@lumenflow/cli 2.7.0 → 2.9.0

package/dist/initiative-add-wu.js

@@ -1,6 +1,4 @@
 #!/usr/bin/env node
-/* eslint-disable security/detect-non-literal-fs-filename */
-/* eslint-disable no-console -- CLI tool requires console output */
 /**
  * Initiative Add WU Command (WU-1389)
  *

package/dist/initiative-create.js

@@ -1,7 +1,4 @@
 #!/usr/bin/env node
-/* eslint-disable security/detect-non-literal-fs-filename */
-/* eslint-disable no-console -- CLI tool requires console output */
-/* eslint-disable @typescript-eslint/explicit-function-return-type -- CLI tool uses dynamic YAML types */
 /**
  * Initiative Create Helper (WU-1247, WU-1439)
  *

package/dist/initiative-edit.js

@@ -1,6 +1,4 @@
 #!/usr/bin/env node
-/* eslint-disable no-console -- CLI tool requires console output */
-/* eslint-disable @typescript-eslint/explicit-function-return-type -- CLI tool uses dynamic YAML types */
 /**
  * Initiative Edit Helper
  *
@@ -225,12 +223,10 @@ function validateCreatedDate(date) {
  */
 function loadInitiative(id) {
     const initPath = INIT_PATHS.INITIATIVE(id);
-    // eslint-disable-next-line security/detect-non-literal-fs-filename -- CLI tool validates init files
     if (!existsSync(initPath)) {
         die(`Initiative ${id} not found at ${initPath}\n\n` +
             `Ensure the Initiative exists and you're in the repo root.`);
     }
-    // eslint-disable-next-line security/detect-non-literal-fs-filename -- CLI tool validates init files
     const content = readFileSync(initPath, { encoding: FILE_SYSTEM.ENCODING });
     return parseYAML(content);
 }
@@ -428,7 +424,6 @@ async function main() {
                 // Write updated Initiative to micro-worktree
                 const initPath = join(worktreePath, INIT_PATHS.INITIATIVE(id));
                 const yamlContent = stringifyYAML(updatedInit);
-                // eslint-disable-next-line security/detect-non-literal-fs-filename -- CLI tool writes init files
                 writeFileSync(initPath, yamlContent, { encoding: FILE_SYSTEM.ENCODING });
                 console.log(`${PREFIX} Updated ${id}.yaml in micro-worktree`);
                 return {

package/dist/initiative-plan.js

@@ -1,5 +1,4 @@
 #!/usr/bin/env node
-/* eslint-disable security/detect-non-literal-fs-filename */
 /**
  * Initiative Plan Command (WU-1105, renamed in WU-1193)
  *

package/dist/initiative-remove-wu.js

@@ -1,6 +1,4 @@
 #!/usr/bin/env node
-/* eslint-disable security/detect-non-literal-fs-filename */
-/* eslint-disable no-console -- CLI tool requires console output */
 /**
  * Initiative Remove WU Command (WU-1328)
  *

package/dist/lane-health.js

@@ -301,9 +301,7 @@ export function formatLaneHealthReport(report) {
 // CLI Entry Point
 // ============================================================================
 /** Logger for CLI output */
-// eslint-disable-next-line no-console
 const log = console.log.bind(console);
-// eslint-disable-next-line no-console
 const warn = console.warn.bind(console);
 /**
  * Run lane health check

package/dist/lane-suggest.js

@@ -1,5 +1,4 @@
 #!/usr/bin/env node
-/* eslint-disable no-console */
 /**
  * lane:suggest CLI Command (WU-1189, WU-1190)
  *

package/dist/mem-checkpoint.js

@@ -76,10 +76,8 @@ async function writeAuditLog(baseDir, entry) {
     try {
         const logPath = path.join(baseDir, LUMENFLOW_PATHS.AUDIT_LOG);
         const logDir = path.dirname(logPath);
-        // eslint-disable-next-line security/detect-non-literal-fs-filename -- CLI tool creates known directory
         await fs.mkdir(logDir, { recursive: true });
         const line = `${JSON.stringify(entry)}\n`;
-        // eslint-disable-next-line security/detect-non-literal-fs-filename -- CLI tool writes audit log
         await fs.appendFile(logPath, line, 'utf-8');
     }
     catch {

package/dist/mem-cleanup.js

@@ -88,10 +88,8 @@ async function writeAuditLog(baseDir, entry) {
     try {
         const logPath = path.join(baseDir, LUMENFLOW_PATHS.AUDIT_LOG);
         const logDir = path.dirname(logPath);
-        // eslint-disable-next-line security/detect-non-literal-fs-filename -- CLI tool creates known directory
         await fs.mkdir(logDir, { recursive: true });
         const line = `${JSON.stringify(entry)}\n`;
-        // eslint-disable-next-line security/detect-non-literal-fs-filename -- CLI tool writes audit log
         await fs.appendFile(logPath, line, 'utf-8');
     }
     catch {

package/dist/mem-context.js

@@ -1,5 +1,4 @@
 #!/usr/bin/env node
-/* eslint-disable no-console -- CLI tool requires console output */
 /**
  * Memory Context CLI (WU-1234, WU-1292)
  *
@@ -96,10 +95,8 @@ async function writeAuditLog(baseDir, entry) {
     try {
         const logPath = path.join(baseDir, LUMENFLOW_PATHS.AUDIT_LOG);
         const logDir = path.dirname(logPath);
-        // eslint-disable-next-line security/detect-non-literal-fs-filename -- CLI tool creates known directory
         await fs.mkdir(logDir, { recursive: true });
         const line = `${JSON.stringify(entry)}\n`;
-        // eslint-disable-next-line security/detect-non-literal-fs-filename -- CLI tool writes audit log
         await fs.appendFile(logPath, line, 'utf-8');
     }
     catch {

package/dist/mem-create.js

@@ -83,10 +83,8 @@ async function writeAuditLog(baseDir, entry) {
     try {
         const logPath = path.join(baseDir, LUMENFLOW_PATHS.AUDIT_LOG);
         const logDir = path.dirname(logPath);
-        // eslint-disable-next-line security/detect-non-literal-fs-filename -- CLI tool creates known directory
         await fs.mkdir(logDir, { recursive: true });
         const line = `${JSON.stringify(entry)}\n`;
-        // eslint-disable-next-line security/detect-non-literal-fs-filename -- CLI tool writes audit log
         await fs.appendFile(logPath, line, 'utf-8');
     }
     catch {

package/dist/mem-delete.js

@@ -1,5 +1,4 @@
 #!/usr/bin/env node
-/* eslint-disable no-console -- CLI command uses console for status output */
 /**
  * Memory Delete CLI (WU-1284)
  *
@@ -81,10 +80,8 @@ async function writeAuditLog(baseDir, entry) {
     try {
         const logPath = path.join(baseDir, LUMENFLOW_PATHS.AUDIT_LOG);
         const logDir = path.dirname(logPath);
-        // eslint-disable-next-line security/detect-non-literal-fs-filename -- CLI tool creates known directory
         await fs.mkdir(logDir, { recursive: true });
         const line = `${JSON.stringify(entry)}\n`;
-        // eslint-disable-next-line security/detect-non-literal-fs-filename -- CLI tool writes audit log
         await fs.appendFile(logPath, line, 'utf-8');
     }
     catch {

package/dist/mem-inbox.js

@@ -77,10 +77,8 @@ async function writeAuditLog(baseDir, entry) {
     try {
         const logPath = path.join(baseDir, LUMENFLOW_PATHS.AUDIT_LOG);
         const logDir = path.dirname(logPath);
-        // eslint-disable-next-line security/detect-non-literal-fs-filename -- CLI tool creates known directory
         await fs.mkdir(logDir, { recursive: true });
         const line = `${JSON.stringify(entry)}\n`;
-        // eslint-disable-next-line security/detect-non-literal-fs-filename -- CLI tool writes audit log
         await fs.appendFile(logPath, line, 'utf-8');
     }
     catch {

package/dist/mem-index.js

@@ -1,5 +1,4 @@
 #!/usr/bin/env node
-/* eslint-disable no-console -- CLI tool requires console output */
 /**
  * Memory Index CLI (WU-1235)
  *

package/dist/mem-init.js

@@ -36,11 +36,9 @@ async function writeAuditLog(baseDir, entry) {
         const logPath = path.join(baseDir, LUMENFLOW_PATHS.AUDIT_LOG);
         const logDir = path.dirname(logPath);
         // Ensure telemetry directory exists
-        // eslint-disable-next-line security/detect-non-literal-fs-filename -- CLI tool creates known directory
         await fs.mkdir(logDir, { recursive: true });
         // Append NDJSON entry
         const line = `${JSON.stringify(entry)}\n`;
-        // eslint-disable-next-line security/detect-non-literal-fs-filename -- CLI tool writes audit log
         await fs.appendFile(logPath, line, 'utf-8');
     }
     catch {

package/dist/mem-profile.js

@@ -1,5 +1,4 @@
 #!/usr/bin/env node
-/* eslint-disable no-console -- CLI tool requires console output */
 /**
  * Memory Profile CLI (WU-1237)
  *

package/dist/mem-promote.js

@@ -1,5 +1,4 @@
 #!/usr/bin/env node
-/* eslint-disable no-console -- CLI tool requires console output */
 /**
  * Memory Promote CLI (WU-1237)
  *

package/dist/mem-ready.js

@@ -62,10 +62,8 @@ async function writeAuditLog(baseDir, entry) {
     try {
         const logPath = path.join(baseDir, LUMENFLOW_PATHS.AUDIT_LOG);
         const logDir = path.dirname(logPath);
-        // eslint-disable-next-line security/detect-non-literal-fs-filename -- CLI tool creates known directory
         await fs.mkdir(logDir, { recursive: true });
         const line = `${JSON.stringify(entry)}\n`;
-        // eslint-disable-next-line security/detect-non-literal-fs-filename -- CLI tool writes audit log
         await fs.appendFile(logPath, line, 'utf-8');
     }
     catch {

package/dist/mem-signal.js

@@ -51,10 +51,8 @@ async function writeAuditLog(baseDir, entry) {
     try {
         const logPath = path.join(baseDir, LUMENFLOW_PATHS.AUDIT_LOG);
         const logDir = path.dirname(logPath);
-        // eslint-disable-next-line security/detect-non-literal-fs-filename -- CLI tool creates known directory
         await fs.mkdir(logDir, { recursive: true });
         const line = `${JSON.stringify(entry)}\n`;
-        // eslint-disable-next-line security/detect-non-literal-fs-filename -- CLI tool writes audit log
         await fs.appendFile(logPath, line, 'utf-8');
     }
     catch {

package/dist/mem-start.js

@@ -37,11 +37,9 @@ async function writeAuditLog(baseDir, entry) {
         const logPath = path.join(baseDir, LUMENFLOW_PATHS.AUDIT_LOG);
         const logDir = path.dirname(logPath);
         // Ensure telemetry directory exists
-        // eslint-disable-next-line security/detect-non-literal-fs-filename -- CLI tool creates known directory
         await fs.mkdir(logDir, { recursive: true });
         // Append NDJSON entry
         const line = `${JSON.stringify(entry)}\n`;
-        // eslint-disable-next-line security/detect-non-literal-fs-filename -- CLI tool writes audit log
         await fs.appendFile(logPath, line, 'utf-8');
     }
     catch {

package/dist/mem-summarize.js

@@ -72,10 +72,8 @@ async function writeAuditLog(baseDir, entry) {
     try {
         const logPath = path.join(baseDir, LUMENFLOW_PATHS.AUDIT_LOG);
         const logDir = path.dirname(logPath);
-        // eslint-disable-next-line security/detect-non-literal-fs-filename -- CLI tool creates known directory
         await fs.mkdir(logDir, { recursive: true });
         const line = `${JSON.stringify(entry)}\n`;
-        // eslint-disable-next-line security/detect-non-literal-fs-filename -- CLI tool writes audit log
         await fs.appendFile(logPath, line, 'utf-8');
     }
     catch {

package/dist/metrics-cli.js

@@ -158,7 +158,7 @@ async function loadGitCommits(weekStart, weekEnd) {
             const message = entry.message;
             const wuIdMatch = message.match(/\b(WU-\d+)\b/i);
             const wuId = wuIdMatch ? wuIdMatch[1].toUpperCase() : undefined;
-            const typeMatch = message.match(/^(feat|fix|docs|chore|refactor|test|style|perf|ci)[\(:]?/i);
+            const typeMatch = message.match(/^(feat|fix|docs|chore|refactor|test|style|perf|ci)[(:]?/i);
             const type = typeMatch ? typeMatch[1].toLowerCase() : undefined;
             commits.push({
                 hash: entry.hash,

package/dist/metrics-snapshot.js

@@ -145,7 +145,7 @@ async function loadGitCommits(weekStart, weekEnd) {
             const wuIdMatch = message.match(/\b(WU-\d+)\b/i);
             const wuId = wuIdMatch ? wuIdMatch[1].toUpperCase() : undefined;
             // Determine commit type from conventional commit prefix
-            const typeMatch = message.match(/^(feat|fix|docs|chore|refactor|test|style|perf|ci)[\(:]?/i);
+            const typeMatch = message.match(/^(feat|fix|docs|chore|refactor|test|style|perf|ci)[(:]?/i);
             const type = typeMatch ? typeMatch[1].toLowerCase() : undefined;
             commits.push({
                 hash: entry.hash,

package/dist/onboarding-smoke-test.js

@@ -174,22 +174,17 @@ export function validateLaneInferenceFormat(options) {
  * Initialize a git repository in the given directory
  */
 function initializeGitRepo(projectDir) {
-    // eslint-disable-next-line sonarjs/no-os-command-from-path -- Git binary from PATH is acceptable for smoke tests
     execFileSync(GIT_BINARY, ['init'], { cwd: projectDir, stdio: 'pipe' });
-    // eslint-disable-next-line sonarjs/no-os-command-from-path -- Git binary from PATH is acceptable for smoke tests
     execFileSync(GIT_BINARY, ['config', 'user.email', 'test@example.com'], {
         cwd: projectDir,
         stdio: 'pipe',
     });
-    // eslint-disable-next-line sonarjs/no-os-command-from-path -- Git binary from PATH is acceptable for smoke tests
     execFileSync(GIT_BINARY, ['config', 'user.name', 'Test User'], {
         cwd: projectDir,
         stdio: 'pipe',
     });
     // Create initial commit
-    // eslint-disable-next-line sonarjs/no-os-command-from-path -- Git binary from PATH is acceptable for smoke tests
     execFileSync(GIT_BINARY, ['add', '-A'], { cwd: projectDir, stdio: 'pipe' });
-    // eslint-disable-next-line sonarjs/no-os-command-from-path -- Git binary from PATH is acceptable for smoke tests
     execFileSync(GIT_BINARY, ['commit', '-m', 'Initial commit', '--allow-empty'], {
         cwd: projectDir,
         stdio: 'pipe',

package/dist/orchestrate-init-status.js

@@ -1,5 +1,4 @@
 #!/usr/bin/env node
-/* eslint-disable no-console -- CLI tool requires console output */
 /**
  * Orchestrate Initiative Status CLI
  *

package/dist/orchestrate-initiative.js

@@ -1,5 +1,4 @@
 #!/usr/bin/env node
-/* eslint-disable no-console -- CLI tool requires console output */
 /**
  * Orchestrate Initiative CLI
  *

package/dist/orchestrate-monitor.js

@@ -1,5 +1,4 @@
 #!/usr/bin/env node
-/* eslint-disable no-console -- CLI tool requires console output */
 /**
  * Orchestrate Monitor CLI (WU-1241)
  *

package/dist/plan-create.js

@@ -1,6 +1,4 @@
 #!/usr/bin/env node
-/* eslint-disable no-console -- CLI tool requires console output */
-/* eslint-disable security/detect-non-literal-fs-filename */
 /**
  * Plan Create Command (WU-1313)
  *

package/dist/plan-edit.js

@@ -1,6 +1,4 @@
 #!/usr/bin/env node
-/* eslint-disable no-console -- CLI tool requires console output */
-/* eslint-disable security/detect-non-literal-fs-filename */
 /**
  * Plan Edit Command (WU-1313)
  *

package/dist/plan-link.js

@@ -1,6 +1,4 @@
 #!/usr/bin/env node
-/* eslint-disable no-console -- CLI tool requires console output */
-/* eslint-disable security/detect-non-literal-fs-filename */
 /**
  * Plan Link Command (WU-1313)
  *

package/dist/plan-promote.js

@@ -1,6 +1,4 @@
 #!/usr/bin/env node
-/* eslint-disable no-console -- CLI tool requires console output */
-/* eslint-disable security/detect-non-literal-fs-filename */
 /**
  * Plan Promote Command (WU-1313)
  *

package/dist/signal-cleanup.js

@@ -1,5 +1,4 @@
 #!/usr/bin/env node
-/* eslint-disable no-console -- CLI tool requires console output */
 /**
  * Signal Cleanup CLI (WU-1204)
  *
@@ -94,10 +93,8 @@ async function writeAuditLog(baseDir, entry) {
     try {
         const logPath = path.join(baseDir, LUMENFLOW_PATHS.AUDIT_LOG);
         const logDir = path.dirname(logPath);
-        // eslint-disable-next-line security/detect-non-literal-fs-filename -- CLI tool creates known directory
         await fs.mkdir(logDir, { recursive: true });
         const line = `${JSON.stringify(entry)}\n`;
-        // eslint-disable-next-line security/detect-non-literal-fs-filename -- CLI tool writes audit log
         await fs.appendFile(logPath, line, 'utf-8');
     }
     catch {
@@ -142,7 +139,6 @@ async function getActiveWuIds(baseDir) {
         for (const file of wuFiles) {
             try {
                 const filePath = path.join(wuDir, file);
-                // eslint-disable-next-line security/detect-non-literal-fs-filename -- CLI tool reads known path
                 const content = await fs.readFile(filePath, 'utf-8');
                 const wu = parseYaml(content);
                 if (wu.id && wu.status && ACTIVE_WU_STATUSES.includes(wu.status)) {

package/dist/state-bootstrap.js

@@ -17,7 +17,6 @@ import { parse as parseYaml } from 'yaml';
 import { readFileSync } from 'node:fs';
 import { WU_PATHS } from '@lumenflow/core/dist/wu-paths.js';
 import { CLI_FLAGS, EXIT_CODES, EMOJI, STRING_LITERALS, } from '@lumenflow/core/dist/wu-constants.js';
-/* eslint-disable security/detect-non-literal-fs-filename */
 /** Log prefix for consistent output */
 const LOG_PREFIX = '[state-bootstrap]';
 /**

package/dist/state-cleanup.js

@@ -1,5 +1,4 @@
 #!/usr/bin/env node
-/* eslint-disable no-console -- CLI tool requires console output */
 /**
  * Unified State Cleanup CLI (WU-1208)
  *
@@ -111,10 +110,8 @@ async function writeAuditLog(baseDir, entry) {
     try {
         const logPath = path.join(baseDir, LUMENFLOW_PATHS.AUDIT_LOG);
         const logDir = path.dirname(logPath);
-        // eslint-disable-next-line security/detect-non-literal-fs-filename -- CLI tool creates known directory
         await fs.mkdir(logDir, { recursive: true });
         const line = `${JSON.stringify(entry)}\n`;
-        // eslint-disable-next-line security/detect-non-literal-fs-filename -- CLI tool writes audit log
         await fs.appendFile(logPath, line, 'utf-8');
     }
     catch {
@@ -150,7 +147,6 @@ async function getActiveWuIds(baseDir) {
         for (const file of wuFiles) {
             try {
                 const filePath = path.join(wuDir, file);
-                // eslint-disable-next-line security/detect-non-literal-fs-filename -- CLI tool reads known path
                 const content = await fs.readFile(filePath, 'utf-8');
                 const wu = parseYaml(content);
                 if (wu.id && wu.status && ACTIVE_WU_STATUSES.includes(wu.status)) {

package/dist/state-doctor-fix.js

@@ -7,9 +7,13 @@
  * 1. No direct file modifications on main branch
  * 2. Removal of stale WU references from backlog.md and status.md
  * 3. All changes pushed via merge, not direct file modification
+ * 4. WU-1362: Retry logic for push failures (inherited from withMicroWorktree)
+ *
+ * Retry behavior is configured via .lumenflow.config.yaml git.push_retry section.
+ * Default: 3 retries with exponential backoff and jitter.
  *
  * @see {@link ./state-doctor.ts} - Main CLI that uses these deps
- * @see {@link @lumenflow/core/dist/micro-worktree.js} - Micro-worktree infrastructure
+ * @see {@link @lumenflow/core/dist/micro-worktree.js} - Micro-worktree infrastructure with retry logic
  */
 import fs from 'node:fs/promises';
 import path from 'node:path';
@@ -56,7 +60,6 @@ function removeWuReferences(content, wuId) {
  */
 async function readFileSafe(filePath) {
     try {
-        // eslint-disable-next-line security/detect-non-literal-fs-filename -- Validated path from config
         return await fs.readFile(filePath, 'utf-8');
     }
     catch {
@@ -100,7 +103,6 @@ export function createStateDoctorFixDeps(_baseDir) {
                             return true; // Keep malformed lines
                         }
                     });
-                    // eslint-disable-next-line security/detect-non-literal-fs-filename -- Validated path
                     await fs.writeFile(signalsPath, lines.join('\n') + '\n', 'utf-8');
                     return {
                         commitMessage: `fix(state-doctor): remove dangling signal ${id}`,
@@ -139,7 +141,6 @@ export function createStateDoctorFixDeps(_baseDir) {
                                 return true; // Keep malformed lines
                             }
                         });
-                        // eslint-disable-next-line security/detect-non-literal-fs-filename -- Validated path
                         await fs.writeFile(eventsPath, lines.join('\n') + '\n', 'utf-8');
                         modifiedFiles.push(WU_EVENTS_FILE);
                     }
@@ -148,7 +149,6 @@ export function createStateDoctorFixDeps(_baseDir) {
                     const backlogContent = await readFileSafe(backlogPath);
                     if (backlogContent && backlogContent.includes(wuId)) {
                         const updatedBacklog = removeWuReferences(backlogContent, wuId);
-                        // eslint-disable-next-line security/detect-non-literal-fs-filename -- Validated path
                         await fs.writeFile(backlogPath, updatedBacklog, 'utf-8');
                         modifiedFiles.push(BACKLOG_FILE);
                     }
@@ -157,7 +157,6 @@ export function createStateDoctorFixDeps(_baseDir) {
                     const statusContent = await readFileSafe(statusPath);
                     if (statusContent && statusContent.includes(wuId)) {
                         const updatedStatus = removeWuReferences(statusContent, wuId);
-                        // eslint-disable-next-line security/detect-non-literal-fs-filename -- Validated path
                         await fs.writeFile(statusPath, updatedStatus, 'utf-8');
                         modifiedFiles.push(STATUS_FILE);
                     }
@@ -179,12 +178,10 @@ export function createStateDoctorFixDeps(_baseDir) {
                 pushOnly: true,
                 execute: async ({ worktreePath }) => {
                     const stampsDir = path.join(worktreePath, '.lumenflow/stamps');
-                    // eslint-disable-next-line security/detect-non-literal-fs-filename -- CLI tool creates known directory
                     await fs.mkdir(stampsDir, { recursive: true });
                     // Create stamp file in micro-worktree
                     const stampPath = path.join(stampsDir, `${wuId}.done`);
                     const stampContent = `# ${wuId} Done\n\nTitle: ${title}\nCreated by: state:doctor --fix\nTimestamp: ${new Date().toISOString()}\n`;
-                    // eslint-disable-next-line security/detect-non-literal-fs-filename -- Validated path
                     await fs.writeFile(stampPath, stampContent, 'utf-8');
                     return {
                         commitMessage: `fix(state-doctor): create missing stamp for ${wuId}`,

package/dist/state-doctor.js

@@ -1,5 +1,4 @@
 #!/usr/bin/env node
-/* eslint-disable no-console -- CLI tool requires console output */
 /**
  * State Doctor CLI (WU-1209)
  *
@@ -101,10 +100,8 @@ async function writeAuditLog(baseDir, entry) {
     try {
         const logPath = path.join(baseDir, LUMENFLOW_PATHS.AUDIT_LOG);
         const logDir = path.dirname(logPath);
-        // eslint-disable-next-line security/detect-non-literal-fs-filename -- CLI tool creates known directory
         await fs.mkdir(logDir, { recursive: true });
         const line = `${JSON.stringify(entry)}\n`;
-        // eslint-disable-next-line security/detect-non-literal-fs-filename -- CLI tool writes audit log
         await fs.appendFile(logPath, line, 'utf-8');
     }
     catch {
@@ -146,7 +143,6 @@ async function createDeps(baseDir) {
                 for (const file of wuFiles) {
                     try {
                         const filePath = path.join(wuDir, file);
-                        // eslint-disable-next-line security/detect-non-literal-fs-filename -- CLI tool reads known path
                         const content = await fs.readFile(filePath, 'utf-8');
                         const wu = parseYaml(content);
                         if (wu.id && wu.status) {
@@ -189,7 +185,6 @@ async function createDeps(baseDir) {
         listSignals: async () => {
             try {
                 const signalsPath = path.join(baseDir, SIGNALS_FILE);
-                // eslint-disable-next-line security/detect-non-literal-fs-filename -- CLI tool reads known path
                 const content = await fs.readFile(signalsPath, 'utf-8');
                 const signals = [];
                 for (const line of content.split('\n')) {
@@ -223,7 +218,6 @@ async function createDeps(baseDir) {
         listEvents: async () => {
             try {
                 const eventsPath = path.join(baseDir, WU_EVENTS_FILE);
-                // eslint-disable-next-line security/detect-non-literal-fs-filename -- CLI tool reads known path
                 const content = await fs.readFile(eventsPath, 'utf-8');
                 const events = [];
                 for (const line of content.split('\n')) {
@@ -255,7 +249,6 @@ async function createDeps(baseDir) {
          */
         removeSignal: async (id) => {
             const signalsPath = path.join(baseDir, SIGNALS_FILE);
-            // eslint-disable-next-line security/detect-non-literal-fs-filename -- CLI tool reads known path
             const content = await fs.readFile(signalsPath, 'utf-8');
             const lines = content.split('\n').filter((line) => {
                 if (!line.trim())
@@ -268,7 +261,6 @@ async function createDeps(baseDir) {
                     return true; // Keep malformed lines
                 }
             });
-            // eslint-disable-next-line security/detect-non-literal-fs-filename -- CLI tool writes known path
             await fs.writeFile(signalsPath, lines.join('\n') + '\n', 'utf-8');
         },
         /**
@@ -276,7 +268,6 @@ async function createDeps(baseDir) {
          */
         removeEvent: async (wuId) => {
             const eventsPath = path.join(baseDir, WU_EVENTS_FILE);
-            // eslint-disable-next-line security/detect-non-literal-fs-filename -- CLI tool reads known path
             const content = await fs.readFile(eventsPath, 'utf-8');
             const lines = content.split('\n').filter((line) => {
                 if (!line.trim())
@@ -289,7 +280,6 @@ async function createDeps(baseDir) {
                     return true; // Keep malformed lines
                 }
             });
-            // eslint-disable-next-line security/detect-non-literal-fs-filename -- CLI tool writes known path
             await fs.writeFile(eventsPath, lines.join('\n') + '\n', 'utf-8');
         },
         /**
@@ -297,7 +287,6 @@ async function createDeps(baseDir) {
          */
         createStamp: async (wuId, title) => {
             const stampsDir = path.join(baseDir, LUMENFLOW_PATHS.STAMPS_DIR);
-            // eslint-disable-next-line security/detect-non-literal-fs-filename -- CLI tool creates known directory
             await fs.mkdir(stampsDir, { recursive: true });
             await createStamp({
                 id: wuId,