fix: harden 4 medium-severity edge cases + 13 new tests (245 total)

1. scanWorkspace single-flight guard. The user-initiated 'Scan
   workspace' and 'Refresh Findings' commands both call scanWorkspace;
   a double-click of one (or scan + refresh in quick succession) used
   to spawn two concurrent progress notifications iterating the same
   URI list. A module-level in-flight flag now collapses every
   concurrent call to one scan; the second caller returns
   skippedAsBusy: true and (in noisy mode) surfaces a friendly
   'already in progress' info toast.
2. installInTerminal reuses any live 'Pipeline-Check install'
   terminal instead of stacking identical ones in the dropdown.
   Exited terminals (exitStatus set) are treated as dead and a fresh
   one takes their place.
3. scan-on-save short-circuits when the saved file's provider is in
   `pipelineCheck.disabledProviders`. The scanOnSave dep
   `isPipelineFile` was renamed to `shouldScanOnSave` and now bundles
   the path-classifier with the disabled-provider check. Saving a
   Dockerfile with `dockerfile` disabled used to trigger a full
   workspace re-open whose findings the middleware would just drop.
4. whatsNew rc → ga transition. Per semver §11 a pre-release version
   is LOWER precedence than the corresponding release. The previous
   compare stripped the suffix and treated `1.0.0-rc.1` and `1.0.0`
   as equal, so pre-release testers missed the GA toast. Now compares
   pre-release suffixes lexicographically when core triples match.

Tests: +13 (232 → 245).
- workspaceScan: +5 busy-guard tests (skippedAsBusy result shape,
  noisy-toast surfaces it, quiet-mode silences it, finally releases
  on throw, preconditions don't lock the flag)
- install: +4 terminal-reuse tests (second call reuses, show + sendText
  still fire, exited terminal triggers fresh, foreign-name terminals
  ignored)
- whatsNew: replaced one stale "strip suffix" test with 4 semver-correct
  tests (rc → ga is upgrade, ga → rc is downgrade, rc → rc lexicographic,
  higher core triple wins)
- scanOnSave: replaced the dep-name test with one for live disabled
  re-evaluation

Stub additions: __stubLiveTerminals (terminal roster for the reuse
lookup) and __stubOpenTextDocumentGate (controllable pause inside
openTextDocument so the busy-guard test can interleave a second
scan call mid-loop).

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

Author: dmartinochoa

CHANGELOG.md

@@ -13,6 +13,31 @@ versions follow [SemVer](https://semver.org/).
 
 ## [Unreleased]
 
+### Fixed (round 2: medium-severity batch)
+
+- **Two scan-workspace runs in parallel no longer spawn two
+  notifications.** A module-level in-flight guard collapses every
+  concurrent `scanWorkspace` caller to one scan. A second call (from
+  a double-clicked button, or scan + refresh) returns immediately
+  with `skippedAsBusy: true` and, in noisy mode, surfaces a
+  "scan already in progress" info toast.
+- **`installInTerminal` reuses the existing "Pipeline-Check install"
+  terminal.** Repeated clicks on the welcome-panel CTA used to stack
+  identical terminals in the dropdown. Now the second click reuses
+  the live terminal; an exited terminal is treated as dead and a
+  fresh one takes its place.
+- **`scan-on-save` short-circuits when the saved file's provider is
+  disabled.** Saving a Dockerfile in a workspace that has
+  `dockerfile` in `pipelineCheck.disabledProviders` used to trigger
+  a full workspace re-open even though every published diagnostic
+  would be dropped by the middleware. The handler now consults the
+  live `disabledProviders` setting and skips the scan.
+- **`whatsNew` rc → ga transition is no longer silently swallowed.**
+  Per semver §11 a pre-release version is LOWER precedence than the
+  corresponding release. The previous version-compare stripped the
+  suffix and treated `1.0.0-rc.1` and `1.0.0` as equal, so
+  pre-release testers never saw the "What's New" toast for the GA.
+
 ### Fixed
 
 - **Welcome panel stops lying after an LSP crash.** Subscribe to

src/__testStubs__/vscode.ts

@@ -90,9 +90,26 @@ declare global {
   // URI strings that `openTextDocument` should reject for (simulating
   // a read error / unsupported encoding). All other URIs resolve.
   var __stubOpenTextDocumentFailures: Set<string> | undefined;
+  // Optional gate the openTextDocument stub awaits before resolving.
+  // Tests that want to inspect mid-scan state (e.g. the in-flight
+  // busy-guard test) set this to a Promise they control, kick off
+  // scanWorkspace, then interrogate state while the open is paused.
+  var __stubOpenTextDocumentGate: Promise<unknown> | undefined;
   // When true, `withProgress` reports cancellation back to the task
   // immediately. Used by the scanWorkspace cancellation test.
   var __stubProgressCancelled: boolean | undefined;
+  // Live terminals roster surfaced via `vscode.window.terminals`. The
+  // stub auto-pushes any createTerminal result here; tests can also
+  // pre-populate to simulate a pre-existing (or exited) terminal.
+  var __stubLiveTerminals:
+    | Array<{
+        name: string;
+        exitStatus: { code: number | undefined } | undefined;
+        show: () => void;
+        sendText: (text: string, addNewLine?: boolean) => void;
+        dispose: () => void;
+      }>
+    | undefined;
   var __stubCalls: StubCalls | undefined;
 }
 
@@ -126,7 +143,9 @@ export function resetStubState(): void {
   globalThis.__stubFindFilesByPattern = undefined;
   globalThis.__stubWorkspaceFolders = undefined;
   globalThis.__stubOpenTextDocumentFailures = undefined;
+  globalThis.__stubOpenTextDocumentGate = undefined;
   globalThis.__stubProgressCancelled = undefined;
+  globalThis.__stubLiveTerminals = undefined;
   globalThis.__stubCalls = {
     findFiles: [],
     terminals: [],
@@ -277,13 +296,20 @@ export function vscodeStub(): Record<string, unknown> {
       // Resolves with a minimal TextDocument-shaped object for any
       // URI not listed in `__stubOpenTextDocumentFailures`, where it
       // rejects instead. scanWorkspace counts those rejections as
-      // `failed` without aborting the rest of the scan.
-      openTextDocument: (uri: { toString: () => string }) => {
+      // `failed` without aborting the rest of the scan. When
+      // `__stubOpenTextDocumentGate` is set, the resolution awaits
+      // it first — that lets tests interleave a second scan call
+      // mid-loop to exercise the in-flight busy guard.
+      openTextDocument: async (uri: { toString: () => string }) => {
         const key = uri.toString();
         if (globalThis.__stubOpenTextDocumentFailures?.has(key)) {
-          return Promise.reject(new Error(`stub: open failed for ${key}`));
+          throw new Error(`stub: open failed for ${key}`);
+        }
+        const gate = globalThis.__stubOpenTextDocumentGate;
+        if (gate) {
+          await gate;
         }
-        return Promise.resolve({ uri });
+        return { uri };
       },
     },
     languages: {
@@ -319,9 +345,18 @@ export function vscodeStub(): Record<string, unknown> {
       openExternal: () => Promise.resolve(true),
     },
     window: {
+      // Live terminals roster used by code that walks
+      // `vscode.window.terminals` (e.g. installInTerminal's reuse
+      // check). Tests can pre-populate this slot to simulate a
+      // pre-existing terminal; createTerminal pushes into it.
+      get terminals() {
+        return globalThis.__stubLiveTerminals ?? [];
+      },
       // Terminal factory captures the name and returns a stub whose
-      // show/sendText calls land on the shared slot. Each call returns
-      // a fresh terminal with its own observation buffer.
+      // show/sendText calls land on the shared slot. The returned
+      // terminal is ALSO pushed onto the live `terminals` roster so
+      // an installInTerminal-style reuse lookup finds it. Each call
+      // returns a fresh terminal with its own observation buffer.
       createTerminal: (name: string) => {
         const sent: Array<{ text: string; addNewLine: boolean }> = [];
         const record = {
@@ -330,18 +365,30 @@ export function vscodeStub(): Record<string, unknown> {
           sent,
         };
         ensureCalls().terminals.push(record);
-        return {
+        const terminal: {
+          name: string;
+          exitStatus: { code: number | undefined } | undefined;
+          show: () => void;
+          sendText: (text: string, addNewLine?: boolean) => void;
+          dispose: () => void;
+        } = {
           name,
+          // Undefined => alive. Tests can mutate this slot directly
+          // (or pre-populate __stubLiveTerminals with a closed one)
+          // to exercise the exited-terminal path.
+          exitStatus: undefined,
           show: () => {
-            // Mutate the captured record so tests see `shown: true`
-            // without having to drill into a closure.
             (record as { shown: boolean }).shown = true;
           },
           sendText: (text: string, addNewLine?: boolean) => {
             sent.push({ text, addNewLine: addNewLine ?? true });
           },
           dispose: () => undefined,
         };
+        const roster = globalThis.__stubLiveTerminals ?? [];
+        roster.push(terminal);
+        globalThis.__stubLiveTerminals = roster;
+        return terminal;
       },
       createStatusBarItem: (
         _alignment?: number,

src/extension.ts

@@ -483,7 +483,20 @@ export async function activate(
       vscode.workspace
         .getConfiguration("pipelineCheck")
         .get<boolean>("scanOnSave", false),
-    isPipelineFile: (fsPath) => providerForPath(fsPath) !== undefined,
+    // Trigger a scan only when the saved file is (a) something
+    // Pipeline-Check actually scans and (b) belongs to a provider
+    // the user has NOT silenced. Saving a Dockerfile in a workspace
+    // that has `dockerfile` in `disabledProviders` should be a
+    // no-op: re-scanning would just produce a publish the
+    // middleware drops on arrival.
+    shouldScanOnSave: (fsPath) => {
+      const provider = providerForPath(fsPath);
+      if (!provider) return false;
+      const disabled = vscode.workspace
+        .getConfiguration("pipelineCheck")
+        .get<string[]>("disabledProviders", []);
+      return !disabled.includes(provider);
+    },
     scan: () => scanWorkspace({ quiet: true }),
   });
   context.subscriptions.push(vscode.workspace.onDidSaveTextDocument(onSave));

src/install.test.ts

@@ -62,6 +62,69 @@ describe("installInTerminal", () => {
     installInTerminal();
     expect(globalThis.__stubCalls?.clipboardWrites).toEqual([]);
   });
+
+  it("reuses the existing 'Pipeline-Check install' terminal on a second call", () => {
+    // A user who clicks "Install in terminal" twice — once from the
+    // welcome panel, then again from the LSP-failure toast — used to
+    // get two identical terminals stacked in the dropdown. Now the
+    // second call surfaces the same terminal. The createTerminal
+    // call count is the canonical assertion.
+    const first = installInTerminal();
+    const second = installInTerminal();
+    expect(second).toBe(first);
+    expect(globalThis.__stubCalls?.terminals).toHaveLength(1);
+  });
+
+  it("the reused terminal still gets show() + sendText() so it's visible and primed", () => {
+    installInTerminal();
+    installInTerminal();
+    const t = globalThis.__stubCalls!.terminals[0];
+    expect(t.shown).toBe(true);
+    // sendText fired twice (once per call); the same command text.
+    expect(t.sent).toHaveLength(2);
+    expect(t.sent[0].text).toBe(PIP_INSTALL_COMMAND);
+    expect(t.sent[1].text).toBe(PIP_INSTALL_COMMAND);
+  });
+
+  it("treats an exited terminal as dead and creates a fresh one", () => {
+    // A user closed the prior install terminal after running pip,
+    // then triggered the install again. Reusing the dead terminal
+    // would silently fail (sendText is a no-op on an exited
+    // pty); a fresh one is the right answer.
+    const first = installInTerminal();
+    // Simulate the user closing the terminal: mark the live entry
+    // as exited.
+    const live = globalThis.__stubLiveTerminals?.[0];
+    if (live) live.exitStatus = { code: 0 };
+    const second = installInTerminal();
+    expect(second).not.toBe(first);
+    expect(globalThis.__stubCalls?.terminals).toHaveLength(2);
+  });
+
+  it("ignores other terminals whose name differs", () => {
+    // A user's `bash` / `python REPL` terminal must not be hijacked
+    // by the install command. Only terminals named exactly
+    // 'Pipeline-Check install' qualify for reuse.
+    // Pre-populate the live roster with a same-named-but-foreign
+    // terminal... actually the simpler check: a foreign terminal
+    // with a different name must not be reused.
+    globalThis.__stubLiveTerminals = [
+      {
+        name: "bash",
+        exitStatus: undefined,
+        show: () => undefined,
+        sendText: () => undefined,
+        dispose: () => undefined,
+      },
+    ];
+    installInTerminal();
+    // createTerminal was called (because the bash terminal didn't
+    // match by name), and the resulting terminal is the one we just
+    // sent the command to.
+    const terminals = globalThis.__stubCalls?.terminals ?? [];
+    expect(terminals).toHaveLength(1);
+    expect(terminals[0].name).toBe("Pipeline-Check install");
+  });
 });
 
 describe("copyInstallCommandToClipboard", () => {

src/install.ts

@@ -10,19 +10,28 @@ const TERMINAL_NAME = "Pipeline-Check install";
 const CONFIRM_TTL_MS = 2500;
 
 /**
- * Open a new integrated terminal, type the pip install command, and
+ * Open the integrated terminal, type the pip install command, and
  * focus the terminal — but do NOT press Enter. The user reviews the
  * command (and activates their conda env / venv first when relevant)
  * before running it. Auto-running here would install into whatever
  * Python the shell's default `pip` points at — usually wrong when the
  * user has a project venv they haven't activated yet.
  *
+ * Reuses any existing "Pipeline-Check install" terminal that is still
+ * alive (`exitStatus === undefined`) so repeated clicks on the
+ * welcome-panel CTA don't stack identical terminals in the dropdown.
+ * A terminal the user already closed (exitStatus is set) is treated
+ * as dead and a fresh one takes its place.
+ *
  * Pulled out as a module-level function (rather than an extension-
  * internal closure) so the welcome-panel command, the LSP-failure
  * toast, and the test suite all hit the same code path.
  */
 export function installInTerminal(): vscode.Terminal {
-  const terminal = vscode.window.createTerminal(TERMINAL_NAME);
+  const existing = vscode.window.terminals.find(
+    (t) => t.name === TERMINAL_NAME && t.exitStatus === undefined,
+  );
+  const terminal = existing ?? vscode.window.createTerminal(TERMINAL_NAME);
   terminal.show();
   // The second argument to sendText is `addNewLine`; passing `false`
   // suppresses the Enter press, which is the whole point.

src/scanOnSave.test.ts

@@ -31,7 +31,7 @@ function makeDeps(
   const calls = { scan: 0 };
   const deps: ScanOnSaveDeps = {
     isEnabled: overrides.isEnabled ?? (() => true),
-    isPipelineFile: overrides.isPipelineFile ?? (() => true),
+    shouldScanOnSave: overrides.shouldScanOnSave ?? (() => true),
     scan:
       overrides.scan ??
       (() => {
@@ -55,7 +55,7 @@ describe("createScanOnSaveHandler", () => {
   // The handler closes over a single boolean so the busy semantics
   // and the gate checks can be locked down without a real save
   // stream. The cheap-gates-first ordering (isEnabled before
-  // isPipelineFile before busy) is the contract — it means a
+  // shouldScanOnSave before busy) is the contract — it means a
   // non-CI save in a workspace with scanOnSave off pays only one
   // config read.
 
@@ -66,8 +66,12 @@ describe("createScanOnSaveHandler", () => {
     expect(fake.scanCalls).toBe(0);
   });
 
-  it("returns immediately for non-CI files even when enabled", async () => {
-    const fake = makeDeps({ isPipelineFile: () => false });
+  it("returns immediately when shouldScanOnSave gates the file out", async () => {
+    // shouldScanOnSave returns false for either (a) non-CI files
+    // (package.json, mkdocs.yml, etc.) or (b) CI files whose
+    // provider the user has put in `disabledProviders`. Either way
+    // the handler bails before locking the busy flag.
+    const fake = makeDeps({ shouldScanOnSave: () => false });
     const handler = createScanOnSaveHandler(fake.deps);
     await handler(doc("/repo/package.json"));
     expect(fake.scanCalls).toBe(0);
@@ -120,7 +124,7 @@ describe("createScanOnSaveHandler", () => {
     // rest of the session.
     const deps: ScanOnSaveDeps = {
       isEnabled: () => true,
-      isPipelineFile: () => true,
+      shouldScanOnSave: () => true,
       scan: () => Promise.reject(new Error("transient")),
     };
     const handler = createScanOnSaveHandler(deps);
@@ -131,7 +135,7 @@ describe("createScanOnSaveHandler", () => {
     let secondScanFired = false;
     const handler2 = createScanOnSaveHandler({
       isEnabled: () => true,
-      isPipelineFile: () => true,
+      shouldScanOnSave: () => true,
       scan: () => {
         secondScanFired = true;
         return Promise.resolve();
@@ -158,24 +162,49 @@ describe("createScanOnSaveHandler", () => {
     await inFlight;
   });
 
-  it("checks isEnabled BEFORE isPipelineFile (cheap gate first)", async () => {
+  it("checks isEnabled BEFORE shouldScanOnSave (cheap gate first)", async () => {
     // When scanOnSave is off, we shouldn't even bother classifying
     // the saved path. Locks down the cheap-gates-first ordering so
     // a future refactor doesn't accidentally invert it and add a
     // providerForPath call on every save in a workspace that has
     // scan-on-save disabled.
-    let pipelineFileCalls = 0;
+    let shouldScanCalls = 0;
     const deps: ScanOnSaveDeps = {
       isEnabled: () => false,
-      isPipelineFile: () => {
-        pipelineFileCalls += 1;
+      shouldScanOnSave: () => {
+        shouldScanCalls += 1;
         return true;
       },
       scan: () => Promise.resolve(),
     };
     const handler = createScanOnSaveHandler(deps);
     await handler(doc("/repo/.gitlab-ci.yml"));
-    expect(pipelineFileCalls).toBe(0);
+    expect(shouldScanCalls).toBe(0);
+  });
+
+  it("re-evaluates shouldScanOnSave on every save (disabled-providers can flip)", async () => {
+    // A user updates `pipelineCheck.disabledProviders` mid-session
+    // and saves again; the handler must consult the live value, not
+    // a snapshot taken at construction.
+    let disabled = false;
+    const fake = makeDeps({
+      shouldScanOnSave: () => !disabled,
+    });
+    const handler = createScanOnSaveHandler(fake.deps);
+    const first = handler(doc("/repo/Dockerfile"));
+    fake.scanResolvers[0]();
+    await first;
+    expect(fake.scanCalls).toBe(1);
+    // Now silence the provider.
+    disabled = true;
+    await handler(doc("/repo/Dockerfile"));
+    expect(fake.scanCalls).toBe(1); // no new scan
+    // And unsilence.
+    disabled = false;
+    const third = handler(doc("/repo/Dockerfile"));
+    fake.scanResolvers[1]();
+    await third;
+    expect(fake.scanCalls).toBe(2);
   });
 
   it("each handler instance has its own busy flag (no cross-instance lock)", async () => {