pi-lens 4.2.0 → 4.3.0

package/dist/clients/dispatch/runners/elixir-check.js

@@ -1,10 +1,12 @@
 import * as fs from "node:fs";
 import * as path from "node:path";
 import { getProjectDataDir } from "../../file-utils.js";
+import { pathsEqual } from "../../path-utils.js";
 import { safeSpawnAsync } from "../../safe-spawn.js";
 import { resolveRunnerCwd } from "../../tool-cwd.js";
 import { PRIORITY } from "../priorities.js";
 import { createAvailabilityChecker } from "./utils/runner-helpers.js";
+import { finishParsedRun, parseToolRun } from "./utils/tool-failure.js";
 // Per-cwd cached `--version` probes (#120). Before this, each dispatch
 // invocation fired a fresh `safeSpawnAsync` per command — once per Elixir
 // file save.
@@ -34,15 +36,15 @@ function parseElixirOutput(raw, filePath, cwd = process.cwd()) {
     const lines = raw.split(/\r?\n/);
     // elixirc reports paths RELATIVE to its cwd (e.g. `bad.ex`, not the absolute
     // path we passed), so resolve the reported path against the runner cwd — not
-    // process.cwd(). Elixir 1.16+ also normalizes to a lowercase drive letter and
-    // forward slashes (`c:/...`), which never string-equals `C:\...` on Windows,
-    // so compare case-insensitively there.
-    const matchesTarget = (sourcePath) => {
-        const resolved = path.resolve(cwd, sourcePath.trim());
-        return process.platform === "win32"
-            ? resolved.toLowerCase() === resolvedTarget.toLowerCase()
-            : resolved === resolvedTarget;
-    };
+    // process.cwd(). Two resolved spellings of ONE file still differ in ways
+    // only the filesystem can settle — Elixir 1.16+ normalizes to a lowercase
+    // drive letter and forward slashes (`c:/...`), which never string-equals
+    // `C:\...` on Windows — so ask `pathsEqual`, the repo's on-disk identity
+    // seam, instead of hand-rolling a win32 case fold here. It folds case
+    // exactly where the filesystem does and nowhere else, which a
+    // `process.platform` test cannot express; `terragrunt.ts:90` asks the same
+    // question the same way (#1193).
+    const matchesTarget = (sourcePath) => pathsEqual(path.resolve(cwd, sourcePath.trim()), resolvedTarget);
     for (let index = 0; index < lines.length; index++) {
         const line = lines[index];
         // Defense-in-depth: cap line length before regex matching. The input is
@@ -130,12 +132,6 @@ function parseElixirOutput(raw, filePath, cwd = process.cwd()) {
     }
     return diagnostics;
 }
-function firstOutputLine(result) {
-    return `${result.stderr || ""}\n${result.stdout || ""}`
-        .trim()
-        .split(/\r?\n/, 1)[0]
-        .slice(0, 200);
-}
 const elixirCheckRunner = {
     id: "elixir-check",
     appliesTo: ["elixir"],
@@ -163,47 +159,36 @@ const elixirCheckRunner = {
             cwd,
             timeout: 30000,
         });
-        if (result.error && !result.stdout && !result.stderr) {
-            return { status: "skipped", diagnostics: [], semantic: "none" };
-        }
         const raw = `${result.stderr || ""}\n${result.stdout || ""}`;
         const hasProjectContext = command === "mix";
-        const diagnostics = parseElixirOutput(raw, ctx.filePath, cwd).map((d) => hasProjectContext
+        const parsed = parseToolRun("elixir-check", {
+            result,
+            output: raw,
+            // EXIT TABLE (Elixir 1.16 measured fixture): 0 clean; 1 findings; 2 error; other nonzero rejected.
+            exitCodes: { ran: [1, 2] },
+        }, (out) => parseElixirOutput(out, ctx.filePath, cwd).map((d) => hasProjectContext
             ? d
             : {
                 ...d,
                 // A direct elixirc invocation cannot resolve Mix dependencies.
                 // Standalone findings inform the agent, but cannot block it.
                 semantic: "warning",
-            });
-        if (diagnostics.length === 0) {
-            if (result.status && result.status !== 0) {
+            }));
+        if (parsed.skipped)
+            return parsed.skipped;
+        return finishParsedRun({
+            tool: "elixir-check",
+            ctx,
+            result,
+            diagnostics: parsed.diagnostics,
+            classify: (diagnostics) => {
+                const hasBlocking = diagnostics.some((d) => d.semantic === "blocking");
                 return {
-                    status: "failed",
-                    diagnostics: [
-                        {
-                            id: "elixir-check-nonzero-no-diagnostics",
-                            message: firstOutputLine(result) ||
-                                `${command} exited non-zero without structured diagnostics`,
-                            filePath: ctx.filePath,
-                            severity: "error",
-                            semantic: hasProjectContext ? "blocking" : "warning",
-                            tool: "elixir-check",
-                            rule: command,
-                            fixable: false,
-                        },
-                    ],
-                    semantic: hasProjectContext ? "blocking" : "warning",
+                    status: hasBlocking ? "failed" : "succeeded",
+                    semantic: hasBlocking ? "blocking" : "warning",
                 };
-            }
-            return { status: "succeeded", diagnostics: [], semantic: "none" };
-        }
-        const hasBlocking = diagnostics.some((d) => d.semantic === "blocking");
-        return {
-            status: hasBlocking ? "failed" : "succeeded",
-            diagnostics,
-            semantic: hasBlocking ? "blocking" : "warning",
-        };
+            },
+        });
     },
 };
 export default elixirCheckRunner;

package/dist/clients/dispatch/runners/eslint.js

@@ -6,11 +6,14 @@
  *
  * Gate: skips when no ESLint config is detected (project uses Biome/OxLint instead).
  */
+import * as path from "node:path";
+import { pathsEqual } from "../../path-utils.js";
 import { safeSpawnAsync } from "../../safe-spawn.js";
 import { resolveRunnerCwd } from "../../tool-cwd.js";
 import { getAutofixCapability, hasEslintConfig } from "../../tool-policy.js";
 import { PRIORITY } from "../priorities.js";
 import { createCwdCachedProbe, resolveToolCommand, } from "./utils/runner-helpers.js";
+import { finishParsedRun, parseToolRun } from "./utils/tool-failure.js";
 const ESLINT_PROBE_BUDGET_MS = 5000;
 // Per-cwd cached eslint `--version` verification (#120). Before this, every
 // dispatch invocation ran a fresh `safeSpawnAsync(cmd, ["--version"])` after
@@ -40,12 +43,18 @@ function getEslintProbe(cmd) {
     eslintAvailabilityByCmd.set(cmd, created);
     return created;
 }
-function parseEslintJson(raw, filePath) {
+function parseEslintJson(raw, filePath, cwd) {
     try {
         const results = JSON.parse(raw);
         const autofix = getAutofixCapability("eslint");
         const diagnostics = [];
+        const absTarget = path.resolve(cwd, filePath);
         for (const fileResult of results) {
+            // #3295: flat config `files`/`ignores` and a directory argv both put a
+            // SECOND result in this array; each names its own `filePath`.
+            if (fileResult.filePath &&
+                !pathsEqual(path.resolve(cwd, fileResult.filePath), absTarget))
+                continue;
             for (const msg of fileResult.messages) {
                 const severity = msg.severity === 2 ? "error" : "warning";
                 diagnostics.push({
@@ -92,11 +101,11 @@ const eslintRunner = {
             return { status: "skipped", diagnostics: [], semantic: "none" };
         }
         const result = await safeSpawnAsync(cmd, ["--format", "json", "--no-error-on-unmatched-pattern", ctx.filePath], { timeout: 30000, cwd });
-        // ESLint exits 2 on fatal/config errors — nothing was linted, so this
-        // is an unavailable run, not a clean or failed one.
-        if (result.status === 2) {
-            return { status: "skipped", diagnostics: [], semantic: "none" };
-        }
+        // Exit table: 0 is clean-or-findings, and 1/2 are ran outcomes whose
+        // JSON parser decides whether findings or a parse/config error reached the
+        // user. In particular, status 2 carries file-local fatal parse messages
+        // as JSON and must not be discarded before parsing.
+        //
         // ESLint exits 0 whenever nothing reached ERROR severity — that
         // includes a run that found only warnings (#1954), which also prints a
         // full JSON report. So parse stdout unconditionally and branch on the
@@ -109,46 +118,20 @@ const eslintRunner = {
         if (raw.length === 0 && result.status !== 0) {
             raw = result.stderr || "";
         }
-        const parsed = parseEslintJson(raw, ctx.filePath);
-        if (parsed.parseError && raw.trim().length > 0) {
-            const preview = raw.replace(/\s+/g, " ").slice(0, 160);
-            return {
-                status: "failed",
-                diagnostics: [
-                    {
-                        id: "eslint:parse-error:1",
-                        message: "ESLint JSON parse failed: " +
-                            parsed.parseError +
-                            (preview ? " (output preview: " + preview + ")" : ""),
-                        filePath: ctx.filePath,
-                        line: 1,
-                        column: 1,
-                        severity: "warning",
-                        semantic: "warning",
-                        tool: "eslint",
-                    },
-                ],
-                semantic: "warning",
-            };
-        }
-        const diagnostics = parsed.diagnostics;
-        if (diagnostics.length === 0) {
-            return { status: "succeeded", diagnostics: [], semantic: "none" };
-        }
-        const hasErrors = diagnostics.some((d) => d.semantic === "blocking");
-        // A warning-only result on exit 0 is ESLint's normal outcome, not a
-        // failure: exit 0 means nothing hit ERROR severity. Keying status off
-        // blocking severity plus exit code (the sibling convention from oxlint,
-        // biome-check, golangci-lint, rubocop) keeps plan.ts's fallback group
-        // ["eslint", "oxlint", "biome-check-json"] stopping at eslint instead
-        // of re-running oxlint and biome-check-json on every warning-only save.
-        // The findings reach delivery regardless of status — dispatcher.ts
-        // buckets by each diagnostic's own `semantic`.
-        return {
-            status: !hasErrors && result.status === 0 ? "succeeded" : "failed",
-            diagnostics,
-            semantic: hasErrors ? "blocking" : "warning",
-        };
+        const parsed = parseToolRun("eslint", {
+            result,
+            output: raw,
+            // EXIT TABLE (ESLint 9.10 docs https://eslint.org/docs/latest/use/command-line-interface): 0 clean; 1 findings; 2 fatal findings/error; other nonzero rejected.
+            exitCodes: { ran: [1, 2] },
+        }, (rawOutput) => parseEslintJson(rawOutput, ctx.filePath, cwd).diagnostics);
+        if (parsed.skipped)
+            return parsed.skipped;
+        return finishParsedRun({
+            tool: "eslint",
+            ctx,
+            result,
+            diagnostics: parsed.diagnostics,
+        });
     },
 };
 export default eslintRunner;

package/dist/clients/dispatch/runners/gleam-check.js

@@ -1,28 +1,108 @@
+import * as path from "node:path";
+import { pathsEqual } from "../../path-utils.js";
 import { safeSpawnAsync } from "../../safe-spawn.js";
+import { stripAnsi } from "../../sanitize.js";
 import { resolveRunnerCwd } from "../../tool-cwd.js";
 import { createAvailabilityChecker } from "./utils/runner-helpers.js";
 import { PRIORITY } from "../priorities.js";
 const gleam = createAvailabilityChecker("gleam", ".exe");
-function parseGleamOutput(raw, filePath) {
+/**
+ * gleam renders every located diagnostic through
+ * `codespan_reporting::term::emit` (v1.18.1
+ * `compiler-core/src/diagnostic.rs:92-133`, unchanged since v1.6.3), so its
+ * location line is codespan's LOCUS line, not a bare `path:line:col`:
+ *
+ * ```text
+ * error: Type mismatch
+ *   ┌─ /abs/proj/src/app.gleam:1:8
+ * ```
+ *
+ * `<outer gutter spaces> ┌─ <name>:<line>:<column>` —
+ * codespan-reporting 0.13.1 `src/term/renderer.rs:379-396` (the gutter, then
+ * `chars().snippet_start`, then one space, then the locus) and `:869-878`
+ * (`{name}:{line_number}:{column_number}`), with `snippet_start` = `┌─` in the
+ * default box-drawing set (`src/term/config.rs:419-429`, reached because gleam
+ * passes `Config::default()`, whose display style is Rich).
+ *
+ * `name` is `location.path` verbatim (`diagnostic.rs:92-94`,
+ * `files.add(main_location_path, …)`), and the CLI builds that path by walking
+ * UP from the absolute `std::env::current_dir()` to the nearest `gleam.toml`
+ * (`compiler-cli/src/fs.rs:32-62`) and joining `src`/`test`
+ * (`compiler-core/src/paths.rs:42-48`) before enumerating the directory — so it
+ * is ABSOLUTE, with host-native separators. Resolving it against the cwd the
+ * tool ran in is therefore a no-op today and the ADR 0009 shape for the
+ * hypothetical relative spelling.
+ *
+ * Capturing the path REQUIRES matching the gutter: the pre-#3285 regex
+ * `/^(.+?):(\d+):(\d+)$/` captured `  ┌─ /abs/proj/src/app.gleam`, gutter
+ * included, and only an `endsWith` compare tolerated that. An equality
+ * predicate (the seam every other runner now uses) drops every gleam diagnostic
+ * unless the gutter is out of the capture — which is why PR #3284 reverted its
+ * own fold here and filed #3285.
+ */
+const GLEAM_LOCUS = /^\s*┌─\s+(.+?):(\d+):(\d+)$/;
+const GLEAM_HEADER = /^\s*(error|warning):\s*(.+?)\s*$/;
+const GLEAM_LABEL = /^\s*│\s*\^+\s*(.*?)\s*$/;
+/**
+ * codespan writes ONE title line per diagnostic and then everything that
+ * belongs to it — locus, borders, snippet, labels, notes — before the next
+ * title (`codespan-reporting` 0.13.1 `src/term/renderer.rs:141-210`). Splitting
+ * on the title is therefore the diagnostic boundary, and it is what keeps an
+ * adjacent diagnostic's label out of its predecessor's message. Lines before
+ * the first title are gleam's own progress output (`Compiling demo`), which
+ * belongs to no diagnostic.
+ */
+function gleamBlocks(lines) {
+    const blocks = [];
+    for (const line of lines) {
+        const header = line.match(GLEAM_HEADER);
+        if (header)
+            blocks.push({ header, body: [] });
+        else
+            blocks.at(-1)?.body.push(line);
+    }
+    return blocks;
+}
+function gleamMessage(title, body) {
+    const labels = body.flatMap((line) => line.match(GLEAM_LABEL)?.[1]?.trim() || []);
+    return labels.length > 0 ? `${title} — ${labels.join(" ")}` : title;
+}
+function parseGleamOutput(raw, filePath, cwd) {
     const diagnostics = [];
-    const lines = raw.split(/\r?\n/);
-    for (let i = 0; i < lines.length; i++) {
-        const location = lines[i].match(/^(.+?):(\d+):(\d+)$/);
+    const absTarget = path.resolve(cwd, filePath);
+    // `stripAnsi` (the seam `ruff.ts`, `go-vet.ts` and `rust-clippy.ts` already
+    // use): gleam colours the gutter whenever `FORCE_COLOR` is set non-empty,
+    // whatever stderr is (`compiler-cli/src/cli.rs:194-207` — `ColorChoice::Never`
+    // only when it is neither forced nor a terminal), and the SGR bytes sit
+    // between the line start and `┌─`. The old suffix compare never saw the
+    // prefix; an anchored capture would drop every diagnostic in that
+    // environment.
+    const lines = stripAnsi(raw).split(/\r?\n/);
+    for (const { header, body } of gleamBlocks(lines)) {
+        const severity = header[1] === "warning" ? "warning" : "error";
+        const title = `${header[1]}: ${header[2]}`;
+        // A Gleam diagnostic with NO locus describes the whole project: `check`
+        // receives no file argument (`Diagnostic::write_title`, no codespan emit).
+        // Leave it for the nonzero-without-diagnostics fallback instead of
+        // charging it to whichever file happened to trigger dispatch — ADR 0009:
+        // without a reported path there is no evidence it is about this file.
+        const location = body
+            .find((line) => GLEAM_LOCUS.test(line))
+            ?.match(GLEAM_LOCUS);
         if (!location)
             continue;
         const [, sourcePath, lineStr, colStr] = location;
-        if (!sourcePath.replace(/\\/g, "/").endsWith(filePath.replace(/\\/g, "/"))) {
+        // #3278: one seam for reported-path attribution — see javac.ts.
+        if (!pathsEqual(path.resolve(cwd, sourcePath.trim()), absTarget))
             continue;
-        }
-        const message = lines.slice(i + 1).find((line) => line.trim().length > 0);
         diagnostics.push({
             id: `gleam-check-${lineStr}-${colStr}`,
-            message: message?.trim() || "gleam check reported an error",
+            message: gleamMessage(title, body),
             filePath,
             line: Number.parseInt(lineStr, 10) || 1,
             column: Number.parseInt(colStr, 10) || 1,
-            severity: "error",
-            semantic: "blocking",
+            severity,
+            semantic: severity === "error" ? "blocking" : "warning",
             tool: "gleam",
             rule: "gleam-check",
             fixable: false,
@@ -54,7 +134,7 @@ const gleamCheckRunner = {
         if (result.error && !result.stdout && !result.stderr) {
             return { status: "skipped", diagnostics: [], semantic: "none" };
         }
-        const diagnostics = parseGleamOutput(`${result.stderr || ""}\n${result.stdout || ""}`, ctx.filePath);
+        const diagnostics = parseGleamOutput(`${result.stderr || ""}\n${result.stdout || ""}`, ctx.filePath, cwd);
         if (diagnostics.length === 0) {
             if (result.status && result.status !== 0) {
                 return {

package/dist/clients/dispatch/runners/go-vet.js

@@ -5,6 +5,7 @@
  */
 import { relative, resolve, sep, posix } from "node:path";
 import { goClient } from "../../go-client.js";
+import { pathsEqual } from "../../path-utils.js";
 import { safeSpawnAsync } from "../../safe-spawn.js";
 import { resolveRunnerCwd } from "../../tool-cwd.js";
 import { stripAnsi } from "../../sanitize.js";
@@ -71,15 +72,28 @@ const goVetRunner = {
         // cwd before comparing, so go's path FORM (a leading `./` for the
         // module-root package, an absolute path, `.` segments) can't cause the
         // edited file's OWN diagnostics to be silently dropped.
+        //
+        // #3277: resolving is not enough — the two sides are SPELLED by
+        // different actors. `ctx.filePath` is `normalizeMapKey`-canonical
+        // (#2016) while go prints its own spelling: `cmd/go` rewrites the
+        // package-dir prefix to a cwd-relative one only when the rewrite
+        // matches byte-for-byte (`replacePrefix`), even though the check that
+        // authorized it (`filepath.Rel`) compares case-insensitively on
+        // Windows, so a differently-cased ABSOLUTE path reaches this filter.
+        // A bare `===` then drops every line for the edited file and the run
+        // is reported clean — the #209 defect. `pathsEqual` asks the
+        // filesystem instead of a platform list, so it is also right on a
+        // case-folding POSIX mount. It does NOT resolve symlinks on POSIX
+        // (`clients/path-utils.ts:181`); nothing here relies on that.
         const absTarget = resolve(ctx.filePath);
         const relevant = raw
             .split("\n")
             .filter((line) => {
             const m = line.match(/^(.+?):(\d+):(\d+):\s*(.+)/);
-            return m != null && resolve(cwd, m[1].trim()) === absTarget;
+            return m != null && pathsEqual(resolve(cwd, m[1].trim()), absTarget);
         })
             .join("\n");
-        const diagnostics = parseGoVetOutput(relevant, ctx.filePath);
+        const diagnostics = parseGoVetOutput(relevant, ctx.filePath, cwd);
         // Edited file clean → succeeded: a sibling-file error no longer flags
         // the edited file's turn (it surfaces when that file is itself edited).
         return diagnostics.length > 0

package/dist/clients/dispatch/runners/golangci-lint.js

@@ -11,10 +11,12 @@
  */
 import * as path from "node:path";
 import { safeSpawnAsync } from "../../safe-spawn.js";
+import { pathsEqual } from "../../path-utils.js";
 import { resolveRunnerCwd } from "../../tool-cwd.js";
 import { getLinterPolicyForCwd, hasGolangciConfig } from "../../tool-policy.js";
 import { PRIORITY } from "../priorities.js";
 import { createAvailabilityChecker, resolveAvailableOrInstall, } from "./utils/runner-helpers.js";
+import { finishParsedRun, parseToolRun } from "./utils/tool-failure.js";
 const golangci = createAvailabilityChecker("golangci-lint", ".exe");
 /**
  * Summarize a golangci-lint Replacement into a single-line fixSuggestion.
@@ -39,13 +41,21 @@ function describeReplacement(replacement) {
     }
     return "Apply golangci-lint suggested fix";
 }
-function parseGolangciJson(raw, filePath) {
+function parseGolangciJson(raw, filePath, cwd) {
     try {
         const output = JSON.parse(raw);
         if (!output.Issues)
             return [];
-        const absFile = path.resolve(filePath);
-        return output.Issues.filter((issue) => path.resolve(issue.Pos.Filename) === absFile).map((issue) => {
+        const absFile = path.resolve(cwd, filePath);
+        // #3278: one seam for reported-path attribution — see javac.ts. The base
+        // matters here more than anywhere else in the family: golangci-lint's
+        // `PathPrettifier` OVERWRITES `Pos.Filename` with `filepath.Rel(basePath,
+        // …)` before the JSON printer sees it (v1.64.8,
+        // `pkg/result/processors/path_prettifier.go:31` +
+        // `path_relativity.go:43`), so the spelling is relative to the child's
+        // base path — the `cwd` we spawned it in — and `path.resolve` with no
+        // base resolved it against the EXTENSION's cwd instead.
+        return output.Issues.filter((issue) => pathsEqual(path.resolve(cwd, issue.Pos.Filename), absFile)).map((issue) => {
             const severity = issue.Severity === "error" ? "error" : "warning";
             // golangci-lint's --out-format=json emits a Replacement object per
             // issue when `golangci-lint run --fix` would deterministically
@@ -95,26 +105,31 @@ const golangciRunner = {
             return { status: "skipped", diagnostics: [], semantic: "none" };
         // Run on the specific file. golangci-lint accepts file paths directly.
         const result = await safeSpawnAsync(cmd, ["run", "--out-format=json", ctx.filePath], { timeout: 60000, cwd });
-        if (result.status === 0) {
-            return { status: "succeeded", diagnostics: [], semantic: "none" };
-        }
-        const diagnostics = parseGolangciJson(result.stdout, ctx.filePath);
-        let semantic = "none";
-        if (diagnostics.some((d) => d.semantic === "blocking")) {
-            semantic = "blocking";
-        }
-        else if (diagnostics.length > 0) {
-            semantic = "warning";
-        }
-        if (semantic === "none") {
-            // Non-zero exit but no parseable issues — likely a config/tool error
-            return { status: "skipped", diagnostics: [], semantic };
-        }
-        return {
-            status: semantic === "blocking" ? "failed" : "succeeded",
-            diagnostics,
-            semantic,
-        };
+        // Exit table: 0 is clean-or-findings; 1 means issues, 3 failure,
+        // 4 timeout, and 5 missing config. Every nonzero code is a ran outcome
+        // whose parser decides: JSON issues remain findings, while emitted
+        // non-JSON text becomes a parse-error diagnostic and no output stays
+        // skipped. Keep stderr as the parse input when stdout is absent so tool
+        // errors cannot be mistaken for a clean file.
+        const raw = (result.stdout ?? "").length > 0
+            ? (result.stdout ?? "")
+            : result.status !== 0
+                ? result.stderr || ""
+                : "";
+        const parsed = parseToolRun("golangci-lint", {
+            result,
+            output: raw,
+            // EXIT TABLE (golangci-lint 1.60 docs https://golangci-lint.run/docs/welcome/quick-start/): 0 clean; 1 findings; 2 error; 3 error; 4 error; 5 error; other nonzero rejected.
+            exitCodes: { ran: [1, 2, 3, 4, 5] },
+        }, (raw) => parseGolangciJson(raw, ctx.filePath, cwd));
+        if (parsed.skipped)
+            return parsed.skipped;
+        return finishParsedRun({
+            tool: "golangci-lint",
+            ctx,
+            result,
+            diagnostics: parsed.diagnostics,
+        });
     },
 };
 export default golangciRunner;

package/dist/clients/dispatch/runners/hadolint.js

@@ -1,4 +1,5 @@
 import * as path from "node:path";
+import { pathsEqual } from "../../path-utils.js";
 import { safeSpawnAsync } from "../../safe-spawn.js";
 import { resolveRunnerCwd } from "../../tool-cwd.js";
 import { getLinterPolicyForCwd } from "../../tool-policy.js";
@@ -7,25 +8,32 @@ import { createAvailabilityChecker, resolveToolCommandWithInstallFallback, } fro
 import { parseToolRun } from "./utils/tool-failure.js";
 import { finishParsedRun } from "./utils/tool-failure.js";
 const hadolint = createAvailabilityChecker("hadolint", ".exe");
-function parseHadolintOutput(raw, filePath) {
+function parseHadolintOutput(raw, filePath, cwd) {
     try {
         const parsed = JSON.parse(raw);
         if (!Array.isArray(parsed))
             return [];
-        return parsed.map((item) => {
+        const absTarget = path.resolve(cwd, filePath);
+        return parsed.flatMap((item) => {
+            // #3295: hadolint takes a LIST of Dockerfiles and names each finding's
+            // own `file`.
+            if (item.file && !pathsEqual(path.resolve(cwd, item.file), absTarget))
+                return [];
             const severity = item.level === "error" ? "error" : "warning";
-            return {
-                id: `hadolint-${item.code}-${item.line}`,
-                message: `[${item.code}] ${item.message}`,
-                filePath,
-                line: item.line,
-                column: item.column ?? 1,
-                severity,
-                semantic: severity === "error" ? "blocking" : "warning",
-                tool: "hadolint",
-                rule: item.code,
-                fixable: false,
-            };
+            return [
+                {
+                    id: `hadolint-${item.code}-${item.line}`,
+                    message: `[${item.code}] ${item.message}`,
+                    filePath,
+                    line: item.line,
+                    column: item.column ?? 1,
+                    severity,
+                    semantic: severity === "error" ? "blocking" : "warning",
+                    tool: "hadolint",
+                    rule: item.code,
+                    fixable: false,
+                },
+            ];
         });
     }
     catch {
@@ -57,7 +65,11 @@ const hadolintRunner = {
         // #1948: hadolint runs with `--no-fail`, so it exits 0 even when it finds
         // something. A nonzero exit therefore means hadolint itself failed, and
         // zero parsed diagnostics out of whatever it printed is a parser break.
-        const run = parseToolRun("hadolint", { result }, (out) => parseHadolintOutput(out, ctx.filePath));
+        const run = parseToolRun("hadolint", {
+            result,
+            // EXIT TABLE (Hadolint 2.12 measured fixture): 0 clean; 1 findings; 2 error; other nonzero rejected.
+            exitCodes: { ran: [1, 2] },
+        }, (out) => parseHadolintOutput(out, ctx.filePath, cwd));
         if (run.skipped)
             return run.skipped;
         const diagnostics = run.diagnostics;

package/dist/clients/dispatch/runners/htmlhint.js

@@ -1,4 +1,5 @@
 import * as path from "node:path";
+import { pathsEqual } from "../../path-utils.js";
 import { safeSpawnAsync } from "../../safe-spawn.js";
 import { resolveRunnerCwd } from "../../tool-cwd.js";
 import { getLinterPolicyForCwd } from "../../tool-policy.js";
@@ -15,19 +16,22 @@ const HTMLHINT_RULES = {
     "spec-char-escape": true,
     "id-unique": true,
 };
-function parseHtmlhintOutput(raw, filePath) {
+function parseHtmlhintOutput(raw, filePath, cwd) {
     const diagnostics = [];
+    const absTarget = path.resolve(cwd, filePath);
     // unix format: "file:line:col: message [severity/rule]"
-    const lineRe = /^.+?:(\d+):(\d+): (.+?) \[(error|warning)\/([^\]]+)\]/;
+    const lineRe = /^(.+?):(\d+):(\d+): (.+?) \[(error|warning)\/([^\]]+)\]/;
     for (const line of raw.split("\n")) {
         const match = line.match(lineRe);
         if (!match)
             continue;
-        const lineNum = parseInt(match[1], 10);
-        const col = parseInt(match[2], 10);
-        const message = match[3].trim();
-        const level = match[4];
-        const rule = match[5].trim();
+        if (!pathsEqual(path.resolve(cwd, match[1]), absTarget))
+            continue;
+        const lineNum = parseInt(match[2], 10);
+        const col = parseInt(match[3], 10);
+        const message = match[4].trim();
+        const level = match[5];
+        const rule = match[6].trim();
         const severity = level === "error" ? "error" : "warning";
         diagnostics.push({
             id: `htmlhint-${rule}-${lineNum}`,
@@ -86,7 +90,12 @@ const htmlhintRunner = {
         // #1948: htmlhint exits 1 when it finds errors and prints them in `unix`
         // format on stdout. Zero parsed out of a nonzero exit is a parser break.
         const output = result.stdout || result.stderr || "";
-        const run = parseToolRun("htmlhint", { result, output }, (out) => parseHtmlhintOutput(out, ctx.filePath));
+        const run = parseToolRun("htmlhint", {
+            result,
+            output,
+            // EXIT TABLE (HTMLHint 1.1 measured fixture): 0 clean; 1 findings; 2 error; other nonzero rejected.
+            exitCodes: { ran: [1, 2] },
+        }, (out) => parseHtmlhintOutput(out, ctx.filePath, cwd));
         if (run.skipped)
             return run.skipped;
         const diagnostics = run.diagnostics;