pi-lens 4.4.2 → 4.4.3

package/dist/{chunk-XKIZ2HNN.js → chunk-MXGY6KPT.js}

@@ -1,14 +1,17 @@
 import { createRequire as __pilensCreateRequire } from "node:module"; const require = __pilensCreateRequire(import.meta.url);
+import {
+  scannerReportParentDir
+} from "./chunk-CSHFH5IN.js";
 import {
   getScratchTreeDirNames
 } from "./chunk-VCHXCQFG.js";
 import {
   SecurityScanClient
-} from "./chunk-IXXDFY73.js";
-import "./chunk-PNQDPDRC.js";
+} from "./chunk-3EFKIGZN.js";
 import {
   resolveOpengrepConfig
 } from "./chunk-VWCXW2E7.js";
+import "./chunk-PNQDPDRC.js";
 import "./chunk-RWWYJ623.js";
 import "./chunk-VRZP76YM.js";
 import {
@@ -34,7 +37,6 @@ import "./chunk-NXL4FFQQ.js";
 
 // dist/clients/opengrep-client.js
 import * as fs from "node:fs";
-import * as os from "node:os";
 import * as path from "node:path";
 import { mkdtempSync } from "node:fs";
 var EMPTY_RESULT = {
@@ -84,7 +86,7 @@ var OpengrepClient = class _OpengrepClient extends SecurityScanClient {
     const scannedAt = (/* @__PURE__ */ new Date()).toISOString();
     const bin = this.binaryPath ?? "opengrep";
     const resolved = _OpengrepClient.resolveConfig(cwd);
-    const outDir = mkdtempSync(path.join(os.tmpdir(), "pi-lens-opengrep-"));
+    const outDir = mkdtempSync(path.join(scannerReportParentDir(), "pi-lens-opengrep-"));
     const reportPath = path.join(outDir, "opengrep-report.json");
     try {
       const result = await safeSpawnAsync(bin, [

package/dist/{chunk-GHB6AYCP.js → chunk-RXCOMYPY.js}

@@ -52,7 +52,7 @@ import {
   tryLazyInstallFormatterTool,
   typstyleFormatter,
   zigFormatter
-} from "./chunk-ARJ6PLFH.js";
+} from "./chunk-3W7IEVVL.js";
 import "./chunk-OXXKQCSV.js";
 import "./chunk-FC4RP4I2.js";
 import "./chunk-RPLINGVB.js";
@@ -63,7 +63,7 @@ import "./chunk-SAEFPSB6.js";
 import "./chunk-GAEGEPOC.js";
 import "./chunk-Z3CCVDUB.js";
 import "./chunk-2BEMIWEW.js";
-import "./chunk-66VMUL7Q.js";
+import "./chunk-ACXEQZOU.js";
 import "./chunk-Q7DUK4LX.js";
 import "./chunk-AW7R2GWG.js";
 import "./chunk-RWWYJ623.js";

package/dist/{chunk-GZYBXISR.js → chunk-SQ4TVJBR.js}

@@ -1,11 +1,11 @@
 import { createRequire as __pilensCreateRequire } from "node:module"; const require = __pilensCreateRequire(import.meta.url);
-import {
-  SecurityScanClient
-} from "./chunk-IXXDFY73.js";
 import {
   firstOutputLine,
   spawnFailedWithNoOutput
 } from "./chunk-UZ3TUTRV.js";
+import {
+  SecurityScanClient
+} from "./chunk-3EFKIGZN.js";
 import {
   probeToolAsync
 } from "./chunk-RWWYJ623.js";

package/dist/{chunk-VITUCP5A.js → chunk-SS36ZX4J.js}

@@ -1,4 +1,7 @@
 import { createRequire as __pilensCreateRequire } from "node:module"; const require = __pilensCreateRequire(import.meta.url);
+import {
+  scannerReportParentDir
+} from "./chunk-CSHFH5IN.js";
 import {
   getSecretsLaneAllowlistPaths,
   isUnderSecretsLaneScratchTree,
@@ -6,7 +9,7 @@ import {
 } from "./chunk-VCHXCQFG.js";
 import {
   SecurityScanClient
-} from "./chunk-IXXDFY73.js";
+} from "./chunk-3EFKIGZN.js";
 import {
   collectTrackedFiles,
   collectUntrackedIgnoredIds,
@@ -22,7 +25,6 @@ import {
 
 // dist/clients/gitleaks-client.js
 import * as fs from "node:fs";
-import * as os from "node:os";
 import * as path from "node:path";
 import { mkdtempSync } from "node:fs";
 var EMPTY_RESULT = {
@@ -185,7 +187,7 @@ var GitleaksClient = class _GitleaksClient extends SecurityScanClient {
   async runScan(cwd) {
     const scannedAt = (/* @__PURE__ */ new Date()).toISOString();
     const bin = this.binaryPath ?? "gitleaks";
-    const outDir = mkdtempSync(path.join(os.tmpdir(), "pi-lens-gitleaks-"));
+    const outDir = mkdtempSync(path.join(scannerReportParentDir(), "pi-lens-gitleaks-"));
     const reportPath = path.join(outDir, "gitleaks-report.json");
     try {
       const configPath = writeScopedGitleaksConfig(outDir, cwd);

package/dist/{chunk-PFNSLWU5.js → chunk-T6CPIZNT.js}

@@ -2,13 +2,14 @@ import { createRequire as __pilensCreateRequire } from "node:module"; const requ
 import {
   createAvailabilityChecker,
   resolveAvailableOrInstall
-} from "./chunk-GOYRYZ2R.js";
+} from "./chunk-YSZNHOBY.js";
 import {
   ruffConfigArgs
 } from "./chunk-RPLINGVB.js";
-import "./chunk-ESBQHFMJ.js";
-import "./chunk-34WSVGEM.js";
+import "./chunk-EU63SDCG.js";
 import "./chunk-VWCXW2E7.js";
+import "./chunk-FCSOVF55.js";
+import "./chunk-PNQDPDRC.js";
 import "./chunk-ZXYDQ3TZ.js";
 import "./chunk-724UL2TJ.js";
 import "./chunk-QOZXJ4NA.js";
@@ -18,7 +19,7 @@ import "./chunk-SAEFPSB6.js";
 import "./chunk-GAEGEPOC.js";
 import "./chunk-Z3CCVDUB.js";
 import "./chunk-2BEMIWEW.js";
-import "./chunk-66VMUL7Q.js";
+import "./chunk-ACXEQZOU.js";
 import {
   resolveToolCwd
 } from "./chunk-Q7DUK4LX.js";

package/dist/{chunk-JWA5I3SR.js → chunk-VCO24T4L.js}

@@ -3,15 +3,13 @@ import {
   stripAnsi
 } from "./chunk-FC4RP4I2.js";
 import {
+  augmentPythonEnvironment,
+  detectPythonEnvironment,
   emitBounded
-} from "./chunk-CO2G5PHH.js";
+} from "./chunk-FCSOVF55.js";
 import {
   resolveGitCheckout
 } from "./chunk-PNQDPDRC.js";
-import {
-  augmentPythonEnvironment,
-  detectPythonEnvironment
-} from "./chunk-34WSVGEM.js";
 import {
   PathKeyedMap
 } from "./chunk-Z3CCVDUB.js";

package/dist/{chunk-Q6ZWTCLY.js → chunk-XAGLWMJ4.js}

@@ -8,11 +8,10 @@ import {
   isExcludedTestTarget,
   isRunnerErrorResult,
   stripWrapperArgs
-} from "./chunk-JWA5I3SR.js";
+} from "./chunk-VCO24T4L.js";
 import "./chunk-FC4RP4I2.js";
-import "./chunk-CO2G5PHH.js";
+import "./chunk-FCSOVF55.js";
 import "./chunk-PNQDPDRC.js";
-import "./chunk-34WSVGEM.js";
 import "./chunk-P7266HLM.js";
 import "./chunk-Z3CCVDUB.js";
 import "./chunk-Q7DUK4LX.js";

package/dist/{chunk-WOKKRCJ5.js → chunk-XIJZVPD5.js}

@@ -7,9 +7,10 @@ import {
   hasGitleaksSignal,
   parseGitleaksReport,
   writeScopedGitleaksConfig
-} from "./chunk-VITUCP5A.js";
+} from "./chunk-SS36ZX4J.js";
+import "./chunk-CSHFH5IN.js";
 import "./chunk-VCHXCQFG.js";
-import "./chunk-IXXDFY73.js";
+import "./chunk-3EFKIGZN.js";
 import "./chunk-PNQDPDRC.js";
 import "./chunk-RWWYJ623.js";
 import "./chunk-VRZP76YM.js";

package/dist/{chunk-7ULNCDCO.js → chunk-YIUAVF7E.js}

@@ -13,15 +13,15 @@ import {
   findManagedNodeToolBinary,
   getManagedToolEnvironment,
   resolveAvailableOrInstall
-} from "./chunk-GOYRYZ2R.js";
+} from "./chunk-YSZNHOBY.js";
 import "./chunk-RPLINGVB.js";
+import "./chunk-EU63SDCG.js";
+import "./chunk-VWCXW2E7.js";
+import "./chunk-FCSOVF55.js";
 import {
   canonicalDirectory,
   listNestedLinkedWorktreeRoots
 } from "./chunk-PNQDPDRC.js";
-import "./chunk-ESBQHFMJ.js";
-import "./chunk-34WSVGEM.js";
-import "./chunk-VWCXW2E7.js";
 import "./chunk-ZXYDQ3TZ.js";
 import "./chunk-724UL2TJ.js";
 import "./chunk-QOZXJ4NA.js";
@@ -33,7 +33,7 @@ import "./chunk-Z3CCVDUB.js";
 import "./chunk-2BEMIWEW.js";
 import {
   logSessionStart
-} from "./chunk-66VMUL7Q.js";
+} from "./chunk-ACXEQZOU.js";
 import "./chunk-Q7DUK4LX.js";
 import {
   findLocalBinUpwards,

package/dist/{chunk-GOYRYZ2R.js → chunk-YSZNHOBY.js}

@@ -6,8 +6,12 @@ import {
 import {
   BUILTIN_SERVER_RUNNER_COVERS,
   getServersForFileWithConfig,
-  isAuxiliary
-} from "./chunk-ESBQHFMJ.js";
+  isAuxiliary,
+  resolveAnalysisRootPath
+} from "./chunk-EU63SDCG.js";
+import {
+  emitBounded
+} from "./chunk-FCSOVF55.js";
 import {
   PathKeyedMap
 } from "./chunk-Z3CCVDUB.js";
@@ -20,7 +24,7 @@ import {
   isSpawnableCommand,
   logSessionStart,
   resetPathWalkMemo
-} from "./chunk-66VMUL7Q.js";
+} from "./chunk-ACXEQZOU.js";
 import {
   resolveToolCwd
 } from "./chunk-Q7DUK4LX.js";
@@ -50,6 +54,7 @@ import {
   createGenerationSource,
   getGlobalPiLensDir,
   isInSpawnTimeoutCooldown,
+  resolveWindowsCommandForEnvironment,
   safeSpawnAsync
 } from "./chunk-C34ZXZ7O.js";
 import {
@@ -60,6 +65,7 @@ import {
   incrementDegradationCount
 } from "./chunk-JAU72XNY.js";
 import {
+  isUnderDir,
   normalizeEphemeralMapKey,
   normalizeMapKey
 } from "./chunk-N2H3ZPZY.js";
@@ -67,6 +73,7 @@ import {
 // dist/clients/dispatch/runners/utils/runner-helpers.js
 import * as fs from "node:fs";
 import * as path from "node:path";
+import { delimiter, resolve as resolveCommandPath } from "node:path";
 import { fileURLToPath } from "node:url";
 function lspPrimaryCoversFile(ctx, runnerId) {
   if (ctx.pi?.getFlag?.("no-lsp"))
@@ -189,14 +196,58 @@ async function findManagedReleaseBinary(tool, verificationArgs = ["--version"])
   const verdict = await verifyManagedCandidate(candidate, verificationArgs);
   return verdict === "ok" || verdict === "unverified" ? candidate : null;
 }
-function createVenvFinder(command, windowsExt = "", verificationArgs = ["--version"]) {
+function resolveAdoptedRootCommand(command, ctx, cwd) {
+  const candidates = managedNodeToolCandidates(command);
+  let selected = candidates.find((candidate) => candidate && fs.existsSync(candidate));
+  if (!selected) {
+    if (process.platform === "win32") {
+      selected = resolveWindowsCommandForEnvironment(command, cwd, process.env)?.resolvedPath;
+    } else {
+      selected = (process.env.PATH ?? "").split(delimiter).map((dir) => resolveCommandPath(cwd, dir, command)).find((candidate) => {
+        try {
+          fs.accessSync(candidate, fs.constants.X_OK);
+          return fs.statSync(candidate).isFile();
+        } catch {
+          return false;
+        }
+      });
+    }
+  }
+  if (!selected)
+    return null;
+  try {
+    const binary = fs.realpathSync.native(selected);
+    const session = ctx.projectRoot ?? ctx.cwd;
+    const adopted = resolveAnalysisRootPath(ctx.filePath, session);
+    if (!adopted)
+      return null;
+    const roots = [adopted, session].map((root) => fs.realpathSync.native(root));
+    if (roots.some((root) => binary === root || isUnderDir(binary, root) || isUnderDir(selected, root))) {
+      emitBounded("adopted_root_binary_refused", `${ctx.filePath}:${command}:${binary}`, {
+        filePath: ctx.filePath,
+        durationMs: 0,
+        metadata: { command, binary }
+      }, {
+        ledgerKind: "adopted-root-binary-refused",
+        risingEdgePer: "identity"
+      });
+      return null;
+    }
+    return binary;
+  } catch {
+    return null;
+  }
+}
+function createVenvFinder(command, windowsExt = "", verificationArgs = ["--version"], allowProjectLocal = true) {
   return async (cwd) => {
-    const venvBin = localBinPath(findLocalBinAt(command, cwd, {
-      windowsExt,
-      binDirs: VENV_BIN_DIRS
-    }));
-    if (venvBin)
-      return { path: venvBin, rung: "venv" };
+    if (allowProjectLocal) {
+      const venvBin = localBinPath(findLocalBinAt(command, cwd, {
+        windowsExt,
+        binDirs: VENV_BIN_DIRS
+      }));
+      if (venvBin)
+        return { path: venvBin, rung: "venv" };
+    }
     const managed = await findManagedNodeToolBinary(command, verificationArgs);
     if (managed)
       return { path: managed, rung: "managed-dir" };
@@ -434,7 +485,7 @@ function createAvailabilityChecker(command, windowsExt = "", versionArgs = ["--v
   const inFlightByCwd = new PathKeyedMap(normalizeEphemeralMapKey);
   let checkerGeneration = availabilityGeneration.current();
   let checkerFlightGeneration = 0;
-  const findCommand = createVenvFinder(command, windowsExt, versionArgs);
+  const findCommand = createVenvFinder(command, windowsExt, versionArgs, options.allowProjectLocal !== false);
   function ensureCurrentGeneration() {
     if (checkerGeneration === availabilityGeneration.current())
       return;
@@ -982,6 +1033,7 @@ export {
   lspPrimaryCoversFile,
   coveringLaneAvailable,
   findManagedNodeToolBinary,
+  resolveAdoptedRootCommand,
   resolveManagedToolClient,
   getManagedToolEnvironment,
   discoverManagedTool,