pi-lens 4.4.0 → 4.4.2

package/dist/{chunk-U3VGR4VU.js → chunk-AW7R2GWG.js}

@@ -2,27 +2,38 @@ import { createRequire as __pilensCreateRequire } from "node:module"; const requ
 import {
   createAvailabilityProbeFlight,
   probeToolAsync
-} from "./chunk-EOKRQ3SA.js";
+} from "./chunk-RWWYJ623.js";
 import {
   classifyProbeFailure,
   createAvailabilityLatch,
   isTransientDecision,
   logAvailabilityDecision,
   startHostStallSampler
-} from "./chunk-WONERJTP.js";
+} from "./chunk-VRZP76YM.js";
 import {
   createGenerationSource,
   safeSpawnAsync
-} from "./chunk-VN2AXLEX.js";
+} from "./chunk-C34ZXZ7O.js";
+import {
+  getProjectTrustState
+} from "./chunk-ZANLILYD.js";
+import {
+  recordDegradationOnce
+} from "./chunk-JAU72XNY.js";
+import {
+  logExtension
+} from "./chunk-XTMJ7XDT.js";
 import {
   isAtOrAboveHomeDir,
+  isUnderDir,
   walkUpDirs
-} from "./chunk-Q5U6FMDI.js";
+} from "./chunk-N2H3ZPZY.js";
 
 // dist/clients/package-manager.js
 import * as fs from "node:fs";
 import * as os from "node:os";
 import * as path from "node:path";
+import { resolve as resolvePath } from "node:path";
 var PREFERENCE = [
   "npm",
   "pnpm",
@@ -254,6 +265,41 @@ var VENV_BIN_DIRS = [
   path.join(".venv", "Scripts"),
   path.join("venv", "Scripts")
 ];
+var PROJECT_LOCAL_BIN_DIRS = [
+  ...NODE_MODULES_BIN_DIRS,
+  ...VENDOR_BIN_DIRS,
+  ...VENV_BIN_DIRS
+];
+function localBinPath(value) {
+  return typeof value === "string" ? value : void 0;
+}
+function refuseLocalBin(tool, root) {
+  const trust = getProjectTrustState();
+  const resolvedRoot = resolvePath(root);
+  const subject = `project-local-binary:${resolvedRoot}:${tool}`;
+  if (recordDegradationOnce({
+    kind: "trust-refusal",
+    subject,
+    reason: `project-local binary refused: pi project trust is ${trust}`
+  })) {
+    logExtension({
+      subsystem: "project-trust",
+      level: "warn",
+      message: "project-local binary refused: mark the project trusted in pi or upgrade pi",
+      metadata: { tool, root: resolvedRoot, trust }
+    });
+  }
+  return { kind: "refused-by-trust", tool, root: resolvedRoot, trust };
+}
+function isProjectLocalBinPath(resolvedCommand, cwd) {
+  for (const ancestor of walkUpDirs(cwd)) {
+    if (isAtOrAboveHomeDir(ancestor, os.homedir()))
+      break;
+    if (PROJECT_LOCAL_BIN_DIRS.some((binDir) => isUnderDir(resolvedCommand, path.join(ancestor, binDir))))
+      return true;
+  }
+  return false;
+}
 function expandCandidateNames(tools, windowsExt, isWindows) {
   return isWindows && windowsExt !== "" ? tools.flatMap((tool) => [`${tool}${windowsExt}`, tool]) : [...tools];
 }
@@ -276,18 +322,27 @@ function* localBinMatches(tools, startDir, options) {
   }
 }
 function findLocalBinUpwards(tool, startDir, options = {}) {
-  return localBinMatches([tool], startDir, options).next().value;
+  const match = localBinMatches([tool], startDir, options).next().value;
+  if (match === void 0 || options.ceiling === false)
+    return match;
+  if (getProjectTrustState() !== "trusted")
+    return refuseLocalBin(tool, startDir);
+  return match;
 }
 function findLocalBinsAt(tools, dir, options = {}) {
   const { windowsExt = ".cmd", binDirs = NODE_MODULES_BIN_DIRS, isWindows = onWindows() } = options;
   const names = expandCandidateNames(tools, windowsExt, isWindows);
-  return [...matchesInDir(path.resolve(dir), names, binDirs)];
+  const matches = [...matchesInDir(path.resolve(dir), names, binDirs)];
+  if (matches.length === 0 || getProjectTrustState() === "trusted")
+    return matches;
+  return [refuseLocalBin(tools.join(","), dir)];
 }
 function findLocalBinAt(tool, dir, options = {}) {
-  return findLocalBinsAt([tool], dir, options)[0];
+  const match = findLocalBinsAt([tool], dir, options)[0];
+  return match;
 }
 async function findNodeToolBinary(tool, cwd, windowsExt = ".cmd") {
-  return findLocalBinUpwards(tool, cwd, { windowsExt }) ?? await findGlobalBinary(tool, windowsExt);
+  return localBinPath(findLocalBinUpwards(tool, cwd, { windowsExt })) ?? await findGlobalBinary(tool, windowsExt);
 }
 
 export {
@@ -301,6 +356,8 @@ export {
   findGlobalBinary,
   VENDOR_BIN_DIRS,
   VENV_BIN_DIRS,
+  localBinPath,
+  isProjectLocalBinPath,
   findLocalBinUpwards,
   findLocalBinsAt,
   findLocalBinAt,

package/dist/{chunk-FJNKANOS.js → chunk-BKE7E7TC.js}

@@ -7,19 +7,20 @@ import {
   loadCallGraph,
   parseSymbolKey,
   saveCallGraph
-} from "./chunk-NKOUFPQF.js";
+} from "./chunk-WOA4LN2R.js";
 import "./chunk-3MED75HT.js";
-import "./chunk-VN2AXLEX.js";
-import "./chunk-DQ2NZ7C4.js";
-import "./chunk-VNMT7C64.js";
+import "./chunk-C34ZXZ7O.js";
+import "./chunk-2BBLFX75.js";
+import "./chunk-XVF2VVXP.js";
 import "./chunk-2EECBNC5.js";
-import "./chunk-N3YQJI6O.js";
-import "./chunk-O6TQT6RI.js";
-import "./chunk-5THXD6X5.js";
-import "./chunk-UK3CMEAL.js";
+import "./chunk-JAU72XNY.js";
+import "./chunk-XTMJ7XDT.js";
+import "./chunk-JMYYOTQG.js";
+import "./chunk-QQNQ7SJW.js";
+import "./chunk-AOHZU2BM.js";
 import "./chunk-LJDODBBZ.js";
 import "./chunk-ABBOA7UD.js";
-import "./chunk-Q5U6FMDI.js";
+import "./chunk-N2H3ZPZY.js";
 import "./chunk-NXL4FFQQ.js";
 export {
   CALL_GRAPH_CACHE_VERSION,

package/dist/{chunk-4W2PLC4J.js → chunk-BRGDSBJE.js}

@@ -3,22 +3,23 @@ import {
   RustClient,
   resetRustAvailability,
   rustClient
-} from "./chunk-RPD5K5NC.js";
-import "./chunk-F3P7VQ7H.js";
-import "./chunk-EOKRQ3SA.js";
-import "./chunk-WONERJTP.js";
-import "./chunk-VN2AXLEX.js";
+} from "./chunk-MRXKYPCS.js";
+import "./chunk-7DYBLXYA.js";
+import "./chunk-RWWYJ623.js";
+import "./chunk-VRZP76YM.js";
+import "./chunk-C34ZXZ7O.js";
 import "./chunk-BW5KFIQC.js";
-import "./chunk-DQ2NZ7C4.js";
-import "./chunk-VNMT7C64.js";
+import "./chunk-2BBLFX75.js";
+import "./chunk-XVF2VVXP.js";
 import "./chunk-2EECBNC5.js";
-import "./chunk-N3YQJI6O.js";
-import "./chunk-O6TQT6RI.js";
-import "./chunk-5THXD6X5.js";
-import "./chunk-UK3CMEAL.js";
+import "./chunk-JAU72XNY.js";
+import "./chunk-XTMJ7XDT.js";
+import "./chunk-JMYYOTQG.js";
+import "./chunk-QQNQ7SJW.js";
+import "./chunk-AOHZU2BM.js";
 import "./chunk-LJDODBBZ.js";
 import "./chunk-ABBOA7UD.js";
-import "./chunk-Q5U6FMDI.js";
+import "./chunk-N2H3ZPZY.js";
 import "./chunk-NXL4FFQQ.js";
 export {
   RustClient,

package/dist/{chunk-VN2AXLEX.js → chunk-C34ZXZ7O.js}

@@ -12,7 +12,7 @@ import {
   reportPiLensConfigRecords,
   resolveOnePiLensConfigDocument,
   warnIgnoredConfigOnce
-} from "./chunk-DQ2NZ7C4.js";
+} from "./chunk-2BBLFX75.js";
 import {
   CANONICAL_GLOBAL_CONFIG_FILE,
   FRESHNESS_CADENCE_MS,
@@ -22,7 +22,7 @@ import {
   errorClassName,
   getPiLensGlobalConfigPath,
   getProductionGlobalConfigResolution
-} from "./chunk-VNMT7C64.js";
+} from "./chunk-XVF2VVXP.js";
 import {
   DEFAULT_MAX_OUTPUT_BYTES,
   createBoundedOutputSink,
@@ -42,16 +42,16 @@ import {
   readToolConfig,
   recordDegradation,
   recordDegradationOnce
-} from "./chunk-N3YQJI6O.js";
+} from "./chunk-JAU72XNY.js";
 import {
   logExtension
-} from "./chunk-O6TQT6RI.js";
+} from "./chunk-XTMJ7XDT.js";
 import {
   logLatency
-} from "./chunk-5THXD6X5.js";
+} from "./chunk-QQNQ7SJW.js";
 import {
   getProcessSingleton
-} from "./chunk-UK3CMEAL.js";
+} from "./chunk-AOHZU2BM.js";
 import {
   sweepOwnStagingFiles
 } from "./chunk-LJDODBBZ.js";
@@ -71,7 +71,7 @@ import {
   normalizeLoggedPath,
   normalizeMapKey,
   toProjectRelativePath
-} from "./chunk-Q5U6FMDI.js";
+} from "./chunk-N2H3ZPZY.js";
 import {
   __commonJS,
   __require,
@@ -1744,6 +1744,15 @@ function loadPiLensGlobalConfig(configPath) {
         warnInvalid("actionableWarnings.autoFix.maxFixes must be a non-negative finite number");
       }
     }
+    const contextInjection = asConfigObject(raw.contextInjection);
+    if (contextInjection && "requirePreExistingFixes" in contextInjection) {
+      if (typeof contextInjection.requirePreExistingFixes === "boolean") {
+        config.contextInjection ??= {};
+        config.contextInjection.requirePreExistingFixes = contextInjection.requirePreExistingFixes;
+      } else {
+        warnInvalid("contextInjection.requirePreExistingFixes must be a boolean");
+      }
+    }
     const widget = asConfigObject(raw.widget);
     if (widget) {
       if (typeof widget.visible === "boolean") {
@@ -1876,6 +1885,17 @@ function classifyTmpDir(dir) {
 function ephemeralStagingRoot(filePath) {
   return classifyTmpDir(path6.dirname(path6.resolve(filePath))).stagingRoot;
 }
+function isPiOwnedTempPath(filePath) {
+  const tmpRoot = realPathOfNearestExisting(os.tmpdir());
+  const real = realPathOfNearestExisting(filePath);
+  if (!isUnderDir(real, tmpRoot))
+    return false;
+  const relative3 = path6.relative(tmpRoot, real);
+  if (relative3.length === 0 || path6.isAbsolute(relative3))
+    return false;
+  const segments = relative3.split(path6.sep);
+  return segments.length === 1 || /^pi-/i.test(segments[0] ?? "");
+}
 function isEphemeralCheckoutRoot(dir) {
   return classifyTmpDir(dir).checkout;
 }
@@ -1884,14 +1904,14 @@ function isEphemeralCheckoutRoot(dir) {
 function getProjectDataDir(cwd) {
   const legacyProjectDir = path7.join(cwd, ".pi-lens");
   const configuredBase = process.env.PILENS_DATA_DIR?.trim();
-  if (!configuredBase && fs4.existsSync(legacyProjectDir)) {
-    return legacyProjectDir;
-  }
   const resolvedBase = projectDataBase();
   const memoKey = `${resolvedBase}\0${path7.resolve(cwd)}`;
   const cached = settledDataDirs.get(memoKey);
   if (cached !== void 0)
     return cached;
+  if (!configuredBase && fs4.existsSync(legacyProjectDir)) {
+    return legacyProjectDir;
+  }
   const canonical = canonicalProjectRoot(cwd);
   const readable = projectDataDirReadableSlug(canonical.root);
   const hash = projectDataDirRootHash(canonical.root);
@@ -2049,6 +2069,21 @@ function getGlobalPiLensDir() {
     return path7.resolve(override);
   return path7.join(os2.homedir(), ".pi-lens");
 }
+function isPiLensInternalPath(filePath, projectRoot) {
+  const absolute = path7.resolve(filePath);
+  const home = path7.resolve(os2.homedir());
+  const candidates = [
+    getGlobalPiLensDir(),
+    getProjectDataDir(projectRoot),
+    path7.join(home, ".pi"),
+    path7.join(home, ".pi-lens")
+  ];
+  if (candidates.some((dir) => isUnderDir(absolute, dir)))
+    return true;
+  if (isPiOwnedTempPath(absolute))
+    return true;
+  return false;
+}
 var EXCLUDED_DIRS = [
   "node_modules",
   ".git",
@@ -3291,6 +3326,39 @@ function mergeInstanceRoots(priorRoots, normalizedRoot) {
     roots.splice(1, 1);
   return roots;
 }
+var HOST_ROOT_HOLDER = "host";
+var ROOT_HOLDER_CAP = 2 * INSTANCE_ROOT_CAP;
+function readRootHolders(entry) {
+  const raw = entry.projectRootHolders;
+  if (typeof raw !== "object" || raw === null || Array.isArray(raw)) {
+    return { [HOST_ROOT_HOLDER]: getInstanceRoots(entry) };
+  }
+  const holders = {};
+  for (const [holder, listed] of Object.entries(raw)) {
+    if (!Array.isArray(listed))
+      continue;
+    holders[holder] = listed.filter((root) => typeof root === "string" && root.length > 0);
+  }
+  return holders;
+}
+function settleRootHolders(roots, holders) {
+  const primary = roots[0];
+  const settled = {};
+  for (const [holder, listed2] of Object.entries(holders)) {
+    const kept = roots.filter((root) => listed2.includes(root));
+    if (kept.length > 0)
+      settled[holder] = kept;
+  }
+  if (primary !== void 0) {
+    settled[HOST_ROOT_HOLDER] = roots.filter((root) => root === primary || holders[HOST_ROOT_HOLDER]?.includes(root) === true);
+  }
+  const secondaries = Object.keys(settled).filter((holder) => holder !== HOST_ROOT_HOLDER);
+  for (const holder of secondaries.slice(0, Math.max(0, secondaries.length - ROOT_HOLDER_CAP))) {
+    delete settled[holder];
+  }
+  const listed = new Set(Object.values(settled).flat());
+  return { roots: roots.filter((root) => listed.has(root)), holders: settled };
+}
 function registerInstance(projectRoot) {
   const generation = registrationGeneration().capture();
   return queueRegistryMutation(() => registerInstanceNow(projectRoot, generation));
@@ -3319,14 +3387,23 @@ async function registerInstanceNow(projectRoot, generation) {
     const existing = file.instances.find((entry) => isOwnEntry(entry, selfStart));
     const existingRoots = existing ? getInstanceRoots(existing) : [];
     const roots = existing?.rootSource === "lsp-fallback" ? existingRoots.slice(1).reduce((acc, root) => mergeInstanceRoots(acc, root), [normalizedRoot]) : mergeInstanceRoots(existingRoots, normalizedRoot);
+    const holders = existing ? readRootHolders(existing) : {};
+    const settled = settleRootHolders(roots, {
+      ...holders,
+      [HOST_ROOT_HOLDER]: [
+        ...holders[HOST_ROOT_HOLDER] ?? [],
+        normalizedRoot
+      ]
+    });
     const namespace = ownPidNamespace();
     others.push({
       pid,
       ...selfStart === void 0 ? {} : { processStart: selfStart },
       ...namespace === void 0 ? {} : { pidNamespace: namespace },
       startedAt: existing?.startedAt ?? now,
-      projectRoot: roots[0] ?? normalizedRoot,
-      projectRoots: roots,
+      projectRoot: settled.roots[0] ?? normalizedRoot,
+      projectRoots: settled.roots,
+      projectRootHolders: settled.holders,
       lspChildren: existing?.lspChildren ?? [],
       lspChildCount: existing?.lspChildren?.length ?? 0,
       rssBytes: process.memoryUsage().rss,
@@ -4550,8 +4627,16 @@ function resolveWindowsCommandForEnvironment(command, cwd, env) {
 function resolveWindowsCommand(command, cwd, env) {
   return resolveWindowsCommandForEnvironment(command, cwd, env);
 }
-function getSpawnEnvironment(overrides) {
-  return process.platform === "win32" ? mergeWindowsEnvironment(process.env, overrides) : { ...process.env, ...overrides };
+function getSpawnEnvironment(overrides, stripNpmConfig) {
+  const merged = process.platform === "win32" ? mergeWindowsEnvironment(process.env, overrides) : { ...process.env, ...overrides };
+  if (!stripNpmConfig)
+    return merged;
+  const stripped = {};
+  for (const [key, value] of Object.entries(merged)) {
+    if (!/^npm_config_/i.test(key))
+      stripped[key] = value;
+  }
+  return stripped;
 }
 var CMD_UNSAFE_CHARS = /["%!\r\n]/;
 function findCmdUnsafeValue(command, args) {
@@ -4744,7 +4829,7 @@ async function safeSpawnAsync(command, args, options) {
       }
     };
     const isWindows2 = process.platform === "win32";
-    const spawnEnv = getSpawnEnvironment(options?.env);
+    const spawnEnv = getSpawnEnvironment(options?.env, options?.stripNpmConfig);
     const spawnCwd = isWindows2 ? resolveEffectiveWindowsCwd(options?.cwd, spawnEnv) ?? options?.cwd : options?.cwd;
     let spawnCmd = command;
     let spawnArgs = args;
@@ -5228,7 +5313,7 @@ async function findCommandAsync(command) {
   return result.stdout.trim().split("\n")[0] || null;
 }
 function safeSpawn(command, args, options) {
-  const spawnEnv = getSpawnEnvironment(options?.env);
+  const spawnEnv = getSpawnEnvironment(options?.env, options?.stripNpmConfig);
   if (process.platform === "win32") {
     const spawnCwd = resolveEffectiveWindowsCwd(options?.cwd, spawnEnv) ?? options?.cwd;
     const resolved = resolveWindowsCommand(command, options?.cwd, spawnEnv);
@@ -5397,6 +5482,7 @@ export {
   drainProjectDataDirMigrations,
   displayProjectDataPath,
   getGlobalPiLensDir,
+  isPiLensInternalPath,
   EXCLUDED_DIRS,
   getProjectIgnoreMatcher,
   isPathIgnoredByProject,

package/dist/{chunk-T4ERT73Y.js → chunk-CF24OIYI.js}

@@ -6,7 +6,7 @@ import {
 import {
   HOOK_WALL_BUDGET_MS,
   bounded
-} from "./chunk-GUOGVTCQ.js";
+} from "./chunk-52FUZI6K.js";
 import {
   acquireManagedInstallGate,
   commitDurableStoreAsync,
@@ -19,38 +19,39 @@ import {
   refreshManagedTool,
   resolveManagedNpmBinPath,
   verifyToolBinary
-} from "./chunk-OQGFCZJ4.js";
-import "./chunk-RUOG5D2C.js";
+} from "./chunk-66VMUL7Q.js";
+import "./chunk-Q7DUK4LX.js";
 import {
   pmBinary,
   resolveNodePackageManager,
   updateArgs
-} from "./chunk-U3VGR4VU.js";
-import "./chunk-NTUJEGDZ.js";
-import "./chunk-EOKRQ3SA.js";
-import "./chunk-WONERJTP.js";
-import "./chunk-22AVIGXS.js";
-import "./chunk-GVXA6CCE.js";
-import "./chunk-6QIUX4EP.js";
-import "./chunk-VHQLPIRJ.js";
+} from "./chunk-AW7R2GWG.js";
+import "./chunk-RWWYJ623.js";
+import "./chunk-VRZP76YM.js";
+import "./chunk-QOBUHWHX.js";
+import "./chunk-QILIYSJF.js";
+import "./chunk-6C7JWPCP.js";
+import "./chunk-5NGR67U5.js";
 import {
   safeSpawnAsync
-} from "./chunk-VN2AXLEX.js";
+} from "./chunk-C34ZXZ7O.js";
 import "./chunk-BW5KFIQC.js";
 import "./chunk-QYF5S6P6.js";
-import "./chunk-5ZEJHV35.js";
-import "./chunk-DQ2NZ7C4.js";
-import "./chunk-VNMT7C64.js";
+import "./chunk-PHDMFAKM.js";
+import "./chunk-2BBLFX75.js";
+import "./chunk-XVF2VVXP.js";
+import "./chunk-ZANLILYD.js";
 import "./chunk-2EECBNC5.js";
 import {
   recordDegradationOnce
-} from "./chunk-N3YQJI6O.js";
-import "./chunk-O6TQT6RI.js";
-import "./chunk-5THXD6X5.js";
-import "./chunk-UK3CMEAL.js";
+} from "./chunk-JAU72XNY.js";
+import "./chunk-XTMJ7XDT.js";
+import "./chunk-JMYYOTQG.js";
+import "./chunk-QQNQ7SJW.js";
+import "./chunk-AOHZU2BM.js";
 import "./chunk-LJDODBBZ.js";
 import "./chunk-ABBOA7UD.js";
-import "./chunk-Q5U6FMDI.js";
+import "./chunk-N2H3ZPZY.js";
 import "./chunk-NXL4FFQQ.js";
 
 // dist/clients/installer/managed-tool-refresh.js

package/dist/{chunk-NMABWBZN.js → chunk-CHOW74WE.js}

@@ -4,7 +4,7 @@ import {
 } from "./chunk-ABBOA7UD.js";
 import {
   normalizeMapKey
-} from "./chunk-Q5U6FMDI.js";
+} from "./chunk-N2H3ZPZY.js";
 
 // dist/clients/dispatch/fact-store.js
 var capacityEvictionReporter;

package/dist/{chunk-ARFCXG7S.js → chunk-CO2G5PHH.js}

@@ -1,10 +1,10 @@
 import { createRequire as __pilensCreateRequire } from "node:module"; const require = __pilensCreateRequire(import.meta.url);
 import {
   incrementDegradationCount
-} from "./chunk-N3YQJI6O.js";
+} from "./chunk-JAU72XNY.js";
 import {
   logLatency
-} from "./chunk-5THXD6X5.js";
+} from "./chunk-QQNQ7SJW.js";
 
 // dist/clients/bounded-telemetry.js
 var MAX_TRACKED_TURN_CAPS = 64;

package/dist/{chunk-AS44CFQ4.js → chunk-EETY4LF7.js}

@@ -4,29 +4,32 @@ import {
   discoverManagedTool,
   getManagedToolEnvironment,
   resolveAvailableOrInstall
-} from "./chunk-7FBF7NPR.js";
+} from "./chunk-GOYRYZ2R.js";
 import {
   mapWithConcurrency
 } from "./chunk-XIMYZ3JA.js";
 import {
   findNodeToolBinary
-} from "./chunk-U3VGR4VU.js";
+} from "./chunk-AW7R2GWG.js";
+import {
+  getIsolatedNpxSpawnOptions
+} from "./chunk-RWWYJ623.js";
 import {
   createAvailabilityLatch
-} from "./chunk-WONERJTP.js";
+} from "./chunk-VRZP76YM.js";
 import {
   safeSpawnAsync
-} from "./chunk-VN2AXLEX.js";
+} from "./chunk-C34ZXZ7O.js";
 import {
   compareOrdinal,
   recordDegradationOnce
-} from "./chunk-N3YQJI6O.js";
+} from "./chunk-JAU72XNY.js";
 import {
   createSubsystemLogger
-} from "./chunk-O6TQT6RI.js";
+} from "./chunk-XTMJ7XDT.js";
 import {
   isFullyQualified
-} from "./chunk-Q5U6FMDI.js";
+} from "./chunk-N2H3ZPZY.js";
 
 // dist/clients/dependency-checker.js
 import * as fs from "node:fs";
@@ -41,7 +44,12 @@ function buildMadgeArgs(target, projectRoot) {
   return args;
 }
 function parseMadgeCycles(stdout, baseDir, projectRoot) {
-  const parsed = JSON.parse(stdout || "[]");
+  let parsed;
+  try {
+    parsed = JSON.parse(stdout || "[]");
+  } catch (err) {
+    throw new Error(`madge report is not valid JSON: ${err instanceof Error ? err.message : String(err)}`);
+  }
   const cycles = Array.isArray(parsed) ? parsed : [];
   const circular = [];
   const circularFiles = /* @__PURE__ */ new Set();
@@ -446,7 +454,10 @@ var DependencyChecker = class _DependencyChecker {
     try {
       const result = await safeSpawnAsync(cmd, [...prefix, ...buildMadgeArgs(normalized, projectRoot)], {
         timeout: 15e3,
-        cwd: projectRoot
+        // A cache-only npx fallback must not read the project's `.npmrc`
+        // (#4268 acceptance 3); a resolved madge keeps the project cwd.
+        cwd: projectRoot,
+        ...cmd === "npx" ? getIsolatedNpxSpawnOptions() : {}
       });
       if (result.error) {
         this.log(`Check error: ${result.error.message}`);
@@ -661,7 +672,10 @@ var DependencyChecker = class _DependencyChecker {
       const { cmd, prefix } = await this.resolveMadge(projectRoot);
       const result = await safeSpawnAsync(cmd, [...prefix, ...buildMadgeArgs(projectRoot, projectRoot)], {
         timeout: 3e4,
-        cwd: projectRoot
+        // A cache-only npx fallback must not read the project's `.npmrc`
+        // (#4268 acceptance 3); a resolved madge keeps the project cwd.
+        cwd: projectRoot,
+        ...cmd === "npx" ? getIsolatedNpxSpawnOptions() : {}
       });
       if (result.error) {
         this.log(`Scan error: ${result.error.message}`);

package/dist/{chunk-I3R7GKDR.js → chunk-EJIUXPBX.js}

@@ -1,7 +1,7 @@
 import { createRequire as __pilensCreateRequire } from "node:module"; const require = __pilensCreateRequire(import.meta.url);
 import {
   detectFileRole
-} from "./chunk-DQ2NZ7C4.js";
+} from "./chunk-2BBLFX75.js";
 
 // dist/clients/collateral-test-role.js
 function isTestRoleCollateral(filePath) {