@harness-engineering/cli 2.3.0 → 2.3.1

package/dist/{chunk-4DWOMGUM.js → chunk-YNG7BWGB.js}

@@ -9,17 +9,19 @@ import {
   isOk
 } from "./chunk-RL4VMEXL.js";
 import {
+  DEFAULT_SKIP_DIRS,
   GraphStore,
   NODE_STABILITY,
   init_dist as init_dist2,
-  queryTraceability
-} from "./chunk-BMM3GXV6.js";
+  queryTraceability,
+  skipDirGlobs
+} from "./chunk-XPRGWHBL.js";
 import {
   __esm,
   __export
 } from "./chunk-KFQGP6VL.js";
 
-// ../core/dist/chunk-NC4RPKD4.mjs
+// ../core/dist/chunk-4UI65RLE.mjs
 import { z } from "zod";
 import { createHash } from "crypto";
 import { minimatch } from "minimatch";
@@ -1421,7 +1423,7 @@ function mapForbiddenImportViolations(forbidden, rootDir, category) {
   });
 }
 function isSkippedEntry(name) {
-  return name.startsWith(".") || name === "node_modules" || name === "dist";
+  return name.startsWith(".") || DEFAULT_SKIP_DIRS.has(name);
 }
 function isTsSourceFile(name) {
   if (!name.endsWith(".ts") && !name.endsWith(".tsx")) return false;
@@ -1510,7 +1512,7 @@ function extractImportSources(content, filePath) {
   return sources;
 }
 function isSkippedEntry2(name) {
-  return name.startsWith(".") || name === "node_modules" || name === "dist";
+  return name.startsWith(".") || DEFAULT_SKIP_DIRS.has(name);
 }
 function isTsSourceFile2(name) {
   if (!name.endsWith(".ts") && !name.endsWith(".tsx")) return false;
@@ -1746,10 +1748,12 @@ async function toHaveMaxDepDepth(received, maxDepth) {
   };
 }
 var __defProp, __export2, ArchMetricCategorySchema, ViolationSchema, MetricResultSchema, CategoryBaselineSchema, ArchBaselineSchema, CategoryRegressionSchema, ArchDiffResultSchema, ThresholdConfigSchema, ArchConfigSchema, ConstraintRuleSchema, ViolationSnapshotSchema, ViolationHistorySchema, EmergenceConfidenceSchema, EmergentConstraintSuggestionSchema, EmergenceResultSchema, accessAsync, readFileAsync, EXTENSION_BY_LANG, JS_EXT_FALLBACKS, CircularDepsCollector, TypeScriptParser, EXTENSION_MAP, parserCache, initialized, GRAMMAR_MAP, TOP_LEVEL_TYPES, METHOD_TYPES, IDENTIFIER_TYPES, NAME_EXTRACTORS, pythonStrategy, goStrategy, RUST_USE_ARG_TYPES, RUST_PUB_ITEM_TYPES, rustStrategy, JAVA_IMPORT_TYPES, JAVA_EXPORT_TYPES, javaStrategy, STRATEGIES, TreeSitterParser, ParserRegistry, defaultRegistry, LayerViolationCollector, ArchBaselineManager, DEFAULT_THRESHOLDS, FUNCTION_PATTERNS, DECISION_PATTERNS, ComplexityCollector, DEFAULT_THRESHOLDS2, CouplingCollector, ForbiddenImportCollector, ModuleSizeCollector, DepDepthCollector, defaultCollectors, archMatchers;
-var init_chunk_NC4RPKD4 = __esm({
-  "../core/dist/chunk-NC4RPKD4.mjs"() {
+var init_chunk_4UI65RLE = __esm({
+  "../core/dist/chunk-4UI65RLE.mjs"() {
     "use strict";
     init_dist();
+    init_dist2();
+    init_dist2();
     __defProp = Object.defineProperty;
     __export2 = (target, all) => {
       for (var name in all)
@@ -2982,6 +2986,7 @@ __export(dist_exports, {
   ViolationHistorySchema: () => ViolationHistorySchema,
   ViolationSchema: () => ViolationSchema,
   ViolationSnapshotSchema: () => ViolationSnapshotSchema,
+  WHATWG_BAD_PORTS: () => WHATWG_BAD_PORTS,
   acquireCompoundLock: () => acquireCompoundLock,
   addProvenance: () => addProvenance,
   agentConfigRules: () => agentConfigRules,
@@ -3007,6 +3012,7 @@ __export(dist_exports, {
   archiveStream: () => archiveStream,
   assembleCandidateReport: () => assembleCandidateReport,
   assembleReport: () => assembleReport,
+  assertPortUsable: () => assertPortUsable,
   assertSanitized: () => assertSanitized,
   assignFeature: () => assignFeature,
   buildDependencyGraph: () => buildDependencyGraph,
@@ -3121,6 +3127,7 @@ __export(dist_exports, {
   goRules: () => goRules,
   injectionRules: () => injectionRules,
   insecureDefaultsRules: () => insecureDefaultsRules,
+  isBadPort: () => isBadPort,
   isDuplicateFinding: () => isDuplicateFinding,
   isErr: () => isErr,
   isOk: () => isOk,
@@ -3319,10 +3326,11 @@ import { basename as basename4, dirname as dirname42 } from "path";
 import { z as z3 } from "zod";
 import * as fs4 from "fs/promises";
 import * as fs5 from "fs/promises";
-import { join as join15, resolve as resolve42 } from "path";
+import { resolve as resolve5 } from "path";
 import { minimatch as minimatch22 } from "minimatch";
-import { dirname as dirname5, resolve as resolve5 } from "path";
-import { dirname as dirname6, extname as extname2, resolve as resolve6 } from "path";
+import { join as join15, resolve as resolve42 } from "path";
+import { dirname as dirname5, resolve as resolve6 } from "path";
+import { dirname as dirname6, extname as extname2, resolve as resolve7 } from "path";
 import { minimatch as minimatch3 } from "minimatch";
 import { readdirSync, statSync as statSync2 } from "fs";
 import { join as join16 } from "path";
@@ -3455,6 +3463,16 @@ import { execFile as execFile2 } from "child_process";
 import { promisify as promisify3 } from "util";
 import * as fs46 from "fs/promises";
 import * as path45 from "path";
+function isBadPort(port) {
+  return BAD_PORT_SET.has(port);
+}
+function assertPortUsable(port, label = "server") {
+  if (isBadPort(port)) {
+    throw new Error(
+      `Refusing to bind ${label} to port ${port}: this port is on the WHATWG fetch bad-ports list, so browsers and Node's fetch() will reject every connection with "bad port". Choose a different port. See https://fetch.spec.whatwg.org/#port-blocking for the full list.`
+    );
+  }
+}
 async function validateFileStructure(projectPath, conventions) {
   const missing = [];
   const unexpected = [];
@@ -3714,7 +3732,7 @@ function isAgnixDisabled() {
   return v === "1" || v === "true";
 }
 function runAgnix(cwd, strict, binPath, timeoutMs = DEFAULT_AGNIX_TIMEOUT_MS, spawnFn = spawn) {
-  return new Promise((resolve9) => {
+  return new Promise((resolve10) => {
     const args = ["--format", "json"];
     if (strict) args.push("--strict");
     args.push(cwd);
@@ -3728,7 +3746,7 @@ function runAgnix(cwd, strict, binPath, timeoutMs = DEFAULT_AGNIX_TIMEOUT_MS, sp
       if (settled) return;
       settled = true;
       clearTimeout(timer);
-      resolve9(outcome);
+      resolve10(outcome);
     };
     const timer = setTimeout(() => {
       child.kill("SIGKILL");
@@ -5867,44 +5885,232 @@ function extractPackageEntries(rootDir, pkg) {
   if (entries.length === 0 && typeof pkg["main"] === "string") {
     entries.push(resolve42(rootDir, pkg["main"]));
   }
-  if (pkg["bin"]) {
-    entries.push(...collectFieldEntries(rootDir, pkg["bin"]));
-  }
+  if (pkg["bin"]) entries.push(...collectFieldEntries(rootDir, pkg["bin"]));
   return entries;
 }
-async function resolveEntryPoints(rootDir, explicitEntries) {
-  if (explicitEntries && explicitEntries.length > 0) {
-    return Ok(explicitEntries.map((e) => resolve42(rootDir, e)));
+async function readPackageJsonEntries(rootDir, pkgPath) {
+  const content = await readFileContent(pkgPath);
+  if (!content.ok) return [];
+  try {
+    const pkg = JSON.parse(content.value);
+    return extractPackageEntries(rootDir, pkg);
+  } catch {
+    return [];
   }
+}
+async function resolveTypeScript(rootDir) {
   const pkgPath = join15(rootDir, "package.json");
-  if (await fileExists(pkgPath)) {
-    const pkgContent = await readFileContent(pkgPath);
-    if (pkgContent.ok) {
-      try {
-        const pkg = JSON.parse(pkgContent.value);
-        const entries = extractPackageEntries(rootDir, pkg);
-        if (entries.length > 0) return Ok(entries);
-      } catch {
-      }
+  const detected = await fileExists(pkgPath);
+  if (detected) {
+    const entries = await readPackageJsonEntries(rootDir, pkgPath);
+    if (entries.length > 0) {
+      return { language: "typescript", detected: true, entries, hints: TS_HINTS };
+    }
+  }
+  for (const conv of TS_CONVENTIONS) {
+    const p = join15(rootDir, conv);
+    if (await fileExists(p)) {
+      return { language: "typescript", detected: true, entries: [p], hints: TS_HINTS };
+    }
+  }
+  return { language: "typescript", detected, entries: [], hints: TS_HINTS };
+}
+async function detectPython(rootDir) {
+  return await fileExists(join15(rootDir, "pyproject.toml")) || await fileExists(join15(rootDir, "setup.py")) || await fileExists(join15(rootDir, "requirements.txt"));
+}
+async function readPyProject(rootDir) {
+  const pyproject = join15(rootDir, "pyproject.toml");
+  if (!await fileExists(pyproject)) return { scriptTargets: [] };
+  const content = await readFileContent(pyproject);
+  if (!content.ok) return { scriptTargets: [] };
+  return parsePyProject(content.value);
+}
+async function resolveScriptTargetEntry(rootDir, target) {
+  const mod = target.split(":")[0];
+  if (!mod) return void 0;
+  const relPath2 = mod.replaceAll(".", "/") + ".py";
+  for (const candidate of [join15(rootDir, relPath2), join15(rootDir, "src", relPath2)]) {
+    if (await fileExists(candidate)) return candidate;
+  }
+  return void 0;
+}
+async function resolvePythonFromScripts(rootDir, targets) {
+  const entries = [];
+  for (const target of targets) {
+    const entry = await resolveScriptTargetEntry(rootDir, target);
+    if (entry) entries.push(entry);
+  }
+  return entries;
+}
+async function resolvePythonFromProjectName(rootDir, projectName) {
+  if (!projectName) return [];
+  const normalized = projectName.replaceAll("-", "_");
+  const candidates = [
+    join15(rootDir, normalized, "__init__.py"),
+    join15(rootDir, normalized, "__main__.py"),
+    join15(rootDir, "src", normalized, "__init__.py"),
+    join15(rootDir, "src", normalized, "__main__.py")
+  ];
+  const entries = [];
+  for (const c of candidates) {
+    if (await fileExists(c)) entries.push(c);
+  }
+  return entries;
+}
+async function resolvePythonConventions(rootDir) {
+  const entries = [];
+  for (const conv of PYTHON_CONVENTIONS) {
+    const p = join15(rootDir, conv);
+    if (await fileExists(p)) entries.push(p);
+  }
+  return entries;
+}
+async function findPythonTopLevelPackages(rootDir) {
+  const found = await findFiles("*/__init__.py", rootDir);
+  if (found.length > 0) return found;
+  return findFiles("src/*/__init__.py", rootDir);
+}
+async function resolvePython(rootDir) {
+  if (!await detectPython(rootDir)) {
+    return { language: "python", detected: false, entries: [], hints: PYTHON_HINTS };
+  }
+  const info = await readPyProject(rootDir);
+  const strategies = [
+    () => resolvePythonFromScripts(rootDir, info.scriptTargets),
+    () => resolvePythonFromProjectName(rootDir, info.projectName),
+    () => resolvePythonConventions(rootDir),
+    () => findPythonTopLevelPackages(rootDir)
+  ];
+  for (const strategy of strategies) {
+    const entries = await strategy();
+    if (entries.length > 0) {
+      return { language: "python", detected: true, entries, hints: PYTHON_HINTS };
+    }
+  }
+  return { language: "python", detected: true, entries: [], hints: PYTHON_HINTS };
+}
+async function resolveGo(rootDir) {
+  const hints = ["Create main.go at the project root, or use the cmd/<name>/main.go layout"];
+  const detected = await fileExists(join15(rootDir, "go.mod"));
+  if (!detected) return { language: "go", detected: false, entries: [], hints };
+  const entries = [];
+  const mainGo = join15(rootDir, "main.go");
+  if (await fileExists(mainGo)) entries.push(mainGo);
+  entries.push(...await findFiles("cmd/*/main.go", rootDir));
+  return { language: "go", detected: true, entries, hints };
+}
+async function resolveRust(rootDir) {
+  const hints = [
+    "Create src/main.rs or src/lib.rs",
+    "Declare [[bin]] entries with a `path` in Cargo.toml"
+  ];
+  const cargoPath = join15(rootDir, "Cargo.toml");
+  const detected = await fileExists(cargoPath);
+  if (!detected) return { language: "rust", detected: false, entries: [], hints };
+  const entries = [];
+  const content = await readFileContent(cargoPath);
+  if (content.ok) {
+    for (const bp of parseCargoBinPaths(content.value)) {
+      const abs = resolve42(rootDir, bp);
+      if (await fileExists(abs)) entries.push(abs);
     }
   }
-  const conventions = ["src/index.ts", "src/main.ts", "index.ts", "main.ts"];
-  for (const conv of conventions) {
-    const convPath = join15(rootDir, conv);
-    if (await fileExists(convPath)) {
-      return Ok([convPath]);
+  if (entries.length === 0) {
+    for (const conv of ["src/main.rs", "src/lib.rs"]) {
+      const p = join15(rootDir, conv);
+      if (await fileExists(p)) entries.push(p);
     }
+    entries.push(...await findFiles("src/bin/*.rs", rootDir));
+  }
+  return { language: "rust", detected: true, entries, hints };
+}
+async function resolveJava(rootDir) {
+  const hints = [
+    "Place an entry class at src/main/java/**/Main.java (or *Application.java for Spring Boot)"
+  ];
+  const detected = await fileExists(join15(rootDir, "pom.xml")) || await fileExists(join15(rootDir, "build.gradle")) || await fileExists(join15(rootDir, "build.gradle.kts"));
+  if (!detected) return { language: "java", detected: false, entries: [], hints };
+  const entries = [];
+  entries.push(...await findFiles("src/main/java/**/Main.java", rootDir));
+  entries.push(...await findFiles("src/main/java/**/*Application.java", rootDir));
+  return { language: "java", detected: true, entries, hints };
+}
+function parseTomlLine(raw) {
+  const line = raw.replace(/(^|\s)#.*$/, "").trim();
+  if (!line) return {};
+  const sectionMatch = /^\[([^\]]+)\]$/.exec(line);
+  if (sectionMatch) return { section: sectionMatch[1] ?? "" };
+  const eq = line.indexOf("=");
+  if (eq <= 0) return {};
+  return {
+    key: line.slice(0, eq).trim(),
+    value: stripTomlString2(line.slice(eq + 1).trim())
+  };
+}
+function parsePyProject(content) {
+  const result = { scriptTargets: [] };
+  let section = null;
+  for (const raw of content.split(/\r?\n/)) {
+    const parsed = parseTomlLine(raw);
+    if (parsed.section !== void 0) {
+      section = parsed.section;
+      continue;
+    }
+    if (parsed.key === void 0 || parsed.value === void 0) continue;
+    if (section === "project" && parsed.key === "name") result.projectName = parsed.value;
+    else if (section === "project.scripts") result.scriptTargets.push(parsed.value);
+  }
+  return result;
+}
+function parseCargoBinPaths(content) {
+  const paths = [];
+  let inBin = false;
+  for (const raw of content.split(/\r?\n/)) {
+    const line = raw.replace(/(^|\s)#.*$/, "").trim();
+    if (!line) continue;
+    if (line === "[[bin]]") {
+      inBin = true;
+      continue;
+    }
+    if (line.startsWith("[")) {
+      inBin = false;
+      continue;
+    }
+    if (!inBin) continue;
+    const eq = line.indexOf("=");
+    if (eq <= 0) continue;
+    const key = line.slice(0, eq).trim();
+    if (key === "path") paths.push(stripTomlString2(line.slice(eq + 1).trim()));
+  }
+  return paths;
+}
+function stripTomlString2(value) {
+  if (value.startsWith('"') && value.endsWith('"') || value.startsWith("'") && value.endsWith("'")) {
+    return value.slice(1, -1);
   }
+  return value;
+}
+async function resolveEntryPoints(rootDir, explicitEntries) {
+  if (explicitEntries && explicitEntries.length > 0) {
+    return Ok(explicitEntries.map((e) => resolve42(rootDir, e)));
+  }
+  const resolvers = [resolveTypeScript, resolvePython, resolveGo, resolveRust, resolveJava];
+  const resolutions = [];
+  for (const resolver of resolvers) {
+    const res = await resolver(rootDir);
+    resolutions.push(res);
+    if (res.entries.length > 0) return Ok(res.entries);
+  }
+  const detectedLangs = resolutions.filter((r) => r.detected);
+  const suggestions = detectedLangs.length > 0 ? detectedLangs.flatMap((r) => r.hints) : resolutions.flatMap((r) => r.hints);
+  suggestions.push("Specify entryPoints in config");
+  const reason = detectedLangs.length > 0 ? `Detected ${detectedLangs.map((r) => r.language).join(", ")} project but found no entry points` : "No language manifest (package.json, pyproject.toml, go.mod, Cargo.toml, pom.xml) and no conventional entry files found";
   return Err(
     createEntropyError(
       "ENTRY_POINT_NOT_FOUND",
       "Could not resolve entry points",
-      { reason: "No package.json exports/main and no conventional entry files found" },
-      [
-        'Add "exports" or "main" to package.json',
-        "Create src/index.ts",
-        "Specify entryPoints in config"
-      ]
+      { reason },
+      suggestions
     )
   );
 }
@@ -6001,6 +6207,7 @@ function extractSymbolsFromNode(node) {
   return [];
 }
 function extractInternalSymbols(ast) {
+  if (ast.language !== "typescript" && ast.language !== "javascript") return [];
   const body = ast.body;
   if (!body?.body) return [];
   const nodes = body.body;
@@ -6011,6 +6218,7 @@ function toJSDocComment(comment) {
   return { content: comment.value, line: comment.loc?.start?.line || 0 };
 }
 function extractJSDocComments(ast) {
+  if (ast.language !== "typescript" && ast.language !== "javascript") return [];
   const body = ast.body;
   if (!body?.comments) return [];
   return body.comments.flatMap((c) => {
@@ -6068,19 +6276,16 @@ function extractAllCodeReferences(docs) {
 }
 async function buildSnapshot2(config) {
   const startTime = Date.now();
-  const parser = config.parser || new TypeScriptParser();
-  const rootDir = resolve42(config.rootDir);
+  const rootDir = resolve5(config.rootDir);
   const entryPointsResult = await resolveEntryPoints(rootDir, config.entryPoints);
   if (!entryPointsResult.ok) {
     return Err(entryPointsResult.error);
   }
-  const includePatterns = config.include || ["**/*.ts", "**/*.tsx"];
-  const excludePatterns = config.exclude || [
-    "node_modules/**",
-    "dist/**",
-    "**/*.test.ts",
-    "**/*.spec.ts"
-  ];
+  const registry = getDefaultRegistry();
+  const singleParser = config.parser;
+  const parserForFile = (filePath) => singleParser ?? registry.getForFile(filePath);
+  const includePatterns = config.include || DEFAULT_INCLUDE_PATTERNS;
+  const excludePatterns = config.exclude || [...skipDirGlobs(), "**/*.test.ts", "**/*.spec.ts"];
   let sourceFilePaths = [];
   for (const pattern of includePatterns) {
     const files2 = await findFiles(pattern, rootDir);
@@ -6092,10 +6297,12 @@ async function buildSnapshot2(config) {
   });
   const files = [];
   for (const filePath of sourceFilePaths) {
-    const parseResult = await parser.parseFile(filePath);
+    const fileParser = parserForFile(filePath);
+    if (!fileParser) continue;
+    const parseResult = await fileParser.parseFile(filePath);
     if (!parseResult.ok) continue;
-    const importsResult = parser.extractImports(parseResult.value);
-    const exportsResult = parser.extractExports(parseResult.value);
+    const importsResult = fileParser.extractImports(parseResult.value);
+    const exportsResult = fileParser.extractExports(parseResult.value);
     const internalSymbols = extractInternalSymbols(parseResult.value);
     const jsDocComments = extractJSDocComments(parseResult.value);
     files.push({
@@ -6107,7 +6314,7 @@ async function buildSnapshot2(config) {
       jsDocComments
     });
   }
-  const graphResult = await buildDependencyGraph(sourceFilePaths, parser);
+  const graphResult = await buildDependencyGraph(sourceFilePaths, singleParser ?? registry);
   const dependencyGraph = graphResult.ok ? graphResult.value : { nodes: [], edges: [] };
   const docPatterns = config.docPaths || ["docs/**/*.md", "README.md", "**/README.md"];
   let docFilePaths = [];
@@ -6242,7 +6449,7 @@ async function checkStructureDrift(snapshot, _config) {
   for (const doc of snapshot.docs) {
     const fileLinks = extractFileLinks(doc.content);
     for (const { link, line } of fileLinks) {
-      const resolvedPath = resolve5(dirname5(doc.path), link);
+      const resolvedPath = resolve6(dirname5(doc.path), link);
       const exists = await fileExists(resolvedPath);
       if (!exists) {
         drifts.push({
@@ -6344,7 +6551,7 @@ function resolveImportToFile(importSource, fromFile, snapshot, fileIndex) {
   }
   const hasFile = fileIndex ? (p) => fileIndex.has(p) : (p) => snapshot.files.some((f) => f.path === p);
   const fromDir = dirname6(fromFile);
-  const resolved = resolve6(fromDir, importSource);
+  const resolved = resolve7(fromDir, importSource);
   const sourceExt = extname2(resolved);
   const fallbacks = JS_EXT_FALLBACKS2[sourceExt];
   if (fallbacks) {
@@ -6354,7 +6561,7 @@ function resolveImportToFile(importSource, fromFile, snapshot, fileIndex) {
       if (hasFile(candidate)) return candidate;
     }
     for (const indexExt of [".ts", ".tsx", ".jsx"]) {
-      const indexPath2 = resolve6(base, "index" + indexExt);
+      const indexPath2 = resolve7(base, "index" + indexExt);
       if (hasFile(indexPath2)) return indexPath2;
     }
   }
@@ -6365,7 +6572,7 @@ function resolveImportToFile(importSource, fromFile, snapshot, fileIndex) {
       if (hasFile(candidate)) return candidate;
     }
     for (const indexExt of [".ts", ".tsx"]) {
-      const indexPath2 = resolve6(resolved, "index" + indexExt);
+      const indexPath2 = resolve7(resolved, "index" + indexExt);
       if (hasFile(indexPath2)) return indexPath2;
     }
   }
@@ -6881,7 +7088,7 @@ function dirSize(dirPath) {
     return 0;
   }
   for (const entry of entries) {
-    if (entry === "node_modules" || entry === ".git") continue;
+    if (DEFAULT_SKIP_DIRS.has(entry)) continue;
     const fullPath = join16(dirPath, entry);
     try {
       const stat2 = statSync2(fullPath);
@@ -8938,7 +9145,7 @@ function checkOverlap(newEntry, existingEntries, options) {
   };
 }
 function sleep(ms) {
-  return new Promise((resolve9) => setTimeout(resolve9, ms));
+  return new Promise((resolve10) => setTimeout(resolve10, ms));
 }
 async function acquireFileLock(lockPath) {
   for (let attempt = 0; attempt < LOCK_RETRIES; attempt++) {
@@ -10415,8 +10622,7 @@ async function runDocsCheck(projectRoot, config) {
     docsDir,
     sourceDir: projectRoot,
     excludePatterns: entropyConfig.excludePatterns || [
-      "**/node_modules/**",
-      "**/dist/**",
+      ...skipDirGlobs(),
       "**/*.test.ts",
       "**/fixtures/**"
     ]
@@ -10481,12 +10687,7 @@ async function runSecurityCheck(projectRoot, config) {
   const { glob: globFn } = await import("glob");
   const sourceFiles = await globFn("**/*.{ts,tsx,js,jsx,go,py}", {
     cwd: projectRoot,
-    ignore: securityConfig.exclude ?? [
-      "**/node_modules/**",
-      "**/dist/**",
-      "**/*.test.ts",
-      "**/fixtures/**"
-    ],
+    ignore: securityConfig.exclude ?? [...skipDirGlobs(), "**/*.test.ts", "**/fixtures/**"],
     absolute: true
   });
   const scanResult = await scanner.scanFiles(sourceFiles);
@@ -13008,7 +13209,7 @@ function parseRepoParts(repo) {
   return { owner: parts[0], repo: parts[1] };
 }
 function sleep2(ms) {
-  return new Promise((resolve9) => setTimeout(resolve9, ms));
+  return new Promise((resolve10) => setTimeout(resolve10, ms));
 }
 async function fetchWithRetry(fetchFn, input, init, opts = RETRY_DEFAULTS) {
   let lastResponse;
@@ -13158,8 +13359,8 @@ async function syncFromExternal(roadmap, adapter2, config, options, prefetchedTi
 async function fullSync(roadmapPath, adapter2, config, options) {
   const previousSync = syncMutex;
   let releaseMutex;
-  syncMutex = new Promise((resolve9) => {
-    releaseMutex = resolve9;
+  syncMutex = new Promise((resolve10) => {
+    releaseMutex = resolve10;
   });
   await previousSync;
   try {
@@ -14822,7 +15023,7 @@ function collectEvents(projectRoot, consent) {
   );
 }
 function sleep3(ms) {
-  return new Promise((resolve9) => setTimeout(resolve9, ms));
+  return new Promise((resolve10) => setTimeout(resolve10, ms));
 }
 async function send(events, apiKey) {
   if (events.length === 0) return;
@@ -15395,14 +15596,20 @@ function assembleCandidateReport(input) {
   }
   return lines.join("\n");
 }
-var VALID_TYPES, CONVENTIONAL_PATTERN, LOOKBACK_PATTERN, PulseDbSourceSchema, PulseSourcesSchema, PulseConfigSchema, BUG_TRACK_CATEGORIES, KNOWLEDGE_TRACK_CATEGORIES, ALL_SOLUTION_CATEGORIES, ISO_DATE, BugTrackSchema, KnowledgeTrackSchema, BaseFrontmatter, SolutionDocFrontmatterSchema, TRACK_CATEGORIES, DEFAULT_AGNIX_TIMEOUT_MS, HARNESS_AGNIX_DISABLE, HARNESS_AGNIX_BIN, CLAUDE_MD_WARN_BYTES, CLAUDE_MD_ERROR_BYTES, CONTEXT_FILES, MIN_DESCRIPTION_LENGTH, SETTINGS_PATHS, KNOWN_HOOK_EVENTS, MCP_SETTINGS_FILES, REQUIRED_SECTIONS, SETTINGS_FILES, KNOWN_AGNIX_TOOLS, DEFAULT_SECTIONS, DEFAULT_RATIOS, NODE_TYPE_TO_CATEGORY, SECTION_LEVEL_MAP, DEFAULT_LEVEL, DEFAULT_BUDGET, DEFAULT_LOADER_CONFIG, LEVEL_FRACTIONS, PHASE_PRIORITIES, ManifestSchema, BundleConstraintsSchema, BundleSchema, ContributionsSchema, LockfilePackageSchema, LockfileSchema, SharableLayerSchema, SharableForbiddenImportSchema, SharableBoundaryConfigSchema, SharableSecurityRulesSchema, VALID_SCOPES, LINE_PATTERN, START_PATTERN, END_PATTERN, CODE_BLOCK_LANGUAGES, DEFAULT_DRIFT_CONFIG, JS_EXT_FALLBACKS2, FILE_TYPES, EXPORT_TYPES, CONVENTION_DESCRIPTIONS, RULE_CHECKERS, EntropyAnalyzer, readFile62, writeFile32, unlink22, mkdir22, copyFile2, DEFAULT_FIX_CONFIG, EXPORT_TYPE_KEYWORD, ALWAYS_UNSAFE_TYPES, idCounter, DEAD_CODE_FIX_ACTIONS, MustExportRuleSchema, MustExportDefaultRuleSchema, NoExportRuleSchema, MustImportRuleSchema, NoImportRuleSchema, NamingRuleSchema, MaxExportsRuleSchema, MaxLinesRuleSchema, RequireJSDocRuleSchema, RuleSchema, ConfigPatternSchema, PatternConfigSchema, DriftConfigSchema, DeadCodeConfigSchema, EntropyConfigSchema, BaselineManager, BenchmarkRunner, RegressionDetector, SKIP_DIRS, SOURCE_EXTENSIONS, FUNCTION_DECL_RE, CONST_DECL_RE, CriticalPathResolver, NoOpTelemetryAdapter, NoOpExecutor, ConsoleSink, feedbackConfig, ChecklistBuilder, AgentActionEmitter, globalEmitter, FileSink, NoOpSink, CategorySnapshotSchema, TimelineSnapshotSchema, TimelineFileSchema, TrendLineSchema, TrendResultSchema, DEFAULT_STABILITY_THRESHOLDS, ALL_CATEGORIES, TimelineManager, ConfidenceTierSchema, RegressionResultSchema, DirectionSchema, CategoryForecastSchema, SpecImpactSignalsSchema, SpecImpactEstimateSchema, ContributingFeatureSchema, AdjustedForecastSchema, PredictionWarningSchema, StabilityForecastSchema, PredictionResultSchema, PredictionOptionsSchema, VALID_STATUSES, EM_DASH, VALID_PRIORITIES, ALL_CATEGORIES2, DIRECTION_THRESHOLD, PredictionEngine, DEFAULT_COEFFICIENTS, SpecImpactEstimator, EMPTY_HISTORY, ViolationHistoryManager, NORMALIZERS, MAX_SAMPLES, DEFAULT_WINDOW_WEEKS, DEFAULT_MIN_OCCURRENCES, FailureEntrySchema, HandoffSchema, GateCheckSchema, GateResultSchema, GateConfigSchema, HarnessStateSchema, DEFAULT_STATE, StreamInfoSchema, StreamIndexSchema, DEFAULT_STREAM_INDEX, HARNESS_DIR, STATE_FILE, LEARNINGS_FILE, FAILURES_FILE, HANDOFF_FILE, GATE_CONFIG_FILE, INDEX_FILE, SESSIONS_DIR, SESSION_INDEX_FILE, SUMMARY_FILE, SESSION_STATE_FILE, ARCHIVE_DIR, CONTENT_HASHES_FILE, EVENTS_FILE, STREAMS_DIR, STREAM_NAME_REGEX, branchCache, BRANCH_CACHE_TTL_MS, STATE_FILES, MAX_CACHE_ENTRIES, learningsCacheMap, WEIGHTS, LOCK_RETRIES, LOCK_BACKOFFS, PROMOTABLE_OUTCOMES, failuresCacheMap, FAILURE_LINE_REGEX, SAFE_GATE_COMMAND, SkillEventSchema, knownHashesCache, EVENT_FORMATTERS, RuleRegistry, DEFAULT_SECURITY_CONFIG, RuleOverrideSchema, SecurityConfigSchema, secretRules, injectionRules, xssRules, cryptoRules, pathTraversalRules, networkRules, deserializationRules, agentConfigRules, mcpRules, insecureDefaultsRules, sharpEdgesRules, nodeRules, expressRules, reactRules, goRules, SecurityScanner, hiddenUnicodePatterns, reRolingPatterns, permissionEscalationPatterns, encodedPayloadPatterns, indirectInjectionPatterns, contextManipulationPatterns, socialEngineeringPatterns, suspiciousPatterns, ALL_PATTERNS, DESTRUCTIVE_BASH, TAINT_DURATION_MS, DEFAULT_SESSION_ID, SecurityCategorySnapshotSchema, SupplyChainSnapshotSchema, SecurityTimelineSnapshotSchema, FindingLifecycleSchema, SecurityTimelineFileSchema, DirectionSchema2, SecurityTrendLineSchema, TrendAttributionSchema, SecurityTrendResultSchema, TimeToFixStatsSchema, TimeToFixResultSchema, EMPTY_SUPPLY_CHAIN, SecurityTimelineManager, ALL_CHECKS, STATUS_ICONS, CINotifier, ExclusionSet, PREFIX_PATTERNS, TEST_FILE_PATTERN, MD_FILE_PATTERN, ALL_DOMAINS, SECURITY_PATTERNS, JS_EXT_FALLBACKS22, SEVERITY_RANK, SEVERITY_ORDER, SEVERITY_LABELS, VALIDATED_BY_RANK, VALIDATION_SCORES, DOMAIN_BASELINES, FACTOR_WEIGHTS, EVIDENCE_SATURATION, CORROBORATED_AGREEMENT, STANDALONE_AGREEMENT, AGREEMENT_LINE_GAP, COMPLIANCE_DESCRIPTOR, EXPORT_RE, BUG_DETECTION_DESCRIPTOR, SECURITY_DESCRIPTOR, EVAL_PATTERN, SECRET_PATTERNS, SQL_CONCAT_PATTERN, SHELL_EXEC_PATTERN, ARCHITECTURE_DESCRIPTOR, LARGE_FILE_THRESHOLD, VIOLATION_FILE_RE, LEARNINGS_DESCRIPTOR, RELEVANCE_THRESHOLD, AGENT_DESCRIPTORS, AGENT_RUNNERS, DOWNGRADE_MAP, DEFAULT_PROVIDER_TIERS, SMALL_SUGGESTION_LINE_LIMIT, FILE_LINE_RANGE_PATTERN, FILE_LINE_PATTERN, FILE_ONLY_PATTERN, SECURITY_SENSITIVE_PATH, MIGRATION_PATH, TEST_PATH, CONFIG_PATH, STAGE_DOMAINS, EM_DASH2, STATUS_RANK, RETRY_DEFAULTS, GitHubIssuesSyncAdapter, syncMutex, PRIORITY_RANK, PRIORITY_RANK2, POSITION_WEIGHT, DEPENDENTS_WEIGHT, AFFINITY_WEIGHT, ConflictError, DEFAULTS, GitHubHttp, ETagStore, START_MARKER, END_MARKER, SERIALIZER_FIELDS, GitHubIssuesTrackerAdapter, migrate_exports, HASH_RE, InteractionTypeSchema, QuestionSchema, ConfirmationSchema, TransitionSchema, EmitInteractionInputSchema, ProjectScanner, SHELL_TEMPLATE, STYLES, SCRIPTS, MockLLMService, llmService, ContentPipeline, BlueprintGenerator, TOKENS_PER_MILLION, fallback_default, LITELLM_PRICING_URL, CACHE_TTL_MS, STALENESS_WARNING_DAYS, MICRODOLLARS_PER_DOLLAR, TOKENS_PER_MILLION2, StructuralStrategy, DEFAULT_TOKEN_BUDGET, CHARS_PER_TOKEN, TRUNCATION_MARKER, TruncationStrategy, CompactionPipeline, STABILITY_LOOKUP, TIER_ORDER, AnthropicCacheAdapter, TIER_ORDER2, OpenAICacheAdapter, TIER_ORDER3, CACHED_CONTENT_MARKER, GeminiCacheAdapter, VERSION, POSTHOG_BATCH_URL, MAX_ATTEMPTS, TIMEOUT_MS, CompoundLockHeldError, KNOWN_CATEGORIES, ALLOWED_FIELD_KEYS, PII_TOKENS, PII_FIELD_DENYLIST, PII_LINE_RE, ALLOWED_SET, PulseAdapterAlreadyRegisteredError, REGISTRY, MOCK_ADAPTER_NAME, ALLOWED_FIELD_SET, adapter, LOOKBACK_RE, MAX_LINES, INLINE_TEMPLATE, TRUNCATION_MARKER2, execFileAsync, FIX_RE, EMPTY_REPO_RE, execFileAsync2, TRACK_CATEGORIES2, STOPWORDS, KEYWORD_TO_CATEGORY;
+var WHATWG_BAD_PORTS, BAD_PORT_SET, VALID_TYPES, CONVENTIONAL_PATTERN, LOOKBACK_PATTERN, PulseDbSourceSchema, PulseSourcesSchema, PulseConfigSchema, BUG_TRACK_CATEGORIES, KNOWLEDGE_TRACK_CATEGORIES, ALL_SOLUTION_CATEGORIES, ISO_DATE, BugTrackSchema, KnowledgeTrackSchema, BaseFrontmatter, SolutionDocFrontmatterSchema, TRACK_CATEGORIES, DEFAULT_AGNIX_TIMEOUT_MS, HARNESS_AGNIX_DISABLE, HARNESS_AGNIX_BIN, CLAUDE_MD_WARN_BYTES, CLAUDE_MD_ERROR_BYTES, CONTEXT_FILES, MIN_DESCRIPTION_LENGTH, SETTINGS_PATHS, KNOWN_HOOK_EVENTS, MCP_SETTINGS_FILES, REQUIRED_SECTIONS, SETTINGS_FILES, KNOWN_AGNIX_TOOLS, DEFAULT_SECTIONS, DEFAULT_RATIOS, NODE_TYPE_TO_CATEGORY, SECTION_LEVEL_MAP, DEFAULT_LEVEL, DEFAULT_BUDGET, DEFAULT_LOADER_CONFIG, LEVEL_FRACTIONS, PHASE_PRIORITIES, ManifestSchema, BundleConstraintsSchema, BundleSchema, ContributionsSchema, LockfilePackageSchema, LockfileSchema, SharableLayerSchema, SharableForbiddenImportSchema, SharableBoundaryConfigSchema, SharableSecurityRulesSchema, VALID_SCOPES, LINE_PATTERN, START_PATTERN, END_PATTERN, TS_HINTS, TS_CONVENTIONS, PYTHON_HINTS, PYTHON_CONVENTIONS, DEFAULT_INCLUDE_PATTERNS, CODE_BLOCK_LANGUAGES, DEFAULT_DRIFT_CONFIG, JS_EXT_FALLBACKS2, FILE_TYPES, EXPORT_TYPES, CONVENTION_DESCRIPTIONS, RULE_CHECKERS, EntropyAnalyzer, readFile62, writeFile32, unlink22, mkdir22, copyFile2, DEFAULT_FIX_CONFIG, EXPORT_TYPE_KEYWORD, ALWAYS_UNSAFE_TYPES, idCounter, DEAD_CODE_FIX_ACTIONS, MustExportRuleSchema, MustExportDefaultRuleSchema, NoExportRuleSchema, MustImportRuleSchema, NoImportRuleSchema, NamingRuleSchema, MaxExportsRuleSchema, MaxLinesRuleSchema, RequireJSDocRuleSchema, RuleSchema, ConfigPatternSchema, PatternConfigSchema, DriftConfigSchema, DeadCodeConfigSchema, EntropyConfigSchema, BaselineManager, BenchmarkRunner, RegressionDetector, SOURCE_EXTENSIONS, FUNCTION_DECL_RE, CONST_DECL_RE, CriticalPathResolver, NoOpTelemetryAdapter, NoOpExecutor, ConsoleSink, feedbackConfig, ChecklistBuilder, AgentActionEmitter, globalEmitter, FileSink, NoOpSink, CategorySnapshotSchema, TimelineSnapshotSchema, TimelineFileSchema, TrendLineSchema, TrendResultSchema, DEFAULT_STABILITY_THRESHOLDS, ALL_CATEGORIES, TimelineManager, ConfidenceTierSchema, RegressionResultSchema, DirectionSchema, CategoryForecastSchema, SpecImpactSignalsSchema, SpecImpactEstimateSchema, ContributingFeatureSchema, AdjustedForecastSchema, PredictionWarningSchema, StabilityForecastSchema, PredictionResultSchema, PredictionOptionsSchema, VALID_STATUSES, EM_DASH, VALID_PRIORITIES, ALL_CATEGORIES2, DIRECTION_THRESHOLD, PredictionEngine, DEFAULT_COEFFICIENTS, SpecImpactEstimator, EMPTY_HISTORY, ViolationHistoryManager, NORMALIZERS, MAX_SAMPLES, DEFAULT_WINDOW_WEEKS, DEFAULT_MIN_OCCURRENCES, FailureEntrySchema, HandoffSchema, GateCheckSchema, GateResultSchema, GateConfigSchema, HarnessStateSchema, DEFAULT_STATE, StreamInfoSchema, StreamIndexSchema, DEFAULT_STREAM_INDEX, HARNESS_DIR, STATE_FILE, LEARNINGS_FILE, FAILURES_FILE, HANDOFF_FILE, GATE_CONFIG_FILE, INDEX_FILE, SESSIONS_DIR, SESSION_INDEX_FILE, SUMMARY_FILE, SESSION_STATE_FILE, ARCHIVE_DIR, CONTENT_HASHES_FILE, EVENTS_FILE, STREAMS_DIR, STREAM_NAME_REGEX, branchCache, BRANCH_CACHE_TTL_MS, STATE_FILES, MAX_CACHE_ENTRIES, learningsCacheMap, WEIGHTS, LOCK_RETRIES, LOCK_BACKOFFS, PROMOTABLE_OUTCOMES, failuresCacheMap, FAILURE_LINE_REGEX, SAFE_GATE_COMMAND, SkillEventSchema, knownHashesCache, EVENT_FORMATTERS, RuleRegistry, DEFAULT_SECURITY_CONFIG, RuleOverrideSchema, SecurityConfigSchema, secretRules, injectionRules, xssRules, cryptoRules, pathTraversalRules, networkRules, deserializationRules, agentConfigRules, mcpRules, insecureDefaultsRules, sharpEdgesRules, nodeRules, expressRules, reactRules, goRules, SecurityScanner, hiddenUnicodePatterns, reRolingPatterns, permissionEscalationPatterns, encodedPayloadPatterns, indirectInjectionPatterns, contextManipulationPatterns, socialEngineeringPatterns, suspiciousPatterns, ALL_PATTERNS, DESTRUCTIVE_BASH, TAINT_DURATION_MS, DEFAULT_SESSION_ID, SecurityCategorySnapshotSchema, SupplyChainSnapshotSchema, SecurityTimelineSnapshotSchema, FindingLifecycleSchema, SecurityTimelineFileSchema, DirectionSchema2, SecurityTrendLineSchema, TrendAttributionSchema, SecurityTrendResultSchema, TimeToFixStatsSchema, TimeToFixResultSchema, EMPTY_SUPPLY_CHAIN, SecurityTimelineManager, ALL_CHECKS, STATUS_ICONS, CINotifier, ExclusionSet, PREFIX_PATTERNS, TEST_FILE_PATTERN, MD_FILE_PATTERN, ALL_DOMAINS, SECURITY_PATTERNS, JS_EXT_FALLBACKS22, SEVERITY_RANK, SEVERITY_ORDER, SEVERITY_LABELS, VALIDATED_BY_RANK, VALIDATION_SCORES, DOMAIN_BASELINES, FACTOR_WEIGHTS, EVIDENCE_SATURATION, CORROBORATED_AGREEMENT, STANDALONE_AGREEMENT, AGREEMENT_LINE_GAP, COMPLIANCE_DESCRIPTOR, EXPORT_RE, BUG_DETECTION_DESCRIPTOR, SECURITY_DESCRIPTOR, EVAL_PATTERN, SECRET_PATTERNS, SQL_CONCAT_PATTERN, SHELL_EXEC_PATTERN, ARCHITECTURE_DESCRIPTOR, LARGE_FILE_THRESHOLD, VIOLATION_FILE_RE, LEARNINGS_DESCRIPTOR, RELEVANCE_THRESHOLD, AGENT_DESCRIPTORS, AGENT_RUNNERS, DOWNGRADE_MAP, DEFAULT_PROVIDER_TIERS, SMALL_SUGGESTION_LINE_LIMIT, FILE_LINE_RANGE_PATTERN, FILE_LINE_PATTERN, FILE_ONLY_PATTERN, SECURITY_SENSITIVE_PATH, MIGRATION_PATH, TEST_PATH, CONFIG_PATH, STAGE_DOMAINS, EM_DASH2, STATUS_RANK, RETRY_DEFAULTS, GitHubIssuesSyncAdapter, syncMutex, PRIORITY_RANK, PRIORITY_RANK2, POSITION_WEIGHT, DEPENDENTS_WEIGHT, AFFINITY_WEIGHT, ConflictError, DEFAULTS, GitHubHttp, ETagStore, START_MARKER, END_MARKER, SERIALIZER_FIELDS, GitHubIssuesTrackerAdapter, migrate_exports, HASH_RE, InteractionTypeSchema, QuestionSchema, ConfirmationSchema, TransitionSchema, EmitInteractionInputSchema, ProjectScanner, SHELL_TEMPLATE, STYLES, SCRIPTS, MockLLMService, llmService, ContentPipeline, BlueprintGenerator, TOKENS_PER_MILLION, fallback_default, LITELLM_PRICING_URL, CACHE_TTL_MS, STALENESS_WARNING_DAYS, MICRODOLLARS_PER_DOLLAR, TOKENS_PER_MILLION2, StructuralStrategy, DEFAULT_TOKEN_BUDGET, CHARS_PER_TOKEN, TRUNCATION_MARKER, TruncationStrategy, CompactionPipeline, STABILITY_LOOKUP, TIER_ORDER, AnthropicCacheAdapter, TIER_ORDER2, OpenAICacheAdapter, TIER_ORDER3, CACHED_CONTENT_MARKER, GeminiCacheAdapter, VERSION, POSTHOG_BATCH_URL, MAX_ATTEMPTS, TIMEOUT_MS, CompoundLockHeldError, KNOWN_CATEGORIES, ALLOWED_FIELD_KEYS, PII_TOKENS, PII_FIELD_DENYLIST, PII_LINE_RE, ALLOWED_SET, PulseAdapterAlreadyRegisteredError, REGISTRY, MOCK_ADAPTER_NAME, ALLOWED_FIELD_SET, adapter, LOOKBACK_RE, MAX_LINES, INLINE_TEMPLATE, TRUNCATION_MARKER2, execFileAsync, FIX_RE, EMPTY_REPO_RE, execFileAsync2, TRACK_CATEGORIES2, STOPWORDS, KEYWORD_TO_CATEGORY;
 var init_dist3 = __esm({
   "../core/dist/index.mjs"() {
-    init_chunk_NC4RPKD4();
+    init_chunk_4UI65RLE();
     init_dist();
+    init_dist2();
+    init_dist2();
+    init_dist2();
     init_dist();
     init_dist();
     init_dist2();
+    init_dist2();
+    init_dist2();
+    init_dist2();
     init_dist();
     init_dist();
     init_dist();
@@ -15410,6 +15617,91 @@ var init_dist3 = __esm({
     init_dist();
     init_dist();
     init_dist2();
+    WHATWG_BAD_PORTS = Object.freeze([
+      1,
+      7,
+      9,
+      11,
+      13,
+      15,
+      17,
+      19,
+      20,
+      21,
+      22,
+      23,
+      25,
+      37,
+      42,
+      43,
+      53,
+      69,
+      77,
+      79,
+      87,
+      95,
+      101,
+      102,
+      103,
+      104,
+      109,
+      110,
+      111,
+      113,
+      115,
+      117,
+      119,
+      123,
+      135,
+      137,
+      139,
+      143,
+      161,
+      179,
+      389,
+      427,
+      465,
+      512,
+      513,
+      514,
+      515,
+      526,
+      530,
+      531,
+      532,
+      540,
+      548,
+      554,
+      556,
+      563,
+      587,
+      601,
+      636,
+      989,
+      990,
+      993,
+      995,
+      1719,
+      1720,
+      1723,
+      2049,
+      3659,
+      4045,
+      4190,
+      5060,
+      5061,
+      6e3,
+      6566,
+      6665,
+      6666,
+      6667,
+      6668,
+      6669,
+      6679,
+      6697,
+      10080
+    ]);
+    BAD_PORT_SET = new Set(WHATWG_BAD_PORTS);
     VALID_TYPES = [
       "feat",
       "fix",
@@ -15724,6 +16016,32 @@ var init_dist3 = __esm({
     LINE_PATTERN = /^[ \t]*(?:\/\/|#)\s*harness-ignore(?!\s*(?:SEC-|-start|-end))(?:\s+([\w,]+))?(?::\s*(.+))?$/;
     START_PATTERN = /^[ \t]*(?:\/\/|#)\s*harness-ignore-start(?:\s+([\w,]+))?(?::\s*(.+))?$/;
     END_PATTERN = /^[ \t]*(?:\/\/|#)\s*harness-ignore-end\s*$/;
+    TS_HINTS = ['Add "exports" or "main" to package.json', "Create src/index.ts"];
+    TS_CONVENTIONS = ["src/index.ts", "src/main.ts", "src/index.tsx", "index.ts", "main.ts"];
+    PYTHON_HINTS = [
+      "Add an entry to [project.scripts] in pyproject.toml",
+      "Create main.py or <package>/__main__.py"
+    ];
+    PYTHON_CONVENTIONS = [
+      "__main__.py",
+      "main.py",
+      "app.py",
+      "src/__main__.py",
+      "src/main.py",
+      "src/app.py"
+    ];
+    DEFAULT_INCLUDE_PATTERNS = [
+      "**/*.ts",
+      "**/*.tsx",
+      "**/*.js",
+      "**/*.jsx",
+      "**/*.mjs",
+      "**/*.cjs",
+      "**/*.py",
+      "**/*.go",
+      "**/*.rs",
+      "**/*.java"
+    ];
     CODE_BLOCK_LANGUAGES = /* @__PURE__ */ new Set(["typescript", "ts", "javascript", "js"]);
     DEFAULT_DRIFT_CONFIG = {
       docPaths: [],
@@ -15762,10 +16080,7 @@ var init_dist3 = __esm({
       snapshot;
       report;
       constructor(config) {
-        this.config = {
-          ...config,
-          parser: config.parser || new TypeScriptParser()
-        };
+        this.config = { ...config };
       }
       /**
        * Run full entropy analysis.
@@ -16357,7 +16672,6 @@ var init_dist3 = __esm({
         };
       }
     };
-    SKIP_DIRS = /* @__PURE__ */ new Set(["node_modules", "dist", ".git"]);
     SOURCE_EXTENSIONS = /* @__PURE__ */ new Set([".ts", ".tsx", ".js", ".jsx"]);
     FUNCTION_DECL_RE = /(?:export\s+)?(?:async\s+)?function\s+(\w+)/;
     CONST_DECL_RE = /(?:export\s+)?(?:const|let)\s+(\w+)\s*=/;
@@ -16398,7 +16712,7 @@ var init_dist3 = __esm({
         }
         for (const item of items) {
           if (item.isDirectory()) {
-            if (SKIP_DIRS.has(item.name)) continue;
+            if (DEFAULT_SKIP_DIRS.has(item.name)) continue;
             this.walkDir(path4.join(dir, item.name), entries);
           } else if (item.isFile() && SOURCE_EXTENSIONS.has(path4.extname(item.name))) {
             this.scanFile(path4.join(dir, item.name), entries);
@@ -17878,14 +18192,14 @@ var init_dist3 = __esm({
       enabled: true,
       strict: false,
       rules: {},
-      exclude: ["**/node_modules/**", "**/dist/**", "**/*.test.ts", "**/fixtures/**"]
+      exclude: [...skipDirGlobs(), "**/*.test.ts", "**/fixtures/**"]
     };
     RuleOverrideSchema = z10.enum(["off", "error", "warning", "info"]);
     SecurityConfigSchema = z10.object({
       enabled: z10.boolean().default(true),
       strict: z10.boolean().default(false),
       rules: z10.record(z10.string(), RuleOverrideSchema).optional().default({}),
-      exclude: z10.array(z10.string()).optional().default(["**/node_modules/**", "**/dist/**", "**/*.test.ts", "**/fixtures/**"]),
+      exclude: z10.array(z10.string()).optional().default([...skipDirGlobs(), "**/*.test.ts", "**/fixtures/**"]),
       external: z10.object({
         semgrep: z10.object({
           enabled: z10.union([z10.literal("auto"), z10.boolean()]).default("auto"),
@@ -21300,6 +21614,9 @@ export {
   architecture,
   archModule,
   archMatchers,
+  WHATWG_BAD_PORTS,
+  isBadPort,
+  assertPortUsable,
   validateFileStructure,
   validateConfig,
   validateCommitMessage,