@gobing-ai/ts-rule-engine 0.4.28 → 0.4.30

package/dist/config/extensions.d.ts

@@ -2,14 +2,22 @@ import type { Logger } from '@gobing-ai/ts-infra';
 import type { RuleEngineHost } from '../host/rule-engine-host';
 /** A capability kind a preset extension can contribute. */
 export type ExtensionKind = 'resolvers' | 'evaluators' | 'fixers' | 'formatters';
-/** A single extension module reference, resolved to an absolute path. */
+/**
+ * A single extension module reference: the authored relative path plus the
+ * declaring directory (task 0060 C2). Keeping the authored string means the
+ * shared loader's `assertRelativeExtensionPath` sees the real declaration — a
+ * `..` segment or absolute path is rejected there, not after a basename smash
+ * has already stripped it.
+ */
 export interface ExtensionRef {
     /** Capability registry the module registers into. */
     readonly kind: ExtensionKind;
-    /** Absolute path to the module to import. */
-    readonly absPath: string;
+    /** Relative path as authored (e.g. `./exts/foo.ts`). */
+    readonly path: string;
+    /** Absolute directory the authored `path` is resolved against. */
+    readonly baseDir: string;
     /** Name of the preset that declared this extension (for diagnostics). */
-    readonly presetName: string;
+    readonly sourceName: string;
 }
 /** Options controlling preset-extension loading. */
 export interface LoadExtensionsOptions {
@@ -37,9 +45,11 @@ export interface LoadExtensionsOptions {
 /**
  * Collect extension refs declared by a preset's or rule file's `extensions` block.
  *
- * Paths are resolved relative to the declaring file's directory. Use the returned
- * refs with {@link loadExtensionsIntoHost}. Rule files and presets are treated
- * identically — both flow through the same trust gate at load time.
+ * Paths are kept **as authored** and paired with the declaring file's directory as
+ * `baseDir` — no eager resolution, so the shared loader's traversal guard sees the
+ * real declaration (task 0060 C2). Use the returned refs with
+ * {@link loadExtensionsIntoHost}. Rule files and presets are treated identically —
+ * both flow through the same trust gate at load time.
  */
 export declare function collectExtensions(sourceName: string, sourceDir: string, extensions: Partial<Record<ExtensionKind, string[] | undefined>> | undefined): ExtensionRef[];
 /**

package/dist/config/extensions.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"extensions.d.ts","sourceRoot":"","sources":["../../src/config/extensions.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,qBAAqB,CAAC;AAclD,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,0BAA0B,CAAC;AAC/D,2DAA2D;AAC3D,MAAM,MAAM,aAAa,GAAG,WAAW,GAAG,YAAY,GAAG,QAAQ,GAAG,YAAY,CAAC;AAEjF,yEAAyE;AACzE,MAAM,WAAW,YAAY;IACzB,qDAAqD;IACrD,QAAQ,CAAC,IAAI,EAAE,aAAa,CAAC;IAC7B,6CAA6C;IAC7C,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,yEAAyE;IACzE,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;CAC/B;AAED,oDAAoD;AACpD,MAAM,WAAW,qBAAqB;IAClC;;;;OAIG;IACH,eAAe,CAAC,EAAE,OAAO,CAAC;IAC1B,sEAAsE;IACtE,MAAM,CAAC,EAAE,IAAI,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC9B,oFAAoF;IACpF,YAAY,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;IACrE;;;;;;;;OAQG;IACH,QAAQ,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,MAAM,CAAC;CAC1C;AAUD;;;;;;GAMG;AACH,wBAAgB,iBAAiB,CAC7B,UAAU,EAAE,MAAM,EAClB,SAAS,EAAE,MAAM,EACjB,UAAU,EAAE,OAAO,CAAC,MAAM,CAAC,aAAa,EAAE,MAAM,EAAE,GAAG,SAAS,CAAC,CAAC,GAAG,SAAS,GAC7E,YAAY,EAAE,CAShB;AAED;;;;;;;;;;;;;;;GAeG;AACH,wBAAsB,sBAAsB,CACxC,IAAI,EAAE,cAAc,EACpB,IAAI,EAAE,SAAS,YAAY,EAAE,EAC7B,OAAO,GAAE,qBAA0B,GACpC,OAAO,CAAC,IAAI,CAAC,CAiEf"}
+{"version":3,"file":"extensions.d.ts","sourceRoot":"","sources":["../../src/config/extensions.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,qBAAqB,CAAC;AAOlD,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,0BAA0B,CAAC;AAC/D,2DAA2D;AAC3D,MAAM,MAAM,aAAa,GAAG,WAAW,GAAG,YAAY,GAAG,QAAQ,GAAG,YAAY,CAAC;AAEjF;;;;;;GAMG;AACH,MAAM,WAAW,YAAY;IACzB,qDAAqD;IACrD,QAAQ,CAAC,IAAI,EAAE,aAAa,CAAC;IAC7B,wDAAwD;IACxD,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,kEAAkE;IAClE,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,yEAAyE;IACzE,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;CAC/B;AAED,oDAAoD;AACpD,MAAM,WAAW,qBAAqB;IAClC;;;;OAIG;IACH,eAAe,CAAC,EAAE,OAAO,CAAC;IAC1B,sEAAsE;IACtE,MAAM,CAAC,EAAE,IAAI,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC9B,oFAAoF;IACpF,YAAY,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;IACrE;;;;;;;;OAQG;IACH,QAAQ,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,MAAM,CAAC;CAC1C;AAUD;;;;;;;;GAQG;AACH,wBAAgB,iBAAiB,CAC7B,UAAU,EAAE,MAAM,EAClB,SAAS,EAAE,MAAM,EACjB,UAAU,EAAE,OAAO,CAAC,MAAM,CAAC,aAAa,EAAE,MAAM,EAAE,GAAG,SAAS,CAAC,CAAC,GAAG,SAAS,GAC7E,YAAY,EAAE,CAShB;AAED;;;;;;;;;;;;;;;GAeG;AACH,wBAAsB,sBAAsB,CACxC,IAAI,EAAE,cAAc,EACpB,IAAI,EAAE,SAAS,YAAY,EAAE,EAC7B,OAAO,GAAE,qBAA0B,GACpC,OAAO,CAAC,IAAI,CAAC,CA2Cf"}

package/dist/config/extensions.js

@@ -1,4 +1,4 @@
-import { basenamePath, createNodeFileSystem, dirnamePath, fileUrlToPath, normalizeSeparators, resolvePath, } from '@gobing-ai/ts-runtime';
+import { createNodeFileSystem } from '@gobing-ai/ts-runtime';
 import { loadExtensionModules } from '@gobing-ai/ts-runtime/extension';
 /** Host registries that can receive extension capabilities (all four kinds). */
 const HOST_REGISTRY_BY_KIND = {
@@ -10,9 +10,11 @@ const HOST_REGISTRY_BY_KIND = {
 /**
  * Collect extension refs declared by a preset's or rule file's `extensions` block.
  *
- * Paths are resolved relative to the declaring file's directory. Use the returned
- * refs with {@link loadExtensionsIntoHost}. Rule files and presets are treated
- * identically — both flow through the same trust gate at load time.
+ * Paths are kept **as authored** and paired with the declaring file's directory as
+ * `baseDir` — no eager resolution, so the shared loader's traversal guard sees the
+ * real declaration (task 0060 C2). Use the returned refs with
+ * {@link loadExtensionsIntoHost}. Rule files and presets are treated identically —
+ * both flow through the same trust gate at load time.
  */
 export function collectExtensions(sourceName, sourceDir, extensions) {
     if (extensions === undefined)
@@ -20,7 +22,7 @@ export function collectExtensions(sourceName, sourceDir, extensions) {
     const refs = [];
     for (const kind of ['resolvers', 'evaluators', 'fixers', 'formatters']) {
         for (const path of extensions[kind] ?? []) {
-            refs.push({ kind, presetName: sourceName, absPath: resolvePath(sourceDir, path) });
+            refs.push({ kind, sourceName, path, baseDir: sourceDir });
         }
     }
     return refs;
@@ -44,33 +46,15 @@ export function collectExtensions(sourceName, sourceDir, extensions) {
 export async function loadExtensionsIntoHost(host, refs, options = {}) {
     if (refs.length === 0)
         return;
-    // Normalize file:// URLs to file paths so dirname/basename produce valid
-    // path components that isAbsolute() accepts (e.g. import.meta.url in tests).
-    const toFilePath = (p) => (p.startsWith('file://') ? fileUrlToPath(p) : p);
-    // Defense-in-depth: pre-validate `..` traversal in caller-supplied absPath
-    // before the basename adaptation strips it.  The shared loader's
-    // assertRelativeExtensionPath also runs on the derived (basename) path.
-    for (const ref of refs) {
-        // Split on normalized separators: fileUrlToPath returns forward slashes on
-        // every platform, so a platform SEP split would miss segments on Windows.
-        const segments = normalizeSeparators(toFilePath(ref.absPath)).split('/');
-        if (segments.includes('..')) {
-            throw new Error(`extension path "${ref.absPath}" declared by "${ref.presetName}" must not contain ".." traversal`);
-        }
-    }
-    // Adapt rule-engine ExtensionRef → shared ExtensionRef so the generic loader
-    // governs every import.  The shared loader resolves (baseDir, path) →
-    // absPath internally; we supply dirname/basename so the resolved path
-    // reconstructs the caller's original absPath.
-    const sharedRefs = refs.map((ref) => {
-        const fp = toFilePath(ref.absPath);
-        return {
-            kind: ref.kind,
-            path: `./${basenamePath(fp)}`,
-            baseDir: dirnamePath(fp),
-            sourceName: ref.presetName,
-        };
-    });
+    // Map 1:1 onto the shared ref shape — no dirname/basename smash, so the shared
+    // loader's assertRelativeExtensionPath + realPath confinement govern the authored
+    // path exactly as declared (task 0060 C2).
+    const sharedRefs = refs.map((ref) => ({
+        kind: ref.kind,
+        path: ref.path,
+        baseDir: ref.baseDir,
+        sourceName: ref.sourceName,
+    }));
     const moduleLoader = options.moduleLoader ?? defaultModuleLoader;
     // Real import policy gets real confinement by default (ADR-022 addendum): a
     // caller relying on the default dynamic-import loader that has not set

package/dist/engine.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"engine.d.ts","sourceRoot":"","sources":["../src/engine.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,EAAE,MAAM,qBAAqB,CAAC;AACtE,OAAO,EAAgB,QAAQ,EAAyB,MAAM,qBAAqB,CAAC;AACpF,OAAO,EAAwB,KAAK,UAAU,EAAE,KAAK,eAAe,EAAE,MAAM,uBAAuB,CAAC;AACpG,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,UAAU,CAAC;AACjD,OAAO,EAIH,KAAK,oBAAoB,EAE5B,MAAM,iBAAiB,CAAC;AAEzB,OAAO,EAAE,cAAc,EAAE,MAAM,yBAAyB,CAAC;AACzD,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,uBAAuB,CAAC;AACpE,OAAO,KAAK,EAAqB,cAAc,EAAE,GAAG,EAAE,OAAO,EAAE,gBAAgB,EAAE,aAAa,EAAE,MAAM,SAAS,CAAC;AAGhH,6CAA6C;AAC7C,MAAM,WAAW,iBAAiB;IAC9B,+DAA+D;IAC/D,eAAe,CAAC,EAAE,eAAe,CAAC;IAClC;;;;OAIG;IACH,UAAU,CAAC,EAAE,UAAU,CAAC;IACxB,mCAAmC;IACnC,IAAI,CAAC,EAAE,cAAc,CAAC;IACtB,kEAAkE;IAClE,MAAM,CAAC,EAAE,QAAQ,CAAC,gBAAgB,CAAC,CAAC;IACpC;;;;;OAKG;IACH,YAAY,CAAC,EAAE,QAAQ,CAAC,kBAAkB,CAAC,CAAC;IAC5C,6EAA6E;IAC7E,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,iEAAiE;IACjE,WAAW,CAAC,EAAE,sBAAsB,CAAC;IACrC,8DAA8D;IAC9D,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,2EAA2E;IAC3E,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACrC;AAED,4EAA4E;AAC5E,qBAAa,UAAU;IACnB,2CAA2C;IAC3C,QAAQ,CAAC,IAAI,EAAE,cAAc,CAAC;IAE9B,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAyC;IAChE,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAS;IAChC,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAqC;IACjE,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAS;IAC/B,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAsC;IAC9D,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAa;gBAE5B,OAAO,GAAE,iBAAsB;IAc3C,wCAAwC;IACxC,iBAAiB,CAAC,IAAI,EAAE,MAAM,EAAE,SAAS,EAAE,aAAa,GAAG,IAAI;IAI/D;;;;;;;OAOG;IACG,QAAQ,CACV,KAAK,EAAE,cAAc,EAAE,EACvB,OAAO,EAAE,MAAM,EACf,WAAW,CAAC,EAAE,OAAO,GAAG,SAAS,GAAG,MAAM,GAC3C,OAAO,CAAC,gBAAgB,CAAC;IAI5B;;;;;;;;;;;;;;;;;;OAkBG;IACG,iBAAiB,CACnB,KAAK,EAAE,cAAc,EAAE,EACvB,OAAO,EAAE,MAAM,EACf,UAAU,GAAE,OAAgB,EAC5B,WAAW,CAAC,EAAE,OAAO,GAAG,SAAS,GAAG,MAAM,GAC3C,OAAO,CAAC,gBAAgB,CAAC;IAmK5B;;;;;;;OAOG;IACG,UAAU,CAAC,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,SAAS,GAAG,EAAE,EAAE,MAAM,UAAQ,GAAG,OAAO,CAAC,oBAAoB,CAAC;CAG1G"}
+{"version":3,"file":"engine.d.ts","sourceRoot":"","sources":["../src/engine.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,EAAE,MAAM,qBAAqB,CAAC;AACtE,OAAO,EAAgB,QAAQ,EAAyB,MAAM,qBAAqB,CAAC;AACpF,OAAO,EAAwB,KAAK,UAAU,EAAE,KAAK,eAAe,EAAE,MAAM,uBAAuB,CAAC;AACpG,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,UAAU,CAAC;AACjD,OAAO,EAIH,KAAK,oBAAoB,EAE5B,MAAM,iBAAiB,CAAC;AAEzB,OAAO,EAAE,cAAc,EAAE,MAAM,yBAAyB,CAAC;AACzD,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,uBAAuB,CAAC;AACpE,OAAO,KAAK,EAAqB,cAAc,EAAE,GAAG,EAAE,OAAO,EAAE,gBAAgB,EAAE,aAAa,EAAE,MAAM,SAAS,CAAC;AAGhH,6CAA6C;AAC7C,MAAM,WAAW,iBAAiB;IAC9B,+DAA+D;IAC/D,eAAe,CAAC,EAAE,eAAe,CAAC;IAClC;;;;OAIG;IACH,UAAU,CAAC,EAAE,UAAU,CAAC;IACxB,mCAAmC;IACnC,IAAI,CAAC,EAAE,cAAc,CAAC;IACtB,kEAAkE;IAClE,MAAM,CAAC,EAAE,QAAQ,CAAC,gBAAgB,CAAC,CAAC;IACpC;;;;;OAKG;IACH,YAAY,CAAC,EAAE,QAAQ,CAAC,kBAAkB,CAAC,CAAC;IAC5C,6EAA6E;IAC7E,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,iEAAiE;IACjE,WAAW,CAAC,EAAE,sBAAsB,CAAC;IACrC,8DAA8D;IAC9D,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,2EAA2E;IAC3E,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACrC;AAED,4EAA4E;AAC5E,qBAAa,UAAU;IACnB,2CAA2C;IAC3C,QAAQ,CAAC,IAAI,EAAE,cAAc,CAAC;IAE9B,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAyC;IAChE,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAS;IAChC,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAqC;IACjE,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAS;IAC/B,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAsC;IAC9D,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAa;gBAE5B,OAAO,GAAE,iBAAsB;IAc3C,wCAAwC;IACxC,iBAAiB,CAAC,IAAI,EAAE,MAAM,EAAE,SAAS,EAAE,aAAa,GAAG,IAAI;IAI/D;;;;;;;OAOG;IACG,QAAQ,CACV,KAAK,EAAE,cAAc,EAAE,EACvB,OAAO,EAAE,MAAM,EACf,WAAW,CAAC,EAAE,OAAO,GAAG,SAAS,GAAG,MAAM,GAC3C,OAAO,CAAC,gBAAgB,CAAC;IAI5B;;;;;;;;;;;;;;;;;;OAkBG;IACG,iBAAiB,CACnB,KAAK,EAAE,cAAc,EAAE,EACvB,OAAO,EAAE,MAAM,EACf,UAAU,GAAE,OAAgB,EAC5B,WAAW,CAAC,EAAE,OAAO,GAAG,SAAS,GAAG,MAAM,GAC3C,OAAO,CAAC,gBAAgB,CAAC;IAkL5B;;;;;;;OAOG;IACG,UAAU,CAAC,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,SAAS,GAAG,EAAE,EAAE,MAAM,UAAQ,GAAG,OAAO,CAAC,oBAAoB,CAAC;CAG1G"}

package/dist/engine.js

@@ -81,7 +81,11 @@ export class RuleEngine {
         return await traceAsync('rule.run', async () => {
             this.logger.info('rule run started', { enabled: enabledRules.length, total: rules.length });
             addSpanEvent('rule.run.start', { rules: enabledRules.length, total: rules.length });
-            void this.events?.emit('rule.run.start', { rules: enabledRules.length, total: rules.length });
+            void this.events?.emit('rule.run.start', {
+                rules: enabledRules.length,
+                total: rules.length,
+                severity: 'info',
+            });
             const findings = [];
             const fixes = [];
             let index = 0;
@@ -101,7 +105,12 @@ export class RuleEngine {
                 const evalStartMs = Date.now();
                 this.logger.debug('eval start', { ruleId: rule.id, index, total: enabledRules.length });
                 addSpanEvent('rule.eval.start', { ruleId: rule.id, index, total: enabledRules.length });
-                void this.events?.emit('rule.eval.start', { ruleId: rule.id, index, total: enabledRules.length });
+                void this.events?.emit('rule.eval.start', {
+                    ruleId: rule.id,
+                    index,
+                    total: enabledRules.length,
+                    severity: 'info',
+                });
                 let ruleFindings = [];
                 let ruleEvalFixes = [];
                 let evalError;
@@ -121,7 +130,11 @@ export class RuleEngine {
                         }),
                     ];
                     addSpanEvent('rule.eval.error', { ruleId: rule.id, error: evalError });
-                    void this.events?.emit('rule.eval.error', { ruleId: rule.id, error: evalError });
+                    void this.events?.emit('rule.eval.error', {
+                        ruleId: rule.id,
+                        error: evalError,
+                        severity: 'error',
+                    });
                 }
                 const durationMs = Date.now() - evalStartMs;
                 addSpanEvent('rule.eval.done', {
@@ -134,6 +147,7 @@ export class RuleEngine {
                     findings: ruleFindings.length,
                     durationMs,
                     details: ruleFindings,
+                    severity: 'info',
                 });
                 // Persist eval completion.
                 await this.persistence?.updateEvalRun({
@@ -190,6 +204,7 @@ export class RuleEngine {
                 findings: findings.length,
                 durationMs: runDurationMs,
                 stoppedEarly: stoppedEarlyLocal,
+                severity: 'info',
             });
             // Finalize the run row.
             await this.persistence?.updateRunStatus(this.runId, 'done', findings.length, fixes.length, 0, // appliedFixCount — set by the caller after applying fixes

package/dist/evaluators/file-discovery.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"file-discovery.d.ts","sourceRoot":"","sources":["../../src/evaluators/file-discovery.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,EAGH,KAAK,UAAU,EAIlB,MAAM,uBAAuB,CAAC;AAG/B,yCAAyC;AACzC,MAAM,WAAW,sBAAsB;IACnC,yBAAyB;IACzB,OAAO,EAAE,MAAM,CAAC;IAChB,0CAA0C;IAC1C,OAAO,CAAC,EAAE,MAAM,EAAE,CAAC;IACnB,8BAA8B;IAC9B,OAAO,CAAC,EAAE,MAAM,EAAE,CAAC;IACnB,0BAA0B;IAC1B,EAAE,CAAC,EAAE,UAAU,CAAC;CACnB;AAED;;;;GAIG;AACH,eAAO,MAAM,gBAAgB,aAAgF,CAAC;AAE9G,qFAAqF;AACrF,wBAAsB,aAAa,CAAC,OAAO,EAAE,sBAAsB,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,CAWtF;AAED,gDAAgD;AAChD,wBAAsB,eAAe,CAAC,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,aAAyB,GAAG,OAAO,CAAC,MAAM,CAAC,CAErH;AAED,2DAA2D;AAC3D,MAAM,WAAW,WAAW;IACxB,6BAA6B;IAC7B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,0BAA0B;IAC1B,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;CAC5B;AAED,8EAA8E;AAC9E,MAAM,MAAM,aAAa,GAAG,OAAO,GAAG,MAAM,CAAC;AAE7C,qCAAqC;AACrC,MAAM,WAAW,gBAAgB;IAC7B,iCAAiC;IACjC,OAAO,EAAE,MAAM,CAAC;IAChB,sFAAsF;IACtF,OAAO,CAAC,EAAE,MAAM,EAAE,CAAC;IACnB,yDAAyD;IACzD,OAAO,CAAC,EAAE,MAAM,EAAE,CAAC;IACnB;;;;;;;;OAQG;IACH,SAAS,EAAE,aAAa,CAAC;IACzB,0BAA0B;IAC1B,EAAE,CAAC,EAAE,UAAU,CAAC;CACnB;AAED;;;;;;;;GAQG;AACH,wBAAsB,SAAS,CAAC,OAAO,EAAE,gBAAgB,GAAG,OAAO,CAAC,WAAW,EAAE,CAAC,CAWjF;AAeD,sDAAsD;AACtD,wBAAgB,iBAAiB,CAAC,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,MAAM,CAEvE;AAED,2DAA2D;AAC3D,wBAAgB,cAAc,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAGnD"}
+{"version":3,"file":"file-discovery.d.ts","sourceRoot":"","sources":["../../src/evaluators/file-discovery.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,EAGH,KAAK,UAAU,EAIlB,MAAM,uBAAuB,CAAC;AAG/B,yCAAyC;AACzC,MAAM,WAAW,sBAAsB;IACnC,yBAAyB;IACzB,OAAO,EAAE,MAAM,CAAC;IAChB,0CAA0C;IAC1C,OAAO,CAAC,EAAE,MAAM,EAAE,CAAC;IACnB,8BAA8B;IAC9B,OAAO,CAAC,EAAE,MAAM,EAAE,CAAC;IACnB,0BAA0B;IAC1B,EAAE,CAAC,EAAE,UAAU,CAAC;CACnB;AAED;;;;GAIG;AACH,eAAO,MAAM,gBAAgB,aAAgF,CAAC;AAE9G,qFAAqF;AACrF,wBAAsB,aAAa,CAAC,OAAO,EAAE,sBAAsB,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,CAWtF;AAED,gDAAgD;AAChD,wBAAsB,eAAe,CAAC,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,aAAyB,GAAG,OAAO,CAAC,MAAM,CAAC,CAErH;AAED,2DAA2D;AAC3D,MAAM,WAAW,WAAW;IACxB,6BAA6B;IAC7B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,0BAA0B;IAC1B,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;CAC5B;AASD,8EAA8E;AAC9E,MAAM,MAAM,aAAa,GAAG,OAAO,GAAG,MAAM,CAAC;AAE7C,qCAAqC;AACrC,MAAM,WAAW,gBAAgB;IAC7B,iCAAiC;IACjC,OAAO,EAAE,MAAM,CAAC;IAChB,sFAAsF;IACtF,OAAO,CAAC,EAAE,MAAM,EAAE,CAAC;IACnB,yDAAyD;IACzD,OAAO,CAAC,EAAE,MAAM,EAAE,CAAC;IACnB;;;;;;;;OAQG;IACH,SAAS,EAAE,aAAa,CAAC;IACzB,0BAA0B;IAC1B,EAAE,CAAC,EAAE,UAAU,CAAC;CACnB;AAED;;;;;;;;GAQG;AACH,wBAAsB,SAAS,CAAC,OAAO,EAAE,gBAAgB,GAAG,OAAO,CAAC,WAAW,EAAE,CAAC,CAcjF;AAeD,sDAAsD;AACtD,wBAAgB,iBAAiB,CAAC,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,MAAM,CAEvE;AAED,2DAA2D;AAC3D,wBAAgB,cAAc,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAGnD"}

package/dist/evaluators/file-discovery.js

@@ -25,6 +25,12 @@ export async function discoverFiles(options) {
 export async function readWorkdirFile(workdir, filePath, fs = createNodeFileSystem()) {
     return await fs.readFile(resolvePath(workdir, filePath));
 }
+/**
+ * Per-file byte cap for {@link scanFiles} (task 0060 R15). Larger files are skipped
+ * with no content buffer so a single oversized artifact cannot balloon memory while
+ * a rule corpus is assembled; evaluators still see every smaller file unchanged.
+ */
+const MAX_SCANNED_FILE_BYTES = 2_000_000;
 /**
  * Discover in-scope files and read each once — the shared scaffolding behind the
  * line-scanning evaluators. Owns discovery, scope filtering (per `matchMode`), and
@@ -41,6 +47,10 @@ export async function scanFiles(options) {
         : await discoverFilesByGlob(options.workdir, options.include, options.exclude, fs);
     const scanned = [];
     for (const file of files) {
+        // Skip oversized files instead of buffering them (task 0060 R15).
+        const stat = await fs.stat(resolvePath(options.workdir, file));
+        if (stat !== null && stat.size > MAX_SCANNED_FILE_BYTES)
+            continue;
         scanned.push({ file, content: await readWorkdirFile(options.workdir, file, fs) });
     }
     return scanned;

package/dist/events.d.ts

@@ -1,3 +1,4 @@
+import type { EventSeverity } from '@gobing-ai/ts-infra';
 import type { ConstraintFinding } from './types';
 /** Typed event map for rule-engine run observability. All events prefixed `rule.`. */
 export type RuleEngineEvents = {
@@ -5,12 +6,14 @@ export type RuleEngineEvents = {
     'rule.run.start': (data: {
         rules: number;
         total: number;
+        severity: EventSeverity;
     }) => void;
     /** Emitted immediately before a single rule's evaluator is invoked. */
     'rule.eval.start': (data: {
         ruleId: string;
         index: number;
         total: number;
+        severity: EventSeverity;
     }) => void;
     /**
      * Emitted after a single rule evaluation finishes successfully.
@@ -23,11 +26,13 @@ export type RuleEngineEvents = {
         findings: number;
         durationMs: number;
         details: ConstraintFinding[];
+        severity: EventSeverity;
     }) => void;
     /** Emitted when a rule evaluator throws (in addition to the `kind:'error'` finding). */
     'rule.eval.error': (data: {
         ruleId: string;
         error: string;
+        severity: EventSeverity;
     }) => void;
     /** Emitted after the last rule finishes (or was short-circuited). */
     'rule.run.done': (data: {
@@ -35,6 +40,7 @@ export type RuleEngineEvents = {
         findings: number;
         durationMs: number;
         stoppedEarly: boolean;
+        severity: EventSeverity;
     }) => void;
 };
 //# sourceMappingURL=events.d.ts.map

package/dist/events.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"events.d.ts","sourceRoot":"","sources":["../src/events.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,SAAS,CAAC;AAEjD,sFAAsF;AACtF,MAAM,MAAM,gBAAgB,GAAG;IAC3B,kDAAkD;IAClD,gBAAgB,EAAE,CAAC,IAAI,EAAE;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,KAAK,IAAI,CAAC;IACnE,uEAAuE;IACvE,iBAAiB,EAAE,CAAC,IAAI,EAAE;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,KAAK,IAAI,CAAC;IACpF;;;;;OAKG;IACH,gBAAgB,EAAE,CAAC,IAAI,EAAE;QACrB,MAAM,EAAE,MAAM,CAAC;QACf,QAAQ,EAAE,MAAM,CAAC;QACjB,UAAU,EAAE,MAAM,CAAC;QACnB,OAAO,EAAE,iBAAiB,EAAE,CAAC;KAChC,KAAK,IAAI,CAAC;IACX,wFAAwF;IACxF,iBAAiB,EAAE,CAAC,IAAI,EAAE;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,KAAK,IAAI,CAAC;IACrE,qEAAqE;IACrE,eAAe,EAAE,CAAC,IAAI,EAAE;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAC;QAAC,UAAU,EAAE,MAAM,CAAC;QAAC,YAAY,EAAE,OAAO,CAAA;KAAE,KAAK,IAAI,CAAC;CACnH,CAAC"}
+{"version":3,"file":"events.d.ts","sourceRoot":"","sources":["../src/events.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AACzD,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,SAAS,CAAC;AAEjD,sFAAsF;AACtF,MAAM,MAAM,gBAAgB,GAAG;IAC3B,kDAAkD;IAClD,gBAAgB,EAAE,CAAC,IAAI,EAAE;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,aAAa,CAAA;KAAE,KAAK,IAAI,CAAC;IAC5F,uEAAuE;IACvE,iBAAiB,EAAE,CAAC,IAAI,EAAE;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,aAAa,CAAA;KAAE,KAAK,IAAI,CAAC;IAC7G;;;;;OAKG;IACH,gBAAgB,EAAE,CAAC,IAAI,EAAE;QACrB,MAAM,EAAE,MAAM,CAAC;QACf,QAAQ,EAAE,MAAM,CAAC;QACjB,UAAU,EAAE,MAAM,CAAC;QACnB,OAAO,EAAE,iBAAiB,EAAE,CAAC;QAC7B,QAAQ,EAAE,aAAa,CAAC;KAC3B,KAAK,IAAI,CAAC;IACX,wFAAwF;IACxF,iBAAiB,EAAE,CAAC,IAAI,EAAE;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,aAAa,CAAA;KAAE,KAAK,IAAI,CAAC;IAC9F,qEAAqE;IACrE,eAAe,EAAE,CAAC,IAAI,EAAE;QACpB,KAAK,EAAE,MAAM,CAAC;QACd,QAAQ,EAAE,MAAM,CAAC;QACjB,UAAU,EAAE,MAAM,CAAC;QACnB,YAAY,EAAE,OAAO,CAAC;QACtB,QAAQ,EAAE,aAAa,CAAC;KAC3B,KAAK,IAAI,CAAC;CACd,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
     "name": "@gobing-ai/ts-rule-engine",
-    "version": "0.4.28",
+    "version": "0.4.30",
     "description": "@gobing-ai/ts-rule-engine — Constraint rule schemas, loading, evaluation, and result formatting.",
     "keywords": [
         "typescript",
@@ -49,10 +49,10 @@
         "release": "echo 'Manual publish is disabled. Releases go through GitHub Actions via Trusted Publishing — push a tag: git tag @gobing-ai/ts-rule-engine-v<version> && git push --tags' && exit 1"
     },
     "dependencies": {
-        "@gobing-ai/ts-ai-runner": "^0.4.28",
-        "@gobing-ai/ts-infra": "^0.4.28",
-        "@gobing-ai/ts-runtime": "^0.4.28",
-        "@gobing-ai/ts-db": "^0.4.28",
+        "@gobing-ai/ts-ai-runner": "^0.4.30",
+        "@gobing-ai/ts-infra": "^0.4.30",
+        "@gobing-ai/ts-runtime": "^0.4.30",
+        "@gobing-ai/ts-db": "^0.4.30",
         "yaml": "^2.7.0",
         "zod": "^4.1.0"
     },

package/src/config/extensions.ts

@@ -1,12 +1,5 @@
 import type { Logger } from '@gobing-ai/ts-infra';
-import {
-    basenamePath,
-    createNodeFileSystem,
-    dirnamePath,
-    fileUrlToPath,
-    normalizeSeparators,
-    resolvePath,
-} from '@gobing-ai/ts-runtime';
+import { createNodeFileSystem } from '@gobing-ai/ts-runtime';
 import type {
     ExtensionRef as SharedExtensionRef,
     LoadExtensionsOptions as SharedLoadExtensionsOptions,
@@ -16,14 +9,22 @@ import type { RuleEngineHost } from '../host/rule-engine-host';
 /** A capability kind a preset extension can contribute. */
 export type ExtensionKind = 'resolvers' | 'evaluators' | 'fixers' | 'formatters';
 
-/** A single extension module reference, resolved to an absolute path. */
+/**
+ * A single extension module reference: the authored relative path plus the
+ * declaring directory (task 0060 C2). Keeping the authored string means the
+ * shared loader's `assertRelativeExtensionPath` sees the real declaration — a
+ * `..` segment or absolute path is rejected there, not after a basename smash
+ * has already stripped it.
+ */
 export interface ExtensionRef {
     /** Capability registry the module registers into. */
     readonly kind: ExtensionKind;
-    /** Absolute path to the module to import. */
-    readonly absPath: string;
+    /** Relative path as authored (e.g. `./exts/foo.ts`). */
+    readonly path: string;
+    /** Absolute directory the authored `path` is resolved against. */
+    readonly baseDir: string;
     /** Name of the preset that declared this extension (for diagnostics). */
-    readonly presetName: string;
+    readonly sourceName: string;
 }
 
 /** Options controlling preset-extension loading. */
@@ -61,9 +62,11 @@ const HOST_REGISTRY_BY_KIND: Record<ExtensionKind, 'resolvers' | 'evaluators' |
 /**
  * Collect extension refs declared by a preset's or rule file's `extensions` block.
  *
- * Paths are resolved relative to the declaring file's directory. Use the returned
- * refs with {@link loadExtensionsIntoHost}. Rule files and presets are treated
- * identically — both flow through the same trust gate at load time.
+ * Paths are kept **as authored** and paired with the declaring file's directory as
+ * `baseDir` — no eager resolution, so the shared loader's traversal guard sees the
+ * real declaration (task 0060 C2). Use the returned refs with
+ * {@link loadExtensionsIntoHost}. Rule files and presets are treated identically —
+ * both flow through the same trust gate at load time.
  */
 export function collectExtensions(
     sourceName: string,
@@ -74,7 +77,7 @@ export function collectExtensions(
     const refs: ExtensionRef[] = [];
     for (const kind of ['resolvers', 'evaluators', 'fixers', 'formatters'] as ExtensionKind[]) {
         for (const path of extensions[kind] ?? []) {
-            refs.push({ kind, presetName: sourceName, absPath: resolvePath(sourceDir, path) });
+            refs.push({ kind, sourceName, path, baseDir: sourceDir });
         }
     }
     return refs;
@@ -103,37 +106,15 @@ export async function loadExtensionsIntoHost(
 ): Promise<void> {
     if (refs.length === 0) return;
 
-    // Normalize file:// URLs to file paths so dirname/basename produce valid
-    // path components that isAbsolute() accepts (e.g. import.meta.url in tests).
-    const toFilePath = (p: string): string => (p.startsWith('file://') ? fileUrlToPath(p) : p);
-
-    // Defense-in-depth: pre-validate `..` traversal in caller-supplied absPath
-    // before the basename adaptation strips it.  The shared loader's
-    // assertRelativeExtensionPath also runs on the derived (basename) path.
-    for (const ref of refs) {
-        // Split on normalized separators: fileUrlToPath returns forward slashes on
-        // every platform, so a platform SEP split would miss segments on Windows.
-        const segments = normalizeSeparators(toFilePath(ref.absPath)).split('/');
-        if (segments.includes('..')) {
-            throw new Error(
-                `extension path "${ref.absPath}" declared by "${ref.presetName}" must not contain ".." traversal`,
-            );
-        }
-    }
-
-    // Adapt rule-engine ExtensionRef → shared ExtensionRef so the generic loader
-    // governs every import.  The shared loader resolves (baseDir, path) →
-    // absPath internally; we supply dirname/basename so the resolved path
-    // reconstructs the caller's original absPath.
-    const sharedRefs: SharedExtensionRef<ExtensionKind>[] = refs.map((ref) => {
-        const fp = toFilePath(ref.absPath);
-        return {
-            kind: ref.kind,
-            path: `./${basenamePath(fp)}`,
-            baseDir: dirnamePath(fp),
-            sourceName: ref.presetName,
-        };
-    });
+    // Map 1:1 onto the shared ref shape — no dirname/basename smash, so the shared
+    // loader's assertRelativeExtensionPath + realPath confinement govern the authored
+    // path exactly as declared (task 0060 C2).
+    const sharedRefs: SharedExtensionRef<ExtensionKind>[] = refs.map((ref) => ({
+        kind: ref.kind,
+        path: ref.path,
+        baseDir: ref.baseDir,
+        sourceName: ref.sourceName,
+    }));
 
     const moduleLoader = options.moduleLoader ?? defaultModuleLoader;
     // Real import policy gets real confinement by default (ADR-022 addendum): a

package/src/engine.ts

@@ -141,7 +141,11 @@ export class RuleEngine {
             async () => {
                 this.logger.info('rule run started', { enabled: enabledRules.length, total: rules.length });
                 addSpanEvent('rule.run.start', { rules: enabledRules.length, total: rules.length });
-                void this.events?.emit('rule.run.start', { rules: enabledRules.length, total: rules.length });
+                void this.events?.emit('rule.run.start', {
+                    rules: enabledRules.length,
+                    total: rules.length,
+                    severity: 'info',
+                });
 
                 const findings: ConstraintFinding[] = [];
                 const fixes: Fix[] = [];
@@ -164,7 +168,12 @@ export class RuleEngine {
                     const evalStartMs = Date.now();
                     this.logger.debug('eval start', { ruleId: rule.id, index, total: enabledRules.length });
                     addSpanEvent('rule.eval.start', { ruleId: rule.id, index, total: enabledRules.length });
-                    void this.events?.emit('rule.eval.start', { ruleId: rule.id, index, total: enabledRules.length });
+                    void this.events?.emit('rule.eval.start', {
+                        ruleId: rule.id,
+                        index,
+                        total: enabledRules.length,
+                        severity: 'info',
+                    });
 
                     let ruleFindings: ConstraintFinding[] = [];
                     let ruleEvalFixes: Fix[] = [];
@@ -184,7 +193,11 @@ export class RuleEngine {
                             }),
                         ];
                         addSpanEvent('rule.eval.error', { ruleId: rule.id, error: evalError });
-                        void this.events?.emit('rule.eval.error', { ruleId: rule.id, error: evalError });
+                        void this.events?.emit('rule.eval.error', {
+                            ruleId: rule.id,
+                            error: evalError,
+                            severity: 'error',
+                        });
                     }
 
                     const durationMs = Date.now() - evalStartMs;
@@ -198,6 +211,7 @@ export class RuleEngine {
                         findings: ruleFindings.length,
                         durationMs,
                         details: ruleFindings,
+                        severity: 'info',
                     });
 
                     // Persist eval completion.
@@ -262,6 +276,7 @@ export class RuleEngine {
                     findings: findings.length,
                     durationMs: runDurationMs,
                     stoppedEarly: stoppedEarlyLocal,
+                    severity: 'info',
                 });
 
                 // Finalize the run row.

package/src/evaluators/file-discovery.ts

@@ -60,6 +60,13 @@ export interface ScannedFile {
     readonly content: string;
 }
 
+/**
+ * Per-file byte cap for {@link scanFiles} (task 0060 R15). Larger files are skipped
+ * with no content buffer so a single oversized artifact cannot balloon memory while
+ * a rule corpus is assembled; evaluators still see every smaller file unchanged.
+ */
+const MAX_SCANNED_FILE_BYTES = 2_000_000;
+
 /** How `scanFiles` matches `include` / `exclude` against discovered paths. */
 export type ScanMatchMode = 'loose' | 'glob';
 
@@ -102,6 +109,9 @@ export async function scanFiles(options: ScanFilesOptions): Promise<ScannedFile[
             : await discoverFilesByGlob(options.workdir, options.include, options.exclude, fs);
     const scanned: ScannedFile[] = [];
     for (const file of files) {
+        // Skip oversized files instead of buffering them (task 0060 R15).
+        const stat = await fs.stat(resolvePath(options.workdir, file));
+        if (stat !== null && stat.size > MAX_SCANNED_FILE_BYTES) continue;
         scanned.push({ file, content: await readWorkdirFile(options.workdir, file, fs) });
     }
     return scanned;

package/src/events.ts

@@ -1,11 +1,12 @@
+import type { EventSeverity } from '@gobing-ai/ts-infra';
 import type { ConstraintFinding } from './types';
 
 /** Typed event map for rule-engine run observability. All events prefixed `rule.`. */
 export type RuleEngineEvents = {
     /** Emitted before the first rule is evaluated. */
-    'rule.run.start': (data: { rules: number; total: number }) => void;
+    'rule.run.start': (data: { rules: number; total: number; severity: EventSeverity }) => void;
     /** Emitted immediately before a single rule's evaluator is invoked. */
-    'rule.eval.start': (data: { ruleId: string; index: number; total: number }) => void;
+    'rule.eval.start': (data: { ruleId: string; index: number; total: number; severity: EventSeverity }) => void;
     /**
      * Emitted after a single rule evaluation finishes successfully.
      * `findings` is the count; `details` carries the actual finding objects so
@@ -17,9 +18,16 @@ export type RuleEngineEvents = {
         findings: number;
         durationMs: number;
         details: ConstraintFinding[];
+        severity: EventSeverity;
     }) => void;
     /** Emitted when a rule evaluator throws (in addition to the `kind:'error'` finding). */
-    'rule.eval.error': (data: { ruleId: string; error: string }) => void;
+    'rule.eval.error': (data: { ruleId: string; error: string; severity: EventSeverity }) => void;
     /** Emitted after the last rule finishes (or was short-circuited). */
-    'rule.run.done': (data: { rules: number; findings: number; durationMs: number; stoppedEarly: boolean }) => void;
+    'rule.run.done': (data: {
+        rules: number;
+        findings: number;
+        durationMs: number;
+        stoppedEarly: boolean;
+        severity: EventSeverity;
+    }) => void;
 };