@harness-engineering/cli 2.1.0 → 2.2.0

package/dist/{chunk-MAFI6UWT.js → chunk-K4WRQTEF.js}

@@ -19,7 +19,7 @@ import {
   __export
 } from "./chunk-KFQGP6VL.js";
 
-// ../core/dist/chunk-H73442AZ.mjs
+// ../core/dist/chunk-CE225WRK.mjs
 import { z } from "zod";
 import { createHash } from "crypto";
 import { minimatch } from "minimatch";
@@ -115,20 +115,32 @@ function getExtensionsForLang(lang) {
       return [".ts", ".tsx", ".js", ".jsx"];
   }
 }
-function resolveImportPath(importSource, fromFile, _rootDir) {
+async function resolveImportPath(importSource, fromFile, _rootDir) {
   if (!importSource.startsWith(".") && !importSource.startsWith("/")) {
     return null;
   }
   const fromDir = dirname(fromFile);
-  let resolved = resolve(fromDir, importSource);
-  const ext = extname(fromFile);
-  const lang = detectLangFromExt(ext);
-  const extensions = getExtensionsForLang(lang);
+  const resolved = resolve(fromDir, importSource);
+  const sourceExt = extname(resolved);
+  const fromLang = detectLangFromExt(extname(fromFile));
+  const fallbacks = JS_EXT_FALLBACKS[sourceExt];
+  if (fallbacks) {
+    const base = resolved.slice(0, -sourceExt.length);
+    for (const ext of fallbacks) {
+      const candidate = base + ext;
+      if (await fileExists(candidate)) return candidate.replace(/\\/g, "/");
+    }
+    for (const indexExt of [".ts", ".tsx", ".jsx"]) {
+      const indexPath2 = resolve(base, "index" + indexExt);
+      if (await fileExists(indexPath2)) return indexPath2.replace(/\\/g, "/");
+    }
+  }
   const hasKnownExt = Object.values(EXTENSION_BY_LANG).flat().some((e) => resolved.endsWith(e));
-  if (!hasKnownExt) {
-    resolved = resolved + extensions[0];
+  if (hasKnownExt) {
+    return resolved.replace(/\\/g, "/");
   }
-  return resolved.replace(/\\/g, "/");
+  const extensions = getExtensionsForLang(fromLang);
+  return (resolved + extensions[0]).replace(/\\/g, "/");
 }
 function getImportType(imp) {
   if (imp.kind === "type") return "type-only";
@@ -157,7 +169,7 @@ async function buildDependencyGraph(files, parser, graphDependencyData) {
       continue;
     }
     for (const imp of importsResult.value) {
-      const resolvedPath = resolveImportPath(imp.source, file, "");
+      const resolvedPath = await resolveImportPath(imp.source, file, "");
       if (resolvedPath) {
         edges.push({
           from: normalizedFile,
@@ -1733,9 +1745,9 @@ async function toHaveMaxDepDepth(received, maxDepth) {
     message: () => pass ? `Expected dependency depth in '${received.scope}' to exceed ${maxDepth} but it was ${maxActual}` : `Module '${received.scope}' has dependency depth ${maxActual} (limit: ${maxDepth})`
   };
 }
-var ArchMetricCategorySchema, ViolationSchema, MetricResultSchema, CategoryBaselineSchema, ArchBaselineSchema, CategoryRegressionSchema, ArchDiffResultSchema, ThresholdConfigSchema, ArchConfigSchema, ConstraintRuleSchema, ViolationSnapshotSchema, ViolationHistorySchema, EmergenceConfidenceSchema, EmergentConstraintSuggestionSchema, EmergenceResultSchema, accessAsync, readFileAsync, EXTENSION_BY_LANG, CircularDepsCollector, TypeScriptParser, EXTENSION_MAP, parserCache, initialized, GRAMMAR_MAP, TOP_LEVEL_TYPES, METHOD_TYPES, IDENTIFIER_TYPES, NAME_EXTRACTORS, pythonStrategy, goStrategy, RUST_USE_ARG_TYPES, RUST_PUB_ITEM_TYPES, rustStrategy, JAVA_IMPORT_TYPES, JAVA_EXPORT_TYPES, javaStrategy, STRATEGIES, TreeSitterParser, ParserRegistry, defaultRegistry, LayerViolationCollector, ArchBaselineManager, DEFAULT_THRESHOLDS, FUNCTION_PATTERNS, DECISION_PATTERNS, ComplexityCollector, DEFAULT_THRESHOLDS2, CouplingCollector, ForbiddenImportCollector, ModuleSizeCollector, DepDepthCollector, defaultCollectors, archMatchers;
-var init_chunk_H73442AZ = __esm({
-  "../core/dist/chunk-H73442AZ.mjs"() {
+var ArchMetricCategorySchema, ViolationSchema, MetricResultSchema, CategoryBaselineSchema, ArchBaselineSchema, CategoryRegressionSchema, ArchDiffResultSchema, ThresholdConfigSchema, ArchConfigSchema, ConstraintRuleSchema, ViolationSnapshotSchema, ViolationHistorySchema, EmergenceConfidenceSchema, EmergentConstraintSuggestionSchema, EmergenceResultSchema, accessAsync, readFileAsync, EXTENSION_BY_LANG, JS_EXT_FALLBACKS, CircularDepsCollector, TypeScriptParser, EXTENSION_MAP, parserCache, initialized, GRAMMAR_MAP, TOP_LEVEL_TYPES, METHOD_TYPES, IDENTIFIER_TYPES, NAME_EXTRACTORS, pythonStrategy, goStrategy, RUST_USE_ARG_TYPES, RUST_PUB_ITEM_TYPES, rustStrategy, JAVA_IMPORT_TYPES, JAVA_EXPORT_TYPES, javaStrategy, STRATEGIES, TreeSitterParser, ParserRegistry, defaultRegistry, LayerViolationCollector, ArchBaselineManager, DEFAULT_THRESHOLDS, FUNCTION_PATTERNS, DECISION_PATTERNS, ComplexityCollector, DEFAULT_THRESHOLDS2, CouplingCollector, ForbiddenImportCollector, ModuleSizeCollector, DepDepthCollector, defaultCollectors, archMatchers;
+var init_chunk_CE225WRK = __esm({
+  "../core/dist/chunk-CE225WRK.mjs"() {
     "use strict";
     init_dist();
     ArchMetricCategorySchema = z.enum([
@@ -1853,6 +1865,12 @@ var init_chunk_H73442AZ = __esm({
       rust: [".rs"],
       java: [".java"]
     };
+    JS_EXT_FALLBACKS = {
+      ".js": [".ts", ".tsx", ".jsx"],
+      ".jsx": [".tsx"],
+      ".mjs": [".mts"],
+      ".cjs": [".cts"]
+    };
     CircularDepsCollector = class {
       category = "circular-deps";
       getRules(_config, _rootDir) {
@@ -2439,6 +2457,25 @@ var init_chunk_H73442AZ = __esm({
           return null;
         }
       }
+      /**
+       * Refresh the on-disk baseline with new results.
+       *
+       * Categories present in `results` overwrite their on-disk entry; categories
+       * absent from `results` are preserved as-is. This prevents silent data loss
+       * when a collector returns no results (e.g. transient failure or a filtered
+       * run) and the regenerated file is committed (issue #268).
+       *
+       * Use this from the `--update-baseline` flow instead of `capture()` + `save()`.
+       */
+      update(results, commitHash) {
+        const fresh = this.capture(results, commitHash);
+        const existing = this.load();
+        if (existing) {
+          fresh.metrics = { ...existing.metrics, ...fresh.metrics };
+        }
+        this.save(fresh);
+        return fresh;
+      }
       /**
        * Save an ArchBaseline to disk.
        * Creates parent directories if they do not exist.
@@ -3267,7 +3304,7 @@ import * as fs4 from "fs/promises";
 import { join as join14, resolve as resolve32 } from "path";
 import { minimatch as minimatch22 } from "minimatch";
 import { dirname as dirname5, resolve as resolve4 } from "path";
-import { dirname as dirname6, resolve as resolve5 } from "path";
+import { dirname as dirname6, extname as extname2, resolve as resolve5 } from "path";
 import { minimatch as minimatch3 } from "minimatch";
 import { readdirSync, statSync as statSync2 } from "fs";
 import { join as join15 } from "path";
@@ -3344,7 +3381,7 @@ import { z as z11 } from "zod";
 import { readFileSync as readFileSync23, writeFileSync as writeFileSync16, renameSync as renameSync82, mkdirSync as mkdirSync15, existsSync as existsSync332 } from "fs";
 import { execSync as execSync3 } from "child_process";
 import { randomBytes as randomBytes22 } from "crypto";
-import { join as join39, dirname as dirname13 } from "path";
+import { isAbsolute as isAbsolute4, join as join39, relative as relative32, dirname as dirname13 } from "path";
 import * as path24 from "path";
 import * as path25 from "path";
 import * as path26 from "path";
@@ -6243,19 +6280,30 @@ function resolveImportToFile(importSource, fromFile, snapshot, fileIndex) {
   }
   const hasFile = fileIndex ? (p) => fileIndex.has(p) : (p) => snapshot.files.some((f) => f.path === p);
   const fromDir = dirname6(fromFile);
-  let resolved = resolve5(fromDir, importSource);
-  if (!resolved.endsWith(".ts") && !resolved.endsWith(".tsx")) {
-    const withTs = resolved + ".ts";
-    if (hasFile(withTs)) {
-      return withTs;
+  const resolved = resolve5(fromDir, importSource);
+  const sourceExt = extname2(resolved);
+  const fallbacks = JS_EXT_FALLBACKS2[sourceExt];
+  if (fallbacks) {
+    const base = resolved.slice(0, -sourceExt.length);
+    for (const ext of fallbacks) {
+      const candidate = base + ext;
+      if (hasFile(candidate)) return candidate;
     }
-    const withIndex = resolve5(resolved, "index.ts");
-    if (hasFile(withIndex)) {
-      return withIndex;
+    for (const indexExt of [".ts", ".tsx", ".jsx"]) {
+      const indexPath2 = resolve5(base, "index" + indexExt);
+      if (hasFile(indexPath2)) return indexPath2;
     }
   }
-  if (hasFile(resolved)) {
-    return resolved;
+  if (hasFile(resolved)) return resolved;
+  if (!sourceExt) {
+    for (const ext of [".ts", ".tsx"]) {
+      const candidate = resolved + ext;
+      if (hasFile(candidate)) return candidate;
+    }
+    for (const indexExt of [".ts", ".tsx"]) {
+      const indexPath2 = resolve5(resolved, "index" + indexExt);
+      if (hasFile(indexPath2)) return indexPath2;
+    }
   }
   return null;
 }
@@ -10915,12 +10963,18 @@ async function resolveImportPath2(projectRoot, fromFile, importSource) {
   const basePath = path26.resolve(fromDir, importSource);
   if (!isWithinProject(basePath, projectRoot)) return null;
   const relBase = relativePosix(projectRoot, basePath);
-  const candidates = [
-    relBase + ".ts",
-    relBase + ".tsx",
-    relBase + ".mts",
-    path26.join(relBase, "index.ts")
-  ];
+  const sourceExt = path26.extname(relBase);
+  const candidates = [];
+  const fallbacks = JS_EXT_FALLBACKS22[sourceExt];
+  if (fallbacks) {
+    const stripped = relBase.slice(0, -sourceExt.length);
+    for (const ext of fallbacks) candidates.push(stripped + ext);
+    candidates.push(path26.join(stripped, "index.ts"));
+    candidates.push(path26.join(stripped, "index.tsx"));
+    candidates.push(path26.join(stripped, "index.jsx"));
+  }
+  candidates.push(relBase + ".ts", relBase + ".tsx", relBase + ".mts");
+  candidates.push(path26.join(relBase, "index.ts"));
   for (const candidate of candidates) {
     const absCandidate = path26.join(projectRoot, candidate);
     if (await fileExists(absCandidate)) {
@@ -14710,10 +14764,10 @@ function assembleCandidateReport(input) {
   }
   return lines.join("\n");
 }
-var VALID_TYPES, CONVENTIONAL_PATTERN, LOOKBACK_PATTERN, PulseDbSourceSchema, PulseSourcesSchema, PulseConfigSchema, BUG_TRACK_CATEGORIES, KNOWLEDGE_TRACK_CATEGORIES, ALL_SOLUTION_CATEGORIES, ISO_DATE, BugTrackSchema, KnowledgeTrackSchema, BaseFrontmatter, SolutionDocFrontmatterSchema, TRACK_CATEGORIES, DEFAULT_AGNIX_TIMEOUT_MS, HARNESS_AGNIX_DISABLE, HARNESS_AGNIX_BIN, CLAUDE_MD_WARN_BYTES, CLAUDE_MD_ERROR_BYTES, CONTEXT_FILES, MIN_DESCRIPTION_LENGTH, SETTINGS_PATHS, KNOWN_HOOK_EVENTS, MCP_SETTINGS_FILES, REQUIRED_SECTIONS, SETTINGS_FILES, KNOWN_AGNIX_TOOLS, DEFAULT_SECTIONS, DEFAULT_RATIOS, NODE_TYPE_TO_CATEGORY, SECTION_LEVEL_MAP, DEFAULT_LEVEL, DEFAULT_BUDGET, DEFAULT_LOADER_CONFIG, LEVEL_FRACTIONS, PHASE_PRIORITIES, ManifestSchema, BundleConstraintsSchema, BundleSchema, ContributionsSchema, LockfilePackageSchema, LockfileSchema, SharableLayerSchema, SharableForbiddenImportSchema, SharableBoundaryConfigSchema, SharableSecurityRulesSchema, VALID_SCOPES, LINE_PATTERN, START_PATTERN, END_PATTERN, CODE_BLOCK_LANGUAGES, DEFAULT_DRIFT_CONFIG, FILE_TYPES, EXPORT_TYPES, CONVENTION_DESCRIPTIONS, RULE_CHECKERS, EntropyAnalyzer, readFile62, writeFile32, unlink22, mkdir22, copyFile2, DEFAULT_FIX_CONFIG, EXPORT_TYPE_KEYWORD, ALWAYS_UNSAFE_TYPES, idCounter, DEAD_CODE_FIX_ACTIONS, MustExportRuleSchema, MustExportDefaultRuleSchema, NoExportRuleSchema, MustImportRuleSchema, NoImportRuleSchema, NamingRuleSchema, MaxExportsRuleSchema, MaxLinesRuleSchema, RequireJSDocRuleSchema, RuleSchema, ConfigPatternSchema, PatternConfigSchema, DriftConfigSchema, DeadCodeConfigSchema, EntropyConfigSchema, BaselineManager, BenchmarkRunner, RegressionDetector, SKIP_DIRS, SOURCE_EXTENSIONS, FUNCTION_DECL_RE, CONST_DECL_RE, CriticalPathResolver, NoOpTelemetryAdapter, NoOpExecutor, ConsoleSink, feedbackConfig, ChecklistBuilder, AgentActionEmitter, globalEmitter, FileSink, NoOpSink, CategorySnapshotSchema, TimelineSnapshotSchema, TimelineFileSchema, TrendLineSchema, TrendResultSchema, DEFAULT_STABILITY_THRESHOLDS, ALL_CATEGORIES, TimelineManager, ConfidenceTierSchema, RegressionResultSchema, DirectionSchema, CategoryForecastSchema, SpecImpactSignalsSchema, SpecImpactEstimateSchema, ContributingFeatureSchema, AdjustedForecastSchema, PredictionWarningSchema, StabilityForecastSchema, PredictionResultSchema, PredictionOptionsSchema, VALID_STATUSES, EM_DASH, VALID_PRIORITIES, ALL_CATEGORIES2, DIRECTION_THRESHOLD, PredictionEngine, DEFAULT_COEFFICIENTS, SpecImpactEstimator, EMPTY_HISTORY, ViolationHistoryManager, NORMALIZERS, MAX_SAMPLES, DEFAULT_WINDOW_WEEKS, DEFAULT_MIN_OCCURRENCES, FailureEntrySchema, HandoffSchema, GateCheckSchema, GateResultSchema, GateConfigSchema, HarnessStateSchema, DEFAULT_STATE, StreamInfoSchema, StreamIndexSchema, DEFAULT_STREAM_INDEX, HARNESS_DIR, STATE_FILE, LEARNINGS_FILE, FAILURES_FILE, HANDOFF_FILE, GATE_CONFIG_FILE, INDEX_FILE, SESSIONS_DIR, SESSION_INDEX_FILE, SUMMARY_FILE, SESSION_STATE_FILE, ARCHIVE_DIR, CONTENT_HASHES_FILE, EVENTS_FILE, STREAMS_DIR, STREAM_NAME_REGEX, branchCache, BRANCH_CACHE_TTL_MS, STATE_FILES, MAX_CACHE_ENTRIES, learningsCacheMap, WEIGHTS, LOCK_RETRIES, LOCK_BACKOFFS, PROMOTABLE_OUTCOMES, failuresCacheMap, FAILURE_LINE_REGEX, SAFE_GATE_COMMAND, SkillEventSchema, knownHashesCache, EVENT_FORMATTERS, RuleRegistry, DEFAULT_SECURITY_CONFIG, RuleOverrideSchema, SecurityConfigSchema, secretRules, injectionRules, xssRules, cryptoRules, pathTraversalRules, networkRules, deserializationRules, agentConfigRules, mcpRules, insecureDefaultsRules, sharpEdgesRules, nodeRules, expressRules, reactRules, goRules, SecurityScanner, hiddenUnicodePatterns, reRolingPatterns, permissionEscalationPatterns, encodedPayloadPatterns, indirectInjectionPatterns, contextManipulationPatterns, socialEngineeringPatterns, suspiciousPatterns, ALL_PATTERNS, DESTRUCTIVE_BASH, TAINT_DURATION_MS, DEFAULT_SESSION_ID, SecurityCategorySnapshotSchema, SupplyChainSnapshotSchema, SecurityTimelineSnapshotSchema, FindingLifecycleSchema, SecurityTimelineFileSchema, DirectionSchema2, SecurityTrendLineSchema, TrendAttributionSchema, SecurityTrendResultSchema, TimeToFixStatsSchema, TimeToFixResultSchema, EMPTY_SUPPLY_CHAIN, SecurityTimelineManager, ALL_CHECKS, STATUS_ICONS, CINotifier, ExclusionSet, PREFIX_PATTERNS, TEST_FILE_PATTERN, MD_FILE_PATTERN, ALL_DOMAINS, SECURITY_PATTERNS, SEVERITY_RANK, SEVERITY_ORDER, SEVERITY_LABELS, VALIDATED_BY_RANK, VALIDATION_SCORES, DOMAIN_BASELINES, FACTOR_WEIGHTS, EVIDENCE_SATURATION, CORROBORATED_AGREEMENT, STANDALONE_AGREEMENT, AGREEMENT_LINE_GAP, COMPLIANCE_DESCRIPTOR, EXPORT_RE, BUG_DETECTION_DESCRIPTOR, SECURITY_DESCRIPTOR, EVAL_PATTERN, SECRET_PATTERNS, SQL_CONCAT_PATTERN, SHELL_EXEC_PATTERN, ARCHITECTURE_DESCRIPTOR, LARGE_FILE_THRESHOLD, VIOLATION_FILE_RE, LEARNINGS_DESCRIPTOR, RELEVANCE_THRESHOLD, AGENT_DESCRIPTORS, AGENT_RUNNERS, DOWNGRADE_MAP, DEFAULT_PROVIDER_TIERS, SMALL_SUGGESTION_LINE_LIMIT, FILE_LINE_RANGE_PATTERN, FILE_LINE_PATTERN, FILE_ONLY_PATTERN, SECURITY_SENSITIVE_PATH, MIGRATION_PATH, TEST_PATH, CONFIG_PATH, STAGE_DOMAINS, EM_DASH2, STATUS_RANK, RETRY_DEFAULTS, GitHubIssuesSyncAdapter, syncMutex, PRIORITY_RANK, POSITION_WEIGHT, DEPENDENTS_WEIGHT, AFFINITY_WEIGHT, InteractionTypeSchema, QuestionSchema, ConfirmationSchema, TransitionSchema, EmitInteractionInputSchema, ProjectScanner, SHELL_TEMPLATE, STYLES, SCRIPTS, MockLLMService, llmService, ContentPipeline, BlueprintGenerator, TOKENS_PER_MILLION, fallback_default, LITELLM_PRICING_URL, CACHE_TTL_MS, STALENESS_WARNING_DAYS, MICRODOLLARS_PER_DOLLAR, TOKENS_PER_MILLION2, StructuralStrategy, DEFAULT_TOKEN_BUDGET, CHARS_PER_TOKEN, TRUNCATION_MARKER, TruncationStrategy, CompactionPipeline, STABILITY_LOOKUP, TIER_ORDER, AnthropicCacheAdapter, TIER_ORDER2, OpenAICacheAdapter, TIER_ORDER3, CACHED_CONTENT_MARKER, GeminiCacheAdapter, VERSION, POSTHOG_BATCH_URL, MAX_ATTEMPTS, TIMEOUT_MS, CompoundLockHeldError, KNOWN_CATEGORIES, ALLOWED_FIELD_KEYS, PII_TOKENS, PII_FIELD_DENYLIST, PII_LINE_RE, ALLOWED_SET, PulseAdapterAlreadyRegisteredError, REGISTRY, MOCK_ADAPTER_NAME, ALLOWED_FIELD_SET, adapter, LOOKBACK_RE, MAX_LINES, INLINE_TEMPLATE, TRUNCATION_MARKER2, execFileAsync, FIX_RE, EMPTY_REPO_RE, execFileAsync2, TRACK_CATEGORIES2, STOPWORDS, KEYWORD_TO_CATEGORY;
+var VALID_TYPES, CONVENTIONAL_PATTERN, LOOKBACK_PATTERN, PulseDbSourceSchema, PulseSourcesSchema, PulseConfigSchema, BUG_TRACK_CATEGORIES, KNOWLEDGE_TRACK_CATEGORIES, ALL_SOLUTION_CATEGORIES, ISO_DATE, BugTrackSchema, KnowledgeTrackSchema, BaseFrontmatter, SolutionDocFrontmatterSchema, TRACK_CATEGORIES, DEFAULT_AGNIX_TIMEOUT_MS, HARNESS_AGNIX_DISABLE, HARNESS_AGNIX_BIN, CLAUDE_MD_WARN_BYTES, CLAUDE_MD_ERROR_BYTES, CONTEXT_FILES, MIN_DESCRIPTION_LENGTH, SETTINGS_PATHS, KNOWN_HOOK_EVENTS, MCP_SETTINGS_FILES, REQUIRED_SECTIONS, SETTINGS_FILES, KNOWN_AGNIX_TOOLS, DEFAULT_SECTIONS, DEFAULT_RATIOS, NODE_TYPE_TO_CATEGORY, SECTION_LEVEL_MAP, DEFAULT_LEVEL, DEFAULT_BUDGET, DEFAULT_LOADER_CONFIG, LEVEL_FRACTIONS, PHASE_PRIORITIES, ManifestSchema, BundleConstraintsSchema, BundleSchema, ContributionsSchema, LockfilePackageSchema, LockfileSchema, SharableLayerSchema, SharableForbiddenImportSchema, SharableBoundaryConfigSchema, SharableSecurityRulesSchema, VALID_SCOPES, LINE_PATTERN, START_PATTERN, END_PATTERN, CODE_BLOCK_LANGUAGES, DEFAULT_DRIFT_CONFIG, JS_EXT_FALLBACKS2, FILE_TYPES, EXPORT_TYPES, CONVENTION_DESCRIPTIONS, RULE_CHECKERS, EntropyAnalyzer, readFile62, writeFile32, unlink22, mkdir22, copyFile2, DEFAULT_FIX_CONFIG, EXPORT_TYPE_KEYWORD, ALWAYS_UNSAFE_TYPES, idCounter, DEAD_CODE_FIX_ACTIONS, MustExportRuleSchema, MustExportDefaultRuleSchema, NoExportRuleSchema, MustImportRuleSchema, NoImportRuleSchema, NamingRuleSchema, MaxExportsRuleSchema, MaxLinesRuleSchema, RequireJSDocRuleSchema, RuleSchema, ConfigPatternSchema, PatternConfigSchema, DriftConfigSchema, DeadCodeConfigSchema, EntropyConfigSchema, BaselineManager, BenchmarkRunner, RegressionDetector, SKIP_DIRS, SOURCE_EXTENSIONS, FUNCTION_DECL_RE, CONST_DECL_RE, CriticalPathResolver, NoOpTelemetryAdapter, NoOpExecutor, ConsoleSink, feedbackConfig, ChecklistBuilder, AgentActionEmitter, globalEmitter, FileSink, NoOpSink, CategorySnapshotSchema, TimelineSnapshotSchema, TimelineFileSchema, TrendLineSchema, TrendResultSchema, DEFAULT_STABILITY_THRESHOLDS, ALL_CATEGORIES, TimelineManager, ConfidenceTierSchema, RegressionResultSchema, DirectionSchema, CategoryForecastSchema, SpecImpactSignalsSchema, SpecImpactEstimateSchema, ContributingFeatureSchema, AdjustedForecastSchema, PredictionWarningSchema, StabilityForecastSchema, PredictionResultSchema, PredictionOptionsSchema, VALID_STATUSES, EM_DASH, VALID_PRIORITIES, ALL_CATEGORIES2, DIRECTION_THRESHOLD, PredictionEngine, DEFAULT_COEFFICIENTS, SpecImpactEstimator, EMPTY_HISTORY, ViolationHistoryManager, NORMALIZERS, MAX_SAMPLES, DEFAULT_WINDOW_WEEKS, DEFAULT_MIN_OCCURRENCES, FailureEntrySchema, HandoffSchema, GateCheckSchema, GateResultSchema, GateConfigSchema, HarnessStateSchema, DEFAULT_STATE, StreamInfoSchema, StreamIndexSchema, DEFAULT_STREAM_INDEX, HARNESS_DIR, STATE_FILE, LEARNINGS_FILE, FAILURES_FILE, HANDOFF_FILE, GATE_CONFIG_FILE, INDEX_FILE, SESSIONS_DIR, SESSION_INDEX_FILE, SUMMARY_FILE, SESSION_STATE_FILE, ARCHIVE_DIR, CONTENT_HASHES_FILE, EVENTS_FILE, STREAMS_DIR, STREAM_NAME_REGEX, branchCache, BRANCH_CACHE_TTL_MS, STATE_FILES, MAX_CACHE_ENTRIES, learningsCacheMap, WEIGHTS, LOCK_RETRIES, LOCK_BACKOFFS, PROMOTABLE_OUTCOMES, failuresCacheMap, FAILURE_LINE_REGEX, SAFE_GATE_COMMAND, SkillEventSchema, knownHashesCache, EVENT_FORMATTERS, RuleRegistry, DEFAULT_SECURITY_CONFIG, RuleOverrideSchema, SecurityConfigSchema, secretRules, injectionRules, xssRules, cryptoRules, pathTraversalRules, networkRules, deserializationRules, agentConfigRules, mcpRules, insecureDefaultsRules, sharpEdgesRules, nodeRules, expressRules, reactRules, goRules, SecurityScanner, hiddenUnicodePatterns, reRolingPatterns, permissionEscalationPatterns, encodedPayloadPatterns, indirectInjectionPatterns, contextManipulationPatterns, socialEngineeringPatterns, suspiciousPatterns, ALL_PATTERNS, DESTRUCTIVE_BASH, TAINT_DURATION_MS, DEFAULT_SESSION_ID, SecurityCategorySnapshotSchema, SupplyChainSnapshotSchema, SecurityTimelineSnapshotSchema, FindingLifecycleSchema, SecurityTimelineFileSchema, DirectionSchema2, SecurityTrendLineSchema, TrendAttributionSchema, SecurityTrendResultSchema, TimeToFixStatsSchema, TimeToFixResultSchema, EMPTY_SUPPLY_CHAIN, SecurityTimelineManager, ALL_CHECKS, STATUS_ICONS, CINotifier, ExclusionSet, PREFIX_PATTERNS, TEST_FILE_PATTERN, MD_FILE_PATTERN, ALL_DOMAINS, SECURITY_PATTERNS, JS_EXT_FALLBACKS22, SEVERITY_RANK, SEVERITY_ORDER, SEVERITY_LABELS, VALIDATED_BY_RANK, VALIDATION_SCORES, DOMAIN_BASELINES, FACTOR_WEIGHTS, EVIDENCE_SATURATION, CORROBORATED_AGREEMENT, STANDALONE_AGREEMENT, AGREEMENT_LINE_GAP, COMPLIANCE_DESCRIPTOR, EXPORT_RE, BUG_DETECTION_DESCRIPTOR, SECURITY_DESCRIPTOR, EVAL_PATTERN, SECRET_PATTERNS, SQL_CONCAT_PATTERN, SHELL_EXEC_PATTERN, ARCHITECTURE_DESCRIPTOR, LARGE_FILE_THRESHOLD, VIOLATION_FILE_RE, LEARNINGS_DESCRIPTOR, RELEVANCE_THRESHOLD, AGENT_DESCRIPTORS, AGENT_RUNNERS, DOWNGRADE_MAP, DEFAULT_PROVIDER_TIERS, SMALL_SUGGESTION_LINE_LIMIT, FILE_LINE_RANGE_PATTERN, FILE_LINE_PATTERN, FILE_ONLY_PATTERN, SECURITY_SENSITIVE_PATH, MIGRATION_PATH, TEST_PATH, CONFIG_PATH, STAGE_DOMAINS, EM_DASH2, STATUS_RANK, RETRY_DEFAULTS, GitHubIssuesSyncAdapter, syncMutex, PRIORITY_RANK, POSITION_WEIGHT, DEPENDENTS_WEIGHT, AFFINITY_WEIGHT, InteractionTypeSchema, QuestionSchema, ConfirmationSchema, TransitionSchema, EmitInteractionInputSchema, ProjectScanner, SHELL_TEMPLATE, STYLES, SCRIPTS, MockLLMService, llmService, ContentPipeline, BlueprintGenerator, TOKENS_PER_MILLION, fallback_default, LITELLM_PRICING_URL, CACHE_TTL_MS, STALENESS_WARNING_DAYS, MICRODOLLARS_PER_DOLLAR, TOKENS_PER_MILLION2, StructuralStrategy, DEFAULT_TOKEN_BUDGET, CHARS_PER_TOKEN, TRUNCATION_MARKER, TruncationStrategy, CompactionPipeline, STABILITY_LOOKUP, TIER_ORDER, AnthropicCacheAdapter, TIER_ORDER2, OpenAICacheAdapter, TIER_ORDER3, CACHED_CONTENT_MARKER, GeminiCacheAdapter, VERSION, POSTHOG_BATCH_URL, MAX_ATTEMPTS, TIMEOUT_MS, CompoundLockHeldError, KNOWN_CATEGORIES, ALLOWED_FIELD_KEYS, PII_TOKENS, PII_FIELD_DENYLIST, PII_LINE_RE, ALLOWED_SET, PulseAdapterAlreadyRegisteredError, REGISTRY, MOCK_ADAPTER_NAME, ALLOWED_FIELD_SET, adapter, LOOKBACK_RE, MAX_LINES, INLINE_TEMPLATE, TRUNCATION_MARKER2, execFileAsync, FIX_RE, EMPTY_REPO_RE, execFileAsync2, TRACK_CATEGORIES2, STOPWORDS, KEYWORD_TO_CATEGORY;
 var init_dist3 = __esm({
   "../core/dist/index.mjs"() {
-    init_chunk_H73442AZ();
+    init_chunk_CE225WRK();
     init_dist();
     init_dist();
     init_dist();
@@ -15043,6 +15097,12 @@ var init_dist3 = __esm({
       checkStructure: true,
       ignorePatterns: []
     };
+    JS_EXT_FALLBACKS2 = {
+      ".js": [".ts", ".tsx", ".jsx"],
+      ".jsx": [".tsx"],
+      ".mjs": [".mts"],
+      ".cjs": [".cts"]
+    };
     FILE_TYPES = /* @__PURE__ */ new Set(["file", "module"]);
     EXPORT_TYPES = /* @__PURE__ */ new Set(["function", "class", "method", "interface", "variable"]);
     CONVENTION_DESCRIPTIONS = {
@@ -18397,6 +18457,10 @@ var init_dist3 = __esm({
       /**
        * Load timeline from disk.
        * Returns empty SecurityTimelineFile if file does not exist or is invalid.
+       * Lifecycle entries with absolute paths under rootDir are migrated to repo-relative
+       * form on read (older versions persisted whatever the scanner emitted, which leaked
+       * machine paths into committed timeline.json). Migrated files are re-saved so the
+       * fixup is one-shot.
        */
       load() {
         if (!existsSync332(this.timelinePath)) {
@@ -18413,6 +18477,15 @@ var init_dist3 = __esm({
             );
             return { version: 1, snapshots: [], findingLifecycles: [] };
           }
+          let mutated = false;
+          for (const lc of parsed.data.findingLifecycles) {
+            const next = this.toRepoRelativePath(lc.file);
+            if (next !== lc.file) {
+              lc.file = next;
+              mutated = true;
+            }
+          }
+          if (mutated) this.save(parsed.data);
           return parsed.data;
         } catch (error) {
           console.error(`Error loading security timeline from ${this.timelinePath}:`, error);
@@ -18437,16 +18510,17 @@ var init_dist3 = __esm({
        * appends to timeline (or replaces if same commitHash), and saves.
        */
       capture(scanResult, commitHash, supplyChain) {
-        const byCategory = this.aggregateByCategory(scanResult.findings);
-        const bySeverity = this.aggregateBySeverity(scanResult.findings);
-        const findingIds = scanResult.findings.map((f) => securityFindingId(f));
+        const normalized = scanResult.findings.map((f) => this.normalizeFindingPath(f));
+        const byCategory = this.aggregateByCategory(normalized);
+        const bySeverity = this.aggregateBySeverity(normalized);
+        const findingIds = normalized.map((f) => securityFindingId(f));
         const supply = supplyChain ?? EMPTY_SUPPLY_CHAIN;
         const snapshot = {
           capturedAt: (/* @__PURE__ */ new Date()).toISOString(),
           commitHash,
           securityScore: 0,
           // computed below
-          totalFindings: scanResult.findings.length,
+          totalFindings: normalized.length,
           bySeverity,
           byCategory,
           supplyChain: supply,
@@ -18509,13 +18583,14 @@ var init_dist3 = __esm({
        */
       updateLifecycles(currentFindings, commitHash) {
         const timeline = this.load();
-        const currentIds = new Set(currentFindings.map((f) => securityFindingId(f)));
+        const normalized = currentFindings.map((f) => this.normalizeFindingPath(f));
+        const currentIds = new Set(normalized.map((f) => securityFindingId(f)));
         const now = (/* @__PURE__ */ new Date()).toISOString();
         const lifecycleMap = /* @__PURE__ */ new Map();
         for (const lc of timeline.findingLifecycles) {
           lifecycleMap.set(lc.findingId, lc);
         }
-        for (const finding of currentFindings) {
+        for (const finding of normalized) {
           const id = securityFindingId(finding);
           this.upsertLifecycle(lifecycleMap, id, finding, now, commitHash);
         }
@@ -18630,6 +18705,23 @@ var init_dist3 = __esm({
         return Math.round(Math.max(0, Math.min(100, 100 - penalty)));
       }
       // --- Private helpers ---
+      /**
+       * Convert a path to repo-relative form using forward slashes. Absolute paths under
+       * rootDir are stripped; already-relative paths are normalized to forward slashes;
+       * paths that escape rootDir (relative starts with `..`) are returned unchanged so we
+       * never silently misattribute a finding outside the project.
+       */
+      toRepoRelativePath(filePath) {
+        if (!filePath) return filePath;
+        if (!isAbsolute4(filePath)) return filePath.replaceAll("\\", "/");
+        const rel = relative32(this.rootDir, filePath).replaceAll("\\", "/");
+        if (rel === "" || rel.startsWith("../") || rel === "..") return filePath;
+        return rel;
+      }
+      normalizeFindingPath(finding) {
+        const next = this.toRepoRelativePath(finding.file);
+        return next === finding.file ? finding : { ...finding, file: next };
+      }
       upsertLifecycle(map, id, finding, now, commitHash) {
         if (!map.has(id)) {
           map.set(id, {
@@ -18865,6 +18957,12 @@ var init_dist3 = __esm({
     MD_FILE_PATTERN = /\.md$/;
     ALL_DOMAINS = ["compliance", "bug", "security", "architecture", "learnings"];
     SECURITY_PATTERNS = /auth|crypto|password|secret|token|session|cookie|hash|encrypt|decrypt|sql|shell|exec|eval/i;
+    JS_EXT_FALLBACKS22 = {
+      ".js": [".ts", ".tsx", ".jsx"],
+      ".jsx": [".tsx"],
+      ".mjs": [".mts"],
+      ".cjs": [".cts"]
+    };
     SEVERITY_RANK = {
       suggestion: 0,
       important: 1,

package/dist/{chunk-M4C3ZIGL.js → chunk-KV7A5OZT.js}

@@ -6,7 +6,7 @@ import {
 } from "./chunk-W6Y7ZW3Y.js";
 import {
   init_dist
-} from "./chunk-MAFI6UWT.js";
+} from "./chunk-K4WRQTEF.js";
 import {
   Ok
 } from "./chunk-RL4VMEXL.js";
@@ -127,7 +127,7 @@ function buildSummaryResponse(report) {
 }
 async function handleDetectEntropy(input) {
   try {
-    const { EntropyAnalyzer } = await import("./dist-K22DQUYY.js");
+    const { EntropyAnalyzer } = await import("./dist-6RT2AVYU.js");
     const typeFilter = input.type ?? "all";
     const analyzer = new EntropyAnalyzer({
       rootDir: sanitizePath(input.path),
@@ -146,7 +146,7 @@ async function handleDetectEntropy(input) {
       return resultToMcpResponse(result);
     }
     if (!result.ok) return resultToMcpResponse(result);
-    const { createFixes, applyFixes, generateSuggestions } = await import("./dist-K22DQUYY.js");
+    const { createFixes, applyFixes, generateSuggestions } = await import("./dist-6RT2AVYU.js");
     const report = result.value;
     const deadCode = report.deadCode;
     const fixTypesConfig = input.fixTypes ? { fixTypes: input.fixTypes } : void 0;