pi-lens 3.8.73 → 4.0.0

package/dist/clients/review-graph/git-identity.js

@@ -14,11 +14,12 @@
  */
 import * as fs from "node:fs";
 import * as path from "node:path";
+import { BoundedLruCache } from "../bounded-cache.js";
 import { normalizeFilePath, walkUpDirs } from "../path-utils.js";
 // Per-process cache of resolved gitdir location keyed by cwd — the gitdir
 // location itself is stable for the life of the process; only HEAD's
 // CONTENT changes (on commit/checkout), so that's re-read fresh every call.
-const _gitDirCache = new Map();
+const _gitDirCache = new BoundedLruCache(32);
 export function _resetGitIdentityCacheForTests() {
     _gitDirCache.clear();
 }

package/dist/clients/review-graph/import-resolvers.js

@@ -90,7 +90,7 @@ function resolveDart(cwd, filePath, source) {
 // JS/TS extension from the specifier before re-appending candidate extensions
 // lets that universal pattern resolve to the real source file. Exported so
 // builder.ts's warm `localImportToFile` shares the exact same regex (#694).
-export const JS_TS_EXT_RE = /\.(mjs|cjs|jsx?|tsx?)$/i;
+export const JS_TS_EXT_RE = /\.(mjs|cjs|mts|cts|jsx?|tsx?)$/i;
 /**
  * Ordered candidate list for resolving a relative JS/TS import specifier
  * (already resolved to an absolute base path) to an on-disk file, with
@@ -122,13 +122,18 @@ function jsTsExtensionCandidates(base, strippedBase, ext) {
         candidates.push(`${strippedBase}.mts`);
     if (ext === ".cjs")
         candidates.push(`${strippedBase}.cts`);
-    candidates.push(`${strippedBase}.ts`, `${strippedBase}.tsx`);
+    if (ext === ".mts")
+        candidates.push(`${strippedBase}.mts`);
+    if (ext === ".cts")
+        candidates.push(`${strippedBase}.cts`);
+    candidates.push(`${strippedBase}.ts`, `${strippedBase}.tsx`, `${strippedBase}.mts`, `${strippedBase}.cts`);
     // The literal specifier path (covers both "no extension in the specifier"
     // — base === strippedBase — and the compiled/as-written extension itself).
-    candidates.push(base);
-    candidates.push(`${strippedBase}.js`, `${strippedBase}.jsx`);
-    candidates.push(path.join(base, "index.ts"), path.join(base, "index.tsx"), path.join(base, "index.js"), path.join(base, "index.jsx"));
-    return candidates;
+    candidates.push(base, `${strippedBase}.js`, `${strippedBase}.jsx`, `${strippedBase}.mjs`, `${strippedBase}.cjs`);
+    for (const index of ["index.ts", "index.tsx", "index.mts", "index.cts", "index.js", "index.jsx", "index.mjs", "index.cjs"]) {
+        candidates.push(path.join(base, index));
+    }
+    return [...new Set(candidates)];
 }
 export function jsTsCandidatePaths(filePath, source) {
     const base = path.resolve(path.dirname(filePath), source);
@@ -198,10 +203,16 @@ function workspaceEntryCandidates(pkgRoot) {
         // missing/unreadable package.json — fall through to index candidates
     }
     const candidates = [];
-    if (main)
-        candidates.push(path.resolve(pkgRoot, main));
-    candidates.push(path.join(pkgRoot, "index.ts"), path.join(pkgRoot, "index.tsx"), path.join(pkgRoot, "index.js"), path.join(pkgRoot, "src", "index.ts"), path.join(pkgRoot, "src", "index.js"));
-    return candidates;
+    if (main) {
+        const mainPath = path.resolve(pkgRoot, main);
+        const ext = path.extname(mainPath).toLowerCase();
+        const stripped = mainPath.replace(JS_TS_EXT_RE, "");
+        candidates.push(...jsTsExtensionCandidates(mainPath, stripped, ext));
+    }
+    for (const base of [pkgRoot, path.join(pkgRoot, "src")]) {
+        candidates.push(path.join(base, "index.ts"), path.join(base, "index.tsx"), path.join(base, "index.mts"), path.join(base, "index.cts"), path.join(base, "index.js"), path.join(base, "index.jsx"), path.join(base, "index.mjs"), path.join(base, "index.cjs"));
+    }
+    return [...new Set(candidates)];
 }
 /** Candidate paths for a workspace-package SUBPATH import (`@scope/pkg/foo`)
  * — same source-twin-preferring extension probe as a relative import, rooted

package/dist/clients/review-graph/persist-worker.js

@@ -0,0 +1,10 @@
+import { serveGzipStageWorker, } from "../gzip-stage-write.js";
+// Streamed gzip stage write runs off the main thread via the shared core (see
+// clients/gzip-stage-write.ts); this worker only echoes its routing fields.
+serveGzipStageWorker((request) => ({
+    id: request.id,
+    cwd: request.cwd,
+    generation: request.generation,
+    stagePath: request.stagePath,
+    elements: request.elements,
+}));

package/dist/clients/review-graph/query.js

@@ -76,6 +76,10 @@ export function computeImpactCascade(graph, changedFile, moduleGraph) {
     const normalizedFile = normalizeMapKey(changedFile);
     const fileNodeId = graph.fileNodes.get(normalizedFile);
     if (!fileNodeId) {
+        // #1023: the changed file has no node in the graph — we CANNOT enumerate
+        // its dependents, so this empty result is "couldn't compute", NOT "nothing
+        // depends on it". Mark it indeterminate so callers surface an honest
+        // advisory instead of an all-clear (#533).
         return {
             filePath: normalizedFile,
             changedSymbols: [],
@@ -83,6 +87,7 @@ export function computeImpactCascade(graph, changedFile, moduleGraph) {
             directCallers: [],
             neighborFiles: [],
             riskFlags: [],
+            indeterminate: { reason: "missing_node" },
         };
     }
     const changedSymbols = graph.changedSymbolsByFile.get(normalizedFile) ?? [];

package/dist/clients/review-graph/shared-extraction-ir.js

@@ -0,0 +1,90 @@
+import { createHash } from "node:crypto";
+import { normalizeMapKey } from "../path-utils.js";
+/**
+ * THE producer/consumer hash contract, in one place (#955 review): scanner
+ * publication and builder acceptance must produce byte-identical digests or
+ * every lookup silently misses forever. Both sides hash the exact decoded
+ * string they parsed.
+ */
+export function reviewGraphIrContentHash(content) {
+    return createHash("sha256").update(content).digest("hex");
+}
+// Process-local handoff only. Values are compact extracted data: never source
+// strings, web-tree-sitter trees, or FactStores. Bounds (#955 review — the
+// #886 retention class): a small root bound, a per-root entry cap, and
+// consume-once semantics — an entry is DELETED when the graph accepts it, and
+// the full build clears the root's leftovers when it finishes, so the
+// registry's lifetime is the scan-to-build window, not the process lifetime.
+const MAX_ROOTS = 8;
+const MAX_FILES_PER_ROOT = 20_000;
+const roots = new Map();
+let accepted = 0;
+let rejected = 0;
+function rootKey(cwd) {
+    return normalizeMapKey(cwd);
+}
+export function publishReviewGraphFileIr(cwd, entry) {
+    // Only consumable entries are worth storing: the builder rejects
+    // incomplete entries and has nothing to read without `structural`, so
+    // publishing them would be pure retention — and an incomplete late
+    // publication must never clobber a still-valid entry (#955 review).
+    if (!entry.complete || !entry.structural)
+        return;
+    const key = rootKey(cwd);
+    let files = roots.get(key);
+    if (!files) {
+        files = new Map();
+        roots.set(key, files);
+        while (roots.size > MAX_ROOTS) {
+            const oldest = roots.keys().next().value;
+            if (oldest === undefined)
+                break;
+            roots.delete(oldest);
+        }
+    }
+    const fileKey = normalizeMapKey(entry.filePath);
+    files.delete(fileKey);
+    while (files.size >= MAX_FILES_PER_ROOT) {
+        const oldest = files.keys().next().value;
+        if (oldest === undefined)
+            break;
+        files.delete(oldest);
+    }
+    files.set(fileKey, { ...entry, filePath: fileKey });
+}
+/**
+ * Consume-once: a hash-fresh entry is removed as it is returned. The graph is
+ * about to ingest these arrays, so keeping a second registry copy alive would
+ * both duplicate the heap and leave a write-through aliasing target (#955
+ * review); a later build re-parses or waits for the next scan to republish.
+ */
+export function getFreshReviewGraphFileIr(cwd, filePath, contentHash) {
+    const files = roots.get(rootKey(cwd));
+    const fileKey = normalizeMapKey(filePath);
+    const entry = files?.get(fileKey);
+    if (!entry)
+        return undefined;
+    if (entry.contentHash !== contentHash) {
+        // Present but stale — the only honest "rejected" (#955 review: absence
+        // is not rejection; counting it made the stat unusable).
+        rejected++;
+        return undefined;
+    }
+    files?.delete(fileKey);
+    accepted++;
+    return entry;
+}
+/** Build-end/session-reset seam; builds also work when this is never called. */
+export function clearReviewGraphFileIr(cwd) {
+    if (cwd === undefined)
+        roots.clear();
+    else
+        roots.delete(rootKey(cwd));
+}
+export function getReviewGraphIrStats() {
+    return { accepted, rejected };
+}
+export function resetReviewGraphIrStats() {
+    accepted = 0;
+    rejected = 0;
+}

package/dist/clients/review-graph/symbol-id.js

@@ -55,3 +55,49 @@
 export function buildSymbolId(filePath, name, kind, startLine) {
     return `${filePath}:${name}:${kind}:${startLine}`;
 }
+/**
+ * Structural shape of a kind token in a canonical symbol id: every kind this
+ * repo mints — the fixed `buildSymbolId` vocabulary (`function`, `method`,
+ * `class`, ...) AND the open-ended LSP-fallback vocabulary from
+ * `lspSymbolKindName` (`enum`, `struct`, `type-parameter`, `enum-member`, the
+ * `lsp-symbol-<n>` catch-all for unknown LSP `SymbolKind` numbers, ...) —
+ * is a lowercase word optionally hyphen-segmented, never containing a colon.
+ * Matching this SHAPE (rather than whitelisting specific kind strings) keeps
+ * `parseSymbolKey` in agreement with whatever kind vocabulary either minter
+ * uses, present or future, without needing a matching update here.
+ */
+const KIND_TOKEN_RE = /^[a-z][a-z0-9]*(?:-[a-z0-9]+)*$/;
+/**
+ * Parse both canonical symbol IDs and the legacy `file:name` compatibility
+ * shape. Canonical IDs are recognized from their typed line suffix, so drive
+ * letters and colons in POSIX filenames are data rather than separators. A
+ * known file hint makes the legacy form lossless too; without it, legacy IDs
+ * remain inherently ambiguous and use their historical final separator.
+ */
+export function parseSymbolKey(key, knownFilePath) {
+    if (key.startsWith("file:")) {
+        return { filePath: key.slice("file:".length) };
+    }
+    const canonical = /^(.*):([^:]*):([^:]+):(\d+)$/.exec(key);
+    if (canonical && KIND_TOKEN_RE.test(canonical[3])) {
+        return {
+            filePath: canonical[1],
+            symbolName: canonical[2] || undefined,
+            kind: canonical[3],
+            line: Number(canonical[4]),
+        };
+    }
+    if (knownFilePath && key.startsWith(`${knownFilePath}:`)) {
+        return {
+            filePath: knownFilePath,
+            symbolName: key.slice(knownFilePath.length + 1) || undefined,
+        };
+    }
+    const separator = key.lastIndexOf(":");
+    return separator < 0
+        ? { filePath: key }
+        : {
+            filePath: key.slice(0, separator),
+            symbolName: key.slice(separator + 1) || undefined,
+        };
+}

package/dist/clients/review-graph/tsconfig-paths.js

@@ -1,9 +1,10 @@
 import * as fs from "node:fs";
 import * as os from "node:os";
+import { BoundedLruCache } from "../bounded-cache.js";
 import * as path from "node:path";
 import { findGoverningTsconfigDir, getDirectoryMarkers, } from "../workspace-topology.js";
-const cache = new Map();
-const referencesCache = new Map();
+const cache = new BoundedLruCache(64);
+const referencesCache = new BoundedLruCache(64);
 /** Strip JSONC comments and trailing commas without touching string contents. */
 function parseJsonc(content) {
     let output = "";
@@ -44,6 +45,50 @@ function parseJsonc(content) {
     }
     return JSON.parse(output.replace(/,\s*([}\]])/g, "$1"));
 }
+function configSignature(configPath) {
+    try {
+        const stat = fs.statSync(configPath);
+        return `${stat.mtimeMs}:${stat.size}`;
+    }
+    catch {
+        return "missing";
+    }
+}
+function configDependencyPaths(configPath) {
+    const paths = new Set();
+    const visit = (currentPath) => {
+        const normalized = path.resolve(currentPath);
+        if (paths.has(normalized))
+            return;
+        paths.add(normalized);
+        let json;
+        try {
+            json = parseJsonc(fs.readFileSync(normalized, "utf8"));
+        }
+        catch {
+            return;
+        }
+        if (typeof json.extends === "string") {
+            const parent = resolveExtends(normalized, json.extends);
+            if (parent)
+                visit(parent);
+        }
+        for (const reference of json.references ?? []) {
+            if (typeof reference?.path !== "string")
+                continue;
+            const referenced = resolveReferenceConfig(normalized, reference.path);
+            if (referenced)
+                visit(referenced);
+        }
+    };
+    visit(configPath);
+    return [...paths].sort((a, b) => a.localeCompare(b));
+}
+function dependencySignature(configPath) {
+    return configDependencyPaths(configPath)
+        .map((dependency) => `${dependency}:${configSignature(dependency)}`)
+        .join("|");
+}
 function resolveExtends(configPath, value) {
     if (!value.startsWith("."))
         return undefined;
@@ -180,14 +225,17 @@ function collectReferencedProjects(configPath, result, visited) {
 }
 /** Find and parse the nearest governing tsconfig, cached per importer directory. */
 export function parseTsconfigPaths(cwd, homeDir = os.homedir()) {
-    const key = path.resolve(cwd);
+    const normalizedCwd = path.resolve(cwd);
+    const configDir = findGoverningTsconfigDir(normalizedCwd, homeDir);
+    const configPath = configDir ? path.join(configDir, "tsconfig.json") : "";
+    const signature = configPath ? dependencySignature(configPath) : "missing";
+    const key = `${normalizedCwd}|${configPath}|${signature}`;
     const cached = cache.get(key);
     if (cached)
         return cached;
     // Home-guarding is enforced inside findGoverningTsconfigDir's walk itself
     // (via workspace-topology's shared isAtOrAboveHomeDir ceiling), so a hit
     // here is never at/above homeDir.
-    const configDir = findGoverningTsconfigDir(key, homeDir);
     if (!configDir) {
         cache.set(key, []);
         return [];
@@ -224,11 +272,14 @@ export function aliasedImportTargets(specifier, importerDir) {
 }
 /** Resolve an exact package-name import through the governing config's project references. */
 export function referencedProjectImportTarget(specifier, importerDir) {
-    const key = path.resolve(importerDir);
+    const normalizedImporterDir = path.resolve(importerDir);
+    const governingDir = findGoverningTsconfigDir(normalizedImporterDir);
+    const governingPath = governingDir ? path.join(governingDir, "tsconfig.json") : "";
+    const key = `${normalizedImporterDir}|${governingPath}|${governingPath ? dependencySignature(governingPath) : "missing"}`;
     let projects = referencesCache.get(key);
     if (!projects) {
         projects = new Map();
-        const configDir = findGoverningTsconfigDir(key);
+        const configDir = governingDir;
         if (configDir) {
             collectReferencedProjects(path.join(configDir, "tsconfig.json"), projects, new Set());
         }

package/dist/clients/review-graph/workspace-modules.js

@@ -6,7 +6,7 @@
  */
 import * as fs from "node:fs";
 import * as path from "node:path";
-import { getProjectIgnoreMatcher, isExcludedDirName } from "../file-utils.js";
+import { getProjectIgnoreMatcher, isExcludedDirName, } from "../file-utils.js";
 import { normalizeMapKey } from "../path-utils.js";
 import { getWorkspaceManifestMarkers } from "../workspace-topology.js";
 // Cap on candidate sub-directories probed per workspace glob level (#262).
@@ -387,6 +387,7 @@ export function buildModuleGraph(cwd) {
 }
 export function clearModuleGraphCache() {
     _moduleGraphCache = null;
+    _moduleSourceFilesMemo.clear();
 }
 /**
  * Find the module that owns a given file path.
@@ -419,13 +420,40 @@ export function getDownstreamModules(graph, moduleName) {
     }
     return [...downstream];
 }
+const _moduleSourceFilesMemo = new Map();
+const MTIME_GRANULARITY_GUARD_MS = 2_000;
+function isMemoEntryFresh(entry) {
+    const validatedAt = Date.now();
+    for (const { dir, mtimeMs, stampedAt } of entry.dirs) {
+        if (validatedAt - stampedAt < MTIME_GRANULARITY_GUARD_MS)
+            return false;
+        try {
+            if (fs.statSync(dir).mtimeMs !== mtimeMs)
+                return false;
+        }
+        catch {
+            return false;
+        }
+    }
+    return true;
+}
 /**
- * Get representative source files in a module.
+ * Get representative source files in a module. Memoized per module root (see
+ * above) — the returned array is a copy; mutating it does not affect the memo.
  */
 export function getModuleSourceFiles(moduleRoot, maxFiles = 20) {
-    const files = [];
     const root = normalizeMapKey(moduleRoot);
     const ignoreMatcher = getProjectIgnoreMatcher(root);
+    const cached = _moduleSourceFilesMemo.get(root);
+    if (cached &&
+        cached.maxFiles === maxFiles &&
+        cached.matcher === ignoreMatcher &&
+        isMemoEntryFresh(cached)) {
+        return [...cached.files];
+    }
+    const files = [];
+    const dirs = [];
+    let allDirsStamped = true;
     const visit = (dir, depth) => {
         if (files.length >= maxFiles || depth > 4)
             return;
@@ -436,6 +464,18 @@ export function getModuleSourceFiles(moduleRoot, maxFiles = 20) {
         catch {
             return;
         }
+        // Stamp AFTER the readdir: a change landing between readdir and stat
+        // records the newer mtime, so validation re-walks (fail-safe direction).
+        try {
+            dirs.push({
+                dir,
+                mtimeMs: fs.statSync(dir).mtimeMs,
+                stampedAt: Date.now(),
+            });
+        }
+        catch {
+            allDirsStamped = false;
+        }
         entries.sort((a, b) => a.name.localeCompare(b.name));
         for (const entry of entries) {
             if (files.length >= maxFiles)
@@ -458,5 +498,13 @@ export function getModuleSourceFiles(moduleRoot, maxFiles = 20) {
         }
     };
     visit(root, 0);
+    if (allDirsStamped) {
+        _moduleSourceFilesMemo.set(root, {
+            files: [...files],
+            maxFiles,
+            dirs,
+            matcher: ignoreMatcher,
+        });
+    }
     return files;
 }

package/dist/clients/review-graph-logger.js

@@ -0,0 +1,53 @@
+import * as path from "node:path";
+import { isTestMode } from "./env-utils.js";
+import { getGlobalPiLensDir } from "./file-utils.js";
+import { createNdjsonLogger } from "./ndjson-logger.js";
+const REVIEW_GRAPH_LOG_DIR = getGlobalPiLensDir();
+const REVIEW_GRAPH_LOG_FILE = path.join(REVIEW_GRAPH_LOG_DIR, "review-graph.log");
+const writer = createNdjsonLogger({ filePath: REVIEW_GRAPH_LOG_FILE });
+/**
+ * Build the one canonical graph metadata shape used by build and persist logs.
+ * Counts come from the graph instance; source-file count may use the exact
+ * signature-map count when the build has one, otherwise the graph file index.
+ */
+export function makeReviewGraphBuildMetadata(graph, options = {}) {
+    return {
+        ...(options.buildId === undefined ? {} : { buildId: options.buildId }),
+        ...(graph.buildGeneration === undefined
+            ? {}
+            : { graphGeneration: graph.buildGeneration }),
+        builtAt: graph.builtAt,
+        ...(options.projectSeq === undefined
+            ? {}
+            : { projectSeq: options.projectSeq }),
+        ...(options.seqHint === undefined ? {} : { seqHint: options.seqHint }),
+        ...(options.mode === undefined ? {} : { mode: options.mode }),
+        sourceFiles: options.sourceFileCount ?? graph.fileNodes.size,
+        ...(options.sourceFileCountTruncated ||
+            graph.persistCoverage?.sourceFilesTruncated
+            ? { sourceFilesTruncated: true }
+            : {}),
+        nodes: graph.nodes.size,
+        edges: graph.edges.length,
+        ...(graph.persistCoverage
+            ? { persistCoverage: graph.persistCoverage }
+            : {}),
+    };
+}
+export function logReviewGraph(entry) {
+    if (isTestMode()) {
+        return;
+    }
+    writer.log({ ts: new Date().toISOString(), ...entry, pid: process.pid });
+}
+export function getReviewGraphLogPath() {
+    return REVIEW_GRAPH_LOG_FILE;
+}
+/** Resolve once all enqueued review-graph writes are on disk (tests/shutdown). */
+export function flushReviewGraphLog() {
+    return writer.flush();
+}
+/** Teardown-only: force queued entries to disk before the process exits. */
+export function flushReviewGraphLogSync() {
+    writer.flushSync();
+}

package/dist/clients/ruff-client.js

@@ -7,62 +7,36 @@
  * Requires: pip install ruff
  * Docs: https://docs.astral.sh/ruff/
  */
+import { createSubsystemLogger } from "./extension-log.js";
 import * as fs from "node:fs";
 import * as path from "node:path";
+import { createAvailabilityChecker, resolveAvailableOrInstall } from "./dispatch/runners/utils/runner-helpers.js";
 import { isFileKind } from "./file-kinds.js";
 import { safeSpawnAsync } from "./safe-spawn.js";
+import { ruffConfigArgs } from "./tool-policy.js";
 // --- Client ---
+const ruffAvailability = createAvailabilityChecker("ruff", ".exe");
 export class RuffClient {
-    ruffAvailable = null;
-    ensureInFlight = null;
+    ruffCommand = "ruff";
     log;
     constructor(verbose = false) {
         this.log = verbose
-            ? (msg) => console.error(`[ruff] ${msg}`)
+            ? createSubsystemLogger("ruff")
             : () => { };
     }
     /**
      * Check if ruff CLI is available, auto-install if not.
      *
-     * Re-entrancy safe: concurrent first-time callers share a single
-     * `ensureInFlight` promise so probing/auto-install isn't duplicated.
-     * Mirrors the dedupe pattern in `SgRunner` / `KnipClient` /
-     * `DependencyChecker`.
+     * Re-entrancy safe: the shared availability seam deduplicates the complete
+     * probe/auto-install transaction per cwd and tool, so concurrent callers do
+     * not duplicate installation attempts.
      */
     async ensureAvailable() {
-        if (this.ruffAvailable !== null)
-            return this.ruffAvailable;
-        if (this.ensureInFlight)
-            return this.ensureInFlight;
-        this.ensureInFlight = this.doEnsureAvailable();
-        try {
-            return await this.ensureInFlight;
-        }
-        finally {
-            this.ensureInFlight = null;
-        }
-    }
-    async doEnsureAvailable() {
-        // Check if available in PATH
-        const result = await safeSpawnAsync("ruff", ["--version"], {
-            timeout: 5000,
-        });
-        this.ruffAvailable = !result.error && result.status === 0;
-        if (this.ruffAvailable) {
-            this.log(`Ruff found: ${result.stdout.trim()}`);
-            return true;
-        }
-        // Auto-install via pi-lens installer
-        this.log("Ruff not found, attempting auto-install...");
-        const { ensureTool } = await import("./installer/index.js");
-        const installedPath = await ensureTool("ruff");
-        if (installedPath) {
-            this.log(`Ruff auto-installed: ${installedPath}`);
-            this.ruffAvailable = true;
-            return true;
-        }
-        this.log("Ruff auto-install failed");
-        return false;
+        const resolved = await resolveAvailableOrInstall(ruffAvailability, "ruff", process.cwd());
+        if (!resolved)
+            return false;
+        this.ruffCommand = resolved;
+        return true;
     }
     /**
      * Check if a file is a Python file
@@ -72,8 +46,10 @@ export class RuffClient {
     }
     /**
      * Async auto-fix variant for pipeline use (non-blocking spawn).
+     * `cwd` is the dispatch language root (used for config discovery); when
+     * omitted it defaults to the file's directory.
      */
-    async fixFileAsync(filePath) {
+    async fixFileAsync(filePath, cwd) {
         if (!(await this.ensureAvailable())) {
             return {
                 success: false,
@@ -93,19 +69,26 @@ export class RuffClient {
         }
         try {
             const before = await fs.promises.readFile(absolutePath, "utf-8");
-            const pre = await safeSpawnAsync("ruff", [
+            // Shared config-args seam (#1247): the lint runner consumes the same
+            // builder, so `check --fix` can never drift to ruff's default rule
+            // set when the project lacks its own config and the package-owned
+            // core.toml fallback applies.
+            const configArgs = ruffConfigArgs(cwd ?? path.dirname(absolutePath));
+            const spawnOpts = { timeout: 10000, cwd: cwd ?? path.dirname(absolutePath) };
+            const pre = await safeSpawnAsync(this.ruffCommand, [
                 "check",
                 "--output-format",
                 "json",
                 "--target-version",
                 "py310",
+                ...configArgs,
                 absolutePath,
-            ], { timeout: 10000 });
+            ], spawnOpts);
             const beforeDiags = pre.stdout?.trim()
                 ? this.parseOutput(pre.stdout, absolutePath)
                 : [];
             const fixableCount = beforeDiags.filter((d) => d.fixable).length;
-            const fix = await safeSpawnAsync("ruff", ["check", "--fix", absolutePath], { timeout: 15000 });
+            const fix = await safeSpawnAsync(this.ruffCommand, ["check", "--fix", ...configArgs, absolutePath], { timeout: 15000, cwd: cwd ?? path.dirname(absolutePath) });
             if (fix.error) {
                 return {
                     success: false,