@herbertgao/pi-extensions 2026.9.15 → 2026.9.16

package/node_modules/pi-lens/dist/clients/mcp/ipc.js

@@ -19,6 +19,8 @@ import * as net from "node:net";
 import * as os from "node:os";
 import * as path from "node:path";
 import { writeFileAtomic } from "../atomic-write.js";
+import { incrementDegradationCount } from "../degradation-ledger.js";
+import { DEFAULT_MAX_OUTPUT_BYTES } from "../spawn-output-cap.js";
 export const WARM_DIAGNOSTICS_SCHEMA_VERSION = 1;
 export const WARM_CODE_ACTION_LOOKUP_LIMIT = 6;
 /**
@@ -27,9 +29,9 @@ export const WARM_CODE_ACTION_LOOKUP_LIMIT = 6;
  * resolved root (lowercased for case-insensitive filesystems), so when they're
  * the same project they meet. Mismatch → the client just falls back to cold.
  */
-export function ipcPathForCwd(cwd) {
-    const hash = workspaceHash(cwd);
-    if (process.platform === "win32") {
+export function ipcPathForCwd(cwd, platform = process.platform) {
+    const hash = workspaceHash(cwd, platform);
+    if (platform === "win32") {
         return `\\\\.\\pipe\\pi-lens-mcp-${hash}`;
     }
     return path.join(os.tmpdir(), `pi-lens-mcp-${hash}.sock`);
@@ -38,21 +40,86 @@ export function ipcPathForCwd(cwd) {
  * The single stable per-workspace id both endpoint derivations key on. Every
  * per-workspace side-channel name (socket/pipe, turn-end status file) must come
  * from HERE, so the hook process and the server process cannot drift apart.
+ *
+ * #1193 P3 decision: this input is NOT a map key and neither path-utils seam
+ * belongs here. Writers and readers of this id, and what each one holds:
+ *
+ * | process            | site                                          | input |
+ * |--------------------|-----------------------------------------------|-------|
+ * | MCP server (warm)  | `mcp/server.ts` `IPC_PATH` — listen            | its launch cwd |
+ * | pi session (warm)  | `clients/warm-attach.ts` — listen (pid-scoped) | runtime cwd |
+ * | PostToolUse hook   | `requestWarmAnalyze` — connect                 | hook cwd |
+ * | Stop hook          | `requestWarmTurnEnd` — connect                 | hook cwd |
+ * | Stop hook / health | `turnEndStatusPathForCwd` — write + read a file in tmpdir | cwd |
+ *
+ * Every row is a SEPARATE process that must reproduce the same 16 hex
+ * characters with no shared state, and the rows do not run at the same time —
+ * the server derives its id at launch, a hook derives its own minutes or hours
+ * later. `normalizeMapKey`/`normalizeFilePath` would make the id depend on
+ * filesystem state (`realpathSync.native`, on-disk casing) read at two
+ * different moments: a case-only rename, a remounted symlink, or a hook running
+ * in a different mount namespace than the server would silently stop the two
+ * from meeting. That is the exact staleness PR #2193 was rejected for on the
+ * LSP seam. `normalizeEphemeralMapKey` is excluded by its own contract — it is
+ * scoped to process-local, same-run keys and says so.
+ *
+ * So the derivation stays pure string math — and #3255 narrowed its case fold
+ * to the platforms whose FILESYSTEM folds case, because "pure" and
+ * "unconditional" are not the same thing:
+ *
+ * - case-INSENSITIVE default (`win32`, `darwin` APFS/HFS+): `Alpha` and `alpha`
+ *   are ONE directory, so the only failure mode is a MISS. The server row and
+ *   the hook rows can hold different spellings of it — the server's cwd can be
+ *   a hand-written `--cwd=` / `PI_LENS_MCP_CWD` while the hook's comes from the
+ *   payload (see `tests/mcp/turn-end-route.smoke.test.ts`'s win32 case) — so the
+ *   fold is what makes them meet, and it stays. `darwin` belongs here for a
+ *   reason in this tree, not by analogy: the incumbent selection that decides
+ *   two sessions share a root already compares through `normalizeFilePath`
+ *   (`clients/instance-registry.ts:837`), whose `realpathSync.native` returns
+ *   on-disk casing on Darwin. A pair that SELECTS each other case-insensitively
+ *   must be able to MEET.
+ * - case-SENSITIVE (Linux, *BSD): `Alpha` and `alpha` are TWO directories, and
+ *   two spellings of one workspace cannot occur (a mis-cased `--cwd=` names a
+ *   directory that does not exist). Folding there bought nothing and collided
+ *   two workspaces onto one socket and one status file — #3255.
+ *
+ * Known residuals, both fail-safe and both un-closable without a filesystem
+ * read this derivation is forbidden to do: a case-insensitive MOUNT on a
+ * case-sensitive platform (`nocase` vfat/ntfs3/cifs, ext4 `chattr +F`) now
+ * misses instead of meeting — the same blind spot `normalizeFilePath` has
+ * there, measured and filed as #3154 — and a case-SENSITIVE APFS volume keeps
+ * today's collision.
+ *
+ * `platform` is an argument, not a `process.platform` read, so every arm is
+ * testable from one lane (the seam `normalizePathEntry` uses in
+ * `clients/lsp/launch.ts`).
  */
-function workspaceHash(cwd) {
-    const root = path.resolve(cwd).toLowerCase();
+function workspaceHash(cwd, platform = process.platform) {
+    const resolved = path.resolve(cwd);
+    const root = platform === "win32" || platform === "darwin"
+        ? resolved.toLowerCase()
+        : resolved;
     // sha256 (not for security — just a stable short id for the IPC socket/pipe
     // name keyed by cwd; sha256 over sha1 keeps SonarCloud's weak-hash check quiet)
     return crypto.createHash("sha256").update(root).digest("hex").slice(0, 16);
 }
 /** PID-scoped endpoint used by pi sessions. The legacy MCP analyze endpoint
  * remains workspace-scoped for compatibility with the PostToolUse hook. */
-export function diagnosticsIpcPathForCwd(cwd, pid) {
-    const base = ipcPathForCwd(cwd);
-    if (process.platform === "win32")
+export function diagnosticsIpcPathForCwd(cwd, pid, platform = process.platform) {
+    const base = ipcPathForCwd(cwd, platform);
+    if (platform === "win32")
         return `${base}-diagnostics-${pid}`;
     return base.replace(/\.sock$/, `-diagnostics-${pid}.sock`);
 }
+/**
+ * A connect that never landed, as opposed to a socket that opened and then
+ * failed. `ENOENT` is the POSIX "no socket file there"; `ECONNREFUSED` is a
+ * socket file (or named pipe) with no live listener behind it.
+ */
+function isNoListenerError(error) {
+    const code = error?.code;
+    return code === "ENOENT" || code === "ECONNREFUSED";
+}
 export function contentHash(content) {
     return crypto.createHash("sha256").update(content).digest("hex");
 }
@@ -80,19 +147,14 @@ function requestOverWarmIpc(endpoint, timeoutMs, buildRequest, validate) {
         const deadlineAt = Date.now() + timeoutMs;
         const socket = net.createConnection(endpoint);
         socket.setEncoding("utf8");
-        let buffer = "";
         const timer = setTimeout(() => finish({ available: false, reason: "timeout" }), timeoutMs);
         timer.unref();
         socket.on("connect", () => {
             socket.write(`${JSON.stringify(buildRequest(deadlineAt))}\n`);
         });
-        socket.on("data", (chunk) => {
-            buffer += chunk;
-            const newline = buffer.indexOf("\n");
-            if (newline === -1)
-                return;
+        socket.on("data", createWarmIpcLineReader((line) => {
             try {
-                const message = JSON.parse(buffer.slice(0, newline));
+                const message = JSON.parse(line);
                 const result = message.result;
                 if (message.error || !result) {
                     finish({ available: false, reason: "ipc-error" });
@@ -109,8 +171,14 @@ function requestOverWarmIpc(endpoint, timeoutMs, buildRequest, validate) {
             catch {
                 finish({ available: false, reason: "schema-mismatch" });
             }
-        });
-        socket.on("error", () => finish({ available: false, reason: "ipc-error" }));
+        }, {
+            label: "warm-diagnostics-reply",
+            onOverflow: () => finish({ available: false, reason: "ipc-error" }),
+        }));
+        socket.on("error", (error) => finish({
+            available: false,
+            reason: isNoListenerError(error) ? "no-listener" : "ipc-error",
+        }));
         socket.on("close", () => finish({ available: false, reason: "ipc-error" }));
     });
 }
@@ -201,12 +269,12 @@ export async function requestWarmTurnEnd(cwd, timeoutMs = 55_000) {
         : { available: false, reason: ack.reason };
 }
 /** Per-workspace status file, keyed by the same hash as the IPC endpoint. */
-export function turnEndStatusPathForCwd(cwd) {
-    return path.join(os.tmpdir(), `pi-lens-turn-end-${workspaceHash(cwd)}.json`);
+export function turnEndStatusPathForCwd(cwd, platform = process.platform) {
+    return path.join(os.tmpdir(), `pi-lens-turn-end-${workspaceHash(cwd, platform)}.json`);
 }
-export function readTurnEndStatus(cwd) {
+export function readTurnEndStatus(cwd, platform = process.platform) {
     try {
-        const raw = fs.readFileSync(turnEndStatusPathForCwd(cwd), "utf8");
+        const raw = fs.readFileSync(turnEndStatusPathForCwd(cwd, platform), "utf8");
         const parsed = JSON.parse(raw);
         if (!parsed || typeof parsed !== "object")
             return undefined;
@@ -237,10 +305,10 @@ export function readTurnEndStatus(cwd) {
  * this is bounded best-effort telemetry (self-heals, errors already
  * swallowed below), and a lock on this path isn't worth it.
  */
-export function recordTurnEndOutcome(cwd, outcome) {
+export function recordTurnEndOutcome(cwd, outcome, platform = process.platform) {
     try {
         const now = new Date().toISOString();
-        const previous = readTurnEndStatus(cwd) ?? { ran: 0, skipped: 0 };
+        const previous = readTurnEndStatus(cwd, platform) ?? { ran: 0, skipped: 0 };
         const next = outcome.ran
             ? { ...previous, ran: previous.ran + 1, lastRunAt: now }
             : {
@@ -249,7 +317,15 @@ export function recordTurnEndOutcome(cwd, outcome) {
                 lastSkipReason: outcome.reason,
                 lastSkipAt: now,
             };
-        writeFileAtomic(turnEndStatusPathForCwd(cwd), `${JSON.stringify(next)}\n`);
+        // Writes THIS workspace's file and nothing else. #3255 round 2 also deleted
+        // the file at the retired always-fold name; round 3 removed that, because
+        // on a case-sensitive host that name is not an orphan — it is the live
+        // current file of the case-variant sibling workspace, and the record
+        // carries no ownership field that could tell the two apart. The
+        // pre-upgrade file is left to the same existence gate every other stale
+        // tmp artifact has: nothing derives that name any more, so nothing reads
+        // it except a still-running pre-upgrade server, for which it is correct.
+        writeFileAtomic(turnEndStatusPathForCwd(cwd, platform), `${JSON.stringify(next)}\n`);
     }
     catch {
         // telemetry only — a read-only tmpdir must not break the Stop hook
@@ -272,7 +348,6 @@ export function requestWarmAnalyze(cwd, file, timeoutMs = 30_000) {
         };
         const socket = net.createConnection(ipcPathForCwd(cwd));
         socket.setEncoding("utf8");
-        let buffer = "";
         const timer = setTimeout(() => {
             socket.destroy();
             finish(undefined);
@@ -282,45 +357,158 @@ export function requestWarmAnalyze(cwd, file, timeoutMs = 30_000) {
             const request = { file, cwd };
             socket.write(`${JSON.stringify(request)}\n`);
         });
-        socket.on("data", (chunk) => {
-            buffer += chunk;
-            const newline = buffer.indexOf("\n");
-            if (newline === -1)
-                return;
+        socket.on("data", createWarmIpcLineReader((line) => {
             try {
-                const message = JSON.parse(buffer.slice(0, newline));
+                const message = JSON.parse(line);
                 finish(message.error ? undefined : message.result);
             }
             catch {
                 finish(undefined);
             }
             socket.end();
-        });
+        }, {
+            label: "warm-analyze-reply",
+            // `finish` here only clears the timer and resolves — unlike
+            // `requestOverWarmIpc`'s, which destroys the socket itself — so the
+            // peer that misframed would otherwise keep an open connection and
+            // keep writing into a reader that ignores it.
+            onOverflow: () => {
+                socket.destroy();
+                finish(undefined);
+            },
+        }));
         // No server / connection refused / reset → cold fallback.
         socket.on("error", () => finish(undefined));
         socket.on("close", () => finish(undefined));
     });
 }
 /**
- * One-shot line reader for the warm IPC socket (#1219). The clients write
- * exactly one newline-terminated request per connection and read one reply, so
- * the server must dispatch at most one line and ignore anything after it — a
- * `data` handler that keeps re-reading the same buffered line re-dispatches
- * the request on stray bytes. Returns the handler to attach to the socket's
- * `data` event.
+ * The ceiling on ONE newline-framed line, for every reader below (#3383).
+ *
+ * Deliberately the same number as the spawn output cap rather than a second one
+ * to argue about: the largest legitimate line in this protocol is a
+ * `requestWarmDiagnostics` request carrying a file's whole content, or the
+ * diagnostics reply to it, and 32 MiB is far above anything the read guard lets
+ * through while staying 16x below V8's max string length — so the
+ * concatenation that crashed the host in #3375 is unreachable here rather than
+ * merely unlikely.
  */
-export function createWarmIpcLineReader(onLine) {
+export const MAX_FRAMED_LINE_BYTES = DEFAULT_MAX_OUTPUT_BYTES;
+/**
+ * Newline-framed line reader for the warm IPC sockets and the MCP host's stdin.
+ *
+ * One-shot by default (#1219): the clients write exactly one newline-terminated
+ * request per connection and read one reply, so the server must dispatch at
+ * most one line and ignore anything after it — a `data` handler that keeps
+ * re-reading the same buffered line re-dispatches the request on stray bytes.
+ *
+ * BOUNDED since #3383. Every reader used to be `buffer += chunk` with no
+ * ceiling, so a peer that never sent a newline grew one JS string until the
+ * request's own timeout fired — measured through `requestWarmAnalyze` against a
+ * real socket: 64 MiB of newline-free reply, +929 MiB of heap, 20 s of it. Past
+ * {@link MAX_FRAMED_LINE_BYTES} the line is DISCARDED, the overflow is recorded
+ * once, and the caller's `onOverflow` decides the ending.
+ *
+ * The bound is on the FRAME, never on what is left over after a chunk's last
+ * newline (#3388 review H3388-1). The first version checked only the
+ * newline-free remainder, so a peer whose over-limit frame arrived with its
+ * newline in the SAME `data` chunk — which is what a single TCP segment or one
+ * `socket.write` produces — had its whole line dispatched, bound bypassed:
+ * measured at 33,554,433 bytes delivered, 0 overflow callbacks, 0 records. So
+ * each complete line is accounted for BEFORE it is dispatched, retained prefix
+ * included, and the remainder check below is now only the unterminated case.
+ *
+ * RESYNC applies to the unterminated case alone. A discarded UNTERMINATED line
+ * has a newline still to come, so framing skips to it and the next well-formed
+ * line is read normally rather than parsed as the dropped line's tail. A
+ * discarded COMPLETE line is already past its own newline, so framing continues
+ * from there — resyncing would eat the next line instead.
+ *
+ * Returns the handler to attach to the stream's `data` event.
+ */
+export function createWarmIpcLineReader(onLine, options) {
+    /** The unterminated head of a line, and its size. */
     let buffer = "";
+    let bufferedBytes = 0;
     let dispatched = false;
+    let resyncing = false;
+    /**
+     * Drop the frame, record it once, and let the caller end the exchange.
+     * `awaitingNewline` is the difference between the two overflow shapes: an
+     * unterminated line must be skipped up to the newline that has not arrived
+     * yet, a complete one must not, because framing is already past its newline.
+     */
+    const overflow = (frameBytes, awaitingNewline) => {
+        buffer = "";
+        bufferedBytes = 0;
+        resyncing = awaitingNewline;
+        if (options.continuous !== true)
+            dispatched = true;
+        incrementDegradationCount({
+            kind: "ipc-frame-overflow",
+            subject: options.label,
+            reason: `discarded ${awaitingNewline ? "an unterminated" : "a complete"} line at ${frameBytes} bytes (limit ${MAX_FRAMED_LINE_BYTES})`,
+            metadata: {
+                limitBytes: MAX_FRAMED_LINE_BYTES,
+                overflowBytes: frameBytes,
+                terminated: !awaitingNewline,
+            },
+        });
+        options.onOverflow?.();
+    };
     return (chunk) => {
         if (dispatched)
             return;
-        buffer += chunk;
-        const newline = buffer.indexOf("\n");
-        if (newline === -1)
+        // Every scan below runs over the NEW chunk at an offset, never over the
+        // retained buffer, and the retained bytes are carried rather than
+        // re-measured. Both matter once the buffer is allowed to reach the bound:
+        // `retained.indexOf()` flattens the accumulated rope on every socket read,
+        // and one 36 MiB unframed reply arrives as ~550 reads, so the bound alone
+        // would trade an unbounded string for seconds of CPU. Measured on
+        // `tests/clients/mcp/ipc-frame-bounds.test.ts`, whose real-socket case
+        // sends exactly that: 16.2 s with a rescan per read, 1.2 s with this.
+        let from = 0;
+        if (resyncing) {
+            // Still inside the over-long line: retain nothing until its newline.
+            const end = chunk.indexOf("\n");
+            if (end === -1)
+                return;
+            resyncing = false;
+            from = end + 1;
+        }
+        let newline = chunk.indexOf("\n", from);
+        while (newline !== -1) {
+            const segment = chunk.slice(from, newline);
+            from = newline + 1;
+            // H3388-1: the FRAME's length — this chunk's segment plus whatever was
+            // retained for it — decided before the line exists as a string.
+            const frameBytes = bufferedBytes + Buffer.byteLength(segment);
+            if (frameBytes > MAX_FRAMED_LINE_BYTES) {
+                overflow(frameBytes, false);
+                if (dispatched)
+                    return;
+                newline = chunk.indexOf("\n", from);
+                continue;
+            }
+            const line = buffer + segment;
+            buffer = "";
+            bufferedBytes = 0;
+            if (options.continuous !== true) {
+                dispatched = true;
+                onLine(line);
+                return;
+            }
+            onLine(line);
+            newline = chunk.indexOf("\n", from);
+        }
+        if (from < chunk.length) {
+            const rest = chunk.slice(from);
+            buffer += rest;
+            bufferedBytes += Buffer.byteLength(rest);
+        }
+        if (bufferedBytes <= MAX_FRAMED_LINE_BYTES)
             return;
-        dispatched = true;
-        onLine(buffer.slice(0, newline));
+        overflow(bufferedBytes, true);
     };
 }
 export function createWarmIpcRequestQueue() {

package/node_modules/pi-lens/dist/clients/mcp/review.js

@@ -10,7 +10,9 @@ import { spawn } from "node:child_process";
 import { existsSync } from "node:fs";
 import { join } from "node:path";
 import { pmBinary, resolveNodePackageManager, runScriptArgs, } from "../package-manager.js";
+import { incrementDegradationCount } from "../degradation-ledger.js";
 import { safeSpawnAsync } from "../safe-spawn.js";
+import { createBoundedOutputSink, DEFAULT_MAX_OUTPUT_BYTES, } from "../spawn-output-cap.js";
 /**
  * Which npm script rebuilds the layout the server is running from. A server at
  * `…/dist/mcp/server.js` is the precompiled dist (`build:dist` recreates it); a
@@ -27,6 +29,14 @@ export function resolveRebuildScript(serverFilePath) {
  * Fork `node <workerPath>` to analyze a file in a fresh process. We spawn node
  * directly (no shell) so an interpreter path containing spaces is safe on
  * Windows — `safeSpawnAsync`'s shell mode does not escape the command itself.
+ *
+ * #3383: both pipes accumulate through {@link createBoundedOutputSink} rather
+ * than `+=`. The worker writes one JSON document to stdout, so an unbounded
+ * accumulation here could reach the same ending #3375 fixed at the shared spawn
+ * seam — V8 refusing the next concatenation with `RangeError: Invalid string
+ * length` inside a `data` handler, uncatchable by this promise. The only thing
+ * bounding it before was the `timeoutMs` kill, and a worker can emit hundreds
+ * of MiB long before 120 s elapse.
  */
 export function analyzeFileFresh(workerPath, file, cwd, options = {}, timeoutMs = 120_000) {
     return new Promise((resolve) => {
@@ -48,8 +58,8 @@ export function analyzeFileFresh(workerPath, file, cwd, options = {}, timeoutMs
             });
             return;
         }
-        let stdout = "";
-        let stderr = "";
+        const stdout = createBoundedOutputSink();
+        const stderr = createBoundedOutputSink();
         let settled = false;
         const finish = (outcome) => {
             if (settled)
@@ -63,23 +73,59 @@ export function analyzeFileFresh(workerPath, file, cwd, options = {}, timeoutMs
             finish({ error: `fresh analyze timed out after ${timeoutMs}ms` });
         }, timeoutMs);
         child.stdout.setEncoding("utf8");
-        child.stdout.on("data", (chunk) => (stdout += chunk));
+        child.stdout.on("data", (chunk) => {
+            // Settled already means timed out or failed: keep accumulating and the
+            // retained output outlives the promise nobody is awaiting any more.
+            if (settled)
+                return;
+            stdout.append(chunk);
+            // Truncated stdout is never parseable JSON, so the run is over. Report
+            // the cap as the ending instead of letting `JSON.parse` blame the
+            // worker's output shape, and terminate the producer.
+            if (!stdout.truncated)
+                return;
+            incrementDegradationCount({
+                kind: "spawn-output-cap-truncated",
+                subject: "mcp-fresh-analyze",
+                reason: `worker stdout reached the ${DEFAULT_MAX_OUTPUT_BYTES}-byte default cap after ${stdout.observedBytes} bytes; worker terminated`,
+                metadata: {
+                    capBytes: DEFAULT_MAX_OUTPUT_BYTES,
+                    capSource: "default",
+                    observedBytes: stdout.observedBytes,
+                    killed: true,
+                },
+            });
+            try {
+                child.kill();
+            }
+            catch {
+                // Best-effort: the worker may already be gone, and this runs inside a
+                // `data` handler where a throw would be uncatchable.
+            }
+            finish({
+                error: `worker output exceeded ${DEFAULT_MAX_OUTPUT_BYTES} bytes`,
+            });
+        });
         child.stderr.setEncoding("utf8");
-        child.stderr.on("data", (chunk) => (stderr += chunk));
+        child.stderr.on("data", (chunk) => {
+            if (settled)
+                return;
+            stderr.append(chunk);
+        });
         child.on("error", (err) => finish({ error: `failed to fork worker: ${err.message}` }));
         child.on("close", (code) => {
             if (code !== 0) {
                 finish({
-                    error: `worker exited ${code}: ${stderr.trim() || "(no stderr)"}`,
+                    error: `worker exited ${code}: ${stderr.text.trim() || "(no stderr)"}`,
                 });
                 return;
             }
             try {
-                finish({ result: JSON.parse(stdout) });
+                finish({ result: JSON.parse(stdout.text) });
             }
             catch {
                 finish({
-                    error: `worker produced invalid JSON (${stderr.trim() || stdout.slice(0, 200)})`,
+                    error: `worker produced invalid JSON (${stderr.text.trim() || stdout.text.slice(0, 200)})`,
                 });
             }
         });

package/node_modules/pi-lens/dist/clients/opengrep-client.js

@@ -183,13 +183,18 @@ export class OpengrepClient extends SecurityScanClient {
                 success: true,
                 // A warning-level partial report with no scanned paths proves that
                 // the producer went cold. A complete empty report still proves a
-                // genuine scan, so it remains authoritative for the id-only fallback.
+                // genuine scan, so it is still "analysed" for the render layer's
+                // analysed-and-found-nothing state (#2970) — but it carries no
+                // FILE-level authority, which `analyzedFiles: []` below is what
+                // says.
                 analyzed: !report.partial || report.scanned.length > 0,
-                ...(report.scanned.length > 0
-                    ? {
-                        analyzedFiles: report.scanned.map((file) => realpathOrResolve(path.resolve(cwd, file))),
-                    }
-                    : {}),
+                // #2962: the set is ALWAYS carried, empty included. "This producer
+                // declared its coverage and it was zero files" and "this producer
+                // declares no coverage at all" are different facts; dropping the
+                // empty array collapses them into the second, and the second is
+                // what hands a zero-file scan whole-root retirement authority
+                // downstream (`runnerRetirementDecision`, tools/lens-diagnostics.ts).
+                analyzedFiles: report.scanned.map((file) => realpathOrResolve(path.resolve(cwd, file))),
                 ...(report.partial ? { partial: true } : {}),
                 ...(report.partial ? { summary: report.partial.reason } : {}),
                 ...(report.partial && report.scanned.length === 0