pi-lens 4.1.2 → 4.1.4

package/dist/clients/dispatch/runners/biome-check.js

@@ -197,7 +197,6 @@ const biomeCheckJsonRunner = {
     id: "biome-check-json",
     appliesTo: ["jsts"],
     priority: PRIORITY.FORMAT_AND_LINT_PRIMARY,
-    enabledByDefault: true,
     async run(ctx) {
         const cwd = ctx.cwd || path.dirname(ctx.filePath);
         const policy = getJstsLintPolicyForCwd(cwd);

package/dist/clients/dispatch/runners/cpp-check.js

@@ -175,7 +175,6 @@ const cppCheckRunner = {
     id: "cpp-check",
     appliesTo: ["cxx"],
     priority: PRIORITY.GENERAL_ANALYSIS,
-    enabledByDefault: true,
     skipTestFiles: false,
     async run(ctx) {
         const cwd = ctx.cwd || process.cwd();

package/dist/clients/dispatch/runners/credo.js

@@ -48,7 +48,6 @@ const credoRunner = {
     id: "credo",
     appliesTo: ["elixir"],
     priority: PRIORITY.GENERAL_ANALYSIS,
-    enabledByDefault: true,
     skipTestFiles: false,
     async run(ctx) {
         const cwd = ctx.cwd || process.cwd();

package/dist/clients/dispatch/runners/cue-vet.js

@@ -278,7 +278,6 @@ const cueVetRunner = {
     id: "cue-vet",
     appliesTo: ["cue"],
     priority: PRIORITY.GENERAL_ANALYSIS,
-    enabledByDefault: true,
     skipTestFiles: false,
     timeoutMs: 30_000,
     async run(ctx) {

package/dist/clients/dispatch/runners/dart-analyze.js

@@ -145,7 +145,6 @@ const dartAnalyzeRunner = {
     id: "dart-analyze",
     appliesTo: ["dart"],
     priority: PRIORITY.GENERAL_ANALYSIS,
-    enabledByDefault: true,
     skipTestFiles: false,
     async run(ctx) {
         const cwd = ctx.cwd || process.cwd();

package/dist/clients/dispatch/runners/detekt.js

@@ -126,7 +126,6 @@ const detektRunner = {
     id: "detekt",
     appliesTo: ["kotlin"],
     priority: PRIORITY.GENERAL_ANALYSIS,
-    enabledByDefault: true,
     timeoutMs: 90_000,
     skipTestFiles: false,
     async run(ctx) {

package/dist/clients/dispatch/runners/dotnet-build.js

@@ -115,7 +115,6 @@ const dotnetBuildRunner = {
     id: "dotnet-build",
     appliesTo: ["csharp"],
     priority: PRIORITY.GENERAL_ANALYSIS,
-    enabledByDefault: true,
     timeoutMs: 90_000,
     skipTestFiles: false,
     async run(ctx) {

package/dist/clients/dispatch/runners/elixir-check.js

@@ -139,7 +139,6 @@ const elixirCheckRunner = {
     id: "elixir-check",
     appliesTo: ["elixir"],
     priority: PRIORITY.GENERAL_ANALYSIS,
-    enabledByDefault: true,
     skipTestFiles: false,
     async run(ctx) {
         const cwd = ctx.cwd || process.cwd();

package/dist/clients/dispatch/runners/eslint.js

@@ -24,7 +24,11 @@ function makeEslintProbe(cmd) {
     return createCwdCachedProbe((cwd) => safeSpawnAsync(cmd, ["--version"], {
         timeout: ESLINT_PROBE_BUDGET_MS,
         cwd,
-    }), { tool: "eslint", budgetMs: ESLINT_PROBE_BUDGET_MS });
+    }), {
+        tool: "eslint",
+        budgetMs: ESLINT_PROBE_BUDGET_MS,
+        flightKeyComponent: cmd,
+    });
 }
 const eslintAvailabilityByCmd = new Map();
 function getEslintProbe(cmd) {
@@ -74,7 +78,6 @@ const eslintRunner = {
     id: "eslint",
     appliesTo: ["jsts"],
     priority: PRIORITY.LINT_SECONDARY,
-    enabledByDefault: true,
     async run(ctx) {
         const cwd = ctx.cwd || process.cwd();
         const userHasConfig = hasEslintConfig(cwd);

package/dist/clients/dispatch/runners/fact-rules.js

@@ -13,7 +13,6 @@ const factRulesRunner = {
     id: "fact-rules",
     appliesTo: ["jsts", "python", "go", "rust", "ruby", "shell", "cmake"],
     priority: PRIORITY.GENERAL_ANALYSIS + 1,
-    enabledByDefault: true,
     async run(ctx) {
         const diagnostics = evaluateRules(ctx);
         if (diagnostics.length === 0) {

package/dist/clients/dispatch/runners/fish-indent.js

@@ -7,7 +7,6 @@ const fishIndentRunner = {
     id: "fish-indent",
     appliesTo: ["fish"],
     priority: PRIORITY.FORMAT_AND_LINT_PRIMARY,
-    enabledByDefault: true,
     skipTestFiles: false,
     async run(ctx) {
         const cwd = ctx.cwd || process.cwd();

package/dist/clients/dispatch/runners/gleam-check.js

@@ -39,7 +39,6 @@ const gleamCheckRunner = {
     id: "gleam-check",
     appliesTo: ["gleam"],
     priority: PRIORITY.GENERAL_ANALYSIS,
-    enabledByDefault: true,
     skipTestFiles: false,
     async run(ctx) {
         const cwd = ctx.cwd || process.cwd();

package/dist/clients/dispatch/runners/go-vet.js

@@ -4,18 +4,16 @@
  * Runs `go vet` for Go files to catch common mistakes.
  */
 import { relative, resolve, sep, posix } from "node:path";
-import { GoClient } from "../../go-client.js";
+import { goClient } from "../../go-client.js";
 import { safeSpawnAsync } from "../../safe-spawn.js";
 import { stripAnsi } from "../../sanitize.js";
 import { skipUnlessToolRan } from "./utils/tool-failure.js";
 import { parseGoVetOutput } from "./utils/diagnostic-parsers.js";
 import { PRIORITY } from "../priorities.js";
-const goClient = new GoClient();
 const goVetRunner = {
     id: "go-vet",
     appliesTo: ["go"],
     priority: PRIORITY.SPECIALIZED_ANALYSIS,
-    enabledByDefault: true,
     timeoutMs: 40_000,
     async run(ctx) {
         // Resolve go path using platform-aware lookup (handles system install paths on Windows)

package/dist/clients/dispatch/runners/golangci-lint.js

@@ -78,7 +78,6 @@ const golangciRunner = {
     id: "golangci-lint",
     appliesTo: ["go"],
     priority: PRIORITY.GENERAL_ANALYSIS,
-    enabledByDefault: true,
     timeoutMs: 90_000,
     async run(ctx) {
         const cwd = ctx.cwd || process.cwd();

package/dist/clients/dispatch/runners/hadolint.js

@@ -35,7 +35,6 @@ const hadolintRunner = {
     id: "hadolint",
     appliesTo: ["docker"],
     priority: PRIORITY.GENERAL_ANALYSIS,
-    enabledByDefault: true,
     skipTestFiles: false,
     async run(ctx) {
         const cwd = ctx.cwd || process.cwd();

package/dist/clients/dispatch/runners/helm-lint.js

@@ -2,12 +2,18 @@ import * as path from "node:path";
 import { PathKeyedMap } from "../../path-keyed-map.js";
 import { normalizeMapKey } from "../../path-utils.js";
 import { safeSpawnAsync } from "../../safe-spawn.js";
+import { truncatedByOutputCap } from "../../spawn-output-cap.js";
 import { findNearestDirWithMarker } from "../../workspace-topology.js";
 import { PRIORITY } from "../priorities.js";
 import { createAvailabilityChecker, resolveAvailableOrInstall, } from "./utils/runner-helpers.js";
 const helm = createAvailabilityChecker("helm", ".exe");
 const inFlightByChartRoot = new PathKeyedMap(normalizeMapKey);
 const HELM_LINT_TIMEOUT_MS = 30_000;
+// `helm lint` prints one `[LEVEL]` line per finding for one chart, so nothing
+// legitimate approaches 8 MiB: this bounds a wedged or runaway helm rather than
+// real lint output, and it is what makes `outputTruncated` reachable for this
+// runner at all (#2100). Same value as the sibling report caps.
+const MAX_HELM_LINT_OUTPUT_BYTES = 8 * 1024 * 1024;
 const SKIPPED = {
     status: "skipped",
     diagnostics: [],
@@ -93,7 +99,17 @@ async function lintChart(chartRoot, cwd) {
         timeout: HELM_LINT_TIMEOUT_MS,
         deadlineAt: Date.now() + HELM_LINT_TIMEOUT_MS,
         resourceLabel: "helm-lint",
+        maxOutputBytes: MAX_HELM_LINT_OUTPUT_BYTES,
     });
+    // FIRST (#2100): the cap kill is OUR SIGTERM, so it also sets
+    // `spawnFailure.kind === "killed"` and `failure === "signal"`. Read after
+    // those two, a truncated lint was reported as a server_error — helm blamed
+    // for output we threw away. A timed-out or aborted run carries
+    // `outputTruncated` too, and `truncatedByOutputCap` leaves those to the
+    // typed-failure block below so they keep reporting timeout/aborted.
+    if (truncatedByOutputCap(result)) {
+        return failedResult("parser_error", "helm lint output was truncated before parsing completed");
+    }
     const output = [result.stdout, result.stderr].filter(Boolean).join("\n");
     const diagnostics = parseHelmLintOutput(output, chartRoot);
     const typedFailure = result.spawnFailure?.kind;
@@ -110,9 +126,6 @@ async function lintChart(chartRoot, cwd) {
     if (result.failure) {
         return failedResult(result.failure === "timeout" ? "timeout" : result.failure, result.error?.message || `helm lint ${result.failure}`);
     }
-    if (result.outputTruncated) {
-        return failedResult("parser_error", "helm lint output was truncated before parsing completed");
-    }
     const hasErrorDiagnostic = diagnostics.some((diagnostic) => diagnostic.severity === "error");
     if (result.status !== 0 && !hasErrorDiagnostic) {
         return failedResult(output.trim() ? "parser_error" : "server_error", output.trim() || "helm lint exited without an error diagnostic");
@@ -131,7 +144,6 @@ const helmLintRunner = {
     id: "helm-lint",
     appliesTo: ["yaml", "helm-template"],
     priority: PRIORITY.GENERAL_ANALYSIS,
-    enabledByDefault: true,
     skipTestFiles: false,
     timeoutMs: 35_000,
     async run(ctx) {

package/dist/clients/dispatch/runners/helm-render.js

@@ -78,6 +78,7 @@ import { normalizeMapKey } from "../../path-utils.js";
 import { loadPiLensProjectConfig } from "../../project-lens-config.js";
 import { getProjectTrustState, projectTrustDenialReason, } from "../../project-trust.js";
 import { safeSpawnAsync } from "../../safe-spawn.js";
+import { killedForOutputCap, truncatedByOutputCap, } from "../../spawn-output-cap.js";
 import { isTrivyEnabled, resolveSeverityFloor } from "../../trivy-client.js";
 import { findNearestDirWithMarker } from "../../workspace-topology.js";
 import { PRIORITY } from "../priorities.js";
@@ -100,6 +101,15 @@ const TRIVY_TIMEOUT_MS = 45_000;
 const MAX_RENDERED_FILES = 400;
 /** Bytes of trivy report we retain. Truncation is reported, never parsed past. */
 const MAX_REPORT_BYTES = 8 * 1024 * 1024;
+/**
+ * Bytes of `helm template` output we retain. The manifests go to `--output-dir`,
+ * so stdout is one short "wrote <path>" line per file — bounded near
+ * {@link MAX_RENDERED_FILES} — and stderr carries template errors. 8 MiB is
+ * therefore a blast-radius bound on a chart that loops or a helm that wedges,
+ * not a working limit, and it is what makes `render.outputTruncated` reachable
+ * at all (#2100).
+ */
+const MAX_RENDER_OUTPUT_BYTES = 8 * 1024 * 1024;
 const SKIPPED = {
     status: "skipped",
     diagnostics: [],
@@ -661,6 +671,16 @@ export async function runIacPass(options) {
         // hold in memory rather than trusting the chart's size (shape 9).
         maxOutputBytes: MAX_REPORT_BYTES,
     });
+    // FIRST (#2100): hitting the cap makes safe-spawn SIGTERM trivy, so a
+    // truncated report also arrives as a killed spawn with a null status. Read
+    // after the gate below, this said "the IaC pass failed" when what actually
+    // happened is that WE stopped reading. A timed-out or aborted scan carries
+    // the flag too and stays with the failure gate, which names its real cause.
+    if (truncatedByOutputCap(scan)) {
+        return [
+            coverageGap(chartRoot, "iac-report-unreadable", `Rendered-manifest IaC checks did not run: the trivy report exceeded ${MAX_REPORT_BYTES} bytes and was truncated before parsing.`),
+        ];
+    }
     const scanFailure = spawnFailureKind(scan);
     // `trivy config` is not given `--exit-code`, so it exits 0 whenever it
     // completed. ANY nonzero status is therefore a real error, with or without
@@ -673,11 +693,6 @@ export async function runIacPass(options) {
             coverageGap(chartRoot, "iac-pass-failed", `Rendered-manifest IaC checks failed to complete (${why}): ${detail}`),
         ];
     }
-    if (scan.outputTruncated) {
-        return [
-            coverageGap(chartRoot, "iac-report-unreadable", `Rendered-manifest IaC checks did not run: the trivy report exceeded ${MAX_REPORT_BYTES} bytes and was truncated before parsing.`),
-        ];
-    }
     const sourceByRendered = new PathKeyedMap(normalizeMapKey);
     for (const manifest of options.manifests) {
         sourceByRendered.set(manifest.renderedPath, {
@@ -754,7 +769,30 @@ async function renderAndValidate(chartRoot, cwd, filePath) {
             timeout: RENDER_TIMEOUT_MS,
             deadlineAt: Date.now() + RENDER_TIMEOUT_MS,
             resourceLabel: "helm-render",
+            maxOutputBytes: MAX_RENDER_OUTPUT_BYTES,
         });
+        const renderOutput = [render.stdout, render.stderr]
+            .filter(Boolean)
+            .join("\n");
+        // `killedForOutputCap` is platform-neutral. POSIX usually reports SIGTERM,
+        // but Windows reports status 1 with no failure or signal. A timed-out or
+        // aborted render retains its own classification.
+        const renderCapped = truncatedByOutputCap(render);
+        if (killedForOutputCap(render)) {
+            // helm was cut off mid-render, so the scratch tree is a PREFIX —
+            // reading it back would report the manifests we never saw as clean
+            // (shape 10). Not parsed as a chart failure either: helm never reported
+            // a verdict, and `parseHelmTemplateFailure` synthesizes a BLOCKING
+            // "helm template failed" finding when it sees no `Error:` line, which
+            // would blame the chart for our own cap (the #1487 inversion).
+            logRenderPass(filePath, chartRoot, startedAt, {
+                outcome: "render-truncated",
+                diagnostics: 1,
+            });
+            return summarize([
+                coverageGap(chartRoot, "render-truncated", `helm template produced more than ${MAX_RENDER_OUTPUT_BYTES} bytes and was stopped mid-render, so the rendered manifests are UNCHECKED rather than clean.`),
+            ]);
+        }
         const startupFailure = spawnFailureKind(render);
         if (startupFailure) {
             // The runner never got a verdict about the chart. Reporting this as a
@@ -766,9 +804,6 @@ async function renderAndValidate(chartRoot, cwd, filePath) {
             });
             return failedResult(startupFailure, render.error?.message || `helm template ${startupFailure}`);
         }
-        const renderOutput = [render.stdout, render.stderr]
-            .filter(Boolean)
-            .join("\n");
         if (render.status !== 0) {
             // Before blaming the chart: did helm reject OUR OWN command line? An old
             // helm (v2 has no `helm template --output-dir`) or a wrapper shim exits
@@ -785,7 +820,9 @@ async function renderAndValidate(chartRoot, cwd, filePath) {
             }
             // A failed RENDER is a real diagnostic: the chart cannot be installed.
             const diagnostics = parseHelmTemplateFailure(renderOutput, chartRoot);
-            if (render.outputTruncated) {
+            if (renderCapped) {
+                // helm reported this failure itself, but we kept only a prefix of
+                // what it said, so the report above may be missing errors.
                 diagnostics.push(coverageGap(chartRoot, "render-truncated", "helm template output was truncated, so this failure report may be incomplete."));
             }
             logRenderPass(filePath, chartRoot, startedAt, {
@@ -804,6 +841,14 @@ async function renderAndValidate(chartRoot, cwd, filePath) {
                 sourceMapped: manifest.sourceMapped,
             }));
         }
+        if (renderCapped) {
+            // helm exited 0, so `--output-dir` holds the COMPLETE tree and every
+            // manifest above was validated from disk — the cap only cost us the
+            // "wrote <path>" lines on stdout, which this runner never parses.
+            // Recorded rather than silent (shape 8), but deliberately not an
+            // UNCHECKED claim: nothing was skipped (review F1).
+            diagnostics.push(coverageGap(chartRoot, "render-output-truncated", `helm template printed more than ${MAX_RENDER_OUTPUT_BYTES} bytes and its stdout was truncated. The rendered manifests were still validated from disk; only helm's own progress output was lost.`));
+        }
         if (tree.truncated) {
             // A partly-validated chart reported as clean is the shape-10 trap.
             diagnostics.push(coverageGap(chartRoot, "render-truncated", `This chart rendered more than ${MAX_RENDERED_FILES} manifests; only the first ${MAX_RENDERED_FILES} were validated, so the rest are UNCHECKED rather than clean.`));
@@ -848,7 +893,6 @@ const helmRenderRunner = {
     id: "helm-render",
     appliesTo: ["yaml", "helm-template"],
     priority: PRIORITY.GENERAL_ANALYSIS,
-    enabledByDefault: true,
     skipTestFiles: false,
     timeoutMs: RENDER_TIMEOUT_MS + TRIVY_TIMEOUT_MS + 10_000,
     async run(ctx) {

package/dist/clients/dispatch/runners/htmlhint.js

@@ -47,7 +47,6 @@ const htmlhintRunner = {
     id: "htmlhint",
     appliesTo: ["html"],
     priority: PRIORITY.GENERAL_ANALYSIS,
-    enabledByDefault: true,
     skipTestFiles: false,
     async run(ctx) {
         const cwd = ctx.cwd || process.cwd();

package/dist/clients/dispatch/runners/index.js

@@ -57,9 +57,7 @@ export function registerDefaultRunners(registry) {
     registry.register(lspRunner); // Unified LSP type-checking for all languages (priority 4)
     registry.register(pyrightRunner); // Python type-checking (priority 5) - fallback when --lens-lsp disabled
     registry.register(biomeCheckJsonRunner); // Biome check with JSON output for diagnostic capture (priority 9)
-    // DISABLED in post-write dispatch - ast-grep-napi can crash. Runs in the
-    // project-wide pass via lens_diagnostics mode=full (refreshRunners) instead.
-    registry.register(astGrepNapiRunner); // TS/JS structural analysis via NAPI (priority 15, post-write disabled)
+    registry.register(astGrepNapiRunner); // JS/TS, CSS, and HTML structural analysis via NAPI (priority 15)
     registry.register(treeSitterRunner); // Tree-sitter structural analysis (priority 14)
     registry.register(ruffRunner); // Python linting (priority 10)
     registry.register(shellcheckRunner); // Shell script linting (priority 20)

package/dist/clients/dispatch/runners/javac.js

@@ -39,7 +39,6 @@ const javacRunner = {
     id: "javac",
     appliesTo: ["java"],
     priority: PRIORITY.GENERAL_ANALYSIS,
-    enabledByDefault: true,
     skipTestFiles: false,
     async run(ctx) {
         const cwd = ctx.cwd || process.cwd();

package/dist/clients/dispatch/runners/ktlint.js

@@ -56,7 +56,6 @@ const ktlintRunner = {
     id: "ktlint",
     appliesTo: ["kotlin"],
     priority: PRIORITY.FORMAT_AND_LINT_PRIMARY,
-    enabledByDefault: true,
     skipTestFiles: false,
     async run(ctx) {
         const cwd = ctx.cwd || process.cwd();

package/dist/clients/dispatch/runners/lsp.js

@@ -15,6 +15,7 @@ import { logExtension } from "../../extension-log.js";
 import { getLspCapableKinds } from "../../language-policy.js";
 import { touchCoverageGap } from "../../lsp/diagnostic-binding.js";
 import { getLSPService } from "../../lsp/index.js";
+import { LSP_SERVERS } from "../../lsp/server.js";
 import { RUNTIME_CONFIG } from "../../runtime-config.js";
 import { PRIORITY } from "../priorities.js";
 import { resolveRunnerPath } from "../runner-context.js";
@@ -32,8 +33,42 @@ const LSP_SPAWN_BUDGET_MS = RUNTIME_CONFIG.pipeline.lspSpawnBudgetMs;
 // can't dominate the per-edit pipeline budget. Diagnostics that arrive
 // after the cap still land in the client's cache and surface on the
 // next edit. Overridable via PI_LENS_LSP_DIAGNOSTICS_MAX_WAIT_MS.
-const LSP_DIAGNOSTICS_WAIT_MS = 2500;
+export const LSP_DIAGNOSTICS_WAIT_MS = 2500;
 const MAX_CODE_ACTION_TITLES = 3;
+/**
+ * Fixed margin above the worst-case cold-spawn-plus-diagnostics wait, so
+ * scheduling jitter alone can't reopen the F2 race below.
+ */
+const LSP_COLD_SPAWN_MARGIN_MS = 5_000;
+/**
+ * This runner's own dispatch wall-clock budget. `runRunner` in
+ * `dispatcher.ts` races `runner.timeoutMs ?? RUNNER_TIMEOUT_MS` (30s)
+ * against `runner.run()` for the WHOLE call — reading the file, waiting for
+ * a client (bounded by `LSP_SPAWN_BUDGET_MS`, raised per-server via
+ * `LSPServerInfo.clientWaitTimeoutMs`), then waiting for diagnostics
+ * (`LSP_DIAGNOSTICS_WAIT_MS`).
+ *
+ * Left undeclared, this runner inherited the shared 30s default. A server
+ * whose `clientWaitTimeoutMs` exceeds that — Prisma's 40s, Vue's 30s
+ * (#2169, #2176) — could never actually use its own raised wait: the outer
+ * race always fired first, at 30s, so raising a server's floor without also
+ * raising this ceiling was a no-op on the real dispatch path (fix-round F2,
+ * #2233). Derive the ceiling from the registry instead of a second
+ * hand-picked literal, so the next slow server's `clientWaitTimeoutMs` keeps
+ * this budget correct automatically: the highest declared
+ * `clientWaitTimeoutMs` (or the shared 5s default, whichever is larger),
+ * plus the diagnostics wait that still runs after a cold spawn succeeds,
+ * plus a fixed margin.
+ *
+ * This raises the failure-detection latency for every OTHER language's
+ * hung-server case too (30s -> the value below), not just the five servers
+ * that need the headroom — the tradeoff is stated in PR #2233's body. It
+ * remains well inside the spread other dispatch runners already use
+ * (pyright 75s, golangci-lint/dotnet-build/rust-clippy 90s).
+ */
+export const LSP_RUNNER_TIMEOUT_MS = Math.max(LSP_SPAWN_BUDGET_MS, ...LSP_SERVERS.map((server) => server.clientWaitTimeoutMs ?? 0)) +
+    LSP_DIAGNOSTICS_WAIT_MS +
+    LSP_COLD_SPAWN_MARGIN_MS;
 function normalizeActionTitle(title) {
     return title.replace(/\s+/g, " ").trim();
 }
@@ -58,7 +93,7 @@ const lspRunner = {
     // is now the only step this seam needs (#1545).
     appliesTo: getLspCapableKinds(),
     priority: PRIORITY.LSP_PRIMARY,
-    enabledByDefault: true,
+    timeoutMs: LSP_RUNNER_TIMEOUT_MS,
     async run(ctx) {
         const diagnosticPath = resolveRunnerPath(ctx.cwd, ctx.filePath);
         // Only run if LSP is not disabled via --no-lsp

package/dist/clients/dispatch/runners/markdownlint.js

@@ -5,7 +5,10 @@ import { createAvailabilityChecker, resolveToolCommandWithInstallFallback, } fro
 import { parseToolRun } from "./utils/tool-failure.js";
 import { isInSpawnTimeoutCooldown, noteSpawnTimeout, } from "../../spawn-timeout-cooldown.js";
 import { finishParsedRun } from "./utils/tool-failure.js";
-const markdownlint = createAvailabilityChecker("markdownlint-cli2", ".cmd");
+const markdownlint = createAvailabilityChecker("markdownlint-cli2", ".cmd", [
+    "--no-globs",
+    "-",
+]);
 // markdownlint-cli2 exit codes (its README's "Exit Codes" section): 0 = no
 // findings, 1 = lint findings, 2 = unexpected error (unreadable config, bad
 // glob, crash). Only 2 is a rejected invocation.
@@ -91,7 +94,6 @@ const markdownlintRunner = {
     id: "markdownlint",
     appliesTo: ["markdown"],
     priority: PRIORITY.DOC_QUALITY,
-    enabledByDefault: true,
     skipTestFiles: false,
     async run(ctx) {
         const cwd = ctx.cwd || process.cwd();

package/dist/clients/dispatch/runners/mypy.js

@@ -59,7 +59,6 @@ const mypyRunner = {
     id: "mypy",
     appliesTo: ["python"],
     priority: PRIORITY.GENERAL_ANALYSIS,
-    enabledByDefault: true,
     skipTestFiles: false,
     async run(ctx) {
         const cwd = ctx.cwd || process.cwd();

package/dist/clients/dispatch/runners/oxlint.js

@@ -6,14 +6,18 @@
  *
  * Requires: oxlint (npm install -g oxlint)
  */
-import * as fs from "node:fs";
-import * as path from "node:path";
-import { walkUpDirs } from "../../path-utils.js";
+import { findLocalBinUpwards } from "../../package-manager.js";
 import { safeSpawnAsync } from "../../safe-spawn.js";
+import { truncatedByOutputCap } from "../../spawn-output-cap.js";
 import { getJstsLintPolicyForCwd, hasVitePlusConfig, } from "../../tool-policy.js";
 import { PRIORITY } from "../priorities.js";
 import { resolveToolCommand, resolveToolCommandWithInstallFallback, } from "./utils/runner-helpers.js";
 import { finishParsedRun, parseToolRun } from "./utils/tool-failure.js";
+// One file's JSON report. Nothing legitimate approaches 8 MiB here, so this is
+// a blast-radius bound on a runaway or wedged oxlint rather than a working
+// limit — the same value MAX_SG_OUTPUT_BYTES and MAX_REPORT_BYTES use, and what
+// makes `outputTruncated` reachable for this runner at all (#2100).
+const MAX_OXLINT_OUTPUT_BYTES = 8 * 1024 * 1024;
 const OXLINT_NO_FILES = Symbol("oxlint-no-files");
 const OXLINT_NO_FILES_UNCONFIRMED = Symbol("oxlint-no-files-unconfirmed");
 const OXLINT_NO_FILES_BANNER = "No files found to lint. Please check your paths and ignore patterns.";
@@ -24,21 +28,19 @@ const OXLINT_NO_FILES_REPORT_KEYS = new Set([
     "threads_count",
     "start_time",
 ]);
+/**
+ * Vite+'s `vp` from the project's own `node_modules/.bin`.
+ *
+ * Delegates to THE shared bin walker (#2544 review F1). This was a private,
+ * UNCEILINGED copy of that walk, while `formatters.ts`'s `oxfmtFormatter`
+ * resolved the SAME binary — `vp` — through the ceilinged `findInNodeModules`:
+ * one `vp` resolver stopped at `$HOME` and the other climbed past it to the
+ * filesystem root, so which policy applied depended on whether the format path
+ * or the lint path asked. A `node_modules/.bin/vp` at or above `$HOME` can
+ * never be this project's own Vite+ install (#2514).
+ */
 function resolveLocalVp(cwd) {
-    const isWin = process.platform === "win32";
-    for (const dir of walkUpDirs(cwd)) {
-        const candidates = isWin
-            ? [
-                path.join(dir, "node_modules", ".bin", "vp.cmd"),
-                path.join(dir, "node_modules", ".bin", "vp"),
-            ]
-            : [path.join(dir, "node_modules", ".bin", "vp")];
-        for (const candidate of candidates) {
-            if (fs.existsSync(candidate))
-                return candidate;
-        }
-    }
-    return null;
+    return findLocalBinUpwards("vp", cwd) ?? null;
 }
 async function resolveVitePlusCommand(cwd) {
     const local = resolveLocalVp(cwd);
@@ -54,7 +56,6 @@ const oxlintRunner = {
     id: "oxlint",
     appliesTo: ["jsts"],
     priority: PRIORITY.LINT_SECONDARY,
-    enabledByDefault: true,
     skipTestFiles: false,
     async run(ctx) {
         const cwd = ctx.cwd || process.cwd();
@@ -86,6 +87,7 @@ const oxlintRunner = {
         // Run oxlint (or Vite+'s vp lint wrapper) on the file.
         const result = await safeSpawnAsync(cmd, args, {
             timeout: 30000,
+            maxOutputBytes: MAX_OXLINT_OUTPUT_BYTES,
         });
         // Oxlint exits 0 whenever nothing at ERROR severity was found — that
         // includes a run that found only warnings, its own default severity
@@ -194,16 +196,16 @@ const oxlintRunner = {
 };
 function oxlintProcessState(result) {
     const failureKind = result.spawnFailure?.kind;
-    if (result.signal || result.failure === "signal")
-        return "signal";
+    if (truncatedByOutputCap(result))
+        return "truncated";
     if (result.failure === "timeout" || failureKind === "timeout")
         return "timeout";
     if (result.failure === "aborted" || failureKind === "killed")
         return "killed";
+    if (result.signal || result.failure === "signal")
+        return "signal";
     if (result.failure === "spawn" || result.error)
         return "spawn";
-    if (result.outputTruncated)
-        return "truncated";
     return "normal";
 }
 function isNonnegativeInteger(value) {

package/dist/clients/dispatch/runners/php-lint.js

@@ -29,7 +29,6 @@ const phpLintRunner = {
     id: "php-lint",
     appliesTo: ["php"],
     priority: PRIORITY.GENERAL_ANALYSIS,
-    enabledByDefault: true,
     skipTestFiles: false,
     async run(ctx) {
         const cwd = ctx.cwd || process.cwd();

package/dist/clients/dispatch/runners/phpstan.js

@@ -82,7 +82,6 @@ const phpstanRunner = {
     id: "phpstan",
     appliesTo: ["php"],
     priority: PRIORITY.GENERAL_ANALYSIS,
-    enabledByDefault: true,
     skipTestFiles: false,
     async run(ctx) {
         const cwd = ctx.cwd || process.cwd();

package/dist/clients/dispatch/runners/prisma-validate.js

@@ -35,7 +35,6 @@ const prismaValidateRunner = {
     id: "prisma-validate",
     appliesTo: ["prisma"],
     priority: PRIORITY.GENERAL_ANALYSIS,
-    enabledByDefault: true,
     skipTestFiles: false,
     async run(ctx) {
         const cwd = ctx.cwd || process.cwd();

package/dist/clients/dispatch/runners/psscriptanalyzer.js

@@ -77,6 +77,7 @@ function notePsDecision(latch, tool, verdict) {
         cause: verdict.available ? "ok" : verdict.cause,
         elapsedMs: verdict.elapsedMs,
         latched: verdict.available || isLatchingOutcome(verdict.outcome),
+        classifiedBy: "probe",
         hostStallMs: verdict.hostStallMs,
         ...(retryAfterMs !== undefined && { retryAfterMs }),
         budgetMs: PS_TIMEOUT_MS,
@@ -268,7 +269,6 @@ const psScriptAnalyzerRunner = {
     id: "psscriptanalyzer",
     appliesTo: ["powershell"],
     priority: PRIORITY.GENERAL_ANALYSIS,
-    enabledByDefault: true,
     skipTestFiles: false,
     async run(ctx) {
         const cmd = await resolvePowerShellCmd();
@@ -412,6 +412,9 @@ const psScriptAnalyzerRunner = {
                     latched: false,
                     hostStallMs,
                     budgetMs: PS_TIMEOUT_MS,
+                    // A read of the process's own stdout, not classifyProbeFailure, is
+                    // what decided this (#2209).
+                    classifiedBy: "caller",
                 });
                 incrementDegradationCount({
                     kind: "grammar-blocked",