pi-lens 3.8.42 → 3.8.44

package/CHANGELOG.md

@@ -4,6 +4,65 @@ All notable changes to pi-lens will be documented in this file.
 
 ## [Unreleased]
 
+## [3.8.44] - 2026-05-13
+
+### Added
+
+- **`fish` FileKind with `fish_indent` formatter runner** — `.fish` files are now a first-class `"fish"` kind rather than being bucketed under `"shell"`. A new `fish-indent` runner wraps `fish_indent --check` (fish ≥ 3.6), reporting a formatting warning with a `fish_indent -w` fix hint on exit 1 and a blocking parse-error diagnostic when stderr is non-empty. Formatter and linter policy entries added for `.fish` in `tool-policy.ts`; fish dispatch group `[lsp, fish-indent]` wired in `language-policy.ts`. Closes #74.
+
+### Fixed
+
+- **Linux `sg` command no longer breaks `ast_grep_search` / `ast_grep_replace`** — ast-grep resolution now prefers the canonical `ast-grep` binary and only accepts `sg` when `--version` proves it is ast-grep, avoiding the util-linux `/usr/bin/sg` group-switch command. The installer, probe cache, tool availability, sync runner helpers, and Python slop scan now share the corrected command shape and `npx --no -- ast-grep` fallback. Closes #75.
+- **`return-in-generator` no longer flags normal `async def` coroutine returns** — added a Python tree-sitter post-filter that keeps only synchronous functions containing `yield`, skips `async def`, and rejects non-generator functions. Added regression tests for valued generator returns, coroutine returns, and normal functions. Closes #76.
+- **`python-sql-injection` no longer flags safe SQLAlchemy expression execution** — the rule now captures the call receiver and the post-filter skips likely SQLAlchemy ORM session receivers (`session.execute(stmt)`) plus expression-builder calls such as `conn.execute(select(...).where(...))`, while still flagging raw `cursor.execute(sql)` and composed SQL strings. Closes #77.
+- **Formatter tests no longer depend on a real global Ruff install** — the Ruff global fallback test now uses an isolated PATH shim, making it deterministic on machines without Ruff installed.
+
+- **`psscriptanalyzer` runner could hang indefinitely** — `spawnPs` had no timeout; if `pwsh` or `Invoke-ScriptAnalyzer` stalled on a large file the turn would block forever. Added a 30s timeout with SIGTERM → 1s → SIGKILL escalation. `shell: false` means `child.pid` is the actual `pwsh` process so `child.kill()` hits the right target directly (no `taskkill` needed).
+
+- **`turn_end` hangs ~40–50s on Windows when knip times out** — `safeSpawnAsync` used `child.kill("SIGTERM/SIGKILL")` to terminate timed-out processes. On Windows with `shell: true`, `child.pid` is the `cmd.exe` wrapper; killing it orphans the actual subprocess (e.g. knip/npx node process) which then runs unsupervised until it naturally exits. Replaced with `taskkill /F /T /PID` on Windows, which kills the full process tree rooted at `cmd.exe`, matching the approach already used in `lsp/client.ts`.
+
+- **`fish` missing from `LANGUAGE_CAPABILITY_MATRIX` and `LintRunnerName`** — adding the `"fish"` FileKind required two exhaustiveness fixes: a `fish` entry in `plan.ts`'s `Record<FileKind, CapabilityMatrixEntry>` and `"fish-indent"` in the `LintRunnerName` union in `tool-policy.ts`; both caused build/type-check failures on CI.
+- **shellcheck and shfmt no longer fire on `.fish` files** — `.fish` was classified as `"shell"`, causing both runners (which use `appliesTo: ["shell"]`) to process fish scripts with `--shell bash`, producing false-positive SC1073/SC1064 parse errors. Moving `.fish` to the new `"fish"` kind fixes the routing with no special-case logic in either runner. Closes #74.
+
+- **`lsp_diagnostics` tool** — proactive LSP error checking for files and directories. The agent can now run `lsp_diagnostics({ filePath: "src/" })` before builds to catch issues without making edits. Directory mode walks the tree (skipping node_modules/.git/target), auto-detects the language extension, opens each file in the LSP client, and aggregates diagnostics. Supports severity filtering (`error`/`warning`/`information`/`hint`/`all`), caps at 50 files and 200 diagnostics. Returns structured details with `totalDiagnostics`, `truncated`, and per-diagnostic `file`/`line`/`severity`/`message`/`source`/`code`. Adapted from `code-yeongyu/pi-lsp-client`.
+- **LSP process stderr capture and health check** — the LSP client now maintains a rolling 100-line stderr buffer from server startup through shutdown. Three new client methods exposed: `processExited()` (true if the server process died), `recentStderr(n)` (last N lines for diagnostics), and `checkAlive()` (pre-request health check returning error string with exit code + stderr tail if dead). Previously, stderr was only captured during initialization and discarded afterward.
+- **SIGTERM → 1.5s → SIGKILL escalation in `killProcessTree`** — on Unix, process cleanup now sends SIGTERM first, waits 1.5 seconds, then sends SIGKILL if the process is still alive. Prevents zombie server processes that survive a standard kill. Windows already uses `taskkill /F /T` (force kill tree).
+- **LSP force-reinstall when PATH-resolved tool is broken** — when an LSP server's PATH candidate fails to launch (e.g. broken symlink, missing runtime, corrupted binary) AND the managed install returns the same broken PATH entry, pi-lens now clears the probe cache, downloads a managed copy from the registry (npm/GitHub/pip), and retries the launch. Previously, broken PATH tools triggered exponential backoff and were permanently disabled after 5 failures. The retry only fires when the `ensureTool` path is a bare command name (no `/` or `\` separators) — absolute paths from prior managed installs are not force-reinstalled to avoid redundant download loops. `ensureTool` gained an optional `forceReinstall` flag that bypasses both the in-memory `resolvedPathCache` and the persistent probe cache.
+- **`getToolPath` prefers managed installs over PATH for github-strategy tools** — github-strategy tools (`rust-analyzer`, `shellcheck`, `shfmt`, `golangci-lint`) now check `~/.pi-lens/bin/` before falling through to PATH lookup. This ensures force-reinstall flows find the newly downloaded binary, and pi-lens-managed copies take priority over potentially stale or broken PATH entries. Non-github tools (npm, pip) are unaffected.
+- **Pattern hints for `ast_grep_search` zero-match results** — when a search returns no matches, the tool now appends a hint suggesting likely pattern mistakes: regex misuse (`\w`, `\d`, `[a-z]`, `.*`, `.+`, `|` alternation), language-specific mistakes (Python trailing colons, incomplete JS/Go/Rust function patterns). Adapted from `code-yeongyu/pi-ast-grep`.
+- **Truncation metadata in ast-grep tool results** — `SgResult` now carries `totalMatches` and `truncated` fields, threaded through `SgRunner` → `AstGrepClient` → both `ast_grep_search` and `ast_grep_replace` tool `details`. The agent can now distinguish "50 shown of 500 total" from "50 total".
+
+### Changed
+
+- **Runner process execution is async/non-blocking across hook paths** — jscpd scans, Madge dependency checks, formatter execution, and dispatch runners that previously used sync `safeSpawn()` now use `safeSpawnAsync()` in write/session/turn hooks. Added in-flight guards for jscpd and Madge project/file scans, async availability checks in runner helpers, and Knip availability dedupe + project-root bail before install/probe.
+- **`isCommandAvailable` replaced `which`/`where` spawn with PATH walk + `statSync` size validation** — instead of spawning `which`/`where` (~50 ms + timeout risk), the installer now walks `$PATH` entries synchronously and checks `statSync(path).isFile() && stat.size > 0` for each candidate. This catches broken symlinks (stat throws `ENOENT` or returns size 0) at ~μs per candidate with zero process spawns. On Windows, `.exe`, `.cmd`, and `.bat` extensions are probed.
+
+### Fixed
+
+- **SonarCloud security hotspots resolved** — replaced the .NET build diagnostic regex with a linear manual parser to avoid ReDoS risk (S5852), and switched jscpd temporary directory creation from a `Math.random()` suffix to `fs.mkdtempSync()` to avoid weak PRNG use (S2245).
+- **ast-grep tool language list aligned with ast-grep CLI** — dropped phantom `dart` and `sql` (not supported by ast-grep binary), added missing `bash`, `nix`, `solidity`. The `LANGUAGES` constant in `tools/shared.ts` now matches ast-grep v0.41's official 25-language list.
+- **Graph-cache test: disk cache leaked across test runs** — `buildOrUpdateGraph` persists to `cwd/.pi-lens/cache/review-graph.json`. All tests used hardcoded `"/cwd"`, causing the first test run's disk cache to contaminate subsequent runs. Switched to `fs.mkdtempSync` temp directories with `afterEach` cleanup.
+- **Disabled tree-sitter rules leaked into production** — `parseQueryFile` uses the YAML's `language:` field over the directory name, so rules in `typescript-disabled/` with `language: typescript` were loaded as active TypeScript rules and appeared in the diagnostics widget. Added `!d.name.endsWith("-disabled")` filter to `loadQueries` directory enumeration.
+
+## [3.8.43] - 2026-05-10
+
+### Added
+
+- **Unresolved inline blocker re-surfacing at turn_end** — when the agent ignores a blocking diagnostic shown during a write/edit and moves to the next turn without fixing it, the blocker now reappears in the turn_end injection framed as `"Unresolved from this turn — <file>: 🔴 STOP…"`. Previously, unresolved inline blockers were silently lost until cascade happened to re-touch the same file via an importer. `RuntimeCoordinator` tracks the last-seen blocking output per file (`_pendingInlineBlockers`); a subsequent write that produces no blockers clears the entry, so only genuinely unresolved issues resurface. The map is cleared at `beginTurn` to prevent cross-turn contamination.
+- **S1219 (switch non-case labels) and S2970 (incomplete assertions) blocking tree-sitter rules** — S1219 detects labeled statements inside switch cases in TypeScript (SonarCloud S1219); S2970 detects Jest/Vitest `expect()` chains that are never called (e.g. `expect(x).toBe(y)` without `await`), with Chai property assertion exclusion. S2083 (path traversal) moved to disabled — regex heuristics on tree-sitter syntax are the wrong layer; needs taint/data-flow analysis. Adds `parent?` field to `TreeSitterNode` interface.
+- **Inline code snippets in blocker output** — each 🔴 STOP diagnostic now includes the exact source line the agent wrote that caused the violation, so the agent can identify and fix the issue without re-reading the file. `fixSuggestion` is also surfaced inline when present. Snippet capped at 120 chars.
+- **AST node type and matched text in blocker output** — tree-sitter diagnostics now carry `matchedText` (the exact matched node, more precise than the full source line) and `astNodeType` (e.g. `call_expression`, `template_string`). The agent sees: `L12: SQL query built with string interpolation (template_string) → db.query(...)`.
+- **Persist review graph to disk** — `_workspaceGraphCache` is now backed by `.pi-lens/cache/review-graph.json`. On cold start, if source file signatures match the stored cache, the full 2–4 s tree-sitter + import-fact build is skipped (~20 ms JSON parse + `rebuildIndexes` instead). Write is fire-and-forget, never blocks dispatch.
+- **Preserve last known LSP diagnostics when LSP goes inactive** — when no live clients are available (dead client respawning, circuit-breaker cooldown), `getDiagnostics` now returns the last non-empty result for that file instead of `[]`. The widget keeps showing the last known issues rather than going blank mid-session. Live clients returning `[]` clears the stale entry. Stale hits are logged as `failureKind: "no_clients_stale"`.
+
+### Fixed
+
+- **Read-guard false-positive block on files outside the project root** — edits to files outside `projectRoot` (e.g. `C:/llama/*.bat`, scripts in arbitrary directories) were always blocked with `zero_read` because reads for external files are intentionally not recorded (`isExternalOrVendor` gate in the read handler), but the `checkEdit` call had no matching guard. Added `!isExternalOrVendor` to the `checkEdit` condition so external files bypass the read-guard entirely, consistent with how reads are handled.
+
+### Changed
+
+- **Replace pyright-langserver and pylsp with jedi-language-server for Python LSP** — `PythonServer` (pyright-langserver) and `PythonPylspServer` (pylsp) removed from `LSP_SERVERS`; replaced by `PythonJediServer` which spawns `jedi-language-server`. pyright-langserver was causing 5–14 s cold-start delays on large Python projects (e.g. tinygrad) because it performs full workspace analysis on startup; jedi starts in ~200–500 ms via lazy per-file analysis. pylsp was removed because it consistently returned 0 diagnostics (no venv → jedi can't resolve imports; 1500 ms aggregate timeout hit on warm runs). Deep type checking is unaffected — the standalone `pyright` CLI runner and `mypy` runner continue to run in parallel. Added `"python-jedi"` strategy entry (`seedFirstPush: true`, `aggregateWaitMs: 1000`). Wall-clock gate for Python dispatch shifts from LSP (~5–14 s) to mypy (~3.5 s).
+
 ## [3.8.42] - 2026-05-08
 
 ### Added
@@ -14,11 +73,11 @@ All notable changes to pi-lens will be documented in this file.
 - **Severity alignment for 3 existing TS tree-sitter blocking rules** — `ts-command-injection`, `ts-ssrf`, `unsafe-regex` had `inline_tier: blocking` but `severity: warning`, producing `semantic: "warning"` which is never shown inline. Fixed to `severity: error` → `semantic: "blocking"` → actually surfaces to the agent.
 - **Fixed `inline_tier: error` typo** on `ts-hallucinated-react-import` and `python-hallucinated-import` (→ `blocking`).
 - **13 new high-confidence blocking promotions across 5 languages** (all `severity: error`, `inline_tier: blocking`):
-  - *TypeScript:* `ts-weak-hash` (`createHash("md5"/"sha1")` — confidence: high)
-  - *Python:* `python-command-injection`, `python-sql-injection`, `python-insecure-deserialization`, `python-weak-hash`
-  - *Go:* `go-command-injection`, `go-sql-injection`, `go-shared-map-write-goroutine`, `go-weak-hash`
-  - *Ruby:* `ruby-weak-hash`
-  - *Rust:* `rust-lock-held-across-await`
+  - _TypeScript:_ `ts-weak-hash` (`createHash("md5"/"sha1")` — confidence: high)
+  - _Python:_ `python-command-injection`, `python-sql-injection`, `python-insecure-deserialization`, `python-weak-hash`
+  - _Go:_ `go-command-injection`, `go-sql-injection`, `go-shared-map-write-goroutine`, `go-weak-hash`
+  - _Ruby:_ `ruby-weak-hash`
+  - _Rust:_ `rust-lock-held-across-await`
 - **4 new blocking tree-sitter rules (SonarCloud BLOCKER equivalents)**:
   - `ts-xss-dom-sink` (S5696) — flags dynamic values assigned to `innerHTML`/`outerHTML` or passed to `document.write()` / `document.writeln()`
   - `ts-dynamic-require` (S5335) — flags `require()` called with a non-string-literal argument (arbitrary module loading)
@@ -41,8 +100,6 @@ All notable changes to pi-lens will be documented in this file.
 
 - **Startup observability** — `checkProbeCache` now logs the reason for each cache miss (`ttl expired`, `gone`, `mtime changed`); the lsp-config fire-and-forget callback logs how many warm files were configured once the config resolves asynchronously.
 
-
-
 ### Added
 
 - **Test runner: import-based fallback discovery** — when basename pattern lookup finds no test file for a modified source file (e.g. `cline.test.ts` for `cline-auth.ts`), the runner now scans `tests/`, `__tests__/`, and the source file's own directory for any `*.test.*` file whose content references the source basename in an import path. Fixes the silent `no test file found` for files whose test is named after a module rather than the source file.

package/clients/ast-grep-client.ts

@@ -8,7 +8,6 @@
  * Rules: ./rules/ directory
  */
 
-import { spawnSync } from "node:child_process";
 import * as fs from "node:fs";
 import * as path from "node:path";
 import { AstGrepParser } from "./ast-grep-parser.js";
@@ -73,7 +72,12 @@ export class AstGrepClient {
 		lang: string,
 		paths: string[],
 		options?: { selector?: string; context?: number },
-	): Promise<{ matches: AstGrepMatch[]; error?: string }> {
+	): Promise<{
+		matches: AstGrepMatch[];
+		totalMatches: number;
+		truncated: boolean;
+		error?: string;
+	}> {
 		const args = ["run", "-p", pattern, "--lang", lang, "--json=compact"];
 		if (options?.selector) {
 			args.push("--selector", options.selector);
@@ -82,7 +86,13 @@ export class AstGrepClient {
 			args.push("--context", String(options.context));
 		}
 		args.push(...paths);
-		return this.runner.exec(args);
+		const result = await this.runner.exec(args);
+		return {
+			matches: result.matches,
+			totalMatches: result.totalMatches,
+			truncated: result.truncated,
+			error: result.error,
+		};
 	}
 
 	/**
@@ -94,7 +104,13 @@ export class AstGrepClient {
 		lang: string,
 		paths: string[],
 		apply = false,
-	): Promise<{ matches: AstGrepMatch[]; applied: boolean; error?: string }> {
+	): Promise<{
+		matches: AstGrepMatch[];
+		totalMatches: number;
+		truncated: boolean;
+		applied: boolean;
+		error?: string;
+	}> {
 		const baseArgs = ["run", "-p", pattern, "-r", rewrite, "--lang", lang];
 
 		if (!apply) {
@@ -104,7 +120,13 @@ export class AstGrepClient {
 				"--json=compact",
 				...paths,
 			]);
-			return { matches: result.matches, applied: false, error: result.error };
+			return {
+				matches: result.matches,
+				totalMatches: result.totalMatches,
+				truncated: result.truncated,
+				applied: false,
+				error: result.error,
+			};
 		}
 
 		// Apply: --update-all and --json are MUTUALLY EXCLUSIVE in sg.
@@ -117,7 +139,13 @@ export class AstGrepClient {
 			...paths,
 		]);
 		if (applyResult.error) {
-			return { matches: [], applied: false, error: applyResult.error };
+			return {
+				matches: [],
+				totalMatches: 0,
+				truncated: false,
+				applied: false,
+				error: applyResult.error,
+			};
 		}
 
 		// Search for what was changed (pattern no longer matches after rewrite,
@@ -131,7 +159,13 @@ export class AstGrepClient {
 			"--json=compact",
 			...paths,
 		]);
-		return { matches: searchResult.matches, applied: true, error: undefined };
+		return {
+			matches: searchResult.matches,
+			totalMatches: searchResult.totalMatches,
+			truncated: searchResult.truncated,
+			applied: true,
+			error: undefined,
+		};
 	}
 
 	/**
@@ -285,18 +319,16 @@ message: found
 		const configPath = path.join(this.ruleDir, ".sgconfig.yml");
 
 		try {
-			const result = spawnSync(
-				"npx",
-				["sg", "scan", "--config", configPath, "--json", absolutePath],
-				{
-					encoding: "utf-8",
-					timeout: 15000,
-					shell: process.platform === "win32",
-				},
-			);
+			const result = this.runner.execSync([
+				"scan",
+				"--config",
+				configPath,
+				"--json",
+				absolutePath,
+			]);
 
 			// ast-grep exits 1 when it finds issues
-			const output = result.stdout || result.stderr || "";
+			const output = result.output;
 			if (!output.trim()) return [];
 
 			const parser = new AstGrepParser(

package/clients/dependency-checker.ts

@@ -11,7 +11,7 @@
 
 import * as fs from "node:fs";
 import * as path from "node:path";
-import { safeSpawn, safeSpawnAsync } from "./safe-spawn.js";
+import { safeSpawnAsync } from "./safe-spawn.js";
 
 // --- Types ---
 
@@ -38,6 +38,12 @@ interface FileImports {
 
 export class DependencyChecker {
 	private available: boolean | null = null;
+	private ensureInFlight: Promise<boolean> | null = null;
+	private checkInFlight = new Map<string, Promise<DepCheckResult>>();
+	private scanInFlight = new Map<
+		string,
+		Promise<{ circular: CircularDep[]; count: number }>
+	>();
 	private log: (msg: string) => void;
 
 	// Cache: file path -> its imports
@@ -61,7 +67,17 @@ export class DependencyChecker {
 	async ensureAvailable(): Promise<boolean> {
 		// Fast path: already checked
 		if (this.available !== null) return this.available;
+		if (this.ensureInFlight) return this.ensureInFlight;
 
+		this.ensureInFlight = this.doEnsureAvailable();
+		try {
+			return await this.ensureInFlight;
+		} finally {
+			this.ensureInFlight = null;
+		}
+	}
+
+	private async doEnsureAvailable(): Promise<boolean> {
 		// Check if available in PATH
 		const result = await safeSpawnAsync("madge", ["--version"], {
 			timeout: 5000,
@@ -84,29 +100,11 @@ export class DependencyChecker {
 			return true;
 		}
 
+		this.available = false;
 		this.log("Madge auto-install failed");
 		return false;
 	}
 
-	/**
-	 * Check if madge is available (legacy sync method)
-	 * Prefer ensureAvailable() for auto-install behavior
-	 */
-	isAvailable(): boolean {
-		if (this.available !== null) return this.available;
-
-		const result = safeSpawn("npx", ["madge", "--version"], {
-			timeout: 5000,
-		});
-
-		this.available = !result.error && result.status === 0;
-		if (this.available) {
-			this.log("Madge available for dependency checking");
-		}
-
-		return this.available;
-	}
-
 	/**
 	 * Check if a file is part of a circular dependency (from cache)
 	 */
@@ -210,7 +208,7 @@ export class DependencyChecker {
 	 * Quick circular dependency check using DFS on cached graph.
 	 * Only re-runs full madge check when imports change.
 	 */
-	checkFile(filePath: string, cwd?: string): DepCheckResult {
+	async checkFile(filePath: string, cwd?: string): Promise<DepCheckResult> {
 		const normalized = path.resolve(filePath);
 
 		// Return early for non-existent files without running availability check
@@ -223,18 +221,9 @@ export class DependencyChecker {
 			};
 		}
 
-		if (!this.isAvailable()) {
-			return {
-				hasCircular: false,
-				circular: [],
-				checked: false,
-				cacheHit: false,
-			};
-		}
-
-		const projectRoot = cwd || process.cwd();
+		const projectRoot = path.resolve(cwd || process.cwd());
 
-		// Check if imports changed
+		// Check if imports changed before probing/installing madge.
 		const importsChanged = this.importsChanged(normalized);
 
 		if (!importsChanged) {
@@ -249,13 +238,37 @@ export class DependencyChecker {
 			};
 		}
 
+		if (!(await this.ensureAvailable())) {
+			return {
+				hasCircular: false,
+				circular: [],
+				checked: false,
+				cacheHit: false,
+			};
+		}
+
+		const key = `${projectRoot}:${normalized}`;
+		const existing = this.checkInFlight.get(key);
+		if (existing) return existing;
+
+		const promise = this.runCheckFile(normalized, projectRoot).finally(() => {
+			this.checkInFlight.delete(key);
+		});
+		this.checkInFlight.set(key, promise);
+		return promise;
+	}
+
+	private async runCheckFile(
+		normalized: string,
+		projectRoot: string,
+	): Promise<DepCheckResult> {
 		this.log(
-			`Imports changed for ${path.basename(filePath)}, checking dependencies...`,
+			`Imports changed for ${path.basename(normalized)}, checking dependencies...`,
 		);
 
 		// Run madge on the specific file (fast)
 		try {
-			const result = safeSpawn(
+			const result = await safeSpawnAsync(
 				"npx",
 				[
 					"madge",
@@ -271,6 +284,16 @@ export class DependencyChecker {
 				},
 			);
 
+			if (result.error) {
+				this.log(`Check error: ${result.error.message}`);
+				return {
+					hasCircular: false,
+					circular: [],
+					checked: false,
+					cacheHit: false,
+				};
+			}
+
 			const output = result.stdout || "[]";
 			const parsed = JSON.parse(output);
 
@@ -333,10 +356,12 @@ export class DependencyChecker {
 	/**
 	 * Full project scan (for /check-deps command)
 	 */
-	scanProject(cwd?: string): { circular: CircularDep[]; count: number } {
-		const projectRoot = cwd || process.cwd();
+	async scanProject(
+		cwd?: string,
+	): Promise<{ circular: CircularDep[]; count: number }> {
+		const projectRoot = path.resolve(cwd || process.cwd());
 
-		// Return early for non-existent or empty directories
+		// Return early for non-existent or empty directories before probing/installing.
 		if (!fs.existsSync(projectRoot)) {
 			return { circular: [], count: 0 };
 		}
@@ -348,12 +373,25 @@ export class DependencyChecker {
 			return { circular: [], count: 0 };
 		}
 
-		if (!this.isAvailable()) {
+		if (!(await this.ensureAvailable())) {
 			return { circular: [], count: 0 };
 		}
 
+		const existing = this.scanInFlight.get(projectRoot);
+		if (existing) return existing;
+
+		const promise = this.runScanProject(projectRoot).finally(() => {
+			this.scanInFlight.delete(projectRoot);
+		});
+		this.scanInFlight.set(projectRoot, promise);
+		return promise;
+	}
+
+	private async runScanProject(
+		projectRoot: string,
+	): Promise<{ circular: CircularDep[]; count: number }> {
 		try {
-			const result = safeSpawn(
+			const result = await safeSpawnAsync(
 				"npx",
 				[
 					"madge",
@@ -369,6 +407,11 @@ export class DependencyChecker {
 				},
 			);
 
+			if (result.error) {
+				this.log(`Scan error: ${result.error.message}`);
+				return { circular: [], count: 0 };
+			}
+
 			const output = result.stdout || "{}";
 			const data = JSON.parse(output);
 

package/clients/dispatch/dispatcher.ts

@@ -742,7 +742,8 @@ export async function dispatchForFile(
 
 	// Format output — only blocking issues shown inline
 	// Warnings tracked but not shown (noise) — surfaced via /lens-booboo
-	let output = formatDiagnostics(inlineBlockers, "blocking");
+	const blockerOutput = formatDiagnostics(inlineBlockers, "blocking");
+	let output = blockerOutput;
 	output += formatDiagnostics(inlineFixed, "fixed");
 	if (coverageNotice) {
 		output += formatDiagnostics([coverageNotice], "warning", 1);
@@ -807,6 +808,7 @@ export async function dispatchForFile(
 		fixed: fixedItems,
 		resolvedCount,
 		output,
+		blockerOutput,
 		hasBlockers: blockers.length > 0,
 	};
 }

package/clients/dispatch/integration.ts

@@ -1127,6 +1127,7 @@ export async function dispatchLintWithResult(
 			fixed: [],
 			resolvedCount: 0,
 			output: "",
+			blockerOutput: "",
 			hasBlockers: false,
 		};
 	}
@@ -1145,6 +1146,7 @@ export async function dispatchLintWithResult(
 			fixed: [],
 			resolvedCount: 0,
 			output: "",
+			blockerOutput: "",
 			hasBlockers: false,
 		};
 	}

package/clients/dispatch/plan.ts

@@ -110,6 +110,11 @@ export const LANGUAGE_CAPABILITY_MATRIX: Record<
 			{ mode: "all", runnerIds: ["fact-rules"], filterKinds: ["cmake"] },
 		],
 	},
+	fish: {
+		name: "Fish Script Formatting",
+		capabilities: ["format"],
+		writeGroups: [primary("fish")],
+	},
 	shell: {
 		name: "Shell Script Linting",
 		capabilities: ["lint", "security"],

package/clients/dispatch/runners/biome.ts

@@ -26,7 +26,7 @@ const biomeRunner: RunnerDefinition = {
 		let cmd: string | null = null;
 		let useNpx = false;
 
-		if (biome.isAvailable(cwd)) {
+		if (await (biome.isAvailableAsync?.(cwd) ?? biome.isAvailable(cwd))) {
 			cmd = biome.getCommand(cwd);
 		}
 

package/clients/dispatch/runners/cpp-check.ts

@@ -1,5 +1,5 @@
 import * as path from "node:path";
-import { safeSpawn } from "../../safe-spawn.js";
+import { safeSpawnAsync } from "../../safe-spawn.js";
 import { PRIORITY } from "../priorities.js";
 import type {
 	Diagnostic,
@@ -12,20 +12,22 @@ type CompilerSpec =
 	| { command: string; args: string[]; flavor: "gcc" | "msvc" }
 	| undefined;
 
-function resolveCompiler(absPath: string): CompilerSpec {
+async function resolveCompiler(absPath: string): Promise<CompilerSpec> {
 	const gccLike: Array<{ command: string; args: string[] }> = [
 		{ command: "clang++", args: ["-fsyntax-only", absPath] },
 		{ command: "g++", args: ["-fsyntax-only", absPath] },
 		{ command: "c++", args: ["-fsyntax-only", absPath] },
 	];
 	for (const candidate of gccLike) {
-		const probe = safeSpawn(candidate.command, ["--version"], { timeout: 5000 });
+		const probe = await safeSpawnAsync(candidate.command, ["--version"], {
+			timeout: 5000,
+		});
 		if (!probe.error && probe.status === 0) {
 			return { ...candidate, flavor: "gcc" };
 		}
 	}
 
-	const clProbe = safeSpawn("cl", [], { timeout: 5000 });
+	const clProbe = await safeSpawnAsync("cl", [], { timeout: 5000 });
 	if (!clProbe.error && clProbe.status !== null) {
 		return {
 			command: "cl",
@@ -49,8 +51,9 @@ function parseGccLikeOutput(raw: string, filePath: string): Diagnostic[] {
 		const resolvedTarget = path.resolve(filePath);
 		if (resolvedSource !== resolvedTarget) continue;
 
-		const severity =
-			severityLabel.toLowerCase().includes("error") ? "error" : "warning";
+		const severity = severityLabel.toLowerCase().includes("error")
+			? "error"
+			: "warning";
 		diagnostics.push({
 			id: `cpp-check-${severityLabel}-${lineStr}-${colStr || "1"}`,
 			message: message.trim(),
@@ -79,8 +82,9 @@ function parseMsvcOutput(raw: string, filePath: string): Diagnostic[] {
 		const resolvedTarget = path.resolve(filePath);
 		if (resolvedSource !== resolvedTarget) continue;
 
-		const severity =
-			severityLabel.toLowerCase().includes("error") ? "error" : "warning";
+		const severity = severityLabel.toLowerCase().includes("error")
+			? "error"
+			: "warning";
 		diagnostics.push({
 			id: `cpp-check-${rule}-${lineStr}-${colStr || "1"}`,
 			message: `[${rule}] ${message.trim()}`,
@@ -111,12 +115,12 @@ const cppCheckRunner: RunnerDefinition = {
 	async run(ctx: DispatchContext): Promise<RunnerResult> {
 		const cwd = ctx.cwd || process.cwd();
 		const absPath = path.resolve(cwd, ctx.filePath);
-		const compiler = resolveCompiler(absPath);
+		const compiler = await resolveCompiler(absPath);
 		if (!compiler) {
 			return { status: "skipped", diagnostics: [], semantic: "none" };
 		}
 
-		const result = safeSpawn(compiler.command, compiler.args, {
+		const result = await safeSpawnAsync(compiler.command, compiler.args, {
 			cwd,
 			timeout: 30000,
 		});
@@ -148,7 +152,12 @@ const cppCheckRunner: RunnerDefinition = {
 					rawOutput: raw,
 				};
 			}
-			return { status: "succeeded", diagnostics: [], semantic: "none", rawOutput: raw };
+			return {
+				status: "succeeded",
+				diagnostics: [],
+				semantic: "none",
+				rawOutput: raw,
+			};
 		}
 
 		const hasErrors = diagnostics.some((d) => d.severity === "error");

package/clients/dispatch/runners/dart-analyze.ts

@@ -21,19 +21,24 @@ function parseDartMachineOutput(raw: string, filePath: string): Diagnostic[] {
 		const parts = line.split("|");
 		if (parts.length < 8) continue;
 
-		const [severityStr, , code, file, lineStr, colStr, , ...messageParts] = parts;
+		const [severityStr, , code, file, lineStr, colStr, , ...messageParts] =
+			parts;
 		const message = messageParts.join("|").trim();
 		const lineNum = parseInt(lineStr, 10);
 		const colNum = parseInt(colStr, 10);
 
 		// Only include diagnostics for the target file
-		if (file && !path.resolve(file).endsWith(path.resolve(filePath).replace(/\\/g, "/"))) {
+		if (
+			file &&
+			!path.resolve(file).endsWith(path.resolve(filePath).replace(/\\/g, "/"))
+		) {
 			const resolvedFile = path.resolve(file.trim());
 			const resolvedTarget = path.resolve(filePath);
 			if (resolvedFile !== resolvedTarget) continue;
 		}
 
-		const severity = severityStr?.trim().toLowerCase() === "error" ? "error" : "warning";
+		const severity =
+			severityStr?.trim().toLowerCase() === "error" ? "error" : "warning";
 		diagnostics.push({
 			id: `dart-${code?.trim()}-${lineNum}-${colNum}`,
 			message: `[${code?.trim()}] ${message}`,
@@ -67,21 +72,22 @@ const dartAnalyzeRunner: RunnerDefinition = {
 	async run(ctx: DispatchContext): Promise<RunnerResult> {
 		const cwd = ctx.cwd || process.cwd();
 		const absPath = path.resolve(cwd, ctx.filePath);
-		const dartAvailable = dart.isAvailable(cwd);
-		const flutterAvailable = !dartAvailable && flutter.isAvailable(cwd);
+		const dartAvailable = await (dart.isAvailableAsync?.(cwd) ??
+			dart.isAvailable(cwd));
+		const flutterAvailable =
+			!dartAvailable &&
+			(await (flutter.isAvailableAsync?.(cwd) ?? flutter.isAvailable(cwd)));
 		if (!dartAvailable && !flutterAvailable) {
 			return { status: "skipped", diagnostics: [], semantic: "none" };
 		}
-		const cmd = dartAvailable ? dart.getCommand(cwd)! : flutter.getCommand(cwd)!;
+		const cmd = dartAvailable
+			? dart.getCommand(cwd)!
+			: flutter.getCommand(cwd)!;
 		const args = dartAvailable
 			? ["analyze", "--format=machine", absPath]
 			: ["analyze", "--machine", absPath];
 
-		const result = await safeSpawnAsync(
-			cmd,
-			args,
-			{ cwd, timeout: 30000 },
-		);
+		const result = await safeSpawnAsync(cmd, args, { cwd, timeout: 30000 });
 
 		if (result.error && !result.stdout && !result.stderr) {
 			return { status: "skipped", diagnostics: [], semantic: "none" };

package/clients/dispatch/runners/detekt.ts

@@ -78,7 +78,10 @@ const detektRunner: RunnerDefinition = {
 			return { status: "skipped", diagnostics: [], semantic: "none" };
 		}
 
-		const cmd = detekt.isAvailable(cwd) ? detekt.getCommand(cwd) : null;
+		const cmd = (await (detekt.isAvailableAsync?.(cwd) ??
+			detekt.isAvailable(cwd)))
+			? detekt.getCommand(cwd)
+			: null;
 		if (!cmd) return { status: "skipped", diagnostics: [], semantic: "none" };
 
 		const absPath = path.resolve(cwd, ctx.filePath);