pi-lens 4.3.0 → 4.4.0

package/dist/clients/dispatch/runners/fact-rules.js

@@ -1,29 +0,0 @@
-/**
- * Fact-rules runner — executes all registered FactRule instances against
- * the populated fact store. Each FactRule has its own appliesTo() guard
- * so this runner can be registered broadly; rules self-select.
- *
- * Severity semantics follow each rule's own diagnostic output.
- * Blocking rules surface on every write; warning-tier rules surface
- * only during full scans (blockingOnly === false).
- */
-import { PRIORITY } from "../priorities.js";
-import { evaluateRules } from "../fact-rule-runner.js";
-const factRulesRunner = {
-    id: "fact-rules",
-    appliesTo: ["jsts", "python", "go", "rust", "ruby", "shell", "cmake"],
-    priority: PRIORITY.GENERAL_ANALYSIS + 1,
-    async run(ctx) {
-        const diagnostics = evaluateRules(ctx);
-        if (diagnostics.length === 0) {
-            return { status: "succeeded", diagnostics: [], semantic: "none" };
-        }
-        const hasBlocking = diagnostics.some((d) => d.semantic === "blocking" || d.severity === "error");
-        return {
-            status: hasBlocking ? "failed" : "succeeded",
-            diagnostics,
-            semantic: hasBlocking ? "blocking" : "warning",
-        };
-    },
-};
-export default factRulesRunner;

package/dist/clients/dispatch/runners/fish-indent.js

@@ -1,69 +0,0 @@
-import { safeSpawnAsync } from "../../safe-spawn.js";
-import { resolveRunnerCwd } from "../../tool-cwd.js";
-import { PRIORITY } from "../priorities.js";
-import { createAvailabilityChecker } from "./utils/runner-helpers.js";
-// fish_indent ships with fish — not separately installable, no managed fallback
-const fishIndent = createAvailabilityChecker("fish_indent");
-const fishIndentRunner = {
-    id: "fish-indent",
-    appliesTo: ["fish"],
-    priority: PRIORITY.FORMAT_AND_LINT_PRIMARY,
-    skipTestFiles: false,
-    async run(ctx) {
-        const cwd = resolveRunnerCwd(ctx, "fish-indent");
-        const available = await fishIndent.isAvailableAsync(cwd);
-        if (!available)
-            return { status: "skipped", diagnostics: [], semantic: "none" };
-        const cmd = fishIndent.getCommand(cwd);
-        if (!cmd)
-            return { status: "skipped", diagnostics: [], semantic: "none" };
-        // --check: exits 0 if already formatted, 1 if reformatting would change the file
-        const result = await safeSpawnAsync(cmd, ["--check", ctx.filePath], {
-            timeout: 10000,
-            cwd,
-        });
-        if (result.status === 0) {
-            return { status: "succeeded", diagnostics: [], semantic: "none" };
-        }
-        // Non-zero exit: either needs formatting or a parse error was reported on stderr
-        const stderrLine = (result.stderr ?? "").split("\n").find((l) => l.trim());
-        if (stderrLine) {
-            // Parse/syntax error — extract line number from "filename (line N): message" if present
-            const lineMatch = stderrLine.match(/\(line\s+(\d+)\)/);
-            const line = lineMatch ? Number(lineMatch[1]) : 1;
-            const diagnostics = [
-                {
-                    id: `fish-indent-parse-${ctx.filePath}`,
-                    message: `fish_indent: ${stderrLine.trim()}`,
-                    filePath: ctx.filePath,
-                    line,
-                    column: 1,
-                    severity: "error",
-                    semantic: "blocking",
-                    tool: "fish-indent",
-                    rule: "fish-indent-parse-error",
-                },
-            ];
-            return { status: "failed", diagnostics, semantic: "blocking" };
-        }
-        // Clean stderr — file just needs formatting
-        const diagnostics = [
-            {
-                id: `fish-indent-format-${ctx.filePath}`,
-                message: "Fish script is not formatted — run `fish_indent -w` to fix",
-                filePath: ctx.filePath,
-                line: 1,
-                column: 1,
-                severity: "warning",
-                semantic: "warning",
-                tool: "fish-indent",
-                rule: "fish-indent-unformatted",
-                fixable: true,
-                autoFixAvailable: false,
-                fixKind: "manual",
-            },
-        ];
-        return { status: "succeeded", diagnostics, semantic: "warning" };
-    },
-};
-export default fishIndentRunner;

package/dist/clients/dispatch/runners/gleam-check.js

@@ -1,167 +0,0 @@
-import * as path from "node:path";
-import { pathsEqual } from "../../path-utils.js";
-import { safeSpawnAsync } from "../../safe-spawn.js";
-import { stripAnsi } from "../../sanitize.js";
-import { resolveRunnerCwd } from "../../tool-cwd.js";
-import { createAvailabilityChecker } from "./utils/runner-helpers.js";
-import { PRIORITY } from "../priorities.js";
-const gleam = createAvailabilityChecker("gleam", ".exe");
-/**
- * gleam renders every located diagnostic through
- * `codespan_reporting::term::emit` (v1.18.1
- * `compiler-core/src/diagnostic.rs:92-133`, unchanged since v1.6.3), so its
- * location line is codespan's LOCUS line, not a bare `path:line:col`:
- *
- * ```text
- * error: Type mismatch
- *   ┌─ /abs/proj/src/app.gleam:1:8
- * ```
- *
- * `<outer gutter spaces> ┌─ <name>:<line>:<column>` —
- * codespan-reporting 0.13.1 `src/term/renderer.rs:379-396` (the gutter, then
- * `chars().snippet_start`, then one space, then the locus) and `:869-878`
- * (`{name}:{line_number}:{column_number}`), with `snippet_start` = `┌─` in the
- * default box-drawing set (`src/term/config.rs:419-429`, reached because gleam
- * passes `Config::default()`, whose display style is Rich).
- *
- * `name` is `location.path` verbatim (`diagnostic.rs:92-94`,
- * `files.add(main_location_path, …)`), and the CLI builds that path by walking
- * UP from the absolute `std::env::current_dir()` to the nearest `gleam.toml`
- * (`compiler-cli/src/fs.rs:32-62`) and joining `src`/`test`
- * (`compiler-core/src/paths.rs:42-48`) before enumerating the directory — so it
- * is ABSOLUTE, with host-native separators. Resolving it against the cwd the
- * tool ran in is therefore a no-op today and the ADR 0009 shape for the
- * hypothetical relative spelling.
- *
- * Capturing the path REQUIRES matching the gutter: the pre-#3285 regex
- * `/^(.+?):(\d+):(\d+)$/` captured `  ┌─ /abs/proj/src/app.gleam`, gutter
- * included, and only an `endsWith` compare tolerated that. An equality
- * predicate (the seam every other runner now uses) drops every gleam diagnostic
- * unless the gutter is out of the capture — which is why PR #3284 reverted its
- * own fold here and filed #3285.
- */
-const GLEAM_LOCUS = /^\s*┌─\s+(.+?):(\d+):(\d+)$/;
-const GLEAM_HEADER = /^\s*(error|warning):\s*(.+?)\s*$/;
-const GLEAM_LABEL = /^\s*│\s*\^+\s*(.*?)\s*$/;
-/**
- * codespan writes ONE title line per diagnostic and then everything that
- * belongs to it — locus, borders, snippet, labels, notes — before the next
- * title (`codespan-reporting` 0.13.1 `src/term/renderer.rs:141-210`). Splitting
- * on the title is therefore the diagnostic boundary, and it is what keeps an
- * adjacent diagnostic's label out of its predecessor's message. Lines before
- * the first title are gleam's own progress output (`Compiling demo`), which
- * belongs to no diagnostic.
- */
-function gleamBlocks(lines) {
-    const blocks = [];
-    for (const line of lines) {
-        const header = line.match(GLEAM_HEADER);
-        if (header)
-            blocks.push({ header, body: [] });
-        else
-            blocks.at(-1)?.body.push(line);
-    }
-    return blocks;
-}
-function gleamMessage(title, body) {
-    const labels = body.flatMap((line) => line.match(GLEAM_LABEL)?.[1]?.trim() || []);
-    return labels.length > 0 ? `${title} — ${labels.join(" ")}` : title;
-}
-function parseGleamOutput(raw, filePath, cwd) {
-    const diagnostics = [];
-    const absTarget = path.resolve(cwd, filePath);
-    // `stripAnsi` (the seam `ruff.ts`, `go-vet.ts` and `rust-clippy.ts` already
-    // use): gleam colours the gutter whenever `FORCE_COLOR` is set non-empty,
-    // whatever stderr is (`compiler-cli/src/cli.rs:194-207` — `ColorChoice::Never`
-    // only when it is neither forced nor a terminal), and the SGR bytes sit
-    // between the line start and `┌─`. The old suffix compare never saw the
-    // prefix; an anchored capture would drop every diagnostic in that
-    // environment.
-    const lines = stripAnsi(raw).split(/\r?\n/);
-    for (const { header, body } of gleamBlocks(lines)) {
-        const severity = header[1] === "warning" ? "warning" : "error";
-        const title = `${header[1]}: ${header[2]}`;
-        // A Gleam diagnostic with NO locus describes the whole project: `check`
-        // receives no file argument (`Diagnostic::write_title`, no codespan emit).
-        // Leave it for the nonzero-without-diagnostics fallback instead of
-        // charging it to whichever file happened to trigger dispatch — ADR 0009:
-        // without a reported path there is no evidence it is about this file.
-        const location = body
-            .find((line) => GLEAM_LOCUS.test(line))
-            ?.match(GLEAM_LOCUS);
-        if (!location)
-            continue;
-        const [, sourcePath, lineStr, colStr] = location;
-        // #3278: one seam for reported-path attribution — see javac.ts.
-        if (!pathsEqual(path.resolve(cwd, sourcePath.trim()), absTarget))
-            continue;
-        diagnostics.push({
-            id: `gleam-check-${lineStr}-${colStr}`,
-            message: gleamMessage(title, body),
-            filePath,
-            line: Number.parseInt(lineStr, 10) || 1,
-            column: Number.parseInt(colStr, 10) || 1,
-            severity,
-            semantic: severity === "error" ? "blocking" : "warning",
-            tool: "gleam",
-            rule: "gleam-check",
-            fixable: false,
-        });
-    }
-    return diagnostics;
-}
-function firstOutputLine(result) {
-    return `${result.stderr || ""}\n${result.stdout || ""}`
-        .trim()
-        .split(/\r?\n/, 1)[0]
-        .slice(0, 200);
-}
-const gleamCheckRunner = {
-    id: "gleam-check",
-    appliesTo: ["gleam"],
-    priority: PRIORITY.GENERAL_ANALYSIS,
-    skipTestFiles: false,
-    async run(ctx) {
-        const cwd = resolveRunnerCwd(ctx, "gleam-check");
-        if (!(await gleam.isAvailableAsync(cwd))) {
-            return { status: "skipped", diagnostics: [], semantic: "none" };
-        }
-        const cmd = gleam.getCommand(cwd);
-        const result = await safeSpawnAsync(cmd, ["check"], {
-            cwd,
-            timeout: 30000,
-        });
-        if (result.error && !result.stdout && !result.stderr) {
-            return { status: "skipped", diagnostics: [], semantic: "none" };
-        }
-        const diagnostics = parseGleamOutput(`${result.stderr || ""}\n${result.stdout || ""}`, ctx.filePath, cwd);
-        if (diagnostics.length === 0) {
-            if (result.status && result.status !== 0) {
-                return {
-                    status: "failed",
-                    diagnostics: [
-                        {
-                            id: "gleam-check-nonzero-no-diagnostics",
-                            message: firstOutputLine(result) ||
-                                "gleam check exited non-zero without structured diagnostics",
-                            filePath: ctx.filePath,
-                            severity: "error",
-                            semantic: "blocking",
-                            tool: "gleam",
-                            rule: "gleam-check",
-                            fixable: false,
-                        },
-                    ],
-                    semantic: "blocking",
-                };
-            }
-            return { status: "succeeded", diagnostics: [], semantic: "none" };
-        }
-        return {
-            status: "failed",
-            diagnostics,
-            semantic: "blocking",
-        };
-    },
-};
-export default gleamCheckRunner;

package/dist/clients/dispatch/runners/go-vet.js

@@ -1,104 +0,0 @@
-/**
- * Go vet runner for dispatch system
- *
- * Runs `go vet` for Go files to catch common mistakes.
- */
-import { relative, resolve, sep, posix } from "node:path";
-import { goClient } from "../../go-client.js";
-import { pathsEqual } from "../../path-utils.js";
-import { safeSpawnAsync } from "../../safe-spawn.js";
-import { resolveRunnerCwd } from "../../tool-cwd.js";
-import { stripAnsi } from "../../sanitize.js";
-import { skipUnlessToolRan } from "./utils/tool-failure.js";
-import { parseGoVetOutput } from "./utils/diagnostic-parsers.js";
-import { PRIORITY } from "../priorities.js";
-const goVetRunner = {
-    id: "go-vet",
-    appliesTo: ["go"],
-    priority: PRIORITY.SPECIALIZED_ANALYSIS,
-    timeoutMs: 40_000,
-    async run(ctx) {
-        // Resolve go path using platform-aware lookup (handles system install paths on Windows)
-        const goExe = await goClient.findGoPathAsync();
-        if (!goExe) {
-            return { status: "skipped", diagnostics: [], semantic: "none" };
-        }
-        // Vet the package containing the file from the module root.
-        //
-        // `go vet <one-file.go>` compiles that file in isolation, so same-package
-        // symbols defined in sibling files read as false `undefined: X`, and when
-        // the spawn cwd is outside the module the run also reports
-        // `go.mod file not found` (#263). ctx.cwd is the go.mod module root
-        // (resolveLanguageRootForFile, markers ["go.mod"]), so vet the file's
-        // package from there.
-        const cwd = resolveRunnerCwd(ctx, "go-vet");
-        const fileRel = relative(cwd, ctx.filePath).split(sep).join(posix.sep);
-        const pkgPath = fileRel.startsWith("../")
-            ? // File isn't under ctx.cwd (unexpected — ctx.cwd is the go.mod root).
-                // Vet the root package as a safe fallback rather than emit `./../x`;
-                // the filename filter below still prevents mis-attribution.
-                "."
-            : fileRel.includes("/")
-                ? "./" + fileRel.slice(0, fileRel.lastIndexOf("/"))
-                : ".";
-        const result = await safeSpawnAsync(goExe, ["vet", pkgPath], {
-            timeout: 30000,
-            cwd,
-        });
-        const raw = stripAnsi(result.stdout + result.stderr);
-        // #1816: `go vet` exits nonzero both for "found problems" and for a
-        // toolchain failure it never got past — `go.mod file not found in
-        // current directory or any parent directory` is the one that bit us
-        // (#263). That prose carries no `file:line:col:` prefix, so it parsed to
-        // zero diagnostics and the file was reported CLEAN by a vet that never
-        // ran. The exit code cannot separate the two cases; the presence of a
-        // parsable diagnostic line can, so that is what the gate is handed.
-        const parsableLines = raw
-            .split("\n")
-            .filter((line) => /^.+?:\d+:\d+:/.test(line))
-            .join("\n");
-        const skipped = skipUnlessToolRan("go-vet", {
-            result,
-            output: parsableLines,
-        });
-        if (skipped)
-            return skipped;
-        if (result.status === 0 && !raw.trim()) {
-            return { status: "succeeded", diagnostics: [], semantic: "none" };
-        }
-        // createLineParser ignores the output filename and attributes every
-        // diagnostic to ctx.filePath, so keep only this file's lines — package
-        // vetting reports siblings too. Resolve each output path against the vet
-        // cwd before comparing, so go's path FORM (a leading `./` for the
-        // module-root package, an absolute path, `.` segments) can't cause the
-        // edited file's OWN diagnostics to be silently dropped.
-        //
-        // #3277: resolving is not enough — the two sides are SPELLED by
-        // different actors. `ctx.filePath` is `normalizeMapKey`-canonical
-        // (#2016) while go prints its own spelling: `cmd/go` rewrites the
-        // package-dir prefix to a cwd-relative one only when the rewrite
-        // matches byte-for-byte (`replacePrefix`), even though the check that
-        // authorized it (`filepath.Rel`) compares case-insensitively on
-        // Windows, so a differently-cased ABSOLUTE path reaches this filter.
-        // A bare `===` then drops every line for the edited file and the run
-        // is reported clean — the #209 defect. `pathsEqual` asks the
-        // filesystem instead of a platform list, so it is also right on a
-        // case-folding POSIX mount. It does NOT resolve symlinks on POSIX
-        // (`clients/path-utils.ts:181`); nothing here relies on that.
-        const absTarget = resolve(ctx.filePath);
-        const relevant = raw
-            .split("\n")
-            .filter((line) => {
-            const m = line.match(/^(.+?):(\d+):(\d+):\s*(.+)/);
-            return m != null && pathsEqual(resolve(cwd, m[1].trim()), absTarget);
-        })
-            .join("\n");
-        const diagnostics = parseGoVetOutput(relevant, ctx.filePath, cwd);
-        // Edited file clean → succeeded: a sibling-file error no longer flags
-        // the edited file's turn (it surfaces when that file is itself edited).
-        return diagnostics.length > 0
-            ? { status: "failed", diagnostics, semantic: "warning" }
-            : { status: "succeeded", diagnostics: [], semantic: "none" };
-    },
-};
-export default goVetRunner;

package/dist/clients/dispatch/runners/golangci-lint.js

@@ -1,135 +0,0 @@
-/**
- * golangci-lint runner for dispatch system
- *
- * Runs golangci-lint when a .golangci.yml config is present.
- * golangci-lint is the standard meta-linter for Go projects — it runs
- * staticcheck, errcheck, gosimple, and many others in one pass.
- *
- * Gate: skips when no .golangci.yml/.golangci.yaml config is found (project
- * relies on go-vet only). This avoids noisy default-rule runs on projects
- * that haven't opted in.
- */
-import * as path from "node:path";
-import { safeSpawnAsync } from "../../safe-spawn.js";
-import { pathsEqual } from "../../path-utils.js";
-import { resolveRunnerCwd } from "../../tool-cwd.js";
-import { getLinterPolicyForCwd, hasGolangciConfig } from "../../tool-policy.js";
-import { PRIORITY } from "../priorities.js";
-import { createAvailabilityChecker, resolveAvailableOrInstall, } from "./utils/runner-helpers.js";
-import { finishParsedRun, parseToolRun } from "./utils/tool-failure.js";
-const golangci = createAvailabilityChecker("golangci-lint", ".exe");
-/**
- * Summarize a golangci-lint Replacement into a single-line fixSuggestion.
- * Prefers the Inline rewrite (precise + short) over multi-line block
- * replacements, and reports a delete-only fix when there's no new content.
- * Returns undefined when there is no Replacement attached.
- */
-function describeReplacement(replacement) {
-    if (!replacement)
-        return undefined;
-    if (replacement.Inline?.NewString !== undefined) {
-        return `Replace with: ${replacement.Inline.NewString}`;
-    }
-    if (replacement.NeedOnlyDelete)
-        return "Delete this code";
-    if (replacement.NewLines && replacement.NewLines.length > 0) {
-        const preview = replacement.NewLines[0].trim();
-        const hint = replacement.NewLines.length > 1
-            ? ` (+${replacement.NewLines.length - 1} more lines)`
-            : "";
-        return `Replace with: ${preview}${hint}`;
-    }
-    return "Apply golangci-lint suggested fix";
-}
-function parseGolangciJson(raw, filePath, cwd) {
-    try {
-        const output = JSON.parse(raw);
-        if (!output.Issues)
-            return [];
-        const absFile = path.resolve(cwd, filePath);
-        // #3278: one seam for reported-path attribution — see javac.ts. The base
-        // matters here more than anywhere else in the family: golangci-lint's
-        // `PathPrettifier` OVERWRITES `Pos.Filename` with `filepath.Rel(basePath,
-        // …)` before the JSON printer sees it (v1.64.8,
-        // `pkg/result/processors/path_prettifier.go:31` +
-        // `path_relativity.go:43`), so the spelling is relative to the child's
-        // base path — the `cwd` we spawned it in — and `path.resolve` with no
-        // base resolved it against the EXTENSION's cwd instead.
-        return output.Issues.filter((issue) => pathsEqual(path.resolve(cwd, issue.Pos.Filename), absFile)).map((issue) => {
-            const severity = issue.Severity === "error" ? "error" : "warning";
-            // golangci-lint's --out-format=json emits a Replacement object per
-            // issue when `golangci-lint run --fix` would deterministically
-            // rewrite the code. Mirror the rust-clippy structured-output path
-            // (commit 221b34d): propagate the field to fixable / fixSuggestion
-            // so the diagnostic routes through actionable-warnings.
-            const fixSuggestion = describeReplacement(issue.Replacement);
-            return {
-                id: `golangci:${issue.FromLinter}:${issue.Pos.Line}`,
-                message: `${issue.FromLinter}: ${issue.Text}`,
-                filePath,
-                line: issue.Pos.Line,
-                column: issue.Pos.Column,
-                severity,
-                semantic: severity === "error" ? "blocking" : "warning",
-                tool: "golangci-lint",
-                rule: issue.FromLinter,
-                defectClass: "correctness",
-                fixable: Boolean(issue.Replacement),
-                fixSuggestion,
-            };
-        });
-    }
-    catch {
-        return [];
-    }
-}
-// Exported for the parser unit tests (#112 golangci-lint slice).
-export { parseGolangciJson };
-const golangciRunner = {
-    id: "golangci-lint",
-    appliesTo: ["go"],
-    priority: PRIORITY.GENERAL_ANALYSIS,
-    timeoutMs: 90_000,
-    async run(ctx) {
-        const cwd = resolveRunnerCwd(ctx, "golangci-lint");
-        const policy = getLinterPolicyForCwd(ctx.filePath, cwd);
-        if (policy && !policy.preferredRunners.includes("golangci-lint")) {
-            return { status: "skipped", diagnostics: [], semantic: "none" };
-        }
-        // Only run if project has opted in via config file
-        if (!hasGolangciConfig(cwd)) {
-            return { status: "skipped", diagnostics: [], semantic: "none" };
-        }
-        const cmd = await resolveAvailableOrInstall(golangci, "golangci-lint", cwd);
-        if (!cmd)
-            return { status: "skipped", diagnostics: [], semantic: "none" };
-        // Run on the specific file. golangci-lint accepts file paths directly.
-        const result = await safeSpawnAsync(cmd, ["run", "--out-format=json", ctx.filePath], { timeout: 60000, cwd });
-        // Exit table: 0 is clean-or-findings; 1 means issues, 3 failure,
-        // 4 timeout, and 5 missing config. Every nonzero code is a ran outcome
-        // whose parser decides: JSON issues remain findings, while emitted
-        // non-JSON text becomes a parse-error diagnostic and no output stays
-        // skipped. Keep stderr as the parse input when stdout is absent so tool
-        // errors cannot be mistaken for a clean file.
-        const raw = (result.stdout ?? "").length > 0
-            ? (result.stdout ?? "")
-            : result.status !== 0
-                ? result.stderr || ""
-                : "";
-        const parsed = parseToolRun("golangci-lint", {
-            result,
-            output: raw,
-            // EXIT TABLE (golangci-lint 1.60 docs https://golangci-lint.run/docs/welcome/quick-start/): 0 clean; 1 findings; 2 error; 3 error; 4 error; 5 error; other nonzero rejected.
-            exitCodes: { ran: [1, 2, 3, 4, 5] },
-        }, (raw) => parseGolangciJson(raw, ctx.filePath, cwd));
-        if (parsed.skipped)
-            return parsed.skipped;
-        return finishParsedRun({
-            tool: "golangci-lint",
-            ctx,
-            result,
-            diagnostics: parsed.diagnostics,
-        });
-    },
-};
-export default golangciRunner;

package/dist/clients/dispatch/runners/hadolint.js

@@ -1,91 +0,0 @@
-import * as path from "node:path";
-import { pathsEqual } from "../../path-utils.js";
-import { safeSpawnAsync } from "../../safe-spawn.js";
-import { resolveRunnerCwd } from "../../tool-cwd.js";
-import { getLinterPolicyForCwd } from "../../tool-policy.js";
-import { PRIORITY } from "../priorities.js";
-import { createAvailabilityChecker, resolveToolCommandWithInstallFallback, } from "./utils/runner-helpers.js";
-import { parseToolRun } from "./utils/tool-failure.js";
-import { finishParsedRun } from "./utils/tool-failure.js";
-const hadolint = createAvailabilityChecker("hadolint", ".exe");
-function parseHadolintOutput(raw, filePath, cwd) {
-    try {
-        const parsed = JSON.parse(raw);
-        if (!Array.isArray(parsed))
-            return [];
-        const absTarget = path.resolve(cwd, filePath);
-        return parsed.flatMap((item) => {
-            // #3295: hadolint takes a LIST of Dockerfiles and names each finding's
-            // own `file`.
-            if (item.file && !pathsEqual(path.resolve(cwd, item.file), absTarget))
-                return [];
-            const severity = item.level === "error" ? "error" : "warning";
-            return [
-                {
-                    id: `hadolint-${item.code}-${item.line}`,
-                    message: `[${item.code}] ${item.message}`,
-                    filePath,
-                    line: item.line,
-                    column: item.column ?? 1,
-                    severity,
-                    semantic: severity === "error" ? "blocking" : "warning",
-                    tool: "hadolint",
-                    rule: item.code,
-                    fixable: false,
-                },
-            ];
-        });
-    }
-    catch {
-        return [];
-    }
-}
-const hadolintRunner = {
-    id: "hadolint",
-    appliesTo: ["docker"],
-    priority: PRIORITY.GENERAL_ANALYSIS,
-    skipTestFiles: false,
-    async run(ctx) {
-        const cwd = resolveRunnerCwd(ctx, "hadolint");
-        const policy = getLinterPolicyForCwd(ctx.filePath, cwd);
-        if (policy && !policy.preferredRunners.includes("hadolint")) {
-            return { status: "skipped", diagnostics: [], semantic: "none" };
-        }
-        let cmd = null;
-        if (await hadolint.isAvailableAsync(cwd)) {
-            cmd = hadolint.getCommand(cwd);
-        }
-        else {
-            cmd = await resolveToolCommandWithInstallFallback(cwd, "hadolint");
-        }
-        if (!cmd) {
-            return { status: "skipped", diagnostics: [], semantic: "none" };
-        }
-        const result = await safeSpawnAsync(cmd, ["--format", "json", "--no-fail", path.resolve(cwd, ctx.filePath)], { cwd });
-        // #1948: hadolint runs with `--no-fail`, so it exits 0 even when it finds
-        // something. A nonzero exit therefore means hadolint itself failed, and
-        // zero parsed diagnostics out of whatever it printed is a parser break.
-        const run = parseToolRun("hadolint", {
-            result,
-            // EXIT TABLE (Hadolint 2.12 measured fixture): 0 clean; 1 findings; 2 error; other nonzero rejected.
-            exitCodes: { ran: [1, 2] },
-        }, (out) => parseHadolintOutput(out, ctx.filePath, cwd));
-        if (run.skipped)
-            return run.skipped;
-        const diagnostics = run.diagnostics;
-        return finishParsedRun({
-            tool: "hadolint",
-            ctx,
-            result,
-            diagnostics,
-            classify: (diagnostics) => {
-                const hasErrors = diagnostics.some((d) => d.severity === "error");
-                return {
-                    status: "failed",
-                    semantic: hasErrors ? "blocking" : "warning",
-                };
-            },
-        });
-    },
-};
-export default hadolintRunner;