@methiu/raigal 0.16.2

package/dist/mount-zBL9B_lE.js

@@ -0,0 +1,18 @@
+#!/usr/bin/env node
+//#region src/ui/agent-tui/mount.ts
+const mountAgentTui = async (store) => {
+	const [{ render }, React, { AgentApp }] = await Promise.all([
+		import("ink"),
+		import("react"),
+		import("./AgentApp-DxfJZJXy.js")
+	]);
+	process.stdout.write("\x1B[?1049h\x1B[?25l");
+	const instance = render(React.createElement(AgentApp, { store }), { exitOnCtrlC: false });
+	return { close: async () => {
+		instance.unmount();
+		await instance.waitUntilExit();
+		process.stdout.write("\x1B[?25h\x1B[?1049l");
+	} };
+};
+//#endregion
+export { mountAgentTui };

package/dist/sarif-B-l1Fhzd.js

@@ -0,0 +1,66 @@
+#!/usr/bin/env node
+import { a as FIXED_SECRET_DIAGNOSTIC_MESSAGE, i as APP_VERSION, o as isSecretClassRule } from "./cli.js";
+import path from "node:path";
+//#region src/output/sarif.ts
+const SARIF_VERSION = "2.1.0";
+const SARIF_SCHEMA = "https://raw.githubusercontent.com/oasis-tcs/sarif-spec/master/Schemata/sarif-schema-2.1.0.json";
+const levelFromSeverity = (severity) => {
+	if (severity === "error") return "error";
+	if (severity === "warning") return "warning";
+	return "note";
+};
+const oneBased = (value) => value >= 1 ? value : 1;
+const toUri = (filePath) => filePath.split(path.sep).join("/");
+const buildRules = (diagnostics) => {
+	const byId = /* @__PURE__ */ new Map();
+	for (const d of diagnostics) {
+		if (byId.has(d.rule)) continue;
+		const isSecret = d.redactSource || isSecretClassRule(d.rule);
+		const desc = isSecret ? FIXED_SECRET_DIAGNOSTIC_MESSAGE : d.message;
+		const helpText = isSecret ? "Rotate it and load it from the environment." : d.help || d.message;
+		byId.set(d.rule, {
+			id: d.rule,
+			name: d.rule,
+			shortDescription: { text: desc },
+			help: { text: helpText }
+		});
+	}
+	return [...byId.values()];
+};
+const buildSarifLog = (results) => {
+	const diagnostics = results.flatMap((r) => r.diagnostics);
+	const rules = buildRules(diagnostics);
+	const ruleIndex = new Map(rules.map((rule, index) => [rule.id, index]));
+	const sarifResults = diagnostics.map((d) => {
+		const isSecret = d.redactSource || isSecretClassRule(d.rule);
+		return {
+			ruleId: d.rule,
+			ruleIndex: ruleIndex.get(d.rule) ?? 0,
+			level: levelFromSeverity(d.severity),
+			message: { text: isSecret ? FIXED_SECRET_DIAGNOSTIC_MESSAGE : d.message },
+			locations: [{ physicalLocation: {
+				artifactLocation: { uri: toUri(d.filePath) },
+				region: {
+					startLine: oneBased(d.line),
+					startColumn: isSecret ? 1 : oneBased(d.column)
+				}
+			} }],
+			...d.changeContext ? { properties: { changeContext: d.changeContext } } : {}
+		};
+	});
+	return {
+		$schema: SARIF_SCHEMA,
+		version: SARIF_VERSION,
+		runs: [{
+			tool: { driver: {
+				name: "aislop",
+				version: APP_VERSION,
+				informationUri: "https://github.com/meethiu/raigal",
+				rules
+			} },
+			results: sarifResults
+		}]
+	};
+};
+//#endregion
+export { buildSarifLog };

package/dist/sarif-B5s74n0Q.js

@@ -0,0 +1,66 @@
+import { t as APP_VERSION } from "./version-CVfOxP_O.js";
+import { n as isSecretClassRule, t as FIXED_SECRET_DIAGNOSTIC_MESSAGE } from "./mask-secrets-BXn-ZSEh.js";
+import path from "node:path";
+//#region src/output/sarif.ts
+const SARIF_VERSION = "2.1.0";
+const SARIF_SCHEMA = "https://raw.githubusercontent.com/oasis-tcs/sarif-spec/master/Schemata/sarif-schema-2.1.0.json";
+const levelFromSeverity = (severity) => {
+	if (severity === "error") return "error";
+	if (severity === "warning") return "warning";
+	return "note";
+};
+const oneBased = (value) => value >= 1 ? value : 1;
+const toUri = (filePath) => filePath.split(path.sep).join("/");
+const buildRules = (diagnostics) => {
+	const byId = /* @__PURE__ */ new Map();
+	for (const d of diagnostics) {
+		if (byId.has(d.rule)) continue;
+		const isSecret = d.redactSource || isSecretClassRule(d.rule);
+		const desc = isSecret ? FIXED_SECRET_DIAGNOSTIC_MESSAGE : d.message;
+		const helpText = isSecret ? "Rotate it and load it from the environment." : d.help || d.message;
+		byId.set(d.rule, {
+			id: d.rule,
+			name: d.rule,
+			shortDescription: { text: desc },
+			help: { text: helpText }
+		});
+	}
+	return [...byId.values()];
+};
+const buildSarifLog = (results) => {
+	const diagnostics = results.flatMap((r) => r.diagnostics);
+	const rules = buildRules(diagnostics);
+	const ruleIndex = new Map(rules.map((rule, index) => [rule.id, index]));
+	const sarifResults = diagnostics.map((d) => {
+		const isSecret = d.redactSource || isSecretClassRule(d.rule);
+		return {
+			ruleId: d.rule,
+			ruleIndex: ruleIndex.get(d.rule) ?? 0,
+			level: levelFromSeverity(d.severity),
+			message: { text: isSecret ? FIXED_SECRET_DIAGNOSTIC_MESSAGE : d.message },
+			locations: [{ physicalLocation: {
+				artifactLocation: { uri: toUri(d.filePath) },
+				region: {
+					startLine: oneBased(d.line),
+					startColumn: isSecret ? 1 : oneBased(d.column)
+				}
+			} }],
+			...d.changeContext ? { properties: { changeContext: d.changeContext } } : {}
+		};
+	});
+	return {
+		$schema: SARIF_SCHEMA,
+		version: SARIF_VERSION,
+		runs: [{
+			tool: { driver: {
+				name: "aislop",
+				version: APP_VERSION,
+				informationUri: "https://github.com/meethiu/raigal",
+				rules
+			} },
+			results: sarifResults
+		}]
+	};
+};
+//#endregion
+export { buildSarifLog };

package/dist/version-CVfOxP_O.js

@@ -0,0 +1,6 @@
+import "node:fs";
+import "node:url";
+//#region src/version.ts
+const APP_VERSION = "0.16.1";
+//#endregion
+export { APP_VERSION as t };

package/package.json

@@ -0,0 +1,129 @@
+{
+	"name": "@methiu/raigal",
+	"version": "0.16.2",
+	"publishConfig": {
+		"access": "public"
+	},
+	"description": "Catch the slop AI coding agents leave in your code: narrative comments, swallowed exceptions, as-any casts, dead code, oversized functions. 50+ rules across 10 language targets (TypeScript, JavaScript, Expo / React Native, Python, Go, Rust, Ruby, PHP, C#, C/C++). Sub-second, deterministic, no LLM at runtime.",
+	"type": "module",
+	"bin": {
+		"raigal": "dist/cli.js",
+		"raigal-mcp": "dist/mcp.js",
+		"raigal-tools": "scripts/install-tools.mjs"
+	},
+	"files": [
+		"dist",
+		"scripts",
+		"tools/jb"
+	],
+	"exports": {
+		".": {
+			"types": "./dist/index.d.ts",
+			"default": "./dist/index.js"
+		},
+		"./adapters/astro": {
+			"types": "./dist/adapters/astro.d.ts",
+			"default": "./dist/adapters/astro.js"
+		},
+		"./adapters/expo": {
+			"types": "./dist/adapters/expo.d.ts",
+			"default": "./dist/adapters/expo.js"
+		},
+		"./adapters/nuxt": {
+			"types": "./dist/adapters/nuxt.d.ts",
+			"default": "./dist/adapters/nuxt.js"
+		},
+		"./adapters/sveltekit": {
+			"types": "./dist/adapters/sveltekit.d.ts",
+			"default": "./dist/adapters/sveltekit.js"
+		},
+		"./adapters/vite": {
+			"types": "./dist/adapters/vite.d.ts",
+			"default": "./dist/adapters/vite.js"
+		}
+	},
+	"scripts": {
+		"dev": "tsdown --watch",
+		"build": "node --require ./scripts/polyfill.cjs ./node_modules/tsdown/dist/run.mjs",
+		"typecheck": "tsc --noEmit",
+		"gen:schema": "pnpm build && node scripts/gen-config-schema.mjs",
+		"test": "pnpm build && vitest run",
+		"scan": "pnpm build && node dist/cli.js scan .",
+		"scan:exclude": "pnpm build && node dist/cli.js scan . --exclude .idea --exclude .gitnore --exclude node_modules",
+		"scan:include": "pnpm build && node dist/cli.js scan . --include src --include tests",
+		"scan:json": "pnpm build && node dist/cli.js scan . --json",
+		"check:licenses": "node scripts/check-licenses.mjs",
+		"check:tarball-keys": "node scripts/check-tarball-keys.mjs",
+		"release:guard": "node scripts/release-guard.mjs",
+		"quality": "pnpm typecheck && pnpm test && node scripts/check-tarball-keys.mjs && node dist/cli.js scan . --json"
+	},
+	"keywords": [
+		"raigal",
+		"ai-slop",
+		"code-quality",
+		"linter",
+		"formatter",
+		"cli",
+		"ai",
+		"copilot",
+		"code-review",
+		"static-analysis",
+		"typescript",
+		"javascript",
+		"python",
+		"go",
+		"rust",
+		"ruby",
+		"php",
+		"csharp",
+		"dotnet",
+		"cpp"
+	],
+	"author": {
+		"name": "Kenny Olawuwo",
+		"url": "https://raigal.dev"
+	},
+	"license": "SEE LICENSE IN LICENSE",
+	"homepage": "https://raigal.dev",
+	"repository": {
+		"type": "git",
+		"url": "git+https://github.com/meethiu/raigal.git"
+	},
+	"bugs": {
+		"url": "https://github.com/meethiu/raigal/issues"
+	},
+	"engines": {
+		"node": ">=20"
+	},
+	"packageManager": "pnpm@10.28.0",
+	"dependencies": {
+		"@biomejs/biome": "^2.5.12",
+		"@clack/prompts": "^1.7.0",
+		"@modelcontextprotocol/sdk": "^1.30.0",
+		"adm-zip": "^0.6.1",
+		"commander": "^14.0.3",
+		"expo-doctor": "^1.20.4",
+		"ink": "^7.1.1",
+		"ink-select-input": "^6.2.0",
+		"knip": "^6.34.0",
+		"micromatch": "^4.0.8",
+		"oxlint": "^1.81.0",
+		"picocolors": "^1.1.1",
+		"react": "^19.2.8",
+		"smol-toml": "^1.8.0",
+		"tar": "^7.5.22",
+		"typescript": "^6.0.3",
+		"wcwidth": "^1.0.1",
+		"yaml": "^2.9.0",
+		"zod": "^4.4.3"
+	},
+	"devDependencies": {
+		"@types/micromatch": "^4.0.10",
+		"@types/node": "^26.4.0",
+		"@types/react": "^19.2.18",
+		"ink-testing-library": "^4.0.0",
+		"tsdown": "^0.22.14",
+		"vite": "^8.2.2",
+		"vitest": "^4.1.11"
+	}
+}

package/scripts/check-licenses.mjs

@@ -0,0 +1,45 @@
+#!/usr/bin/env node
+import fs from "node:fs";
+import path from "node:path";
+import { fileURLToPath } from "node:url";
+
+const __dirname = path.dirname(fileURLToPath(import.meta.url));
+const ROOT = path.resolve(__dirname, "..");
+const PKG_PATH = path.join(ROOT, "package.json");
+const NODE_MODULES = path.join(ROOT, "node_modules");
+
+const FORBIDDEN_LICENSES = [/GPL/i, /AGPL/i, /SSPL/i];
+
+const pkg = JSON.parse(fs.readFileSync(PKG_PATH, "utf-8"));
+const dependencies = Object.keys(pkg.dependencies || {});
+
+const violations = [];
+
+for (const dep of dependencies) {
+	const depPkgPath = path.join(NODE_MODULES, dep, "package.json");
+	if (!fs.existsSync(depPkgPath)) {
+		continue;
+	}
+	try {
+		const depPkg = JSON.parse(fs.readFileSync(depPkgPath, "utf-8"));
+		const license = depPkg.license || (Array.isArray(depPkg.licenses) ? depPkg.licenses.map((l) => l.type || l).join(", ") : "");
+		for (const regex of FORBIDDEN_LICENSES) {
+			if (typeof license === "string" && regex.test(license)) {
+				violations.push({ dep, license });
+			}
+		}
+	} catch {
+		console.warn(`Warning: Could not parse package.json for ${dep}`);
+	}
+}
+
+if (violations.length > 0) {
+	console.error("Dependency license audit FAILED: GPL/AGPL packages detected in dependencies:");
+	for (const v of violations) {
+		console.error(`  - ${v.dep}: ${v.license}`);
+	}
+	process.exit(1);
+}
+
+console.log(`Dependency license audit PASSED (${dependencies.length} production dependencies verified).`);
+process.exit(0);

package/scripts/check-tarball-keys.mjs

@@ -0,0 +1,106 @@
+#!/usr/bin/env node
+import { execSync } from "node:child_process";
+import fs from "node:fs";
+import os from "node:os";
+import path from "node:path";
+
+// Allowed PostHog project API keys (empty by default; unauthorized keys fail the build).
+const ALLOWED_KEYS = new Set([]);
+
+// Break literal pattern to prevent detector self-matching
+const PH_KEY_PREFIX = `${"p" + "h" + "c"}_`;
+const PH_KEY_PATTERN = new RegExp(`${PH_KEY_PREFIX}[A-Za-z0-9_-]{20,}`, "g");
+
+const ROOT_DIR = path.resolve(import.meta.dirname, "..");
+
+const walkDirectory = (dir, callback) => {
+	const entries = fs.readdirSync(dir, { withFileTypes: true });
+	for (const entry of entries) {
+		const fullPath = path.join(dir, entry.name);
+		if (entry.isDirectory()) {
+			walkDirectory(fullPath, callback);
+		} else if (entry.isFile()) {
+			callback(fullPath);
+		}
+	}
+};
+
+let tarballPath = null;
+let extractDir = null;
+
+try {
+	// 1. Pack the package tarball
+	const packOutput = execSync("npm pack", {
+		cwd: ROOT_DIR,
+		encoding: "utf-8",
+		stdio: ["ignore", "pipe", "pipe"],
+	}).trim();
+
+	const lines = packOutput.split("\n");
+	const tarballName = lines[lines.length - 1]?.trim();
+	if (!tarballName || !tarballName.endsWith(".tgz")) {
+		throw new Error(`Unexpected npm pack output: "${packOutput}"`);
+	}
+
+	tarballPath = path.join(ROOT_DIR, tarballName);
+	if (!fs.existsSync(tarballPath)) {
+		throw new Error(`Packed tarball not found at ${tarballPath}`);
+	}
+
+	// 2. Extract into a temporary directory
+	extractDir = fs.mkdtempSync(path.join(os.tmpdir(), "raigal-tarball-"));
+	execSync(`tar -xzf "${tarballPath}" -C "${extractDir}"`, {
+		stdio: "ignore",
+	});
+
+	const packageDir = path.join(extractDir, "package");
+	if (!fs.existsSync(packageDir)) {
+		throw new Error(`Extracted package directory not found at ${packageDir}`);
+	}
+
+	// 3. Scan all extracted files for unapproved PostHog keys
+	const unauthorizedKeys = [];
+
+	walkDirectory(packageDir, (filePath) => {
+		// Only check text / script / metadata files
+		try {
+			const content = fs.readFileSync(filePath, "utf-8");
+			const matches = content.match(PH_KEY_PATTERN);
+			if (matches) {
+				for (const match of matches) {
+					if (!ALLOWED_KEYS.has(match)) {
+						const relPath = path.relative(packageDir, filePath);
+						unauthorizedKeys.push({ key: match, file: relPath });
+					}
+				}
+			}
+		} catch {
+			// Skip binary files that cannot be decoded as utf-8
+		}
+	});
+
+	if (unauthorizedKeys.length > 0) {
+		console.error("Tarball PostHog key check FAILED: Unauthorized keys found in package:");
+		for (const item of unauthorizedKeys) {
+			console.error(`  - Key "${item.key}" in file "${item.file}"`);
+		}
+		process.exit(1);
+	}
+
+	console.log("Tarball key check passed: No unauthorized PostHog keys found in package.");
+	process.exit(0);
+} catch (err) {
+	console.error(`Tarball key check error: ${err instanceof Error ? err.message : String(err)}`);
+	process.exit(1);
+} finally {
+	if (tarballPath && fs.existsSync(tarballPath)) {
+		try {
+			fs.rmSync(tarballPath, { force: true });
+		} catch {}
+	}
+	if (extractDir && fs.existsSync(extractDir)) {
+		try {
+			fs.rmSync(extractDir, { recursive: true, force: true });
+		} catch {}
+	}
+}

package/scripts/gen-config-schema.mjs

@@ -0,0 +1,35 @@
+#!/usr/bin/env node
+import { writeFileSync } from "node:fs";
+import { dirname, resolve } from "node:path";
+import { fileURLToPath } from "node:url";
+import { z } from "zod/v4";
+import { AislopConfigSchema } from "../dist/index.js";
+
+const here = dirname(fileURLToPath(import.meta.url));
+const outPath = resolve(here, "..", "schema", "raigal.config.schema.json");
+
+// Strip `required`/`additionalProperties:false` so partial user configs (every
+// key has a default) validate, and allow the loader-handled `extends` key.
+const relax = (node) => {
+	if (!node || typeof node !== "object") return;
+	if (Array.isArray(node)) {
+		for (const item of node) relax(item);
+		return;
+	}
+	delete node.required;
+	if (node.additionalProperties === false) delete node.additionalProperties;
+	for (const value of Object.values(node)) relax(value);
+};
+
+const jsonSchema = z.toJSONSchema(AislopConfigSchema, { target: "draft-2020-12" });
+relax(jsonSchema);
+jsonSchema.$id = "https://raigal.dev/schema/raigal.config.schema.json";
+jsonSchema.title = "raigal configuration (.raigal/config.yml)";
+jsonSchema.description = "Configuration schema for the raigal code-quality CLI.";
+jsonSchema.properties.extends = {
+	type: "string",
+	description: "Path to a parent .raigal config to extend.",
+};
+
+writeFileSync(outPath, `${JSON.stringify(jsonSchema, null, "\t")}\n`);
+process.stdout.write(`Wrote ${outPath}\n`);