is nothing for `blockingFiles` to be
+    // checked against and nothing a per-file dispatch may claim authority over.
+    // All-blank-but-non-empty text lands here (HIGH-3287-1, round 1's fail-open):
+    // `[].every(…)` is vacuously true, so treating zero sections as "nothing left
+    // to attribute" let a clean dispatch of an unrelated file DELETE a record
+    // whose `blockingFiles` named a different file, and the gate then answered
+    // `no_record`. Unattributed is not clean.
+    if (sectionKeys.length === 0)
+        return undefined;
+    return sectionKeys.every((key) => provenanceKeys.includes(key))
+        ? sectionKeys
+        : undefined;
 }
 function getShellCommand(input) {
     if (!input || typeof input !== "object")
@@ -669,8 +770,53 @@ export function retireInlineBlockerAndResyncGuard(args) {
     }
     return true;
 }
+/**
+ * Bring the commit-gate LATCH back in line with the turn-end disposition
+ * policy (#3248), at the point where the post-policy survivor set per file is
+ * final.
+ *
+ * The defect this exists for: the agent marks every blocker on a file
+ * `false-positive`, the turn-end composer renders no `Unresolved from this
+ * turn` section and no `🔴 STOP` — and `lens-guard` still blocks the commit,
+ * because `evaluateGitGuard` reads the LATCH first and the latch counted the
+ * still-present map entry. The blocker record stays in the map on purpose: the
+ * policy is content-bound and re-derived every turn end, so retiring the entry
+ * would be silencing rather than filtering (AGENTS.md shape 10). It carries
+ * the verdict instead, and the two gate derivations honor it — this latch, and
+ * `syncGitGuardRecord`'s persisted `blockerContent` below.
+ *
+ * The persisted record needs no third writer here. The composer that calls
+ * this rewrites it later in the SAME turn end from the same survivor set —
+ * `writeGitGuardRecord` with `hasBlockers` derived from the surviving blocker
+ * sections (`clients/runtime-turn.ts:4287`, and the dedupe path at `:4231`),
+ * or `clearCache("turn-end-findings")` when nothing survives
+ * (`clients/runtime-turn.ts:4379`) — and that clear is itself gated on the
+ * latch this call just recomputed. Adding a second durable writer between them
+ * would only race the one that already owns the record.
+ *
+ * Colocated with the gate rather than inlined at the wiring site, for the same
+ * reason `retireInlineBlockerAndResyncGuard` is: the claim is testable without
+ * booting the extension.
+ */
+export function resyncGitGuardAfterInlinePolicy(args) {
+    const changed = args.runtime.applyInlineBlockerPolicyVerdicts(args.suppressedFilePaths);
+    // Nothing left the gate's view of the map and nothing rejoined it. This is
+    // what keeps the recompute off every ordinary turn end: `updateGitGuardStatus`
+    // re-derives the latch from the map, and a turn that changed no verdict has
+    // no business re-deriving anything.
+    if (args.suppressedFilePaths.length === 0 && changed === 0)
+        return;
+    // Exactly as the retire path re-derives it: `false` is this caller's own
+    // contribution, never a blanket clear — a sibling file's surviving blocker
+    // is still in the map and still sets the latch.
+    args.runtime.updateGitGuardStatus(false, "");
+}
 export function syncGitGuardRecord(runtime, cacheManager, cwd, editedFilePath) {
-    const entries = runtime.getInlineBlockersSnapshot?.() ?? [];
+    // #3248: a record the turn-end policy fully suppressed is not a blocker the
+    // commit gate may persist — the agent was shown nothing for it. The entry
+    // stays in the map so the next turn re-derives the verdict from current
+    // bytes; it just stops speaking for the gate.
+    const entries = (runtime.getInlineBlockersSnapshot?.() ?? []).filter((entry) => !entry.policySuppressed);
     const inspection = cacheManager.inspectCache("turn-end-findings", cwd);
     const existing = cacheRecord(cacheManager, cwd);
     if (existing &&
@@ -689,10 +835,10 @@ export function syncGitGuardRecord(runtime, cacheManager, cwd, editedFilePath) {
     }
     const inlineFiles = entries.map((entry) => resolveGuardPath(entry.filePath, cwd));
     const existingBlockingFiles = existing?.blockingFiles ?? [];
-    const provenanceComplete = existing?.blockerContent
-        ? hasCompleteBlockingProvenance(existing.blockerContent, existingBlockingFiles, cwd)
-        : true;
-    if (existing?.blockerContent && !provenanceComplete) {
+    const blockerSections = existing?.blockerContent
+        ? blockingProvenance(existing.blockerContent, existingBlockingFiles, cwd)
+        : undefined;
+    if (existing?.blockerContent && !blockerSections) {
         markCacheUnknown(runtime, "blocking_provenance_untrusted");
         return;
     }
@@ -711,16 +857,22 @@ export function syncGitGuardRecord(runtime, cacheManager, cwd, editedFilePath) {
             affectedFiles = affectedFiles.filter((file) => guardPathKey(file, cwd) !== editedKey);
         }
     }
-    // A clean per-file dispatch is authoritative for that file. When the
-    // persisted record has explicit blocking-file provenance and the last such
-    // file just reconciled clean, retaining blockerContent would resurrect a
-    // stale blocker on every later git-guard lookup. Records without that
-    // provenance remain fail-closed: they cannot be safely cleared here.
+    // A clean per-file dispatch is authoritative for that file. When every
+    // blocker section the persisted record still carries is THIS file's,
+    // retaining `blockerContent` would resurrect a blocker the dispatch just
+    // cleared on every later git-guard lookup. Records whose text cannot be
+    // attributed remain fail-closed: they returned above.
+    //
+    // The question is asked of the SECTIONS, not of `blockingFiles` (#3282): the
+    // turn-end composer persists `blockingFiles: affectedFiles`
+    // (`clients/runtime-turn.ts:4292`) — every file the turn touched, blocking or
+    // not — so "the list has shrunk to nothing" never became true for a turn that
+    // edited a clean file alongside a blocking one, and the fixed blocker was
+    // quoted back at every commit for the rest of the session.
     const clearedLastKnownBlocker = !entries.length &&
         !!editedKey &&
-        provenanceComplete &&
-        existingBlockingFiles.length > 0 &&
-        remainingBlockingFiles.length === 0;
+        !!blockerSections &&
+        blockerSections.every((key) => key === editedKey);
     const blockerContent = entries.length > 0
         ? entries.map((entry) => `${entry.filePath}: ${entry.summary}`).join("\n")
         : clearedLastKnownBlocker
@@ -736,6 +888,13 @@ export function syncGitGuardRecord(runtime, cacheManager, cwd, editedFilePath) {
         .join("\n\n");
     if (!hasBlockers && !content) {
         cacheManager.clearCache("turn-end-findings", cwd);
+        // #3282 acceptance 5: this branch is a COMPLETE recomputation of the
+        // gate's state that happens to find nothing left to record, so it owns the
+        // unknown reason exactly as `writeGitGuardRecord` does (`:800`). Without
+        // this, a reason latched earlier in the session outlived the record it
+        // described and refused every commit after it, with no re-run able to
+        // clear it.
+        runtime.clearGitGuardCacheUnknown();
         return;
     }
     writeGitGuardRecord(cacheManager, runtime, cwd, {
@@ -820,6 +979,49 @@ export function clearGitGuardTestFailure(cacheManager, cwd, runtime, passedFiles
         fileContentHashes: {},
     });
 }
+/**
+ * The first suppression verdict in the blocker map that no longer describes the
+ * file it was computed against, if any (#3248 round 2, GG-3283-01).
+ *
+ * `policySuppressed` is a statement about BYTES: the turn-end policy read the
+ * file's current content, re-derived the record's blockers through the
+ * content-bound disposition anchors, and found every one of them suppressed. It
+ * is therefore only true while those bytes are still there. Everything that
+ * changes a file THROUGH pi-lens re-establishes the verdict on its own — a
+ * dispatch replaces the record wholesale, and the turn-end freshness sweep
+ * demotes a self-drifted record before the policy loop can suppress it, which
+ * clears the verdict. Bytes that move OUTSIDE dispatch (an external formatter, a
+ * `git checkout`, an editor write) trigger neither, and the commit gate can be
+ * reached with no turn end in between at all — so the gate, the one reader that
+ * can let a verdict OPEN a commit, confirms it here instead of trusting the
+ * latch memo.
+ *
+ * Unverifiable is not clean: a record whose dispatch could not fingerprint the
+ * file (`inlineBlockerFileContent` absent, `clients/pipeline.ts:1632`) carries
+ * nothing to confirm, so it fails CLOSED — the same rule
+ * `retireInlineBlockerOnConfirmedClean` applies to unknown provenance.
+ *
+ * Cost: nothing at all unless a verdict is live (the common case), then one
+ * read per suppressed record — on commit/push attempts, the path that already
+ * fingerprints every affected file below. A size/mtime fast path was written
+ * first and deleted: `fileFingerprint` decides the same question on its own, so
+ * the tiers were unmutatable branches, not guards. `fileFingerprint` also
+ * returns `"missing"`/`"unreadable:<code>"` rather than throwing, and neither
+ * can equal a recorded hash, so an unreadable file is expired too.
+ */
+function firstExpiredSuppressionVerdict(runtime) {
+    for (const entry of runtime.getInlineBlockersSnapshot?.() ?? []) {
+        if (!entry.policySuppressed)
+            continue;
+        if (entry.recordedHash === undefined) {
+            return { filePath: entry.filePath, tier: "no_baseline" };
+        }
+        if (fileFingerprint(entry.filePath) !== entry.recordedHash) {
+            return { filePath: entry.filePath, tier: "content" };
+        }
+    }
+    return undefined;
+}
 export function evaluateGitGuard(runtime, cacheManager, cwd, host = "pi") {
     // #2535 F3: a known tool with no mapping on this host resolves to
     // undefined — rephrase rather than naming a dead tool. `lens_diagnostics`
@@ -840,6 +1042,17 @@ export function evaluateGitGuard(runtime, cacheManager, cwd, host = "pi") {
             reason: `🔴 COMMIT BLOCKED (--lens-guard): unresolved blockers must be fixed before commit/push.${detail}\n${inspectLine}`,
         };
     }
+    // #3248 round 2 (GG-3283-01): the latch above is a MEMO of the last policy
+    // pass, and a pass can only speak for the bytes it read. A verdict whose file
+    // has moved since is no answer at all, so it must not be the reason this
+    // commit is allowed.
+    const expired = firstExpiredSuppressionVerdict(runtime);
+    if (expired) {
+        return unknown(cwd, "inline_policy_stale", {
+            file: expired.filePath,
+            tier: expired.tier,
+        });
+    }
     if (runtime.gitGuardCacheUnknownReason) {
         return unknown(cwd, runtime.gitGuardCacheUnknownReason);
     }

package/node_modules/pi-lens/dist/clients/gradle-ktfmt-style.js

@@ -1,5 +1,5 @@
 /**
- * ktfmt Gradle-plugin style carriage (#2468).
+ * ktfmt Gradle-plugin and Spotless style carriage (#2468/#2481).
  *
  * The `com.ncorti.ktfmt.gradle` plugin's `ktfmt { }` extension block lets a
  * project select `googleStyle()` or `kotlinLangStyle()` (verified against
@@ -9,17 +9,21 @@
  * `blockIndent`/`continuationIndent`/`trailingCommaManagementStrategy`, so a
  * body calling both is LAST-CALL-WINS, not first).
  *
- * None of this is read by ktfmt's own CLI from `build.gradle` — verified
- * against `ParsedArgs.kt` in `facebook/ktfmt` (now mirrored at
+ * Spotless uses a second DSL shape, `spotless { kotlin { ktfmt(...).googleStyle()
+ * } }`, with `kotlinlangStyle()` and `dropboxStyle()` as fluent methods.
+ *
+ * None of these selections are read by ktfmt's own CLI from `build.gradle` —
+ * verified against `ParsedArgs.kt` in `facebook/ktfmt` (now mirrored at
  * `Kotlin/ktfmt`) at tag v0.63, the exact version `clients/installer/
  * index.ts` pins for pi-lens's managed ktfmt install. That CLI accepts
  * `--google-style` / `--kotlinlang-style` (plus the default `--meta-style`)
  * — so the Gradle-declared choice has to be translated to the matching CLI
  * flag by something on our side; ktfmt itself never bridges `build.gradle`
- * to argv.
+ * to argv. Spotless's Dropbox style has no equivalent flag, so that case logs
+ * and falls back to bare ktfmt.
  *
  * Reuses the exact lexical pre-pass (`stripGradleCommentsAndStrings` /
- * `namedGradleBlockRanges`) that `clients/tool-policy.ts`'s
+ * `gradleBlockRanges`) that `clients/tool-policy.ts`'s
  * `getSpotlessKotlinFormatter` already applies to Gradle files, instead of a
  * second hand-rolled Gradle-block parser (#2468 AC) — same
  * single-source-of-truth reuse `clients/cargo-manifest.ts` did for TOML
@@ -57,6 +61,8 @@
  * - `subprojects { ktfmt { … } }` → DESCENDANT directories only, never the
  *   declaring one. `subprojects` configures the children and nothing else.
  * - `allprojects { ktfmt { … } }` → the declaring directory AND descendants.
+ * - `spotless { kotlin { … } }` excludes the Spotless DSL wrapper from scope
+ *   classification, while any outer project wrapper keeps its existing scope.
  * - anything else enclosing it — `configure(subprojects.filter { … }) { }`,
  *   `project(":app") { }`, `tasks.register(…) { }`, a convention-plugin
  *   wrapper, or more than one nested block — reaches NEITHER scope. pi-lens
@@ -81,6 +87,8 @@
 import * as os from "node:os";
 import * as path from "node:path";
 import { readTextFileOrUndefined } from "./cargo-manifest.js";
+import { incrementDegradationCount } from "./degradation-ledger.js";
+import { logExtension } from "./extension-log.js";
 import { findNearestMarkerRoot } from "./path-utils.js";
 import { gradleBlockRanges, stripGradleCommentsAndStrings, } from "./tool-policy.js";
 /** Nearest-first: a Kotlin script build file wins over its Groovy sibling. */
@@ -99,6 +107,8 @@ const KTFMT_GRADLE_ROOT_FILES = [
  * long before this.
  */
 const MAX_GRADLE_ANCESTOR_HOPS = 16;
+/** Bound malformed Spotless calls without rejecting ordinary nested arguments. */
+const MAX_SPOTLESS_KTFMT_CALL_CHARS = 4096;
 /** The CLI flags ktfmt v0.63 actually defines (`ParsedArgs.kt`, verified above). */
 const KTFMT_STYLE_CLI_FLAG = {
     google: "--google-style",
@@ -131,6 +141,46 @@ function styleFromKtfmtBlockBody(body) {
     }
     return style;
 }
+/** Find a bounded matching close parenthesis for a Spotless ktfmt call. */
+function findBalancedCallEnd(source, openingParen) {
+    let depth = 0;
+    const limit = Math.min(source.length, openingParen + MAX_SPOTLESS_KTFMT_CALL_CHARS);
+    for (let index = openingParen; index < limit; index += 1) {
+        if (source[index] === "(")
+            depth += 1;
+        if (source[index] !== ")")
+            continue;
+        depth -= 1;
+        if (depth === 0)
+            return index + 1;
+    }
+    return undefined;
+}
+/** Read a Spotless `ktfmt(...).style()` fluent chain from one kotlin body. */
+function styleFromSpotlessKotlinBody(body) {
+    let style;
+    for (const call of body.matchAll(/\bktfmt\s*(?=\()/g)) {
+        const callOpenParen = call.index + call[0].length;
+        const closeParen = findBalancedCallEnd(body, callOpenParen);
+        if (closeParen === undefined)
+            continue;
+        const chain = /^\s*((?:\.\s*(?:googleStyle|kotlinlangStyle|dropboxStyle)\s*\(\s*\)\s*)+)/.exec(body.slice(closeParen));
+        if (!chain)
+            continue;
+        const chainBody = chain[1];
+        if (!chainBody)
+            continue;
+        for (const method of chainBody.matchAll(/\.\s*(googleStyle|kotlinlangStyle|dropboxStyle)\s*\(\s*\)/g)) {
+            if (method[1] === "googleStyle")
+                style = "google";
+            if (method[1] === "kotlinlangStyle")
+                style = "kotlinlang";
+            if (method[1] === "dropboxStyle")
+                style = "spotless-dropbox-unsupported";
+        }
+    }
+    return style;
+}
 /**
  * The Gradle blocks whose scope is exactly expressible here. Every other
  * enclosing block — including one we simply have not heard of — is a scope
@@ -141,9 +191,9 @@ const SCOPE_BY_ENCLOSING_BLOCK = {
     allprojects: "both",
 };
 /**
- * Classify one `ktfmt { }` block by the block that encloses it.
+ * Classify one Gradle style block by the block that encloses it.
  *
- * `blocks` is every brace pair in the stripped source, so "enclosing" is
+ * `ranges` is every brace pair in the stripped source, so "enclosing" is
  * literal containment, not a guess from a name test: `range` strictly inside
  * `outer` means `outer.start < range.start` (an enclosing body always opens
  * before the body it contains) and `outer.end >= range.end`.
@@ -153,17 +203,49 @@ const SCOPE_BY_ENCLOSING_BLOCK = {
  * exactly the kind of build-script evaluation this lexical pass cannot do,
  * and the cost of the conservative answer is the pre-#2468 bare invocation.
  */
-function scopeOfKtfmtBlock(range, blocks) {
-    const enclosing = blocks.filter((outer) => outer.start < range.start && outer.end >= range.end);
+function scopeOfGradleStyleBlock(range, ranges) {
+    const enclosing = ranges.filter((outer) => outer.start < range.start && outer.end >= range.end);
     if (enclosing.length === 0)
         return "own";
     if (enclosing.length > 1)
         return undefined;
     return SCOPE_BY_ENCLOSING_BLOCK[enclosing[0].name];
 }
+function styleSelectionForGradleBlock(block, source, allBlockRanges, nonSpotlessRanges) {
+    if (block.name === "ktfmt") {
+        const scope = scopeOfGradleStyleBlock(block, allBlockRanges);
+        if (!scope)
+            return undefined;
+        const style = styleFromKtfmtBlockBody(source.slice(block.start, block.end));
+        return style ? { scope, style } : undefined;
+    }
+    if (block.name !== "kotlin")
+        return undefined;
+    const enclosingSpotless = [];
+    for (const outer of allBlockRanges) {
+        if (outer.name === "spotless" &&
+            outer.start < block.start &&
+            outer.end >= block.end) {
+            enclosingSpotless.push(outer);
+        }
+    }
+    if (enclosingSpotless.length !== 1)
+        return undefined;
+    const scope = scopeOfGradleStyleBlock(block, nonSpotlessRanges);
+    if (!scope)
+        return undefined;
+    const style = styleFromSpotlessKotlinBody(source.slice(block.start, block.end));
+    return style ? { scope, style } : undefined;
+}
 function stylesFromGradleContent(content) {
     const stripped = stripGradleCommentsAndStrings(content);
     const blocks = gradleBlockRanges(stripped);
+    // The Spotless block is the target DSL, not a project-scope wrapper.
+    const scopeRanges = [];
+    for (const range of blocks) {
+        if (range.name !== "spotless")
+            scopeRanges.push(range);
+    }
     const styles = {};
     // Source order, so a later block overwrites an earlier one for the scope
     // it reaches — the same last-call-wins rule that applies inside one body.
@@ -172,18 +254,13 @@ function stylesFromGradleContent(content) {
     // over a single slot, or the source order of unrelated scopes decides
     // which project gets the wrong flag.
     for (const range of blocks) {
-        if (range.name !== "ktfmt")
-            continue;
-        const scope = scopeOfKtfmtBlock(range, blocks);
-        if (!scope)
-            continue;
-        const style = styleFromKtfmtBlockBody(stripped.slice(range.start, range.end));
-        if (!style)
+        const selection = styleSelectionForGradleBlock(range, stripped, blocks, scopeRanges);
+        if (!selection)
             continue;
-        if (scope !== "descendants")
-            styles.own = style;
-        if (scope !== "own")
-            styles.descendants = style;
+        if (selection.scope !== "descendants")
+            styles.own = selection.style;
+        if (selection.scope !== "own")
+            styles.descendants = selection.style;
     }
     return styles;
 }
@@ -220,11 +297,11 @@ async function stylesForGradleDir(gradleDir) {
  *   the climb only continues past a gradle directory that declares NO style
  *   applying to this file, so nearest-wins is unchanged where a nearer
  *   declaration exists.
- * - Returns `undefined` on any miss (no gradle file found, no `ktfmt { }`
- *   block, or no recognized style call in one): callers fall back to their
- *   pre-existing default argv rather than guessing. `dropboxStyle()` — the
- *   call ktfmt-gradle removed in 0.19.0, never a ktfmt CLI flag — is just
- *   such a miss and never becomes a guessed flag.
+ * - Returns `undefined` on any miss (no gradle file found, no style block, or
+ *   no recognized style call): callers fall back to their pre-existing default
+ *   argv rather than guessing. Spotless `dropboxStyle()` is recognized as a
+ *   standalone-CLI limitation, records a bounded notice, and still falls back
+ *   without becoming a guessed flag.
  *
  * `homeDir` defaults to `os.homedir()` and exists as a parameter so tests can
  * inject a nearer ceiling and prove the guard actually stops a climb (mirrors
@@ -241,6 +318,25 @@ export async function resolveKtfmtGradleStyle(filePath, homeDir = os.homedir())
             return undefined;
         const styles = await stylesForGradleDir(gradleDir);
         const style = hop === 0 ? styles.own : styles.descendants;
+        if (style === "spotless-dropbox-unsupported") {
+            const reason = "Spotless ktfmt dropboxStyle(): pi-lens standalone CLI cannot express " +
+                "the style; falling back to bare ktfmt";
+            const firstOccurrence = incrementDegradationCount({
+                kind: "formatter-skip",
+                subject: "ktfmt:spotless-dropbox",
+                reason,
+                metadata: { filePath, gradleDir },
+            });
+            if (firstOccurrence) {
+                logExtension({
+                    subsystem: "format",
+                    level: "debug",
+                    message: reason,
+                    metadata: { filePath, gradleDir },
+                });
+            }
+            return undefined;
+        }
         if (style)
             return KTFMT_STYLE_CLI_FLAG[style];
         const parent = path.dirname(gradleDir);