@herbertgao/pi-extensions 2026.9.2 → 2026.9.3

package/node_modules/pi-lens/dist/clients/dispatch/runners/vale.js

@@ -1,6 +1,7 @@
 import * as fs from "node:fs";
 import * as path from "node:path";
 import { safeSpawnAsync } from "../../safe-spawn.js";
+import { resolveRunnerCwd } from "../../tool-cwd.js";
 import { PRIORITY } from "../priorities.js";
 import { createAvailabilityChecker, resolveToolCommandWithInstallFallback, } from "./utils/runner-helpers.js";
 import { parseToolRun } from "./utils/tool-failure.js";
@@ -72,7 +73,7 @@ const valeRunner = {
     priority: PRIORITY.DOC_QUALITY,
     skipTestFiles: false,
     async run(ctx) {
-        const cwd = ctx.cwd || process.cwd();
+        const cwd = resolveRunnerCwd(ctx, "vale");
         // Config-gated: skip unless a .vale.ini is found
         if (!findValeConfig(cwd)) {
             return { status: "skipped", diagnostics: [], semantic: "none" };

package/node_modules/pi-lens/dist/clients/dispatch/runners/yamllint.js

@@ -1,7 +1,8 @@
 import { safeSpawnAsync } from "../../safe-spawn.js";
+import { logRunnerAdvisoryOnce } from "../../tool-cwd.js";
 import { getLinterPolicyForCwd, hasYamllintConfig } from "../../tool-policy.js";
 import { PRIORITY } from "../priorities.js";
-import { createAvailabilityChecker, resolveToolCommandWithInstallFallback, } from "./utils/runner-helpers.js";
+import { createAvailabilityChecker, resolveRunnerCwd, resolveToolCommandWithInstallFallback, } from "./utils/runner-helpers.js";
 import { parseToolRun } from "./utils/tool-failure.js";
 import { finishParsedRun } from "./utils/tool-failure.js";
 const yamllint = createAvailabilityChecker("yamllint", ".exe");
@@ -35,14 +36,14 @@ const yamllintRunner = {
     priority: PRIORITY.YAML_LINT,
     skipTestFiles: false,
     async run(ctx) {
-        const cwd = ctx.cwd || process.cwd();
+        const cwd = resolveRunnerCwd(ctx, "yamllint");
         const policy = getLinterPolicyForCwd(ctx.filePath, cwd);
         if (policy && !policy.preferredRunners.includes("yamllint")) {
             return { status: "skipped", diagnostics: [], semantic: "none" };
         }
         const hasConfig = hasYamllintConfig(cwd);
         if (!hasConfig) {
-            ctx.log("yamllint: no config detected, running with default rules");
+            logRunnerAdvisoryOnce(ctx, "yamllint", cwd, "yamllint: no config detected, running with default rules");
         }
         let cmd = null;
         if (await yamllint.isAvailableAsync(cwd)) {

package/node_modules/pi-lens/dist/clients/dispatch/runners/zig-check.js

@@ -1,5 +1,6 @@
 import * as path from "node:path";
 import { safeSpawnAsync } from "../../safe-spawn.js";
+import { resolveRunnerCwd } from "../../tool-cwd.js";
 import { createAvailabilityChecker } from "./utils/runner-helpers.js";
 import { PRIORITY } from "../priorities.js";
 // zig rejects `--version`; the version subcommand is `zig version`. Using the
@@ -46,7 +47,7 @@ const zigCheckRunner = {
     priority: PRIORITY.GENERAL_ANALYSIS,
     skipTestFiles: false,
     async run(ctx) {
-        const cwd = ctx.cwd || process.cwd();
+        const cwd = resolveRunnerCwd(ctx, "zig-check");
         if (!(await zig.isAvailableAsync(cwd))) {
             return { status: "skipped", diagnostics: [], semantic: "none" };
         }

package/node_modules/pi-lens/dist/clients/effective-config.js

@@ -47,7 +47,9 @@ import { explainServersForFile, lspConfigOf, registerLSPConfig, } from "./lsp/co
 // apart on a Windows-shaped path (AGENTS.md defect shape 2).
 import { isSameOrWithin } from "./lsp/server.js";
 import { homeRelativePath } from "./path-utils.js";
+import { resolveToolCwd } from "./tool-cwd.js";
 import { compareOrdinal } from "./string-utils.js";
+import { LENS_TOOL_NAMES, resolveLensToolEnabled } from "./tool-config.js";
 /** True when a `file` half is the rejection shape, not a resolved view. */
 export function isEffectiveFileViewError(file) {
     return "error" in file;
@@ -289,6 +291,10 @@ export async function effectiveConfig(options = {}) {
         provenance: provenanceView(resolved, homeDir).entries,
         provenanceCounts: summary.countsByTier,
         recordCounts: countBy(resolution.records, (record) => record.code),
+        tools: LENS_TOOL_NAMES.map((name) => ({
+            name,
+            enabled: resolveLensToolEnabled(name, resolved.value, undefined, options.noTools),
+        })),
         ...(fileOutsideCwd
             ? {
                 file: {
@@ -299,7 +305,7 @@ export async function effectiveConfig(options = {}) {
             : absolute === undefined
                 ? {}
                 : {
-                    file: await fileView(absolute, resolved, homeDir, 
+                    file: await fileView(absolute, resolved, homeDir, cwd, 
                     // The gates read the LSP slice of that SAME resolution, through
                     // the same `registerLSPConfig` conversion `initLSPConfig` uses —
                     // no session-root registration, no per-root config-store write
@@ -325,7 +331,7 @@ function toolReason(selected, kind) {
         return "selected";
     return kind === undefined ? "no-dispatch-plan" : "not-registered-for-kind";
 }
-async function fileView(absolute, resolved, homeDir, lspConfig) {
+async function fileView(absolute, resolved, homeDir, workspaceCwd, lspConfig) {
     const language = resolveLanguage(absolute);
     const kind = detectFileKind(absolute);
     const section = lspSectionOf(resolved.value);
@@ -392,6 +398,10 @@ async function fileView(absolute, resolved, homeDir, lspConfig) {
         id,
         selected: available.has(id),
         reason: toolReason(available.has(id), kind),
+        resolvedCwd: homeRelativePath(resolveToolCwd("runner", id, absolute, {
+            cwd: workspaceCwd,
+            suppressTelemetry: true,
+        }), homeDir),
     }));
     return {
         path: homeRelativePath(absolute, homeDir),

package/node_modules/pi-lens/dist/clients/extension-log.js

@@ -26,6 +26,7 @@ import { isTestMode } from "./env-utils.js";
 import { getGlobalPiLensLogDir } from "./probe-home-state.js";
 import { getMaxLogSizeMB } from "./log-cleanup.js";
 import { createNdjsonLogger } from "./ndjson-logger.js";
+import { getTurnId } from "./turn-context.js";
 export const EXTENSION_LOG_FILE = path.join(getGlobalPiLensLogDir(), "extension.log");
 const writer = createNdjsonLogger({
     filePath: EXTENSION_LOG_FILE,
@@ -37,6 +38,7 @@ export function logExtension(entry) {
     writer.log({
         ts: new Date().toISOString(),
         pid: process.pid,
+        turnId: getTurnId(),
         level: entry.level ?? "error",
         subsystem: entry.subsystem,
         message: entry.message,

package/node_modules/pi-lens/dist/clients/file-role.js

@@ -51,15 +51,32 @@ function isTypeStub(content) {
  */
 export function detectFileRole(filePath, content) {
     const windowsShaped = isWindowsPath(filePath);
-    const base = (windowsShaped ? win32.basename(filePath) : basename(filePath)).toLowerCase();
+    const rawBase = windowsShaped ? win32.basename(filePath) : basename(filePath);
+    const base = rawBase.toLowerCase();
     const dir = (windowsShaped ? win32.dirname(filePath) : dirname(filePath))
         .replace(/\\/g, "/")
         .toLowerCase();
     // --- Test ---
+    // Suffix conventions informed by the test-runner table
+    // (SOURCE_TO_TEST_PATTERNS + RUNNERS kinds in
+    // clients/test-runner-client.ts); hand-written, not iterated from it —
+    // see #2928 for the single-classifier fold:
+    // - `_test.` infix: Go (`*_test.go`), pytest (`*_test.py`), ExUnit
+    //   (`*_test.exs`), Dart (`*_test.dart`). The underscore anchor keeps
+    //   this precise: `contest.py` and `latest.ts` do not match.
+    // - `_spec.` infix: RSpec (`*_spec.rb`).
+    // - CamelCase `*Test(s).<ext>` suffix, matched case-SENSITIVELY on the
+    //   raw basename: JUnit/Surefire (`*Test.java`, `*TestCase.java`),
+    //   Kotlin (`*Test.kt`), dotnet (`*Test.cs`/`*Tests.cs`), PHPUnit
+    //   (`*Test.php`). Case matters: Surefire's `*Test.java` does not match
+    //   `contest.java`, so neither do we.
     if (base.includes(".test.") ||
         base.includes(".spec.") ||
+        base.includes("_test.") ||
+        base.includes("_spec.") ||
         base.startsWith("test_") ||
         base.startsWith("spec_") ||
+        /(Test|Tests|TestCase)\.(java|kt|kts|cs|fs|php)$/.test(rawBase) ||
         dir.includes("/__tests__/") ||
         dir.includes("/test/") ||
         dir.includes("/tests/") ||

package/node_modules/pi-lens/dist/clients/finding-delivery-gate.js

@@ -139,6 +139,10 @@
  * agent-facing surface is EITHER gated OR explicitly labeled — never neither.
  */
 const MS_PER_MINUTE = 60_000;
+/** Mark retained findings whose replacement result could not be reconciled. */
+export function markUnreconciledFindings(findings) {
+    return findings.map((finding) => ({ ...finding, stale: true }));
+}
 /**
  * Render a short, honest age suffix for a store that cannot be freshness-
  * gated per-path (see module doc). `undefined`/unparseable `scannedAt`

package/node_modules/pi-lens/dist/clients/formatters.js

@@ -15,7 +15,8 @@ import * as os from "node:os";
 import * as path from "node:path";
 import { BoundedLruCache } from "./bounded-cache.js";
 import { createGenerationSource } from "./generation-guard.js";
-import { findNearestMarkerRoot, isRealGitMarker, normalizeMapKey, } from "./path-utils.js";
+import { normalizeMapKey } from "./path-utils.js";
+import { resolveToolCwd } from "./tool-cwd.js";
 import { resolveCargoPackageEdition } from "./cargo-manifest.js";
 import { resolveKtfmtGradleStyle } from "./gradle-ktfmt-style.js";
 import { resolvePhpCsFixerConfig } from "./php-cs-fixer-config.js";
@@ -27,8 +28,10 @@ import { compareOrdinal } from "./string-utils.js";
 import { classifyProbeFailure, createAvailabilityLatch, logAvailabilityDecision, startHostStallSampler, } from "./dispatch/runners/utils/availability-policy.js";
 import { findGlobalBinary, findLocalBinUpwards, VENDOR_BIN_DIRS, VENV_BIN_DIRS, } from "./package-manager.js";
 import { safeSpawnAsync } from "./safe-spawn.js";
+import { probeToolAsync } from "./tool-probe.js";
 import { assertInstallAllowed } from "./project-trust.js";
 import { tryLazyInstallForFormatter } from "./dispatch/runners/utils/lazy-installer.js";
+import { getToolPath } from "./installer/index.js";
 import { findPSScriptAnalyzerConfigPath, getAutoInstallToolIdForFormatter, getFormatterPolicyForFile, getSmartDefaultFormatterName, hasBiomeConfig, hasBlackConfig, hasClangFormatConfig, hasCljfmtConfig, hasCmakeFormatConfig, hasCsharpierConfig, hasFantomasConfig, hasGoogleJavaFormatConfig, hasKtfmtConfig, hasKtlintConfig, hasMixFormatConfig, hasNearestPackageJsonDependency, hasNearestPackageJsonField, hasOcamlformatConfig, hasOrmoluConfig, hasOxfmtConfig, hasOxfmtSvelteConfig, hasPhpCsFixerConfig, hasPrettierConfig, hasPSScriptAnalyzerConfig, hasRubocopConfig, hasRuffConfig, hasSqlfluffConfig, hasStandardrbConfig, hasStyluaConfig, hasSwiftformatConfig, hasTaploConfig, hasTerraformConfig, hasVitePlusConfig, OXFMT_SUPPORTED_EXTENSIONS, } from "./tool-policy.js";
 /**
  * Lazy-install a formatter's tool, through the shared seam (#1537).
@@ -380,7 +383,7 @@ async function resolveGoFmtBinary() {
     const inPath = await which("gofmt");
     if (inPath)
         return inPath;
-    const goCheck = await safeSpawnAsync("go", ["env", "GOROOT"], {
+    const goCheck = await probeToolAsync("go", ["env", "GOROOT"], {
         timeout: 5000,
     });
     if (goCheck.error || goCheck.status !== 0)
@@ -468,6 +471,22 @@ async function resolveManagedSmartDefaultCommand(formatterName, filePath, args)
         return null;
     return [installed, ...args, filePath];
 }
+/** Resolve an explicitly selected formatter from the shared managed-tool seam. */
+async function resolveManagedFormatterCommand(toolId, filePath, args, findLocal, cwd) {
+    const local = findLocal && cwd ? await findLocal(toolId, cwd) : null;
+    const installed = local ?? (await which(toolId)) ?? (await getToolPath(toolId));
+    return installed ? [installed, ...args, filePath] : FORMATTER_UNAVAILABLE;
+}
+function managedFormatterResolver(toolId, args, findLocal) {
+    return (filePath, cwd) => resolveManagedFormatterCommand(toolId, filePath, args, findLocal, cwd);
+}
+function managedToolDetect(toolId, configDetect, nativeDetect) {
+    return async (cwd) => {
+        const available = (nativeDetect && (await nativeDetect(cwd))) ||
+            Boolean(await getToolPath(toolId));
+        return available && (configDetect ? await configDetect(cwd) : true);
+    };
+}
 /**
  * One entry per formatter that can be selected via explicit project config
  * (the `formatterPolicy` "explicit-config" branch of `getFormattersForFile`).
@@ -603,109 +622,19 @@ async function indentationArgs(filePath, tool, cwd) {
         String(indentation.width),
     ];
 }
-const FORMATTER_MARKERS_BY_NAME = new Map([
-    ["biome", ["biome.json", "biome.jsonc", "package.json"]],
-    [
-        "prettier",
-        [
-            ".prettierrc",
-            ".prettierrc.json",
-            ".prettierrc.yaml",
-            ".prettierrc.yml",
-            ".prettierrc.js",
-            ".prettierrc.cjs",
-            ".prettierrc.mjs",
-            "prettier.config.js",
-            "prettier.config.cjs",
-            "prettier.config.mjs",
-            ".prettierignore",
-            "package.json",
-        ],
-    ],
-    [
-        "oxfmt",
-        ["oxfmt.toml", ".oxfmtrc.json", "vite-plus.json", "package.json"],
-    ],
-    ["ruff", ["pyproject.toml", "ruff.toml", ".ruff.toml"]],
-    ["black", ["pyproject.toml", "black.toml", ".black"]],
-    ["sqlfluff", [".sqlfluff", "pyproject.toml", "setup.cfg"]],
-    ["rustfmt", ["rustfmt.toml", ".rustfmt.toml", "Cargo.toml"]],
-    ["rubocop", [".rubocop.yml", ".rubocop.yaml"]],
-    ["standardrb", [".standard.yml", ".standard.yaml"]],
-    ["clang-format", [".clang-format", "_clang-format"]],
-    ["php-cs-fixer", [".php-cs-fixer.php", ".php-cs-fixer.dist.php"]],
-    ["stylua", ["stylua.toml", ".stylua.toml"]],
-    ["ocamlformat", [".ocamlformat"]],
-    ["google-java-format", [".google-java-format", ".editorconfig"]],
-    ["cljfmt", [".cljfmt.edn", "cljfmt.edn", ".cljfmt"]],
-    [
-        "cmake-format",
-        [
-            ".cmake-format",
-            ".cmake-format.yaml",
-            ".cmake-format.yml",
-            ".cmake-format.json",
-            ".cmake-format.py",
-            "cmake-format.yaml",
-            "cmake-format.yml",
-            ".editorconfig",
-        ],
-    ],
-    [
-        "psscriptanalyzer-format",
-        ["PSScriptAnalyzerSettings.psd1", "ScriptAnalyzerSettings.psd1"],
-    ],
-    [
-        "csharpier",
-        [
-            ".csharpierrc",
-            ".csharpierrc.json",
-            ".csharpierrc.yaml",
-            ".csharpierrc.yml",
-        ],
-    ],
-    ["ormolu", [".ormolu"]],
-    ["taplo", ["taplo.toml", ".taplo.toml"]],
-    ["terraform", [".terraform.lock.hcl"]],
-    ["swiftformat", [".swiftformat"]],
-    ["fantomas", [".fantomasignore", ".editorconfig"]],
-    ["mix", [".formatter.exs"]],
-    ["shfmt", [".editorconfig"]],
-    ["ktlint", [".editorconfig"]],
-    [
-        "ktfmt",
-        [
-            ".editorconfig",
-            ".ktfmt",
-            ".ktfmt.kts",
-            "build.gradle",
-            "build.gradle.kts",
-            "settings.gradle",
-            "settings.gradle.kts",
-        ],
-    ],
-]);
 /**
  * Resolve the cwd for the formatter child, capped at the user's home
  * directory. Files outside a project retain the historical file-directory
  * cwd. The optional homeDir is only for the ceiling regression test.
  */
 export function resolveFormatterCwd(absolutePath, formatterName, homeDir = os.homedir()) {
-    const fileDir = path.dirname(path.resolve(absolutePath));
-    const effectiveHome = homeDir || undefined;
-    const markers = formatterName
-        ? [...(FORMATTER_MARKERS_BY_NAME.get(formatterName) ?? []), ".gitignore"]
-        : [".gitignore"];
-    const root = findNearestMarkerRoot(fileDir, markers, {
-        homeDir: effectiveHome,
-    });
-    if (root)
-        return root;
-    const gitRoot = findNearestMarkerRoot(fileDir, [".git"], {
-        homeDir: effectiveHome,
-        markerPredicate: isRealGitMarker,
+    return resolveToolCwd("formatter", formatterName ?? "unknown", absolutePath, {
+        // Formatter discovery historically walks above the file directory. The
+        // filesystem root is the neutral dispatch boundary; the seam's `$HOME`
+        // ceiling prevents it from escaping the user's workspace.
+        cwd: path.parse(path.resolve(absolutePath)).root,
+        homeDir,
     });
-    return gitRoot ?? fileDir;
 }
 /**
  * Every biome invocation must carry this. Biome exits 1 with "No files were
@@ -888,11 +817,7 @@ export const oxfmtFormatter = {
         const found = await which("oxfmt");
         if (found)
             return [found, OXFMT_NO_ERROR_ON_UNMATCHED, filePath];
-        // #2413: neither node_modules/.bin nor PATH has oxfmt, and `detect()` is
-        // config-only (it never probes the binary), so selection can reach here
-        // with nothing installed. The static command is bare `oxfmt` — spawning it
-        // only reproduces the reported `spawn oxfmt ENOENT`. Prove it unavailable.
-        return FORMATTER_UNAVAILABLE;
+        return ((await resolveManagedFormatterCommand("oxfmt", filePath, [OXFMT_NO_ERROR_ON_UNMATCHED], findInNodeModules, cwd)) ?? FORMATTER_UNAVAILABLE);
     },
     // Single source of truth: OXFMT_SUPPORTED_EXTENSIONS in tool-policy.ts.
     // Do not hand-maintain a second copy of this list (#1134 — previously two
@@ -941,21 +866,14 @@ export const ruffFormatter = {
             return true;
         // No-config fallback: if Ruff is already available, allow formatter usage.
         // This keeps Python default behavior consistent with startup defaults.
-        const { getToolPath } = await import("./installer/index.js");
-        const installed = await getToolPath("ruff");
-        return Boolean(installed);
+        return Boolean(await getToolPath("ruff"));
     },
 };
 export const blackFormatter = {
     name: "black",
     command: ["black", "$FILE"],
     extensions: [".py", ".pyi"],
-    async resolveCommand(filePath, cwd) {
-        const venv = await findInVenv("black", cwd);
-        if (venv)
-            return [venv, filePath];
-        return null;
-    },
+    resolveCommand: managedFormatterResolver("black", [], findInVenv),
     async detect(cwd) {
         return hasBlackConfig(cwd);
     },
@@ -1054,12 +972,7 @@ export const shfmtFormatter = {
             ...styleArgs,
         ]);
     },
-    async detect(_cwd) {
-        if ((await which("shfmt")) !== null)
-            return true;
-        const { getToolPath } = await import("./installer/index.js");
-        return Boolean(await getToolPath("shfmt"));
-    },
+    detect: managedToolDetect("shfmt", undefined, async () => (await which("shfmt")) !== null),
 };
 export const nixfmtFormatter = {
     name: "nixfmt",
@@ -1121,12 +1034,7 @@ export const ktlintFormatter = {
             return [inPath, "-F", filePath];
         return resolveManagedSmartDefaultCommand("ktlint", filePath, ["-F"]);
     },
-    async detect(_cwd) {
-        if ((await which("ktlint")) !== null)
-            return true;
-        const { getToolPath } = await import("./installer/index.js");
-        return Boolean(await getToolPath("ktlint"));
-    },
+    detect: managedToolDetect("ktlint", undefined, async () => (await which("ktlint")) !== null),
 };
 export const ktfmtFormatter = {
     name: "ktfmt",
@@ -1256,36 +1164,25 @@ export const phpCsFixerFormatter = {
         const configPath = resolvePhpCsFixerConfig(filePath);
         const binary = (await findInVendorBin("php-cs-fixer", cwd)) ??
             (await which("php-cs-fixer"));
+        const managed = await resolveManagedFormatterCommand("php-cs-fixer", filePath, [], findInVendorBin, cwd);
+        if (managed === FORMATTER_UNAVAILABLE)
+            return FORMATTER_UNAVAILABLE;
+        const resolved = binary ?? managed[0];
         // #2413/#2472 review F4: both probes (vendor/bin, then PATH) have
         // PROVEN the binary is absent — returning `null` here would fall back
         // to the static `command` above, which is the SAME bare
         // `php-cs-fixer` this just failed to find, spawning it only to
         // re-observe the ENOENT already known. Report the proven-missing
         // state instead so `formatFile` skips the wasted spawn.
-        if (!binary)
+        if (!resolved)
             return FORMATTER_UNAVAILABLE;
         return configPath
-            ? [binary, "fix", "--config", configPath, filePath]
-            : [binary, "fix", filePath];
-    },
-    async detect(cwd) {
-        const vendorBin = await findInVendorBin("php-cs-fixer", cwd);
-        const globalBin = await which("php-cs-fixer");
-        if (!vendorBin && !globalBin)
-            return false;
-        // Only run if project has explicit config. This is a presence-only
-        // climb from the project `cwd` (not necessarily the formatted file's
-        // own directory) via this file's own `findUp` — deliberately NOT
-        // merged with `resolvePhpCsFixerConfig` above (#2472 AC4): that
-        // resolver climbs from the FILE's directory and needs the exact
-        // winning path for `--config`, while this only needs a yes/no answer
-        // from whatever `cwd` the caller passed. `rustfmtFormatter.detect`
-        // keeps the same non-merged shape against `resolveCargoPackageEdition`
-        // for the identical reason.
-        const configs = [".php-cs-fixer.php", ".php-cs-fixer.dist.php"];
-        const found = await findUp(configs, cwd);
-        return found.length > 0;
+            ? [resolved, "fix", "--config", configPath, filePath]
+            : [resolved, "fix", filePath];
     },
+    detect: managedToolDetect("php-cs-fixer", async (cwd) => (await findUp([".php-cs-fixer.php", ".php-cs-fixer.dist.php"], cwd))
+        .length > 0, async (cwd) => Boolean((await findInVendorBin("php-cs-fixer", cwd)) ||
+        (await which("php-cs-fixer")))),
 };
 export const csharpierFormatter = {
     name: "csharpier",
@@ -1301,9 +1198,7 @@ export const csharpierFormatter = {
         }
         // CSharpier 0.x: invoked through the dotnet driver.
         if ((await which("dotnet")) !== null) {
-            const legacy = await safeSpawnAsync("dotnet", ["csharpier", "--version"], {
-                timeout: 5000,
-            });
+            const legacy = await probeToolAsync("dotnet", ["csharpier", "--version"], { timeout: 5000 });
             if (!legacy.error && legacy.status === 0) {
                 return ["dotnet", "csharpier", filePath];
             }
@@ -1317,7 +1212,7 @@ export const csharpierFormatter = {
         // … or the legacy dotnet-driver form (CSharpier 0.x).
         if ((await which("dotnet")) === null)
             return false;
-        const result = await safeSpawnAsync("dotnet", ["csharpier", "--version"], {
+        const result = await probeToolAsync("dotnet", ["csharpier", "--version"], {
             timeout: 5000,
         });
         return !result.error && result.status === 0;
@@ -1343,23 +1238,8 @@ export const styluaFormatter = {
     name: "stylua",
     command: ["stylua", "$FILE"],
     extensions: [".lua"],
-    async resolveCommand(filePath, cwd) {
-        // Project binary first (#1731, discipline B): stylua has no pi-lens
-        // managed install, so before this the ONLY resolution was a bare
-        // `stylua` PATH lookup — a project-local install via npm
-        // `@johnnymorganz/stylua` (`node_modules/.bin/stylua`) was invisible.
-        const local = findLocalBinUpwards("stylua", cwd);
-        return local ? [local, filePath] : null;
-    },
-    async detect(cwd) {
-        const local = findLocalBinUpwards("stylua", cwd);
-        if (!local && (await which("stylua")) === null)
-            return false;
-        // Prefer explicit config but also run if binary is present in a Lua project
-        const configs = ["stylua.toml", ".stylua.toml"];
-        const found = await findUp(configs, cwd);
-        return found.length > 0;
-    },
+    resolveCommand: managedFormatterResolver("stylua", [], findLocalBinUpwards),
+    detect: managedToolDetect("stylua", async (cwd) => (await findUp(["stylua.toml", ".stylua.toml"], cwd)).length > 0, async (cwd) => Boolean(findLocalBinUpwards("stylua", cwd) || (await which("stylua")))),
 };
 export const ormoluFormatter = {
     name: "ormolu",
@@ -1379,42 +1259,28 @@ export const taploFormatter = {
             return [inPath, "fmt", filePath];
         return resolveManagedSmartDefaultCommand("taplo", filePath, ["fmt"]);
     },
-    async detect(_cwd) {
-        if ((await which("taplo")) !== null)
-            return true;
-        const { getToolPath } = await import("./installer/index.js");
-        return Boolean(await getToolPath("taplo"));
-    },
+    detect: managedToolDetect("taplo", undefined, async () => (await which("taplo")) !== null),
 };
 export const googleJavaFormatFormatter = {
     name: "google-java-format",
     command: ["google-java-format", "--replace", "$FILE"],
     extensions: [".java"],
-    async detect(cwd) {
-        if ((await which("google-java-format")) === null)
-            return false;
-        return hasGoogleJavaFormatConfig(cwd);
-    },
+    resolveCommand: managedFormatterResolver("google-java-format", ["--replace"]),
+    detect: managedToolDetect("google-java-format", hasGoogleJavaFormatConfig, async () => (await which("google-java-format")) !== null),
 };
 export const cljfmtFormatter = {
     name: "cljfmt",
     command: ["cljfmt", "fix", "$FILE"],
     extensions: [".clj", ".cljc", ".cljs"],
-    async detect(cwd) {
-        if ((await which("cljfmt")) === null)
-            return false;
-        return hasCljfmtConfig(cwd);
-    },
+    resolveCommand: managedFormatterResolver("cljfmt", ["fix"]),
+    detect: managedToolDetect("cljfmt", hasCljfmtConfig, async () => (await which("cljfmt")) !== null),
 };
 export const cmakeFormatFormatter = {
     name: "cmake-format",
     command: ["cmake-format", "-i", "$FILE"],
     extensions: [".cmake"],
-    async detect(cwd) {
-        if ((await which("cmake-format")) === null)
-            return false;
-        return hasCmakeFormatConfig(cwd);
-    },
+    resolveCommand: managedFormatterResolver("cmake-format", ["-i"]),
+    detect: managedToolDetect("cmake-format", hasCmakeFormatConfig, async () => (await which("cmake-format")) !== null),
 };
 export const cueFormatter = {
     name: "cue",
@@ -1487,7 +1353,7 @@ export const psscriptanalyzerFormatFormatter = {
         if (!pwsh)
             return false;
         // Check PSScriptAnalyzer module is available
-        const result = await safeSpawnAsync(pwsh, [
+        const result = await probeToolAsync(pwsh, [
             "-NoProfile",
             "-Command",
             "Get-Module -ListAvailable PSScriptAnalyzer | Select-Object -First 1 -ExpandProperty Name",

package/node_modules/pi-lens/dist/clients/generation-guard.js

@@ -186,6 +186,10 @@ export function createGenerationMap(name, options = {}) {
             invalidations += 1;
             stamps.delete(normalize(key));
         },
+        clear() {
+            invalidations += 1;
+            stamps.clear();
+        },
         size() {
             return stamps.size;
         },

package/node_modules/pi-lens/dist/clients/gitleaks-client.js

@@ -45,11 +45,12 @@
  * module doc for why blanket gitignore-respect is wrong for a secrets scanner
  * (an untracked `.env` with a real credential is exactly the case gitleaks
  * exists to catch, and `.env` is commonly gitignored). `classifyAndFilterFindings`
- * backstops the config with a TS-side re-classification: a finding under the
- * secrets-lane scratch tier is DEMOTED (not deleted) to `severity: "info"`,
- * `semantic: "none"`, `pathStatus: "scratch"` — visible for an audit read,
- * but it can never surface as a blocking "leaked secret" alarm. Every other
- * finding gets `pathStatus` from git's tracked/ignored view.
+ * backstops the config with a TS-side re-classification. Findings under the
+ * secrets-lane scratch tier, in gitignored files, or inside nested repositories
+ * are DEMOTED (not deleted) to `severity: "info"` / `semantic: "none"` by the
+ * project-diagnostics adapter. They remain visible for an explicit audit but
+ * can never surface as blocking "leaked secret" alarms or automatic turn
+ * context. Tracked and ordinary untracked files remain blocking.
  *
  * Refs: #130, #1562
  */
@@ -333,8 +334,10 @@ export class GitleaksClient extends SecurityScanClient {
             }
             const rawFindings = parseGitleaksReport(fs.readFileSync(reportPath, "utf-8"));
             const findings = await classifyAndFilterFindings(rawFindings, cwd);
+            // #2154: the one gitleaks site that parsed a scan of this root.
             return {
                 success: true,
+                analyzed: true,
                 findings,
                 scannedAt,
             };
@@ -375,7 +378,10 @@ export class GitleaksClient extends SecurityScanClient {
  *      assert the config we hand it, so this backstop guarantees the demotion
  *      even if the generated regex ever mismatches gitleaks's own path
  *      normalization.
- *   2. Every OTHER finding gets `pathStatus` set from git's tracked/ignored
+ *   2. A finding below a nested git boundary is labelled
+ *      `nested-repository`. Parent scans must not claim ownership of a
+ *      submodule's or nested repository's files.
+ *   3. Every OTHER finding gets `pathStatus` set from git's tracked/ignored
  *      view, so a future false-positive triage is a log read.
  *
  * `collectTrackedFiles`/`collectUntrackedIgnoredIds` degrade to `undefined`
@@ -383,6 +389,32 @@ export class GitleaksClient extends SecurityScanClient {
  * keep `pathStatus: undefined` rather than a guessed value (fail-open,
  * matching `git-tracked-ignore.ts`'s own contract). Exported for unit tests.
  */
+function isInsideNestedGitRepository(file, cwd) {
+    const root = path.resolve(cwd);
+    const absoluteFile = path.isAbsolute(file)
+        ? path.resolve(file)
+        : path.resolve(root, file);
+    const relative = path.relative(root, absoluteFile);
+    if (relative === ".." ||
+        relative.startsWith(`..${path.sep}`) ||
+        path.isAbsolute(relative))
+        return false;
+    let directory = path.dirname(absoluteFile);
+    while (directory !== root) {
+        try {
+            if (fs.existsSync(path.join(directory, ".git")))
+                return true;
+        }
+        catch {
+            return false;
+        }
+        const parent = path.dirname(directory);
+        if (parent === directory)
+            return false;
+        directory = parent;
+    }
+    return false;
+}
 export async function classifyAndFilterFindings(findings, cwd) {
     if (findings.length === 0)
         return findings;
@@ -399,6 +431,10 @@ export async function classifyAndFilterFindings(findings, cwd) {
         const absPath = path.isAbsolute(finding.file)
             ? finding.file
             : path.resolve(cwd, finding.file);
+        if (isInsideNestedGitRepository(absPath, cwd)) {
+            classified.push({ ...finding, pathStatus: "nested-repository" });
+            continue;
+        }
         let pathStatus;
         if (trackedIds?.has(normalizeEphemeralMapKey(absPath))) {
             pathStatus = "tracked";