@herbertgao/pi-extensions 2026.9.15 → 2026.9.17

package/node_modules/pi-lens/dist/clients/dispatch/finding-policy.js

@@ -18,7 +18,7 @@
  * hold dispatch `Diagnostic`s, `applyLspFindingPolicy` for the probe lane,
  * which holds raw `LSPDiagnostic`s.
  */
-import { applyDispositions, hasAnyDispositionMarks, } from "../diagnostic-dispositions.js";
+import { applyDispositions, applyDispositionsMultiFile, hasAnyDispositionMarks, } from "../diagnostic-dispositions.js";
 import { loadPiLensProjectConfig } from "../project-lens-config.js";
 import { retagAuxiliaryDiagnostics } from "./auxiliary-lsp.js";
 import { applyInlineSuppressions } from "./inline-suppressions.js";
@@ -129,6 +129,57 @@ function probeIdentities(canonical, raw) {
 export function renderedRuleIdentities(diagnostic) {
     return expandRenderedIdentities([[diagnostic.tool, diagnostic.rule]]);
 }
+/**
+ * #3246: the identity spellings a mark against a surface that renders NEITHER
+ * the tool NOR the rule can carry — the turn-end unresolved-inline-blocker
+ * body, whose every line is `formatDiagnostics`' `  L<n>: <message>` (plus an
+ * optional fix hint). An agent marking from that text has only the message and
+ * the line to give `lens_diagnostic_mark`, whose `tool` AND `rule` parameters
+ * are both optional, so the mark's anchor carries neither; a mark made from the
+ * widget or `mode=full` carries the full canonical pair for the same finding.
+ * Honoring one spelling and not the other is exactly the non-convergence #3088
+ * reported, so both go through the SAME expansion `probeIdentities` uses. The
+ * bare spelling stays safe for this STOP-tier surface because a `"blocking"`
+ * diagnostic can only ever be dropped by the STRICT, content-bound
+ * false-positive anchor (`applyDispositions`' F1 rule), which still binds the
+ * normalized message and the flagged line's content hash.
+ */
+export function inlineBlockerIdentities(diagnostic) {
+    return expandRenderedIdentities([
+        [diagnostic.tool, diagnostic.rule],
+        [undefined, undefined],
+    ]);
+}
+/**
+ * The whole stack for a turn-end PUSH surface that renders dispatch
+ * diagnostics for ONE file — the late-auxiliary drain (#3102) and the
+ * late-runner drain (#3248), which are the same shape: a post-freshness-gate
+ * `Diagnostic[]`, a `<file>:<line>:<col> [<rule>] <message>` rendering that
+ * prints the rule but never the tool, and a suppressed count the caller
+ * surfaces once per delivery (#1616).
+ *
+ * It exists so those two lanes cannot drift apart: this used to be open-coded
+ * at the late-auxiliary site, and #3248 would have made a second copy of the
+ * identical four arguments — the single-source rule's exact failure shape. The
+ * caller still owns its own content read, because the two lanes read on
+ * different schedules (the auxiliary drain reads once per FILE across several
+ * server pairs; the runner drain reads once per pending runner).
+ *
+ * `content` is `undefined` when the file could not be read: it becomes `""`,
+ * `FindingPolicyOptions.content`'s documented fail-open input, so the STRICT
+ * anchor cannot match and nothing is hidden over an I/O error (shape 48).
+ */
+export function applyPushedFindingPolicy(findings, options) {
+    const { kept } = applyFindingPolicy(findings, {
+        cwd: options.cwd,
+        filePath: options.filePath,
+        content: options.content ?? "",
+        // mtime-cached, so several files in one drain cost one stat.
+        policyMap: loadProjectRulePolicyMap(options.cwd),
+        identities: renderedRuleIdentities,
+    });
+    return { kept, suppressed: findings.length - kept.length };
+}
 /** Every rendered `(tool, rule)` spelling plus the `tool`-omitted form of
  * each, de-duplicated, in order. One derivation for both callers. */
 function expandRenderedIdentities(rendered) {
@@ -220,3 +271,69 @@ export function applyLspFindingPolicy(diagnostics, options) {
     };
     return { kept: survivorsOf(kept), inlineKept: survivorsOf(inlineKept) };
 }
+/**
+ * #1617: turn_end reads gitleaks/govulncheck/trivy straight from their
+ * session-scan caches and formats them into advisory/blocker text — a
+ * reporting lane parallel to (and, before this fix, entirely bypassing)
+ * `dispatcher.ts:924`'s `applyDispositions` filter. An agent-marked
+ * false-positive/won't-fix on one of these findings never suppressed it
+ * here, so it re-reported on every turn.
+ *
+ * Filters `findings` through the SAME anchor derivation the dispatch path
+ * and `lens_diagnostics mode=full` use (`applyDispositionsMultiFile` in
+ * `diagnostic-dispositions.ts`), keyed off each lane's own canonical
+ * `ProjectDiagnostic` adapter (`toDiagnostic`) — the exact tool/rule/message
+ * identity `lens_diagnostics` already surfaces and `lens_diagnostic_mark`
+ * already anchors a mark against, not a second, cloned identity that would
+ * silently diverge from what the agent actually marked.
+ *
+ * Returns the surviving findings plus how many were dropped, so a caller can
+ * still surface a "suppressed by disposition: N" trace (the #1616
+ * suppressed-bucket rule — a security finding must never vanish with no
+ * trace, even when the disposition that dropped it is working as intended).
+ */
+export function filterFindingsByDisposition(findings, cwd, toDiagnostic) {
+    if (findings.length === 0)
+        return { kept: findings, suppressed: 0 };
+    // #3248: every `(tool, rule)` spelling a mark against these findings can
+    // carry, not just the canonical one. NONE of these turn-end surfaces prints
+    // a tool — knip renders `<file>:<line> — <type>: <name>`, dead-code
+    // `unused <kind> <name>`, the security lanes `Potential secret: <rule>` —
+    // so an agent marking from what it was SHOWN has no tool to pass, and
+    // `lens_diagnostic_mark`'s `tool` parameter is optional. Honouring only the
+    // spelling `lens_diagnostics` happens to show is the #3088 non-convergence,
+    // and it is fixed HERE, once, for every caller of this helper rather than
+    // per lane. Widening is safe for the blocking members because a
+    // `semantic: "blocking"` finding can still only be dropped by the STRICT,
+    // content-bound false-positive anchor, which keeps binding the normalized
+    // message and the flagged line's content.
+    // The expanded candidate is a `DispositionCandidate` with a path, NOT a
+    // `ProjectDiagnostic`: the tool-omitted spelling has no `tool`, which that
+    // type requires. Only the anchor derivation reads it.
+    const candidates = findings.flatMap((finding) => {
+        const diagnostic = toDiagnostic(finding);
+        return renderedRuleIdentities(diagnostic).map((identity) => ({
+            finding,
+            candidate: {
+                filePath: diagnostic.filePath,
+                message: diagnostic.message,
+                ...(diagnostic.line !== undefined && { line: diagnostic.line }),
+                ...(diagnostic.semantic !== undefined && {
+                    semantic: diagnostic.semantic,
+                }),
+                ...(identity.tool !== undefined && { tool: identity.tool }),
+                ...(identity.rule !== undefined && { rule: identity.rule }),
+            },
+        }));
+    });
+    const survivors = new Set(applyDispositionsMultiFile(candidates.map((c) => c.candidate), cwd, (d) => d.filePath));
+    const disposed = new Set();
+    for (const candidate of candidates) {
+        if (!survivors.has(candidate.candidate))
+            disposed.add(candidate.finding);
+    }
+    const kept = disposed.size === 0
+        ? findings
+        : findings.filter((finding) => !disposed.has(finding));
+    return { kept, suppressed: findings.length - kept.length };
+}

package/node_modules/pi-lens/dist/clients/dispatch/indent-detect.js

@@ -12,8 +12,14 @@ export function detectIndentation(content) {
     const spaceCounts = lines
         .map((line) => line.match(/^ +(?=\S)/)?.[0].length ?? 0)
         .filter((count) => count > 0);
-    if (tabs === 0 && spaceCounts.length === 0)
-        return DEFAULT_INDENTATION;
+    if (tabs === 0 && spaceCounts.length === 0) {
+        // The formatter gate uses the shared hasDetectableIndentation predicate. If
+        // that predicate fired but structural masking removed every candidate line,
+        // there is no style to pin and the caller must take the #3038 skip valve
+        // instead of imposing the default width. Keep the historical default for
+        // content with no raw indentation, whose callers never enter this path.
+        return hasDetectableIndentation(content) ? undefined : DEFAULT_INDENTATION;
+    }
     if (tabs > spaceCounts.length)
         return { style: "tab", width: 1 };
     if (spaceCounts.length > tabs) {

package/node_modules/pi-lens/dist/clients/dispatch/inline-suppressions.js

@@ -11,6 +11,25 @@
  */
 import { normalizeRuleId } from "./rule-id-normalize.js";
 const SUPPRESS_RE = /(?:\/\/|#)\s*pi-lens-ignore:\s*(.+)/;
+const TRAILING_REASON_RE = /(?:\s+--\s+|\s+—\s+|:\s+).+$/u;
+export function splitInlineSuppressionPayload(payload) {
+    const reasonMatch = TRAILING_REASON_RE.exec(payload);
+    const trailingReason = reasonMatch?.[0];
+    if (reasonMatch === null || trailingReason === undefined) {
+        return { ruleList: payload, trailingReason: "" };
+    }
+    return {
+        ruleList: payload.slice(0, reasonMatch.index),
+        trailingReason,
+    };
+}
+export function parseInlineSuppressionRuleIds(payload) {
+    const { ruleList } = splitInlineSuppressionPayload(payload);
+    return ruleList
+        .split(",")
+        .map((rule) => rule.trim())
+        .filter(Boolean);
+}
 /**
  * Normalize a rule id to the form a user writes in a `pi-lens-ignore` comment.
  * The napi scan and the ast-grep LSP tag the same rule as `ast-grep:<id>` /
@@ -37,10 +56,10 @@ export function applyInlineSuppressions(diagnostics, content) {
         const m = SUPPRESS_RE.exec(lines[i]);
         if (!m)
             continue;
-        const rules = m[1]
-            .split(",")
-            .map((r) => r.trim())
-            .filter(Boolean);
+        const payload = m[1];
+        if (payload === undefined)
+            continue;
+        const rules = parseInlineSuppressionRuleIds(payload);
         const suppressedLine = i + 1; // same line (1-based)
         const nextLine = i + 2; // next line (1-based)
         for (const ruleId of rules) {

package/node_modules/pi-lens/dist/clients/dispatch/rule-ignores.js

@@ -15,22 +15,29 @@
 import * as path from "node:path";
 import { minimatch } from "../deps/minimatch.js";
 import { buildEffectiveAstGrepCatalog } from "./ast-grep-catalog.js";
+import { isWindowsPath, toPosix } from "../path-utils.js";
 /**
  * True when `filePath` is carved out of a rule by one of its glob `patterns`.
  *
  * The glob is matched against `filePath` relative to `root`, forward-slashed.
  * Falls back to the absolute (slash-normalized) path when `filePath` isn't
- * under `root` (e.g. an out-of-tree temp file), so a glob like `scripts/**`
- * simply never matches rather than throwing.
+ * under `root` (e.g. an out-of-tree temp file). Leaf-file patterns retain that
+ * fallback for sinks such as a double-star logger leaf; directory carve-outs
+ * ending in a slash plus double-star remain root-contained so a project's CLI
+ * exemption cannot suppress a finding in an unrelated out-of-tree file.
  */
 export function isRuleIgnoredForPath(filePath, root, patterns) {
     if (!patterns || patterns.length === 0)
         return false;
-    const relative = path.relative(root, filePath);
-    const displayPath = (relative.startsWith("..") ? filePath : relative)
-        .split(path.sep)
-        .join("/");
-    return patterns.some((pattern) => minimatch(displayPath, pattern, { dot: true }));
+    const pathApi = isWindowsPath(root) || isWindowsPath(filePath) ? path.win32 : path.posix;
+    const relative = pathApi.relative(root, filePath);
+    const outsideRoot = relative !== "" &&
+        (relative === ".." ||
+            relative.startsWith(`..${pathApi.sep}`) ||
+            pathApi.isAbsolute(relative));
+    const displayPath = toPosix(outsideRoot ? filePath : relative);
+    return patterns.some((pattern) => (!outsideRoot || !pattern.replaceAll("\\", "/").endsWith("/**")) &&
+        minimatch(displayPath, pattern, { dot: true }));
 }
 /**
  * Rule id → its `ignores` globs, for the effective ast-grep catalog at `root`.

package/node_modules/pi-lens/dist/clients/dispatch/runners/actionlint.js

@@ -1,8 +1,10 @@
 import path from "node:path";
+import { pathsEqual } from "../../path-utils.js";
 import { safeSpawnAsync } from "../../safe-spawn.js";
 import { resolveRunnerCwd } from "../../tool-cwd.js";
 import { PRIORITY } from "../priorities.js";
 import { createAvailabilityChecker, resolveToolCommandWithInstallFallback, } from "./utils/runner-helpers.js";
+import { finishParsedRun, parseToolRun } from "./utils/tool-failure.js";
 const actionlint = createAvailabilityChecker("actionlint", ".exe");
 export function isGitHubWorkflowFile(filePath) {
     const normalized = filePath.replace(/\\/g, "/");
@@ -31,14 +33,18 @@ function toDiagnostic(issue, filePath) {
         matchedText: issue.snippet,
     };
 }
-export function parseActionlintJson(raw, filePath) {
+export function parseActionlintJson(raw, filePath, cwd) {
     const trimmed = raw.trim();
     if (!trimmed)
         return [];
+    // #3295: actionlint resolves reusable-workflow and composite-action refs, so
+    // its `filepath` is not always the workflow we asked about.
+    const absTarget = path.resolve(cwd, filePath);
+    const isTarget = (issue) => !issue.filepath || pathsEqual(path.resolve(cwd, issue.filepath), absTarget);
     try {
         const parsed = JSON.parse(trimmed);
         const issues = Array.isArray(parsed) ? parsed : [parsed];
-        return issues.map((issue) => toDiagnostic(issue, filePath));
+        return issues.flatMap((issue) => isTarget(issue) ? [toDiagnostic(issue, filePath)] : []);
     }
     catch {
         // Some actionlint versions or wrappers may emit one JSON object per line.
@@ -48,6 +54,8 @@ export function parseActionlintJson(raw, filePath) {
                 continue;
             try {
                 const parsed = JSON.parse(line);
+                if (!isTarget(parsed))
+                    continue;
                 diagnostics.push(toDiagnostic(parsed, filePath));
             }
             catch {
@@ -82,32 +90,22 @@ const actionlintRunner = {
             cwd,
             timeout: 15000,
         });
-        const raw = `${result.stdout ?? ""}${result.stderr ?? ""}`;
-        let diagnostics = parseActionlintJson(raw, ctx.filePath);
-        if (diagnostics.length === 0 && result.status !== 0 && raw.trim()) {
-            diagnostics = [
-                {
-                    id: `actionlint-${path.basename(ctx.filePath)}-failure`,
-                    message: raw.trim().split(/\r?\n/)[0] || "actionlint failed",
-                    filePath: ctx.filePath,
-                    line: 1,
-                    column: 1,
-                    severity: "error",
-                    semantic: "blocking",
-                    tool: "actionlint",
-                    rule: "actionlint",
-                    defectClass: "correctness",
-                },
-            ];
-        }
-        if (diagnostics.length === 0) {
-            return { status: "succeeded", diagnostics: [], semantic: "none" };
-        }
-        return {
-            status: "failed",
-            diagnostics,
-            semantic: "blocking",
-        };
+        const output = `${result.stdout ?? ""}${result.stderr ?? ""}`;
+        const parsed = parseToolRun("actionlint", {
+            result,
+            output,
+            // EXIT TABLE (actionlint 1.7.7 measured fixture): 0 clean; 1 findings; 2 error; other nonzero rejected.
+            exitCodes: { ran: [1, 2] },
+        }, (raw) => parseActionlintJson(raw, ctx.filePath, cwd));
+        if (parsed.skipped)
+            return parsed.skipped;
+        return finishParsedRun({
+            tool: "actionlint",
+            ctx,
+            result,
+            diagnostics: parsed.diagnostics,
+            classify: () => ({ status: "failed", semantic: "blocking" }),
+        });
     },
 };
 export default actionlintRunner;

package/node_modules/pi-lens/dist/clients/dispatch/runners/biome-check.js

@@ -5,7 +5,9 @@
  * Autofix is handled earlier by the post-write pipeline to avoid
  * mutating files mid-dispatch after LSP sync has already happened.
  */
+import * as path from "node:path";
 import { incrementDegradationCount } from "../../degradation-ledger.js";
+import { pathsEqual } from "../../path-utils.js";
 import { mapWithConcurrency } from "../../dependency-checker.js";
 import { safeSpawnAsync } from "../../safe-spawn.js";
 import { biomeConfigArgs, getAutofixCapability, getJstsLintPolicyForCwd, } from "../../tool-policy.js";
@@ -50,35 +52,46 @@ export function biomeRuleNameFromCategory(category) {
     const parts = category.split("/");
     return parts[parts.length - 1] || undefined;
 }
-export function parseBiomeJson(raw, filePath, fixKindByRule) {
+export function parseBiomeJson(raw, filePath, cwd, fixKindByRule) {
     try {
         const result = JSON.parse(raw);
         const diagnostics = result.diagnostics || [];
         const autofix = getAutofixCapability("biome");
+        const absTarget = path.resolve(cwd, filePath);
         return {
-            diagnostics: diagnostics.map((d) => {
-                const ruleName = biomeRuleNameFromCategory(d.category);
-                const fixKind = ruleName ? fixKindByRule?.get(ruleName) : undefined;
-                const isFixable = fixKind === "safe" || fixKind === "unsafe";
-                return {
-                    id: `biome:${d.category}:${d.location.start.line}`,
-                    message: d.message,
-                    filePath,
-                    line: d.location.start.line,
-                    column: d.location.start.column,
-                    severity: normalizeBiomeSeverity(d.severity),
-                    semantic: d.severity === "error" ? "blocking" : "warning",
-                    tool: "biome",
-                    rule: d.category,
-                    fixable: isFixable,
-                    // Mirrors `biomeClient.fixFileAsync`'s own `lint --write` call
-                    // (no `--unsafe`, clients/biome-client.ts): the pipeline only
-                    // ever applies SAFE fixes, so only "safe" earns autoFixAvailable.
-                    autoFixAvailable: fixKind === "safe" && (autofix?.safePipelineAutofix ?? false),
-                    fixKind: isFixable && autofix?.fixKind !== "none"
-                        ? autofix?.fixKind
-                        : undefined,
-                };
+            diagnostics: diagnostics.flatMap((d) => {
+                // #3295: `location.path` is biome's own name for the file each
+                // diagnostic is about; `biome.json` `files.includes` can widen the
+                // run past the argv.
+                if (d.location?.path &&
+                    !pathsEqual(path.resolve(cwd, d.location.path), absTarget))
+                    return [];
+                {
+                    const ruleName = biomeRuleNameFromCategory(d.category);
+                    const fixKind = ruleName ? fixKindByRule?.get(ruleName) : undefined;
+                    const isFixable = fixKind === "safe" || fixKind === "unsafe";
+                    return [
+                        {
+                            id: `biome:${d.category}:${d.location.start.line}`,
+                            message: d.message,
+                            filePath,
+                            line: d.location.start.line,
+                            column: d.location.start.column,
+                            severity: normalizeBiomeSeverity(d.severity),
+                            semantic: d.severity === "error" ? "blocking" : "warning",
+                            tool: "biome",
+                            rule: d.category,
+                            fixable: isFixable,
+                            // Mirrors `biomeClient.fixFileAsync`'s own `lint --write` call
+                            // (no `--unsafe`, clients/biome-client.ts): the pipeline only
+                            // ever applies SAFE fixes, so only "safe" earns autoFixAvailable.
+                            autoFixAvailable: fixKind === "safe" && (autofix?.safePipelineAutofix ?? false),
+                            fixKind: isFixable && autofix?.fixKind !== "none"
+                                ? autofix?.fixKind
+                                : undefined,
+                        },
+                    ];
+                }
             }),
         };
     }
@@ -248,7 +261,7 @@ const biomeCheckJsonRunner = {
             fixKindByRule = await resolveBiomeFixKinds(cmd, cwd, categories);
         }
         const parsed = checkResult.status === 0 || checkResult.status === 1
-            ? parseBiomeJson(checkResult.stdout || "", ctx.filePath, fixKindByRule)
+            ? parseBiomeJson(checkResult.stdout || "", ctx.filePath, cwd, fixKindByRule)
             : { diagnostics: [] };
         if (parsed.parseError) {
             const raw = checkResult.stdout || checkResult.stderr || "";

package/node_modules/pi-lens/dist/clients/dispatch/runners/cpp-check.js

@@ -1,10 +1,12 @@
 import * as fs from "node:fs";
 import * as path from "node:path";
+import { pathsEqual } from "../../path-utils.js";
 import { safeSpawnAsync } from "../../safe-spawn.js";
 import { probeToolAsync } from "../../tool-probe.js";
 import { resolveRunnerCwd } from "../../tool-cwd.js";
 import { PRIORITY } from "../priorities.js";
 import { createAvailabilityChecker } from "./utils/runner-helpers.js";
+import { finishParsedRun, parseToolRun } from "./utils/tool-failure.js";
 // Per-compiler availability checkers — each one caches per-cwd and
 // dedupes concurrent --version probes, the same protections every other
 // runner gets via createAvailabilityChecker. cpp-check previously
@@ -112,16 +114,16 @@ async function resolveCompiler(absPath, cwd) {
     }
     return undefined;
 }
-function parseGccLikeOutput(raw, filePath) {
+function parseGccLikeOutput(raw, filePath, cwd) {
     const diagnostics = [];
+    const absTarget = path.resolve(cwd, filePath);
     for (const line of raw.split(/\r?\n/)) {
         const match = line.match(/^(.*?):(\d+):(?:(\d+):)?\s*(fatal error|error|warning|note):\s+(.+)$/i);
         if (!match)
             continue;
         const [, sourcePath, lineStr, colStr, severityLabel, message] = match;
-        const resolvedSource = path.resolve(sourcePath.trim());
-        const resolvedTarget = path.resolve(filePath);
-        if (resolvedSource !== resolvedTarget)
+        // #3278: one seam for reported-path attribution — see javac.ts.
+        if (!pathsEqual(path.resolve(cwd, sourcePath.trim()), absTarget))
             continue;
         const severity = severityLabel.toLowerCase().includes("error")
             ? "error"
@@ -143,16 +145,16 @@ function parseGccLikeOutput(raw, filePath) {
     }
     return diagnostics;
 }
-function parseMsvcOutput(raw, filePath) {
+function parseMsvcOutput(raw, filePath, cwd) {
     const diagnostics = [];
+    const absTarget = path.resolve(cwd, filePath);
     for (const line of raw.split(/\r?\n/)) {
         const match = line.match(/^(.*)\((\d+)(?:,(\d+))?\):\s*(fatal error|error|warning)\s+([A-Z]+\d+):\s+(.+)$/i);
         if (!match)
             continue;
         const [, sourcePath, lineStr, colStr, severityLabel, rule, message] = match;
-        const resolvedSource = path.resolve(sourcePath.trim());
-        const resolvedTarget = path.resolve(filePath);
-        if (resolvedSource !== resolvedTarget)
+        // #3278: one seam for reported-path attribution — see javac.ts.
+        if (!pathsEqual(path.resolve(cwd, sourcePath.trim()), absTarget))
             continue;
         const severity = severityLabel.toLowerCase().includes("error")
             ? "error"
@@ -173,9 +175,6 @@ function parseMsvcOutput(raw, filePath) {
     }
     return diagnostics;
 }
-function firstOutputLine(raw) {
-    return raw.trim().split(/\r?\n/, 1)[0]?.slice(0, 200) ?? "";
-}
 const cppCheckRunner = {
     id: "cpp-check",
     appliesTo: ["cxx"],
@@ -193,44 +192,28 @@ const cppCheckRunner = {
             timeout: 30000,
         });
         const raw = `${result.stdout ?? ""}\n${result.stderr ?? ""}`.trim();
-        const diagnostics = compiler.flavor === "msvc"
-            ? parseMsvcOutput(raw, ctx.filePath)
-            : parseGccLikeOutput(raw, ctx.filePath);
-        if (diagnostics.length === 0) {
-            if (result.status && result.status !== 0) {
-                return {
-                    status: "failed",
-                    diagnostics: [
-                        {
-                            id: "cpp-check-nonzero-no-diagnostics",
-                            message: firstOutputLine(raw) ||
-                                `${compiler.command} exited non-zero without structured diagnostics`,
-                            filePath: ctx.filePath,
-                            severity: "warning",
-                            semantic: "warning",
-                            tool: "cpp-check",
-                            rule: compiler.command,
-                            fixable: false,
-                        },
-                    ],
-                    semantic: "warning",
-                    rawOutput: raw,
-                };
-            }
-            return {
-                status: "succeeded",
-                diagnostics: [],
-                semantic: "none",
-                rawOutput: raw,
-            };
-        }
-        const hasErrors = diagnostics.some((d) => d.severity === "error");
-        return {
-            status: hasErrors ? "failed" : "succeeded",
-            diagnostics,
-            semantic: "warning",
-            rawOutput: raw,
-        };
+        const parsed = parseToolRun("cpp-check", {
+            result,
+            output: raw,
+            // EXIT TABLE (gcc/clang 13 measured fixture): 0 clean; 1 findings; 2 error; other nonzero rejected.
+            exitCodes: { ran: [1, 2] },
+        }, (output) => compiler.flavor === "msvc"
+            ? parseMsvcOutput(output, ctx.filePath, cwd)
+            : parseGccLikeOutput(output, ctx.filePath, cwd));
+        if (parsed.skipped)
+            return parsed.skipped;
+        return finishParsedRun({
+            tool: "cpp-check",
+            ctx,
+            result,
+            diagnostics: parsed.diagnostics,
+            classify: (diagnostics) => ({
+                status: diagnostics.some((d) => d.severity === "error")
+                    ? "failed"
+                    : "succeeded",
+                semantic: "warning",
+            }),
+        });
     },
 };
 export default cppCheckRunner;

package/node_modules/pi-lens/dist/clients/dispatch/runners/credo.js

@@ -3,6 +3,7 @@ import * as fs from "node:fs";
 import { safeSpawnAsync } from "../../safe-spawn.js";
 import { resolveRunnerCwd } from "../../tool-cwd.js";
 import { PRIORITY } from "../priorities.js";
+import { finishParsedRun, parseToolRun } from "./utils/tool-failure.js";
 import { createCwdCachedProbe } from "./utils/runner-helpers.js";
 const CREDO_PROBE_BUDGET_MS = 10_000;
 // Per-cwd cached `mix credo --version` probe (#120), governed by the shared
@@ -61,20 +62,21 @@ const credoRunner = {
         }
         const absPath = path.resolve(cwd, ctx.filePath);
         const result = await safeSpawnAsync("mix", ["credo", "--format", "json", "--strict", absPath], { timeout: 30000, cwd });
-        // credo exits 1 when issues found, 0 when clean
-        if (result.status === null || result.status > 1) {
-            return { status: "skipped", diagnostics: [], semantic: "none" };
-        }
-        const diagnostics = parseCredoJson(result.stdout ?? "", ctx.filePath, cwd);
-        if (diagnostics.length === 0) {
-            return { status: "succeeded", diagnostics: [], semantic: "none" };
-        }
-        const hasBlocking = diagnostics.some((d) => d.semantic === "blocking");
-        return {
-            status: hasBlocking ? "failed" : "succeeded",
-            diagnostics,
-            semantic: hasBlocking ? "blocking" : "warning",
-        };
+        const output = `${result.stdout ?? ""}${result.stderr ?? ""}`;
+        const parsed = parseToolRun("credo", {
+            result,
+            output,
+            // EXIT TABLE (Credo 1.7 measured fixture): 0 clean; 1 findings; 2 error; other nonzero rejected.
+            exitCodes: { ran: [1, 2] },
+        }, (raw) => parseCredoJson(raw, ctx.filePath, cwd));
+        if (parsed.skipped)
+            return parsed.skipped;
+        return finishParsedRun({
+            tool: "credo",
+            ctx,
+            result,
+            diagnostics: parsed.diagnostics,
+        });
     },
 };
 export default credoRunner;