pi-lens 4.2.0 → 4.3.0

package/dist/clients/dispatch/runners/javac.js

@@ -1,21 +1,29 @@
 import * as path from "node:path";
+import { pathsEqual } from "../../path-utils.js";
 import { safeSpawnAsync } from "../../safe-spawn.js";
 import { resolveRunnerCwd } from "../../tool-cwd.js";
 import { hasJavaBuildDescriptor } from "../../tool-policy.js";
 import { PRIORITY } from "../priorities.js";
 import { createAvailabilityChecker } from "./utils/runner-helpers.js";
+import { finishParsedRun, parseToolRun } from "./utils/tool-failure.js";
 const javac = createAvailabilityChecker("javac", ".exe");
-function parseJavacOutput(raw, filePath) {
+function parseJavacOutput(raw, filePath, cwd) {
     const diagnostics = [];
     const lines = raw.split(/\r?\n/);
+    const absTarget = path.resolve(cwd, filePath);
     for (const line of lines) {
         const match = line.match(/^(.*?\.java):(\d+):\s+(error|warning):\s+(.+)$/i);
         if (!match)
             continue;
         const [, reportedFile, lineStr, severityLabel, message] = match;
-        const resolvedReported = path.resolve(reportedFile.trim());
-        const resolvedTarget = path.resolve(filePath);
-        if (resolvedReported !== resolvedTarget)
+        // Is this reported diagnostic about the file we dispatched for? ONE seam
+        // answers that for every runner (#3278): resolve the tool's spelling against
+        // the cwd the tool RAN in — never `process.cwd()`, which is the extension's,
+        // not the runner's — and compare through `pathsEqual`, the repo's on-disk
+        // identity predicate. A bare `===` treats a spelling that differs only in
+        // case (the same file on Windows and on a case-folding POSIX mount) as a
+        // different file and drops every finding for the edited file (#209, #3277).
+        if (!pathsEqual(path.resolve(cwd, reportedFile.trim()), absTarget))
             continue;
         const severity = severityLabel.toLowerCase() === "error" ? "error" : "warning";
         const lineNum = Number.parseInt(lineStr, 10) || 1;
@@ -66,24 +74,26 @@ const javacRunner = {
             timeout: 30000,
         });
         const raw = `${result.stdout ?? ""}\n${result.stderr ?? ""}`.trim();
-        if (result.status === 0 && !raw) {
-            return { status: "succeeded", diagnostics: [], semantic: "none" };
-        }
-        const diagnostics = parseJavacOutput(raw, ctx.filePath);
-        if (diagnostics.length === 0) {
-            return {
-                status: result.status === 0 ? "succeeded" : "failed",
-                diagnostics: [],
+        const parsed = parseToolRun("javac", {
+            result,
+            output: raw,
+            // EXIT TABLE (javac 21 docs https://docs.oracle.com/en/java/javase/21/docs/specs/man/javac.html): 0 clean; 1 findings; 2 error; other nonzero rejected.
+            exitCodes: { ran: [1, 2] },
+        }, (output) => parseJavacOutput(output, ctx.filePath, cwd));
+        if (parsed.skipped)
+            return parsed.skipped;
+        return finishParsedRun({
+            tool: "javac",
+            ctx,
+            result,
+            diagnostics: parsed.diagnostics,
+            classify: (diagnostics) => ({
+                status: diagnostics.some((d) => d.severity === "error")
+                    ? "failed"
+                    : "succeeded",
                 semantic: "warning",
-                rawOutput: raw,
-            };
-        }
-        const hasErrors = diagnostics.some((d) => d.severity === "error");
-        return {
-            status: hasErrors ? "failed" : "succeeded",
-            diagnostics,
-            semantic: "warning",
-        };
+            }),
+        });
     },
 };
 export default javacRunner;

package/dist/clients/dispatch/runners/ktlint.js

@@ -1,10 +1,21 @@
 import * as path from "node:path";
+import { pathsEqual } from "../../path-utils.js";
 import { safeSpawnAsync } from "../../safe-spawn.js";
 import { resolveRunnerCwd } from "../../tool-cwd.js";
 import { getAutofixCapability, getLinterPolicyForCwd, } from "../../tool-policy.js";
 import { PRIORITY } from "../priorities.js";
 import { createAvailabilityChecker, resolveToolCommandWithInstallFallback, } from "./utils/runner-helpers.js";
+import { finishParsedRun, parseToolRun } from "./utils/tool-failure.js";
 const ktlint = createAvailabilityChecker("ktlint", ".exe");
+// KtLint's exit contract, declared HERE rather than in the shared classifier:
+// an admission is a property of this tool, and #3291 round 2 shipped it through
+// a shared `parseToolRun` option that silently erased every OTHER runner's
+// table. KtLint 1.8.0's CLI page documents the JSON reporter and a nonzero exit
+// on violations, but does not enumerate numeric classes; 1, 2 and 3 are the
+// statuses this runner observes carrying a valid reporter payload, and a valid
+// payload is the evidence that analysis was reached. Any other nonzero status
+// stays a rejected invocation.
+const KTLINT_EXIT_CODES = { ran: [1, 2, 3] };
 function normalizeKtlintResults(parsed) {
     if (Array.isArray(parsed)) {
         return parsed;
@@ -16,14 +27,19 @@ function normalizeKtlintResults(parsed) {
     }
     return null;
 }
-function parseKtlintOutput(raw, filePath) {
+function parseKtlintOutput(raw, filePath, cwd) {
     try {
         const parsed = normalizeKtlintResults(JSON.parse(raw));
         if (!parsed)
             return null;
         const autofix = getAutofixCapability("ktlint");
         const diagnostics = [];
+        const absTarget = path.resolve(cwd, filePath);
         for (const result of parsed) {
+            // #3295: ktlint's JSON reporter is an array of FILES; `.editorconfig`
+            // globs put more than the argv in it.
+            if (result.file && !pathsEqual(path.resolve(cwd, result.file), absTarget))
+                continue;
             for (const err of result.errors ?? []) {
                 diagnostics.push({
                     id: `ktlint-${err.ruleId}-${err.line}-${err.col}`,
@@ -47,12 +63,6 @@ function parseKtlintOutput(raw, filePath) {
         return null;
     }
 }
-function firstOutputLine(result) {
-    return (result.stderr || result.stdout || "")
-        .trim()
-        .split(/\r?\n/, 1)[0]
-        .slice(0, 200);
-}
 const ktlintRunner = {
     id: "ktlint",
     appliesTo: ["kotlin"],
@@ -78,59 +88,23 @@ const ktlintRunner = {
             cwd,
             timeout: 30000,
         });
-        // Ktlint exits non-zero when issues are found, so only treat a total lack
-        // of output as a hard skip. Any non-empty but unparseable output should
-        // surface as runner failure instead of a false clean result.
-        if (result.error && !result.stdout) {
-            return { status: "skipped", diagnostics: [], semantic: "none" };
-        }
-        const diagnostics = parseKtlintOutput(result.stdout || "", ctx.filePath);
-        if (diagnostics === null) {
-            const detail = firstOutputLine(result) || "Unknown ktlint output";
-            return {
-                status: "failed",
-                diagnostics: [
-                    {
-                        id: "ktlint-output-unparseable",
-                        message: `Unable to parse ktlint output: ${detail}`,
-                        filePath: ctx.filePath,
-                        severity: "warning",
-                        semantic: "warning",
-                        tool: "ktlint",
-                        fixable: false,
-                        autoFixAvailable: false,
-                    },
-                ],
-                semantic: "warning",
-            };
-        }
-        if (diagnostics.length === 0) {
-            if (result.status && result.status !== 0) {
-                return {
-                    status: "failed",
-                    diagnostics: [
-                        {
-                            id: "ktlint-nonzero-no-diagnostics",
-                            message: firstOutputLine(result) ||
-                                "ktlint exited non-zero without JSON diagnostics",
-                            filePath: ctx.filePath,
-                            severity: "warning",
-                            semantic: "warning",
-                            tool: "ktlint",
-                            fixable: false,
-                            autoFixAvailable: false,
-                        },
-                    ],
-                    semantic: "warning",
-                };
-            }
-            return { status: "succeeded", diagnostics: [], semantic: "none" };
-        }
-        return {
-            status: result.status && result.status !== 0 ? "failed" : "succeeded",
-            diagnostics,
-            semantic: "warning",
-        };
+        // `output` is what the classifier judges AND what the parser reads: ktlint
+        // writes its reporter payload to stdout and its errors to stderr, so both
+        // are one wire here. The exit table rides in this same per-runner input,
+        // never in a shared option (#3291 r3).
+        const run = parseToolRun("ktlint", {
+            result,
+            output: `${result.stdout ?? ""}\n${result.stderr ?? ""}`,
+            exitCodes: KTLINT_EXIT_CODES,
+        }, (output) => parseKtlintOutput(output, ctx.filePath, cwd) ?? []);
+        if (run.skipped)
+            return run.skipped;
+        return finishParsedRun({
+            tool: "ktlint",
+            ctx,
+            result,
+            diagnostics: run.diagnostics,
+        });
     },
 };
 export default ktlintRunner;

package/dist/clients/dispatch/runners/lsp.js

@@ -13,6 +13,7 @@
  */
 import { logExtension } from "../../extension-log.js";
 import { getLspCapableKinds } from "../../language-policy.js";
+import { exceedsLspSyncLimits } from "../../lsp/content-limits.js";
 import { touchCoverageGap } from "../../lsp/diagnostic-binding.js";
 import { getLSPService } from "../../lsp/index.js";
 import { LSP_SERVERS } from "../../lsp/server.js";
@@ -25,8 +26,6 @@ import { enabledAuxiliaryLspServerIds, retagAuxiliaryDiagnostics, } from "../aux
 import { readFileContent } from "./utils.js";
 import { tryWarmAttachedCodeActions, tryWarmAttachedDiagnostics, } from "../../warm-attach.js";
 import { contentHash, WARM_CODE_ACTION_LOOKUP_LIMIT } from "../../mcp/ipc.js";
-const LSP_MAX_FILE_BYTES = RUNTIME_CONFIG.pipeline.lspMaxFileBytes;
-const LSP_MAX_FILE_LINES = RUNTIME_CONFIG.pipeline.lspMaxFileLines;
 const LSP_SPAWN_BUDGET_MS = RUNTIME_CONFIG.pipeline.lspSpawnBudgetMs;
 // Diagnostics-wait cap for the dispatch lsp-runner. Bounded so a slow LSP
 // (typescript-language-server on large monorepos has been observed >7 s)
@@ -133,9 +132,11 @@ const lspRunner = {
         if (!content) {
             return { status: "skipped", diagnostics: [], semantic: "none" };
         }
-        const sizeBytes = Buffer.byteLength(content, "utf-8");
-        const lineCount = content.split("\n").length;
-        if (sizeBytes > LSP_MAX_FILE_BYTES || lineCount > LSP_MAX_FILE_LINES) {
+        // #3405 r2: was an inline second copy of the pipeline's byte/line
+        // predicate. One module owns the bound now (M3406-1's root cause was that
+        // a third writer could be added with neither copy); the SKIP is still this
+        // runner's own policy.
+        if (exceedsLspSyncLimits(content).tooLarge) {
             return { status: "skipped", diagnostics: [], semantic: "none" };
         }
         // Cross-cutting auxiliary scanners (opengrep, …) attach alongside the

package/dist/clients/dispatch/runners/markdownlint.js

@@ -1,3 +1,5 @@
+import * as path from "node:path";
+import { pathsEqual } from "../../path-utils.js";
 import { safeSpawnAsync } from "../../safe-spawn.js";
 import { logRunnerAdvisoryOnce, resolveRunnerCwd } from "../../tool-cwd.js";
 import { getLinterPolicyForCwd, markdownlintConfigArgs, } from "../../tool-policy.js";
@@ -10,7 +12,7 @@ const markdownlint = createAvailabilityChecker("markdownlint-cli2", ".cmd", [
     "--no-globs",
     "-",
 ]);
-// markdownlint-cli2 exit codes (its README's "Exit Codes" section): 0 = no
+// EXIT TABLE (markdownlint-cli2 0.17 README https://github.com/DavidAnson/markdownlint-cli2#exit-codes): 0 = no
 // findings, 1 = lint findings, 2 = unexpected error (unreadable config, bad
 // glob, crash). Only 2 is a rejected invocation.
 const MARKDOWNLINT_EXIT_CODES = { ran: [1] };
@@ -59,18 +61,23 @@ const MARKDOWNLINT_FIXABLE_RULES = new Set([
 //   2. some rules carry MULTIPLE slash-separated names (e.g.
 //      `MD041/first-line-heading/first-line-h1`).
 // The severity token is optional so older/relative-path output still parses.
-function parseMarkdownlintOutput(raw, filePath) {
+function parseMarkdownlintOutput(raw, filePath, cwd) {
     const diagnostics = [];
+    const absTarget = path.resolve(cwd, filePath);
     for (const line of raw.split(/\r?\n/)) {
         if (!line.trim())
             continue;
         // Rule code is MD### followed by one or more slash-joined names. Use a
         // single char class (`[\w/-]+`) rather than a nested quantifier
         // (`(?:/[\w-]+)+`) so there's no super-linear backtracking (S5852).
-        const match = line.match(/^.*?:(\d+)(?::(\d+))?\s+(?:error|warning)?\s*(MD\d+\/[\w/-]+)\s+(.+)$/);
+        const match = line.match(/^(.*?):(\d+)(?::(\d+))?\s+(?:error|warning)?\s*(MD\d+\/[\w/-]+)\s+(.+)$/);
         if (!match)
             continue;
-        const [, lineNum, col, ruleCode, message] = match;
+        const [, reported, lineNum, col, ruleCode, message] = match;
+        // #3295: the leading `.*?` this parser discarded IS markdownlint-cli2's
+        // reported path, and its config globs can widen the run past the argv.
+        if (reported && !pathsEqual(path.resolve(cwd, reported), absTarget))
+            continue;
         const ruleName = ruleCode.split("/")[0];
         const fixable = MARKDOWNLINT_FIXABLE_RULES.has(ruleName);
         diagnostics.push({
@@ -144,7 +151,7 @@ const markdownlintRunner = {
         const raw = `${result.stdout ?? ""}${result.stderr ?? ""}`;
         // #1948: one seam for both gates — the tool produced nothing, and the
         // tool produced something the parser could not read.
-        const run = parseToolRun("markdownlint", { result, output: raw, exitCodes: MARKDOWNLINT_EXIT_CODES }, (out) => parseMarkdownlintOutput(out, ctx.filePath));
+        const run = parseToolRun("markdownlint", { result, output: raw, exitCodes: MARKDOWNLINT_EXIT_CODES }, (out) => parseMarkdownlintOutput(out, ctx.filePath, cwd));
         if (run.skipped)
             return run.skipped;
         const diagnostics = run.diagnostics;

package/dist/clients/dispatch/runners/mypy.js

@@ -14,7 +14,8 @@ const mypy = createAvailabilityChecker("mypy", "");
 // [syntax]`). A bad flag or unreadable config also exits 2, but writes its
 // message to STDERR and leaves stdout empty.
 //
-// So the exit code cannot separate the two, and the STREAM does: the gate below
+// EXIT TABLE (mypy 1.11 docs https://mypy.readthedocs.io/en/stable/command_line.html): 0 clean; 1 findings; 2 findings/error; other
+// nonzero rejected. The exit code cannot separate the two, and the STREAM does:
 // judges "nothing to parse" on stdout alone, while the parser still reads both.
 // The table's remaining job is to reject any OTHER nonzero status.
 const MYPY_EXIT_CODES = { ran: [1, 2] };

package/dist/clients/dispatch/runners/oxlint.js

@@ -6,7 +6,9 @@
  *
  * Requires: oxlint (npm install -g oxlint)
  */
+import * as path from "node:path";
 import { findLocalBinUpwards } from "../../package-manager.js";
+import { pathsEqual } from "../../path-utils.js";
 import { safeSpawnAsync } from "../../safe-spawn.js";
 import { resolveRunnerCwd } from "../../tool-cwd.js";
 import { truncatedByOutputCap } from "../../spawn-output-cap.js";
@@ -111,7 +113,12 @@ const oxlintRunner = {
         // force a status-0 lookalike away from clean. Neither escapes this runner.
         // parseToolRun checks process failures before invoking this parser, so
         // spawn/timeout/killed/signal precedence remains owned by #1994.
-        const parsedRun = parseToolRun("oxlint", { result, output: parsedOutput }, () => {
+        const parsedRun = parseToolRun("oxlint", {
+            result,
+            output: parsedOutput,
+            // EXIT TABLE (oxlint 0.8 measured fixture): 0 clean; 1 findings; 2 error; other nonzero rejected.
+            exitCodes: { ran: [1, 2] },
+        }, () => {
             if (noFilesDecision.kind === "expected-no-files") {
                 return [OXLINT_NO_FILES];
             }
@@ -119,9 +126,9 @@ const oxlintRunner = {
                 result.status === 0) {
                 return [OXLINT_NO_FILES_UNCONFIRMED];
             }
-            let parsed = parseOxlintJson(stdout, ctx.filePath);
+            let parsed = parseOxlintJson(stdout, ctx.filePath, cwd);
             if (parsed.length === 0 && stdout.length > 0) {
-                parsed = parseOxlintUnix(parsedOutput, ctx.filePath);
+                parsed = parseOxlintUnix(parsedOutput, ctx.filePath, cwd);
             }
             return parsed;
         }, { parseOutput: parsedOutput });
@@ -334,7 +341,7 @@ function extractOxlintRule(code) {
         return code;
     return code.slice(open + 1, close);
 }
-function parseOxlintJson(raw, filePath) {
+function parseOxlintJson(raw, filePath, cwd) {
     const trimmed = raw.trim();
     if (!trimmed.startsWith("{"))
         return [];
@@ -348,7 +355,11 @@ function parseOxlintJson(raw, filePath) {
     if (!Array.isArray(parsed.diagnostics))
         return [];
     const diagnostics = [];
+    const absTarget = path.resolve(cwd, filePath);
     for (const d of parsed.diagnostics) {
+        if (!d.filename || !pathsEqual(path.resolve(cwd, d.filename), absTarget)) {
+            continue;
+        }
         const rule = extractOxlintRule(d.code);
         const label = d.labels?.[0]?.span;
         const lineNum = label?.line ?? 1;
@@ -374,13 +385,18 @@ function parseOxlintJson(raw, filePath) {
     }
     return diagnostics;
 }
-function parseOxlintUnix(raw, filePath) {
+function parseOxlintUnix(raw, filePath, cwd) {
     const diagnostics = [];
+    const absTarget = path.resolve(cwd, filePath);
     for (const line of raw.split("\n")) {
         // Parse: file:line:column: message (rule)
         const match = line.match(/^(.+):(\d+):(\d+):\s*(.+?)\s*\(([^)]+)\)$/);
         if (match) {
-            const [, _file, lineStr, _col, message, rule] = match;
+            const [, reportedPath, lineStr, _col, message, rule] = match;
+            if (!reportedPath || !lineStr || !message || !rule)
+                continue;
+            if (!pathsEqual(path.resolve(cwd, reportedPath), absTarget))
+                continue;
             diagnostics.push({
                 id: `oxlint-${rule}-${lineStr}`,
                 message: `${message} (${rule})`,

package/dist/clients/dispatch/runners/php-lint.js

@@ -1,16 +1,33 @@
 import * as path from "node:path";
+import { pathsEqual } from "../../path-utils.js";
 import { safeSpawnAsync } from "../../safe-spawn.js";
 import { resolveRunnerCwd } from "../../tool-cwd.js";
 import { PRIORITY } from "../priorities.js";
 import { createAvailabilityChecker } from "./utils/runner-helpers.js";
+import { finishParsedRun, parseToolRun } from "./utils/tool-failure.js";
+// PHP's `-l` exit contract, declared HERE rather than in the shared classifier
+// (#3291 r3): an admission is a property of this tool. The manual documents
+// `-l` as syntax-check-only with a nonzero return on failure; the captured
+// PHP 8.3.32 wire exits 1 in the usual CLI path and 255 (the shell reading of
+// PHP's documented -1) for the parse-error wire. Both are completed analyses
+// whose output must reach the parser; any other nonzero status stays a
+// rejected invocation.
+const PHP_LINT_EXIT_CODES = { ran: [1, 255] };
 const php = createAvailabilityChecker("php", ".exe");
-function parsePhpLintOutput(raw, filePath) {
+function parsePhpLintOutput(raw, filePath, cwd) {
     const output = raw.trim();
-    if (!output)
+    if (!output || !/(?:PHP )?Parse error:/i.test(output))
         return [];
     const lineMatch = output.match(/on line (\d+)/i);
-    const messageMatch = output.match(/PHP Parse error:\s*(.+?)(?:\s+in\s+.+?\s+on line \d+)?$/im) ??
-        output.match(/Parse error:\s*(.+?)(?:\s+in\s+.+?\s+on line \d+)?$/im);
+    const messageMatch = output.match(/PHP Parse error:\s*(.+?)(?:\s+in\s+(.+?)\s+on line \d+)?$/im) ??
+        output.match(/Parse error:\s*(.+?)(?:\s+in\s+(.+?)\s+on line \d+)?$/im);
+    // #3295: PHP names the file it could not parse in the same sentence. `php -l`
+    // follows no includes today, so this drops nothing under our argv — it pins
+    // the attribution the parser was asserting without asking.
+    const reported = messageMatch?.[2]?.trim();
+    if (reported &&
+        !pathsEqual(path.resolve(cwd, reported), path.resolve(cwd, filePath)))
+        return [];
     return [
         {
             id: `php-lint:${lineMatch?.[1] ?? "1"}`,
@@ -45,18 +62,24 @@ const phpLintRunner = {
             timeout: 15000,
             cwd,
         });
-        if (result.status === 0) {
-            return { status: "succeeded", diagnostics: [], semantic: "none" };
-        }
-        const diagnostics = parsePhpLintOutput(`${result.stdout ?? ""}\n${result.stderr ?? ""}`, ctx.filePath);
-        if (diagnostics.length === 0) {
-            return { status: "skipped", diagnostics: [], semantic: "none" };
-        }
-        return {
-            status: "failed",
-            diagnostics,
-            semantic: "blocking",
-        };
+        // `output` is what the classifier judges AND what the parser reads: the
+        // parse error arrives on stderr, so both streams are one wire here. The
+        // exit table rides in this same per-runner input, never in a shared
+        // option (#3291 r3).
+        const run = parseToolRun("php-lint", {
+            result,
+            output: `${result.stdout ?? ""}\n${result.stderr ?? ""}`,
+            exitCodes: PHP_LINT_EXIT_CODES,
+        }, (output) => parsePhpLintOutput(output, ctx.filePath, cwd));
+        if (run.skipped)
+            return run.skipped;
+        return finishParsedRun({
+            tool: "php-lint",
+            ctx,
+            result,
+            diagnostics: run.diagnostics,
+            classify: () => ({ status: "failed", semantic: "blocking" }),
+        });
     },
 };
 export default phpLintRunner;

package/dist/clients/dispatch/runners/phpstan.js

@@ -6,7 +6,7 @@ import { PRIORITY } from "../priorities.js";
 import { createAvailabilityChecker, resolveVendorToolCommand, } from "./utils/runner-helpers.js";
 import { parseToolRun } from "./utils/tool-failure.js";
 import { finishParsedRun } from "./utils/tool-failure.js";
-// phpstan's documented exit codes: 0 = no errors, 1 = errors found, 2 = a
+// EXIT TABLE (PHPStan 1.12 docs https://phpstan.org/user-guide/command-line-usage): 0 = no errors, 1 = errors found, 2 = a
 // fatal/internal error that stopped the analysis. Only 1 is a run that carries
 // findings.
 const PHPSTAN_EXIT_CODES = { ran: [1] };

package/dist/clients/dispatch/runners/rubocop.js

@@ -7,11 +7,14 @@
  *
  * Supports bundle exec (preferred in Bundler projects).
  */
+import * as path from "node:path";
+import { pathsEqual } from "../../path-utils.js";
 import { safeSpawnAsync } from "../../safe-spawn.js";
 import { resolveRunnerCwd } from "../../tool-cwd.js";
 import { getAutofixCapability, getLinterPolicyForCwd, getRubocopCommand, } from "../../tool-policy.js";
 import { PRIORITY } from "../priorities.js";
 import { resolveCommandArgsWithInstallFallback } from "./utils/runner-helpers.js";
+import { finishParsedRun, parseToolRun } from "./utils/tool-failure.js";
 const SEVERITY_MAP = {
     fatal: "error",
     error: "error",
@@ -19,12 +22,17 @@ const SEVERITY_MAP = {
     convention: "warning",
     refactor: "info",
 };
-function parseRubocopJson(raw, filePath) {
+function parseRubocopJson(raw, filePath, cwd) {
     try {
         const output = JSON.parse(raw);
         const autofix = getAutofixCapability("rubocop");
         const diagnostics = [];
+        const absTarget = path.resolve(cwd, filePath);
         for (const file of output.files) {
+            // #3295: `.rubocop.yml` `Include:`/`inherit_from` can widen the run past
+            // the argv, and each result carries its own `path`.
+            if (file.path && !pathsEqual(path.resolve(cwd, file.path), absTarget))
+                continue;
             for (const offense of file.offenses) {
                 const severity = SEVERITY_MAP[offense.severity] ?? "warning";
                 diagnostics.push({
@@ -68,23 +76,24 @@ const rubocopRunner = {
         const { cmd, args } = resolved;
         // Lint only — no auto-correct (formatter handles that)
         const result = await safeSpawnAsync(cmd, [...args, "--format", "json", "--no-color", ctx.filePath], { timeout: 30000, cwd });
-        // rubocop exits 0 = no offenses, 1 = offenses found, 2 = fatal error
-        if (result.status === 2) {
-            return { status: "skipped", diagnostics: [], semantic: "none" };
-        }
-        if (result.status === 0) {
-            return { status: "succeeded", diagnostics: [], semantic: "none" };
-        }
-        const diagnostics = parseRubocopJson(result.stdout, ctx.filePath);
-        if (diagnostics.length === 0) {
-            return { status: "succeeded", diagnostics: [], semantic: "none" };
-        }
-        const hasErrors = diagnostics.some((d) => d.semantic === "blocking");
-        return {
-            status: hasErrors ? "failed" : "succeeded",
-            diagnostics,
-            semantic: hasErrors ? "blocking" : "warning",
-        };
+        // EXIT TABLE (RuboCop 1.66 docs https://docs.rubocop.org/rubocop/usage/basic_usage.html): 0 = clean, 1 = offenses/findings, 2 = fatal/error or rejected
+        // invocation. A nonzero exit with valid JSON remains findings; a nonzero
+        // exit with empty or unparsable JSON is never clean (#1816).
+        const run = parseToolRun("rubocop", {
+            result,
+            // Classify both streams so stderr-only failures reach the parse-error
+            // path, while parseOutput keeps RuboCop's native JSON parser on stdout.
+            output: `${result.stdout}${result.stderr}`,
+            exitCodes: { ran: [1, 2] },
+        }, (output) => parseRubocopJson(output, ctx.filePath, cwd), { parseOutput: result.stdout });
+        if (run.skipped)
+            return run.skipped;
+        return finishParsedRun({
+            tool: "rubocop",
+            ctx,
+            result,
+            diagnostics: run.diagnostics,
+        });
     },
 };
 export default rubocopRunner;

package/dist/clients/dispatch/runners/ruff.js

@@ -10,6 +10,7 @@ import { safeSpawnAsync } from "../../safe-spawn.js";
 import { stripAnsi } from "../../sanitize.js";
 import { getAutofixCapability, getLinterPolicyForCwd, ruffConfigArgs, } from "../../tool-policy.js";
 import { PRIORITY } from "../priorities.js";
+import { finishParsedRun, parseToolRun } from "./utils/tool-failure.js";
 import { parseRuffOutput } from "./utils/diagnostic-parsers.js";
 import { createAvailabilityChecker, resolveAvailableOrInstall, resolveRunnerCwd, } from "./utils/runner-helpers.js";
 const ruff = createAvailabilityChecker("ruff", ".exe");
@@ -65,25 +66,23 @@ const ruffRunner = {
         // Step 1: Capture diagnostics (before fixing) — teaching signal for the agent
         const checkResult = await safeSpawnAsync(cmd, ["check", "--output-format", "json", ...configArgs, ctx.filePath], { cwd, timeout: 30000 });
         const raw = stripAnsi(checkResult.stdout + checkResult.stderr);
-        const diagnostics = parseRuffJson(checkResult.stdout || "", ctx.filePath);
-        const parsedDiagnostics = diagnostics.length > 0 ? diagnostics : parseRuffOutput(raw, ctx.filePath);
-        if (checkResult.status === 0 && parsedDiagnostics.length === 0) {
-            return { status: "succeeded", diagnostics: [], semantic: "none" };
-        }
-        if (parsedDiagnostics.length === 0) {
-            return {
-                status: "failed",
-                diagnostics: [],
-                semantic: "warning",
-                rawOutput: raw.slice(0, 500),
-            };
-        }
-        const hasErrors = parsedDiagnostics.some((d) => d.severity === "error");
-        return {
-            status: hasErrors ? "failed" : "succeeded",
-            diagnostics: parsedDiagnostics,
-            semantic: hasErrors ? "blocking" : "warning",
-        };
+        // EXIT TABLE (Ruff 0.6 docs https://docs.astral.sh/ruff/linter/): 0 = clean, 1 = findings, 2 = findings/error or
+        // tool error. A nonzero exit with valid findings stays findings; empty or
+        // unparsable output must never become clean (#1816).
+        const run = parseToolRun("ruff", { result: checkResult, output: raw, exitCodes: { ran: [1, 2] } }, (output) => {
+            const diagnostics = parseRuffJson(output, ctx.filePath);
+            return diagnostics.length > 0
+                ? diagnostics
+                : parseRuffOutput(output, ctx.filePath, cwd);
+        });
+        if (run.skipped)
+            return run.skipped;
+        return finishParsedRun({
+            tool: "ruff",
+            ctx,
+            result: checkResult,
+            diagnostics: run.diagnostics,
+        });
     },
 };
 export default ruffRunner;

package/dist/clients/dispatch/runners/rust-clippy.js

@@ -4,6 +4,7 @@
  * Runs `cargo clippy` for Rust files to catch common mistakes.
  */
 import { isAbsolute, resolve } from "node:path";
+import { pathsEqual } from "../../path-utils.js";
 import { rustClient } from "../../rust-client.js";
 import { safeSpawnAsync } from "../../safe-spawn.js";
 import { stripAnsi } from "../../sanitize.js";
@@ -125,8 +126,12 @@ const rustClippyRunner = {
         // a crate-mate's pre-existing diagnostic must NOT fail the edited file's
         // turn. Filter to the edited file like golangci-lint — if the edited file
         // is clean, this turn succeeds even when siblings carry warnings/errors.
+        // #3278: one seam for reported-path attribution — see javac.ts. This
+        // member already had the right BASE (`parseClippyOutput` resolves
+        // `span.file` against `cargoDir`); what it lacked was the on-disk
+        // identity predicate.
         const absEdited = resolve(ctx.filePath);
-        const diagnostics = allDiagnostics.filter((d) => resolve(d.filePath) === absEdited);
+        const diagnostics = allDiagnostics.filter((d) => pathsEqual(resolve(cargoDir, d.filePath), absEdited));
         const hasErrors = diagnostics.some((d) => d.semantic === "blocking");
         return {
             status: hasErrors ? "failed" : "succeeded",