pi-lens 4.4.1 → 4.4.3

package/dist/{chunk-KJCWXUUS.js → chunk-724UL2TJ.js}

@@ -1,13 +1,13 @@
 import { createRequire as __pilensCreateRequire } from "node:module"; const require = __pilensCreateRequire(import.meta.url);
 import {
   getGlobalPiLensDir
-} from "./chunk-T54VJRAD.js";
+} from "./chunk-C34ZXZ7O.js";
 import {
   SPECIAL_FILENAMES
-} from "./chunk-64LU2OVH.js";
+} from "./chunk-PHDMFAKM.js";
 import {
   getTurnId
-} from "./chunk-VSMJK3ZJ.js";
+} from "./chunk-AOHZU2BM.js";
 import {
   BoundedFifoMap
 } from "./chunk-ABBOA7UD.js";
@@ -180,6 +180,7 @@ var LANGUAGES = [
     extensions: [".kt", ".kts"],
     grammar: "kotlin"
   },
+  { id: "lean", kind: "lean", extensions: [".lean"] },
   { id: "less", kind: "css", extensions: [".less"] },
   { id: "lua", kind: "lua", extensions: [".lua"], grammar: "lua" },
   { id: "markdown", kind: "markdown", extensions: [".md", ".mdx"] },
@@ -409,7 +410,8 @@ var SCAN_LANGUAGE_PRIORITY = [
   ["json", "jsonc"],
   ["yaml"],
   ["toml"],
-  ["prisma"]
+  ["prisma"],
+  ["lean"]
 ];
 
 export {

package/dist/{chunk-MQA2YBAH.js → chunk-76MWC2K6.js}

@@ -1,17 +1,17 @@
 import { createRequire as __pilensCreateRequire } from "node:module"; const require = __pilensCreateRequire(import.meta.url);
 import {
   extractFactsFromTree
-} from "./chunk-TQFBZVCG.js";
+} from "./chunk-GXW6K4YJ.js";
 import {
   findOwnerName
 } from "./chunk-5W3R6LFT.js";
 import {
   firstChildOfType,
   walk
-} from "./chunk-UEAHAMEI.js";
+} from "./chunk-QHJ6DQ2R.js";
 import {
   isJstsFactFile
-} from "./chunk-64LU2OVH.js";
+} from "./chunk-PHDMFAKM.js";
 
 // dist/clients/dispatch/facts/function-facts.js
 var BOUNDARY_PREFIXES = [

package/dist/{chunk-YLN4K6WD.js → chunk-77M37OKR.js}

@@ -1,27 +1,29 @@
 import { createRequire as __pilensCreateRequire } from "node:module"; const require = __pilensCreateRequire(import.meta.url);
+import {
+  scannerReportParentDir
+} from "./chunk-CSHFH5IN.js";
 import {
   getScratchTreeGlobPatterns,
   nestedWorktreeOffsets
-} from "./chunk-J3FZR3YY.js";
+} from "./chunk-VCHXCQFG.js";
 import {
   SecurityScanClient
-} from "./chunk-5JHXUETW.js";
+} from "./chunk-3EFKIGZN.js";
 import {
   safeSpawnAsync
-} from "./chunk-T54VJRAD.js";
+} from "./chunk-C34ZXZ7O.js";
 import {
   loadPiLensProjectConfig
-} from "./chunk-N2IRDBZI.js";
+} from "./chunk-2BBLFX75.js";
 import {
   incrementDegradationCount
-} from "./chunk-7ELY2CSM.js";
+} from "./chunk-JAU72XNY.js";
 import {
   toPosix
-} from "./chunk-G3RLJYA2.js";
+} from "./chunk-N2H3ZPZY.js";
 
 // dist/clients/trivy-client.js
 import * as fs from "node:fs";
-import * as os from "node:os";
 import * as path from "node:path";
 import { mkdtempSync } from "node:fs";
 var EMPTY_RESULT = {
@@ -178,7 +180,7 @@ var TrivyClient = class extends SecurityScanClient {
     const scannedAt = (/* @__PURE__ */ new Date()).toISOString();
     const bin = this.binaryPath ?? "trivy";
     const severities = resolveSeverityFloor(cwd);
-    const outDir = mkdtempSync(path.join(os.tmpdir(), "pi-lens-trivy-"));
+    const outDir = mkdtempSync(path.join(scannerReportParentDir(), "pi-lens-trivy-"));
     const reportPath = path.join(outDir, "trivy-report.json");
     try {
       const result = await safeSpawnAsync(bin, [

package/dist/{chunk-XHSCVSOL.js → chunk-7DYBLXYA.js}

@@ -2,16 +2,16 @@ import { createRequire as __pilensCreateRequire } from "node:module"; const requ
 import {
   createAvailabilityProbeFlight,
   probeToolAsync
-} from "./chunk-CMU4RMJB.js";
+} from "./chunk-RWWYJ623.js";
 import {
   classifyProbeFailure,
   createAvailabilityLatch,
   logAvailabilityDecision,
   startHostStallSampler
-} from "./chunk-O7HZX7CA.js";
+} from "./chunk-VRZP76YM.js";
 import {
   createGenerationSource
-} from "./chunk-T54VJRAD.js";
+} from "./chunk-C34ZXZ7O.js";
 import {
   createSingleFlight
 } from "./chunk-BW5KFIQC.js";

package/dist/{chunk-OC7LYAU5.js → chunk-AB3YYG6N.js}

@@ -4,29 +4,32 @@ import {
   discoverManagedTool,
   getManagedToolEnvironment,
   resolveAvailableOrInstall
-} from "./chunk-NFXP47RV.js";
+} from "./chunk-YSZNHOBY.js";
 import {
   mapWithConcurrency
 } from "./chunk-XIMYZ3JA.js";
 import {
   findNodeToolBinary
-} from "./chunk-T4QZ6FEH.js";
+} from "./chunk-AW7R2GWG.js";
+import {
+  getIsolatedNpxSpawnOptions
+} from "./chunk-RWWYJ623.js";
 import {
   createAvailabilityLatch
-} from "./chunk-O7HZX7CA.js";
+} from "./chunk-VRZP76YM.js";
 import {
   safeSpawnAsync
-} from "./chunk-T54VJRAD.js";
+} from "./chunk-C34ZXZ7O.js";
 import {
   compareOrdinal,
   recordDegradationOnce
-} from "./chunk-7ELY2CSM.js";
+} from "./chunk-JAU72XNY.js";
 import {
   createSubsystemLogger
-} from "./chunk-34OCDWOS.js";
+} from "./chunk-XTMJ7XDT.js";
 import {
   isFullyQualified
-} from "./chunk-G3RLJYA2.js";
+} from "./chunk-N2H3ZPZY.js";
 
 // dist/clients/dependency-checker.js
 import * as fs from "node:fs";
@@ -41,7 +44,12 @@ function buildMadgeArgs(target, projectRoot) {
   return args;
 }
 function parseMadgeCycles(stdout, baseDir, projectRoot) {
-  const parsed = JSON.parse(stdout || "[]");
+  let parsed;
+  try {
+    parsed = JSON.parse(stdout || "[]");
+  } catch (err) {
+    throw new Error(`madge report is not valid JSON: ${err instanceof Error ? err.message : String(err)}`);
+  }
   const cycles = Array.isArray(parsed) ? parsed : [];
   const circular = [];
   const circularFiles = /* @__PURE__ */ new Set();
@@ -446,7 +454,10 @@ var DependencyChecker = class _DependencyChecker {
     try {
       const result = await safeSpawnAsync(cmd, [...prefix, ...buildMadgeArgs(normalized, projectRoot)], {
         timeout: 15e3,
-        cwd: projectRoot
+        // A cache-only npx fallback must not read the project's `.npmrc`
+        // (#4268 acceptance 3); a resolved madge keeps the project cwd.
+        cwd: projectRoot,
+        ...cmd === "npx" ? getIsolatedNpxSpawnOptions() : {}
       });
       if (result.error) {
         this.log(`Check error: ${result.error.message}`);
@@ -661,7 +672,10 @@ var DependencyChecker = class _DependencyChecker {
       const { cmd, prefix } = await this.resolveMadge(projectRoot);
       const result = await safeSpawnAsync(cmd, [...prefix, ...buildMadgeArgs(projectRoot, projectRoot)], {
         timeout: 3e4,
-        cwd: projectRoot
+        // A cache-only npx fallback must not read the project's `.npmrc`
+        // (#4268 acceptance 3); a resolved madge keeps the project cwd.
+        cwd: projectRoot,
+        ...cmd === "npx" ? getIsolatedNpxSpawnOptions() : {}
       });
       if (result.error) {
         this.log(`Scan error: ${result.error.message}`);

package/dist/{chunk-LD7WFTRX.js → chunk-ACXEQZOU.js}

@@ -1,27 +1,23 @@
 import { createRequire as __pilensCreateRequire } from "node:module"; const require = __pilensCreateRequire(import.meta.url);
 import {
   resolveToolCwd
-} from "./chunk-IUR76K6A.js";
+} from "./chunk-Q7DUK4LX.js";
 import {
   allAvailableGlobalBinDirs,
   installArgs,
   pmBinary,
   resolveNodePackageManager
-} from "./chunk-T4QZ6FEH.js";
-import {
-  assertInstallAllowed,
-  projectTrustDenialReason
-} from "./chunk-D6YF5HKX.js";
+} from "./chunk-AW7R2GWG.js";
 import {
   probeToolAsync
-} from "./chunk-CMU4RMJB.js";
+} from "./chunk-RWWYJ623.js";
 import {
   TRANSIENT_MAX_COOLDOWN_MS,
   classifyProbeFailure,
   createAvailabilityLatch,
   logAvailabilityDecision,
   startHostStallSampler
-} from "./chunk-O7HZX7CA.js";
+} from "./chunk-VRZP76YM.js";
 import {
   acquireBoundedPidFileLock,
   acquireQuarantinePidFileLock,
@@ -37,7 +33,11 @@ import {
   safeSpawnAsync,
   startGenerationHeartbeat,
   tryAcquireGeneration
-} from "./chunk-T54VJRAD.js";
+} from "./chunk-C34ZXZ7O.js";
+import {
+  assertInstallAllowed,
+  projectTrustDenialReason
+} from "./chunk-ZANLILYD.js";
 import {
   DEFAULT_MAX_OUTPUT_BYTES,
   createBoundedOutputSink,
@@ -48,23 +48,23 @@ import {
   getDegradationLedgerGeneration,
   incrementDegradationCount,
   recordDegradationOnce
-} from "./chunk-7ELY2CSM.js";
+} from "./chunk-JAU72XNY.js";
 import {
   logExtension
-} from "./chunk-34OCDWOS.js";
+} from "./chunk-XTMJ7XDT.js";
 import {
   createNdjsonLogger,
   getGlobalPiLensLogDir,
   getMaxLogSizeMB,
   isTestMode
-} from "./chunk-VSMJK3ZJ.js";
+} from "./chunk-AOHZU2BM.js";
 import {
   BoundedLruCache
 } from "./chunk-ABBOA7UD.js";
 import {
   findLocalToolConfig,
   isFullyQualified
-} from "./chunk-G3RLJYA2.js";
+} from "./chunk-N2H3ZPZY.js";
 import {
   __require
 } from "./chunk-NXL4FFQQ.js";
@@ -4057,7 +4057,7 @@ async function stampInstallResolution(toolId) {
     return;
   try {
     const resolutionId = lastInstallResolutionId.get(toolId);
-    const refresh = await import("./chunk-CBD2B5CP.js");
+    const refresh = await import("./chunk-5UCAH366.js");
     await refresh.stampManagedToolInstall(toolId, resolutionId);
   } catch {
   }
@@ -4070,7 +4070,7 @@ async function finishInstallAttempt(toolId, ok, startedAt) {
   if (ok) {
     resetSafeSpawnWindowsCommandCache();
     try {
-      const { resetMadgeManagedPathMemo } = await import("./chunk-WPE5FPGR.js");
+      const { resetMadgeManagedPathMemo } = await import("./chunk-EC47DWFA.js");
       resetMadgeManagedPathMemo();
     } catch (err) {
       logSessionStart(`auto-install ${toolId}: madge memo reset failed: ${err.message}`);
@@ -4100,7 +4100,7 @@ async function installTool(toolId, ownsLock) {
           return false;
         const npmPath = await installNpmTool(tool.id, tool.packageName, tool.binaryName, tool.checkArgs, getToolVerificationTimeout(tool), packageEntryVerification(tool), ownsLock);
         if (npmPath !== void 0) {
-          await import("./chunk-CBD2B5CP.js").then((m) => m.stampManagedToolInstalled(tool.id, tool.packageName)).catch(() => {
+          await import("./chunk-5UCAH366.js").then((m) => m.stampManagedToolInstalled(tool.id, tool.packageName)).catch(() => {
           });
         }
         return finishInstallAttempt(tool.id, npmPath !== void 0, startedAt);

package/dist/{chunk-VSMJK3ZJ.js → chunk-AOHZU2BM.js}

@@ -3,7 +3,7 @@ import {
   isUnderDir,
   normalizeFilePath,
   pathsEqual
-} from "./chunk-G3RLJYA2.js";
+} from "./chunk-N2H3ZPZY.js";
 
 // dist/clients/env-utils.js
 function isTestMode() {

package/dist/{chunk-T4QZ6FEH.js → chunk-AW7R2GWG.js}

@@ -2,27 +2,38 @@ import { createRequire as __pilensCreateRequire } from "node:module"; const requ
 import {
   createAvailabilityProbeFlight,
   probeToolAsync
-} from "./chunk-CMU4RMJB.js";
+} from "./chunk-RWWYJ623.js";
 import {
   classifyProbeFailure,
   createAvailabilityLatch,
   isTransientDecision,
   logAvailabilityDecision,
   startHostStallSampler
-} from "./chunk-O7HZX7CA.js";
+} from "./chunk-VRZP76YM.js";
 import {
   createGenerationSource,
   safeSpawnAsync
-} from "./chunk-T54VJRAD.js";
+} from "./chunk-C34ZXZ7O.js";
+import {
+  getProjectTrustState
+} from "./chunk-ZANLILYD.js";
+import {
+  recordDegradationOnce
+} from "./chunk-JAU72XNY.js";
+import {
+  logExtension
+} from "./chunk-XTMJ7XDT.js";
 import {
   isAtOrAboveHomeDir,
+  isUnderDir,
   walkUpDirs
-} from "./chunk-G3RLJYA2.js";
+} from "./chunk-N2H3ZPZY.js";
 
 // dist/clients/package-manager.js
 import * as fs from "node:fs";
 import * as os from "node:os";
 import * as path from "node:path";
+import { resolve as resolvePath } from "node:path";
 var PREFERENCE = [
   "npm",
   "pnpm",
@@ -254,6 +265,41 @@ var VENV_BIN_DIRS = [
   path.join(".venv", "Scripts"),
   path.join("venv", "Scripts")
 ];
+var PROJECT_LOCAL_BIN_DIRS = [
+  ...NODE_MODULES_BIN_DIRS,
+  ...VENDOR_BIN_DIRS,
+  ...VENV_BIN_DIRS
+];
+function localBinPath(value) {
+  return typeof value === "string" ? value : void 0;
+}
+function refuseLocalBin(tool, root) {
+  const trust = getProjectTrustState();
+  const resolvedRoot = resolvePath(root);
+  const subject = `project-local-binary:${resolvedRoot}:${tool}`;
+  if (recordDegradationOnce({
+    kind: "trust-refusal",
+    subject,
+    reason: `project-local binary refused: pi project trust is ${trust}`
+  })) {
+    logExtension({
+      subsystem: "project-trust",
+      level: "warn",
+      message: "project-local binary refused: mark the project trusted in pi or upgrade pi",
+      metadata: { tool, root: resolvedRoot, trust }
+    });
+  }
+  return { kind: "refused-by-trust", tool, root: resolvedRoot, trust };
+}
+function isProjectLocalBinPath(resolvedCommand, cwd) {
+  for (const ancestor of walkUpDirs(cwd)) {
+    if (isAtOrAboveHomeDir(ancestor, os.homedir()))
+      break;
+    if (PROJECT_LOCAL_BIN_DIRS.some((binDir) => isUnderDir(resolvedCommand, path.join(ancestor, binDir))))
+      return true;
+  }
+  return false;
+}
 function expandCandidateNames(tools, windowsExt, isWindows) {
   return isWindows && windowsExt !== "" ? tools.flatMap((tool) => [`${tool}${windowsExt}`, tool]) : [...tools];
 }
@@ -276,18 +322,27 @@ function* localBinMatches(tools, startDir, options) {
   }
 }
 function findLocalBinUpwards(tool, startDir, options = {}) {
-  return localBinMatches([tool], startDir, options).next().value;
+  const match = localBinMatches([tool], startDir, options).next().value;
+  if (match === void 0 || options.ceiling === false)
+    return match;
+  if (getProjectTrustState() !== "trusted")
+    return refuseLocalBin(tool, startDir);
+  return match;
 }
 function findLocalBinsAt(tools, dir, options = {}) {
   const { windowsExt = ".cmd", binDirs = NODE_MODULES_BIN_DIRS, isWindows = onWindows() } = options;
   const names = expandCandidateNames(tools, windowsExt, isWindows);
-  return [...matchesInDir(path.resolve(dir), names, binDirs)];
+  const matches = [...matchesInDir(path.resolve(dir), names, binDirs)];
+  if (matches.length === 0 || getProjectTrustState() === "trusted")
+    return matches;
+  return [refuseLocalBin(tools.join(","), dir)];
 }
 function findLocalBinAt(tool, dir, options = {}) {
-  return findLocalBinsAt([tool], dir, options)[0];
+  const match = findLocalBinsAt([tool], dir, options)[0];
+  return match;
 }
 async function findNodeToolBinary(tool, cwd, windowsExt = ".cmd") {
-  return findLocalBinUpwards(tool, cwd, { windowsExt }) ?? await findGlobalBinary(tool, windowsExt);
+  return localBinPath(findLocalBinUpwards(tool, cwd, { windowsExt })) ?? await findGlobalBinary(tool, windowsExt);
 }
 
 export {
@@ -301,6 +356,8 @@ export {
   findGlobalBinary,
   VENDOR_BIN_DIRS,
   VENV_BIN_DIRS,
+  localBinPath,
+  isProjectLocalBinPath,
   findLocalBinUpwards,
   findLocalBinsAt,
   findLocalBinAt,

package/dist/{chunk-GAYGGICG.js → chunk-BKE7E7TC.js}

@@ -7,19 +7,20 @@ import {
   loadCallGraph,
   parseSymbolKey,
   saveCallGraph
-} from "./chunk-WW5BLB74.js";
+} from "./chunk-WOA4LN2R.js";
 import "./chunk-3MED75HT.js";
-import "./chunk-T54VJRAD.js";
-import "./chunk-N2IRDBZI.js";
-import "./chunk-Z6BB4JLQ.js";
+import "./chunk-C34ZXZ7O.js";
+import "./chunk-2BBLFX75.js";
+import "./chunk-XVF2VVXP.js";
 import "./chunk-2EECBNC5.js";
-import "./chunk-7ELY2CSM.js";
-import "./chunk-34OCDWOS.js";
-import "./chunk-3PNFWVHT.js";
-import "./chunk-VSMJK3ZJ.js";
+import "./chunk-JAU72XNY.js";
+import "./chunk-XTMJ7XDT.js";
+import "./chunk-JMYYOTQG.js";
+import "./chunk-QQNQ7SJW.js";
+import "./chunk-AOHZU2BM.js";
 import "./chunk-LJDODBBZ.js";
 import "./chunk-ABBOA7UD.js";
-import "./chunk-G3RLJYA2.js";
+import "./chunk-N2H3ZPZY.js";
 import "./chunk-NXL4FFQQ.js";
 export {
   CALL_GRAPH_CACHE_VERSION,

package/dist/{chunk-EUT3B22Y.js → chunk-BRGDSBJE.js}

@@ -3,22 +3,23 @@ import {
   RustClient,
   resetRustAvailability,
   rustClient
-} from "./chunk-3MRXIJ6I.js";
-import "./chunk-XHSCVSOL.js";
-import "./chunk-CMU4RMJB.js";
-import "./chunk-O7HZX7CA.js";
-import "./chunk-T54VJRAD.js";
+} from "./chunk-MRXKYPCS.js";
+import "./chunk-7DYBLXYA.js";
+import "./chunk-RWWYJ623.js";
+import "./chunk-VRZP76YM.js";
+import "./chunk-C34ZXZ7O.js";
 import "./chunk-BW5KFIQC.js";
-import "./chunk-N2IRDBZI.js";
-import "./chunk-Z6BB4JLQ.js";
+import "./chunk-2BBLFX75.js";
+import "./chunk-XVF2VVXP.js";
 import "./chunk-2EECBNC5.js";
-import "./chunk-7ELY2CSM.js";
-import "./chunk-34OCDWOS.js";
-import "./chunk-3PNFWVHT.js";
-import "./chunk-VSMJK3ZJ.js";
+import "./chunk-JAU72XNY.js";
+import "./chunk-XTMJ7XDT.js";
+import "./chunk-JMYYOTQG.js";
+import "./chunk-QQNQ7SJW.js";
+import "./chunk-AOHZU2BM.js";
 import "./chunk-LJDODBBZ.js";
 import "./chunk-ABBOA7UD.js";
-import "./chunk-G3RLJYA2.js";
+import "./chunk-N2H3ZPZY.js";
 import "./chunk-NXL4FFQQ.js";
 export {
   RustClient,

package/dist/{chunk-T54VJRAD.js → chunk-C34ZXZ7O.js}

@@ -12,7 +12,7 @@ import {
   reportPiLensConfigRecords,
   resolveOnePiLensConfigDocument,
   warnIgnoredConfigOnce
-} from "./chunk-N2IRDBZI.js";
+} from "./chunk-2BBLFX75.js";
 import {
   CANONICAL_GLOBAL_CONFIG_FILE,
   FRESHNESS_CADENCE_MS,
@@ -22,7 +22,7 @@ import {
   errorClassName,
   getPiLensGlobalConfigPath,
   getProductionGlobalConfigResolution
-} from "./chunk-Z6BB4JLQ.js";
+} from "./chunk-XVF2VVXP.js";
 import {
   DEFAULT_MAX_OUTPUT_BYTES,
   createBoundedOutputSink,
@@ -42,16 +42,16 @@ import {
   readToolConfig,
   recordDegradation,
   recordDegradationOnce
-} from "./chunk-7ELY2CSM.js";
+} from "./chunk-JAU72XNY.js";
 import {
   logExtension
-} from "./chunk-34OCDWOS.js";
+} from "./chunk-XTMJ7XDT.js";
 import {
   logLatency
-} from "./chunk-3PNFWVHT.js";
+} from "./chunk-QQNQ7SJW.js";
 import {
   getProcessSingleton
-} from "./chunk-VSMJK3ZJ.js";
+} from "./chunk-AOHZU2BM.js";
 import {
   sweepOwnStagingFiles
 } from "./chunk-LJDODBBZ.js";
@@ -71,7 +71,7 @@ import {
   normalizeLoggedPath,
   normalizeMapKey,
   toProjectRelativePath
-} from "./chunk-G3RLJYA2.js";
+} from "./chunk-N2H3ZPZY.js";
 import {
   __commonJS,
   __require,
@@ -1744,6 +1744,15 @@ function loadPiLensGlobalConfig(configPath) {
         warnInvalid("actionableWarnings.autoFix.maxFixes must be a non-negative finite number");
       }
     }
+    const contextInjection = asConfigObject(raw.contextInjection);
+    if (contextInjection && "requirePreExistingFixes" in contextInjection) {
+      if (typeof contextInjection.requirePreExistingFixes === "boolean") {
+        config.contextInjection ??= {};
+        config.contextInjection.requirePreExistingFixes = contextInjection.requirePreExistingFixes;
+      } else {
+        warnInvalid("contextInjection.requirePreExistingFixes must be a boolean");
+      }
+    }
     const widget = asConfigObject(raw.widget);
     if (widget) {
       if (typeof widget.visible === "boolean") {
@@ -1876,6 +1885,17 @@ function classifyTmpDir(dir) {
 function ephemeralStagingRoot(filePath) {
   return classifyTmpDir(path6.dirname(path6.resolve(filePath))).stagingRoot;
 }
+function isPiOwnedTempPath(filePath) {
+  const tmpRoot = realPathOfNearestExisting(os.tmpdir());
+  const real = realPathOfNearestExisting(filePath);
+  if (!isUnderDir(real, tmpRoot))
+    return false;
+  const relative3 = path6.relative(tmpRoot, real);
+  if (relative3.length === 0 || path6.isAbsolute(relative3))
+    return false;
+  const segments = relative3.split(path6.sep);
+  return segments.length === 1 || /^pi-/i.test(segments[0] ?? "");
+}
 function isEphemeralCheckoutRoot(dir) {
   return classifyTmpDir(dir).checkout;
 }
@@ -2049,6 +2069,21 @@ function getGlobalPiLensDir() {
     return path7.resolve(override);
   return path7.join(os2.homedir(), ".pi-lens");
 }
+function isPiLensInternalPath(filePath, projectRoot) {
+  const absolute = path7.resolve(filePath);
+  const home = path7.resolve(os2.homedir());
+  const candidates = [
+    getGlobalPiLensDir(),
+    getProjectDataDir(projectRoot),
+    path7.join(home, ".pi"),
+    path7.join(home, ".pi-lens")
+  ];
+  if (candidates.some((dir) => isUnderDir(absolute, dir)))
+    return true;
+  if (isPiOwnedTempPath(absolute))
+    return true;
+  return false;
+}
 var EXCLUDED_DIRS = [
   "node_modules",
   ".git",
@@ -4592,8 +4627,16 @@ function resolveWindowsCommandForEnvironment(command, cwd, env) {
 function resolveWindowsCommand(command, cwd, env) {
   return resolveWindowsCommandForEnvironment(command, cwd, env);
 }
-function getSpawnEnvironment(overrides) {
-  return process.platform === "win32" ? mergeWindowsEnvironment(process.env, overrides) : { ...process.env, ...overrides };
+function getSpawnEnvironment(overrides, stripNpmConfig) {
+  const merged = process.platform === "win32" ? mergeWindowsEnvironment(process.env, overrides) : { ...process.env, ...overrides };
+  if (!stripNpmConfig)
+    return merged;
+  const stripped = {};
+  for (const [key, value] of Object.entries(merged)) {
+    if (!/^npm_config_/i.test(key))
+      stripped[key] = value;
+  }
+  return stripped;
 }
 var CMD_UNSAFE_CHARS = /["%!\r\n]/;
 function findCmdUnsafeValue(command, args) {
@@ -4786,7 +4829,7 @@ async function safeSpawnAsync(command, args, options) {
       }
     };
     const isWindows2 = process.platform === "win32";
-    const spawnEnv = getSpawnEnvironment(options?.env);
+    const spawnEnv = getSpawnEnvironment(options?.env, options?.stripNpmConfig);
     const spawnCwd = isWindows2 ? resolveEffectiveWindowsCwd(options?.cwd, spawnEnv) ?? options?.cwd : options?.cwd;
     let spawnCmd = command;
     let spawnArgs = args;
@@ -5270,7 +5313,7 @@ async function findCommandAsync(command) {
   return result.stdout.trim().split("\n")[0] || null;
 }
 function safeSpawn(command, args, options) {
-  const spawnEnv = getSpawnEnvironment(options?.env);
+  const spawnEnv = getSpawnEnvironment(options?.env, options?.stripNpmConfig);
   if (process.platform === "win32") {
     const spawnCwd = resolveEffectiveWindowsCwd(options?.cwd, spawnEnv) ?? options?.cwd;
     const resolved = resolveWindowsCommand(command, options?.cwd, spawnEnv);
@@ -5439,6 +5482,7 @@ export {
   drainProjectDataDirMigrations,
   displayProjectDataPath,
   getGlobalPiLensDir,
+  isPiLensInternalPath,
   EXCLUDED_DIRS,
   getProjectIgnoreMatcher,
   isPathIgnoredByProject,

package/dist/{chunk-UGSMCQ4D.js → chunk-CHOW74WE.js}

@@ -4,7 +4,7 @@ import {
 } from "./chunk-ABBOA7UD.js";
 import {
   normalizeMapKey
-} from "./chunk-G3RLJYA2.js";
+} from "./chunk-N2H3ZPZY.js";
 
 // dist/clients/dispatch/fact-store.js
 var capacityEvictionReporter;