@herbertgao/pi-extensions 2026.9.2 → 2026.9.4

package/node_modules/pi-lens/dist/clients/formatters.js

@@ -15,7 +15,8 @@ import * as os from "node:os";
 import * as path from "node:path";
 import { BoundedLruCache } from "./bounded-cache.js";
 import { createGenerationSource } from "./generation-guard.js";
-import { findNearestMarkerRoot, isRealGitMarker, normalizeMapKey, } from "./path-utils.js";
+import { normalizeMapKey } from "./path-utils.js";
+import { resolveToolCwd } from "./tool-cwd.js";
 import { resolveCargoPackageEdition } from "./cargo-manifest.js";
 import { resolveKtfmtGradleStyle } from "./gradle-ktfmt-style.js";
 import { resolvePhpCsFixerConfig } from "./php-cs-fixer-config.js";
@@ -27,8 +28,10 @@ import { compareOrdinal } from "./string-utils.js";
 import { classifyProbeFailure, createAvailabilityLatch, logAvailabilityDecision, startHostStallSampler, } from "./dispatch/runners/utils/availability-policy.js";
 import { findGlobalBinary, findLocalBinUpwards, VENDOR_BIN_DIRS, VENV_BIN_DIRS, } from "./package-manager.js";
 import { safeSpawnAsync } from "./safe-spawn.js";
+import { probeToolAsync } from "./tool-probe.js";
 import { assertInstallAllowed } from "./project-trust.js";
 import { tryLazyInstallForFormatter } from "./dispatch/runners/utils/lazy-installer.js";
+import { getToolPath } from "./installer/index.js";
 import { findPSScriptAnalyzerConfigPath, getAutoInstallToolIdForFormatter, getFormatterPolicyForFile, getSmartDefaultFormatterName, hasBiomeConfig, hasBlackConfig, hasClangFormatConfig, hasCljfmtConfig, hasCmakeFormatConfig, hasCsharpierConfig, hasFantomasConfig, hasGoogleJavaFormatConfig, hasKtfmtConfig, hasKtlintConfig, hasMixFormatConfig, hasNearestPackageJsonDependency, hasNearestPackageJsonField, hasOcamlformatConfig, hasOrmoluConfig, hasOxfmtConfig, hasOxfmtSvelteConfig, hasPhpCsFixerConfig, hasPrettierConfig, hasPSScriptAnalyzerConfig, hasRubocopConfig, hasRuffConfig, hasSqlfluffConfig, hasStandardrbConfig, hasStyluaConfig, hasSwiftformatConfig, hasTaploConfig, hasTerraformConfig, hasVitePlusConfig, OXFMT_SUPPORTED_EXTENSIONS, } from "./tool-policy.js";
 /**
  * Lazy-install a formatter's tool, through the shared seam (#1537).
@@ -380,7 +383,7 @@ async function resolveGoFmtBinary() {
     const inPath = await which("gofmt");
     if (inPath)
         return inPath;
-    const goCheck = await safeSpawnAsync("go", ["env", "GOROOT"], {
+    const goCheck = await probeToolAsync("go", ["env", "GOROOT"], {
         timeout: 5000,
     });
     if (goCheck.error || goCheck.status !== 0)
@@ -468,6 +471,22 @@ async function resolveManagedSmartDefaultCommand(formatterName, filePath, args)
         return null;
     return [installed, ...args, filePath];
 }
+/** Resolve an explicitly selected formatter from the shared managed-tool seam. */
+async function resolveManagedFormatterCommand(toolId, filePath, args, findLocal, cwd) {
+    const local = findLocal && cwd ? await findLocal(toolId, cwd) : null;
+    const installed = local ?? (await which(toolId)) ?? (await getToolPath(toolId));
+    return installed ? [installed, ...args, filePath] : FORMATTER_UNAVAILABLE;
+}
+function managedFormatterResolver(toolId, args, findLocal) {
+    return (filePath, cwd) => resolveManagedFormatterCommand(toolId, filePath, args, findLocal, cwd);
+}
+function managedToolDetect(toolId, configDetect, nativeDetect) {
+    return async (cwd) => {
+        const available = (nativeDetect && (await nativeDetect(cwd))) ||
+            Boolean(await getToolPath(toolId));
+        return available && (configDetect ? await configDetect(cwd) : true);
+    };
+}
 /**
  * One entry per formatter that can be selected via explicit project config
  * (the `formatterPolicy` "explicit-config" branch of `getFormattersForFile`).
@@ -603,109 +622,19 @@ async function indentationArgs(filePath, tool, cwd) {
         String(indentation.width),
     ];
 }
-const FORMATTER_MARKERS_BY_NAME = new Map([
-    ["biome", ["biome.json", "biome.jsonc", "package.json"]],
-    [
-        "prettier",
-        [
-            ".prettierrc",
-            ".prettierrc.json",
-            ".prettierrc.yaml",
-            ".prettierrc.yml",
-            ".prettierrc.js",
-            ".prettierrc.cjs",
-            ".prettierrc.mjs",
-            "prettier.config.js",
-            "prettier.config.cjs",
-            "prettier.config.mjs",
-            ".prettierignore",
-            "package.json",
-        ],
-    ],
-    [
-        "oxfmt",
-        ["oxfmt.toml", ".oxfmtrc.json", "vite-plus.json", "package.json"],
-    ],
-    ["ruff", ["pyproject.toml", "ruff.toml", ".ruff.toml"]],
-    ["black", ["pyproject.toml", "black.toml", ".black"]],
-    ["sqlfluff", [".sqlfluff", "pyproject.toml", "setup.cfg"]],
-    ["rustfmt", ["rustfmt.toml", ".rustfmt.toml", "Cargo.toml"]],
-    ["rubocop", [".rubocop.yml", ".rubocop.yaml"]],
-    ["standardrb", [".standard.yml", ".standard.yaml"]],
-    ["clang-format", [".clang-format", "_clang-format"]],
-    ["php-cs-fixer", [".php-cs-fixer.php", ".php-cs-fixer.dist.php"]],
-    ["stylua", ["stylua.toml", ".stylua.toml"]],
-    ["ocamlformat", [".ocamlformat"]],
-    ["google-java-format", [".google-java-format", ".editorconfig"]],
-    ["cljfmt", [".cljfmt.edn", "cljfmt.edn", ".cljfmt"]],
-    [
-        "cmake-format",
-        [
-            ".cmake-format",
-            ".cmake-format.yaml",
-            ".cmake-format.yml",
-            ".cmake-format.json",
-            ".cmake-format.py",
-            "cmake-format.yaml",
-            "cmake-format.yml",
-            ".editorconfig",
-        ],
-    ],
-    [
-        "psscriptanalyzer-format",
-        ["PSScriptAnalyzerSettings.psd1", "ScriptAnalyzerSettings.psd1"],
-    ],
-    [
-        "csharpier",
-        [
-            ".csharpierrc",
-            ".csharpierrc.json",
-            ".csharpierrc.yaml",
-            ".csharpierrc.yml",
-        ],
-    ],
-    ["ormolu", [".ormolu"]],
-    ["taplo", ["taplo.toml", ".taplo.toml"]],
-    ["terraform", [".terraform.lock.hcl"]],
-    ["swiftformat", [".swiftformat"]],
-    ["fantomas", [".fantomasignore", ".editorconfig"]],
-    ["mix", [".formatter.exs"]],
-    ["shfmt", [".editorconfig"]],
-    ["ktlint", [".editorconfig"]],
-    [
-        "ktfmt",
-        [
-            ".editorconfig",
-            ".ktfmt",
-            ".ktfmt.kts",
-            "build.gradle",
-            "build.gradle.kts",
-            "settings.gradle",
-            "settings.gradle.kts",
-        ],
-    ],
-]);
 /**
  * Resolve the cwd for the formatter child, capped at the user's home
  * directory. Files outside a project retain the historical file-directory
  * cwd. The optional homeDir is only for the ceiling regression test.
  */
 export function resolveFormatterCwd(absolutePath, formatterName, homeDir = os.homedir()) {
-    const fileDir = path.dirname(path.resolve(absolutePath));
-    const effectiveHome = homeDir || undefined;
-    const markers = formatterName
-        ? [...(FORMATTER_MARKERS_BY_NAME.get(formatterName) ?? []), ".gitignore"]
-        : [".gitignore"];
-    const root = findNearestMarkerRoot(fileDir, markers, {
-        homeDir: effectiveHome,
-    });
-    if (root)
-        return root;
-    const gitRoot = findNearestMarkerRoot(fileDir, [".git"], {
-        homeDir: effectiveHome,
-        markerPredicate: isRealGitMarker,
+    return resolveToolCwd("formatter", formatterName ?? "unknown", absolutePath, {
+        // Formatter discovery historically walks above the file directory. The
+        // filesystem root is the neutral dispatch boundary; the seam's `$HOME`
+        // ceiling prevents it from escaping the user's workspace.
+        cwd: path.parse(path.resolve(absolutePath)).root,
+        homeDir,
     });
-    return gitRoot ?? fileDir;
 }
 /**
  * Every biome invocation must carry this. Biome exits 1 with "No files were
@@ -888,11 +817,7 @@ export const oxfmtFormatter = {
         const found = await which("oxfmt");
         if (found)
             return [found, OXFMT_NO_ERROR_ON_UNMATCHED, filePath];
-        // #2413: neither node_modules/.bin nor PATH has oxfmt, and `detect()` is
-        // config-only (it never probes the binary), so selection can reach here
-        // with nothing installed. The static command is bare `oxfmt` — spawning it
-        // only reproduces the reported `spawn oxfmt ENOENT`. Prove it unavailable.
-        return FORMATTER_UNAVAILABLE;
+        return ((await resolveManagedFormatterCommand("oxfmt", filePath, [OXFMT_NO_ERROR_ON_UNMATCHED], findInNodeModules, cwd)) ?? FORMATTER_UNAVAILABLE);
     },
     // Single source of truth: OXFMT_SUPPORTED_EXTENSIONS in tool-policy.ts.
     // Do not hand-maintain a second copy of this list (#1134 — previously two
@@ -941,21 +866,14 @@ export const ruffFormatter = {
             return true;
         // No-config fallback: if Ruff is already available, allow formatter usage.
         // This keeps Python default behavior consistent with startup defaults.
-        const { getToolPath } = await import("./installer/index.js");
-        const installed = await getToolPath("ruff");
-        return Boolean(installed);
+        return Boolean(await getToolPath("ruff"));
     },
 };
 export const blackFormatter = {
     name: "black",
     command: ["black", "$FILE"],
     extensions: [".py", ".pyi"],
-    async resolveCommand(filePath, cwd) {
-        const venv = await findInVenv("black", cwd);
-        if (venv)
-            return [venv, filePath];
-        return null;
-    },
+    resolveCommand: managedFormatterResolver("black", [], findInVenv),
     async detect(cwd) {
         return hasBlackConfig(cwd);
     },
@@ -1054,12 +972,7 @@ export const shfmtFormatter = {
             ...styleArgs,
         ]);
     },
-    async detect(_cwd) {
-        if ((await which("shfmt")) !== null)
-            return true;
-        const { getToolPath } = await import("./installer/index.js");
-        return Boolean(await getToolPath("shfmt"));
-    },
+    detect: managedToolDetect("shfmt", undefined, async () => (await which("shfmt")) !== null),
 };
 export const nixfmtFormatter = {
     name: "nixfmt",
@@ -1121,12 +1034,7 @@ export const ktlintFormatter = {
             return [inPath, "-F", filePath];
         return resolveManagedSmartDefaultCommand("ktlint", filePath, ["-F"]);
     },
-    async detect(_cwd) {
-        if ((await which("ktlint")) !== null)
-            return true;
-        const { getToolPath } = await import("./installer/index.js");
-        return Boolean(await getToolPath("ktlint"));
-    },
+    detect: managedToolDetect("ktlint", undefined, async () => (await which("ktlint")) !== null),
 };
 export const ktfmtFormatter = {
     name: "ktfmt",
@@ -1256,36 +1164,25 @@ export const phpCsFixerFormatter = {
         const configPath = resolvePhpCsFixerConfig(filePath);
         const binary = (await findInVendorBin("php-cs-fixer", cwd)) ??
             (await which("php-cs-fixer"));
+        const managed = await resolveManagedFormatterCommand("php-cs-fixer", filePath, [], findInVendorBin, cwd);
+        if (managed === FORMATTER_UNAVAILABLE)
+            return FORMATTER_UNAVAILABLE;
+        const resolved = binary ?? managed[0];
         // #2413/#2472 review F4: both probes (vendor/bin, then PATH) have
         // PROVEN the binary is absent — returning `null` here would fall back
         // to the static `command` above, which is the SAME bare
         // `php-cs-fixer` this just failed to find, spawning it only to
         // re-observe the ENOENT already known. Report the proven-missing
         // state instead so `formatFile` skips the wasted spawn.
-        if (!binary)
+        if (!resolved)
             return FORMATTER_UNAVAILABLE;
         return configPath
-            ? [binary, "fix", "--config", configPath, filePath]
-            : [binary, "fix", filePath];
-    },
-    async detect(cwd) {
-        const vendorBin = await findInVendorBin("php-cs-fixer", cwd);
-        const globalBin = await which("php-cs-fixer");
-        if (!vendorBin && !globalBin)
-            return false;
-        // Only run if project has explicit config. This is a presence-only
-        // climb from the project `cwd` (not necessarily the formatted file's
-        // own directory) via this file's own `findUp` — deliberately NOT
-        // merged with `resolvePhpCsFixerConfig` above (#2472 AC4): that
-        // resolver climbs from the FILE's directory and needs the exact
-        // winning path for `--config`, while this only needs a yes/no answer
-        // from whatever `cwd` the caller passed. `rustfmtFormatter.detect`
-        // keeps the same non-merged shape against `resolveCargoPackageEdition`
-        // for the identical reason.
-        const configs = [".php-cs-fixer.php", ".php-cs-fixer.dist.php"];
-        const found = await findUp(configs, cwd);
-        return found.length > 0;
+            ? [resolved, "fix", "--config", configPath, filePath]
+            : [resolved, "fix", filePath];
     },
+    detect: managedToolDetect("php-cs-fixer", async (cwd) => (await findUp([".php-cs-fixer.php", ".php-cs-fixer.dist.php"], cwd))
+        .length > 0, async (cwd) => Boolean((await findInVendorBin("php-cs-fixer", cwd)) ||
+        (await which("php-cs-fixer")))),
 };
 export const csharpierFormatter = {
     name: "csharpier",
@@ -1301,9 +1198,7 @@ export const csharpierFormatter = {
         }
         // CSharpier 0.x: invoked through the dotnet driver.
         if ((await which("dotnet")) !== null) {
-            const legacy = await safeSpawnAsync("dotnet", ["csharpier", "--version"], {
-                timeout: 5000,
-            });
+            const legacy = await probeToolAsync("dotnet", ["csharpier", "--version"], { timeout: 5000 });
             if (!legacy.error && legacy.status === 0) {
                 return ["dotnet", "csharpier", filePath];
             }
@@ -1317,7 +1212,7 @@ export const csharpierFormatter = {
         // … or the legacy dotnet-driver form (CSharpier 0.x).
         if ((await which("dotnet")) === null)
             return false;
-        const result = await safeSpawnAsync("dotnet", ["csharpier", "--version"], {
+        const result = await probeToolAsync("dotnet", ["csharpier", "--version"], {
             timeout: 5000,
         });
         return !result.error && result.status === 0;
@@ -1343,23 +1238,8 @@ export const styluaFormatter = {
     name: "stylua",
     command: ["stylua", "$FILE"],
     extensions: [".lua"],
-    async resolveCommand(filePath, cwd) {
-        // Project binary first (#1731, discipline B): stylua has no pi-lens
-        // managed install, so before this the ONLY resolution was a bare
-        // `stylua` PATH lookup — a project-local install via npm
-        // `@johnnymorganz/stylua` (`node_modules/.bin/stylua`) was invisible.
-        const local = findLocalBinUpwards("stylua", cwd);
-        return local ? [local, filePath] : null;
-    },
-    async detect(cwd) {
-        const local = findLocalBinUpwards("stylua", cwd);
-        if (!local && (await which("stylua")) === null)
-            return false;
-        // Prefer explicit config but also run if binary is present in a Lua project
-        const configs = ["stylua.toml", ".stylua.toml"];
-        const found = await findUp(configs, cwd);
-        return found.length > 0;
-    },
+    resolveCommand: managedFormatterResolver("stylua", [], findLocalBinUpwards),
+    detect: managedToolDetect("stylua", async (cwd) => (await findUp(["stylua.toml", ".stylua.toml"], cwd)).length > 0, async (cwd) => Boolean(findLocalBinUpwards("stylua", cwd) || (await which("stylua")))),
 };
 export const ormoluFormatter = {
     name: "ormolu",
@@ -1379,42 +1259,28 @@ export const taploFormatter = {
             return [inPath, "fmt", filePath];
         return resolveManagedSmartDefaultCommand("taplo", filePath, ["fmt"]);
     },
-    async detect(_cwd) {
-        if ((await which("taplo")) !== null)
-            return true;
-        const { getToolPath } = await import("./installer/index.js");
-        return Boolean(await getToolPath("taplo"));
-    },
+    detect: managedToolDetect("taplo", undefined, async () => (await which("taplo")) !== null),
 };
 export const googleJavaFormatFormatter = {
     name: "google-java-format",
     command: ["google-java-format", "--replace", "$FILE"],
     extensions: [".java"],
-    async detect(cwd) {
-        if ((await which("google-java-format")) === null)
-            return false;
-        return hasGoogleJavaFormatConfig(cwd);
-    },
+    resolveCommand: managedFormatterResolver("google-java-format", ["--replace"]),
+    detect: managedToolDetect("google-java-format", hasGoogleJavaFormatConfig, async () => (await which("google-java-format")) !== null),
 };
 export const cljfmtFormatter = {
     name: "cljfmt",
     command: ["cljfmt", "fix", "$FILE"],
     extensions: [".clj", ".cljc", ".cljs"],
-    async detect(cwd) {
-        if ((await which("cljfmt")) === null)
-            return false;
-        return hasCljfmtConfig(cwd);
-    },
+    resolveCommand: managedFormatterResolver("cljfmt", ["fix"]),
+    detect: managedToolDetect("cljfmt", hasCljfmtConfig, async () => (await which("cljfmt")) !== null),
 };
 export const cmakeFormatFormatter = {
     name: "cmake-format",
     command: ["cmake-format", "-i", "$FILE"],
     extensions: [".cmake"],
-    async detect(cwd) {
-        if ((await which("cmake-format")) === null)
-            return false;
-        return hasCmakeFormatConfig(cwd);
-    },
+    resolveCommand: managedFormatterResolver("cmake-format", ["-i"]),
+    detect: managedToolDetect("cmake-format", hasCmakeFormatConfig, async () => (await which("cmake-format")) !== null),
 };
 export const cueFormatter = {
     name: "cue",
@@ -1487,7 +1353,7 @@ export const psscriptanalyzerFormatFormatter = {
         if (!pwsh)
             return false;
         // Check PSScriptAnalyzer module is available
-        const result = await safeSpawnAsync(pwsh, [
+        const result = await probeToolAsync(pwsh, [
             "-NoProfile",
             "-Command",
             "Get-Module -ListAvailable PSScriptAnalyzer | Select-Object -First 1 -ExpandProperty Name",

package/node_modules/pi-lens/dist/clients/generation-guard.js

@@ -186,6 +186,10 @@ export function createGenerationMap(name, options = {}) {
             invalidations += 1;
             stamps.delete(normalize(key));
         },
+        clear() {
+            invalidations += 1;
+            stamps.clear();
+        },
         size() {
             return stamps.size;
         },

package/node_modules/pi-lens/dist/clients/gitleaks-client.js

@@ -45,11 +45,12 @@
  * module doc for why blanket gitignore-respect is wrong for a secrets scanner
  * (an untracked `.env` with a real credential is exactly the case gitleaks
  * exists to catch, and `.env` is commonly gitignored). `classifyAndFilterFindings`
- * backstops the config with a TS-side re-classification: a finding under the
- * secrets-lane scratch tier is DEMOTED (not deleted) to `severity: "info"`,
- * `semantic: "none"`, `pathStatus: "scratch"` — visible for an audit read,
- * but it can never surface as a blocking "leaked secret" alarm. Every other
- * finding gets `pathStatus` from git's tracked/ignored view.
+ * backstops the config with a TS-side re-classification. Findings under the
+ * secrets-lane scratch tier, in gitignored files, or inside nested repositories
+ * are DEMOTED (not deleted) to `severity: "info"` / `semantic: "none"` by the
+ * project-diagnostics adapter. They remain visible for an explicit audit but
+ * can never surface as blocking "leaked secret" alarms or automatic turn
+ * context. Tracked and ordinary untracked files remain blocking.
  *
  * Refs: #130, #1562
  */
@@ -333,8 +334,10 @@ export class GitleaksClient extends SecurityScanClient {
             }
             const rawFindings = parseGitleaksReport(fs.readFileSync(reportPath, "utf-8"));
             const findings = await classifyAndFilterFindings(rawFindings, cwd);
+            // #2154: the one gitleaks site that parsed a scan of this root.
             return {
                 success: true,
+                analyzed: true,
                 findings,
                 scannedAt,
             };
@@ -375,7 +378,10 @@ export class GitleaksClient extends SecurityScanClient {
  *      assert the config we hand it, so this backstop guarantees the demotion
  *      even if the generated regex ever mismatches gitleaks's own path
  *      normalization.
- *   2. Every OTHER finding gets `pathStatus` set from git's tracked/ignored
+ *   2. A finding below a nested git boundary is labelled
+ *      `nested-repository`. Parent scans must not claim ownership of a
+ *      submodule's or nested repository's files.
+ *   3. Every OTHER finding gets `pathStatus` set from git's tracked/ignored
  *      view, so a future false-positive triage is a log read.
  *
  * `collectTrackedFiles`/`collectUntrackedIgnoredIds` degrade to `undefined`
@@ -383,6 +389,32 @@ export class GitleaksClient extends SecurityScanClient {
  * keep `pathStatus: undefined` rather than a guessed value (fail-open,
  * matching `git-tracked-ignore.ts`'s own contract). Exported for unit tests.
  */
+function isInsideNestedGitRepository(file, cwd) {
+    const root = path.resolve(cwd);
+    const absoluteFile = path.isAbsolute(file)
+        ? path.resolve(file)
+        : path.resolve(root, file);
+    const relative = path.relative(root, absoluteFile);
+    if (relative === ".." ||
+        relative.startsWith(`..${path.sep}`) ||
+        path.isAbsolute(relative))
+        return false;
+    let directory = path.dirname(absoluteFile);
+    while (directory !== root) {
+        try {
+            if (fs.existsSync(path.join(directory, ".git")))
+                return true;
+        }
+        catch {
+            return false;
+        }
+        const parent = path.dirname(directory);
+        if (parent === directory)
+            return false;
+        directory = parent;
+    }
+    return false;
+}
 export async function classifyAndFilterFindings(findings, cwd) {
     if (findings.length === 0)
         return findings;
@@ -399,6 +431,10 @@ export async function classifyAndFilterFindings(findings, cwd) {
         const absPath = path.isAbsolute(finding.file)
             ? finding.file
             : path.resolve(cwd, finding.file);
+        if (isInsideNestedGitRepository(absPath, cwd)) {
+            classified.push({ ...finding, pathStatus: "nested-repository" });
+            continue;
+        }
         let pathStatus;
         if (trackedIds?.has(normalizeEphemeralMapKey(absPath))) {
             pathStatus = "tracked";

package/node_modules/pi-lens/dist/clients/govulncheck-client.js

@@ -20,6 +20,8 @@ import * as fs from "node:fs";
 import * as os from "node:os";
 import * as path from "node:path";
 import { safeSpawnAsync } from "./safe-spawn.js";
+import { probeToolAsync } from "./tool-probe.js";
+import { firstOutputLine, spawnFailedWithNoOutput, } from "./dispatch/runners/utils/spawn-outcome.js";
 import { assertInstallAllowed } from "./project-trust.js";
 import { SecurityScanClient } from "./security-scan-client.js";
 import { classifyProbeFailure, describeProbeEvidence, INSTALL_TRANSIENT_MAX_ATTEMPTS, logAvailabilityDecision, startHostStallSampler, } from "./dispatch/runners/utils/availability-policy.js";
@@ -86,7 +88,7 @@ export class GovulncheckClient extends SecurityScanClient {
         let goOnPath;
         let goHostStallMs;
         try {
-            goOnPath = await safeSpawnAsync("go", ["version"], {
+            goOnPath = await probeToolAsync("go", ["version"], {
                 timeout: 5000,
             });
         }
@@ -219,7 +221,7 @@ export class GovulncheckClient extends SecurityScanClient {
         let reprobe;
         let reprobeHostStallMs;
         try {
-            reprobe = await safeSpawnAsync("govulncheck", ["-version"], {
+            reprobe = await probeToolAsync("govulncheck", ["-version"], {
                 timeout: 5000,
             });
         }
@@ -366,21 +368,60 @@ export class GovulncheckClient extends SecurityScanClient {
         const bin = this.binaryPath ?? "govulncheck";
         try {
             const result = await safeSpawnAsync(bin, ["-mode=source", "-format=json", "./..."], { cwd, timeout: SCAN_TIMEOUT_MS });
+            // #2154 v4 F1: this was the one runner client with no `result.error`
+            // check before its parse site. `safeSpawnAsync` reports a timeout or
+            // an ambient abort as `{status: null, error, stdout: <partial>}`, and
+            // the old guard (`!stdout.trim() && status !== 0 && status !== 3`)
+            // let that partial stream through as an authoritative scan. Same
+            // order as the seven sibling clients: the process first, its output
+            // second.
+            if (result.error) {
+                this.log(`Scan error: ${result.error.message}`);
+                return {
+                    ...EMPTY_RESULT,
+                    scannedAt,
+                    summary: result.error.message.slice(0, 200),
+                };
+            }
             // govulncheck exits non-zero (status 3) when vulnerabilities are
-            // found — that's success from our perspective. Genuine failures
-            // produce empty stdout + a stderr message.
+            // found — that's success from our perspective. Any other exit code
+            // means the scan was not analysed, even if its config preamble or
+            // partial stream reached stdout before the failure.
             const rawStdout = result.stdout ?? "";
-            if (!rawStdout.trim() && result.status !== 0 && result.status !== 3) {
-                this.log(`Scan failed: ${(result.stderr ?? "").slice(0, 200)}`);
+            if (result.status !== 0 && result.status !== 3) {
+                return {
+                    ...EMPTY_RESULT,
+                    scannedAt,
+                    summary: firstOutputLine(result.stderr) || "scan failed",
+                };
+            }
+            if (!rawStdout.trim()) {
+                // Nothing to parse. `govulncheck -format=json` always writes a
+                // stream (a `config` record at minimum), so an empty one is never
+                // evidence of "no vulnerabilities" — it must not retire a retained
+                // CVE finding, whatever the exit code. `spawnFailedWithNoOutput`
+                // is the same shared discriminator knip and dead-code use, in
+                // place of this file's hand-rolled status test.
+                if (spawnFailedWithNoOutput(result, rawStdout)) {
+                    this.log(`Scan failed: ${(result.stderr ?? "").slice(0, 200)}`);
+                    return {
+                        ...EMPTY_RESULT,
+                        scannedAt,
+                        summary: firstOutputLine(result.stderr) || "scan failed",
+                    };
+                }
                 return {
                     ...EMPTY_RESULT,
+                    success: true,
                     scannedAt,
-                    summary: (result.stderr ?? "").trim().split("\n")[0] || "scan failed",
+                    summary: "govulncheck produced no output; nothing parsed",
                 };
             }
             const findings = parseGovulncheckJson(rawStdout);
+            // #2154: the one govulncheck site that parsed a scan of this root.
             return {
                 success: true,
+                analyzed: true,
                 findings,
                 scannedAt,
             };