pi-lens 4.2.0 → 4.3.0

package/dist/clients/dependency-checker.js

@@ -8,6 +8,7 @@
  * Requires: npm install -D madge
  * Docs: https://github.com/pahen/madge
  */
+import { recordDegradationOnce } from "./degradation-ledger.js";
 import { createSubsystemLogger } from "./extension-log.js";
 import * as fs from "node:fs";
 import * as path from "node:path";
@@ -36,34 +37,79 @@ export function buildMadgeArgs(target, projectRoot) {
     if (fs.existsSync(tsConfig)) {
         args.push("--ts-config", tsConfig);
     }
-    // --warning surfaces files madge couldn't resolve into the graph (to stderr;
-    // stdout JSON is unaffected). Without it those skips are SILENT — and a
-    // skipped *local* file could hide a real cycle. We log them (see
-    // parseMadgeSkips) instead of discarding stderr.
-    args.push("--warning", "--json", target);
+    // No `--warning`: madge gates it on `!program.json` (bin/cli.js:195) and this
+    // argv always passes `--json`, so the flag is inert; ungated it prints the
+    // skipped-file list to STDOUT (lib/output.js), which would corrupt the JSON
+    // this reader parses. The skip list is therefore unreachable through any
+    // argv this builder emits — `parseMadgeSkips` could only ever return zeros
+    // (#3436). The lost visibility is disclosed once per session/root by
+    // `recordDegradationOnce` from `parseMadgeCycles`, the one reader both
+    // madge lanes pass through, instead of parsed from bytes madge never
+    // writes.
+    args.push("--json", target);
     return args;
 }
 /**
- * Parse madge's `--warning` stderr for skipped (unresolvable) files. External
- * package specifiers (bare names / subpaths like `web-tree-sitter`,
- * `vitest/config`) are expected — madge doesn't traverse node_modules. We flag
- * only **local** skips (relative/absolute paths), which are the ones that could
- * silently drop an internal edge and hide a cycle.
+ * The ONE reader of madge's `--circular --json` contract (#3428).
  *
- * @returns total skip count and the subset that look local.
+ * madge prints an array of cycles, each cycle an array of member paths —
+ * `[["src/a.ts", "src/b.ts"]]` — not a dependency graph. Upstream 8.0.0:
+ * `bin/cli.js:258-268` hands `Madge.circular()` (an Array, `lib/api.js:103`) to
+ * `output.circular`, which for `--json` is `printJSON(circular)`
+ * (`lib/output.js:71-73`). The graph OBJECT is what `--json` prints WITHOUT
+ * `--circular`, and `buildMadgeArgs` always passes `--circular`.
+ *
+ * This function exists because there were two readers and they disagreed: the
+ * whole-project scan read the array with `Object.entries`, so every cycle it
+ * reported was anchored at the array INDEX (`<root>/0`, a path that does not
+ * exist) and every member was resolved against the extension host's cwd. Both
+ * callers now share this one reader.
+ *
+ * `baseDir` is the directory madge's relative members resolve against, which is
+ * the TARGET it was pointed at (measured, madge 8.0.0: `--json <root>` prints
+ * `src/a.ts`; `--json <root>/src/a.ts` prints `a.ts`), so each caller passes
+ * the base its own target implies.
+ *
+ * Malformed JSON throws, which both callers already treat as "did not parse". A
+ * parse that is not an array does NOT throw: it yields zero cycles, so an
+ * unexpected shape reports no findings instead of turning a completed scan into
+ * a failed one (#2154 — a failed madge scan is a COLD lane in `mode=full`).
+ *
+ * This reader is also the ONE place both madge lanes (the turn-end
+ * `runMadgeSpawn` and the session-start `runScanProject`) turn bytes into
+ * findings, so the argv's blind spot is recorded here rather than once per
+ * caller (#3436). `projectRoot` is the ledger subject, not the resolve
+ * `baseDir`: a single-file target resolves members against its own directory
+ * but the gap is a property of the project's scan, disclosed once per
+ * session/root.
  */
-export function parseMadgeSkips(stderr) {
-    const lines = (stderr || "").split(/\r?\n/);
-    const headerIdx = lines.findIndex((l) => /Skipped\s+\d+\s+file/i.test(l));
-    if (headerIdx === -1)
-        return { total: 0, local: [] };
-    const total = Number.parseInt(lines[headerIdx].match(/Skipped\s+(\d+)/i)?.[1] ?? "0", 10) || 0;
-    const specifiers = lines
-        .slice(headerIdx + 1)
-        .map((l) => l.trim())
-        .filter(Boolean);
-    const local = specifiers.filter((s) => s.startsWith(".") || s.startsWith("/") || /^[a-zA-Z]:[\\/]/.test(s));
-    return { total, local };
+function parseMadgeCycles(stdout, baseDir, projectRoot) {
+    const parsed = JSON.parse(stdout || "[]");
+    const cycles = Array.isArray(parsed) ? parsed : [];
+    const circular = [];
+    const circularFiles = new Set();
+    for (const cycle of cycles) {
+        const resolvedPaths = cycle.map((f) => path.resolve(baseDir, f));
+        for (const f of resolvedPaths) {
+            circularFiles.add(f);
+        }
+        circular.push({
+            file: resolvedPaths[0],
+            path: resolvedPaths,
+        });
+    }
+    // madge's `--warning` is inert under `--json` (bin/cli.js:195 gates it on
+    // `!program.json`) and, ungated, prints the skip list to stdout where it
+    // would corrupt the JSON this reader parses, so no argv `buildMadgeArgs`
+    // emits can report which LOCAL files madge failed to resolve. A skipped
+    // local file can hide a real cycle, so the gap is disclosed once per
+    // session/root instead of being read as a clean graph (#3436).
+    recordDegradationOnce({
+        kind: "madge-skip-visibility-unavailable",
+        subject: projectRoot,
+        reason: "madge --warning is inert under --json; skipped-file visibility is unavailable for this scan",
+    });
+    return { circular, circularFiles };
 }
 /**
  * Defensive cap on concurrent madge spawns for a single `checkFilesBatch`
@@ -520,7 +566,6 @@ export class DependencyChecker {
             circular: spawnResult.circular.filter((d) => d.file === normalized || d.path.includes(normalized)),
             checked: true,
             cacheHit: false,
-            localSkips: spawnResult.localSkips,
         };
     }
     /**
@@ -542,31 +587,20 @@ export class DependencyChecker {
                 this.log(`Check error: ${result.error.message}`);
                 return { ok: false };
             }
-            const output = result.stdout || "[]";
-            const parsed = JSON.parse(output);
-            // Madge --circular --json returns array of cycle arrays: [["a.ts", "b.ts"], ...]
-            const cycles = Array.isArray(parsed) ? parsed : [];
-            const circular = [];
-            const circularFiles = new Set();
-            for (const cycle of cycles) {
-                const resolvedPaths = cycle.map((f) => path.resolve(projectRoot, f));
-                for (const f of resolvedPaths) {
-                    circularFiles.add(f);
-                }
-                circular.push({
-                    file: resolvedPaths[0],
-                    path: resolvedPaths,
-                });
-            }
-            const skips = parseMadgeSkips(result.stderr || "");
-            if (skips.local.length > 0) {
-                this.log(`madge skipped ${skips.local.length} local file(s) (possible silent cycle-miss): ${skips.local.slice(0, 5).join(", ")}`);
-            }
+            // madge resolves its printed members against the TARGET, which this
+            // lane points at a single FILE, so they come back relative to that
+            // file's directory — `a.ts`/`b.ts` for a `src/a.ts` target, and
+            // `../lib/b.ts` for a cycle that leaves it (measured with madge 8.0.0,
+            // see parseMadgeCycles). Resolving them against `projectRoot` instead
+            // anchors `<root>/a.ts`, a path that does not exist, and keys the
+            // shared `circularFiles` set with it (#3435). `path.dirname` of the
+            // target is the file-independent form of "the directory madge printed
+            // relative to"; a top-level target degenerates to `projectRoot`.
+            const { circular, circularFiles } = parseMadgeCycles(result.stdout || "", path.dirname(normalized), projectRoot);
             return {
                 ok: true,
                 circular,
                 circularFiles,
-                localSkips: skips.local.length,
             };
         }
         catch (err) {
@@ -729,7 +763,6 @@ export class DependencyChecker {
                 circular: spawnResult.circular.filter((d) => d.file === entry.normalized || d.path.includes(entry.normalized)),
                 checked: true,
                 cacheHit: false,
-                localSkips: spawnResult.localSkips,
             });
         }
         // A batch that learned nothing publishes nothing — advancing the
@@ -800,25 +833,15 @@ export class DependencyChecker {
                 this.log(`Scan error: ${result.error.message}`);
                 return { circular: [], count: 0 };
             }
-            const output = result.stdout || "{}";
-            const data = JSON.parse(output);
-            const circular = [];
-            const circularFiles = new Set();
-            for (const [file, deps] of Object.entries(data)) {
-                if (Array.isArray(deps) && deps.length > 0) {
-                    const resolvedFile = path.resolve(file);
-                    circularFiles.add(resolvedFile);
-                    circular.push({
-                        file: resolvedFile,
-                        path: [resolvedFile, ...deps.map((d) => path.resolve(d))],
-                    });
-                }
-            }
+            // The scan's target IS `projectRoot`, so that is the base madge's
+            // relative members resolve against (#3428: this site used to read the
+            // cycle array as a graph and anchor every finding at `<hostCwd>/0`).
+            const { circular, circularFiles } = parseMadgeCycles(result.stdout || "", projectRoot, projectRoot);
             this.publishState(gen, circular, circularFiles);
-            // #2154: the one madge site that parsed a graph for this root. Every
-            // other return here (missing root, no top-level source file, madge
-            // unavailable, spawn error, parse throw) is the SAME empty shape and
-            // must not be read as "no cycles in this project".
+            // #2154: the one madge site that parsed madge's output for this root.
+            // Every other return here (missing root, no top-level source file,
+            // madge unavailable, spawn error, parse throw) is the SAME empty shape
+            // and must not be read as "no cycles in this project".
             return { circular, count: circular.length, analyzed: true };
         }
         catch (err) {

package/dist/clients/diagnostic-dispositions.js

@@ -118,10 +118,42 @@ export const normalizeMessage = sharedNormalizeMessage;
 // file, and the module doc/comments above referencing `relativeFile`, keep
 // working unchanged.
 const relativeFile = sharedRelativeFile;
+/**
+ * The SPAN component of a strict anchor: the `lineContentHash` of the
+ * diagnostic's OWN line in `content`. `undefined` when there is no line to
+ * hash — no content, no line, or a line outside the content's range.
+ *
+ * Exported for #3183. The widget store's retention lifetime asks the same
+ * question a strict anchor does — "is the marked line still in this file?" —
+ * so it reuses this derivation rather than re-spelling it; a second spelling is
+ * how the store's answer drifts from the filter's (the retention identity's own
+ * drift from `computeWeakAnchor`'s parts cost #3158 a round). Note what is NOT
+ * here: the cwd/path component `stableFindingId` adds. Both sides of a
+ * retention comparison are the same file, so the span alone discriminates
+ * exactly as well while needing no `cwd` — which is why the store can ask it at
+ * all (see `retentionIdentity` in `clients/widget-state.ts`).
+ */
+export function strictAnchorSpan(content, line) {
+    if (content === undefined || line === undefined)
+        return undefined;
+    const lines = content.split(/\r?\n/);
+    if (line < 1 || line > lines.length)
+        return undefined;
+    return lineContentHash(lines[line - 1] ?? "");
+}
+/**
+ * Every span {@link strictAnchorSpan} could produce for `content` — one hash
+ * per line (#3183). Membership answers "does the line a mark was made against
+ * still exist in this file", wherever it has since moved to.
+ */
+export function strictAnchorSpansIn(content) {
+    const spans = new Set();
+    for (const line of content.split(/\r?\n/))
+        spans.add(lineContentHash(line));
+    return spans;
+}
 /** Site-specific anchor — see module doc. Used only for false-positive. */
 export function computeStrictAnchor(args) {
-    const lines = args.content?.split(/\r?\n/);
-    const lineText = args.line !== undefined && lines ? (lines[args.line - 1] ?? "") : "";
     return stableFindingId("dd:", {
         cwd: args.cwd,
         filePath: args.filePath,
@@ -129,7 +161,11 @@ export function computeStrictAnchor(args) {
             args.tool ?? "",
             args.rule ?? "",
             normalizeMessage(args.message),
-            lineContentHash(lineText),
+            // An absent/out-of-range line hashes the empty string, exactly as the
+            // pre-#3183 `lines[args.line - 1] ?? ""` fallback did: stable, but less
+            // resistant to a same-file/rule/message collision (see
+            // `DispositionAnchorArgs.content`).
+            strictAnchorSpan(args.content, args.line) ?? lineContentHash(""),
         ],
     });
 }

package/dist/clients/dispatch/finding-policy.js

@@ -18,7 +18,7 @@
  * hold dispatch `Diagnostic`s, `applyLspFindingPolicy` for the probe lane,
  * which holds raw `LSPDiagnostic`s.
  */
-import { applyDispositions, hasAnyDispositionMarks, } from "../diagnostic-dispositions.js";
+import { applyDispositions, applyDispositionsMultiFile, hasAnyDispositionMarks, } from "../diagnostic-dispositions.js";
 import { loadPiLensProjectConfig } from "../project-lens-config.js";
 import { retagAuxiliaryDiagnostics } from "./auxiliary-lsp.js";
 import { applyInlineSuppressions } from "./inline-suppressions.js";
@@ -129,6 +129,57 @@ function probeIdentities(canonical, raw) {
 export function renderedRuleIdentities(diagnostic) {
     return expandRenderedIdentities([[diagnostic.tool, diagnostic.rule]]);
 }
+/**
+ * #3246: the identity spellings a mark against a surface that renders NEITHER
+ * the tool NOR the rule can carry — the turn-end unresolved-inline-blocker
+ * body, whose every line is `formatDiagnostics`' `  L<n>: <message>` (plus an
+ * optional fix hint). An agent marking from that text has only the message and
+ * the line to give `lens_diagnostic_mark`, whose `tool` AND `rule` parameters
+ * are both optional, so the mark's anchor carries neither; a mark made from the
+ * widget or `mode=full` carries the full canonical pair for the same finding.
+ * Honoring one spelling and not the other is exactly the non-convergence #3088
+ * reported, so both go through the SAME expansion `probeIdentities` uses. The
+ * bare spelling stays safe for this STOP-tier surface because a `"blocking"`
+ * diagnostic can only ever be dropped by the STRICT, content-bound
+ * false-positive anchor (`applyDispositions`' F1 rule), which still binds the
+ * normalized message and the flagged line's content hash.
+ */
+export function inlineBlockerIdentities(diagnostic) {
+    return expandRenderedIdentities([
+        [diagnostic.tool, diagnostic.rule],
+        [undefined, undefined],
+    ]);
+}
+/**
+ * The whole stack for a turn-end PUSH surface that renders dispatch
+ * diagnostics for ONE file — the late-auxiliary drain (#3102) and the
+ * late-runner drain (#3248), which are the same shape: a post-freshness-gate
+ * `Diagnostic[]`, a `<file>:<line>:<col> [<rule>] <message>` rendering that
+ * prints the rule but never the tool, and a suppressed count the caller
+ * surfaces once per delivery (#1616).
+ *
+ * It exists so those two lanes cannot drift apart: this used to be open-coded
+ * at the late-auxiliary site, and #3248 would have made a second copy of the
+ * identical four arguments — the single-source rule's exact failure shape. The
+ * caller still owns its own content read, because the two lanes read on
+ * different schedules (the auxiliary drain reads once per FILE across several
+ * server pairs; the runner drain reads once per pending runner).
+ *
+ * `content` is `undefined` when the file could not be read: it becomes `""`,
+ * `FindingPolicyOptions.content`'s documented fail-open input, so the STRICT
+ * anchor cannot match and nothing is hidden over an I/O error (shape 48).
+ */
+export function applyPushedFindingPolicy(findings, options) {
+    const { kept } = applyFindingPolicy(findings, {
+        cwd: options.cwd,
+        filePath: options.filePath,
+        content: options.content ?? "",
+        // mtime-cached, so several files in one drain cost one stat.
+        policyMap: loadProjectRulePolicyMap(options.cwd),
+        identities: renderedRuleIdentities,
+    });
+    return { kept, suppressed: findings.length - kept.length };
+}
 /** Every rendered `(tool, rule)` spelling plus the `tool`-omitted form of
  * each, de-duplicated, in order. One derivation for both callers. */
 function expandRenderedIdentities(rendered) {
@@ -220,3 +271,69 @@ export function applyLspFindingPolicy(diagnostics, options) {
     };
     return { kept: survivorsOf(kept), inlineKept: survivorsOf(inlineKept) };
 }
+/**
+ * #1617: turn_end reads gitleaks/govulncheck/trivy straight from their
+ * session-scan caches and formats them into advisory/blocker text — a
+ * reporting lane parallel to (and, before this fix, entirely bypassing)
+ * `dispatcher.ts:924`'s `applyDispositions` filter. An agent-marked
+ * false-positive/won't-fix on one of these findings never suppressed it
+ * here, so it re-reported on every turn.
+ *
+ * Filters `findings` through the SAME anchor derivation the dispatch path
+ * and `lens_diagnostics mode=full` use (`applyDispositionsMultiFile` in
+ * `diagnostic-dispositions.ts`), keyed off each lane's own canonical
+ * `ProjectDiagnostic` adapter (`toDiagnostic`) — the exact tool/rule/message
+ * identity `lens_diagnostics` already surfaces and `lens_diagnostic_mark`
+ * already anchors a mark against, not a second, cloned identity that would
+ * silently diverge from what the agent actually marked.
+ *
+ * Returns the surviving findings plus how many were dropped, so a caller can
+ * still surface a "suppressed by disposition: N" trace (the #1616
+ * suppressed-bucket rule — a security finding must never vanish with no
+ * trace, even when the disposition that dropped it is working as intended).
+ */
+export function filterFindingsByDisposition(findings, cwd, toDiagnostic) {
+    if (findings.length === 0)
+        return { kept: findings, suppressed: 0 };
+    // #3248: every `(tool, rule)` spelling a mark against these findings can
+    // carry, not just the canonical one. NONE of these turn-end surfaces prints
+    // a tool — knip renders `<file>:<line> — <type>: <name>`, dead-code
+    // `unused <kind> <name>`, the security lanes `Potential secret: <rule>` —
+    // so an agent marking from what it was SHOWN has no tool to pass, and
+    // `lens_diagnostic_mark`'s `tool` parameter is optional. Honouring only the
+    // spelling `lens_diagnostics` happens to show is the #3088 non-convergence,
+    // and it is fixed HERE, once, for every caller of this helper rather than
+    // per lane. Widening is safe for the blocking members because a
+    // `semantic: "blocking"` finding can still only be dropped by the STRICT,
+    // content-bound false-positive anchor, which keeps binding the normalized
+    // message and the flagged line's content.
+    // The expanded candidate is a `DispositionCandidate` with a path, NOT a
+    // `ProjectDiagnostic`: the tool-omitted spelling has no `tool`, which that
+    // type requires. Only the anchor derivation reads it.
+    const candidates = findings.flatMap((finding) => {
+        const diagnostic = toDiagnostic(finding);
+        return renderedRuleIdentities(diagnostic).map((identity) => ({
+            finding,
+            candidate: {
+                filePath: diagnostic.filePath,
+                message: diagnostic.message,
+                ...(diagnostic.line !== undefined && { line: diagnostic.line }),
+                ...(diagnostic.semantic !== undefined && {
+                    semantic: diagnostic.semantic,
+                }),
+                ...(identity.tool !== undefined && { tool: identity.tool }),
+                ...(identity.rule !== undefined && { rule: identity.rule }),
+            },
+        }));
+    });
+    const survivors = new Set(applyDispositionsMultiFile(candidates.map((c) => c.candidate), cwd, (d) => d.filePath));
+    const disposed = new Set();
+    for (const candidate of candidates) {
+        if (!survivors.has(candidate.candidate))
+            disposed.add(candidate.finding);
+    }
+    const kept = disposed.size === 0
+        ? findings
+        : findings.filter((finding) => !disposed.has(finding));
+    return { kept, suppressed: findings.length - kept.length };
+}

package/dist/clients/dispatch/indent-detect.js

@@ -12,8 +12,14 @@ export function detectIndentation(content) {
     const spaceCounts = lines
         .map((line) => line.match(/^ +(?=\S)/)?.[0].length ?? 0)
         .filter((count) => count > 0);
-    if (tabs === 0 && spaceCounts.length === 0)
-        return DEFAULT_INDENTATION;
+    if (tabs === 0 && spaceCounts.length === 0) {
+        // The formatter gate uses the shared hasDetectableIndentation predicate. If
+        // that predicate fired but structural masking removed every candidate line,
+        // there is no style to pin and the caller must take the #3038 skip valve
+        // instead of imposing the default width. Keep the historical default for
+        // content with no raw indentation, whose callers never enter this path.
+        return hasDetectableIndentation(content) ? undefined : DEFAULT_INDENTATION;
+    }
     if (tabs > spaceCounts.length)
         return { style: "tab", width: 1 };
     if (spaceCounts.length > tabs) {

package/dist/clients/dispatch/inline-suppressions.js

@@ -11,6 +11,25 @@
  */
 import { normalizeRuleId } from "./rule-id-normalize.js";
 const SUPPRESS_RE = /(?:\/\/|#)\s*pi-lens-ignore:\s*(.+)/;
+const TRAILING_REASON_RE = /(?:\s+--\s+|\s+—\s+|:\s+).+$/u;
+export function splitInlineSuppressionPayload(payload) {
+    const reasonMatch = TRAILING_REASON_RE.exec(payload);
+    const trailingReason = reasonMatch?.[0];
+    if (reasonMatch === null || trailingReason === undefined) {
+        return { ruleList: payload, trailingReason: "" };
+    }
+    return {
+        ruleList: payload.slice(0, reasonMatch.index),
+        trailingReason,
+    };
+}
+export function parseInlineSuppressionRuleIds(payload) {
+    const { ruleList } = splitInlineSuppressionPayload(payload);
+    return ruleList
+        .split(",")
+        .map((rule) => rule.trim())
+        .filter(Boolean);
+}
 /**
  * Normalize a rule id to the form a user writes in a `pi-lens-ignore` comment.
  * The napi scan and the ast-grep LSP tag the same rule as `ast-grep:<id>` /
@@ -37,10 +56,10 @@ export function applyInlineSuppressions(diagnostics, content) {
         const m = SUPPRESS_RE.exec(lines[i]);
         if (!m)
             continue;
-        const rules = m[1]
-            .split(",")
-            .map((r) => r.trim())
-            .filter(Boolean);
+        const payload = m[1];
+        if (payload === undefined)
+            continue;
+        const rules = parseInlineSuppressionRuleIds(payload);
         const suppressedLine = i + 1; // same line (1-based)
         const nextLine = i + 2; // next line (1-based)
         for (const ruleId of rules) {

package/dist/clients/dispatch/rule-ignores.js

@@ -15,22 +15,29 @@
 import * as path from "node:path";
 import { minimatch } from "../deps/minimatch.js";
 import { buildEffectiveAstGrepCatalog } from "./ast-grep-catalog.js";
+import { isWindowsPath, toPosix } from "../path-utils.js";
 /**
  * True when `filePath` is carved out of a rule by one of its glob `patterns`.
  *
  * The glob is matched against `filePath` relative to `root`, forward-slashed.
  * Falls back to the absolute (slash-normalized) path when `filePath` isn't
- * under `root` (e.g. an out-of-tree temp file), so a glob like `scripts/**`
- * simply never matches rather than throwing.
+ * under `root` (e.g. an out-of-tree temp file). Leaf-file patterns retain that
+ * fallback for sinks such as a double-star logger leaf; directory carve-outs
+ * ending in a slash plus double-star remain root-contained so a project's CLI
+ * exemption cannot suppress a finding in an unrelated out-of-tree file.
  */
 export function isRuleIgnoredForPath(filePath, root, patterns) {
     if (!patterns || patterns.length === 0)
         return false;
-    const relative = path.relative(root, filePath);
-    const displayPath = (relative.startsWith("..") ? filePath : relative)
-        .split(path.sep)
-        .join("/");
-    return patterns.some((pattern) => minimatch(displayPath, pattern, { dot: true }));
+    const pathApi = isWindowsPath(root) || isWindowsPath(filePath) ? path.win32 : path.posix;
+    const relative = pathApi.relative(root, filePath);
+    const outsideRoot = relative !== "" &&
+        (relative === ".." ||
+            relative.startsWith(`..${pathApi.sep}`) ||
+            pathApi.isAbsolute(relative));
+    const displayPath = toPosix(outsideRoot ? filePath : relative);
+    return patterns.some((pattern) => (!outsideRoot || !pattern.replaceAll("\\", "/").endsWith("/**")) &&
+        minimatch(displayPath, pattern, { dot: true }));
 }
 /**
  * Rule id → its `ignores` globs, for the effective ast-grep catalog at `root`.

package/dist/clients/dispatch/runners/actionlint.js

@@ -1,8 +1,10 @@
 import path from "node:path";
+import { pathsEqual } from "../../path-utils.js";
 import { safeSpawnAsync } from "../../safe-spawn.js";
 import { resolveRunnerCwd } from "../../tool-cwd.js";
 import { PRIORITY } from "../priorities.js";
 import { createAvailabilityChecker, resolveToolCommandWithInstallFallback, } from "./utils/runner-helpers.js";
+import { finishParsedRun, parseToolRun } from "./utils/tool-failure.js";
 const actionlint = createAvailabilityChecker("actionlint", ".exe");
 export function isGitHubWorkflowFile(filePath) {
     const normalized = filePath.replace(/\\/g, "/");
@@ -31,14 +33,18 @@ function toDiagnostic(issue, filePath) {
         matchedText: issue.snippet,
     };
 }
-export function parseActionlintJson(raw, filePath) {
+export function parseActionlintJson(raw, filePath, cwd) {
     const trimmed = raw.trim();
     if (!trimmed)
         return [];
+    // #3295: actionlint resolves reusable-workflow and composite-action refs, so
+    // its `filepath` is not always the workflow we asked about.
+    const absTarget = path.resolve(cwd, filePath);
+    const isTarget = (issue) => !issue.filepath || pathsEqual(path.resolve(cwd, issue.filepath), absTarget);
     try {
         const parsed = JSON.parse(trimmed);
         const issues = Array.isArray(parsed) ? parsed : [parsed];
-        return issues.map((issue) => toDiagnostic(issue, filePath));
+        return issues.flatMap((issue) => isTarget(issue) ? [toDiagnostic(issue, filePath)] : []);
     }
     catch {
         // Some actionlint versions or wrappers may emit one JSON object per line.
@@ -48,6 +54,8 @@ export function parseActionlintJson(raw, filePath) {
                 continue;
             try {
                 const parsed = JSON.parse(line);
+                if (!isTarget(parsed))
+                    continue;
                 diagnostics.push(toDiagnostic(parsed, filePath));
             }
             catch {
@@ -82,32 +90,22 @@ const actionlintRunner = {
             cwd,
             timeout: 15000,
         });
-        const raw = `${result.stdout ?? ""}${result.stderr ?? ""}`;
-        let diagnostics = parseActionlintJson(raw, ctx.filePath);
-        if (diagnostics.length === 0 && result.status !== 0 && raw.trim()) {
-            diagnostics = [
-                {
-                    id: `actionlint-${path.basename(ctx.filePath)}-failure`,
-                    message: raw.trim().split(/\r?\n/)[0] || "actionlint failed",
-                    filePath: ctx.filePath,
-                    line: 1,
-                    column: 1,
-                    severity: "error",
-                    semantic: "blocking",
-                    tool: "actionlint",
-                    rule: "actionlint",
-                    defectClass: "correctness",
-                },
-            ];
-        }
-        if (diagnostics.length === 0) {
-            return { status: "succeeded", diagnostics: [], semantic: "none" };
-        }
-        return {
-            status: "failed",
-            diagnostics,
-            semantic: "blocking",
-        };
+        const output = `${result.stdout ?? ""}${result.stderr ?? ""}`;
+        const parsed = parseToolRun("actionlint", {
+            result,
+            output,
+            // EXIT TABLE (actionlint 1.7.7 measured fixture): 0 clean; 1 findings; 2 error; other nonzero rejected.
+            exitCodes: { ran: [1, 2] },
+        }, (raw) => parseActionlintJson(raw, ctx.filePath, cwd));
+        if (parsed.skipped)
+            return parsed.skipped;
+        return finishParsedRun({
+            tool: "actionlint",
+            ctx,
+            result,
+            diagnostics: parsed.diagnostics,
+            classify: () => ({ status: "failed", semantic: "blocking" }),
+        });
     },
 };
 export default actionlintRunner;